diff --git a/build/installer.nsh b/build/installer.nsh
index 185964316..5da7ba55f 100644
--- a/build/installer.nsh
+++ b/build/installer.nsh
@@ -17,6 +17,7 @@ Var /GLOBAL KunInstallerPreserveOtherScope
 Var /GLOBAL KunInstallerOtherUninstallString
 Var /GLOBAL KunInstallerOtherQuietUninstallString
 Var /GLOBAL KunInstallerRestoreInteractive
+Var /GLOBAL KunInstallerInPlaceUpdate
 Var /GLOBAL KunInstallerCurrentUserShortcutName
 Var /GLOBAL KunInstallerCurrentUserMenuDirectory
 !endif
@@ -77,6 +78,7 @@ Var /GLOBAL KunInstallerStopResult
   StrCpy $KunInstallerOtherQuietUninstallString ""
   !ifndef BUILD_UNINSTALLER
     StrCpy $KunInstallerRestoreInteractive 0
+    StrCpy $KunInstallerInPlaceUpdate 0
   !endif
 
   ${if} ${isUpdated}
@@ -157,7 +159,14 @@ Var /GLOBAL KunInstallerStopResult
 !macroend
 
 !macro customUnInstallCheck
-  ${if} $KunInstallerPrimarySourceStale != 1
+  ${if} $KunInstallerInPlaceUpdate == 1
+    # Same-directory automatic updates overwrite in place. Running the old
+    # uninstaller or FallbackCleanup first can empty the program directory when
+    # the subsequent extract/validate step fails.
+    ClearErrors
+    StrCpy $R0 0
+    DetailPrint "In-place automatic update; skipping pre-install removal of $KunInstallerPrimarySourceDir."
+  ${elseIf} $KunInstallerPrimarySourceStale != 1
     StrCpy $KunInstallerSourceDir $KunInstallerPrimarySourceDir
     Call KunHandleOldUninstallerResult
   ${else}
@@ -214,6 +223,13 @@ Var /GLOBAL KunInstallerStopResult
     Quit
   ${endif}
 
+  ${if} $KunInstallerInPlaceUpdate == 1
+    !insertmacro kunRunMigrationHelper CleanupInPlaceLeftovers
+    ${if} $KunInstallerHelperExitCode != 0
+      DetailPrint "Kun could not remove obsolete in-place update leftovers: $KunInstallerHelperOutput"
+    ${endif}
+  ${endif}
+
   !insertmacro kunRunMigrationHelper UpdatePath
   ${if} $KunInstallerHelperExitCode != 0
     DetailPrint "Kun could not update the user PATH: $KunInstallerHelperOutput"
@@ -256,6 +272,7 @@ Var /GLOBAL KunInstallerStopResult
     System::Call 'kernel32::SetEnvironmentVariable(t, t)i ("KUN_INSTALLER_PRIMARY_SOURCE_STALE", "$KunInstallerPrimarySourceStale").r0'
     System::Call 'kernel32::SetEnvironmentVariable(t, t)i ("KUN_INSTALLER_SECONDARY_SOURCE_STALE", "$KunInstallerSecondarySourceStale").r0'
     System::Call 'kernel32::SetEnvironmentVariable(t, t)i ("KUN_INSTALLER_CANDIDATE_EXPLICIT", "$KunInstallerCandidateExplicit").r0'
+    System::Call 'kernel32::SetEnvironmentVariable(t, t)i ("KUN_INSTALLER_IN_PLACE_UPDATE", "$KunInstallerInPlaceUpdate").r0'
     System::Call 'kernel32::SetEnvironmentVariable(t, t)i ("KUN_INSTALLER_INSTALL_MODE", "$installMode").r0'
   FunctionEnd
 
@@ -528,6 +545,7 @@ Var /GLOBAL KunInstallerStopResult
       Call KunRetireSelectedShellState
     ${else}
       StrCpy $KunInstallerSourceDir $KunInstallerPrimarySourceDir
+      Call KunMarkInPlaceAutomaticUpdate
       Call KunSecureSelectedUninstallRegistration
     ${endif}
     ${if} $KunInstallerHelperOutput == "2"
@@ -543,6 +561,20 @@ Var /GLOBAL KunInstallerStopResult
     StrCpy $KunInstallerMigrationPrepared 1
   FunctionEnd
 
+  Function KunMarkInPlaceAutomaticUpdate
+    StrCpy $KunInstallerInPlaceUpdate 0
+    ${ifNot} ${isUpdated}
+      Return
+    ${endif}
+    ${if} $KunInstallerPrimarySourceDir == ""
+      Return
+    ${endif}
+    ${if} $KunInstallerPrimarySourceDir == $KunInstallerTargetDir
+      StrCpy $KunInstallerInPlaceUpdate 1
+      DetailPrint "Automatic update will overwrite $KunInstallerTargetDir in place without pre-deleting the application payload."
+    ${endif}
+  FunctionEnd
+
   Function KunSuspendCurrentUserUninstallRegistration
     ReadRegStr $KunInstallerOtherUninstallString HKEY_CURRENT_USER "${UNINSTALL_REGISTRY_KEY}" UninstallString
     ReadRegStr $KunInstallerOtherQuietUninstallString HKEY_CURRENT_USER "${UNINSTALL_REGISTRY_KEY}" QuietUninstallString
@@ -575,6 +607,14 @@ Var /GLOBAL KunInstallerStopResult
   FunctionEnd
 
   Function KunSecureSelectedUninstallRegistration
+    ${if} $KunInstallerInPlaceUpdate == 1
+      # Hide the old uninstaller from electron-builder so it cannot wipe the
+      # same directory before the new payload is written and validated.
+      DeleteRegValue SHELL_CONTEXT "${UNINSTALL_REGISTRY_KEY}" UninstallString
+      DeleteRegValue SHELL_CONTEXT "${UNINSTALL_REGISTRY_KEY}" QuietUninstallString
+      DetailPrint "In-place automatic update; suppressed the selected-scope uninstaller until the new payload is installed."
+      Return
+    ${endif}
     Call KunResolveTrustedUninstaller
     ${if} $KunInstallerHelperOutput == ""
       DeleteRegValue SHELL_CONTEXT "${UNINSTALL_REGISTRY_KEY}" UninstallString
diff --git a/build/windows-installer-migration.ps1 b/build/windows-installer-migration.ps1
index daad715e1..23f802671 100644
--- a/build/windows-installer-migration.ps1
+++ b/build/windows-installer-migration.ps1
@@ -1,6 +1,6 @@
 param(
   [Parameter(Mandatory = $true)]
-  [ValidateSet('ResolvePath', 'ResolveSource', 'ResolveUpdateScope', 'ResolveUninstaller', 'StopProcesses', 'Recover', 'Prepare', 'FallbackCleanup', 'Restore', 'ValidatePayload', 'UpdatePath')]
+  [ValidateSet('ResolvePath', 'ResolveSource', 'ResolveUpdateScope', 'ResolveUninstaller', 'StopProcesses', 'Recover', 'Prepare', 'FallbackCleanup', 'Restore', 'ValidatePayload', 'CleanupInPlaceLeftovers', 'UpdatePath')]
   [string]$Action,
   [string]$ResultPath = ''
 )
@@ -939,6 +939,93 @@ function Assert-PackagedInstallPayload {
   ) 'the unpacked Kun service manager entry'
 }
 
+function Test-InPlaceUpdateRequested {
+  return [string]::Equals(
+    (Get-EnvironmentValue 'KUN_INSTALLER_IN_PLACE_UPDATE').Trim(),
+    '1',
+    [StringComparison]::Ordinal
+  )
+}
+
+function Get-CurrentProductUninstallerFile {
+  $configured = (Get-EnvironmentValue 'KUN_INSTALLER_PRODUCT_NAME').Trim()
+  if (-not [string]::IsNullOrWhiteSpace($configured)) {
+    return 'Uninstall ' + $configured + '.exe'
+  }
+  return 'Uninstall ' + (Get-CanonicalLeaf) + '.exe'
+}
+
+function Test-RetainedInPlaceKnownEntry([IO.FileSystemInfo]$Entry) {
+  if ($Entry.PSIsContainer) {
+    # Keep packaged directories that the new payload still uses.
+    return @('resources', 'locales', 'bin') -contains $Entry.Name.ToLowerInvariant()
+  }
+
+  $expectedExecutable = Get-ExpectedApplicationExecutable
+  if ([string]::Equals($Entry.Name, $expectedExecutable, [StringComparison]::OrdinalIgnoreCase)) {
+    return $true
+  }
+
+  $currentUninstaller = Get-CurrentProductUninstallerFile
+  if ([string]::Equals($Entry.Name, $currentUninstaller, [StringComparison]::OrdinalIgnoreCase)) {
+    return $true
+  }
+
+  # Electron runtime files from the newly extracted package stay in place.
+  $runtimeFiles = @(
+    'uninstallericon.ico',
+    'chrome_100_percent.pak',
+    'chrome_200_percent.pak',
+    'd3dcompiler_47.dll',
+    'dxcompiler.dll',
+    'dxil.dll',
+    'ffmpeg.dll',
+    'icudtl.dat',
+    'libegl.dll',
+    'libglesv2.dll',
+    'license.electron.txt',
+    'licenses.chromium.html',
+    'resources.pak',
+    'snapshot_blob.bin',
+    'v8_context_snapshot.bin',
+    'vk_swiftshader.dll',
+    'vk_swiftshader_icd.json',
+    'vulkan-1.dll'
+  )
+  return $runtimeFiles -contains $Entry.Name.ToLowerInvariant()
+}
+
+function Invoke-CleanupInPlaceLeftovers {
+  if (-not (Test-InPlaceUpdateRequested)) {
+    return
+  }
+
+  $target = Normalize-FullPath (Get-EnvironmentValue 'KUN_INSTALLER_TARGET')
+  $source = Normalize-FullPath (Get-EnvironmentValue 'KUN_INSTALLER_SOURCE')
+  if ([string]::IsNullOrWhiteSpace($target)) {
+    throw 'KUN_INSTALLER_TARGET is required for in-place leftover cleanup.'
+  }
+  if (-not [string]::IsNullOrWhiteSpace($source) -and -not (Test-PathEqual $source $target)) {
+    throw "In-place leftover cleanup requires the source and target to match: $source -> $target"
+  }
+
+  Assert-PackagedInstallPayload
+
+  $legacyEntries = @(Get-ChildItem -LiteralPath $target -Force | Where-Object {
+    (Test-KnownApplicationEntry $_) -and -not (Test-RetainedInPlaceKnownEntry $_)
+  })
+  foreach ($entry in $legacyEntries) {
+    if ($entry.PSIsContainer) {
+      Assert-NoReparsePointsInTree $entry 'Obsolete in-place application directory'
+    } elseif (Test-ReparsePoint $entry.FullName) {
+      throw "Obsolete in-place application file is a reparse point: $($entry.FullName)"
+    }
+  }
+  foreach ($entry in $legacyEntries) {
+    Remove-KnownApplicationEntry $entry
+  }
+}
+
 function Test-AppSpecificUninstaller([string]$Source) {
   if ([string]::IsNullOrWhiteSpace($Source)) {
     return $false
@@ -1384,6 +1471,9 @@ try {
     'ValidatePayload' {
       Assert-PackagedInstallPayload
     }
+    'CleanupInPlaceLeftovers' {
+      Invoke-CleanupInPlaceLeftovers
+    }
     'UpdatePath' {
       Update-UserPath
     }
diff --git a/kun/benchmarks/agent-core.json b/kun/benchmarks/agent-core.json
index 66d078d5c..3f05c2785 100644
--- a/kun/benchmarks/agent-core.json
+++ b/kun/benchmarks/agent-core.json
@@ -10,121 +10,121 @@
       "id": "architecture-summary",
       "tags": ["smoke", "architecture"],
       "prompt": "Read the repository and explain the active Renderer -> preload -> main -> Kun runtime data path. Cite the most relevant file paths. Do not modify files.",
-      "expect": { "requiredAnyTools": ["read", "grep", "find", "ls"] }
+      "expect": { "requiredTools": ["explore_agent"], "requiredAnyTools": ["explore_agent", "read", "grep", "find", "ls"] }
     },
     {
       "id": "runtime-entrypoint",
       "tags": ["smoke", "runtime"],
       "prompt": "Find the Kun serve-mode composition root and summarize how stores, model clients, tools, and the agent loop are assembled. Cite exact file paths. Do not modify files.",
-      "expect": { "requiredAnyTools": ["read", "grep", "find", "ls"] }
+      "expect": { "requiredAnyTools": ["explore_agent", "read", "grep", "find", "ls"] }
     },
     {
       "id": "renderer-send-flow",
       "tags": ["smoke", "frontend"],
       "prompt": "Trace a chat message from the renderer composer through the preload/main bridge to the Kun turn endpoint. Return a concise ordered call path with files. Do not modify files.",
-      "expect": { "requiredAnyTools": ["read", "grep", "find", "ls"] }
+      "expect": { "requiredAnyTools": ["explore_agent", "read", "grep", "find", "ls"] }
     },
     {
       "id": "sse-replay",
       "tags": ["smoke", "runtime"],
       "prompt": "Explain how Kun SSE event replay avoids duplicates and cursor rewind after reconnect or restart. Cite the implementation and tests. Do not modify files.",
-      "expect": { "requiredAnyTools": ["read", "grep", "find", "ls"] }
+      "expect": { "requiredAnyTools": ["explore_agent", "read", "grep", "find", "ls"] }
     },
     {
       "id": "mcp-lifecycle",
       "tags": ["smoke", "mcp"],
       "prompt": "Inspect MCP startup, tool discovery, execution, and reconnect behavior. Identify the main reliability boundaries and cite the implementation files. Do not modify files.",
-      "expect": { "requiredAnyTools": ["read", "grep", "find", "ls"] }
+      "expect": { "requiredAnyTools": ["explore_agent", "read", "grep", "find", "ls"] }
     },
     {
       "id": "cache-prefix",
       "tags": ["cache"],
       "prompt": "Explain what makes Kun's immutable prompt prefix stable and list dynamic data that must remain outside it. Cite code and documentation. Do not modify files.",
-      "expect": { "requiredAnyTools": ["read", "grep", "find", "ls"] }
+      "expect": { "requiredAnyTools": ["explore_agent", "read", "grep", "find", "ls"] }
     },
     {
       "id": "provider-url-contract",
       "tags": ["provider"],
       "prompt": "Trace how baseUrl and endpointFormat affect provider URL construction and request bodies across chat and auxiliary model calls. Cite all important consumers. Do not modify files.",
-      "expect": { "requiredAnyTools": ["read", "grep", "find", "ls"] }
+      "expect": { "requiredAnyTools": ["explore_agent", "read", "grep", "find", "ls"] }
     },
     {
       "id": "attachment-flow",
       "tags": ["attachments"],
       "prompt": "Trace an image or local file attachment from renderer selection to model input or fallback. Identify the cross-layer contract fields and failure points. Do not modify files.",
-      "expect": { "requiredAnyTools": ["read", "grep", "find", "ls"] }
+      "expect": { "requiredAnyTools": ["explore_agent", "read", "grep", "find", "ls"] }
     },
     {
       "id": "approval-flow",
       "tags": ["runtime", "security"],
       "prompt": "Trace a tool approval request from agent loop creation through SSE/UI resolution back to tool execution. Cite routes, gates, and renderer handlers. Do not modify files.",
-      "expect": { "requiredAnyTools": ["read", "grep", "find", "ls"] }
+      "expect": { "requiredAnyTools": ["explore_agent", "read", "grep", "find", "ls"] }
     },
     {
       "id": "goal-resume",
       "tags": ["runtime", "goal"],
       "prompt": "Explain how active goals survive runtime restart, how orphaned turns are reconciled, and where auto-resume is triggered. Cite tests if present. Do not modify files.",
-      "expect": { "requiredAnyTools": ["read", "grep", "find", "ls"] }
+      "expect": { "requiredAnyTools": ["explore_agent", "read", "grep", "find", "ls"] }
     },
     {
       "id": "subagent-permissions",
       "tags": ["subagent", "security"],
       "prompt": "Explain how subagent tool policies inherit or restrict built-in tools, MCP servers, and skills without escalating the parent permissions. Cite enforcement points. Do not modify files.",
-      "expect": { "requiredAnyTools": ["read", "grep", "find", "ls"] }
+      "expect": { "requiredAnyTools": ["explore_agent", "read", "grep", "find", "ls"] }
     },
     {
       "id": "settings-persistence",
       "tags": ["settings"],
       "prompt": "Trace a Kun settings change from renderer state through validation/persistence to managed runtime restart. Highlight rollback behavior. Do not modify files.",
-      "expect": { "requiredAnyTools": ["read", "grep", "find", "ls"] }
+      "expect": { "requiredAnyTools": ["explore_agent", "read", "grep", "find", "ls"] }
     },
     {
       "id": "test-selection",
       "tags": ["quality"],
       "prompt": "Identify how the verify_changes tool selects and runs validation after edits. Explain its safety limits and output contract. Do not modify files.",
-      "expect": { "requiredAnyTools": ["read", "grep", "find", "ls"] }
+      "expect": { "requiredAnyTools": ["explore_agent", "read", "grep", "find", "ls"] }
     },
     {
       "id": "build-pipeline",
       "tags": ["build"],
       "prompt": "Summarize the development, typecheck, test, build, and packaging pipeline for Kun. Cite package scripts and packaging configuration. Do not modify files.",
-      "expect": { "requiredAnyTools": ["read", "grep", "find", "ls"] }
+      "expect": { "requiredAnyTools": ["explore_agent", "read", "grep", "find", "ls"] }
     },
     {
       "id": "security-boundaries",
       "tags": ["security"],
       "prompt": "Map the main trust boundaries for renderer IPC, filesystem tools, command execution, MCP, and secrets. Cite concrete enforcement files. Do not modify files.",
-      "expect": { "requiredAnyTools": ["read", "grep", "find", "ls"] }
+      "expect": { "requiredAnyTools": ["explore_agent", "read", "grep", "find", "ls"] }
     },
     {
       "id": "runtime-hotspots",
       "tags": ["performance"],
       "prompt": "Inspect runtime event persistence, SSE replay, tool execution, and context assembly. Identify three evidence-based performance or memory hotspots with file references. Do not modify files.",
-      "expect": { "requiredAnyTools": ["read", "grep", "find", "ls"] }
+      "expect": { "requiredAnyTools": ["explore_agent", "read", "grep", "find", "ls"] }
     },
     {
       "id": "thread-persistence",
       "tags": ["storage"],
       "prompt": "Explain how thread/session data is persisted and indexed across file and hybrid SQLite stores, including usage carryover. Cite implementation files. Do not modify files.",
-      "expect": { "requiredAnyTools": ["read", "grep", "find", "ls"] }
+      "expect": { "requiredAnyTools": ["explore_agent", "read", "grep", "find", "ls"] }
     },
     {
       "id": "model-capabilities",
       "tags": ["provider"],
       "prompt": "Explain how model capabilities control image input, tool calling, reasoning effort, endpoint format, and context limits. Cite schemas and request construction. Do not modify files.",
-      "expect": { "requiredAnyTools": ["read", "grep", "find", "ls"] }
+      "expect": { "requiredAnyTools": ["explore_agent", "read", "grep", "find", "ls"] }
     },
     {
       "id": "frontend-chunking",
       "tags": ["frontend", "performance"],
       "prompt": "Inspect renderer lazy loading and identify which Workbench surfaces are split into separate chunks and which heavy chat dependencies still load eagerly. Do not modify files.",
-      "expect": { "requiredAnyTools": ["read", "grep", "find", "ls"] }
+      "expect": { "requiredAnyTools": ["explore_agent", "read", "grep", "find", "ls"] }
     },
     {
       "id": "failure-recovery",
       "tags": ["runtime", "reliability"],
       "prompt": "Map how the desktop app detects an unhealthy Kun child, budgets restarts, distinguishes settings restarts from crashes, and reports status to the renderer. Do not modify files.",
-      "expect": { "requiredAnyTools": ["read", "grep", "find", "ls"] }
+      "expect": { "requiredAnyTools": ["explore_agent", "read", "grep", "find", "ls"] }
     }
   ]
 }
diff --git a/kun/src/adapters/model/compat-message-projector.ts b/kun/src/adapters/model/compat-message-projector.ts
index ee0af03ee..b6e40ed11 100644
--- a/kun/src/adapters/model/compat-message-projector.ts
+++ b/kun/src/adapters/model/compat-message-projector.ts
@@ -8,6 +8,7 @@ import { extractToolResultImages, toolResultTextWithoutImages } from '../../loop
 import { wrapUntrustedContent } from '../../security/untrusted-content.js'
 import {
   COMPAT_ANTHROPIC_THINKING,
+  COMPAT_TOOL_RESULT_ERROR,
   COMPAT_HISTORY_CONTEXT,
   type CompatChatMessage,
   type CompatChatMessageContentPart
@@ -248,7 +249,8 @@ class CompatMessageProjector {
         return {
           role: 'tool',
           content: text || '(image omitted: the active model has no image input)',
-          tool_call_id: item.callId
+          tool_call_id: item.callId,
+          ...(item.isError === true ? { [COMPAT_TOOL_RESULT_ERROR]: true } : {})
         }
       }
       const parts: CompatChatMessageContentPart[] = []
@@ -259,12 +261,18 @@ class CompatMessageProjector {
           image_url: { url: `data:${image.mimeType};base64,${image.dataBase64}` }
         })
       }
-      return { role: 'tool', content: parts, tool_call_id: item.callId }
+      return {
+        role: 'tool',
+        content: parts,
+        tool_call_id: item.callId,
+        ...(item.isError === true ? { [COMPAT_TOOL_RESULT_ERROR]: true } : {})
+      }
     }
     return {
       role: 'tool',
       content: toolResultContent(item.output),
-      tool_call_id: item.callId
+      tool_call_id: item.callId,
+      ...(item.isError === true ? { [COMPAT_TOOL_RESULT_ERROR]: true } : {})
     }
   }
 
diff --git a/kun/src/adapters/model/compat-model-client.endpoint-format.test.ts b/kun/src/adapters/model/compat-model-client.endpoint-format.test.ts
index 471da3913..15b8b9045 100644
--- a/kun/src/adapters/model/compat-model-client.endpoint-format.test.ts
+++ b/kun/src/adapters/model/compat-model-client.endpoint-format.test.ts
@@ -568,15 +568,19 @@ describe('CompatModelClient per-model endpointFormat', () => {
   })
 
   it('uses the Codex Responses Lite shape for GPT-5.6 models', async () => {
-    const calls: Array<{ headers: Record<string, string>; body: Record<string, unknown> }> = []
+    const calls: Array<{ url: string; headers: Record<string, string>; body: Record<string, unknown> }> = []
     const client = new CompatModelClient({
       baseUrl: 'https://chatgpt.com/backend-api/codex',
       apiKey: 'oauth-access-token',
       model: 'gpt-5.6-sol',
       endpointFormat: 'responses',
       nonStreaming: true,
-      fetchImpl: (async (_url: string, init: { headers: Record<string, string>; body: string }) => {
-        calls.push({ headers: init.headers, body: JSON.parse(init.body) as Record<string, unknown> })
+      fetchImpl: (async (url: string, init: { headers: Record<string, string>; body: string }) => {
+        calls.push({
+          url: String(url),
+          headers: init.headers,
+          body: JSON.parse(init.body) as Record<string, unknown>
+        })
         return new Response(JSON.stringify({ output_text: 'ok' }), {
           status: 200,
           headers: { 'content-type': 'application/json' }
@@ -605,6 +609,7 @@ describe('CompatModelClient per-model endpointFormat', () => {
       }]
     }))
 
+    expect(calls[0].url).toBe('https://chatgpt.com/backend-api/codex/responses')
     expect(calls[0].headers['x-openai-internal-codex-responses-lite']).toBe('true')
     expect(calls[0].body).toMatchObject({
       model: 'gpt-5.6-sol',
@@ -628,6 +633,34 @@ describe('CompatModelClient per-model endpointFormat', () => {
     expect(input[1]).toMatchObject({ type: 'message', role: 'developer' })
   })
 
+  it('normalizes legacy Codex baseUrl + responses format to the custom /responses endpoint', async () => {
+    const calls: Array<{ url: string; body: Record<string, unknown> }> = []
+    const client = new CompatModelClient({
+      baseUrl: 'https://chatgpt.com/backend-api/codex',
+      apiKey: 'oauth-access-token',
+      model: 'gpt-5.5',
+      endpointFormat: 'responses',
+      nonStreaming: true,
+      fetchImpl: (async (url: string, init: { body: string }) => {
+        calls.push({ url: String(url), body: JSON.parse(init.body) as Record<string, unknown> })
+        return new Response(JSON.stringify({ output_text: 'ok' }), {
+          status: 200,
+          headers: { 'content-type': 'application/json' }
+        })
+      }) as unknown as typeof fetch,
+      modelCapabilities: modelCapabilities({})
+    })
+
+    await drain(client.stream(request('gpt-5.5')))
+
+    expect(calls[0].url).toBe('https://chatgpt.com/backend-api/codex/responses')
+    expect(calls[0].body).toMatchObject({
+      model: 'gpt-5.5',
+      store: false
+    })
+    expect(calls[0].body).not.toHaveProperty('messages')
+  })
+
   it('keeps GPT-5.6 Responses Lite cache inputs append-only and thread-scoped', async () => {
     const calls: Array<{ headers: Record<string, string>; body: Record<string, unknown> }> = []
     const responses = [
diff --git a/kun/src/adapters/model/compat-model-client.ts b/kun/src/adapters/model/compat-model-client.ts
index 4cee5721d..aa1cdefe2 100644
--- a/kun/src/adapters/model/compat-model-client.ts
+++ b/kun/src/adapters/model/compat-model-client.ts
@@ -171,6 +171,25 @@ function isCodexEndpoint(baseUrl: string): boolean {
   return baseUrl.includes('chatgpt.com/backend-api/codex')
 }
 
+function normalizeCodexResponsesUrl(baseUrl: string): string {
+  try {
+    const url = new URL(baseUrl.trim())
+    if (
+      url.protocol !== 'https:' ||
+      url.hostname !== 'chatgpt.com' ||
+      !url.pathname.replace(/\/+$/u, '').startsWith('/backend-api/codex')
+    ) {
+      return exactModelEndpointUrl(baseUrl)
+    }
+    url.pathname = '/backend-api/codex/responses'
+    url.search = ''
+    url.hash = ''
+    return url.toString()
+  } catch {
+    return exactModelEndpointUrl(baseUrl)
+  }
+}
+
 /**
  * Multi-provider HTTP model client.
  *
@@ -257,7 +276,17 @@ export class CompatModelClient implements ModelClient {
     // OpenCode Go) can route some models to chat completions and others to
     // Anthropic Messages. Falls back to the provider/runtime format.
     const configuredEndpointFormat = this.endpointFormatForModel(requestModel)
-    const endpointFormat = resolveModelEndpointFormat(configuredEndpointFormat, this.config.baseUrl)
+    const isCodex = isCodexEndpoint(this.config.baseUrl)
+    // Legacy Codex profiles stored `.../codex` + `responses` (or a bare
+    // custom path without `/responses`). Normalize before format inference so
+    // chat does not fail the custom-endpoint suffix check or hit `/v1/responses`.
+    const resolveBaseUrl = isCodex
+      ? normalizeCodexResponsesUrl(this.config.baseUrl)
+      : this.config.baseUrl
+    const endpointFormat = resolveModelEndpointFormat(
+      isCodex ? 'custom_endpoint' : configuredEndpointFormat,
+      resolveBaseUrl
+    )
     if (!endpointFormat) {
       yield {
         kind: 'error',
@@ -1311,6 +1340,7 @@ export class CompatModelClient implements ModelClient {
 }
 
 function buildModelEndpointUrl(baseUrl: string, endpointFormat: ModelEndpointFormat): string {
+  if (isCodexEndpoint(baseUrl)) return normalizeCodexResponsesUrl(baseUrl)
   if (isCustomModelEndpointFormat(endpointFormat)) return exactModelEndpointUrl(baseUrl)
   const path = modelEndpointPath(endpointFormat)
   const normalized = baseUrl.trim().replace(/\/+$/, '')
diff --git a/kun/src/adapters/model/compat-request-builder.ts b/kun/src/adapters/model/compat-request-builder.ts
index 59797bada..9060ef8f7 100644
--- a/kun/src/adapters/model/compat-request-builder.ts
+++ b/kun/src/adapters/model/compat-request-builder.ts
@@ -4,6 +4,7 @@ import { isDeepSeekHost } from './model-error-probe.js'
 import { repairToolArguments } from './tool-argument-repair.js'
 import {
   COMPAT_ANTHROPIC_THINKING,
+  COMPAT_TOOL_RESULT_ERROR,
   CompatRequestCodecs,
   type CompatChatMessage,
   type CompatChatMessageContentPart
@@ -19,7 +20,7 @@ type AnthropicContentBlock = (
   | { type: 'thinking'; thinking: string; signature: string }
   | { type: 'redacted_thinking'; data: string }
   | { type: 'tool_use'; id: string; name: string; input: Record<string, unknown> }
-  | { type: 'tool_result'; tool_use_id: string; content: string }
+  | { type: 'tool_result'; tool_use_id: string; content: string; is_error?: boolean }
 ) & { cache_control?: AnthropicCacheControl }
 type AnthropicMessage = {
   role: 'user' | 'assistant'
@@ -133,7 +134,8 @@ function messagesToAnthropic(
       const blocks: AnthropicContentBlock[] = [{
         type: 'tool_result',
         tool_use_id: message.tool_call_id,
-        content: chatContentToTextOnly(message.content)
+        content: chatContentToTextOnly(message.content),
+        ...(message[COMPAT_TOOL_RESULT_ERROR] === true ? { is_error: true } : {})
       }]
       if (Array.isArray(message.content)) {
         for (const part of message.content) {
diff --git a/kun/src/adapters/model/compat-request-codecs.ts b/kun/src/adapters/model/compat-request-codecs.ts
index 155a24d46..a9d608a7e 100644
--- a/kun/src/adapters/model/compat-request-codecs.ts
+++ b/kun/src/adapters/model/compat-request-codecs.ts
@@ -6,6 +6,7 @@ import { isDeepSeekHost, isGeminiOpenAiHost } from './model-error-probe.js'
 
 export const COMPAT_HISTORY_CONTEXT = Symbol('compat-history-context')
 export const COMPAT_ANTHROPIC_THINKING = Symbol('compat-anthropic-thinking')
+export const COMPAT_TOOL_RESULT_ERROR = Symbol('compat-tool-result-error')
 
 export type CompatChatMessage = {
   role: 'system' | 'user' | 'assistant' | 'tool'
@@ -14,6 +15,7 @@ export type CompatChatMessage = {
   [COMPAT_ANTHROPIC_THINKING]?: NonNullable<
     NonNullable<ToolCallProviderMetadata['anthropic']>['thinkingBlocks']
   >
+  [COMPAT_TOOL_RESULT_ERROR]?: boolean
   name?: string
   tool_call_id?: string
   reasoning_content?: string
diff --git a/kun/src/adapters/model/compat-tool-error-projection.test.ts b/kun/src/adapters/model/compat-tool-error-projection.test.ts
new file mode 100644
index 000000000..cdd74b1e0
--- /dev/null
+++ b/kun/src/adapters/model/compat-tool-error-projection.test.ts
@@ -0,0 +1,100 @@
+import { describe, expect, it } from 'vitest'
+import { makeAssistantTextItem, makeToolCallItem, makeToolResultItem } from '../../domain/item.js'
+import type { ModelRequest } from '../../ports/model-client.js'
+import { projectCompatMessages } from './compat-message-projector.js'
+import { createCompatRequestCodecs } from './compat-request-builder.js'
+import { COMPAT_TOOL_RESULT_ERROR } from './compat-request-codecs.js'
+
+const requestBase: ModelRequest = {
+  threadId: 'thread',
+  turnId: 'turn',
+  model: 'test-model',
+  prefix: [],
+  history: [],
+  tools: [],
+  abortSignal: new AbortController().signal
+}
+
+function errorMessages(): ReturnType<typeof projectCompatMessages> {
+  return projectCompatMessages({
+    ...requestBase,
+    history: [
+      makeAssistantTextItem({
+        id: 'assistant',
+        threadId: 'thread',
+        turnId: 'turn',
+        text: 'I will inspect that.'
+      }),
+      makeToolCallItem({
+        id: 'call-item',
+        threadId: 'thread',
+        turnId: 'turn',
+        callId: 'call-1',
+        toolName: 'read',
+        arguments: {},
+        status: 'completed'
+      }),
+      makeToolResultItem({
+        id: 'result-item',
+        threadId: 'thread',
+        turnId: 'turn',
+        callId: 'call-1',
+        toolName: 'read',
+        output: {
+          code: 'tool_cancelled_by_user',
+          guidance: 'Only this tool was stopped. Do not repeat the identical call automatically.'
+        },
+        isError: true
+      })
+    ]
+  }, {
+    thinkingMode: false,
+    supportsImages: false
+  })
+}
+
+describe('tool cancellation protocol projection', () => {
+  it('keeps the provider-neutral error marker paired with the call id', () => {
+    const messages = errorMessages()
+    const tool = messages.find((message) => message.role === 'tool')
+    expect(tool).toMatchObject({ role: 'tool', tool_call_id: 'call-1' })
+    expect(tool?.[COMPAT_TOOL_RESULT_ERROR]).toBe(true)
+  })
+
+  it('emits Anthropic is_error and structured text for OpenAI protocols', () => {
+    const messages = errorMessages()
+    const codecs = createCompatRequestCodecs()
+    const common = {
+      request: requestBase,
+      model: 'test-model',
+      messages,
+      tools: [],
+      stream: false,
+      baseUrl: 'https://provider.example/v1',
+      isCodex: false,
+      isCodexLite: false,
+      codexNativeImageGeneration: false
+    }
+
+    const anthropic = codecs.build({ ...common, endpointFormat: 'messages' })
+    const anthropicTool = (anthropic.messages as Array<{ content: unknown }>).flatMap((message) =>
+      Array.isArray(message.content) ? message.content : []
+    ).find((block) => (block as { type?: string }).type === 'tool_result') as {
+      tool_use_id: string
+      is_error?: boolean
+    }
+    expect(anthropicTool).toMatchObject({ tool_use_id: 'call-1', is_error: true })
+
+    const chat = codecs.build({ ...common, endpointFormat: 'chat_completions' })
+    expect(chat.messages).toEqual(expect.arrayContaining([
+      expect.objectContaining({ role: 'tool', tool_call_id: 'call-1' })
+    ]))
+    expect(JSON.stringify(chat.messages)).toContain('tool_cancelled_by_user')
+
+    const responses = codecs.build({ ...common, endpointFormat: 'responses' })
+    expect(responses.input).toEqual(expect.arrayContaining([
+      expect.objectContaining({ type: 'function_call_output', call_id: 'call-1' })
+    ]))
+    expect(JSON.stringify(responses.input)).toContain('tool_cancelled_by_user')
+  })
+})
diff --git a/kun/src/adapters/tool/capability-registry.test.ts b/kun/src/adapters/tool/capability-registry.test.ts
index e6f02bfa0..de8aa7109 100644
--- a/kun/src/adapters/tool/capability-registry.test.ts
+++ b/kun/src/adapters/tool/capability-registry.test.ts
@@ -78,6 +78,13 @@ describe('CapabilityRegistry Graph orchestration policy', () => {
       enabled: true,
       available: true,
       tools: [tool('delegate_task'), tool('list_subagent_profiles', 'read-only')]
+    },
+    {
+      id: 'explore-agent',
+      kind: 'delegation' as const,
+      enabled: true,
+      available: true,
+      tools: [tool('explore_agent', 'read-only')]
     }
   ]
 
@@ -90,8 +97,10 @@ describe('CapabilityRegistry Graph orchestration policy', () => {
       expect(registry.listTools(current).map((spec) => spec.name)).toEqual([
         'read',
         'graph_create_run',
-        'graph_control_run'
+        'graph_control_run',
+        'explore_agent'
       ])
+      expect(registry.resolveTool('explore_agent', current).provider.id).toBe('explore-agent')
       for (const name of [
         'delegate_task',
         'list_subagent_profiles',
@@ -115,7 +124,8 @@ describe('CapabilityRegistry Graph orchestration policy', () => {
       'graph_create_run',
       'graph_control_run',
       'delegate_task',
-      'list_subagent_profiles'
+      'list_subagent_profiles',
+      'explore_agent'
     ])
     expect(registry.resolveTool('delegate_task', direct).provider.kind).toBe('delegation')
     expect(registry.resolveTool('task_graph', direct).provider.id).toBe('builtin')
@@ -138,4 +148,31 @@ describe('CapabilityRegistry Plan mode policy', () => {
     expect(() => registry.resolveTool('mcp_test_mutate', planContext))
       .toThrow('tool mcp_test_mutate is not advertised by active tool policy')
   })
+
+  it('keeps read-only explore_agent visible in plan mode while hiding delegate_task', () => {
+    const registry = new CapabilityRegistry([
+      {
+        id: 'delegation',
+        kind: 'delegation',
+        enabled: true,
+        available: true,
+        tools: [tool('delegate_task'), tool('list_subagent_profiles', 'read-only')]
+      },
+      {
+        id: 'explore-agent',
+        kind: 'delegation',
+        enabled: true,
+        available: true,
+        tools: [tool('explore_agent', 'read-only')]
+      }
+    ])
+    const planContext = context([], 'plan')
+
+    expect(registry.listTools(planContext).map((spec) => spec.name)).toEqual([
+      'list_subagent_profiles',
+      'explore_agent'
+    ])
+    expect(() => registry.resolveTool('delegate_task', planContext))
+      .toThrow('tool delegate_task is not advertised by active tool policy')
+  })
 })
diff --git a/kun/src/adapters/tool/explore-agent-tool-provider.ts b/kun/src/adapters/tool/explore-agent-tool-provider.ts
index 20fe07753..a1350a742 100644
--- a/kun/src/adapters/tool/explore-agent-tool-provider.ts
+++ b/kun/src/adapters/tool/explore-agent-tool-provider.ts
@@ -4,7 +4,7 @@ import {
   ModelReasoningEffort,
   type SubagentProfileConfig
 } from '../../contracts/capabilities.js'
-import type { ToolHostContext } from '../../ports/tool-host.js'
+import type { ToolExecutionUpdate, ToolHostContext } from '../../ports/tool-host.js'
 import type { CapabilityToolProvider } from './capability-registry.js'
 import { LocalToolHost } from './local-tool-host.js'
 
@@ -43,20 +43,31 @@ const EXPLORE_AGENT_PROMPT_PREAMBLE = [
   '绝不修改任何文件或外部状态，也不要执行会改动工作区的命令。'
 ].join('')
 
+const EXPLORE_AGENT_DESCRIPTION = [
+  'Use this first for any repository or project exploration: locating files or symbols, searching code or keywords, tracing call paths or dependencies, understanding architecture or behavior, or gathering context before a change.',
+  'Complex questions MUST be split into multiple parallel explore_agent calls with non-overlapping scopes (for example one call for API wiring, another for UI, another for tests). Never pack a whole-repo investigation into a single call.',
+  'Each call needs a short distinct title (2-6 words) for the UI plus a narrow, self-contained query that states what evidence to return.',
+  '即使后续需要修改文件，也必须先调用 explore_agent；它优先于主代理直接使用 read/grep/glob/ls/repo_map/find/bash，并应为独立调查面并行发起多个调用。',
+  'Only use direct inspection tools for narrow follow-up verification after this tool returns, or when explore_agent is unavailable or fails.',
+  '它可以运行 bash 与只读探索工具（read/grep/glob/ls/repo_map/find/web_fetch/web_search），但始终不会修改文件。'
+].join(' ')
+
 /**
  * First-class `explore_agent` tool: the main agent delegates a scoped
  * exploration query to a read-oriented child that may use full bash plus the
  * exploration allow-list. It reuses the whole subagent runtime (child thread,
  * events, approval inheritance, SubagentCallCard rendering) while keeping the
- * delegate_task router untouched. Disabled via Lab settings removes the tool
- * from the main agent's tool list entirely.
+ * delegate_task router untouched. Lab disable is enforced live via
+ * `shouldAdvertise` (and an execute backstop) so hot-applied settings can
+ * hide or restore the tool without rebuilding the provider away.
  */
 export function buildExploreAgentToolProvider(
   runtime: DelegationRuntime | undefined,
   config: () => ExploreAgentToolConfig | undefined
 ): CapabilityToolProvider[] {
   if (!runtime?.enabled()) return []
-  if (config()?.enabled === false) return []
+  const shouldAdvertise = (_context: ToolHostContext): boolean =>
+    config()?.enabled !== false
   return [
     {
       id: EXPLORE_AGENT_PROVIDER_ID,
@@ -66,43 +77,48 @@ export function buildExploreAgentToolProvider(
       tools: [
         LocalToolHost.defineTool({
           name: EXPLORE_AGENT_TOOL_NAME,
-          description: [
-            'First-class exploration agent for file lookup, code/keyword search, and project information.',
-            '使用探索代理查找文件、搜索关键字或回答关于项目的问题；优先于 delegate_task 用于纯探索任务。',
-            '它可以运行 bash 与只读探索工具（read/grep/glob/ls/repo_map/find/web_fetch/web_search），但不会修改文件。'
-          ].join(' '),
+          description: EXPLORE_AGENT_DESCRIPTION,
           inputSchema: {
             type: 'object',
             properties: {
+              title: {
+                type: 'string',
+                description: 'Distinct 2-6 word UI title for this exploration (shown in the parallel explore list).'
+              },
               query: {
                 type: 'string',
-                description: '探索目标：要查找的文件/符号/关键字，或要回答的项目问题。'
+                description: 'Narrow, self-contained investigation request: what to locate or explain, and which file:line evidence or concise conclusion to return. Do not restate the whole user question if multiple explores are running in parallel.'
               },
               workspace: {
                 type: 'string',
                 description: 'Optional workspace root to explore. Defaults to the parent turn workspace.'
               }
             },
-            required: ['query'],
+            required: ['title', 'query'],
             additionalProperties: false
           },
           policy: 'auto',
-          execute: async (args, context) => {
+          sideEffect: 'read-only',
+          shouldAdvertise,
+          execute: async (args, context, onUpdate) => {
             const cfg = config()
-            if (!cfg || cfg.enabled === false) {
+            if (cfg?.enabled === false) {
               return {
                 output: { error: 'explore_agent is disabled in Lab settings' },
                 isError: true
               }
             }
+            const title = stringValue(args.title)
             const query = stringValue(args.query)
+            if (!title) return { output: { error: 'title is required' }, isError: true }
             if (!query) return { output: { error: 'query is required' }, isError: true }
             const workspace = stringValue(args.workspace) || context.workspace
-            const inlineProfile = buildExploreInlineProfile(cfg)
+            const resolvedCfg = cfg ?? {}
+            const inlineProfile = buildExploreInlineProfile(resolvedCfg)
             const record = await runtime.runChild({
               parentThreadId: context.threadId,
               parentTurnId: context.turnId,
-              label: '探索项目',
+              label: title,
               prompt: query,
               workspace,
               inlineProfile,
@@ -110,7 +126,7 @@ export function buildExploreAgentToolProvider(
               // Follow the parent session's model/provider/reasoning/service
               // tier unless the Lab settings configure an explicit override.
               inheritSessionDefaults: true,
-              ...(cfg.fast === true ? { serviceTier: 'priority' as const } : {}),
+              ...(resolvedCfg.fast === true ? { serviceTier: 'priority' as const } : {}),
               ...(context.serviceTier ? { inheritedServiceTier: context.serviceTier } : {}),
               ...(context.actingModelRoute?.model
                 ? { inheritedModel: context.actingModelRoute.model }
@@ -164,14 +180,63 @@ export function buildExploreAgentToolProvider(
               approvalReviewer: context.approvalReviewer ?? 'user',
               ...(context.clientSurface ? { clientSurface: context.clientSurface } : {}),
               returnFormat: 'summary',
+              onQueued: async (childId, profile, metadata) => {
+                await emitExploreLifecycle(onUpdate, {
+                  childId,
+                  status: 'queued',
+                  title,
+                  profile,
+                  metadata: {
+                    ...metadata,
+                    profileName: metadata?.profileName?.trim() || 'Repository Explorer',
+                    model: metadata?.model?.trim() ||
+                      context.actingModelRoute?.model?.trim() ||
+                      context.model?.id?.trim() ||
+                      undefined
+                  }
+                })
+              },
+              onRunning: async (childId, profile, metadata) => {
+                await emitExploreLifecycle(onUpdate, {
+                  childId,
+                  status: 'running',
+                  title,
+                  profile,
+                  metadata: {
+                    ...metadata,
+                    profileName: metadata?.profileName?.trim() || 'Repository Explorer',
+                    model: metadata?.model?.trim() ||
+                      context.actingModelRoute?.model?.trim() ||
+                      context.model?.id?.trim() ||
+                      undefined
+                  }
+                })
+              },
               signal: context.abortSignal
             })
             const failed = record.status === 'failed' || record.status === 'aborted'
+            const resolvedModel =
+              record.model?.trim() ||
+              (typeof context.actingModelRoute?.model === 'string'
+                ? context.actingModelRoute.model.trim()
+                : '') ||
+              context.model?.id?.trim() ||
+              ''
+            const profileName =
+              record.profileSnapshot?.name?.trim() ||
+              'Repository Explorer'
             return {
               output: {
+                childId: record.id,
+                status: record.status,
+                title,
                 summary: record.summary ?? '',
                 toolInvocations: record.toolInvocations ?? 0,
                 usage: record.usage,
+                profile: 'explore',
+                profileName,
+                ...(resolvedModel ? { model: resolvedModel } : {}),
+                ...(record.durationMs !== undefined ? { durationMs: record.durationMs } : {}),
                 ...(failed ? { error: record.error ?? record.status } : {})
               },
               isError: failed
@@ -183,6 +248,30 @@ export function buildExploreAgentToolProvider(
   ]
 }
 
+async function emitExploreLifecycle(
+  onUpdate: ((update: ToolExecutionUpdate) => Promise<void> | void) | undefined,
+  args: {
+    childId: string
+    status: 'queued' | 'running'
+    title: string
+    profile?: string
+    metadata?: { profileName?: string; model?: string; reasoningEffort?: string }
+  }
+): Promise<void> {
+  await onUpdate?.({
+    output: {
+      childId: args.childId,
+      status: args.status,
+      title: args.title,
+      profile: args.profile ?? 'explore',
+      profileName: args.metadata?.profileName?.trim() || 'Repository Explorer',
+      ...(args.metadata?.model ? { model: args.metadata.model } : {}),
+      ...(args.metadata?.reasoningEffort ? { reasoningEffort: args.metadata.reasoningEffort } : {})
+    },
+    isError: false
+  })
+}
+
 function buildExploreInlineProfile(
   cfg: ExploreAgentToolConfig
 ): { id: string; profile: SubagentProfileConfig; source: 'builtin' } {
diff --git a/kun/src/adapters/tool/explore-agent-tool.test.ts b/kun/src/adapters/tool/explore-agent-tool.test.ts
index 3c43ffcd9..afdd98964 100644
--- a/kun/src/adapters/tool/explore-agent-tool.test.ts
+++ b/kun/src/adapters/tool/explore-agent-tool.test.ts
@@ -25,6 +25,8 @@ import {
   EXPLORE_AGENT_TOOL_NAME,
   buildExploreAgentToolProvider
 } from './explore-agent-tool-provider.js'
+import { CapabilityRegistry } from './capability-registry.js'
+import { LocalToolHost } from './local-tool-host.js'
 
 function makeRuntime(dir: string, executor: ChildRunExecutor): DelegationRuntime {
   const nowIso = () => '2026-07-08T00:00:00.000Z'
@@ -92,22 +94,65 @@ describe('explore_agent tool provider', () => {
     if (dir) await rm(dir, { recursive: true, force: true })
   })
 
-  it('registers the tool only when enabled by default or explicitly', async () => {
+  it('registers the tool and gates advertising from live Lab settings', async () => {
     dir = await mkdtemp(join(tmpdir(), 'explore-agent-tool-'))
     const runtime = makeRuntime(dir, async () => ({ summary: 'ok' }))
     expect(buildExploreAgentToolProvider(runtime, () => undefined)).toHaveLength(1)
     expect(buildExploreAgentToolProvider(runtime, () => ({ enabled: true }))).toHaveLength(1)
-    expect(buildExploreAgentToolProvider(runtime, () => ({ enabled: false }))).toHaveLength(0)
+    const disabledProvider = buildExploreAgentToolProvider(runtime, () => ({ enabled: false }))
+    expect(disabledProvider).toHaveLength(1)
+    expect(disabledProvider[0].tools[0].shouldAdvertise?.(baseContext)).toBe(false)
     const provider = buildExploreAgentToolProvider(runtime, () => ({}))[0]
     expect(provider.id).toBe(EXPLORE_AGENT_PROVIDER_ID)
     expect(provider.tools[0].name).toBe(EXPLORE_AGENT_TOOL_NAME)
+    expect(provider.tools[0].sideEffect).toBe('read-only')
+    expect(provider.tools[0].shouldAdvertise?.(baseContext)).toBe(true)
+    expect(provider.tools[0].description).toContain('Use this first for any repository or project exploration')
+    expect(provider.tools[0].description).toContain('multiple parallel explore_agent calls')
+    expect(provider.tools[0].description).toContain('即使后续需要修改文件，也必须先调用 explore_agent')
+    expect(provider.tools[0].description).toContain('Only use direct inspection tools for narrow follow-up verification')
+    expect(provider.tools[0].description).toContain('始终不会修改文件')
+    expect(provider.tools[0].inputSchema).toMatchObject({
+      required: ['title', 'query']
+    })
+
+    let cfg: { enabled?: boolean } | undefined
+    const liveTool = buildExploreAgentToolProvider(runtime, () => cfg)[0].tools[0]
+    expect(liveTool.shouldAdvertise?.(baseContext)).toBe(true)
+    cfg = { enabled: false }
+    expect(liveTool.shouldAdvertise?.(baseContext)).toBe(false)
+    cfg = { enabled: true }
+    expect(liveTool.shouldAdvertise?.(baseContext)).toBe(true)
   })
 
   it('does not register when delegation is unavailable', () => {
     expect(buildExploreAgentToolProvider(undefined, () => ({ enabled: true }))).toHaveLength(0)
   })
 
-  it('rejects a missing query and a disabled feature without creating a child run', async () => {
+  it('stays advertised in plan and graph contexts while Lab is enabled', async () => {
+    dir = await mkdtemp(join(tmpdir(), 'explore-agent-tool-'))
+    const runtime = makeRuntime(dir, async () => ({ summary: 'ok' }))
+    const host = new LocalToolHost({
+      registry: new CapabilityRegistry(buildExploreAgentToolProvider(runtime, () => ({ enabled: true })))
+    })
+
+    for (const current of [
+      { ...baseContext, threadMode: 'plan' as const },
+      { ...baseContext, orchestration: 'graph' as const },
+      { ...baseContext, messageSource: 'graph_runtime' as const }
+    ]) {
+      const tools = await host.listTools(current)
+      expect(tools.map((tool) => tool.name)).toEqual([EXPLORE_AGENT_TOOL_NAME])
+      expect(tools[0]?.sideEffect).toBe('read-only')
+    }
+
+    const disabledHost = new LocalToolHost({
+      registry: new CapabilityRegistry(buildExploreAgentToolProvider(runtime, () => ({ enabled: false })))
+    })
+    expect(await disabledHost.listTools({ ...baseContext, threadMode: 'plan' })).toEqual([])
+  })
+
+  it('rejects a missing title/query and a disabled feature without creating a child run', async () => {
     dir = await mkdtemp(join(tmpdir(), 'explore-agent-tool-'))
     let ran = false
     const runtime = makeRuntime(dir, async () => {
@@ -115,20 +160,23 @@ describe('explore_agent tool provider', () => {
       return { summary: 'ok' }
     })
     const tool = buildExploreAgentToolProvider(runtime, () => ({ enabled: true }))[0].tools[0]
-    const missing = await tool.execute({}, baseContext)
-    expect(missing.isError).toBe(true)
-    expect((missing.output as { error: string }).error).toBe('query is required')
+    const missingBoth = await tool.execute({}, baseContext)
+    expect(missingBoth.isError).toBe(true)
+    expect((missingBoth.output as { error: string }).error).toBe('title is required')
     expect(ran).toBe(false)
 
-    // A provider built while disabled registers no tool at all.
-    expect(buildExploreAgentToolProvider(runtime, () => ({ enabled: false }))).toHaveLength(0)
+    const missingQuery = await tool.execute({ title: 'Find main' }, baseContext)
+    expect(missingQuery.isError).toBe(true)
+    expect((missingQuery.output as { error: string }).error).toBe('query is required')
+    expect(ran).toBe(false)
 
     // The execute-time backstop fires when the feature is turned off after
     // the tool was already advertised (in-flight call safety).
     let cfg = { enabled: true }
     const mutableTool = buildExploreAgentToolProvider(runtime, () => cfg)[0].tools[0]
     cfg = { enabled: false }
-    const disabled = await mutableTool.execute({ query: 'find x' }, baseContext)
+    expect(mutableTool.shouldAdvertise?.(baseContext)).toBe(false)
+    const disabled = await mutableTool.execute({ title: 'Find x', query: 'find x' }, baseContext)
     expect(disabled.isError).toBe(true)
     expect((disabled.output as { error: string }).error).toContain('disabled in Lab settings')
     expect(ran).toBe(false)
@@ -137,6 +185,7 @@ describe('explore_agent tool provider', () => {
   it('runs a read-oriented child that inherits the main session and returns a summary', async () => {
     dir = await mkdtemp(join(tmpdir(), 'explore-agent-tool-'))
     let received: Record<string, unknown> | undefined
+    const lifecycle: Array<Record<string, unknown>> = []
     const runtime = makeRuntime(dir, async () => ({ summary: 'found src/main.ts:12', toolInvocations: 3 }))
     const originalRunChild = runtime.runChild.bind(runtime)
     runtime.runChild = (async (input) => {
@@ -144,18 +193,38 @@ describe('explore_agent tool provider', () => {
       return originalRunChild(input)
     }) as typeof runtime.runChild
     const tool = buildExploreAgentToolProvider(runtime, () => ({ enabled: true }))[0].tools[0]
-    const result = await tool.execute({ query: 'where is main defined' }, baseContext)
+    const result = await tool.execute(
+      { title: 'Locate main symbol', query: 'where is main defined' },
+      baseContext,
+      async (update) => {
+        lifecycle.push(update.output as Record<string, unknown>)
+      }
+    )
     expect(result.isError).toBeFalsy()
     expect(result.output).toMatchObject({
       summary: 'found src/main.ts:12',
-      toolInvocations: 3
+      toolInvocations: 3,
+      title: 'Locate main symbol',
+      profile: 'explore',
+      profileName: 'Repository Explorer',
+      model: 'main-model',
+      status: 'completed'
+    })
+    expect(typeof (result.output as { childId?: string }).childId).toBe('string')
+    expect((result.output as { childId: string }).childId.length).toBeGreaterThan(0)
+    expect(lifecycle.length).toBeGreaterThanOrEqual(1)
+    expect(lifecycle[0]).toMatchObject({
+      status: expect.stringMatching(/^(queued|running)$/),
+      title: 'Locate main symbol',
+      profile: 'explore'
     })
+    expect(typeof lifecycle[0]?.childId).toBe('string')
     expect(received).toMatchObject({
       parentThreadId: 'thr_main',
       parentTurnId: 'turn_main',
       prompt: 'where is main defined',
       workspace: '/workspace',
-      label: '探索项目',
+      label: 'Locate main symbol',
       agentSurface: 'code',
       inheritSessionDefaults: true,
       inheritedModel: 'main-model',
@@ -192,7 +261,7 @@ describe('explore_agent tool provider', () => {
       reasoningEffort: 'medium',
       fast: true
     }))[0].tools[0]
-    await tool.execute({ query: 'inspect' }, baseContext)
+    await tool.execute({ title: 'Inspect module', query: 'inspect' }, baseContext)
     const inline = received?.inlineProfile as { profile: Record<string, unknown> }
     expect(inline.profile.model).toBe('gpt-5.4')
     expect(inline.profile.providerId).toBe('codex-2')
diff --git a/kun/src/contracts/items.ts b/kun/src/contracts/items.ts
index e95db8ed5..2249eb72d 100644
--- a/kun/src/contracts/items.ts
+++ b/kun/src/contracts/items.ts
@@ -122,6 +122,8 @@ export const ToolCallTurnItem = TurnItemBase.extend({
   kind: z.literal('tool_call'),
   toolName: z.string().min(1),
   callId: z.string().min(1),
+  /** Set when a user requested cancellation of this still-running call. */
+  cancelRequestedAt: z.string().optional(),
   toolKind: z.enum(['tool_call', 'command_execution', 'file_change']),
   arguments: z.record(z.string(), z.unknown()),
   /**
diff --git a/kun/src/contracts/threads.ts b/kun/src/contracts/threads.ts
index 049be8f0f..07978e68b 100644
--- a/kun/src/contracts/threads.ts
+++ b/kun/src/contracts/threads.ts
@@ -1,5 +1,5 @@
 import { z } from 'zod'
-import { TurnSchema } from './turns.js'
+import { TurnSchema, TurnStatus } from './turns.js'
 import {
   ApprovalPolicySchema,
   ApprovalReviewerSchema,
@@ -12,6 +12,24 @@ import {
 export const ThreadStatus = z.enum(['idle', 'running', 'archived', 'deleted'])
 export type ThreadStatus = z.infer<typeof ThreadStatus>
 
+/**
+ * Small runtime-facing projection for background status checks.  Unlike the
+ * full thread document this deliberately excludes turn items/history, making
+ * it safe to poll while another conversation is selected.
+ */
+export const ThreadRuntimeStateSchema = z.object({
+  id: z.string().min(1),
+  status: ThreadStatus,
+  updatedAt: z.string(),
+  latestSeq: z.number().int().nonnegative(),
+  latestTurn: z.object({
+    id: z.string().min(1),
+    status: TurnStatus,
+    orchestration: z.enum(['direct', 'graph'])
+  }).nullable()
+})
+export type ThreadRuntimeState = z.infer<typeof ThreadRuntimeStateSchema>
+
 /**
  * The generic thread PATCH endpoint only owns the archival visibility
  * overlay. Execution and deletion states are controlled by TurnService and
diff --git a/kun/src/contracts/turns.ts b/kun/src/contracts/turns.ts
index f52c201d5..0ec5ab1ce 100644
--- a/kun/src/contracts/turns.ts
+++ b/kun/src/contracts/turns.ts
@@ -358,6 +358,14 @@ export const InterruptTurnResponse = z.object({
 })
 export type InterruptTurnResponse = z.infer<typeof InterruptTurnResponse>
 
+export const CancelToolCallResponse = z.object({
+  threadId: z.string().min(1),
+  turnId: z.string().min(1),
+  callId: z.string().min(1),
+  status: z.enum(['cancellation_requested', 'already_requested'])
+}).strict()
+export type CancelToolCallResponse = z.infer<typeof CancelToolCallResponse>
+
 export const CompactRequest = z.object({
   reason: z.string().optional(),
   /** Optional explicit token budget. */
diff --git a/kun/src/contracts/usage.ts b/kun/src/contracts/usage.ts
index 1e047ba53..89d45630d 100644
--- a/kun/src/contracts/usage.ts
+++ b/kun/src/contracts/usage.ts
@@ -51,7 +51,25 @@ export const UsageSnapshotSchema = z.object({
   tokenEconomySavingsUsd: z.number().nonnegative().optional(),
   tokenEconomySavingsCny: z.number().nonnegative().optional(),
   /** Provider reported an unrecoverable error mid-stream. */
-  hasError: z.boolean().optional()
+  hasError: z.boolean().optional(),
+  /**
+   * Time-to-first-token of this single model request (ms), measured from
+   * request start until the first text/reasoning chunk arrives. Missing for
+   * non-streaming or legacy providers.
+   */
+  requestTtftMs: z.number().nonnegative().optional(),
+  /** Time spent generating this single model response (ms), from first chunk
+   * until the final usage/completed chunk. Used with `completionTokens` to
+   * derive per-request tokens-per-second. */
+  requestGenerationMs: z.number().nonnegative().optional(),
+  /** Average TTFT across model calls of the current turn (null = no data). */
+  turnAvgTtftMs: z.number().nonnegative().nullable().optional(),
+  /** Average tokens-per-second across model calls of the current turn. */
+  turnAvgTokensPerSecond: z.number().nonnegative().nullable().optional(),
+  /** Thread-cumulative average TTFT across all model calls (null = no data). */
+  avgTtftMs: z.number().nonnegative().nullable().optional(),
+  /** Thread-cumulative average tokens-per-second across all model calls. */
+  avgTokensPerSecond: z.number().nonnegative().nullable().optional()
 })
 export type UsageSnapshot = z.infer<typeof UsageSnapshotSchema>
 
@@ -158,5 +176,9 @@ export const emptyUsageSnapshot = (): UsageSnapshot => ({
   cacheMissTokens: 0,
   cacheHitRate: null,
   turns: 0,
-  tokenEconomySavingsTokens: 0
+  tokenEconomySavingsTokens: 0,
+  turnAvgTtftMs: null,
+  turnAvgTokensPerSecond: null,
+  avgTtftMs: null,
+  avgTokensPerSecond: null
 })
diff --git a/kun/src/delegation/child-agent-executor.ts b/kun/src/delegation/child-agent-executor.ts
index f3c0b7b5d..813baf1b2 100644
--- a/kun/src/delegation/child-agent-executor.ts
+++ b/kun/src/delegation/child-agent-executor.ts
@@ -286,7 +286,10 @@ export function createChildAgentExecutor(options: ChildAgentExecutorOptions): Ch
       // providerId into every ModelRequest, and the executor's model is the
       // MultiProviderModelClient, so this single field is all routing needs.
       ...(input.providerId ? { providerId: input.providerId } : {}),
-      ...(input.accountId ? { accountId: input.accountId } : {})
+      ...(input.accountId ? { accountId: input.accountId } : {}),
+      // Persist the resolved profile id so the GUI can label explore/side
+      // sessions (e.g. return-bar "viewing explore process").
+      ...(input.profile?.trim() ? { agentId: input.profile.trim() } : {})
     }, {
       id: input.childId,
       title,
diff --git a/kun/src/graph/graph-run-completion.ts b/kun/src/graph/graph-run-completion.ts
index 6bf5c606f..365b66fce 100644
--- a/kun/src/graph/graph-run-completion.ts
+++ b/kun/src/graph/graph-run-completion.ts
@@ -59,18 +59,44 @@ export async function finishGraphRun(initialRun: GraphRunV1, options: Completion
 }
 
 /**
- * Summary persistence is the first durable step of terminal finalization.
- * A later cleanup or status-transition failure may temporarily move the run
- * back to supervision. Only summaries whose current revision still satisfies
- * the normal completion gates receive that protection.
+ * Node/completion gates have passed (or the run is already in completing).
+ * Used only to avoid cancelling semantically finished work on incidental Lead
+ * settlement. Does not by itself authorize silent finalization.
+ */
+export function isGraphRunSemanticComplete(run: GraphRunV1): boolean {
+  return run.status === 'completing' || graphRunCompletionGatesPassed(run)
+}
+
+/**
+ * Unresolved holds that make auto-finish unsafe even when gates have passed:
+ * human attention, scheduler errors, or any needs_attention obligation.
+ */
+export function graphRunHasBlockingFinalizationHold(run: GraphRunV1): boolean {
+  if (run.status === 'awaiting_human') return true
+  return run.supervisionObligations.some((obligation) =>
+    obligation.state !== 'resolved' &&
+    (
+      obligation.state === 'needs_attention' ||
+      obligation.kind === 'scheduler_error'
+    ))
+}
+
+/**
+ * Finalization is safe to push through the scheduler without another Lead
+ * episode. Distinct from {@link isGraphRunSemanticComplete}:
+ * - semantic complete: do not cancel on incidental settlement
+ * - finalization safe: resumeRun may complete without bypassing blockers
+ *
+ * Requirements: completing, or (gates passed + no mailbox blockers + no
+ * human/scheduler finalization holds). Missing summary is allowed so the
+ * gates-passed race before tryComplete can finish after resumeRun.
  */
 export function isGraphRunCompletionFinalizing(
   run: GraphRunV1,
   mailbox: Pick<GraphMailbox, 'unresolvedBlockers'>
 ): boolean {
-  return run.status === 'completing' || (
-    run.summary !== undefined &&
-    graphRunCompletionGatesPassed(run) &&
-    mailbox.unresolvedBlockers(run).length === 0
-  )
+  if (run.status === 'completing') return true
+  if (mailbox.unresolvedBlockers(run).length > 0) return false
+  if (graphRunHasBlockingFinalizationHold(run)) return false
+  return graphRunCompletionGatesPassed(run)
 }
diff --git a/kun/src/graph/graph-tool-boundary.test.ts b/kun/src/graph/graph-tool-boundary.test.ts
index bfc79f7f9..7b7b7d387 100644
--- a/kun/src/graph/graph-tool-boundary.test.ts
+++ b/kun/src/graph/graph-tool-boundary.test.ts
@@ -34,6 +34,19 @@ describe('Graph tool boundary', () => {
     }, { orchestration: 'direct' })).toBe(true)
   })
 
+  it('keeps Lab explore_agent available on Graph Lead turns', () => {
+    expect(isToolAllowedInOrchestration({
+      toolName: 'explore_agent',
+      providerId: 'explore-agent',
+      providerKind: 'delegation'
+    }, { orchestration: 'graph' })).toBe(true)
+    expect(isToolAllowedInOrchestration({
+      toolName: 'explore_agent',
+      providerId: 'explore-agent',
+      providerKind: 'delegation'
+    }, { messageSource: 'graph_runtime' })).toBe(true)
+  })
+
   it('builds executor authority without ordinary or Graph orchestration tools', () => {
     const names = graphParentAuthorityToolNames([
       'read',
@@ -43,7 +56,8 @@ describe('Graph tool boundary', () => {
       'delegate_task',
       'list_subagent_profiles',
       'task_graph',
-      'design_component'
+      'design_component',
+      'explore_agent'
     ])
 
     expect(names).toEqual(['read'])
diff --git a/kun/src/graph/graph-tool-boundary.ts b/kun/src/graph/graph-tool-boundary.ts
index 21f3c5e84..4a9bea4e4 100644
--- a/kun/src/graph/graph-tool-boundary.ts
+++ b/kun/src/graph/graph-tool-boundary.ts
@@ -1,5 +1,9 @@
 import type { ToolHostContext, ToolProviderKind } from '../ports/tool-host.js'
 
+/** Keep as literals to avoid a cycle with explore-agent-tool-provider → capability-registry. */
+const EXPLORE_AGENT_TOOL_NAME = 'explore_agent'
+const EXPLORE_AGENT_PROVIDER_ID = 'explore-agent'
+
 export const GRAPH_LEAD_TOOL_NAMES = [
   'graph_define_plan',
   'graph_create_run',
@@ -23,6 +27,8 @@ export const GRAPH_WORKER_REPORT_TOOL_NAME = 'report_to_parent' as const
  * Ordinary orchestration surfaces conflict with host-owned Graph scheduling.
  * Provider-kind filtering covers current and future delegation tools; exact
  * names cover legacy DAG state and built-in wrappers that can spawn a child.
+ * Lab `explore_agent` is exempt from Lead listing (read-only investigation)
+ * but is still stripped from Worker assignment snapshots below.
  */
 export const GRAPH_INCOMPATIBLE_TOOL_NAMES = [
   'delegate_task',
@@ -44,6 +50,14 @@ export function isGraphLeadContext(
     context?.messageSource === 'graph_runtime'
 }
 
+function isExploreAgentTool(input: {
+  toolName: string
+  providerId: string
+}): boolean {
+  return input.toolName === EXPLORE_AGENT_TOOL_NAME ||
+    input.providerId === EXPLORE_AGENT_PROVIDER_ID
+}
+
 export function isToolAllowedInOrchestration(
   input: {
     toolName: string
@@ -53,6 +67,9 @@ export function isToolAllowedInOrchestration(
   context: Pick<ToolHostContext, 'orchestration' | 'messageSource'> | undefined
 ): boolean {
   if (!isGraphLeadContext(context)) return true
+  // Read-only Lab explore stays available on Graph Lead turns so planning can
+  // gather repository facts without ordinary delegate_task / child fan-out.
+  if (isExploreAgentTool(input)) return true
   if (input.providerKind === 'delegation' || input.providerId === 'delegation') {
     return false
   }
@@ -66,6 +83,7 @@ export function isToolAllowedInOrchestration(
  */
 export function graphParentAuthorityToolNames(toolNames: readonly string[]): string[] {
   return [...new Set(toolNames.filter((name) =>
+    name !== EXPLORE_AGENT_TOOL_NAME &&
     !INCOMPATIBLE_TOOL_NAMES.has(name) &&
     !LEAD_TOOL_NAMES.has(name) &&
     !WORKER_TOOL_NAMES.has(name) &&
diff --git a/kun/src/loop/agent-loop.ts b/kun/src/loop/agent-loop.ts
index 2c43cb378..9d3695b10 100644
--- a/kun/src/loop/agent-loop.ts
+++ b/kun/src/loop/agent-loop.ts
@@ -34,6 +34,7 @@ import type {
 import { ContextCompactor } from './context-compactor.js'
 import type { RolesConfig } from '../config/kun-config.js'
 import { InflightTracker } from './inflight-tracker.js'
+import { ToolCancellationRegistry } from './tool-cancellation-registry.js'
 import { SteeringQueue } from './steering-queue.js'
 import {
   createImmutablePrefix
@@ -141,6 +142,7 @@ export type AgentLoopOptions = {
   events: RuntimeEventRecorder
   turns: TurnService
   inflight: InflightTracker
+  toolCancellation?: ToolCancellationRegistry
   steering: SteeringQueue
   compactor: ContextCompactor
   prefix: ImmutablePrefix
@@ -289,7 +291,7 @@ export class AgentLoop {
 
   constructor(opts: AgentLoopOptions) {
     this.opts = opts
-    this.telemetry = new LoopTelemetry(opts.sessionStore)
+    this.telemetry = new LoopTelemetry()
     this.threadItems = new ThreadItemProjectionService({
       threadStore: opts.threadStore,
       sessionStore: opts.sessionStore,
@@ -362,6 +364,7 @@ export class AgentLoop {
     this.toolExecution = new ToolExecutionService({
       toolHost: opts.toolHost,
       inflight: opts.inflight,
+      toolCancellation: opts.toolCancellation,
       turns: opts.turns,
       events: opts.events,
       nowIso: opts.nowIso,
diff --git a/kun/src/loop/compaction-history.test.ts b/kun/src/loop/compaction-history.test.ts
index 6bd823ea0..d5c8eee1c 100644
--- a/kun/src/loop/compaction-history.test.ts
+++ b/kun/src/loop/compaction-history.test.ts
@@ -57,6 +57,7 @@ describe('compaction history projection', () => {
     expect(visible.map((item) => item.id)).toEqual([
       'item_head_a',
       'item_head_b',
+      'compaction_previous',
       'compaction_next',
       'item_tail_a',
       'item_tail_b'
@@ -116,7 +117,7 @@ describe('compaction history projection', () => {
     ])
   })
 
-  it('preserves manual compaction markers when coalescing automatic markers', () => {
+  it('preserves manual and automatic compaction markers with distinct identities', () => {
     const threadId = 'thread_1'
     const turnId = 'turn_1'
     const manualSummary = makeCompactionItem({
@@ -238,7 +239,7 @@ describe('compaction history projection', () => {
     ])
   })
 
-  it('coalesces old automatic markers while preserving manual compactions', () => {
+  it('preserves distinct automatic and manual markers in chronological order', () => {
     const threadId = 'thread_1'
     const turnId = 'turn_coalesce'
     const userMessage = {
@@ -291,6 +292,7 @@ describe('compaction history projection', () => {
       ]).map((item) => item.id)
     ).toEqual([
       'item_user_coalesce',
+      'compaction_old_auto',
       'compaction_manual',
       'compaction_latest_auto'
     ])
diff --git a/kun/src/loop/compaction-history.ts b/kun/src/loop/compaction-history.ts
index 916940381..bcd120459 100644
--- a/kun/src/loop/compaction-history.ts
+++ b/kun/src/loop/compaction-history.ts
@@ -17,10 +17,7 @@ export function insertCompactionIntoVisibleHistory(input: {
 }): TurnItem[] {
   const summaryIndex = input.compactedItems.findIndex((item) => item.id === input.summaryItem.id)
   if (summaryIndex < 0) {
-    return replaceOrAppendItem(
-      coalesceAutomaticCompactions(input.visibleItems, input.summaryItem),
-      input.summaryItem
-    )
+    return replaceOrAppendItem(input.visibleItems, input.summaryItem)
   }
 
   // Goal context is internal model history. `ContextCompactor` intentionally
@@ -38,10 +35,9 @@ export function insertCompactionIntoVisibleHistory(input: {
       .filter((item) => item.kind !== 'goal_context')
       .map((item) => item.id)
   )
-  const withoutSummary = coalesceAutomaticCompactions(
-    input.visibleItems,
-    input.summaryItem
-  ).filter((item) => item.id !== input.summaryItem.id && item.kind !== 'goal_context')
+  const withoutSummary = input.visibleItems.filter(
+    (item) => item.id !== input.summaryItem.id && item.kind !== 'goal_context'
+  )
   if (tailIds.size === 0) return [...withoutSummary, input.summaryItem, ...goalContexts]
 
   const insertIndex = withoutSummary.findIndex((item) => tailIds.has(item.id))
@@ -83,10 +79,9 @@ function replaceOrAppendItem(items: readonly TurnItem[], item: TurnItem): TurnIt
  * items move here; every other item keeps its established relative order.
  */
 export function placeCompactionsChronologically(items: readonly TurnItem[]): TurnItem[] {
-  const coalesced = coalesceAutomaticCompactions(items)
-  const indexed = coalesced.map((item, sourceIndex) => ({ item, sourceIndex }))
+  const indexed = items.map((item, sourceIndex) => ({ item, sourceIndex }))
   const compactions = indexed.filter(({ item }) => isVisibleCompaction(item))
-  if (compactions.length === 0) return coalesced
+  if (compactions.length === 0) return [...items]
 
   const timeline = indexed.filter(({ item }) => !isVisibleCompaction(item))
   const turnOwnerItemIds = new Map<string, string>()
@@ -159,22 +154,3 @@ function timelineEntryFollowsCompaction(
 function isVisibleCompaction(item: TurnItem): boolean {
   return item.kind === 'compaction' && item.replacedTokens > 0
 }
-
-/** Keep manual markers and only the newest automatic marker for each turn. */
-function coalesceAutomaticCompactions(
-  items: readonly TurnItem[],
-  incoming?: TurnItem
-): TurnItem[] {
-  const latestAutoByTurn = new Map<string, string>()
-  for (const item of [...items, ...(incoming ? [incoming] : [])]) {
-    if (isAutomaticCompaction(item)) latestAutoByTurn.set(item.turnId, item.id)
-  }
-  if (latestAutoByTurn.size === 0) return [...items]
-  return items.filter((item) =>
-    !isAutomaticCompaction(item) || latestAutoByTurn.get(item.turnId) === item.id
-  )
-}
-
-function isAutomaticCompaction(item: TurnItem): boolean {
-  return item.kind === 'compaction' && item.replacedTokens > 0 && item.auto !== false
-}
diff --git a/kun/src/loop/history-compaction-service.test.ts b/kun/src/loop/history-compaction-service.test.ts
index 56a0bb5ba..8306b085c 100644
--- a/kun/src/loop/history-compaction-service.test.ts
+++ b/kun/src/loop/history-compaction-service.test.ts
@@ -64,7 +64,6 @@ function modelCompactionService(
     events: createEvents(sessionStore),
     ids: new SequentialIdGenerator(),
     telemetry: {
-      hydratePromptPressureIfCold: async () => undefined,
       consumePromptPressure: () => undefined
     },
     recordGoalUsage: async () => undefined,
@@ -93,7 +92,6 @@ describe('HistoryCompactionService', () => {
       events: createEvents(sessionStore),
       ids: new SequentialIdGenerator(),
       telemetry: {
-        hydratePromptPressureIfCold: async () => undefined,
         consumePromptPressure: () => undefined
       },
       recordGoalUsage: async () => undefined,
@@ -172,7 +170,7 @@ describe('HistoryCompactionService', () => {
     })).toEqual({ providerId: 'EXT-CURRENT', accountId: 'account-current' })
   })
 
-  it('hydrates pressure, atomically writes the visible marker, then projects and reports it', async () => {
+  it('consumes live pressure, atomically writes the visible marker, then projects and reports it', async () => {
     const sessionStore = new InMemorySessionStore()
     for (let index = 0; index < 5; index += 1) {
       await sessionStore.appendItem(threadId, makeUserItem({
@@ -182,16 +180,9 @@ describe('HistoryCompactionService', () => {
         text: `older context ${index} ${'x'.repeat(120)}`
       }))
     }
-    const telemetryCalls: string[] = []
     const telemetry = {
-      hydratePromptPressureIfCold: vi.fn(async () => {
-        telemetryCalls.push('hydrate')
-      }),
-      consumePromptPressure: vi.fn(() => {
-        telemetryCalls.push('consume')
-        return undefined
-      })
-    } as unknown as Pick<LoopTelemetry, 'hydratePromptPressureIfCold' | 'consumePromptPressure'>
+      consumePromptPressure: vi.fn(() => undefined)
+    } as unknown as Pick<LoopTelemetry, 'consumePromptPressure'>
     const effectOrder: string[] = []
     const service = new HistoryCompactionService({
       sessionStore,
@@ -219,7 +210,7 @@ describe('HistoryCompactionService', () => {
       turnId
     })).history
 
-    expect(telemetryCalls).toEqual(['hydrate', 'consume'])
+    expect(telemetry.consumePromptPressure).toHaveBeenCalledWith(threadId, 'test-model')
     expect(history[0]).toMatchObject({ kind: 'compaction', id: 'compaction_1' })
     expect(effectOrder).toEqual([`clear:${threadId}`, `project:${threadId}`])
     const persisted = await sessionStore.loadItems(threadId)
@@ -249,7 +240,6 @@ describe('HistoryCompactionService', () => {
       events: createEvents(sessionStore),
       ids: new SequentialIdGenerator(),
       telemetry: {
-        hydratePromptPressureIfCold: async () => undefined,
         consumePromptPressure: () => undefined
       },
       recordGoalUsage: async () => undefined,
@@ -279,9 +269,8 @@ describe('HistoryCompactionService', () => {
     const sessionStore = new InMemorySessionStore()
     const item = makeUserItem({ id: 'item_only', threadId, turnId, text: 'short' })
     const telemetry = {
-      hydratePromptPressureIfCold: vi.fn(async () => undefined),
       consumePromptPressure: vi.fn(() => undefined)
-    } as unknown as Pick<LoopTelemetry, 'hydratePromptPressureIfCold' | 'consumePromptPressure'>
+    } as unknown as Pick<LoopTelemetry, 'consumePromptPressure'>
     const rewriteThreadItemsFromSession = vi.fn(async () => undefined)
     const service = new HistoryCompactionService({
       sessionStore,
@@ -307,7 +296,6 @@ describe('HistoryCompactionService', () => {
 
     expect(history).toBe(inputItems)
     expect(history).toEqual([item])
-    expect(telemetry.hydratePromptPressureIfCold).toHaveBeenCalledWith(threadId, 'test-model')
     expect(telemetry.consumePromptPressure).toHaveBeenCalledWith(threadId, 'test-model')
     expect(rewriteThreadItemsFromSession).not.toHaveBeenCalled()
     await expect(sessionStore.loadItems(threadId)).resolves.toEqual([])
@@ -332,7 +320,6 @@ describe('HistoryCompactionService', () => {
       events: createEvents(sessionStore),
       ids: new SequentialIdGenerator(),
       telemetry: {
-        hydratePromptPressureIfCold: async () => undefined,
         consumePromptPressure: () => undefined
       },
       recordGoalUsage: async () => undefined,
@@ -386,7 +373,6 @@ describe('HistoryCompactionService', () => {
       events: createEvents(sessionStore),
       ids: new SequentialIdGenerator(),
       telemetry: {
-        hydratePromptPressureIfCold: async () => undefined,
         consumePromptPressure: () => undefined
       },
       recordGoalUsage: async () => undefined,
@@ -497,7 +483,6 @@ describe('HistoryCompactionService', () => {
       events: createEvents(sessionStore),
       ids: new SequentialIdGenerator(),
       telemetry: {
-        hydratePromptPressureIfCold: async () => undefined,
         consumePromptPressure: () => undefined
       },
       recordGoalUsage,
diff --git a/kun/src/loop/history-compaction-service.ts b/kun/src/loop/history-compaction-service.ts
index f2ef69adc..bffe8b630 100644
--- a/kun/src/loop/history-compaction-service.ts
+++ b/kun/src/loop/history-compaction-service.ts
@@ -33,7 +33,7 @@ export type HistoryCompactionServiceDeps = {
   usage: UsageService
   events: RuntimeEventRecorder
   ids: IdGenerator
-  telemetry: Pick<LoopTelemetry, 'hydratePromptPressureIfCold' | 'consumePromptPressure'>
+  telemetry: Pick<LoopTelemetry, 'consumePromptPressure'>
   recordGoalUsage: (threadId: string, tokens: number) => Promise<void>
   /** Read live runtime config so hot-apply affects future compactions. */
   getContextCompaction?: () => ContextCompactionConfig | undefined
@@ -97,7 +97,6 @@ export class HistoryCompactionService {
     allowModelSummary?: boolean
     reserveModelRequest?: () => Promise<{ allowed: boolean; reason?: string }>
   }): Promise<HistoryCompactionOutcome> {
-    await this.deps.telemetry.hydratePromptPressureIfCold(input.threadId, input.model)
     const pressure = this.deps.telemetry.consumePromptPressure(input.threadId, input.model)
     const thresholdModel = pressure?.model || input.model
     const overheadTokens = input.requestOverheadTokens === undefined
diff --git a/kun/src/loop/loop-telemetry.test.ts b/kun/src/loop/loop-telemetry.test.ts
index ee65d38f9..5b4258e56 100644
--- a/kun/src/loop/loop-telemetry.test.ts
+++ b/kun/src/loop/loop-telemetry.test.ts
@@ -1,28 +1,15 @@
-import { describe, expect, it, vi } from 'vitest'
-import type { SessionStore } from '../ports/session-store.js'
+import { describe, expect, it } from 'vitest'
 import { LoopTelemetry } from './loop-telemetry.js'
 
 describe('LoopTelemetry', () => {
-  it('hydrates the latest positive persisted prompt pressure only once', async () => {
-    const loadUsageRecords = vi.fn().mockResolvedValue([
-      { threadId: 'thread_1', model: 'older', usage: { promptTokens: 10 } },
-      { threadId: 'thread_1', model: '', usage: { promptTokens: 30 } },
-      { threadId: 'other', model: 'other', usage: { promptTokens: 100 } }
-    ])
-    const telemetry = new LoopTelemetry({ loadUsageRecords } as unknown as SessionStore)
+  it('starts without pressure instead of restoring cumulative usage', () => {
+    const telemetry = new LoopTelemetry()
 
-    await telemetry.hydratePromptPressureIfCold('thread_1', 'fallback')
-
-    expect(telemetry.consumePromptPressure('thread_1', 'fallback')).toEqual({
-      model: 'fallback',
-      promptTokens: 30
-    })
-    await telemetry.hydratePromptPressureIfCold('thread_1', 'fallback')
-    expect(loadUsageRecords).toHaveBeenCalledTimes(1)
+    expect(telemetry.consumePromptPressure('thread_1', 'fallback')).toBeUndefined()
   })
 
   it('keeps the highest prompt pressure seen before compaction consumes it', () => {
-    const telemetry = new LoopTelemetry({} as unknown as SessionStore)
+    const telemetry = new LoopTelemetry()
 
     telemetry.recordPromptPressure('thread_1', 'first', 20)
     telemetry.recordPromptPressure('thread_1', 'smaller', 10)
@@ -36,7 +23,7 @@ describe('LoopTelemetry', () => {
   })
 
   it('classifies additive and breaking tool catalog changes without persistence side effects', () => {
-    const telemetry = new LoopTelemetry({} as unknown as SessionStore)
+    const telemetry = new LoopTelemetry()
     const base = {
       threadId: 'thread_1',
       workspace: '/workspace',
diff --git a/kun/src/loop/loop-telemetry.ts b/kun/src/loop/loop-telemetry.ts
index 789979506..7636c1b81 100644
--- a/kun/src/loop/loop-telemetry.ts
+++ b/kun/src/loop/loop-telemetry.ts
@@ -1,8 +1,6 @@
 import type { GuiDesignArtifactContext } from '../ports/tool-host.js'
-import type { SessionStore } from '../ports/session-store.js'
 
 const MAX_TOOL_CATALOG_SNAPSHOTS = 256
-const MAX_HYDRATED_PRESSURE_THREADS = 512
 
 type ToolCatalogSnapshot = {
   fingerprint: string
@@ -38,12 +36,8 @@ export type ToolCatalogFingerprintInput = {
  */
 export class LoopTelemetry {
   private readonly promptTokenPressure = new Map<string, { model: string; promptTokens: number }>()
-  /** Threads for which a one-time pressure hydration from persisted usage was already attempted. */
-  private readonly hydratedPressureThreads = new Set<string>()
   private readonly toolCatalogSnapshots = new Map<string, ToolCatalogSnapshot>()
 
-  constructor(private readonly sessionStore: SessionStore) {}
-
   recordPromptPressure(threadId: string, model: string, promptTokens: number): void {
     if (!threadId || promptTokens <= 0) return
     const current = this.promptTokenPressure.get(threadId)
@@ -51,40 +45,6 @@ export class LoopTelemetry {
     this.promptTokenPressure.set(threadId, { model, promptTokens })
   }
 
-  /**
-   * Seed prompt pressure from persisted request usage once per thread and
-   * process. This keeps a restart from underestimating a history that already
-   * includes a large system prompt or tool catalog. Failure is intentionally
-   * best-effort; the caller's local estimator remains the fallback.
-   */
-  async hydratePromptPressureIfCold(threadId: string, fallbackModel: string): Promise<void> {
-    if (!threadId) return
-    if (this.promptTokenPressure.has(threadId)) return
-    if (this.hydratedPressureThreads.has(threadId)) return
-    const loadUsageRecords = this.sessionStore.loadUsageRecords
-    if (typeof loadUsageRecords !== 'function') {
-      this.rememberHydratedPressureThread(threadId)
-      return
-    }
-    try {
-      const records = await loadUsageRecords.call(this.sessionStore, { threadId })
-      let restored: { model: string; promptTokens: number } | undefined
-      for (const record of records) {
-        if (record.threadId !== threadId) continue
-        const promptTokens = Math.floor(record.usage?.promptTokens ?? 0)
-        if (promptTokens > 0) {
-          restored = { model: record.model || fallbackModel, promptTokens }
-        }
-      }
-      if (restored && !this.promptTokenPressure.has(threadId)) {
-        this.promptTokenPressure.set(threadId, restored)
-      }
-      this.rememberHydratedPressureThread(threadId)
-    } catch {
-      // Best-effort restore; the estimator + overhead floor still applies.
-    }
-  }
-
   consumePromptPressure(
     threadId: string,
     model: string
@@ -134,14 +94,6 @@ export class LoopTelemetry {
       : { kind: 'breaking', previous }
   }
 
-  private rememberHydratedPressureThread(threadId: string): void {
-    this.hydratedPressureThreads.delete(threadId)
-    this.hydratedPressureThreads.add(threadId)
-    if (this.hydratedPressureThreads.size > MAX_HYDRATED_PRESSURE_THREADS) {
-      const oldest = this.hydratedPressureThreads.values().next().value
-      if (oldest !== undefined) this.hydratedPressureThreads.delete(oldest)
-    }
-  }
 }
 
 function isAdditiveToolCatalogChange(previous: ToolCatalogSnapshot, current: ToolCatalogSnapshot): boolean {
diff --git a/kun/src/loop/model-request-composer.test.ts b/kun/src/loop/model-request-composer.test.ts
index 8fb6b0d95..988381479 100644
--- a/kun/src/loop/model-request-composer.test.ts
+++ b/kun/src/loop/model-request-composer.test.ts
@@ -15,17 +15,27 @@ const emptyAttachments = {
 } as const
 
 describe('composeModelRequest', () => {
-  it('clamps declared output to the remaining safe context capacity', () => {
+  it('bounds model output capability by the ordinary reservation and remaining capacity', () => {
     expect(effectiveOutputBudgetTokens({
       inputTokens: 14_236,
       contextCapTokens: 111_411,
       declaredMaxOutputTokens: 128_000
-    })).toBe(97_175)
+    })).toBe(32_768)
     expect(effectiveOutputBudgetTokens({
       inputTokens: 14_236,
       contextCapTokens: 111_411,
       declaredMaxOutputTokens: 500_000
-    })).toBe(97_175)
+    })).toBe(32_768)
+    expect(effectiveOutputBudgetTokens({
+      inputTokens: 14_236,
+      contextCapTokens: 111_411,
+      declaredMaxOutputTokens: 8_000
+    })).toBe(8_000)
+    expect(effectiveOutputBudgetTokens({
+      inputTokens: 105_000,
+      contextCapTokens: 111_411,
+      declaredMaxOutputTokens: 128_000
+    })).toBe(6_411)
   })
 
   it('uses a finite fallback when a model has no output metadata', () => {
diff --git a/kun/src/loop/model-request-composer.ts b/kun/src/loop/model-request-composer.ts
index 51028b701..bd5bd90a1 100644
--- a/kun/src/loop/model-request-composer.ts
+++ b/kun/src/loop/model-request-composer.ts
@@ -32,7 +32,12 @@ export function effectiveOutputBudgetTokens(input: {
     ? fallback
     : Math.max(1, Math.floor(input.declaredMaxOutputTokens))
   const remaining = Math.max(1, Math.floor(input.contextCapTokens - input.inputTokens))
-  return Math.min(declared, remaining)
+  // `maxOutputTokens` is provider capability metadata, not an instruction to
+  // reserve the model's entire maximum on every request. Keep the ordinary
+  // request reservation bounded by the runtime default; smaller model limits
+  // remain authoritative, and the final request is still clamped to the
+  // remaining safe context capacity.
+  return Math.min(declared, fallback, remaining)
 }
 
 export type ModelRequestComposerInput = Readonly<{
diff --git a/kun/src/loop/model-round-engine.ts b/kun/src/loop/model-round-engine.ts
index 9e07a5266..cafc85820 100644
--- a/kun/src/loop/model-round-engine.ts
+++ b/kun/src/loop/model-round-engine.ts
@@ -361,7 +361,12 @@ export class ModelRoundEngine {
                 input.request.model,
                 intent.usage.promptTokens
               )
-              const usage = this.deps.usage.record(input.threadId, intent.usage, input.cacheSignature)
+              const usage = this.deps.usage.record(
+                input.threadId,
+                intent.usage,
+                input.cacheSignature,
+                input.turnId
+              )
               await this.deps.recordGoalUsage(input.threadId, intent.usage.totalTokens)
               await this.deps.events.record({
                 kind: 'usage',
diff --git a/kun/src/loop/model-step-service.ts b/kun/src/loop/model-step-service.ts
index 58ab5a403..8c942e013 100644
--- a/kun/src/loop/model-step-service.ts
+++ b/kun/src/loop/model-step-service.ts
@@ -709,26 +709,34 @@ export class ModelStepService {
       signal
     }).sentInputTokens
     // Share one capacity model between the compaction preflight and the
-    // send-time guard. The output budget is reserved for this request's
-    // completion, so compaction must treat `input + output` as the real
-    // pressure instead of only comparing input against the soft threshold.
+    // send-time guard. `maxOutputTokens` is a capability ceiling, so first
+    // derive the bounded ordinary reservation independently from the current
+    // input. Final request construction may only lower this preferred value
+    // when the rebuilt request leaves less room under the hard cap.
     const declaredOutputBudgetTokens = modelCapabilities.maxOutputTokens
     const requestHardCapTokens = modelCapabilities.contextWindowTokens
       ? Math.floor(modelCapabilities.contextWindowTokens * 0.85)
       : this.deps.compactor.hardCap(model, providerId)
-    // Use the request overhead as the conservative input floor during compaction;
-    // the final request is recalculated after history/image rehydration.
-    const effectiveBudget = (inputTokens: number): number =>
+    const preferredOutputBudgetTokens =
       modelCapabilities.endpointFormat === 'messages' && declaredOutputBudgetTokens === undefined
         ? 0
         : effectiveOutputBudgetTokens({
-            inputTokens,
+            inputTokens: 0,
             contextCapTokens: requestHardCapTokens,
             ...(declaredOutputBudgetTokens !== undefined
               ? { declaredMaxOutputTokens: declaredOutputBudgetTokens }
               : {})
           })
-    let outputBudgetTokens = effectiveBudget(requestOverheadTokens)
+    const effectiveBudget = (inputTokens: number): number =>
+      preferredOutputBudgetTokens === 0
+        ? 0
+        : effectiveOutputBudgetTokens({
+            inputTokens,
+            contextCapTokens: requestHardCapTokens,
+            declaredMaxOutputTokens: preferredOutputBudgetTokens,
+            fallbackTokens: preferredOutputBudgetTokens
+          })
+    let outputBudgetTokens = preferredOutputBudgetTokens
     // History compaction retries from the latest canonical snapshot to avoid
     // losing concurrent writes. That snapshot deliberately retains internal
     // goal records, including records for goals that later ended or changed.
diff --git a/kun/src/loop/model-timing-decorator.test.ts b/kun/src/loop/model-timing-decorator.test.ts
new file mode 100644
index 000000000..34cf22233
--- /dev/null
+++ b/kun/src/loop/model-timing-decorator.test.ts
@@ -0,0 +1,119 @@
+import { describe, expect, it } from 'vitest'
+import type { ModelClient, ModelStreamChunk } from '../ports/model-client.js'
+import { emptyUsageSnapshot } from '../contracts/usage.js'
+import { withModelTiming } from './model-timing-decorator.js'
+
+function makeClient(chunks: ModelStreamChunk[], clock: { value: number }): ModelClient {
+  return {
+    provider: 'test',
+    model: 'test-model',
+    async *stream() {
+      for (const chunk of chunks) {
+        // Simulate network/provider latency so the decorator observes
+        // non-zero TTFT and generation durations.
+        clock.value += 250
+        yield chunk
+      }
+    }
+  }
+}
+
+const usageChunk = (completionTokens = 10): ModelStreamChunk => ({
+  kind: 'usage',
+  usage: { ...emptyUsageSnapshot(), completionTokens, totalTokens: completionTokens }
+})
+
+async function drain(stream: AsyncIterable<ModelStreamChunk>): Promise<ModelStreamChunk[]> {
+  const out: ModelStreamChunk[] = []
+  for await (const chunk of stream) out.push(chunk)
+  return out
+}
+
+describe('withModelTiming', () => {
+  it('attaches TTFT and generation duration to the usage chunk of a text stream', async () => {
+    const clock = { value: 0 }
+    const client = withModelTiming(makeClient([
+      { kind: 'assistant_text_delta', text: 'a' },
+      { kind: 'assistant_text_delta', text: 'b' },
+      usageChunk(),
+      { kind: 'completed', stopReason: 'stop' }
+    ], clock), { now: () => clock.value })
+
+    const chunks = await drain(client.stream({
+      threadId: 't', turnId: 'turn', model: 'm', prefix: [], history: [],
+      tools: [], abortSignal: new AbortController().signal
+    }))
+    const usage = chunks.find((chunk) => chunk.kind === 'usage')
+    expect(usage).toBeDefined()
+    if (usage && usage.kind === 'usage') {
+      // First text chunk arrived at 250ms; usage at 750ms.
+      expect(usage.usage.requestTtftMs).toBe(250)
+      expect(usage.usage.requestGenerationMs).toBe(500)
+    }
+  })
+
+  it('falls back to the first tool chunk for pure tool-call rounds', async () => {
+    const clock = { value: 0 }
+    const client = withModelTiming(makeClient([
+      { kind: 'tool_call_complete', callId: 'call_1', toolName: 'read', arguments: {} },
+      usageChunk(5),
+      { kind: 'completed', stopReason: 'tool_calls' }
+    ], clock), { now: () => clock.value })
+
+    const chunks = await drain(client.stream({
+      threadId: 't', turnId: 'turn', model: 'm', prefix: [], history: [],
+      tools: [], abortSignal: new AbortController().signal
+    }))
+    const usage = chunks.find((chunk) => chunk.kind === 'usage')
+    if (usage && usage.kind === 'usage') {
+      expect(usage.usage.requestTtftMs).toBe(250)
+      expect(usage.usage.requestGenerationMs).toBe(250)
+    }
+  })
+
+  it('passes streams without a usage chunk through unchanged', async () => {
+    const clock = { value: 0 }
+    const client = withModelTiming(makeClient([
+      { kind: 'assistant_text_delta', text: 'hello' },
+      { kind: 'completed', stopReason: 'stop' }
+    ], clock), { now: () => clock.value })
+
+    const chunks = await drain(client.stream({
+      threadId: 't', turnId: 'turn', model: 'm', prefix: [], history: [],
+      tools: [], abortSignal: new AbortController().signal
+    }))
+    expect(chunks).toEqual([
+      { kind: 'assistant_text_delta', text: 'hello' },
+      { kind: 'completed', stopReason: 'stop' }
+    ])
+  })
+
+  it('does not time a stream that errors before any content chunk', async () => {
+    const clock = { value: 0 }
+    const client = withModelTiming(makeClient([
+      { kind: 'error', message: 'boom' }
+    ], clock), { now: () => clock.value })
+
+    const chunks = await drain(client.stream({
+      threadId: 't', turnId: 'turn', model: 'm', prefix: [], history: [],
+      tools: [], abortSignal: new AbortController().signal
+    }))
+    expect(chunks).toEqual([{ kind: 'error', message: 'boom' }])
+  })
+
+  it('preserves chunk metadata such as route identity', async () => {
+    const clock = { value: 0 }
+    const route = { routePoolId: 'p', targetId: 'x', providerId: 'prov', modelId: 'm', requestedModelId: 'alias' }
+    const client = withModelTiming(makeClient([
+      { kind: 'assistant_text_delta', text: 'a' },
+      { ...usageChunk(), route }
+    ], clock), { now: () => clock.value })
+
+    const chunks = await drain(client.stream({
+      threadId: 't', turnId: 'turn', model: 'm', prefix: [], history: [],
+      tools: [], abortSignal: new AbortController().signal
+    }))
+    const usage = chunks.find((chunk) => chunk.kind === 'usage')
+    expect(usage?.route).toEqual({ routePoolId: 'p', targetId: 'x', providerId: 'prov', modelId: 'm', requestedModelId: 'alias' })
+  })
+})
diff --git a/kun/src/loop/model-timing-decorator.ts b/kun/src/loop/model-timing-decorator.ts
new file mode 100644
index 000000000..b2c1d9dbc
--- /dev/null
+++ b/kun/src/loop/model-timing-decorator.ts
@@ -0,0 +1,74 @@
+import type {
+  ModelClient,
+  ModelRequest,
+  ModelStreamChunk
+} from '../ports/model-client.js'
+
+/**
+ * Chunks that represent actual model output (as opposed to transport
+ * bookkeeping such as retries, usage, completion, or error markers). The
+ * first such chunk marks the end of time-to-first-token; pure tool-call
+ * rounds fall back to their first tool chunk so they still get a TTFT.
+ */
+function isContentChunk(chunk: ModelStreamChunk): boolean {
+  return (
+    chunk.kind === 'assistant_text_delta' ||
+    chunk.kind === 'assistant_reasoning_delta' ||
+    chunk.kind === 'tool_call_delta' ||
+    chunk.kind === 'tool_call_complete' ||
+    chunk.kind === 'image_generation_complete'
+  )
+}
+
+/**
+ * Wraps a `ModelClient` so every streamed response carries per-request
+ * timing on its `usage` chunk:
+ *
+ * - `requestTtftMs`: request start -> first content chunk (TTFT).
+ * - `requestGenerationMs`: first content chunk -> usage chunk (used with
+ *   `completionTokens` to derive tokens-per-second).
+ *
+ * The wrapper never modifies the underlying provider parsing; it only
+ * clones the usage snapshot to attach timing. Streams without a usage
+ * chunk (or without any content chunk) pass through unchanged.
+ */
+export function withModelTiming(
+  client: ModelClient,
+  options: { now?: () => number } = {}
+): ModelClient {
+  const now = options.now ?? ((): number => performance.now())
+  return {
+    ...client,
+    stream(request: ModelRequest): AsyncIterable<ModelStreamChunk> {
+      return timedStream(client.stream(request), now)
+    }
+  }
+}
+
+async function* timedStream(
+  stream: AsyncIterable<ModelStreamChunk>,
+  now: () => number
+): AsyncIterable<ModelStreamChunk> {
+  const startedAt = now()
+  let firstChunkAt: number | null = null
+  for await (const chunk of stream) {
+    if (firstChunkAt === null && isContentChunk(chunk)) {
+      firstChunkAt = now()
+    }
+    if (chunk.kind === 'usage' && firstChunkAt !== null) {
+      const usageAt = now()
+      const ttftMs = Math.max(0, Math.round(firstChunkAt - startedAt))
+      const generationMs = Math.max(0, Math.round(usageAt - firstChunkAt))
+      yield {
+        ...chunk,
+        usage: {
+          ...chunk.usage,
+          requestTtftMs: ttftMs,
+          requestGenerationMs: generationMs
+        }
+      }
+      continue
+    }
+    yield chunk
+  }
+}
diff --git a/kun/src/loop/plan-mode.ts b/kun/src/loop/plan-mode.ts
index 1bd9fed96..32410236a 100644
--- a/kun/src/loop/plan-mode.ts
+++ b/kun/src/loop/plan-mode.ts
@@ -12,7 +12,7 @@ import { VERIFY_CHANGES_TOOL_NAME } from '../adapters/tool/builtin-verify-tool.j
  */
 export const PLAN_MODE_INSTRUCTION = [
   'You are in Plan mode.',
-  'Investigate the task first using the available read-only tools: prefer `repo_map`, `read`, `grep`, `glob`, and `ls`, and use `git_inspect` for repository status, branches, history, revisions, diffs, and merge-base checks.',
+  'Investigate the task first using the available read-only tools: when `explore_agent` is available, prefer it for repository or project exploration (file lookup, code/keyword search, symbol and call-path tracing, architecture or behavior inspection); otherwise prefer `repo_map`, `read`, `grep`, `glob`, and `ls`. Use `git_inspect` for repository status, branches, history, revisions, diffs, and merge-base checks.',
   'You may use `write` and `edit` only for Markdown (`.md`) working documents. The host rejects every other file mutation in this mode, including attempts through symlinks.',
   'Do NOT run mutating shell commands or invoke tools with unknown/external side effects in this mode.',
   'If the request is ambiguous or hinges on a decision only the user can make, ask before planning: prefer the `user_input` tool to ask one concise round of clarifying questions (offer concrete options when there are any), then use the answer to write the plan in the same turn. If that tool is not available, end your turn with the question(s) in prose and wait for the answer. Either way, do NOT call `create_plan` until the ambiguity is resolved — a set of options the user still has to choose between is not a plan.',
diff --git a/kun/src/loop/tool-call-dispatcher.test.ts b/kun/src/loop/tool-call-dispatcher.test.ts
index 53104b3ac..5b2a8455d 100644
--- a/kun/src/loop/tool-call-dispatcher.test.ts
+++ b/kun/src/loop/tool-call-dispatcher.test.ts
@@ -97,6 +97,45 @@ describe('ToolCallDispatcher', () => {
     expect(executed).toEqual(['read', 'grep'])
   })
 
+  it('continues a parallel batch when one result is a tool-level cancellation', async () => {
+    const persisted: Array<{ callId: string; isError?: boolean }> = []
+    const dispatcher = new ToolCallDispatcher({
+      executeSafely: vi.fn(async (input: { call: ToolCallLike }) => {
+        if (input.call.callId === 'read_1') {
+          return {
+            item: makeToolResultItem({
+              id: 'item_read_1',
+              threadId: 'thread_1',
+              turnId: 'turn_1',
+              callId: 'read_1',
+              toolName: input.call.toolName,
+              output: { code: 'tool_cancelled_by_user' },
+              isError: true
+            }),
+            approved: false
+          }
+        }
+        return resultFor(input.call)
+      }),
+      persistResult: vi.fn(async (_threadId: string, _turnId: string, entry: ToolCallLike, result: ToolHostResult) => {
+        persisted.push({
+          callId: entry.callId,
+          isError: result.item.kind === 'tool_result' ? result.item.isError : undefined
+        })
+      }),
+      persistSuppressed: vi.fn(async () => undefined)
+    } as never)
+
+    await expect(dispatcher.dispatch({
+      dispatch: dispatchInput([call('read', 'read_1'), call('grep', 'grep_1')]),
+      context
+    })).resolves.toBe('continue')
+    expect(persisted).toEqual([
+      { callId: 'read_1', isError: true },
+      { callId: 'grep_1', isError: false }
+    ])
+  })
+
   it('reports all-suppressed only when no call executes', async () => {
     const persistSuppressed = vi.fn(async () => undefined)
     const dispatcher = new ToolCallDispatcher({
diff --git a/kun/src/loop/tool-cancellation-registry.test.ts b/kun/src/loop/tool-cancellation-registry.test.ts
new file mode 100644
index 000000000..d64d7fcc8
--- /dev/null
+++ b/kun/src/loop/tool-cancellation-registry.test.ts
@@ -0,0 +1,62 @@
+import { describe, expect, it } from 'vitest'
+import {
+  ToolCancellationRegistry,
+  ToolExecutionCancelledError
+} from './tool-cancellation-registry.js'
+
+describe('ToolCancellationRegistry', () => {
+  it('isolates a child cancellation from the parent and sibling tools', () => {
+    const registry = new ToolCancellationRegistry()
+    const parent = new AbortController()
+    const first = registry.register(
+      { threadId: 'thread', turnId: 'turn', callId: 'first' },
+      parent.signal
+    )
+    const second = registry.register(
+      { threadId: 'thread', turnId: 'turn', callId: 'second' },
+      parent.signal
+    )
+
+    expect(registry.request(
+      { threadId: 'thread', turnId: 'turn', callId: 'first' },
+      '2026-08-07T00:00:00.000Z'
+    )).toBe('cancellation_requested')
+    expect(first.signal.aborted).toBe(true)
+    expect(first.wasCancelledByUser()).toBe(true)
+    expect(second.signal.aborted).toBe(false)
+    expect(registry.request(
+      { threadId: 'thread', turnId: 'turn', callId: 'first' },
+      '2026-08-07T00:00:01.000Z'
+    )).toBe('already_requested')
+  })
+
+  it('propagates a parent turn abort without treating it as a user tool cancel', () => {
+    const registry = new ToolCancellationRegistry()
+    const parent = new AbortController()
+    const child = registry.register(
+      { threadId: 'thread', turnId: 'turn', callId: 'call' },
+      parent.signal
+    )
+
+    parent.abort(new Error('turn interrupted'))
+
+    expect(child.signal.aborted).toBe(true)
+    expect(child.wasCancelledByUser()).toBe(false)
+    expect(registry.request(
+      { threadId: 'thread', turnId: 'turn', callId: 'call' },
+      '2026-08-07T00:00:00.000Z'
+    )).toBe('turn_aborted')
+    expect(ToolExecutionCancelledError).toBeDefined()
+  })
+
+  it('removes handles when a tool settles', () => {
+    const registry = new ToolCancellationRegistry()
+    const registration = registry.register(
+      { threadId: 'thread', turnId: 'turn', callId: 'call' },
+      new AbortController().signal
+    )
+    registration.dispose()
+    expect(registry.has({ threadId: 'thread', turnId: 'turn', callId: 'call' })).toBe(false)
+    expect(registry.list()).toEqual([])
+  })
+})
diff --git a/kun/src/loop/tool-cancellation-registry.ts b/kun/src/loop/tool-cancellation-registry.ts
new file mode 100644
index 000000000..b3f204340
--- /dev/null
+++ b/kun/src/loop/tool-cancellation-registry.ts
@@ -0,0 +1,111 @@
+/**
+ * Process-local cancellation handles for foreground tool executions.
+ *
+ * A turn owns the parent abort signal. Each tool gets a child signal so a
+ * user can stop one tool while the rest of the model step continues. The
+ * registry is intentionally independent from AgentLoop instances because
+ * model/provider hot reload replaces the loop while active executions may
+ * still belong to the previous instance.
+ */
+
+export const TOOL_CANCELLED_BY_USER_CODE = 'tool_cancelled_by_user'
+
+export class ToolExecutionCancelledError extends Error {
+  readonly code = TOOL_CANCELLED_BY_USER_CODE
+
+  constructor() {
+    super('Tool execution was stopped by the user.')
+    this.name = 'ToolExecutionCancelledError'
+  }
+}
+
+export type ToolCancellationKey = {
+  threadId: string
+  turnId: string
+  callId: string
+}
+
+type ActiveToolCancellation = ToolCancellationKey & {
+  controller: AbortController
+  requestedAt?: string
+  detachParent: () => void
+}
+
+export type ToolCancellationRegistration = {
+  signal: AbortSignal
+  wasCancelledByUser: () => boolean
+  dispose: () => void
+}
+
+export type ToolCancellationRequestStatus =
+  | 'cancellation_requested'
+  | 'already_requested'
+  | 'not_found'
+  | 'turn_aborted'
+
+function keyFor(input: ToolCancellationKey): string {
+  return `${input.threadId}\u0000${input.turnId}\u0000${input.callId}`
+}
+
+function isUserCancellationReason(reason: unknown): boolean {
+  return reason instanceof ToolExecutionCancelledError ||
+    (reason instanceof Error && reason.name === 'ToolExecutionCancelledError')
+}
+
+export class ToolCancellationRegistry {
+  private readonly active = new Map<string, ActiveToolCancellation>()
+
+  register(
+    input: ToolCancellationKey,
+    parentSignal: AbortSignal
+  ): ToolCancellationRegistration {
+    const controller = new AbortController()
+    const key = keyFor(input)
+    const onParentAbort = (): void => {
+      if (!controller.signal.aborted) controller.abort(parentSignal.reason)
+    }
+    parentSignal.addEventListener('abort', onParentAbort, { once: true })
+
+    const entry: ActiveToolCancellation = {
+      ...input,
+      controller,
+      detachParent: () => parentSignal.removeEventListener('abort', onParentAbort)
+    }
+    this.active.set(key, entry)
+    if (parentSignal.aborted) onParentAbort()
+
+    let disposed = false
+    return {
+      signal: controller.signal,
+      wasCancelledByUser: () => isUserCancellationReason(controller.signal.reason),
+      dispose: () => {
+        if (disposed) return
+        disposed = true
+        entry.detachParent()
+        if (this.active.get(key) === entry) this.active.delete(key)
+      }
+    }
+  }
+
+  request(input: ToolCancellationKey, requestedAt: string): ToolCancellationRequestStatus {
+    const entry = this.active.get(keyFor(input))
+    if (!entry) return 'not_found'
+    if (entry.requestedAt) return 'already_requested'
+    if (entry.controller.signal.aborted) return 'turn_aborted'
+    entry.requestedAt = requestedAt
+    entry.controller.abort(new ToolExecutionCancelledError())
+    return 'cancellation_requested'
+  }
+
+  has(input: ToolCancellationKey): boolean {
+    return this.active.has(keyFor(input))
+  }
+
+  list(): ToolCancellationKey[] {
+    return [...this.active.values()].map(({ threadId, turnId, callId }) => ({
+      threadId,
+      turnId,
+      callId
+    }))
+  }
+}
diff --git a/kun/src/loop/tool-dispatch-policy.test.ts b/kun/src/loop/tool-dispatch-policy.test.ts
index 723590b51..8878ec681 100644
--- a/kun/src/loop/tool-dispatch-policy.test.ts
+++ b/kun/src/loop/tool-dispatch-policy.test.ts
@@ -38,20 +38,31 @@ describe('tool dispatch policy', () => {
     expect(classifyToolDispatchLane(call('write'), builtIn)).toBe('serial')
   })
 
-  it('classifies only delegation-provider delegate_task calls as parallel delegation', () => {
-    const delegated = policy('auto', { delegate_task: 'delegation' })
+  it('classifies delegation-provider delegate_task and explore_agent as parallel delegation', () => {
+    const delegated = policy('auto', {
+      delegate_task: 'delegation',
+      explore_agent: 'delegation'
+    })
 
     expect(classifyToolDispatchLane(call('delegate_task'), delegated)).toBe('delegation')
+    expect(classifyToolDispatchLane(call('explore_agent'), delegated)).toBe('delegation')
     expect(isParallelDelegationCall(call('delegate_task'), delegated)).toBe(true)
+    expect(isParallelDelegationCall(call('explore_agent'), delegated)).toBe(true)
     expect(isParallelDelegationCall(call('delegate_task'), policy('auto', { delegate_task: 'built-in' }))).toBe(false)
+    expect(isParallelDelegationCall(call('explore_agent'), policy('auto', { explore_agent: 'built-in' }))).toBe(false)
   })
 
   it.each(['always', 'untrusted', 'never'] as const)(
     'keeps %s policy calls serial',
     (approvalPolicy) => {
-      const current = policy(approvalPolicy, { read: 'built-in', delegate_task: 'delegation' })
+      const current = policy(approvalPolicy, {
+        read: 'built-in',
+        delegate_task: 'delegation',
+        explore_agent: 'delegation'
+      })
       expect(classifyToolDispatchLane(call('read'), current)).toBe('serial')
       expect(classifyToolDispatchLane(call('delegate_task'), current)).toBe('serial')
+      expect(classifyToolDispatchLane(call('explore_agent'), current)).toBe('serial')
       expect(isParallelSafeToolCall(call('read'), current)).toBe(false)
     }
   )
@@ -85,4 +96,38 @@ describe('tool dispatch policy', () => {
     expect(collectParallelToolDispatchCandidates({ calls: [call('write')], startIndex: 0, policy: current })).toBeNull()
     expect(collectParallelToolDispatchCandidates({ calls, startIndex: 9, policy: current })).toBeNull()
   })
+
+  it('batches contiguous explore_agent calls on the delegation lane', () => {
+    const current = policy('auto', {
+      explore_agent: 'delegation',
+      delegate_task: 'delegation',
+      read: 'built-in'
+    })
+    const calls = [
+      call('explore_agent', 'explore_1'),
+      call('explore_agent', 'explore_2'),
+      call('explore_agent', 'explore_3'),
+      call('read', 'read_1')
+    ]
+
+    expect(collectParallelToolDispatchCandidates({ calls, startIndex: 0, policy: current }))
+      .toEqual({ lane: 'delegation', calls: calls.slice(0, 3) })
+    expect(collectParallelToolDispatchCandidates({ calls, startIndex: 3, policy: current }))
+      .toEqual({ lane: 'read_only', calls: calls.slice(3) })
+  })
+
+  it('batches mixed contiguous delegate_task and explore_agent on the same delegation lane', () => {
+    const current = policy('auto', {
+      explore_agent: 'delegation',
+      delegate_task: 'delegation'
+    })
+    const calls = [
+      call('explore_agent', 'explore_1'),
+      call('delegate_task', 'delegate_1'),
+      call('explore_agent', 'explore_2')
+    ]
+
+    expect(collectParallelToolDispatchCandidates({ calls, startIndex: 0, policy: current }))
+      .toEqual({ lane: 'delegation', calls })
+  })
 })
diff --git a/kun/src/loop/tool-dispatch-policy.ts b/kun/src/loop/tool-dispatch-policy.ts
index 0bc75760a..af73329e3 100644
--- a/kun/src/loop/tool-dispatch-policy.ts
+++ b/kun/src/loop/tool-dispatch-policy.ts
@@ -3,6 +3,11 @@ import type { ToolCallLike, ToolProviderKind } from '../ports/tool-host.js'
 
 const PARALLEL_READ_ONLY_TOOL_NAMES = new Set(['read', 'grep', 'glob', 'find', 'ls'])
 const DELEGATE_TASK_TOOL_NAME = 'delegate_task'
+const EXPLORE_AGENT_TOOL_NAME = 'explore_agent'
+const PARALLEL_DELEGATION_TOOL_NAMES = new Set([
+  DELEGATE_TASK_TOOL_NAME,
+  EXPLORE_AGENT_TOOL_NAME
+])
 export const DEFAULT_MAX_PARALLEL_READ_ONLY_TOOL_CALLS = 3
 
 export type ToolDispatchLane = 'serial' | 'read_only' | 'delegation'
@@ -55,7 +60,7 @@ export function isParallelDelegationCall(
   call: ToolCallLike,
   policy: Pick<ToolDispatchPolicy, 'toolProviderKinds'>
 ): boolean {
-  return call.toolName === DELEGATE_TASK_TOOL_NAME &&
+  return PARALLEL_DELEGATION_TOOL_NAMES.has(call.toolName) &&
     policy.toolProviderKinds.get(call.toolName) === 'delegation'
 }
 
diff --git a/kun/src/loop/tool-execution-service.test.ts b/kun/src/loop/tool-execution-service.test.ts
index df8972f27..452f47f6e 100644
--- a/kun/src/loop/tool-execution-service.test.ts
+++ b/kun/src/loop/tool-execution-service.test.ts
@@ -5,6 +5,7 @@ import type { ToolHost, ToolHostContext, ToolHostResult } from '../ports/tool-ho
 import type { RuntimeEventRecorder } from '../services/runtime-event-recorder.js'
 import type { TurnService } from '../services/turn-service.js'
 import { InflightTracker } from './inflight-tracker.js'
+import { ToolCancellationRegistry } from './tool-cancellation-registry.js'
 import { ToolExecutionService } from './tool-execution-service.js'
 
 const call = {
@@ -27,6 +28,7 @@ function makeService(input: {
   execute?: ToolHost['execute']
   onPlanWritten?: () => Promise<void>
   awaitWorkspaceCheckpoint?: (requestId: string, signal: AbortSignal) => Promise<string | null>
+  toolCancellation?: ToolCancellationRegistry
 } = {}) {
   const lifecycle: string[] = []
   const events: Array<Record<string, unknown>> = []
@@ -57,7 +59,8 @@ function makeService(input: {
     ...(input.awaitWorkspaceCheckpoint
       ? { awaitWorkspaceCheckpoint: input.awaitWorkspaceCheckpoint }
       : {}),
-    ...(input.onPlanWritten ? { onPlanWritten: input.onPlanWritten } : {})
+    ...(input.onPlanWritten ? { onPlanWritten: input.onPlanWritten } : {}),
+    ...(input.toolCancellation ? { toolCancellation: input.toolCancellation } : {})
   })
   return { service, lifecycle, events, turns }
 }
@@ -82,6 +85,84 @@ describe('ToolExecutionService', () => {
     ]))
   })
 
+  it('turns an accepted tool cancellation into a paired model-visible error result', async () => {
+    const registry = new ToolCancellationRegistry()
+    let started!: () => void
+    const toolStarted = new Promise<void>((resolve) => { started = resolve })
+    const setup = makeService({
+      toolCancellation: registry,
+      execute: async (_call, executionContext) => {
+        started()
+        return await new Promise<never>((_resolve, reject) => {
+          executionContext.abortSignal.addEventListener('abort', () => {
+            reject(executionContext.abortSignal.reason)
+          }, { once: true })
+        })
+      }
+    })
+    const parent = new AbortController()
+    const execution = setup.service.executeSafely({
+      threadId: 'thread_1',
+      turnId: 'turn_1',
+      call,
+      context: { ...context, abortSignal: parent.signal }
+    })
+    await toolStarted
+    expect(registry.request(
+      { threadId: 'thread_1', turnId: 'turn_1', callId: 'call_1' },
+      '2026-08-07T00:00:00.000Z'
+    )).toBe('cancellation_requested')
+    const result = await execution
+    expect(result).toMatchObject({ approved: false, item: { isError: true } })
+    expect(result.item.kind === 'tool_result' ? result.item.output : null).toMatchObject({
+      code: 'tool_cancelled_by_user',
+      guidance: expect.stringContaining('Do not repeat the identical call automatically')
+    })
+    expect(registry.list()).toEqual([])
+  })
+
+  it('keeps the cancellation result when a tool catches abort and returns normally', async () => {
+    const registry = new ToolCancellationRegistry()
+    let started!: () => void
+    const toolStarted = new Promise<void>((resolve) => { started = resolve })
+    const setup = makeService({
+      toolCancellation: registry,
+      execute: async (toolCall, executionContext) => {
+        started()
+        await new Promise<void>((resolve) => {
+          executionContext.abortSignal.addEventListener('abort', () => resolve(), { once: true })
+        })
+        return {
+          item: makeToolResultItem({
+            id: `item_${toolCall.callId}`,
+            threadId: 'thread_1',
+            turnId: 'turn_1',
+            callId: toolCall.callId,
+            toolName: toolCall.toolName,
+            output: { stale: true }
+          }),
+          approved: true
+        }
+      }
+    })
+    const execution = setup.service.executeSafely({
+      threadId: 'thread_1',
+      turnId: 'turn_1',
+      call,
+      context: { ...context, abortSignal: new AbortController().signal }
+    })
+    await toolStarted
+    expect(registry.request(
+      { threadId: 'thread_1', turnId: 'turn_1', callId: 'call_1' },
+      '2026-08-07T00:00:00.000Z'
+    )).toBe('cancellation_requested')
+    const result = await execution
+    expect(result.item).toMatchObject({ kind: 'tool_result', isError: true })
+    expect(result.item.kind === 'tool_result' ? result.item.output : null).toMatchObject({
+      code: 'tool_cancelled_by_user'
+    })
+  })
+
   it('waits for a pending checkpoint before the first workspace mutation', async () => {
     const order: string[] = []
     const setup = makeService({
diff --git a/kun/src/loop/tool-execution-service.ts b/kun/src/loop/tool-execution-service.ts
index 15f6f5671..79a3dc8e2 100644
--- a/kun/src/loop/tool-execution-service.ts
+++ b/kun/src/loop/tool-execution-service.ts
@@ -5,6 +5,10 @@ import type { ToolCallLike, ToolHost, ToolHostContext, ToolHostResult } from '..
 import type { RuntimeEventRecorder } from '../services/runtime-event-recorder.js'
 import type { TurnService } from '../services/turn-service.js'
 import { InflightTracker } from './inflight-tracker.js'
+import {
+  TOOL_CANCELLED_BY_USER_CODE,
+  ToolCancellationRegistry
+} from './tool-cancellation-registry.js'
 import { prepareBrowserUseToolResultForPersistence } from './tool-result-image.js'
 
 export type PlanWrittenCallback = (input: {
@@ -20,6 +24,7 @@ export type ToolExecutionServiceDeps = {
   inflight: InflightTracker
   turns: TurnService
   events: RuntimeEventRecorder
+  toolCancellation?: ToolCancellationRegistry
   nowIso: () => string
   onPlanWritten?: PlanWrittenCallback
   awaitWorkspaceCheckpoint?: (
@@ -42,14 +47,47 @@ export type ToolExecutionInput = {
  */
 export class ToolExecutionService {
   private readonly checkpointGates = new Map<string, Promise<void>>()
+  private readonly deps: ToolExecutionServiceDeps
+  private readonly toolCancellation: ToolCancellationRegistry
 
-  constructor(private readonly deps: ToolExecutionServiceDeps) {}
+  constructor(deps: ToolExecutionServiceDeps) {
+    const toolCancellation = deps.toolCancellation ?? new ToolCancellationRegistry()
+    this.deps = {
+      ...deps,
+      toolCancellation
+    }
+    this.toolCancellation = toolCancellation
+  }
 
   async executeSafely(input: ToolExecutionInput): Promise<ToolHostResult> {
+    // Detached/background turns keep their dedicated lifecycle controls. The
+    // registry is intentionally limited to foreground GUI tool calls.
+    const registration = input.context.messageSource
+      ? undefined
+      : this.toolCancellation.register(
+          {
+            threadId: input.threadId,
+            turnId: input.turnId,
+            callId: input.call.callId
+          },
+          input.context.abortSignal
+        )
+    const executionInput: ToolExecutionInput = {
+      ...input,
+      ...(registration
+        ? { context: { ...input.context, abortSignal: registration.signal } }
+        : {})
+    }
     try {
-      return await this.execute(input)
+      const result = await this.execute(executionInput)
+      if (input.context.abortSignal.aborted) {
+        throw input.context.abortSignal.reason ?? new Error('Tool execution aborted')
+      }
+      if (registration?.wasCancelledByUser()) return this.cancelledResult(input)
+      return result
     } catch (error) {
-      if (input.context.abortSignal.aborted) throw error
+      if (input.context.abortSignal.aborted && !registration?.wasCancelledByUser()) throw error
+      if (registration?.wasCancelledByUser()) return this.cancelledResult(input)
       const message = error instanceof Error ? error.message : String(error)
       await this.deps.events.record({
         kind: 'error',
@@ -77,6 +115,29 @@ export class ToolExecutionService {
         }),
         approved: false
       }
+    } finally {
+      registration?.dispose()
+    }
+  }
+
+  private cancelledResult(input: ToolExecutionInput): ToolHostResult {
+    return {
+      item: makeToolResultItem({
+        id: `item_${input.call.callId}`,
+        turnId: input.turnId,
+        threadId: input.threadId,
+        callId: input.call.callId,
+        toolName: input.call.toolName,
+        toolKind: input.call.toolKind ?? 'tool_call',
+        output: {
+          code: TOOL_CANCELLED_BY_USER_CODE,
+          error: 'The user stopped this tool execution.',
+          guidance:
+            'Only this tool was stopped. Continue using the other tool results and choose an alternative approach. Do not repeat the identical call automatically.'
+        },
+        isError: true
+      }),
+      approved: false
     }
   }
 
diff --git a/kun/src/prompt/graph-lead-mode.test.ts b/kun/src/prompt/graph-lead-mode.test.ts
index 23519ec5a..4618251a6 100644
--- a/kun/src/prompt/graph-lead-mode.test.ts
+++ b/kun/src/prompt/graph-lead-mode.test.ts
@@ -78,6 +78,17 @@ describe('Graph Lead mode system contract', () => {
     )
   })
 
+  it('allows read-only explore_agent while forbidding ordinary delegate_task in planning', () => {
+    expect(GRAPH_LEAD_MODE_INSTRUCTION).toContain('Prefer `explore_agent` when it is advertised')
+    expect(GRAPH_LEAD_MODE_INSTRUCTION).toContain('or use ordinary `delegate_task` during planning')
+    expect(GRAPH_LEAD_MODE_INSTRUCTION).toContain(
+      'Do not use ordinary `delegate_task` / reusable-profile delegation'
+    )
+    expect(GRAPH_LEAD_MODE_INSTRUCTION).toContain(
+      'Read-only `explore_agent` remains allowed for repository investigation'
+    )
+  })
+
   it('keeps executors task-only and makes every handoff a Lead decision', () => {
     expect(GRAPH_LEAD_MODE_INSTRUCTION).toContain(
       'They can proactively use `report_to_parent`'
diff --git a/kun/src/prompt/graph-lead-mode.ts b/kun/src/prompt/graph-lead-mode.ts
index 9e92598fb..78bd795e7 100644
--- a/kun/src/prompt/graph-lead-mode.ts
+++ b/kun/src/prompt/graph-lead-mode.ts
@@ -32,7 +32,7 @@ Do not treat dispatch or one milestone as completion.
 
 The host has already created a durable planning draft for this turn. Follow these five steps:
 
-1. Inspect the relevant project facts with the available read-only tools before defining work. Do not mutate files, run arbitrary commands, or delegate during planning.
+1. Inspect the relevant project facts with the available read-only tools before defining work. Prefer \`explore_agent\` when it is advertised; do not mutate files, run arbitrary commands, or use ordinary \`delegate_task\` during planning.
 2. Split the outcome into focused tasks. Use \`dependsOn\` only for real control ordering and \`dataFrom\` only when a task consumes a named accepted predecessor result.
 3. Call \`graph_define_plan\` using only its advertised fields. A complete minimal valid call is:
 \`{"plan":{"title":"Update project documentation","tasks":[{"key":"update_docs","kind":"work","title":"Update the documentation","objective":"Inspect the current documentation and make the requested corrections.","dependsOn":[],"dataFrom":[],"acceptanceCriteria":["The requested behavior is documented with a concrete example."],"readScopes":["."],"writeScopes":["docs"]}],"completionTaskKeys":["update_docs"]}}\`
@@ -45,7 +45,7 @@ The host has already created a durable planning draft for this turn. Follow thes
 - Maximize useful safe fan-out, not node count for its own sake. Split independent concerns, subsystems, repository regions, or validation tracks into sibling ready nodes so the scheduler can use the available concurrency. Keep nodes large enough to produce a meaningful reviewed result; do not create line-by-line busywork.
 - Treat independence as the default. Add a control edge only when the successor truly requires the predecessor outcome, and add a data edge only when it consumes that accepted named result packet. Do not serialize nodes merely because they belong to the same phase or because their final results will later be integrated. If the work is inherently sequential, keep the real dependency.
 - A data-edge name labels the bounded result packet you will approve for the successor; it does not require the executor to publish an artifact. Avoid worker-to-worker message flow. Use explicit completion nodes and only bounded LoopGates. A LoopGate may observe only a source node that has produced a real outcome; never route repair or final work from a pending condition source. Ordinary dependencies must remain acyclic.
-- Do not use ordinary delegation, legacy task_graph fields, guessed profile ids, assignments, or host-owned identity/provenance fields while planning.
+- Do not use ordinary \`delegate_task\` / reusable-profile delegation, legacy task_graph fields, guessed profile ids, assignments, or host-owned identity/provenance fields while planning. Read-only \`explore_agent\` remains allowed for repository investigation.
 - Never submit budget, model, provider, reasoning, timeout, retry, priority, phase, revision, workspace, run-id, or timestamp fields. They belong to the host and are intentionally absent from \`graph_define_plan\`.
 - Scopes must be normalized repository-relative paths such as \`.\`, \`src\`, or \`.graph-artifacts\`, never absolute workspace paths.
 - Ordinary \`work\`, \`review\`, and \`integration\` tasks never contain \`loop\`. Only a \`loop_gate\` task contains the required bounded loop object.
diff --git a/kun/src/prompt/kun-system-prompt.test.ts b/kun/src/prompt/kun-system-prompt.test.ts
index 93b03246e..06927c6a2 100644
--- a/kun/src/prompt/kun-system-prompt.test.ts
+++ b/kun/src/prompt/kun-system-prompt.test.ts
@@ -160,6 +160,44 @@ describe('buildToolPreferenceInstruction', () => {
     expect(buildToolPreferenceInstruction([...tools].reverse())).toBe(instruction)
   })
 
+  it('makes explore_agent the first step for all repository investigation', () => {
+    const tools = [
+      { name: 'explore_agent', description: 'Explore the repository' },
+      { name: 'read', description: 'Read a file' },
+      { name: 'grep', description: 'Search file contents' },
+      { name: 'bash', description: 'Run a shell command' },
+      { name: 'edit', description: 'Edit a file' },
+      {
+        name: 'mcp_symbol_graph',
+        description: 'Navigate source definitions and reference call graph',
+        providerKind: 'mcp'
+      }
+    ]
+    const instruction = buildToolPreferenceInstruction(tools)
+
+    expect(instruction).toContain('Use `explore_agent` as the first tool')
+    expect(instruction).toContain('This applies even to simple lookups and to tasks that will later modify files')
+    expect(instruction).toContain('Only after `explore_agent` returns')
+    expect(instruction).toContain('narrow follow-up')
+    expect(instruction).toContain('parent agent remains responsible for edits')
+    expect(instruction).toContain('Issue multiple `explore_agent` calls together')
+    expect(instruction).not.toContain('do not use it for tasks that require write access')
+    expect(instruction).not.toContain('Prefer `read` over `bash`')
+    expect(buildToolPreferenceInstruction([...tools].reverse())).toBe(instruction)
+  })
+
+  it('keeps direct inspection guidance when explore_agent is unavailable', () => {
+    const instruction = buildToolPreferenceInstruction([
+      { name: 'read', description: 'Read a file' },
+      { name: 'grep', description: 'Search file contents' },
+      { name: 'bash', description: 'Run a shell command' }
+    ])
+
+    expect(instruction).toContain('Inspect relevant current state before changing it')
+    expect(instruction).toContain('Prefer `read`, `grep` over `bash`')
+    expect(instruction).not.toContain('explore_agent')
+  })
+
   it('adds bounded delegation guidance only when the child-agent tool is available', () => {
     const instruction = buildToolPreferenceInstruction([
       { name: 'delegate_task', description: 'Run a standalone child agent' }
diff --git a/kun/src/prompt/kun-system-prompt.ts b/kun/src/prompt/kun-system-prompt.ts
index a452e2466..3f6eb30f8 100644
--- a/kun/src/prompt/kun-system-prompt.ts
+++ b/kun/src/prompt/kun-system-prompt.ts
@@ -60,7 +60,7 @@ type ToolPreferenceSpec = {
 const SOURCE_EXPLORATION_PATTERN =
   /\b(?:code(?:base|graph)?|source|repository|repo|symbol|definition|reference|implementation|dependency|call[ -]?graph|ast)\b/i
 
-const INSPECTION_TOOL_NAMES = ['read', 'grep', 'glob', 'ls', 'repo_map', 'lsp'] as const
+const INSPECTION_TOOL_NAMES = ['read', 'grep', 'glob', 'ls', 'repo_map', 'find', 'lsp'] as const
 const MUTATION_TOOL_NAMES = ['edit', 'write'] as const
 const TODO_TOOL_NAMES = ['todo_list', 'todo_write'] as const
 const GOAL_TOOL_NAMES = ['get_goal', 'create_goal', 'update_goal'] as const
@@ -83,9 +83,10 @@ export function buildToolPreferenceInstruction(
   const goalTools = presentNames(names, GOAL_TOOL_NAMES)
   const inputTools = presentNames(names, USER_INPUT_TOOL_NAMES)
   const memoryTools = presentNames(names, MEMORY_TOOL_NAMES)
+  const exploreAgentAvailable = names.has('explore_agent')
   const bullets: string[] = []
 
-  if (inspectionTools.length > 0) {
+  if (inspectionTools.length > 0 && !exploreAgentAvailable) {
     bullets.push(
       `Inspect relevant current state before changing it. Use ${formatToolNames(inspectionTools)} for the matching file, search, directory, repository, or symbol operation.`
     )
@@ -97,16 +98,20 @@ export function buildToolPreferenceInstruction(
     bullets.push(
       'Run independent inspection calls in parallel when their inputs do not depend on one another; keep dependent work sequential.'
     )
-  } else if (names.has('bash')) {
+  } else if (names.has('bash') && !exploreAgentAvailable) {
     bullets.push('Use `bash` for necessary shell and system operations, with commands scoped to the active workspace and task.')
   }
 
   if (mutationTools.length > 0) {
     if (names.has('edit')) {
-      bullets.push('Use `edit` for focused changes to existing files after reading the relevant content.')
+      bullets.push(exploreAgentAvailable
+        ? 'After `explore_agent` returns, use `edit` for focused changes to existing files; the parent agent owns all mutations.'
+        : 'Use `edit` for focused changes to existing files after reading the relevant content.')
     }
     if (names.has('write')) {
-      bullets.push('Use `write` only when creating or fully replacing a file is necessary; do not create files for explanation or one-off scratch work in the project.')
+      bullets.push(exploreAgentAvailable
+        ? 'After `explore_agent` returns, use `write` only when creating or fully replacing a file is necessary; do not create files for explanation or one-off scratch work in the project.'
+        : 'Use `write` only when creating or fully replacing a file is necessary; do not create files for explanation or one-off scratch work in the project.')
     }
     if (names.has('bash')) {
       bullets.push(
@@ -168,18 +173,37 @@ export function buildToolPreferenceInstruction(
     )
   }
 
-  if (names.has('explore_agent')) {
+  if (exploreAgentAvailable) {
+    const directInspectionTools = [
+      ...inspectionTools,
+      ...(names.has('bash') ? ['bash'] : [])
+    ]
     bullets.push(
-      'Use `explore_agent` for file lookup, code/keyword search, and project information exploration: it runs a dedicated read-oriented child with bash plus exploration tools and returns a file:line summary. Prefer it over `delegate_task` for pure investigation; keep `delegate_task` for broader units of work that need full tool access.'
+      'Use `explore_agent` as the first tool for any repository or project exploration: file lookup, code or keyword search, symbol and call-path tracing, architecture or behavior inspection, and context gathering before a change. This applies even to simple lookups and to tasks that will later modify files.'
     )
     bullets.push(
-      '`explore_agent` never edits files — do not use it for tasks that require write access.'
+      '`explore_agent` runs a dedicated read-oriented child and never edits files; after it returns, the parent agent remains responsible for edits and final verification.'
     )
+    if (directInspectionTools.length > 0) {
+      bullets.push(
+        `Only after \`explore_agent\` returns, or when it is unavailable or fails, use ${formatToolNames(directInspectionTools)} for narrow follow-up verification and unsupported-file fallback.`
+      )
+    }
+    bullets.push(
+      'Issue multiple `explore_agent` calls together when the exploration questions are independent; keep dependent investigation sequential.'
+    )
+    if (names.has('delegate_task')) {
+      bullets.push(
+        'Reserve `delegate_task` for broader child work that needs full tool access; use `explore_agent` for repository investigation.'
+      )
+    }
   }
 
   if (names.has('graph_define_plan')) {
     bullets.push(
-      'A durable Graph planning draft already exists. Inspect relevant repository facts with read-only tools, then use `graph_define_plan` with only task keys, objectives, dependencies, acceptance criteria, and repository-relative scopes. The host supplies every execution mechanic.'
+      exploreAgentAvailable
+        ? 'A durable Graph planning draft already exists. Use `explore_agent` to inspect relevant repository facts first, then use `graph_define_plan` with only task keys, objectives, dependencies, acceptance criteria, and repository-relative scopes. The host supplies every execution mechanic.'
+        : 'A durable Graph planning draft already exists. Inspect relevant repository facts with read-only tools, then use `graph_define_plan` with only task keys, objectives, dependencies, acceptance criteria, and repository-relative scopes. The host supplies every execution mechanic.'
     )
     bullets.push(
       'You may make one changed correction from structured validation issues. Never repeat unchanged invalid plan arguments or claim a GraphRun exists before `graph_define_plan` returns committed.'
@@ -208,15 +232,17 @@ export function buildToolPreferenceInstruction(
     const fallback = inspectionTools.length > 0
       ? ` Use ${formatToolNames(inspectionTools)} for unsupported files, narrow fallback checks, and verification.`
       : ''
-    bullets.push(
-      `Specialized source-code MCP tools are available: ${formatToolNames(sourceTools.map((tool) => tool.name))}. Prefer a matching one for structural source navigation before broad scans.${fallback}`
-    )
+    bullets.push(exploreAgentAvailable
+      ? `Specialized source-code MCP tools are available: ${formatToolNames(sourceTools.map((tool) => tool.name))}. Start repository exploration with \`explore_agent\`; use a matching MCP tool only for narrow structural follow-up or when exploration fails.${fallback}`
+      : `Specialized source-code MCP tools are available: ${formatToolNames(sourceTools.map((tool) => tool.name))}. Prefer a matching one for structural source navigation before broad scans.${fallback}`)
   } else if (mcpTools.some((tool) => tool.name === 'mcp_search')) {
-    bullets.push('Use `mcp_search` when the task may benefit from a specialized external capability not already advertised.')
+    bullets.push(exploreAgentAvailable
+      ? 'Start repository exploration with `explore_agent`; use `mcp_search` only for a specialized external capability that the exploration child cannot provide.'
+      : 'Use `mcp_search` when the task may benefit from a specialized external capability not already advertised.')
   } else if (mcpTools.length > 0) {
-    bullets.push(
-      `Use an advertised MCP tool when its description directly matches the task: ${formatToolNames(mcpTools.map((tool) => tool.name))}.`
-    )
+    bullets.push(exploreAgentAvailable
+      ? `Start repository exploration with \`explore_agent\`; use an advertised MCP tool only when its description directly matches a narrow follow-up task: ${formatToolNames(mcpTools.map((tool) => tool.name))}.`
+      : `Use an advertised MCP tool when its description directly matches the task: ${formatToolNames(mcpTools.map((tool) => tool.name))}.`)
   }
 
   if (bullets.length === 0) return null
diff --git a/kun/src/runtime/cursor/cursor-sdk-runtime-factory.test.ts b/kun/src/runtime/cursor/cursor-sdk-runtime-factory.test.ts
index 62b3fd662..3dea9de6e 100644
--- a/kun/src/runtime/cursor/cursor-sdk-runtime-factory.test.ts
+++ b/kun/src/runtime/cursor/cursor-sdk-runtime-factory.test.ts
@@ -167,16 +167,15 @@ describe('Cursor SDK runtime factory', () => {
 
     const planning = await loadKunTurnContext(input)
     expect(planning.graphPhase).toBe('planning')
+    // Overlapping Cursor built-ins (read/write) are not bridged as custom tools.
     expect(planning.tools.map((tool) => tool.name).sort()).toEqual([
-      'graph_define_plan',
-      'read'
+      'graph_define_plan'
     ])
     expect(planning.instructionBlocks.join('\n')).toContain(
       'Graph Mode: source Lead operating contract'
     )
     expect(Object.keys(planning.customTools).sort()).toEqual([
-      'graph_define_plan',
-      'read'
+      'graph_define_plan'
     ])
     expect(planning.graphPlanWasCommitted?.()).toBe(false)
     expect(planning.graphPlanCanRetry?.()).toBe(true)
@@ -195,8 +194,7 @@ describe('Cursor SDK runtime factory', () => {
     const supervising = await loadKunTurnContext(input)
     expect(supervising.graphPhase).toBe('supervising')
     expect(supervising.tools.map((tool) => tool.name).sort()).toEqual([
-      'graph_review_node',
-      'read'
+      'graph_review_node'
     ])
   })
 
@@ -439,7 +437,8 @@ describe('Cursor SDK runtime factory', () => {
     expect(String(sentMessages[0])).toContain('Kun canonical system prompt')
     expect(String(sentMessages[0])).toContain('Thread persona')
     expect(String(sentMessages[0])).toContain('Workspace AGENTS.md instruction')
-    expect(String(sentMessages[0])).toContain('Kun-managed tools are available')
+    expect(String(sentMessages[0])).toContain('Prefer Cursor built-in tools')
+    expect(String(sentMessages[0])).toContain('Kun-managed capabilities are available')
     expect(updatedMetadata).toContainEqual(expect.objectContaining({
       instructionInjectionBytes: 31
     }))
diff --git a/kun/src/runtime/cursor/cursor-sdk-runtime-factory.ts b/kun/src/runtime/cursor/cursor-sdk-runtime-factory.ts
index cecdc6294..bbf89498d 100644
--- a/kun/src/runtime/cursor/cursor-sdk-runtime-factory.ts
+++ b/kun/src/runtime/cursor/cursor-sdk-runtime-factory.ts
@@ -58,9 +58,9 @@ import {
 } from '../delegated-graph-turn-policy.js'
 
 const CURSOR_KUN_TOOL_INSTRUCTION = [
-  'Kun-managed tools are available through Cursor custom tools.',
-  'Use these tools for Kun capabilities such as MCP, extensions, skills, memory, media, GUI input, and delegation.',
-  'Tool execution remains governed by Kun approval and sandbox policy.'
+  'Prefer Cursor built-in tools for reading, editing, searching, and running shell commands.',
+  'Kun-managed capabilities are available through Cursor custom tools (MCP, extensions, skills, memory, media, GUI input, and delegation).',
+  'Use those custom tools only for Kun-exclusive work; their execution remains governed by Kun approval and sandbox policy.'
 ].join(' ')
 
 export interface CursorSdkRuntimeFactoryDeps extends Omit<
diff --git a/kun/src/runtime/cursor/cursor-sdk-tool-bridge.test.ts b/kun/src/runtime/cursor/cursor-sdk-tool-bridge.test.ts
index dd4317a16..c6df8de8b 100644
--- a/kun/src/runtime/cursor/cursor-sdk-tool-bridge.test.ts
+++ b/kun/src/runtime/cursor/cursor-sdk-tool-bridge.test.ts
@@ -23,6 +23,62 @@ const tools: CursorBridgeTool[] = [{
   inputSchema: { type: 'object' },
   providerId: 'extension:render',
   providerKind: 'extension'
+}, {
+  name: 'read',
+  description: 'Overlaps Cursor built-in read',
+  toolKind: 'tool_call',
+  inputSchema: { type: 'object' },
+  providerId: 'builtin',
+  providerKind: 'built-in'
+}, {
+  name: 'bash',
+  description: 'Overlaps Cursor built-in shell',
+  toolKind: 'command_execution',
+  inputSchema: { type: 'object' },
+  providerId: 'builtin',
+  providerKind: 'built-in'
+}, {
+  name: 'edit',
+  description: 'Overlaps Cursor built-in edit',
+  toolKind: 'file_change',
+  inputSchema: { type: 'object' },
+  providerId: 'builtin',
+  providerKind: 'built-in'
+}, {
+  name: 'write',
+  description: 'Overlaps Cursor built-in write',
+  toolKind: 'file_change',
+  inputSchema: { type: 'object' },
+  providerId: 'builtin',
+  providerKind: 'built-in'
+}, {
+  name: 'grep',
+  description: 'Overlaps Cursor built-in grep',
+  toolKind: 'tool_call',
+  inputSchema: { type: 'object' },
+  providerId: 'builtin',
+  providerKind: 'built-in'
+}, {
+  name: 'glob',
+  description: 'Overlaps Cursor built-in glob',
+  toolKind: 'tool_call',
+  inputSchema: { type: 'object' },
+  providerId: 'builtin',
+  providerKind: 'built-in'
+}, {
+  name: 'find',
+  description: 'Overlaps Cursor built-in find',
+  toolKind: 'tool_call',
+  inputSchema: { type: 'object' },
+  providerId: 'builtin',
+  providerKind: 'built-in'
+}, {
+  name: 'ls',
+  description: 'Overlaps Cursor built-in ls',
+  toolKind: 'tool_call',
+  inputSchema: { type: 'object' },
+  providerId: 'builtin',
+  providerKind: 'built-in'
 }, {
   name: '  padded_tool  ',
   description: 'Padded name',
@@ -39,7 +95,7 @@ const tools: CursorBridgeTool[] = [{
 }]
 
 describe('Cursor SDK Kun custom-tool bridge', () => {
-  test('keeps Kun and provider provenance (including toolKind) while excluding internal-only tools', () => {
+  test('bridges Kun-exclusive tools while excluding overlap and internal-only tools', () => {
     expect(selectCursorBridgeTools(tools).map((tool) => [
       tool.name,
       tool.toolKind,
@@ -52,6 +108,15 @@ describe('Cursor SDK Kun custom-tool bridge', () => {
     ])
   })
 
+  test('does not advertise overlapping Cursor built-ins as custom tools', () => {
+    const customTools = buildCursorCustomTools(tools, async () => ({ output: 'ok' }))
+    for (const name of ['read', 'bash', 'edit', 'write', 'grep', 'glob', 'find', 'ls', 'echo']) {
+      expect(customTools[name]).toBeUndefined()
+    }
+    expect(customTools.mcp_call_tool).toBeDefined()
+    expect(customTools.extension_render).toBeDefined()
+  })
+
   test('maps Cursor callbacks to Kun execution and preserves call identity and provenance', async () => {
     const execute = vi.fn(async () => ({
       output: { ok: true, value: 42 }
diff --git a/kun/src/runtime/cursor/cursor-sdk-tool-bridge.ts b/kun/src/runtime/cursor/cursor-sdk-tool-bridge.ts
index 1ae9719a6..f10bc7cb3 100644
--- a/kun/src/runtime/cursor/cursor-sdk-tool-bridge.ts
+++ b/kun/src/runtime/cursor/cursor-sdk-tool-bridge.ts
@@ -1,3 +1,12 @@
+/**
+ * Re-exposes Kun-exclusive tools to the Cursor SDK as `local.customTools`.
+ * Cursor registers those callbacks as the `custom-user-tools` MCP server.
+ *
+ * Decision (aligned with Claude Agent SDK): tools that OVERLAP Cursor's
+ * built-ins (read/bash/edit/write/grep/glob/find/ls) are NOT bridged — the
+ * model uses Cursor's native tools. We only bridge Kun-exclusive tools such
+ * as MCP facades, extensions, memory, media, GUI input, and delegation.
+ */
 import type {
   SDKCustomTool,
   SDKCustomToolContext,
@@ -5,6 +14,8 @@ import type {
 } from '@cursor/sdk'
 import type { CapabilityToolSpec } from '../../adapters/tool/capability-registry.js'
 import {
+  DEFAULT_EXCLUDED_TOOL_NAMES,
+  DEFAULT_OVERLAP_TOOL_NAMES,
   mapKunResultToSdkContent,
   type KunToolResult
 } from '../agent-sdk/sdk-tool-bridge.js'
@@ -26,15 +37,31 @@ export type CursorKunToolCall = {
 
 export type CursorKunToolExecutor = (call: CursorKunToolCall) => Promise<KunToolResult>
 
-const CURSOR_BRIDGE_EXCLUDED_TOOL_NAMES = new Set(['echo'])
+export interface SelectCursorBridgeOptions {
+  overlap?: ReadonlySet<string>
+  excluded?: ReadonlySet<string>
+}
+
+/**
+ * Kun built-ins that overlap Cursor SDK built-ins — use Cursor's instead.
+ * Kept as an alias of the shared Claude overlap set so both delegated runtimes
+ * drop the same catalog names.
+ */
+export const CURSOR_OVERLAP_TOOL_NAMES: ReadonlySet<string> = DEFAULT_OVERLAP_TOOL_NAMES
+
+/** Kun tools that are meaningless or internal-only on a Cursor turn. */
+export const CURSOR_EXCLUDED_TOOL_NAMES: ReadonlySet<string> = DEFAULT_EXCLUDED_TOOL_NAMES
 
 export function selectCursorBridgeTools(
-  tools: readonly CursorBridgeTool[]
+  tools: readonly CursorBridgeTool[],
+  opts: SelectCursorBridgeOptions = {}
 ): CursorBridgeTool[] {
+  const overlap = opts.overlap ?? CURSOR_OVERLAP_TOOL_NAMES
+  const excluded = opts.excluded ?? CURSOR_EXCLUDED_TOOL_NAMES
   const seen = new Set<string>()
   return tools.filter((tool) => {
     const name = tool.name.trim()
-    if (!name || seen.has(name) || CURSOR_BRIDGE_EXCLUDED_TOOL_NAMES.has(name)) return false
+    if (!name || seen.has(name) || overlap.has(name) || excluded.has(name)) return false
     seen.add(name)
     return true
   })
diff --git a/kun/src/server/graph-runtime-factory.test.ts b/kun/src/server/graph-runtime-factory.test.ts
index ff4b31144..a5085671c 100644
--- a/kun/src/server/graph-runtime-factory.test.ts
+++ b/kun/src/server/graph-runtime-factory.test.ts
@@ -5,11 +5,16 @@ import { afterEach, describe, expect, it, vi } from 'vitest'
 import { InMemoryThreadStore } from '../adapters/in-memory-thread-store.js'
 import { InMemoryArtifactStore } from '../artifacts/artifact-store.js'
 import type { GraphRuntimeConfig } from '../config/kun-config.js'
-import { GRAPH_CONTRACT_VERSION, type GraphRunV1 } from '../contracts/graph.js'
+import {
+  GRAPH_CONTRACT_VERSION,
+  GraphNodeAttemptV1Schema,
+  type GraphRunV1
+} from '../contracts/graph.js'
 import { createThreadRecord } from '../domain/thread.js'
 import { createTurnRecord } from '../domain/turn.js'
 import { GraphRunConflictError } from '../graph/graph-run-store.js'
 import {
+  testAssignmentSnapshot,
   testGraphConfig,
   testGraphPlan
 } from '../graph/graph-test-fixtures.test-support.js'
@@ -43,7 +48,8 @@ async function transitionRun(
 async function recordFinalSummary(
   runtime: GraphRuntimeComposition,
   run: GraphRunV1,
-  commandId: string
+  commandId: string,
+  finalAnswer = 'A stale Graph report was persisted before later work.'
 ): Promise<GraphRunV1> {
   return (await runtime.store.append(run.id, {
     expectedSeq: run.lastEventSeq,
@@ -55,7 +61,7 @@ async function recordFinalSummary(
       payload: {
         summary: {
           version: GRAPH_CONTRACT_VERSION,
-          finalAnswer: 'A stale Graph report was persisted before later work.',
+          finalAnswer,
           evidenceRefs: [],
           unresolvedRisks: [],
           changedFiles: [],
@@ -69,6 +75,167 @@ async function recordFinalSummary(
   })).state
 }
 
+/** Force every plan node into accepted so completion gates pass. */
+async function acceptAllNodes(
+  runtime: GraphRuntimeComposition,
+  run: GraphRunV1,
+  label: string
+): Promise<GraphRunV1> {
+  let current = run
+  for (const node of Object.values(current.nodes)) {
+    if (node.status === 'accepted' || node.status === 'superseded') continue
+    const nodeId = node.node.id
+    if (current.nodes[nodeId]!.status === 'pending') {
+      current = (await runtime.store.append(current.id, {
+        expectedSeq: current.lastEventSeq,
+        graphRevision: current.currentRevision,
+        commandId: `${label}_${nodeId}_ready`,
+        idempotencyKey: `${label}_${nodeId}_ready`,
+        event: {
+          type: 'node_status_changed',
+          payload: {
+            nodeId,
+            from: 'pending',
+            to: 'ready',
+            reason: 'test fixture: semantic work complete'
+          }
+        }
+      })).state
+    }
+    const attemptId = `attempt_${label}_${nodeId}`
+    const attempt = GraphNodeAttemptV1Schema.parse({
+      version: GRAPH_CONTRACT_VERSION,
+      id: attemptId,
+      runId: current.id,
+      nodeId,
+      revision: current.currentRevision,
+      attemptNumber: 1,
+      iteration: 0,
+      commandId: `${label}_${nodeId}_attempt`,
+      idempotencyKey: `${label}_${nodeId}_attempt`,
+      status: 'queued',
+      assignment: testAssignmentSnapshot(),
+      queuedAt: '2026-07-26T00:00:00.000Z',
+      tokenUsage: 0,
+      elapsedMs: 0
+    })
+    // attempt_created admits on ready and moves the node to queued.
+    const events = [
+      { type: 'attempt_created' as const, payload: { attempt } },
+      {
+        type: 'attempt_status_changed' as const,
+        payload: {
+          nodeId,
+          attemptId,
+          from: 'queued' as const,
+          to: 'running' as const
+        }
+      },
+      {
+        type: 'node_status_changed' as const,
+        payload: {
+          nodeId,
+          from: 'queued' as const,
+          to: 'running' as const,
+          reason: 'test fixture: semantic work complete'
+        }
+      },
+      {
+        type: 'attempt_status_changed' as const,
+        payload: {
+          nodeId,
+          attemptId,
+          from: 'running' as const,
+          to: 'submitted' as const
+        }
+      },
+      {
+        type: 'node_status_changed' as const,
+        payload: {
+          nodeId,
+          from: 'running' as const,
+          to: 'submitted' as const,
+          reason: 'test fixture: semantic work complete'
+        }
+      },
+      {
+        type: 'attempt_status_changed' as const,
+        payload: {
+          nodeId,
+          attemptId,
+          from: 'submitted' as const,
+          to: 'accepted' as const
+        }
+      },
+      {
+        type: 'node_status_changed' as const,
+        payload: {
+          nodeId,
+          from: 'submitted' as const,
+          to: 'accepted' as const,
+          reason: 'test fixture: semantic work complete'
+        }
+      }
+    ]
+    for (const [index, event] of events.entries()) {
+      current = (await runtime.store.append(current.id, {
+        expectedSeq: current.lastEventSeq,
+        graphRevision: current.currentRevision,
+        commandId: `${label}_${nodeId}_accept_${index}`,
+        idempotencyKey: `${label}_${nodeId}_accept_${index}`,
+        event
+      })).state
+    }
+  }
+  return current
+}
+
+async function createOwnedGraphRuntime(label: string): Promise<{
+  runtime: GraphRuntimeComposition
+  threadId: string
+  sourceTurnId: string
+  workspace: string
+  root: string
+  threadStore: InMemoryThreadStore
+}> {
+  const root = await mkdtemp(join(tmpdir(), `kun-graph-runtime-${label}-`))
+  const workspace = join(root, 'workspace')
+  await mkdir(workspace)
+  roots.push(root)
+  let id = 0
+  const threadStore = new InMemoryThreadStore()
+  const threadId = `thread_${label}`
+  const sourceTurnId = `turn_${label}`
+  const thread = createThreadRecord({
+    id: threadId,
+    title: `Graph ${label}`,
+    workspace,
+    model: 'test-model'
+  })
+  await threadStore.upsert({
+    ...thread,
+    turns: [
+      createTurnRecord({
+        id: sourceTurnId,
+        threadId,
+        prompt: 'Build a graph.',
+        orchestration: 'graph',
+        status: 'running'
+      })
+    ]
+  })
+  const runtime = new GraphRuntimeComposition({
+    dataDir: root,
+    config: () => testGraphConfig(),
+    artifactStore: new InMemoryArtifactStore(),
+    runtimeEvents: { record: vi.fn(async (event) => event as never) },
+    threadStore,
+    ids: { next: (prefix) => `${prefix}_${++id}` },
+    nowIso: () => '2026-07-26T00:00:00.000Z'
+  })
+  return { runtime, threadId, sourceTurnId, workspace, root, threadStore }
+}
+
 describe('GraphRuntimeComposition creation authority', () => {
   it('binds HTTP/tool creation inputs to the canonical parent thread and source turn', async () => {
     const root = await mkdtemp(join(tmpdir(), 'kun-graph-runtime-authority-'))
@@ -720,3 +887,484 @@ describe('GraphRuntimeComposition creation authority', () => {
     await runtime.stop()
   })
 })
+
+function testAuthority(workspace: string) {
+  return {
+    workspaceRoot: workspace,
+    model: 'test-model',
+    providerId: 'default',
+    allowedModelProviderIds: ['default'],
+    allowedModels: ['test-model'],
+    allowedProviderIds: [],
+    reasoningEffort: 'off' as const,
+    approvalPolicy: 'never' as const,
+    sandboxMode: 'read-only' as const,
+    allowedTools: [] as string[],
+    blockedTools: [] as string[],
+    allowedSkills: [] as string[],
+    blockedSkills: [] as string[],
+    allowedMcpServers: [] as string[],
+    blockedMcpServers: [] as string[],
+    readScopes: ['.'],
+    writeScopes: [] as string[],
+    networkAllowed: false
+  }
+}
+
+async function startOwnedRuntime(
+  runtime: GraphRuntimeComposition,
+  workspace: string
+): Promise<void> {
+  await runtime.start({
+    delegation: () => undefined,
+    leadTurn: async () => undefined,
+    authorityForRun: () => testAuthority(workspace)
+  })
+}
+
+async function settleSourceTurn(
+  threadStore: InMemoryThreadStore,
+  threadId: string,
+  sourceTurnId: string,
+  status: 'failed' | 'aborted'
+): Promise<void> {
+  const thread = await threadStore.get(threadId)
+  if (!thread) throw new Error(`missing thread ${threadId}`)
+  await threadStore.upsert({
+    ...thread,
+    turns: thread.turns.map((turn) =>
+      turn.id === sourceTurnId ? { ...turn, status } : turn)
+  })
+}
+
+function spyResumeRun(runtime: GraphRuntimeComposition) {
+  const original = runtime.scheduler.resumeRun.bind(runtime.scheduler)
+  return vi.spyOn(runtime.scheduler, 'resumeRun').mockImplementation(async (runId) =>
+    original(runId))
+}
+
+async function expectNoCancelledTransition(
+  runtime: GraphRuntimeComposition,
+  runId: string
+): Promise<void> {
+  expect(
+    (await runtime.store.events(runId, 0)).some((envelope) =>
+      envelope.event.type === 'run_status_changed' &&
+      envelope.event.payload.to === 'cancelled')
+  ).toBe(false)
+}
+
+describe('GraphRuntimeComposition source-turn terminal semantics (#1071)', () => {
+  it('converges a completing run to completed after incidental aborted when scheduler is started', async () => {
+    // start() first so the initial scheduler tick is empty; then construct the
+    // completing run. That way completed can only come from preserve→resumeRun.
+    const { runtime, threadId, sourceTurnId, workspace, threadStore } =
+      await createOwnedGraphRuntime('completing_live')
+    await startOwnedRuntime(runtime, workspace)
+    const identity = await runtime.registry.identify(workspace)
+    await runtime.control.create({
+      runId: 'run_completing_live',
+      threadId,
+      projectId: identity.projectId,
+      sourceTurnId,
+      plan: testGraphPlan({ workspaceRoot: workspace }),
+      commandId: 'create_completing_live',
+      idempotencyKey: 'create_completing_live'
+    })
+    let run = await runtime.control.get('run_completing_live')
+    run = await transitionRun(runtime, run, 'running', 'to_running_completing_live')
+    run = await acceptAllNodes(runtime, run, 'completing_live')
+    run = await transitionRun(runtime, run, 'completing', 'to_completing_live')
+    expect(run.status).toBe('completing')
+    expect(run.summary).toBeUndefined()
+
+    await settleSourceTurn(threadStore, threadId, sourceTurnId, 'aborted')
+    const resume = spyResumeRun(runtime)
+    await runtime.handleSourceTurnTerminal(threadId, sourceTurnId, 'aborted')
+
+    expect(resume).toHaveBeenCalledTimes(1)
+    expect(resume).toHaveBeenCalledWith(run.id)
+    const after = await runtime.control.get(run.id)
+    expect(after.status).toBe('completed')
+    expect(after.summary).toBeDefined()
+    expect(after.summary!.finalAnswer.length).toBeGreaterThan(0)
+    await expectNoCancelledTransition(runtime, run.id)
+    await runtime.stop()
+  })
+
+  it('converges gates-passed running work to completed after incidental failure when scheduler is started', async () => {
+    // Remaining race beyond v0.2.35: gates passed, no summary/completing yet.
+    // start() first → empty tick; then install the running gates-passed snapshot.
+    const { runtime, threadId, sourceTurnId, workspace, threadStore } =
+      await createOwnedGraphRuntime('gates_live')
+    await startOwnedRuntime(runtime, workspace)
+    const identity = await runtime.registry.identify(workspace)
+    await runtime.control.create({
+      runId: 'run_gates_live',
+      threadId,
+      projectId: identity.projectId,
+      sourceTurnId,
+      plan: testGraphPlan({ workspaceRoot: workspace }),
+      commandId: 'create_gates_live',
+      idempotencyKey: 'create_gates_live'
+    })
+    let run = await runtime.control.get('run_gates_live')
+    run = await transitionRun(runtime, run, 'running', 'to_running_gates_live')
+    run = await acceptAllNodes(runtime, run, 'gates_live')
+    expect(run.status).toBe('running')
+    expect(run.summary).toBeUndefined()
+    expect(Object.values(run.nodes).every((node) => node.status === 'accepted')).toBe(true)
+
+    await settleSourceTurn(threadStore, threadId, sourceTurnId, 'failed')
+    const resume = spyResumeRun(runtime)
+    await runtime.handleSourceTurnTerminal(threadId, sourceTurnId, 'failed')
+
+    expect(resume).toHaveBeenCalledTimes(1)
+    expect(resume).toHaveBeenCalledWith(run.id)
+    const after = await runtime.control.get(run.id)
+    expect(after.status).toBe('completed')
+    expect(after.summary).toBeDefined()
+    expect(after.summary!.finalAnswer.length).toBeGreaterThan(0)
+    expect(after.finishedAt).toBeTruthy()
+    await expectNoCancelledTransition(runtime, run.id)
+    await runtime.stop()
+  })
+
+  it('preserves accepted+summary awaiting_supervision and finishes when finalization is safe', async () => {
+    const { runtime, threadId, sourceTurnId, workspace, threadStore } =
+      await createOwnedGraphRuntime('accepted_summary_live')
+    await startOwnedRuntime(runtime, workspace)
+    const identity = await runtime.registry.identify(workspace)
+    await runtime.control.create({
+      runId: 'run_accepted_summary_live',
+      threadId,
+      projectId: identity.projectId,
+      sourceTurnId,
+      plan: testGraphPlan({ workspaceRoot: workspace }),
+      commandId: 'create_accepted_summary_live',
+      idempotencyKey: 'create_accepted_summary_live'
+    })
+    let run = await runtime.control.get('run_accepted_summary_live')
+    run = await transitionRun(runtime, run, 'running', 'to_running_accepted_live')
+    run = await acceptAllNodes(runtime, run, 'accepted_summary_live')
+    run = await recordFinalSummary(
+      runtime,
+      run,
+      'summary_accepted_live',
+      'All nodes accepted and the final report is complete.'
+    )
+    run = await transitionRun(runtime, run, 'awaiting_supervision', 'hold_after_summary_live')
+    expect(run.status).toBe('awaiting_supervision')
+    expect(run.summary?.finalAnswer).toContain('final report is complete')
+
+    await settleSourceTurn(threadStore, threadId, sourceTurnId, 'failed')
+    const resume = spyResumeRun(runtime)
+    await runtime.handleSourceTurnTerminal(threadId, sourceTurnId, 'failed')
+
+    expect(resume).toHaveBeenCalledTimes(1)
+    expect(resume).toHaveBeenCalledWith(run.id)
+    const after = await runtime.control.get(run.id)
+    expect(after.status).toBe('completed')
+    expect(after.summary?.finalAnswer).toContain('final report is complete')
+    await expectNoCancelledTransition(runtime, run.id)
+    await runtime.stop()
+  })
+
+  it('does not auto-finish gates-passed work with an unresolved blocking mailbox message', async () => {
+    const { runtime, threadId, sourceTurnId, workspace, threadStore } =
+      await createOwnedGraphRuntime('mailbox_block')
+    await startOwnedRuntime(runtime, workspace)
+    const identity = await runtime.registry.identify(workspace)
+    await runtime.control.create({
+      runId: 'run_mailbox_block',
+      threadId,
+      projectId: identity.projectId,
+      sourceTurnId,
+      plan: testGraphPlan({ workspaceRoot: workspace }),
+      commandId: 'create_mailbox_block',
+      idempotencyKey: 'create_mailbox_block'
+    })
+    let run = await runtime.control.get('run_mailbox_block')
+    run = await transitionRun(runtime, run, 'running', 'to_running_mailbox')
+    run = await acceptAllNodes(runtime, run, 'mailbox_block')
+    await runtime.mailbox.send({
+      id: 'message_blocking_1',
+      runId: run.id,
+      sender: { kind: 'system' },
+      recipients: [{ kind: 'worker', nodeId: 'finish' }],
+      type: 'system',
+      priority: 'blocking',
+      summary: 'Confirm the handoff before finalization.',
+      artifactRefs: [],
+      replyRequired: true
+    }, { commandId: 'send_block_1', idempotencyKey: 'send_block_1' })
+    run = (await runtime.store.get(run.id))!
+    expect(runtime.mailbox.unresolvedBlockers(run).length).toBeGreaterThan(0)
+    expect(run.status).toBe('running')
+
+    await settleSourceTurn(threadStore, threadId, sourceTurnId, 'failed')
+    const resume = spyResumeRun(runtime)
+    await runtime.handleSourceTurnTerminal(threadId, sourceTurnId, 'failed')
+
+    // Semantic complete forbids cancel; finalization unsafe forbids resumeRun.
+    expect(resume).not.toHaveBeenCalled()
+    const after = await runtime.control.get(run.id)
+    expect(after.status).not.toBe('cancelled')
+    expect(after.status).not.toBe('completed')
+    expect(runtime.mailbox.unresolvedBlockers(after).length).toBeGreaterThan(0)
+    await runtime.stop()
+  })
+
+  it('keeps awaiting_human with needs_attention after incidental settlement', async () => {
+    const { runtime, threadId, sourceTurnId, workspace, threadStore } =
+      await createOwnedGraphRuntime('human_hold')
+    await startOwnedRuntime(runtime, workspace)
+    const identity = await runtime.registry.identify(workspace)
+    await runtime.control.create({
+      runId: 'run_human_hold',
+      threadId,
+      projectId: identity.projectId,
+      sourceTurnId,
+      plan: testGraphPlan({ workspaceRoot: workspace }),
+      commandId: 'create_human_hold',
+      idempotencyKey: 'create_human_hold'
+    })
+    let run = await runtime.control.get('run_human_hold')
+    run = await transitionRun(runtime, run, 'running', 'to_running_human')
+    run = await acceptAllNodes(runtime, run, 'human_hold')
+    run = await recordFinalSummary(runtime, run, 'summary_human', 'Semantic work finished.')
+    const obligation = {
+      version: GRAPH_CONTRACT_VERSION,
+      id: 'graph_obligation_human_hold',
+      kind: 'help' as const,
+      reason: 'help' as const,
+      graphRevision: run.currentRevision,
+      nodeIds: [] as string[],
+      attemptIds: [] as string[],
+      digest: 'Human attention required before finalization.',
+      state: 'needs_attention' as const,
+      deliveryAttempts: 1,
+      noProgressCount: 3,
+      lastProgressSeq: run.lastEventSeq,
+      attentionReason: 'Source Lead made no progress; human review required.',
+      createdAt: '2026-07-26T00:00:00.000Z',
+      updatedAt: '2026-07-26T00:00:00.000Z'
+    }
+    run = (await runtime.store.append(run.id, {
+      expectedSeq: run.lastEventSeq,
+      graphRevision: run.currentRevision,
+      commandId: 'open_human_hold',
+      idempotencyKey: 'open_human_hold',
+      event: {
+        type: 'supervision_obligation_updated',
+        payload: { obligation }
+      }
+    })).state
+    run = await transitionRun(runtime, run, 'awaiting_human', 'to_awaiting_human')
+    expect(run.status).toBe('awaiting_human')
+
+    await settleSourceTurn(threadStore, threadId, sourceTurnId, 'failed')
+    const resume = spyResumeRun(runtime)
+    await runtime.handleSourceTurnTerminal(threadId, sourceTurnId, 'failed')
+
+    expect(resume).not.toHaveBeenCalled()
+    const after = await runtime.control.get(run.id)
+    expect(after.status).toBe('awaiting_human')
+    expect(after.status).not.toBe('completed')
+    expect(after.status).not.toBe('cancelled')
+    expect(after.supervisionObligations.some((entry) =>
+      entry.id === obligation.id && entry.state === 'needs_attention')).toBe(true)
+    expect(after.summary?.finalAnswer).toContain('Semantic work finished')
+    await runtime.stop()
+  })
+
+  it('does not auto-complete awaiting_supervision with an unresolved scheduler_error obligation', async () => {
+    const { runtime, threadId, sourceTurnId, workspace, threadStore } =
+      await createOwnedGraphRuntime('sched_err')
+    await startOwnedRuntime(runtime, workspace)
+    const identity = await runtime.registry.identify(workspace)
+    await runtime.control.create({
+      runId: 'run_sched_err',
+      threadId,
+      projectId: identity.projectId,
+      sourceTurnId,
+      plan: testGraphPlan({ workspaceRoot: workspace }),
+      commandId: 'create_sched_err',
+      idempotencyKey: 'create_sched_err'
+    })
+    let run = await runtime.control.get('run_sched_err')
+    run = await transitionRun(runtime, run, 'running', 'to_running_sched_err')
+    run = await acceptAllNodes(runtime, run, 'sched_err')
+    run = await recordFinalSummary(runtime, run, 'summary_sched_err', 'Gates passed.')
+    const obligation = {
+      version: GRAPH_CONTRACT_VERSION,
+      id: 'graph_obligation_sched_err',
+      kind: 'scheduler_error' as const,
+      reason: 'scheduler_error' as const,
+      graphRevision: run.currentRevision,
+      nodeIds: [] as string[],
+      attemptIds: [] as string[],
+      digest: 'Scheduler failed while finalizing.',
+      state: 'pending' as const,
+      deliveryAttempts: 0,
+      noProgressCount: 0,
+      lastProgressSeq: run.lastEventSeq,
+      createdAt: '2026-07-26T00:00:00.000Z',
+      updatedAt: '2026-07-26T00:00:00.000Z'
+    }
+    run = (await runtime.store.append(run.id, {
+      expectedSeq: run.lastEventSeq,
+      graphRevision: run.currentRevision,
+      commandId: 'open_sched_err',
+      idempotencyKey: 'open_sched_err',
+      event: {
+        type: 'supervision_obligation_opened',
+        payload: { obligation }
+      }
+    })).state
+    run = await transitionRun(runtime, run, 'awaiting_supervision', 'to_awaiting_sched_err')
+    expect(run.status).toBe('awaiting_supervision')
+
+    await settleSourceTurn(threadStore, threadId, sourceTurnId, 'failed')
+    const resume = spyResumeRun(runtime)
+    await runtime.handleSourceTurnTerminal(threadId, sourceTurnId, 'failed')
+
+    expect(resume).not.toHaveBeenCalled()
+    const after = await runtime.control.get(run.id)
+    expect(after.status).not.toBe('completed')
+    expect(after.status).not.toBe('cancelled')
+    expect(after.status).toBe('awaiting_supervision')
+    expect(after.supervisionObligations.some((entry) =>
+      entry.id === obligation.id && entry.state !== 'resolved')).toBe(true)
+    await runtime.stop()
+  })
+
+  it('leaves gates-passed work uncancelled without finishing when scheduler is not started (cold-start)', async () => {
+    // Cold composition before runtime.start: incidental settlement must not
+    // cancel, but cannot finish without a scheduler. Explicit cold-start semantics.
+    const { runtime, threadId, sourceTurnId, workspace } = await createOwnedGraphRuntime('cold_start')
+    const identity = await runtime.registry.identify(workspace)
+    await runtime.control.create({
+      runId: 'run_cold_start',
+      threadId,
+      projectId: identity.projectId,
+      sourceTurnId,
+      plan: testGraphPlan({ workspaceRoot: workspace }),
+      commandId: 'create_cold_start',
+      idempotencyKey: 'create_cold_start'
+    })
+    let run = await runtime.control.get('run_cold_start')
+    run = await transitionRun(runtime, run, 'running', 'to_running_cold')
+    run = await acceptAllNodes(runtime, run, 'cold_start')
+
+    await runtime.handleSourceTurnTerminal(threadId, sourceTurnId, 'failed')
+    const after = await runtime.control.get(run.id)
+    expect(after.status).not.toBe('cancelled')
+    expect(['running', 'completing']).toContain(after.status)
+    expect(after.summary).toBeUndefined()
+    await runtime.stop()
+  })
+
+  it('force-cancels even a completing run for explicit user Stop', async () => {
+    const { runtime, threadId, sourceTurnId, workspace } = await createOwnedGraphRuntime('force_stop')
+    const identity = await runtime.registry.identify(workspace)
+    await runtime.control.create({
+      runId: 'run_force_stop',
+      threadId,
+      projectId: identity.projectId,
+      sourceTurnId,
+      plan: testGraphPlan({ workspaceRoot: workspace }),
+      commandId: 'create_force_stop',
+      idempotencyKey: 'create_force_stop'
+    })
+    let run = await runtime.control.get('run_force_stop')
+    run = await transitionRun(runtime, run, 'running', 'to_running_force')
+    run = await acceptAllNodes(runtime, run, 'force_stop')
+    run = await recordFinalSummary(runtime, run, 'summary_force_stop', 'Semantic work finished.')
+    run = await transitionRun(runtime, run, 'completing', 'to_completing_force')
+    // Do not start the scheduler first: a tick would finish completing before
+    // Stop. Explicit cancel must work against a durable completing snapshot.
+
+    await runtime.cancelSourceTurnRunsExplicitly(threadId, sourceTurnId)
+    await expect(runtime.control.get(run.id)).resolves.toMatchObject({
+      status: 'cancelled'
+    })
+    expect(
+      (await runtime.store.events(run.id, 0)).some((envelope) =>
+        envelope.event.type === 'run_status_changed' &&
+        envelope.event.payload.to === 'cancelled' &&
+        envelope.event.payload.reason === 'user interrupted the owning source turn')
+    ).toBe(true)
+    await runtime.stop()
+  })
+
+  it('still cancels unfinished owned runs on incidental settlement', async () => {
+    const { runtime, threadId, sourceTurnId, workspace } = await createOwnedGraphRuntime('unfinished')
+    const identity = await runtime.registry.identify(workspace)
+    await runtime.control.create({
+      runId: 'run_unfinished',
+      threadId,
+      projectId: identity.projectId,
+      sourceTurnId,
+      plan: testGraphPlan({ workspaceRoot: workspace }),
+      commandId: 'create_unfinished',
+      idempotencyKey: 'create_unfinished'
+    })
+    let run = await runtime.control.get('run_unfinished')
+    run = await transitionRun(runtime, run, 'running', 'to_running_unfinished')
+    expect(run.nodes.research?.status).not.toBe('accepted')
+    await startOwnedRuntime(runtime, workspace)
+
+    await runtime.handleSourceTurnTerminal(threadId, sourceTurnId, 'aborted')
+    await expect(runtime.control.get(run.id)).resolves.toMatchObject({
+      status: 'cancelled'
+    })
+    await runtime.stop()
+  })
+
+  it('treats concurrent completion as a successful terminal fence for cancel races', async () => {
+    const { runtime, threadId, sourceTurnId, workspace } = await createOwnedGraphRuntime('race')
+    const identity = await runtime.registry.identify(workspace)
+    await runtime.control.create({
+      runId: 'run_race',
+      threadId,
+      projectId: identity.projectId,
+      sourceTurnId,
+      plan: testGraphPlan({ workspaceRoot: workspace }),
+      commandId: 'create_race',
+      idempotencyKey: 'create_race'
+    })
+    let run = await runtime.control.get('run_race')
+    run = await transitionRun(runtime, run, 'running', 'to_running_race')
+    run = await transitionRun(runtime, run, 'completing', 'to_completing_race')
+
+    const originalList = runtime.store.list.bind(runtime.store)
+    vi.spyOn(runtime.store, 'list').mockImplementation(async (query) => {
+      const listed = await originalList(query)
+      for (const item of listed) {
+        if (item.id !== run.id || item.status === 'completed') continue
+        const latest = (await runtime.store.get(item.id))!
+        if (latest.status === 'completed') continue
+        await runtime.store.append(latest.id, {
+          expectedSeq: latest.lastEventSeq,
+          graphRevision: latest.currentRevision,
+          commandId: 'complete_race_win',
+          idempotencyKey: 'complete_race_win',
+          event: {
+            type: 'run_status_changed',
+            payload: { from: latest.status, to: 'completed' }
+          }
+        })
+      }
+      return listed
+    })
+
+    await expect(
+      runtime.cancelSourceTurnRunsExplicitly(threadId, sourceTurnId)
+    ).resolves.toBeUndefined()
+    await expect(runtime.control.get(run.id)).resolves.toMatchObject({
+      status: 'completed'
+    })
+    await runtime.stop()
+  })
+})
diff --git a/kun/src/server/graph-runtime-factory.ts b/kun/src/server/graph-runtime-factory.ts
index 387295cb7..a38bad3bd 100644
--- a/kun/src/server/graph-runtime-factory.ts
+++ b/kun/src/server/graph-runtime-factory.ts
@@ -35,7 +35,10 @@ import type { SessionStore } from '../ports/session-store.js'
 import type { ThreadStore } from '../ports/thread-store.js'
 import type { RuntimeEventRecorder } from '../services/runtime-event-recorder.js'
 import { createGraphCheckVerifier } from '../graph/graph-check-verifier.js'
-import { isGraphRunCompletionFinalizing } from '../graph/graph-run-completion.js'
+import {
+  isGraphRunCompletionFinalizing,
+  isGraphRunSemanticComplete
+} from '../graph/graph-run-completion.js'
 import {
   recoverGraphLeadOwnership,
   recoverGraphPlanningCommits
@@ -419,6 +422,21 @@ export class GraphRuntimeComposition {
     }
   }
 
+  /**
+   * Explicit user Stop / interruptTurn fence. Always cancels owned nonterminal
+   * GraphRuns before the source turn is persisted as aborted. Do not use for
+   * incidental Lead settlement (model failure, approval expiry, normal
+   * completed turn) — call {@link handleSourceTurnTerminal} without force.
+   */
+  async cancelSourceTurnRunsExplicitly(
+    threadId: string,
+    sourceTurnId: string
+  ): Promise<void> {
+    await this.handleSourceTurnTerminal(threadId, sourceTurnId, 'aborted', {
+      forceCancel: true
+    })
+  }
+
   async handleSourceTurnTerminal(
     threadId: string,
     sourceTurnId: string,
@@ -437,19 +455,30 @@ export class GraphRuntimeComposition {
       }
       if (
         options.forceCancel !== true &&
-        isGraphRunCompletionFinalizing(run, this.mailbox)
+        isGraphRunSemanticComplete(run)
       ) {
-        // Scheduler owns idempotent cleanup and completion. Wake it when the
-        // source Lead has just failed so a persisted final summary can finish
-        // without needing another Lead episode.
-        await this.scheduler?.resumeRun(run.id)
+        // Incidental settlement: never cancel semantically finished work.
+        // resumeRun only auto-finishes when finalization is also safe
+        // (no mailbox / human / scheduler holds). Explicit Stop uses
+        // forceCancel and must not take this branch (#1071).
+        if (isGraphRunCompletionFinalizing(run, this.mailbox)) {
+          await this.scheduler?.resumeRun(run.id)
+        }
         continue
       }
       try {
         await this.control.cancel(run.id, {
-          commandId: this.options.ids.next('graph_source_turn_terminal'),
-          idempotencyKey: `source-turn-terminal:${threadId}:${sourceTurnId}:${run.id}:${status}`,
-          reason: `owning source turn ended with status ${status}`
+          commandId: this.options.ids.next(
+            options.forceCancel === true
+              ? 'graph_source_turn_stop'
+              : 'graph_source_turn_terminal'
+          ),
+          idempotencyKey: options.forceCancel === true
+            ? `source-turn-stop:${threadId}:${sourceTurnId}:${run.id}`
+            : `source-turn-terminal:${threadId}:${sourceTurnId}:${run.id}:${status}`,
+          reason: options.forceCancel === true
+            ? 'user interrupted the owning source turn'
+            : `owning source turn ended with status ${status}`
         })
       } catch (error) {
         // Completion may win after list() but before cancel(). That is already
diff --git a/kun/src/server/routes/index.ts b/kun/src/server/routes/index.ts
index f63353d80..9a58d3190 100644
--- a/kun/src/server/routes/index.ts
+++ b/kun/src/server/routes/index.ts
@@ -10,6 +10,7 @@ import {
   getThreadGoal,
   getThreadTodos,
   getThread,
+  getThreadState,
   listThreads,
   setThreadGoal,
   setThreadTodos,
@@ -18,6 +19,7 @@ import {
 import { summarizeThread } from './threads-summarize.js'
 import {
   compactTurn,
+  cancelToolCall,
   getSteeringQueue,
   getTurn,
   interruptTurn,
@@ -170,7 +172,7 @@ import {
  * - `POST /v1/delegation/abort/{childId}` (auth)
  * - `GET /v1/workspace/status` (auth)
  * - `GET/POST /v1/threads` (auth)
- * - `GET/PATCH/DELETE /v1/threads/{id}` (auth)
+ * - `GET/PATCH/DELETE /v1/threads/{id}` and `GET /v1/threads/{id}/state` (auth)
  * - `GET /v1/threads/{id}/model-requests` (auth)
  * - `POST /v1/threads/{id}/fork` (auth)
  * - `POST /v1/threads/{id}/summarize` (auth)
@@ -675,6 +677,14 @@ export function buildRouter(runtime: ServerRuntime): Router {
     if (!authorize(request, runtime)) return ERRORS.unauthorized()
     return createThread(runtime.threadService, request)
   })
+  // This static suffix must be registered before `/:id`, because Router uses
+  // first-match ordering for parameterized paths.
+  router.add('GET', '/v1/threads/:id/state', async (request, ctx) => {
+    if (!authorize(request, runtime)) return ERRORS.unauthorized()
+    const forwarded = await runtime.forwardThreadControl?.(request, ctx.params.id)
+    if (forwarded) return forwarded
+    return getThreadState(runtime.threadService, ctx.params.id, runtime.sessionStore)
+  })
   router.add('GET', '/v1/threads/:id', async (request, ctx) => {
     if (!authorize(request, runtime)) return ERRORS.unauthorized()
     // The active approval gate is process-local. When a manager lease belongs
@@ -800,6 +810,17 @@ export function buildRouter(runtime: ServerRuntime): Router {
     if (forwarded) return forwarded
     return interruptTurn(runtime.turnService, ctx.params.id, ctx.params.turnId, request)
   })
+  router.add('POST', '/v1/threads/:id/turns/:turnId/tool-calls/:callId/cancel', async (request, ctx) => {
+    if (!authorize(request, runtime)) return ERRORS.unauthorized()
+    const forwarded = await runtime.forwardThreadControl?.(request, ctx.params.id)
+    if (forwarded) return forwarded
+    return cancelToolCall(
+      runtime.toolCancellationService,
+      ctx.params.id,
+      ctx.params.turnId,
+      ctx.params.callId
+    )
+  })
   router.add('POST', '/v1/threads/:id/compact', async (request, ctx) => {
     if (!authorize(request, runtime)) return ERRORS.unauthorized()
     return compactTurn(runtime.turnService, ctx.params.id, request)
diff --git a/kun/src/server/routes/server-runtime.ts b/kun/src/server/routes/server-runtime.ts
index a85cdd887..44db37fbb 100644
--- a/kun/src/server/routes/server-runtime.ts
+++ b/kun/src/server/routes/server-runtime.ts
@@ -94,6 +94,7 @@ import type { ModelConnectionRegistry } from '../../services/model-connection-re
 import type { ModelConnectionOAuthService } from '../../services/model-connection-oauth.js'
 import type { OfficialProviderAuthService } from '../../services/official-provider-cli.js'
 import type { ProviderQuotaService } from '../../services/provider-quota-service.js'
+import type { ToolCancellationService } from '../../services/tool-cancellation-service.js'
 
 export type RuntimeToolDiagnostics = {
   providers: ToolProviderPolicy[]
@@ -162,6 +163,7 @@ export type ExtensionPlatformRuntime = {
 export type ServerRuntime = {
   threadService: ThreadService
   turnService: TurnService
+  toolCancellationService?: ToolCancellationService
   usageService: UsageService
   reviewService?: ReviewService
   eventBus: EventBus
diff --git a/kun/src/server/routes/threads.test.ts b/kun/src/server/routes/threads.test.ts
index 198bde87a..ff3cba5bc 100644
--- a/kun/src/server/routes/threads.test.ts
+++ b/kun/src/server/routes/threads.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it, vi } from 'vitest'
-import { forkThread, getThread, updateThread } from './threads.js'
+import { forkThread, getThread, getThreadState, updateThread } from './threads.js'
 import { buildRouter } from './index.js'
 import type { ServerRuntime } from './server-runtime.js'
 import { createThreadRecord } from '../../domain/thread.js'
@@ -118,6 +118,50 @@ describe('getThread replay snapshot boundary (#1087)', () => {
   })
 })
 
+describe('getThreadState', () => {
+  it('returns only metadata and never loads session item history', async () => {
+    const record = createThreadRecord({
+      id: 'thr_state', title: 'State', workspace: '/tmp', model: 'deepseek-chat', status: 'running'
+    })
+    record.turns = [createTurnRecord({
+      id: 'turn_state', threadId: record.id, prompt: 'continue', status: 'running',
+      createdAt: '2026-08-07T00:00:00.000Z'
+    })]
+    const getMetadata = vi.fn(async () => record)
+    const loadItems = vi.fn(async () => {
+      throw new Error('state route must not load items')
+    })
+    const response = await getThreadState({
+      get: vi.fn(async () => record),
+      getMetadata
+    } as unknown as ThreadService, record.id, {
+      highestSeq: vi.fn(async () => 73),
+      loadItems
+    } as never)
+
+    expect(response.status).toBe(200)
+    expect(JSON.parse(response.body)).toEqual({
+      id: record.id,
+      status: 'running',
+      updatedAt: record.updatedAt,
+      latestSeq: 73,
+      latestTurn: { id: 'turn_state', status: 'running', orchestration: 'direct' }
+    })
+    expect(getMetadata).toHaveBeenCalledWith(record.id)
+    expect(loadItems).not.toHaveBeenCalled()
+  })
+
+  it('returns the normal 404 response for a missing thread', async () => {
+    const response = await getThreadState({
+      get: vi.fn(async () => null),
+      getMetadata: vi.fn(async () => null)
+    } as unknown as ThreadService, 'thr_missing')
+
+    expect(response.status).toBe(404)
+    expect(JSON.parse(response.body)).toMatchObject({ code: 'not_found' })
+  })
+})
+
 describe('getThread session-only goal context', () => {
   it('does not expose durable goal context through the renderer hydration snapshot', async () => {
     const record = createThreadRecord({
@@ -348,4 +392,24 @@ describe('GET /v1/threads/:id active-owner forwarding (#1053)', () => {
     expect(forwardThreadControl).toHaveBeenCalledWith(request, 'thr_owner')
     expect(result).toBe(forwarded)
   })
+
+  it('registers the authenticated lightweight state route before the generic detail route', async () => {
+    const forwarded = new Response(JSON.stringify({ state: true }), { status: 200 })
+    const forwardThreadControl = vi.fn(async () => forwarded)
+    const router = buildRouter({
+      runtimeToken: 'thread-route-token', insecure: false, forwardThreadControl
+    } as unknown as ServerRuntime)
+    const authorized = new Request('http://127.0.0.1/v1/threads/thr_owner/state', {
+      headers: { authorization: 'Bearer thread-route-token' }
+    })
+    const match = router.match('GET', new URL(authorized.url).pathname)
+    if (!match) throw new Error('thread state route not found')
+
+    expect(await match.handler(authorized, { params: match.params })).toBe(forwarded)
+    expect(forwardThreadControl).toHaveBeenCalledWith(authorized, 'thr_owner')
+
+    const unauthorized = new Request('http://127.0.0.1/v1/threads/thr_owner/state')
+    const rejected = await match.handler(unauthorized, { params: match.params })
+    expect(rejected.status).toBe(401)
+  })
 })
diff --git a/kun/src/server/routes/threads.ts b/kun/src/server/routes/threads.ts
index 2512941bc..3ccadf312 100644
--- a/kun/src/server/routes/threads.ts
+++ b/kun/src/server/routes/threads.ts
@@ -9,6 +9,7 @@ import {
   SetThreadGoalRequest,
   SetThreadTodosRequest,
   ThreadGoalResponse,
+  ThreadRuntimeStateSchema,
   ThreadSchema,
   ThreadTodosResponse,
   UpdateThreadRequest,
@@ -104,7 +105,21 @@ export async function getThread(
   // replayable without creating either an old-state/new-cursor gap or duplicate
   // assistant text.
   const latestSeq = sessionStore ? await sessionStore.highestSeq(threadId) : 0
-  const thread = await service.get(threadId)
+  // With a durable session store, the thread metadata and items are separate
+  // projections. Read only metadata here, then hydrate item history once
+  // below; `service.get()` would otherwise transfer the same history first.
+  let thread: ThreadRecord | null
+  let loadedSessionItems: TurnItem[] | undefined
+  if (sessionStore) {
+    const loaded = await Promise.all([
+      loadThreadMetadata(service, threadId),
+      sessionStore.loadItems(threadId)
+    ])
+    thread = loaded[0]
+    loadedSessionItems = loaded[1]
+  } else {
+    thread = await service.get(threadId)
+  }
   if (!thread) {
     return jsonResponse(
       { code: 'not_found', message: `thread not found: ${threadId}` },
@@ -114,7 +129,7 @@ export async function getThread(
   const pendingApprovals = approvalGate?.pending(threadId) ?? []
   let sessionItems: TurnItem[] = []
   if (sessionStore) {
-    sessionItems = await sessionStore.loadItems(threadId)
+    sessionItems = loadedSessionItems ?? []
     sessionItems = await healSessionItemsForFinishedTurns(thread, sessionItems, sessionStore)
   } else if (pendingApprovals.length > 0) {
     // Tests and lightweight embedded callers can omit the session store. Use
@@ -149,6 +164,48 @@ export async function getThread(
   })
 }
 
+/**
+ * Return just enough state to decide whether a background thread is still
+ * running. This route intentionally never reads session items.
+ */
+export async function getThreadState(
+  service: ThreadService,
+  threadId: string,
+  sessionStore?: SessionStore
+): Promise<JsonResponse> {
+  const latestSeq = sessionStore ? await sessionStore.highestSeq(threadId) : 0
+  const thread = await loadThreadMetadata(service, threadId)
+  if (!thread) {
+    return jsonResponse(
+      { code: 'not_found', message: `thread not found: ${threadId}` },
+      404
+    )
+  }
+  const latestTurn = thread.turns.at(-1)
+  return jsonResponse(ThreadRuntimeStateSchema.parse({
+    id: thread.id,
+    status: thread.status,
+    updatedAt: thread.updatedAt,
+    latestSeq,
+    latestTurn: latestTurn
+      ? {
+          id: latestTurn.id,
+          status: latestTurn.status,
+          orchestration: latestTurn.orchestration === 'graph' ? 'graph' : 'direct'
+        }
+      : null
+  }))
+}
+
+function loadThreadMetadata(service: ThreadService, threadId: string): Promise<ThreadRecord | null> {
+  // Keep direct route-unit fakes and third-party ThreadService facades from
+  // needing a coordinated upgrade; production ThreadService always exposes
+  // getMetadata and takes the lightweight path.
+  return typeof service.getMetadata === 'function'
+    ? service.getMetadata(threadId)
+    : service.get(threadId)
+}
+
 function mergePendingApprovalItems(
   sessionItems: TurnItem[],
   pendingApprovals: readonly ApprovalRequest[]
diff --git a/kun/src/server/routes/turns.test.ts b/kun/src/server/routes/turns.test.ts
index 1d2d837b8..b1d30c4a8 100644
--- a/kun/src/server/routes/turns.test.ts
+++ b/kun/src/server/routes/turns.test.ts
@@ -12,7 +12,7 @@ import { SequentialIdGenerator } from '../../ports/id-generator.js'
 import { RuntimeEventRecorder } from '../../services/runtime-event-recorder.js'
 import { TurnService } from '../../services/turn-service.js'
 import type { JsonResponse } from '../response.js'
-import { getTurn, rewindThread, startTurn, steerTurn } from './turns.js'
+import { cancelToolCall, getTurn, rewindThread, startTurn, steerTurn } from './turns.js'
 
 describe('GET /v1/threads/:id/turns/:turnId public-item boundary', () => {
   it('does not expose a legacy internal goal context from the raw turn mirror', async () => {
@@ -69,6 +69,48 @@ describe('POST /v1/threads/:id/turns/:turnId/steer execution', () => {
   })
 })
 
+describe('POST /v1/threads/:id/turns/:turnId/tool-calls/:callId/cancel', () => {
+  it('returns the accepted cancellation status without requiring a request body', async () => {
+    const cancellation = {
+      cancel: vi.fn(async (input: { threadId: string; turnId: string; callId: string }) => ({
+        ...input,
+        status: 'cancellation_requested' as const
+      }))
+    }
+    const response = await cancelToolCall(
+      cancellation as never,
+      'thread_1',
+      'turn_1',
+      'call_1'
+    ) as JsonResponse
+
+    expect(response.status).toBe(200)
+    expect(JSON.parse(response.body)).toEqual({
+      threadId: 'thread_1',
+      turnId: 'turn_1',
+      callId: 'call_1',
+      status: 'cancellation_requested'
+    })
+    expect(cancellation.cancel).toHaveBeenCalledWith({
+      threadId: 'thread_1',
+      turnId: 'turn_1',
+      callId: 'call_1'
+    })
+  })
+
+  it('maps missing and inactive calls to the documented HTTP statuses', async () => {
+    const notFound = await cancelToolCall({
+      cancel: async () => { throw new Error('tool call not found: call_1') }
+    } as never, 'thread_1', 'turn_1', 'call_1') as JsonResponse
+    expect(notFound.status).toBe(404)
+
+    const conflict = await cancelToolCall({
+      cancel: async () => { throw new Error('tool call is no longer active: call_1') }
+    } as never, 'thread_1', 'turn_1', 'call_1') as JsonResponse
+    expect(conflict.status).toBe(409)
+  })
+})
+
 describe('POST /v1/threads/:id/turns admission', () => {
   it('rejects stale Graph submissions after safe disable while direct turns remain available', async () => {
     const threadStore = new InMemoryThreadStore()
diff --git a/kun/src/server/routes/turns.ts b/kun/src/server/routes/turns.ts
index 132afeecc..fae3553b4 100644
--- a/kun/src/server/routes/turns.ts
+++ b/kun/src/server/routes/turns.ts
@@ -1,5 +1,6 @@
 import {
   CompactRequest,
+  CancelToolCallResponse,
   InterruptTurnRequest,
   InterruptTurnResponse,
   RewindThreadRequest,
@@ -17,6 +18,7 @@ import { ERRORS } from './runtime-error.js'
 import { TurnCapacityError, TurnConflictError, type TurnService } from '../../services/turn-service.js'
 import { ThreadExecutionBusyError } from '../../ports/thread-execution-lease.js'
 import { isPublicTurnItem } from '../../contracts/items.js'
+import type { ToolCancellationService } from '../../services/tool-cancellation-service.js'
 
 export async function startTurn(
   turns: TurnService,
@@ -155,6 +157,27 @@ export async function interruptTurn(
   return jsonResponse(payload)
 }
 
+export async function cancelToolCall(
+  cancellation: ToolCancellationService | undefined,
+  threadId: string,
+  turnId: string,
+  callId: string
+): Promise<JsonResponse | Response> {
+  if (!cancellation) return ERRORS.unavailable('tool cancellation is unavailable')
+  try {
+    const result = await cancellation.cancel({ threadId, turnId, callId })
+    const payload: CancelToolCallResponse = CancelToolCallResponse.parse(result)
+    return jsonResponse(payload)
+  } catch (error) {
+    if (error instanceof TurnConflictError) return ERRORS.conflict(error.message)
+    if (error instanceof Error && /not found/i.test(error.message)) return ERRORS.notFound(error.message)
+    if (error instanceof Error && /no longer active|not currently executing|already being interrupted/i.test(error.message)) {
+      return ERRORS.conflict(error.message)
+    }
+    throw error
+  }
+}
+
 export async function compactTurn(
   turns: TurnService,
   threadId: string,
diff --git a/kun/src/server/runtime-factory.ts b/kun/src/server/runtime-factory.ts
index f3768a886..f9c8c21fd 100644
--- a/kun/src/server/runtime-factory.ts
+++ b/kun/src/server/runtime-factory.ts
@@ -104,6 +104,7 @@ import {
 } from '../contracts/policy.js'
 import { AgentLoop, type AgentLoopOptions } from '../loop/agent-loop.js'
 import { ContextCompactor } from '../loop/context-compactor.js'
+import { withModelTiming } from '../loop/model-timing-decorator.js'
 import type { TokenEconomyConfig } from '../loop/token-economy.js'
 import {
   DEFAULT_CONTEXT_THRESHOLDS,
@@ -138,6 +139,7 @@ import { buildBuiltinHooks } from '../hooks/builtins/index.js'
 import { mergeBuiltinSubagentProfiles } from '../delegation/builtin-profiles.js'
 import { buildExploreAgentToolProvider } from '../adapters/tool/explore-agent-tool-provider.js'
 import { InflightTracker } from '../loop/inflight-tracker.js'
+import { ToolCancellationRegistry } from '../loop/tool-cancellation-registry.js'
 import { SteeringQueue } from '../loop/steering-queue.js'
 import type { TurnRunOutcome } from '../loop/turn-execution-types.js'
 import { RandomIdGenerator } from '../ports/id-generator.js'
@@ -148,6 +150,7 @@ import type { ToolHostContext } from '../ports/tool-host.js'
 import { ScopedMigrationMaintenanceLock } from '../ports/migration-maintenance-lock.js'
 import { KUN_SYSTEM_PROMPT } from '../prompt/kun-system-prompt.js'
 import { RuntimeEventRecorder } from '../services/runtime-event-recorder.js'
+import { ToolCancellationService } from '../services/tool-cancellation-service.js'
 import { GraphRuntimeComposition } from './graph-runtime-factory.js'
 import { createGraphRuntimeStartOptions } from './graph-runtime-bootstrap.js'
 import {
@@ -411,6 +414,7 @@ async function createKunServeRuntimeComposition(
   const workspaceInspector = new LocalWorkspaceInspector()
   const usageService = new UsageService()
   const inflight = new InflightTracker()
+  const toolCancellation = new ToolCancellationRegistry()
   const steering = new SteeringQueue()
   let modelProfiles = modelContextProfilesFromConfig({
     contextCompaction: activeOptions.contextCompaction,
@@ -772,17 +776,23 @@ async function createKunServeRuntimeComposition(
     modelCapabilities,
     routeHealth
   )
+  /**
+   * Timing-instrumented entry point shared by the chat loop, child agents,
+   * review, and compaction so every model response reports TTFT and
+   * generation duration on its usage chunk.
+   */
+  const timedModelClient = withModelTiming(modelClient)
   const routePoolTests = new RoutePoolTestService(
     modelClient,
     () => modelClient.routePools(),
     routeHealth
   )
   const subagentRouter = new SubagentRouter({
-    modelClient,
+    modelClient: timedModelClient,
     roles: () => activeOptions.roles,
     defaultModel: () => activeOptions.model,
     recordUsage: async ({ threadId, turnId, model, usage }) => {
-      const cumulative = usageService.record(threadId, usage)
+      const cumulative = usageService.record(threadId, usage, undefined, turnId)
       await events.record({
         kind: 'usage',
         threadId,
@@ -1025,7 +1035,7 @@ async function createKunServeRuntimeComposition(
     inflight,
     steering,
     compactor,
-    model: modelClient,
+    model: timedModelClient,
     usage: usageService,
     prefix,
     attachmentStore: () => attachmentStore,
@@ -1041,9 +1051,7 @@ async function createKunServeRuntimeComposition(
 	    transitionGraphPlanningDraft: (input) =>
 	      graphRuntime.transitionPlanningDraft(input),
 	    cancelGraphSourceRuns: ({ threadId, sourceTurnId }) =>
-	      graphRuntime.handleSourceTurnTerminal(threadId, sourceTurnId, 'aborted', {
-	        forceCancel: true
-	      }),
+	      graphRuntime.cancelSourceTurnRunsExplicitly(threadId, sourceTurnId),
 	    migrationMaintenance,
 	    ids,
 	    nowIso
@@ -1075,6 +1083,11 @@ async function createKunServeRuntimeComposition(
     turns: turnService,
     nowIso
   })
+  const toolCancellationService = new ToolCancellationService(
+    turnService,
+    toolCancellation,
+    nowIso
+  )
   const supplyChainTrust = new InMemoryPublisherTrustStore()
   backgroundShellRuntime.bindStopHandler(stopBashSessionById)
   const backgroundShellTool = createBackgroundShellTool({
@@ -1100,7 +1113,7 @@ async function createKunServeRuntimeComposition(
   const reviewDeps = {
     threadStore,
     turns: turnService,
-    model: modelClient,
+    model: timedModelClient,
     defaultModel: activeOptions.model,
     nowIso,
     modelCapabilities,
@@ -1427,7 +1440,7 @@ async function createKunServeRuntimeComposition(
 	        turns: turnService,
 	        nowIso,
 	        executor: createChildAgentExecutor({
-	          model: modelClient,
+	          model: timedModelClient,
 	          toolHost: childToolHost,
 	          prefix,
 	          defaultModel: activeOptions.model,
@@ -1733,13 +1746,14 @@ async function createKunServeRuntimeComposition(
 	    approvalGate,
       approvalReview: approvalReviewService,
     userInputGate,
-    model: modelClient,
+    model: timedModelClient,
     toolHost,
     sdkRuntime,
     usage: usageService,
     events,
     turns: turnService,
     inflight,
+    toolCancellation,
     steering,
     compactor,
     prefix,
@@ -2473,6 +2487,10 @@ async function createKunServeRuntimeComposition(
 	        tools: [taskGraphTool]
 	      },
 	      ...buildDelegationToolProviders(delegationRuntime, subagentRouter),
+	      ...buildExploreAgentToolProvider(
+	        delegationRuntime,
+	        () => activeOptions.lab?.exploreAgent
+	      ),
 	      ...buildComponentDesignToolProviders(delegationRuntime)
 	    ])
 
@@ -2580,7 +2598,7 @@ async function createKunServeRuntimeComposition(
 	    turnService.updateRuntimeConfig({
 	      defaultModel: activeOptions.model,
 	      contextCompaction: activeOptions.contextCompaction,
-	      model: modelClient,
+	      model: timedModelClient,
 	      maxConcurrentTurns: activeOptions.runtime?.turnLimits?.maxConcurrentTurns
 	    })
 	    extensionAgent.updateRuntimeConfig({
@@ -2634,9 +2652,10 @@ async function createKunServeRuntimeComposition(
 	      }
 	    }
 	  }
-	  return {
+  return {
     threadService,
     turnService,
+    toolCancellationService,
     reviewService,
     usageService,
     eventBus,
diff --git a/kun/src/services/chromium-browser-cookies.test.ts b/kun/src/services/chromium-browser-cookies.test.ts
new file mode 100644
index 000000000..49656c05e
--- /dev/null
+++ b/kun/src/services/chromium-browser-cookies.test.ts
@@ -0,0 +1,292 @@
+import { createCipheriv, createHash } from 'node:crypto'
+import { execFileSync } from 'node:child_process'
+import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import {
+  decryptChromiumCookieValue,
+  deriveChromiumSafeStorageKey,
+  listChromiumCookieDatabaseCandidates,
+  readChromiumCookiesForDomains,
+  readChromiumCookiesForDomainsWithDiagnosis
+} from './chromium-browser-cookies.js'
+
+describe('chromium-browser-cookies', () => {
+  it('lists Comet cookie databases and Chrome Beta/Canary on macOS', () => {
+    const paths = listChromiumCookieDatabaseCandidates({
+      platform: 'darwin',
+      homeDirectory: '/Users/kun',
+      environment: {}
+    }).map((candidate) => candidate.databasePath)
+
+    expect(paths).toEqual(expect.arrayContaining([
+      '/Users/kun/Library/Application Support/Google/Chrome/Default/Network/Cookies',
+      '/Users/kun/Library/Application Support/Google/Chrome/Default/Cookies',
+      '/Users/kun/Library/Application Support/Google/Chrome Beta/Default/Network/Cookies',
+      '/Users/kun/Library/Application Support/Google/Chrome Canary/Default/Network/Cookies',
+      '/Users/kun/Library/Application Support/Comet/Default/Network/Cookies',
+      '/Users/kun/Library/Application Support/Comet/Default/Cookies',
+      '/Users/kun/Library/Application Support/Dia/User Data/Default/Cookies'
+    ]))
+  })
+
+  it('skips missing cookie databases when a profile root exists', () => {
+    const home = mkdtempSync(join(tmpdir(), 'kun-chromium-home-'))
+    const profileRoot = join(home, 'Library', 'Application Support', 'Google', 'Chrome')
+    const defaultProfile = join(profileRoot, 'Default')
+    mkdirSync(join(defaultProfile, 'Network'), { recursive: true })
+    writeFileSync(join(defaultProfile, 'Cookies'), '')
+
+    const paths = listChromiumCookieDatabaseCandidates({
+      platform: 'darwin',
+      homeDirectory: home,
+      environment: {},
+      browsers: [{
+        id: 'chrome',
+        displayName: 'Chrome',
+        profileRootSegments: ['Google', 'Chrome'],
+        safeStorageLabels: [{ service: 'Chrome Safe Storage', account: 'Chrome' }]
+      }]
+    }).map((candidate) => candidate.databasePath)
+
+    expect(paths).toEqual([join(defaultProfile, 'Cookies')])
+    expect(paths.some((path) => path.includes(`${join('Network', 'Cookies')}`))).toBe(false)
+  })
+
+  it('decrypts v10 cookies with DB version >= 24 domain hash prefix', () => {
+    const password = 'test-password'
+    const key = deriveChromiumSafeStorageKey(password)
+    const hostKey = 'opencode.ai'
+    const plaintext = 'session-token-value'
+    const encrypted = encryptV10Cookie(plaintext, key, hostKey, 24)
+
+    expect(decryptChromiumCookieValue(encrypted, key, hostKey, 24)).toBe(plaintext)
+    expect(
+      decryptChromiumCookieValue(encrypted, key, 'other.host', 24)
+    ).toBeUndefined()
+  })
+
+  it('reads and decrypts OpenCode auth cookies from a Chromium DB', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'kun-chromium-cookie-'))
+    const databasePath = join(directory, 'Cookies')
+    const password = 'comet-password'
+    const key = deriveChromiumSafeStorageKey(password)
+    const hostKey = 'opencode.ai'
+    const token = 'auth-session-token'
+    const encrypted = encryptV10Cookie(token, key, hostKey, 24)
+    const localeEncrypted = encryptV10Cookie('en', key, hostKey, 24)
+    createCookieDatabase(databasePath, [
+      { hostKey, name: 'auth', value: '', encryptedHex: encrypted.toString('hex') },
+      { hostKey, name: 'oc_locale', value: '', encryptedHex: localeEncrypted.toString('hex') }
+    ])
+
+    const cookies = await readChromiumCookiesForDomains({
+      platform: 'darwin',
+      candidates: [{
+        browser: {
+          id: 'comet',
+          displayName: 'Comet',
+          profileRootSegments: ['Comet'],
+          safeStorageLabels: [{ service: 'Comet Safe Storage', account: 'Comet' }]
+        },
+        databasePath
+      }],
+      domainSuffixes: ['opencode.ai', 'app.opencode.ai'],
+      cookieNames: new Set(['auth', '__host-auth']),
+      readSafeStoragePassword: async () => password
+    })
+
+    expect(cookies).toEqual([
+      { name: 'auth', value: token, hostKey: 'opencode.ai' }
+    ])
+  })
+
+  it('reads auth cookies hosted on app.opencode.ai', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'kun-chromium-cookie-app-'))
+    const databasePath = join(directory, 'Cookies')
+    createCookieDatabase(databasePath, [
+      { hostKey: 'app.opencode.ai', name: 'auth', value: 'app-token', encryptedHex: '' }
+    ])
+
+    const result = await readChromiumCookiesForDomainsWithDiagnosis({
+      platform: 'darwin',
+      candidates: [{
+        browser: {
+          id: 'chrome',
+          displayName: 'Chrome',
+          profileRootSegments: ['Google', 'Chrome'],
+          safeStorageLabels: [{ service: 'Chrome Safe Storage', account: 'Chrome' }]
+        },
+        databasePath
+      }],
+      domainSuffixes: ['opencode.ai', 'app.opencode.ai'],
+      cookieNames: new Set(['auth'])
+    })
+
+    expect(result.cookies).toEqual([
+      { name: 'auth', value: 'app-token', hostKey: 'app.opencode.ai' }
+    ])
+    expect(result.diagnosis.kind).toBe('success')
+  })
+
+  it('prefers plaintext cookie values without touching Safe Storage', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'kun-chromium-cookie-plain-'))
+    const databasePath = join(directory, 'Cookies')
+    createCookieDatabase(databasePath, [
+      { hostKey: 'opencode.ai', name: 'auth', value: 'plain-token', encryptedHex: '' }
+    ])
+
+    let passwordCalls = 0
+    const cookies = await readChromiumCookiesForDomains({
+      platform: 'darwin',
+      candidates: [{
+        browser: {
+          id: 'chrome',
+          displayName: 'Chrome',
+          profileRootSegments: ['Google', 'Chrome'],
+          safeStorageLabels: [{ service: 'Chrome Safe Storage', account: 'Chrome' }]
+        },
+        databasePath
+      }],
+      cookieNames: new Set(['auth']),
+      readSafeStoragePassword: async () => {
+        passwordCalls += 1
+        return 'unused'
+      }
+    })
+
+    expect(cookies).toEqual([
+      { name: 'auth', value: 'plain-token', hostKey: 'opencode.ai' }
+    ])
+    expect(passwordCalls).toBe(0)
+  })
+
+  it('reports decrypt_failed when encrypted auth exists but Keychain is unavailable', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'kun-chromium-cookie-locked-'))
+    const databasePath = join(directory, 'Cookies')
+    const key = deriveChromiumSafeStorageKey('secret')
+    const encrypted = encryptV10Cookie('token', key, 'opencode.ai', 24)
+    createCookieDatabase(databasePath, [
+      { hostKey: 'opencode.ai', name: 'auth', value: '', encryptedHex: encrypted.toString('hex') }
+    ])
+
+    const result = await readChromiumCookiesForDomainsWithDiagnosis({
+      platform: 'darwin',
+      candidates: [{
+        browser: {
+          id: 'chrome',
+          displayName: 'Chrome',
+          profileRootSegments: ['Google', 'Chrome'],
+          safeStorageLabels: [{ service: 'Chrome Safe Storage', account: 'Chrome' }]
+        },
+        databasePath
+      }],
+      cookieNames: new Set(['auth']),
+      readSafeStoragePassword: async () => undefined
+    })
+
+    expect(result.cookies).toEqual([])
+    expect(result.diagnosis).toMatchObject({
+      kind: 'decrypt_failed',
+      browserId: 'chrome',
+      reason: 'keychain_unavailable'
+    })
+  })
+
+  it('caches Safe Storage passwords across profiles in one scan', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'kun-chromium-cookie-cache-'))
+    const firstPath = join(directory, 'one', 'Cookies')
+    const secondPath = join(directory, 'two', 'Cookies')
+    mkdirSync(join(directory, 'one'), { recursive: true })
+    mkdirSync(join(directory, 'two'), { recursive: true })
+    const password = 'shared-password'
+    const key = deriveChromiumSafeStorageKey(password)
+    // First profile's blob uses a mismatched domain hash so decrypt fails after
+    // Keychain is consulted; the second profile should reuse the cached password.
+    createCookieDatabase(firstPath, [
+      {
+        hostKey: 'opencode.ai',
+        name: 'auth',
+        value: '',
+        encryptedHex: encryptV10Cookie('stale', key, 'other.host', 24).toString('hex')
+      }
+    ])
+    createCookieDatabase(secondPath, [
+      {
+        hostKey: 'opencode.ai',
+        name: 'auth',
+        value: '',
+        encryptedHex: encryptV10Cookie('cached-token', key, 'opencode.ai', 24).toString('hex')
+      }
+    ])
+
+    let passwordCalls = 0
+    const browser = {
+      id: 'chrome',
+      displayName: 'Chrome',
+      profileRootSegments: ['Google', 'Chrome'],
+      safeStorageLabels: [{ service: 'Chrome Safe Storage', account: 'Chrome' }]
+    }
+    const result = await readChromiumCookiesForDomainsWithDiagnosis({
+      platform: 'darwin',
+      candidates: [
+        { browser, databasePath: firstPath },
+        { browser, databasePath: secondPath }
+      ],
+      cookieNames: new Set(['auth']),
+      readSafeStoragePassword: async () => {
+        passwordCalls += 1
+        return password
+      }
+    })
+
+    expect(result.cookies).toEqual([
+      { name: 'auth', value: 'cached-token', hostKey: 'opencode.ai' }
+    ])
+    expect(passwordCalls).toBe(1)
+  })
+})
+
+function createCookieDatabase(
+  databasePath: string,
+  rows: Array<{ hostKey: string; name: string; value: string; encryptedHex: string }>
+): void {
+  const binary = process.platform === 'darwin' ? '/usr/bin/sqlite3' : 'sqlite3'
+  const inserts = rows.map((row) => {
+    const encryptedSql = row.encryptedHex ? `X'${row.encryptedHex}'` : `X''`
+    return `INSERT INTO cookies (host_key, name, value, encrypted_value) VALUES ('${row.hostKey}', '${row.name}', '${row.value}', ${encryptedSql});`
+  }).join('\n')
+  execFileSync(binary, [databasePath], {
+    input: `
+      CREATE TABLE meta (key TEXT PRIMARY KEY, value TEXT);
+      CREATE TABLE cookies (
+        host_key TEXT,
+        name TEXT,
+        value TEXT,
+        encrypted_value BLOB
+      );
+      INSERT INTO meta (key, value) VALUES ('version', '24');
+      ${inserts}
+    `,
+    encoding: 'utf8'
+  })
+}
+
+function encryptV10Cookie(
+  plaintext: string,
+  key: Buffer,
+  hostKey: string,
+  databaseVersion: number
+): Buffer {
+  const body = databaseVersion >= 24
+    ? Buffer.concat([
+      createHash('sha256').update(hostKey, 'utf8').digest(),
+      Buffer.from(plaintext, 'utf8')
+    ])
+    : Buffer.from(plaintext, 'utf8')
+  const iv = Buffer.alloc(16, 0x20)
+  const cipher = createCipheriv('aes-128-cbc', key, iv)
+  const encrypted = Buffer.concat([cipher.update(body), cipher.final()])
+  return Buffer.concat([Buffer.from('v10', 'utf8'), encrypted])
+}
diff --git a/kun/src/services/chromium-browser-cookies.ts b/kun/src/services/chromium-browser-cookies.ts
new file mode 100644
index 000000000..9ab30c4ac
--- /dev/null
+++ b/kun/src/services/chromium-browser-cookies.ts
@@ -0,0 +1,674 @@
+import { createDecipheriv, createHash, pbkdf2Sync } from 'node:crypto'
+import { execFile } from 'node:child_process'
+import { accessSync, constants, readdirSync } from 'node:fs'
+import { access, copyFile, mkdtemp, rm } from 'node:fs/promises'
+import { homedir, tmpdir } from 'node:os'
+import { join, win32 } from 'node:path'
+import { promisify } from 'node:util'
+
+const execFileAsync = promisify(execFile)
+const CHROMIUM_COOKIE_SALT = Buffer.from('saltysalt')
+const CHROMIUM_COOKIE_IV = Buffer.alloc(16, 0x20)
+/** Allow time for the macOS Keychain Allow dialog on first access. */
+const KEYCHAIN_TIMEOUT_MS = 30_000
+
+export type ChromiumCookieRow = {
+  name: string
+  value: string
+  hostKey: string
+}
+
+export type ChromiumSafeStorageLabel = {
+  service: string
+  account: string
+}
+
+export type ChromiumBrowserCookieSource = {
+  id: string
+  displayName: string
+  /** Application Support-relative profile root on macOS / Linux config root. */
+  profileRootSegments: string[]
+  /** Windows Local AppData-relative profile root. */
+  windowsProfileRootSegments?: string[]
+  /** Linux ~/.config-relative profile root segments. */
+  linuxProfileRootSegments?: string[]
+  safeStorageLabels: ChromiumSafeStorageLabel[]
+}
+
+/**
+ * Chromium browsers CodexBar / SweetCookieKit can import from for OpenCode Go.
+ * Keep Comet and Dia here — they are real session hosts for opencode.ai.
+ * Beta/Canary/Nightly variants match CodexBar's broader Chromium coverage.
+ */
+export const OPENCODE_GO_CHROMIUM_BROWSERS: ChromiumBrowserCookieSource[] = [
+  {
+    id: 'chrome',
+    displayName: 'Chrome',
+    profileRootSegments: ['Google', 'Chrome'],
+    windowsProfileRootSegments: ['Google', 'Chrome', 'User Data'],
+    linuxProfileRootSegments: ['google-chrome'],
+    safeStorageLabels: [{ service: 'Chrome Safe Storage', account: 'Chrome' }]
+  },
+  {
+    id: 'chrome-beta',
+    displayName: 'Chrome Beta',
+    profileRootSegments: ['Google', 'Chrome Beta'],
+    windowsProfileRootSegments: ['Google', 'Chrome Beta', 'User Data'],
+    linuxProfileRootSegments: ['google-chrome-beta'],
+    safeStorageLabels: [
+      { service: 'Chrome Safe Storage', account: 'Chrome' },
+      { service: 'Chrome Beta Safe Storage', account: 'Chrome Beta' }
+    ]
+  },
+  {
+    id: 'chrome-canary',
+    displayName: 'Chrome Canary',
+    profileRootSegments: ['Google', 'Chrome Canary'],
+    windowsProfileRootSegments: ['Google', 'Chrome SxS', 'User Data'],
+    linuxProfileRootSegments: ['google-chrome-unstable'],
+    safeStorageLabels: [
+      { service: 'Chrome Safe Storage', account: 'Chrome' },
+      { service: 'Chrome Canary Safe Storage', account: 'Chrome Canary' }
+    ]
+  },
+  {
+    id: 'edge',
+    displayName: 'Microsoft Edge',
+    profileRootSegments: ['Microsoft Edge'],
+    windowsProfileRootSegments: ['Microsoft', 'Edge', 'User Data'],
+    linuxProfileRootSegments: ['microsoft-edge'],
+    safeStorageLabels: [
+      { service: 'Microsoft Edge Safe Storage', account: 'Microsoft Edge' }
+    ]
+  },
+  {
+    id: 'edge-beta',
+    displayName: 'Microsoft Edge Beta',
+    profileRootSegments: ['Microsoft Edge Beta'],
+    windowsProfileRootSegments: ['Microsoft', 'Edge Beta', 'User Data'],
+    linuxProfileRootSegments: ['microsoft-edge-beta'],
+    safeStorageLabels: [
+      { service: 'Microsoft Edge Safe Storage', account: 'Microsoft Edge' },
+      { service: 'Microsoft Edge Beta Safe Storage', account: 'Microsoft Edge Beta' }
+    ]
+  },
+  {
+    id: 'edge-canary',
+    displayName: 'Microsoft Edge Canary',
+    profileRootSegments: ['Microsoft Edge Canary'],
+    windowsProfileRootSegments: ['Microsoft', 'Edge SxS', 'User Data'],
+    linuxProfileRootSegments: ['microsoft-edge-dev'],
+    safeStorageLabels: [
+      { service: 'Microsoft Edge Safe Storage', account: 'Microsoft Edge' },
+      { service: 'Microsoft Edge Canary Safe Storage', account: 'Microsoft Edge Canary' }
+    ]
+  },
+  {
+    id: 'brave',
+    displayName: 'Brave',
+    profileRootSegments: ['BraveSoftware', 'Brave-Browser'],
+    windowsProfileRootSegments: ['BraveSoftware', 'Brave-Browser', 'User Data'],
+    linuxProfileRootSegments: ['BraveSoftware', 'Brave-Browser'],
+    safeStorageLabels: [{ service: 'Brave Safe Storage', account: 'Brave' }]
+  },
+  {
+    id: 'brave-beta',
+    displayName: 'Brave Beta',
+    profileRootSegments: ['BraveSoftware', 'Brave-Browser-Beta'],
+    windowsProfileRootSegments: ['BraveSoftware', 'Brave-Browser-Beta', 'User Data'],
+    linuxProfileRootSegments: ['BraveSoftware', 'Brave-Browser-Beta'],
+    safeStorageLabels: [
+      { service: 'Brave Safe Storage', account: 'Brave' },
+      { service: 'Brave Safe Storage', account: 'Brave Beta' }
+    ]
+  },
+  {
+    id: 'brave-nightly',
+    displayName: 'Brave Nightly',
+    profileRootSegments: ['BraveSoftware', 'Brave-Browser-Nightly'],
+    windowsProfileRootSegments: ['BraveSoftware', 'Brave-Browser-Nightly', 'User Data'],
+    linuxProfileRootSegments: ['BraveSoftware', 'Brave-Browser-Nightly'],
+    safeStorageLabels: [
+      { service: 'Brave Safe Storage', account: 'Brave' },
+      { service: 'Brave Safe Storage', account: 'Brave Nightly' }
+    ]
+  },
+  {
+    id: 'arc',
+    displayName: 'Arc',
+    profileRootSegments: ['Arc', 'User Data'],
+    linuxProfileRootSegments: ['arc'],
+    safeStorageLabels: [{ service: 'Arc Safe Storage', account: 'Arc' }]
+  },
+  {
+    id: 'dia',
+    displayName: 'Dia',
+    profileRootSegments: ['Dia', 'User Data'],
+    safeStorageLabels: [{ service: 'Dia Safe Storage', account: 'Dia' }]
+  },
+  {
+    id: 'comet',
+    displayName: 'Comet',
+    profileRootSegments: ['Comet'],
+    linuxProfileRootSegments: ['comet'],
+    safeStorageLabels: [{ service: 'Comet Safe Storage', account: 'Comet' }]
+  },
+  {
+    id: 'vivaldi',
+    displayName: 'Vivaldi',
+    profileRootSegments: ['Vivaldi'],
+    windowsProfileRootSegments: ['Vivaldi', 'User Data'],
+    linuxProfileRootSegments: ['vivaldi'],
+    safeStorageLabels: [{ service: 'Vivaldi Safe Storage', account: 'Vivaldi' }]
+  },
+  {
+    id: 'chromium',
+    displayName: 'Chromium',
+    profileRootSegments: ['Chromium'],
+    windowsProfileRootSegments: ['Chromium', 'User Data'],
+    linuxProfileRootSegments: ['chromium'],
+    safeStorageLabels: [{ service: 'Chromium Safe Storage', account: 'Chromium' }]
+  }
+]
+
+export type ChromiumCookieDatabaseCandidate = {
+  browser: ChromiumBrowserCookieSource
+  databasePath: string
+}
+
+/** Non-sensitive outcome of a Chromium cookie scan (never includes cookie values). */
+export type ChromiumCookieReadDiagnosis =
+  | {
+    kind: 'success'
+    browserId: string
+    browserDisplayName: string
+    databasePath: string
+  }
+  | {
+    kind: 'not_found'
+    scannedDatabases: number
+    foundAuthRows: boolean
+  }
+  | {
+    kind: 'decrypt_failed'
+    browserId: string
+    browserDisplayName: string
+    databasePath: string
+    reason: 'keychain_unavailable' | 'decrypt_failed'
+  }
+
+export type ChromiumCookieReadResult = {
+  cookies: ChromiumCookieRow[]
+  diagnosis: ChromiumCookieReadDiagnosis
+}
+
+export type ReadChromiumCookiesForDomainsOptions = {
+  platform?: NodeJS.Platform
+  environment?: NodeJS.ProcessEnv
+  homeDirectory?: string
+  browsers?: ChromiumBrowserCookieSource[]
+  candidates?: ChromiumCookieDatabaseCandidate[]
+  domainSuffixes?: string[]
+  cookieNames?: Set<string>
+  readSafeStoragePassword?: (
+    label: ChromiumSafeStorageLabel
+  ) => Promise<string | undefined>
+}
+
+/**
+ * Reads Chromium cookies for the given domains, decrypting macOS Safe Storage
+ * values when needed. Mirrors SweetCookieKit's best-effort Chromium path:
+ * copy the locked Cookies DB, decrypt v10 blobs with PBKDF2+AES-CBC, and for
+ * cookie DB version >= 24 strip the SHA-256(host_key) prefix.
+ */
+export async function readChromiumCookiesForDomains(
+  options: ReadChromiumCookiesForDomainsOptions = {}
+): Promise<ChromiumCookieRow[]> {
+  const result = await readChromiumCookiesForDomainsWithDiagnosis(options)
+  return result.cookies
+}
+
+/**
+ * Same as {@link readChromiumCookiesForDomains}, but also returns a
+ * non-sensitive diagnosis so callers can distinguish "not signed in" from
+ * "signed in but Keychain/decrypt failed".
+ */
+export async function readChromiumCookiesForDomainsWithDiagnosis(
+  options: ReadChromiumCookiesForDomainsOptions = {}
+): Promise<ChromiumCookieReadResult> {
+  const domainSuffixes = options.domainSuffixes ?? ['opencode.ai', 'app.opencode.ai']
+  const cookieNames = options.cookieNames
+  const candidates = options.candidates ??
+    listChromiumCookieDatabaseCandidates(options)
+  const passwordCache = new Map<string, string | undefined>()
+  let scannedDatabases = 0
+  let foundAuthRows = false
+  let decryptFailure: Extract<ChromiumCookieReadDiagnosis, { kind: 'decrypt_failed' }> | undefined
+
+  for (const candidate of candidates) {
+    try {
+      if (!(await cookieDatabaseExists(candidate.databasePath))) continue
+      scannedDatabases += 1
+      const rows = await readCookiesFromDatabase(candidate.databasePath, domainSuffixes)
+      const matched = rows.filter((row) =>
+        cookieNames ? cookieNames.has(row.name.toLowerCase()) : true
+      )
+      if (matched.length === 0) continue
+      foundAuthRows = true
+
+      const plaintext = matched.filter((row) => row.value.trim().length > 0)
+      if (plaintext.length > 0) {
+        return {
+          cookies: plaintext.map((row) => ({
+            name: row.name,
+            value: row.value,
+            hostKey: row.hostKey
+          })),
+          diagnosis: {
+            kind: 'success',
+            browserId: candidate.browser.id,
+            browserDisplayName: candidate.browser.displayName,
+            databasePath: candidate.databasePath
+          }
+        }
+      }
+
+      const encrypted = matched.filter((row) => row.encryptedValue.length > 0)
+      if (encrypted.length === 0) continue
+      const platform = options.platform ?? process.platform
+      if (platform !== 'darwin') {
+        decryptFailure = {
+          kind: 'decrypt_failed',
+          browserId: candidate.browser.id,
+          browserDisplayName: candidate.browser.displayName,
+          databasePath: candidate.databasePath,
+          reason: 'decrypt_failed'
+        }
+        continue
+      }
+
+      const password = await resolveSafeStoragePassword(
+        candidate.browser,
+        options.readSafeStoragePassword,
+        passwordCache
+      )
+      if (!password) {
+        decryptFailure = {
+          kind: 'decrypt_failed',
+          browserId: candidate.browser.id,
+          browserDisplayName: candidate.browser.displayName,
+          databasePath: candidate.databasePath,
+          reason: 'keychain_unavailable'
+        }
+        continue
+      }
+      const key = deriveChromiumSafeStorageKey(password)
+      const decrypted: ChromiumCookieRow[] = []
+      for (const row of encrypted) {
+        const value = decryptChromiumCookieValue(
+          row.encryptedValue,
+          key,
+          row.hostKey,
+          row.databaseVersion
+        )
+        if (!value?.trim()) continue
+        decrypted.push({ name: row.name, value, hostKey: row.hostKey })
+      }
+      if (decrypted.length > 0) {
+        return {
+          cookies: decrypted,
+          diagnosis: {
+            kind: 'success',
+            browserId: candidate.browser.id,
+            browserDisplayName: candidate.browser.displayName,
+            databasePath: candidate.databasePath
+          }
+        }
+      }
+      decryptFailure = {
+        kind: 'decrypt_failed',
+        browserId: candidate.browser.id,
+        browserDisplayName: candidate.browser.displayName,
+        databasePath: candidate.databasePath,
+        reason: 'decrypt_failed'
+      }
+    } catch {
+      // Locked DBs and unexpected IO failures are expected; try the next source.
+    }
+  }
+
+  if (decryptFailure) {
+    return { cookies: [], diagnosis: decryptFailure }
+  }
+  return {
+    cookies: [],
+    diagnosis: {
+      kind: 'not_found',
+      scannedDatabases,
+      foundAuthRows
+    }
+  }
+}
+
+export function listChromiumCookieDatabaseCandidates(
+  options: Omit<
+    ReadChromiumCookiesForDomainsOptions,
+    'candidates' | 'domainSuffixes' | 'cookieNames' | 'readSafeStoragePassword'
+  > = {}
+): ChromiumCookieDatabaseCandidate[] {
+  const platform = options.platform ?? process.platform
+  const environment = options.environment ?? process.env
+  const userHome = options.homeDirectory ?? homedir()
+  const browsers = options.browsers ?? OPENCODE_GO_CHROMIUM_BROWSERS
+  const joinPath = platform === 'win32' ? win32.join : join
+  const roots: Array<{ browser: ChromiumBrowserCookieSource; root: string }> = []
+
+  for (const browser of browsers) {
+    if (platform === 'darwin') {
+      roots.push({
+        browser,
+        root: joinPath(userHome, 'Library', 'Application Support', ...browser.profileRootSegments)
+      })
+      continue
+    }
+    if (platform === 'linux') {
+      const segments = browser.linuxProfileRootSegments
+      if (!segments?.length) continue
+      roots.push({
+        browser,
+        root: joinPath(userHome, '.config', ...segments)
+      })
+      continue
+    }
+    if (platform === 'win32') {
+      const segments = browser.windowsProfileRootSegments
+      if (!segments) continue
+      const localAppData = environment.LOCALAPPDATA?.trim()
+      const localRoot = localAppData || joinPath(userHome, 'AppData', 'Local')
+      roots.push({
+        browser,
+        root: joinPath(localRoot, ...segments)
+      })
+    }
+  }
+
+  const out: ChromiumCookieDatabaseCandidate[] = []
+  for (const { browser, root } of roots) {
+    for (const profileName of discoverChromiumProfileNamesSync(root)) {
+      const networkPath = joinPath(root, profileName, 'Network', 'Cookies')
+      const legacyPath = joinPath(root, profileName, 'Cookies')
+      // Prefer listing only paths that exist when the profile root is readable.
+      // When the root itself is missing, keep Default candidates for tests that
+      // assert path shapes without creating directories.
+      if (directoryExistsSync(root)) {
+        if (cookieDatabaseExistsSync(networkPath)) {
+          out.push({ browser, databasePath: networkPath })
+        }
+        if (cookieDatabaseExistsSync(legacyPath)) {
+          out.push({ browser, databasePath: legacyPath })
+        }
+        continue
+      }
+      out.push(
+        { browser, databasePath: networkPath },
+        { browser, databasePath: legacyPath }
+      )
+    }
+  }
+  return out
+}
+
+/** Exported for tests: PBKDF2 key derivation used by Chromium Safe Storage. */
+export function deriveChromiumSafeStorageKey(password: string): Buffer {
+  return pbkdf2Sync(password, CHROMIUM_COOKIE_SALT, 1_003, 16, 'sha1')
+}
+
+/** Exported for tests: decrypt a Chromium v10 cookie blob. */
+export function decryptChromiumCookieValue(
+  encryptedValue: Buffer,
+  key: Buffer,
+  hostKey: string,
+  databaseVersion: number
+): string | undefined {
+  if (encryptedValue.length <= 3) return undefined
+  const prefix = encryptedValue.subarray(0, 3).toString('utf8')
+  if (prefix !== 'v10') return undefined
+  const payload = encryptedValue.subarray(3)
+  if (payload.length === 0 || payload.length % 16 !== 0) return undefined
+  let decrypted: Buffer
+  try {
+    const decipher = createDecipheriv('aes-128-cbc', key, CHROMIUM_COOKIE_IV)
+    decrypted = Buffer.concat([decipher.update(payload), decipher.final()])
+  } catch {
+    return undefined
+  }
+  let value = decrypted
+  if (databaseVersion >= 24) {
+    const expectedDomainHash = createHash('sha256').update(hostKey, 'utf8').digest()
+    if (
+      value.length < expectedDomainHash.length ||
+      !value.subarray(0, expectedDomainHash.length).equals(expectedDomainHash)
+    ) {
+      return undefined
+    }
+    value = value.subarray(expectedDomainHash.length)
+  }
+  const text = value.toString('utf8')
+  return text.length > 0 ? text : undefined
+}
+
+type RawCookieRow = {
+  name: string
+  value: string
+  hostKey: string
+  encryptedValue: Buffer
+  databaseVersion: number
+}
+
+async function cookieDatabaseExists(databasePath: string): Promise<boolean> {
+  try {
+    await access(databasePath)
+    return true
+  } catch {
+    return false
+  }
+}
+
+function cookieDatabaseExistsSync(databasePath: string): boolean {
+  try {
+    accessSync(databasePath, constants.F_OK)
+    return true
+  } catch {
+    return false
+  }
+}
+
+function directoryExistsSync(directoryPath: string): boolean {
+  try {
+    accessSync(directoryPath, constants.F_OK)
+    return true
+  } catch {
+    return false
+  }
+}
+
+async function readCookiesFromDatabase(
+  databasePath: string,
+  domainSuffixes: string[]
+): Promise<RawCookieRow[]> {
+  const tempRoot = await mkdtemp(join(tmpdir(), 'kun-chromium-cookies-'))
+  const copiedDb = join(tempRoot, 'Cookies')
+  try {
+    await copyFile(databasePath, copiedDb)
+    await Promise.allSettled([
+      copyFile(`${databasePath}-wal`, `${copiedDb}-wal`),
+      copyFile(`${databasePath}-shm`, `${copiedDb}-shm`)
+    ])
+
+    let sqliteModule: { default: typeof import('better-sqlite3') }
+    try {
+      sqliteModule = await import('better-sqlite3')
+    } catch {
+      return await readCookiesFromDatabaseWithSqliteCli(copiedDb, domainSuffixes)
+    }
+
+    let database: import('better-sqlite3').Database
+    try {
+      database = new sqliteModule.default(copiedDb, {
+        readonly: true,
+        fileMustExist: true
+      })
+    } catch {
+      // Native module ABI mismatches (system Node vs Electron) fall back to sqlite3 CLI.
+      return await readCookiesFromDatabaseWithSqliteCli(copiedDb, domainSuffixes)
+    }
+    try {
+      database.pragma('query_only = ON')
+      database.pragma('busy_timeout = 250')
+      const versionRow = database.prepare(
+        "SELECT value FROM meta WHERE key = 'version' LIMIT 1"
+      ).get() as { value?: string | number } | undefined
+      const databaseVersion = Number(versionRow?.value ?? 0)
+      const where = domainSuffixes
+        .map(() => 'host_key LIKE ?')
+        .join(' OR ')
+      const params = domainSuffixes.map((suffix) => `%${suffix}`)
+      const rows = database.prepare(`
+        SELECT host_key AS hostKey, name, value, encrypted_value AS encryptedValue
+        FROM cookies
+        WHERE ${where}
+      `).all(...params) as Array<{
+        hostKey?: unknown
+        name?: unknown
+        value?: unknown
+        encryptedValue?: unknown
+      }>
+      return rows.flatMap((row) => {
+        const hostKey = typeof row.hostKey === 'string' ? row.hostKey : ''
+        const name = typeof row.name === 'string' ? row.name : ''
+        if (!hostKey || !name) return []
+        const value = typeof row.value === 'string' ? row.value : ''
+        const encryptedValue = Buffer.isBuffer(row.encryptedValue)
+          ? row.encryptedValue
+          : row.encryptedValue instanceof Uint8Array
+            ? Buffer.from(row.encryptedValue)
+            : Buffer.alloc(0)
+        return [{ name, value, hostKey, encryptedValue, databaseVersion }]
+      })
+    } finally {
+      database.close()
+    }
+  } finally {
+    await rm(tempRoot, { recursive: true, force: true })
+  }
+}
+
+async function readCookiesFromDatabaseWithSqliteCli(
+  databasePath: string,
+  domainSuffixes: string[]
+): Promise<RawCookieRow[]> {
+  const binary = process.platform === 'darwin' ? '/usr/bin/sqlite3' : 'sqlite3'
+  const where = domainSuffixes
+    .map((suffix) => `host_key LIKE '%${suffix.replaceAll("'", "''")}%'`)
+    .join(' OR ')
+  const versionResult = await execFileAsync(binary, [
+    databasePath,
+    "SELECT value FROM meta WHERE key='version' LIMIT 1;"
+  ], {
+    encoding: 'utf8',
+    timeout: 2_000,
+    maxBuffer: 64 * 1024
+  }).catch(() => ({ stdout: '0' }))
+  const databaseVersion = Number(versionResult.stdout.trim() || 0)
+  const { stdout } = await execFileAsync(binary, [
+    '-separator',
+    '\t',
+    databasePath,
+    `SELECT host_key, name, value, hex(encrypted_value) FROM cookies WHERE ${where};`
+  ], {
+    encoding: 'utf8',
+    timeout: 2_000,
+    maxBuffer: 512 * 1024
+  })
+  return stdout
+    .split('\n')
+    .flatMap((line) => {
+      if (!line.trim()) return []
+      const [hostKey, name, value, encryptedHex = ''] = line.split('\t')
+      if (!hostKey || !name) return []
+      return [{
+        hostKey,
+        name,
+        value: value ?? '',
+        encryptedValue: encryptedHex
+          ? Buffer.from(encryptedHex, 'hex')
+          : Buffer.alloc(0),
+        databaseVersion
+      }]
+    })
+}
+
+async function resolveSafeStoragePassword(
+  browser: ChromiumBrowserCookieSource,
+  override: ((label: ChromiumSafeStorageLabel) => Promise<string | undefined>) | undefined,
+  passwordCache: Map<string, string | undefined>
+): Promise<string | undefined> {
+  for (const label of browser.safeStorageLabels) {
+    const cacheKey = `${label.service}\0${label.account}`
+    if (passwordCache.has(cacheKey)) {
+      const cached = passwordCache.get(cacheKey)
+      if (cached?.trim()) return cached.trim()
+      continue
+    }
+    const password = override
+      ? await override(label)
+      : await readMacosSafeStoragePassword(label)
+    const trimmed = password?.trim() || undefined
+    passwordCache.set(cacheKey, trimmed)
+    if (trimmed) return trimmed
+  }
+  return undefined
+}
+
+async function readMacosSafeStoragePassword(
+  label: ChromiumSafeStorageLabel
+): Promise<string | undefined> {
+  try {
+    const { stdout } = await execFileAsync('security', [
+      'find-generic-password',
+      '-w',
+      '-s',
+      label.service,
+      '-a',
+      label.account
+    ], {
+      encoding: 'utf8',
+      timeout: KEYCHAIN_TIMEOUT_MS,
+      maxBuffer: 64 * 1024
+    })
+    const password = stdout.trim()
+    return password || undefined
+  } catch {
+    return undefined
+  }
+}
+
+function discoverChromiumProfileNamesSync(root: string): string[] {
+  // Synchronous discovery keeps path listing pure for tests; IO failures just
+  // fall back to the Default profile, which matches the previous OpenCode Go behavior.
+  try {
+    const entries = readdirSync(root, { withFileTypes: true })
+    const names = entries
+      .filter((entry) => entry.isDirectory())
+      .map((entry) => entry.name)
+      .filter((name) =>
+        name === 'Default' ||
+        name.startsWith('Profile ') ||
+        name.startsWith('user-')
+      )
+      .sort((left, right) => left.localeCompare(right))
+    return names.length > 0 ? names : ['Default']
+  } catch {
+    return ['Default']
+  }
+}
diff --git a/kun/src/services/model-connection-registry.test.ts b/kun/src/services/model-connection-registry.test.ts
index 0366dc522..bc7354a7f 100644
--- a/kun/src/services/model-connection-registry.test.ts
+++ b/kun/src/services/model-connection-registry.test.ts
@@ -214,7 +214,7 @@ describe('ModelConnectionRegistry', () => {
     expect(String(fetchMock.mock.calls[0]?.[0])).toBe(expectedUrl)
   })
 
-  it('does not guess a models URL from a custom full inference endpoint', async () => {
+  it('returns configured models for a custom full inference endpoint without guessing a models URL', async () => {
     const fetchMock = vi.fn()
     vi.stubGlobal('fetch', fetchMock)
     const { value } = await registry()
@@ -233,9 +233,10 @@ describe('ModelConnectionRegistry', () => {
       select: false
     })
 
-    await expect(value.probe('custom-full-endpoint')).rejects.toThrow(
-      'custom_endpoint does not define a models URL'
-    )
+    await expect(value.probe('custom-full-endpoint')).resolves.toEqual({
+      ok: true,
+      models: ['configured-model']
+    })
     expect(fetchMock).not.toHaveBeenCalled()
     await expect(value.snapshot()).resolves.toMatchObject({
       providers: [expect.objectContaining({
@@ -245,6 +246,62 @@ describe('ModelConnectionRegistry', () => {
     })
   })
 
+  it('rejects custom_endpoint probe when no models are configured', async () => {
+    const fetchMock = vi.fn()
+    vi.stubGlobal('fetch', fetchMock)
+    const { value } = await registry()
+    await value.connect({
+      expectedRevision: 0,
+      id: 'custom-empty-models',
+      name: 'Custom Empty Models',
+      kind: 'http',
+      authType: 'api-key',
+      baseUrl: 'https://gateway.example.test/inference/team-a/respond',
+      endpointFormat: 'custom_endpoint',
+      credential: 'registry-secret',
+      models: [],
+      probe: false,
+      select: false
+    })
+
+    await expect(value.probe('custom-empty-models')).rejects.toThrow(
+      'custom_endpoint does not define a models URL'
+    )
+    expect(fetchMock).not.toHaveBeenCalled()
+  })
+
+  it('probes Codex with configured models without requesting a models URL', async () => {
+    const fetchMock = vi.fn()
+    vi.stubGlobal('fetch', fetchMock)
+    const { value } = await registry()
+    await value.connect({
+      expectedRevision: 0,
+      id: 'codex',
+      name: 'ChatGPT 订阅',
+      kind: 'http',
+      authType: 'oauth',
+      baseUrl: 'https://chatgpt.com/backend-api/codex/responses',
+      endpointFormat: 'custom_endpoint',
+      credential: JSON.stringify({
+        kind: 'codex-oauth',
+        accessToken: 'access-token',
+        refreshToken: 'refresh-token',
+        expiresAt: Date.now() + 60_000,
+        accountId: 'account-1'
+      }),
+      models: ['gpt-5.5', 'gpt-5.4'],
+      selectedModel: 'gpt-5.5',
+      probe: false,
+      select: false
+    })
+
+    await expect(value.probe('codex')).resolves.toEqual({
+      ok: true,
+      models: ['gpt-5.5', 'gpt-5.4']
+    })
+    expect(fetchMock).not.toHaveBeenCalled()
+  })
+
   it('probes Messages providers with the Registry credential and Anthropic headers', async () => {
     const fetchMock = vi.fn(async (_input: string | URL | Request, _init?: RequestInit) => new Response(JSON.stringify({
       data: [{ id: 'claude-sonnet-4-5' }]
@@ -1977,6 +2034,113 @@ describe('ModelConnectionRegistry', () => {
     expect(afterRestart.providers[0]?.models).toEqual(['keep-model'])
   })
 
+  it('selects the first remaining model when a catalog removes the active model', async () => {
+    const { value } = await registry()
+    const connected = await value.connect({
+      expectedRevision: 0,
+      id: 'catalog-owner',
+      name: 'Catalog Owner',
+      kind: 'http',
+      authType: 'api-key',
+      baseUrl: 'https://catalog.example/v1',
+      endpointFormat: 'chat_completions',
+      credential: 'secret',
+      models: ['model-a', 'model-b'],
+      selectedModel: 'model-a',
+      probe: false,
+      select: true
+    })
+
+    const patched = await value.patch('catalog-owner', {
+      expectedRevision: connected.revision,
+      models: ['model-b']
+    })
+
+    expect(patched.providers[0]).toMatchObject({
+      models: ['model-b'],
+      selectedModel: 'model-b'
+    })
+    expect(patched).toMatchObject({
+      defaultProviderId: 'catalog-owner',
+      defaultAccountId: 'account:catalog-owner',
+      defaultModel: 'model-b'
+    })
+  })
+
+  it('clears the default selection when the active provider loses its last model', async () => {
+    const { value } = await registry()
+    const connected = await value.connect({
+      expectedRevision: 0,
+      id: 'catalog-owner',
+      name: 'Catalog Owner',
+      kind: 'http',
+      authType: 'api-key',
+      baseUrl: 'https://catalog.example/v1',
+      endpointFormat: 'chat_completions',
+      credential: 'secret',
+      models: ['model-a'],
+      selectedModel: 'model-a',
+      probe: false,
+      select: true
+    })
+
+    const patched = await value.patch('catalog-owner', {
+      expectedRevision: connected.revision,
+      models: []
+    })
+
+    expect(patched.providers[0]).toMatchObject({ models: [] })
+    expect(patched.providers[0]).not.toHaveProperty('selectedModel')
+    expect(patched).not.toHaveProperty('defaultProviderId')
+    expect(patched).not.toHaveProperty('defaultAccountId')
+    expect(patched).not.toHaveProperty('defaultModel')
+  })
+
+  it('falls back to another configured provider when the default provider loses its last model', async () => {
+    const { value } = await registry()
+    const primary = await value.connect({
+      expectedRevision: 0,
+      id: 'primary',
+      name: 'Primary',
+      kind: 'http',
+      authType: 'api-key',
+      baseUrl: 'https://primary.example/v1',
+      endpointFormat: 'chat_completions',
+      credential: 'primary-secret',
+      models: ['primary-model'],
+      selectedModel: 'primary-model',
+      probe: false,
+      select: true
+    })
+    const withFallback = await value.connect({
+      expectedRevision: primary.revision,
+      id: 'fallback',
+      name: 'Fallback',
+      kind: 'http',
+      authType: 'api-key',
+      baseUrl: 'https://fallback.example/v1',
+      endpointFormat: 'chat_completions',
+      credential: 'fallback-secret',
+      models: ['fallback-model'],
+      selectedModel: 'fallback-model',
+      probe: false,
+      select: false
+    })
+
+    const patched = await value.patch('primary', {
+      expectedRevision: withFallback.revision,
+      models: []
+    })
+
+    expect(patched.providers.find((provider) => provider.id === 'primary'))
+      .not.toHaveProperty('selectedModel')
+    expect(patched).toMatchObject({
+      defaultProviderId: 'fallback',
+      defaultAccountId: 'account:fallback',
+      defaultModel: 'fallback-model'
+    })
+  })
+
   it('retries deleted-provider legacy source retirement without allowing seed resurrection', async () => {
     let attempts = 0
     const retired: string[] = []
diff --git a/kun/src/services/model-connection-registry.ts b/kun/src/services/model-connection-registry.ts
index c6359b7c7..d187dffcc 100644
--- a/kun/src/services/model-connection-registry.ts
+++ b/kun/src/services/model-connection-registry.ts
@@ -706,6 +706,7 @@ export class ModelConnectionRegistry {
   async patch(providerId: string, raw: unknown): Promise<ModelConnectionSnapshot> {
     const input = ModelConnectionPatchRequestSchema.parse(raw)
     const { expectedRevision: _expectedRevision, ...changes } = input
+    const fallbackHealth = await this.inspectCredentialHealth(await this.file.read(emptyDocument))
     const document = await this.file.update(emptyDocument, (current) => {
       assertRevision(current, input.expectedRevision, this.options.modelCapabilities, this.credentialHealth)
       const profile = requireProfile(current, providerId)
@@ -721,24 +722,52 @@ export class ModelConnectionRegistry {
         : profile.modelCapabilities
           ? capabilitiesForModels(profile.modelCapabilities, models)
           : undefined
-      const selectedModel = input.selectedModel ?? profile.selectedModel
-      if (selectedModel && models.length > 0 && !models.includes(selectedModel)) {
+      if (input.selectedModel && !models.includes(input.selectedModel)) {
         throw new Error('selected model is not present in the provider model list')
       }
+      const selectedModel = input.selectedModel ?? (
+        profile.selectedModel && models.includes(profile.selectedModel)
+          ? profile.selectedModel
+          : models[0]
+      )
+      const { selectedModel: _previousSelectedModel, ...profileWithoutSelection } = profile
+      const nextProfile = StoredProfileSchema.parse({
+        ...profileWithoutSelection,
+        ...changes,
+        models,
+        ...(modelCapabilities ? { modelCapabilities } : {}),
+        ...(selectedModel ? { selectedModel } : {})
+      })
+      const profiles = {
+        ...current.profiles,
+        [providerId]: nextProfile
+      }
+      const fallback = current.defaultProviderId === providerId && !selectedModel
+        ? configuredFallback(Object.values(profiles), fallbackHealth)
+        : undefined
       return {
         ...current,
         revision: current.revision + 1,
-        profiles: {
-          ...current.profiles,
-          [providerId]: StoredProfileSchema.parse({
-            ...profile,
-            ...changes,
-            models,
-            ...(modelCapabilities ? { modelCapabilities } : {}),
-            selectedModel
-          })
-        },
-        ...(current.defaultProviderId === providerId && selectedModel ? { defaultModel: selectedModel } : {})
+        profiles,
+        ...(current.defaultProviderId === providerId
+          ? selectedModel
+            ? {
+                defaultProviderId: providerId,
+                defaultAccountId: profile.accountId,
+                defaultModel: selectedModel
+              }
+            : fallback
+              ? {
+                  defaultProviderId: fallback.profile.id,
+                  defaultAccountId: fallback.profile.accountId,
+                  defaultModel: fallback.model
+                }
+              : {
+                  defaultProviderId: undefined,
+                  defaultAccountId: undefined,
+                  defaultModel: undefined
+                }
+          : {})
       }
     })
     await this.changed(document)
@@ -2528,6 +2557,21 @@ async function probeModels(input: {
 }): Promise<string[]> {
   if (input.kind !== 'http') return uniqueModels(input.fallbackModels)
   if (!input.baseUrl) throw new Error('provider probe failed: HTTP provider has no base URL')
+  // Custom full inference endpoints have no discoverable /models URL. When the
+  // profile already lists models (Codex, coding-plan gateways, user custom
+  // paths), treat an explicit credential + catalog as a successful probe.
+  if (input.endpointFormat === 'custom_endpoint') {
+    const configured = uniqueModels(input.fallbackModels)
+    if (configured.length === 0) {
+      throw new Error(
+        'provider probe failed: custom_endpoint does not define a models URL; configure models explicitly with probe disabled'
+      )
+    }
+    if (!input.apiKey.trim()) {
+      throw new Error('provider probe failed: custom_endpoint requires a credential when probing configured models')
+    }
+    return configured
+  }
   const url = modelsUrl(input.baseUrl, input.endpointFormat)
   const usesAnthropicHeaders = input.endpointFormat === 'messages'
   const authHeaders: Record<string, string> = input.apiKey
diff --git a/kun/src/services/opencode-go-web-quota.test.ts b/kun/src/services/opencode-go-web-quota.test.ts
index a4e79b057..02d577638 100644
--- a/kun/src/services/opencode-go-web-quota.test.ts
+++ b/kun/src/services/opencode-go-web-quota.test.ts
@@ -28,6 +28,7 @@ describe('filterOpenCodeGoCookieHeader', () => {
       'auth=a; __Host-auth=b; session=ignored; theme=dark'
     )).toBe('auth=a; __Host-auth=b')
     expect(filterOpenCodeGoCookieHeader('AUTH=x')).toBe('AUTH=x')
+    expect(filterOpenCodeGoCookieHeader('Cookie: auth=manual; session=x')).toBe('auth=manual')
     expect(filterOpenCodeGoCookieHeader('session=only')).toBeUndefined()
     expect(filterOpenCodeGoCookieHeader(undefined)).toBeUndefined()
     expect(filterOpenCodeGoCookieHeader('')).toBeUndefined()
diff --git a/kun/src/services/opencode-go-web-quota.ts b/kun/src/services/opencode-go-web-quota.ts
index be18b02cf..c763d9653 100644
--- a/kun/src/services/opencode-go-web-quota.ts
+++ b/kun/src/services/opencode-go-web-quota.ts
@@ -78,7 +78,8 @@ export function filterOpenCodeGoCookieHeader(
   rawHeader: string | undefined
 ): string | undefined {
   if (!rawHeader?.trim()) return undefined
-  const pairs = rawHeader
+  const normalized = rawHeader.trim().replace(/^cookie:\s*/i, '')
+  const pairs = normalized
     .split(';')
     .map((part) => part.trim())
     .filter(Boolean)
diff --git a/kun/src/services/provider-subscription-quota.test.ts b/kun/src/services/provider-subscription-quota.test.ts
index 256e56cae..2d113c361 100644
--- a/kun/src/services/provider-subscription-quota.test.ts
+++ b/kun/src/services/provider-subscription-quota.test.ts
@@ -1,12 +1,26 @@
-import { describe, expect, it } from 'vitest'
+import { createCipheriv, createHash } from 'node:crypto'
+import { execFileSync } from 'node:child_process'
+import { mkdtempSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { deriveChromiumSafeStorageKey } from './chromium-browser-cookies.js'
+import { OpenCodeGoWebQuotaError } from './opencode-go-web-quota.js'
 import {
+  clearOpenCodeGoCookieCache,
+  getOpenCodeGoCookieFailureReason,
+  OPENCODE_GO_COOKIE_ENV,
+  OPENCODE_GO_KEYCHAIN_MESSAGE,
+  OPENCODE_GO_SIGN_IN_MESSAGE,
   openCodeGoCookieDatabasePaths,
   parseClaudeSubscriptionQuota,
   parseCodexSubscriptionQuota,
   parseCursorSubscriptionQuota,
   parseGrokSubscriptionQuota,
   parseGoogleCodeAssistQuota,
-  resolveOpenCodeGoCookie
+  resolveOpenCodeGoCookie,
+  resolveOpenCodeGoCookieResult,
+  runSubscriptionQuotaProbe
 } from './provider-subscription-quota.js'
 
 function grokBillingFrame(usedPercent: number, resetEpoch: number): Uint8Array {
@@ -118,6 +132,10 @@ describe('subscription provider quota parsers', () => {
 })
 
 describe('resolveOpenCodeGoCookie', () => {
+  afterEach(() => {
+    clearOpenCodeGoCookieCache()
+  })
+
   it('returns an auth cookie header when a browser has one', async () => {
     await expect(resolveOpenCodeGoCookie({
       cookieDatabasePaths: ['/browsers/chrome/Cookies'],
@@ -161,7 +179,7 @@ describe('resolveOpenCodeGoCookie', () => {
     })).resolves.toBeUndefined()
   })
 
-  it('resolves platform cookie database paths', () => {
+  it('resolves platform cookie database paths including Comet and Chrome Beta', () => {
     const darwin = openCodeGoCookieDatabasePaths({
       platform: 'darwin',
       environment: {},
@@ -169,7 +187,10 @@ describe('resolveOpenCodeGoCookie', () => {
     })
     expect(darwin).toEqual(expect.arrayContaining([
       '/Users/kun/Library/Application Support/Google/Chrome/Default/Network/Cookies',
-      '/Users/kun/Library/Application Support/Arc/User Data/Default/Network/Cookies'
+      '/Users/kun/Library/Application Support/Google/Chrome Beta/Default/Network/Cookies',
+      '/Users/kun/Library/Application Support/Arc/User Data/Default/Network/Cookies',
+      '/Users/kun/Library/Application Support/Comet/Default/Cookies',
+      '/Users/kun/Library/Application Support/Dia/User Data/Default/Cookies'
     ]))
     const windows = openCodeGoCookieDatabasePaths({
       platform: 'win32',
@@ -178,4 +199,239 @@ describe('resolveOpenCodeGoCookie', () => {
     })
     expect(windows[0]).toBe('C:\\Users\\Kun\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network\\Cookies')
   })
+
+  it('decrypts Safe Storage cookies when resolving OpenCode Go auth', async () => {
+    await expect(resolveOpenCodeGoCookie({
+      platform: 'darwin',
+      cookieDatabasePaths: ['/browsers/comet/Cookies'],
+      readSafeStoragePassword: async () => 'unused-because-readCookies-wins',
+      readCookies: async () => [
+        { name: 'auth', value: 'comet-session' }
+      ]
+    })).resolves.toBe('auth=comet-session')
+  })
+
+  it('prefers a manual Cookie header and the KUN_OPENCODE_GO_COOKIE env', async () => {
+    await expect(resolveOpenCodeGoCookieResult({
+      environment: { [OPENCODE_GO_COOKIE_ENV]: 'auth=env-token; oc_locale=en' },
+      platform: 'linux'
+    })).resolves.toEqual({
+      cookieHeader: 'auth=env-token',
+      source: 'manual'
+    })
+
+    await expect(resolveOpenCodeGoCookieResult({
+      manualCookieHeader: 'Cookie: auth=manual-token',
+      environment: {},
+      platform: 'linux',
+      bypassCache: true
+    })).resolves.toEqual({
+      cookieHeader: 'auth=manual-token',
+      source: 'manual'
+    })
+  })
+
+  it('reuses a memory-cached cookie until the cache is cleared', async () => {
+    await expect(resolveOpenCodeGoCookieResult({
+      manualCookieHeader: 'auth=cached-token',
+      environment: {},
+      platform: 'linux'
+    })).resolves.toMatchObject({ cookieHeader: 'auth=cached-token', source: 'manual' })
+
+    await expect(resolveOpenCodeGoCookieResult({
+      environment: {},
+      platform: 'linux'
+    })).resolves.toEqual({
+      cookieHeader: 'auth=cached-token',
+      source: 'cache'
+    })
+
+    clearOpenCodeGoCookieCache()
+    await expect(resolveOpenCodeGoCookieResult({
+      environment: {},
+      platform: 'linux',
+      cookieDatabasePaths: ['/missing/Cookies'],
+      readCookies: async () => []
+    })).resolves.toEqual({ failureReason: 'not_found' })
+    expect(getOpenCodeGoCookieFailureReason()).toBe('not_found')
+  })
+
+  it('reports decrypt_failed when encrypted browser auth cannot be unlocked', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'kun-opencode-cookie-'))
+    const databasePath = join(directory, 'Cookies')
+    const key = deriveChromiumSafeStorageKey('secret')
+    const encrypted = encryptV10Cookie('token', key, 'opencode.ai', 24)
+    createCookieDatabase(databasePath, [
+      { hostKey: 'opencode.ai', name: 'auth', value: '', encryptedHex: encrypted.toString('hex') }
+    ])
+
+    await expect(resolveOpenCodeGoCookieResult({
+      platform: 'darwin',
+      environment: {},
+      bypassCache: true,
+      cookieDatabasePaths: [databasePath],
+      readSafeStoragePassword: async () => undefined
+    })).resolves.toEqual({ failureReason: 'decrypt_failed' })
+    expect(getOpenCodeGoCookieFailureReason()).toBe('decrypt_failed')
+  })
+
+  it('surfaces the Keychain message when decrypt fails and local history is empty', async () => {
+    await expect(runSubscriptionQuotaProbe(
+      'opencode-go-local',
+      {
+        id: 'opencode-go',
+        name: 'OpenCode Go',
+        kind: 'http',
+        apiKey: ''
+      },
+      {
+        fetcher: async () => new Response('unused'),
+        proxyUrl: ''
+      },
+      {
+        resolveOpenCodeGoCookie: async () => undefined,
+        resolveOpenCodeGoQuota: async () => undefined
+      }
+    )).rejects.toThrow(OPENCODE_GO_SIGN_IN_MESSAGE)
+
+    const directory = mkdtempSync(join(tmpdir(), 'kun-opencode-probe-'))
+    const databasePath = join(directory, 'Cookies')
+    const key = deriveChromiumSafeStorageKey('secret')
+    createCookieDatabase(databasePath, [
+      {
+        hostKey: 'opencode.ai',
+        name: 'auth',
+        value: '',
+        encryptedHex: encryptV10Cookie('token', key, 'opencode.ai', 24).toString('hex')
+      }
+    ])
+    clearOpenCodeGoCookieCache()
+    await resolveOpenCodeGoCookieResult({
+      platform: 'darwin',
+      environment: {},
+      bypassCache: true,
+      cookieDatabasePaths: [databasePath],
+      readSafeStoragePassword: async () => undefined
+    })
+
+    await expect(runSubscriptionQuotaProbe(
+      'opencode-go-local',
+      {
+        id: 'opencode-go',
+        name: 'OpenCode Go',
+        kind: 'http',
+        apiKey: ''
+      },
+      {
+        fetcher: async () => new Response('unused'),
+        proxyUrl: ''
+      },
+      {
+        resolveOpenCodeGoCookie: async () => undefined,
+        resolveOpenCodeGoQuota: async () => undefined
+      }
+    )).rejects.toThrow(OPENCODE_GO_KEYCHAIN_MESSAGE)
+  })
+
+  it('clears the cookie cache and retries after invalid_credentials', async () => {
+    clearOpenCodeGoCookieCache()
+    await resolveOpenCodeGoCookieResult({
+      manualCookieHeader: 'auth=stale-token',
+      environment: {},
+      platform: 'linux'
+    })
+
+    let cookieCalls = 0
+    let webCalls = 0
+    const result = await runSubscriptionQuotaProbe(
+      'opencode-go-local',
+      {
+        id: 'opencode-go',
+        name: 'OpenCode Go',
+        kind: 'http',
+        apiKey: ''
+      },
+      {
+        fetcher: async () => new Response('unused'),
+        proxyUrl: ''
+      },
+      {
+        resolveOpenCodeGoCookie: async () => {
+          cookieCalls += 1
+          return cookieCalls === 1 ? 'auth=stale-token' : 'auth=fresh-token'
+        },
+        resolveOpenCodeGoQuota: async () => undefined,
+        fetchOpenCodeGoWebQuota: async (cookieHeader) => {
+          webCalls += 1
+          if (cookieHeader.includes('stale-token')) {
+            throw new OpenCodeGoWebQuotaError('expired', 'invalid_credentials')
+          }
+          return {
+            metrics: [{
+              id: 'five-hour',
+              label: '5-hour usage',
+              unit: 'percent',
+              used: 10,
+              limit: 100,
+              remaining: 90,
+              usedPercent: 10
+            }],
+            summary: 'OpenCode Go subscription · wrk_fresh',
+            dashboardUrl: 'https://opencode.ai',
+            workspaceId: 'wrk_fresh'
+          }
+        }
+      }
+    )
+
+    expect(result).toMatchObject({
+      source: 'OpenCode Go subscription usage',
+      summary: 'OpenCode Go subscription · wrk_fresh'
+    })
+    expect(cookieCalls).toBe(2)
+    expect(webCalls).toBe(2)
+  })
 })
+
+function createCookieDatabase(
+  databasePath: string,
+  rows: Array<{ hostKey: string; name: string; value: string; encryptedHex: string }>
+): void {
+  const binary = process.platform === 'darwin' ? '/usr/bin/sqlite3' : 'sqlite3'
+  const inserts = rows.map((row) => {
+    const encryptedSql = row.encryptedHex ? `X'${row.encryptedHex}'` : `X''`
+    return `INSERT INTO cookies (host_key, name, value, encrypted_value) VALUES ('${row.hostKey}', '${row.name}', '${row.value}', ${encryptedSql});`
+  }).join('\n')
+  execFileSync(binary, [databasePath], {
+    input: `
+      CREATE TABLE meta (key TEXT PRIMARY KEY, value TEXT);
+      CREATE TABLE cookies (
+        host_key TEXT,
+        name TEXT,
+        value TEXT,
+        encrypted_value BLOB
+      );
+      INSERT INTO meta (key, value) VALUES ('version', '24');
+      ${inserts}
+    `,
+    encoding: 'utf8'
+  })
+}
+
+function encryptV10Cookie(
+  plaintext: string,
+  key: Buffer,
+  hostKey: string,
+  databaseVersion: number
+): Buffer {
+  const body = databaseVersion >= 24
+    ? Buffer.concat([
+      createHash('sha256').update(hostKey, 'utf8').digest(),
+      Buffer.from(plaintext, 'utf8')
+    ])
+    : Buffer.from(plaintext, 'utf8')
+  const iv = Buffer.alloc(16, 0x20)
+  const cipher = createCipheriv('aes-128-cbc', key, iv)
+  const encrypted = Buffer.concat([cipher.update(body), cipher.final()])
+  return Buffer.concat([Buffer.from('v10', 'utf8'), encrypted])
+}
diff --git a/kun/src/services/provider-subscription-quota.ts b/kun/src/services/provider-subscription-quota.ts
index b103ba8ee..d650c0c50 100644
--- a/kun/src/services/provider-subscription-quota.ts
+++ b/kun/src/services/provider-subscription-quota.ts
@@ -1,7 +1,7 @@
 import { execFile } from 'node:child_process'
 import { readFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
-import { join, win32 } from 'node:path'
+import { join } from 'node:path'
 import { promisify } from 'node:util'
 import type { ProviderQuotaMetric } from '../contracts/provider-quota.js'
 import { GeminiCliOAuthSource } from '../adapters/model/gemini-cli-oauth.js'
@@ -27,9 +27,15 @@ import {
 } from './opencode-go-local-quota.js'
 import {
   fetchOpenCodeGoWebQuota as fetchOpenCodeGoWebQuotaImpl,
+  filterOpenCodeGoCookieHeader,
   OpenCodeGoWebQuotaError,
   type OpenCodeGoWebQuotaResult
 } from './opencode-go-web-quota.js'
+import {
+  listChromiumCookieDatabaseCandidates,
+  readChromiumCookiesForDomainsWithDiagnosis,
+  type ChromiumCookieDatabaseCandidate
+} from './chromium-browser-cookies.js'
 
 const execFileAsync = promisify(execFile)
 const QUOTA_TIMEOUT_MS = 12_000
@@ -222,33 +228,7 @@ export async function runSubscriptionQuotaProbe(
     return probeGoogleCodeAssistQuota(credential, context, 'antigravity')
   }
   if (kind === 'opencode-go-local') {
-    const cookieHeader = await runtime.resolveOpenCodeGoCookie()
-    if (cookieHeader) {
-      try {
-        const web = await runtime.fetchOpenCodeGoWebQuota(cookieHeader, context)
-        if (web.metrics.length > 0) {
-          return {
-            metrics: web.metrics,
-            ...(web.summary ? { summary: web.summary } : {}),
-            source: 'OpenCode Go subscription usage'
-          }
-        }
-      } catch (error) {
-        // Web quota is best-effort: any auth/network/parse failure falls back
-        // to the local usage database estimate.
-        if (!(error instanceof OpenCodeGoWebQuotaError)) throw error
-      }
-    }
-    const quota = await runtime.resolveOpenCodeGoQuota()
-    if (quota) {
-      return {
-        ...quota,
-        source: 'OpenCode Go local usage estimate'
-      }
-    }
-    throw new ProviderQuotaMissingCredentialError(
-      'Sign in to opencode.ai in your browser, or use OpenCode Go locally first so its usage history exists.'
-    )
+    return probeOpenCodeGoLocalQuota(runtime, context)
   }
   const accessToken = await runtime.resolveGeminiCliToken(context)
   if (!accessToken) {
@@ -259,6 +239,59 @@ export async function runSubscriptionQuotaProbe(
   return probeGoogleCodeAssistQuota({ accessToken }, context, 'gemini-cli')
 }
 
+async function probeOpenCodeGoLocalQuota(
+  runtime: SubscriptionQuotaRuntime,
+  context: ProbeContext
+): Promise<{ metrics: ProviderQuotaMetric[]; summary?: string; source?: string }> {
+  const tryWeb = async (cookieHeader: string) => {
+    const web = await runtime.fetchOpenCodeGoWebQuota(cookieHeader, context)
+    if (web.metrics.length > 0) {
+      return {
+        metrics: web.metrics,
+        ...(web.summary ? { summary: web.summary } : {}),
+        source: 'OpenCode Go subscription usage'
+      } as const
+    }
+    return undefined
+  }
+
+  let cookieHeader = await runtime.resolveOpenCodeGoCookie()
+  if (cookieHeader) {
+    try {
+      const web = await tryWeb(cookieHeader)
+      if (web) return web
+    } catch (error) {
+      if (!(error instanceof OpenCodeGoWebQuotaError)) throw error
+      if (error.code === 'invalid_credentials') {
+        clearOpenCodeGoCookieCache()
+        cookieHeader = await runtime.resolveOpenCodeGoCookie()
+        if (cookieHeader) {
+          try {
+            const web = await tryWeb(cookieHeader)
+            if (web) return web
+          } catch (retryError) {
+            if (!(retryError instanceof OpenCodeGoWebQuotaError)) throw retryError
+          }
+        }
+      }
+    }
+  }
+
+  const quota = await runtime.resolveOpenCodeGoQuota()
+  if (quota) {
+    return {
+      ...quota,
+      source: 'OpenCode Go local usage estimate'
+    }
+  }
+
+  throw new ProviderQuotaMissingCredentialError(
+    getOpenCodeGoCookieFailureReason() === 'decrypt_failed'
+      ? OPENCODE_GO_KEYCHAIN_MESSAGE
+      : OPENCODE_GO_SIGN_IN_MESSAGE
+  )
+}
+
 export function parseClaudeSubscriptionQuota(payload: unknown): ProviderQuotaMetric[] {
   const root = requireRecord(payload, 'Claude returned an invalid usage response.')
   const metrics: ProviderQuotaMetric[] = []
@@ -1410,107 +1443,261 @@ export type OpenCodeGoCookieResolverOptions = {
   platform?: NodeJS.Platform
   environment?: NodeJS.ProcessEnv
   homeDirectory?: string
+  /** Prefer this Cookie header over env/cache/browser import. */
+  manualCookieHeader?: string
+  /** When true, skip the in-memory / Keychain cookie cache. */
+  bypassCache?: boolean
   cookieDatabasePaths?: string[]
   readCookies?: (databasePath: string) => Promise<Array<{ name: string; value: string }>>
+  readSafeStoragePassword?: (
+    label: { service: string; account: string }
+  ) => Promise<string | undefined>
+}
+
+export type OpenCodeGoCookieFailureReason = 'not_found' | 'decrypt_failed'
+
+export type OpenCodeGoCookieResolveResult = {
+  cookieHeader?: string
+  source?: 'manual' | 'cache' | 'browser'
+  failureReason?: OpenCodeGoCookieFailureReason
 }
 
+export const OPENCODE_GO_SIGN_IN_MESSAGE =
+  'Sign in to opencode.ai in your browser, or use OpenCode Go locally first so its usage history exists.'
+
+export const OPENCODE_GO_KEYCHAIN_MESSAGE =
+  'Found an opencode.ai browser session, but could not unlock the browser Safe Storage keychain. Allow Keychain access for Kun (Chrome/Comet Safe Storage), or set KUN_OPENCODE_GO_COOKIE to a Cookie header.'
+
+export const OPENCODE_GO_COOKIE_ENV = 'KUN_OPENCODE_GO_COOKIE'
+
 const OPENCODE_COOKIE_NAMES = new Set(['auth', '__host-auth'])
+const OPENCODE_GO_COOKIE_DOMAINS = ['opencode.ai', 'app.opencode.ai']
+const OPENCODE_GO_CACHE_SERVICE = 'kun-opencode-go'
+const OPENCODE_GO_CACHE_ACCOUNT = 'session-cookie'
+
+let openCodeGoCookieMemoryCache: string | undefined
+let openCodeGoCookieFailureReason: OpenCodeGoCookieFailureReason | undefined
+
+/** Last browser-import failure for OpenCode Go quota probe messaging. */
+export function getOpenCodeGoCookieFailureReason(): OpenCodeGoCookieFailureReason | undefined {
+  return openCodeGoCookieFailureReason
+}
+
+/** Clears in-memory and Keychain-cached OpenCode Go session cookies. */
+export function clearOpenCodeGoCookieCache(): void {
+  openCodeGoCookieMemoryCache = undefined
+  openCodeGoCookieFailureReason = undefined
+  void clearPersistedOpenCodeGoCookieCache()
+}
 
 /**
- * Resolves an OpenCode session cookie header (auth / __Host-auth) from
- * installed Chromium-family browsers. Any read failure, missing cookie, or
- * encrypted cookie value returns undefined so callers fall back to the local
- * usage database instead of surfacing an error.
+ * Resolves an OpenCode session cookie header (auth / __Host-auth) from manual
+ * config/env, a short-lived cache, or installed Chromium-family browsers
+ * (including Comet/Dia), decrypting macOS Safe Storage values when needed.
+ * Any read failure, missing cookie, or undecryptable cookie returns undefined
+ * so callers fall back to the local usage database instead of surfacing an
+ * error — use {@link getOpenCodeGoCookieFailureReason} for the specific cause.
  */
 export async function resolveOpenCodeGoCookie(
   options: OpenCodeGoCookieResolverOptions = {}
 ): Promise<string | undefined> {
-  const databasePaths = options.cookieDatabasePaths ??
-    openCodeGoCookieDatabasePaths(options)
-  const readCookies = options.readCookies ?? readChromiumCookies
-  for (const databasePath of databasePaths) {
-    try {
-      const cookies = await readCookies(databasePath)
-      const pairs = cookies
-        .filter((cookie) => OPENCODE_COOKIE_NAMES.has(cookie.name.toLowerCase()))
-        .filter((cookie) => cookie.value.trim().length > 0)
-        // Chrome 137+ encrypts cookie values with a v10 prefix; those cannot be
-        // decrypted with the sqlite3 CLI and are treated as absent.
-        .filter((cookie) => !cookie.value.startsWith('v10'))
-        .map((cookie) => `${cookie.name}=${cookie.value}`)
-      if (pairs.length > 0) return pairs.join('; ')
-    } catch {
-      // Browser cookie databases may be locked or encrypted; try the next candidate.
-    }
-  }
-  return undefined
+  const result = await resolveOpenCodeGoCookieResult(options)
+  return result.cookieHeader
 }
 
-export function openCodeGoCookieDatabasePaths(
-  options: Omit<OpenCodeGoCookieResolverOptions, 'readCookies'> = {}
-): string[] {
-  const platform = options.platform ?? process.platform
+export async function resolveOpenCodeGoCookieResult(
+  options: OpenCodeGoCookieResolverOptions = {}
+): Promise<OpenCodeGoCookieResolveResult> {
   const environment = options.environment ?? process.env
-  const userHome = options.homeDirectory ?? homedir()
-  const paths: string[] = []
-  if (platform === 'darwin') {
-    const root = join(userHome, 'Library', 'Application Support')
-    paths.push(
-      join(root, 'Google', 'Chrome'),
-      join(root, 'Microsoft Edge'),
-      join(root, 'BraveSoftware', 'Brave-Browser'),
-      join(root, 'Arc', 'User Data')
-    )
-  } else if (platform === 'linux') {
-    const root = join(userHome, '.config')
-    paths.push(
-      join(root, 'google-chrome'),
-      join(root, 'microsoft-edge'),
-      join(root, 'brave'),
-      join(root, 'arc')
-    )
-  } else if (platform === 'win32') {
-    const localAppData = environment.LOCALAPPDATA?.trim()
-    const root = localAppData || join(userHome, 'AppData', 'Local')
-    const joinPath = win32.join
-    paths.push(
-      joinPath(root, 'Google', 'Chrome', 'User Data'),
-      joinPath(root, 'Microsoft', 'Edge', 'User Data'),
-      joinPath(root, 'BraveSoftware', 'Brave-Browser', 'User Data')
+  const injectedReader = Boolean(options.readCookies || options.cookieDatabasePaths)
+  const allowCache = !options.bypassCache && !injectedReader
+
+  if (!injectedReader) {
+    const manual = filterOpenCodeGoCookieHeader(
+      options.manualCookieHeader ??
+        environment[OPENCODE_GO_COOKIE_ENV] ??
+        undefined
     )
+    if (manual) {
+      openCodeGoCookieFailureReason = undefined
+      openCodeGoCookieMemoryCache = manual
+      void persistOpenCodeGoCookieCache(manual, options.platform)
+      return { cookieHeader: manual, source: 'manual' }
+    }
+
+    if (allowCache) {
+      const cached = openCodeGoCookieMemoryCache ??
+        await loadPersistedOpenCodeGoCookieCache(options.platform)
+      const filteredCached = filterOpenCodeGoCookieHeader(cached)
+      if (filteredCached) {
+        openCodeGoCookieMemoryCache = filteredCached
+        openCodeGoCookieFailureReason = undefined
+        return { cookieHeader: filteredCached, source: 'cache' }
+      }
+    }
+  } else if (options.manualCookieHeader) {
+    const manual = filterOpenCodeGoCookieHeader(options.manualCookieHeader)
+    if (manual) {
+      openCodeGoCookieFailureReason = undefined
+      return { cookieHeader: manual, source: 'manual' }
+    }
   }
-  const joinPath = platform === 'win32' ? win32.join : join
-  return paths.flatMap((browserRoot) => [
-    joinPath(browserRoot, 'Default', 'Network', 'Cookies'),
-    joinPath(browserRoot, 'Default', 'Cookies')
-  ])
+
+  // Tests and callers can still inject plaintext cookie readers per DB path.
+  if (injectedReader) {
+    const databasePaths = options.cookieDatabasePaths ??
+      openCodeGoCookieDatabasePaths(options)
+    const readCookies = options.readCookies
+    if (!readCookies) {
+      return resolveOpenCodeGoCookieFromChromiumSources({
+        ...options,
+        candidates: databasePaths.map((databasePath) => ({
+          browser: {
+            id: 'custom',
+            displayName: 'Custom',
+            profileRootSegments: [],
+            // Allow Safe Storage overrides when callers inject DB paths only.
+            safeStorageLabels: [
+              { service: 'Chrome Safe Storage', account: 'Chrome' },
+              { service: 'Comet Safe Storage', account: 'Comet' }
+            ]
+          },
+          databasePath
+        }))
+      })
+    }
+    for (const databasePath of databasePaths) {
+      try {
+        const cookies = await readCookies(databasePath)
+        const pairs = cookies
+          .filter((cookie) => OPENCODE_COOKIE_NAMES.has(cookie.name.toLowerCase()))
+          .filter((cookie) => cookie.value.trim().length > 0)
+          .filter((cookie) => !cookie.value.startsWith('v10'))
+          .map((cookie) => `${cookie.name}=${cookie.value}`)
+        if (pairs.length > 0) {
+          const cookieHeader = pairs.join('; ')
+          openCodeGoCookieFailureReason = undefined
+          return { cookieHeader, source: 'browser' }
+        }
+      } catch {
+        // Browser cookie databases may be locked; try the next candidate.
+      }
+    }
+    openCodeGoCookieFailureReason = 'not_found'
+    return { failureReason: 'not_found' }
+  }
+
+  return resolveOpenCodeGoCookieFromChromiumSources(options)
 }
 
-async function readChromiumCookies(
-  databasePath: string
-): Promise<Array<{ name: string; value: string }>> {
-  const binary = process.platform === 'darwin' ? '/usr/bin/sqlite3' : 'sqlite3'
-  const { stdout } = await execFileAsync(binary, [
-    databasePath,
-    "SELECT name, value FROM cookies WHERE host_key LIKE '%opencode.ai';"
-  ], {
-    encoding: 'utf8',
-    timeout: 2_000,
-    maxBuffer: 512 * 1024
+async function resolveOpenCodeGoCookieFromChromiumSources(
+  options: OpenCodeGoCookieResolverOptions & {
+    candidates?: ChromiumCookieDatabaseCandidate[]
+  }
+): Promise<OpenCodeGoCookieResolveResult> {
+  const { cookies, diagnosis } = await readChromiumCookiesForDomainsWithDiagnosis({
+    platform: options.platform,
+    environment: options.environment,
+    homeDirectory: options.homeDirectory,
+    candidates: options.candidates,
+    domainSuffixes: OPENCODE_GO_COOKIE_DOMAINS,
+    cookieNames: OPENCODE_COOKIE_NAMES,
+    ...(options.readSafeStoragePassword
+      ? { readSafeStoragePassword: options.readSafeStoragePassword }
+      : {})
   })
-  return stdout
-    .split('\n')
-    .map((line) => {
-      const separator = line.indexOf('|')
-      if (separator <= 0) return undefined
-      return {
-        name: line.slice(0, separator).trim(),
-        value: line.slice(separator + 1)
-      }
+  const pairs = cookies
+    .filter((cookie) => OPENCODE_COOKIE_NAMES.has(cookie.name.toLowerCase()))
+    .filter((cookie) => cookie.value.trim().length > 0)
+    .map((cookie) => `${cookie.name}=${cookie.value}`)
+  if (pairs.length > 0) {
+    const cookieHeader = pairs.join('; ')
+    openCodeGoCookieFailureReason = undefined
+    openCodeGoCookieMemoryCache = cookieHeader
+    void persistOpenCodeGoCookieCache(cookieHeader, options.platform)
+    return { cookieHeader, source: 'browser' }
+  }
+  const failureReason: OpenCodeGoCookieFailureReason =
+    diagnosis.kind === 'decrypt_failed' ? 'decrypt_failed' : 'not_found'
+  openCodeGoCookieFailureReason = failureReason
+  return { failureReason }
+}
+
+async function loadPersistedOpenCodeGoCookieCache(
+  platform: NodeJS.Platform | undefined
+): Promise<string | undefined> {
+  if ((platform ?? process.platform) !== 'darwin') return undefined
+  try {
+    const { stdout } = await execFileAsync('security', [
+      'find-generic-password',
+      '-w',
+      '-s',
+      OPENCODE_GO_CACHE_SERVICE,
+      '-a',
+      OPENCODE_GO_CACHE_ACCOUNT
+    ], {
+      encoding: 'utf8',
+      timeout: 2_000,
+      maxBuffer: 64 * 1024
     })
-    .filter((row): row is { name: string; value: string } =>
-      row !== undefined &&
-      row.name.length > 0)
+    return filterOpenCodeGoCookieHeader(stdout.trim()) || undefined
+  } catch {
+    return undefined
+  }
+}
+
+async function persistOpenCodeGoCookieCache(
+  cookieHeader: string,
+  platform: NodeJS.Platform | undefined
+): Promise<void> {
+  if ((platform ?? process.platform) !== 'darwin') return
+  try {
+    await execFileAsync('security', [
+      'add-generic-password',
+      '-U',
+      '-s',
+      OPENCODE_GO_CACHE_SERVICE,
+      '-a',
+      OPENCODE_GO_CACHE_ACCOUNT,
+      '-w',
+      cookieHeader
+    ], {
+      encoding: 'utf8',
+      timeout: 2_000,
+      maxBuffer: 64 * 1024
+    })
+  } catch {
+    // Cache persistence is best-effort.
+  }
+}
+
+async function clearPersistedOpenCodeGoCookieCache(): Promise<void> {
+  if (process.platform !== 'darwin') return
+  try {
+    await execFileAsync('security', [
+      'delete-generic-password',
+      '-s',
+      OPENCODE_GO_CACHE_SERVICE,
+      '-a',
+      OPENCODE_GO_CACHE_ACCOUNT
+    ], {
+      encoding: 'utf8',
+      timeout: 2_000,
+      maxBuffer: 64 * 1024
+    })
+  } catch {
+    // Missing cache entries are fine.
+  }
+}
+
+export function openCodeGoCookieDatabasePaths(
+  options: Omit<OpenCodeGoCookieResolverOptions, 'readCookies' | 'readSafeStoragePassword'> = {}
+): string[] {
+  return listChromiumCookieDatabaseCandidates({
+    platform: options.platform,
+    environment: options.environment,
+    homeDirectory: options.homeDirectory
+  }).map((candidate) => candidate.databasePath)
 }
 
 async function readJsonFile(path: string): Promise<unknown> {
diff --git a/kun/src/services/thread-service.ts b/kun/src/services/thread-service.ts
index 77503bb7d..41813f494 100644
--- a/kun/src/services/thread-service.ts
+++ b/kun/src/services/thread-service.ts
@@ -174,6 +174,17 @@ export class ThreadService {
     return this.threadStore.get(threadId)
   }
 
+  /**
+   * Read the thread/turn metadata without hydrating the item history when the
+   * backing store supports it. File/hybrid stores use this on detail and
+   * status routes so the session items are loaded exactly once.
+   */
+  async getMetadata(threadId: string): Promise<ThreadRecord | null> {
+    return this.threadStore.getMetadata
+      ? this.threadStore.getMetadata(threadId)
+      : this.threadStore.get(threadId)
+  }
+
   async create(
     request: CreateThreadRequest,
     options: {
diff --git a/kun/src/services/tool-cancellation-service.test.ts b/kun/src/services/tool-cancellation-service.test.ts
new file mode 100644
index 000000000..efbf7a731
--- /dev/null
+++ b/kun/src/services/tool-cancellation-service.test.ts
@@ -0,0 +1,54 @@
+import { describe, expect, it, vi } from 'vitest'
+import { makeToolCallItem } from '../domain/item.js'
+import type { ToolCallTurnItem } from '../contracts/items.js'
+import type { Turn } from '../contracts/turns.js'
+import { ToolCancellationRegistry } from '../loop/tool-cancellation-registry.js'
+import { ToolCancellationService } from './tool-cancellation-service.js'
+
+describe('ToolCancellationService', () => {
+  it('records the request and keeps retries idempotent after execution cleanup', async () => {
+    const call: ToolCallTurnItem = makeToolCallItem({
+      id: 'item_call',
+      threadId: 'thread',
+      turnId: 'turn',
+      callId: 'call',
+      toolName: 'read',
+      arguments: {},
+      status: 'running'
+    }) as ToolCallTurnItem
+    const turn = {
+      id: 'turn',
+      threadId: 'thread',
+      status: 'running',
+      items: [call]
+    } as unknown as Turn
+    const getTurn = vi.fn(async () => turn)
+    const updateItem = vi.fn(async (_threadId: string, _itemId: string, patch: Record<string, unknown>) => {
+      Object.assign(call, patch)
+      return call
+    })
+    const registry = new ToolCancellationRegistry()
+    const registration = registry.register(
+      { threadId: 'thread', turnId: 'turn', callId: 'call' },
+      new AbortController().signal
+    )
+    const service = new ToolCancellationService(
+      { getTurn, updateItem } as never,
+      registry,
+      () => '2026-08-07T00:00:00.000Z'
+    )
+
+    await expect(service.cancel({ threadId: 'thread', turnId: 'turn', callId: 'call' }))
+      .resolves.toMatchObject({ status: 'cancellation_requested' })
+    expect(call.cancelRequestedAt).toBe('2026-08-07T00:00:00.000Z')
+    expect(updateItem).toHaveBeenCalledWith('thread', 'item_call', {
+      cancelRequestedAt: '2026-08-07T00:00:00.000Z'
+    })
+
+    await expect(service.cancel({ threadId: 'thread', turnId: 'turn', callId: 'call' }))
+      .resolves.toMatchObject({ status: 'already_requested' })
+    registration.dispose()
+    await expect(service.cancel({ threadId: 'thread', turnId: 'turn', callId: 'call' }))
+      .resolves.toMatchObject({ status: 'already_requested' })
+  })
+})
diff --git a/kun/src/services/tool-cancellation-service.ts b/kun/src/services/tool-cancellation-service.ts
new file mode 100644
index 000000000..2f14a1e86
--- /dev/null
+++ b/kun/src/services/tool-cancellation-service.ts
@@ -0,0 +1,63 @@
+import type { ToolCallTurnItem } from '../contracts/items.js'
+import type { TurnService } from './turn-service.js'
+import {
+  ToolCancellationRegistry,
+  type ToolCancellationRequestStatus
+} from '../loop/tool-cancellation-registry.js'
+
+export type ToolCancellationServiceResult = {
+  threadId: string
+  turnId: string
+  callId: string
+  status: Extract<ToolCancellationRequestStatus, 'cancellation_requested' | 'already_requested'>
+}
+
+/** Coordinates durable request state with the process-local tool signal. */
+export class ToolCancellationService {
+  constructor(
+    private readonly turns: Pick<TurnService, 'getTurn' | 'updateItem'>,
+    private readonly registry: ToolCancellationRegistry,
+    private readonly nowIso: () => string
+  ) {}
+
+  async cancel(input: {
+    threadId: string
+    turnId: string
+    callId: string
+  }): Promise<ToolCancellationServiceResult> {
+    const turn = await this.turns.getTurn(input.threadId, input.turnId)
+    if (!turn) throw new Error(`turn not found: ${input.turnId}`)
+    if (turn.status !== 'queued' && turn.status !== 'running') {
+      throw new Error(`turn is no longer active: ${input.turnId}`)
+    }
+    const call = turn.items.find(
+      (item): item is ToolCallTurnItem => item.kind === 'tool_call' && item.callId === input.callId
+    )
+    if (!call) throw new Error(`tool call not found: ${input.callId}`)
+
+    const status = this.registry.request(input, this.nowIso())
+    // The registry is process-local and removes a handle in `finally` as soon
+    // as the tool settles. Keep a durable marker as the idempotency record so
+    // a retry that races just after completion still reports success rather
+    // than turning an already accepted cancellation into a 409.
+    if (status === 'not_found' && call.cancelRequestedAt) {
+      return { ...input, status: 'already_requested' }
+    }
+    if (status === 'not_found') {
+      throw new Error(`tool call is not currently executing: ${input.callId}`)
+    }
+    if (status === 'turn_aborted') {
+      throw new Error(`turn is already being interrupted: ${input.turnId}`)
+    }
+
+    if (!call.cancelRequestedAt) {
+      await this.turns.updateItem(input.threadId, call.id, {
+        cancelRequestedAt: this.nowIso()
+      })
+    }
+    return {
+      ...input,
+      status
+    }
+  }
+}
diff --git a/kun/src/services/turn-service.ts b/kun/src/services/turn-service.ts
index 3b22a897d..3b1d9c4d9 100644
--- a/kun/src/services/turn-service.ts
+++ b/kun/src/services/turn-service.ts
@@ -1040,6 +1040,9 @@ export class TurnService {
 
     this.clearRuntimeTurnState(input.threadId, input.turnId)
     await this.finalizePersistedOpenItems(input.threadId, input.turnId, input.status)
+    // The turn's usage metrics are now stable; release per-turn aggregation
+    // so long-lived threads do not accumulate one entry per historical turn.
+    this.deps.usage?.endTurn(input.threadId, input.turnId)
     const errorItem = input.error
       ? makeErrorItem({
           id: `item_${input.turnId}_error`,
diff --git a/kun/src/services/usage-service.test.ts b/kun/src/services/usage-service.test.ts
index 27c2295c9..2e4e2c6be 100644
--- a/kun/src/services/usage-service.test.ts
+++ b/kun/src/services/usage-service.test.ts
@@ -127,3 +127,58 @@ describe('usage cache diagnostics', () => {
     })
   })
 })
+
+describe('usage per-turn timing aggregation', () => {
+  const timed = (overrides: Record<string, unknown>) => ({
+    promptTokens: 100,
+    completionTokens: 10,
+    totalTokens: 110,
+    cacheHitRate: null,
+    turns: 1,
+    ...overrides
+  })
+
+  it('attaches turn averages to the cumulative snapshot per turnId', () => {
+    const usage = new UsageService()
+    // Turn A: two model calls within one user turn.
+    usage.record('thread-a', timed({ completionTokens: 40, requestTtftMs: 800, requestGenerationMs: 2_000 }), undefined, 'turn-a')
+    const turnASnapshot = usage.record('thread-a', timed({ completionTokens: 120, requestTtftMs: 1_200, requestGenerationMs: 2_000 }), undefined, 'turn-a')
+    // Turn B: separate averages, must not bleed into turn A.
+    const afterTurnB = usage.record('thread-a', timed({ completionTokens: 50, requestTtftMs: 500, requestGenerationMs: 1_000 }), undefined, 'turn-b')
+
+    expect(turnASnapshot.turnAvgTtftMs).toBe(1_000)
+    expect(turnASnapshot.turnAvgTokensPerSecond).toBe(40)
+    // Session averages aggregate across all calls in the thread.
+    expect(afterTurnB.avgTtftMs).toBe((800 + 1_200 + 500) / 3)
+    expect(afterTurnB.avgTokensPerSecond).toBe(210 / 5_000 * 1_000)
+    // Turn B has its own fresh averages.
+    expect(afterTurnB.turnAvgTtftMs).toBe(500)
+  })
+
+  it('reports null turn averages without timing data', () => {
+    const usage = new UsageService()
+    const snapshot = usage.record('thread-a', timed({}), undefined, 'turn-a')
+
+    expect(snapshot.turnAvgTtftMs).toBeNull()
+    expect(snapshot.turnAvgTokensPerSecond).toBeNull()
+  })
+
+  it('does not fold timing into a turn when turnId is omitted', () => {
+    const usage = new UsageService()
+    const snapshot = usage.record('thread-a', timed({ requestTtftMs: 900, requestGenerationMs: 1_000 }))
+
+    expect(snapshot.turnAvgTtftMs).toBeUndefined()
+    // Session aggregation still applies.
+    expect(snapshot.avgTtftMs).toBe(900)
+  })
+
+  it('endTurn releases per-turn aggregation for finished turns', () => {
+    const usage = new UsageService()
+    usage.record('thread-a', timed({ requestTtftMs: 800, requestGenerationMs: 1_000 }), undefined, 'turn-a')
+    usage.endTurn('thread-a', 'turn-a')
+
+    // A new call in the same turnId starts a fresh aggregation window.
+    const next = usage.record('thread-a', timed({ requestTtftMs: 200, requestGenerationMs: 1_000 }), undefined, 'turn-a')
+    expect(next.turnAvgTtftMs).toBe(200)
+  })
+})
diff --git a/kun/src/services/usage-service.ts b/kun/src/services/usage-service.ts
index 22e5b8f7d..c451e25f9 100644
--- a/kun/src/services/usage-service.ts
+++ b/kun/src/services/usage-service.ts
@@ -25,6 +25,8 @@ export class UsageService {
   private readonly counter = new UsageCounter()
   private readonly cache = new CacheTelemetry()
   private readonly cacheSignatures = new Map<string, CacheRequestSignature>()
+  /** Raw per-request timing sums keyed by `threadId::turnId`. */
+  private readonly turnTiming = new Map<string, TurnTiming>()
   /**
    * Rolling cacheable-hit-rate history keyed by thread + provider/model/endpoint
    * so a model or provider switch starts a FRESH baseline instead of polluting
@@ -41,11 +43,16 @@ export class UsageService {
   record(
     threadId: string,
     usage: UsageSnapshot,
-    signature?: CacheRequestSignature
+    signature?: CacheRequestSignature,
+    turnId?: string
   ): UsageSnapshot {
     const enriched = signature ? this.withCacheDiagnostics(threadId, usage, signature) : usage
     this.cache.ingest(threadId, enriched)
-    return this.counter.record(threadId, enriched)
+    const cumulative = this.counter.record(threadId, enriched)
+    if (turnId) {
+      return attachTurnAverages(cumulative, this.foldTurnTiming(threadId, turnId, enriched))
+    }
+    return cumulative
   }
 
   recordTokenEconomySavings(
@@ -64,6 +71,7 @@ export class UsageService {
     this.cache.ingest(threadId, seeded)
     this.cacheSignatures.delete(threadId)
     this.clearCacheHistory(threadId)
+    this.clearTurnTiming(threadId)
     return seeded
   }
 
@@ -82,14 +90,64 @@ export class UsageService {
   reset(threadId?: string): void {
     this.counter.reset(threadId)
     this.cache.reset(threadId)
-    if (threadId === undefined) this.cacheSignatures.clear()
-    else this.cacheSignatures.delete(threadId)
+    if (threadId === undefined) {
+      this.cacheSignatures.clear()
+    } else {
+      this.cacheSignatures.delete(threadId)
+    }
     if (threadId === undefined) {
       this.cacheHitHistory.clear()
       this.cacheRegressionCooldown.clear()
     } else {
       this.clearCacheHistory(threadId)
     }
+    this.clearTurnTiming(threadId)
+  }
+
+  /**
+   * Drop per-turn timing for a finished turn so long-lived threads do not
+   * accumulate one entry per historical turn. Call when the turn settles.
+   */
+  endTurn(threadId: string, turnId: string): void {
+    this.turnTiming.delete(this.turnKey(threadId, turnId))
+  }
+
+  private turnKey(threadId: string, turnId: string): string {
+    return `${threadId}::${turnId}`
+  }
+
+  private clearTurnTiming(threadId?: string): void {
+    if (threadId === undefined) {
+      this.turnTiming.clear()
+      return
+    }
+    const prefix = `${threadId}::`
+    for (const key of this.turnTiming.keys()) {
+      if (key.startsWith(prefix)) this.turnTiming.delete(key)
+    }
+  }
+
+  private foldTurnTiming(threadId: string, turnId: string, snapshot: UsageSnapshot): TurnTiming {
+    const key = this.turnKey(threadId, turnId)
+    const agg = this.turnTiming.get(key) ?? emptyTurnTiming()
+    const ttft = snapshot.requestTtftMs
+    if (typeof ttft === 'number' && Number.isFinite(ttft) && ttft >= 0) {
+      agg.ttftSumMs += ttft
+      agg.ttftCalls += 1
+    }
+    const generation = snapshot.requestGenerationMs
+    if (
+      typeof generation === 'number' &&
+      Number.isFinite(generation) &&
+      generation >= 0 &&
+      snapshot.completionTokens > 0
+    ) {
+      agg.generationSumMs += generation
+      agg.completionTokensSum += snapshot.completionTokens
+      agg.tpsCalls += 1
+    }
+    this.turnTiming.set(key, agg)
+    return agg
   }
 
   /** Drop all signature-keyed cache history + cooldown rows for one thread. */
@@ -159,6 +217,40 @@ export class UsageService {
   }
 }
 
+type TurnTiming = {
+  ttftSumMs: number
+  generationSumMs: number
+  completionTokensSum: number
+  ttftCalls: number
+  tpsCalls: number
+}
+
+function emptyTurnTiming(): TurnTiming {
+  return {
+    ttftSumMs: 0,
+    generationSumMs: 0,
+    completionTokensSum: 0,
+    ttftCalls: 0,
+    tpsCalls: 0
+  }
+}
+
+/**
+ * Attach this turn's averages to the cumulative snapshot. TTFT is a simple
+ * mean; tokens-per-second is weighted by total generated tokens over total
+ * generation time.
+ */
+function attachTurnAverages(snapshot: UsageSnapshot, timing: TurnTiming): UsageSnapshot {
+  return {
+    ...snapshot,
+    turnAvgTtftMs: timing.ttftCalls > 0 ? timing.ttftSumMs / timing.ttftCalls : null,
+    turnAvgTokensPerSecond:
+      timing.generationSumMs > 0
+        ? (timing.completionTokensSum / timing.generationSumMs) * 1_000
+        : null
+  }
+}
+
 export const MAX_DAILY_USAGE_DAYS = 370
 
 /** Rolling window of recent cacheable-hit-rate samples kept per thread. */
diff --git a/kun/src/telemetry/usage-counter.test.ts b/kun/src/telemetry/usage-counter.test.ts
index 83c8546af..4fd34d5dc 100644
--- a/kun/src/telemetry/usage-counter.test.ts
+++ b/kun/src/telemetry/usage-counter.test.ts
@@ -131,3 +131,84 @@ describe('UsageCounter.total cross-thread aggregate', () => {
     })
   })
 })
+
+describe('UsageCounter timing aggregation', () => {
+  it('derives thread-cumulative TTFT and tokens-per-second averages', () => {
+    const counter = new UsageCounter()
+    // TTFT simple mean: (800 + 1200) / 2 = 1000ms.
+    // TPS weighted: (50 + 150) / (2s + 2s) * 1000 = 50 tok/s.
+    counter.record('thread-a', snapshot({
+      completionTokens: 50,
+      requestTtftMs: 800,
+      requestGenerationMs: 2_000
+    }))
+    counter.record('thread-a', snapshot({
+      completionTokens: 150,
+      requestTtftMs: 1_200,
+      requestGenerationMs: 2_000
+    }))
+
+    const usage = counter.forThread('thread-a')
+    expect(usage.avgTtftMs).toBe(1_000)
+    expect(usage.avgTokensPerSecond).toBe(50)
+  })
+
+  it('treats missing timing fields as null instead of zero', () => {
+    const counter = new UsageCounter()
+    counter.record('thread-a', snapshot({ completionTokens: 10 }))
+
+    const usage = counter.forThread('thread-a')
+    expect(usage.avgTtftMs).toBeNull()
+    expect(usage.avgTokensPerSecond).toBeNull()
+  })
+
+  it('ignores invalid timing and mixes timed and untimed requests', () => {
+    const counter = new UsageCounter()
+    counter.record('thread-a', snapshot({ completionTokens: 100 }))
+    counter.record('thread-a', snapshot({
+      completionTokens: 100,
+      requestTtftMs: 400,
+      requestGenerationMs: 1_000
+    }))
+
+    const usage = counter.forThread('thread-a')
+    // Only the timed request contributes to the TTFT average.
+    expect(usage.avgTtftMs).toBe(400)
+    expect(usage.avgTokensPerSecond).toBe(100)
+  })
+
+  it('recomputes timing averages across threads in total()', () => {
+    const counter = new UsageCounter()
+    counter.record('thread-a', snapshot({
+      completionTokens: 100,
+      requestTtftMs: 1_000,
+      requestGenerationMs: 2_000
+    }))
+    counter.record('thread-b', snapshot({
+      completionTokens: 300,
+      requestTtftMs: 3_000,
+      requestGenerationMs: 2_000
+    }))
+
+    const total = counter.total()
+    expect(total.avgTtftMs).toBe(2_000)
+    expect(total.avgTokensPerSecond).toBe(100)
+  })
+
+  it('resets timing together with the thread counter', () => {
+    const counter = new UsageCounter()
+    counter.record('thread-a', snapshot({
+      completionTokens: 100,
+      requestTtftMs: 1_000,
+      requestGenerationMs: 2_000
+    }))
+    counter.reset('thread-a')
+    expect(counter.forThread('thread-a').avgTtftMs).toBeNull()
+    expect(counter.forThread('thread-a').avgTokensPerSecond).toBeNull()
+
+    // Seed restores snapshot values but starts timing history fresh.
+    counter.seed('thread-a', snapshot({ promptTokens: 5, completionTokens: 5 }))
+    expect(counter.forThread('thread-a').promptTokens).toBe(5)
+    expect(counter.forThread('thread-a').avgTtftMs).toBeNull()
+  })
+})
diff --git a/kun/src/telemetry/usage-counter.ts b/kun/src/telemetry/usage-counter.ts
index 5a53b533e..0123e7347 100644
--- a/kun/src/telemetry/usage-counter.ts
+++ b/kun/src/telemetry/usage-counter.ts
@@ -8,18 +8,24 @@ import { emptyUsageSnapshot } from '../contracts/usage.js'
  */
 export class UsageCounter {
   private perThread = new Map<string, UsageSnapshot>()
+  /** Raw per-request timing sums keyed by thread, used to derive averages. */
+  private readonly timing = new Map<string, TimingAgg>()
 
   reset(threadId?: string): void {
     if (threadId === undefined) {
       this.perThread.clear()
+      this.timing.clear()
       return
     }
     this.perThread.delete(threadId)
+    this.timing.delete(threadId)
   }
 
   seed(threadId: string, snapshot: UsageSnapshot): UsageSnapshot {
-    const next = normalizeUsageSnapshot(snapshot)
+    const next = attachTimingAverages(normalizeUsageSnapshot(snapshot), emptyTimingAgg())
     this.perThread.set(threadId, next)
+    // Restored threads have no in-process timing history.
+    this.timing.delete(threadId)
     return next
   }
 
@@ -99,8 +105,10 @@ export class UsageCounter {
       tokenEconomySavingsCny,
       hasError: snapshot.hasError
     }
-    this.perThread.set(threadId, next)
-    return next
+    const threadTiming = this.timing.get(threadId) ?? emptyTimingAgg()
+    this.timing.set(threadId, foldTiming(threadTiming, snapshot))
+    this.perThread.set(threadId, attachTimingAverages(next, this.timing.get(threadId)!))
+    return this.perThread.get(threadId)!
   }
 
   recordTokenEconomySavings(
@@ -132,7 +140,8 @@ export class UsageCounter {
     const totals = [...this.perThread.values()].reduce((acc, snapshot) => {
       return mergeUsage(acc, snapshot)
     }, emptyUsageSnapshot())
-    return totals
+    const timing = aggregateTiming([...this.timing.values()])
+    return attachTimingAverages(totals, timing)
   }
 
   forThread(threadId: string): UsageSnapshot {
@@ -140,6 +149,73 @@ export class UsageCounter {
   }
 }
 
+type TimingAgg = {
+  ttftSumMs: number
+  generationSumMs: number
+  completionTokensSum: number
+  ttftCalls: number
+  tpsCalls: number
+}
+
+function emptyTimingAgg(): TimingAgg {
+  return {
+    ttftSumMs: 0,
+    generationSumMs: 0,
+    completionTokensSum: 0,
+    ttftCalls: 0,
+    tpsCalls: 0
+  }
+}
+
+/** Fold one request's timing fields into the thread aggregate. */
+function foldTiming(agg: TimingAgg, snapshot: UsageSnapshot): TimingAgg {
+  const ttft = snapshot.requestTtftMs
+  if (typeof ttft === 'number' && Number.isFinite(ttft) && ttft >= 0) {
+    agg.ttftSumMs += ttft
+    agg.ttftCalls += 1
+  }
+  const generation = snapshot.requestGenerationMs
+  if (
+    typeof generation === 'number' &&
+    Number.isFinite(generation) &&
+    generation >= 0 &&
+    snapshot.completionTokens > 0
+  ) {
+    agg.generationSumMs += generation
+    agg.completionTokensSum += snapshot.completionTokens
+    agg.tpsCalls += 1
+  }
+  return agg
+}
+
+function aggregateTiming(items: readonly TimingAgg[]): TimingAgg {
+  const agg = emptyTimingAgg()
+  for (const item of items) {
+    agg.ttftSumMs += item.ttftSumMs
+    agg.generationSumMs += item.generationSumMs
+    agg.completionTokensSum += item.completionTokensSum
+    agg.ttftCalls += item.ttftCalls
+    agg.tpsCalls += item.tpsCalls
+  }
+  return agg
+}
+
+/**
+ * Attach thread-cumulative averages to a snapshot. TTFT is a simple mean
+ * over timed requests; tokens-per-second is a weighted mean computed from
+ * total generated tokens divided by total generation time.
+ */
+function attachTimingAverages(snapshot: UsageSnapshot, timing: TimingAgg): UsageSnapshot {
+  return {
+    ...snapshot,
+    avgTtftMs: timing.ttftCalls > 0 ? timing.ttftSumMs / timing.ttftCalls : null,
+    avgTokensPerSecond:
+      timing.generationSumMs > 0
+        ? (timing.completionTokensSum / timing.generationSumMs) * 1_000
+        : null
+  }
+}
+
 function normalizeUsageSnapshot(snapshot: UsageSnapshot): UsageSnapshot {
   const promptTokens = Math.max(0, Math.floor(snapshot.promptTokens))
   const completionTokens = Math.max(0, Math.floor(snapshot.completionTokens))
diff --git a/kun/tests/loop.test.ts b/kun/tests/loop.test.ts
index 17585bf87..45eb284fd 100644
--- a/kun/tests/loop.test.ts
+++ b/kun/tests/loop.test.ts
@@ -115,21 +115,6 @@ describe('AgentLoop', () => {
     )).toEqual([expect.objectContaining({ kind: 'turn_aborted' })])
   })
 
-  it('bounds cached prompt-pressure hydration markers', () => {
-    const telemetry = new LoopTelemetry({} as unknown as SessionStore) as unknown as {
-      rememberHydratedPressureThread(threadId: string): void
-      hydratedPressureThreads: Set<string>
-    }
-
-    for (let index = 0; index <= 512; index += 1) {
-      telemetry.rememberHydratedPressureThread(`thread_${index}`)
-    }
-
-    expect(telemetry.hydratedPressureThreads).toHaveLength(512)
-    expect(telemetry.hydratedPressureThreads.has('thread_0')).toBe(false)
-    expect(telemetry.hydratedPressureThreads.has('thread_512')).toBe(true)
-  })
-
   it('injects the current shell runtime under the full-access sandbox', async () => {
     let observedRequest: ModelRequest | null = null
     const h = makeHarness({
@@ -445,7 +430,7 @@ describe('AgentLoop', () => {
     expect(events.some((event) => event.kind === 'context_snapshot')).toBe(false)
   })
 
-  it('auto-compacts the 725733 + 131072 dead zone before the model transport instead of failing', async () => {
+  it('does not compact below the soft threshold solely for a large output capability', async () => {
     const requests: ModelRequest[] = []
     const h = makeHarness({
       provider: 'deadzone',
@@ -470,8 +455,9 @@ describe('AgentLoop', () => {
     await h.threadStore.upsert(
       createThreadRecord({ id: h.threadId, title: 'demo', workspace: '/tmp', model: 'deadzone' })
     )
-    // ~725k estimated input tokens: below the 750k soft threshold, but with
-    // the 131072 output budget the full request would exceed the 850k cap.
+    // ~725k estimated input tokens stays below the 750k soft threshold. The
+    // advertised 131072 capability must not be reserved in full; ordinary
+    // requests use the bounded 32768-token reservation.
     const chunk = '工'.repeat(6_050)
     for (let index = 0; index < 120; index += 1) {
       await h.sessionStore.appendItem(h.threadId, makeUserItem({
@@ -490,15 +476,13 @@ describe('AgentLoop', () => {
     await expect(h.loop.runTurn(h.threadId, h.turnId)).resolves.toBe('completed')
 
     expect(requests).toHaveLength(1)
-    expect(requests[0]?.history[0]).toMatchObject({ kind: 'compaction' })
+    expect(requests[0]?.history[0]).toMatchObject({ kind: 'user_message' })
+    expect(requests[0]?.maxTokens).toBe(32_768)
     const events = await h.sessionStore.loadEventsSince(h.threadId, 0)
     expect(events.some((event) =>
       event.kind === 'error' && event.code === 'context_window_exceeded'
     )).toBe(false)
-    expect(events).toContainEqual(expect.objectContaining({
-      kind: 'compaction_completed',
-      replacedTokens: expect.any(Number)
-    }))
+    expect(events.some((event) => event.kind === 'compaction_completed')).toBe(false)
     const compressed = events.find((event) =>
       event.kind === 'pipeline_stage' && event.stage === 'input_compressed'
     )
@@ -506,13 +490,72 @@ describe('AgentLoop', () => {
       kind: 'pipeline_stage',
       stage: 'input_compressed',
       details: expect.objectContaining({
-        outputBudgetTokens: 131_072,
+        outputBudgetTokens: 32_768,
         requestHardCapTokens: 850_000,
         fallbackCompactionAttempted: false
       })
     })
   })
 
+  it('does not repeatedly compact retained history for a 256k / 500k capability profile', async () => {
+    const requests: ModelRequest[] = []
+    const h = makeHarness({
+      provider: 'pathological-output-profile',
+      model: 'grok-4.5',
+      async *stream(request): AsyncIterable<ModelStreamChunk> {
+        requests.push(request)
+        yield { kind: 'completed', stopReason: 'stop' }
+      }
+    }, {
+      tools: [],
+      compactor: new ContextCompactor({ softThreshold: 192_000, hardThreshold: 217_600 }),
+      modelCapabilities: (model) => ({
+        id: model,
+        inputModalities: ['text'],
+        outputModalities: ['text'],
+        supportsToolCalling: true,
+        contextWindowTokens: 256_000,
+        maxOutputTokens: 500_000,
+        messageParts: ['text']
+      })
+    })
+    await h.threadStore.upsert(
+      createThreadRecord({ id: h.threadId, title: 'demo', workspace: '/tmp', model: 'grok-4.5' })
+    )
+    for (let index = 0; index < 40; index += 1) {
+      await h.sessionStore.appendItem(h.threadId, makeUserItem({
+        id: `pathological_old_${index}`,
+        turnId: `pathological_old_turn_${index}`,
+        threadId: h.threadId,
+        text: '工'.repeat(5_000)
+      }))
+    }
+    const first = await h.turns.startTurn({
+      threadId: h.threadId,
+      request: { prompt: 'first retained request' }
+    })
+    h.turnId = first.turnId
+
+    await expect(h.loop.runTurn(h.threadId, h.turnId)).resolves.toBe('completed')
+    const afterFirst = await h.sessionStore.loadEventsSince(h.threadId, 0)
+    expect(afterFirst.filter((event) => event.kind === 'compaction_completed')).toHaveLength(1)
+
+    const second = await h.turns.startTurn({
+      threadId: h.threadId,
+      request: { prompt: 'small follow-up after compaction' }
+    })
+    h.turnId = second.turnId
+    await expect(h.loop.runTurn(h.threadId, h.turnId)).resolves.toBe('completed')
+
+    const afterSecond = await h.sessionStore.loadEventsSince(h.threadId, 0)
+    expect(afterSecond.filter((event) => event.kind === 'compaction_completed')).toHaveLength(1)
+    const mainRequests = requests.filter((request) => request.systemPrompt !== COMPACTION_SYSTEM_PROMPT)
+    expect(mainRequests.at(-1)).toMatchObject({ maxTokens: 32_768 })
+    expect(mainRequests.at(-1)?.history.some((item) =>
+      item.kind === 'user_message' && item.text === 'small follow-up after compaction'
+    )).toBe(true)
+  })
+
   it('fails once with a detailed reason when the current message itself cannot be compacted', async () => {
     let dispatches = 0
     const h = makeHarness({
@@ -561,7 +604,7 @@ describe('AgentLoop', () => {
     expect(events.some((event) => event.kind === 'compaction_completed')).toBe(false)
   })
 
-  it('clamps the send-time output budget when rehydrated generated-image input grows', async () => {
+  it('keeps a large output capability bounded when generated-image input is rehydrated', async () => {
     const requests: ModelRequest[] = []
     const h = makeHarness({
       provider: 'image-fallback',
@@ -588,11 +631,9 @@ describe('AgentLoop', () => {
       await h.threadStore.upsert(
         createThreadRecord({ id: h.threadId, title: 'demo', workspace: '/tmp', model: 'image-fallback' })
       )
-      // Preflight lands just below the soft threshold (718,127), while the
-      // rehydrated forwarded image adds a fixed 1,210-token vision allowance
-      // and pushes the final request past what the declared 131,072 output
-      // budget would allow. The send-time clamp shrinks the output budget to
-      // the remaining capacity (130,663) instead of compacting history.
+      // Preflight lands just below the soft threshold and image rehydration
+      // adds a fixed vision allowance. The 131,072 model capability remains a
+      // 32,768-token ordinary reservation, so history stays intact.
       for (let index = 0; index < 119; index += 1) {
         await h.sessionStore.appendItem(h.threadId, makeUserItem({
           id: `image_old_${index}`,
@@ -632,9 +673,9 @@ describe('AgentLoop', () => {
       await expect(h.loop.runTurn(h.threadId, h.turnId)).resolves.toBe('completed')
 
       expect(requests).toHaveLength(1)
-      // History stays intact: the clamp absorbed the 1,210-token overage.
+      // History stays intact because the advertised maximum is not reserved.
       expect(requests[0]?.history[0]).toMatchObject({ kind: 'user_message' })
-      expect(requests[0]?.maxTokens).toBe(130_494)
+      expect(requests[0]?.maxTokens).toBe(32_768)
       const events = await h.sessionStore.loadEventsSince(h.threadId, 0)
       expect(events.some((event) =>
         event.kind === 'error' && event.code === 'context_window_exceeded'
@@ -647,7 +688,7 @@ describe('AgentLoop', () => {
         kind: 'pipeline_stage',
         stage: 'input_compressed',
         details: expect.objectContaining({
-          outputBudgetTokens: 130_494,
+          outputBudgetTokens: 32_768,
           requestHardCapTokens: 850_000,
           fallbackCompactionAttempted: false
         })
diff --git a/kun/tests/runtime-factory.test.ts b/kun/tests/runtime-factory.test.ts
index fe14d4508..25d89a4aa 100644
--- a/kun/tests/runtime-factory.test.ts
+++ b/kun/tests/runtime-factory.test.ts
@@ -156,6 +156,73 @@ describe('runtime factory usage carryover', () => {
     }
   })
 
+  it('keeps explore_agent advertised across Lab hot-apply toggles', async () => {
+    const dataDir = await mkdtemp(join(tmpdir(), 'kun-runtime-explore-lab-'))
+    tempDirs.push(dataDir)
+    const runtime = await createKunServeRuntime({
+      host: '127.0.0.1',
+      port: 0,
+      dataDir,
+      runtimeToken: 'tok',
+      apiKey: 'sk-default',
+      baseUrl: 'https://api.example.test/v1',
+      model: 'model-before',
+      approvalPolicy: 'auto',
+      sandboxMode: 'danger-full-access',
+      tokenEconomyMode: false,
+      insecure: false,
+      storage: { backend: 'file' },
+      lab: { exploreAgent: { enabled: true, fast: false } },
+      capabilities: KunCapabilitiesConfig.parse({
+        subagents: { enabled: true }
+      })
+    })
+
+    const listExplore = async () => {
+      const toolHost = runtime.toolHost
+      expect(toolHost).toBeDefined()
+      if (!toolHost) throw new Error('Expected the Kun runtime tool host to be available')
+      const tools = await toolHost.listTools({
+        threadId: 'thr_explore',
+        turnId: 'turn_explore',
+        workspace: dataDir,
+        threadMode: 'agent',
+        clientSurface: 'gui',
+        approvalPolicy: 'auto',
+        abortSignal: new AbortController().signal,
+        awaitApproval: async () => 'allow'
+      })
+      return tools.some((tool) => tool.name === 'explore_agent')
+    }
+
+    try {
+      const diagnostics = await runtime.toolDiagnostics?.()
+      expect(diagnostics?.providers.some((provider) => provider.id === 'explore-agent')).toBe(true)
+      expect(await listExplore()).toBe(true)
+
+      // Any hot-apply previously dropped explore_agent from the rebuilt registry.
+      expect(await runtime.applyConfig({
+        capabilities: KunCapabilitiesConfig.parse({
+          subagents: { enabled: true },
+          web: { enabled: true, fetchEnabled: true }
+        })
+      })).toEqual({ ok: true })
+      expect(await listExplore()).toBe(true)
+
+      expect(await runtime.applyConfig({
+        lab: { exploreAgent: { enabled: false, fast: false } }
+      })).toEqual({ ok: true })
+      expect(await listExplore()).toBe(false)
+
+      expect(await runtime.applyConfig({
+        lab: { exploreAgent: { enabled: true, fast: false } }
+      })).toEqual({ ok: true })
+      expect(await listExplore()).toBe(true)
+    } finally {
+      await runtime.shutdown?.()
+    }
+  })
+
   it('keeps the recorder available while gating capture by each thread state', async () => {
     for (const [name, runtimeOptions, expectedCapture] of [
       ['omitted', undefined, false],
diff --git a/release/release-v0.2.37.md b/release/release-v0.2.37.md
new file mode 100644
index 000000000..136b5be8c
--- /dev/null
+++ b/release/release-v0.2.37.md
@@ -0,0 +1,45 @@
+# Kun v0.2.37
+
+v0.2.37 重点完善探索型子代理（explore_agent）的只读调查链路与展示体验，同时加固 Agent Graph 并发、Provider 凭据和模型目录的稳定性，并补充自动更新、工具取消与用量计时等运行时能力。
+
+### 探索型子代理
+
+- 新增 `explore_agent` 只读探索工具，支持并行多路调查、Lab 配置和 Codex 快速执行路径；探索任务只读运行，不会修改工作区文件。
+- 探索结果在会话中呈现为可展开的 ExplorePeekBody 组件，SubagentCallCard 增加结论处理，消息时间线完整保留探索过程。
+- 工具调度策略与消息时间线补齐对 `explore_agent` 的专门处理；强化工具描述后，探索被确立为仓库调查的第一步。
+- `explore_agent` 会根据 Lab 设置动态决定是否对外暴露，未启用时不会增加无关的上下文与调用开销。
+
+### Agent Graph 与并发稳定性
+
+- Graph 增加线程所有权门禁，避免会话被错误跨线程接管；SSE 观察改为独立观察者，降低并发通知冲突。
+- 主导（lead）结算时保留已完成就绪的运行，避免结算顺序问题导致子代理结果被误判为失败。
+- 共享 Kun 运行时在发现进程 PID 失效后可以自动恢复，减少僵尸进程导致的连接异常。
+
+### Provider、模型与凭据
+
+- MiniMax 增加 OpenAI-compatible `/v1` endpoint 别名，兼容性模型接入更简单。
+- Provider 凭据保存改为保留脱敏凭据，避免异步保存把已填写的 API key 回退为空；空 primary model 不再覆盖当前生效的设置。
+- Token Plan 模型目录在注册表并发更新时保持稳定，不再因竞争而丢失。
+- 语音转文字设置增加凭据就绪检查；OpenCode Go 的 Chromium Cookie 读取、解密与订阅诊断进一步完善。
+- Cursor 集成重新暴露 Kun 独有工具，并排除重叠的 Cursor 内置工具；Codex responses URL 规范化，相关 endpoint 处理更一致。
+
+### 工具、用量与可观测性
+
+- 新增工具取消功能，长时间运行的工具可以主动中断。
+- 用量追踪增加计时指标，telemetry 压力管理简化，模型请求处理更稳定。
+- 线程快照增加缓存与状态管理，恢复会话时更快、更可靠。
+
+### 更新、发布与 Office
+
+- 自动更新支持原地安装处理与更新残留清理，升级过程更干净。
+- Windows 下 `.cmd` 脚本改用 cmd.exe 执行，修复脚本类工具在 Windows 上的运行问题。
+- Office/WPS 文档导入时 schema 校验改为软失败，个别文档兼容性问题不再阻断导入。
+
+### 升级说明
+
+- 从 v0.2.36 升级无需手动迁移会话、工作区、Graph 或 Provider 配置。
+- 探索型子代理为新增能力，无需迁移历史数据；如未在 Lab 中启用，不会改变既有工作流。
+
+### 完整变更
+
+https://github.com/KunAgent/Kun/compare/v0.2.36...v0.2.37
diff --git a/scripts/run-with-kun-flavor.cjs b/scripts/run-with-kun-flavor.cjs
index 437b87ed1..269db16cd 100644
--- a/scripts/run-with-kun-flavor.cjs
+++ b/scripts/run-with-kun-flavor.cjs
@@ -10,6 +10,9 @@ if ((flavor !== 'production' && flavor !== 'development') || !command) {
 const executable = process.platform === 'win32' && !/\.(?:cmd|exe)$/iu.test(command)
   ? `${command}.cmd`
   : command
+// On Windows, .cmd batch scripts cannot be launched directly via CreateProcess;
+// they must go through cmd.exe, otherwise spawnSync fails with EINVAL.
+const needsCmdShell = process.platform === 'win32' && /\.cmd$/iu.test(executable)
 let electronCliArgs = []
 try {
   const configured = JSON.parse(process.env.ELECTRON_CLI_ARGS || '[]')
@@ -34,7 +37,8 @@ const result = spawnSync(executable, args, {
       : {}),
     ELECTRON_CLI_ARGS: JSON.stringify(electronCliArgs)
   },
-  stdio: 'inherit'
+  stdio: 'inherit',
+  ...(needsCmdShell ? { shell: true } : {})
 })
 
 if (result.error) {
diff --git a/scripts/smoke-windows-installer-migration.ps1 b/scripts/smoke-windows-installer-migration.ps1
index b7e784f50..c895f5862 100644
--- a/scripts/smoke-windows-installer-migration.ps1
+++ b/scripts/smoke-windows-installer-migration.ps1
@@ -482,12 +482,15 @@ try {
   Assert-True (-not (Test-Path -LiteralPath $attackerMarker)) 'The elevated update executed the tampered registry uninstaller.'
   $machineLocationAfterUpdate = Get-ItemPropertyValue -LiteralPath $machineInstallRegistryPath -Name InstallLocation
   Assert-True (Test-PathEqual $machineLocationAfterUpdate $machineTarget) 'The automatic update did not retain the all-users registration.'
+  Assert-True (Test-Path -LiteralPath (Join-Path $machineTarget 'Kun.exe')) 'The automatic update left the all-users application executable missing.'
+  Assert-True (Test-Path -LiteralPath (Join-Path $machineTarget 'resources\app.asar')) 'The automatic update left the all-users application payload incomplete.'
   $otherUserLocationAfterUpdate = Get-ItemPropertyValue -LiteralPath $otherUserInstallRegistryPath -Name InstallLocation
   Assert-True (Test-PathEqual $otherUserLocationAfterUpdate $otherUserTarget) 'The automatic update changed the unrelated current-user registration.'
   $otherUserUninstallAfterUpdate = Get-ItemPropertyValue -LiteralPath $otherUserUninstallRegistryPath -Name UninstallString
   Assert-True ($otherUserUninstallAfterUpdate -eq $otherUserUninstallString) 'The automatic update did not restore the unrelated current-user uninstall registration.'
   $automaticUpdateDiagnostics = Get-Content -LiteralPath $diagnosticPath -Raw
   Assert-True ($automaticUpdateDiagnostics -match [regex]::Escape("source=$machineTarget")) 'The automatic update did not validate the running all-users source.'
+  Assert-True ($automaticUpdateDiagnostics -match 'SUCCESS action=CleanupInPlaceLeftovers') 'The automatic update did not run post-validate in-place leftover cleanup.'
 
   Invoke-Uninstaller 'all-users uninstall' $machineTarget '/allusers'
   Assert-PathEntryRemoved $machineTarget
diff --git a/src/main/index.ts b/src/main/index.ts
index d8f35d534..47e788959 100644
--- a/src/main/index.ts
+++ b/src/main/index.ts
@@ -26,6 +26,7 @@ import {
   JsonSettingsStore,
   devServerHintUrl
 } from './settings-store'
+import { preserveRedactedProviderCredentials } from './settings-credential-redaction'
 import kunLogoPng from '../asset/img/kun.png?url'
 import kunMacLogoPng from '../asset/img/kun_mac.png?url'
 import kunTrayPng from '../asset/img/kun_tray.png?url'
@@ -3229,7 +3230,10 @@ app.whenReady().then(async () => {
     const { previous, saved } = await runtimeSettingsIntents.serializePersistence(async () => {
       let committedPrevious: AppSettingsV1 | undefined
       const saved = await store.update((current) => {
-        const effectivePartial = preserveRuntimeTokenForFullSettingsSnapshot(current, partial)
+        const effectivePartial = preserveRedactedProviderCredentials(
+          current,
+          preserveRuntimeTokenForFullSettingsSnapshot(current, partial)
+        )
         const requestedDataDir = effectivePartial.agents?.kun?.dataDir
         if (
           appEnvironment.flavor === 'production' &&
@@ -3308,7 +3312,10 @@ app.whenReady().then(async () => {
     const saved = await runtimeSettingsIntents.serializePersistence(async () => {
       let committedPrevious: AppSettingsV1 | undefined
       const saved = await store.update((current) => {
-        const effectivePartial = preserveRuntimeTokenForFullSettingsSnapshot(current, partial)
+        const effectivePartial = preserveRedactedProviderCredentials(
+          current,
+          preserveRuntimeTokenForFullSettingsSnapshot(current, partial)
+        )
         const requestedDataDir = effectivePartial.agents?.kun?.dataDir
         if (
           appEnvironment.flavor === 'production' &&
diff --git a/src/main/ipc/app-ipc-schemas.test.ts b/src/main/ipc/app-ipc-schemas.test.ts
index 7fa335930..e7054a108 100644
--- a/src/main/ipc/app-ipc-schemas.test.ts
+++ b/src/main/ipc/app-ipc-schemas.test.ts
@@ -6,6 +6,7 @@ import {
   conversationExportPayloadSchema,
   cursorSubscriptionDiscoveryPayloadSchema,
   isSafeOpenExternalUrl,
+  modelProviderCredentialRevealPayloadSchema,
   modelsDevCatalogPayloadSchema,
   notificationPayloadSchema,
   runtimeRequestPayloadSchema,
@@ -63,6 +64,17 @@ describe('app-ipc-schemas', () => {
     expect(() => cursorSubscriptionDiscoveryPayloadSchema.parse({ apiKey: '' })).toThrow()
   })
 
+  it('accepts only one bounded provider identity for credential reveal', () => {
+    expect(modelProviderCredentialRevealPayloadSchema.parse({
+      providerId: ' deepseek '
+    })).toEqual({ providerId: 'deepseek' })
+    expect(() => modelProviderCredentialRevealPayloadSchema.parse({ providerId: '' })).toThrow()
+    expect(() => modelProviderCredentialRevealPayloadSchema.parse({
+      providerId: 'deepseek',
+      credential: 'must-not-cross-the-request-boundary'
+    })).toThrow()
+  })
+
   it('accepts only provider identity and refresh fields for models.dev lookup', () => {
     expect(modelsDevCatalogPayloadSchema.parse({
       providerId: 'xiaomi-token-plan',
@@ -600,6 +612,20 @@ describe('app-ipc-schemas', () => {
     })).toThrow()
   })
 
+  it('accepts clearing the provider while keeping the primary model non-empty', () => {
+    expect(settingsPatchSchema.parse({
+      agents: { kun: { providerId: '' } }
+    }).agents?.kun).toEqual({ providerId: '' })
+    const emptyModel = settingsPatchSchema.safeParse({
+      agents: { kun: { model: '' } }
+    })
+    expect(emptyModel.success).toBe(false)
+    if (!emptyModel.success) {
+      expect(emptyModel.error.issues[0]?.path).toEqual(['agents', 'kun', 'model'])
+      expect(emptyModel.error.issues[0]?.message).toMatch(/Too small/)
+    }
+  })
+
   it('accepts the cursor spotlight preference', () => {
     expect(settingsPatchSchema.parse({ cursorSpotlight: false }).cursorSpotlight).toBe(false)
     expect(settingsPatchSchema.parse({ cursorSpotlightColor: ' #FF8800 ' }).cursorSpotlightColor).toBe('#FF8800')
diff --git a/src/main/ipc/app-ipc-schemas/runtime.ts b/src/main/ipc/app-ipc-schemas/runtime.ts
index d6b4aa4ad..3cf963c78 100644
--- a/src/main/ipc/app-ipc-schemas/runtime.ts
+++ b/src/main/ipc/app-ipc-schemas/runtime.ts
@@ -42,8 +42,10 @@ import {
   KUN_THREAD_TURN_TEMPLATE,
   KUN_THREAD_TURNS_TEMPLATE,
   KUN_THREAD_INTERRUPT_TEMPLATE,
+  KUN_THREAD_TOOL_CANCEL_TEMPLATE,
   KUN_THREAD_MODEL_REQUESTS_TEMPLATE,
   KUN_THREAD_STEER_TEMPLATE,
+  KUN_THREAD_STATE_TEMPLATE,
   KUN_THREAD_TEMPLATE,
   KUN_USER_INPUT_TEMPLATE,
   KUN_USAGE_TEMPLATE,
@@ -95,6 +97,12 @@ export const providerProbePayloadSchema = z
   })
   .strict()
 
+export const modelProviderCredentialRevealPayloadSchema = z
+  .object({
+    providerId: trimmedString(128)
+  })
+  .strict()
+
 export const modelsDevCatalogPayloadSchema = z
   .object({
     providerId: trimmedString(128),
@@ -171,6 +179,7 @@ const ENDPOINTS: readonly EndpointTemplate[] = [
   compileEndpoint(KUN_MCP_OAUTH_TEMPLATE, ['GET', 'DELETE']),
   compileEndpoint(KUN_MCP_OAUTH_SERVER_TEMPLATE, ['DELETE']),
   compileEndpoint(KUN_THREADS_TEMPLATE, ['GET', 'POST']),
+  compileEndpoint(KUN_THREAD_STATE_TEMPLATE, ['GET']),
   compileEndpoint(KUN_THREAD_TEMPLATE, ['GET', 'PATCH', 'DELETE']),
   compileEndpoint(KUN_THREAD_FORK_TEMPLATE, ['POST']),
   compileEndpoint(KUN_THREAD_GOAL_TEMPLATE, ['GET', 'POST', 'DELETE']),
@@ -182,6 +191,7 @@ const ENDPOINTS: readonly EndpointTemplate[] = [
   compileEndpoint(KUN_THREAD_TURN_TEMPLATE, ['GET']),
   compileEndpoint(KUN_THREAD_STEER_TEMPLATE, ['POST']),
   compileEndpoint(KUN_THREAD_INTERRUPT_TEMPLATE, ['POST']),
+  compileEndpoint(KUN_THREAD_TOOL_CANCEL_TEMPLATE, ['POST']),
   compileEndpoint(KUN_THREAD_MODEL_REQUESTS_TEMPLATE, ['GET']),
   compileEndpoint(KUN_USER_INPUT_TEMPLATE, ['POST']),
   compileEndpoint(KUN_SESSION_RESUME_TEMPLATE, ['POST']),
diff --git a/src/main/ipc/register-app-ipc-handlers.test.ts b/src/main/ipc/register-app-ipc-handlers.test.ts
index 9ed01c78a..52750f3f9 100644
--- a/src/main/ipc/register-app-ipc-handlers.test.ts
+++ b/src/main/ipc/register-app-ipc-handlers.test.ts
@@ -666,6 +666,18 @@ describe('registerAppIpcHandlers', () => {
     expect(applySettingsPatch).not.toHaveBeenCalled()
   })
 
+  it('includes the Zod path when settings:set rejects an empty primary model', async () => {
+    const applySettingsPatch = vi.fn(async () => settings())
+
+    registerAppIpcHandlers(registerOptions({ applySettingsPatch }))
+
+    const handler = handlers.get('settings:set')
+    await expect(
+      handler?.({}, { agents: { kun: { model: '' } } })
+    ).rejects.toThrow(/Invalid payload for settings:set: agents\.kun\.model: Too small/)
+    expect(applySettingsPatch).not.toHaveBeenCalled()
+  })
+
   it('redacts plaintext model credentials from settings:get without mutating the Main snapshot', async () => {
     const current = settingsWithPlaintextModelCredentials()
     const original = JSON.stringify(current)
@@ -696,6 +708,58 @@ describe('registerAppIpcHandlers', () => {
     expect(JSON.stringify(persisted)).toBe(original)
   })
 
+  it('reveals only the requested provider credential to the trusted workbench', async () => {
+    const projected = settingsWithPlaintextModelCredentials()
+    const providerId = projected.provider.providers[0]!.id
+    const stored: AppSettingsV1 = {
+      ...projected,
+      provider: {
+        ...projected.provider,
+        apiKey: '',
+        providers: projected.provider.providers.map((provider) => ({
+          ...provider,
+          apiKey: ''
+        }))
+      }
+    }
+    const mainFrame = { processId: 10, routingId: 20 }
+    const contents = { id: 7, mainFrame }
+    const mainWindow = { isDestroyed: () => false, webContents: contents }
+    const trustedEvent = { sender: contents, senderFrame: mainFrame }
+    const withRegistryCredentials = vi.fn(async () => projected)
+    registerAppIpcHandlers(registerOptions({
+      store: { load: vi.fn(async () => stored) } as never,
+      getMainWindow: () => mainWindow as never,
+      withRegistryCredentials
+    }))
+
+    await expect(handlers.get('model-provider:credential:reveal')?.(
+      trustedEvent,
+      { providerId }
+    )).resolves.toEqual({ providerId, credential: 'provider-secret-0' })
+    expect(withRegistryCredentials).toHaveBeenCalledOnce()
+  })
+
+  it('rejects untrusted provider credential reveal before loading protected settings', async () => {
+    const mainFrame = { processId: 10, routingId: 20 }
+    const contents = { id: 7, mainFrame }
+    const mainWindow = { isDestroyed: () => false, webContents: contents }
+    const storeLoad = vi.fn(async () => settings())
+    const withRegistryCredentials = vi.fn(async (value: AppSettingsV1) => value)
+    registerAppIpcHandlers(registerOptions({
+      store: { load: storeLoad } as never,
+      getMainWindow: () => mainWindow as never,
+      withRegistryCredentials
+    }))
+
+    await expect(handlers.get('model-provider:credential:reveal')?.(
+      { sender: { id: 99 }, senderFrame: { processId: 90, routingId: 91 } },
+      { providerId: 'deepseek' }
+    )).rejects.toThrow(/trusted workbench frame/)
+    expect(storeLoad).not.toHaveBeenCalled()
+    expect(withRegistryCredentials).not.toHaveBeenCalled()
+  })
+
   it('requires trusted native confirmation before resetting unreadable credentials', async () => {
     const mainFrame = { processId: 10, routingId: 20 }
     const contents = { id: 7, mainFrame }
diff --git a/src/main/ipc/register-app-ipc-handlers.ts b/src/main/ipc/register-app-ipc-handlers.ts
index daffe2c2d..f184a2df3 100644
--- a/src/main/ipc/register-app-ipc-handlers.ts
+++ b/src/main/ipc/register-app-ipc-handlers.ts
@@ -37,6 +37,7 @@ import type {
   ConversationWorkspaceCreateResult,
   DesktopCommand,
   KunRuntimeSettingsSyncStatusPayload,
+  ModelProviderCredentialRevealResult,
   RuntimeRequestResult,
   SystemNotificationResult,
   TurnCompleteNotificationPayload,
@@ -69,6 +70,7 @@ import {
   notificationPayloadSchema,
   openEditorPathPayloadSchema,
   modelsDevCatalogPayloadSchema,
+  modelProviderCredentialRevealPayloadSchema,
   providerProbePayloadSchema,
   projectDesignMdLintPayloadSchema,
   promptOptimizationPayloadSchema,
@@ -432,11 +434,23 @@ function approvalLogReference(approvalId: string): string {
   return `sha256:${createHash('sha256').update(approvalId).digest('hex').slice(0, 16)}`
 }
 
+function formatZodIssuePath(path: readonly PropertyKey[]): string {
+  return path
+    .map((segment) => typeof segment === 'symbol' ? segment.toString() : String(segment))
+    .join('.')
+}
+
 function parseIpcPayload<T>(channel: string, schema: z.ZodType<T>, payload: unknown): T {
   const parsed = schema.safeParse(payload)
   if (parsed.success) return parsed.data
   const issue = parsed.error.issues[0]
-  throw new Error(`Invalid payload for ${channel}: ${issue?.message ?? 'Bad request.'}`)
+  const message = issue?.message ?? 'Bad request.'
+  const path = issue?.path?.length ? formatZodIssuePath(issue.path) : ''
+  throw new Error(
+    path
+      ? `Invalid payload for ${channel}: ${path}: ${message}`
+      : `Invalid payload for ${channel}: ${message}`
+  )
 }
 
 function withoutRendererProjectConfigGrants(partial: AppSettingsPatch): AppSettingsPatch {
@@ -918,6 +932,27 @@ export function registerAppIpcHandlers(options: RegisterAppIpcHandlersOptions):
   ipcMain.handle('settings:get', async () =>
     withoutRendererPlaintextCredentials(await store.load())
   )
+  ipcMain.handle(
+    'model-provider:credential:reveal',
+    async (event, payload: unknown): Promise<ModelProviderCredentialRevealResult> => {
+      assertTrustedWorkbenchSender(event, getMainWindow)
+      const { providerId } = parseIpcPayload(
+        'model-provider:credential:reveal',
+        modelProviderCredentialRevealPayloadSchema,
+        payload
+      )
+      const stored = await store.load()
+      if (!stored.provider.providers.some((provider) => provider.id === providerId)) {
+        throw new Error(`Provider profile "${providerId}" is unavailable`)
+      }
+      const projected = await withRegistryCredentials(stored)
+      const credential = projected.provider.providers
+        .find((provider) => provider.id === providerId)
+        ?.apiKey.trim() ?? ''
+      if (!credential) throw new Error('Protected provider credential is unavailable')
+      return { providerId, credential }
+    }
+  )
   ipcMain.handle('credentials:reset-unreadable', async (event): Promise<CredentialRecoveryResetResult> => {
     assertTrustedWorkbenchSender(event, getMainWindow)
     const parent = getMainWindow()
diff --git a/src/main/kun-runtime-supervisor.test.ts b/src/main/kun-runtime-supervisor.test.ts
index 6564ff90a..a9f799a7a 100644
--- a/src/main/kun-runtime-supervisor.test.ts
+++ b/src/main/kun-runtime-supervisor.test.ts
@@ -184,6 +184,26 @@ describe('KunRuntimeSupervisor', () => {
     expect(h.statuses.map((status) => status.state)).toEqual(['restarting', 'running'])
   })
 
+  it('takes the missing/ensure path when health clears a stale childRunning cache (#1116)', async () => {
+    let childRunning = true
+    const h = harness({
+      childRunning: true,
+      watchdogFailureThreshold: 3
+    })
+    h.deps.isChildRunning = () => childRunning
+    h.checkHealth.mockImplementation(async () => {
+      childRunning = false
+      return false
+    })
+    h.supervisor.setManagedRuntimeExpected(true)
+
+    await h.supervisor.watchdogTick()
+
+    expect(h.ensureRuntime).toHaveBeenCalledOnce()
+    expect(h.restartRuntime).not.toHaveBeenCalled()
+    expect(h.statuses.map((status) => status.state)).toEqual(['restarting', 'running'])
+  })
+
   it('does not recover or restart after shutdown begins', async () => {
     const h = harness({ stopped: true })
     h.supervisor.setManagedRuntimeExpected(true)
diff --git a/src/main/kun-runtime-supervisor.ts b/src/main/kun-runtime-supervisor.ts
index 20346cbd9..5a8d1f28d 100644
--- a/src/main/kun-runtime-supervisor.ts
+++ b/src/main/kun-runtime-supervisor.ts
@@ -247,12 +247,16 @@ export class KunRuntimeSupervisor<Settings> {
       const settings = await this.deps.loadSettings()
       if (!this.managedRuntimeExpected || !this.deps.canAutoRestart(settings)) return
 
-      const childRunning = this.deps.isChildRunning()
+      let childRunning = this.deps.isChildRunning()
       if (childRunning && await this.deps.checkHealth(settings, 5_000)) {
         this.noteHealthy('watchdog')
         return
       }
 
+      // checkHealth refreshes discovery; a dead shared-runtime PID may have been
+      // cleared from the adapter cache. Re-read before counting unresponsive
+      // failures so recovery can take the missing/ensure path (#1116).
+      childRunning = this.deps.isChildRunning()
       if (!childRunning) {
         await this.recoverFromWatchdog('missing')
         return
diff --git a/src/main/legacy-provider-settings-migration.ts b/src/main/legacy-provider-settings-migration.ts
index 05b147769..34822acb1 100644
--- a/src/main/legacy-provider-settings-migration.ts
+++ b/src/main/legacy-provider-settings-migration.ts
@@ -163,7 +163,8 @@ export class LegacyProviderSettingsMigrationCoordinator {
 
   /**
    * Produces a short-lived Main-only settings view for legacy request paths.
-   * Registry credentials never enter ordinary settings or renderer IPC.
+   * Registry credentials never enter ordinary settings or bulk renderer IPC;
+   * the trusted workbench may request one provider explicitly for UI reveal.
    */
   async withRegistryCredentials(settings: AppSettingsV1): Promise<AppSettingsV1> {
     const dataDir = resolveSettingsDataDir(settings)
diff --git a/src/main/models-dev-catalog.test.ts b/src/main/models-dev-catalog.test.ts
index 72051f0a9..771ebd216 100644
--- a/src/main/models-dev-catalog.test.ts
+++ b/src/main/models-dev-catalog.test.ts
@@ -199,8 +199,12 @@ describe('resolveModelsDevProvider', () => {
     ['xiaomi-token-plan', 'https://token-plan-cn.xiaomimimo.com/v1/', 'xiaomi-token-plan-cn', 'catalog'],
     ['xiaomi-token-plan', 'https://token-plan-sgp.xiaomimimo.com/v1', 'xiaomi-token-plan-sgp', 'catalog'],
     ['xiaomi-token-plan', 'https://token-plan-ams.xiaomimimo.com/v1', 'xiaomi-token-plan-ams', 'catalog'],
+    ['minimax-token-plan', 'https://api.minimaxi.com/v1', 'minimax-cn-coding-plan', 'catalog'],
+    ['minimax-token-plan', 'https://api.minimax.io/v1', 'minimax-coding-plan', 'catalog'],
     ['minimax-token-plan', 'https://api.minimax.io/anthropic', 'minimax-coding-plan', 'catalog'],
     ['minimax-token-plan', 'https://api.minimaxi.com/anthropic', 'minimax-cn-coding-plan', 'catalog'],
+    ['minimax', 'https://api.minimaxi.com/v1', 'minimax-cn', 'catalog'],
+    ['minimax', 'https://api.minimax.io/v1', 'minimax', 'catalog'],
     ['minimax', 'https://api.minimaxi.com/anthropic', 'minimax-cn', 'catalog'],
     ['minimax', 'https://api.minimax.io/anthropic', 'minimax', 'catalog'],
     ['aliyun', 'https://dashscope.aliyuncs.com/compatible-mode/v1', 'alibaba-cn', 'catalog'],
diff --git a/src/main/models-dev-catalog.ts b/src/main/models-dev-catalog.ts
index f7038a8c6..f480215eb 100644
--- a/src/main/models-dev-catalog.ts
+++ b/src/main/models-dev-catalog.ts
@@ -106,6 +106,10 @@ const XIAOMI_TOKEN_PLAN_URLS = urlMatchMap({
 })
 
 const MINIMAX_URLS = urlMatchMap({
+  'https://api.minimaxi.com/v1': 'minimax-cn',
+  'https://api.minimaxi.com/v1/': 'minimax-cn',
+  'https://api.minimax.io/v1': 'minimax',
+  'https://api.minimax.io/v1/': 'minimax',
   'https://api.minimaxi.com/anthropic': 'minimax-cn',
   'https://api.minimaxi.com/anthropic/v1': 'minimax-cn',
   'https://api.minimax.io/anthropic': 'minimax',
@@ -113,6 +117,10 @@ const MINIMAX_URLS = urlMatchMap({
 })
 
 const MINIMAX_TOKEN_PLAN_URLS = urlMatchMap({
+  'https://api.minimaxi.com/v1': 'minimax-cn-coding-plan',
+  'https://api.minimaxi.com/v1/': 'minimax-cn-coding-plan',
+  'https://api.minimax.io/v1': 'minimax-coding-plan',
+  'https://api.minimax.io/v1/': 'minimax-coding-plan',
   'https://api.minimaxi.com/anthropic': 'minimax-cn-coding-plan',
   'https://api.minimaxi.com/anthropic/v1': 'minimax-cn-coding-plan',
   'https://api.minimax.io/anthropic': 'minimax-coding-plan',
@@ -137,8 +145,9 @@ const ENRICHMENT_ONLY_URL_MATCHES = new Map<string, ModelsDevProviderMatch>([
 ])
 
 // URL fallback is intentionally limited to unambiguous public endpoints.
-// MiniMax's regular API and Token Plan share the same URLs, so those entries
-// require a known Kun profile id and are excluded here.
+// MiniMax exposes both OpenAI-compatible and Anthropic-compatible URLs for
+// the regular API and Token Plan, so those entries require a known Kun profile
+// id and are excluded here.
 const UNAMBIGUOUS_URL_MATCHES = urlMatchMap({
   'https://api.deepseek.com': 'deepseek',
   'https://api.longcat.chat/openai': 'longcat',
diff --git a/src/main/packaging-config.test.ts b/src/main/packaging-config.test.ts
index 5144169b8..e3ca3579c 100644
--- a/src/main/packaging-config.test.ts
+++ b/src/main/packaging-config.test.ts
@@ -566,6 +566,17 @@ describe('electron-builder Kun packaging', () => {
       'DeleteRegKey HKEY_CURRENT_USER "${INSTALL_REGISTRY_KEY}"'
     )
     expect(installerScript).toContain('KunHandleOldUninstallerResult')
+    expect(installerScript).toContain('Var /GLOBAL KunInstallerInPlaceUpdate')
+    expect(installerScript).toContain('Function KunMarkInPlaceAutomaticUpdate')
+    expect(installerScript).toContain('${if} $KunInstallerInPlaceUpdate == 1')
+    expect(installerScript).toContain(
+      'skipping pre-install removal of $KunInstallerPrimarySourceDir'
+    )
+    expect(installerScript).toContain(
+      'suppressed the selected-scope uninstaller until the new payload is installed'
+    )
+    expect(installerScript).toContain('!insertmacro kunRunMigrationHelper CleanupInPlaceLeftovers')
+    expect(installerScript).toContain('KUN_INSTALLER_IN_PLACE_UPDATE')
     expect(installerScript).toContain('Function KunSecureSelectedUninstallRegistration')
     expect(installerScript).toContain('Function KunSecureCurrentUserUninstallRegistration')
     expect(installerScript).toContain('!insertmacro kunRunMigrationHelper ResolveUninstaller')
@@ -590,6 +601,10 @@ describe('electron-builder Kun packaging', () => {
     expect(installerScript).not.toContain('Stop-Process -Id')
 
     expect(migrationScript).toContain("'ResolveUpdateScope', 'ResolveUninstaller', 'StopProcesses'")
+    expect(migrationScript).toContain("'CleanupInPlaceLeftovers', 'UpdatePath'")
+    expect(migrationScript).toContain('function Invoke-CleanupInPlaceLeftovers')
+    expect(migrationScript).toContain('function Test-RetainedInPlaceKnownEntry')
+    expect(migrationScript).toContain("Get-EnvironmentValue 'KUN_INSTALLER_IN_PLACE_UPDATE'")
     expect(migrationScript).not.toContain("'old-uninstaller.exe'")
     expect(migrationScript).toContain("Join-Path $PSScriptRoot 'kun-windows-installer-result.txt'")
     expect(migrationScript).toContain('function Test-AppOwnedProcessPath')
diff --git a/src/main/provider-subscription-quota.ts b/src/main/provider-subscription-quota.ts
index d39f2a231..1d8057afa 100644
--- a/src/main/provider-subscription-quota.ts
+++ b/src/main/provider-subscription-quota.ts
@@ -15,6 +15,10 @@ import {
   type OpenCodeGoLocalQuotaResult
 } from '../../kun/src/services/opencode-go-local-quota.js'
 import {
+  clearOpenCodeGoCookieCache,
+  getOpenCodeGoCookieFailureReason,
+  OPENCODE_GO_KEYCHAIN_MESSAGE,
+  OPENCODE_GO_SIGN_IN_MESSAGE,
   resolveOpenCodeGoCookie as resolveOpenCodeGoCookieImpl
 } from '../../kun/src/services/provider-subscription-quota.js'
 import {
@@ -223,21 +227,37 @@ export async function runSubscriptionQuotaProbe(
     return probeGoogleCodeAssistQuota(credential, context, 'antigravity')
   }
   if (kind === 'opencode-go-local') {
-    const cookieHeader = await runtime.resolveOpenCodeGoCookie()
+    const tryWeb = async (cookieHeader: string) => {
+      const web = await runtime.fetchOpenCodeGoWebQuota(cookieHeader, context)
+      if (web.metrics.length > 0) {
+        return {
+          metrics: web.metrics,
+          ...(web.summary ? { summary: web.summary } : {}),
+          source: 'OpenCode Go subscription usage'
+        } as const
+      }
+      return undefined
+    }
+
+    let cookieHeader = await runtime.resolveOpenCodeGoCookie()
     if (cookieHeader) {
       try {
-        const web = await runtime.fetchOpenCodeGoWebQuota(cookieHeader, context)
-        if (web.metrics.length > 0) {
-          return {
-            metrics: web.metrics,
-            ...(web.summary ? { summary: web.summary } : {}),
-            source: 'OpenCode Go subscription usage'
-          }
-        }
+        const web = await tryWeb(cookieHeader)
+        if (web) return web
       } catch (error) {
-        // Web quota is best-effort: any auth/network/parse failure falls back
-        // to the local usage database estimate.
         if (!(error instanceof OpenCodeGoWebQuotaError)) throw error
+        if (error.code === 'invalid_credentials') {
+          clearOpenCodeGoCookieCache()
+          cookieHeader = await runtime.resolveOpenCodeGoCookie()
+          if (cookieHeader) {
+            try {
+              const web = await tryWeb(cookieHeader)
+              if (web) return web
+            } catch (retryError) {
+              if (!(retryError instanceof OpenCodeGoWebQuotaError)) throw retryError
+            }
+          }
+        }
       }
     }
     const quota = await runtime.resolveOpenCodeGoQuota()
@@ -248,7 +268,9 @@ export async function runSubscriptionQuotaProbe(
       }
     }
     throw new ProviderQuotaMissingCredentialError(
-      'Sign in to opencode.ai in your browser, or use OpenCode Go locally first so its usage history exists.'
+      getOpenCodeGoCookieFailureReason() === 'decrypt_failed'
+        ? OPENCODE_GO_KEYCHAIN_MESSAGE
+        : OPENCODE_GO_SIGN_IN_MESSAGE
     )
   }
   const accessToken = await runtime.resolveGeminiCliToken(context)
diff --git a/src/main/runtime/kun-adapter.test.ts b/src/main/runtime/kun-adapter.test.ts
index 4c71b07c4..b6a39e33c 100644
--- a/src/main/runtime/kun-adapter.test.ts
+++ b/src/main/runtime/kun-adapter.test.ts
@@ -23,7 +23,8 @@ import {
   resolveRuntimeRequestTimeoutMs,
   runtimeAuthHeaders,
   runtimeRequestViaHost,
-  runtimeRequestViaLease
+  runtimeRequestViaLease,
+  setResolvedKunRuntimeConnectionForTests
 } from './kun-adapter'
 import { buildRuntimeCapabilityManifest } from '../../../kun/src/contracts/capabilities.js'
 import { modelCapabilitiesForModel } from '../../../kun/src/loop/model-context-profile.js'
@@ -481,3 +482,48 @@ describe('kunRuntimeAdapter.resolveConnection', () => {
     }
   })
 })
+
+describe('kunRuntimeAdapter.isChildRunning dead-PID recovery', () => {
+  afterEach(async () => {
+    setResolvedKunRuntimeConnectionForTests(null)
+    await kunRuntimeAdapter.stopAndWait()
+  })
+
+  it('clears a cached discovery record whose PID is no longer alive (#1116)', () => {
+    setResolvedKunRuntimeConnectionForTests({
+      version: 1,
+      instanceId: 'dead-shared-runtime',
+      pid: 2_147_483_647,
+      startedAt: '2026-08-07T00:00:00.000Z',
+      host: '127.0.0.1',
+      port: 44793,
+      baseUrl: 'http://127.0.0.1:44793',
+      runtimeToken: 'stale-token',
+      insecure: false,
+      serviceVersion: '0.0.0-test',
+      launchMode: 'shared'
+    })
+
+    expect(kunRuntimeAdapter.isChildRunning()).toBe(false)
+    expect(kunRuntimeAdapter.getBaseUrl(settingsForPort(18788))).toBe('http://127.0.0.1:18788')
+  })
+
+  it('keeps reporting running while the cached discovery PID is alive', () => {
+    setResolvedKunRuntimeConnectionForTests({
+      version: 1,
+      instanceId: 'live-shared-runtime',
+      pid: process.pid,
+      startedAt: '2026-08-07T00:00:00.000Z',
+      host: '127.0.0.1',
+      port: 44793,
+      baseUrl: 'http://127.0.0.1:44793',
+      runtimeToken: 'live-token',
+      insecure: false,
+      serviceVersion: '0.0.0-test',
+      launchMode: 'shared'
+    })
+
+    expect(kunRuntimeAdapter.isChildRunning()).toBe(true)
+    expect(kunRuntimeAdapter.getBaseUrl(settingsForPort(18788))).toBe('http://127.0.0.1:44793')
+  })
+})
diff --git a/src/main/runtime/kun-adapter.ts b/src/main/runtime/kun-adapter.ts
index 3b1db766b..4b7fef8f4 100644
--- a/src/main/runtime/kun-adapter.ts
+++ b/src/main/runtime/kun-adapter.ts
@@ -68,7 +68,14 @@ export const kunRuntimeAdapter = {
   },
 
   isChildRunning(): boolean {
-    return Boolean(resolvedConnection) || isKunChildRunning()
+    if (resolvedConnection) {
+      // Shared runtimes are detached; a cached discovery record can outlive the
+      // process. Treat a dead PID as "not running" so watchdog recovery takes the
+      // missing/ensure fast path instead of waiting out unresponsive retries (#1116).
+      if (processIsAlive(resolvedConnection.pid)) return true
+      resolvedConnection = null
+    }
+    return isKunChildRunning()
   },
 
   getBaseUrl(settings: AppSettingsV1): string {
@@ -167,6 +174,23 @@ function expandDataDir(value: string): string {
   return value.replace(/^~(?=$|[\\/])/, homedir())
 }
 
+function processIsAlive(pid: number): boolean {
+  try {
+    process.kill(pid, 0)
+    return true
+  } catch (error) {
+    // EPERM means the process exists but we cannot signal it.
+    return (error as NodeJS.ErrnoException)?.code === 'EPERM'
+  }
+}
+
+/** Test-only: inject a cached discovery record for dead-PID recovery coverage. */
+export function setResolvedKunRuntimeConnectionForTests(
+  connection: RuntimeDiscoveryRecord | null
+): void {
+  resolvedConnection = connection
+}
+
 export type RuntimeRequestInit = {
   method?: string
   body?: string
diff --git a/src/main/services/office-document-service.test.ts b/src/main/services/office-document-service.test.ts
index 1d19ef919..5c800e54e 100644
--- a/src/main/services/office-document-service.test.ts
+++ b/src/main/services/office-document-service.test.ts
@@ -6,7 +6,10 @@ import { join } from 'node:path'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { ZipFile } from 'yazl'
 import { MAX_RUNTIME_DOCUMENT_SOURCE_BYTES } from '../../shared/office-document'
-import { readLocalOfficeDocument } from './office-document-service'
+import {
+  isBenignOoxmlSchemaFailure,
+  readLocalOfficeDocument
+} from './office-document-service'
 
 const roots: string[] = []
 
@@ -141,4 +144,113 @@ describe('Office document intake', () => {
     expect(result).toMatchObject({ ok: false, code: 'file_too_large' })
     expect(runOfficeCli).not.toHaveBeenCalled()
   })
+
+  it('soft-fails WPS undeclared schema attributes and continues text extraction (#1122)', async () => {
+    const filePath = await ooxmlFixture('xlsx')
+    const wpsSchemaFailure = JSON.stringify({
+      success: false,
+      data: {
+        count: 1,
+        errors: [{
+          type: 'Schema',
+          description:
+            "The'http://www.wps.cn/officeDocument/2017/etCustomData:filterBottomFollowUsedRange' attribute is not declared.",
+          path: '/x:worksheet[1]/x:autoFilter[1]',
+          part: '/xl/worksheets/sheet1.xml'
+        }]
+      }
+    })
+    const runOfficeCli = vi.fn(async (args: string[]) => {
+      if (args[0] === 'validate') {
+        return { stdout: wpsSchemaFailure, stderr: '', exitCode: 1 }
+      }
+      if (args[2] === 'stats') return { stdout: '{"sheetCount":1}', stderr: '', exitCode: 0 }
+      if (args[2] === 'html') return { stdout: '<html><body>WPS</body></html>', stderr: '', exitCode: 0 }
+      return { stdout: 'Sheet1\\nA1 = ok', stderr: '', exitCode: 0 }
+    })
+
+    const result = await readLocalOfficeDocument({ path: filePath }, {
+      runOfficeCli,
+      renderHtml: vi.fn(async () => ({
+        dataBase64: Buffer.from('p').toString('base64'),
+        mimeType: 'image/webp' as const,
+        byteSize: 1
+      }))
+    })
+
+    expect(result).toMatchObject({
+      ok: true,
+      format: 'xlsx',
+      documentText: expect.stringContaining('A1 = ok'),
+      validationWarning: expect.stringContaining('filterBottomFollowUsedRange')
+    })
+    expect(runOfficeCli.mock.calls.map(([args]) => args[0])).toEqual([
+      'validate',
+      'view',
+      'view',
+      'view'
+    ])
+  })
+
+  it('still rejects non-schema OfficeCLI validate failures', async () => {
+    const filePath = await ooxmlFixture('xlsx')
+    const runOfficeCli = vi.fn(async (args: string[]) => {
+      if (args[0] === 'validate') {
+        return {
+          stdout: JSON.stringify({
+            success: false,
+            data: {
+              count: 1,
+              errors: [{ type: 'Package', description: 'Missing required part /xl/workbook.xml' }]
+            }
+          }),
+          stderr: '',
+          exitCode: 1
+        }
+      }
+      return { stdout: 'should-not-run', stderr: '', exitCode: 0 }
+    })
+
+    const result = await readLocalOfficeDocument({ path: filePath }, {
+      runOfficeCli,
+      renderHtml: vi.fn()
+    })
+
+    expect(result).toMatchObject({
+      ok: false,
+      code: 'office_document_failed',
+      message: expect.stringContaining('Office document validation failed')
+    })
+    expect(runOfficeCli).toHaveBeenCalledTimes(1)
+  })
+})
+
+describe('isBenignOoxmlSchemaFailure', () => {
+  it('accepts Schema undeclared-attribute errors from WPS packages', () => {
+    expect(isBenignOoxmlSchemaFailure({
+      exitCode: 1,
+      stdout: JSON.stringify({
+        success: false,
+        data: {
+          errors: [{
+            type: 'Schema',
+            description:
+              "The'http://www.wps.cn/officeDocument/2017/etCustomData:filterBottomFollowUsedRange' attribute is not declared."
+          }]
+        }
+      }),
+      stderr: ''
+    })).toBe(true)
+  })
+
+  it('rejects package-structure validate failures', () => {
+    expect(isBenignOoxmlSchemaFailure({
+      exitCode: 1,
+      stdout: JSON.stringify({
+        success: false,
+        data: { errors: [{ type: 'Package', description: 'Corrupt ZIP central directory' }] }
+      }),
+      stderr: ''
+    })).toBe(false)
+  })
 })
diff --git a/src/main/services/office-document-service.ts b/src/main/services/office-document-service.ts
index aa7c2339e..e47f13c2d 100644
--- a/src/main/services/office-document-service.ts
+++ b/src/main/services/office-document-service.ts
@@ -84,7 +84,16 @@ export async function readLocalOfficeDocument(
       ))
 
     const validation = await run(['validate', filePath, '--json'])
-    assertOfficeCliSuccess(validation, 'Office document validation failed')
+    let validationWarning: string | undefined
+    if (validation.exitCode !== 0) {
+      if (!isBenignOoxmlSchemaFailure(validation)) {
+        assertOfficeCliSuccess(validation, 'Office document validation failed')
+      }
+      // Vendor extensions (notably WPS etCustomData attrs) fail strict OpenXML
+      // schema checks but still extract cleanly. Keep intake open and surface a
+      // warning instead of forcing a local tool-reference fallback (#1122).
+      validationWarning = summarizeOfficeCliFailure(validation, 'Office document validation warning')
+    }
 
     const semanticArgs = semanticViewArgs(filePath, format)
     const semantic = await run(semanticArgs)
@@ -130,7 +139,8 @@ export async function readLocalOfficeDocument(
       ...(pageCount ? { pageCount } : {}),
       truncated,
       ...(visualPreview ? { visualPreview } : {}),
-      ...(previewUnavailableReason ? { previewUnavailableReason } : {})
+      ...(previewUnavailableReason ? { previewUnavailableReason } : {}),
+      ...(validationWarning ? { validationWarning } : {})
     }
   } catch (error) {
     return { ok: false, code: 'office_document_failed', message: boundedErrorMessage(error) }
@@ -145,8 +155,57 @@ function semanticViewArgs(filePath: string, format: OfficeDocumentFormat): strin
 
 function assertOfficeCliSuccess(result: OfficeCliResult, fallback: string): void {
   if (result.exitCode === 0) return
+  throw new Error(summarizeOfficeCliFailure(result, fallback))
+}
+
+function summarizeOfficeCliFailure(result: OfficeCliResult, fallback: string): string {
   const detail = result.stderr.trim() || result.stdout.trim()
-  throw new Error(detail ? `${fallback}: ${detail}` : fallback)
+  return detail ? `${fallback}: ${detail}` : fallback
+}
+
+/**
+ * Intake-only: strict OpenXML schema rejects common vendor extensions (WPS
+ * etCustomData attributes, undeclared Ignorable attrs). Those documents still
+ * yield usable text via `view`. Reject anything that is not a Schema / undeclared
+ * markup failure so corrupted packages stay blocked.
+ */
+export function isBenignOoxmlSchemaFailure(result: OfficeCliResult): boolean {
+  if (result.exitCode === 0) return false
+  const payload = result.stdout.trim() || result.stderr.trim()
+  if (!payload) return false
+  const errors = extractOfficeValidateErrors(payload)
+  if (!errors || errors.length === 0) {
+    // Fallback when officecli prints a flat message without --json structure.
+    return /not declared|undeclared|schema/i.test(payload) &&
+      /wps\.cn|etCustomData|officeDocument\/2017/i.test(payload)
+  }
+  return errors.every((error) => isBenignOoxmlSchemaError(error))
+}
+
+function extractOfficeValidateErrors(payload: string): Array<Record<string, unknown>> | null {
+  try {
+    const parsed = JSON.parse(payload) as unknown
+    if (!parsed || typeof parsed !== 'object') return null
+    const root = parsed as Record<string, unknown>
+    const data = root.data && typeof root.data === 'object'
+      ? root.data as Record<string, unknown>
+      : root
+    const errors = data.errors
+    if (!Array.isArray(errors)) return null
+    return errors.filter((entry): entry is Record<string, unknown> =>
+      Boolean(entry) && typeof entry === 'object'
+    )
+  } catch {
+    return null
+  }
+}
+
+function isBenignOoxmlSchemaError(error: Record<string, unknown>): boolean {
+  const type = typeof error.type === 'string' ? error.type : ''
+  const description = typeof error.description === 'string' ? error.description : ''
+  const combined = `${type} ${description}`
+  if (!/schema/i.test(type) && !/schema/i.test(description)) return false
+  return /not declared|undeclared|wps\.cn|etCustomData|officeDocument\/2017/i.test(combined)
 }
 
 async function runOfficeCli(
diff --git a/src/main/services/speech-to-text-service.test.ts b/src/main/services/speech-to-text-service.test.ts
index 114833d46..69018738f 100644
--- a/src/main/services/speech-to-text-service.test.ts
+++ b/src/main/services/speech-to-text-service.test.ts
@@ -1,7 +1,10 @@
 import { describe, expect, it } from 'vitest'
 import type { AppSettingsV1 } from '../../shared/app-settings'
 import { isSpeechToTextConfigured } from '../../shared/speech-to-text'
-import { requestSpeechTranscription } from './speech-to-text-service'
+import {
+  requestSpeechTranscription,
+  resolveSpeechToTextForTranscription
+} from './speech-to-text-service'
 
 const AUDIO_BASE64 = Buffer.from('fake-wav-bytes').toString('base64')
 
@@ -52,6 +55,65 @@ describe('speech-to-text service', () => {
     expect(isSpeechToTextConfigured({ enabled: true, protocol: 'local-whisper', baseUrl: '', apiKey: '', model: 'whisper-small-q5_1' })).toBe(true)
     expect(isSpeechToTextConfigured({ enabled: true, protocol: 'xai-stt', baseUrl: 'x', apiKey: 'y', model: '' })).toBe(true)
     expect(isSpeechToTextConfigured({ enabled: true, protocol: 'gemini-cli-audio', baseUrl: '', apiKey: '', model: 'gemini-2.5-flash' })).toBe(true)
+    expect(isSpeechToTextConfigured(
+      { enabled: true, protocol: 'xai-stt', baseUrl: 'https://api.x.ai/v1', apiKey: '', model: 'grok-transcribe' },
+      { credentialReady: true }
+    )).toBe(true)
+    expect(isSpeechToTextConfigured(
+      { enabled: true, protocol: 'xai-stt', baseUrl: 'https://api.x.ai/v1', apiKey: '', model: 'grok-transcribe' },
+      { credentialReady: false }
+    )).toBe(false)
+  })
+
+  it('falls back to Registry-projected apiKey when the renderer payload is redacted', async () => {
+    const { fetchImpl, requests } = fakeFetch({ text: 'hello from Grok' })
+    const result = await requestSpeechTranscription(
+      settingsWithSpeech({
+        protocol: 'xai-stt',
+        baseUrl: 'https://api.x.ai/v1',
+        apiKey: 'registry-oauth-json',
+        model: 'grok-transcribe'
+      }),
+      {
+        audioBase64: AUDIO_BASE64,
+        mimeType: 'audio/wav',
+        speechToText: {
+          enabled: true,
+          providerId: 'grok-subscription',
+          protocol: 'xai-stt',
+          baseUrl: 'https://api.x.ai/v1',
+          apiKey: '',
+          model: 'grok-transcribe',
+          localWhisperDownloadSource: 'huggingface',
+          language: '',
+          timeoutMs: 30000
+        }
+      },
+      { fetchImpl }
+    )
+
+    expect(result).toEqual({ ok: true, text: 'hello from Grok' })
+    const headers = requests[0].init.headers as Record<string, string>
+    expect(headers.Authorization).toBe('Bearer registry-oauth-json')
+    expect(resolveSpeechToTextForTranscription(
+      settingsWithSpeech({
+        protocol: 'xai-stt',
+        baseUrl: 'https://api.x.ai/v1',
+        apiKey: 'registry-oauth-json',
+        model: 'grok-transcribe'
+      }),
+      {
+        enabled: true,
+        providerId: 'grok-subscription',
+        protocol: 'xai-stt',
+        baseUrl: 'https://api.x.ai/v1',
+        apiKey: '',
+        model: 'grok-transcribe',
+        localWhisperDownloadSource: 'huggingface',
+        language: '',
+        timeoutMs: 30000
+      }
+    ).apiKey).toBe('registry-oauth-json')
   })
 
   it('transcribes via MiMo ASR chat completions with a base64 data URI', async () => {
diff --git a/src/main/services/speech-to-text-service.ts b/src/main/services/speech-to-text-service.ts
index 328b0e371..11334ab03 100644
--- a/src/main/services/speech-to-text-service.ts
+++ b/src/main/services/speech-to-text-service.ts
@@ -35,6 +35,24 @@ const XAI_FORMAT_LANGUAGE_CODES = new Set([
   'mk', 'ms', 'fa', 'pl', 'pt', 'ro', 'ru', 'es', 'sv', 'th', 'tr', 'vi'
 ])
 
+/**
+ * Merge renderer-provided speech settings with Main's credential-projected
+ * settings. Renderer `settings:get` redacts provider apiKeys, so an empty
+ * request apiKey must fall back to the Registry-injected value.
+ */
+export function resolveSpeechToTextForTranscription(
+  settings: AppSettingsV1,
+  requestSpeechToText?: KunSpeechToTextSettingsV1
+): KunSpeechToTextSettingsV1 {
+  const resolved = resolveKunSpeechToTextSettings(settings)
+  if (!requestSpeechToText) return resolved
+  return {
+    ...resolved,
+    ...requestSpeechToText,
+    apiKey: requestSpeechToText.apiKey.trim() || resolved.apiKey
+  }
+}
+
 export async function requestSpeechTranscription(
   settings: AppSettingsV1,
   request: SpeechTranscriptionRequest,
@@ -50,7 +68,7 @@ export async function requestSpeechTranscription(
     ) => Promise<string>
   } = {}
 ): Promise<SpeechTranscriptionResult> {
-  const speechToText = request.speechToText ?? resolveKunSpeechToTextSettings(settings)
+  const speechToText = resolveSpeechToTextForTranscription(settings, request.speechToText)
   if (!isSpeechToTextConfigured(speechToText)) {
     return { ok: false, message: describeSpeechConfigurationIssue(speechToText) }
   }
diff --git a/src/main/settings-credential-redaction.test.ts b/src/main/settings-credential-redaction.test.ts
new file mode 100644
index 000000000..5f21568e8
--- /dev/null
+++ b/src/main/settings-credential-redaction.test.ts
@@ -0,0 +1,112 @@
+import { describe, expect, it } from 'vitest'
+import {
+  defaultKunRuntimeSettings,
+  defaultModelProviderSettings,
+  type AppSettingsV1
+} from '../shared/app-settings'
+import { preserveRedactedProviderCredentials } from './settings-credential-redaction'
+
+function settingsWithSecrets(): AppSettingsV1 {
+  const provider = defaultModelProviderSettings()
+  const deepseek = provider.providers.find((item) => item.id === 'deepseek') ?? provider.providers[0]!
+  return {
+    version: 1,
+    initialSetupCompleted: true,
+    locale: 'en',
+    theme: 'system',
+    provider: {
+      ...provider,
+      apiKey: 'top-level-secret',
+      providers: [
+        { ...deepseek, apiKey: 'deepseek-secret' },
+        {
+          id: 'opencode-go',
+          name: 'OpenCode Go',
+          apiKey: 'opencode-secret',
+          baseUrl: 'https://opencode.ai/zen/go/v1',
+          endpointFormat: 'chat_completions',
+          models: ['grok-4.5'],
+          modelProfiles: {}
+        }
+      ]
+    },
+    agents: {
+      kun: {
+        ...defaultKunRuntimeSettings(),
+        apiKey: 'kun-runtime-secret',
+        providerId: 'opencode-go',
+        model: 'grok-4.5'
+      }
+    }
+  } as AppSettingsV1
+}
+
+describe('preserveRedactedProviderCredentials', () => {
+  it('restores hydrated provider secrets when the renderer sends redacted empty apiKeys', () => {
+    const prev = settingsWithSecrets()
+    const preserved = preserveRedactedProviderCredentials(prev, {
+      provider: {
+        providers: prev.provider.providers.map((provider) => ({
+          ...provider,
+          apiKey: ''
+        })),
+        apiKey: ''
+      },
+      agents: {
+        kun: {
+          providerId: 'opencode-go',
+          apiKey: '',
+          baseUrl: ''
+        }
+      }
+    })
+
+    expect(preserved.provider?.apiKey).toBe('top-level-secret')
+    expect(preserved.provider?.providers?.find((item) => item.id === 'deepseek')?.apiKey)
+      .toBe('deepseek-secret')
+    expect(preserved.provider?.providers?.find((item) => item.id === 'opencode-go')?.apiKey)
+      .toBe('opencode-secret')
+    expect(preserved.agents?.kun?.apiKey).toBe('kun-runtime-secret')
+  })
+
+  it('keeps newly provided non-empty secrets from the patch', () => {
+    const prev = settingsWithSecrets()
+    const preserved = preserveRedactedProviderCredentials(prev, {
+      provider: {
+        providers: prev.provider.providers.map((provider) =>
+          provider.id === 'opencode-go'
+            ? { ...provider, apiKey: 'replacement-secret' }
+            : { ...provider, apiKey: '' }
+        )
+      }
+    })
+
+    expect(preserved.provider?.providers?.find((item) => item.id === 'opencode-go')?.apiKey)
+      .toBe('replacement-secret')
+    expect(preserved.provider?.providers?.find((item) => item.id === 'deepseek')?.apiKey)
+      .toBe('deepseek-secret')
+  })
+
+  it('does not invent secrets for brand-new providers', () => {
+    const prev = settingsWithSecrets()
+    const preserved = preserveRedactedProviderCredentials(prev, {
+      provider: {
+        providers: [
+          ...prev.provider.providers.map((provider) => ({ ...provider, apiKey: '' })),
+          {
+            id: 'custom-new',
+            name: 'Custom',
+            apiKey: '',
+            baseUrl: 'https://example.test/v1',
+            endpointFormat: 'chat_completions',
+            models: [],
+            modelProfiles: {}
+          }
+        ]
+      }
+    })
+
+    expect(preserved.provider?.providers?.find((item) => item.id === 'custom-new')?.apiKey)
+      .toBe('')
+  })
+})
diff --git a/src/main/settings-credential-redaction.ts b/src/main/settings-credential-redaction.ts
new file mode 100644
index 000000000..6854b45c6
--- /dev/null
+++ b/src/main/settings-credential-redaction.ts
@@ -0,0 +1,89 @@
+import {
+  getKunRuntimeSettings,
+  type AppSettingsPatch,
+  type AppSettingsV1
+} from '../shared/app-settings'
+
+/**
+ * Renderer settings projections intentionally redact provider secrets to `''`
+ * (`settings:get` / shared-connection projection). Those empty strings must not
+ * be treated as "user cleared the API key" during `settings:set`, or Main's
+ * legacy credential migration will `forgetSources` and wipe OAuth/API bindings.
+ *
+ * Intentional disconnects go through the protected Registry credential DELETE
+ * path and do not rely on redacted empty apiKey patches.
+ *
+ * Read `prev.provider` directly (not via normalize helpers) so per-provider
+ * hydrated secrets are not collapsed onto the legacy top-level apiKey field.
+ */
+export function preserveRedactedProviderCredentials(
+  prev: AppSettingsV1,
+  partial: AppSettingsPatch
+): AppSettingsPatch {
+  let next = partial
+  const previousProviders = Array.isArray(prev.provider?.providers) ? prev.provider.providers : []
+  const previousTopLevelApiKey =
+    typeof prev.provider?.apiKey === 'string' ? prev.provider.apiKey : ''
+  const previousById = new Map(
+    previousProviders.map((provider) => [provider.id, provider])
+  )
+
+  if (Array.isArray(partial.provider?.providers)) {
+    const providers = partial.provider.providers.map((provider) => {
+      if (!provider || typeof provider.id !== 'string') return provider
+      const previous = previousById.get(provider.id)
+      if (!previous?.apiKey.trim()) return provider
+      if (typeof provider.apiKey !== 'string') return provider
+      if (provider.apiKey.trim()) return provider
+      return { ...provider, apiKey: previous.apiKey }
+    })
+    const topLevelApiKey =
+      typeof partial.provider.apiKey === 'string' &&
+      !partial.provider.apiKey.trim() &&
+      previousTopLevelApiKey.trim()
+        ? previousTopLevelApiKey
+        : partial.provider.apiKey
+    next = {
+      ...next,
+      provider: {
+        ...partial.provider,
+        ...(topLevelApiKey !== undefined ? { apiKey: topLevelApiKey } : {}),
+        providers
+      }
+    }
+  } else if (
+    typeof partial.provider?.apiKey === 'string' &&
+    !partial.provider.apiKey.trim() &&
+    previousTopLevelApiKey.trim()
+  ) {
+    next = {
+      ...next,
+      provider: {
+        ...partial.provider,
+        apiKey: previousTopLevelApiKey
+      }
+    }
+  }
+
+  const incomingKun = next.agents?.kun
+  const previousKunApiKey = getKunRuntimeSettings(prev).apiKey
+  if (
+    incomingKun &&
+    typeof incomingKun.apiKey === 'string' &&
+    !incomingKun.apiKey.trim() &&
+    previousKunApiKey.trim()
+  ) {
+    next = {
+      ...next,
+      agents: {
+        ...next.agents,
+        kun: {
+          ...incomingKun,
+          apiKey: previousKunApiKey
+        }
+      }
+    }
+  }
+
+  return next
+}
diff --git a/src/main/windows-installer-migration.test.ts b/src/main/windows-installer-migration.test.ts
index 3a778ae6a..ef10ce98d 100644
--- a/src/main/windows-installer-migration.test.ts
+++ b/src/main/windows-installer-migration.test.ts
@@ -27,7 +27,7 @@ function makeTempRoot(): string {
 }
 
 function runHelper(input: {
-  action: 'ResolvePath' | 'ResolveSource' | 'ResolveUpdateScope' | 'ResolveUninstaller' | 'Recover' | 'Prepare' | 'FallbackCleanup' | 'Restore' | 'ValidatePayload'
+  action: 'ResolvePath' | 'ResolveSource' | 'ResolveUpdateScope' | 'ResolveUninstaller' | 'Recover' | 'Prepare' | 'FallbackCleanup' | 'Restore' | 'ValidatePayload' | 'CleanupInPlaceLeftovers'
   source?: string
   secondary?: string
   currentUserSource?: string
@@ -45,6 +45,7 @@ function runHelper(input: {
   userProfile?: string
   primarySourceStale?: boolean
   secondarySourceStale?: boolean
+  inPlaceUpdate?: boolean
   installMode?: 'CurrentUser' | 'all'
   appGuid?: string
   canonicalLeaf?: string
@@ -86,6 +87,7 @@ function runHelper(input: {
         KUN_INSTALLER_UNINSTALL_STRING: input.uninstallCommand ?? '',
         KUN_INSTALLER_PRIMARY_SOURCE_STALE: input.primarySourceStale ? '1' : '0',
         KUN_INSTALLER_SECONDARY_SOURCE_STALE: input.secondarySourceStale ? '1' : '0',
+        KUN_INSTALLER_IN_PLACE_UPDATE: input.inPlaceUpdate ? '1' : '0',
         KUN_INSTALLER_INSTALL_MODE: input.installMode ?? 'CurrentUser',
         KUN_INSTALLER_APP_GUID: input.appGuid ?? 'test-kun-app-guid',
         KUN_INSTALLER_CANONICAL_LEAF: input.canonicalLeaf ?? 'Kun',
@@ -174,6 +176,25 @@ describe('Windows installer migration ACL contract', () => {
     expect(script).toContain('$process.ExitCode -ne $accessViolationExitCode')
     expect(script).toContain('retrying once after 2 seconds')
   })
+
+  it('keeps same-directory automatic updates from pre-deleting the application payload', () => {
+    const installerScript = readFileSync(join(process.cwd(), 'build/installer.nsh'), 'utf8')
+    const migrationScript = readFileSync(helperPath, 'utf8')
+
+    expect(installerScript).toContain('Function KunMarkInPlaceAutomaticUpdate')
+    expect(installerScript).toContain('${if} $KunInstallerInPlaceUpdate == 1')
+    expect(installerScript).toContain('skipping pre-install removal of $KunInstallerPrimarySourceDir')
+    expect(installerScript).toContain(
+      'suppressed the selected-scope uninstaller until the new payload is installed'
+    )
+    expect(installerScript.indexOf('!insertmacro kunRunMigrationHelper ValidatePayload')).toBeLessThan(
+      installerScript.indexOf('!insertmacro kunRunMigrationHelper CleanupInPlaceLeftovers')
+    )
+    expect(migrationScript).toContain('function Invoke-CleanupInPlaceLeftovers')
+    expect(migrationScript).toContain('function Test-RetainedInPlaceKnownEntry')
+    expect(smokePath.length).toBeGreaterThan(0)
+    expect(readFileSync(smokePath, 'utf8')).toContain('in-app all-users automatic update scope')
+  })
 })
 
 windowsOnly('Windows installer migration helper', () => {
@@ -187,6 +208,83 @@ windowsOnly('Windows installer migration helper', () => {
     expect(result.status, processError(result)).toBe(0)
   })
 
+  it('removes only obsolete known identity files after a validated in-place update', () => {
+    const target = join(makeTempRoot(), 'Kun')
+    mkdirSync(target, { recursive: true })
+    writePackagedInstallPayload(target)
+    writeFileSync(join(target, 'DeepSeek GUI.exe'), 'legacy identity')
+    writeFileSync(join(target, 'Uninstall DeepSeek GUI.exe'), 'legacy uninstaller')
+    writeFileSync(join(target, 'Uninstall Kun.exe'), 'current uninstaller')
+    writeFileSync(join(target, 'ffmpeg.dll'), 'runtime')
+    writeFileSync(join(target, 'notes.txt'), 'user file')
+
+    const result = runHelper({
+      action: 'CleanupInPlaceLeftovers',
+      source: target,
+      target,
+      inPlaceUpdate: true
+    })
+
+    expect(result.status, processError(result)).toBe(0)
+    expect(existsSync(join(target, 'Kun.exe'))).toBe(true)
+    expect(existsSync(join(target, 'Uninstall Kun.exe'))).toBe(true)
+    expect(existsSync(join(target, 'ffmpeg.dll'))).toBe(true)
+    expect(existsSync(join(target, 'resources', 'app.asar'))).toBe(true)
+    expect(existsSync(join(target, 'DeepSeek GUI.exe'))).toBe(false)
+    expect(existsSync(join(target, 'Uninstall DeepSeek GUI.exe'))).toBe(false)
+    expect(readFileSync(join(target, 'notes.txt'), 'utf8')).toBe('user file')
+  })
+
+  it('does not clean in-place leftovers unless the in-place update marker is set', () => {
+    const target = join(makeTempRoot(), 'Kun')
+    mkdirSync(target, { recursive: true })
+    writePackagedInstallPayload(target)
+    writeFileSync(join(target, 'DeepSeek GUI.exe'), 'legacy identity')
+
+    const result = runHelper({
+      action: 'CleanupInPlaceLeftovers',
+      source: target,
+      target,
+      inPlaceUpdate: false
+    })
+
+    expect(result.status, processError(result)).toBe(0)
+    expect(existsSync(join(target, 'DeepSeek GUI.exe'))).toBe(true)
+  })
+
+  it('refuses in-place leftover cleanup when the validated payload is incomplete', () => {
+    const target = join(makeTempRoot(), 'Kun')
+    mkdirSync(target, { recursive: true })
+    writePackagedInstallPayload(target)
+    rmSync(join(target, 'Kun.exe'))
+    writeFileSync(join(target, 'DeepSeek GUI.exe'), 'legacy identity')
+
+    const result = runHelper({
+      action: 'CleanupInPlaceLeftovers',
+      source: target,
+      target,
+      inPlaceUpdate: true
+    })
+
+    expect(result.status).not.toBe(0)
+    expect(processError(result)).toContain('payload is missing')
+    expect(existsSync(join(target, 'DeepSeek GUI.exe'))).toBe(true)
+  })
+
+  it('keeps known application files after prepare for same-directory updates', () => {
+    const root = makeTempRoot()
+    const source = join(root, 'Kun')
+    const journal = join(root, 'recovery', 'journal.json')
+    mkdirSync(join(source, 'resources'), { recursive: true })
+    writeFileSync(join(source, 'Kun.exe'), 'app')
+    writeFileSync(join(source, 'notes.txt'), 'keep me')
+
+    const prepared = runHelper({ action: 'Prepare', source, target: source, journal })
+    expect(prepared.status, processError(prepared)).toBe(0)
+    expect(existsSync(join(source, 'Kun.exe'))).toBe(true)
+    expect(existsSync(join(source, 'notes.txt'))).toBe(false)
+  })
+
   it.each([
     ['application executable', (target: string) => join(target, 'Kun.exe')],
     ['resources\\app.asar', (target: string) => join(target, 'resources', 'app.asar')],
diff --git a/src/preload/index.ts b/src/preload/index.ts
index 9c1413796..b8b72e158 100644
--- a/src/preload/index.ts
+++ b/src/preload/index.ts
@@ -129,6 +129,8 @@ const api = {
     respondRendererRequest: (response) => ipcRenderer.invoke('data-migration:renderer-response', response)
   },
   getSettings: () => ipcRenderer.invoke('settings:get'),
+  revealModelProviderCredential: (providerId) =>
+    ipcRenderer.invoke('model-provider:credential:reveal', { providerId }),
   resetUnreadableCredentials: () => ipcRenderer.invoke('credentials:reset-unreadable'),
   cliInstallStatus: () => ipcRenderer.invoke('cli-install:status'),
   cliInstallAction: (action) => ipcRenderer.invoke('cli-install:action', action),
diff --git a/src/renderer/src/agent/agent-tool-provenance.test.ts b/src/renderer/src/agent/agent-tool-provenance.test.ts
index 2a0c50446..bd4417710 100644
--- a/src/renderer/src/agent/agent-tool-provenance.test.ts
+++ b/src/renderer/src/agent/agent-tool-provenance.test.ts
@@ -41,6 +41,12 @@ describe('Agent Perspective tool provenance', () => {
     expect(resolveToolProvenance('design_svg_edit', undefined)).toMatchObject({
       source: 'kun', category: 'kun-gui', inferred: true
     })
+    expect(resolveToolProvenance('browser_use', undefined)).toMatchObject({
+      source: 'kun', category: 'kun-gui', inferred: true
+    })
+    expect(resolveToolProvenance('explore_agent', undefined)).toMatchObject({
+      source: 'kun', category: 'kun-runtime', inferred: true
+    })
     expect(resolveToolProvenance('mcp_filesystem_read', undefined)).toMatchObject({
       source: 'mcp', category: 'mcp-server', inferred: true
     })
diff --git a/src/renderer/src/agent/agent-tool-provenance.ts b/src/renderer/src/agent/agent-tool-provenance.ts
index 673df6229..32e0b980e 100644
--- a/src/renderer/src/agent/agent-tool-provenance.ts
+++ b/src/renderer/src/agent/agent-tool-provenance.ts
@@ -54,11 +54,11 @@ const LEGACY_KUN_CORE_TOOLS = new Set([
   'request_user_input', 'create_plan', 'read_artifact', 'task_graph'
 ])
 const LEGACY_KUN_GUI_TOOLS = new Set([
-  'computer_use', 'get_goal', 'create_goal', 'update_goal', 'todo_list', 'todo_write'
+  'computer_use', 'browser_use', 'get_goal', 'create_goal', 'update_goal', 'todo_list', 'todo_write'
 ])
 const LEGACY_KUN_RUNTIME_TOOLS = new Set([
   'web_search', 'web_fetch', 'load_skill', 'memory_create', 'memory_update',
-  'memory_delete', 'delegate_task', 'generate_image', 'generate_speech',
+  'memory_delete', 'delegate_task', 'explore_agent', 'generate_image', 'generate_speech',
   'generate_music', 'generate_video', 'ppt_master_run', 'ppt_master_read_guide',
   'ppt_master_confirm_design'
 ])
diff --git a/src/renderer/src/agent/kun-contract.ts b/src/renderer/src/agent/kun-contract.ts
index 0dd192c60..b5f131dc2 100644
--- a/src/renderer/src/agent/kun-contract.ts
+++ b/src/renderer/src/agent/kun-contract.ts
@@ -59,6 +59,18 @@ export type CoreThreadJson = CoreThreadSummaryJson & {
   pendingApprovalIds?: string[]
 }
 
+export type CoreThreadRuntimeStateJson = {
+  id: string
+  status: string
+  updatedAt: string
+  latestSeq: number
+  latestTurn: {
+    id: string
+    status: string
+    orchestration: 'direct' | 'graph'
+  } | null
+}
+
 export type CoreAttachmentMetadataJson = {
   id: string
   name: string
@@ -488,6 +500,7 @@ export type CoreTurnItemJson = {
   messageSource?: 'background_shell' | 'background_subagent' | 'graph_runtime'
   toolName?: string
   callId?: string
+  cancelRequestedAt?: string
   toolKind?: 'tool_call' | 'command_execution' | 'file_change'
   arguments?: Record<string, unknown>
   output?: unknown
@@ -608,6 +621,13 @@ export type CoreStartTurnResponseJson = {
   userMessageItemId?: string
 }
 
+export type CoreCancelToolCallResponseJson = {
+  threadId: string
+  turnId: string
+  callId: string
+  status: 'cancellation_requested' | 'already_requested'
+}
+
 export type CoreStartReviewResponseJson = CoreStartTurnResponseJson & {
   reviewItemId?: string
 }
@@ -666,6 +686,18 @@ export type CoreUsageSnapshotJson = {
   costUsd?: number
   costCny?: number
   tokenEconomySavingsTokens?: number
+  /** Time-to-first-token of this single model request (ms). */
+  requestTtftMs?: number
+  /** Generation duration of this single model request (ms). */
+  requestGenerationMs?: number
+  /** Average TTFT across model calls of the current turn. */
+  turnAvgTtftMs?: number | null
+  /** Average tokens-per-second across model calls of the current turn. */
+  turnAvgTokensPerSecond?: number | null
+  /** Thread-cumulative average TTFT across all model calls. */
+  avgTtftMs?: number | null
+  /** Thread-cumulative average tokens-per-second across all model calls. */
+  avgTokensPerSecond?: number | null
 }
 
 export type CoreRuntimeEventJson = {
diff --git a/src/renderer/src/agent/kun-event-normalizer.ts b/src/renderer/src/agent/kun-event-normalizer.ts
index 9d25f5f15..1e8c13ad2 100644
--- a/src/renderer/src/agent/kun-event-normalizer.ts
+++ b/src/renderer/src/agent/kun-event-normalizer.ts
@@ -204,12 +204,17 @@ function normalizeKunRuntimeEventPayload(
         }
       }]
     case 'turn_completed':
-    case 'turn_aborted':
       if (event.child) {
         const tool = deps.childTool(event)
         return tool ? [{ type: 'tool_updated', payload: tool }] : []
       }
       return [{ type: 'turn_completed' }]
+    case 'turn_aborted':
+      if (event.child) {
+        const tool = deps.childTool(event)
+        return tool ? [{ type: 'tool_updated', payload: tool }] : []
+      }
+      return [{ type: 'turn_aborted' }]
     case 'turn_failed': {
       if (event.child) {
         const tool = deps.childTool(event)
diff --git a/src/renderer/src/agent/kun-mapper.test.ts b/src/renderer/src/agent/kun-mapper.test.ts
index f8ca0a9d1..0178ac2c7 100644
--- a/src/renderer/src/agent/kun-mapper.test.ts
+++ b/src/renderer/src/agent/kun-mapper.test.ts
@@ -207,6 +207,19 @@ describe('runtime projection action normalization', () => {
     }])
   })
 
+  it('keeps turn interruption distinct from successful completion', () => {
+    expect(runtimeProjectionActionsFromEvent({
+      kind: 'turn_completed',
+      threadId: 'thread_1',
+      turnId: 'turn_1'
+    })).toEqual([{ type: 'turn_completed' }])
+    expect(runtimeProjectionActionsFromEvent({
+      kind: 'turn_aborted',
+      threadId: 'thread_1',
+      turnId: 'turn_1'
+    })).toEqual([{ type: 'turn_aborted' }])
+  })
+
   it('normalizes the same goal event to a stable action transcript', () => {
     const event: CoreRuntimeEventJson = {
       kind: 'goal_updated',
@@ -2118,6 +2131,78 @@ describe('usage event mapping', () => {
       turns: 1
     })
   })
+
+  it('passes through per-turn and session timing averages', async () => {
+    let captured: unknown = null
+    const sink: ThreadEventSink = {
+      ...makeSink(),
+      onUsage: (usage) => {
+        captured = usage
+      }
+    }
+
+    await dispatchKunRuntimeEvent(
+      {
+        kind: 'usage',
+        seq: 14,
+        turnId: 'turn_1',
+        usage: {
+          promptTokens: 100,
+          completionTokens: 50,
+          totalTokens: 150,
+          turnAvgTtftMs: 1_000,
+          turnAvgTokensPerSecond: 40.2,
+          avgTtftMs: 1_200,
+          avgTokensPerSecond: 38.5,
+          turns: 1
+        }
+      },
+      sink,
+      async () => undefined
+    )
+
+    expect(captured).toMatchObject({
+      turnAvgTtftMs: 1_000,
+      turnAvgTokensPerSecond: 40.2,
+      avgTtftMs: 1_200,
+      avgTokensPerSecond: 38.5,
+      turnId: 'turn_1'
+    })
+  })
+
+  it('normalizes missing or invalid timing fields to null', async () => {
+    let captured: unknown = null
+    const sink: ThreadEventSink = {
+      ...makeSink(),
+      onUsage: (usage) => {
+        captured = usage
+      }
+    }
+
+    await dispatchKunRuntimeEvent(
+      {
+        kind: 'usage',
+        seq: 15,
+        usage: {
+          promptTokens: 10,
+          completionTokens: 2,
+          totalTokens: 12,
+          turnAvgTtftMs: Number.NaN,
+          turns: 1
+        }
+      },
+      sink,
+      async () => undefined
+    )
+
+    expect(captured).toMatchObject({
+      turnAvgTtftMs: null,
+      turnAvgTokensPerSecond: null,
+      avgTtftMs: null,
+      avgTokensPerSecond: null
+    })
+    expect((captured as { turnId?: string }).turnId).toBeUndefined()
+  })
 })
 
 describe('context snapshot event mapping', () => {
diff --git a/src/renderer/src/agent/kun-mapper.ts b/src/renderer/src/agent/kun-mapper.ts
index 3f7f31e31..c5bd43e78 100644
--- a/src/renderer/src/agent/kun-mapper.ts
+++ b/src/renderer/src/agent/kun-mapper.ts
@@ -850,7 +850,8 @@ function toolBlockFromItem(item: CoreTurnItemJson, child?: CoreChildRuntimeMetad
     sourceItemId: item.id,
     sourceItemKind: item.kind,
     ...(item.callId ? { callId: item.callId } : {}),
-    ...(item.toolName ? { toolName: item.toolName } : {})
+    ...(item.toolName ? { toolName: item.toolName } : {}),
+    ...(item.cancelRequestedAt ? { cancelRequestedAt: item.cancelRequestedAt } : {})
   }
   applyRuntimeDisclosureMeta(meta, item, child)
   const sources = extractToolSources(item)
@@ -1061,7 +1062,7 @@ function normalizeUserInputAnswer(answer: unknown): UserInputAnswer | null {
   }
 }
 
-function usageFromCore(usage: CoreUsageSnapshotJson): ThreadUsageSnapshot {
+function usageFromCore(usage: CoreUsageSnapshotJson, turnId?: string): ThreadUsageSnapshot {
   const inputTokens = usage.promptTokens ?? 0
   const outputTokens = usage.completionTokens ?? 0
   const hasHitTokens = typeof usage.cacheHitTokens === 'number' && Number.isFinite(usage.cacheHitTokens)
@@ -1085,10 +1086,20 @@ function usageFromCore(usage: CoreUsageSnapshotJson): ThreadUsageSnapshot {
     costUsd: usage.costUsd ?? 0,
     costCny: usage.costCny ?? null,
     tokenEconomySavingsTokens: usage.tokenEconomySavingsTokens ?? 0,
-    turns: usage.turns ?? 0
+    turns: usage.turns ?? 0,
+    avgTtftMs: nullableFinite(usage.avgTtftMs),
+    avgTokensPerSecond: nullableFinite(usage.avgTokensPerSecond),
+    turnAvgTtftMs: nullableFinite(usage.turnAvgTtftMs),
+    turnAvgTokensPerSecond: nullableFinite(usage.turnAvgTokensPerSecond),
+    ...(turnId ? { turnId } : {})
   }
 }
 
+/** Pass through a nullable metric, normalizing non-finite values to null. */
+function nullableFinite(value: number | null | undefined): number | null {
+  return typeof value === 'number' && Number.isFinite(value) ? value : null
+}
+
 function contextSnapshotFromCore(event: CoreRuntimeEventJson): RequestContextSnapshot | null {
   const threadId = event.threadId?.trim()
   const model = event.model?.trim()
@@ -1815,7 +1826,7 @@ const kunEventNormalizerDeps: KunEventNormalizerDeps = {
   }),
   contextSnapshot: contextSnapshotFromCore,
   delegatedRuntime: delegatedRuntimeFromCore,
-  usage: (event) => event.usage ? usageFromCore(event.usage) : null,
+  usage: (event) => event.usage ? usageFromCore(event.usage, event.turnId) : null,
   runtimeError: runtimeErrorFromEvent,
   errorFromRuntime: errorForRuntimeEvent
 }
@@ -1853,7 +1864,8 @@ async function applyRuntimeProjectionAction(
     case 'context_snapshot_received': sink.onContextSnapshot?.(action.payload); return
     case 'delegated_runtime_received': sink.onDelegatedRuntimeState?.(action.payload); return
     case 'usage_received': sink.onUsage?.(action.payload); return
-    case 'turn_completed': sink.onTurnComplete(); return
+    case 'turn_completed': sink.onTurnComplete('completed'); return
+    case 'turn_aborted': sink.onTurnComplete('aborted'); return
     case 'turn_failed': sink.onError(action.error, action.options); return
   }
 }
diff --git a/src/renderer/src/agent/kun-runtime.test.ts b/src/renderer/src/agent/kun-runtime.test.ts
index ea92e573b..ff9bc78c1 100644
--- a/src/renderer/src/agent/kun-runtime.test.ts
+++ b/src/renderer/src/agent/kun-runtime.test.ts
@@ -357,6 +357,31 @@ describe('KunRuntimeProvider', () => {
     expect(detail.latestTurnOrchestration).toBe(expected)
   })
 
+  it('loads lightweight thread state without requesting full detail', async () => {
+    const runtimeRequest = vi.fn(async (path: string) => ({
+      ok: true,
+      status: 200,
+      body: JSON.stringify({
+        id: 'thr_state',
+        status: 'running',
+        updatedAt: '2026-08-07T00:00:00.000Z',
+        latestSeq: 91,
+        latestTurn: { id: 'turn_state', status: 'running', orchestration: 'direct' }
+      })
+    }))
+    installDsGui({ runtimeRequest })
+
+    await expect(new KunRuntimeProvider().getThreadState('thr_state')).resolves.toEqual({
+      status: 'running',
+      updatedAt: '2026-08-07T00:00:00.000Z',
+      latestSeq: 91,
+      latestTurnId: 'turn_state',
+      latestTurnStatus: 'running',
+      latestTurnOrchestration: 'direct'
+    })
+    expect(runtimeRequest).toHaveBeenCalledWith('/v1/threads/thr_state/state', 'GET')
+  })
+
   it('rehydrates persisted partial assistant output for a running turn', async () => {
     installDsGui({
       runtimeRequest: vi.fn(async () => ({
diff --git a/src/renderer/src/agent/kun-runtime.ts b/src/renderer/src/agent/kun-runtime.ts
index 837f7396e..33ec09b43 100644
--- a/src/renderer/src/agent/kun-runtime.ts
+++ b/src/renderer/src/agent/kun-runtime.ts
@@ -27,7 +27,9 @@ import {
   kunThreadRewindPath,
   kunThreadTodosPath,
   kunThreadInterruptPath,
+  kunThreadToolCancelPath,
   kunThreadPath,
+  kunThreadStatePath,
   kunThreadSteerPath,
   kunThreadTurnsPath,
   kunAttachmentContentPath,
@@ -65,9 +67,11 @@ import type {
   CoreStartReviewResponseJson,
   CoreClearThreadGoalResponseJson,
   CoreClearThreadTodosResponseJson,
+  CoreCancelToolCallResponseJson,
   CoreStartTurnResponseJson,
   CoreThreadGoalResponseJson,
   CoreThreadJson,
+  CoreThreadRuntimeStateJson,
   CoreThreadSummaryJson,
   CoreThreadTodosResponseJson
 } from './kun-contract'
@@ -303,6 +307,7 @@ export class KunRuntimeProvider implements AgentProvider {
     latestSeq: number
     threadStatus?: string
     latestTurnId?: string
+    latestTurnStatus?: string
     latestTurnOrchestration?: 'direct' | 'graph'
     latestUserMessageId?: string
     turnDurationByUserId?: Record<string, number>
@@ -311,6 +316,7 @@ export class KunRuntimeProvider implements AgentProvider {
     parentThreadId?: string
     goal?: NormalizedThread['goal']
     todos?: NormalizedThread['todos']
+    payloadBytes?: number
   }> {
     const response = await rendererRuntimeClient.runtimeRequest(kunThreadPath(threadId), 'GET')
     if (!response.ok) {
@@ -377,6 +383,7 @@ export class KunRuntimeProvider implements AgentProvider {
       latestSeq: thread.latestSeq ?? 0,
       threadStatus: thread.status ?? latestTurn?.status,
       latestTurnId: latestTurn?.id,
+      latestTurnStatus: latestTurn?.status,
       latestTurnOrchestration: latestTurn
         ? latestTurn.orchestration === 'graph' ? 'graph' : 'direct'
         : undefined,
@@ -385,7 +392,38 @@ export class KunRuntimeProvider implements AgentProvider {
       ...(thread.parentThreadId ? { parentThreadId: thread.parentThreadId } : {}),
       ...(typeof thread.model === 'string' && thread.model.trim() ? { model: thread.model.trim() } : {}),
       goal: thread.goal ? goalFromCore(thread.goal) : null,
-      todos: thread.todos ? todosFromCore(thread.todos) : null
+      todos: thread.todos ? todosFromCore(thread.todos) : null,
+      payloadBytes: response.body.length
+    }
+  }
+
+  async getThreadState(threadId: string): Promise<{
+    status: string
+    updatedAt: string
+    latestSeq: number
+    latestTurnId?: string
+    latestTurnStatus?: string
+    latestTurnOrchestration?: 'direct' | 'graph'
+  }> {
+    const response = await rendererRuntimeClient.runtimeRequest(kunThreadStatePath(threadId), 'GET')
+    if (!response.ok) {
+      throw runtimeErrorToError(readRuntimeError(response.body, 'failed to load thread state'))
+    }
+    const state = readRuntimeJson<CoreThreadRuntimeStateJson>(
+      response.body,
+      'runtime returned an invalid thread state response'
+    )
+    return {
+      status: state.status,
+      updatedAt: state.updatedAt,
+      latestSeq: state.latestSeq,
+      ...(state.latestTurn
+        ? {
+            latestTurnId: state.latestTurn.id,
+            latestTurnStatus: state.latestTurn.status,
+            latestTurnOrchestration: state.latestTurn.orchestration
+          }
+        : {})
     }
   }
 
@@ -586,6 +624,24 @@ export class KunRuntimeProvider implements AgentProvider {
     }
   }
 
+  async cancelToolCall(
+    threadId: string,
+    turnId: string,
+    callId: string
+  ): Promise<CoreCancelToolCallResponseJson> {
+    const response = await rendererRuntimeClient.runtimeRequest(
+      kunThreadToolCancelPath(threadId, turnId, callId),
+      'POST'
+    )
+    if (!response.ok) {
+      throw runtimeErrorToError(readRuntimeError(response.body, 'failed to cancel tool call'))
+    }
+    return readRuntimeJson<CoreCancelToolCallResponseJson>(
+      response.body,
+      'runtime returned an invalid tool cancellation response'
+    )
+  }
+
   async renameThread(threadId: string, title: string, auto?: boolean): Promise<void> {
     const response = await rendererRuntimeClient.runtimeRequest(
       kunThreadPath(threadId),
diff --git a/src/renderer/src/agent/runtime-projection-actions.ts b/src/renderer/src/agent/runtime-projection-actions.ts
index 046be84ad..90bbfd733 100644
--- a/src/renderer/src/agent/runtime-projection-actions.ts
+++ b/src/renderer/src/agent/runtime-projection-actions.ts
@@ -67,6 +67,7 @@ type RuntimeProjectionActionPayload =
       }
     }
   | { type: 'turn_completed' }
+  | { type: 'turn_aborted' }
   | { type: 'turn_failed'; error: Error; options?: ThreadErrorOptions }
 
 /**
diff --git a/src/renderer/src/agent/types.ts b/src/renderer/src/agent/types.ts
index 84abd93be..6462e6aba 100644
--- a/src/renderer/src/agent/types.ts
+++ b/src/renderer/src/agent/types.ts
@@ -604,6 +604,16 @@ export type ThreadUsageSnapshot = {
   costCny: number | null
   tokenEconomySavingsTokens: number
   turns: number
+  /** Thread-cumulative average time-to-first-token across model calls (ms). */
+  avgTtftMs: number | null
+  /** Thread-cumulative average tokens-per-second across model calls. */
+  avgTokensPerSecond: number | null
+  /** Average TTFT across model calls of the current turn (null = no data). */
+  turnAvgTtftMs: number | null
+  /** Average tokens-per-second across model calls of the current turn. */
+  turnAvgTokensPerSecond: number | null
+  /** Turn this snapshot was emitted for (for per-turn metric attribution). */
+  turnId?: string
 }
 
 export type RequestContextSnapshot = {
@@ -673,7 +683,7 @@ export type ThreadEventSink = {
   onTodos?(ev: { threadId: string; todos: ThreadTodoList | null; cleared?: boolean; createdAt?: string }): void
   /** Thread metadata changed out-of-band (e.g. the backend LLM titler upgraded the title). */
   onThreadUpdated?(ev: { threadId: string; title?: string; titleAuto?: boolean; status?: string }): void
-  onTurnComplete(): void
+  onTurnComplete(status?: 'completed' | 'aborted'): void
   onError(err: Error, options?: ThreadErrorOptions): void
   /** Optional: cumulative usage update for the thread. */
   onUsage?(usage: ThreadUsageSnapshot): void
@@ -706,6 +716,7 @@ export interface AgentProvider {
     latestSeq: number
     threadStatus?: string
     latestTurnId?: string
+    latestTurnStatus?: string
     latestTurnOrchestration?: 'direct' | 'graph'
     latestUserMessageId?: string
     turnDurationByUserId?: Record<string, number>
@@ -715,6 +726,16 @@ export interface AgentProvider {
     model?: string
     goal?: ThreadGoal | null
     todos?: ThreadTodoList | null
+    /** Original detail response size, used only to bound renderer snapshots. */
+    payloadBytes?: number
+  }>
+  getThreadState(threadId: string): Promise<{
+    status: string
+    updatedAt: string
+    latestSeq: number
+    latestTurnId?: string
+    latestTurnStatus?: string
+    latestTurnOrchestration?: 'direct' | 'graph'
   }>
   sendUserMessage(
     threadId: string,
@@ -804,6 +825,11 @@ export interface AgentProvider {
     options?: { displayText?: string }
   ): Promise<void>
   interruptTurn(threadId: string, turnId: string, options?: { discard?: boolean }): Promise<void>
+  cancelToolCall?(
+    threadId: string,
+    turnId: string,
+    callId: string
+  ): Promise<{ status: 'cancellation_requested' | 'already_requested' }>
   /**
    * Rename a thread. `auto` marks the title as provisional/auto (true, e.g. the
    * client first-message heuristic — the backend LLM titler may upgrade it) or
diff --git a/src/renderer/src/components/Workbench.tsx b/src/renderer/src/components/Workbench.tsx
index 2c1df6a44..a9c8dc34c 100644
--- a/src/renderer/src/components/Workbench.tsx
+++ b/src/renderer/src/components/Workbench.tsx
@@ -1344,6 +1344,11 @@ export function Workbench(): ReactElement {
             devPreviewOpened: rightPanelMode === BUILTIN_RIGHT_PANEL_IDS.browser,
             returnParentTitle: threads.find((thread) => thread.id === activeThreadParentId)?.title?.trim() ?? '',
             showReturnBar: activeThreadRelation === 'side' && Boolean(activeThreadParentId),
+            returnBarVariant: (
+              threads.find((thread) => thread.id === activeThreadId)?.agentId === 'explore'
+                ? 'explore'
+                : 'subagent'
+            ) as 'explore' | 'subagent',
             graphChildContext,
             composerProps: chatComposerProps,
             conversationDropWorkspaceRoot: activeSkillWorkspace,
diff --git a/src/renderer/src/components/chat/ExplorePeekPopover.tsx b/src/renderer/src/components/chat/ExplorePeekPopover.tsx
new file mode 100644
index 000000000..a5ed2b81e
--- /dev/null
+++ b/src/renderer/src/components/chat/ExplorePeekPopover.tsx
@@ -0,0 +1,235 @@
+import {
+  useEffect,
+  useRef,
+  useState,
+  type CSSProperties,
+  type ReactElement
+} from 'react'
+import { createPortal } from 'react-dom'
+import { ExternalLink, X } from 'lucide-react'
+import { useTranslation } from 'react-i18next'
+import { getProvider } from '../../agent/registry'
+import type { ChatBlock, RuntimeChildActivity } from '../../agent/types'
+import { threadSnapshotLooksRunning } from '../../store/chat-store-runtime-helpers'
+import {
+  calculateComposerPopoverPlacement,
+  currentComposerBodyZoom,
+  type ComposerPopoverPlacement
+} from './floating-composer-popover-placement'
+import { ExplorePeekBody } from './explore-peek-body'
+import {
+  formatChildActivityLabel,
+  summarizeExplorePeekBlocks,
+  type ExplorePeekStep
+} from './explore-peek-summary'
+
+export { ExplorePeekBody } from './explore-peek-body'
+
+const PEEK_POPOVER_WIDTH = 420
+const PEEK_POPOVER_MAX_HEIGHT = 360
+const PEEK_POPOVER_ESTIMATED_HEIGHT = 280
+const PEEK_POLL_MS = 1_200
+
+export type ExplorePeekPopoverProps = {
+  open: boolean
+  anchorEl: HTMLElement | null
+  childId: string
+  title: string
+  elapsedLabel: string
+  statusLabel: string
+  activity?: RuntimeChildActivity
+  summary?: string
+  onClose: () => void
+  onOpenChildThread?: (threadId: string) => void
+}
+
+export function ExplorePeekPopover({
+  open,
+  anchorEl,
+  childId,
+  title,
+  elapsedLabel,
+  statusLabel,
+  activity,
+  summary,
+  onClose,
+  onOpenChildThread
+}: ExplorePeekPopoverProps): ReactElement | null {
+  const { t } = useTranslation('common')
+  const popoverRef = useRef<HTMLDivElement | null>(null)
+  const [placement, setPlacement] = useState<ComposerPopoverPlacement | null>(null)
+  const [loading, setLoading] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+  const [steps, setSteps] = useState<ExplorePeekStep[]>([])
+  const [reasoningPreview, setReasoningPreview] = useState<string | undefined>()
+  const [assistantPreview, setAssistantPreview] = useState<string | undefined>()
+
+  useEffect(() => {
+    if (!open || !childId) {
+      setSteps([])
+      setReasoningPreview(undefined)
+      setAssistantPreview(undefined)
+      setError(null)
+      setLoading(false)
+      return
+    }
+    let cancelled = false
+    let pollTimer: number | null = null
+    setLoading(true)
+    setError(null)
+
+    const load = async (): Promise<void> => {
+      try {
+        const detail = await getProvider().getThreadDetail(childId)
+        if (cancelled) return
+        const peek = summarizeExplorePeekBlocks(detail.blocks as ChatBlock[])
+        setSteps(peek.steps)
+        setReasoningPreview(peek.reasoningPreview)
+        setAssistantPreview(peek.assistantPreview)
+        setError(null)
+        if (threadSnapshotLooksRunning(detail.blocks, detail.threadStatus)) {
+          pollTimer = window.setTimeout(() => {
+            void load()
+          }, PEEK_POLL_MS)
+        }
+      } catch (err) {
+        if (!cancelled) {
+          setError(err instanceof Error ? err.message : String(err))
+        }
+      } finally {
+        if (!cancelled) setLoading(false)
+      }
+    }
+
+    void load()
+    return () => {
+      cancelled = true
+      if (pollTimer !== null) window.clearTimeout(pollTimer)
+    }
+  }, [open, childId])
+
+  useEffect(() => {
+    if (!open || !anchorEl || typeof window === 'undefined') {
+      setPlacement(null)
+      return
+    }
+    const updatePlacement = (): void => {
+      setPlacement(calculateComposerPopoverPlacement({
+        anchorRect: anchorEl.getBoundingClientRect(),
+        popoverHeight: popoverRef.current?.offsetHeight ?? PEEK_POPOVER_ESTIMATED_HEIGHT,
+        viewportHeight: window.innerHeight,
+        viewportWidth: window.innerWidth,
+        coordinateScale: currentComposerBodyZoom(),
+        preferredWidth: PEEK_POPOVER_WIDTH,
+        maximumHeight: PEEK_POPOVER_MAX_HEIGHT
+      }))
+    }
+    updatePlacement()
+    const frame = window.requestAnimationFrame(updatePlacement)
+    window.addEventListener('resize', updatePlacement)
+    window.addEventListener('scroll', updatePlacement, true)
+    return () => {
+      window.cancelAnimationFrame(frame)
+      window.removeEventListener('resize', updatePlacement)
+      window.removeEventListener('scroll', updatePlacement, true)
+    }
+  }, [open, anchorEl, steps.length, loading, error, reasoningPreview, assistantPreview])
+
+  useEffect(() => {
+    if (!open || typeof window === 'undefined') return
+    const onPointerDown = (event: PointerEvent): void => {
+      const target = event.target
+      if (!(target instanceof Node)) return
+      if (anchorEl?.contains(target) || popoverRef.current?.contains(target)) return
+      onClose()
+    }
+    const onKeyDown = (event: KeyboardEvent): void => {
+      if (event.key === 'Escape') onClose()
+    }
+    window.addEventListener('pointerdown', onPointerDown)
+    window.addEventListener('keydown', onKeyDown)
+    return () => {
+      window.removeEventListener('pointerdown', onPointerDown)
+      window.removeEventListener('keydown', onKeyDown)
+    }
+  }, [open, anchorEl, onClose])
+
+  if (!open || typeof document === 'undefined') return null
+
+  const activityLabel = formatChildActivityLabel(activity)
+  const style: CSSProperties | undefined = placement
+    ? {
+        position: 'fixed',
+        left: placement.left,
+        top: placement.top,
+        width: placement.width,
+        maxHeight: placement.maxHeight,
+        zIndex: 80
+      }
+    : {
+        position: 'fixed',
+        left: -9999,
+        top: -9999,
+        width: PEEK_POPOVER_WIDTH,
+        maxHeight: PEEK_POPOVER_MAX_HEIGHT,
+        zIndex: 80,
+        visibility: 'hidden'
+      }
+
+  return createPortal(
+    <div
+      ref={popoverRef}
+      role="dialog"
+      aria-label={t('explorePeekTitle', { defaultValue: 'Explore progress' })}
+      data-testid="explore-peek-popover"
+      style={style}
+      className="flex flex-col overflow-hidden rounded-[16px] border border-ds-border bg-ds-card/95 shadow-[0_18px_48px_rgba(60,76,110,0.18)] backdrop-blur-xl"
+    >
+      <div className="flex items-start gap-2 border-b border-ds-border-muted px-3.5 py-3">
+        <div className="min-w-0 flex-1">
+          <div className="truncate text-[13.5px] font-semibold text-ds-ink" title={title}>
+            {title}
+          </div>
+          <div className="mt-0.5 flex flex-wrap items-center gap-x-2 gap-y-0.5 text-[11.5px] text-ds-muted">
+            <span>{statusLabel}</span>
+            <span className="tabular-nums">{elapsedLabel}</span>
+          </div>
+          {activityLabel ? (
+            <div className="mt-1 truncate text-[12px] text-accent" title={activityLabel}>
+              {activityLabel}
+            </div>
+          ) : null}
+        </div>
+        {childId ? (
+          <button
+            type="button"
+            onClick={() => onOpenChildThread?.(childId)}
+            className="flex h-7 w-7 shrink-0 items-center justify-center rounded-md text-ds-faint transition hover:bg-accent/10 hover:text-accent"
+            aria-label={t('subagentOpenSession')}
+            title={t('subagentOpenSession')}
+          >
+            <ExternalLink className="h-3.5 w-3.5" strokeWidth={2} />
+          </button>
+        ) : null}
+        <button
+          type="button"
+          onClick={onClose}
+          className="flex h-7 w-7 shrink-0 items-center justify-center rounded-md text-ds-faint transition hover:bg-ds-hover hover:text-ds-ink"
+          aria-label={t('explorePeekClose', { defaultValue: 'Close' })}
+        >
+          <X className="h-3.5 w-3.5" strokeWidth={2} />
+        </button>
+      </div>
+
+      <ExplorePeekBody
+        loading={loading}
+        error={error}
+        summary={summary}
+        reasoningPreview={reasoningPreview}
+        assistantPreview={assistantPreview}
+        steps={steps}
+      />
+    </div>,
+    document.body
+  )
+}
diff --git a/src/renderer/src/components/chat/FloatingComposer.test.ts b/src/renderer/src/components/chat/FloatingComposer.test.ts
index d7557ae06..9f47cbfd7 100644
--- a/src/renderer/src/components/chat/FloatingComposer.test.ts
+++ b/src/renderer/src/components/chat/FloatingComposer.test.ts
@@ -1889,6 +1889,30 @@ describe('FloatingComposer capability controls', () => {
       language: '',
       timeoutMs: 60_000
     })).toBe(false)
+
+    expect(shouldShowVoiceDictation({
+      enabled: true,
+      providerId: 'grok-subscription',
+      protocol: 'xai-stt',
+      baseUrl: 'https://api.x.ai/v1',
+      apiKey: '',
+      model: 'grok-transcribe',
+      localWhisperDownloadSource: 'huggingface',
+      language: '',
+      timeoutMs: 60_000
+    })).toBe(false)
+
+    expect(shouldShowVoiceDictation({
+      enabled: true,
+      providerId: 'grok-subscription',
+      protocol: 'xai-stt',
+      baseUrl: 'https://api.x.ai/v1',
+      apiKey: '',
+      model: 'grok-transcribe',
+      localWhisperDownloadSource: 'huggingface',
+      language: '',
+      timeoutMs: 60_000
+    }, true)).toBe(true)
   })
 
   it('surfaces user-input requests in Chat, Design, and the compact Write composer', () => {
diff --git a/src/renderer/src/components/chat/FloatingComposer.tsx b/src/renderer/src/components/chat/FloatingComposer.tsx
index d274ea9f0..2fedd895e 100644
--- a/src/renderer/src/components/chat/FloatingComposer.tsx
+++ b/src/renderer/src/components/chat/FloatingComposer.tsx
@@ -64,6 +64,8 @@ import {
   formatCost,
   formatPercent,
   cumulativeCacheHitRate,
+  formatTtftSeconds,
+  formatTps,
   useThreadUsageState
 } from '../../hooks/use-thread-usage'
 import { FloatingComposerContextCapacity } from './FloatingComposerContextCapacity'
@@ -135,9 +137,10 @@ export type { ComposerFileReference } from '../../lib/composer-file-references'
 export type { ComposerExecutionSettings } from './FloatingComposerExecutionPicker'
 
 export function shouldShowVoiceDictation(
-  speechToText: KunSpeechToTextSettingsV1 | null | undefined
+  speechToText: KunSpeechToTextSettingsV1 | null | undefined,
+  credentialReady = false
 ): boolean {
-  return speechToText != null && isSpeechToTextConfigured(speechToText)
+  return speechToText != null && isSpeechToTextConfigured(speechToText, { credentialReady })
 }
 
 export function returnQueuedMessageToComposer(
@@ -401,6 +404,7 @@ export function FloatingComposer({
   const route = useChatStore((s) => s.route)
   const workspaceRoot = useChatStore((s) => s.workspaceRoot)
   const storeActiveThreadId = useChatStore((s) => s.activeThreadId)
+  const threadLoadingId = useChatStore((s) => s.threadLoadingId)
   const activeThreadId = activeThreadIdOverride === undefined
     ? storeActiveThreadId
     : activeThreadIdOverride
@@ -446,7 +450,8 @@ export function FloatingComposer({
     onResolveUserInput ?? resolveUserInput
   )
   const fileInputRef = useRef<HTMLInputElement | null>(null)
-  const speechToTextSettings = useSpeechToTextSettings()
+  const { speechToText: speechToTextSettings, credentialReady: speechCredentialReady } =
+    useSpeechToTextSettings()
   const promptOptimizationSettings = usePromptOptimizationSettings()
   const dictationInputRef = useRef(input)
   useEffect(() => {
@@ -465,7 +470,7 @@ export function FloatingComposer({
       }
     }
   })
-  const showVoiceDictation = shouldShowVoiceDictation(speechToTextSettings)
+  const showVoiceDictation = shouldShowVoiceDictation(speechToTextSettings, speechCredentialReady)
   const activeClawChannel = useMemo(
     () => clawChannels.find((channel) => channel.id === activeClawChannelId) ?? null,
     [activeClawChannelId, clawChannels]
@@ -491,6 +496,15 @@ export function FloatingComposer({
     `${activeThread?.updatedAt ?? ''}:${busy ? 'busy' : 'idle'}:${usageRefreshKey}`
   )
   const threadUsage = threadUsageState.usage
+  /**
+   * Live session-average TTFT/TPS from the latest usage SSE event of the
+   * active thread. The REST summary above does not carry these timing fields.
+   */
+  const liveThreadUsage = useChatStore((s) =>
+    s.lastTurnUsage && s.lastTurnUsage.threadId === s.activeThreadId
+      ? s.lastTurnUsage.snapshot
+      : null
+  )
   const effectiveWorkspaceRoot = normalizeWorkspaceRoot(activeThreadWorkspace || workspaceRootOverride || workspaceRoot)
   const clawAgentName =
     activeClawChannel?.agentProfile.name.trim()
@@ -504,8 +518,9 @@ export function FloatingComposer({
     activeClawChannel?.remoteSession?.chatId?.trim()
   )
 
-  const canEditComposer = !disabled && (route === 'claw' ? clawHasInboundConversation : true)
-  const canCompose = !disabled && runtimeReady && (
+  const hydratingActiveThread = activeThreadId != null && threadLoadingId === activeThreadId
+  const canEditComposer = !disabled && !hydratingActiveThread && (route === 'claw' ? clawHasInboundConversation : true)
+  const canCompose = !disabled && !hydratingActiveThread && runtimeReady && (
     route === 'claw'
       ? clawHasInboundConversation
       : (hasActiveThread || !!effectiveWorkspaceRoot)
@@ -1968,7 +1983,6 @@ export function FloatingComposer({
                         {
                         tokens: formatCompactNumber(threadUsage.totalTokens),
                         cost: formatCost(threadUsage.costUsd, i18n.language, threadUsage.costCny),
-                        saved: formatCompactNumber(threadUsage.tokenEconomySavingsTokens),
                         cache: formatPercent(threadUsage.cacheHitRate),
                         latestCache: formatPercent(threadUsage.lastTurnCacheHitRate),
                         cached: formatCompactNumber(threadUsage.cachedTokens),
@@ -1995,21 +2009,6 @@ export function FloatingComposer({
                         cost: formatCost(threadUsage.costUsd, i18n.language, threadUsage.costCny)
                       })}
                     </span>
-                    {threadUsage.tokenEconomySavingsTokens > 0 ? (
-                      <>
-                        <span className="ds-composer-usage-context-savings-separator text-ds-faint">·</span>
-                        <span
-                          className="ds-composer-usage-context-savings shrink-0 tabular-nums text-emerald-700 dark:text-emerald-300"
-                          title={t('sessionUsageContextSavingsTitle', {
-                            tokens: formatCompactNumber(threadUsage.tokenEconomySavingsTokens)
-                          })}
-                        >
-                          {t('sessionUsageContextSavings', {
-                            tokens: formatCompactNumber(threadUsage.tokenEconomySavingsTokens)
-                          })}
-                        </span>
-                      </>
-                    ) : null}
                     {threadUsage.turns > 1 ? (
                       <>
                         <span className="ds-composer-usage-cache-separator text-ds-faint">·</span>
@@ -2024,6 +2023,21 @@ export function FloatingComposer({
                     <span className="ds-composer-usage-turns shrink-0 truncate tabular-nums">
                       {t('sessionUsageTurns', { turns: threadUsage.turns })}
                     </span>
+                    {liveThreadUsage &&
+                    (liveThreadUsage.avgTtftMs != null || liveThreadUsage.avgTokensPerSecond != null) ? (
+                      <>
+                        <span className="ds-composer-usage-turns-separator text-ds-faint">·</span>
+                        <span
+                          className="ds-composer-usage-metrics shrink-0 truncate tabular-nums"
+                          title={t('sessionUsageAvgMetricsTitle')}
+                        >
+                          {t('sessionUsageAvgMetrics', {
+                            ttft: formatTtftSeconds(liveThreadUsage.avgTtftMs) ?? '-',
+                            tps: formatTps(liveThreadUsage.avgTokensPerSecond) ?? '-'
+                          })}
+                        </span>
+                      </>
+                    ) : null}
                   </>
                 ) : activeThreadId ? (
                   <span className="shrink-0 text-ds-faint">
diff --git a/src/renderer/src/components/chat/MessageTimeline.tool-summary.test.ts b/src/renderer/src/components/chat/MessageTimeline.tool-summary.test.ts
index 8a30b6384..bd9630ab6 100644
--- a/src/renderer/src/components/chat/MessageTimeline.tool-summary.test.ts
+++ b/src/renderer/src/components/chat/MessageTimeline.tool-summary.test.ts
@@ -16,7 +16,8 @@ import {
 import {
   GeneratedFilesPanel,
   MessageBubble,
-  generatedMediaScrollAvailability
+  generatedMediaScrollAvailability,
+  turnMetricsLabel
 } from './message-timeline-bubbles'
 import {
   describeProcessSection,
@@ -45,6 +46,8 @@ const labels: Record<string, string> = {
   toolActionBackgroundShellList: 'List background shells',
   workingToolAction: 'Working {{action}}',
   thinkingNow: 'Thinking…',
+  turnMetricsTtft: 'Avg TTFT {{value}}',
+  turnMetricsTps: 'Avg {{value}} tok/s',
   groupReadFiles: 'Read {{count}} files',
   groupReadFile: 'Read 1 file',
   groupSearched: 'Searched {{count}} times',
@@ -196,6 +199,22 @@ describe('MessageTimeline tool summaries', () => {
     expect(find).toBe('Find *.ts · /tmp/src')
   })
 
+  it('summarizes explore_agent with its short UI title', () => {
+    expect(
+      summarizeToolBlock(
+        toolBlock({
+          summary: 'explore_agent',
+          meta: { toolName: 'explore_agent' },
+          detail: JSON.stringify({
+            title: 'Voice transcription flow',
+            query: 'Trace speech transcription wiring'
+          })
+        }),
+        t
+      )
+    ).toBe('Explore agent Voice transcription flow')
+  })
+
   it('does not repeat a raw summary that matches the generated tool label', () => {
     expect(
       summarizeToolBlock(
@@ -366,6 +385,102 @@ describe('MessageTimeline tool summaries', () => {
       }
     ])
   })
+
+  it('keeps sibling explore_agent calls as independent subagent sections', () => {
+    const sections = groupProcessSections([
+      toolBlock({
+        id: 'explore_1',
+        summary: 'explore packaging',
+        meta: {
+          toolName: 'explore_agent',
+          child: {
+            parentThreadId: 'thread_parent',
+            parentTurnId: 'turn_1',
+            childId: 'child_1',
+            childProfile: 'explore',
+            childSeq: 1
+          }
+        }
+      }),
+      toolBlock({
+        id: 'explore_2',
+        summary: 'explore workflow',
+        meta: {
+          toolName: 'explore_agent',
+          child: {
+            parentThreadId: 'thread_parent',
+            parentTurnId: 'turn_1',
+            childId: 'child_2',
+            childProfile: 'explore',
+            childSeq: 2
+          }
+        }
+      }),
+      toolBlock({
+        id: 'explore_3',
+        summary: 'explore runtime',
+        meta: {
+          toolName: 'explore_agent',
+          child: {
+            parentThreadId: 'thread_parent',
+            parentTurnId: 'turn_1',
+            childId: 'child_3',
+            childProfile: 'explore',
+            childSeq: 3
+          }
+        }
+      })
+    ])
+
+    expect(sections.map((section) => ({
+      kind: section.kind,
+      ids: section.blocks.map((block) => block.id)
+    }))).toEqual([
+      { kind: 'subagent', ids: ['explore_1'] },
+      { kind: 'subagent', ids: ['explore_2'] },
+      { kind: 'subagent', ids: ['explore_3'] }
+    ])
+  })
+
+  it('still coalesces sibling non-explore delegate_task calls into one swarm section', () => {
+    const sections = groupProcessSections([
+      toolBlock({
+        id: 'delegate_1',
+        summary: 'General Agent 1',
+        meta: {
+          toolName: 'delegate_task',
+          child: {
+            parentThreadId: 'thread_parent',
+            parentTurnId: 'turn_1',
+            childId: 'child_a',
+            childProfile: 'general',
+            childSeq: 1
+          }
+        }
+      }),
+      toolBlock({
+        id: 'delegate_2',
+        summary: 'General Agent 2',
+        meta: {
+          toolName: 'delegate_task',
+          child: {
+            parentThreadId: 'thread_parent',
+            parentTurnId: 'turn_1',
+            childId: 'child_b',
+            childProfile: 'general',
+            childSeq: 2
+          }
+        }
+      })
+    ])
+
+    expect(sections.map((section) => ({
+      kind: section.kind,
+      ids: section.blocks.map((block) => block.id)
+    }))).toEqual([
+      { kind: 'subagent', ids: ['delegate_1', 'delegate_2'] }
+    ])
+  })
 })
 
 describe('MessageTimeline Kun runtime metadata smoke', () => {
@@ -409,6 +524,64 @@ describe('MessageTimeline Kun runtime metadata smoke', () => {
     expect(html).toContain('为什么图片完全没有识别啊')
     expect(html).not.toContain('Attachments 1')
     expect(html).not.toContain('ds-media-printer-reveal')
+    expect(html).toContain('data-user-media-gallery')
+    expect(html).toContain('data-user-media-count="1"')
+    expect(html).toContain('max-w-[min(100%,20rem)]')
+    expect(html).not.toContain('data-user-media-carousel')
+    expect(html).not.toContain('generatedFileDownload')
+  })
+
+  it('keeps two or three user images in a row without carousel controls', () => {
+    const attachments = [1, 2, 3].map((index) => ({
+      id: `att_${index}`,
+      name: `image-${index}.png`,
+      mimeType: 'image/png',
+      previewUrl: `data:image/png;base64,img${index}`
+    }))
+    const block: ChatBlock = {
+      kind: 'user',
+      id: 'user_multi',
+      text: '三张图',
+      meta: {
+        attachmentIds: attachments.map((item) => item.id),
+        attachments
+      }
+    }
+
+    const html = renderToStaticMarkup(createElement(MessageBubble, { block }))
+
+    expect(html).toContain('data-user-media-count="3"')
+    expect(html).not.toContain('data-user-media-carousel')
+    expect(html).not.toContain('generatedFilesPreviousImages')
+    expect(html).not.toContain('generatedFilesNextImages')
+    expect(html).toContain('src="data:image/png;base64,img1"')
+    expect(html).toContain('src="data:image/png;base64,img3"')
+  })
+
+  it('enables the user media carousel only when there are more than three images', () => {
+    const attachments = [1, 2, 3, 4].map((index) => ({
+      id: `att_${index}`,
+      name: `image-${index}.png`,
+      mimeType: 'image/png',
+      previewUrl: `data:image/png;base64,img${index}`
+    }))
+    const block: ChatBlock = {
+      kind: 'user',
+      id: 'user_carousel',
+      text: '四张图',
+      meta: {
+        attachmentIds: attachments.map((item) => item.id),
+        attachments
+      }
+    }
+
+    const html = renderToStaticMarkup(createElement(MessageBubble, { block }))
+
+    expect(html).toContain('data-user-media-gallery')
+    expect(html).toContain('data-user-media-count="4"')
+    expect(html).toContain('data-user-media-carousel')
+    expect(html).toContain('snap-x')
+    expect(html).toContain('overflow-x-auto')
   })
 
   it('renders user file references under the sent prompt', () => {
@@ -1865,6 +2038,43 @@ describe('MessageTimeline Kun runtime metadata smoke', () => {
     expect(html).toMatch(/writeExportPng|Export PNG|导出 PNG/)
   })
 
+  it('renders per-turn average TTFT/TPS next to the timestamp when available', () => {
+    useChatStore.setState({
+      turnTimingMetrics: new Map([
+        ['turn_1', { avgTtftMs: 1_000, avgTokensPerSecond: 40.2 }]
+      ])
+    })
+    try {
+      const html = renderToStaticMarkup(
+        createElement(MessageBubble, {
+          block: {
+            kind: 'assistant',
+            id: 'assistant_1',
+            turnId: 'turn_1',
+            text: 'hello'
+          }
+        })
+      )
+
+      // zustand v5 serves SSR renders from the INITIAL state, so the
+      // per-turn map set above is not visible here; verify the wiring
+      // through the client render path instead.
+      expect(turnMetricsLabel(t, { avgTtftMs: 1_000, avgTokensPerSecond: 40.2 }))
+        .toBe('Avg TTFT 1.0s · Avg 40.2 tok/s')
+      expect(html).not.toContain('tok/s')
+    } finally {
+      useChatStore.setState({ turnTimingMetrics: new Map() })
+    }
+  })
+
+  it('omits segments without timing data from the footer label', () => {
+    expect(turnMetricsLabel(t, { avgTtftMs: null, avgTokensPerSecond: null })).toBe('')
+    expect(turnMetricsLabel(t, { avgTtftMs: 800, avgTokensPerSecond: null }))
+      .toBe('Avg TTFT 0.8s')
+    expect(turnMetricsLabel(t, { avgTtftMs: null, avgTokensPerSecond: 38.5 }))
+      .toBe('Avg 38.5 tok/s')
+  })
+
   it('renders the workspace rollback action with fork in completed assistant response actions', () => {
     const blocks: ChatBlock[] = [
       {
diff --git a/src/renderer/src/components/chat/MessageTimeline.tsx b/src/renderer/src/components/chat/MessageTimeline.tsx
index e1cd72649..e767c7033 100644
--- a/src/renderer/src/components/chat/MessageTimeline.tsx
+++ b/src/renderer/src/components/chat/MessageTimeline.tsx
@@ -1,8 +1,9 @@
 import type { ReactElement, RefObject } from 'react'
-import { memo, useEffect, useMemo, useRef, useState } from 'react'
+import { memo, useCallback, useEffect, useMemo, useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import { ChevronDown, CircleAlert, GitCommitHorizontal, Hash } from 'lucide-react'
-import type { ChatBlock, RuntimeConnectionStatus } from '../../agent/types'
+import type { ChatBlock, RuntimeChildActivity, RuntimeConnectionStatus, ToolBlock } from '../../agent/types'
+import { formatChildActivityLabel } from './explore-peek-summary'
 import { useChatStore } from '../../store/chat-store'
 import { threadHasPendingRuntimeWork } from '../../store/chat-store-runtime-helpers'
 import { useTimelineStores } from './use-timeline-stores'
@@ -428,6 +429,14 @@ export function MessageTimeline({
   onExtensionCommand
 }: Props): ReactElement {
   const { t } = useTranslation('common')
+  const threadLoadingId = useChatStore((state) => state.threadLoadingId)
+  const cancelToolCall = useChatStore((state) => state.cancelToolCall)
+  const handleCancelToolCall = useCallback(async (block: ToolBlock): Promise<boolean> => {
+    if (!activeThreadId || !block.turnId) return false
+    const callId = typeof block.meta?.callId === 'string' ? block.meta.callId : ''
+    if (!callId) return false
+    return cancelToolCall(activeThreadId, block.turnId, callId)
+  }, [activeThreadId, cancelToolCall])
   const {
     route,
     workspaceRoot,
@@ -727,7 +736,17 @@ export function MessageTimeline({
       <div className={`ds-message-timeline-content ds-chat-column-inset ds-chat-content-max-width mx-auto flex w-full min-w-0 flex-col gap-8 pt-8 ${
         timelineBottomPaddingClass()
       }`}>
-        {!hasContent || !activeThreadId ? (
+        {activeThreadId && threadLoadingId === activeThreadId ? (
+          <div
+            data-testid="thread-hydration-skeleton"
+            aria-busy="true"
+            className="flex flex-col gap-4 py-4"
+          >
+            <div className="h-5 w-32 animate-pulse rounded bg-ds-border/60" />
+            <div className="h-20 w-4/5 animate-pulse rounded-2xl bg-ds-border/40" />
+            <div className="ml-auto h-14 w-3/5 animate-pulse rounded-2xl bg-ds-border/30" />
+          </div>
+        ) : !hasContent || !activeThreadId ? (
           <MessageTimelineEmptyHero
             route={heroRoute}
             ready={runtimeConnection === 'ready'}
@@ -847,6 +866,7 @@ export function MessageTimeline({
                 onReviewChanges={onReviewChanges}
                 reviewChangesDisabled={reviewChangesDisabled}
                 onOpenChildThread={onOpenChildThread}
+                onCancelToolCall={activeThreadId ? handleCancelToolCall : undefined}
                 onComponentPrototypePrompt={onComponentPrototypePrompt}
                 filePreviewWorkspaceRoot={filePreviewWorkspaceRoot}
                 viewportRef={containerRef}
@@ -910,6 +930,7 @@ export function MessageTimeline({
             filePreviewWorkspaceRoot={filePreviewWorkspaceRoot}
             viewportRef={containerRef}
             onOpenChildThread={onOpenChildThread}
+            onCancelToolCall={undefined}
             onComponentPrototypePrompt={onComponentPrototypePrompt}
             compactCards={compactCards}
             durationMs={
@@ -965,6 +986,7 @@ export type ConversationTurnProps = {
   onReviewChanges?: () => void
   reviewChangesDisabled?: boolean
   onOpenChildThread?: OpenChildThreadHandler
+  onCancelToolCall?: (block: ToolBlock) => Promise<boolean>
   onComponentPrototypePrompt?: (prompt: string) => void
   filePreviewWorkspaceRoot: string
   viewportRef: RefObject<HTMLDivElement | null>
@@ -989,6 +1011,7 @@ export function ConversationTurn({
   onReviewChanges,
   reviewChangesDisabled = false,
   onOpenChildThread,
+  onCancelToolCall,
   onComponentPrototypePrompt,
   filePreviewWorkspaceRoot,
   viewportRef,
@@ -1086,14 +1109,33 @@ export function ConversationTurn({
     workProcessBlocks.length > 0 ||
     (runtimeErrorBlocks.length > 0 && typeof durationMs === 'number')
   const showLiveProgress = isProcessing
-  const showLiveThinking = Boolean(liveProcessText.trim())
   const liveToolBlock = useMemo(
     () => [...workProcessBlocks].reverse().find(
+      (block): block is Extract<ChatBlock, { kind: 'tool' }> =>
+        block.kind === 'tool' && block.status === 'running'
+    ) ?? [...workProcessBlocks].reverse().find(
       (block): block is Extract<ChatBlock, { kind: 'tool' }> =>
         block.kind === 'tool'
     ),
     [workProcessBlocks]
   )
+  const liveChildActivityLabel = useMemo(() => {
+    if (!liveToolBlock) return undefined
+    const child = liveToolBlock.meta?.child
+    if (!child || typeof child !== 'object' || Array.isArray(child)) return undefined
+    const activity = (child as {
+      activity?: { phase?: RuntimeChildActivity['phase']; label?: string; toolName?: string; startedAt?: string; updatedAt?: string }
+    }).activity
+    if (!activity?.label?.trim()) return undefined
+    return formatChildActivityLabel({
+      phase: activity.phase ?? 'tool',
+      label: activity.label.trim(),
+      ...(activity.toolName?.trim() ? { toolName: activity.toolName.trim() } : {}),
+      startedAt: activity.startedAt ?? '',
+      updatedAt: activity.updatedAt ?? ''
+    })
+  }, [liveToolBlock])
+  const showLiveThinking = Boolean(liveProcessText.trim()) && !liveChildActivityLabel && !liveToolBlock
   const forkFromTurn = async (): Promise<void> => {
     if (!allowMainThreadActions || !forkTurnId || forking) return
     setForking(true)
@@ -1144,6 +1186,7 @@ export function ConversationTurn({
                   workspaceRoot={filePreviewWorkspaceRoot}
                   viewportRef={viewportRef}
                   onOpenChildThread={onOpenChildThread}
+                  onCancelToolCall={onCancelToolCall}
                   allowThreadActions={allowMainThreadActions}
                 />
               ))}
@@ -1228,7 +1271,11 @@ export function ConversationTurn({
       ) : null}
 
       {showLiveProgress ? (
-        <LiveTurnProgressRow tool={liveToolBlock} thinking={showLiveThinking} />
+        <LiveTurnProgressRow
+          tool={liveToolBlock}
+          thinking={showLiveThinking}
+          activityLabel={liveChildActivityLabel}
+        />
       ) : null}
     </div>
   )
@@ -1236,10 +1283,12 @@ export function ConversationTurn({
 
 function LiveTurnProgressRow({
   tool,
-  thinking
+  thinking,
+  activityLabel
 }: {
   tool?: Extract<ChatBlock, { kind: 'tool' }>
   thinking: boolean
+  activityLabel?: string
 }): ReactElement {
   const { t, i18n } = useTranslation('common')
   const swimMode = useWorkLogoSwimMode(true)
@@ -1256,13 +1305,15 @@ function LiveTurnProgressRow({
     swimLabelKey as UiPluginLabelKey,
     i18n.language ?? 'zh'
   )
-  const label = thinking
-    ? t('thinkingNow')
-    : tool
-      ? t('workingToolAction', { action: summarizeToolBlock(tool, t) })
-      : ikunModeOn
-        ? t(IKUN_WORK_LOGO_VARIANT_LABEL_KEYS[ikunVariant])
-        : pluginLabel ?? t(swimLabelKey)
+  const label = activityLabel
+    ? t('workingToolAction', { action: activityLabel })
+    : thinking
+      ? t('thinkingNow')
+      : tool
+        ? t('workingToolAction', { action: summarizeToolBlock(tool, t) })
+        : ikunModeOn
+          ? t(IKUN_WORK_LOGO_VARIANT_LABEL_KEYS[ikunVariant])
+          : pluginLabel ?? t(swimLabelKey)
 
   return (
     <LiveTurnActivityRow
@@ -1308,6 +1359,7 @@ const MemoMessageTurn = memo(ConversationTurn, (prev, next) => (
   prev.onReviewChanges === next.onReviewChanges &&
   prev.reviewChangesDisabled === next.reviewChangesDisabled &&
   prev.onOpenChildThread === next.onOpenChildThread &&
+  prev.onCancelToolCall === next.onCancelToolCall &&
   prev.onComponentPrototypePrompt === next.onComponentPrototypePrompt &&
   prev.filePreviewWorkspaceRoot === next.filePreviewWorkspaceRoot &&
   prev.compactCards === next.compactCards &&
diff --git a/src/renderer/src/components/chat/SubagentCallCard.test.ts b/src/renderer/src/components/chat/SubagentCallCard.test.ts
index 4eb899709..06ee28453 100644
--- a/src/renderer/src/components/chat/SubagentCallCard.test.ts
+++ b/src/renderer/src/components/chat/SubagentCallCard.test.ts
@@ -4,6 +4,13 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { ToolBlock } from '../../agent/types'
 import { parseDelegateDetail, SubagentCallCard, SubagentGroup } from './SubagentCallCard'
 
+const selectThread = vi.fn(async () => undefined)
+
+vi.mock('../../store/chat-store', () => ({
+  useChatStore: (selector: (state: { selectThread: typeof selectThread }) => unknown) =>
+    selector({ selectThread })
+}))
+
 vi.mock('react-i18next', () => {
   const labels: Record<string, string> = {
     subagentAgentLabel: 'Agent',
@@ -16,13 +23,31 @@ vi.mock('react-i18next', () => {
     subagentStatusFailed: 'Failed',
     subagentStatusAwaiting: 'Awaiting approval',
     subagentOpenSession: 'Open sub-session',
-    subagentGeneratedBadge: 'Generated'
+    subagentOpenSessionShort: 'Open',
+    subagentGeneratedBadge: 'Generated',
+    exploreKindBadge: 'Explore',
+    exploreTaskDefaultTitle: 'Explore task',
+    exploreViewProcess: 'View explore process',
+    exploreViewProcessShort: 'Open',
+    exploreViewProcessSteps: 'View explore process · {{count}} steps',
+    exploreExpandConclusion: 'Show conclusion',
+    explorePeekPreview: 'Preview',
+    subagentSwarmTitle: '{{count}} subagents',
+    subagentSwarmRunning: '{{count}} running',
+    subagentSwarmQueued: '{{count}} queued',
+    subagentSwarmDone: '{{count}} done',
+    'subagentsPanel.role.explore.name': 'Repository Explorer',
+    'subagentsPanel.role.general.name': 'General Agent'
   }
   return {
     initReactI18next: { type: '3rdParty', init: () => undefined },
     useTranslation: () => ({
-      t: (key: string, fallback?: string | { defaultValue?: string }) =>
-        labels[key] ?? (typeof fallback === 'string' ? fallback : fallback?.defaultValue) ?? key
+      t: (key: string, fallback?: string | { defaultValue?: string; count?: number }) => {
+        if (typeof fallback === 'object' && fallback && 'count' in fallback && key === 'exploreViewProcessSteps') {
+          return `View explore process · ${fallback.count} steps`
+        }
+        return labels[key] ?? (typeof fallback === 'string' ? fallback : fallback?.defaultValue) ?? key
+      }
     })
   }
 })
@@ -54,6 +79,22 @@ describe('parseDelegateDetail', () => {
       generatedAgentName: 'Browser QA Specialist'
     })
   })
+
+  it('reads explore_agent title and query from the tool payload', () => {
+    expect(parseDelegateDetail(JSON.stringify({
+      childId: 'child_explore',
+      status: 'running',
+      title: 'Voice transcription flow',
+      query: 'Find how speech transcription is wired',
+      profile: 'explore'
+    }))).toMatchObject({
+      childId: 'child_explore',
+      status: 'running',
+      title: 'Voice transcription flow',
+      query: 'Find how speech transcription is wired',
+      profile: 'explore'
+    })
+  })
 })
 
 describe('SubagentCallCard route metadata', () => {
@@ -109,7 +150,7 @@ describe('SubagentCallCard route metadata', () => {
     expect(instanceText(metadata)).toContain('IPC Investigator (generated:ipc-investigator:12345678)')
   })
 
-  it('labels missing legacy identity and model instead of inferring current settings', async () => {
+  it('labels missing legacy identity and omits an empty model instead of showing Not recorded', async () => {
     await act(async () => {
       renderer = create(createElement(SubagentCallCard, {
         block: childBlock(undefined, { summary: 'Legacy result.' })
@@ -118,8 +159,9 @@ describe('SubagentCallCard route metadata', () => {
 
     const metadata = renderer!.root.findByProps({ 'data-testid': 'subagent-route-metadata' })
     expect(metadata.props['data-agent-id']).toBe('')
-    expect(metadata.props['data-model']).toBe('Not recorded')
-    expect(instanceText(metadata).match(/Not recorded/g)).toHaveLength(2)
+    expect(metadata.props['data-model']).toBe('')
+    expect(instanceText(metadata)).toContain('Not recorded')
+    expect(instanceText(metadata)).not.toContain('Model')
   })
 
   it('shows independently comparable route metadata for every grouped child row', async () => {
@@ -151,6 +193,195 @@ describe('SubagentCallCard route metadata', () => {
     expect(rows.map((row) => row.props['data-agent-id'])).toEqual(['general', 'explore'])
     expect(rows.map((row) => row.props['data-model'])).toEqual(['gpt-5.6-sol', 'gpt-5.6-terra'])
   })
+
+  it('renders an all-explore cluster as independent full cards without a subagent swarm header', async () => {
+    const onOpenChildThread = vi.fn()
+    await act(async () => {
+      renderer = create(createElement(SubagentGroup, {
+        onOpenChildThread,
+        blocks: [
+          exploreChildBlock({
+            id: 'tool_explore_a',
+            childId: 'child_a',
+            childSeq: 1,
+            title: 'Packaging config',
+            summary: 'Checked packaging scripts.'
+          }),
+          exploreChildBlock({
+            id: 'tool_explore_b',
+            childId: 'child_b',
+            childSeq: 2,
+            title: 'Release workflow',
+            summary: 'Checked release.yml.'
+          })
+        ]
+      }))
+    })
+
+    const text = instanceText(renderer!.root)
+    expect(renderer!.root.findByProps({ 'data-testid': 'explore-independent-stack' })).toBeTruthy()
+    expect(renderer!.root.findAllByProps({ 'data-testid': 'subagent-call-card' })).toHaveLength(2)
+    expect(text).toContain('Packaging config')
+    expect(text).toContain('Release workflow')
+    expect(text).not.toContain('subagents')
+    expect(text).not.toContain('{{count}} subagents')
+
+    const openButtons = renderer!.root.findAllByProps({ 'data-testid': 'explore-open-process-button' })
+    expect(openButtons.length).toBeGreaterThanOrEqual(1)
+    await act(async () => {
+      openButtons[0].props.onClick({ stopPropagation() {} })
+    })
+    expect(onOpenChildThread).toHaveBeenCalledWith('child_a')
+  })
+
+  it('prefers explore title and live activity on a running explore_agent card', async () => {
+    await act(async () => {
+      renderer = create(createElement(SubagentCallCard, {
+        block: {
+          kind: 'tool',
+          id: 'tool_explore_live',
+          createdAt: '2026-08-07T00:00:00.000Z',
+          summary: 'explore_agent',
+          status: 'running',
+          toolKind: 'tool_call',
+          detail: JSON.stringify({
+            childId: 'child_voice',
+            status: 'running',
+            title: 'Voice transcription flow',
+            query: 'Trace speech transcription',
+            profile: 'explore'
+          }),
+          meta: {
+            toolName: 'explore_agent',
+            child: {
+              parentThreadId: 'thread_parent',
+              parentTurnId: 'turn_parent',
+              childId: 'child_voice',
+              childLabel: 'Voice transcription flow',
+              childProfile: 'explore',
+              childProfileName: 'Repository Explorer',
+              childModel: 'deepseek-v4-flash',
+              childStatus: 'running',
+              childSeq: 1,
+              activity: {
+                phase: 'tool',
+                label: 'Reading tool timeline UI',
+                toolName: 'read',
+                startedAt: '2026-08-07T00:00:00.000Z',
+                updatedAt: '2026-08-07T00:00:02.000Z'
+              }
+            }
+          }
+        }
+      }))
+    })
+
+    expect(instanceText(renderer!.root)).toContain('Explore')
+    expect(instanceText(renderer!.root)).toContain('Voice transcription flow')
+    expect(instanceText(renderer!.root)).toContain('Reading tool timeline UI · read')
+    expect(instanceText(renderer!.root)).not.toContain('explore_agent')
+    expect(instanceText(renderer!.root)).not.toContain('Not recorded')
+    const card = renderer!.root.findByProps({ 'data-testid': 'subagent-call-card' })
+    expect(card.props['data-activity-label']).toBe('Reading tool timeline UI · read')
+    expect(card.props['data-explore']).toBe('true')
+  })
+
+  it('shows the full conclusion by default and opens the child only via the process button', async () => {
+    selectThread.mockClear()
+    const onOpenChildThread = vi.fn()
+    const conclusion = [
+      '已找到完整链路。结论如下:',
+      '## 1) 设置定义',
+      '- 类型定义: ProviderRetryConfig'
+    ].join('\n')
+    await act(async () => {
+      renderer = create(createElement(SubagentCallCard, {
+        onOpenChildThread,
+        block: {
+          kind: 'tool',
+          id: 'tool_explore_done',
+          createdAt: '2026-08-07T00:00:00.000Z',
+          summary: 'explore_agent',
+          status: 'success',
+          toolKind: 'tool_call',
+          detail: JSON.stringify({
+            childId: 'child_tokens',
+            status: 'completed',
+            title: 'Token save label',
+            summary: conclusion,
+            profile: 'explore',
+            profileName: 'Repository Explorer',
+            model: 'deepseek-v4-flash',
+            toolInvocations: 5
+          }),
+          meta: {
+            toolName: 'explore_agent',
+            child: {
+              parentThreadId: 'thread_parent',
+              parentTurnId: 'turn_parent',
+              childId: 'child_tokens',
+              childLabel: 'Token save label',
+              childProfile: 'explore',
+              childStatus: 'completed',
+              childSeq: 1,
+              toolInvocations: 5
+            }
+          }
+        }
+      }))
+    })
+
+    const card = renderer!.root.findByProps({ 'data-testid': 'subagent-call-card' })
+    expect(card.props['data-conclusion-expanded']).toBe('true')
+    expect(instanceText(renderer!.root)).toContain('已找到完整链路')
+    expect(instanceText(renderer!.root)).toContain('ProviderRetryConfig')
+    expect(instanceText(renderer!.root)).not.toContain('View explore process · 5 steps')
+
+    const clickable = card.findAll((node) => node.props?.role === 'button')[0]
+    await act(async () => {
+      clickable.props.onClick()
+    })
+    expect(onOpenChildThread).not.toHaveBeenCalled()
+    expect(
+      renderer!.root.findByProps({ 'data-testid': 'subagent-call-card' }).props['data-conclusion-expanded']
+    ).toBe('false')
+
+    const openProcess = renderer!.root.findByProps({ 'data-testid': 'explore-open-process-button' })
+    await act(async () => {
+      openProcess.props.onClick({ stopPropagation() {} })
+    })
+    expect(onOpenChildThread).toHaveBeenCalledWith('child_tokens')
+    expect(selectThread).not.toHaveBeenCalled()
+  })
+
+  it('never titles a completed explore card with the raw tool name', async () => {
+    await act(async () => {
+      renderer = create(createElement(SubagentCallCard, {
+        block: {
+          kind: 'tool',
+          id: 'tool_explore_legacy',
+          createdAt: '2026-08-07T00:00:00.000Z',
+          summary: 'explore_agent',
+          status: 'success',
+          toolKind: 'tool_call',
+          detail: JSON.stringify({
+            childId: 'child_legacy',
+            status: 'completed',
+            summary: 'Located save-tokens rendering in FloatingComposer.tsx',
+            toolInvocations: 5
+          }),
+          meta: { toolName: 'explore_agent' }
+        }
+      }))
+    })
+
+    const text = instanceText(renderer!.root)
+    expect(text).toContain('Explore')
+    expect(text).toContain('Located save-tokens rendering in FloatingComposer.tsx')
+    expect(text).not.toMatch(/(^|[^a-z_])explore_agent([^a-z_]|$)/i)
+    expect(text).toContain('Repository Explorer')
+    expect(text).not.toContain('Not recorded')
+  })
 })
 
 function childBlock(
@@ -188,6 +419,46 @@ function childBlock(
   }
 }
 
+function exploreChildBlock(input: {
+  id: string
+  childId: string
+  childSeq: number
+  title: string
+  summary: string
+}): ToolBlock {
+  return {
+    kind: 'tool',
+    id: input.id,
+    createdAt: '2026-08-07T00:00:00.000Z',
+    summary: 'explore_agent',
+    status: 'success',
+    toolKind: 'tool_call',
+    detail: JSON.stringify({
+      childId: input.childId,
+      status: 'completed',
+      title: input.title,
+      summary: input.summary,
+      profile: 'explore',
+      profileName: 'Repository Explorer',
+      toolInvocations: 3
+    }),
+    meta: {
+      toolName: 'explore_agent',
+      child: {
+        parentThreadId: 'thread_parent',
+        parentTurnId: 'turn_parent',
+        childId: input.childId,
+        childLabel: input.title,
+        childProfile: 'explore',
+        childProfileName: 'Repository Explorer',
+        childModel: 'deepseek-v4-flash',
+        childStatus: 'completed',
+        childSeq: input.childSeq
+      }
+    }
+  }
+}
+
 function instanceText(instance: ReactTestInstance): string {
   return instance.children
     .map((child) => typeof child === 'string' ? child : instanceText(child))
diff --git a/src/renderer/src/components/chat/SubagentCallCard.tsx b/src/renderer/src/components/chat/SubagentCallCard.tsx
index 78e3ac2cc..e897828dc 100644
--- a/src/renderer/src/components/chat/SubagentCallCard.tsx
+++ b/src/renderer/src/components/chat/SubagentCallCard.tsx
@@ -2,7 +2,7 @@ import type { ReactElement } from 'react'
 import { useEffect, useMemo, useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import type { TFunction } from 'i18next'
-import { Check, ChevronDown, ChevronRight, ExternalLink, Hourglass, Loader2 } from 'lucide-react'
+import { Check, ChevronDown, ChevronRight, Eye, Hourglass, Loader2 } from 'lucide-react'
 import type { ChatBlock, ToolBlock } from '../../agent/types'
 import { useChatStore } from '../../store/chat-store'
 import { AgentKun } from '../subagents/AgentKun'
@@ -15,6 +15,18 @@ import {
   useSubagentReducedMotion
 } from '../subagents/SubagentLiveness'
 import { BUILTIN_AGENT_CATALOG_BY_ID } from '../../../../../kun/src/delegation/builtin-agent-catalog'
+import { AssistantMarkdown } from './AssistantMarkdown'
+import { ExplorePeekPopover } from './ExplorePeekPopover'
+import {
+  firstUsefulLine,
+  isBareSubagentToolName,
+  isExploreToolBlock,
+  resolveExploreTaskTitle
+} from './explore-card-copy'
+import {
+  formatChildActivityLabel,
+  readChildActivityFromBlock
+} from './explore-peek-summary'
 
 /**
  * "Kun Crew" — the subagent (`delegate_task`) visualization for the chat
@@ -45,11 +57,15 @@ const KNOWN_POSE_IDS = new Set([
   'summary'
 ])
 
-/** Parsed shape of the `delegate_task` tool `detail` JSON (all optional). */
+/** Parsed shape of the `delegate_task` / `explore_agent` tool `detail` JSON (all optional). */
 type DelegateDetail = {
   /** The child thread id — always present in the tool result, unlike `meta.child`. */
   childId?: string
   status?: 'queued' | 'running' | 'completed' | 'failed' | 'aborted'
+  /** Short UI title from explore_agent (or early lifecycle updates). */
+  title?: string
+  /** Narrow explore query from the initial tool arguments payload. */
+  query?: string
   summary?: string
   error?: string
   profile?: string
@@ -94,6 +110,8 @@ export function parseDelegateDetail(detail: string | undefined): DelegateDetail
   return {
     childId: str(obj.childId),
     status: status(obj.status),
+    title: str(obj.title),
+    query: str(obj.query),
     summary: str(obj.summary),
     error: str(obj.error),
     profile: str(obj.profile),
@@ -252,6 +270,17 @@ function GeneratedPill({ t }: { t: TFunction<'common'> }): ReactElement {
   )
 }
 
+function ExploreKindBadge({ t }: { t: TFunction<'common'> }): ReactElement {
+  return (
+    <span
+      data-testid="explore-kind-badge"
+      className="shrink-0 rounded-full bg-emerald-500/12 px-2 py-[2px] text-[10.5px] font-semibold text-emerald-700 dark:text-emerald-300"
+    >
+      {t('exploreKindBadge', { defaultValue: 'Explore' })}
+    </span>
+  )
+}
+
 function MetaChip({ children, title }: { children: React.ReactNode; title?: string }): ReactElement {
   return (
     <span
@@ -272,17 +301,19 @@ function AgentModelMetadata({
 }: {
   agentIdentity: string
   profileId?: string
-  model: string
+  /** When omitted/empty, the model chips are hidden (never show "Not recorded"). */
+  model?: string
   compact: boolean
   t: TFunction<'common'>
 }): ReactElement {
   const labelClass = 'shrink-0 rounded-[5px] bg-ds-card-muted/70 px-1.5 py-0.5 font-semibold text-ds-faint'
   const valueClass = 'min-w-0 truncate rounded-[5px] bg-ds-card-muted/45 px-1.5 py-0.5 text-ds-muted'
+  const modelValue = model?.trim() || ''
   return (
     <div
       data-testid="subagent-route-metadata"
       data-agent-id={profileId ?? ''}
-      data-model={model}
+      data-model={modelValue}
       className="mt-1 flex min-w-0 items-center gap-1 overflow-hidden text-[10.5px] leading-4"
     >
       <span className={labelClass}>{t('subagentAgentLabel', { defaultValue: 'Agent' })}</span>
@@ -292,14 +323,18 @@ function AgentModelMetadata({
       >
         {agentIdentity}
       </span>
-      <span className="shrink-0 text-ds-faint">·</span>
-      <span className={labelClass}>{t('subagentModelLabel', { defaultValue: 'Model' })}</span>
-      <span
-        className={`${valueClass} ${compact ? 'max-w-[130px]' : 'max-w-[180px]'} font-mono`}
-        title={model}
-      >
-        {model}
-      </span>
+      {modelValue ? (
+        <>
+          <span className="shrink-0 text-ds-faint">·</span>
+          <span className={labelClass}>{t('subagentModelLabel', { defaultValue: 'Model' })}</span>
+          <span
+            className={`${valueClass} ${compact ? 'max-w-[130px]' : 'max-w-[180px]'} font-mono`}
+            title={modelValue}
+          >
+            {modelValue}
+          </span>
+        </>
+      ) : null}
     </div>
   )
 }
@@ -331,17 +366,19 @@ export function SubagentCallCard({
     () => parseDelegateDetail(block.kind === 'tool' ? (block as ToolBlock).detail : undefined),
     [block]
   )
+  const activity = useMemo(() => readChildActivityFromBlock(block), [block])
   const status = resolveStatus(block, child, detail)
   const detached = child.detached === true || detail.detached === true
   const generated = detail.generated === true || (child.childProfile?.startsWith('generated:') ?? false)
   const animate = !reducedMotion && onScreen && status === 'running'
+  const isExplore = block.kind === 'tool' && isExploreToolBlock(block as ToolBlock)
 
   // Profile id: prefer the live `childProfile` from the runtime metadata (set on
   // the first queued/running event) so the agent type shows immediately; the
   // result-JSON `profile` only arrives after the child completes.
-  const profileId = child.childProfile || detail.profile
+  const profileId = child.childProfile || detail.profile || (isExplore ? 'explore' : undefined)
   // Pose key: profile → childLabel → block toolName → 'custom'.
-  const poseId = profileId || child.childLabel || child.childId || 'custom'
+  const poseId = profileId || (isExplore ? 'explore' : undefined) || child.childLabel || child.childId || 'custom'
   const isKnownPose = KNOWN_POSE_IDS.has(poseId)
   const hue = isKnownPose ? null : hashHue(poseId)
 
@@ -349,29 +386,61 @@ export function SubagentCallCard({
   // snapshot is authoritative for custom/generated roles; built-ins may use a
   // localized catalog label without consulting mutable profile settings.
   const taskText = block.kind === 'tool' ? splitTaskLine(block as ToolBlock) : undefined
+  const exploreCatalog = BUILTIN_AGENT_CATALOG_BY_ID.explore
   const recordedAgentName = child.childProfileName || detail.profileName || detail.generatedAgentName
   const localizedBuiltinName =
     profileId && BUILTIN_AGENT_CATALOG_BY_ID[profileId]
       ? t(`subagentsPanel.role.${profileId}.name`, BUILTIN_AGENT_CATALOG_BY_ID[profileId]!.name)
       : undefined
-  const agentName =
-    localizedBuiltinName ||
-    recordedAgentName ||
-    (profileId && KNOWN_POSE_IDS.has(profileId)
-      ? t(`subagentsPanel.role.${profileId}.name`, profileId)
-      : undefined) ||
-    profileId?.trim() ||
-    t('subagentNotRecorded', { defaultValue: 'Not recorded' })
-  const agentIdentity = profileId && agentName !== profileId
-    ? `${agentName} (${profileId})`
-    : agentName
-  const model = child.childModel || detail.model || t('subagentNotRecorded', { defaultValue: 'Not recorded' })
-  const taskTitle =
-    child.childLabel?.trim() ||
-    taskText?.trim().split(/\s+/).slice(0, 6).join(' ').slice(0, 28) ||
-    agentName ||
-    t('subagentDefaultName')
-  const taskLine = detail.summary?.trim() || (taskText?.trim() !== taskTitle ? taskText?.trim() : '')
+  const exploreAgentName = t(
+    'subagentsPanel.role.explore.name',
+    exploreCatalog?.name ?? 'Repository Explorer'
+  )
+  const agentName = isExplore
+    ? (localizedBuiltinName || recordedAgentName || exploreAgentName)
+    : (
+      localizedBuiltinName ||
+      recordedAgentName ||
+      (profileId && KNOWN_POSE_IDS.has(profileId)
+        ? t(`subagentsPanel.role.${profileId}.name`, profileId)
+        : undefined) ||
+      profileId?.trim() ||
+      t('subagentNotRecorded', { defaultValue: 'Not recorded' })
+    )
+  const agentIdentity = isExplore
+    ? agentName
+    : (profileId && agentName !== profileId ? `${agentName} (${profileId})` : agentName)
+  const model = (child.childModel || detail.model || '').trim() || undefined
+  const taskTitle = isExplore
+    ? resolveExploreTaskTitle({
+      childLabel: child.childLabel,
+      title: detail.title,
+      query: detail.query,
+      summary: detail.summary,
+      blockSummary: block.kind === 'tool' ? (block as ToolBlock).summary : undefined,
+      fallback: t('exploreTaskDefaultTitle', { defaultValue: 'Explore task' })
+    })
+    : (
+      firstUsefulLine(child.childLabel) ||
+      firstUsefulLine(detail.title) ||
+      firstUsefulLine(taskText, 48) ||
+      (isBareSubagentToolName(agentName) ? t('subagentDefaultName') : agentName) ||
+      t('subagentDefaultName')
+    )
+  const activityLine = !isTerminal(status) ? formatChildActivityLabel(activity) : undefined
+  const steps = child.toolInvocations ?? detail.toolInvocations
+  const childId = child.childId || detail.childId
+  // Short subtitle only — keep CTA on the explicit process button, not in truncated text.
+  const taskLine = activityLine || (
+    isExplore && isTerminal(status)
+      ? (firstUsefulLine(detail.summary, 96) || firstUsefulLine(detail.query, 96) || undefined)
+      : (
+        detail.summary?.trim() ||
+        detail.query?.trim() ||
+        (taskText?.trim() !== taskTitle ? taskText?.trim() : '') ||
+        undefined
+      )
+  )
 
   const elapsed = useSubagentElapsed(
     status,
@@ -379,26 +448,28 @@ export function SubagentCallCard({
     child.durationMs ?? detail.durationMs,
     tickNow
   )
-  const steps = child.toolInvocations ?? detail.toolInvocations
 
-  // Always start collapsed — both while running and after it finishes. The card
-  // only opens when the user clicks it (no auto-expand on terminal transition).
   const hasBody = Boolean(detail.summary?.trim() || detail.error?.trim())
+  // Completed explore conclusions default open so the full text is readable.
+  const exploreConclusionDefaultOpen = isExplore && isTerminal(status) && hasBody
   const [userToggled, setUserToggled] = useState<boolean | null>(null)
-  const expanded = (userToggled ?? false) && hasBody
+  const [peekOpen, setPeekOpen] = useState(false)
+  const expanded = hasBody && !peekOpen && (userToggled ?? exploreConclusionDefaultOpen)
 
-  // `meta.child` is only attached on the live child events (which the renderer
-  // currently drops), so for a completed delegation the reliable source of the
-  // child thread id is the tool result JSON (`detail.childId`).
-  const childId = child.childId || detail.childId
+  const canJump = Boolean(childId)
   const openChild = (): void => {
     if (!childId) return
+    setPeekOpen(false)
     if (onOpenChildThread) {
       onOpenChildThread(childId)
       return
     }
     void selectThread(childId).catch(() => undefined)
   }
+  const toggleConclusion = (): void => {
+    if (!hasBody) return
+    setUserToggled(!(userToggled ?? exploreConclusionDefaultOpen))
+  }
 
   // Stagger sweep/pulse per child so a swarm reads as independent.
   const staggerDelay = typeof child.childSeq === 'number' ? `${(child.childSeq % 6) * 0.18}s` : '0s'
@@ -413,20 +484,24 @@ export function SubagentCallCard({
       ref={ref as React.RefObject<HTMLElement>}
       className={`${shellClass}${failBorder}`}
       style={{ ['--ds-subagent-stagger' as string]: staggerDelay }}
-      aria-label={`${taskTitle} · ${agentIdentity} · ${model} · ${pillText(status, t)}`}
+      aria-label={`${taskTitle} · ${agentIdentity}${model ? ` · ${model}` : ''} · ${pillText(status, t)}`}
+      data-testid="subagent-call-card"
+      data-explore={isExplore ? 'true' : 'false'}
+      data-activity-label={activityLine ?? ''}
+      data-conclusion-expanded={expanded ? 'true' : 'false'}
     >
       <div
         role={hasBody ? 'button' : undefined}
         tabIndex={hasBody ? 0 : undefined}
         aria-expanded={hasBody ? expanded : undefined}
         onClick={() => {
-          if (hasBody) setUserToggled(!expanded)
+          if (hasBody) toggleConclusion()
         }}
         onKeyDown={(e) => {
           if (!hasBody) return
           if (e.key === 'Enter' || e.key === ' ') {
             e.preventDefault()
-            setUserToggled(!expanded)
+            toggleConclusion()
           }
         }}
         className={`flex items-center gap-3 px-4 ${compact ? 'py-2.5' : 'py-3'} text-left ${
@@ -435,7 +510,8 @@ export function SubagentCallCard({
       >
         <AvatarDisc poseId={poseId} status={status} hue={hue} compact={compact} animate={animate} />
         <div className="min-w-0 flex-1">
-          <div className="flex items-center gap-2">
+          <div className="flex min-w-0 items-center gap-2">
+            {isExplore ? <ExploreKindBadge t={t} /> : null}
             <span className="truncate text-[14px] font-semibold text-ds-ink" title={taskTitle}>{taskTitle}</span>
             {generated ? <GeneratedPill t={t} /> : null}
             {detached ? <BackgroundPill t={t} /> : null}
@@ -448,8 +524,21 @@ export function SubagentCallCard({
             compact={compact}
             t={t}
           />
-          {taskLine ? (
-            <span className="mt-0.5 block truncate text-[12.5px] text-ds-muted" title={taskLine}>{taskLine}</span>
+          {taskLine && !expanded ? (
+            <span
+              className={`mt-0.5 block truncate text-[12.5px] ${
+                activityLine ? 'text-accent' : 'text-ds-muted'
+              }`}
+              title={taskLine}
+              data-testid="subagent-activity-line"
+            >
+              {taskLine}
+            </span>
+          ) : null}
+          {hasBody && !expanded ? (
+            <span className="mt-0.5 block text-[11.5px] font-semibold text-accent">
+              {t('exploreExpandConclusion', { defaultValue: 'Show conclusion' })}
+            </span>
           ) : null}
         </div>
         <span className="shrink-0 text-right tabular-nums">
@@ -462,6 +551,22 @@ export function SubagentCallCard({
                   : ''}
           </span>
         </span>
+        {childId ? (
+          <button
+            type="button"
+            onClick={(e) => {
+              e.stopPropagation()
+              setPeekOpen((value) => !value)
+            }}
+            className="flex h-7 shrink-0 items-center gap-1 rounded-md px-1.5 text-[11px] font-semibold text-ds-faint transition hover:bg-ds-hover hover:text-ds-ink"
+            aria-label={t('explorePeekPreview', { defaultValue: 'Preview' })}
+            title={t('explorePeekPreview', { defaultValue: 'Preview' })}
+            data-testid="explore-peek-button"
+          >
+            <Eye className="h-3.5 w-3.5" strokeWidth={2} />
+            <span className="hidden sm:inline">{t('explorePeekPreview', { defaultValue: 'Preview' })}</span>
+          </button>
+        ) : null}
         {childId ? (
           <button
             type="button"
@@ -469,11 +574,23 @@ export function SubagentCallCard({
               e.stopPropagation()
               openChild()
             }}
-            className="flex h-7 w-7 shrink-0 items-center justify-center rounded-md text-ds-faint transition hover:bg-accent/10 hover:text-accent"
-            aria-label={t('subagentOpenSession')}
-            title={t('subagentOpenSession')}
+            className="flex h-7 shrink-0 items-center gap-1 rounded-md bg-accent/10 px-2 text-[11px] font-semibold text-accent transition hover:bg-accent/15"
+            aria-label={
+              isExplore
+                ? t('exploreViewProcess', { defaultValue: 'View explore process' })
+                : t('subagentOpenSession')
+            }
+            title={
+              isExplore
+                ? t('exploreViewProcess', { defaultValue: 'View explore process' })
+                : t('subagentOpenSession')
+            }
+            data-testid="explore-open-process-button"
           >
-            <ExternalLink className="h-3.5 w-3.5" strokeWidth={2} />
+            {isExplore
+              ? t('exploreViewProcessShort', { defaultValue: 'Open' })
+              : t('subagentOpenSessionShort', { defaultValue: 'Open' })}
+            <ChevronRight className="h-3.5 w-3.5" strokeWidth={2} />
           </button>
         ) : null}
         {hasBody ? (
@@ -490,13 +607,28 @@ export function SubagentCallCard({
       <LaneHairline status={status} animate={animate} />
 
       {expanded ? (
-        <div className="border-t border-ds-border-muted/70 px-4 py-3.5">
+        <div
+          className="border-t border-ds-border-muted/70 px-4 py-3.5"
+          data-testid="subagent-conclusion-body"
+        >
           {detail.error?.trim() ? (
-            <pre className="whitespace-pre-wrap break-words rounded-[10px] border border-red-200/80 bg-red-50/80 px-3 py-2.5 font-mono text-[12px] leading-5 text-ds-danger dark:border-red-800/40 dark:bg-red-500/10">
+            <pre className="max-h-[320px] overflow-y-auto whitespace-pre-wrap break-words rounded-[10px] border border-red-200/80 bg-red-50/80 px-3 py-2.5 font-mono text-[12px] leading-5 text-ds-danger dark:border-red-800/40 dark:bg-red-500/10">
               {detail.error}
             </pre>
           ) : detail.summary?.trim() ? (
-            <p className="whitespace-pre-wrap text-[14px] leading-6 text-ds-muted">{detail.summary}</p>
+            isExplore ? (
+              <div className="max-h-[360px] overflow-y-auto text-[14px] leading-6 text-ds-ink">
+                <AssistantMarkdown
+                  text={detail.summary}
+                  streaming={false}
+                  className="ds-markdown text-[14px] leading-6 text-ds-ink"
+                />
+              </div>
+            ) : (
+              <p className="max-h-[320px] overflow-y-auto whitespace-pre-wrap text-[14px] leading-6 text-ds-muted">
+                {detail.summary}
+              </p>
+            )
           ) : null}
 
           <div className="mt-3 flex flex-wrap items-center gap-1.5">
@@ -512,6 +644,28 @@ export function SubagentCallCard({
           </div>
         </div>
       ) : null}
+
+      {childId ? (
+        <ExplorePeekPopover
+          open={peekOpen}
+          anchorEl={ref.current}
+          childId={childId}
+          title={taskTitle}
+          elapsedLabel={elapsed}
+          statusLabel={pillText(status, t)}
+          activity={activity}
+          summary={detail.summary}
+          onClose={() => setPeekOpen(false)}
+          onOpenChildThread={(threadId) => {
+            setPeekOpen(false)
+            if (onOpenChildThread) {
+              onOpenChildThread(threadId)
+              return
+            }
+            void selectThread(threadId).catch(() => undefined)
+          }}
+        />
+      ) : null}
     </section>
   )
 }
@@ -533,14 +687,18 @@ function pillText(status: CardStatus, t: (k: string) => string): string {
   }
 }
 
-/** Best-effort task one-liner from a generic delegate_task summary string. */
+/** Best-effort task one-liner from a generic delegate/explore summary string. */
 function splitTaskLine(block: ToolBlock): string | undefined {
+  const detail = parseDelegateDetail(block.detail)
+  if (detail.title?.trim()) return detail.title.trim()
   const raw = block.summary?.trim()
   if (!raw) return undefined
-  const stripped = raw.replace(/^delegate_task\s*:\s*/i, '').trim()
+  const stripped = raw
+    .replace(/^(delegate_task|explore_agent|generate_subagent)\s*:\s*/i, '')
+    .trim()
   if (!stripped || stripped.length > 160) return undefined
   // Bare tool name (no task text yet, e.g. while running) — nothing useful.
-  if (/^delegate_task$/i.test(stripped)) return undefined
+  if (/^(delegate_task|explore_agent|generate_subagent)$/i.test(stripped)) return undefined
   return stripped
 }
 
@@ -587,9 +745,27 @@ export function SubagentGroup({
 
   if (sorted.length === 0) return null
 
-  // N=1: single full card, no swarm header.
-  if (sorted.length === 1) {
-    return <SubagentCallCard block={sorted[0]} tickNow={tickNow} onOpenChildThread={onOpenChildThread} />
+  const allExplore = sorted.every(
+    (b) => b.kind === 'tool' && isExploreToolBlock(b as ToolBlock)
+  )
+
+  // N=1, or an all-explore cluster: full independent cards (no swarm shell).
+  if (sorted.length === 1 || allExplore) {
+    if (sorted.length === 1) {
+      return <SubagentCallCard block={sorted[0]} tickNow={tickNow} onOpenChildThread={onOpenChildThread} />
+    }
+    return (
+      <div className="flex flex-col gap-2" data-testid="explore-independent-stack">
+        {sorted.map((b) => (
+          <SubagentCallCard
+            key={b.id}
+            block={b}
+            tickNow={tickNow}
+            onOpenChildThread={onOpenChildThread}
+          />
+        ))}
+      </div>
+    )
   }
 
   const clusterPoses = sorted.slice(0, 5).map((b) => {
diff --git a/src/renderer/src/components/chat/explore-card-copy.test.ts b/src/renderer/src/components/chat/explore-card-copy.test.ts
new file mode 100644
index 000000000..ff95ff3f2
--- /dev/null
+++ b/src/renderer/src/components/chat/explore-card-copy.test.ts
@@ -0,0 +1,57 @@
+import { describe, expect, it } from 'vitest'
+import type { ToolBlock } from '../../agent/types'
+import {
+  isBareSubagentToolName,
+  isExploreToolBlock,
+  resolveExploreTaskTitle
+} from './explore-card-copy'
+
+describe('explore-card-copy', () => {
+  it('rejects bare tool names as titles', () => {
+    expect(isBareSubagentToolName('explore_agent')).toBe(true)
+    expect(isBareSubagentToolName('delegate_task')).toBe(true)
+    expect(isBareSubagentToolName('Voice transcription flow')).toBe(false)
+  })
+
+  it('detects explore tool blocks by tool name or profile', () => {
+    const byName: ToolBlock = {
+      kind: 'tool',
+      id: 't1',
+      createdAt: '2026-08-07T00:00:00.000Z',
+      summary: 'explore_agent',
+      status: 'running',
+      toolKind: 'tool_call',
+      meta: { toolName: 'explore_agent' }
+    }
+    expect(isExploreToolBlock(byName)).toBe(true)
+
+    const byProfile: ToolBlock = {
+      ...byName,
+      meta: { toolName: 'delegate_task' },
+      detail: JSON.stringify({ profile: 'explore', title: 'Find tokens' })
+    }
+    expect(isExploreToolBlock(byProfile)).toBe(true)
+  })
+
+  it('resolves a human title and never falls back to explore_agent', () => {
+    expect(resolveExploreTaskTitle({
+      blockSummary: 'explore_agent',
+      fallback: 'Explore task'
+    })).toBe('Explore task')
+
+    expect(resolveExploreTaskTitle({
+      childLabel: undefined,
+      title: undefined,
+      query: 'Locate where save tokens is rendered',
+      summary: 'found FloatingComposer.tsx',
+      blockSummary: 'explore_agent',
+      fallback: 'Explore task'
+    })).toBe('Locate where save tokens is rendered')
+
+    expect(resolveExploreTaskTitle({
+      title: 'Token save label',
+      query: 'longer query text',
+      fallback: 'Explore task'
+    })).toBe('Token save label')
+  })
+})
diff --git a/src/renderer/src/components/chat/explore-card-copy.ts b/src/renderer/src/components/chat/explore-card-copy.ts
new file mode 100644
index 000000000..da5099b88
--- /dev/null
+++ b/src/renderer/src/components/chat/explore-card-copy.ts
@@ -0,0 +1,63 @@
+import type { ToolBlock } from '../../agent/types'
+
+const BARE_TOOL_NAMES = /^(delegate_task|explore_agent|generate_subagent)$/i
+
+export function isBareSubagentToolName(text: string | undefined | null): boolean {
+  const value = text?.trim() ?? ''
+  if (!value) return true
+  return BARE_TOOL_NAMES.test(value)
+}
+
+function readDetailString(detail: string | undefined, key: string): string | undefined {
+  if (!detail?.trim()) return undefined
+  try {
+    const parsed = JSON.parse(detail) as unknown
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return undefined
+    const value = (parsed as Record<string, unknown>)[key]
+    return typeof value === 'string' && value.trim() ? value.trim() : undefined
+  } catch {
+    return undefined
+  }
+}
+
+export function isExploreToolBlock(block: ToolBlock): boolean {
+  const toolName = typeof block.meta?.toolName === 'string' ? block.meta.toolName.trim() : ''
+  if (toolName === 'explore_agent') return true
+  if (readDetailString(block.detail, 'profile') === 'explore') return true
+  const child = block.meta?.child
+  if (child && typeof child === 'object' && !Array.isArray(child)) {
+    const profile = (child as { childProfile?: unknown }).childProfile
+    if (typeof profile === 'string' && profile.trim() === 'explore') return true
+  }
+  return false
+}
+
+export function firstUsefulLine(text: string | undefined, max = 48): string | undefined {
+  if (!text?.trim()) return undefined
+  const oneLine = text.replace(/\s+/g, ' ').trim()
+  if (!oneLine || isBareSubagentToolName(oneLine)) return undefined
+  if (oneLine.length <= max) return oneLine
+  return `${oneLine.slice(0, Math.max(1, max - 1)).trimEnd()}…`
+}
+
+export function resolveExploreTaskTitle(input: {
+  childLabel?: string
+  title?: string
+  query?: string
+  summary?: string
+  blockSummary?: string
+  fallback: string
+}): string {
+  const candidates = [
+    input.childLabel,
+    input.title,
+    input.query,
+    input.summary,
+    input.blockSummary
+  ]
+  for (const candidate of candidates) {
+    const line = firstUsefulLine(candidate, 48)
+    if (line) return line
+  }
+  return input.fallback
+}
diff --git a/src/renderer/src/components/chat/explore-peek-body.test.ts b/src/renderer/src/components/chat/explore-peek-body.test.ts
new file mode 100644
index 000000000..590980bdd
--- /dev/null
+++ b/src/renderer/src/components/chat/explore-peek-body.test.ts
@@ -0,0 +1,58 @@
+import { createElement } from 'react'
+import { act, create, type ReactTestInstance, type ReactTestRenderer } from 'react-test-renderer'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { ExplorePeekBody } from './explore-peek-body'
+
+vi.mock('react-i18next', () => ({
+  initReactI18next: { type: '3rdParty', init: () => undefined },
+  useTranslation: () => ({
+    t: (key: string, fallback?: string | { defaultValue?: string }) =>
+      (typeof fallback === 'string' ? fallback : fallback?.defaultValue) ?? key
+  })
+}))
+
+describe('ExplorePeekBody', () => {
+  let renderer: ReactTestRenderer | undefined
+
+  beforeEach(() => {
+    ;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
+  })
+
+  afterEach(async () => {
+    if (renderer) await act(async () => renderer?.unmount())
+    renderer = undefined
+  })
+
+  it('keeps the full summary visible even when step rows are present', async () => {
+    const summary = [
+      '已找到完整链路。结论如下:',
+      '## 1) 设置定义',
+      '- 默认应开启失败重试'
+    ].join('\n')
+
+    await act(async () => {
+      renderer = create(createElement(ExplorePeekBody, {
+        loading: false,
+        error: null,
+        summary,
+        steps: [
+          { id: 't1', kind: 'tool', label: 'grep retry', status: 'success' },
+          { id: 't2', kind: 'tool', label: 'read settings', status: 'success' }
+        ]
+      }))
+    })
+
+    const summaryNode = renderer!.root.findByProps({ 'data-testid': 'explore-peek-summary' })
+    const stepsNode = renderer!.root.findByProps({ 'data-testid': 'explore-peek-steps' })
+    expect(instanceText(summaryNode)).toContain('已找到完整链路')
+    expect(instanceText(summaryNode)).toContain('默认应开启失败重试')
+    expect(instanceText(stepsNode)).toContain('grep retry')
+    expect(instanceText(stepsNode)).toContain('read settings')
+  })
+})
+
+function instanceText(instance: ReactTestInstance): string {
+  return instance.children
+    .map((child) => typeof child === 'string' ? child : instanceText(child))
+    .join('')
+}
diff --git a/src/renderer/src/components/chat/explore-peek-body.tsx b/src/renderer/src/components/chat/explore-peek-body.tsx
new file mode 100644
index 000000000..0fe49f50a
--- /dev/null
+++ b/src/renderer/src/components/chat/explore-peek-body.tsx
@@ -0,0 +1,79 @@
+import type { ReactElement } from 'react'
+import { Loader2 } from 'lucide-react'
+import { useTranslation } from 'react-i18next'
+import type { ExplorePeekStep } from './explore-peek-summary'
+
+/** Presentational peek body — kept free of portal/document for unit tests. */
+export function ExplorePeekBody({
+  loading,
+  error,
+  summary,
+  reasoningPreview,
+  assistantPreview,
+  steps
+}: {
+  loading: boolean
+  error: string | null
+  summary?: string
+  reasoningPreview?: string
+  assistantPreview?: string
+  steps: ExplorePeekStep[]
+}): ReactElement {
+  const { t } = useTranslation('common')
+  return (
+    <div className="min-h-0 flex-1 overflow-y-auto px-3.5 py-3">
+      {loading && steps.length === 0 && !summary?.trim() ? (
+        <div className="flex items-center gap-2 text-[12.5px] text-ds-muted">
+          <Loader2 className="h-3.5 w-3.5 animate-spin" strokeWidth={2} />
+          {t('explorePeekLoading', { defaultValue: 'Loading explore progress…' })}
+        </div>
+      ) : null}
+      {error ? (
+        <p className="text-[12.5px] text-ds-danger">{error}</p>
+      ) : null}
+      {!error && summary?.trim() ? (
+        <div
+          className="mb-3 max-h-[180px] overflow-y-auto whitespace-pre-wrap break-words rounded-[10px] border border-ds-border-muted bg-ds-card-muted/35 px-2.5 py-2 text-[13px] leading-5 text-ds-ink"
+          data-testid="explore-peek-summary"
+        >
+          {summary.trim()}
+        </div>
+      ) : null}
+      {!error && !summary?.trim() && reasoningPreview ? (
+        <p className="mb-2 whitespace-pre-wrap text-[12.5px] leading-5 text-ds-muted">
+          {reasoningPreview}
+        </p>
+      ) : null}
+      {!error && !summary?.trim() && !reasoningPreview && assistantPreview ? (
+        <p className="mb-2 whitespace-pre-wrap text-[12.5px] leading-5 text-ds-muted">
+          {assistantPreview}
+        </p>
+      ) : null}
+      {!error && steps.length > 0 ? (
+        <ul className="flex flex-col gap-1.5" data-testid="explore-peek-steps">
+          {steps.map((step) => (
+            <li
+              key={step.id}
+              className="flex items-start gap-2 rounded-[8px] bg-ds-card-muted/40 px-2 py-1.5 text-[12px] leading-4 text-ds-ink"
+            >
+              <span className="mt-0.5 shrink-0 text-[10px] font-semibold uppercase tracking-wide text-ds-faint">
+                {step.kind === 'tool' ? t('explorePeekStepTool', { defaultValue: 'Tool' })
+                  : step.kind === 'reasoning' ? t('explorePeekStepThinking', { defaultValue: 'Think' })
+                    : t('explorePeekStepReply', { defaultValue: 'Reply' })}
+              </span>
+              <span className="min-w-0 flex-1 break-words">{step.label}</span>
+              {step.status === 'running' ? (
+                <Loader2 className="mt-0.5 h-3 w-3 shrink-0 animate-spin text-accent" strokeWidth={2} />
+              ) : null}
+            </li>
+          ))}
+        </ul>
+      ) : null}
+      {!error && !loading && steps.length === 0 && !summary?.trim() && !reasoningPreview && !assistantPreview ? (
+        <p className="text-[12.5px] text-ds-faint">
+          {t('explorePeekEmpty', { defaultValue: 'Waiting for explore steps…' })}
+        </p>
+      ) : null}
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/chat/explore-peek-summary.test.ts b/src/renderer/src/components/chat/explore-peek-summary.test.ts
new file mode 100644
index 000000000..c9134c5e5
--- /dev/null
+++ b/src/renderer/src/components/chat/explore-peek-summary.test.ts
@@ -0,0 +1,113 @@
+import { describe, expect, it } from 'vitest'
+import type { ChatBlock } from '../../agent/types'
+import {
+  formatChildActivityLabel,
+  readChildActivityFromBlock,
+  summarizeExplorePeekBlocks
+} from './explore-peek-summary'
+
+describe('formatChildActivityLabel', () => {
+  it('joins label and toolName when the tool name is not already present', () => {
+    expect(formatChildActivityLabel({
+      phase: 'tool',
+      label: 'Searching the repository',
+      toolName: 'grep',
+      startedAt: '2026-08-07T00:00:00.000Z',
+      updatedAt: '2026-08-07T00:00:01.000Z'
+    })).toBe('Searching the repository · grep')
+  })
+
+  it('keeps the label alone when toolName is already embedded as a token', () => {
+    expect(formatChildActivityLabel({
+      phase: 'tool',
+      label: 'Running grep across src',
+      toolName: 'grep',
+      startedAt: '2026-08-07T00:00:00.000Z',
+      updatedAt: '2026-08-07T00:00:01.000Z'
+    })).toBe('Running grep across src')
+  })
+
+  it('does not treat a substring like Reading as the read tool name', () => {
+    expect(formatChildActivityLabel({
+      phase: 'tool',
+      label: 'Reading tool timeline UI',
+      toolName: 'read',
+      startedAt: '2026-08-07T00:00:00.000Z',
+      updatedAt: '2026-08-07T00:00:01.000Z'
+    })).toBe('Reading tool timeline UI · read')
+  })
+})
+
+describe('readChildActivityFromBlock', () => {
+  it('reads activity from tool child metadata', () => {
+    const block: ChatBlock = {
+      kind: 'tool',
+      id: 'tool_1',
+      createdAt: '2026-08-07T00:00:00.000Z',
+      summary: 'Explore voice flow',
+      status: 'running',
+      toolKind: 'tool_call',
+      meta: {
+        toolName: 'explore_agent',
+        child: {
+          childId: 'child_1',
+          parentThreadId: 'thr_parent',
+          parentTurnId: 'turn_1',
+          childStatus: 'running',
+          childSeq: 1,
+          activity: {
+            phase: 'tool',
+            label: 'Reading tool timeline UI',
+            toolName: 'read',
+            startedAt: '2026-08-07T00:00:00.000Z',
+            updatedAt: '2026-08-07T00:00:02.000Z'
+          }
+        }
+      }
+    }
+    expect(readChildActivityFromBlock(block)).toMatchObject({
+      phase: 'tool',
+      label: 'Reading tool timeline UI',
+      toolName: 'read'
+    })
+  })
+})
+
+describe('summarizeExplorePeekBlocks', () => {
+  it('keeps the latest tool and reasoning steps for the peek popover', () => {
+    const blocks: ChatBlock[] = [
+      {
+        kind: 'reasoning',
+        id: 'r1',
+        createdAt: '2026-08-07T00:00:00.000Z',
+        text: 'I will inspect the voice transcription module next.'
+      },
+      {
+        kind: 'tool',
+        id: 't1',
+        createdAt: '2026-08-07T00:00:01.000Z',
+        summary: 'grep voice',
+        status: 'success',
+        toolKind: 'tool_call',
+        meta: { toolName: 'grep' }
+      },
+      {
+        kind: 'tool',
+        id: 't2',
+        createdAt: '2026-08-07T00:00:02.000Z',
+        summary: 'read src/main/voice.ts',
+        status: 'running',
+        toolKind: 'tool_call',
+        meta: { toolName: 'read' }
+      }
+    ]
+    const peek = summarizeExplorePeekBlocks(blocks)
+    expect(peek.reasoningPreview).toContain('voice transcription')
+    expect(peek.steps.map((step) => step.id)).toEqual(['r1', 't1', 't2'])
+    expect(peek.steps.at(-1)).toMatchObject({
+      id: 't2',
+      kind: 'tool',
+      status: 'running'
+    })
+  })
+})
diff --git a/src/renderer/src/components/chat/explore-peek-summary.ts b/src/renderer/src/components/chat/explore-peek-summary.ts
new file mode 100644
index 000000000..50c139e7c
--- /dev/null
+++ b/src/renderer/src/components/chat/explore-peek-summary.ts
@@ -0,0 +1,124 @@
+import type { ChatBlock, RuntimeChildActivity, ToolBlock } from '../../agent/types'
+
+export type ExplorePeekStep = {
+  id: string
+  kind: 'tool' | 'reasoning' | 'assistant'
+  label: string
+  status?: ToolBlock['status']
+}
+
+const MAX_PEEK_STEPS = 12
+const MAX_REASONING_CHARS = 280
+
+export function formatChildActivityLabel(
+  activity: RuntimeChildActivity | undefined | null
+): string | undefined {
+  if (!activity?.label?.trim()) return undefined
+  const label = activity.label.trim()
+  const toolName = activity.toolName?.trim()
+  if (toolName && !labelMentionsToolName(label, toolName)) {
+    return `${label} · ${toolName}`
+  }
+  return label
+}
+
+function labelMentionsToolName(label: string, toolName: string): boolean {
+  const escaped = toolName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+  return new RegExp(`(?:^|[^a-z0-9_])${escaped}(?:$|[^a-z0-9_])`, 'i').test(label)
+}
+
+export function readChildActivityFromBlock(block: ChatBlock): RuntimeChildActivity | undefined {
+  if (block.kind !== 'tool' && block.kind !== 'approval') return undefined
+  const child = block.meta?.child
+  if (!child || typeof child !== 'object' || Array.isArray(child)) return undefined
+  const activity = (child as Record<string, unknown>).activity
+  if (!activity || typeof activity !== 'object' || Array.isArray(activity)) return undefined
+  const record = activity as Record<string, unknown>
+  const phase = record.phase
+  const label = typeof record.label === 'string' ? record.label.trim() : ''
+  if (!label) return undefined
+  if (
+    phase !== 'starting' &&
+    phase !== 'thinking' &&
+    phase !== 'responding' &&
+    phase !== 'tool' &&
+    phase !== 'retrying' &&
+    phase !== 'compacting' &&
+    phase !== 'waiting'
+  ) {
+    return undefined
+  }
+  return {
+    phase,
+    label,
+    ...(typeof record.toolName === 'string' && record.toolName.trim()
+      ? { toolName: record.toolName.trim() }
+      : {}),
+    startedAt: typeof record.startedAt === 'string' ? record.startedAt : '',
+    updatedAt: typeof record.updatedAt === 'string' ? record.updatedAt : ''
+  }
+}
+
+export function summarizeExplorePeekBlocks(blocks: ChatBlock[]): {
+  steps: ExplorePeekStep[]
+  reasoningPreview?: string
+  assistantPreview?: string
+} {
+  const steps: ExplorePeekStep[] = []
+  let reasoningPreview: string | undefined
+  let assistantPreview: string | undefined
+
+  for (const block of blocks) {
+    if (block.kind === 'tool') {
+      const toolName =
+        typeof block.meta?.toolName === 'string' && block.meta.toolName.trim()
+          ? block.meta.toolName.trim()
+          : 'tool'
+      const summary = block.summary?.trim()
+      steps.push({
+        id: block.id,
+        kind: 'tool',
+        label: summary && summary !== toolName ? summary : toolName,
+        status: block.status
+      })
+      continue
+    }
+    if (block.kind === 'reasoning') {
+      const text = block.text.trim()
+      if (!text) continue
+      if (!reasoningPreview) reasoningPreview = truncatePeekText(text, MAX_REASONING_CHARS)
+      steps.push({
+        id: block.id,
+        kind: 'reasoning',
+        label: truncatePeekText(text, 96)
+      })
+      continue
+    }
+    if (block.kind === 'assistant') {
+      const text = stripThinkTags(block.text).trim()
+      if (!text) continue
+      if (!assistantPreview) assistantPreview = truncatePeekText(text, MAX_REASONING_CHARS)
+      steps.push({
+        id: block.id,
+        kind: 'assistant',
+        label: truncatePeekText(text, 96)
+      })
+    }
+  }
+
+  return {
+    steps: steps.slice(-MAX_PEEK_STEPS),
+    ...(reasoningPreview ? { reasoningPreview } : {}),
+    ...(assistantPreview ? { assistantPreview } : {})
+  }
+}
+
+function stripThinkTags(text: string): string {
+  return text.replace(/<think>[\s\S]*?(?:<\/think>|$)/g, '').trim()
+}
+
+function truncatePeekText(text: string, max: number): string {
+  const oneLine = text.replace(/\s+/g, ' ').trim()
+  if (oneLine.length <= max) return oneLine
+  return `${oneLine.slice(0, Math.max(1, max - 1)).trimEnd()}…`
+}
diff --git a/src/renderer/src/components/chat/message-timeline-bubbles.tsx b/src/renderer/src/components/chat/message-timeline-bubbles.tsx
index d96aa03c6..c8c55f982 100644
--- a/src/renderer/src/components/chat/message-timeline-bubbles.tsx
+++ b/src/renderer/src/components/chat/message-timeline-bubbles.tsx
@@ -34,6 +34,7 @@ import {
   type AttachmentPreviewFailureState
 } from './attachment-preview-loader'
 import { useDeferredRender } from '../../hooks/use-deferred-render'
+import { formatTtftSeconds, formatTps } from '../../hooks/use-thread-usage'
 
 const COPY_FEEDBACK_RESET_MS = 1600
 const ASSISTANT_EXPORT_FORMATS: WriteExportFormat[] = ['pdf', 'docx', 'png', 'html']
@@ -899,16 +900,30 @@ function useMediaPreviews(
   return { resolvedPreviews, failedPreviewIds }
 }
 
+function userMediaTileClass(mediaCount: number): string {
+  const base =
+    'group block aspect-[3/2] overflow-hidden rounded-lg border border-ds-border-muted bg-ds-card shadow-sm'
+  if (mediaCount <= 1) {
+    return `${base} w-full max-w-[min(100%,20rem)]`
+  }
+  if (mediaCount <= 3) {
+    return `${base} w-[calc((100%-1rem)/3)] max-w-56 shrink-0`
+  }
+  return `${base} w-[calc((100%-1rem)/3)] max-w-56 shrink-0 snap-start`
+}
+
 function MediaPreviewTile({
   media,
   previewUrl,
   previewState,
-  variant
+  variant,
+  mediaCount = 1
 }: {
   media: TimelineMediaReference
   previewUrl?: string
   previewState?: 'loading' | 'failed'
   variant: 'user' | 'tool' | 'conversation'
+  mediaCount?: number
 }): ReactElement {
   const { t } = useTranslation('common')
   const globalWorkspaceRoot = useChatStore((s) => s.workspaceRoot)
@@ -926,9 +941,9 @@ function MediaPreviewTile({
       ? 'group aspect-square w-52 shrink-0 snap-start overflow-hidden rounded-xl border border-ds-border-muted bg-ds-card shadow-sm'
       : variant === 'tool'
         ? 'block h-32 w-40 overflow-hidden rounded-lg border border-ds-border-muted bg-ds-card shadow-sm'
-        : 'block h-28 w-36 overflow-hidden rounded-lg border border-ds-border-muted bg-ds-card shadow-sm'
+        : userMediaTileClass(mediaCount)
   const revealClass = variant === 'user' ? '' : ' ds-media-printer-reveal'
-  const mediaClass = `h-full w-full ${variant === 'conversation' ? 'object-cover' : 'object-contain'}`
+  const mediaClass = `h-full w-full ${variant === 'tool' ? 'object-contain' : 'object-cover'}`
   const canSave = !unavailable && Boolean(filePath || dataUrlPayload(previewUrl))
   const canOpenArtifact = !unavailable && Boolean(
     media.artifactId && media.ownerExtensionId && media.ownerExtensionVersion &&
@@ -991,9 +1006,11 @@ function MediaPreviewTile({
     'inline-flex h-7 items-center justify-center rounded-md border border-ds-border-muted bg-ds-card/90 px-2 text-[11.5px] font-medium text-ds-muted shadow-sm transition hover:bg-ds-hover hover:text-ds-ink disabled:cursor-not-allowed disabled:opacity-50'
   const iconButtonClass =
     `absolute right-2 top-2 inline-flex h-8 w-8 items-center justify-center rounded-md border border-ds-border-muted bg-ds-card/92 text-ds-muted shadow-sm backdrop-blur transition hover:bg-ds-hover hover:text-ds-ink disabled:cursor-not-allowed disabled:opacity-50 ${
-      variant === 'conversation'
-        ? 'opacity-0 focus-visible:opacity-100 group-hover:opacity-100'
-        : ''
+      variant === 'user'
+        ? 'h-7 w-7 opacity-0 focus-visible:opacity-100 group-hover:opacity-100'
+        : variant === 'conversation'
+          ? 'opacity-0 focus-visible:opacity-100 group-hover:opacity-100'
+          : ''
     }`
   const saveIcon = saveState === 'saving'
     ? <Loader2 className="h-3.5 w-3.5 animate-spin" strokeWidth={1.9} />
@@ -1018,19 +1035,21 @@ function MediaPreviewTile({
         >
           <img src={previewUrl} alt={title} className={mediaClass} loading="lazy" />
         </button>
-        <button
-          type="button"
-          onClick={(event) => {
-            event.stopPropagation()
-            void handleSaveAs()
-          }}
-          disabled={!canSave || saveState === 'saving'}
-          title={saveLabel}
-          aria-label={saveLabel}
-          className={iconButtonClass}
-        >
-          {saveIcon}
-        </button>
+        {variant === 'user' ? null : (
+          <button
+            type="button"
+            onClick={(event) => {
+              event.stopPropagation()
+              void handleSaveAs()
+            }}
+            disabled={!canSave || saveState === 'saving'}
+            title={saveLabel}
+            aria-label={saveLabel}
+            className={iconButtonClass}
+          >
+            {saveIcon}
+          </button>
+        )}
         <ImagePreviewLightbox
           open={imagePreviewOpen}
           src={previewUrl}
@@ -1131,6 +1150,8 @@ function MediaPreviewTile({
   )
 }
 
+const USER_MEDIA_CAROUSEL_THRESHOLD = 3
+
 function MediaAttachmentGallery({
   media,
   variant
@@ -1151,9 +1172,11 @@ function MediaAttachmentGallery({
     canScrollBackward: false,
     canScrollForward: false
   })
+  const useUserCarousel = variant === 'user' && media.length > USER_MEDIA_CAROUSEL_THRESHOLD
+  const useCarouselLayout = variant === 'conversation' || useUserCarousel
 
   useEffect(() => {
-    if (variant !== 'conversation') return
+    if (!useCarouselLayout) return
     const scroller = conversationScrollerRef.current
     if (!scroller) return
 
@@ -1183,13 +1206,10 @@ function MediaAttachmentGallery({
       scroller.removeEventListener('scroll', updateAvailability)
       resizeObserver.disconnect()
     }
-  }, [media.length, variant])
+  }, [media.length, useCarouselLayout])
 
   if (media.length === 0) return null
-  const wrapperClass =
-    variant === 'tool'
-        ? 'flex min-w-0 flex-wrap gap-2 border-t border-ds-border-muted/60 px-4 py-3'
-        : 'flex max-w-[80%] flex-wrap justify-end gap-2'
+  const wrapperClass = 'flex min-w-0 flex-wrap gap-2 border-t border-ds-border-muted/60 px-4 py-3'
 
   const tiles = media.map((item) => {
     const key = mediaKey(item)
@@ -1217,11 +1237,28 @@ function MediaAttachmentGallery({
                 : undefined
         }
         variant={variant}
+        mediaCount={media.length}
       />
     )
   })
 
-  if (variant === 'conversation') {
+  if (variant === 'user' && !useUserCarousel) {
+    return (
+      <div
+        ref={previewAdmissionRef}
+        className="relative min-w-0 w-full max-w-[80%]"
+        data-extension-attachment-context
+        data-user-media-gallery=""
+        data-user-media-count={media.length}
+      >
+        <div className="flex w-full justify-end gap-2 px-0.5 pb-1">
+          {tiles}
+        </div>
+      </div>
+    )
+  }
+
+  if (variant !== 'tool') {
     const moveCarousel = (direction: -1 | 1): void => {
       const scroller = conversationScrollerRef.current
       if (!scroller) return
@@ -1231,39 +1268,72 @@ function MediaAttachmentGallery({
       })
     }
     const showCarouselControls = scrollAvailability.canScrollBackward || scrollAvailability.canScrollForward
+    const isConversation = variant === 'conversation'
 
     return (
-      <div ref={previewAdmissionRef} className="group/gallery relative min-w-0 w-full" data-extension-attachment-context data-generated-media-carousel>
+      <div
+        ref={previewAdmissionRef}
+        className={`group/gallery relative min-w-0 ${isConversation ? 'w-full' : 'w-full max-w-[80%]'}`}
+        data-extension-attachment-context
+        {...(isConversation
+          ? { 'data-generated-media-carousel': true }
+          : { 'data-user-media-gallery': '', 'data-user-media-carousel': true, 'data-user-media-count': media.length })}
+      >
         <div
           ref={conversationScrollerRef}
           className="flex w-full snap-x snap-mandatory gap-2 overflow-x-auto px-0.5 pb-1 scroll-smooth [scrollbar-width:none] [&::-webkit-scrollbar]:hidden"
-          data-generated-media-strip
+          {...(isConversation ? { 'data-generated-media-strip': true } : {})}
         >
           {tiles}
         </div>
         {showCarouselControls ? (
-          <div className="absolute bottom-3 right-3 flex items-center gap-1.5">
-            <button
-              type="button"
-              onClick={() => moveCarousel(-1)}
-              disabled={!scrollAvailability.canScrollBackward}
-              className="inline-flex h-9 w-9 items-center justify-center rounded-full border border-white/20 bg-black/55 text-white shadow-md backdrop-blur-sm transition hover:bg-black/70 disabled:cursor-default disabled:opacity-35"
-              title={t('generatedFilesPreviousImages')}
-              aria-label={t('generatedFilesPreviousImages')}
-            >
-              <ChevronLeft className="h-5 w-5" strokeWidth={2} />
-            </button>
-            <button
-              type="button"
-              onClick={() => moveCarousel(1)}
-              disabled={!scrollAvailability.canScrollForward}
-              className="inline-flex h-9 w-9 items-center justify-center rounded-full border border-white/20 bg-black/55 text-white shadow-md backdrop-blur-sm transition hover:bg-black/70 disabled:cursor-default disabled:opacity-35"
-              title={t('generatedFilesNextImages')}
-              aria-label={t('generatedFilesNextImages')}
-            >
-              <ChevronRight className="h-5 w-5" strokeWidth={2} />
-            </button>
-          </div>
+          isConversation ? (
+            <div className="absolute bottom-3 right-3 flex items-center gap-1.5">
+              <button
+                type="button"
+                onClick={() => moveCarousel(-1)}
+                disabled={!scrollAvailability.canScrollBackward}
+                className="inline-flex h-9 w-9 items-center justify-center rounded-full border border-white/20 bg-black/55 text-white shadow-md backdrop-blur-sm transition hover:bg-black/70 disabled:cursor-default disabled:opacity-35"
+                title={t('generatedFilesPreviousImages')}
+                aria-label={t('generatedFilesPreviousImages')}
+              >
+                <ChevronLeft className="h-5 w-5" strokeWidth={2} />
+              </button>
+              <button
+                type="button"
+                onClick={() => moveCarousel(1)}
+                disabled={!scrollAvailability.canScrollForward}
+                className="inline-flex h-9 w-9 items-center justify-center rounded-full border border-white/20 bg-black/55 text-white shadow-md backdrop-blur-sm transition hover:bg-black/70 disabled:cursor-default disabled:opacity-35"
+                title={t('generatedFilesNextImages')}
+                aria-label={t('generatedFilesNextImages')}
+              >
+                <ChevronRight className="h-5 w-5" strokeWidth={2} />
+              </button>
+            </div>
+          ) : (
+            <>
+              <button
+                type="button"
+                onClick={() => moveCarousel(-1)}
+                disabled={!scrollAvailability.canScrollBackward}
+                className="absolute left-1.5 top-1/2 inline-flex h-7 w-7 -translate-y-1/2 items-center justify-center rounded-full border border-ds-border-muted bg-ds-card/92 text-ds-muted opacity-0 shadow-sm backdrop-blur transition hover:bg-ds-hover hover:text-ds-ink focus-visible:opacity-100 disabled:cursor-default disabled:opacity-0 group-hover/gallery:opacity-100"
+                title={t('generatedFilesPreviousImages')}
+                aria-label={t('generatedFilesPreviousImages')}
+              >
+                <ChevronLeft className="h-4 w-4" strokeWidth={2} />
+              </button>
+              <button
+                type="button"
+                onClick={() => moveCarousel(1)}
+                disabled={!scrollAvailability.canScrollForward}
+                className="absolute right-1.5 top-1/2 inline-flex h-7 w-7 -translate-y-1/2 items-center justify-center rounded-full border border-ds-border-muted bg-ds-card/92 text-ds-muted opacity-0 shadow-sm backdrop-blur transition hover:bg-ds-hover hover:text-ds-ink focus-visible:opacity-100 disabled:cursor-default disabled:opacity-0 group-hover/gallery:opacity-100"
+                title={t('generatedFilesNextImages')}
+                aria-label={t('generatedFilesNextImages')}
+              >
+                <ChevronRight className="h-4 w-4" strokeWidth={2} />
+              </button>
+            </>
+          )
         ) : null}
       </div>
     )
@@ -1811,6 +1881,27 @@ function formatMessageDateTime(input: string, locale: string): string {
  */
 export const MessageBubble = memo(MessageBubbleImpl)
 
+type TurnMetricsLike = {
+  avgTtftMs: number | null
+  avgTokensPerSecond: number | null
+}
+
+/**
+ * Renders a turn's average TTFT/TPS as a compact footer label. Segments with
+ * no data are omitted so legacy turns show nothing at all.
+ */
+export function turnMetricsLabel(
+  t: (key: string, options?: Record<string, unknown>) => string,
+  metrics: TurnMetricsLike
+): string {
+  const parts: string[] = []
+  const ttft = formatTtftSeconds(metrics.avgTtftMs)
+  if (ttft != null) parts.push(t('turnMetricsTtft', { value: ttft }))
+  const tps = formatTps(metrics.avgTokensPerSecond)
+  if (tps != null) parts.push(t('turnMetricsTps', { value: tps }))
+  return parts.join(' · ')
+}
+
 function MessageBubbleImpl({
   block,
   nested = false,
@@ -1832,6 +1923,7 @@ function MessageBubbleImpl({
 }): ReactElement {
   const { t, i18n } = useTranslation('common')
   const resolveApproval = useChatStore((s) => s.resolveApproval)
+  const turnTimingMetrics = useChatStore((s) => s.turnTimingMetrics)
   if (block.kind === 'user' && isBackgroundShellNoticeBlock(block)) {
     return <BackgroundShellNoticeBubble block={block} nested={nested} />
   }
@@ -1846,6 +1938,10 @@ function MessageBubbleImpl({
     const createdAtLabel = block.createdAt
       ? formatMessageDateTime(block.createdAt, i18n.language)
       : null
+    const turnMetrics =
+      !streaming && block.turnId
+        ? turnTimingMetrics.get(block.turnId)
+        : undefined
     return (
       <div className="group/message flex min-w-0 max-w-full flex-col">
         <div className="ds-markdown ds-chat-answer min-w-0 max-w-full text-ds-ink">
@@ -1853,7 +1949,17 @@ function MessageBubbleImpl({
         </div>
         {!streaming ? (
           <div className="mt-1 flex min-h-5 min-w-0 items-center justify-between gap-3 text-[11.5px] text-ds-faint opacity-0 transition duration-150 group-hover/message:opacity-100">
-            <span className="min-w-0 truncate">{createdAtLabel ?? ''}</span>
+            <span className="flex min-w-0 items-center gap-2">
+              <span className="truncate">{createdAtLabel ?? ''}</span>
+              {turnMetrics ? (
+                <span
+                  className="shrink-0 whitespace-nowrap tabular-nums"
+                  title={t('turnMetricsTitle')}
+                >
+                  {turnMetricsLabel(t, turnMetrics)}
+                </span>
+              ) : null}
+            </span>
             <div className="flex shrink-0 items-center gap-1.5">
               {rollbackAction ? (
                 <button
diff --git a/src/renderer/src/components/chat/message-timeline-empty.tsx b/src/renderer/src/components/chat/message-timeline-empty.tsx
index 8a91edc75..1bcb23c78 100644
--- a/src/renderer/src/components/chat/message-timeline-empty.tsx
+++ b/src/renderer/src/components/chat/message-timeline-empty.tsx
@@ -233,16 +233,22 @@ export function ThreadForkBanner({ parentTitle }: { parentTitle: string }): Reac
  */
 export function SubagentReturnBar({
   parentTitle,
-  onBack
+  onBack,
+  variant = 'subagent'
 }: {
   parentTitle: string
   onBack: () => void
+  /** Explore child sessions get stronger "process / back to main" copy. */
+  variant?: 'explore' | 'subagent'
 }): ReactElement {
   const { t } = useTranslation('common')
+  const isExplore = variant === 'explore'
   return (
     <button
       type="button"
       onClick={onBack}
+      data-testid="subagent-return-bar"
+      data-variant={variant}
       className="group ds-chat-content-max-width flex w-full items-center gap-3 rounded-[16px] border border-accent/16 bg-accent/7 px-4 py-3 text-left text-ds-muted shadow-[0_14px_36px_rgba(59,130,216,0.05)] transition hover:bg-accent/12"
     >
       <span className="flex h-8 w-8 shrink-0 items-center justify-center rounded-[12px] bg-accent/12 text-accent">
@@ -250,17 +256,30 @@ export function SubagentReturnBar({
       </span>
       <span className="min-w-0 flex-1">
         <span className="block text-[13.5px] font-semibold text-ds-ink">
-          {t('subagentSessionBannerTitle')}
+          {isExplore
+            ? t('exploreSessionBannerTitle', { defaultValue: 'Viewing explore process' })
+            : t('subagentSessionBannerTitle')}
         </span>
         <span className="mt-1 block truncate text-[12.5px] leading-5 text-ds-muted">
           {parentTitle
-            ? t('subagentSessionBannerSub', { title: parentTitle })
-            : t('subagentSessionBannerSubUnknown')}
+            ? (isExplore
+              ? t('exploreSessionBannerSub', {
+                title: parentTitle,
+                defaultValue: 'Exploring for “{{title}}”. Return to the main chat anytime.'
+              })
+              : t('subagentSessionBannerSub', { title: parentTitle }))
+            : (isExplore
+              ? t('exploreSessionBannerSubUnknown', {
+                defaultValue: 'Exploring in a side session. Return to the main chat anytime.'
+              })
+              : t('subagentSessionBannerSubUnknown'))}
         </span>
       </span>
       <span className="flex shrink-0 items-center gap-1.5 rounded-[10px] bg-accent/10 px-2.5 py-1.5 text-[12px] font-semibold text-accent transition group-hover:bg-accent/15">
         <CornerUpLeft className="h-3.5 w-3.5" strokeWidth={2} />
-        {t('subagentSessionBannerBack')}
+        {isExplore
+          ? t('exploreSessionBannerBack', { defaultValue: 'Back to main chat' })
+          : t('subagentSessionBannerBack')}
       </span>
     </button>
   )
diff --git a/src/renderer/src/components/chat/message-timeline-process.subagent.test.ts b/src/renderer/src/components/chat/message-timeline-process.subagent.test.ts
new file mode 100644
index 000000000..8f9646aee
--- /dev/null
+++ b/src/renderer/src/components/chat/message-timeline-process.subagent.test.ts
@@ -0,0 +1,61 @@
+import { describe, expect, it } from 'vitest'
+import type { ChatBlock } from '../../agent/types'
+import { isSubagentBlock } from './message-timeline-process'
+
+describe('isSubagentBlock', () => {
+  it('recognizes explore_agent even before child metadata arrives', () => {
+    const block: ChatBlock = {
+      kind: 'tool',
+      id: 'tool_explore',
+      createdAt: '2026-08-07T00:00:00.000Z',
+      summary: 'explore_agent',
+      status: 'running',
+      toolKind: 'tool_call',
+      meta: { toolName: 'explore_agent' }
+    }
+    expect(isSubagentBlock(block)).toBe(true)
+  })
+
+  it('still recognizes delegate_task and child-bearing tools', () => {
+    expect(isSubagentBlock({
+      kind: 'tool',
+      id: 'tool_delegate',
+      createdAt: '2026-08-07T00:00:00.000Z',
+      summary: 'delegate_task',
+      status: 'running',
+      toolKind: 'tool_call',
+      meta: { toolName: 'delegate_task' }
+    })).toBe(true)
+
+    expect(isSubagentBlock({
+      kind: 'tool',
+      id: 'tool_child',
+      createdAt: '2026-08-07T00:00:00.000Z',
+      summary: 'custom',
+      status: 'running',
+      toolKind: 'tool_call',
+      meta: {
+        toolName: 'custom_tool',
+        child: {
+          childId: 'child_1',
+          parentThreadId: 'thr',
+          parentTurnId: 'turn',
+          childStatus: 'running',
+          childSeq: 1
+        }
+      }
+    })).toBe(true)
+  })
+
+  it('does not treat ordinary tools as subagent cards', () => {
+    expect(isSubagentBlock({
+      kind: 'tool',
+      id: 'tool_grep',
+      createdAt: '2026-08-07T00:00:00.000Z',
+      summary: 'grep',
+      status: 'running',
+      toolKind: 'tool_call',
+      meta: { toolName: 'grep' }
+    })).toBe(false)
+  })
+})
diff --git a/src/renderer/src/components/chat/message-timeline-process.tsx b/src/renderer/src/components/chat/message-timeline-process.tsx
index 226a09684..a97cd1190 100644
--- a/src/renderer/src/components/chat/message-timeline-process.tsx
+++ b/src/renderer/src/components/chat/message-timeline-process.tsx
@@ -1,5 +1,5 @@
 import type { KeyboardEvent as ReactKeyboardEvent, MouseEvent as ReactMouseEvent, ReactElement, RefObject } from 'react'
-import { useState } from 'react'
+import { useEffect, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import type { LucideIcon } from 'lucide-react'
 import {
@@ -19,6 +19,7 @@ import {
   BellRing,
   Search,
   Sparkles,
+  Square,
   Terminal,
   Wrench
 } from 'lucide-react'
@@ -41,8 +42,10 @@ import {
   formatDuration,
   formatToolTitle,
   isBackgroundShellCommandBlock,
+  parseToolBlockPayload,
   summarizeBackgroundShellToolBlock
 } from './message-timeline-tools'
+import { isExploreToolBlock } from './explore-card-copy'
 import { SubagentGroup, type OpenChildThreadHandler } from './SubagentCallCard'
 import { InjectedMemoryMetaChip } from './injected-memory-meta-chip'
 
@@ -61,7 +64,11 @@ export function isSubagentBlock(block: ChatBlock): boolean {
   const meta = block.meta
   if (meta?.child && typeof meta.child === 'object') return true
   const toolName = typeof meta?.toolName === 'string' ? meta.toolName.trim() : ''
-  return toolName === 'delegate_task' || toolName === 'generate_subagent'
+  return (
+    toolName === 'delegate_task' ||
+    toolName === 'generate_subagent' ||
+    toolName === 'explore_agent'
+  )
 }
 
 function processBlockHasGeneratedMedia(block: ChatBlock): block is ToolBlock {
@@ -83,16 +90,31 @@ function subagentParentTurnId(block: ChatBlock): string {
   return ''
 }
 
+function isExploreSubagentBlock(block: ChatBlock): boolean {
+  return block.kind === 'tool' && isExploreToolBlock(block)
+}
+
+function sectionHasExploreBlock(section: ProcessSection): boolean {
+  return section.blocks.some(isExploreSubagentBlock)
+}
+
 export function groupProcessSections(blocks: ChatBlock[]): ProcessSection[] {
   const sections: ProcessSection[] = []
 
   for (const block of blocks) {
     if (isSubagentBlock(block)) {
       const last = sections[sections.length - 1]
-      // Coalesce sibling delegations of one turn (same parentTurnId) into one
-      // swarm section. Blocks without a parentTurnId only merge with an
-      // adjacent parentTurnId-less subagent run.
-      if (last && last.kind === 'subagent') {
+      // Coalesce sibling non-explore delegations of one turn (same parentTurnId)
+      // into one swarm section. Explore cards stay independent so they never
+      // land under an "N subagents" swarm shell.
+      // Blocks without a parentTurnId only merge with an adjacent
+      // parentTurnId-less non-explore subagent run.
+      if (
+        last &&
+        last.kind === 'subagent' &&
+        !isExploreSubagentBlock(block) &&
+        !sectionHasExploreBlock(last)
+      ) {
         const lastParent = subagentParentTurnId(last.blocks[0])
         const parent = subagentParentTurnId(block)
         if (lastParent === parent) {
@@ -272,6 +294,7 @@ export function ProcessSectionRow({
   workspaceRoot,
   viewportRef,
   onOpenChildThread,
+  onCancelToolCall,
   allowThreadActions = true
 }: {
   section: ProcessSection
@@ -281,6 +304,7 @@ export function ProcessSectionRow({
   workspaceRoot: string
   viewportRef: RefObject<HTMLDivElement | null>
   onOpenChildThread?: OpenChildThreadHandler
+  onCancelToolCall?: (block: ToolBlock) => Promise<boolean>
   allowThreadActions?: boolean
 }): ReactElement {
   const { t } = useTranslation('common')
@@ -342,6 +366,7 @@ export function ProcessSectionRow({
           block={block}
           processing={processing}
           workspaceRoot={workspaceRoot}
+          onCancelToolCall={onCancelToolCall}
           allowThreadActions={allowThreadActions}
         />
       )
@@ -432,6 +457,7 @@ export function ProcessSectionRow({
               blocks={section.blocks}
               processing={processing}
               workspaceRoot={workspaceRoot}
+              onCancelToolCall={onCancelToolCall}
               allowThreadActions={allowThreadActions}
             />
           )
@@ -505,15 +531,95 @@ function BackgroundSubagentRowSummary({
   )
 }
 
+function toolCancelCallId(block: ChatBlock): string {
+  if (block.kind !== 'tool') return ''
+  const callId = block.meta?.callId
+  return typeof callId === 'string' ? callId.trim() : ''
+}
+
+function toolCancelRequested(block: ChatBlock): boolean {
+  if (block.kind !== 'tool') return false
+  return typeof block.meta?.cancelRequestedAt === 'string' && block.meta.cancelRequestedAt.trim().length > 0
+}
+
+function canCancelToolBlock(block: ChatBlock, processing: boolean): block is ToolBlock {
+  if (!processing || block.kind !== 'tool' || block.status !== 'running' || !toolCancelCallId(block)) return false
+  // Detached/background work owns its own lifecycle and must keep using its
+  // existing control surface rather than the foreground tool cancellation API.
+  if (block.meta?.detached === true || isBackgroundShellCommandBlock(block) || isSubagentBlock(block)) {
+    return false
+  }
+  return true
+}
+
+function ToolCancelButton({
+  block,
+  processing,
+  onCancelToolCall
+}: {
+  block: ChatBlock
+  processing: boolean
+  onCancelToolCall?: (block: ToolBlock) => Promise<boolean>
+}): ReactElement | null {
+  const { t } = useTranslation('common')
+  const [requested, setRequested] = useState(() => toolCancelRequested(block))
+  const cancellable = canCancelToolBlock(block, processing)
+  const blockStatus = block.kind === 'tool' ? block.status : undefined
+  const blockCancelRequestedAt = block.kind === 'tool' && typeof block.meta?.cancelRequestedAt === 'string'
+    ? block.meta.cancelRequestedAt
+    : undefined
+  const cancelRequested = toolCancelRequested(block)
+
+  useEffect(() => {
+    setRequested(cancelRequested)
+  }, [block.id, blockStatus, blockCancelRequestedAt, cancelRequested])
+
+  if (!cancellable || !onCancelToolCall) return null
+  const stopping = requested || toolCancelRequested(block)
+  const handleClick = (event: ReactMouseEvent<HTMLButtonElement>): void => {
+    event.preventDefault()
+    event.stopPropagation()
+    if (stopping) return
+    setRequested(true)
+    void onCancelToolCall(block).then((accepted) => {
+      if (!accepted) setRequested(false)
+    }).catch(() => {
+      setRequested(false)
+    })
+  }
+
+  return (
+    <button
+      type="button"
+      aria-label={stopping ? t('toolCancelling') : t('toolCancel')}
+      title={stopping ? t('toolCancelling') : t('toolCancel')}
+      aria-busy={stopping}
+      disabled={stopping}
+      onClick={handleClick}
+      className={`mt-0.5 flex h-7 w-7 shrink-0 items-center justify-center rounded-md transition ${
+        stopping ? 'cursor-wait text-accent opacity-80' : 'text-ds-faint hover:bg-ds-hover/70 hover:text-ds-ink'
+      }`}
+    >
+      {stopping ? (
+        <LoaderCircle className="h-3.5 w-3.5 animate-spin" strokeWidth={1.9} />
+      ) : (
+        <Square className="h-3 w-3" fill="currentColor" strokeWidth={1.9} />
+      )}
+    </button>
+  )
+}
+
 function ProcessStackRows({
   blocks,
   processing,
   workspaceRoot,
+  onCancelToolCall,
   allowThreadActions = true
 }: {
   blocks: ChatBlock[]
   processing: boolean
   workspaceRoot: string
+  onCancelToolCall?: (block: ToolBlock) => Promise<boolean>
   allowThreadActions?: boolean
 }): ReactElement {
   const { t } = useTranslation('common')
@@ -617,6 +723,7 @@ function ProcessStackRows({
                   )}
                 </button>
               ) : null}
+              <ToolCancelButton block={block} processing={processing} onCancelToolCall={onCancelToolCall} />
             </div>
             {open ? (
               detail.kind === 'assistant' ? (
@@ -813,11 +920,13 @@ function ProcessEntryRow({
   block,
   processing,
   workspaceRoot,
+  onCancelToolCall,
   allowThreadActions = true
 }: {
   block: ChatBlock
   processing: boolean
   workspaceRoot: string
+  onCancelToolCall?: (block: ToolBlock) => Promise<boolean>
   allowThreadActions?: boolean
 }): ReactElement {
   const { t } = useTranslation('common')
@@ -926,6 +1035,7 @@ function ProcessEntryRow({
             )}
           </button>
         ) : null}
+        <ToolCancelButton block={block} processing={processing} onCancelToolCall={onCancelToolCall} />
       </div>
       <RuntimeMetaBadges block={block} t={t} />
       {canExpand && open ? (
@@ -1495,6 +1605,19 @@ export function summarizeToolBlock(
     return summarizeBackgroundShellToolBlock(block, t)
   }
 
+  if (toolName === 'explore_agent') {
+    const payload = parseToolBlockPayload(block)
+    const title =
+      (typeof payload.title === 'string' && payload.title.trim() ? payload.title.trim() : undefined) ||
+      (block.meta?.child && typeof block.meta.child === 'object'
+        ? (typeof (block.meta.child as { childLabel?: unknown }).childLabel === 'string'
+          ? (block.meta.child as { childLabel: string }).childLabel.trim()
+          : undefined)
+        : undefined)
+    if (title) return `${label} ${summarizeProcessText(title, 72)}`
+    return label
+  }
+
   if ((toolName === 'read_file' || toolName === 'read') && filePath) {
     return `${label} ${filePath}`
   }
diff --git a/src/renderer/src/components/chat/use-voice-dictation.ts b/src/renderer/src/components/chat/use-voice-dictation.ts
index e5a7429a4..7d66266b4 100644
--- a/src/renderer/src/components/chat/use-voice-dictation.ts
+++ b/src/renderer/src/components/chat/use-voice-dictation.ts
@@ -1,6 +1,7 @@
 import { useCallback, useEffect, useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import {
+  CUSTOM_SPEECH_TO_TEXT_PROVIDER_ID,
   resolveKunSpeechToTextSettings,
   getKunRuntimeSettings,
   type AppSettingsV1,
@@ -9,6 +10,11 @@ import {
 } from '@shared/app-settings'
 import { SPEECH_TRANSCRIPTION_MAX_DURATION_MS } from '@shared/speech-to-text'
 import { SETTINGS_CHANGED_EVENT } from '../../lib/keyboard-shortcut-settings'
+import {
+  connectionCredentialStateById,
+  fetchSharedModelConnectionCredentialStates,
+  providerHasUsableCredential
+} from '../../lib/provider-credential-readiness'
 
 export type VoiceDictationStatus = 'idle' | 'recording' | 'transcribing'
 
@@ -19,14 +25,68 @@ const TRANSCRIPTION_SAMPLE_RATE = 16_000
 const MIN_RECORDING_MS = 500
 const RECORDER_MIME_CANDIDATES = ['audio/webm;codecs=opus', 'audio/webm', 'audio/mp4']
 
+export type SpeechToTextSettingsState = {
+  speechToText: KunSpeechToTextSettingsV1 | null
+  /** True when the bound shared provider has usable Registry credentials. */
+  credentialReady: boolean
+}
+
+function speechProviderCredentialReady(
+  speechToText: KunSpeechToTextSettingsV1 | null,
+  connectionUsable: boolean
+): boolean {
+  if (!speechToText) return false
+  if (speechToText.apiKey.trim()) return true
+  const providerId = speechToText.providerId.trim()
+  if (!providerId || providerId === CUSTOM_SPEECH_TO_TEXT_PROVIDER_ID) return false
+  if (
+    speechToText.protocol === 'local-whisper' ||
+    speechToText.protocol === 'gemini-cli-audio'
+  ) {
+    return false
+  }
+  return connectionUsable
+}
+
 /** Resolved speech-to-text settings, kept in sync with the settings screen. */
-export function useSpeechToTextSettings(): KunSpeechToTextSettingsV1 | null {
+export function useSpeechToTextSettings(): SpeechToTextSettingsState {
   const [speechToText, setSpeechToText] = useState<KunSpeechToTextSettingsV1 | null>(null)
+  const [credentialReady, setCredentialReady] = useState(false)
 
   useEffect(() => {
     let cancelled = false
+    const refreshCredentialReady = (next: KunSpeechToTextSettingsV1): void => {
+      const providerId = next.providerId.trim()
+      if (
+        !providerId ||
+        providerId === CUSTOM_SPEECH_TO_TEXT_PROVIDER_ID ||
+        next.protocol === 'local-whisper' ||
+        next.protocol === 'gemini-cli-audio' ||
+        next.apiKey.trim()
+      ) {
+        if (!cancelled) {
+          setCredentialReady(speechProviderCredentialReady(next, false))
+        }
+        return
+      }
+      void fetchSharedModelConnectionCredentialStates()
+        .then((states) => {
+          if (cancelled) return
+          const usable = providerHasUsableCredential(
+            { id: providerId, apiKey: next.apiKey },
+            connectionCredentialStateById(states, providerId)
+          )
+          setCredentialReady(speechProviderCredentialReady(next, usable))
+        })
+        .catch(() => {
+          if (!cancelled) setCredentialReady(false)
+        })
+    }
     const apply = (settings: AppSettingsV1): void => {
-      if (!cancelled) setSpeechToText(resolveKunSpeechToTextSettings(settings))
+      if (cancelled) return
+      const resolved = resolveKunSpeechToTextSettings(settings)
+      setSpeechToText(resolved)
+      refreshCredentialReady(resolved)
     }
     if (typeof window.kunGui?.getSettings === 'function') {
       void window.kunGui.getSettings().then(apply).catch(() => undefined)
@@ -41,7 +101,7 @@ export function useSpeechToTextSettings(): KunSpeechToTextSettingsV1 | null {
     }
   }, [])
 
-  return speechToText
+  return { speechToText, credentialReady }
 }
 
 export function usePromptOptimizationSettings(): KunPromptOptimizationSettingsV1 | null {
diff --git a/src/renderer/src/components/graph/GraphModePanel.test.ts b/src/renderer/src/components/graph/GraphModePanel.test.ts
index c0b75152c..7aec99720 100644
--- a/src/renderer/src/components/graph/GraphModePanel.test.ts
+++ b/src/renderer/src/components/graph/GraphModePanel.test.ts
@@ -19,6 +19,7 @@ import {
   graphElements,
   GRAPH_DASHBOARD_SNAPSHOT_REFRESH_INTERVAL_MS,
   graphDashboardNeedsSnapshotRefresh,
+  graphProjectionOwnedByThread,
   plannedAssignmentLabel,
   runProgress,
   selectGraphPlanningDraft,
@@ -27,6 +28,18 @@ import {
 import { reconcileInteractiveGraphNodes } from './graph-canvas-state'
 import { clampGraphInspectorWidth } from './graph-workspace-layout'
 
+const graphClient = vi.hoisted(() => ({
+  listRuns: vi.fn(),
+  listDrafts: vi.fn(),
+  delegationDiagnostics: vi.fn()
+}))
+
+vi.mock('../../graph/graph-runtime-client', () => ({
+  graphRuntimeClient: graphClient
+}))
+
+import { useGraphStore } from '../../graph/graph-store'
+
 function node(id: string, phaseId: string): GraphPlanNode {
   return {
     id,
@@ -144,24 +157,70 @@ function SnapshotRefreshHarness({
   return null
 }
 
+/**
+ * Drives the real #1072 poll gate from store state — must not hard-code shouldRefresh.
+ */
+function StoreDrivenSnapshotRefreshHarness({
+  active,
+  sourceGraphTurnActive = false
+}: {
+  active: boolean
+  sourceGraphTurnActive?: boolean
+}): null {
+  const threadId = useGraphStore((state) => state.threadId)
+  const runs = useGraphStore((state) => state.runs)
+  const drafts = useGraphStore((state) => state.drafts)
+  const refreshThread = useGraphStore((state) => state.refreshThread)
+  const shouldRefresh = graphDashboardNeedsSnapshotRefresh(
+    runs,
+    drafts,
+    sourceGraphTurnActive
+  )
+  useGraphDashboardSnapshotRefresh({
+    active,
+    threadId,
+    shouldRefresh,
+    refreshThread
+  })
+  return null
+}
+
 describe('Graph Mode panel projection', () => {
   afterEach(() => {
     vi.useRealTimers()
   })
 
-  it('reconciles nonterminal Graph work and an active source turn even before a run is visible', () => {
+  it('keeps the v0.2.35 snapshot poll contract independent of SSE live status', () => {
     const liveRun = graphRun([node('work', 'phase_1')], [])
-    const terminalRun = { ...liveRun, status: 'completed' as const }
+    const completed = { ...liveRun, status: 'completed' as const }
+    const failed = { ...liveRun, status: 'failed' as const }
+    const cancelled = { ...liveRun, status: 'cancelled' as const }
     const pausedRun = { ...liveRun, status: 'paused' as const }
+    const awaitingHuman = { ...liveRun, status: 'awaiting_human' as const }
 
+    // Non-terminal + SSE live must still poll (silent event bridge failure path).
     expect(graphDashboardNeedsSnapshotRefresh([liveRun], [], false)).toBe(true)
-    expect(graphDashboardNeedsSnapshotRefresh([terminalRun], [], false)).toBe(false)
-    expect(graphDashboardNeedsSnapshotRefresh([pausedRun], [], false)).toBe(false)
+    expect(graphDashboardNeedsSnapshotRefresh([pausedRun], [], false)).toBe(true)
+    expect(graphDashboardNeedsSnapshotRefresh([awaitingHuman], [], false)).toBe(true)
+
+    // Hard terminals without live drafts / source turn stop poll.
+    expect(graphDashboardNeedsSnapshotRefresh([completed], [], false)).toBe(false)
+    expect(graphDashboardNeedsSnapshotRefresh([failed], [], false)).toBe(false)
+    expect(graphDashboardNeedsSnapshotRefresh([cancelled], [], false)).toBe(false)
+
+    // Planning draft / source turn still force poll with no runs.
     expect(graphDashboardNeedsSnapshotRefresh([], [planningDraft('draft_1', 'planning')], false))
       .toBe(true)
     expect(graphDashboardNeedsSnapshotRefresh([], [], true)).toBe(true)
   })
 
+  it('gates rendered projection on store thread ownership', () => {
+    expect(graphProjectionOwnedByThread('thread_a', 'thread_a')).toBe(true)
+    expect(graphProjectionOwnedByThread('thread_a', 'thread_b')).toBe(false)
+    expect(graphProjectionOwnedByThread(null, 'thread_b')).toBe(false)
+    expect(graphProjectionOwnedByThread('thread_b', null)).toBe(false)
+  })
+
   it('polls durable Graph snapshots without overlapping requests and stops when hidden', async () => {
     vi.useFakeTimers()
     const resolveRefreshes: Array<() => void> = []
@@ -224,6 +283,64 @@ describe('Graph Mode panel projection', () => {
     await act(async () => renderer.unmount())
   })
 
+  it('covers fully missed SSE by low-frequency snapshot fallback (seq 2 → 5, fake timers)', async () => {
+    vi.useFakeTimers()
+    graphClient.listDrafts.mockResolvedValue([])
+    graphClient.delegationDiagnostics.mockResolvedValue({
+      enabled: true,
+      active: 0,
+      childRuns: []
+    })
+    const runAt = (seq: number): GraphRun => ({
+      ...graphRun([node('work', 'phase_1')], []),
+      lastEventSeq: seq,
+      status: 'running'
+    })
+
+    useGraphStore.setState({
+      threadId: 'thread_1',
+      runs: [runAt(2)],
+      drafts: [],
+      childRuns: {},
+      syncStatus: 'live',
+      threadEventSeq: 40,
+      loading: false,
+      error: null
+    })
+    // Gate must be true from real contract math — not a hard-coded shouldRefresh.
+    expect(graphDashboardNeedsSnapshotRefresh(
+      useGraphStore.getState().runs,
+      useGraphStore.getState().drafts,
+      false
+    )).toBe(true)
+    expect(useGraphStore.getState().syncStatus).toBe('live')
+    expect(useGraphStore.getState().runs[0]?.lastEventSeq).toBe(2)
+
+    graphClient.listRuns.mockResolvedValue([runAt(5)])
+
+    let renderer!: ReactTestRenderer
+    await act(async () => {
+      renderer = createRenderer(createElement(StoreDrivenSnapshotRefreshHarness, {
+        active: true
+      }))
+    })
+
+    await act(async () => {
+      vi.advanceTimersByTime(GRAPH_DASHBOARD_SNAPSHOT_REFRESH_INTERVAL_MS)
+      await Promise.resolve()
+      await Promise.resolve()
+    })
+
+    await vi.waitFor(() => {
+      expect(useGraphStore.getState().runs[0]?.lastEventSeq).toBe(5)
+    })
+    expect(graphClient.listRuns).toHaveBeenCalled()
+    // No SSE Graph events were delivered; snapshot alone converged the projection.
+    expect(useGraphStore.getState().syncStatus).toBe('live')
+
+    await act(async () => renderer.unmount())
+  })
+
   it('never lets a terminal host error hide the current run or create a second error surface', () => {
     const hostError = planningDraft('draft_failed', 'host_error')
     const correction = planningDraft('draft_active', 'needs_correction')
diff --git a/src/renderer/src/components/graph/GraphModePanel.tsx b/src/renderer/src/components/graph/GraphModePanel.tsx
index 114d85eee..39df35f5a 100644
--- a/src/renderer/src/components/graph/GraphModePanel.tsx
+++ b/src/renderer/src/components/graph/GraphModePanel.tsx
@@ -9,7 +9,8 @@ import { useTranslation } from 'react-i18next'
 import { useChatStore } from '../../store/chat-store'
 import { openGraphChildThread } from '../../graph/graph-child-navigation'
 import { useGraphStore } from '../../graph/graph-store'
-import type { GraphPlanningDraftView, GraphRun } from '../../graph/graph-types'
+import { useGraphThreadObserver } from '../../graph/use-graph-thread-observer'
+import type { GraphPlanningDraftView, GraphRun, GraphRunStatus } from '../../graph/graph-types'
 import { GraphAgentsView } from './GraphAgentsView'
 import { GraphLearningView } from './GraphLearningView'
 import { GraphPlanningCard } from './GraphPlanningCard'
@@ -35,16 +36,17 @@ type View = 'run' | 'agents' | 'learning'
 
 export const GRAPH_DASHBOARD_SNAPSHOT_REFRESH_INTERVAL_MS = 5_000
 
-const liveGraphRunStatuses = new Set<GraphRun['status']>([
-  'draft',
-  'validating',
-  'ready',
-  'running',
-  'pausing',
-  'awaiting_supervision',
-  'completing'
+/** Hard terminal Graph run statuses — only these may stop fallback polling. */
+export const GRAPH_RUN_TERMINAL_STATUSES = new Set<GraphRunStatus>([
+  'completed',
+  'failed',
+  'cancelled'
 ])
 
+export function graphRunStatusIsTerminal(status: GraphRunStatus): boolean {
+  return GRAPH_RUN_TERMINAL_STATUSES.has(status)
+}
+
 const livePlanningDraftStatuses = new Set<GraphPlanningDraftView['draft']['status']>([
   'planning',
   'validating',
@@ -52,14 +54,30 @@ const livePlanningDraftStatuses = new Set<GraphPlanningDraftView['draft']['statu
   'committing'
 ])
 
+/**
+ * v0.2.35 / #1072 contract: while any non-terminal run, live planning draft, or
+ * active Graph source turn exists, poll durable snapshots every 5s — independent
+ * of SSE syncStatus. Live SSE is the low-latency path; HTTP snapshot is the
+ * reliability backstop when the event bridge is silently stuck.
+ */
 export function graphDashboardNeedsSnapshotRefresh(
   runs: readonly Pick<GraphRun, 'status'>[],
   drafts: readonly Pick<GraphPlanningDraftView, 'draft'>[],
   sourceGraphTurnActive: boolean
 ): boolean {
-  return sourceGraphTurnActive ||
-    runs.some((run) => liveGraphRunStatuses.has(run.status)) ||
-    drafts.some((draft) => livePlanningDraftStatuses.has(draft.draft.status))
+  if (sourceGraphTurnActive) return true
+  if (drafts.some((draft) => livePlanningDraftStatuses.has(draft.draft.status))) {
+    return true
+  }
+  return runs.some((run) => !graphRunStatusIsTerminal(run.status))
+}
+
+/** True only when the store binding matches the panel's target thread. */
+export function graphProjectionOwnedByThread(
+  storeThreadId: string | null,
+  graphThreadId: string | null
+): boolean {
+  return Boolean(graphThreadId) && storeThreadId === graphThreadId
 }
 
 export function useGraphDashboardSnapshotRefresh({
@@ -125,9 +143,10 @@ export function GraphModePanel({
   const [view, setView] = useState<View>('run')
   const [steering, setSteering] = useState('')
   const {
-    runs,
-    drafts,
-    childRuns,
+    threadId: storeThreadId,
+    runs: storeRuns,
+    drafts: storeDrafts,
+    childRuns: storeChildRuns,
     childReturnTarget,
     selectedRunId,
     selectedNodeId,
@@ -144,6 +163,7 @@ export function GraphModePanel({
     identity,
     loading,
     error,
+    syncStatus,
     refreshThread,
     refreshProject,
     refreshSelectedRun,
@@ -175,14 +195,24 @@ export function GraphModePanel({
   const graphThreadId = childReturnTarget?.childThreadId === activeThreadId
     ? childReturnTarget.parentThreadId
     : activeThreadId
+  // Render gate: never show thread-A projection under thread-B before bind runs.
+  const projectionOwned = graphProjectionOwnedByThread(storeThreadId, graphThreadId)
+  const runs = projectionOwned ? storeRuns : []
+  const drafts = projectionOwned ? storeDrafts : []
+  const childRuns = projectionOwned ? storeChildRuns : {}
   const sourceGraphTurnActive = graphThreadId === activeThreadId &&
     threadBusy && currentTurnOrchestration === 'graph'
+  // Polling decision uses owned projection only; syncStatus is display-only.
   const shouldRefreshSnapshot = graphDashboardNeedsSnapshotRefresh(
     runs,
     drafts,
     sourceGraphTurnActive
   )
 
+  // Independent of chat busy: Graph SSE keeps projecting after Lead settles.
+  // Ownership is atomic via bindGraphThread (not effect order with refreshThread).
+  useGraphThreadObserver(graphThreadId, active)
+
   useEffect(() => {
     if (!active) return
     void refreshThread(graphThreadId)
@@ -199,7 +229,9 @@ export function GraphModePanel({
     void refreshProject(workspaceRoot)
   }, [refreshProject, workspaceRoot])
 
-  const run = runs.find((item) => item.id === selectedRunId) ?? runs[0] ?? null
+  const run = projectionOwned
+    ? (runs.find((item) => item.id === selectedRunId) ?? runs[0] ?? null)
+    : null
   const planningDraft = selectGraphPlanningDraft(drafts, Boolean(run))
   const selectedNode = run && selectedNodeId ? run.nodes[selectedNodeId] : undefined
   const canvasFocusRequestKey = run && selectedNodeId
@@ -271,6 +303,18 @@ export function GraphModePanel({
             </div>
             <div className="truncate text-[10px] text-ds-faint">
               {identity?.source.replaceAll('_', ' ') ?? 'project orchestration'}
+              {syncStatus === 'live'
+                ? ` · ${t('graphObserver_live')}`
+                : null}
+              {syncStatus === 'connecting'
+                ? ` · ${t('graphObserver_connecting')}`
+                : null}
+              {syncStatus === 'reconnecting'
+                ? ` · ${t('graphObserver_reconnecting')}`
+                : null}
+              {syncStatus === 'stopped'
+                ? ` · ${t('graphObserver_stopped')}`
+                : null}
             </div>
           </div>
         </div>
diff --git a/src/renderer/src/components/settings-controls.tsx b/src/renderer/src/components/settings-controls.tsx
index 4586c9e78..685c85e9a 100644
--- a/src/renderer/src/components/settings-controls.tsx
+++ b/src/renderer/src/components/settings-controls.tsx
@@ -6,7 +6,7 @@ import {
   type ReactElement,
   type ReactNode
 } from 'react'
-import { ChevronDown, Eye, EyeOff, type LucideIcon } from 'lucide-react'
+import { ChevronDown, Eye, EyeOff, Loader2, type LucideIcon } from 'lucide-react'
 
 export type InlineNotice = {
   tone: 'success' | 'error' | 'info'
@@ -21,6 +21,7 @@ export function SecretInput({
   placeholder,
   autoComplete,
   invalid = false,
+  toggleBusy = false,
   showLabel,
   hideLabel,
   className = ''
@@ -32,6 +33,7 @@ export function SecretInput({
   placeholder?: string
   autoComplete?: string
   invalid?: boolean
+  toggleBusy?: boolean
   showLabel: string
   hideLabel: string
   className?: string
@@ -57,9 +59,15 @@ export function SecretInput({
         aria-label={visible ? hideLabel : showLabel}
         title={visible ? hideLabel : showLabel}
         onClick={onToggleVisibility}
-        className="shrink-0 border-l border-ds-border-muted px-3 text-ds-muted transition hover:bg-ds-hover hover:text-ds-ink"
+        disabled={toggleBusy}
+        aria-busy={toggleBusy}
+        className="shrink-0 border-l border-ds-border-muted px-3 text-ds-muted transition hover:bg-ds-hover hover:text-ds-ink disabled:cursor-wait disabled:opacity-60"
       >
-        {visible ? <EyeOff className="h-4 w-4" strokeWidth={1.75} /> : <Eye className="h-4 w-4" strokeWidth={1.75} />}
+        {toggleBusy
+          ? <Loader2 className="h-4 w-4 animate-spin" strokeWidth={1.75} />
+          : visible
+            ? <EyeOff className="h-4 w-4" strokeWidth={1.75} />
+            : <Eye className="h-4 w-4" strokeWidth={1.75} />}
       </button>
     </div>
   )
diff --git a/src/renderer/src/components/settings-section-image-generation.tsx b/src/renderer/src/components/settings-section-image-generation.tsx
index bb3c2905c..2d3719e95 100644
--- a/src/renderer/src/components/settings-section-image-generation.tsx
+++ b/src/renderer/src/components/settings-section-image-generation.tsx
@@ -8,6 +8,11 @@ import {
   IMAGE_GENERATION_RESOLUTIONS,
   resolveKunImageGenerationSettings
 } from '@shared/app-settings'
+import {
+  fetchSharedModelConnectionCredentialStates,
+  shouldWarnMissingProviderCredential,
+  type SharedConnectionCredentialState
+} from '../lib/provider-credential-readiness'
 import { InlineNoticeView, ModelSelect, SecretInput, SettingsCard, SettingRow, Toggle } from './settings-controls'
 
 const DEFAULT_IMAGE_GENERATION = {
@@ -76,9 +81,28 @@ export function ImageGenerationSettingsSection({ ctx }: { ctx: Record<string, an
     : selectedProviderImage?.models ?? []
   const [showImageGenApiKey, setShowImageGenApiKey] = useState(false)
   const [defaultSizeInput, setDefaultSizeInput] = useState(imageGeneration.defaultSize)
+  const [connectionCredentials, setConnectionCredentials] = useState<SharedConnectionCredentialState[] | null>(null)
+  const warnMissingImageProviderKey = shouldWarnMissingProviderCredential({
+    usingCustomProvider,
+    provider: selectedImageProvider,
+    connectionCredentials
+  })
   useEffect(() => {
     setDefaultSizeInput(imageGeneration.defaultSize)
   }, [imageGeneration.defaultSize])
+  useEffect(() => {
+    let cancelled = false
+    void fetchSharedModelConnectionCredentialStates()
+      .then((states) => {
+        if (!cancelled) setConnectionCredentials(states)
+      })
+      .catch(() => {
+        if (!cancelled) setConnectionCredentials([])
+      })
+    return () => {
+      cancelled = true
+    }
+  }, [])
   const updateImageGeneration = (patch: Record<string, unknown>): void => {
     updateKun({
       imageGeneration: {
@@ -133,7 +157,7 @@ export function ImageGenerationSettingsSection({ ctx }: { ctx: Record<string, an
                   ))}
                   <option value={CUSTOM_IMAGE_GENERATION_PROVIDER_ID}>{t('imageGenProviderCustom')}</option>
                 </select>
-                {!usingCustomProvider && !selectedImageProvider?.apiKey?.trim() ? (
+                {warnMissingImageProviderKey ? (
                   <p className="mt-2 text-[12px] text-amber-700 dark:text-amber-300">
                     {t('imageGenProviderMissingKey', { provider: selectedImageProvider?.name ?? selectedProviderId })}
                   </p>
diff --git a/src/renderer/src/components/settings-section-media-generation.tsx b/src/renderer/src/components/settings-section-media-generation.tsx
index 9f2d1e387..dda14449d 100644
--- a/src/renderer/src/components/settings-section-media-generation.tsx
+++ b/src/renderer/src/components/settings-section-media-generation.tsx
@@ -1,4 +1,4 @@
-import { useState, type ReactElement } from 'react'
+import { useEffect, useState, type ReactElement } from 'react'
 import { AudioLines, Image as ImageIcon, Music2, Video } from 'lucide-react'
 import {
   CUSTOM_MUSIC_GENERATION_PROVIDER_ID,
@@ -11,6 +11,11 @@ import {
   TEXT_TO_SPEECH_PROTOCOLS,
   VIDEO_GENERATION_PROTOCOLS
 } from '@shared/app-settings'
+import {
+  fetchSharedModelConnectionCredentialStates,
+  shouldWarnMissingProviderCredential,
+  type SharedConnectionCredentialState
+} from '../lib/provider-credential-readiness'
 import {
   ModelSelect,
   SecretInput,
@@ -113,6 +118,21 @@ export function MediaGenerationSettingsSection({ ctx }: { ctx: Record<string, an
   const [showMusicApiKey, setShowMusicApiKey] = useState(false)
   const [showVideoApiKey, setShowVideoApiKey] = useState(false)
   const [activeTab, setActiveTab] = useState<MediaGenerationTab>('image')
+  const [connectionCredentials, setConnectionCredentials] = useState<SharedConnectionCredentialState[] | null>(null)
+
+  useEffect(() => {
+    let cancelled = false
+    void fetchSharedModelConnectionCredentialStates()
+      .then((states) => {
+        if (!cancelled) setConnectionCredentials(states)
+      })
+      .catch(() => {
+        if (!cancelled) setConnectionCredentials([])
+      })
+    return () => {
+      cancelled = true
+    }
+  }, [])
 
   const updateTextToSpeech = (patch: Record<string, unknown>): void => {
     updateKun({
@@ -230,6 +250,7 @@ export function MediaGenerationSettingsSection({ ctx }: { ctx: Record<string, an
               missingKeyKey: 'textToSpeechProviderMissingKey',
               setting: textToSpeech,
               defaultProtocol: DEFAULT_TEXT_TO_SPEECH_PROTOCOL,
+              connectionCredentials,
               update: updateTextToSpeech
             })}
             {selectedTts.usingCustom ? (
@@ -319,6 +340,7 @@ export function MediaGenerationSettingsSection({ ctx }: { ctx: Record<string, an
               missingKeyKey: 'musicGenerationProviderMissingKey',
               setting: musicGeneration,
               defaultProtocol: DEFAULT_MUSIC_GENERATION_PROTOCOL,
+              connectionCredentials,
               update: updateMusicGeneration
             })}
             {selectedMusic.usingCustom ? (
@@ -396,6 +418,7 @@ export function MediaGenerationSettingsSection({ ctx }: { ctx: Record<string, an
               missingKeyKey: 'videoGenerationProviderMissingKey',
               setting: videoGeneration,
               defaultProtocol: DEFAULT_VIDEO_GENERATION_PROTOCOL,
+              connectionCredentials,
               update: updateVideoGeneration
             })}
             {selectedVideo.usingCustom ? (
@@ -535,8 +558,14 @@ function renderProviderRow(input: {
   missingKeyKey: string
   setting: { baseUrl: string; apiKey: string; protocol: string; model: string }
   defaultProtocol: string
+  connectionCredentials: SharedConnectionCredentialState[] | null
   update: (patch: Record<string, unknown>) => void
 }): ReactElement {
+  const warnMissingKey = shouldWarnMissingProviderCredential({
+    usingCustomProvider: input.selected.usingCustom,
+    provider: input.selected.provider,
+    connectionCredentials: input.connectionCredentials
+  })
   return (
     <SettingRow
       title={input.title}
@@ -568,7 +597,7 @@ function renderProviderRow(input: {
             ))}
             <option value={input.customProviderId}>{input.customLabel}</option>
           </select>
-          {!input.selected.usingCustom && !input.selected.provider?.apiKey?.trim() ? (
+          {warnMissingKey ? (
             <p className="mt-2 text-[12px] text-amber-700 dark:text-amber-300">
               {input.t(input.missingKeyKey, {
                 provider: input.selected.provider?.name ?? input.selected.providerId
diff --git a/src/renderer/src/components/settings-section-providers.test.ts b/src/renderer/src/components/settings-section-providers.test.ts
index d1ca167ea..a7cf40e07 100644
--- a/src/renderer/src/components/settings-section-providers.test.ts
+++ b/src/renderer/src/components/settings-section-providers.test.ts
@@ -1,4 +1,4 @@
-import { createElement } from 'react'
+import { createElement, useState } from 'react'
 import {
   act,
   create as createRenderer,
@@ -9,9 +9,11 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import {
   defaultKunRuntimeSettings,
   defaultModelProviderSettings,
+  modelProviderTokenPlanProfile,
   type ModelProviderModelProfileV1,
   type ModelProviderProfileV1
 } from '@shared/app-settings'
+import { MODEL_PROVIDER_PRESETS } from '@shared/model-provider-presets'
 import {
   ProvidersSettingsSection,
   applyPendingSharedProviderCatalog,
@@ -20,6 +22,9 @@ import {
   createSharedModelMutationQueue,
   deleteSharedModelConnection,
   fenceSharedModelConnectionCredential,
+  kunProviderSelectionPatch,
+  modelProvidersSettingsPatch,
+  nonEmptyModelId,
   projectSharedModelConnections,
   rebasePendingSharedProviderCatalog,
   reconcilePendingSharedProviderCatalogs,
@@ -47,6 +52,58 @@ const textModelProfile: ModelProviderModelProfileV1 = {
   messageParts: ['text']
 }
 
+describe('provider settings patch model sanitization', () => {
+  it('omits empty agents.kun.model so settings:set cannot receive Too small', () => {
+    const provider = defaultModelProviderSettings()
+    const patch = modelProvidersSettingsPatch({
+      provider,
+      providers: provider.providers,
+      kun: { providerId: 'opencode-go', model: '' }
+    })
+
+    expect(patch.agents?.kun).toEqual({
+      providerId: 'opencode-go',
+      apiKey: '',
+      baseUrl: ''
+    })
+    expect(patch.agents?.kun).not.toHaveProperty('model')
+  })
+
+  it('keeps a non-empty primary model on the kun selection patch', () => {
+    const provider = defaultModelProviderSettings()
+    const patch = modelProvidersSettingsPatch({
+      provider,
+      providers: provider.providers,
+      kun: { providerId: 'opencode-go', model: 'grok-4.5' }
+    })
+
+    expect(patch.agents?.kun).toMatchObject({
+      providerId: 'opencode-go',
+      model: 'grok-4.5'
+    })
+  })
+
+  it('builds selection patches that skip blank model ids', () => {
+    expect(nonEmptyModelId('')).toBeUndefined()
+    expect(nonEmptyModelId('  ')).toBeUndefined()
+    expect(nonEmptyModelId('grok-4.5')).toBe('grok-4.5')
+    expect(kunProviderSelectionPatch({ providerId: 'custom', model: '' })).toEqual({
+      providerId: 'custom'
+    })
+    expect(kunProviderSelectionPatch({
+      providerId: 'opencode-go',
+      model: nonEmptyModelId('') ?? nonEmptyModelId('')
+    })).toEqual({ providerId: 'opencode-go' })
+    expect(kunProviderSelectionPatch({
+      providerId: 'opencode-go',
+      model: nonEmptyModelId('') ?? 'glm-5.2'
+    })).toEqual({
+      providerId: 'opencode-go',
+      model: 'glm-5.2'
+    })
+  })
+})
+
 describe('shared model connection API-key setup status', () => {
   it('treats missing and unreadable protected credentials as unavailable', () => {
     expect(sharedModelConnectionHasUsableCredential({ configured: true })).toBe(true)
@@ -548,6 +605,105 @@ describe('pending shared model connection catalogs', () => {
     expect(applyPendingSharedProviderCatalog(committedWithRemote, rebased).models)
       .toEqual(['old-model', 'remote-model', 'model-a', 'model-b'])
   })
+
+  it('retains a pending Aliyun Token Plan catalog when the registry has not connected yet (#1117)', () => {
+    const aliyunPreset = MODEL_PROVIDER_PRESETS.find((preset) => preset.id === 'aliyun')
+    expect(aliyunPreset).toBeTruthy()
+    const tokenPlan = modelProviderTokenPlanProfile(aliyunPreset!, 'sk-token-plan')
+    const fetchedModels = ['qwen-plus', 'qwen-max', 'qwen-turbo']
+    const current = defaultModelProviderSettings()
+    current.providers.push({
+      ...tokenPlan,
+      models: fetchedModels,
+      modelProfiles: Object.fromEntries(fetchedModels.map((model) => [model, textModelProfile]))
+    })
+    const pendingCatalog = {
+      generation: 1,
+      baseModels: [...tokenPlan.models],
+      baseModelProfiles: structuredClone(tokenPlan.modelProfiles),
+      localModels: fetchedModels,
+      localModelProfiles: Object.fromEntries(fetchedModels.map((model) => [model, textModelProfile])),
+      committedRevision: null
+    }
+
+    const projected = projectSharedModelConnections(
+      current,
+      { schemaVersion: 1, revision: 2, providers: [] },
+      new Map(),
+      new Map(),
+      new Map([[tokenPlan.id, pendingCatalog]])
+    )
+
+    expect(projected.provider.providers.find((item) => item.id === tokenPlan.id)).toMatchObject({
+      models: fetchedModels
+    })
+  })
+
+  it('connects then commits a catalog when the shared connection is missing (#1117)', async () => {
+    const aliyunPreset = MODEL_PROVIDER_PRESETS.find((preset) => preset.id === 'aliyun')
+    expect(aliyunPreset).toBeTruthy()
+    const tokenPlan = modelProviderTokenPlanProfile(aliyunPreset!, 'sk-token-plan')
+    const fetchedModels = ['qwen-plus', 'qwen-max']
+    const pendingCatalog = {
+      generation: 2,
+      baseModels: [...tokenPlan.models],
+      baseModelProfiles: structuredClone(tokenPlan.modelProfiles),
+      localModels: fetchedModels,
+      localModelProfiles: Object.fromEntries(fetchedModels.map((model) => [model, textModelProfile])),
+      committedRevision: null
+    }
+    const emptySnapshot = { schemaVersion: 1 as const, revision: 3, providers: [] as [] }
+    const connectedSnapshot = {
+      schemaVersion: 1 as const,
+      revision: 4,
+      providers: [{
+        id: tokenPlan.id,
+        accountId: `account:${tokenPlan.id}`,
+        name: tokenPlan.name,
+        kind: 'http' as const,
+        authType: 'api-key' as const,
+        baseUrl: tokenPlan.baseUrl,
+        endpointFormat: tokenPlan.endpointFormat,
+        configured: true,
+        models: fetchedModels,
+        modelCapabilities: Object.fromEntries(fetchedModels.map((model) => [model, {
+          id: model,
+          ...textModelProfile
+        }])),
+        selectedModel: fetchedModels[0]
+      }]
+    }
+    const runtimeRequest = vi.fn()
+      .mockResolvedValueOnce({ ok: true, status: 200, body: JSON.stringify(emptySnapshot) })
+      .mockResolvedValueOnce({ ok: true, status: 200, body: JSON.stringify(connectedSnapshot) })
+    vi.stubGlobal('window', { kunGui: { runtimeRequest } })
+
+    try {
+      await expect(commitSharedModelConnectionCatalog(
+        tokenPlan.id,
+        pendingCatalog,
+        () => false,
+        { provider: tokenPlan, credential: 'sk-token-plan' }
+      )).resolves.toMatchObject({ revision: 4 })
+
+      expect(runtimeRequest.mock.calls.map(([path, method]) => [path, method])).toEqual([
+        ['/v1/model-connections', 'GET'],
+        ['/v1/model-connections/connect', 'POST']
+      ])
+      const connectBody = JSON.parse(runtimeRequest.mock.calls[1]![2] as string) as {
+        id: string
+        models: string[]
+        credential: string
+      }
+      expect(connectBody).toMatchObject({
+        id: tokenPlan.id,
+        models: fetchedModels,
+        credential: 'sk-token-plan'
+      })
+    } finally {
+      vi.unstubAllGlobals()
+    }
+  })
 })
 
 describe('shared model connection credential replacement', () => {
@@ -996,7 +1152,7 @@ describe('shared model connection settings projection', () => {
     })
   })
 
-  it('clears the GUI default when the last shared connection is removed', () => {
+  it('clears the GUI provider without emitting an invalid empty model', () => {
     const projected = projectSharedModelConnections(defaultModelProviderSettings(), {
       schemaVersion: 1,
       revision: 5,
@@ -1006,7 +1162,7 @@ describe('shared model connection settings projection', () => {
       localModelGateway: { enabled: false }
     })
 
-    expect(projected.kun).toEqual({ providerId: '', model: '' })
+    expect(projected.kun).toEqual({ providerId: '' })
   })
 
   it('does not restore a provider while its canonical deletion is pending', () => {
@@ -1032,7 +1188,7 @@ describe('shared model connection settings projection', () => {
     }, new Map([['custom-provider-2', { generation: 1, committedRevision: 8 }]]))
 
     expect(projected.provider.providers.map((provider) => provider.id)).toEqual(['deepseek'])
-    expect(projected.kun).toEqual({ providerId: '', model: '' })
+    expect(projected.kun).toEqual({ providerId: '' })
   })
 })
 
@@ -1255,6 +1411,58 @@ describe('provider mutation lifecycle across settings remounts', () => {
     expect(rendererText(renderer)).not.toContain('credential_unreadable')
   })
 
+  it('reveals a protected credential on demand and clears it when hidden again', async () => {
+    const { settings, provider } = providerFixture('deepseek')
+    const runtimeRequest = vi.fn(async (path: string) => {
+      if (path.includes('/events?')) return new Promise<never>(() => undefined)
+      return { ok: true, status: 200, body: JSON.stringify(snapshotFor(provider, 1)) }
+    })
+    const revealModelProviderCredential = vi.fn(async (providerId: string) => ({
+      providerId,
+      credential: 'sk-protected-secret'
+    }))
+    Object.assign(window.kunGui, { runtimeRequest, revealModelProviderCredential })
+    const ctx = contextFor(settings, provider)
+    const Harness = () => {
+      const [showApiKey, setShowApiKey] = useState(false)
+      return createElement(ProvidersSettingsSection, {
+        ctx: { ...ctx, showApiKey, setShowApiKey }
+      })
+    }
+    let renderer!: ReactTestRenderer
+    await act(async () => {
+      renderer = createRenderer(createElement(Harness))
+    })
+    mountedRenderers.push(renderer)
+    await flush()
+
+    const hiddenInput = renderer.root.findAllByType('input')
+      .find((input) => input.props.type === 'password')
+    expect(hiddenInput?.props.value).toBe('')
+    expect(hiddenInput?.props.placeholder).toBe('••••••••••••')
+    const showButton = renderer.root.findAllByType('button')
+      .find((button) => button.props['aria-label'] === 'showSecret')
+    expect(showButton).toBeTruthy()
+    await act(async () => showButton!.props.onClick())
+    await flush()
+
+    const revealedInput = renderer.root.findAllByType('input')
+      .find((input) => input.props.type === 'text' && input.props.value === 'sk-protected-secret')
+    expect(revealedInput).toBeTruthy()
+    expect(revealModelProviderCredential).toHaveBeenCalledWith('deepseek')
+
+    const hideButton = renderer.root.findAllByType('button')
+      .find((button) => button.props['aria-label'] === 'hideSecret')
+    expect(hideButton).toBeTruthy()
+    await act(async () => hideButton!.props.onClick())
+    await flush()
+
+    const rehiddenInput = renderer.root.findAllByType('input')
+      .find((input) => input.props.type === 'password')
+    expect(rehiddenInput?.props.value).toBe('')
+    expect(rehiddenInput?.props.placeholder).toBe('••••••••••••')
+  })
+
   it('keeps a credential generation through unmount and clears it after the adopted commit', async () => {
     const { settings, provider } = providerFixture()
     let registryRevision = 1
diff --git a/src/renderer/src/components/settings-section-providers.tsx b/src/renderer/src/components/settings-section-providers.tsx
index 620fe36e0..39268a179 100644
--- a/src/renderer/src/components/settings-section-providers.tsx
+++ b/src/renderer/src/components/settings-section-providers.tsx
@@ -97,10 +97,14 @@ import {
   Toggle,
   type InlineNotice
 } from './settings-controls'
+import { sharedModelConnectionHasUsableCredential } from '../lib/provider-credential-readiness'
+
+export { sharedModelConnectionHasUsableCredential } from '../lib/provider-credential-readiness'
 import {
   drainSharedProviderCatalogMutation,
   drainSharedProviderCredentialMutation,
   enqueueSharedModelMutation,
+  hasInFlightSharedProviderCatalogMutation,
   replaceMapContents,
   sharedProviderMutationCoordinator,
   stageSharedProviderCredentialMutation,
@@ -139,14 +143,9 @@ type SharedModelConnectionsSnapshot = {
   localModelGateway?: { enabled: boolean }
 }
 
-export function sharedModelConnectionHasUsableCredential(
-  connection: Pick<SharedModelConnection, 'configured' | 'credentialStatus'> | undefined
-): boolean {
-  return Boolean(
-    connection?.configured &&
-    connection.credentialStatus !== 'missing' &&
-    connection.credentialStatus !== 'unreadable'
-  )
+type ProjectedKunSelectionPatch = {
+  providerId: string
+  model?: string
 }
 
 export function sharedProviderSetupNeedsApiKey(
@@ -196,6 +195,7 @@ function SharedDefaultModelPicker({
   const triggerRef = useRef<HTMLButtonElement>(null)
   const searchRef = useRef<HTMLInputElement>(null)
   const [open, setOpen] = useState(false)
+  const [placement, setPlacement] = useState<'down' | 'up'>('down')
   const [activeProviderId, setActiveProviderId] = useState('')
   const [query, setQuery] = useState('')
   const providers = useMemo(() => snapshot?.providers ?? [], [snapshot?.providers])
@@ -282,6 +282,18 @@ function SharedDefaultModelPicker({
           aria-expanded={open}
           disabled={!snapshot || providers.length === 0}
           onClick={() => {
+            if (!open) {
+              // 该区块靠近页面底部,下方空间不足时向上展开,避免弹层被视口裁切
+              const rect = triggerRef.current?.getBoundingClientRect()
+              if (rect) {
+                const spaceBelow = window.innerHeight - rect.bottom
+                const spaceAbove = rect.top
+                const panelHeight = Math.min(420, window.innerHeight * 0.7)
+                setPlacement(
+                  spaceBelow < panelHeight && spaceAbove > spaceBelow ? 'up' : 'down'
+                )
+              }
+            }
             setQuery('')
             setOpen((current) => !current)
           }}
@@ -306,7 +318,9 @@ function SharedDefaultModelPicker({
           <div
             role="dialog"
             aria-label={zh ? '选择默认模型' : 'Choose default model'}
-            className="absolute left-0 top-full z-40 mt-2 grid w-full min-w-0 grid-cols-1 overflow-hidden rounded-2xl border border-ds-border bg-ds-card shadow-xl shadow-black/10 sm:grid-cols-[minmax(190px,0.8fr)_minmax(260px,1.2fr)] dark:shadow-black/35"
+            className={`absolute left-0 z-40 grid max-h-[70vh] w-full min-w-0 grid-cols-1 overflow-hidden rounded-2xl border border-ds-border bg-ds-card shadow-xl shadow-black/10 sm:grid-cols-[minmax(190px,0.8fr)_minmax(260px,1.2fr)] dark:shadow-black/35 ${
+              placement === 'up' ? 'bottom-full mb-2' : 'top-full mt-2'
+            }`}
           >
             <div className="min-w-0 border-b border-ds-border-muted p-2 sm:border-b-0 sm:border-r">
               <div className="px-2 pb-1.5 pt-1 text-[11px] font-semibold text-ds-faint">
@@ -709,18 +723,56 @@ export function rebasePendingSharedProviderCatalog(
   }
 }
 
+export type SharedModelConnectionCatalogConnectSource = {
+  provider: ModelProviderProfileV1
+  credential?: string
+}
+
 export async function commitSharedModelConnectionCatalog(
   providerId: string,
   pending: PendingSharedProviderCatalog,
-  isProviderTombstoned: (providerId: string) => boolean = () => false
+  isProviderTombstoned: (providerId: string) => boolean = () => false,
+  connectSource?: SharedModelConnectionCatalogConnectSource
 ): Promise<SharedModelConnectionsSnapshot> {
   let snapshot = await requestSharedModelConnections('/v1/model-connections')
   for (let attempt = 0; attempt < 2; attempt += 1) {
     if (isProviderTombstoned(providerId)) {
       throw new Error(`Shared model connection ${providerId} is pending deletion`)
     }
-    const connection = snapshot.providers.find((item) => item.id === providerId)
-    if (!connection) throw new Error(`Shared model connection ${providerId} is no longer available`)
+    let connection = snapshot.providers.find((item) => item.id === providerId)
+    if (!connection) {
+      // Fetch/import can stage a catalog before syncOnce has connected the
+      // provider (common for Aliyun Token Plan). Connect with the pending
+      // catalog instead of leaving an orphan that SSE later reverts (#1117).
+      if (!connectSource) {
+        throw new Error(`Shared model connection ${providerId} is no longer available`)
+      }
+      try {
+        snapshot = await connectSharedModelConnectionWithCatalog(
+          snapshot,
+          connectSource.provider,
+          pending,
+          connectSource.credential
+        )
+      } catch (error) {
+        if (!(error instanceof SharedModelConnectionConflictError) || attempt === 1) throw error
+        snapshot = error.snapshot
+        continue
+      }
+      connection = snapshot.providers.find((item) => item.id === providerId)
+      if (!connection) {
+        throw new Error(`Shared model connection ${providerId} is no longer available`)
+      }
+      if (
+        JSON.stringify(connection.models) === JSON.stringify(pending.localModels) &&
+        sameCatalogCapabilities(
+          connection.modelCapabilities,
+          catalogCapabilities(pending.localModels, pending.localModelProfiles)
+        )
+      ) {
+        return snapshot
+      }
+    }
     const catalog = applyPendingSharedProviderCatalog(connection, pending)
     try {
       return await requestSharedModelConnections(
@@ -736,6 +788,35 @@ export async function commitSharedModelConnectionCatalog(
   return snapshot
 }
 
+async function connectSharedModelConnectionWithCatalog(
+  snapshot: SharedModelConnectionsSnapshot,
+  provider: ModelProviderProfileV1,
+  pending: PendingSharedProviderCatalog,
+  credential?: string
+): Promise<SharedModelConnectionsSnapshot> {
+  const baseUrlOptional =
+    provider.kind === 'agent-sdk' ||
+    provider.kind === 'antigravity-cli' ||
+    provider.kind === 'cursor-sdk'
+  const resolvedCredential = (credential ?? provider.apiKey).trim()
+  const selectedModel = pending.localModels[0]
+  return await requestSharedModelConnections('/v1/model-connections/connect', 'POST', {
+    expectedRevision: snapshot.revision,
+    id: provider.id,
+    name: provider.name.trim() || provider.id,
+    kind: provider.kind ?? 'http',
+    authType: isSubscriptionProvider(provider) ? 'subscription' : 'api-key',
+    ...(baseUrlOptional ? {} : { baseUrl: provider.baseUrl }),
+    endpointFormat: provider.endpointFormat,
+    ...(resolvedCredential ? { credential: resolvedCredential } : {}),
+    models: pending.localModels,
+    modelCapabilities: catalogCapabilities(pending.localModels, pending.localModelProfiles),
+    ...(selectedModel ? { selectedModel } : {}),
+    probe: false,
+    select: false
+  })
+}
+
 export async function replaceSharedModelConnectionCredential(
   providerId: string,
   credential: string,
@@ -928,7 +1009,7 @@ export function projectSharedModelConnections(
   pendingCatalogs: Pick<ReadonlyMap<string, PendingSharedProviderCatalog>, 'get'> = new Map()
 ): {
   provider: Pick<ModelProviderSettingsV1, 'providers' | 'proxy' | 'routePools' | 'localGateway'>
-  kun: Pick<KunRuntimeSettingsV1, 'providerId' | 'model'>
+  kun: ProjectedKunSelectionPatch
 } {
   const existingById = new Map(current.providers.map((item) => [item.id, item]))
   const visibleConnections = snapshot.providers.filter((connection) =>
@@ -962,15 +1043,34 @@ export function projectSharedModelConnections(
         : sharedModelProfiles(connection, existing)
     }
   })
-  // AppSettings keeps a normalized DeepSeek editor as its legacy fallback.
-  // When the canonical registry intentionally has no DeepSeek profile, retain
-  // that local placeholder without treating it as a connected profile.
-  const compatibilityDefault = !visibleConnections.some((entry) => entry.id === DEFAULT_MODEL_PROVIDER_ID)
-    ? existingById.get(DEFAULT_MODEL_PROVIDER_ID)
-    : undefined
-  const providers = compatibilityDefault
-    ? [compatibilityDefault, ...projectedProviders]
-    : projectedProviders
+  // Keep local-only providers that are not yet in the registry (or are waiting
+  // on a catalog commit). Without this, SSE projections drop freshly fetched
+  // Aliyun Token Plan catalogs before connect finishes (#1117).
+  const projectedIds = new Set(projectedProviders.map((provider) => provider.id))
+  const retainedLocalProviders = current.providers
+    .filter((provider) => {
+      if (projectedIds.has(provider.id)) return false
+      if (pendingDeletions.get(provider.id) != null) return false
+      if (provider.id === DEFAULT_MODEL_PROVIDER_ID) return true
+      return pendingCatalogs.get(provider.id) != null
+    })
+    .map((provider) => {
+      const pendingCatalog = pendingCatalogs.get(provider.id)
+      if (!pendingCatalog) return provider
+      return {
+        ...provider,
+        models: [...pendingCatalog.localModels],
+        modelProfiles: structuredClone(pendingCatalog.localModelProfiles)
+      }
+    })
+  const providers = [...retainedLocalProviders, ...projectedProviders]
+  const defaultProviderId = snapshot.defaultProviderId?.trim()
+  const defaultModel = snapshot.defaultModel?.trim()
+  const hasUsableDefault = Boolean(
+    defaultProviderId &&
+    defaultModel &&
+    pendingDeletions.get(defaultProviderId)?.committedRevision == null
+  )
   return {
     provider: {
       providers,
@@ -981,16 +1081,9 @@ export function projectSharedModelConnections(
         enabled: snapshot.localModelGateway?.enabled ?? current.localGateway.enabled
       }
     },
-    kun: {
-      providerId: snapshot.defaultProviderId &&
-        pendingDeletions.get(snapshot.defaultProviderId)?.committedRevision == null
-        ? snapshot.defaultProviderId
-        : '',
-      model: snapshot.defaultProviderId &&
-        pendingDeletions.get(snapshot.defaultProviderId)?.committedRevision == null
-        ? snapshot.defaultModel ?? ''
-        : ''
-    }
+    kun: hasUsableDefault
+      ? { providerId: defaultProviderId!, model: defaultModel! }
+      : { providerId: '' }
   }
 }
 
@@ -1130,6 +1223,27 @@ const SUBSCRIPTION_REGION_TABS: Array<{
   { id: 'united-states', labelKey: 'modelProviderSubscriptionRegionUnitedStates' }
 ]
 
+/** Primary chat model ids must be non-empty for settings:set (modelIdSchema). */
+export function nonEmptyModelId(value: string | undefined | null): string | undefined {
+  const trimmed = typeof value === 'string' ? value.trim() : ''
+  return trimmed || undefined
+}
+
+/**
+ * Build a kun selection patch that never emits `model: ''`, which Zod rejects
+ * as `Too small: expected string to have >= 1 characters`.
+ */
+export function kunProviderSelectionPatch(input: {
+  providerId: string
+  model?: string | null
+}): KunRuntimeSettingsPatchV1 {
+  const model = nonEmptyModelId(input.model)
+  return {
+    providerId: input.providerId,
+    ...(model ? { model } : {})
+  }
+}
+
 export function modelProvidersSettingsPatch(input: {
   provider: ModelProviderSettingsV1
   providers: ModelProviderProfileV1[]
@@ -1145,8 +1259,13 @@ export function modelProvidersSettingsPatch(input: {
   const baseKunPatch = input.kun?.providerId?.trim()
     ? { ...input.kun, apiKey: '', baseUrl: '' }
     : input.kun ?? {}
+  const { model: rawModel, ...kunWithoutModel } = baseKunPatch as KunRuntimeSettingsPatchV1 & {
+    model?: string
+  }
+  const model = nonEmptyModelId(rawModel)
   const kunPatch = {
-    ...baseKunPatch,
+    ...kunWithoutModel,
+    ...(model ? { model } : {}),
     ...(miniMaxMediaDefaults ?? {})
   }
   return {
@@ -2449,6 +2568,13 @@ export function ProvidersSettingsSection({ ctx }: { ctx: Record<string, any> }):
         .map(([providerId, pending]) => [providerId, pending.credential])
     )
   )
+  const [revealedCredential, setRevealedCredential] = useState<{
+    providerId: string
+    credential: string
+  } | null>(null)
+  const [credentialRevealPendingProviderId, setCredentialRevealPendingProviderId] = useState('')
+  const [credentialRevealError, setCredentialRevealError] = useState('')
+  const credentialRevealGeneration = useRef(0)
   const enqueueSharedMutation = enqueueSharedModelMutation
   const sharedProjectionInput = useRef({ provider, kun, update, form })
   sharedProjectionInput.current = { provider, kun, update, form }
@@ -2535,6 +2661,15 @@ export function ProvidersSettingsSection({ ctx }: { ctx: Record<string, any> }):
   const activeProvider =
     displayProviders.find((item) => item.id === selectedProviderId) ??
     modelProviders[0]
+  const activeProviderIdRef = useRef(activeProvider?.id ?? '')
+  activeProviderIdRef.current = activeProvider?.id ?? ''
+  useEffect(() => {
+    credentialRevealGeneration.current += 1
+    setShowApiKey(false)
+    setRevealedCredential(null)
+    setCredentialRevealPendingProviderId('')
+    setCredentialRevealError('')
+  }, [activeProvider?.id, setShowApiKey])
   const sharedConnectionFor = (providerId: string): SharedModelConnection | undefined =>
     sharedConnections?.providers.find((connection) => connection.id === providerId)
   const hasConfiguredCredential = (provider: ModelProviderProfileV1): boolean =>
@@ -2595,6 +2730,12 @@ export function ProvidersSettingsSection({ ctx }: { ctx: Record<string, any> }):
             snapshot,
             pendingSharedProviderCatalogs.current
           ))
+          // Skip AppSettings writes while a catalog commit owns the queue so a
+          // stale registry snapshot cannot revert an in-flight Token Plan fetch
+          // (#1117). SharedConnections UI state above still refreshes.
+          if (hasInFlightSharedProviderCatalogMutation()) {
+            return
+          }
           const projected = projectSharedModelConnections(
             current.provider,
             snapshot,
@@ -2602,10 +2743,11 @@ export function ProvidersSettingsSection({ ctx }: { ctx: Record<string, any> }):
             pendingSharedProviderNames.current,
             pendingSharedProviderCatalogs.current
           )
+          const effectiveProjectedModel = projected.kun.model ?? current.kun.model
           const fingerprint = sharedSettingsFingerprint({
             providers: projected.provider.providers,
             providerId: projected.kun.providerId,
-            model: projected.kun.model,
+            model: effectiveProjectedModel,
             proxy: projected.provider.proxy,
             routePools: projected.provider.routePools,
             localGateway: projected.provider.localGateway
@@ -2717,6 +2859,12 @@ export function ProvidersSettingsSection({ ctx }: { ctx: Record<string, any> }):
         const selectedModel = item.models.includes(latestKun.model) ? latestKun.model : item.models[0]
         if (!existing) {
           if (pendingSharedProviderDeletions.current.has(item.id)) continue
+          // Renderer projections redact apiKey to ''. Connecting without a
+          // credential creates an authoritative empty Registry shell that
+          // shadows legacy bindings and leaves the supplier stuck on
+          // "needs configuration". Keyless kinds (CLI/SDK) may still connect.
+          // Credential-bearing connects happen via the staged credential drain.
+          if (modelProviderRequiresApiKey(item) && !item.apiKey.trim()) continue
           snapshot = await requestSharedModelConnections('/v1/model-connections/connect', 'POST', {
             expectedRevision: snapshot.revision,
             id: item.id,
@@ -2857,16 +3005,21 @@ export function ProvidersSettingsSection({ ctx }: { ctx: Record<string, any> }):
   ])
 
   const selectSharedModel = async (connection: SharedModelConnection, model: string): Promise<void> => {
+    const selectedModel = nonEmptyModelId(model)
+    if (!selectedModel) return
     try {
       await enqueueSharedMutation(async () => {
         const snapshot = await selectSharedModelConnection(
           connection.id,
-          model,
+          selectedModel,
           (providerId) => pendingSharedProviderDeletions.current.has(providerId)
         )
         setSharedConnections(snapshot)
         setSharedConnectionsError('')
-        update({ agents: { kun: { providerId: connection.id, model } } })
+        update({ agents: { kun: kunProviderSelectionPatch({
+          providerId: connection.id,
+          model: selectedModel
+        }) } })
       })
     } catch (error) {
       if (error instanceof SharedModelConnectionConflictError) {
@@ -2974,16 +3127,23 @@ export function ProvidersSettingsSection({ ctx }: { ctx: Record<string, any> }):
     void drainSharedProviderCatalogMutation(providerId, generation, async () => {
       const pending = pendingSharedProviderCatalogs.current.get(providerId)
       if (!pending || pending.generation !== generation) return
+      const latestProvider = (sharedProjectionInput.current.provider.providers as ModelProviderProfileV1[])
+        .find((item) => item.id === providerId)
+      const pendingCredential = pendingSharedProviderCredentials.current.get(providerId)?.credential
       const snapshot = await commitSharedModelConnectionCatalog(
         providerId,
         pending,
-        (id) => pendingSharedProviderDeletions.current.has(id)
+        (id) => pendingSharedProviderDeletions.current.has(id),
+        latestProvider
+          ? {
+              provider: latestProvider,
+              credential: pendingCredential ?? latestProvider.apiKey
+            }
+          : undefined
       )
       const current = pendingSharedProviderCatalogs.current.get(providerId)
       const connection = snapshot.providers.find((item) => item.id === providerId)
       if (current?.generation === generation) {
-        const latestProvider = (sharedProjectionInput.current.provider.providers as ModelProviderProfileV1[])
-          .find((item) => item.id === providerId)
         pendingSharedProviderCatalogs.current.set(providerId, {
           ...current,
           ...(connection ? {
@@ -3214,6 +3374,72 @@ export function ProvidersSettingsSection({ ctx }: { ctx: Record<string, any> }):
     }
   }
 
+  const updateActiveProviderCredential = (value: string): void => {
+    if (!activeProvider) return
+    setCredentialRevealError('')
+    if (showApiKey) {
+      setRevealedCredential({ providerId: activeProvider.id, credential: value })
+    }
+    updateModelProvider(activeProvider.id, { apiKey: value })
+  }
+
+  const toggleActiveProviderCredentialVisibility = async (): Promise<void> => {
+    if (!activeProvider) return
+    const providerId = activeProvider.id
+    if (showApiKey) {
+      credentialRevealGeneration.current += 1
+      setShowApiKey(false)
+      setRevealedCredential(null)
+      setCredentialRevealError('')
+      return
+    }
+
+    setCredentialRevealError('')
+    if (
+      activeProvider.apiKey.length > 0 ||
+      !sharedModelConnectionHasUsableCredential(sharedConnectionFor(providerId))
+    ) {
+      setShowApiKey(true)
+      return
+    }
+
+    setCredentialRevealPendingProviderId(providerId)
+    const generation = ++credentialRevealGeneration.current
+    try {
+      if (typeof window.kunGui?.revealModelProviderCredential !== 'function') {
+        throw new Error('Provider credential reveal is unavailable')
+      }
+      const result = await window.kunGui.revealModelProviderCredential(providerId)
+      if (
+        !mounted.current ||
+        activeProviderIdRef.current !== providerId ||
+        credentialRevealGeneration.current !== generation
+      ) return
+      setRevealedCredential({ providerId, credential: result.credential })
+      setShowApiKey(true)
+    } catch {
+      if (
+        mounted.current &&
+        activeProviderIdRef.current === providerId &&
+        credentialRevealGeneration.current === generation
+      ) {
+        setCredentialRevealError(
+          zh
+            ? '无法显示已保存的凭据。请重试，或输入新值替换它。'
+            : 'The saved credential could not be shown. Try again, or enter a new value to replace it.'
+        )
+      }
+    } finally {
+      if (
+        mounted.current &&
+        activeProviderIdRef.current === providerId &&
+        credentialRevealGeneration.current === generation
+      ) {
+        setCredentialRevealPendingProviderId('')
+      }
+    }
+  }
+
   const updateModelProviderImage = (id: string, patch: Partial<ModelProviderImageCapabilityV1>): void => {
     const target = displayProviders.find((item) => item.id === id)
     if (!target) return
@@ -3384,7 +3610,10 @@ export function ProvidersSettingsSection({ ctx }: { ctx: Record<string, any> }):
     updateModelProviders(
       [...modelProviders, secretFreeProvider],
       credential
-        ? { providerId: providerDraft.id, model: providerDraft.models[0] ?? kun.model }
+        ? kunProviderSelectionPatch({
+            providerId: providerDraft.id,
+            model: nonEmptyModelId(providerDraft.models[0]) ?? kun.model
+          })
         : undefined
     )
     previousProviderSelectionRef.current = null
@@ -3478,7 +3707,10 @@ export function ProvidersSettingsSection({ ctx }: { ctx: Record<string, any> }):
     updateModelProviders(
       nextProviders,
       nextProvider.apiKey.trim()
-        ? { providerId: nextProvider.id, model: nextProvider.models[0] ?? kun.model }
+        ? kunProviderSelectionPatch({
+            providerId: nextProvider.id,
+            model: nonEmptyModelId(nextProvider.models[0]) ?? kun.model
+          })
         : undefined
     )
   }
@@ -3692,12 +3924,11 @@ export function ProvidersSettingsSection({ ctx }: { ctx: Record<string, any> }):
 
   const runProbe = async (target: ModelProviderProfileV1, mode: 'test' | 'fetch'): Promise<void> => {
     const fingerprint = providerConnectionFingerprint(target)
-    if (
-      isCursorSubscriptionProvider(target) &&
-      (Boolean(target.apiKey.trim()) ||
-        !sharedModelConnectionHasUsableCredential(sharedConnectionFor(target.id)))
-    ) {
-      if (!target.apiKey.trim()) {
+    if (isCursorSubscriptionProvider(target)) {
+      const cursorCredentialReady =
+        Boolean(target.apiKey.trim()) ||
+        sharedModelConnectionHasUsableCredential(sharedConnectionFor(target.id))
+      if (!cursorCredentialReady) {
         setProbeStates((previous) => ({
           ...previous,
           [target.id]: {
@@ -3718,6 +3949,7 @@ export function ProvidersSettingsSection({ ctx }: { ctx: Record<string, any> }):
         if (typeof discover !== 'function') {
           throw new Error(`No bridge registered for '${CURSOR_SUBSCRIPTION_DISCOVERY_CHANNEL}'`)
         }
+        // apiKey may be redacted in the renderer; Main resolves Registry secrets via providerId.
         const discovery = await discover(target.apiKey.trim() || undefined, target.id)
         const accountName = [
           discovery.account.userFirstName,
@@ -4218,6 +4450,11 @@ export function ProvidersSettingsSection({ ctx }: { ctx: Record<string, any> }):
     )
       ? '••••••••••••'
       : t('modelProviderApiKeyPlaceholder')
+  const activeApiKeyValue = showApiKey && revealedCredential?.providerId === activeProvider?.id
+    ? revealedCredential.credential
+    : activeProvider?.apiKey ?? ''
+  const activeCredentialRevealBusy =
+    credentialRevealPendingProviderId === activeProvider?.id
   const activeTokenPlanRegions = activeProvider
     ? tokenPlanPresetForProfile(activeProvider)?.tokenPlan?.regions ?? []
     : []
@@ -4619,16 +4856,21 @@ export function ProvidersSettingsSection({ ctx }: { ctx: Record<string, any> }):
                         {t('modelProviderApiKey')}
                         <SecretInput
                           className="min-h-11 !rounded-lg"
-                          value={activeProvider.apiKey}
-                          onChange={(value) => updateModelProvider(activeProvider.id, { apiKey: value })}
+                          value={activeApiKeyValue}
+                          onChange={updateActiveProviderCredential}
                           visible={showApiKey}
-                          onToggleVisibility={() => setShowApiKey((value: boolean) => !value)}
+                          onToggleVisibility={() => { void toggleActiveProviderCredentialVisibility() }}
+                          toggleBusy={activeCredentialRevealBusy}
                           placeholder={activeApiKeyPlaceholder}
                           autoComplete="off"
                           showLabel={t('showSecret')}
                           hideLabel={t('hideSecret')}
                         />
-                        {!activeProvider.apiKey.trim() && activeCredentialNeedsReplacement ? (
+                        {credentialRevealError ? (
+                          <span className="text-[12px] font-normal text-amber-600 dark:text-amber-300">
+                            {credentialRevealError}
+                          </span>
+                        ) : !activeProvider.apiKey.trim() && activeCredentialNeedsReplacement ? (
                           <span className="text-[12px] font-normal text-amber-600 dark:text-amber-300">
                             {activeSharedConnection?.credentialStatus === 'unreadable'
                               ? zh
@@ -4677,16 +4919,21 @@ export function ProvidersSettingsSection({ ctx }: { ctx: Record<string, any> }):
                         {t('modelProviderApiKey')}
                         <SecretInput
                           className="min-h-11 !rounded-lg"
-                          value={activeProvider.apiKey}
-                          onChange={(value) => updateModelProvider(activeProvider.id, { apiKey: value })}
+                          value={activeApiKeyValue}
+                          onChange={updateActiveProviderCredential}
                           visible={showApiKey}
-                          onToggleVisibility={() => setShowApiKey((value: boolean) => !value)}
+                          onToggleVisibility={() => { void toggleActiveProviderCredentialVisibility() }}
+                          toggleBusy={activeCredentialRevealBusy}
                           placeholder={activeApiKeyPlaceholder}
                           autoComplete="off"
                           showLabel={t('showSecret')}
                           hideLabel={t('hideSecret')}
                         />
-                        {!activeProvider.apiKey.trim() && activeCredentialNeedsReplacement ? (
+                        {credentialRevealError ? (
+                          <span className="text-[12px] font-normal text-amber-600 dark:text-amber-300">
+                            {credentialRevealError}
+                          </span>
+                        ) : !activeProvider.apiKey.trim() && activeCredentialNeedsReplacement ? (
                           <span className="text-[12px] font-normal text-amber-600 dark:text-amber-300">
                             {activeSharedConnection?.credentialStatus === 'unreadable'
                               ? zh
diff --git a/src/renderer/src/components/settings-section-speech-to-text.test.tsx b/src/renderer/src/components/settings-section-speech-to-text.test.tsx
index 2af4cb188..8d6a3d1a8 100644
--- a/src/renderer/src/components/settings-section-speech-to-text.test.tsx
+++ b/src/renderer/src/components/settings-section-speech-to-text.test.tsx
@@ -119,4 +119,35 @@ describe('SpeechToTextSettingsSection', () => {
     expect(html).not.toContain('has no API key')
     expect(html).toContain('gemini-2.5-flash')
   })
+
+  it('does not demand a plaintext API key for redacted Grok OAuth while credentials load', () => {
+    const grok = modelProviderPresetProfile(
+      getModelProviderPreset('grok-subscription')!,
+      ''
+    )
+    const defaults = defaultKunRuntimeSettings()
+    const html = renderToStaticMarkup(createElement(SpeechToTextSettingsSection, {
+      ctx: {
+        t,
+        provider: { providers: [grok] },
+        kun: {
+          ...defaults,
+          speechToText: {
+            ...defaults.speechToText,
+            enabled: true,
+            providerId: grok.id,
+            protocol: 'xai-stt',
+            model: 'grok-transcribe'
+          }
+        },
+        selectControlClass: 'select',
+        updateKun: vi.fn()
+      }
+    }))
+
+    // Credential readiness is fetched asynchronously; until it lands the UI
+    // must not flash a false "missing API key" warning for OAuth providers.
+    expect(html).not.toContain('has no API key')
+    expect(html).toContain('grok-transcribe')
+  })
 })
diff --git a/src/renderer/src/components/settings-section-speech-to-text.tsx b/src/renderer/src/components/settings-section-speech-to-text.tsx
index b622b240e..48d50e1a7 100644
--- a/src/renderer/src/components/settings-section-speech-to-text.tsx
+++ b/src/renderer/src/components/settings-section-speech-to-text.tsx
@@ -17,6 +17,11 @@ import {
   type LocalWhisperModelStatus
 } from '@shared/local-whisper'
 import { Download, Loader2, Mic, PlugZap, SlidersHorizontal, Square, Trash2 } from 'lucide-react'
+import {
+  fetchSharedModelConnectionCredentialStates,
+  shouldWarnMissingProviderCredential,
+  type SharedConnectionCredentialState
+} from '../lib/provider-credential-readiness'
 import {
   AdvancedSettingsDisclosure,
   InlineNoticeView,
@@ -197,7 +202,28 @@ export function SpeechToTextSettingsSection({ ctx }: { ctx: Record<string, any>
   const [localWhisperNotice, setLocalWhisperNotice] = useState<InlineNotice | null>(null)
   const [localWhisperSourceStatuses, setLocalWhisperSourceStatuses] = useState<LocalWhisperDownloadSourceStatus[] | null>(null)
   const [localWhisperSourceCheckBusy, setLocalWhisperSourceCheckBusy] = useState(false)
+  const [connectionCredentials, setConnectionCredentials] = useState<SharedConnectionCredentialState[] | null>(null)
   const localWhisperStatus = localWhisperStatuses[selectedLocalWhisperModelId] ?? null
+  const warnMissingSpeechProviderKey = shouldWarnMissingProviderCredential({
+    usingCustomProvider: usingLocalWhisper || usingCustomProvider,
+    protocolExempt: selectedProviderSpeech?.protocol === 'gemini-cli-audio',
+    provider: selectedSpeechProvider,
+    connectionCredentials
+  })
+
+  useEffect(() => {
+    let cancelled = false
+    void fetchSharedModelConnectionCredentialStates()
+      .then((states) => {
+        if (!cancelled) setConnectionCredentials(states)
+      })
+      .catch(() => {
+        if (!cancelled) setConnectionCredentials([])
+      })
+    return () => {
+      cancelled = true
+    }
+  }, [])
   const updateSpeechToText = (patch: Record<string, unknown>): void => {
     updateKun({
       speechToText: {
@@ -455,10 +481,7 @@ export function SpeechToTextSettingsSection({ ctx }: { ctx: Record<string, any>
                   ))}
                   <option value={CUSTOM_SPEECH_TO_TEXT_PROVIDER_ID}>{t('speechToTextProviderCustom')}</option>
                 </select>
-                {!usingLocalWhisper &&
-                !usingCustomProvider &&
-                selectedProviderSpeech?.protocol !== 'gemini-cli-audio' &&
-                !selectedSpeechProvider?.apiKey?.trim() ? (
+                {warnMissingSpeechProviderKey ? (
                   <p className="mt-2 text-[12px] text-amber-700 dark:text-amber-300">
                     {t('speechToTextProviderMissingKey', { provider: selectedSpeechProvider?.name ?? selectedProviderId })}
                   </p>
diff --git a/src/renderer/src/components/settings-utils.test.ts b/src/renderer/src/components/settings-utils.test.ts
index a81c0615e..47b490370 100644
--- a/src/renderer/src/components/settings-utils.test.ts
+++ b/src/renderer/src/components/settings-utils.test.ts
@@ -29,6 +29,21 @@ describe('coerceRendererSettings', () => {
 })
 
 describe('diffSettingsPatch', () => {
+  it('preserves the last valid model when the selected provider is cleared', () => {
+    const base = settings({ providerId: 'custom-provider', model: 'custom-model' })
+    const next = mergeSettings(base, {
+      agents: { kun: { providerId: '' } }
+    })
+
+    expect(next.agents.kun).toMatchObject({
+      providerId: '',
+      model: 'custom-model'
+    })
+    const patch = diffSettingsPatch(base, next)
+    expect(patch.agents?.kun).toEqual({ providerId: '' })
+    expect(patch.agents?.kun).not.toHaveProperty('model')
+  })
+
   it('omits an unchanged blank runtime token when another setting changes', () => {
     const base = settings({ runtimeToken: '' })
     const next: AppSettingsV1 = {
diff --git a/src/renderer/src/components/shared-provider-mutation-coordinator.ts b/src/renderer/src/components/shared-provider-mutation-coordinator.ts
index 89efb6f12..60058452b 100644
--- a/src/renderer/src/components/shared-provider-mutation-coordinator.ts
+++ b/src/renderer/src/components/shared-provider-mutation-coordinator.ts
@@ -69,6 +69,11 @@ export function drainSharedProviderCatalogMutation<T>(
   return promise
 }
 
+/** True while a staged catalog commit is running on the shared mutation queue. */
+export function hasInFlightSharedProviderCatalogMutation(): boolean {
+  return catalogDrains.size > 0
+}
+
 export function stageSharedProviderCredentialMutation(
   providerId: string,
   credential: string,
diff --git a/src/renderer/src/components/workbench/WorkbenchChatStage.tsx b/src/renderer/src/components/workbench/WorkbenchChatStage.tsx
index 9eca9b4f3..61772630e 100644
--- a/src/renderer/src/components/workbench/WorkbenchChatStage.tsx
+++ b/src/renderer/src/components/workbench/WorkbenchChatStage.tsx
@@ -52,6 +52,7 @@ export type WorkbenchChatStageProps = {
   devPreviewOpened: boolean
   returnParentTitle: string
   showReturnBar: boolean
+  returnBarVariant?: 'explore' | 'subagent'
   graphChildContext?: GraphChildSessionContext
   composerProps: FloatingComposerProps
   conversationDropWorkspaceRoot: string
@@ -107,6 +108,7 @@ export function WorkbenchChatStage({
   devPreviewOpened,
   returnParentTitle,
   showReturnBar,
+  returnBarVariant = 'subagent',
   graphChildContext,
   composerProps,
   conversationDropWorkspaceRoot,
@@ -263,6 +265,7 @@ export function WorkbenchChatStage({
             <SubagentReturnBar
               parentTitle={returnParentTitle}
               onBack={onBackToParent}
+              variant={returnBarVariant}
             />
           ) : (
             <div className="flex w-full min-w-0 flex-col items-center gap-1">
diff --git a/src/renderer/src/graph/graph-store-types.ts b/src/renderer/src/graph/graph-store-types.ts
index 0064c41b7..d22a8d807 100644
--- a/src/renderer/src/graph/graph-store-types.ts
+++ b/src/renderer/src/graph/graph-store-types.ts
@@ -1,5 +1,6 @@
 import type { RuntimeChildEventPayload } from '../agent/types'
 import type { GraphChildReturnTarget } from './graph-child-runtime'
+import type { GraphThreadSyncStatus } from './graph-thread-observer'
 import type {
   GraphAgentEvidence,
   GraphAgentProfile,
@@ -17,6 +18,8 @@ import type {
   ProjectIdentity
 } from './graph-types'
 
+export type { GraphThreadSyncStatus } from './graph-thread-observer'
+
 type GraphThreadRefreshOptions = {
   silent?: boolean
 }
@@ -44,6 +47,16 @@ export type GraphViewState = {
   wakingObligationId: string | null
   loading: boolean
   error: string | null
+  /** Graph-owned SSE / observer lifecycle (independent of chat busy). */
+  syncStatus: GraphThreadSyncStatus
+  /** Monotonic thread SSE cursor for the bound Graph panel thread. */
+  threadEventSeq: number
+  /**
+   * Atomic thread ownership transition for the Graph panel. Switching to a
+   * different thread clears all thread-scoped projection and resets the SSE
+   * cursor to 0. Same-thread calls are no-ops (reconnect keeps the snapshot).
+   */
+  bindGraphThread: (threadId: string | null) => { switched: boolean }
   refreshThread: (threadId: string | null, options?: GraphThreadRefreshOptions) => Promise<void>
   refreshProject: (workspace: string) => Promise<void>
   refreshSelectedRun: () => Promise<void>
@@ -53,6 +66,8 @@ export type GraphViewState = {
   updateChildObserver: (status: GraphChildReturnTarget['observerStatus'], cursor?: number) => void
   updateChildSessionStatus: (status: GraphChildReturnTarget['childSessionStatus']) => void
   clearChildReturnTarget: () => void
+  setSyncStatus: (status: GraphThreadSyncStatus, ownerThreadId?: string) => void
+  advanceThreadEventSeq: (seq: number, ownerThreadId?: string) => void
   receiveChildRuntimeEvent: (event: RuntimeChildEventPayload) => void
   receiveEvent: (event: GraphEventEnvelope) => void
   receivePlanningEvent: (event: GraphPlanningLifecycleEvent) => void
diff --git a/src/renderer/src/graph/graph-store.test.ts b/src/renderer/src/graph/graph-store.test.ts
index aae71d8f0..80d6a25df 100644
--- a/src/renderer/src/graph/graph-store.test.ts
+++ b/src/renderer/src/graph/graph-store.test.ts
@@ -161,7 +161,9 @@ describe('Graph renderer store', () => {
       artifactLoading: false,
       wakingObligationId: null,
       loading: false,
-      error: null
+      error: null,
+      syncStatus: 'idle',
+      threadEventSeq: 0
     })
     client.delegationDiagnostics.mockResolvedValue({
       enabled: true,
@@ -305,26 +307,164 @@ describe('Graph renderer store', () => {
     expect(client.resumeDraft).toHaveBeenLastCalledWith('draft_1', 4)
   })
 
-  it('does not let an older concurrent refresh overwrite a newer Graph snapshot', async () => {
-    let resolveOlder!: (runs: GraphRun[]) => void
-    let resolveNewer!: (runs: GraphRun[]) => void
+  it('coalesces concurrent refreshThread calls and never regresses lastEventSeq', async () => {
+    let resolveFirst!: (runs: GraphRun[]) => void
+    let resolveSecond!: (runs: GraphRun[]) => void
     client.listRuns
-      .mockReturnValueOnce(new Promise<GraphRun[]>((resolve) => { resolveOlder = resolve }))
-      .mockReturnValueOnce(new Promise<GraphRun[]>((resolve) => { resolveNewer = resolve }))
+      .mockReturnValueOnce(new Promise<GraphRun[]>((resolve) => { resolveFirst = resolve }))
+      .mockReturnValueOnce(new Promise<GraphRun[]>((resolve) => { resolveSecond = resolve }))
 
-    const olderRefresh = useGraphStore.getState().refreshThread('thread_1')
-    const newerRefresh = useGraphStore.getState().refreshThread('thread_1')
-    resolveNewer([runWithNode('run_1', 3, 'node_1')])
-    await newerRefresh
-    expect(useGraphStore.getState().runs[0]?.lastEventSeq).toBe(3)
+    const first = useGraphStore.getState().refreshThread('thread_1')
+    const second = useGraphStore.getState().refreshThread('thread_1', { silent: true })
+    // Single-flight: only one HTTP snapshot is in flight until it settles.
+    expect(client.listRuns).toHaveBeenCalledTimes(1)
 
-    resolveOlder([run('run_1', 2)])
-    await olderRefresh
+    resolveFirst([run('run_1', 2)])
+    await Promise.resolve()
+    await Promise.resolve()
+    // Pending request starts after the leader finishes.
+    await vi.waitFor(() => expect(client.listRuns).toHaveBeenCalledTimes(2))
+    resolveSecond([runWithNode('run_1', 5, 'node_1')])
+    await Promise.all([first, second])
 
     expect(useGraphStore.getState().runs[0]).toMatchObject({
-      lastEventSeq: 3,
+      lastEventSeq: 5,
       nodes: { node_1: { status: 'running' } }
     })
+
+    // A late, weaker snapshot still cannot move lastEventSeq backwards.
+    client.listRuns.mockResolvedValueOnce([run('run_1', 3)])
+    await useGraphStore.getState().refreshThread('thread_1', { silent: true })
+    expect(useGraphStore.getState().runs[0]?.lastEventSeq).toBe(5)
+  })
+
+  it('backfills via snapshot when graphSeq jumps ahead of lastEventSeq (gap)', async () => {
+    client.listRuns.mockResolvedValueOnce([run('run_1', 2)])
+    await useGraphStore.getState().refreshThread('thread_1')
+    expect(useGraphStore.getState().runs[0]?.lastEventSeq).toBe(2)
+
+    client.listRuns.mockResolvedValueOnce([run('run_1', 4)])
+    receiveGraphRuntimeEvent({
+      version: 1,
+      eventId: 'event_4',
+      runId: 'run_1',
+      threadId: 'thread_1',
+      graphSeq: 4,
+      graphRevision: 1,
+      timestamp: '2026-07-26T00:00:04.000Z',
+      event: { type: 'node_status_changed', payload: {} }
+    } satisfies GraphEventEnvelope)
+
+    await vi.waitFor(() => {
+      expect(useGraphStore.getState().runs[0]?.lastEventSeq).toBe(4)
+    })
+    // Snapshot recovery — listEvents is intentionally not used for projection.
+    expect(client.listRuns).toHaveBeenCalledTimes(2)
+    expect(useGraphStore.getState().runs).toHaveLength(1)
+  })
+
+  it('drops a late refresh from a previous thread after a thread switch', async () => {
+    let resolveOld!: (runs: GraphRun[]) => void
+    client.listRuns
+      .mockReturnValueOnce(new Promise<GraphRun[]>((resolve) => { resolveOld = resolve }))
+      .mockResolvedValueOnce([run('run_new', 1)])
+
+    const oldRefresh = useGraphStore.getState().refreshThread('thread_old')
+    await useGraphStore.getState().refreshThread('thread_new')
+    expect(useGraphStore.getState().threadId).toBe('thread_new')
+    expect(useGraphStore.getState().runs[0]?.id).toBe('run_new')
+
+    resolveOld([run('run_old', 9)])
+    await oldRefresh
+
+    expect(useGraphStore.getState().threadId).toBe('thread_new')
+    expect(useGraphStore.getState().runs[0]?.id).toBe('run_new')
+    expect(useGraphStore.getState().runs.some((item) => item.id === 'run_old')).toBe(false)
+  })
+
+  it('atomically clears thread-scoped projection when binding a different thread', async () => {
+    useGraphStore.setState({
+      threadId: 'thread_a',
+      threadEventSeq: 100,
+      runs: [runWithNode('run_a', 8, 'node_a')],
+      drafts: [planningDraft('needs_correction', 1)],
+      childRuns: {
+        child_a: {
+          childId: 'child_a',
+          parentThreadId: 'thread_a',
+          parentTurnId: 'turn_a',
+          status: 'running',
+          updatedAt: '2026-07-26T00:00:00.000Z'
+        }
+      },
+      selectedRunId: 'run_a',
+      selectedNodeId: 'node_a',
+      artifactPage: null,
+      artifactContent: 'artifact from A',
+      artifactLoading: true,
+      syncStatus: 'live'
+    })
+
+    const { switched } = useGraphStore.getState().bindGraphThread('thread_b')
+    expect(switched).toBe(true)
+    expect(useGraphStore.getState()).toMatchObject({
+      threadId: 'thread_b',
+      threadEventSeq: 0,
+      runs: [],
+      drafts: [],
+      childRuns: {},
+      selectedRunId: null,
+      selectedNodeId: null,
+      artifactContent: '',
+      artifactLoading: false,
+      artifactPage: null,
+      loading: true,
+      syncStatus: 'connecting'
+    })
+
+    // Failed snapshot for B must not resurrect A.
+    client.listRuns.mockRejectedValueOnce(new Error('network down'))
+    client.listDrafts.mockRejectedValueOnce(new Error('network down'))
+    await useGraphStore.getState().refreshThread('thread_b')
+    expect(useGraphStore.getState().runs).toEqual([])
+    expect(useGraphStore.getState().drafts).toEqual([])
+    expect(useGraphStore.getState().runs.some((item) => item.id === 'run_a')).toBe(false)
+  })
+
+  it('keeps the same-thread snapshot across reconnect binds', () => {
+    useGraphStore.setState({
+      threadId: 'thread_1',
+      threadEventSeq: 12,
+      runs: [run('run_1', 12)],
+      syncStatus: 'live'
+    })
+    const { switched } = useGraphStore.getState().bindGraphThread('thread_1')
+    expect(switched).toBe(false)
+    expect(useGraphStore.getState()).toMatchObject({
+      threadId: 'thread_1',
+      threadEventSeq: 12,
+      runs: [{ id: 'run_1', lastEventSeq: 12 }],
+      syncStatus: 'live'
+    })
+  })
+
+  it('advances threadEventSeq monotonically only for the owning thread', () => {
+    useGraphStore.setState({ threadId: 'thread_a', threadEventSeq: 0 })
+    useGraphStore.getState().advanceThreadEventSeq(2, 'thread_a')
+    useGraphStore.getState().advanceThreadEventSeq(5, 'thread_a')
+    useGraphStore.getState().advanceThreadEventSeq(4, 'thread_a')
+    expect(useGraphStore.getState().threadEventSeq).toBe(5)
+
+    useGraphStore.getState().bindGraphThread('thread_b')
+    useGraphStore.getState().advanceThreadEventSeq(99, 'thread_a')
+    useGraphStore.getState().setSyncStatus('live', 'thread_a')
+    expect(useGraphStore.getState()).toMatchObject({
+      threadId: 'thread_b',
+      threadEventSeq: 0,
+      syncStatus: 'connecting'
+    })
+    useGraphStore.getState().advanceThreadEventSeq(3, 'thread_b')
+    expect(useGraphStore.getState().threadEventSeq).toBe(3)
   })
 
   it('preserves a durable node selection when the selected run refreshes', async () => {
diff --git a/src/renderer/src/graph/graph-store.ts b/src/renderer/src/graph/graph-store.ts
index 3acf1f588..4595b476c 100644
--- a/src/renderer/src/graph/graph-store.ts
+++ b/src/renderer/src/graph/graph-store.ts
@@ -21,11 +21,84 @@ import type {
 } from './graph-types'
 
 export { selectGraphPlanningCorrectionDraft } from './graph-planning-selection'
+export type { GraphThreadSyncStatus } from './graph-thread-observer'
+
+type ThreadRefreshGate = {
+  inFlight: Promise<void> | null
+  pending: boolean
+  /** Pending refresh is silent only when every coalesced request asked for silent. */
+  pendingSilent: boolean
+}
+
+/** One in-flight HTTP snapshot per thread; later requests mark pending. */
+const threadRefreshGates = new Map<string, ThreadRefreshGate>()
+
+function refreshGateFor(threadId: string): ThreadRefreshGate {
+  const existing = threadRefreshGates.get(threadId)
+  if (existing) return existing
+  const created: ThreadRefreshGate = {
+    inFlight: null,
+    pending: false,
+    pendingSilent: true
+  }
+  threadRefreshGates.set(threadId, created)
+  return created
+}
 
 function message(error: unknown): string {
   return error instanceof Error ? error.message : String(error)
 }
 
+async function applyThreadSnapshot(
+  get: () => GraphViewState,
+  set: (
+    partial:
+      | Partial<GraphViewState>
+      | ((state: GraphViewState) => Partial<GraphViewState>)
+  ) => void,
+  threadId: string,
+  silent: boolean
+): Promise<void> {
+  if (!silent) set({ loading: true, error: null })
+  try {
+    const [runs, drafts, diagnostics] = await Promise.all([
+      graphRuntimeClient.listRuns(threadId),
+      graphRuntimeClient.listDrafts(threadId),
+      graphRuntimeClient.delegationDiagnostics(threadId).catch(() => null)
+    ])
+    if (get().threadId !== threadId) return
+    const current = get()
+    const mergedRuns = mergeGraphRunSnapshots(current.runs, runs)
+    const previousRunId = current.selectedRunId
+    const previousNodeId = current.selectedNodeId
+    const selectedRunId = mergedRuns.some((run) => run.id === previousRunId)
+      ? previousRunId
+      : mergedRuns[0]?.id ?? null
+    const selectedRun = mergedRuns.find((run) => run.id === selectedRunId)
+    const selectedNodeId = previousNodeId && selectedRun?.nodes[previousNodeId]
+      ? previousNodeId
+      : null
+    set({
+      runs: mergedRuns,
+      drafts,
+      childRuns: mergeGraphChildDiagnostics(current.childRuns, diagnostics, threadId),
+      selectedRunId,
+      selectedNodeId,
+      artifactPage: null,
+      artifactContent: '',
+      artifactLoading: false,
+      // Always clear loading after a successful snapshot so a silent follow-up
+      // cannot leave the panel stuck after bindGraphThread set loading=true.
+      loading: false,
+      ...(silent ? {} : { error: null })
+    })
+  } catch (error) {
+    if (get().threadId !== threadId) return
+    if (!silent) set({ loading: false, error: message(error) })
+    else if (get().loading) set({ loading: false })
+  }
+}
+
 export const useGraphStore = create<GraphViewState>((set, get) => ({
   threadId: null,
   workspace: '',
@@ -49,12 +122,17 @@ export const useGraphStore = create<GraphViewState>((set, get) => ({
   wakingObligationId: null,
   loading: false,
   error: null,
+  syncStatus: 'idle',
+  threadEventSeq: 0,
 
-  refreshThread: async (threadId, options) => {
-    const silent = options?.silent === true
-    set(silent ? { threadId } : { threadId, loading: true, error: null })
-    if (!threadId) {
+  bindGraphThread: (nextThreadId) => {
+    const current = get()
+    if (nextThreadId === null) {
+      if (current.threadId === null && current.runs.length === 0) {
+        return { switched: false }
+      }
       set({
+        threadId: null,
         runs: [],
         drafts: [],
         childRuns: {},
@@ -63,42 +141,79 @@ export const useGraphStore = create<GraphViewState>((set, get) => ({
         artifactPage: null,
         artifactContent: '',
         artifactLoading: false,
-        loading: false
+        loading: false,
+        error: null,
+        syncStatus: 'idle',
+        threadEventSeq: 0
       })
+      return { switched: true }
+    }
+    if (current.threadId === nextThreadId) {
+      return { switched: false }
+    }
+    // Different thread: never show the previous thread's Graph projection.
+    set({
+      threadId: nextThreadId,
+      runs: [],
+      drafts: [],
+      childRuns: {},
+      selectedRunId: null,
+      selectedNodeId: null,
+      artifactPage: null,
+      artifactContent: '',
+      artifactLoading: false,
+      loading: true,
+      error: null,
+      syncStatus: 'connecting',
+      threadEventSeq: 0
+    })
+    return { switched: true }
+  },
+
+  refreshThread: async (threadId, options) => {
+    const silent = options?.silent === true
+    if (!threadId) {
+      get().bindGraphThread(null)
       return
     }
-    try {
-      const [runs, drafts, diagnostics] = await Promise.all([
-        graphRuntimeClient.listRuns(threadId),
-        graphRuntimeClient.listDrafts(threadId),
-        graphRuntimeClient.delegationDiagnostics(threadId).catch(() => null)
-      ])
-      if (get().threadId !== threadId) return
-      const current = get()
-      const mergedRuns = mergeGraphRunSnapshots(current.runs, runs)
-      const previousRunId = current.selectedRunId
-      const previousNodeId = current.selectedNodeId
-      const selectedRunId = mergedRuns.some((run) => run.id === previousRunId)
-        ? previousRunId
-        : mergedRuns[0]?.id ?? null
-      const selectedRun = mergedRuns.find((run) => run.id === selectedRunId)
-      const selectedNodeId = previousNodeId && selectedRun?.nodes[previousNodeId]
-        ? previousNodeId
-        : null
-      set({
-        runs: mergedRuns,
-        drafts,
-        childRuns: mergeGraphChildDiagnostics(current.childRuns, diagnostics, threadId),
-        selectedRunId,
-        selectedNodeId,
-        artifactPage: null,
-        artifactContent: '',
-        artifactLoading: false,
-        ...(silent ? {} : { loading: false, error: null })
-      })
-    } catch (error) {
-      if (!silent) set({ loading: false, error: message(error) })
+
+    // Atomic ownership transition — does not depend on React effect order.
+    const { switched } = get().bindGraphThread(threadId)
+    if (!switched && !silent) {
+      set({ loading: true, error: null })
+    } else if (!switched && silent) {
+      // same thread silent reconcile: leave projection untouched until apply
     }
+
+    const gate = refreshGateFor(threadId)
+    if (gate.inFlight) {
+      gate.pending = true
+      gate.pendingSilent = gate.pendingSilent && silent
+      await gate.inFlight
+      return
+    }
+
+    gate.pending = true
+    gate.pendingSilent = silent
+    const run = (async () => {
+      try {
+        while (gate.pending && get().threadId === threadId) {
+          const useSilent = gate.pendingSilent
+          gate.pending = false
+          gate.pendingSilent = true
+          await applyThreadSnapshot(get, set, threadId, useSilent)
+        }
+      } finally {
+        gate.inFlight = null
+        // A request may have marked pending after the while-check but before
+        // inFlight was cleared; start a follow-up leader without dropping it.
+        if (gate.pending && get().threadId === threadId) {
+          void get().refreshThread(threadId, { silent: gate.pendingSilent })
+        }
+      }
+    })()
+    gate.inFlight = run
+    await run
   },
 
   refreshProject: async (workspace) => {
@@ -191,6 +306,16 @@ export const useGraphStore = create<GraphViewState>((set, get) => ({
   }),
   clearChildReturnTarget: () => set({ childReturnTarget: null }),
 
+  setSyncStatus: (syncStatus, ownerThreadId) => set((state) => {
+    if (ownerThreadId !== undefined && state.threadId !== ownerThreadId) return {}
+    return { syncStatus }
+  }),
+
+  advanceThreadEventSeq: (seq, ownerThreadId) => set((state) => {
+    if (ownerThreadId !== undefined && state.threadId !== ownerThreadId) return {}
+    return { threadEventSeq: Math.max(state.threadEventSeq, seq) }
+  }),
+
   receiveChildRuntimeEvent: (event) => {
     if (event.child.parentThreadId !== get().threadId) return
     const incoming = graphChildRuntimeFromEvent(event)
@@ -208,9 +333,11 @@ export const useGraphStore = create<GraphViewState>((set, get) => ({
   receiveEvent: (event) => {
     if (event.threadId !== get().threadId) return
     const known = get().runs.find((run) => run.id === event.runId)
-    if (!known || event.graphSeq > known.lastEventSeq) {
-      void get().refreshThread(event.threadId)
-    }
+    // graphSeq is run-local; thread SSE cursor is separate. Gaps and advances
+    // both converge via a coalesced silent snapshot — domain listEvents is not
+    // projected because the renderer owns HTTP run snapshots, not event replay.
+    if (known && event.graphSeq <= known.lastEventSeq) return
+    void get().refreshThread(event.threadId, { silent: true })
   },
 
   receivePlanningEvent: (event) => {
diff --git a/src/renderer/src/graph/graph-thread-observer.test.ts b/src/renderer/src/graph/graph-thread-observer.test.ts
new file mode 100644
index 000000000..ec13fb4a5
--- /dev/null
+++ b/src/renderer/src/graph/graph-thread-observer.test.ts
@@ -0,0 +1,155 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { ThreadEventSink } from '../agent/types'
+import {
+  GRAPH_THREAD_OBSERVER_RECONNECT_BASE_MS,
+  startGraphThreadObserver
+} from './graph-thread-observer'
+
+describe('Graph thread observer', () => {
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  it('subscribes independently of chat busy and advances a monotonic SSE cursor', async () => {
+    const statuses: string[] = []
+    const seqs: number[] = []
+    let cursor = 2
+    const subscribe = vi.fn(async (
+      threadId: string,
+      sinceSeq: number,
+      sink: ThreadEventSink,
+      signal: AbortSignal
+    ) => {
+      expect(threadId).toBe('thread_graph')
+      expect(sinceSeq).toBe(2)
+      sink.onConnected?.()
+      sink.onSeq(5)
+      sink.onGraphEvent?.({ graphSeq: 4 })
+      await new Promise<void>((resolve) => {
+        signal.addEventListener('abort', () => resolve(), { once: true })
+      })
+    })
+
+    const observer = startGraphThreadObserver({
+      threadId: 'thread_graph',
+      getSinceSeq: () => cursor,
+      onSeq: (seq) => {
+        cursor = Math.max(cursor, seq)
+        seqs.push(seq)
+      },
+      onStatus: (status) => statuses.push(status),
+      onGraphEvent: vi.fn(),
+      subscribe
+    })
+
+    await vi.waitFor(() => {
+      expect(subscribe).toHaveBeenCalledTimes(1)
+      expect(seqs).toEqual([5])
+    })
+    expect(statuses).toContain('connecting')
+    expect(statuses).toContain('live')
+    expect(cursor).toBe(5)
+
+    observer.stop()
+    expect(statuses.at(-1)).toBe('stopped')
+  })
+
+  it('reconnects from the latest cursor after disconnect without requiring a remount', async () => {
+    vi.useFakeTimers()
+    const subscribe = vi.fn()
+    let cursor = 0
+    subscribe
+      .mockImplementationOnce(async (
+        _threadId: string,
+        sinceSeq: number,
+        sink: ThreadEventSink
+      ) => {
+        expect(sinceSeq).toBe(0)
+        sink.onSeq(3)
+      })
+      .mockImplementationOnce(async (
+        _threadId: string,
+        sinceSeq: number,
+        sink: ThreadEventSink,
+        signal: AbortSignal
+      ) => {
+        expect(sinceSeq).toBe(3)
+        sink.onConnected?.()
+        await new Promise<void>((resolve) => {
+          signal.addEventListener('abort', () => resolve(), { once: true })
+        })
+      })
+
+    const observer = startGraphThreadObserver({
+      threadId: 'thread_graph',
+      getSinceSeq: () => cursor,
+      onSeq: (seq) => {
+        cursor = Math.max(cursor, seq)
+      },
+      onStatus: vi.fn(),
+      onGraphEvent: vi.fn(),
+      subscribe
+    })
+
+    await vi.waitFor(() => expect(subscribe).toHaveBeenCalledTimes(1))
+    await vi.advanceTimersByTimeAsync(GRAPH_THREAD_OBSERVER_RECONNECT_BASE_MS)
+    await vi.waitFor(() => expect(subscribe).toHaveBeenCalledTimes(2))
+    expect(subscribe.mock.calls[1]?.[1]).toBe(3)
+
+    observer.stop()
+  })
+
+  it('stops reconnecting when shouldReconnect becomes false (terminal Graph)', async () => {
+    vi.useFakeTimers()
+    let live = true
+    const statuses: string[] = []
+    const subscribe = vi.fn(async () => {
+      live = false
+    })
+
+    startGraphThreadObserver({
+      threadId: 'thread_graph',
+      getSinceSeq: () => 0,
+      onSeq: vi.fn(),
+      onStatus: (status) => statuses.push(status),
+      onGraphEvent: vi.fn(),
+      subscribe,
+      shouldReconnect: () => live
+    })
+
+    await vi.waitFor(() => expect(subscribe).toHaveBeenCalledTimes(1))
+    await vi.advanceTimersByTimeAsync(GRAPH_THREAD_OBSERVER_RECONNECT_BASE_MS * 4)
+    expect(subscribe).toHaveBeenCalledTimes(1)
+    expect(statuses.at(-1)).toBe('stopped')
+  })
+
+  it('aborts the active subscription on stop so thread switches cannot leak', async () => {
+    let aborted = false
+    const subscribe = vi.fn(async (
+      _threadId: string,
+      _sinceSeq: number,
+      _sink: ThreadEventSink,
+      signal: AbortSignal
+    ) => {
+      await new Promise<void>((resolve) => {
+        signal.addEventListener('abort', () => {
+          aborted = true
+          resolve()
+        }, { once: true })
+      })
+    })
+
+    const observer = startGraphThreadObserver({
+      threadId: 'thread_old',
+      getSinceSeq: () => 1,
+      onSeq: vi.fn(),
+      onStatus: vi.fn(),
+      onGraphEvent: vi.fn(),
+      subscribe
+    })
+
+    await vi.waitFor(() => expect(subscribe).toHaveBeenCalledTimes(1))
+    observer.stop()
+    await vi.waitFor(() => expect(aborted).toBe(true))
+  })
+})
diff --git a/src/renderer/src/graph/graph-thread-observer.ts b/src/renderer/src/graph/graph-thread-observer.ts
new file mode 100644
index 000000000..5ef020f42
--- /dev/null
+++ b/src/renderer/src/graph/graph-thread-observer.ts
@@ -0,0 +1,135 @@
+import type { ThreadEventSink } from '../agent/types'
+
+/** Reachable Graph panel observer lifecycle values (no unused placeholders). */
+export type GraphThreadSyncStatus =
+  | 'idle'
+  | 'connecting'
+  | 'live'
+  | 'reconnecting'
+  | 'stopped'
+
+export const GRAPH_THREAD_OBSERVER_RECONNECT_BASE_MS = 1_000
+export const GRAPH_THREAD_OBSERVER_RECONNECT_MAX_MS = 5_000
+
+export type GraphThreadObserverHandles = {
+  stop: () => void
+}
+
+export type GraphThreadObserverDeps = {
+  threadId: string
+  getSinceSeq: () => number
+  onSeq: (seq: number) => void
+  onStatus: (status: GraphThreadSyncStatus) => void
+  onGraphEvent: (event: unknown) => void
+  onChildRuntimeEvent?: ThreadEventSink['onChildRuntimeEvent']
+  onGraphPlanningEvent?: ThreadEventSink['onGraphPlanningEvent']
+  subscribe: (
+    threadId: string,
+    sinceSeq: number,
+    sink: ThreadEventSink,
+    signal: AbortSignal
+  ) => Promise<void>
+  /** When false after a stream ends, the observer stops reconnecting. */
+  shouldReconnect?: () => boolean
+  waitForReconnect?: (ms: number, signal: AbortSignal) => Promise<void>
+}
+
+function defaultWait(ms: number, signal: AbortSignal): Promise<void> {
+  return new Promise((resolve) => {
+    if (signal.aborted) {
+      resolve()
+      return
+    }
+    const id = globalThis.setTimeout(resolve, ms)
+    signal.addEventListener('abort', () => {
+      globalThis.clearTimeout(id)
+      resolve()
+    }, { once: true })
+  })
+}
+
+function reconnectDelayMs(attempt: number): number {
+  return Math.min(
+    GRAPH_THREAD_OBSERVER_RECONNECT_MAX_MS,
+    GRAPH_THREAD_OBSERVER_RECONNECT_BASE_MS * (2 ** Math.min(2, Math.max(0, attempt - 1)))
+  )
+}
+
+/**
+ * Independent Graph SSE lifecycle for the Graph panel. Not gated by chat busy:
+ * reconnects from a monotonic thread event cursor, and only projects Graph
+ * envelopes (plus safe child/planning events) into the Graph store.
+ */
+export function startGraphThreadObserver(
+  deps: GraphThreadObserverDeps
+): GraphThreadObserverHandles {
+  const controller = new AbortController()
+  const wait = deps.waitForReconnect ?? defaultWait
+  let reconnectAttempt = 0
+  let stopped = false
+
+  const sink: ThreadEventSink = {
+    onConnected: () => {
+      if (stopped || controller.signal.aborted) return
+      reconnectAttempt = 0
+      deps.onStatus('live')
+    },
+    onSeq: (seq) => {
+      if (stopped || controller.signal.aborted) return
+      reconnectAttempt = 0
+      deps.onSeq(seq)
+      deps.onStatus('live')
+    },
+    onDeltas: () => undefined,
+    onUserMessage: () => undefined,
+    onTool: () => undefined,
+    onCompaction: () => undefined,
+    onApproval: () => undefined,
+    onUserInput: () => undefined,
+    onUserInputStatus: () => undefined,
+    onGoal: () => undefined,
+    onTurnComplete: () => undefined,
+    onError: () => {
+      if (stopped || controller.signal.aborted) return
+      deps.onStatus('reconnecting')
+    },
+    onChildRuntimeEvent: deps.onChildRuntimeEvent,
+    onGraphEvent: deps.onGraphEvent,
+    onGraphPlanningEvent: deps.onGraphPlanningEvent
+  }
+
+  const loop = async (): Promise<void> => {
+    while (!controller.signal.aborted && !stopped) {
+      deps.onStatus(reconnectAttempt === 0 ? 'connecting' : 'reconnecting')
+      try {
+        await deps.subscribe(
+          deps.threadId,
+          deps.getSinceSeq(),
+          sink,
+          controller.signal
+        )
+      } catch {
+        if (controller.signal.aborted || stopped) return
+      }
+      if (controller.signal.aborted || stopped) return
+      if (deps.shouldReconnect && !deps.shouldReconnect()) {
+        deps.onStatus('stopped')
+        return
+      }
+      reconnectAttempt += 1
+      deps.onStatus('reconnecting')
+      await wait(reconnectDelayMs(reconnectAttempt), controller.signal)
+    }
+  }
+
+  void loop()
+
+  return {
+    stop: () => {
+      if (stopped) return
+      stopped = true
+      controller.abort()
+      deps.onStatus('stopped')
+    }
+  }
+}
diff --git a/src/renderer/src/graph/use-graph-thread-observer.test.ts b/src/renderer/src/graph/use-graph-thread-observer.test.ts
new file mode 100644
index 000000000..851f7ae01
--- /dev/null
+++ b/src/renderer/src/graph/use-graph-thread-observer.test.ts
@@ -0,0 +1,324 @@
+import { createElement } from 'react'
+import { act, create, type ReactTestRenderer } from 'react-test-renderer'
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { ThreadEventSink } from '../agent/types'
+import { useGraphStore } from './graph-store'
+import { useGraphThreadObserver } from './use-graph-thread-observer'
+
+const provider = vi.hoisted(() => ({
+  subscribeThreadEvents: vi.fn()
+}))
+
+const client = vi.hoisted(() => ({
+  listRuns: vi.fn(),
+  listDrafts: vi.fn(),
+  delegationDiagnostics: vi.fn()
+}))
+
+vi.mock('../agent/registry', () => ({
+  getProvider: () => provider
+}))
+
+vi.mock('./graph-runtime-client', () => ({
+  graphRuntimeClient: client
+}))
+
+function Harness({
+  threadId,
+  active
+}: {
+  threadId: string | null
+  active: boolean
+}): null {
+  useGraphThreadObserver(threadId, active)
+  return null
+}
+
+function run(id: string, seq: number, status: 'running' | 'completed' = 'running') {
+  return {
+    version: 1 as const,
+    id,
+    projectId: 'project_1',
+    threadId: 'thread_1',
+    sourceTurnId: 'turn_1',
+    status,
+    currentRevision: 1,
+    plans: [],
+    nodes: {
+      node_1: {
+        node: {
+          id: 'node_1',
+          phaseId: 'phase_1',
+          kind: 'work' as const,
+          title: 'Work',
+          objective: 'Do work',
+          priority: 1,
+          required: true,
+          riskClass: 'low' as const,
+          readScopes: [],
+          writeScopes: []
+        },
+        status: status === 'completed' ? 'accepted' as const : 'running' as const,
+        attempts: [],
+        loopIteration: 0
+      }
+    },
+    reviews: [],
+    messages: [],
+    artifacts: [],
+    cleanup: [],
+    steering: [],
+    budget: {
+      limits: { maxWallTimeMs: 60_000, maxAttemptsPerNode: 3 },
+      attempts: 0,
+      revisions: 0,
+      loopIterations: 0,
+      elapsedMs: 0,
+      totalTokens: 0,
+      messages: 0,
+      artifactBytes: 0,
+      warningKinds: [],
+      closed: false
+    },
+    lastEventSeq: seq,
+    createdAt: '2026-07-26T00:00:00.000Z',
+    updatedAt: '2026-07-26T00:00:00.000Z'
+  }
+}
+
+describe('useGraphThreadObserver', () => {
+  beforeAll(() => {
+    ;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
+  })
+
+  afterAll(() => {
+    delete (globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT
+  })
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    useGraphStore.setState({
+      threadId: null,
+      runs: [],
+      drafts: [],
+      childRuns: {},
+      syncStatus: 'idle',
+      threadEventSeq: 0,
+      loading: false,
+      error: null
+    })
+    client.listDrafts.mockResolvedValue([])
+    client.delegationDiagnostics.mockResolvedValue({
+      enabled: true,
+      active: 0,
+      childRuns: []
+    })
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  it('keeps observing after Lead settles (chat busy=false) and projects later Graph status', async () => {
+    client.listRuns.mockResolvedValue([run('run_1', 2)])
+    provider.subscribeThreadEvents.mockImplementation(
+      async (
+        _threadId: string,
+        _seq: number,
+        sink: ThreadEventSink,
+        signal: AbortSignal
+      ) => {
+        sink.onConnected?.()
+        await new Promise<void>((resolve) => {
+          signal.addEventListener('abort', () => resolve(), { once: true })
+        })
+      }
+    )
+
+    let renderer: ReactTestRenderer
+    await act(async () => {
+      renderer = create(createElement(Harness, { threadId: 'thread_1', active: true }))
+    })
+
+    await act(async () => {
+      await useGraphStore.getState().refreshThread('thread_1')
+    })
+    expect(useGraphStore.getState().runs[0]?.lastEventSeq).toBe(2)
+    expect(useGraphStore.getState().syncStatus).toBe('live')
+
+    client.listRuns.mockResolvedValue([run('run_1', 6)])
+    const sink = provider.subscribeThreadEvents.mock.calls[0]![2] as ThreadEventSink
+    await act(async () => {
+      sink.onGraphEvent?.({
+        version: 1,
+        eventId: 'event_6',
+        runId: 'run_1',
+        threadId: 'thread_1',
+        graphSeq: 6,
+        graphRevision: 1,
+        timestamp: '2026-07-26T00:00:06.000Z',
+        event: { type: 'node_status_changed', payload: {} }
+      })
+    })
+
+    await vi.waitFor(() => {
+      expect(useGraphStore.getState().runs[0]?.lastEventSeq).toBe(6)
+    })
+
+    await act(async () => renderer!.unmount())
+  })
+
+  it('aborts the previous thread observer when the Graph panel switches threads', async () => {
+    const signals: AbortSignal[] = []
+    provider.subscribeThreadEvents.mockImplementation(
+      (_threadId: string, _seq: number, _sink: ThreadEventSink, signal: AbortSignal) => {
+        signals.push(signal)
+        return new Promise<void>((resolve) => {
+          signal.addEventListener('abort', () => resolve(), { once: true })
+        })
+      }
+    )
+
+    let renderer: ReactTestRenderer
+    await act(async () => {
+      renderer = create(createElement(Harness, { threadId: 'thread_a', active: true }))
+    })
+    await vi.waitFor(() => expect(provider.subscribeThreadEvents).toHaveBeenCalledTimes(1))
+
+    await act(async () => {
+      renderer!.update(createElement(Harness, { threadId: 'thread_b', active: true }))
+    })
+    await vi.waitFor(() => expect(provider.subscribeThreadEvents).toHaveBeenCalledTimes(2))
+    expect(signals[0]?.aborted).toBe(true)
+    expect(provider.subscribeThreadEvents.mock.calls[1]?.[0]).toBe('thread_b')
+
+    await act(async () => renderer!.unmount())
+  })
+
+  it('resets the SSE cursor to 0 on thread switch and ignores late owner callbacks', async () => {
+    useGraphStore.setState({
+      threadId: 'thread_a',
+      threadEventSeq: 100,
+      runs: [run('run_a', 100)],
+      syncStatus: 'live'
+    })
+
+    const sinks: ThreadEventSink[] = []
+    provider.subscribeThreadEvents.mockImplementation(
+      (_threadId: string, _seq: number, sink: ThreadEventSink, signal: AbortSignal) => {
+        sinks.push(sink)
+        return new Promise<void>((resolve) => {
+          signal.addEventListener('abort', () => resolve(), { once: true })
+        })
+      }
+    )
+
+    let renderer: ReactTestRenderer
+    await act(async () => {
+      renderer = create(createElement(Harness, { threadId: 'thread_a', active: true }))
+    })
+    await vi.waitFor(() => expect(provider.subscribeThreadEvents).toHaveBeenCalledTimes(1))
+    // Same thread remount/bind must keep cursor (subscribe still sees 100).
+    expect(provider.subscribeThreadEvents.mock.calls[0]?.[1]).toBe(100)
+
+    await act(async () => {
+      renderer!.update(createElement(Harness, { threadId: 'thread_b', active: true }))
+    })
+    await vi.waitFor(() => expect(provider.subscribeThreadEvents).toHaveBeenCalledTimes(2))
+
+    // Critical: second subscribe must not reuse thread-A's cursor.
+    expect(provider.subscribeThreadEvents.mock.calls[1]?.slice(0, 2)).toEqual([
+      'thread_b',
+      0
+    ])
+    expect(useGraphStore.getState().threadEventSeq).toBe(0)
+    expect(useGraphStore.getState().runs).toEqual([])
+
+    await act(async () => {
+      sinks[1]!.onSeq(3)
+      sinks[1]!.onConnected?.()
+    })
+    expect(useGraphStore.getState()).toMatchObject({
+      threadId: 'thread_b',
+      threadEventSeq: 3,
+      syncStatus: 'live'
+    })
+
+    // Late callbacks from the aborted thread-A observer must not pollute B.
+    await act(async () => {
+      sinks[0]!.onSeq(250)
+      sinks[0]!.onConnected?.()
+      // startGraphThreadObserver sets reconnecting on error; ownership must drop it.
+      sinks[0]!.onError(new Error('stale a'))
+    })
+    expect(useGraphStore.getState()).toMatchObject({
+      threadId: 'thread_b',
+      threadEventSeq: 3,
+      syncStatus: 'live'
+    })
+
+    await act(async () => renderer!.unmount())
+  })
+
+  it('preserves cursor when the same thread is hidden and reopened', async () => {
+    provider.subscribeThreadEvents.mockImplementation(
+      (_threadId: string, _seq: number, sink: ThreadEventSink, signal: AbortSignal) => {
+        sink.onSeq(7)
+        return new Promise<void>((resolve) => {
+          signal.addEventListener('abort', () => resolve(), { once: true })
+        })
+      }
+    )
+
+    let renderer: ReactTestRenderer
+    await act(async () => {
+      renderer = create(createElement(Harness, { threadId: 'thread_1', active: true }))
+    })
+    await vi.waitFor(() => expect(useGraphStore.getState().threadEventSeq).toBe(7))
+
+    await act(async () => {
+      renderer!.update(createElement(Harness, { threadId: 'thread_1', active: false }))
+    })
+    expect(useGraphStore.getState().threadEventSeq).toBe(7)
+
+    await act(async () => {
+      renderer!.update(createElement(Harness, { threadId: 'thread_1', active: true }))
+    })
+    await vi.waitFor(() => expect(provider.subscribeThreadEvents).toHaveBeenCalledTimes(2))
+    expect(provider.subscribeThreadEvents.mock.calls[1]?.[1]).toBe(7)
+
+    await act(async () => renderer!.unmount())
+  })
+
+  it('does not clear durable Graph runs while reconnecting', async () => {
+    useGraphStore.setState({
+      threadId: 'thread_1',
+      runs: [run('run_1', 3)],
+      syncStatus: 'live'
+    })
+    provider.subscribeThreadEvents
+      .mockImplementationOnce(async (_t, _s, sink: ThreadEventSink) => {
+        sink.onConnected?.()
+        sink.onError(new Error('socket dropped'))
+      })
+      .mockImplementation(
+        (_threadId: string, _seq: number, _sink: ThreadEventSink, signal: AbortSignal) =>
+          new Promise<void>((resolve) => {
+            signal.addEventListener('abort', () => resolve(), { once: true })
+          })
+      )
+
+    vi.useFakeTimers()
+    let renderer: ReactTestRenderer
+    await act(async () => {
+      renderer = create(createElement(Harness, { threadId: 'thread_1', active: true }))
+      await Promise.resolve()
+    })
+
+    expect(useGraphStore.getState().runs).toHaveLength(1)
+    expect(useGraphStore.getState().runs[0]?.lastEventSeq).toBe(3)
+    expect(useGraphStore.getState().syncStatus).toMatch(/reconnecting|connecting|live|stopped/)
+
+    await act(async () => renderer!.unmount())
+  })
+})
diff --git a/src/renderer/src/graph/use-graph-thread-observer.ts b/src/renderer/src/graph/use-graph-thread-observer.ts
new file mode 100644
index 000000000..419aa1354
--- /dev/null
+++ b/src/renderer/src/graph/use-graph-thread-observer.ts
@@ -0,0 +1,81 @@
+import { useEffect } from 'react'
+import { getProvider } from '../agent/registry'
+import {
+  receiveGraphChildRuntimeEvent,
+  receiveGraphPlanningRuntimeEvent,
+  receiveGraphRuntimeEvent,
+  useGraphStore
+} from './graph-store'
+import {
+  startGraphThreadObserver,
+  type GraphThreadSyncStatus
+} from './graph-thread-observer'
+
+/**
+ * Owns Graph projection SSE for the Graph panel itself (not child-transcript
+ * foregrounding). Independent of chat busy: Lead can finish while Graph runs
+ * continue and this observer keeps projecting runtime state.
+ *
+ * Thread ownership is established only through `bindGraphThread` (atomic). This
+ * hook never patches `threadId` alone, so React effect order cannot leave a
+ * stale SSE cursor bound to a new thread.
+ */
+export function useGraphThreadObserver(
+  threadId: string | null,
+  active: boolean
+): void {
+  useEffect(() => {
+    if (!active || !threadId) {
+      const state = useGraphStore.getState()
+      // Hide/reopen the same thread: keep projection + cursor; only mark idle.
+      if (threadId && state.threadId === threadId) {
+        state.setSyncStatus('idle', threadId)
+      } else if (!threadId && state.syncStatus !== 'idle') {
+        state.setSyncStatus('idle')
+      }
+      return
+    }
+
+    // Atomic: different thread clears projection + zeros threadEventSeq.
+    useGraphStore.getState().bindGraphThread(threadId)
+    const ownedThreadId = threadId
+
+    const observer = startGraphThreadObserver({
+      threadId: ownedThreadId,
+      getSinceSeq: () => {
+        const current = useGraphStore.getState()
+        return current.threadId === ownedThreadId ? current.threadEventSeq : 0
+      },
+      onSeq: (seq) => {
+        useGraphStore.getState().advanceThreadEventSeq(seq, ownedThreadId)
+      },
+      onStatus: (status: GraphThreadSyncStatus) => {
+        useGraphStore.getState().setSyncStatus(status, ownedThreadId)
+      },
+      onGraphEvent: (event) => {
+        if (useGraphStore.getState().threadId !== ownedThreadId) return
+        receiveGraphRuntimeEvent(event)
+      },
+      onChildRuntimeEvent: (event) => {
+        if (useGraphStore.getState().threadId !== ownedThreadId) return
+        receiveGraphChildRuntimeEvent(event)
+      },
+      onGraphPlanningEvent: (event) => {
+        if (useGraphStore.getState().threadId !== ownedThreadId) return
+        receiveGraphPlanningRuntimeEvent(event)
+      },
+      subscribe: (id, sinceSeq, sink, signal) =>
+        getProvider().subscribeThreadEvents(id, sinceSeq, sink, signal),
+      shouldReconnect: () => useGraphStore.getState().threadId === ownedThreadId
+    })
+
+    return () => {
+      observer.stop()
+      const current = useGraphStore.getState()
+      // Do not force 'stopped' over a newer thread's status after a switch.
+      if (current.threadId === ownedThreadId) {
+        current.setSyncStatus('stopped', ownedThreadId)
+      }
+    }
+  }, [active, threadId])
+}
diff --git a/src/renderer/src/hooks/use-thread-usage.ts b/src/renderer/src/hooks/use-thread-usage.ts
index 1358e8c6f..9970c895f 100644
--- a/src/renderer/src/hooks/use-thread-usage.ts
+++ b/src/renderer/src/hooks/use-thread-usage.ts
@@ -243,3 +243,15 @@ export function useThreadUsage(
 ): ThreadUsageSummary | null {
   return useThreadUsageState(threadId, enabled, refreshKey).usage
 }
+
+/** Format a TTFT millisecond value as a compact seconds label (`1.2s`). */
+export function formatTtftSeconds(value: number | null): string | null {
+  if (value == null || !Number.isFinite(value) || value < 0) return null
+  return `${(value / 1_000).toFixed(1)}s`
+}
+
+/** Format tokens-per-second with one decimal (`38.5`). */
+export function formatTps(value: number | null): string | null {
+  if (value == null || !Number.isFinite(value) || value < 0) return null
+  return value.toFixed(1)
+}
diff --git a/src/renderer/src/lib/provider-credential-readiness.test.ts b/src/renderer/src/lib/provider-credential-readiness.test.ts
new file mode 100644
index 000000000..a2b3f2e85
--- /dev/null
+++ b/src/renderer/src/lib/provider-credential-readiness.test.ts
@@ -0,0 +1,76 @@
+import { describe, expect, it } from 'vitest'
+import {
+  connectionCredentialStateById,
+  providerHasUsableCredential,
+  sharedModelConnectionHasUsableCredential,
+  shouldWarnMissingProviderCredential
+} from './provider-credential-readiness'
+
+describe('provider credential readiness', () => {
+  it('treats plaintext apiKey as usable without a shared connection', () => {
+    expect(providerHasUsableCredential({ id: 'deepseek', apiKey: 'sk-test' }, undefined)).toBe(true)
+  })
+
+  it('treats configured shared connections as usable when apiKey is redacted', () => {
+    expect(providerHasUsableCredential(
+      { id: 'grok-subscription', apiKey: '' },
+      { id: 'grok-subscription', configured: true, credentialStatus: 'ready' }
+    )).toBe(true)
+    expect(sharedModelConnectionHasUsableCredential({
+      configured: true,
+      credentialStatus: 'ready'
+    })).toBe(true)
+  })
+
+  it('rejects missing or unreadable shared credentials', () => {
+    expect(providerHasUsableCredential(
+      { id: 'grok-subscription', apiKey: '' },
+      { id: 'grok-subscription', configured: true, credentialStatus: 'missing' }
+    )).toBe(false)
+    expect(providerHasUsableCredential(
+      { id: 'grok-subscription', apiKey: '' },
+      { id: 'grok-subscription', configured: true, credentialStatus: 'unreadable' }
+    )).toBe(false)
+    expect(providerHasUsableCredential(
+      { id: 'grok-subscription', apiKey: '' },
+      { id: 'grok-subscription', configured: false }
+    )).toBe(false)
+  })
+
+  it('looks up credential state by provider id', () => {
+    const states = [
+      { id: 'deepseek', configured: true, credentialStatus: 'ready' as const },
+      { id: 'grok-subscription', configured: true, credentialStatus: 'missing' as const }
+    ]
+    expect(connectionCredentialStateById(states, 'grok-subscription')).toEqual(states[1])
+    expect(connectionCredentialStateById(states, 'missing')).toBeUndefined()
+  })
+
+  it('does not warn for redacted Grok OAuth when the shared connection is ready', () => {
+    expect(shouldWarnMissingProviderCredential({
+      usingCustomProvider: false,
+      provider: { id: 'grok-subscription', apiKey: '' },
+      connectionCredentials: [
+        { id: 'grok-subscription', configured: true, credentialStatus: 'ready' }
+      ]
+    })).toBe(false)
+  })
+
+  it('warns for redacted Grok OAuth when the shared connection is missing credentials', () => {
+    expect(shouldWarnMissingProviderCredential({
+      usingCustomProvider: false,
+      provider: { id: 'grok-subscription', apiKey: '' },
+      connectionCredentials: [
+        { id: 'grok-subscription', configured: true, credentialStatus: 'missing' }
+      ]
+    })).toBe(true)
+  })
+
+  it('suppresses the missing-key warning while credential state is still loading', () => {
+    expect(shouldWarnMissingProviderCredential({
+      usingCustomProvider: false,
+      provider: { id: 'grok-subscription', apiKey: '' },
+      connectionCredentials: null
+    })).toBe(false)
+  })
+})
diff --git a/src/renderer/src/lib/provider-credential-readiness.ts b/src/renderer/src/lib/provider-credential-readiness.ts
new file mode 100644
index 000000000..da0966d28
--- /dev/null
+++ b/src/renderer/src/lib/provider-credential-readiness.ts
@@ -0,0 +1,106 @@
+/**
+ * Renderer-facing helpers for "does this provider already have usable
+ * credentials?" without reading plaintext secrets.
+ *
+ * Canonical connections expose only `configured` / `credentialStatus`;
+ * `settings:get` redacts `provider.apiKey` to an empty string. UI surfaces that
+ * previously checked `apiKey.trim()` alone mis-report OAuth subscriptions
+ * (e.g. grok-subscription) as missing a key.
+ */
+
+export type SharedConnectionCredentialState = {
+  id: string
+  configured: boolean
+  credentialStatus?: 'ready' | 'missing' | 'unreadable'
+}
+
+export function sharedModelConnectionHasUsableCredential(
+  connection: Pick<SharedConnectionCredentialState, 'configured' | 'credentialStatus'> | undefined
+): boolean {
+  return Boolean(
+    connection?.configured &&
+    connection.credentialStatus !== 'missing' &&
+    connection.credentialStatus !== 'unreadable'
+  )
+}
+
+export function providerHasUsableCredential(
+  provider: { id?: string; apiKey?: string } | null | undefined,
+  connection: Pick<SharedConnectionCredentialState, 'configured' | 'credentialStatus'> | undefined
+): boolean {
+  if (provider?.apiKey?.trim()) return true
+  return sharedModelConnectionHasUsableCredential(connection)
+}
+
+export function connectionCredentialStateById(
+  states: readonly SharedConnectionCredentialState[] | null | undefined,
+  providerId: string | undefined
+): SharedConnectionCredentialState | undefined {
+  const id = providerId?.trim()
+  if (!id || !states?.length) return undefined
+  return states.find((item) => item.id === id)
+}
+
+type SharedModelConnectionsSnapshotLike = {
+  schemaVersion?: unknown
+  providers?: unknown
+}
+
+function parseCredentialStates(body: string): SharedConnectionCredentialState[] {
+  let value: SharedModelConnectionsSnapshotLike
+  try {
+    value = JSON.parse(body) as SharedModelConnectionsSnapshotLike
+  } catch {
+    throw new Error('Invalid shared model connection response')
+  }
+  if (value.schemaVersion !== 1 || !Array.isArray(value.providers)) {
+    throw new Error('Invalid shared model connection response')
+  }
+  const states: SharedConnectionCredentialState[] = []
+  for (const entry of value.providers) {
+    if (!entry || typeof entry !== 'object') continue
+    const item = entry as Record<string, unknown>
+    if (typeof item.id !== 'string' || !item.id.trim()) continue
+    if (typeof item.configured !== 'boolean') continue
+    const credentialStatus = item.credentialStatus
+    states.push({
+      id: item.id,
+      configured: item.configured,
+      ...(credentialStatus === 'ready' ||
+      credentialStatus === 'missing' ||
+      credentialStatus === 'unreadable'
+        ? { credentialStatus }
+        : {})
+    })
+  }
+  return states
+}
+
+/**
+ * Whether a capability settings row should warn that the selected provider
+ * still needs credentials. Suppresses the warning while credential state is
+ * still loading (`connectionCredentials == null`).
+ */
+export function shouldWarnMissingProviderCredential(input: {
+  usingCustomProvider: boolean
+  protocolExempt?: boolean
+  provider: { id?: string; apiKey?: string } | null | undefined
+  connectionCredentials: readonly SharedConnectionCredentialState[] | null
+}): boolean {
+  if (input.usingCustomProvider || input.protocolExempt) return false
+  if (input.connectionCredentials == null) return false
+  return !providerHasUsableCredential(
+    input.provider,
+    connectionCredentialStateById(input.connectionCredentials, input.provider?.id)
+  )
+}
+
+/** One-shot GET of credential readiness for all shared model connections. */
+export async function fetchSharedModelConnectionCredentialStates(): Promise<SharedConnectionCredentialState[]> {
+  if (typeof window.kunGui?.runtimeRequest !== 'function') return []
+  const result = await window.kunGui.runtimeRequest('/v1/model-connections', 'GET')
+  if (!result.ok) {
+    throw new Error(`Shared model connection request failed (HTTP ${result.status})`)
+  }
+  return parseCredentialStates(result.body)
+}
diff --git a/src/renderer/src/locales/en/common.json b/src/renderer/src/locales/en/common.json
index b69d4b8d0..8f9a8d097 100644
--- a/src/renderer/src/locales/en/common.json
+++ b/src/renderer/src/locales/en/common.json
@@ -1810,6 +1810,8 @@
   "copySuccess": "Copied",
   "copyFailed": "Copy failed",
   "interrupt": "Stop",
+  "toolCancel": "Stop tool",
+  "toolCancelling": "Stopping tool",
   "connecting": "Connecting…",
   "runtimeOffline": "Kun is unavailable. Check settings or start `kun serve`.",
   "planMode": "Plan",
@@ -2049,16 +2051,19 @@
   "noSessionSelected": "No thread selected",
   "sessionHeaderHint": "Start a thread from the left, or reconnect the runtime to continue working.",
   "sessionUsageTitle": "{{turns}} turns in this thread",
-  "sessionUsageTokens": "{{tokens}} tokens",
+  "sessionUsageTokens": "Cumulative {{tokens}} tokens",
   "sessionUsageCost": "{{cost}}",
-  "sessionUsageContextSavings": "saved {{tokens}} tokens",
-  "sessionUsageContextSavingsTitle": "Saved about {{tokens}} context tokens",
   "sessionUsageTurns": "{{turns}} turns",
+  "turnMetricsTtft": "Avg TTFT {{value}}",
+  "turnMetricsTps": "Avg {{value}} tok/s",
+  "turnMetricsTitle": "Average time-to-first-token (TTFT) and generation speed across all model calls in this answer",
+  "sessionUsageAvgMetrics": "Avg TTFT {{ttft}} · Avg {{tps}} tok/s",
+  "sessionUsageAvgMetricsTitle": "Average time-to-first-token (TTFT) and generation speed across all model calls in this session",
   "sessionUsageCache": "cache {{cache}}",
   "sessionUsageCacheTitle": "Cumulative cache {{cache}} · {{cached}} cached / {{miss}} miss · reasons: {{reasons}} · suggestion: {{suggestions}}",
   "sessionUsageCacheTitleWithLatest": "Latest turn cache {{latestCache}} · cacheable {{cacheableCache}} · total input {{totalInputCache}} · cumulative {{cache}} · {{cached}} cached / {{miss}} miss · reasons: {{reasons}} · suggestion: {{suggestions}}",
-  "sessionUsageDetailsTitle": "{{tokens}} tokens · {{cost}} · saved {{saved}} tokens · cumulative cache {{cache}} · {{cached}} cached / {{miss}} miss · {{turns}} turns",
-  "sessionUsageDetailsTitleWithLatestCache": "{{tokens}} tokens · {{cost}} · saved {{saved}} tokens · latest cache {{latestCache}} · cumulative cache {{cache}} · {{cached}} cached / {{miss}} miss · {{turns}} turns",
+  "sessionUsageDetailsTitle": "{{tokens}} tokens · {{cost}} · cumulative cache {{cache}} · {{cached}} cached / {{miss}} miss · {{turns}} turns",
+  "sessionUsageDetailsTitleWithLatestCache": "{{tokens}} tokens · {{cost}} · latest cache {{latestCache}} · cumulative cache {{cache}} · {{cached}} cached / {{miss}} miss · {{turns}} turns",
   "sessionUsageLoading": "Loading usage",
   "sessionUsageUnavailable": "No usage yet",
   "contextCapacityTitle": "Context window",
@@ -3021,10 +3026,29 @@
   "subagentPolicyReadOnly": "Read-only",
   "subagentPolicyFull": "Full access",
   "subagentOpenSession": "Open sub-session",
-  "subagentSessionBannerTitle": "Subagent session",
-  "subagentSessionBannerSub": "This is a subagent's own session, delegated from “{{title}}”.",
-  "subagentSessionBannerSubUnknown": "This is a subagent's own session, delegated from the parent conversation.",
-  "subagentSessionBannerBack": "Back to parent",
+  "subagentOpenSessionShort": "Open",
+  "exploreKindBadge": "Explore",
+  "exploreTaskDefaultTitle": "Explore task",
+  "exploreViewProcess": "View explore process",
+  "exploreViewProcessShort": "Open",
+  "exploreViewProcessSteps": "View explore process · {{count}} steps",
+  "exploreExpandConclusion": "Show conclusion",
+  "explorePeekPreview": "Preview",
+  "explorePeekTitle": "Explore progress",
+  "explorePeekClose": "Close",
+  "explorePeekLoading": "Loading explore progress…",
+  "explorePeekEmpty": "Waiting for explore steps…",
+  "explorePeekStepTool": "Tool",
+  "explorePeekStepThinking": "Think",
+  "explorePeekStepReply": "Reply",
+  "exploreSessionBannerTitle": "Viewing explore process",
+  "exploreSessionBannerSub": "Exploring for “{{title}}”. Return to the main chat anytime.",
+  "exploreSessionBannerSubUnknown": "Exploring in a side session. Return to the main chat anytime.",
+  "exploreSessionBannerBack": "Back to main chat",
+  "subagentSessionBannerTitle": "Viewing agent process",
+  "subagentSessionBannerSub": "This process was delegated from “{{title}}”. Return to the main chat anytime.",
+  "subagentSessionBannerSubUnknown": "This is a subagent process page. Return to the main chat anytime.",
+  "subagentSessionBannerBack": "Back to main chat",
   "subagentSwarmTitle": "{{count}} subagents",
   "subagentSwarmRunning": "{{count}} running",
   "subagentSwarmQueued": "{{count}} queued",
diff --git a/src/renderer/src/locales/hi/common.json b/src/renderer/src/locales/hi/common.json
index c0f5996fd..a1f736d59 100644
--- a/src/renderer/src/locales/hi/common.json
+++ b/src/renderer/src/locales/hi/common.json
@@ -1810,6 +1810,8 @@
   "copySuccess": "नकल की गई",
   "copyFailed": "प्रतिलिपि विफल",
   "interrupt": "रुकें",
+  "toolCancel": "टूल रोकें",
+  "toolCancelling": "टूल रोक रहे हैं",
   "connecting": "कनेक्ट हो रहा है...",
   "runtimeOffline": "कुन अनुपलब्ध है. सेटिंग्स जांचें या `कुन सर्व` प्रारंभ करें।",
   "planMode": "योजना",
@@ -2049,16 +2051,19 @@
   "noSessionSelected": "कोई थ्रेड चयनित नहीं",
   "sessionHeaderHint": "बाईं ओर से थ्रेड शुरू करें, या काम जारी रखने के लिए रनटाइम को फिर से कनेक्ट करें।",
   "sessionUsageTitle": "{{turns}} turns in this thread",
-  "sessionUsageTokens": "{{tokens}} tokens",
+  "sessionUsageTokens": "कुल {{tokens}} टोकन",
   "sessionUsageCost": "{{cost}}",
-  "sessionUsageContextSavings": "saved {{tokens}} tokens",
-  "sessionUsageContextSavingsTitle": "Saved about {{tokens}} context tokens",
   "sessionUsageTurns": "{{turns}} turns",
+  "turnMetricsTtft": "Avg TTFT {{value}}",
+  "turnMetricsTps": "Avg {{value}} tok/s",
+  "turnMetricsTitle": "Average time-to-first-token (TTFT) and generation speed across all model calls in this answer",
+  "sessionUsageAvgMetrics": "Avg TTFT {{ttft}} · Avg {{tps}} tok/s",
+  "sessionUsageAvgMetricsTitle": "Average time-to-first-token (TTFT) and generation speed across all model calls in this session",
   "sessionUsageCache": "cache {{cache}}",
   "sessionUsageCacheTitle": "Cumulative cache {{cache}} · {{cached}} cached / {{miss}} miss · reasons: {{reasons}} · suggestion: {{suggestions}}",
   "sessionUsageCacheTitleWithLatest": "Latest turn cache {{latestCache}} · cacheable {{cacheableCache}} · total input {{totalInputCache}} · cumulative {{cache}} · {{cached}} cached / {{miss}} miss · reasons: {{reasons}} · suggestion: {{suggestions}}",
-  "sessionUsageDetailsTitle": "{{tokens}} tokens · {{cost}} · saved {{saved}} tokens · cumulative cache {{cache}} · {{cached}} cached / {{miss}} miss · {{turns}} turns",
-  "sessionUsageDetailsTitleWithLatestCache": "{{tokens}} tokens · {{cost}} · saved {{saved}} tokens · latest cache {{latestCache}} · cumulative cache {{cache}} · {{cached}} cached / {{miss}} miss · {{turns}} turns",
+  "sessionUsageDetailsTitle": "{{tokens}} tokens · {{cost}} · cumulative cache {{cache}} · {{cached}} cached / {{miss}} miss · {{turns}} turns",
+  "sessionUsageDetailsTitleWithLatestCache": "{{tokens}} tokens · {{cost}} · latest cache {{latestCache}} · cumulative cache {{cache}} · {{cached}} cached / {{miss}} miss · {{turns}} turns",
   "sessionUsageLoading": "उपयोग लोड हो रहा है",
   "sessionUsageUnavailable": "अभी तक कोई उपयोग नहीं",
   "contextCapacityTitle": "प्रसंग विंडो",
diff --git a/src/renderer/src/locales/ja/common.json b/src/renderer/src/locales/ja/common.json
index 27c193c19..a4273096e 100644
--- a/src/renderer/src/locales/ja/common.json
+++ b/src/renderer/src/locales/ja/common.json
@@ -1810,6 +1810,8 @@
   "copySuccess": "コピーされました",
   "copyFailed": "コピーに失敗しました",
   "interrupt": "停止",
+  "toolCancel": "ツールを停止",
+  "toolCancelling": "ツールを停止中",
   "connecting": "接続中…",
   "runtimeOffline": "くんは不在です。設定を確認するか、「くんサーブ」を起動してください。",
   "planMode": "計画",
@@ -2049,16 +2051,19 @@
   "noSessionSelected": "スレッドが選択されていません",
   "sessionHeaderHint": "左側からスレッドを開始するか、ランタイムを再接続して作業を続行します。",
   "sessionUsageTitle": "このスレッドのターン数は {{turns}} 回です",
-  "sessionUsageTokens": "{{tokens}} tokens",
+  "sessionUsageTokens": "累計 {{tokens}} tokens",
   "sessionUsageCost": "{{cost}}",
-  "sessionUsageContextSavings": "保存された {{tokens}} 個のトークン",
-  "sessionUsageContextSavingsTitle": "{{tokens}} 個のコンテキスト トークンについて保存しました",
   "sessionUsageTurns": "{{turns}} turns",
+  "turnMetricsTtft": "平均 TTFT {{value}}",
+  "turnMetricsTps": "平均 {{value}} tok/s",
+  "turnMetricsTitle": "この回答内の全モデル呼び出しの平均 首トークン遅延（TTFT）と生成速度（tokens/s）",
+  "sessionUsageAvgMetrics": "平均 TTFT {{ttft}} · 平均 {{tps}} tok/s",
+  "sessionUsageAvgMetricsTitle": "このセッションの全モデル呼び出しの平均 首トークン遅延（TTFT）と生成速度（tokens/s）",
   "sessionUsageCache": "cache {{cache}}",
   "sessionUsageCacheTitle": "累積キャッシュ {{cache}} · {{cached}} キャッシュ / {{miss}} ミス · 理由: {{reasons}} · 提案: {{suggestions}}",
   "sessionUsageCacheTitleWithLatest": "最新ターン キャッシュ {{latestCache}} · キャッシュ可能 {{cacheableCache}} · 合計入力 {{totalInputCache}} · 累積 {{cache}} · {{cached}} キャッシュ / {{miss}} ミス · 理由: {{reasons}} · 提案: {{suggestions}}",
-  "sessionUsageDetailsTitle": "{{tokens}} トークン · {{cost}} · 保存された {{saved}} トークン · 累積キャッシュ {{cache}} · {{cached}} キャッシュ / {{miss}} ミス · {{turns}} ターン",
-  "sessionUsageDetailsTitleWithLatestCache": "{{tokens}} トークン · {{cost}} · 保存された {{saved}} トークン · 最新キャッシュ {{latestCache}} · 累積キャッシュ {{cache}} · {{cached}} キャッシュ / {{miss}} ミス · {{turns}} ターン",
+  "sessionUsageDetailsTitle": "{{tokens}} トークン · {{cost}} · 累積キャッシュ {{cache}} · {{cached}} キャッシュ / {{miss}} ミス · {{turns}} ターン",
+  "sessionUsageDetailsTitleWithLatestCache": "{{tokens}} トークン · {{cost}} · 最新キャッシュ {{latestCache}} · 累積キャッシュ {{cache}} · {{cached}} キャッシュ / {{miss}} ミス · {{turns}} ターン",
   "sessionUsageLoading": "使用方法を読み込み中",
   "sessionUsageUnavailable": "まだ使用されていません",
   "contextCapacityTitle": "コンテキストウィンドウ",
diff --git a/src/renderer/src/locales/ko/common.json b/src/renderer/src/locales/ko/common.json
index 0cc113e7a..ee1c06e42 100644
--- a/src/renderer/src/locales/ko/common.json
+++ b/src/renderer/src/locales/ko/common.json
@@ -1810,6 +1810,8 @@
   "copySuccess": "복사됨",
   "copyFailed": "복사 실패",
   "interrupt": "중지",
+  "toolCancel": "도구 중지",
+  "toolCancelling": "도구 중지 중",
   "connecting": "연결 중…",
   "runtimeOffline": "쿤은 이용할 수 없습니다. 설정을 확인하거나 '쿤 서브'를 시작하세요.",
   "planMode": "계획",
@@ -2049,16 +2051,19 @@
   "noSessionSelected": "선택한 스레드가 없습니다.",
   "sessionHeaderHint": "왼쪽에서 스레드를 시작하거나 런타임을 다시 연결하여 작업을 계속하세요.",
   "sessionUsageTitle": "이 스레드에서 {{turns}} 회전",
-  "sessionUsageTokens": "{{tokens}} 토큰",
+  "sessionUsageTokens": "누적 {{tokens}} 토큰",
   "sessionUsageCost": "{{cost}}",
-  "sessionUsageContextSavings": "저장된 {{tokens}} 토큰",
-  "sessionUsageContextSavingsTitle": "약 {{tokens}} 컨텍스트 토큰이 저장되었습니다.",
   "sessionUsageTurns": "{{turns}} 턴",
+  "turnMetricsTtft": "평균 TTFT {{value}}",
+  "turnMetricsTps": "평균 {{value}} tok/s",
+  "turnMetricsTitle": "이 답변의 모든 모델 호출에 대한 평균 첫 토큰 지연(TTFT) 및 생성 속도(tokens/s)",
+  "sessionUsageAvgMetrics": "평균 TTFT {{ttft}} · 평균 {{tps}} tok/s",
+  "sessionUsageAvgMetricsTitle": "이 세션의 모든 모델 호출에 대한 평균 첫 토큰 지연(TTFT) 및 생성 속도(tokens/s)",
   "sessionUsageCache": "cache {{cache}}",
   "sessionUsageCacheTitle": "Cumulative cache {{cache}} · {{cached}} cached / {{miss}} miss · reasons: {{reasons}} · suggestion: {{suggestions}}",
   "sessionUsageCacheTitleWithLatest": "최신 턴 캐시 {{latestCache}} · 캐시 가능 {{cacheableCache}} · 총 입력 {{totalInputCache}} · 누적 {{cache}} · 캐시된 {{cached}} / {{miss}} 누락 · 이유: {{reasons}} · 제안: {{suggestions}}",
-  "sessionUsageDetailsTitle": "{{tokens}} 토큰 · {{cost}} · 저장된 {{saved}} 토큰 · 누적 캐시 {{cache}} · {{cached}} 캐시됨 / {{miss}} 누락 · {{turns}} 턴",
-  "sessionUsageDetailsTitleWithLatestCache": "{{tokens}} 토큰 · {{cost}} · 저장된 {{saved}} 토큰 · 최신 캐시 {{latestCache}} · 누적 캐시 {{cache}} · {{cached}} 캐시됨 / {{miss}} 누락 · {{turns}} 턴",
+  "sessionUsageDetailsTitle": "{{tokens}} 토큰 · {{cost}} · 누적 캐시 {{cache}} · {{cached}} 캐시됨 / {{miss}} 누락 · {{turns}} 턴",
+  "sessionUsageDetailsTitleWithLatestCache": "{{tokens}} 토큰 · {{cost}} · 최신 캐시 {{latestCache}} · 누적 캐시 {{cache}} · {{cached}} 캐시됨 / {{miss}} 누락 · {{turns}} 턴",
   "sessionUsageLoading": "로딩 사용량",
   "sessionUsageUnavailable": "아직 사용량이 없습니다",
   "contextCapacityTitle": "컨텍스트 창",
diff --git a/src/renderer/src/locales/ru/common.json b/src/renderer/src/locales/ru/common.json
index 96660e4a7..a07311f0a 100644
--- a/src/renderer/src/locales/ru/common.json
+++ b/src/renderer/src/locales/ru/common.json
@@ -1810,6 +1810,8 @@
   "copySuccess": "Скопировано",
   "copyFailed": "Не удалось скопировать",
   "interrupt": "Прервать",
+  "toolCancel": "Остановить инструмент",
+  "toolCancelling": "Остановка инструмента",
   "connecting": "Подключение…",
   "runtimeOffline": "Кун недоступен. Проверьте настройки или запустите «Kun Serve».",
   "planMode": "План",
@@ -2049,16 +2051,19 @@
   "noSessionSelected": "Нить не выбрана",
   "sessionHeaderHint": "Запустите поток слева или повторно подключите среду выполнения, чтобы продолжить работу.",
   "sessionUsageTitle": "{{turns}} поворотов в этой теме",
-  "sessionUsageTokens": "{{tokens}} токенов",
+  "sessionUsageTokens": "Всего {{tokens}} токенов",
   "sessionUsageCost": "{{cost}}",
-  "sessionUsageContextSavings": "сохранено токенов {{tokens}}",
-  "sessionUsageContextSavingsTitle": "Сохранено о контекстных токенах {{tokens}}.",
   "sessionUsageTurns": "{{turns}} поворотов",
+  "turnMetricsTtft": "Средний TTFT {{value}}",
+  "turnMetricsTps": "Средняя скорость {{value}} ток/с",
+  "turnMetricsTitle": "Средняя задержка первого токена (TTFT) и скорость генерации (ток/с) по всем вызовам модели в этом ответе",
+  "sessionUsageAvgMetrics": "Средний TTFT {{ttft}} · Средняя скорость {{tps}} ток/с",
+  "sessionUsageAvgMetricsTitle": "Средняя задержка первого токена (TTFT) и скорость генерации (ток/с) по всем вызовам модели в этой сессии",
   "sessionUsageCache": "cache {{cache}}",
   "sessionUsageCacheTitle": "Совокупный кеш {{cache}} · {{cached}} кеширован / {{miss}} промах · причины: {{reasons}} · предложение: {{suggestions}}",
   "sessionUsageCacheTitleWithLatest": "Latest turn cache {{latestCache}} · cacheable {{cacheableCache}} · total input {{totalInputCache}} · cumulative {{cache}} · {{cached}} cached / {{miss}} miss · reasons: {{reasons}} · suggestion: {{suggestions}}",
-  "sessionUsageDetailsTitle": "Жетоны {{tokens}} · {{cost}} · сохраненные жетоны {{saved}} · накопительный кеш {{cache}} · {{cached}} кешированный / {{miss}} промах · {{turns}} ходов",
-  "sessionUsageDetailsTitleWithLatestCache": "{{tokens}} tokens · {{cost}} · saved {{saved}} tokens · latest cache {{latestCache}} · cumulative cache {{cache}} · {{cached}} cached / {{miss}} miss · {{turns}} turns",
+  "sessionUsageDetailsTitle": "Жетоны {{tokens}} · {{cost}} · накопительный кеш {{cache}} · {{cached}} кешированный / {{miss}} промах · {{turns}} ходов",
+  "sessionUsageDetailsTitleWithLatestCache": "{{tokens}} tokens · {{cost}} · latest cache {{latestCache}} · cumulative cache {{cache}} · {{cached}} cached / {{miss}} miss · {{turns}} turns",
   "sessionUsageLoading": "Загрузка использования",
   "sessionUsageUnavailable": "Пока не использовался",
   "contextCapacityTitle": "Контекстное окно",
diff --git a/src/renderer/src/locales/th/common.json b/src/renderer/src/locales/th/common.json
index f66e38c0c..9e3ebb539 100644
--- a/src/renderer/src/locales/th/common.json
+++ b/src/renderer/src/locales/th/common.json
@@ -1810,6 +1810,8 @@
   "copySuccess": "คัดลอกแล้ว",
   "copyFailed": "การคัดลอกล้มเหลว",
   "interrupt": "หยุด",
+  "toolCancel": "หยุดเครื่องมือ",
+  "toolCancelling": "กำลังหยุดเครื่องมือ",
   "connecting": "กำลังเชื่อมต่อ...",
   "runtimeOffline": "คุนไม่ว่าง ตรวจสอบการตั้งค่าหรือเริ่ม `คุนเสิร์ฟ`",
   "planMode": "แผน",
@@ -2049,16 +2051,19 @@
   "noSessionSelected": "ไม่ได้เลือกชุดข้อความ",
   "sessionHeaderHint": "เริ่มเธรดจากด้านซ้าย หรือเชื่อมต่อรันไทม์อีกครั้งเพื่อทำงานต่อ",
   "sessionUsageTitle": "{{turns}} รอบในกระทู้นี้",
-  "sessionUsageTokens": "โทเค็น {{tokens}}",
+  "sessionUsageTokens": "สะสม {{tokens}} โทเค็น",
   "sessionUsageCost": "{{cost}}",
-  "sessionUsageContextSavings": "บันทึกโทเค็น {{tokens}} แล้ว",
-  "sessionUsageContextSavingsTitle": "บันทึกเกี่ยวกับโทเค็นบริบท {{tokens}} แล้ว",
   "sessionUsageTurns": "{{turns}} รอบ",
+  "turnMetricsTtft": "TTFT เฉลี่ย {{value}}",
+  "turnMetricsTps": "เฉลี่ย {{value}} tok/s",
+  "turnMetricsTitle": "ค่าเฉลี่ยเวลาถึงโทเค็นแรก (TTFT) และความเร็วการสร้างข้อความ (tokens/s) ของทุกการเรียกโมเดลในคำตอบนี้",
+  "sessionUsageAvgMetrics": "TTFT เฉลี่ย {{ttft}} · เฉลี่ย {{tps}} tok/s",
+  "sessionUsageAvgMetricsTitle": "ค่าเฉลี่ยเวลาถึงโทเค็นแรก (TTFT) และความเร็วการสร้างข้อความ (tokens/s) ของทุกการเรียกโมเดลในเซสชันนี้",
   "sessionUsageCache": "cache {{cache}}",
   "sessionUsageCacheTitle": "แคชสะสม {{cache}} · แคชไว้ {{cached}} / พลาด {{miss}} · เหตุผล: {{reasons}} · คำแนะนำ: {{suggestions}}",
   "sessionUsageCacheTitleWithLatest": "แคชเทิร์นล่าสุด {{latestCache}} · แคชได้ {{cacheableCache}} · อินพุตทั้งหมด {{totalInputCache}} · สะสม {{cache}} · แคช {{cached}} แคช / {{miss}} พลาด · เหตุผล: {{reasons}} · คำแนะนำ: {{suggestions}}",
-  "sessionUsageDetailsTitle": "โทเค็น {{tokens}} รายการ · {{cost}} · บันทึกแล้ว {{saved}} โทเค็น · แคชสะสม {{cache}} · แคชไว้ {{cached}} รายการ / พลาด {{miss}} ครั้ง · {{turns}} รอบ",
-  "sessionUsageDetailsTitleWithLatestCache": "โทเค็น {{tokens}} รายการ · {{cost}} · บันทึกแล้ว {{saved}} โทเค็น · แคชล่าสุด {{latestCache}} · แคชสะสม {{cache}} · แคชไว้ {{cached}} รายการ / พลาด {{miss}} ครั้ง · {{turns}} รอบ",
+  "sessionUsageDetailsTitle": "โทเค็น {{tokens}} รายการ · {{cost}} · แคชสะสม {{cache}} · แคชไว้ {{cached}} รายการ / พลาด {{miss}} ครั้ง · {{turns}} รอบ",
+  "sessionUsageDetailsTitleWithLatestCache": "โทเค็น {{tokens}} รายการ · {{cost}} · แคชล่าสุด {{latestCache}} · แคชสะสม {{cache}} · แคชไว้ {{cached}} รายการ / พลาด {{miss}} ครั้ง · {{turns}} รอบ",
   "sessionUsageLoading": "กำลังโหลดการใช้งาน",
   "sessionUsageUnavailable": "ยังไม่มีการใช้งาน",
   "contextCapacityTitle": "หน้าต่างบริบท",
diff --git a/src/renderer/src/locales/zh/common.json b/src/renderer/src/locales/zh/common.json
index ea8419286..d546f3bc0 100644
--- a/src/renderer/src/locales/zh/common.json
+++ b/src/renderer/src/locales/zh/common.json
@@ -1810,6 +1810,8 @@
   "copySuccess": "已复制",
   "copyFailed": "复制失败",
   "interrupt": "停止",
+  "toolCancel": "停止工具",
+  "toolCancelling": "正在停止工具",
   "connecting": "连接中…",
   "runtimeOffline": "Kun 不可用。请在设置中检查或先启动 `kun serve`。",
   "planMode": "规划",
@@ -2049,16 +2051,19 @@
   "noSessionSelected": "未选择会话",
   "sessionHeaderHint": "从左侧进入一个会话，或先恢复运行时连接再继续工作。",
   "sessionUsageTitle": "当前会话 {{turns}} 个回合",
-  "sessionUsageTokens": "{{tokens}} tokens",
+  "sessionUsageTokens": "累计 {{tokens}} tokens",
   "sessionUsageCost": "{{cost}}",
-  "sessionUsageContextSavings": "省 {{tokens}} tokens",
-  "sessionUsageContextSavingsTitle": "节省约 {{tokens}} tokens 上下文",
   "sessionUsageTurns": "{{turns}} 回合",
+  "turnMetricsTtft": "平均 TTFT {{value}}",
+  "turnMetricsTps": "平均 {{value}} tok/s",
+  "turnMetricsTitle": "本回答内所有模型调用的平均首 token 延迟（TTFT）与生成速度（tokens/s）",
+  "sessionUsageAvgMetrics": "平均 TTFT {{ttft}} · 平均 {{tps}} tok/s",
+  "sessionUsageAvgMetricsTitle": "本会话所有模型调用的平均首 token 延迟（TTFT）与生成速度（tokens/s）",
   "sessionUsageCache": "cache {{cache}}",
   "sessionUsageCacheTitle": "累计缓存 {{cache}} · {{cached}} 命中 / {{miss}} 未命中 · 原因：{{reasons}} · 建议：{{suggestions}}",
   "sessionUsageCacheTitleWithLatest": "最近一轮缓存 {{latestCache}} · 可缓存 {{cacheableCache}} · 总输入 {{totalInputCache}} · 累计 {{cache}} · {{cached}} 命中 / {{miss}} 未命中 · 原因：{{reasons}} · 建议：{{suggestions}}",
-  "sessionUsageDetailsTitle": "{{tokens}} tokens · {{cost}} · 省 {{saved}} tokens · 累计缓存 {{cache}} · {{cached}} 命中 / {{miss}} 未命中 · {{turns}} 回合",
-  "sessionUsageDetailsTitleWithLatestCache": "{{tokens}} tokens · {{cost}} · 省 {{saved}} tokens · 最近一轮缓存 {{latestCache}} · 累计缓存 {{cache}} · {{cached}} 命中 / {{miss}} 未命中 · {{turns}} 回合",
+  "sessionUsageDetailsTitle": "{{tokens}} tokens · {{cost}} · 累计缓存 {{cache}} · {{cached}} 命中 / {{miss}} 未命中 · {{turns}} 回合",
+  "sessionUsageDetailsTitleWithLatestCache": "{{tokens}} tokens · {{cost}} · 最近一轮缓存 {{latestCache}} · 累计缓存 {{cache}} · {{cached}} 命中 / {{miss}} 未命中 · {{turns}} 回合",
   "sessionUsageLoading": "正在读取用量",
   "sessionUsageUnavailable": "暂无用量",
   "contextCapacityTitle": "上下文容量",
@@ -3021,10 +3026,29 @@
   "subagentPolicyReadOnly": "只读",
   "subagentPolicyFull": "完整权限",
   "subagentOpenSession": "打开子会话",
-  "subagentSessionBannerTitle": "子代理会话",
-  "subagentSessionBannerSub": "这是子代理的独立会话，由「{{title}}」委派。",
-  "subagentSessionBannerSubUnknown": "这是子代理的独立会话，由上级会话委派。",
-  "subagentSessionBannerBack": "返回上级会话",
+  "subagentOpenSessionShort": "打开",
+  "exploreKindBadge": "探索",
+  "exploreTaskDefaultTitle": "探索任务",
+  "exploreViewProcess": "查看探索过程",
+  "exploreViewProcessShort": "查看过程",
+  "exploreViewProcessSteps": "查看探索过程 · {{count}} 步",
+  "exploreExpandConclusion": "展开结论",
+  "explorePeekPreview": "预览",
+  "explorePeekTitle": "探索进度",
+  "explorePeekClose": "关闭",
+  "explorePeekLoading": "正在加载探索进度…",
+  "explorePeekEmpty": "等待探索步骤…",
+  "explorePeekStepTool": "工具",
+  "explorePeekStepThinking": "思考",
+  "explorePeekStepReply": "回复",
+  "exploreSessionBannerTitle": "正在查看探索过程",
+  "exploreSessionBannerSub": "这是「{{title}}」委派的探索过程，可随时返回主对话。",
+  "exploreSessionBannerSubUnknown": "这是探索过程页，可随时返回主对话。",
+  "exploreSessionBannerBack": "返回主对话",
+  "subagentSessionBannerTitle": "正在查看代理过程",
+  "subagentSessionBannerSub": "这是「{{title}}」委派的子代理过程，可随时返回主对话。",
+  "subagentSessionBannerSubUnknown": "这是子代理过程页，可随时返回主对话。",
+  "subagentSessionBannerBack": "返回主对话",
   "subagentSwarmTitle": "{{count}} 子代理",
   "subagentSwarmRunning": "{{count}} 运行",
   "subagentSwarmQueued": "{{count}} 排队",
diff --git a/src/renderer/src/store/chat-projection-reducer.test.ts b/src/renderer/src/store/chat-projection-reducer.test.ts
index 285ee1f69..6e0bb0203 100644
--- a/src/renderer/src/store/chat-projection-reducer.test.ts
+++ b/src/renderer/src/store/chat-projection-reducer.test.ts
@@ -43,9 +43,13 @@ function state(): ChatState {
   } as unknown as ChatState
 }
 
-function project(initial: ChatState, actions: RuntimeProjectionAction[]): ChatState {
+function project(
+  initial: ChatState,
+  actions: RuntimeProjectionAction[],
+  reducerContext = context
+): ChatState {
   return actions.reduce(
-    (current, action) => ({ ...current, ...reduceChatProjection(current, action, context) }),
+    (current, action) => ({ ...current, ...reduceChatProjection(current, action, reducerContext) }),
     initial
   )
 }
@@ -171,6 +175,37 @@ describe('chat projection reducer', () => {
     })
   })
 
+  it('settles an interrupted turn as aborted and closes running tools', () => {
+    const projected = project({
+      ...state(),
+      busy: true,
+      currentTurnId: 'turn_1',
+      threads: [{ ...state().threads[0]!, status: 'running' }],
+      blocks: [{
+        kind: 'tool',
+        id: 'tool_1',
+        turnId: 'turn_1',
+        summary: 'Run command',
+        status: 'running'
+      }]
+    }, [{ type: 'turn_aborted' }], {
+      ...context,
+      settlePendingRuntimeWork: (blocks) => blocks.map((block) =>
+        block.kind === 'tool' && block.status === 'running'
+          ? { ...block, status: 'error' as const }
+          : block
+      )
+    })
+
+    expect(projected.busy).toBe(false)
+    expect(projected.currentTurnId).toBeNull()
+    expect(projected.threads[0]).toMatchObject({
+      status: 'idle',
+      latestTurnStatus: 'aborted'
+    })
+    expect(projected.blocks[0]).toMatchObject({ kind: 'tool', status: 'error' })
+  })
+
   it('clears current-turn orchestration when a Graph turn fails terminally', () => {
     const projected = project({
       ...state(),
@@ -498,7 +533,7 @@ describe('chat projection reducer', () => {
     expect(projected.currentTurnUserId).toBe('item_original_user')
   })
 
-  it('keeps only the latest automatic compaction marker for a turn', () => {
+  it('keeps distinct automatic compaction markers for a turn', () => {
     const projected = project(state(), [
       {
         type: 'compaction_updated',
@@ -523,6 +558,12 @@ describe('chat projection reducer', () => {
     ])
 
     expect(projected.blocks).toEqual([
+      expect.objectContaining({
+        kind: 'compaction',
+        id: 'compaction_1',
+        turnId: 'turn_1',
+        summary: 'first summary'
+      }),
       expect.objectContaining({
         kind: 'compaction',
         id: 'compaction_2',
@@ -532,6 +573,44 @@ describe('chat projection reducer', () => {
     ])
   })
 
+  it('updates one automatic compaction marker across status changes', () => {
+    const projected = project(state(), [
+      {
+        type: 'compaction_updated',
+        payload: {
+          itemId: 'compaction_1',
+          turnId: 'turn_1',
+          summary: 'starting',
+          status: 'running',
+          auto: true
+        }
+      },
+      {
+        type: 'compaction_updated',
+        payload: {
+          itemId: 'compaction_1',
+          turnId: 'turn_1',
+          summary: 'completed summary',
+          status: 'success',
+          auto: true,
+          messagesBefore: 10,
+          messagesAfter: 3
+        }
+      }
+    ])
+
+    expect(projected.blocks).toEqual([
+      expect.objectContaining({
+        kind: 'compaction',
+        id: 'compaction_1',
+        summary: 'completed summary',
+        status: 'success',
+        messagesBefore: 10,
+        messagesAfter: 3
+      })
+    ])
+  })
+
   it('retires a pending approval after its runtime resolution is projected', () => {
     const projected = project(state(), [
       {
@@ -930,3 +1009,107 @@ describe('chat projection reducer', () => {
     expect(projected.blocks.find((block) => block.id === 'assistant_1')).toBe(assistant)
   })
 })
+
+describe('chat projection reducer usage timing metrics', () => {
+  const usageSnapshot = (overrides: Record<string, unknown>) => ({
+    inputTokens: 100,
+    outputTokens: 50,
+    reasoningTokens: 0,
+    cachedTokens: 0,
+    cacheMissTokens: 100,
+    cacheHitRate: 0,
+    totalTokens: 150,
+    costUsd: 0,
+    costCny: null,
+    tokenEconomySavingsTokens: 0,
+    turns: 1,
+    avgTtftMs: null,
+    avgTokensPerSecond: null,
+    turnAvgTtftMs: null,
+    turnAvgTokensPerSecond: null,
+    ...overrides
+  })
+
+  it('stores per-turn averages keyed by the snapshot turnId', () => {
+    const projected = project(state(), [
+      {
+        type: 'usage_received',
+        payload: usageSnapshot({
+          turnId: 'turn_1',
+          turnAvgTtftMs: 1_000,
+          turnAvgTokensPerSecond: 40.2,
+          avgTtftMs: 1_200,
+          avgTokensPerSecond: 38.5
+        })
+      }
+    ])
+
+    expect(projected.turnTimingMetrics.get('turn_1')).toEqual({
+      avgTtftMs: 1_000,
+      avgTokensPerSecond: 40.2
+    })
+  })
+
+  it('clears per-turn metrics when a usage event belongs to a different thread', () => {
+    const first = project(state(), [
+      {
+        type: 'usage_received',
+        payload: usageSnapshot({ turnId: 'turn_1', turnAvgTtftMs: 800 })
+      }
+    ])
+    const switched = project({ ...first, activeThreadId: 'thread_2' }, [
+      {
+        type: 'usage_received',
+        payload: usageSnapshot({ turnId: 'turn_2', turnAvgTtftMs: 500 })
+      }
+    ])
+
+    expect(switched.turnTimingMetrics.has('turn_1')).toBe(false)
+    expect(switched.turnTimingMetrics.get('turn_2')).toEqual({
+      avgTtftMs: 500,
+      avgTokensPerSecond: null
+    })
+  })
+
+  it('removes a turn entry when its snapshot has no timing data', () => {
+    const first = project(state(), [
+      {
+        type: 'usage_received',
+        payload: usageSnapshot({ turnId: 'turn_1', turnAvgTtftMs: 800 })
+      }
+    ])
+    const cleared = project(first, [
+      {
+        type: 'usage_received',
+        payload: usageSnapshot({ turnId: 'turn_1' })
+      }
+    ])
+
+    expect(cleared.turnTimingMetrics.has('turn_1')).toBe(false)
+  })
+
+  it('clears per-turn metrics when the active thread changes', () => {
+    const first = project(state(), [
+      {
+        type: 'usage_received',
+        payload: usageSnapshot({ turnId: 'turn_1', turnAvgTtftMs: 800 })
+      }
+    ])
+    const reconciled = project({ ...first, activeThreadId: 'thread_2' }, [
+      {
+        type: 'thread_snapshot_reconciled',
+        payload: {
+          threadId: 'thread_2',
+          turnId: 'turn_2',
+          userBlockId: 'user_2',
+          latestSeq: 1,
+          blocks: [
+            { kind: 'user', id: 'user_2', turnId: 'turn_2', text: 'Hi' }
+          ]
+        }
+      }
+    ])
+
+    expect(reconciled.turnTimingMetrics.size).toBe(0)
+  })
+})
diff --git a/src/renderer/src/store/chat-projection-reducer.ts b/src/renderer/src/store/chat-projection-reducer.ts
index df5295507..c928c6dab 100644
--- a/src/renderer/src/store/chat-projection-reducer.ts
+++ b/src/renderer/src/store/chat-projection-reducer.ts
@@ -585,17 +585,9 @@ export function reduceChatProjection(
         }
         return { ...base, blocks, error: context.clearRecoveringError(state.error) }
       }
-      const visibleBlocks = event.auto !== false && event.turnId
-        ? state.blocks.filter((block) => !(
-            block.kind === 'compaction' &&
-            block.id !== event.itemId &&
-            block.auto !== false &&
-            block.turnId === event.turnId
-          ))
-        : state.blocks
       return {
         ...base,
-        blocks: [...visibleBlocks, {
+        blocks: [...state.blocks, {
           kind: 'compaction',
           id: event.itemId,
           turnId: event.turnId,
@@ -708,11 +700,26 @@ export function reduceChatProjection(
       return state.activeThreadId === action.payload.threadId
         ? { lastDelegatedRuntimeState: action.payload }
         : {}
-    case 'usage_received':
+    case 'usage_received': {
+      const threadId = state.activeThreadId ?? ''
+      const turnId = action.payload.turnId
+      const turnTimingMetrics = new Map(state.turnTimingMetrics)
+      if (threadId !== (state.lastTurnUsage?.threadId ?? '')) turnTimingMetrics.clear()
+      if (turnId) {
+        const avgTtftMs = action.payload.turnAvgTtftMs
+        const avgTokensPerSecond = action.payload.turnAvgTokensPerSecond
+        if (avgTtftMs != null || avgTokensPerSecond != null) {
+          turnTimingMetrics.set(turnId, { avgTtftMs, avgTokensPerSecond })
+        } else {
+          turnTimingMetrics.delete(turnId)
+        }
+      }
       return {
         usageRefreshKey: state.usageRefreshKey + 1,
-        lastTurnUsage: { threadId: state.activeThreadId ?? '', snapshot: action.payload }
+        lastTurnUsage: { threadId, snapshot: action.payload },
+        turnTimingMetrics
       }
+    }
     case 'thread_snapshot_reconciled': {
       const snapshot = action.payload
       if (state.activeThreadId !== snapshot.threadId) return {}
@@ -750,25 +757,39 @@ export function reduceChatProjection(
               liveAssistantCreatedAt: undefined
             }
           : {}),
+        ...(state.lastTurnUsage && state.lastTurnUsage.threadId !== snapshot.threadId
+          ? { turnTimingMetrics: new Map() }
+          : {}),
         activeThreadGoal: snapshot.goal ?? state.activeThreadGoal,
         activeThreadTodos: snapshot.todos ?? state.activeThreadTodos,
         ...(threads !== state.threads ? { threads } : {}),
         error: context.clearRecoveringError(state.error)
       }
     }
-    case 'turn_completed': {
+    case 'turn_completed':
+    case 'turn_aborted': {
+      const aborted = action.type === 'turn_aborted'
       const threadId = state.activeThreadId
       const threads = threadId
-        ? settleProjectedThreadStatus(state.threads, threadId, 'completed')
+        ? settleProjectedThreadStatus(state.threads, threadId, aborted ? 'aborted' : 'completed')
         : state.threads
       if (!state.busy && !state.currentTurnId) {
-        return threads === state.threads ? {} : { threads }
+        if (!aborted) return threads === state.threads ? {} : { threads }
+        const blocks = context.settlePendingRuntimeWork(state.blocks)
+        return {
+          ...(threads !== state.threads ? { threads } : {}),
+          ...(blocks !== state.blocks ? { blocks } : {})
+        }
       }
       const patch = flushLiveProjection(state, context.now, {
         ...finalizeTurnTimingAt(state, context.now),
         error: null,
         currentTurnId: null,
         currentTurnOrchestration: null,
+        ...(aborted ? {
+          currentTurnUserId: null,
+          blocks: context.settlePendingRuntimeWork(state.blocks)
+        } : {}),
         ...(state.busy ? { busy: false } : {}),
         ...(threads !== state.threads ? { threads } : {})
       })
diff --git a/src/renderer/src/store/chat-store-claw-actions.ts b/src/renderer/src/store/chat-store-claw-actions.ts
index c356d2399..398362c67 100644
--- a/src/renderer/src/store/chat-store-claw-actions.ts
+++ b/src/renderer/src/store/chat-store-claw-actions.ts
@@ -12,6 +12,7 @@ import type { ChatState, ChatStoreGet, ChatStoreSet } from './chat-store-types'
 import type { ChatBlock, NormalizedThread } from '../agent/types'
 import { clawThreadTitleLooksManaged, clawThreadIdsFromChannels } from './chat-store-helpers'
 import { emitRendererSettingsChanged } from '../lib/keyboard-shortcut-settings'
+import { invalidateThreadSnapshot } from './thread-snapshot-cache'
 
 type ClawAgentProviderLike = {
   createThread: (input: { workspace: string; title: string; mode: 'agent' | 'plan' }) => Promise<NormalizedThread>
@@ -531,7 +532,9 @@ export function createClawActions(options: CreateClawActionsOptions): Pick<
         const threadId = clawThreadIdForProvider(channel)
         if (threadId) {
           const provider = getProvider()
-          await provider.deleteThread(threadId).catch(() => undefined)
+          await provider.deleteThread(threadId)
+            .then(() => invalidateThreadSnapshot(threadId))
+            .catch(() => undefined)
         }
       }
       if (nextChannel) {
@@ -590,7 +593,9 @@ export function createClawActions(options: CreateClawActionsOptions): Pick<
         }))
         await get().selectThread(thread.id)
         if (oldThreadId && oldThreadId !== thread.id) {
-          await provider.deleteThread(oldThreadId).catch(() => undefined)
+          await provider.deleteThread(oldThreadId)
+            .then(() => invalidateThreadSnapshot(oldThreadId))
+            .catch(() => undefined)
           await get().refreshThreads()
         }
         set({ error: i18n.t('common:clawSessionCleared') })
diff --git a/src/renderer/src/store/chat-store-initial-state.ts b/src/renderer/src/store/chat-store-initial-state.ts
index a92cee841..ab2e09227 100644
--- a/src/renderer/src/store/chat-store-initial-state.ts
+++ b/src/renderer/src/store/chat-store-initial-state.ts
@@ -25,6 +25,7 @@ export function createInitialChatStoreState(workingDirectoryLabel: string) {
     threadSearch: '',
     showArchivedThreads: false,
     activeThreadId: null,
+    threadLoadingId: null,
     lastCodeThreadId: null,
     activeThreadRelation: null,
     activeThreadParentId: null,
@@ -38,6 +39,7 @@ export function createInitialChatStoreState(workingDirectoryLabel: string) {
     lastContextSnapshot: null,
     lastDelegatedRuntimeState: null,
     lastTurnUsage: null,
+    turnTimingMetrics: new Map(),
     busy: false,
     error: null,
     runtimeErrorDetail: null,
diff --git a/src/renderer/src/store/chat-store-maintenance-actions.ts b/src/renderer/src/store/chat-store-maintenance-actions.ts
index 0e86802b3..9d58129a8 100644
--- a/src/renderer/src/store/chat-store-maintenance-actions.ts
+++ b/src/renderer/src/store/chat-store-maintenance-actions.ts
@@ -35,6 +35,7 @@ import {
   forgetQueuedMessagesForThread,
   saveQueuedMessagesForThread
 } from './queued-message-persistence'
+import { invalidateThreadSnapshot } from './thread-snapshot-cache'
 
 /**
  * Release the worktree pool slot owned by a thread when the task completes
@@ -235,7 +236,7 @@ function resolveCheckpointExpectedWorkspaceRoot(state: {
 export function createMaintenanceActions(
   { set, get, sseAbortRef }: StoreActionContext,
   dependencies: MaintenanceActionDependencies = {}
-): Pick<ChatState, 'renameActiveThread' | 'renameThread' | 'pinThread' | 'archiveThread' | 'compactActiveThread' | 'forkActiveThread' | 'forkThreadFromTurn' | 'setActiveThreadGoal' | 'setActiveThreadGoalStatus' | 'clearActiveThreadGoal' | 'setActiveThreadTodoStatus' | 'clearActiveThreadTodos' | 'syncPlanTodosFromMarkdown' | 'resumeSessionIntoThread' | 'deleteThread' | 'clearDesignHistory' | 'rewindAndResend' | 'rollbackWorkspaceToCheckpoint' | 'resolveApproval' | 'resolveUserInput' | 'interrupt'> {
+): Pick<ChatState, 'renameActiveThread' | 'renameThread' | 'pinThread' | 'archiveThread' | 'compactActiveThread' | 'forkActiveThread' | 'forkThreadFromTurn' | 'setActiveThreadGoal' | 'setActiveThreadGoalStatus' | 'clearActiveThreadGoal' | 'setActiveThreadTodoStatus' | 'clearActiveThreadTodos' | 'syncPlanTodosFromMarkdown' | 'resumeSessionIntoThread' | 'deleteThread' | 'clearDesignHistory' | 'rewindAndResend' | 'rollbackWorkspaceToCheckpoint' | 'resolveApproval' | 'resolveUserInput' | 'interrupt' | 'cancelToolCall'> {
   const prepareCanvasResend = dependencies.prepareCodeCanvasResend ?? prepareCodeCanvasResend
   const openCodeCanvasPanel =
     dependencies.requestCodeCanvasPanelOpen ?? requestCodeCanvasPanelOpen
@@ -380,6 +381,9 @@ export function createMaintenanceActions(
       } else {
         throw new Error(i18n.t('common:runtimeFeatureUnsupported'))
       }
+      // An archived/unarchived projection can differ from the one currently
+      // parked in memory; force a fresh durable snapshot next time.
+      invalidateThreadSnapshot(targetId)
       if (archivingActive) {
         sseAbortRef.current?.abort()
         sseAbortRef.current = null
@@ -802,11 +806,13 @@ export function createMaintenanceActions(
     await Promise.all(originalThreadIds.map(async (threadId) => {
       try {
         await provider.deleteThread(threadId)
+        invalidateThreadSnapshot(threadId)
         runtimeDeletedIds.push(threadId)
       } catch (error) {
         // A retry after an interrupted local cleanup commonly reaches a thread
         // already removed from Kun. That is success for this idempotent action.
         if (getRuntimeErrorCode(error) === 'not_found') {
+          invalidateThreadSnapshot(threadId)
           runtimeDeletedIds.push(threadId)
           return
         }
@@ -988,6 +994,7 @@ export function createMaintenanceActions(
     }
     try {
       await p.deleteThread(targetId)
+      invalidateThreadSnapshot(targetId)
       forgetQueuedMessagesForThread(targetId)
       saveWriteThreadRegistry(forgetWriteThread(targetId))
       saveDesignThreadRegistry(forgetDesignThread(targetId))
@@ -1108,6 +1115,7 @@ export function createMaintenanceActions(
       })
       if (canvasResend) openCodeCanvasPanel()
       await p.rewindThread(state.activeThreadId, turnId)
+      invalidateThreadSnapshot(state.activeThreadId)
       set({
         blocks: trimmedBlocks,
         liveReasoning: '',
@@ -1422,6 +1430,37 @@ export function createMaintenanceActions(
     if (get().activeThreadId === activeThreadId && sseAbortRef.current === null) {
       await get().recoverActiveTurn()
     }
+  },
+
+  cancelToolCall: async (threadId, turnId, callId) => {
+    const normalizedThreadId = threadId.trim()
+    const normalizedTurnId = turnId.trim()
+    const normalizedCallId = callId.trim()
+    if (!normalizedThreadId || !normalizedTurnId || !normalizedCallId) return false
+    const p = getProvider()
+    if (typeof p.cancelToolCall !== 'function') {
+      set({ error: i18n.t('common:runtimeFeatureUnsupported') })
+      return false
+    }
+    try {
+      await p.cancelToolCall(normalizedThreadId, normalizedTurnId, normalizedCallId)
+      return true
+    } catch (e) {
+      const msg = formatRuntimeError(e)
+      void window.kunGui.logError('tool-cancel', 'Failed to cancel tool call', {
+        message: msg,
+        threadId: normalizedThreadId,
+        turnId: normalizedTurnId,
+        callId: normalizedCallId
+      }).catch(() => undefined)
+      set({
+        error: msg,
+        ...(shouldOpenSettingsForError(e)
+          ? { route: 'settings' as const, settingsSection: 'agents' as const }
+          : {})
+      })
+      return false
+    }
   }
   }
 }
diff --git a/src/renderer/src/store/chat-store-navigation-actions.ts b/src/renderer/src/store/chat-store-navigation-actions.ts
index 871e73c13..dd0f8e3e2 100644
--- a/src/renderer/src/store/chat-store-navigation-actions.ts
+++ b/src/renderer/src/store/chat-store-navigation-actions.ts
@@ -43,6 +43,7 @@ import { resolveProjectWorkspacePath } from '../lib/worktree-project-path'
 import { readThreadWorktreeRegistry } from '../lib/thread-worktree-registry'
 import { buildClawRuntimePrompt } from '@shared/app-settings'
 import type { ChatState, ChatStoreGet, ChatStoreSet } from './chat-store-types'
+import { invalidateThreadSnapshot } from './thread-snapshot-cache'
 import {
   activeClawChannel,
   forgetCodeWorkspaceRoot,
@@ -512,6 +513,7 @@ export function createNavigationActions(
         let cleanupError: unknown = null
         try {
           await provider.deleteThread(thread.id)
+          invalidateThreadSnapshot(thread.id)
           saveDesignThreadRegistry(forgetDesignThread(thread.id, readDesignThreadRegistry()))
         } catch (error) {
           cleanupError = error
@@ -902,6 +904,7 @@ export function createNavigationActions(
     try {
       for (const th of workspaceThreads) {
         await p.deleteThread(th.id)
+        invalidateThreadSnapshot(th.id)
       }
       const removeIds = new Set(workspaceThreads.map((th) => th.id))
       const codeWorkspaceRoots = forgetCodeWorkspaceRoot(get().codeWorkspaceRoots, normalizedPath)
diff --git a/src/renderer/src/store/chat-store-runtime-helpers.ts b/src/renderer/src/store/chat-store-runtime-helpers.ts
index b4298c875..83ce0ad2c 100644
--- a/src/renderer/src/store/chat-store-runtime-helpers.ts
+++ b/src/renderer/src/store/chat-store-runtime-helpers.ts
@@ -256,6 +256,7 @@ export function collectAssistantTextForTurn(
 export function clearedThreadSelection(): Pick<
   ChatState,
   | 'activeThreadId'
+  | 'threadLoadingId'
   | 'activeThreadRelation'
   | 'activeThreadParentId'
   | 'activeThreadGoal'
@@ -278,6 +279,7 @@ export function clearedThreadSelection(): Pick<
 > {
   return {
     activeThreadId: null,
+    threadLoadingId: null,
     activeThreadRelation: null,
     activeThreadParentId: null,
     activeThreadGoal: null,
diff --git a/src/renderer/src/store/chat-store-runtime.ts b/src/renderer/src/store/chat-store-runtime.ts
index fe140da37..6c6e7a72f 100644
--- a/src/renderer/src/store/chat-store-runtime.ts
+++ b/src/renderer/src/store/chat-store-runtime.ts
@@ -35,6 +35,7 @@ import {
   threadSnapshotLooksRunning,
   upsertUserBlock
 } from './chat-store-runtime-helpers'
+import { invalidateThreadSnapshot } from './thread-snapshot-cache'
 import {
   isWriteAssistantThread,
   type WriteThreadRegistry
@@ -689,11 +690,11 @@ export function syncTurnCompletionPoll(
   syncTurnCompletionPollImpl(set, get, {
     loadThreadState: async (state, threadId) => {
       const provider = getProvider()
-      return provider.getThreadDetail(threadId)
+      return provider.getThreadState(threadId)
     },
-    threadLooksRunning: threadSnapshotLooksRunning,
-    onCompletedThreads: async (doneIds, state, setState, getState) => {
-      for (const id of doneIds) {
+    threadLooksRunning: (status) => threadSnapshotLooksRunning([], status),
+    onCompletedThreads: async (done, state, setState, getState) => {
+      for (const { id } of done) {
         notifyTurnComplete(
           id,
           state,
@@ -705,13 +706,41 @@ export function syncTurnCompletionPoll(
       setState((snapshot) => {
         const watchTurnCompletion = { ...snapshot.watchTurnCompletion }
         const unreadThreadIds = { ...snapshot.unreadThreadIds }
-        for (const id of doneIds) {
+        for (const { id } of done) {
           delete watchTurnCompletion[id]
           unreadThreadIds[id] = true
         }
-        return { watchTurnCompletion, unreadThreadIds }
+        const completedById = new Map(done.map((item) => [item.id, item.latestTurnStatus]))
+        return {
+          watchTurnCompletion,
+          unreadThreadIds,
+          threads: snapshot.threads.map((thread) => {
+            const latestTurnStatus = completedById.get(thread.id)
+            if (!completedById.has(thread.id)) return thread
+            return {
+              ...thread,
+              status: thread.archived ? thread.status : 'idle',
+              ...(latestTurnStatus ? { latestTurnStatus } : {})
+            }
+          })
+        }
       })
+      for (const { id } of done) invalidateThreadSnapshot(id)
       void getState().refreshThreads()
+    },
+    isMissingThreadError: (error) => getRuntimeErrorCode(error) === 'not_found',
+    onMissingThreads: async (ids, _state, setState) => {
+      for (const id of ids) clearWatchedCompletionNotification(id)
+      setState((snapshot) => {
+        const watchTurnCompletion = { ...snapshot.watchTurnCompletion }
+        const unreadThreadIds = { ...snapshot.unreadThreadIds }
+        for (const id of ids) {
+          delete watchTurnCompletion[id]
+          delete unreadThreadIds[id]
+        }
+        return { watchTurnCompletion, unreadThreadIds }
+      })
+      for (const id of ids) invalidateThreadSnapshot(id)
     }
   })
 }
@@ -1010,7 +1039,7 @@ export function buildThreadEventSink(
       if (!isCurrentStream()) return
       set((state) => reduce(state, { type: 'thread_metadata_changed', payload: event }))
     },
-    onTurnComplete: () => {
+    onTurnComplete: (status = 'completed') => {
       if (!isCurrentStream()) return
       // Reconnect/replay can deliver the same terminal event after the first
       // projection already cleared the active turn. Treat it as a no-op so
@@ -1035,7 +1064,9 @@ export function buildThreadEventSink(
               completedState.liveAssistant
             )
           : ''
-      set((state) => reduce(state, { type: 'turn_completed' }))
+      set((state) => reduce(state, {
+        type: status === 'aborted' ? 'turn_aborted' : 'turn_completed'
+      }))
       if (completedThreadId) clearWatchedCompletionNotification(completedThreadId)
       runEffects(completionProjectionEffects({
         state: completedState,
diff --git a/src/renderer/src/store/chat-store-schedulers.test.ts b/src/renderer/src/store/chat-store-schedulers.test.ts
index 1b3d5d1f1..a241b8ba8 100644
--- a/src/renderer/src/store/chat-store-schedulers.test.ts
+++ b/src/renderer/src/store/chat-store-schedulers.test.ts
@@ -2,7 +2,9 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import {
   armBusyWatchdog,
   clearBusyWatchdog,
-  resetBusyRecoveryAttempts
+  resetBusyRecoveryAttempts,
+  stopTurnCompletionPoll,
+  syncTurnCompletionPoll
 } from './chat-store-schedulers'
 import type { ChatState, ChatStoreSet } from './chat-store-types'
 
@@ -138,3 +140,33 @@ describe('busyTimeout minutes interpolation (#131)', () => {
     expect(h.getState().error as string).toMatch(/已等待 9 分钟/)
   })
 })
+
+describe('syncTurnCompletionPoll', () => {
+  beforeEach(() => vi.useFakeTimers())
+  afterEach(() => {
+    stopTurnCompletionPoll()
+    vi.useRealTimers()
+  })
+
+  it('uses the lightweight status response and clears a completed watch', async () => {
+    const h = makeHarness({
+      runtimeConnection: 'ready',
+      watchTurnCompletion: { thr_background: true }
+    })
+    const loadThreadState = vi.fn(async () => ({ status: 'idle', latestTurnStatus: 'completed' }))
+    const onCompletedThreads = vi.fn(async (done: Array<{ id: string }>) => {
+      h.set({ watchTurnCompletion: {} })
+      expect(done).toEqual([{ id: 'thr_background', latestTurnStatus: 'completed' }])
+    })
+
+    syncTurnCompletionPoll(h.set, h.get, {
+      loadThreadState,
+      threadLooksRunning: (status) => status === 'running',
+      onCompletedThreads
+    })
+    await vi.runAllTimersAsync()
+
+    expect(loadThreadState).toHaveBeenCalledWith(expect.anything(), 'thr_background')
+    expect(onCompletedThreads).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/renderer/src/store/chat-store-schedulers.ts b/src/renderer/src/store/chat-store-schedulers.ts
index 56edc59b9..10dd7f6e4 100644
--- a/src/renderer/src/store/chat-store-schedulers.ts
+++ b/src/renderer/src/store/chat-store-schedulers.ts
@@ -1,4 +1,3 @@
-import type { ChatBlock } from '../agent/types'
 import type { ChatState, ChatStoreGet, ChatStoreSet } from './chat-store-types'
 
 let startupRuntimeProbeTimer: ReturnType<typeof setTimeout> | null = null
@@ -18,16 +17,28 @@ type TurnCompletionPollOptions = {
   loadThreadState: (
     state: ChatState,
     threadId: string
-  ) => Promise<{ blocks: ChatBlock[]; threadStatus?: string }>
-  threadLooksRunning: (blocks: ChatBlock[], threadStatus?: string) => boolean
+  ) => Promise<{ status: string; latestTurnStatus?: string }>
+  threadLooksRunning: (threadStatus: string) => boolean
   onCompletedThreads: (
-    doneIds: string[],
+    done: Array<{ id: string; latestTurnStatus?: string }>,
+    state: ChatState,
+    set: ChatStoreSet,
+    get: ChatStoreGet
+  ) => void | Promise<void>
+  isMissingThreadError?: (error: unknown) => boolean
+  onMissingThreads?: (
+    ids: string[],
     state: ChatState,
     set: ChatStoreSet,
     get: ChatStoreGet
   ) => void | Promise<void>
 }
 
+type CompletionPollOutcome =
+  | { kind: 'completed'; id: string; latestTurnStatus?: string }
+  | { kind: 'missing'; id: string }
+  | null
+
 export function scheduleStartupRuntimeProbe(get: ChatStoreGet): void {
   if (startupRuntimeProbeTimer) {
     clearTimeout(startupRuntimeProbeTimer)
@@ -124,20 +135,29 @@ async function pollTurnCompletionWatch(
     return
   }
 
-  const doneIds: string[] = []
-  for (const threadId of ids) {
+  const outcomes: CompletionPollOutcome[] = await Promise.all(ids.map(async (threadId) => {
     try {
-      const { blocks, threadStatus } = await options.loadThreadState(state, threadId)
-      if (!options.threadLooksRunning(blocks, threadStatus)) {
-        doneIds.push(threadId)
-      }
-    } catch {
-      /* ignore */
+      const thread = await options.loadThreadState(state, threadId)
+      return options.threadLooksRunning(thread.status)
+        ? null
+        : { kind: 'completed' as const, id: threadId, latestTurnStatus: thread.latestTurnStatus }
+    } catch (error) {
+      return options.isMissingThreadError?.(error) ? { kind: 'missing' as const, id: threadId } : null
     }
+  }))
+  const completed = outcomes.filter((outcome): outcome is Extract<CompletionPollOutcome, { kind: 'completed' }> =>
+    outcome?.kind === 'completed'
+  )
+  const done = completed.map(({ id, latestTurnStatus }) => ({ id, latestTurnStatus }))
+  const missingIds = outcomes.flatMap((outcome) =>
+    outcome?.kind === 'missing' ? [outcome.id] : []
+  )
+
+  if (done.length > 0) {
+    await options.onCompletedThreads(done, state, set, get)
   }
-
-  if (doneIds.length > 0) {
-    await options.onCompletedThreads(doneIds, state, set, get)
+  if (missingIds.length > 0) {
+    await options.onMissingThreads?.(missingIds, state, set, get)
   }
 
   if (Object.keys(get().watchTurnCompletion).filter((id) => get().watchTurnCompletion[id]).length === 0) {
diff --git a/src/renderer/src/store/chat-store-side-actions.test.ts b/src/renderer/src/store/chat-store-side-actions.test.ts
index dcdf15d52..60365e00f 100644
--- a/src/renderer/src/store/chat-store-side-actions.test.ts
+++ b/src/renderer/src/store/chat-store-side-actions.test.ts
@@ -42,6 +42,9 @@ class FakeProvider implements AgentProvider {
   async getThreadDetail() {
     return { blocks: [], latestSeq: 0 }
   }
+  async getThreadState() {
+    return { status: 'idle', updatedAt: '', latestSeq: 0 }
+  }
   async sendUserMessage(
     threadId: string,
     text: string,
diff --git a/src/renderer/src/store/chat-store-side-actions.ts b/src/renderer/src/store/chat-store-side-actions.ts
index 6c66ebd0b..52db9a0de 100644
--- a/src/renderer/src/store/chat-store-side-actions.ts
+++ b/src/renderer/src/store/chat-store-side-actions.ts
@@ -19,6 +19,7 @@ import {
 } from './chat-store-helpers'
 import { upsertUserBlock } from './chat-store-runtime-helpers'
 import { monotonicToolStatus } from './chat-projection-reducer'
+import { invalidateThreadSnapshot } from './thread-snapshot-cache'
 import { serviceTierForComposerSelection } from '../components/chat/composer-fast-mode'
 
 type SideContext = {
@@ -917,6 +918,7 @@ export function createSideActions(ctx: SideContext): Pick<
         const provider = ctx.getProvider()
         try {
           await provider.deleteThread(sideId)
+          invalidateThreadSnapshot(sideId)
         } catch (e) {
           ctx.set({
             error: ctx.formatRuntimeError(e),
diff --git a/src/renderer/src/store/chat-store-thread-actions.test.ts b/src/renderer/src/store/chat-store-thread-actions.test.ts
index 4af0489aa..cf98887a9 100644
--- a/src/renderer/src/store/chat-store-thread-actions.test.ts
+++ b/src/renderer/src/store/chat-store-thread-actions.test.ts
@@ -11,6 +11,7 @@ import {
   queuedMessagesForThread,
   saveQueuedMessagesForThread
 } from './queued-message-persistence'
+import { clearThreadSnapshotCache } from './thread-snapshot-cache'
 
 const registryMock = vi.hoisted(() => ({
   getProvider: vi.fn()
@@ -111,6 +112,7 @@ function expectSink(sink: ThreadEventSink | null): ThreadEventSink {
 
 describe('chat-store-thread-actions queued messages', () => {
   beforeEach(() => {
+    clearThreadSnapshotCache()
     rendererRuntimeClient.invalidateSettings()
     registryMock.getProvider.mockReset()
     registryMock.getProvider.mockReturnValue({})
@@ -314,6 +316,82 @@ describe('chat-store-thread-actions queued messages', () => {
     expect(state.blocks).toEqual([])
   })
 
+  it('selects immediately, then settles a stale running sidebar summary from idle detail', async () => {
+    const detail = deferredValue<{
+      blocks: ChatBlock[]
+      latestSeq: number
+      threadStatus: 'idle'
+      latestTurnStatus: 'completed'
+    }>()
+    registryMock.getProvider.mockReturnValue({
+      getThreadDetail: vi.fn(() => detail.promise),
+      subscribeThreadEvents: vi.fn(async () => undefined)
+    })
+    const { actions, state } = buildHarness()
+    state.busy = false
+    state.composerPickList = []
+    state.composerModelGroups = []
+    state.threads = [thread('thr_existing'), { ...thread('thr_idle'), status: 'running' }]
+
+    const selecting = actions.selectThread('thr_idle')
+    expect(state.activeThreadId).toBe('thr_idle')
+    expect(state.threadLoadingId).toBe('thr_idle')
+    expect(state.blocks).toEqual([])
+
+    detail.resolve({
+      blocks: [{ kind: 'assistant', id: 'a-idle', text: 'already complete' }],
+      latestSeq: 17,
+      threadStatus: 'idle',
+      latestTurnStatus: 'completed'
+    })
+    await selecting
+
+    expect(state.threadLoadingId).toBeNull()
+    expect(state.busy).toBe(false)
+    expect(state.threads.find((thread) => thread.id === 'thr_idle')).toMatchObject({
+      status: 'idle',
+      latestTurnStatus: 'completed'
+    })
+  })
+
+  it('restores a cached thread without a second detail request and resumes SSE at its cursor', async () => {
+    const subscribeThreadEvents = vi.fn(async () => undefined)
+    const getThreadDetail = vi.fn(async (id: string) => {
+      if (id === 'thr_b') {
+        return {
+          blocks: [{ kind: 'assistant' as const, id: 'b-answer', text: 'B' }],
+          latestSeq: 22,
+          threadStatus: 'idle'
+        }
+      }
+      throw new Error(`unexpected detail request for ${id}`)
+    })
+    registryMock.getProvider.mockReturnValue({ getThreadDetail, subscribeThreadEvents })
+    const { actions, state } = buildHarness()
+    state.busy = false
+    state.composerPickList = []
+    state.composerModelGroups = []
+    state.activeThreadId = 'thr_a'
+    state.blocks = [{ kind: 'assistant', id: 'a-answer', text: 'A' }]
+    state.lastSeq = 11
+    state.liveDeltaSeqFloor = 11
+    state.threads = [thread('thr_a'), thread('thr_b')]
+
+    await actions.selectThread('thr_b')
+    await actions.selectThread('thr_a')
+
+    expect(getThreadDetail).toHaveBeenCalledTimes(1)
+    expect(getThreadDetail).toHaveBeenCalledWith('thr_b')
+    expect(state.blocks).toEqual([{ kind: 'assistant', id: 'a-answer', text: 'A' }])
+    expect(state.lastSeq).toBe(11)
+    expect(subscribeThreadEvents).toHaveBeenLastCalledWith(
+      'thr_a',
+      11,
+      expect.anything(),
+      expect.anything()
+    )
+  })
+
   it('records a Code thread selection as the last Code session memory', async () => {
     registryMock.getProvider.mockReturnValue({
       getThreadDetail: vi.fn(async () => ({ blocks: [], latestSeq: 0, threadStatus: 'idle' })),
@@ -1693,6 +1771,7 @@ describe('chat-store-thread-actions queued messages', () => {
 
 describe('chat-store-thread-actions subscribeThreadEventsLive', () => {
   beforeEach(() => {
+    clearThreadSnapshotCache()
     rendererRuntimeClient.invalidateSettings()
     registryMock.getProvider.mockReset()
     registryMock.getProvider.mockReturnValue({})
diff --git a/src/renderer/src/store/chat-store-thread-actions.ts b/src/renderer/src/store/chat-store-thread-actions.ts
index 42b9013e0..56188f0a0 100644
--- a/src/renderer/src/store/chat-store-thread-actions.ts
+++ b/src/renderer/src/store/chat-store-thread-actions.ts
@@ -125,6 +125,7 @@ import {
   turnCompleteNotificationSource,
   watchTurnCompletionNotification
 } from './chat-store-runtime'
+import { getThreadSnapshot, snapshotThreadProjection } from './thread-snapshot-cache'
 import {
   composerSelectionForThread,
   ensureRuntimeProviderForSend,
@@ -566,8 +567,7 @@ export function createThreadActions(
     const prevBusy = previousState.busy
     const selectionStillCurrent = (): boolean => {
       if (selectionGeneration !== threadSelectionGeneration) return false
-      const currentId = get().activeThreadId
-      return currentId === prevId || currentId === id
+      return get().activeThreadId === id
     }
     let nextWatch = { ...get().watchTurnCompletion }
     delete nextWatch[id]
@@ -587,14 +587,112 @@ export function createThreadActions(
     sseAbortRef.current = null
     const p = getProvider()
     const durableQueuedMessages = queuedMessagesForThread(id)
+    // Park the outgoing renderer projection before its state is replaced. This
+    // is intentionally O(1): blocks stay immutable while another thread is
+    // active, so no expensive JSON serialization runs on the click path.
+    if (prevId && prevId !== id) snapshotThreadProjection(previousState)
+    // Re-selecting the active conversation is an explicit refresh (and is
+    // used by recovery paths to pick up durable queues), so only cross-thread
+    // navigation may consume an in-memory snapshot.
+    const cached = prevId !== id ? getThreadSnapshot(id) : null
+    const targetThread = get().threads.find((thread) => thread.id === id) ?? null
+    resetBusyRecoveryAttempts()
+    clearBusyWatchdog()
+    if (cached) {
+      const queuedMessages = reconcileQueuedMessages(cached.queuedMessages, {
+        busy: cached.busy,
+        turnId: cached.currentTurnId ?? undefined,
+        blocks: cached.blocks
+      })
+      const remembersCodeThread = targetThread != null &&
+        targetThread.archived !== true &&
+        isCodeSidebarThread(
+          targetThread,
+          get().clawChannels,
+          readWriteThreadRegistry(),
+          readDesignThreadRegistry(),
+          readSddThreadRegistry()
+        )
+      set((state) => ({
+        watchTurnCompletion: nextWatch,
+        unreadThreadIds: nextUnread,
+        activeThreadId: id,
+        threadLoadingId: null,
+        activeThreadRelation: cached.activeThreadRelation ?? 'primary',
+        activeThreadParentId: cached.activeThreadParentId,
+        activeThreadGoal: cached.activeThreadGoal,
+        activeThreadTodos: cached.activeThreadTodos,
+        blocks: cached.blocks,
+        lastSeq: cached.lastSeq,
+        liveDeltaSeqFloor: cached.liveDeltaSeqFloor,
+        liveReasoning: cached.liveReasoning,
+        liveAssistant: cached.liveAssistant,
+        error: null,
+        busy: cached.busy,
+        currentTurnId: cached.currentTurnId,
+        currentTurnOrchestration: cached.currentTurnOrchestration,
+        currentTurnUserId: cached.currentTurnUserId,
+        turnStartedAtByUserId: cached.turnStartedAtByUserId,
+        turnDurationByUserId: cached.turnDurationByUserId,
+        turnReasoningFirstAtByUserId: cached.turnReasoningFirstAtByUserId,
+        turnReasoningLastAtByUserId: cached.turnReasoningLastAtByUserId,
+        inspectorSelectedId: null,
+        queuedMessages,
+        composerMode: cached.composerMode,
+        composerModel: cached.composerModel,
+        composerProviderId: cached.composerProviderId,
+        composerReasoningEffort: cached.composerReasoningEffort,
+        threads: state.threads.map((thread) => thread.id === id
+          ? { ...thread, status: cached.busy ? 'running' : 'idle' }
+          : thread),
+        ...(remembersCodeThread ? { lastCodeThreadId: id } : {})
+      }))
+      saveQueuedMessagesForThread(id, queuedMessages)
+      syncTurnCompletionPoll(set, get)
+      const ac = new AbortController()
+      sseAbortRef.current = ac
+      const sink = buildThreadEventSink(set, get, { threadId: id, signal: ac.signal, sinceSeq: cached.lastSeq })
+      subscribeThreadEventsWithRecovery(p, id, cached.lastSeq, sink, ac.signal, get)
+      if (cached.busy) armBusyWatchdog(set, get)
+      else if (queuedMessages.some(isPendingQueuedMessage)) void get().drainQueuedMessages()
+      return
+    }
+    // Give the sidebar its selected state in this render frame. The timeline
+    // shows a skeleton and the composer is disabled until detail hydration
+    // commits, preventing sends against an unhydrated thread.
+    set({
+      watchTurnCompletion: nextWatch,
+      unreadThreadIds: nextUnread,
+      activeThreadId: id,
+      threadLoadingId: id,
+      activeThreadRelation: targetThread?.relation ?? 'primary',
+      activeThreadParentId: targetThread?.parentThreadId ?? null,
+      activeThreadGoal: targetThread?.goal ?? null,
+      activeThreadTodos: targetThread?.todos ?? null,
+      blocks: [],
+      lastSeq: 0,
+      liveDeltaSeqFloor: 0,
+      liveReasoning: '',
+      liveAssistant: '',
+      busy: false,
+      currentTurnId: null,
+      currentTurnOrchestration: null,
+      currentTurnUserId: null,
+      turnStartedAtByUserId: {},
+      turnDurationByUserId: {},
+      turnReasoningFirstAtByUserId: {},
+      turnReasoningLastAtByUserId: {},
+      inspectorSelectedId: null,
+      queuedMessages: [],
+      error: null
+    })
     try {
-      resetBusyRecoveryAttempts()
-      clearBusyWatchdog()
       const {
         blocks: rawBlocks,
         latestSeq,
         threadStatus,
         latestTurnId,
+        latestTurnStatus,
         latestTurnOrchestration,
         latestUserMessageId,
         turnDurationByUserId = {},
@@ -603,7 +701,8 @@ export function createThreadActions(
         parentThreadId: threadParentId,
         model: threadModel,
         goal,
-        todos
+        todos,
+        payloadBytes
       } = await p.getThreadDetail(id)
       if (!selectionStillCurrent()) return
       // A subagent's `side` thread has no locally-stored per-turn model labels
@@ -653,6 +752,7 @@ export function createThreadActions(
         watchTurnCompletion: nextWatch,
         unreadThreadIds: nextUnread,
         activeThreadId: id,
+        threadLoadingId: null,
         activeThreadRelation: threadRelation ?? 'primary',
         activeThreadParentId: threadParentId ?? null,
         activeThreadGoal: goal ?? null,
@@ -674,6 +774,13 @@ export function createThreadActions(
         inspectorSelectedId: null,
         queuedMessages,
         composerMode,
+        threads: get().threads.map((thread) => thread.id === id
+          ? {
+              ...thread,
+              status: thread.archived ? thread.status : (busy ? 'running' : 'idle'),
+              ...(latestTurnStatus ? { latestTurnStatus } : {})
+            }
+          : thread),
         ...(remembersCodeThread ? { lastCodeThreadId: id } : {}),
         ...(composerSelection
           ? {
@@ -687,6 +794,7 @@ export function createThreadActions(
             }
           : {})
       })
+      snapshotThreadProjection(get(), payloadBytes)
       saveQueuedMessagesForThread(id, queuedMessages)
       syncTurnCompletionPoll(set, get)
       const ac = new AbortController()
@@ -701,6 +809,7 @@ export function createThreadActions(
     } catch (e) {
       if (!selectionStillCurrent()) return
       set({
+        threadLoadingId: null,
         error: formatRuntimeError(e),
         ...(shouldOpenSettingsForError(e)
           ? { route: 'settings' as const, settingsSection: 'agents' as const }
@@ -733,6 +842,7 @@ export function createThreadActions(
     clearBusyWatchdog()
     set({
       activeThreadId: targetThreadId,
+      threadLoadingId: null,
       blocks: keepExistingBlocks ? prevState.blocks : [],
       lastSeq: fallbackSinceSeq,
       liveDeltaSeqFloor: fallbackSinceSeq,
diff --git a/src/renderer/src/store/chat-store-types.ts b/src/renderer/src/store/chat-store-types.ts
index b708d24ce..cb9ff307a 100644
--- a/src/renderer/src/store/chat-store-types.ts
+++ b/src/renderer/src/store/chat-store-types.ts
@@ -221,6 +221,11 @@ export type SideConversation = {
   error: string | null
 }
 
+export type TurnTimingMetrics = {
+  avgTtftMs: number | null
+  avgTokensPerSecond: number | null
+}
+
 export type SidePanelState = {
   open: boolean
   activeSideId: string | null
@@ -252,6 +257,8 @@ export type ChatState = {
   threadSearch: string
   showArchivedThreads: boolean
   activeThreadId: string | null
+  /** Thread selected immediately but whose durable snapshot is still loading. */
+  threadLoadingId: string | null
   /** 最近一次在 Code 工作台(chat 路由)选中的会话,供从设置/其他工作区/Connect Phone 返回时恢复。 */
   lastCodeThreadId: string | null
   /** Relationship of the active thread (e.g. `side` for a subagent's own session). */
@@ -296,6 +303,11 @@ export type ChatState = {
    * This is billing/cache telemetry and must not be used as context occupancy.
    */
   lastTurnUsage: { threadId: string; snapshot: ThreadUsageSnapshot } | null
+  /**
+   * Per-turn TTFT/TPS averages for the active thread, keyed by turnId. Bounded
+   * to the turns currently visible in the timeline; cleared on thread switch.
+   */
+  turnTimingMetrics: Map<string, TurnTimingMetrics>
   busy: boolean
   error: string | null
   runtimeErrorDetail: string | null
@@ -444,6 +456,7 @@ export type ChatState = {
   rewindAndResend: (userBlockId: string, newText: string) => Promise<void>
   rollbackWorkspaceToCheckpoint: (checkpointId: string) => Promise<void>
   interrupt: (options?: { discard?: boolean }) => Promise<void>
+  cancelToolCall: (threadId: string, turnId: string, callId: string) => Promise<boolean>
   renameActiveThread: (title: string) => Promise<void>
   renameThread: (threadId: string, title: string) => Promise<void>
   pinThread: (threadId: string, pinned: boolean) => Promise<void>
diff --git a/src/renderer/src/store/thread-snapshot-cache.test.ts b/src/renderer/src/store/thread-snapshot-cache.test.ts
new file mode 100644
index 000000000..53647090a
--- /dev/null
+++ b/src/renderer/src/store/thread-snapshot-cache.test.ts
@@ -0,0 +1,59 @@
+import { afterEach, describe, expect, it } from 'vitest'
+import type { ChatState } from './chat-store-types'
+import {
+  clearThreadSnapshotCache,
+  getThreadSnapshot,
+  snapshotThreadProjection,
+  THREAD_SNAPSHOT_CACHE_MAX_BYTES,
+  threadSnapshotCacheStats
+} from './thread-snapshot-cache'
+
+function stateFor(threadId: string): ChatState {
+  return {
+    activeThreadId: threadId,
+    threadLoadingId: null,
+    blocks: [{ kind: 'assistant', id: `${threadId}-answer`, text: threadId }],
+    lastSeq: 1,
+    liveDeltaSeqFloor: 1,
+    liveReasoning: '',
+    liveAssistant: '',
+    busy: false,
+    currentTurnId: null,
+    currentTurnOrchestration: null,
+    currentTurnUserId: null,
+    turnStartedAtByUserId: {},
+    turnDurationByUserId: {},
+    turnReasoningFirstAtByUserId: {},
+    turnReasoningLastAtByUserId: {},
+    activeThreadRelation: 'primary',
+    activeThreadParentId: null,
+    activeThreadGoal: null,
+    activeThreadTodos: null,
+    queuedMessages: [],
+    composerMode: 'agent',
+    composerModel: '',
+    composerProviderId: '',
+    composerReasoningEffort: 'max'
+  } as unknown as ChatState
+}
+
+describe('thread snapshot cache', () => {
+  afterEach(() => clearThreadSnapshotCache())
+
+  it('keeps an LRU of six renderer projections', () => {
+    for (let index = 0; index < 7; index += 1) {
+      snapshotThreadProjection(stateFor(`thr_${index}`), 1)
+    }
+
+    expect(threadSnapshotCacheStats()).toEqual({ entries: 6, bytes: 6 })
+    expect(getThreadSnapshot('thr_0')).toBeNull()
+    expect(getThreadSnapshot('thr_6')?.lastSeq).toBe(1)
+  })
+
+  it('does not retain one snapshot larger than the shared byte budget', () => {
+    snapshotThreadProjection(stateFor('thr_large'), THREAD_SNAPSHOT_CACHE_MAX_BYTES + 1)
+
+    expect(getThreadSnapshot('thr_large')).toBeNull()
+    expect(threadSnapshotCacheStats()).toEqual({ entries: 0, bytes: 0 })
+  })
+})
diff --git a/src/renderer/src/store/thread-snapshot-cache.ts b/src/renderer/src/store/thread-snapshot-cache.ts
new file mode 100644
index 000000000..cf0753d11
--- /dev/null
+++ b/src/renderer/src/store/thread-snapshot-cache.ts
@@ -0,0 +1,127 @@
+import type { ChatState, QueuedUserMessage } from './chat-store-types'
+import type { ChatBlock, ThreadGoal, ThreadTodoList } from '../agent/types'
+
+export const THREAD_SNAPSHOT_CACHE_MAX_ENTRIES = 6
+export const THREAD_SNAPSHOT_CACHE_MAX_BYTES = 32 * 1024 * 1024
+// A snapshot normally gets the actual HTTP payload size on hydration. The
+// conservative fallback still makes a locally-created thread bounded if it is
+// switched away before a durable detail response has been observed.
+const UNKNOWN_SNAPSHOT_BYTES = 4 * 1024 * 1024
+
+export type ThreadSnapshot = {
+  threadId: string
+  blocks: ChatBlock[]
+  lastSeq: number
+  liveDeltaSeqFloor: number
+  liveReasoning: string
+  liveAssistant: string
+  busy: boolean
+  currentTurnId: string | null
+  currentTurnOrchestration: 'direct' | 'graph' | null
+  currentTurnUserId: string | null
+  turnStartedAtByUserId: Record<string, number>
+  turnDurationByUserId: Record<string, number>
+  turnReasoningFirstAtByUserId: Record<string, number>
+  turnReasoningLastAtByUserId: Record<string, number>
+  activeThreadRelation: 'primary' | 'fork' | 'side' | null
+  activeThreadParentId: string | null
+  activeThreadGoal: ThreadGoal | null
+  activeThreadTodos: ThreadTodoList | null
+  queuedMessages: QueuedUserMessage[]
+  composerMode: 'plan' | 'agent'
+  composerModel: string
+  composerProviderId: string
+  composerReasoningEffort: ChatState['composerReasoningEffort']
+  payloadBytes: number
+}
+
+const snapshots = new Map<string, ThreadSnapshot>()
+let totalBytes = 0
+
+function normalizedPayloadBytes(value: number | undefined): number {
+  return Number.isFinite(value) && (value ?? 0) > 0
+    ? Math.floor(value as number)
+    : UNKNOWN_SNAPSHOT_BYTES
+}
+
+function evictUntilBounded(): void {
+  while (
+    snapshots.size > THREAD_SNAPSHOT_CACHE_MAX_ENTRIES ||
+    totalBytes > THREAD_SNAPSHOT_CACHE_MAX_BYTES
+  ) {
+    const oldestId = snapshots.keys().next().value as string | undefined
+    if (!oldestId) return
+    const oldest = snapshots.get(oldestId)
+    snapshots.delete(oldestId)
+    totalBytes -= oldest?.payloadBytes ?? 0
+  }
+}
+
+export function snapshotThreadProjection(state: ChatState, payloadBytes?: number): void {
+  const threadId = state.activeThreadId
+  if (!threadId || state.threadLoadingId === threadId) return
+  const existing = snapshots.get(threadId)
+  const bytes = normalizedPayloadBytes(payloadBytes ?? existing?.payloadBytes)
+  if (bytes > THREAD_SNAPSHOT_CACHE_MAX_BYTES) {
+    invalidateThreadSnapshot(threadId)
+    return
+  }
+  if (existing) {
+    snapshots.delete(threadId)
+    totalBytes -= existing.payloadBytes
+  }
+  snapshots.set(threadId, {
+    threadId,
+    blocks: state.blocks,
+    lastSeq: state.lastSeq,
+    liveDeltaSeqFloor: state.liveDeltaSeqFloor,
+    liveReasoning: state.liveReasoning,
+    liveAssistant: state.liveAssistant,
+    busy: state.busy,
+    currentTurnId: state.currentTurnId,
+    currentTurnOrchestration: state.currentTurnOrchestration,
+    currentTurnUserId: state.currentTurnUserId,
+    turnStartedAtByUserId: state.turnStartedAtByUserId,
+    turnDurationByUserId: state.turnDurationByUserId,
+    turnReasoningFirstAtByUserId: state.turnReasoningFirstAtByUserId,
+    turnReasoningLastAtByUserId: state.turnReasoningLastAtByUserId,
+    activeThreadRelation: state.activeThreadRelation,
+    activeThreadParentId: state.activeThreadParentId,
+    activeThreadGoal: state.activeThreadGoal,
+    activeThreadTodos: state.activeThreadTodos,
+    queuedMessages: state.queuedMessages,
+    composerMode: state.composerMode,
+    composerModel: state.composerModel,
+    composerProviderId: state.composerProviderId,
+    composerReasoningEffort: state.composerReasoningEffort,
+    payloadBytes: bytes
+  })
+  totalBytes += bytes
+  evictUntilBounded()
+}
+
+export function getThreadSnapshot(threadId: string): ThreadSnapshot | null {
+  const snapshot = snapshots.get(threadId)
+  if (!snapshot) return null
+  // Map insertion order is our LRU ordering.
+  snapshots.delete(threadId)
+  snapshots.set(threadId, snapshot)
+  return snapshot
+}
+
+export function invalidateThreadSnapshot(threadId: string): void {
+  const existing = snapshots.get(threadId)
+  if (!existing) return
+  snapshots.delete(threadId)
+  totalBytes -= existing.payloadBytes
+}
+
+export function clearThreadSnapshotCache(): void {
+  snapshots.clear()
+  totalBytes = 0
+}
+
+/** Test-only, kept narrow so product code never depends on cache internals. */
+export function threadSnapshotCacheStats(): { entries: number; bytes: number } {
+  return { entries: snapshots.size, bytes: totalBytes }
+}
diff --git a/src/shared/app-settings-kun.ts b/src/shared/app-settings-kun.ts
index 0846b9651..a339e3d8d 100644
--- a/src/shared/app-settings-kun.ts
+++ b/src/shared/app-settings-kun.ts
@@ -647,12 +647,15 @@ export function mergeKunRuntimeSettings(
   const nextLab = mergeKunLabSettings(current.lab, patch?.lab)
   // Do not let the nested partial patch leak through the broad object spread;
   // `nextSubagents` below is the fully materialized authoritative value.
+  // Primary `model` is handled separately: empty strings must not wipe the
+  // chat model (settings:set rejects model: '' via modelIdSchema.min(1)).
   const {
     subagents: _subagentsPatch,
     projectConfig: _projectConfigPatch,
     graph: _graphPatch,
     llmDebug: _llmDebugPatch,
     lab: _labPatch,
+    model: _modelPatch,
     ...flatPatch
   } = patch ?? {}
   void _subagentsPatch
@@ -660,6 +663,11 @@ export function mergeKunRuntimeSettings(
   void _graphPatch
   void _llmDebugPatch
   void _labPatch
+  void _modelPatch
+  const nextModel = nonEmptyStringOrFallback(
+    patch?.model,
+    nonEmptyStringOrFallback(current.model, DEFAULT_KUN_MODEL)
+  )
   // NOTE: approvalPolicy/sandboxMode/reviewer are merged through verbatim from
   // the patch. The three-mode UI selector resolves a deliberate selection to
   // its complete authority snapshot before dispatching the patch. We must NOT
@@ -668,6 +676,7 @@ export function mergeKunRuntimeSettings(
   const merged: KunRuntimeSettingsV1 = {
     ...current,
     ...flatPatch,
+    model: nextModel,
     approvalReviewer: normalizeApprovalReviewer(
       patch?.approvalReviewer ?? current.approvalReviewer
     ),
diff --git a/src/shared/app-settings-provider.test.ts b/src/shared/app-settings-provider.test.ts
index 408eeb260..85d8acd55 100644
--- a/src/shared/app-settings-provider.test.ts
+++ b/src/shared/app-settings-provider.test.ts
@@ -327,6 +327,8 @@ describe('ChatGPT subscription migration', () => {
 
     const provider = normalized.providers.find((item) => item.id === 'codex')!
     expect(provider.name).toBe('ChatGPT 订阅')
+    expect(provider.baseUrl).toBe('https://chatgpt.com/backend-api/codex/responses')
+    expect(provider.endpointFormat).toBe('custom_endpoint')
     expect(provider.models).toEqual(CHATGPT_SUBSCRIPTION_MODEL_IDS)
     for (const modelId of ['gpt-5.6-sol', 'gpt-5.6-terra', 'gpt-5.6-luna']) {
       expect(provider.modelProfiles[modelId]).toMatchObject({
@@ -389,7 +391,9 @@ describe('ChatGPT subscription migration', () => {
 
     expect(normalized.providers.find((item) => item.id === 'codex')).toMatchObject({
       name: 'Team subscription',
-      models: ['gpt-5.5', 'team-model']
+      models: ['gpt-5.5', 'team-model'],
+      baseUrl: 'https://chatgpt.com/backend-api/codex/responses',
+      endpointFormat: 'custom_endpoint'
     })
   })
 })
@@ -2355,6 +2359,49 @@ describe('provider presets', () => {
     }
   })
 
+  it('publishes and narrowly repairs the OpenCode Go Grok 4.5 capacity profile', () => {
+    const preset = getModelProviderPreset('opencode-go')!
+    const profile = modelProviderPresetProfile(preset, 'sk-opencode')
+
+    expect(profile.models).toContain('grok-4.5')
+    expect(profile.modelProfiles['grok-4.5']).toMatchObject({
+      contextWindowTokens: 500_000,
+      maxOutputTokens: 64_000,
+      inputModalities: ['text', 'image'],
+      reasoning: {
+        supportedEfforts: ['low', 'medium', 'high'],
+        defaultEffort: 'medium',
+        requestProtocol: 'openai-chat-completions'
+      }
+    })
+
+    profile.modelProfiles['grok-4.5'] = {
+      ...profile.modelProfiles['grok-4.5']!,
+      contextWindowTokens: 256_000,
+      maxOutputTokens: 500_000
+    }
+    const repaired = normalizeModelProviderSettings({
+      providers: [profile]
+    }).providers.find((provider) => provider.id === 'opencode-go')
+    expect(repaired?.modelProfiles['grok-4.5']).toMatchObject({
+      contextWindowTokens: 500_000,
+      maxOutputTokens: 64_000
+    })
+
+    profile.modelProfiles['grok-4.5'] = {
+      ...profile.modelProfiles['grok-4.5']!,
+      contextWindowTokens: 300_000,
+      maxOutputTokens: 80_000
+    }
+    const preserved = normalizeModelProviderSettings({
+      providers: [profile]
+    }).providers.find((provider) => provider.id === 'opencode-go')
+    expect(preserved?.modelProfiles['grok-4.5']).toMatchObject({
+      contextWindowTokens: 300_000,
+      maxOutputTokens: 80_000
+    })
+  })
+
   it('upgrades the obsolete generated single-auto GLM capability', () => {
     const preset = getModelProviderPreset('opencode-go')!
     const profile = modelProviderPresetProfile(preset, 'sk-opencode')
diff --git a/src/shared/app-settings-provider.ts b/src/shared/app-settings-provider.ts
index 6cd0488fb..89f5db6cc 100644
--- a/src/shared/app-settings-provider.ts
+++ b/src/shared/app-settings-provider.ts
@@ -1222,7 +1222,8 @@ function normalizeModelProviderProfile(
             : undefined
         )
   const rawName = typeof input?.name === 'string' && input.name.trim() ? input.name.trim() : id
-  const baseUrl = normalizeModelProviderBaseUrl(input?.baseUrl)
+  const rawBaseUrl = normalizeModelProviderBaseUrl(input?.baseUrl)
+  const rawEndpointFormat = normalizeModelEndpointFormat(input?.endpointFormat)
   const savedModels = normalizeProviderModels(input?.models)
   // Existing builds used `gemini-code-assist` on the legacy Antigravity preset.
   // Keep that one-time migration on Antigravity; the new direct Gemini CLI API
@@ -1231,8 +1232,16 @@ function normalizeModelProviderProfile(
     presetSource?.presetId === 'gemini-subscription' && input?.kind === 'gemini-code-assist'
       ? [...GEMINI_SUBSCRIPTION_MODEL_IDS]
       : savedModels
-  const migrated = migrateChatGptSubscriptionProfile(id, rawName, rawModels)
+  const migrated = migrateChatGptSubscriptionProfile(
+    id,
+    rawName,
+    rawModels,
+    rawBaseUrl,
+    rawEndpointFormat
+  )
   const name = migrated.name
+  const baseUrl = migrated.baseUrl
+  const endpointFormat = migrated.endpointFormat
   const models = migrateProviderPresetModelCatalog(id, migrated.models)
   const modelProfiles = withPresetModelProfiles(
     { id, presetSource },
@@ -1255,7 +1264,7 @@ function normalizeModelProviderProfile(
           ? input.apiKey.trim()
           : '',
     baseUrl,
-    endpointFormat: normalizeModelEndpointFormat(input?.endpointFormat),
+    endpointFormat,
     retry: normalizeModelRequestRetrySettings(input?.retry),
     ...(kind ? { kind } : {}),
     models,
@@ -1285,19 +1294,46 @@ function normalizeModelProviderPresetSource(
   return inferred ? { presetId: inferred.preset.id, mode: inferred.mode } : undefined
 }
 
+const CHATGPT_SUBSCRIPTION_RESPONSES_URL = 'https://chatgpt.com/backend-api/codex/responses'
+
+function isChatGptSubscriptionCodexBaseUrl(baseUrl: string): boolean {
+  try {
+    const url = new URL(baseUrl)
+    return url.protocol === 'https:' &&
+      url.hostname === 'chatgpt.com' &&
+      url.pathname.replace(/\/+$/u, '').startsWith('/backend-api/codex')
+  } catch {
+    return false
+  }
+}
+
 function migrateChatGptSubscriptionProfile(
   id: string,
   name: string,
+  models: string[],
+  baseUrl: string,
+  endpointFormat: ModelEndpointFormat
+): {
+  name: string
   models: string[]
-): { name: string; models: string[] } {
-  if (id !== CHATGPT_SUBSCRIPTION_PROVIDER_ID) return { name, models }
+  baseUrl: string
+  endpointFormat: ModelEndpointFormat
+} {
+  if (id !== CHATGPT_SUBSCRIPTION_PROVIDER_ID) {
+    return { name, models, baseUrl, endpointFormat }
+  }
+  const migrateEndpoint = isChatGptSubscriptionCodexBaseUrl(baseUrl)
   return {
     name: name === CHATGPT_SUBSCRIPTION_LEGACY_NAME ? CHATGPT_SUBSCRIPTION_NAME : name,
     // This is intentionally a precise one-time signature migration. Do not
     // re-add models that a user deliberately removed from a custom list.
     models: sameModelIds(models, CHATGPT_SUBSCRIPTION_LEGACY_MODEL_IDS)
       ? [...CHATGPT_SUBSCRIPTION_MODEL_IDS]
-      : models
+      : models,
+    // Older builds stored `.../codex` + `responses`, which CompatModelClient
+    // would expand to the broken `.../codex/v1/responses` path.
+    baseUrl: migrateEndpoint ? CHATGPT_SUBSCRIPTION_RESPONSES_URL : baseUrl,
+    endpointFormat: migrateEndpoint ? 'custom_endpoint' : endpointFormat
   }
 }
 
@@ -1390,6 +1426,12 @@ function withPresetModelProfiles(
       storedProfile?.reasoning,
       presetProfile.reasoning
     )
+    const repairKnownGrokCapacity = shouldRepairKnownOpenCodeGrokCapacity(
+      provider,
+      modelId,
+      storedProfile,
+      presetProfile
+    )
     const profile: ModelProviderModelProfileV1 = {
       ...presetProfile,
       ...(storedProfile ?? {}),
@@ -1406,6 +1448,12 @@ function withPresetModelProfiles(
       // added profiles should inherit it from the preset.
       ...(presetProfile.responsesMode && !storedProfile?.responsesMode
         ? { responsesMode: presetProfile.responsesMode }
+        : {}),
+      ...(repairKnownGrokCapacity
+        ? {
+            contextWindowTokens: presetProfile.contextWindowTokens!,
+            maxOutputTokens: presetProfile.maxOutputTokens!
+          }
         : {})
     }
     if (!presetProfile.serviceTiers?.length) delete profile.serviceTiers
@@ -1414,6 +1462,21 @@ function withPresetModelProfiles(
   return profiles
 }
 
+function shouldRepairKnownOpenCodeGrokCapacity(
+  provider: Pick<ModelProviderProfileV1, 'id' | 'presetSource'>,
+  modelId: string,
+  stored: ModelProviderModelProfileV1 | undefined,
+  preset: ModelProviderModelProfileV1
+): boolean {
+  const source = resolveModelProviderPresetSource(provider)
+  return source?.preset.id === 'opencode-go' &&
+    modelId === 'grok-4.5' &&
+    stored?.contextWindowTokens === 256_000 &&
+    stored.maxOutputTokens === 500_000 &&
+    preset.contextWindowTokens === 500_000 &&
+    preset.maxOutputTokens === 64_000
+}
+
 function shouldUpgradeGeneratedPresetReasoning(
   providerId: string,
   modelId: string,
diff --git a/src/shared/app-settings.test.ts b/src/shared/app-settings.test.ts
index e15658af3..1812f2712 100644
--- a/src/shared/app-settings.test.ts
+++ b/src/shared/app-settings.test.ts
@@ -848,6 +848,20 @@ describe('isKunRuntimeInsecure', () => {
 })
 
 describe('mergeKunRuntimeSettings', () => {
+  it('does not let an empty primary model wipe the current chat model', () => {
+    const current = defaultKunRuntimeSettings()
+    expect(current.model.trim().length).toBeGreaterThan(0)
+
+    const next = mergeKunRuntimeSettings(current, {
+      providerId: 'opencode-go',
+      model: ''
+    })
+
+    expect(next.providerId).toBe('opencode-go')
+    expect(next.model).toBe(current.model)
+    expect(next.model.trim().length).toBeGreaterThan(0)
+  })
+
   it('merges the new-conversation Agent Perspective capture default', () => {
     const current = defaultKunRuntimeSettings()
     const next = mergeKunRuntimeSettings(current, {
diff --git a/src/shared/kun-endpoints.ts b/src/shared/kun-endpoints.ts
index e66ed5278..7c1cc9e23 100644
--- a/src/shared/kun-endpoints.ts
+++ b/src/shared/kun-endpoints.ts
@@ -211,6 +211,11 @@ export function kunThreadPath(threadId: string): string {
   return `/v1/threads/${encodeURIComponent(threadId)}`
 }
 
+export const KUN_THREAD_STATE_TEMPLATE = '/v1/threads/{id}/state'
+export function kunThreadStatePath(threadId: string): string {
+  return `${kunThreadPath(threadId)}/state`
+}
+
 export const KUN_THREAD_FORK_TEMPLATE = '/v1/threads/{id}/fork'
 export function kunThreadForkPath(threadId: string): string {
   return `${kunThreadPath(threadId)}/fork`
@@ -261,6 +266,12 @@ export function kunThreadInterruptPath(threadId: string, turnId: string): string
   return `${kunThreadTurnPath(threadId, turnId)}/interrupt`
 }
 
+export const KUN_THREAD_TOOL_CANCEL_TEMPLATE =
+  '/v1/threads/{id}/turns/{turn}/tool-calls/{id}/cancel'
+export function kunThreadToolCancelPath(threadId: string, turnId: string, callId: string): string {
+  return `${kunThreadTurnPath(threadId, turnId)}/tool-calls/${encodeURIComponent(callId)}/cancel`
+}
+
 export const KUN_THREAD_EVENTS_TEMPLATE = '/v1/threads/{id}/events'
 export function kunThreadEventsPath(threadId: string): string {
   return `${kunThreadPath(threadId)}/events`
diff --git a/src/shared/kun-gui-api.ts b/src/shared/kun-gui-api.ts
index 12ec42e94..961bee246 100644
--- a/src/shared/kun-gui-api.ts
+++ b/src/shared/kun-gui-api.ts
@@ -573,6 +573,11 @@ export type CredentialRecoveryResetResult =
   | { reset: false }
   | { reset: true; backupPath: string; movedItems: string[] }
 
+export type ModelProviderCredentialRevealResult = {
+  providerId: string
+  credential: string
+}
+
 export type KunGuiApi = ExtensionIpcApi & {
   platform: string
   homeDir: string
@@ -621,6 +626,8 @@ export type KunGuiApi = ExtensionIpcApi & {
     respondRendererRequest: (response: DataMigrationRendererResponse) => Promise<void>
   }
   getSettings: () => Promise<AppSettingsV1>
+  /** Reveal one protected provider credential after an explicit trusted-workbench action. */
+  revealModelProviderCredential: (providerId: string) => Promise<ModelProviderCredentialRevealResult>
   resetUnreadableCredentials: () => Promise<CredentialRecoveryResetResult>
   cliInstallStatus: () => Promise<CliInstallStatus>
   cliInstallAction: (action: CliInstallAction) => Promise<CliInstallResult>
diff --git a/src/shared/model-provider-presets.ts b/src/shared/model-provider-presets.ts
index 3279ae1ae..903a35643 100644
--- a/src/shared/model-provider-presets.ts
+++ b/src/shared/model-provider-presets.ts
@@ -266,6 +266,12 @@ const GROK_RESPONSES_REASONING: ModelProviderReasoningCapabilityV1 = {
   requestProtocol: 'openai-responses'
 }
 
+const GROK_CHAT_REASONING: ModelProviderReasoningCapabilityV1 = {
+  supportedEfforts: ['low', 'medium', 'high'],
+  defaultEffort: 'medium',
+  requestProtocol: 'openai-chat-completions'
+}
+
 const KIMI_K3_REASONING: ModelProviderReasoningCapabilityV1 = {
   supportedEfforts: ['low', 'high', 'max'],
   defaultEffort: 'high',
@@ -644,6 +650,7 @@ export const MODEL_PROVIDER_PRESETS: ModelProviderPreset[] = [
     baseUrl: 'https://opencode.ai/zen/go/v1',
     endpointFormat: 'chat_completions',
     models: [
+      'grok-4.5',
       'glm-5.2',
       'glm-5.1',
       'glm-5',
@@ -665,6 +672,10 @@ export const MODEL_PROVIDER_PRESETS: ModelProviderPreset[] = [
       'qwen3.5-plus'
     ],
     modelProfiles: {
+      'grok-4.5': {
+        ...visionChatProfile(500_000, GROK_CHAT_REASONING),
+        maxOutputTokens: 64_000
+      },
       'glm-5.2': visionChatProfile(1_000_000, GLM_REASONING),
       'glm-5.1': visionChatProfile(131_072, GLM_REASONING),
       'glm-5': visionChatProfile(131_072, GLM_REASONING),
diff --git a/src/shared/office-document.ts b/src/shared/office-document.ts
index 90a503ad0..350685962 100644
--- a/src/shared/office-document.ts
+++ b/src/shared/office-document.ts
@@ -29,6 +29,8 @@ export type LocalOfficeDocumentReadResult =
       truncated: boolean
       visualPreview?: OfficeDocumentVisualPreview
       previewUnavailableReason?: string
+      /** Soft OOXML schema issues (e.g. WPS vendor attrs) that did not block intake. */
+      validationWarning?: string
     }
   | { ok: false; code?: string; message: string }
 
diff --git a/src/shared/speech-to-text.ts b/src/shared/speech-to-text.ts
index 72e6e901d..7bcd63b2d 100644
--- a/src/shared/speech-to-text.ts
+++ b/src/shared/speech-to-text.ts
@@ -14,10 +14,16 @@ export const SPEECH_TRANSCRIPTION_MAX_DURATION_MS = 5 * 60 * 1000
  * Single source of truth for whether the configured speech transport can run.
  * Keep transport-specific credential rules here so every UI surface and the
  * main-process service stay in sync as speech providers are added.
+ *
+ * Renderer settings redact provider apiKeys. Pass `credentialReady: true` when
+ * a shared model connection reports usable Registry credentials for the bound
+ * provider (OAuth subscriptions such as grok-subscription).
  */
 export function isSpeechToTextConfigured(
-  speechToText: Pick<KunSpeechToTextSettingsV1, 'enabled' | 'protocol' | 'baseUrl' | 'apiKey' | 'model'>
+  speechToText: Pick<KunSpeechToTextSettingsV1, 'enabled' | 'protocol' | 'baseUrl' | 'apiKey' | 'model'>,
+  options: { credentialReady?: boolean } = {}
 ): boolean {
+  const hasCredential = Boolean(speechToText.apiKey.trim()) || Boolean(options.credentialReady)
   if (speechToText.protocol === 'local-whisper' || speechToText.protocol === 'gemini-cli-audio') {
     return speechToText.enabled && Boolean(speechToText.model.trim())
   }
@@ -25,13 +31,13 @@ export function isSpeechToTextConfigured(
     return (
       speechToText.enabled &&
       Boolean(speechToText.baseUrl.trim()) &&
-      Boolean(speechToText.apiKey.trim())
+      hasCredential
     )
   }
   return (
     speechToText.enabled &&
     Boolean(speechToText.baseUrl.trim()) &&
-    Boolean(speechToText.apiKey.trim()) &&
+    hasCredential &&
     Boolean(speechToText.model.trim())
   )
 }