feat(persona,model,loop): 人格 thinking 配置 + 5 个死字段接线 + 推理旋钮（按 provider 映射）

按 DevDocs/design/01 §2.1/§2.2 与 design/04 §3.2 实现（规格含联网核过的官方依据：思考内容刻意不角色化、不写分步思考指令、思考控制只走参数级）。
- 人格 schema 新增 thinking：budgetTokens / effort / showToUser(*bool，省略=nil=保持现行为，显式 false=只落库) / mode(default|on|off→Enable 三态)；非法 mode/负预算 → ErrInvalidThinking（不静默）
- 5 个死字段接上注入：personality→values→speechStyle→catchphrase→background 拼为独立段落（带【】小标题，空值不拼）；**全空时输出与旧实现逐字节一致**（有专门测试）
- model.Request 新增 Thinking{ BudgetTokens, Enable } 与 ReasoningEffort；新增 model/reasoning.go：厂商识别（模型名→baseURL 兜底）、取值白名单（OpenAI 系 none…max / DeepSeek low|high|max）、非法值降级+WARN、**不支持一律 WARN 而非静默**；Anthropic 映射 thinking{budget_tokens} 并**保证 budget<max_tokens**（不足时抬高 max_tokens+WARN，正是历史上思考吃光预算→空回复那个坑）
- loop：新增 Options.ThinkingShowToUser(*bool) 仅门控 thinking_* 帧（正文/工具帧不受影响）；场景级 mute 语义不变
- 补一处任务清单外但必需的接线：persona→model.Request 的 thinking 映射（否则 budget/effort/mode 会变成新的死字段）；showToUser 刻意不产生 Thinking（纯呈现开关）
- 管理端：personaUpsertRequest 补 thinking DTO + 校验（400）；PUT 省略时**保留已存块**（防旧客户端抹配置）；写侧 yaml round-trip 已验证
- Docs/api-client v0.40→v0.41（可选请求字段）
- 测试：26 个新用例（loader 解析/拼接逐字节/映射、anthropic 非流式+流式预算约束、openai 透传/降级/丢弃、Qwen 诚实 WARN、loop 门控、DTO round-trip）；3 次变异验证（省略与 false 混同 / 去掉预算约束 / 短路门控 各自 FAIL）
- 验收：go build/vet/test 全绿（含 57 包）+ linux/darwin 交叉编译 + 前端 build；唯一 FAIL 是既有 flake TestInterruptCancelsTurnAndClearsPending（3/20 新代码 vs 3/20 纯 HEAD，已归因非本次引入）

internal/runtime/model/anthropic.go

@@ -6,6 +6,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"log/slog"
 	"net/http"
 	"strings"
 	"time"
@@ -24,8 +25,19 @@ const (
 	anthropicDefaultMaxTokens = 8192
 	// anthropicDataPrefix marks a payload embedded as a data: URI.
 	anthropicDataPrefix = "data:"
+	// anthropicThinkingTypeEnabled is the wire value of an enabled extended-
+	// thinking directive.
+	anthropicThinkingTypeEnabled = "enabled"
 )
 
+// anthropicThinking is the wire form of the extended-thinking directive. It is
+// omitted entirely when the caller did not ask for thinking (or asked for it to
+// be off), because Anthropic treats a missing field as "no thinking".
+type anthropicThinking struct {
+	Type         string `json:"type"`
+	BudgetTokens int    `json:"budget_tokens"`
+}
+
 // anthropicRequest is the body sent to /v1/messages. Messages carry Anthropic's
 // content-block model and the system prompt lives at the request root.
 type anthropicRequest struct {
@@ -36,6 +48,7 @@ type anthropicRequest struct {
 	ToolChoice  any                `json:"tool_choice,omitempty"`
 	Temperature *float64           `json:"temperature,omitempty"`
 	MaxTokens   int                `json:"max_tokens"`
+	Thinking    *anthropicThinking `json:"thinking,omitempty"`
 	Stream      bool               `json:"stream,omitempty"`
 }
 
@@ -90,6 +103,10 @@ type AnthropicChatAdapter struct {
 	model    string
 	client   *http.Client
 	recorder Recorder
+	// log reports reasoning adjustments and ignored directives. It is never nil:
+	// a discard logger tagged with this adapter's source is installed when the
+	// caller supplies none, so a provider decision is always traceable.
+	log *slog.Logger
 }
 
 // AnthropicOption configures an AnthropicChatAdapter.
@@ -111,6 +128,17 @@ func WithAnthropicModel(m string) AnthropicOption {
 	return func(a *AnthropicChatAdapter) { a.model = m }
 }
 
+// WithAnthropicLogger attaches the logger used to report reasoning adjustments
+// (budget raised to fit max_tokens, ignored directives). A nil logger is ignored
+// so the discard default stays in place.
+func WithAnthropicLogger(l *slog.Logger) AnthropicOption {
+	return func(a *AnthropicChatAdapter) {
+		if l != nil {
+			a.log = l
+		}
+	}
+}
+
 // NewAnthropicChat builds an Anthropic adapter from a supplier config. baseURL is
 // trimmed of any trailing slash before the /v1/messages path is appended.
 func NewAnthropicChat(cfg config.LLMConfig, opts ...AnthropicOption) *AnthropicChatAdapter {
@@ -123,6 +151,7 @@ func NewAnthropicChat(cfg config.LLMConfig, opts ...AnthropicOption) *AnthropicC
 			Transport: http.DefaultTransport,
 			Timeout:   defaultHTTPTimeout,
 		},
+		log: discardLogger("runtime/model/anthropic"),
 	}
 	for _, o := range opts {
 		o(a)
@@ -264,6 +293,9 @@ func (a *AnthropicChatAdapter) buildRequest(req Request, stream bool) ([]byte, e
 		return nil, err
 	}
 	tokenLimit := effectiveMaxTokens(req.MaxTokens, anthropicDefaultMaxTokens)
+	// Extended thinking shares max_tokens with the visible answer, so the budget
+	// is resolved together with the limit it requires (design/04 §3.2 red line).
+	tokenLimit, thinking := anthropicThinkingFor(req.Thinking, tokenLimit, a.log)
 	wire := anthropicRequest{
 		Model:       req.Model,
 		System:      system,
@@ -272,6 +304,7 @@ func (a *AnthropicChatAdapter) buildRequest(req Request, stream bool) ([]byte, e
 		ToolChoice:  req.ToolChoice,
 		Temperature: req.Temperature,
 		MaxTokens:   tokenLimit,
+		Thinking:    thinking,
 		Stream:      stream,
 	}
 	buf, err := json.Marshal(wire)

internal/runtime/model/factory.go

@@ -3,6 +3,7 @@ package model
 import (
 	"errors"
 	"fmt"
+	"log/slog"
 
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/config"
 )
@@ -40,11 +41,19 @@ func NewChatAdapter(cfg config.LLMConfig) (Adapter, error) {
 // step is served by an adapter of the selected protocol. The empty provider
 // defaults to openai. An unrecognized provider returns ErrUnknownProvider.
 func NewChatChain(cfg config.LLMConfig) (*Chain, error) {
+	return NewChatChainWithLog(cfg, nil)
+}
+
+// NewChatChainWithLog is NewChatChain with a logger attached to every adapter it
+// builds, so a provider-level reasoning decision (a thinking budget raised to fit
+// max_tokens, a reasoning_effort value downgraded or ignored) is reported with
+// its module source. A nil logger leaves the adapters' discard default in place.
+func NewChatChainWithLog(cfg config.LLMConfig, log *slog.Logger) (*Chain, error) {
 	switch cfg.Provider {
 	case ProviderOpenAI, "":
-		return newOpenAIChain(cfg)
+		return newOpenAIChain(cfg, WithOpenAILogger(log))
 	case ProviderAnthropic:
-		return newAnthropicChain(cfg)
+		return newAnthropicChain(cfg, WithAnthropicLogger(log))
 	default:
 		return nil, fmt.Errorf("model: %w: provider %q", ErrUnknownProvider, cfg.Provider)
 	}
@@ -65,13 +74,13 @@ func newOpenAIChain(cfg config.LLMConfig, opts ...OpenAIOption) (*Chain, error)
 
 // newAnthropicChain builds a fallback chain from the Anthropic config block. Each
 // step is an AnthropicChatAdapter against the configured /v1/messages endpoint.
-func newAnthropicChain(cfg config.LLMConfig) (*Chain, error) {
+func newAnthropicChain(cfg config.LLMConfig, opts ...AnthropicOption) (*Chain, error) {
 	if cfg.AnthropicBaseURL == "" || cfg.AnthropicModel == "" {
 		return nil, ErrNoModel
 	}
-	steps := []Step{{Model: cfg.AnthropicModel, Adapter: NewAnthropicChat(cfg)}}
+	steps := []Step{{Model: cfg.AnthropicModel, Adapter: NewAnthropicChat(cfg, opts...)}}
 	if cfg.AnthropicFallback != "" && cfg.AnthropicFallback != cfg.AnthropicModel {
-		steps = append(steps, Step{Model: cfg.AnthropicFallback, Adapter: NewAnthropicChat(cfg)})
+		steps = append(steps, Step{Model: cfg.AnthropicFallback, Adapter: NewAnthropicChat(cfg, opts...)})
 	}
 	return NewChain(steps...), nil
 }

internal/runtime/model/model.go

@@ -170,6 +170,28 @@ type Request struct {
 	// "name":"x"}); empty means the provider default. Passed through verbatim to
 	// protocols that support it (Anthropic's tool_choice).
 	ToolChoice any
+	// Thinking controls the provider's reasoning budget/switch (design/04 §3.2).
+	// nil means "do not intervene" and uses the provider default. A provider
+	// whose protocol has no mapping for it logs a WARN rather than silently
+	// ignoring it.
+	Thinking *Thinking
+	// ReasoningEffort is the OpenAI-compatible reasoning strength knob
+	// (reasoning_effort). Empty means "do not intervene". The value is validated
+	// against the detected provider's whitelist; an unsupported value is
+	// downgraded to the nearest allowed tier (or dropped) with a WARN.
+	ReasoningEffort string
+}
+
+// Thinking carries the reasoning knobs a caller wants applied (design/04 §3.2).
+// Providers map the fields they actually support and report the rest; it only
+// controls budget/switch, never the thought content (design/01 §2.1 red line).
+type Thinking struct {
+	// BudgetTokens is the Anthropic thinking.budget_tokens target (the official
+	// semantic is a target, not a hard cap). Zero selects the adapter default.
+	BudgetTokens int
+	// Enable is an explicit on/off switch for providers that expose a boolean
+	// thinking flag. nil = no explicit switch.
+	Enable *bool
 }
 
 // Response is a normalized completion result.

internal/runtime/model/openai.go

@@ -6,6 +6,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"log/slog"
 	"net/http"
 	"strings"
 	"time"
@@ -39,6 +40,10 @@ type OpenAIChatAdapter struct {
 	model    string
 	client   *http.Client
 	recorder Recorder
+	// log reports reasoning_effort validation and ignored thinking directives. It
+	// is never nil: a discard logger tagged with this adapter's source is
+	// installed when the caller supplies none, so a decision is always traceable.
+	log *slog.Logger
 }
 
 // OpenAIOption configures an OpenAIChatAdapter.
@@ -60,6 +65,17 @@ func WithModel(m string) OpenAIOption {
 	return func(a *OpenAIChatAdapter) { a.model = m }
 }
 
+// WithOpenAILogger attaches the logger used to report reasoning_effort
+// validation and ignored thinking directives. A nil logger is ignored so the
+// discard default stays in place.
+func WithOpenAILogger(l *slog.Logger) OpenAIOption {
+	return func(a *OpenAIChatAdapter) {
+		if l != nil {
+			a.log = l
+		}
+	}
+}
+
 // NewOpenAIChat builds an adapter from a supplier config. baseURL is trimmed of
 // any trailing slash before the /chat/completions path is appended.
 func NewOpenAIChat(cfg config.LLMConfig, opts ...OpenAIOption) *OpenAIChatAdapter {
@@ -72,6 +88,7 @@ func NewOpenAIChat(cfg config.LLMConfig, opts ...OpenAIOption) *OpenAIChatAdapte
 			Transport: http.DefaultTransport,
 			Timeout:   defaultHTTPTimeout,
 		},
+		log: discardLogger("runtime/model/openai"),
 	}
 	for _, o := range opts {
 		o(a)

internal/runtime/model/openai_encode.go

@@ -15,6 +15,10 @@ type openAIChatRequest struct {
 	Stream        bool              `json:"stream,omitempty"`
 	StreamOptions *openAIStreamOpts `json:"stream_options,omitempty"`
 	Tools         []openAITool      `json:"tools,omitempty"`
+	// ReasoningEffort is the OpenAI-compatible reasoning strength knob. It is set
+	// only after validation against the detected vendor's whitelist (design/04
+	// §3.2); an unsupported value is downgraded or dropped, never forwarded as-is.
+	ReasoningEffort string `json:"reasoning_effort,omitempty"`
 }
 
 // openAIStreamOpts asks the provider to include usage in the final stream chunk.
@@ -66,13 +70,19 @@ func (a *OpenAIChatAdapter) buildRequest(req Request, stream bool) ([]byte, erro
 	if err != nil {
 		return nil, err
 	}
+	// The vendor behind an OpenAI-compatible endpoint decides which
+	// reasoning_effort tiers are legal; classify it from the resolved model (and
+	// the base URL as a fallback) before touching the request (design/04 §3.2).
+	vendor := reasoningVendorFor(req.Model, a.baseURL)
+	reportUnmappedThinking(a.log, vendor, req.Model, req.Thinking)
 	wire := openAIChatRequest{
-		Model:       req.Model,
-		Messages:    msgs,
-		Temperature: req.Temperature,
-		MaxTokens:   req.MaxTokens,
-		Stream:      stream,
-		Tools:       buildTools(req.Tools),
+		Model:           req.Model,
+		Messages:        msgs,
+		Temperature:     req.Temperature,
+		MaxTokens:       req.MaxTokens,
+		Stream:          stream,
+		Tools:           buildTools(req.Tools),
+		ReasoningEffort: resolveReasoningEffort(a.log, vendor, req.ReasoningEffort, req.Model),
 	}
 	if stream {
 		wire.StreamOptions = &openAIStreamOpts{IncludeUsage: true}

internal/runtime/model/reasoning.go

@@ -0,0 +1,216 @@
+package model
+
+import (
+	"io"
+	"log/slog"
+	"strings"
+
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/logger"
+)
+
+// discardLogger returns a logger that drops every record but still carries the
+// adapter's module source, so an adapter built without an injected logger can
+// never emit an unsourced record.
+func discardLogger(source string) *slog.Logger {
+	return logger.WithSource(slog.New(slog.NewTextHandler(io.Discard, nil)), source)
+}
+
+// Anthropic extended-thinking protocol bounds (design/04 §3.2).
+const (
+	// anthropicMinThinkingBudget is the smallest budget_tokens the Messages API
+	// accepts for thinking.type=enabled; anything below it is rejected with a
+	// 400, so a lower non-zero budget is raised and reported rather than sent.
+	anthropicMinThinkingBudget = 1024
+	// anthropicDefaultThinkingBudget is used when thinking is switched on without
+	// an explicit budget.
+	anthropicDefaultThinkingBudget = 4096
+	// anthropicThinkingBodyReserve is the body room kept on top of the thinking
+	// budget: max_tokens is shared by thinking and the visible answer, so the
+	// budget must never be allowed to consume it all (design/04 §3.2 red line:
+	// "预算与正文不得互相吃光").
+	anthropicThinkingBodyReserve = 2048
+)
+
+// reasoningVendor identifies the vendor behind an OpenAI-compatible endpoint.
+// The wire protocol is the same for all of them, but the accepted
+// reasoning_effort values are not, so a value must be checked against the right
+// whitelist instead of being forwarded blindly.
+type reasoningVendor string
+
+const (
+	vendorOpenAI   reasoningVendor = "openai"
+	vendorDeepSeek reasoningVendor = "deepseek"
+	vendorQwen     reasoningVendor = "qwen"
+	vendorUnknown  reasoningVendor = "unknown"
+)
+
+// reasoningEffortLadder is the canonical ascending order of reasoning_effort
+// tiers. It is used to round an unsupported value down to the nearest tier a
+// vendor accepts.
+var reasoningEffortLadder = []string{"none", "minimal", "low", "medium", "high", "xhigh", "max"}
+
+// reasoningEffortAllowed is the per-vendor whitelist. A vendor absent from this
+// table has no reasoning_effort support at all, which is reported rather than
+// guessed.
+var reasoningEffortAllowed = map[reasoningVendor]map[string]bool{
+	vendorOpenAI:   tierSet("none", "minimal", "low", "medium", "high", "xhigh", "max"),
+	vendorDeepSeek: tierSet("low", "high", "max"),
+}
+
+// tierSet builds a membership set from the given tiers.
+func tierSet(tiers ...string) map[string]bool {
+	set := make(map[string]bool, len(tiers))
+	for _, t := range tiers {
+		set[t] = true
+	}
+	return set
+}
+
+// reasoningVendorFor classifies the vendor of an OpenAI-compatible request from
+// its model name, falling back to the base URL when the name does not identify
+// one. An unrecognized pair yields vendorUnknown so the caller reports "not
+// supported" instead of assuming OpenAI semantics.
+func reasoningVendorFor(model, baseURL string) reasoningVendor {
+	m := strings.ToLower(strings.TrimSpace(model))
+	switch {
+	case strings.Contains(m, "deepseek"):
+		return vendorDeepSeek
+	case strings.Contains(m, "qwen"):
+		return vendorQwen
+	case strings.Contains(m, "gpt-"), strings.Contains(m, "chatgpt"),
+		strings.HasPrefix(m, "o1"), strings.HasPrefix(m, "o3"), strings.HasPrefix(m, "o4"):
+		return vendorOpenAI
+	}
+	u := strings.ToLower(strings.TrimSpace(baseURL))
+	switch {
+	case strings.Contains(u, "deepseek"):
+		return vendorDeepSeek
+	case strings.Contains(u, "dashscope"), strings.Contains(u, "aliyuncs"):
+		return vendorQwen
+	case strings.Contains(u, "openai"):
+		return vendorOpenAI
+	}
+	return vendorUnknown
+}
+
+// resolveReasoningEffort validates effort against the vendor's whitelist and
+// returns the value to send. An unsupported tier is rounded down to the nearest
+// tier the vendor accepts; a value the vendor does not accept at all — or a
+// vendor with no whitelist — yields "", meaning the field is dropped. Every
+// decision is logged (provider, field, value), never silently applied.
+func resolveReasoningEffort(log *slog.Logger, vendor reasoningVendor, effort, model string) string {
+	effort = strings.TrimSpace(effort)
+	if effort == "" {
+		return ""
+	}
+	allowed, ok := reasoningEffortAllowed[vendor]
+	if !ok {
+		log.Warn("reasoning_effort ignored: provider does not support it",
+			"provider", string(vendor), "field", "reasoning_effort", "value", effort, "model", model)
+		return ""
+	}
+	if allowed[effort] {
+		return effort
+	}
+	downgraded, ok := downgradeReasoningEffort(allowed, effort)
+	if !ok {
+		log.Warn("reasoning_effort dropped: unrecognized value",
+			"provider", string(vendor), "field", "reasoning_effort", "value", effort, "model", model)
+		return ""
+	}
+	log.Warn("reasoning_effort downgraded: value not accepted by provider",
+		"provider", string(vendor), "field", "reasoning_effort",
+		"value", effort, "sent", downgraded, "model", model)
+	return downgraded
+}
+
+// downgradeReasoningEffort rounds an unsupported tier down to the nearest tier
+// the vendor accepts using the canonical ladder order; a tier below the vendor's
+// minimum maps to that minimum. It reports false when effort is not on the
+// ladder at all, so the caller drops the field instead of inventing a value.
+func downgradeReasoningEffort(allowed map[string]bool, effort string) (string, bool) {
+	start := -1
+	for i, tier := range reasoningEffortLadder {
+		if tier == effort {
+			start = i
+			break
+		}
+	}
+	if start < 0 {
+		return "", false
+	}
+	for i := start; i >= 0; i-- {
+		if allowed[reasoningEffortLadder[i]] {
+			return reasoningEffortLadder[i], true
+		}
+	}
+	for _, tier := range reasoningEffortLadder {
+		if allowed[tier] {
+			return tier, true
+		}
+	}
+	return "", false
+}
+
+// anthropicThinkingFor resolves the extended-thinking directive together with the
+// max_tokens it requires. It returns the (possibly raised) max_tokens and the
+// wire block; a nil block means "do not send thinking" (no directive, or an
+// explicit off). Because max_tokens is shared by thinking and the visible answer,
+// the returned budget always leaves anthropicThinkingBodyReserve for the body,
+// and a request whose budget would eat the answer raises max_tokens instead — the
+// adjustment is logged so it is never a silent rewrite.
+func anthropicThinkingFor(th *Thinking, maxTokens int, log *slog.Logger) (int, *anthropicThinking) {
+	if th == nil || (th.Enable != nil && !*th.Enable) {
+		return maxTokens, nil
+	}
+	budget := th.BudgetTokens
+	if budget == 0 {
+		budget = anthropicDefaultThinkingBudget
+	}
+	if budget < anthropicMinThinkingBudget {
+		log.Warn("thinking budget raised to the protocol minimum",
+			"provider", "anthropic", "field", "thinking.budget_tokens",
+			"budget_tokens", th.BudgetTokens, "sent", anthropicMinThinkingBudget)
+		budget = anthropicMinThinkingBudget
+	}
+	if need := budget + anthropicThinkingBodyReserve; maxTokens < need {
+		log.Warn("max_tokens raised to leave room for thinking plus the answer",
+			"provider", "anthropic", "budget_tokens", budget,
+			"max_tokens_requested", maxTokens, "max_tokens_sent", need,
+			"body_reserve", anthropicThinkingBodyReserve)
+		maxTokens = need
+	}
+	return maxTokens, &anthropicThinking{Type: anthropicThinkingTypeEnabled, BudgetTokens: budget}
+}
+
+// reportUnmappedThinking logs why a Thinking directive cannot be carried by an
+// OpenAI-compatible request, naming the provider and the field that was ignored.
+// Qwen3 does have enable_thinking, but the protocol has no portable field for
+// it (vLLM wants chat_template_kwargs.enable_thinking, DashScope's compatible
+// mode wants a top-level enable_thinking), and sending the wrong shape can 400
+// the request — so this version reports it instead of guessing.
+func reportUnmappedThinking(log *slog.Logger, vendor reasoningVendor, model string, th *Thinking) {
+	if th == nil {
+		return
+	}
+	if th.Enable != nil {
+		switch vendor {
+		case vendorQwen:
+			log.Warn("enable_thinking not forwarded: the OpenAI-compatible protocol has no portable field for it",
+				"provider", "qwen", "field", "extra_body.chat_template_kwargs.enable_thinking",
+				"enable", *th.Enable, "model", model)
+		case vendorDeepSeek:
+			log.Warn("deepseek thinking switch not mapped in this version; only reasoning_effort is forwarded",
+				"provider", "deepseek", "field", "thinking.type", "enable", *th.Enable, "model", model)
+		default:
+			log.Warn("thinking switch ignored: provider has no boolean thinking switch",
+				"provider", string(vendor), "field", "thinking.enable", "enable", *th.Enable, "model", model)
+		}
+		return
+	}
+	if th.BudgetTokens > 0 {
+		log.Warn("thinking budget ignored: OpenAI-compatible providers take reasoning_effort, not a token budget",
+			"provider", string(vendor), "field", "thinking.budget_tokens",
+			"budget_tokens", th.BudgetTokens, "model", model)
+	}
+}

internal/runtime/model/reasoning_test.go

@@ -0,0 +1,364 @@
+package model
+
+import (
+	"bytes"
+	"context"
+	"log/slog"
+	"net/http"
+	"strings"
+	"testing"
+
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/config"
+)
+
+// captureLog returns a logger writing text records into a buffer, plus the
+// buffer, so a test can assert the WARN an adapter emits.
+func captureLog() (*slog.Logger, *bytes.Buffer) {
+	buf := &bytes.Buffer{}
+	return slog.New(slog.NewTextHandler(buf, &slog.HandlerOptions{Level: slog.LevelDebug})), buf
+}
+
+// boolPtr is a convenience for the tri-state Thinking.Enable.
+func boolPtr(v bool) *bool { return &v }
+
+// TestAnthropicChat_ThinkingBudgetLeavesRoomForTheAnswer is the design/04 §3.2
+// red line: a budget large enough to eat max_tokens must not be sent as-is —
+// the adapter raises max_tokens so thinking and the visible answer both fit, and
+// it logs the adjustment (never a silent rewrite).
+func TestAnthropicChat_ThinkingBudgetLeavesRoomForTheAnswer(t *testing.T) {
+	t.Parallel()
+	ch := make(chan anthropicCaptured, 1)
+	srv := newAnthropicServer(t, http.StatusOK, "application/json", anthropicTextResponse, ch)
+	log, buf := captureLog()
+	ad := NewAnthropicChat(
+		config.LLMConfig{AnthropicBaseURL: srv.URL, AnthropicModel: "claude-test"},
+		WithAnthropicLogger(log))
+
+	const budget = 4096
+	// max_tokens equals the budget: without the guard the whole budget would be
+	// consumed by thinking and the answer would come back empty.
+	if _, err := ad.Chat(context.Background(), Request{
+		Model:     "claude-test",
+		Messages:  []Message{TextMessage(RoleUser, "hi")},
+		MaxTokens: budget,
+		Thinking:  &Thinking{BudgetTokens: budget},
+	}, Options{}); err != nil {
+		t.Fatalf("Chat error: %v", err)
+	}
+	body := (<-ch).body
+	think, ok := body["thinking"].(map[string]any)
+	if !ok {
+		t.Fatalf("body.thinking = %v, want an enabled directive", body["thinking"])
+	}
+	if think["type"] != anthropicThinkingTypeEnabled {
+		t.Errorf("thinking.type = %v, want %q", think["type"], anthropicThinkingTypeEnabled)
+	}
+	gotBudget, _ := think["budget_tokens"].(float64)
+	maxTokens, _ := body["max_tokens"].(float64)
+	if int(gotBudget) != budget {
+		t.Errorf("thinking.budget_tokens = %v, want %d", gotBudget, budget)
+	}
+	if maxTokens <= gotBudget {
+		t.Fatalf("max_tokens = %v, want > budget_tokens %v (thinking would eat the answer)", maxTokens, gotBudget)
+	}
+	if maxTokens < gotBudget+anthropicThinkingBodyReserve {
+		t.Errorf("max_tokens = %v, want >= budget %v + body reserve %d", maxTokens, gotBudget, anthropicThinkingBodyReserve)
+	}
+	if !strings.Contains(buf.String(), "max_tokens raised") {
+		t.Errorf("log = %q, want a WARN explaining the max_tokens raise", buf.String())
+	}
+}
+
+// TestAnthropicChat_ThinkingBudgetBelowMaxTokensUnchanged pins the non-saturated
+// case: when the caller's max_tokens already leaves room, it is sent untouched
+// and the budget stays strictly below it.
+func TestAnthropicChat_ThinkingBudgetBelowMaxTokensUnchanged(t *testing.T) {
+	t.Parallel()
+	ch := make(chan anthropicCaptured, 1)
+	srv := newAnthropicServer(t, http.StatusOK, "application/json", anthropicTextResponse, ch)
+	log, buf := captureLog()
+	ad := NewAnthropicChat(
+		config.LLMConfig{AnthropicBaseURL: srv.URL, AnthropicModel: "claude-test"},
+		WithAnthropicLogger(log))
+
+	if _, err := ad.Chat(context.Background(), Request{
+		Model:     "claude-test",
+		Messages:  []Message{TextMessage(RoleUser, "hi")},
+		MaxTokens: anthropicDefaultMaxTokens,
+		Thinking:  &Thinking{BudgetTokens: 4096},
+	}, Options{}); err != nil {
+		t.Fatalf("Chat error: %v", err)
+	}
+	body := (<-ch).body
+	think := body["thinking"].(map[string]any)
+	gotBudget, _ := think["budget_tokens"].(float64)
+	maxTokens, _ := body["max_tokens"].(float64)
+	if maxTokens != float64(anthropicDefaultMaxTokens) {
+		t.Errorf("max_tokens = %v, want the requested %d (unchanged)", maxTokens, anthropicDefaultMaxTokens)
+	}
+	if gotBudget >= maxTokens {
+		t.Errorf("budget_tokens %v >= max_tokens %v", gotBudget, maxTokens)
+	}
+	if strings.Contains(buf.String(), "max_tokens raised") {
+		t.Errorf("unexpected adjustment log: %q", buf.String())
+	}
+}
+
+// TestAnthropicChat_ThinkingDisabledOmitsField asserts the explicit off switch
+// sends no thinking directive at all (Anthropic treats a missing field as off).
+func TestAnthropicChat_ThinkingDisabledOmitsField(t *testing.T) {
+	t.Parallel()
+	ch := make(chan anthropicCaptured, 1)
+	srv := newAnthropicServer(t, http.StatusOK, "application/json", anthropicTextResponse, ch)
+	ad := NewAnthropicChat(config.LLMConfig{AnthropicBaseURL: srv.URL, AnthropicModel: "claude-test"})
+
+	if _, err := ad.Chat(context.Background(), Request{
+		Model:    "claude-test",
+		Messages: []Message{TextMessage(RoleUser, "hi")},
+		Thinking: &Thinking{BudgetTokens: 4096, Enable: boolPtr(false)},
+	}, Options{}); err != nil {
+		t.Fatalf("Chat error: %v", err)
+	}
+	if body := (<-ch).body; body["thinking"] != nil {
+		t.Fatalf("body.thinking = %v, want the field omitted", body["thinking"])
+	}
+}
+
+// TestAnthropicChat_ThinkingBudgetRaisedToProtocolMinimum asserts a budget below
+// the API minimum is raised (sending it as-is would 400) and reported.
+func TestAnthropicChat_ThinkingBudgetRaisedToProtocolMinimum(t *testing.T) {
+	t.Parallel()
+	ch := make(chan anthropicCaptured, 1)
+	srv := newAnthropicServer(t, http.StatusOK, "application/json", anthropicTextResponse, ch)
+	log, buf := captureLog()
+	ad := NewAnthropicChat(
+		config.LLMConfig{AnthropicBaseURL: srv.URL, AnthropicModel: "claude-test"},
+		WithAnthropicLogger(log))
+
+	if _, err := ad.Chat(context.Background(), Request{
+		Model:    "claude-test",
+		Messages: []Message{TextMessage(RoleUser, "hi")},
+		Thinking: &Thinking{BudgetTokens: 512},
+	}, Options{}); err != nil {
+		t.Fatalf("Chat error: %v", err)
+	}
+	think := (<-ch).body["thinking"].(map[string]any)
+	if got, _ := think["budget_tokens"].(float64); int(got) != anthropicMinThinkingBudget {
+		t.Errorf("thinking.budget_tokens = %v, want the minimum %d", got, anthropicMinThinkingBudget)
+	}
+	if !strings.Contains(buf.String(), "protocol minimum") {
+		t.Errorf("log = %q, want a WARN about the minimum budget", buf.String())
+	}
+}
+
+// TestOpenAIChat_ReasoningEffortPassthrough asserts a supported tier on a known
+// provider is forwarded verbatim, with no warning.
+func TestOpenAIChat_ReasoningEffortPassthrough(t *testing.T) {
+	t.Parallel()
+	ch := make(chan capturedRequest, 1)
+	srv := newCompletionServer(t, http.StatusOK, "application/json", okCompletion, ch)
+	log, buf := captureLog()
+	ad := NewOpenAIChat(config.LLMConfig{BaseURL: srv.URL, Model: "gpt-test"}, WithOpenAILogger(log))
+
+	if _, err := ad.Chat(context.Background(), Request{
+		Model:           "gpt-4o",
+		Messages:        []Message{TextMessage(RoleUser, "hi")},
+		ReasoningEffort: "high",
+	}, Options{}); err != nil {
+		t.Fatalf("Chat error: %v", err)
+	}
+	if got := (<-ch).body["reasoning_effort"]; got != "high" {
+		t.Fatalf("body.reasoning_effort = %v, want high", got)
+	}
+	if buf.Len() != 0 {
+		t.Errorf("unexpected log for a supported value: %q", buf.String())
+	}
+}
+
+// TestOpenAIChat_ReasoningEffortDowngradedForDeepSeek asserts a tier the vendor
+// does not accept (DeepSeek allows only low/high/max) is rounded down to the
+// nearest allowed tier and reported, never forwarded as-is.
+func TestOpenAIChat_ReasoningEffortDowngradedForDeepSeek(t *testing.T) {
+	t.Parallel()
+	ch := make(chan capturedRequest, 1)
+	srv := newCompletionServer(t, http.StatusOK, "application/json", okCompletion, ch)
+	log, buf := captureLog()
+	ad := NewOpenAIChat(config.LLMConfig{BaseURL: srv.URL, Model: "deepseek-chat"}, WithOpenAILogger(log))
+
+	if _, err := ad.Chat(context.Background(), Request{
+		Model:           "deepseek-chat",
+		Messages:        []Message{TextMessage(RoleUser, "hi")},
+		ReasoningEffort: "medium",
+	}, Options{}); err != nil {
+		t.Fatalf("Chat error: %v", err)
+	}
+	if got := (<-ch).body["reasoning_effort"]; got != "low" {
+		t.Fatalf("body.reasoning_effort = %v, want the downgraded low", got)
+	}
+	rec := buf.String()
+	for _, want := range []string{"level=WARN", "reasoning_effort", "deepseek", "medium", "low"} {
+		if !strings.Contains(rec, want) {
+			t.Errorf("log %q missing %q", rec, want)
+		}
+	}
+}
+
+// TestOpenAIChat_ReasoningEffortDroppedForUnknownProvider asserts an
+// unrecognized provider/model leaves the request untouched and reports the
+// ignored field (design/04 §3.2: never silently ineffective).
+func TestOpenAIChat_ReasoningEffortDroppedForUnknownProvider(t *testing.T) {
+	t.Parallel()
+	ch := make(chan capturedRequest, 1)
+	srv := newCompletionServer(t, http.StatusOK, "application/json", okCompletion, ch)
+	log, buf := captureLog()
+	ad := NewOpenAIChat(config.LLMConfig{BaseURL: srv.URL, Model: "mystery-1"}, WithOpenAILogger(log))
+
+	if _, err := ad.Chat(context.Background(), Request{
+		Model:           "mystery-1",
+		Messages:        []Message{TextMessage(RoleUser, "hi")},
+		ReasoningEffort: "high",
+	}, Options{}); err != nil {
+		t.Fatalf("Chat error: %v", err)
+	}
+	body := (<-ch).body
+	if _, present := body["reasoning_effort"]; present {
+		t.Fatalf("body.reasoning_effort = %v, want the field dropped", body["reasoning_effort"])
+	}
+	rec := buf.String()
+	for _, want := range []string{"level=WARN", "reasoning_effort", "unknown", "high"} {
+		if !strings.Contains(rec, want) {
+			t.Errorf("log %q missing %q", rec, want)
+		}
+	}
+}
+
+// TestOpenAIChat_QwenEnableThinkingReportedNotForwarded documents the deliberate
+// choice for the Qwen3 hard switch: the OpenAI-compatible protocol has no
+// portable wire shape for enable_thinking, so this version reports it and leaves
+// the request byte-identical instead of guessing a shape that could 400.
+func TestOpenAIChat_QwenEnableThinkingReportedNotForwarded(t *testing.T) {
+	t.Parallel()
+	ch := make(chan capturedRequest, 1)
+	srv := newCompletionServer(t, http.StatusOK, "application/json", okCompletion, ch)
+	log, buf := captureLog()
+	ad := NewOpenAIChat(config.LLMConfig{BaseURL: srv.URL, Model: "qwen3-max"}, WithOpenAILogger(log))
+
+	plain := make(chan capturedRequest, 1)
+	plainSrv := newCompletionServer(t, http.StatusOK, "application/json", okCompletion, plain)
+	plainAd := NewOpenAIChat(config.LLMConfig{BaseURL: plainSrv.URL, Model: "qwen3-max"})
+	if _, err := plainAd.Chat(context.Background(), Request{
+		Model:    "qwen3-max",
+		Messages: []Message{TextMessage(RoleUser, "hi")},
+	}, Options{}); err != nil {
+		t.Fatalf("Chat error: %v", err)
+	}
+	if _, err := ad.Chat(context.Background(), Request{
+		Model:    "qwen3-max",
+		Messages: []Message{TextMessage(RoleUser, "hi")},
+		Thinking: &Thinking{Enable: boolPtr(false)},
+	}, Options{}); err != nil {
+		t.Fatalf("Chat error: %v", err)
+	}
+	body := (<-ch).body
+	for _, key := range []string{"enable_thinking", "chat_template_kwargs", "extra_body", "thinking"} {
+		if _, present := body[key]; present {
+			t.Errorf("body.%s = %v, want the request unchanged", key, body[key])
+		}
+	}
+	if len(body) != len((<-plain).body) {
+		t.Errorf("request shape changed with a thinking directive: %v", body)
+	}
+	rec := buf.String()
+	for _, want := range []string{"level=WARN", "enable_thinking", "qwen"} {
+		if !strings.Contains(rec, want) {
+			t.Errorf("log %q missing %q", rec, want)
+		}
+	}
+}
+
+// TestOpenAIChat_ThinkingBudgetReportedIgnored asserts a token budget (an
+// Anthropic-style directive) is reported as unmappable on an OpenAI-compatible
+// endpoint rather than silently dropped.
+func TestOpenAIChat_ThinkingBudgetReportedIgnored(t *testing.T) {
+	t.Parallel()
+	ch := make(chan capturedRequest, 1)
+	srv := newCompletionServer(t, http.StatusOK, "application/json", okCompletion, ch)
+	log, buf := captureLog()
+	ad := NewOpenAIChat(config.LLMConfig{BaseURL: srv.URL, Model: "gpt-4o"}, WithOpenAILogger(log))
+
+	if _, err := ad.Chat(context.Background(), Request{
+		Model:    "gpt-4o",
+		Messages: []Message{TextMessage(RoleUser, "hi")},
+		Thinking: &Thinking{BudgetTokens: 8192},
+	}, Options{}); err != nil {
+		t.Fatalf("Chat error: %v", err)
+	}
+	if _, present := (<-ch).body["thinking"]; present {
+		t.Fatal("body.thinking was sent to an OpenAI-compatible endpoint")
+	}
+	rec := buf.String()
+	for _, want := range []string{"level=WARN", "thinking.budget_tokens", "gpt"} {
+		if !strings.Contains(rec, want) {
+			t.Errorf("log %q missing %q", rec, want)
+		}
+	}
+}
+
+// TestAnthropicChatStream_ThinkingBudgetLeavesRoomForTheAnswer runs the same
+// red-line check on the streaming path, which builds its own request body.
+func TestAnthropicChatStream_ThinkingBudgetLeavesRoomForTheAnswer(t *testing.T) {
+	t.Parallel()
+	ch := make(chan anthropicCaptured, 1)
+	const sse = "event: message_start\ndata: {\"type\":\"message_start\"}\n\n" +
+		"event: content_block_start\ndata: {\"type\":\"content_block_start\",\"index\":0,\"content_block\":{\"type\":\"text\",\"text\":\"\"}}\n\n" +
+		"event: content_block_delta\ndata: {\"type\":\"content_block_delta\",\"index\":0,\"delta\":{\"type\":\"text_delta\",\"text\":\"hi\"}}\n\n" +
+		"event: message_stop\ndata: {\"type\":\"message_stop\"}\n\n"
+	srv := newAnthropicServer(t, http.StatusOK, "text/event-stream", sse, ch)
+	ad := NewAnthropicChat(config.LLMConfig{AnthropicBaseURL: srv.URL, AnthropicModel: "claude-test"})
+
+	if _, err := ad.ChatStream(context.Background(), Request{
+		Model:     "claude-test",
+		Messages:  []Message{TextMessage(RoleUser, "hi")},
+		MaxTokens: 2048,
+		Thinking:  &Thinking{BudgetTokens: 2048},
+	}, func(StreamEvent) {}); err != nil {
+		t.Fatalf("ChatStream error: %v", err)
+	}
+	body := (<-ch).body
+	think, ok := body["thinking"].(map[string]any)
+	if !ok {
+		t.Fatalf("stream body.thinking = %v, want an enabled directive", body["thinking"])
+	}
+	gotBudget, _ := think["budget_tokens"].(float64)
+	maxTokens, _ := body["max_tokens"].(float64)
+	if gotBudget >= maxTokens {
+		t.Fatalf("stream max_tokens = %v, want > budget_tokens %v", maxTokens, gotBudget)
+	}
+}
+
+// TestReasoningVendorFor_Classification locks the vendor detection the whitelist
+// depends on, including the fallback to the base URL.
+func TestReasoningVendorFor_Classification(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		model   string
+		baseURL string
+		want    reasoningVendor
+	}{
+		{model: "deepseek-reasoner", want: vendorDeepSeek},
+		{model: "Qwen3-Max", want: vendorQwen},
+		{model: "gpt-4o", want: vendorOpenAI},
+		{model: "o3-mini", want: vendorOpenAI},
+		{model: "chatgpt-4o-latest", want: vendorOpenAI},
+		{model: "claude-sonnet-4", baseURL: "https://api.openai.com/v1", want: vendorOpenAI},
+		{model: "qwen-plus", baseURL: "https://dashscope.aliyuncs.com/compatible-mode/v1", want: vendorQwen},
+		{model: "some-model", baseURL: "https://api.deepseek.com/v1", want: vendorDeepSeek},
+		{model: "some-model", baseURL: "http://localhost:8000/v1", want: vendorUnknown},
+	}
+	for _, tt := range cases {
+		if got := reasoningVendorFor(tt.model, tt.baseURL); got != tt.want {
+			t.Errorf("reasoningVendorFor(%q, %q) = %q, want %q", tt.model, tt.baseURL, got, tt.want)
+		}
+	}
+}

internal/runtime/model/runtime.go

@@ -141,7 +141,7 @@ func (m *RuntimeLLM) swap(groups []runtimeconfig.Group) error {
 	if len(groups) == 0 {
 		groups = runtimeconfig.GroupFromEnv(m.env)
 	}
-	snap, err := buildSnapshot(groups, m.env)
+	snap, err := buildSnapshot(groups, m.env, m.log)
 	if err != nil {
 		return err
 	}
@@ -162,10 +162,10 @@ func (m *RuntimeLLM) load() *runtimeChainSnapshot {
 // without a base URL/model yields a nil chain (no model configured), surfaced as
 // ErrNoModel by the adapter methods. The Router keeps the env vision model so a
 // dedicated vision model survives a reload that only changes the vendor group.
-func buildSnapshot(groups []runtimeconfig.Group, env config.LLMConfig) (*runtimeChainSnapshot, error) {
+func buildSnapshot(groups []runtimeconfig.Group, env config.LLMConfig, log *slog.Logger) (*runtimeChainSnapshot, error) {
 	active := groups[0]
 	cfg := active.ToLLMConfig()
-	chain, err := NewChatChain(cfg)
+	chain, err := NewChatChainWithLog(cfg, log)
 	if err != nil && !errors.Is(err, ErrNoModel) {
 		return nil, err
 	}