fix(ci): lint test code too, and revive two tests that stopped running

`cargo clippy --workspace -- -D warnings` lints lib and bin targets
only. Without `--all-targets` it never sees `#[cfg(test)]` modules,
`tests/`, `benches/` or `examples/` — so despite `-D warnings`, no
warning in test code has ever gated a merge.

That was not hypothetical. One bad edit in candle.rs had displaced a doc
comment and a `#[test]` attribute onto the following function, causing
three separate faults that CI could not see:

  - `kv_budget_prices_a_long_context_session` lost its `#[test]` and
    stopped running;
  - `validate_request_cap_and_fit` lost its `#[test]` and stopped
    running, and inherited a doc comment describing a different test;
  - `saturated_model_with_a_budget_is_still_servable` ended up with two
    `#[test]` attributes and was registered — and run — *twice*.

Both revived tests pass, so no product defect was hiding behind them.
They cover KV-budget pricing and request cap/fit validation, which is
the admission path from #257, so they are not tests worth losing.

Reattaching the attributes and dropping the duplicate is a net +1
registered test: +2 revived, -1 that had been counted twice.

The remaining backlog was 19 warnings, far smaller than feared. Fixed
rather than suppressed, except one: `figment::Jail::expect_with` dictates
a closure returning `figment::Error`, 208 bytes and not ours to shrink,
so `result_large_err` gets a scoped `#[allow]` with the reason written
down. The rest are three `needless_range_loop`s in the snapshot batch
tests (now `iter().enumerate()`, bounds verified equal), a doc comment
whose wrapped `+` read as a markdown bullet, and clippy's own autofixes.

`build-prerelease.yml` carried the same omission and is fixed with it —
that is the gate `main` relies on, since ci.yml deliberately skips main.
CLAUDE.md's documented triad updated to match, so the local command and
the CI command stay the same command.

Refs #286, #257

.gitea/workflows/build-prerelease.yml

@@ -262,7 +262,7 @@ jobs:
       # fast instead of triggering a slower uncached rebuild; only a real
       # sccache fault drops the cache. See script/ci-cargo-escalate.sh.
       - name: Clippy (sccache escalation)
-        run: script/ci-cargo-escalate.sh cargo clippy --workspace -- -D warnings
+        run: script/ci-cargo-escalate.sh cargo clippy --workspace --all-targets -- -D warnings
 
   test:
     name: Test

.gitea/workflows/ci.yml

@@ -179,8 +179,13 @@ jobs:
       # in sync with build-prerelease.yml): a signal death (rustc SIGSEGV
       # / OOM-kill) keeps the cache and fails fast instead of an uncached
       # rebuild; only a real sccache fault drops the cache.
+      # --all-targets so `#[cfg(test)]` modules, tests/, benches/ and
+      # examples/ are linted too (#286). Without it clippy sees only lib
+      # and bin targets, so `-D warnings` never gated a single line of
+      # test code — which is how two tests lost their `#[test]` attribute
+      # and stopped running unnoticed.
       - name: Clippy (sccache escalation)
-        run: script/ci-cargo-escalate.sh cargo clippy --workspace -- -D warnings
+        run: script/ci-cargo-escalate.sh cargo clippy --workspace --all-targets -- -D warnings
 
   test:
     name: Test

CLAUDE.md

@@ -167,7 +167,7 @@ doc-comment; touch points (the `Job` enum, the dispatch handlers, the
 cargo build --release           # build all crates
 cargo run -p cortex-cli -- serve    # run the gateway
 cargo test                      # run all tests
-cargo clippy --workspace        # lint
+cargo clippy --workspace --all-targets   # lint (test code included)
 ```
 
 ## CI
@@ -177,7 +177,7 @@ pass before merging:
 
 ```sh
 cargo fmt --check --all                    # formatting
-cargo clippy --workspace -- -D warnings   # lint (warnings are errors)
+cargo clippy --workspace --all-targets -- -D warnings   # lint (warnings are errors)
 cargo test --workspace                     # tests
 ```
 
@@ -191,7 +191,8 @@ Work each change on its own branch; `main` stays releasable.
 
 1. Implement on a feature branch (`fix/<issue>-…`, `feat/<issue>-…`).
 2. Run the CI triad locally (`cargo fmt --check --all`,
-   `cargo clippy --workspace -- -D warnings`, `cargo test --workspace`).
+   `cargo clippy --workspace --all-targets -- -D warnings`,
+   `cargo test --workspace`).
    Local builds are **CPU-only** — the `#[cfg(feature = "cuda")]` neuron/TP
    paths do NOT compile locally. The branch CI's **CUDA type-check** job is
    the only thing that validates them, so for any neuron change the push to

crates/cortex-core/src/anthropic.rs

@@ -20,6 +20,11 @@ pub struct MessagesRequest {
     pub temperature: Option<f64>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub top_p: Option<f64>,
+    /// Anthropic's Messages API carries `top_k` natively, so it maps
+    /// straight onto the OpenAI-side field rather than being dropped in
+    /// translation (#272).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub top_k: Option<usize>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub stream: Option<bool>,
     #[serde(flatten)]

crates/cortex-core/src/harness.rs

@@ -50,8 +50,48 @@ pub struct ModelLimit {
     /// back to `context − output`.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub input: Option<usize>,
-    /// Maximum number of generation tokens.
+    /// The generation budget a request gets when it names none, and the
+    /// figure `input = context − output` is derived from.
+    ///
+    /// A *reserve*, not a ceiling — a request may ask for more and be
+    /// served it. Named `output` for the shape's history; the number a
+    /// client should plan against is [`ModelLimit::output_ceiling`].
     pub output: usize,
+    /// The largest output a request may name and be served (#278).
+    ///
+    /// Distinct from `output`, which is the default and the KV-planning
+    /// reserve. Publishing the reserve as the ceiling meant a client
+    /// that trusted the advertisement asked for a fraction of what the
+    /// model would happily generate — on a reasoning model, often less
+    /// than its own think block costs.
+    ///
+    /// `#[serde(default)]` so a neuron predating this field still
+    /// deserializes; zero means "not advertised", and consumers fall
+    /// back to `output`.
+    #[serde(default, skip_serializing_if = "is_zero")]
+    pub output_ceiling: usize,
+}
+
+fn is_zero(v: &usize) -> bool {
+    *v == 0
+}
+
+/// What each reasoning effort level costs, in reasoning tokens (#223).
+///
+/// OpenAI-shaped clients can only send `minimal|low|medium|high` — the
+/// ladder is their entire vocabulary, and they cannot express a token
+/// count. So the server picks the numbers, and has to say what they are:
+/// a client choosing `low` with no idea whether that buys 2k tokens or
+/// 20k is guessing, which is the failure #274 exists to end.
+///
+/// Ordered rungs rather than a map, so the ladder reads in the order a
+/// client would climb it.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ReasoningBudgetRung {
+    /// The effort level as the caller spells it on the wire.
+    pub effort: String,
+    /// Reasoning tokens that level is allowed to spend.
+    pub tokens: usize,
 }
 
 /// Operator-set pricing, **USD per 1,000,000 tokens, as JSON numbers**
@@ -144,6 +184,11 @@ pub struct ModelInfo {
     /// from its own routing table.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub servable: Option<ModelServability>,
+    /// The reasoning-effort ladder this deployment honours (#223).
+    /// Absent when the model does not reason, or the harness has no
+    /// budget to offer.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub reasoning_budget: Vec<ReasoningBudgetRung>,
 }
 
 /// Why a loaded model can or cannot be served right now (#245).

crates/cortex-core/src/node.rs

@@ -44,6 +44,12 @@ pub struct NodeState {
     /// just one whose total topology could. Empty until the first
     /// /health poll.
     pub device_health: Vec<crate::discovery::DeviceHealth>,
+    /// The reasoning-effort ladder this neuron honours (#223), copied
+    /// from its `/models` reply at poll time. Per-node rather than
+    /// per-model because it is host configuration — every model on a
+    /// neuron reports the same rungs — and duplicating it onto each
+    /// model entry would invite the two to disagree.
+    pub reasoning_budget: Vec<crate::harness::ReasoningBudgetRung>,
 }
 
 /// A model registered on a node, with its runtime status.
@@ -187,12 +193,26 @@ pub struct CortexModelEntry {
     /// Served max-seq-len in tokens — mirrors `limit.context`.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub max_model_len: Option<usize>,
+    /// The same window under the two names generic OpenAI clients look
+    /// for (#278). pi-ai's provider discovery, for one, reads
+    /// `context_window` then `context_length` and nothing else — so a
+    /// client probing cortex found no window at all and fell back to a
+    /// number its operator had to invent by hand.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub context_window: Option<usize>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub context_length: Option<usize>,
     /// Usable input budget — mirrors `limit.input` when present.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub max_input_tokens: Option<usize>,
-    /// Maximum generation tokens — mirrors `limit.output`.
+    /// The largest output a request may name — mirrors
+    /// `limit.output_ceiling`, falling back to `limit.output` (#278).
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub max_output_tokens: Option<usize>,
+    /// What each effort level buys, in reasoning tokens (#223) — so a
+    /// client picking `low` knows what it asked for.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub reasoning_budget: Vec<crate::harness::ReasoningBudgetRung>,
 }
 
 impl CortexModelEntry {
@@ -204,8 +224,22 @@ impl CortexModelEntry {
     /// dropped the limit.
     pub fn sync_flat_limit(&mut self) {
         self.max_model_len = self.limit.as_ref().map(|l| l.context);
+        self.context_window = self.limit.as_ref().map(|l| l.context);
+        self.context_length = self.limit.as_ref().map(|l| l.context);
         self.max_input_tokens = self.limit.as_ref().and_then(|l| l.input);
-        self.max_output_tokens = self.limit.as_ref().map(|l| l.output);
+        // The ceiling, not the reserve (#278): this field is what
+        // OpenAI-ecosystem clients read to decide what to ask for, and
+        // pi-ai/DSH turns it straight into a per-request cap. Advertising
+        // the reserve here handed a reasoning model less budget than its
+        // own think block needs. Falls back to the reserve for a neuron
+        // too old to publish a ceiling.
+        self.max_output_tokens = self.limit.as_ref().map(|l| {
+            if l.output_ceiling > 0 {
+                l.output_ceiling
+            } else {
+                l.output
+            }
+        });
     }
 }
 

crates/cortex-core/src/openai.rs

@@ -18,6 +18,31 @@ pub struct ChatCompletionRequest {
     pub temperature: Option<f64>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub top_p: Option<f64>,
+    /// Truncate sampling to the `k` most likely tokens (#272).
+    ///
+    /// Not in the OpenAI schema but universal among serving stacks
+    /// (vLLM, SGLang, llama.cpp, Ollama), and required by models that
+    /// publish it — Qwen3 specifies `top_k = 20`. A named field rather
+    /// than `extra`, because a sampling parameter that lands in `extra`
+    /// is accepted and silently discarded.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub top_k: Option<usize>,
+    /// Pin the sampler's RNG for reproducible output (OpenAI core).
+    ///
+    /// Previously ignored on every text path, which called
+    /// `unix_subsec_nanos()` regardless — a caller asking for
+    /// determinism got fresh randomness and a `200`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub seed: Option<u64>,
+    /// Penalty applied to recently-generated tokens; `1.0` disables.
+    /// Defaults to 1.1 when absent (#272).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub repetition_penalty: Option<f32>,
+    /// How many recent tokens `repetition_penalty` considers. Defaults
+    /// to 64 — fine for chat, short for a long reasoning block, which is
+    /// why it is a knob rather than a constant (#272).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub repeat_last_n: Option<usize>,
     /// The deprecated spelling of the output cap. Still what most
     /// clients send; see [`ChatCompletionRequest::effective_max_tokens`].
     #[serde(skip_serializing_if = "Option::is_none")]

crates/cortex-core/src/responses.rs

@@ -55,6 +55,21 @@ pub struct ResponsesRequest {
     pub temperature: Option<f64>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub top_p: Option<f64>,
+    /// Truncate sampling to the `k` most likely tokens (#272). Not in
+    /// the Responses schema, but a sampling parameter that lands in
+    /// `extra` is accepted and silently discarded, which is the defect
+    /// this closes.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub top_k: Option<usize>,
+    /// Pin the sampler's RNG for reproducible output (#272).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub seed: Option<u64>,
+    /// Penalty on recently-generated tokens; `1.0` disables (#272).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub repetition_penalty: Option<f32>,
+    /// Window `repetition_penalty` considers (#272).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub repeat_last_n: Option<usize>,
     /// Chained-conversation identifier. We don't store responses
     /// server-side yet; if this is `Some`, the handler returns 400.
     #[serde(default, skip_serializing_if = "Option::is_none")]
@@ -130,12 +145,22 @@ pub enum ResponsesInputItem {
     /// string or an array of content parts; the translator renders
     /// either form to text rather than losing the tool result.
     FunctionCallOutput { call_id: String, output: Value },
-    /// Reasoning items emitted by o-series models. Accepted but
-    /// not forwarded to the model — neuron's candle path doesn't
-    /// surface reasoning separately yet.
+    /// A reasoning item the model emitted on an earlier turn, replayed
+    /// by the client so the model can continue its own train of thought.
+    ///
+    /// Both spellings are modelled because both are in the wild and one
+    /// of them is ours: OpenAI's o-series carries the text in `content`
+    /// as `reasoning_text` parts, while neuron emits `summary` with a
+    /// `summary_text` part. Clients round-trip the completed item
+    /// verbatim — pi-ai stores our `response.output_item.done` payload
+    /// and replays it unchanged — so whichever field we emit is the
+    /// field we get back, and reading only one of them silently loses
+    /// the turn's reasoning.
     Reasoning {
         #[serde(default)]
         content: Vec<Value>,
+        #[serde(default)]
+        summary: Vec<Value>,
     },
 }
 

crates/cortex-core/src/translate.rs

@@ -94,6 +94,28 @@ pub fn anthropic_to_openai(req: MessagesRequest) -> ChatCompletionRequest {
         if let Some(tc) = tool_choice {
             obj.insert("tool_choice".into(), tc);
         }
+        // Anthropic's extended-thinking budget is the one quantitative
+        // reasoning control any of our wire formats offers (#223).
+        // Normalised onto `reasoning.max_tokens`, the shape the harness
+        // resolves, so all three inlets converge on one field instead of
+        // each generation loop learning three spellings.
+        let budget = obj
+            .get("thinking")
+            .filter(|t| t.get("type").and_then(Value::as_str) != Some("disabled"))
+            .and_then(|t| t.get("budget_tokens"))
+            .and_then(Value::as_u64)
+            .filter(|n| *n > 0);
+        if let Some(budget) = budget {
+            let reasoning = obj
+                .entry("reasoning")
+                .or_insert_with(|| Value::Object(Default::default()));
+            if !reasoning.is_object() {
+                *reasoning = Value::Object(Default::default());
+            }
+            if let Some(r) = reasoning.as_object_mut() {
+                r.entry("max_tokens").or_insert_with(|| Value::from(budget));
+            }
+        }
     }
 
     ChatCompletionRequest {
@@ -101,6 +123,13 @@ pub fn anthropic_to_openai(req: MessagesRequest) -> ChatCompletionRequest {
         messages,
         temperature: req.temperature,
         top_p: req.top_p,
+        // Anthropic models top_k too, so it survives the hop (#272).
+        top_k: req.top_k,
+        // Anthropic's Messages API has no seed or penalty knobs; absent
+        // means the model's own generation_config decides.
+        seed: None,
+        repetition_penalty: None,
+        repeat_last_n: None,
         max_tokens: Some(req.max_tokens),
         // Anthropic has one spelling; it maps onto the legacy field.
         max_completion_tokens: None,

crates/cortex-gateway/src/handlers.rs

@@ -798,6 +798,10 @@ async fn list_models(State(fleet): State<Arc<CortexState>>) -> Json<Value> {
                 max_model_len: None,
                 max_input_tokens: None,
                 max_output_tokens: None,
+                context_window: None,
+                context_length: None,
+                // Catalogue-seeded: no neuron has reported rungs yet.
+                reasoning_budget: Vec::new(),
             },
         );
     }
@@ -839,6 +843,13 @@ async fn list_models(State(fleet): State<Arc<CortexState>>) -> Json<Value> {
                     // so a client never overflows the most-constrained
                     // deployment that might serve it.
                     e.limit = tightest_limit(e.limit.take(), entry.limit.clone());
+                    // The reasoning ladder this neuron honours (#223).
+                    // First non-empty wins: a catalogue-seeded entry
+                    // starts with none, and neurons serving the same
+                    // model are configured alike.
+                    if e.reasoning_budget.is_empty() {
+                        e.reasoning_budget = node.reasoning_budget.clone();
+                    }
                 })
                 .or_insert_with(|| CortexModelEntry {
                     id: model_id.clone(),
@@ -858,6 +869,10 @@ async fn list_models(State(fleet): State<Arc<CortexState>>) -> Json<Value> {
                     max_model_len: None,
                     max_input_tokens: None,
                     max_output_tokens: None,
+                    context_window: None,
+                    context_length: None,
+                    // What this neuron says each effort level buys (#223).
+                    reasoning_budget: node.reasoning_budget.clone(),
                 });
         }
     }
@@ -919,6 +934,10 @@ async fn list_models(State(fleet): State<Arc<CortexState>>) -> Json<Value> {
                     max_model_len: None,
                     max_input_tokens: None,
                     max_output_tokens: None,
+                    context_window: None,
+                    context_length: None,
+                    // What this neuron says each effort level buys (#223).
+                    reasoning_budget: node.reasoning_budget.clone(),
                 });
         }
     }
@@ -956,6 +975,10 @@ async fn list_models(State(fleet): State<Arc<CortexState>>) -> Json<Value> {
                 max_model_len: None,
                 max_input_tokens: None,
                 max_output_tokens: None,
+                context_window: None,
+                context_length: None,
+                // Catalogue-seeded: no neuron has reported rungs yet.
+                reasoning_budget: Vec::new(),
             },
         );
     }

crates/cortex-gateway/src/metering.rs

@@ -141,6 +141,15 @@ pub fn usage_sink(
 /// returns a guard the caller settles with actual usage; on refusal returns
 /// the #63 envelope (`rate_limit_exceeded` + `Retry-After` for a resetting
 /// window, `insufficient_quota` for a hard balance — never `402`).
+// The `Err` variant is the #63 envelope itself, which is a data-carrying
+// struct (status, type, code, message, param, retry hint, diagnostics) and
+// is passed by value everywhere it is built, matched and rendered. Boxing it
+// at this one boundary would push `Box` conversions through three handlers
+// and both HTTP adapters to save an allocation on a path taken once per
+// rejected request. clippy 1.98 lowered what it considers large enough to
+// flag; the shape is deliberate. Same call as the existing allows on the
+// figment-returning config loaders.
+#[allow(clippy::result_large_err)]
 pub async fn reserve_or_reject(
     provider: Arc<dyn EntitlementProvider>,
     principal: &Principal,
@@ -279,7 +288,7 @@ mod tests {
         // Requested output dominates; prompt estimate is small for a tiny body.
         let body = br#"{"model":"m","max_tokens":1000}"#;
         let est = reservation_estimate(body, Some(8192));
-        assert!(est >= 1000 && est < 1100, "est was {est}");
+        assert!((1000..1100).contains(&est), "est was {est}");
     }
 
     #[test]

crates/cortex-gateway/src/poller.rs

@@ -130,6 +130,17 @@ async fn poll_neuron(fleet: &CortexState, name: &str, endpoint: &str) {
         Ok(resp) if resp.status().is_success() => {
             match resp.json::<Vec<ModelInfo>>().await {
                 Ok(models) => {
+                    // The reasoning-effort ladder is host configuration:
+                    // every model on a neuron reports the same rungs, so
+                    // it is held once per node rather than copied onto
+                    // each model entry where the two could drift (#223).
+                    // Taken from the first model that offers one — a
+                    // non-reasoning model advertises none.
+                    node.reasoning_budget = models
+                        .iter()
+                        .map(|m| m.reasoning_budget.clone())
+                        .find(|rungs| !rungs.is_empty())
+                        .unwrap_or_default();
                     let mut seen = std::collections::HashSet::new();
                     for upstream in &models {
                         seen.insert(upstream.id.clone());

crates/cortex-gateway/src/state.rs

@@ -66,6 +66,9 @@ impl CortexState {
                     endpoint: nc.endpoint.clone(),
                     healthy: false,
                     models: HashMap::new(),
+                    // Filled from the neuron's /models reply at the
+                    // first poll (#223).
+                    reasoning_budget: Vec::new(),
                     lifecycle_cycles: 0,
                     last_poll: None,
                     discovery: None,

crates/cortex-gateway/tests/budget_enforcement.rs

@@ -1,9 +1,9 @@
 //! Integration tests for budget enforcement (#52) — the A0 seatbelt.
 //!
 //! A reservation over the key's hard cap is refused *before* neuron is hit,
-//! with the #63 code matching the cap-window semantics (rate_limit_exceeded
-//! + Retry-After for a resetting window, insufficient_quota for a hard
-//! balance). Spend never exceeds the cap. No 402, ever.
+//! with the #63 code matching the cap-window semantics: `rate_limit_exceeded`
+//! plus `Retry-After` for a resetting window, `insufficient_quota` for a hard
+//! balance. Spend never exceeds the cap. No 402, ever.
 
 use axum::Json;
 use axum::extract::Path;

crates/cortex-gateway/tests/model_limits.rs

@@ -69,6 +69,18 @@ capabilities = ["text"]
         let mut nodes = fleet.nodes.write().await;
         let node = nodes.get_mut("mock-node").expect("node exists");
         node.healthy = true;
+        // The ladder the neuron reported at poll time (#223) — host
+        // configuration, held once per node.
+        node.reasoning_budget = ["minimal", "low", "medium", "high"]
+            .into_iter()
+            .zip([1024usize, 4096, 12288, 32768])
+            .map(
+                |(effort, tokens)| cortex_core::harness::ReasoningBudgetRung {
+                    effort: effort.into(),
+                    tokens,
+                },
+            )
+            .collect();
         node.models.insert(
             "test-model".into(),
             ModelEntry {
@@ -85,6 +97,9 @@ capabilities = ["text"]
                     context: 49152,
                     input: Some(40960),
                     output: 8192,
+                    // The ceiling a request may name, distinct from the
+                    // 8192-token reserve above (#278).
+                    output_ceiling: 32768,
                 }),
                 servable: None,
             },
@@ -147,7 +162,34 @@ capabilities = ["text"]
     // vLLM-convention probes (Hermes Agent) auto-detect the window.
     assert_eq!(entry["max_model_len"], 49152);
     assert_eq!(entry["max_input_tokens"], 40960);
-    assert_eq!(entry["max_output_tokens"], 8192);
+    // The ceiling, not the reserve (#278). pi-ai's discovery — and every
+    // client like it — turns this field into the cap it sends on each
+    // request; advertising the 8192 reserve told a reasoning model's
+    // harness to stop below the cost of a single think block.
+    assert_eq!(entry["max_output_tokens"], 32768);
+    // What each effort level buys (#223). A client can only send the
+    // rung names — it has no way to express a token count — so a ladder
+    // it cannot see is a ladder it has to guess at.
+    let rungs = entry["reasoning_budget"]
+        .as_array()
+        .expect("reasoning_budget advertised for a reasoning model");
+    let names: Vec<&str> = rungs
+        .iter()
+        .map(|r| r["effort"].as_str().expect("effort"))
+        .collect();
+    assert_eq!(names, ["minimal", "low", "medium", "high"]);
+    assert!(
+        rungs
+            .iter()
+            .all(|r| r["tokens"].as_u64().is_some_and(|t| t > 0)),
+        "every advertised rung must name a token count"
+    );
+
+    // The window under the two names generic clients actually read.
+    // pi-ai looks for `context_window` then `context_length` and gives
+    // up if neither is present — `max_model_len` is invisible to it.
+    assert_eq!(entry["context_window"], 49152);
+    assert_eq!(entry["context_length"], 49152);
 
     // No limit → flat fields omitted entirely, never 0 or a guess.
     let unknown = body["data"]
@@ -157,7 +199,13 @@ capabilities = ["text"]
         .find(|m| m["id"] == "no-limit-model")
         .expect("no-limit-model present in /v1/models");
     assert!(unknown.get("limit").is_none());
-    for key in ["max_model_len", "max_input_tokens", "max_output_tokens"] {
+    for key in [
+        "max_model_len",
+        "max_input_tokens",
+        "max_output_tokens",
+        "context_window",
+        "context_length",
+    ] {
         assert!(
             unknown.get(key).is_none(),
             "{key} must be omitted when the window is unknown"

crates/cortex-gateway/tests/prompt_prevalidation.rs

@@ -96,6 +96,7 @@ async fn spawn_gateway(neuron: &str, context: usize) -> String {
                     context,
                     input: None,
                     output: 16,
+                    output_ceiling: 0,
                 }),
                 servable: None,
             },

crates/helexa-bench/src/client.rs

@@ -236,6 +236,7 @@ impl TargetClient {
                         // A generic OpenAI endpoint says nothing about
                         // serviceability, and absent means "no opinion".
                         servable: None,
+                        reasoning_budget: Vec::new(),
                     })
                     .collect())
             }

crates/helexa-router/src/catalogue.rs

@@ -80,10 +80,19 @@ fn router_entry(cortex: &str, e: &CortexModelEntry) -> CortexModelEntry {
         cost: e.cost.clone(),
         tool_call: e.tool_call,
         reasoning: e.reasoning,
-        // Derived from `limit` by the final sync pass in aggregate_models.
-        max_model_len: None,
-        max_input_tokens: None,
-        max_output_tokens: None,
+        // Every flat ecosystem field is derived from `limit` by the
+        // final sync pass in aggregate_models, so they are cleared here
+        // rather than copied. Spread from `e` keeps a field added to the
+        // entry later from being silently dropped at this hop.
+        ..CortexModelEntry {
+            max_model_len: None,
+            max_input_tokens: None,
+            max_output_tokens: None,
+            context_window: None,
+            context_length: None,
+            reasoning_budget: Vec::new(),
+            ..e.clone()
+        }
     }
 }
 
@@ -164,6 +173,9 @@ mod tests {
             max_model_len: None,
             max_input_tokens: None,
             max_output_tokens: None,
+            context_window: None,
+            context_length: None,
+            reasoning_budget: Vec::new(),
         }
     }
 
@@ -224,6 +236,7 @@ mod tests {
             context: 32_768,
             input: None,
             output: 4096,
+            output_ceiling: 0,
         });
         a.cost = Some(ModelCost {
             input: 0.50,
@@ -236,6 +249,7 @@ mod tests {
             context: 16_384, // tighter
             input: None,
             output: 4096,
+            output_ceiling: 0,
         });
         b.cost = Some(ModelCost {
             input: 0.20, // cheaper

crates/helexa-router/tests/dispatch.rs

@@ -42,6 +42,9 @@ fn model_entry(loaded: bool, feasible: bool) -> CortexModelEntry {
         max_model_len: None,
         max_input_tokens: None,
         max_output_tokens: None,
+        context_window: None,
+        context_length: None,
+        reasoning_budget: Vec::new(),
     }
 }
 

crates/helexa-tools/src/config.rs

@@ -58,6 +58,11 @@ mod tests {
         assert!(cfg.max_redirects > 0);
     }
 
+    // The closure's error type is `figment::Error`, which is 208 bytes and
+    // not ours to shrink; `Jail::expect_with` dictates the signature. The
+    // usual remedy (box the Err) is not available through a third-party
+    // callback contract, and this is a test closure run once.
+    #[allow(clippy::result_large_err)]
     #[test]
     fn loads_toml_with_env_override() {
         figment::Jail::expect_with(|jail| {

crates/neuron/src/config.rs

@@ -86,6 +86,16 @@ pub struct CandleHarnessConfig {
     #[serde(default)]
     pub context_limit: ContextLimitConfig,
 
+    /// What each OpenAI effort level costs, in reasoning tokens (#223).
+    ///
+    /// OpenAI-shaped clients cannot send a token count — their whole
+    /// vocabulary is the `minimal|low|medium|high` ladder — so the
+    /// numbers live here and are advertised on `/models`. Operator
+    /// configurable because the right values depend on the model and the
+    /// hardware.
+    #[serde(default)]
+    pub reasoning_budget: crate::harness::reasoning_budget::ReasoningBudgetLadder,
+
     /// Admission control (#53): bounds the per-model wait queue so a busy
     /// model returns a fast, retryable `429`/`503` instead of stalling new
     /// requests until their client times out.
@@ -333,8 +343,24 @@ pub struct ContextLimitConfig {
     /// Generation reserve (tokens) left below the context wall:
     /// `input = context − output_reserve_tokens`. Defaults to neuron's
     /// default `max_tokens`.
+    ///
+    /// This is the budget a request gets when it names none, and the
+    /// figure the input/output split is derived from. It is **not** the
+    /// most a request may ask for — see `max_output_tokens` (#278).
     #[serde(default = "default_output_reserve_tokens")]
     pub output_reserve_tokens: usize,
+
+    /// The largest output a request may name, advertised as
+    /// `max_output_tokens` on `/v1/models` (#278).
+    ///
+    /// `None` derives it as `min(max_position_embeddings,
+    /// DEFAULT_OUTPUT_CEILING)`. Separate from the reserve because the
+    /// two answer different questions and were previously the same
+    /// number: publishing the reserve told every client that read the
+    /// advertisement to cap itself at the default, which on a reasoning
+    /// model can be less than one think block.
+    #[serde(default)]
+    pub max_output_tokens: Option<usize>,
 }
 
 impl Default for ContextLimitConfig {
@@ -346,6 +372,7 @@ impl Default for ContextLimitConfig {
             activation_headroom_mb: default_activation_headroom_mb(),
             min_free_floor_mb: default_context_min_free_floor_mb(),
             output_reserve_tokens: default_output_reserve_tokens(),
+            max_output_tokens: None,
         }
     }
 }

crates/neuron/src/harness/admission.rs

@@ -1051,7 +1051,7 @@ mod tests {
 
         // Fill the single queue slot with a waiter that parks on the semaphore.
         let ctrl2 = Arc::clone(&ctrl);
-        let waiter = tokio::spawn(async move { ctrl2.enter(None).await.map(|p| drop(p)) });
+        let waiter = tokio::spawn(async move { ctrl2.enter(None).await.map(drop) });
         // Give the waiter a moment to occupy the queue slot.
         tokio::time::sleep(Duration::from_millis(50)).await;
         assert_eq!(ctrl.queue_depth(), 1);

crates/neuron/src/harness/arch/qwen3_5/snapshot.rs

@@ -562,9 +562,9 @@ mod tests {
                 .forward_batch_decode(&input, &positions, mask.as_ref())
                 .expect("batched step");
             assert_eq!(h.dims()[0], 3);
-            for row in 0..3 {
+            for (row, exp) in expected.iter().enumerate() {
                 let got: Vec<f32> = h.i((row, 0, ..)).unwrap().to_vec1().unwrap();
-                let diff = max_abs_diff(&expected[row][t], &got);
+                let diff = max_abs_diff(&exp[t], &got);
                 assert!(diff < 1e-4, "row {row} step {t} diverged: {diff}");
             }
         }
@@ -610,9 +610,9 @@ mod tests {
         let h = model
             .forward_batch_decode(&input, &[3, 3], None)
             .expect("step");
-        for row in 0..2 {
+        for (row, exp) in expected.iter().enumerate() {
             let got: Vec<f32> = h.i((row, 0, ..)).unwrap().to_vec1().unwrap();
-            let diff = max_abs_diff(&expected[row], &got);
+            let diff = max_abs_diff(exp, &got);
             assert!(diff < 1e-4, "row {row} diverged: {diff}");
         }
     }
@@ -674,9 +674,9 @@ mod tests {
             let h = model
                 .forward_batch_decode(&input, &positions, mask.as_ref())
                 .expect("batched step");
-            for row in 0..2 {
+            for (row, exp) in expected.iter().enumerate() {
                 let got: Vec<f32> = h.i((row, 0, ..)).unwrap().to_vec1().unwrap();
-                let diff = max_abs_diff(&expected[row][t], &got);
+                let diff = max_abs_diff(&exp[t], &got);
                 assert!(diff < 1e-4, "batched row {row} step {t}: {diff}");
             }
         }

crates/neuron/src/harness/chat_template.rs

@@ -233,7 +233,24 @@ pub fn render_chat_template(
                 MessageContent::Null => Value::Null,
             };
             let mut obj = serde_json::Map::new();
-            obj.insert("role".into(), Value::String(m.role.clone()));
+            // `developer` is OpenAI's successor to `system` and is what
+            // a client sends once a model is declared reasoning-capable
+            // (pi-ai: `model.reasoning && supportsDeveloperRole`). Most
+            // chat templates — every one on this fleet — only know the
+            // older spelling and `raise_exception` on anything else, so
+            // an unmodified client got a 422 for a system prompt it sent
+            // correctly.
+            //
+            // Rewritten only when the template does not handle the role
+            // itself: a template that knows `developer` may treat it as
+            // distinct from `system`, and substituting there would be us
+            // deciding something the model's authors already decided.
+            let role = if m.role == "developer" && !template.contains("developer") {
+                "system"
+            } else {
+                m.role.as_str()
+            };
+            obj.insert("role".into(), Value::String(role.to_string()));
             obj.insert("content".into(), content_value);
             // Forward extras (e.g. tool_calls on assistant turns,
             // tool_call_id on tool result turns). HF templates that
@@ -498,6 +515,78 @@ mod tests {
     /// Minimal Qwen3-style template — enough surface to confirm
     /// our renderer threads role + content correctly without
     /// loading a real model's tokenizer_config.json.
+    /// A reasoning-capable model makes OpenAI clients send the system
+    /// prompt as `developer` — and every chat template on this fleet
+    /// raises on an unknown role, so the caller got a 422 for a prompt
+    /// it had sent correctly. Observed live: pi with `reasoning: true`,
+    /// `template_render_failed: Unexpected message role`.
+    #[test]
+    fn the_developer_role_reaches_a_template_that_only_knows_system() {
+        const SYSTEM_ONLY: &str = "{%- for message in messages -%}\
+{%- if message.role == 'system' -%}SYS:{{ message.content }}\
+{%- elif message.role == 'user' -%}USR:{{ message.content }}\
+{%- else -%}{{ raise_exception('Unexpected message role.') }}\
+{%- endif -%}\
+{%- endfor -%}";
+        let messages = vec![
+            ChatMessage {
+                role: "developer".into(),
+                content: MessageContent::Text("be terse".into()),
+                extra: Value::Object(Default::default()),
+            },
+            user_msg("hi"),
+        ];
+        let out = render_chat_template(SYSTEM_ONLY, &messages, &Value::Null, &Value::Null)
+            .expect("a developer role must not blow up a system-only template");
+        assert!(out.contains("SYS:be terse"), "got {out:?}");
+    }
+
+    /// A template that models `developer` itself keeps it: the role may
+    /// mean something distinct there, and substituting would override a
+    /// decision the model's authors already made.
+    #[test]
+    fn a_template_that_knows_developer_keeps_it() {
+        const KNOWS_DEVELOPER: &str = "{%- for message in messages -%}\
+{%- if message.role == 'developer' -%}DEV:{{ message.content }}\
+{%- else -%}{{ message.role }}:{{ message.content }}\
+{%- endif -%}\
+{%- endfor -%}";
+        let messages = vec![ChatMessage {
+            role: "developer".into(),
+            content: MessageContent::Text("be terse".into()),
+            extra: Value::Object(Default::default()),
+        }];
+        let out = render_chat_template(KNOWS_DEVELOPER, &messages, &Value::Null, &Value::Null)
+            .expect("render");
+        assert!(out.contains("DEV:be terse"), "got {out:?}");
+    }
+
+    /// The fetcher and the reader must agree on the filenames, or the
+    /// reader looks for something nobody downloaded and falls back to a
+    /// built-in prompt format without anything failing (#280 — observed
+    /// live: every model neuron downloaded itself was served with the
+    /// fallback because no sidecar was ever fetched).
+    #[test]
+    fn every_template_source_this_reads_is_one_the_loader_fetches() {
+        for name in crate::harness::candle::CandleHarness::SIDECAR_FILES {
+            assert!(
+                !name.is_empty(),
+                "sidecar names are the contract between fetch and read"
+            );
+        }
+        // The three the reader consults, in its own priority order.
+        for source in [
+            "chat_template.jinja",
+            "chat_template.json",
+            "tokenizer_config.json",
+        ] {
+            assert!(
+                crate::harness::candle::CandleHarness::SIDECAR_FILES.contains(&source),
+                "{source} is read by load_chat_template_alongside but never fetched"
+            );
+        }
+    }
+
     const QWEN3_LIKE: &str = "{%- for message in messages -%}\
 <|im_start|>{{ message.role }}\n{{ message.content }}<|im_end|>\n\
 {%- endfor -%}\

crates/neuron/src/harness/context_limit.rs

@@ -234,10 +234,23 @@ fn round_down(tokens: usize, granularity: usize) -> usize {
 
 const CONTEXT_GRANULARITY: usize = 1024;
 
+/// Default ceiling on what a request may name as its output budget.
+///
+/// Not derived from anything — a deliberate figure, and configurable
+/// per host (`[context_limit] max_output_tokens`). The evidence behind
+/// it: a reasoning model asked to build a small application front-loads
+/// one long think block before it acts, measured at 27,504 tokens for a
+/// frontier model on a task Qwen3.8-27B was cut off attempting at
+/// 24,433 (#271, #278). A ceiling below that turns a capable model into
+/// one that never reaches its first tool call, so the default sits
+/// above the observed cost of that class of turn.
+const DEFAULT_OUTPUT_CEILING: usize = 32_768;
+
 /// Derive `limit{context,input,output}` for a loaded model.
 ///
 /// ```text
-/// output  = output_reserve_tokens
+/// output         = output_reserve_tokens          (default + KV planning)
+/// output_ceiling = min(max_output_tokens, max_position_embeddings)
 /// vram_ceiling       = (free_tightest − activation_headroom − min_free_floor) / kv_bytes_per_token_per_card
 /// throughput_ceiling = target_prefill_latency_secs × prefill_tok_per_sec
 /// context = min(max_position_embeddings, vram_ceiling, throughput_ceiling) [clamped by `hard_ceiling` if set]
@@ -318,10 +331,26 @@ pub fn derive_limit(
     );
 
     let input = context.saturating_sub(output);
+    // The ceiling a request may name, distinct from the reserve above
+    // (#278). Bounded by the model's own position limit rather than by
+    // the live context, because the advertisement is read once and
+    // cached by clients: a ceiling that shrank with fleet VRAM would be
+    // stale in whichever direction hurt — either rejecting what we said
+    // we would serve, or leaving budget unclaimed. A request that will
+    // not actually fit is refused at request time, with the numbers,
+    // instead of being under-promised here.
+    let output_ceiling = round_down(
+        cfg.max_output_tokens
+            .unwrap_or(DEFAULT_OUTPUT_CEILING)
+            .min(profile.max_position_embeddings),
+        CONTEXT_GRANULARITY,
+    )
+    .max(output);
     ModelLimit {
         context,
         input: Some(input),
         output,
+        output_ceiling,
     }
 }
 
@@ -329,6 +358,82 @@ pub fn derive_limit(
 mod tests {
     use super::*;
 
+    /// The ceiling a client is told to plan against must not be the
+    /// reserve. Advertising the reserve is what told a reasoning model's
+    /// harness to cap itself below the cost of one think block (#278).
+    #[test]
+    fn the_advertised_ceiling_is_not_the_reserve() {
+        let cfg = ContextLimitConfig::default();
+        let profile = ContextProfile {
+            max_position_embeddings: 131_072,
+            kv_bytes_per_token_per_card: 65_536,
+            world_size: 2,
+        };
+        let limit = derive_limit(&profile, 0, 0.0, None, &cfg);
+        assert_eq!(limit.output, cfg.output_reserve_tokens, "reserve unchanged");
+        assert_eq!(limit.output_ceiling, DEFAULT_OUTPUT_CEILING);
+        assert!(limit.output_ceiling > limit.output);
+    }
+
+    /// A model whose own position limit is below the default ceiling
+    /// cannot generate past it, so the advertisement must not claim it.
+    #[test]
+    fn the_ceiling_never_exceeds_the_models_own_position_limit() {
+        let cfg = ContextLimitConfig::default();
+        let profile = ContextProfile {
+            max_position_embeddings: 16_384,
+            kv_bytes_per_token_per_card: 65_536,
+            world_size: 1,
+        };
+        let limit = derive_limit(&profile, 0, 0.0, None, &cfg);
+        assert_eq!(limit.output_ceiling, 16_384);
+    }
+
+    /// The operator's number wins, which is what makes the default a
+    /// starting point rather than a guess baked into the binary.
+    #[test]
+    fn a_configured_ceiling_overrides_the_default() {
+        let cfg = ContextLimitConfig {
+            max_output_tokens: Some(65_536),
+            ..ContextLimitConfig::default()
+        };
+        let profile = ContextProfile {
+            max_position_embeddings: 131_072,
+            kv_bytes_per_token_per_card: 65_536,
+            world_size: 2,
+        };
+        assert_eq!(
+            derive_limit(&profile, 0, 0.0, None, &cfg).output_ceiling,
+            65_536
+        );
+    }
+
+    /// The ceiling is deliberately *not* a function of live VRAM: it is
+    /// read once and cached by clients, so it has to mean the same thing
+    /// tomorrow. The live context still moves — that is what a request
+    /// is judged against — but the contract does not.
+    #[test]
+    fn the_ceiling_holds_still_while_the_context_moves() {
+        let cfg = ContextLimitConfig::default();
+        let profile = ContextProfile {
+            max_position_embeddings: 131_072,
+            kv_bytes_per_token_per_card: 65_536,
+            world_size: 2,
+        };
+        let roomy = derive_limit(&profile, 60_000, 5_000.0, None, &cfg);
+        // Tight enough that the VRAM term binds — the same shape as the
+        // fleet advertising 109568 one hour and 131072 the next.
+        let tight = derive_limit(&profile, 6_000, 5_000.0, None, &cfg);
+        assert!(
+            tight.context < roomy.context,
+            "the live window should shrink under VRAM pressure"
+        );
+        assert_eq!(
+            tight.output_ceiling, roomy.output_ceiling,
+            "the advertised ceiling must not move with fleet load"
+        );
+    }
+
     /// beast Qwen3.6-27B: 16 full-attn layers, 4 kv heads, head_dim 256,
     /// f16 (2 B), TP=2 → 64 KiB/token total, 32 KiB/token/card.
     fn beast_profile() -> ContextProfile {

crates/neuron/src/harness/engine.rs

@@ -406,9 +406,14 @@ async fn op_prefill(
 pub struct EngineRequest {
     pub prompt_tokens: Vec<u32>,
     pub max_new: usize,
-    pub temperature: f64,
-    pub top_p: Option<f64>,
-    pub seed: u64,
+    /// Sampling resolved once from request → model `generation_config`
+    /// → fallback (#272), rather than loose scalars each caller could
+    /// default differently.
+    pub sampling: crate::harness::sampling::SamplingParams,
+    /// Reasoning-token budget for this request (#223). `None` is
+    /// unbounded — the default, and the behaviour before it existed.
+    /// Per-request because slots in one batch can differ.
+    pub reasoning_budget: Option<usize>,
     pub eos_id: Option<u32>,
     pub tool_schemas: ToolSchemas,
     pub tx: mpsc::Sender<InferenceEvent>,
@@ -466,6 +471,12 @@ struct Slot {
     max_new: usize,
     eos_id: Option<u32>,
     lp: LogitsProcessor,
+    /// The slot's resolved sampling (#272). Held per-slot because the
+    /// repetition penalty and its window are per-request knobs, and
+    /// slots in one batch can carry different ones.
+    sampling: crate::harness::sampling::SamplingParams,
+    /// Bounds this slot's think block (#223); `None` = unbounded.
+    governor: Option<crate::harness::reasoning_budget::ReasoningGovernor>,
     router: mpsc::Sender<RouterMsg>,
     /// Set by the router when the consumer hangs up; the engine stops
     /// feeding the slot and compacts it out.
@@ -573,7 +584,13 @@ async fn run_engine(cfg: EngineConfig, mut rx: mpsc::Receiver<EngineRequest>) {
                     break;
                 }
             };
-            let nt = match sample_with_penalty(&logits, &slot.generated, &mut slot.lp) {
+            let nt = match sample_with_penalty(
+                &logits,
+                &slot.generated,
+                &mut slot.lp,
+                &slot.sampling,
+                slot.governor.as_mut(),
+            ) {
                 Ok(t) => t,
                 Err(e) => {
                     let health = logits_health_slice(&logits_vec);
@@ -774,14 +791,11 @@ async fn prefill_join(
     session: &mut ActiveSession,
     req: EngineRequest,
 ) -> Result<Option<(Slot, u64)>> {
-    use candle_transformers::generation::Sampling;
-
     let EngineRequest {
         prompt_tokens,
         max_new,
-        temperature,
-        top_p,
-        seed,
+        sampling,
+        reasoning_budget,
         eos_id,
         tool_schemas,
         tx,
@@ -789,17 +803,16 @@ async fn prefill_join(
         span,
     } = req;
 
-    let mut lp = {
-        let sampling = if temperature <= 0.0 {
-            Sampling::ArgMax
-        } else {
-            match top_p {
-                Some(p) => Sampling::TopP { p, temperature },
-                None => Sampling::All { temperature },
-            }
-        };
-        LogitsProcessor::from_sampling(seed, sampling)
-    };
+    let mut lp = LogitsProcessor::from_sampling(sampling.seed, sampling.to_sampling());
+    // Built before prefill's first sample so a prompt that opens the
+    // think block is governed from its very first token (#223).
+    let mut governor = crate::harness::reasoning_budget::ReasoningGovernor::new(
+        reasoning_budget,
+        cfg.reasoning_tokens
+            .as_ref()
+            .map(|p| (p.open_id, p.close_id)),
+        prompt_opens_reasoning(&prompt_tokens, cfg.reasoning_tokens.as_ref()),
+    );
 
     let prompt_len = prompt_tokens.len();
     let prefill_start = std::time::Instant::now();
@@ -809,17 +822,18 @@ async fn prefill_join(
     // First token from the prefill logits.
     let generated: Vec<u32> = Vec::new();
     let logits = Tensor::new(logits_vec.as_slice(), &Device::Cpu)?;
-    let first = match sample_with_penalty(&logits, &generated, &mut lp) {
-        Ok(t) => t,
-        Err(e) => {
-            let health = logits_health_slice(&logits_vec);
-            tracing::warn!(
-                ?health,
-                "batch engine: prefill sample failed; logits unhealthy"
-            );
-            return Err(e);
-        }
-    };
+    let first =
+        match sample_with_penalty(&logits, &generated, &mut lp, &sampling, governor.as_mut()) {
+            Ok(t) => t,
+            Err(e) => {
+                let health = logits_health_slice(&logits_vec);
+                tracing::warn!(
+                    ?health,
+                    "batch engine: prefill sample failed; logits unhealthy"
+                );
+                return Err(e);
+            }
+        };
 
     // Router task for this slot.
     let hangup = Arc::new(AtomicBool::new(false));
@@ -848,6 +862,8 @@ async fn prefill_join(
         max_new,
         eos_id,
         lp,
+        sampling,
+        governor,
         router: router_tx,
         hangup,
         finished: None,
@@ -1188,9 +1204,20 @@ mod tests {
             .submit(EngineRequest {
                 prompt_tokens: prompt,
                 max_new,
-                temperature: 0.0, // greedy — deterministic
-                top_p: None,
-                seed: 0,
+                // Greedy, deterministic: the fixture asserts exact
+                // token sequences.
+                sampling: crate::harness::sampling::SamplingParams::resolve(
+                    &crate::harness::sampling::RequestedSampling {
+                        temperature: Some(0.0),
+                        seed: Some(0),
+                        ..Default::default()
+                    },
+                    &crate::harness::sampling::ModelGenerationDefaults::default(),
+                    0,
+                ),
+                // Unbounded: this fixture asserts exact token sequences,
+                // so nothing may substitute a close marker (#223).
+                reasoning_budget: None,
                 eos_id: None,
                 tool_schemas: ToolSchemas::new(),
                 tx,

crates/neuron/src/harness/mod.rs

@@ -12,6 +12,8 @@ pub mod image;
 pub mod prefix_cache;
 pub mod preflight;
 pub mod preprocess;
+pub mod reasoning_budget;
+pub mod sampling;
 pub mod speculative;
 pub mod tp;
 

crates/neuron/src/harness/reasoning_budget.rs

@@ -0,0 +1,279 @@
+//! Bounding how long a model may think before it must answer (#223).
+//!
+//! A reasoning model with no stopping criterion will fill whatever
+//! output budget it is given. Measured on Qwen3.8-27B: given 16,384
+//! tokens it used 16,384; given 32,768 it used 32,768; both times it was
+//! still opening new topics when the cap bit, and both times the caller
+//! received no answer at all.
+//!
+//! The fix is not to stop the model thinking — the run that did produce
+//! files designed for 27,157 tokens first, and that design was good. It
+//! is to bound the thinking so the rest of the output budget survives
+//! for the answer.
+//!
+//! Two halves live here:
+//!
+//! - [`ReasoningBudget`] — how many reasoning tokens this request may
+//!   spend, resolved from whichever control the caller's wire format
+//!   gave them.
+//! - [`ReasoningGovernor`] — the per-request state that enforces it, by
+//!   substituting the model's own `</think>` token when the budget runs
+//!   out so generation transitions to answering instead of being cut off.
+
+use serde::{Deserialize, Serialize};
+
+/// Per-model mapping from an OpenAI effort level to a token budget.
+///
+/// OpenAI-shaped clients cannot send a token count — pi-ai's vocabulary
+/// is the ladder `off | minimal | low | medium | high | xhigh | max` and
+/// nothing else — so the numbers have to live on the server. Operator
+/// configurable, because the right values depend on the model and the
+/// hardware; a derived default would be a guess baked into the binary.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ReasoningBudgetLadder {
+    pub minimal: usize,
+    pub low: usize,
+    pub medium: usize,
+    pub high: usize,
+    /// `xhigh` and `max` are only offered by a client when the model
+    /// declares them; absent here means "not offered", and a request
+    /// naming one falls back to `high` rather than being rejected.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub xhigh: Option<usize>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub max: Option<usize>,
+}
+
+impl Default for ReasoningBudgetLadder {
+    /// Rungs sized against observed behaviour rather than round numbers:
+    /// a long agentic design turn on this class of model runs to ~27k
+    /// tokens, so `high` sits above that (bounded but rarely binding),
+    /// `medium` at roughly half (enough to plan a whole implementation),
+    /// and `low` at the scale of a focused single-file change.
+    fn default() -> Self {
+        Self {
+            minimal: 1_024,
+            low: 4_096,
+            medium: 12_288,
+            high: 32_768,
+            xhigh: None,
+            max: None,
+        }
+    }
+}
+
+impl ReasoningBudgetLadder {
+    /// Resolve an effort level to a token budget.
+    ///
+    /// `none`/`off` are handled before this — they disable thinking
+    /// outright via the chat template — so they have no budget here.
+    /// An unrecognised level resolves to `None` (unbounded) rather than
+    /// to a guess: silently substituting a budget nobody asked for is
+    /// the failure mode this whole area has been full of.
+    pub fn for_effort(&self, effort: &str) -> Option<usize> {
+        match effort.trim().to_ascii_lowercase().as_str() {
+            "minimal" => Some(self.minimal),
+            "low" => Some(self.low),
+            "medium" => Some(self.medium),
+            "high" => Some(self.high),
+            "xhigh" => Some(self.xhigh.unwrap_or(self.high)),
+            "max" => Some(self.max.or(self.xhigh).unwrap_or(self.high)),
+            _ => None,
+        }
+    }
+
+    /// The mapping as a client should see it on `/v1/models` — the rungs
+    /// this deployment actually offers, so a caller picking `low` knows
+    /// what it bought instead of guessing (#274).
+    pub fn advertised(&self) -> Vec<(String, usize)> {
+        let mut out = vec![
+            ("minimal".to_string(), self.minimal),
+            ("low".to_string(), self.low),
+            ("medium".to_string(), self.medium),
+            ("high".to_string(), self.high),
+        ];
+        if let Some(v) = self.xhigh {
+            out.push(("xhigh".to_string(), v));
+        }
+        if let Some(v) = self.max {
+            out.push(("max".to_string(), v));
+        }
+        out
+    }
+}
+
+/// Enforces a resolved budget over one request's token stream.
+///
+/// Fed every sampled token; returns the token that should actually be
+/// emitted. While the model is inside a think block and over budget, it
+/// returns the close marker instead, exactly once — after which the
+/// model is answering and the governor is inert.
+#[derive(Debug, Clone)]
+pub struct ReasoningGovernor {
+    limit: usize,
+    open_id: u32,
+    close_id: u32,
+    inside: bool,
+    used: usize,
+    forced: bool,
+}
+
+impl ReasoningGovernor {
+    /// `None` when the request named no budget, or the model has no
+    /// reasoning markers to enforce one with — in both cases generation
+    /// proceeds exactly as it did before this existed.
+    pub fn new(
+        limit: Option<usize>,
+        markers: Option<(u32, u32)>,
+        prompt_opened_reasoning: bool,
+    ) -> Option<Self> {
+        let limit = limit?;
+        let (open_id, close_id) = markers?;
+        Some(Self {
+            limit,
+            open_id,
+            close_id,
+            inside: prompt_opened_reasoning,
+            used: 0,
+            forced: false,
+        })
+    }
+
+    /// Whether the forced close has already been spent.
+    pub fn forced(&self) -> bool {
+        self.forced
+    }
+
+    /// Reasoning tokens counted so far.
+    pub fn used(&self) -> usize {
+        self.used
+    }
+
+    /// Govern one sampled token, returning the token to emit.
+    pub fn govern(&mut self, sampled: u32) -> u32 {
+        if sampled == self.open_id {
+            self.inside = true;
+            return sampled;
+        }
+        if sampled == self.close_id {
+            self.inside = false;
+            return sampled;
+        }
+        if !self.inside {
+            return sampled;
+        }
+        if self.used >= self.limit {
+            // Budget spent: hand the model its own close marker so it
+            // transitions to answering. Cutting the stream here instead
+            // would reproduce the very failure this exists to prevent.
+            self.inside = false;
+            self.forced = true;
+            return self.close_id;
+        }
+        self.used += 1;
+        sampled
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const OPEN: u32 = 100;
+    const CLOSE: u32 = 101;
+
+    fn governor(limit: usize, opened: bool) -> ReasoningGovernor {
+        ReasoningGovernor::new(Some(limit), Some((OPEN, CLOSE)), opened).expect("governor")
+    }
+
+    #[test]
+    fn a_request_with_no_budget_is_ungoverned() {
+        assert!(ReasoningGovernor::new(None, Some((OPEN, CLOSE)), true).is_none());
+    }
+
+    /// A model with no detected markers cannot be governed — better
+    /// unbounded than truncated at an arbitrary token.
+    #[test]
+    fn a_model_without_markers_is_ungoverned() {
+        assert!(ReasoningGovernor::new(Some(10), None, true).is_none());
+    }
+
+    /// The case that motivated this: the chat template left the think
+    /// block open, so the model is reasoning from the first token.
+    #[test]
+    fn a_prompt_opened_block_is_bounded_and_force_closed() {
+        let mut g = governor(3, true);
+        assert_eq!(g.govern(7), 7);
+        assert_eq!(g.govern(8), 8);
+        assert_eq!(g.govern(9), 9);
+        assert_eq!(g.govern(10), CLOSE, "the fourth token must close the block");
+        assert!(g.forced());
+        assert_eq!(g.used(), 3);
+        // Answering now — the governor is inert.
+        assert_eq!(g.govern(11), 11);
+        assert_eq!(g.govern(12), 12);
+    }
+
+    /// Content before the block opens is never counted against the
+    /// reasoning budget.
+    #[test]
+    fn only_tokens_inside_the_block_are_counted() {
+        let mut g = governor(2, false);
+        assert_eq!(g.govern(5), 5);
+        assert_eq!(g.govern(6), 6);
+        assert_eq!(g.used(), 0);
+        assert_eq!(g.govern(OPEN), OPEN);
+        assert_eq!(g.govern(7), 7);
+        assert_eq!(g.govern(8), 8);
+        assert_eq!(g.govern(9), CLOSE);
+        assert_eq!(g.used(), 2);
+    }
+
+    /// A model that finishes thinking on its own is untouched — the
+    /// budget is a ceiling, not a target.
+    #[test]
+    fn a_model_that_stops_on_its_own_is_not_forced() {
+        let mut g = governor(100, true);
+        for t in 20..30 {
+            assert_eq!(g.govern(t), t);
+        }
+        assert_eq!(g.govern(CLOSE), CLOSE);
+        assert!(!g.forced());
+        for t in 40..50 {
+            assert_eq!(g.govern(t), t);
+        }
+        assert!(!g.forced(), "content after the block must not be governed");
+    }
+
+    #[test]
+    fn the_ladder_resolves_the_levels_clients_can_send() {
+        let l = ReasoningBudgetLadder::default();
+        assert_eq!(l.for_effort("minimal"), Some(1_024));
+        assert_eq!(l.for_effort("LOW"), Some(4_096));
+        assert_eq!(l.for_effort(" medium "), Some(12_288));
+        assert_eq!(l.for_effort("high"), Some(32_768));
+        // Not offered by default → falls back to high rather than
+        // rejecting a level the client was told it could send.
+        assert_eq!(l.for_effort("xhigh"), Some(32_768));
+        assert_eq!(l.for_effort("max"), Some(32_768));
+        // Unknown → unbounded, never a substituted guess.
+        assert_eq!(l.for_effort("enthusiastic"), None);
+        assert_eq!(l.for_effort("none"), None);
+    }
+
+    #[test]
+    fn the_advertised_ladder_lists_only_what_is_offered() {
+        let l = ReasoningBudgetLadder::default();
+        let names: Vec<_> = l.advertised().into_iter().map(|(k, _)| k).collect();
+        assert_eq!(names, ["minimal", "low", "medium", "high"]);
+        let l2 = ReasoningBudgetLadder {
+            xhigh: Some(49_152),
+            ..ReasoningBudgetLadder::default()
+        };
+        assert!(
+            l2.advertised()
+                .iter()
+                .any(|(k, v)| k == "xhigh" && *v == 49_152)
+        );
+    }
+}

crates/neuron/src/harness/sampling.rs

@@ -0,0 +1,368 @@
+//! Sampling parameter resolution (#272).
+//!
+//! Three sources, in priority order:
+//!
+//! 1. what the **request** asked for,
+//! 2. what the **model** published in `generation_config.json`,
+//! 3. a built-in fallback.
+//!
+//! Before this, (2) did not exist and (3) was a hardcoded
+//! `temperature = 0.7` with `top_p = None` — and `None` selects
+//! `Sampling::All`, meaning no truncation at all. So a caller that
+//! omitted sampling fields (the common case: the DeepSeek Harness sends
+//! only `temperature`) got untruncated sampling across the full ~250k
+//! vocabulary on a model whose authors published `top_k = 20,
+//! top_p = 0.95, temperature = 1.0`.
+//!
+//! Picking "no truncation" for an absent field is not a neutral default,
+//! it is the widest possible one. The neutral default is what the model
+//! shipped with.
+//!
+//! Resolved **once** per request and threaded whole. The eight
+//! `LogitsProcessor` construction sites this replaces could each have
+//! disagreed about a default — the same shape of bug as #252, where two
+//! config files described one model and drifted.
+
+use serde::{Deserialize, Serialize};
+use std::path::Path;
+
+/// Fallback temperature when neither the request nor the model says.
+/// Retained from the previous hardcoded value so a model without a
+/// `generation_config.json` behaves exactly as it did before.
+const FALLBACK_TEMPERATURE: f64 = 0.7;
+
+/// Repetition penalty applied to recently-generated tokens before
+/// sampling. 1.0 disables it; >1.0 makes recently-emitted tokens less
+/// likely. mistral.rs and llama.cpp default to 1.1, which is enough to
+/// stop small quantized models from degenerating into "Wait, no, no..."
+/// loops without distorting normal output.
+pub const DEFAULT_REPEAT_PENALTY: f32 = 1.1;
+
+/// Number of recently-generated tokens fed into the repetition penalty.
+/// Matches the candle quantized-qwen3 example default.
+///
+/// Defensible for chat and poorly suited to a 24k-token reasoning block,
+/// where a derivation repeated 500 tokens later is well outside the
+/// window — which is why it is now a per-request knob rather than a
+/// constant.
+pub const DEFAULT_REPEAT_LAST_N: usize = 64;
+
+/// What a model published in its `generation_config.json`.
+///
+/// Every field optional: the file is a HuggingFace convention, not a
+/// schema, and models populate different subsets of it.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct ModelGenerationDefaults {
+    pub temperature: Option<f64>,
+    pub top_p: Option<f64>,
+    pub top_k: Option<usize>,
+}
+
+impl ModelGenerationDefaults {
+    /// Read `generation_config.json` from a model snapshot directory.
+    ///
+    /// Absent or unparseable is not an error — we fall back exactly as
+    /// before — but it is logged, because silently guessing the model's
+    /// sampling is how the untruncated default went unnoticed.
+    pub fn load_from_dir(dir: &Path) -> Self {
+        let path = dir.join("generation_config.json");
+        let text = match std::fs::read_to_string(&path) {
+            Ok(t) => t,
+            Err(e) => {
+                tracing::debug!(
+                    path = %path.display(),
+                    error = %e,
+                    "sampling: no generation_config.json; using built-in fallbacks"
+                );
+                return Self::default();
+            }
+        };
+        match serde_json::from_str::<Self>(&text) {
+            Ok(d) => {
+                tracing::info!(
+                    path = %path.display(),
+                    temperature = ?d.temperature,
+                    top_p = ?d.top_p,
+                    top_k = ?d.top_k,
+                    "sampling: model generation defaults loaded"
+                );
+                d
+            }
+            Err(e) => {
+                tracing::warn!(
+                    path = %path.display(),
+                    error = %e,
+                    "sampling: generation_config.json did not parse; using built-in fallbacks"
+                );
+                Self::default()
+            }
+        }
+    }
+}
+
+/// What the caller asked for. All optional — absent means "no opinion",
+/// which defers to the model's published value.
+#[derive(Debug, Clone, Default)]
+pub struct RequestedSampling {
+    pub temperature: Option<f64>,
+    pub top_p: Option<f64>,
+    pub top_k: Option<usize>,
+    pub seed: Option<u64>,
+    pub repeat_penalty: Option<f32>,
+    pub repeat_last_n: Option<usize>,
+}
+
+/// Fully-resolved sampling for one request.
+#[derive(Debug, Clone, PartialEq)]
+pub struct SamplingParams {
+    pub temperature: f64,
+    pub top_p: Option<f64>,
+    pub top_k: Option<usize>,
+    pub seed: u64,
+    pub repeat_penalty: f32,
+    pub repeat_last_n: usize,
+}
+
+impl SamplingParams {
+    /// Resolve request over model defaults over fallback.
+    ///
+    /// `random_seed` is the per-request seed used when the caller did
+    /// not pin one; it is passed in rather than generated here so this
+    /// stays a pure function and the "same seed reproduces" property is
+    /// testable without a clock.
+    pub fn resolve(
+        requested: &RequestedSampling,
+        model: &ModelGenerationDefaults,
+        random_seed: u64,
+    ) -> Self {
+        Self {
+            temperature: requested
+                .temperature
+                .or(model.temperature)
+                .unwrap_or(FALLBACK_TEMPERATURE),
+            // No `unwrap_or` here on purpose: `None` still means "do not
+            // truncate", but it is now only reachable when neither the
+            // caller nor the model expressed a preference, rather than
+            // whenever the caller stayed quiet.
+            top_p: requested.top_p.or(model.top_p),
+            top_k: requested.top_k.or(model.top_k),
+            seed: requested.seed.unwrap_or(random_seed),
+            repeat_penalty: requested.repeat_penalty.unwrap_or(DEFAULT_REPEAT_PENALTY),
+            repeat_last_n: requested.repeat_last_n.unwrap_or(DEFAULT_REPEAT_LAST_N),
+        }
+    }
+
+    /// The candle sampling strategy these parameters select.
+    ///
+    /// `temperature <= 0` is greedy regardless of the rest — a caller
+    /// asking for determinism that way should not have it silently
+    /// softened by a `top_k` the model happened to publish.
+    pub fn to_sampling(&self) -> candle_transformers::generation::Sampling {
+        use candle_transformers::generation::Sampling;
+        if self.temperature <= 0.0 {
+            return Sampling::ArgMax;
+        }
+        let temperature = self.temperature;
+        match (self.top_k, self.top_p) {
+            (Some(k), Some(p)) => Sampling::TopKThenTopP { k, p, temperature },
+            (Some(k), None) => Sampling::TopK { k, temperature },
+            (None, Some(p)) => Sampling::TopP { p, temperature },
+            (None, None) => Sampling::All { temperature },
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use candle_transformers::generation::Sampling;
+
+    fn qwen3_defaults() -> ModelGenerationDefaults {
+        ModelGenerationDefaults {
+            temperature: Some(1.0),
+            top_p: Some(0.95),
+            top_k: Some(20),
+        }
+    }
+
+    /// The case that motivated #271: a caller that names no sampling
+    /// parameters must get the model's published ones, not untruncated
+    /// sampling at a hardcoded 0.7.
+    #[test]
+    fn a_silent_request_inherits_the_models_published_sampling() {
+        let p = SamplingParams::resolve(&RequestedSampling::default(), &qwen3_defaults(), 42);
+        assert_eq!(p.temperature, 1.0);
+        assert_eq!(p.top_p, Some(0.95));
+        assert_eq!(p.top_k, Some(20));
+        assert_eq!(
+            p.to_sampling(),
+            Sampling::TopKThenTopP {
+                k: 20,
+                p: 0.95,
+                temperature: 1.0
+            },
+            "the combination Qwen3 asks for must be expressible"
+        );
+    }
+
+    /// The caller still wins. A harness that deliberately sets a low
+    /// temperature must not have it overridden by the model's file.
+    #[test]
+    fn the_request_overrides_the_model() {
+        let requested = RequestedSampling {
+            temperature: Some(0.2),
+            top_k: Some(5),
+            ..Default::default()
+        };
+        let p = SamplingParams::resolve(&requested, &qwen3_defaults(), 42);
+        assert_eq!(p.temperature, 0.2);
+        assert_eq!(p.top_k, Some(5));
+        // Untouched fields still fall through to the model.
+        assert_eq!(p.top_p, Some(0.95));
+    }
+
+    /// A model with no `generation_config.json` must behave exactly as
+    /// it did before this landed, so nothing regresses on the models
+    /// that do not ship one.
+    #[test]
+    fn without_model_defaults_the_old_behaviour_is_preserved() {
+        let p = SamplingParams::resolve(
+            &RequestedSampling::default(),
+            &ModelGenerationDefaults::default(),
+            42,
+        );
+        assert_eq!(p.temperature, FALLBACK_TEMPERATURE);
+        assert_eq!(p.top_p, None);
+        assert_eq!(p.top_k, None);
+        assert_eq!(p.to_sampling(), Sampling::All { temperature: 0.7 });
+    }
+
+    /// A pinned seed is honoured; an absent one takes the per-request
+    /// random value. Reproducibility is the whole point — the text paths
+    /// previously called `unix_subsec_nanos()` unconditionally, so
+    /// `seed` was accepted and discarded.
+    #[test]
+    fn seed_is_pinned_when_given_and_random_otherwise() {
+        let pinned = SamplingParams::resolve(
+            &RequestedSampling {
+                seed: Some(7),
+                ..Default::default()
+            },
+            &ModelGenerationDefaults::default(),
+            42,
+        );
+        assert_eq!(pinned.seed, 7);
+
+        let unpinned = SamplingParams::resolve(
+            &RequestedSampling::default(),
+            &ModelGenerationDefaults::default(),
+            42,
+        );
+        assert_eq!(unpinned.seed, 42);
+    }
+
+    /// Greedy beats every truncation setting: a caller asking for
+    /// `temperature = 0` wants determinism, not a softened version of it.
+    #[test]
+    fn zero_temperature_is_greedy_even_with_model_top_k() {
+        let requested = RequestedSampling {
+            temperature: Some(0.0),
+            ..Default::default()
+        };
+        let p = SamplingParams::resolve(&requested, &qwen3_defaults(), 42);
+        assert_eq!(p.to_sampling(), Sampling::ArgMax);
+    }
+
+    /// Each truncation knob alone selects the matching strategy.
+    #[test]
+    fn single_knobs_select_their_own_strategy() {
+        let only_k = SamplingParams::resolve(
+            &RequestedSampling {
+                top_k: Some(20),
+                ..Default::default()
+            },
+            &ModelGenerationDefaults::default(),
+            1,
+        );
+        assert_eq!(
+            only_k.to_sampling(),
+            Sampling::TopK {
+                k: 20,
+                temperature: 0.7
+            }
+        );
+
+        let only_p = SamplingParams::resolve(
+            &RequestedSampling {
+                top_p: Some(0.9),
+                ..Default::default()
+            },
+            &ModelGenerationDefaults::default(),
+            1,
+        );
+        assert_eq!(
+            only_p.to_sampling(),
+            Sampling::TopP {
+                p: 0.9,
+                temperature: 0.7
+            }
+        );
+    }
+
+    /// Repetition penalty and its window are now per-request, defaulting
+    /// to the values that were previously constants.
+    #[test]
+    fn repetition_knobs_default_to_the_former_constants() {
+        let d = SamplingParams::resolve(
+            &RequestedSampling::default(),
+            &ModelGenerationDefaults::default(),
+            1,
+        );
+        assert_eq!(d.repeat_penalty, DEFAULT_REPEAT_PENALTY);
+        assert_eq!(d.repeat_last_n, DEFAULT_REPEAT_LAST_N);
+
+        let tuned = SamplingParams::resolve(
+            &RequestedSampling {
+                repeat_penalty: Some(1.05),
+                repeat_last_n: Some(512),
+                ..Default::default()
+            },
+            &ModelGenerationDefaults::default(),
+            1,
+        );
+        assert_eq!(tuned.repeat_penalty, 1.05);
+        assert_eq!(tuned.repeat_last_n, 512);
+    }
+
+    #[test]
+    fn absent_generation_config_is_not_an_error() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let d = ModelGenerationDefaults::load_from_dir(dir.path());
+        assert!(d.temperature.is_none() && d.top_p.is_none() && d.top_k.is_none());
+    }
+
+    #[test]
+    fn a_real_generation_config_parses() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        // Verbatim from Qwen/Qwen3.8-27B, extra fields included — the
+        // reader must tolerate the ones it does not model.
+        std::fs::write(
+            dir.path().join("generation_config.json"),
+            r#"{"bos_token_id":248044,"do_sample":true,"eos_token_id":[248046,248044],
+                "pad_token_id":248044,"temperature":1.0,"top_k":20,"top_p":0.95}"#,
+        )
+        .expect("write");
+        let d = ModelGenerationDefaults::load_from_dir(dir.path());
+        assert_eq!(d.temperature, Some(1.0));
+        assert_eq!(d.top_p, Some(0.95));
+        assert_eq!(d.top_k, Some(20));
+    }
+
+    #[test]
+    fn malformed_generation_config_falls_back_rather_than_failing() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        std::fs::write(dir.path().join("generation_config.json"), "{not json").expect("write");
+        let d = ModelGenerationDefaults::load_from_dir(dir.path());
+        assert!(d.temperature.is_none());
+    }
+}

crates/neuron/src/harness/tp/tp_qwen3_5.rs

@@ -2445,7 +2445,7 @@ mod tests {
     }
 
     #[cfg(not(feature = "cuda"))]
-    fn vb_over(path: &std::path::Path) -> ShardedVarBuilder {
+    fn vb_over(path: &std::path::Path) -> ShardedVarBuilder<'_> {
         // SAFETY: mmap of a file the test just wrote; nothing mutates it.
         unsafe {
             candle_nn::var_builder::ShardedSafeTensors::var_builder(

crates/neuron/src/wire/openai_responses.rs

@@ -113,8 +113,30 @@ pub fn request_to_chat(req: ResponsesRequest) -> Result<ChatCompletionRequest, T
             });
         }
         ResponsesInput::Items(items) => {
+            // A reasoning item describes the assistant turn that
+            // follows it, so it is held until that turn arrives rather
+            // than becoming a message of its own (#277).
+            let mut pending_reasoning: Option<String> = None;
             for element in items {
                 let msg = match element {
+                    ResponsesInputElement::Typed(ResponsesInputItem::Reasoning {
+                        content,
+                        summary,
+                    }) => {
+                        if let Some(text) = reasoning_item_text(&content, &summary) {
+                            // Two reasoning items with no assistant turn
+                            // between them: keep both, in order, rather
+                            // than letting the second overwrite the first.
+                            match &mut pending_reasoning {
+                                Some(existing) => {
+                                    existing.push_str("\n\n");
+                                    existing.push_str(&text);
+                                }
+                                slot => *slot = Some(text),
+                            }
+                        }
+                        None
+                    }
                     ResponsesInputElement::Typed(item) => input_item_to_chat(item),
                     // Bare `{role, content}` (OpenAI EasyInputMessage —
                     // what litellm/agent-zero emit). `content: null`
@@ -128,34 +150,95 @@ pub fn request_to_chat(req: ResponsesRequest) -> Result<ChatCompletionRequest, T
                         extra: Value::Object(Default::default()),
                     }),
                     // Forward-compat: an item shape we don't model.
-                    // Dropped rather than rejected (see
-                    // `ResponsesInputElement::Other`).
-                    ResponsesInputElement::Other(_) => None,
+                    // Counted and logged rather than vanishing silently —
+                    // a shape we drop must be discoverable from the
+                    // outside (#277), which is how this class of defect
+                    // stayed invisible for so long.
+                    ResponsesInputElement::Other(other) => {
+                        // Resolved before the macro: `tracing`'s own
+                        // `Value` trait is in scope inside it, and would
+                        // shadow `serde_json::Value` here.
+                        let item_type = other
+                            .get("type")
+                            .and_then(|t| t.as_str())
+                            .unwrap_or("<untyped>")
+                            .to_string();
+                        tracing::warn!(
+                            %item_type,
+                            "responses: dropping an input item shape this build does not model"
+                        );
+                        None
+                    }
                 };
-                if let Some(msg) = msg {
+                if let Some(mut msg) = msg {
+                    if msg.role == "assistant"
+                        && let Some(text) = pending_reasoning.take()
+                    {
+                        attach_reasoning(&mut msg, text);
+                    }
                     messages.push(msg);
                 }
             }
+            // Reasoning with no assistant turn after it — the exact
+            // shape of a turn truncated mid-think and replayed with
+            // "continue". It is the whole payload of that turn, so it
+            // becomes an assistant turn of its own rather than being
+            // discarded for lack of a message to ride on.
+            if let Some(text) = pending_reasoning.take() {
+                let mut msg = ChatMessage {
+                    role: "assistant".into(),
+                    content: MessageContent::Text(String::new()),
+                    extra: Value::Object(Default::default()),
+                };
+                attach_reasoning(&mut msg, text);
+                messages.push(msg);
+            }
         }
     }
 
-    // Forward tool definitions to the harness (#158). The chat path
-    // reads `extra["tools"]` for both the Jinja prompt render and
-    // argument-type coercion, so normalizing into the chat-wrapped
-    // shape here is all the plumbing tools need.
-    let mut extra = serde_json::Map::new();
-    if let Some(tools) = req.extra.get("tools").and_then(Value::as_array) {
-        let normalized: Vec<Value> = tools.iter().filter_map(normalize_tool).collect();
-        if !normalized.is_empty() {
-            extra.insert("tools".into(), Value::Array(normalized));
+    // Carry the caller's extension fields across the hop (#277).
+    //
+    // This used to start from an empty map and insert exactly one key,
+    // which meant every extension a caller sent to `/v1/responses` was
+    // discarded — including `chat_template_kwargs`, the only route by
+    // which `enable_thinking` can reach the template, which is why
+    // `/no_think` worked on chat/completions and not here (#223).
+    // Keys the chat path does not model are inert, so forwarding them
+    // costs nothing and stops the next control needing its own plumbing.
+    let mut extra = match req.extra {
+        Value::Object(map) => map,
+        _ => serde_json::Map::new(),
+    };
+    // Tool definitions are the exception: Responses flattens the
+    // function fields and the chat path (#158) reads the nested shape
+    // for both the Jinja render and argument coercion, so this key is
+    // rewritten rather than forwarded.
+    match extra.get("tools").and_then(Value::as_array) {
+        Some(tools) => {
+            let normalized: Vec<Value> = tools.iter().filter_map(normalize_tool).collect();
+            if normalized.is_empty() {
+                extra.remove("tools");
+            } else {
+                extra.insert("tools".into(), Value::Array(normalized));
+            }
+        }
+        None => {
+            extra.remove("tools");
         }
     }
 
+    // A caller that asked for no reasoning must get none (#223).
+    apply_reasoning_effort(&mut extra);
+
     Ok(ChatCompletionRequest {
         model: req.model,
         messages,
         temperature: req.temperature,
         top_p: req.top_p,
+        top_k: req.top_k,
+        seed: req.seed,
+        repetition_penalty: req.repetition_penalty,
+        repeat_last_n: req.repeat_last_n,
         max_tokens: req.max_output_tokens,
         // Responses spells the cap `max_output_tokens`, already
         // resolved onto the legacy field above.
@@ -239,13 +322,102 @@ fn input_item_to_chat(item: ResponsesInputItem) -> Option<ChatMessage> {
                 extra: Value::Object(extra),
             })
         }
-        // Reasoning items don't have a chat-completions equivalent
-        // we can faithfully forward. Silently drop — the alternative
-        // is rejecting a well-formed request, which is worse UX.
+        // Handled before this function is reached: a reasoning item
+        // belongs to the assistant turn that follows it, so the caller
+        // holds it and attaches it there (#277).
         ResponsesInputItem::Reasoning { .. } => None,
     }
 }
 
+/// Map the Responses reasoning control onto the template kwarg neuron
+/// already honours (#223).
+///
+/// `reasoning: {"effort": "none"}` is how a Responses client says "do
+/// not think" — it is what pi-ai emits for thinking-level *off*. The
+/// chat-completions path couples generation to surfacing via
+/// `default_enable_thinking`; this surface never did, so the switch had
+/// no route at all and a client asking for no reasoning got a full think
+/// block anyway. Observed live: a harness set thinking off and received
+/// 32,768 tokens of reasoning and no answer.
+///
+/// Only `none` and `off` map. `minimal` / `low` deliberately do not:
+/// they ask for *less* thinking, not none, and the template's switch is
+/// binary — silently turning "minimal" into "off" would be the same
+/// class of lie this whole area has been full of. They pass through and
+/// the model thinks as usual.
+///
+/// An explicit `chat_template_kwargs.enable_thinking` from the caller
+/// wins, matching `default_enable_thinking`'s precedence: the more
+/// specific control is the one the caller reached for.
+fn apply_reasoning_effort(extra: &mut serde_json::Map<String, Value>) {
+    if extra
+        .get("chat_template_kwargs")
+        .and_then(|k| k.get("enable_thinking"))
+        .is_some()
+    {
+        return;
+    }
+    let effort = extra
+        .get("reasoning")
+        .and_then(|r| r.get("effort"))
+        .and_then(|e| e.as_str())
+        .map(|e| e.trim().to_ascii_lowercase());
+    if !matches!(effort.as_deref(), Some("none") | Some("off")) {
+        return;
+    }
+    let kwargs = extra
+        .entry("chat_template_kwargs")
+        .or_insert_with(|| json!({}));
+    if !kwargs.is_object() {
+        *kwargs = json!({});
+    }
+    if let Some(kw) = kwargs.as_object_mut() {
+        kw.insert("enable_thinking".into(), Value::Bool(false));
+    }
+}
+
+/// The text of a replayed reasoning item, under either spelling.
+///
+/// `summary` is what neuron emits (`summary_text` parts) and `content`
+/// is what OpenAI's o-series emits (`reasoning_text` parts); clients
+/// replay the completed item verbatim, so the field we read has to be
+/// the field the far end wrote. Parts are joined with a blank line,
+/// matching how pi-ai flattens the same item for display.
+///
+/// Returns `None` for an item with no usable text — an
+/// encrypted-content-only item, or an empty summary — so an assistant
+/// turn is not annotated with an empty think block.
+fn reasoning_item_text(content: &[Value], summary: &[Value]) -> Option<String> {
+    fn join(parts: &[Value]) -> String {
+        parts
+            .iter()
+            .filter_map(|p| p.get("text").and_then(Value::as_str))
+            .filter(|t| !t.is_empty())
+            .collect::<Vec<_>>()
+            .join("\n\n")
+    }
+    let text = match join(summary) {
+        s if !s.is_empty() => s,
+        _ => join(content),
+    };
+    (!text.is_empty()).then_some(text)
+}
+
+/// Hang a turn's reasoning on the assistant message it belongs to.
+///
+/// `reasoning_content` is the field HF chat templates read — Qwen3.8's
+/// renders it back inside `<think>` — and `render_chat_template`
+/// forwards message extras verbatim, so this is the whole of what the
+/// round-trip needs on our side.
+fn attach_reasoning(msg: &mut ChatMessage, text: String) {
+    if !msg.extra.is_object() {
+        msg.extra = Value::Object(Default::default());
+    }
+    if let Some(obj) = msg.extra.as_object_mut() {
+        obj.insert("reasoning_content".into(), Value::String(text));
+    }
+}
+
 fn message_content_to_chat(content: ResponsesMessageContent) -> MessageContent {
     match content {
         ResponsesMessageContent::Text(s) => MessageContent::Text(s),
@@ -1008,6 +1180,10 @@ mod tests {
             max_output_tokens: None,
             temperature: None,
             top_p: None,
+            top_k: None,
+            seed: None,
+            repetition_penalty: None,
+            repeat_last_n: None,
             previous_response_id: None,
             extra: Value::Object(Default::default()),
         };
@@ -1030,6 +1206,10 @@ mod tests {
             max_output_tokens: None,
             temperature: None,
             top_p: None,
+            top_k: None,
+            seed: None,
+            repetition_penalty: None,
+            repeat_last_n: None,
             previous_response_id: None,
             extra: Value::Object(Default::default()),
         };
@@ -1053,6 +1233,10 @@ mod tests {
             max_output_tokens: None,
             temperature: None,
             top_p: None,
+            top_k: None,
+            seed: None,
+            repetition_penalty: None,
+            repeat_last_n: None,
             previous_response_id: Some("resp_prev".into()),
             extra: Value::Object(Default::default()),
         };
@@ -1085,6 +1269,10 @@ mod tests {
             max_output_tokens: None,
             temperature: None,
             top_p: None,
+            top_k: None,
+            seed: None,
+            repetition_penalty: None,
+            repeat_last_n: None,
             previous_response_id: None,
             extra: Value::Object(Default::default()),
         };
@@ -1115,6 +1303,10 @@ mod tests {
             max_output_tokens: None,
             temperature: None,
             top_p: None,
+            top_k: None,
+            seed: None,
+            repetition_penalty: None,
+            repeat_last_n: None,
             previous_response_id: None,
             extra: Value::Object(Default::default()),
         };
@@ -1160,6 +1352,10 @@ mod tests {
             max_output_tokens: None,
             temperature: None,
             top_p: None,
+            top_k: None,
+            seed: None,
+            repetition_penalty: None,
+            repeat_last_n: None,
             previous_response_id: None,
             extra: Value::Object(Default::default()),
         };
@@ -1197,6 +1393,10 @@ mod tests {
             max_output_tokens: None,
             temperature: None,
             top_p: None,
+            top_k: None,
+            seed: None,
+            repetition_penalty: None,
+            repeat_last_n: None,
             previous_response_id: None,
             extra: Value::Object(Default::default()),
         };
@@ -1207,12 +1407,18 @@ mod tests {
         ));
     }
 
+    /// An item carrying no readable text — encrypted-content-only, or
+    /// an empty summary — must not manufacture an empty assistant turn
+    /// with a blank think block.
     #[test]
-    fn reasoning_items_are_silently_dropped() {
+    fn a_reasoning_item_with_no_text_adds_no_turn() {
         let req = ResponsesRequest {
             model: "m".into(),
             input: typed_items(vec![
-                ResponsesInputItem::Reasoning { content: vec![] },
+                ResponsesInputItem::Reasoning {
+                    content: vec![],
+                    summary: vec![],
+                },
                 ResponsesInputItem::Message {
                     role: "user".into(),
                     content: ResponsesMessageContent::Text("hi".into()),
@@ -1223,6 +1429,10 @@ mod tests {
             max_output_tokens: None,
             temperature: None,
             top_p: None,
+            top_k: None,
+            seed: None,
+            repetition_penalty: None,
+            repeat_last_n: None,
             previous_response_id: None,
             extra: Value::Object(Default::default()),
         };
@@ -1231,6 +1441,299 @@ mod tests {
         assert_eq!(chat.messages[0].role, "user");
     }
 
+    /// The shape neuron itself emits — `summary` with a `summary_text`
+    /// part — replayed by a client that round-trips the completed item
+    /// verbatim, which is what pi-ai/DSH does.
+    #[test]
+    fn replayed_reasoning_rides_on_the_assistant_turn_it_belongs_to() {
+        let raw = r#"{
+            "model": "Qwen/Qwen3.8-27B",
+            "input": [
+                {"type": "message", "role": "user", "content": "build it"},
+                {"type": "reasoning", "id": "rs_1", "status": "completed",
+                 "summary": [{"type": "summary_text", "text": "the plan so far"}]},
+                {"type": "message", "role": "assistant",
+                 "content": [{"type": "output_text", "text": "partial answer"}]},
+                {"type": "message", "role": "user", "content": "continue"}
+            ]
+        }"#;
+        let req: ResponsesRequest = serde_json::from_str(raw).expect("parse");
+        let chat = request_to_chat(req).expect("translate");
+        assert_eq!(chat.messages.len(), 3);
+        assert_eq!(chat.messages[1].role, "assistant");
+        assert_eq!(
+            chat.messages[1].extra.get("reasoning_content"),
+            Some(&Value::String("the plan so far".into())),
+            "the assistant turn must carry the thinking that produced it"
+        );
+    }
+
+    /// OpenAI's o-series spelling: the text lives in `content` as
+    /// `reasoning_text` parts. Same item, different field.
+    #[test]
+    fn the_content_spelling_of_a_reasoning_item_is_read_too() {
+        let raw = r#"{
+            "model": "m",
+            "input": [
+                {"type": "reasoning", "id": "rs_1",
+                 "content": [{"type": "reasoning_text", "text": "step one"},
+                             {"type": "reasoning_text", "text": "step two"}]},
+                {"type": "message", "role": "assistant", "content": "done"}
+            ]
+        }"#;
+        let req: ResponsesRequest = serde_json::from_str(raw).expect("parse");
+        let chat = request_to_chat(req).expect("translate");
+        assert_eq!(
+            chat.messages[0].extra.get("reasoning_content"),
+            Some(&Value::String("step one\n\nstep two".into()))
+        );
+    }
+
+    /// The case that motivated #277: a turn truncated mid-think, then
+    /// `continue`. There is no assistant *message* to hang the
+    /// reasoning on — the reasoning is the entire turn — so it must
+    /// still reach the model, or the model restarts from nothing.
+    #[test]
+    fn a_truncated_turn_replayed_as_reasoning_alone_still_reaches_the_model() {
+        let raw = r#"{
+            "model": "Qwen/Qwen3.8-27B",
+            "input": [
+                {"type": "message", "role": "user", "content": "build a game"},
+                {"type": "reasoning", "id": "rs_1", "status": "incomplete",
+                 "summary": [{"type": "summary_text", "text": "24k tokens of design"}]},
+                {"type": "message", "role": "user", "content": "continue"}
+            ]
+        }"#;
+        let req: ResponsesRequest = serde_json::from_str(raw).expect("parse");
+        let chat = request_to_chat(req).expect("translate");
+        let assistant: Vec<_> = chat
+            .messages
+            .iter()
+            .filter(|m| m.role == "assistant")
+            .collect();
+        assert_eq!(
+            assistant.len(),
+            1,
+            "the truncated turn must survive as a turn"
+        );
+        assert_eq!(
+            assistant[0].extra.get("reasoning_content"),
+            Some(&Value::String("24k tokens of design".into()))
+        );
+    }
+
+    /// Consecutive reasoning items with no assistant turn between them
+    /// accumulate rather than the later one erasing the earlier.
+    #[test]
+    fn consecutive_reasoning_items_accumulate() {
+        let raw = r#"{
+            "model": "m",
+            "input": [
+                {"type": "reasoning", "summary": [{"type": "summary_text", "text": "first"}]},
+                {"type": "reasoning", "summary": [{"type": "summary_text", "text": "second"}]},
+                {"type": "message", "role": "assistant", "content": "ok"}
+            ]
+        }"#;
+        let req: ResponsesRequest = serde_json::from_str(raw).expect("parse");
+        let chat = request_to_chat(req).expect("translate");
+        assert_eq!(
+            chat.messages[0].extra.get("reasoning_content"),
+            Some(&Value::String("first\n\nsecond".into()))
+        );
+    }
+
+    /// The control a Responses client actually reaches for (#223): pi-ai
+    /// emits `reasoning: {"effort": "none"}` for thinking-level *off*.
+    /// Before this it went nowhere, and a harness that asked for no
+    /// thinking got 32,768 tokens of it and no answer.
+    #[test]
+    fn reasoning_effort_none_turns_thinking_off() {
+        for effort in ["none", "off", "NONE", " off "] {
+            let raw =
+                format!(r#"{{"model":"m","input":"hi","reasoning":{{"effort":"{effort}"}}}}"#);
+            let req: ResponsesRequest = serde_json::from_str(&raw).expect("parse");
+            let chat = request_to_chat(req).expect("translate");
+            assert_eq!(
+                chat.extra
+                    .get("chat_template_kwargs")
+                    .and_then(|k| k.get("enable_thinking")),
+                Some(&Value::Bool(false)),
+                "effort {effort:?} must reach the template as enable_thinking=false"
+            );
+        }
+    }
+
+    /// `minimal` and `low` ask for *less* thinking, not none. The
+    /// template switch is binary, so mapping them to off would be a
+    /// silent substitution — they pass through untouched instead.
+    #[test]
+    fn a_reduced_effort_is_not_silently_treated_as_none() {
+        for effort in ["minimal", "low", "medium", "high"] {
+            let raw =
+                format!(r#"{{"model":"m","input":"hi","reasoning":{{"effort":"{effort}"}}}}"#);
+            let req: ResponsesRequest = serde_json::from_str(&raw).expect("parse");
+            let chat = request_to_chat(req).expect("translate");
+            assert!(
+                chat.extra
+                    .get("chat_template_kwargs")
+                    .and_then(|k| k.get("enable_thinking"))
+                    .is_none(),
+                "effort {effort:?} must not be rewritten to off"
+            );
+        }
+    }
+
+    /// The more specific control wins, matching `default_enable_thinking`.
+    #[test]
+    fn an_explicit_template_kwarg_beats_the_effort_mapping() {
+        let raw = r#"{"model":"m","input":"hi",
+                      "reasoning":{"effort":"none"},
+                      "chat_template_kwargs":{"enable_thinking":true}}"#;
+        let req: ResponsesRequest = serde_json::from_str(raw).expect("parse");
+        let chat = request_to_chat(req).expect("translate");
+        assert_eq!(
+            chat.extra
+                .get("chat_template_kwargs")
+                .and_then(|k| k.get("enable_thinking")),
+            Some(&Value::Bool(true))
+        );
+    }
+
+    /// A request with no reasoning control is untouched — the model
+    /// thinks by default, which is the Responses-native expectation.
+    #[test]
+    fn no_reasoning_control_leaves_thinking_alone() {
+        let raw = r#"{"model":"m","input":"hi"}"#;
+        let req: ResponsesRequest = serde_json::from_str(raw).expect("parse");
+        let chat = request_to_chat(req).expect("translate");
+        assert!(chat.extra.get("chat_template_kwargs").is_none());
+    }
+
+    /// End to end, on the rendered prompt: Qwen3's template emits an
+    /// empty think block when `enable_thinking` is false, and opens one
+    /// otherwise. This asserts the caller's control reaches that branch.
+    #[test]
+    fn reasoning_effort_none_reaches_the_template_branch() {
+        const QWEN_THINK_SWITCH: &str = "{%- if enable_thinking is defined and enable_thinking is false -%}\
+<think>\n\n</think>\n\n\
+{%- else -%}\
+<think>\n\
+{%- endif -%}";
+        let raw = r#"{"model":"m","input":"hi","reasoning":{"effort":"none"}}"#;
+        let req: ResponsesRequest = serde_json::from_str(raw).expect("parse");
+        let chat = request_to_chat(req).expect("translate");
+        let kwargs = chat
+            .extra
+            .get("chat_template_kwargs")
+            .cloned()
+            .unwrap_or(Value::Null);
+        let out = crate::harness::chat_template::render_chat_template(
+            QWEN_THINK_SWITCH,
+            &chat.messages,
+            &Value::Null,
+            &kwargs,
+        )
+        .expect("render");
+        assert!(
+            out.contains("<think>\n\n</think>"),
+            "the closed think block is what tells the model not to reason; got {out:?}"
+        );
+    }
+
+    /// #223's root cause: `chat_template_kwargs` is how `enable_thinking`
+    /// reaches the template, and the translator used to rebuild `extra`
+    /// from an allowlist of one key, so it never arrived.
+    #[test]
+    fn extension_fields_survive_the_hop() {
+        let raw = r#"{
+            "model": "m",
+            "input": "hello",
+            "chat_template_kwargs": {"enable_thinking": false},
+            "some_future_control": 7
+        }"#;
+        let req: ResponsesRequest = serde_json::from_str(raw).expect("parse");
+        let chat = request_to_chat(req).expect("translate");
+        assert_eq!(
+            chat.extra
+                .get("chat_template_kwargs")
+                .and_then(|k| k.get("enable_thinking")),
+            Some(&Value::Bool(false)),
+            "the thinking switch must reach the chat path"
+        );
+        assert_eq!(chat.extra.get("some_future_control"), Some(&Value::from(7)));
+    }
+
+    /// The end-to-end claim, asserted where it actually matters: on the
+    /// rendered prompt. A translator test proves we set a field; this
+    /// proves the model sees the thinking, through the same
+    /// `reasoning_content` branch Qwen3.8's real template uses.
+    ///
+    /// The same shape as the #179 system-prompt tests, and for the same
+    /// reason — the contract is what reaches the model, not what the
+    /// intermediate struct holds.
+    #[test]
+    fn replayed_reasoning_reaches_the_rendered_prompt() {
+        // The assistant branch of Qwen3.8's chat_template, reduced to
+        // the part under test.
+        const QWEN_REASONING_LIKE: &str = "{%- for message in messages -%}\
+{%- if message.role == 'assistant' -%}\
+<|im_start|>assistant\n<think>\n{{ message.reasoning_content }}\n</think>\n\n{{ message.content }}<|im_end|>\n\
+{%- else -%}\
+<|im_start|>{{ message.role }}\n{{ message.content }}<|im_end|>\n\
+{%- endif -%}\
+{%- endfor -%}";
+
+        let raw = r#"{
+            "model": "Qwen/Qwen3.8-27B",
+            "input": [
+                {"type": "message", "role": "user", "content": "build a game"},
+                {"type": "reasoning", "id": "rs_1",
+                 "summary": [{"type": "summary_text", "text": "the design so far"}]},
+                {"type": "message", "role": "user", "content": "continue"}
+            ]
+        }"#;
+        let req: ResponsesRequest = serde_json::from_str(raw).expect("parse");
+        let chat = request_to_chat(req).expect("translate");
+        let prompt = crate::harness::chat_template::render_chat_template(
+            QWEN_REASONING_LIKE,
+            &chat.messages,
+            &Value::Null,
+            &Value::Null,
+        )
+        .expect("render");
+        assert!(
+            prompt.contains("<think>\nthe design so far\n</think>"),
+            "the replayed reasoning must reach the prompt; got:\n{prompt}"
+        );
+    }
+
+    /// Forwarding `extra` wholesale must not smuggle the Responses-shaped
+    /// tool array through — the chat path reads the nested spelling.
+    #[test]
+    fn tools_are_still_rewritten_not_forwarded_raw() {
+        let raw = r#"{
+            "model": "m",
+            "input": "hi",
+            "tools": [{"type": "function", "name": "run_code",
+                       "parameters": {"type": "object"}}]
+        }"#;
+        let req: ResponsesRequest = serde_json::from_str(raw).expect("parse");
+        let chat = request_to_chat(req).expect("translate");
+        let tools = chat
+            .extra
+            .get("tools")
+            .and_then(Value::as_array)
+            .expect("tools");
+        assert_eq!(
+            tools[0]["function"]["name"],
+            Value::String("run_code".into())
+        );
+        assert!(
+            tools[0].get("name").is_none(),
+            "the flat spelling must not survive"
+        );
+    }
+
     #[test]
     fn bare_easy_messages_translate_like_typed_messages() {
         // The agent-zero / litellm shape: bare `{role, content}` items

crates/neuron/tests/numerical_reference.rs

@@ -60,7 +60,9 @@ fn read_f32(path: &Path) -> Vec<f32> {
     let bytes = std::fs::read(path).unwrap_or_else(|e| panic!("read {path:?}: {e}"));
     assert!(bytes.len().is_multiple_of(4), "truncated f32 file {path:?}");
     bytes
-        .chunks_exact(4)
+        .as_chunks::<4>()
+        .0
+        .iter()
         .map(|b| f32::from_le_bytes([b[0], b[1], b[2], b[3]]))
         .collect()
 }

crates/neuron/tests/qwen3_next_parity.rs

@@ -37,7 +37,9 @@ fn fixture_dir() -> PathBuf {
 fn read_f32(path: &Path) -> Vec<f32> {
     let bytes = std::fs::read(path).unwrap_or_else(|e| panic!("read {path:?}: {e}"));
     bytes
-        .chunks_exact(4)
+        .as_chunks::<4>()
+        .0
+        .iter()
         .map(|c| f32::from_le_bytes([c[0], c[1], c[2], c[3]]))
         .collect()
 }