• OLMo3 tool calls that completed in the final streaming chunk were silently dropped.
• The parser now inspects the terminal chunk, so a call at end-of-stream is parsed and returned.

• A streaming split inside DeepSeek3's multi-character opening tag left a partial delimiter, silently discarding the tool call.
• Partial delimiters are now buffered across chunk boundaries until they can be resolved and the call recognised.

• Bounded catastrophic regex backtracking by running searches in an isolated worker thread.
• Adds a 2-second budget and 1,000-character pattern limit, with timeout, cancellation, and worker cleanup.

Validation: Typecheck, build, Markdown lint, and 10 targeted tests passed; full-suite environment failures remain.

• Restricted dynamic tool-handler imports to an approved set of namespaces.
• Blocked callers from claiming the reserved `DataPoint` schema title, closing a collision that could shadow an internal schema.
• Both restrictions carry regression tests.

• `UnpicklableArtifactException` was receiving pre-formatted prose instead of the artifact name.
• Passing the name restores the intended error text; the underlying serialization error stays chained and visible instead of being swallowed.