A step's tool set no longer empties when the step is cancelled. The shared
pipeline already settles unstarted calls as cancelled; keeping admission lets
those calls keep their finalizers, and a wrapper result completed at
cancellation now reports cancellation instead of UNKNOWN_TOOL.
exit_plan_mode checks for a missing Agent explicitly instead of asserting it.
Document the activation types on the tools subsystem page, the turn/end code
for a failed tool condition, the replacement and no-set consequences in the
upgrade guide, and the admission rule in the parallel tool-call note.
The tool executor merge added ToolBatchInput.toolSet; the subsystem page's type-equivalence block now matches it. The architecture turn-flow line names step-admitted tool schemas in one line so the page stays within its word budget.
The default per-image limit is 50 MiB and the default per-side limit is
65,535 pixels, but the admission summaries in the attachment subsystem
page and the attachment-local README still named 20 MiB and 8192 pixels.
The session-controller note on the /api/file byte limit and the tool-fs
note on read_image source caps also named the old 20 MiB maxImageBytes
default.
Disclose the exit tool progressively instead of following every plan-mode
transition. The plan projection records whether a logged plan/mode ever
activated plan mode (stateVersion 4), and the tool's condition admits it
for a step whose selected state is active or once the Session has entered
plan mode. Leaving plan mode now changes only the guidance section, so an
addition-only route no longer drops a declaration from its cached prefix.
A call while plan mode is not committed still fails as unavailable outside
plan mode, and a Session that never entered plan mode does not list the
tool. The Web plan-review fixtures return to master's recording because the
request tool lists no longer change on exit.
Integrate exact origin/master b9bdd062c8ffd3dc234ebea7f5dff55ff26d87ad. Preserve the Session Markdown copy lifecycle and dictionary while adopting the Japanese locale, regenerate the client slot catalog, and add the Japanese quote-removal string required by the merged locale type.
Normalization already downscales long sides, so the default per-side
limit rises from 8192px to 65,535px, the largest side a JPEG carries,
and the decoded-pixel limit alone bounds admission. The default
per-image limit rises from 20 MiB to 50 MiB.
Address the review of this pull request:
- A failed image upload keeps the Host's attachment refusal reason. The
thumbnail of a refused image names the reason instead of offering a
retry that cannot succeed, and Enter while uploads hold the send names
the first failure; a transport failure still offers retry, and an
image without a file name uses the pending-image label.
- An image upload stops reading at the smaller of the per-image and
per-message byte limits.
- A carried image draft moving to a Session that sends images inline
drops its upload instead of staging it again.
- The image upload ready state no longer carries an unread image ref.
- Docs describe stored-image admission and the command image path, and
the attachment rail test builds typed props instead of casting through
unknown.
zhc