fix(core): LLM client resilience + tool-call extraction hardening

Audit wave 2026-07-11, findings 2/3/7/9/10/11/15:
- ParseResponse degrades only the malformed tool call, keeps text + other calls
- index-less streaming delta attributed to the sole open call; only open calls
  can be poisoned, completed ones never
- rate-limit classification requires explicit signals (no more 'generate' hits)
- circuit breaker: single half-open probe; abandoned/cancelled streams release
  the probe without counting as backend failure
- ToolExecutionPolicy: top-level isError:true counts as failure (MCP contract)
- text extractor: exact call shape required, cited/backticked/fenced examples
  skipped, balanced-paren scanning preserves parens inside arguments
- assistant history is stripped of think-blocks before persisting
- InGameLlmChatService serializes overlapping requests

Author: NeoXider

Assets/CoreAI/CHANGELOG.md

@@ -2,6 +2,41 @@
 
 ## [Unreleased]
 
+### Fixed (2026-07-11 audit wave)
+
+- **Lua sandbox: nested guarded calls can no longer disarm the outer guard.** `LuaCsExecutionGuard` keeps a
+  per-`LuaState` stack of installed hooks; leaving a nested `mods_call` restores the caller's hook instead of
+  removing it, so step/time/alloc budgets stay armed across direct and indirect (`A→B→A`) cross-mod calls.
+- **Lua mods: transaction scope is reset after every handler/timer/load.** `LuaCsModRuntime` now accepts the
+  shared `ILuaTransactionScope` and resets it in `finally`, so a handler dying between `coreai_world_begin`
+  and commit no longer leaks an open transaction that silently swallows later world commands.
+- **Mod headers: tolerant capability parsing.** Unknown capability tokens are skipped (`Enum.TryParse`,
+  fail-closed to `None` when nothing parses) and `ResourcesBundledModSource` isolates per-mod load failures,
+  so one bad header no longer breaks seeding of all bundled mods.
+- **Non-streaming responses survive one bad tool call.** `ParseResponse` degrades only the malformed call to
+  the parse-error marker contract; the text and remaining calls are preserved (previously the whole message
+  was silently replaced with an empty one).
+- **Streaming: an index-less tool-call delta no longer poisons every pending call.** The fragment is
+  attributed to the sole open call when unambiguous; only genuinely ambiguous open calls are failed, and
+  completed calls are never touched.
+- **Error classification: `rate` substring false positives removed.** Rate-limit detection now requires
+  explicit signals (`rate limit`, `429` status, `too many requests`, `quota`) instead of matching
+  "gene**rate**"/"mode**rate**".
+- **Circuit breaker: half-open admits exactly one probe** (concurrent calls short-circuit) and an abandoned
+  or cancelled stream releases the probe slot without being misclassified as a backend failure; a stream
+  abandoned after a terminal error chunk still counts as a failure.
+- **Tool result classification: top-level `isError: true` (MCP contract) counts as failure**; nested `error`
+  fields in legitimate tool payloads never did and still don't (regression-pinned by test).
+- **Text-extracted tool calls: quoted examples are no longer executed.** The extractor now requires exact
+  call shape (top-level `name` string + `arguments` object), skips backtick/quote-cited spans and fenced
+  code blocks, and preserves parentheses inside quoted arguments via balanced scanning (previously a lazy
+  regex truncated them and dropped the call).
+- **Reasoning no longer persists into conversation history.** Assistant messages are run through the
+  think-block filter before `AppendChatMessage`, so multi-kilobyte reasoning blobs stop inflating every
+  subsequent turn's context.
+- **`InGameLlmChatService`: overlapping requests are serialized** (snapshot → LLM → append under one gate),
+  so a second response always sees the first turn and history order cannot interleave.
+
 ## 5.6.1 - Build-time policy registration + code-style pass (2026-07-11)
 
 - **`AgentBuilder.Build()` auto-applies to the global policy.** When `CoreAIAgent.Policy` exists, `Build()`

Assets/CoreAI/Runtime/Core/Features/Llm/CircuitBreakerLlmClientDecorator.cs

@@ -44,6 +44,7 @@ private enum State
         private State _state = State.Closed;
         private int _consecutiveFailures;
         private long _openedAtMs;
+        private bool _halfOpenProbeInFlight;
 
         /// <param name="inner">The client to protect.</param>
         /// <param name="failureThreshold">Consecutive transient failures that trip the breaker (min 1).</param>
@@ -89,25 +90,40 @@ public async Task<LlmCompletionResult> CompleteAsync(
                 };
             }
 
-            LlmCompletionResult result;
+            bool classified = false;
             try
             {
-                result = await _inner.CompleteAsync(request, cancellationToken).ConfigureAwait(false);
-            }
-            catch (OperationCanceledException)
-            {
-                // WHY: Cancellation is caller intent, not a backend fault — do not count it, do not swallow it.
-                throw;
+                LlmCompletionResult result;
+                try
+                {
+                    result = await _inner.CompleteAsync(request, cancellationToken).ConfigureAwait(false);
+                }
+                catch (OperationCanceledException)
+                {
+                    // WHY: Cancellation is caller intent, not a backend fault — do not count it, do not swallow it.
+                    throw;
+                }
+                catch (Exception ex)
+                {
+                    // WHY: An unexpected throw from the inner client is treated as a transient backend fault.
+                    RecordFailure();
+                    classified = true;
+                    throw new LlmClientException(ex.Message, LlmErrorCode.ProviderError);
+                }
+
+                RecordResult(result?.Ok ?? false, result?.ErrorCode ?? LlmErrorCode.ProviderError);
+                classified = true;
+                return result;
             }
-            catch (Exception ex)
+            finally
             {
-                // WHY: An unexpected throw from the inner client is treated as a transient backend fault.
-                RecordFailure();
-                throw new LlmClientException(ex.Message, LlmErrorCode.ProviderError);
+                if (!classified)
+                {
+                    // WHY: The call ended without a health verdict (cancellation): release the half-open
+                    // probe slot so the breaker is not stuck waiting for a result that never comes.
+                    ReleaseHalfOpenProbe();
+                }
             }
-
-            RecordResult(result?.Ok ?? false, result?.ErrorCode ?? LlmErrorCode.ProviderError);
-            return result;
         }
 
         public async IAsyncEnumerable<LlmStreamChunk> CompleteStreamingAsync(
@@ -129,6 +145,8 @@ public async IAsyncEnumerable<LlmStreamChunk> CompleteStreamingAsync(
             bool sawTerminalFailure = false;
             LlmErrorCode terminalCode = LlmErrorCode.None;
             bool sawAnyChunk = false;
+            bool streamEnded = false;
+            bool classified = false;
 
             IAsyncEnumerator<LlmStreamChunk> e =
                 _inner.CompleteStreamingAsync(request, cancellationToken).GetAsyncEnumerator(cancellationToken);
@@ -156,6 +174,7 @@ public async IAsyncEnumerable<LlmStreamChunk> CompleteStreamingAsync(
                     catch (Exception ex)
                     {
                         RecordFailure();
+                        classified = true;
                         moveError = ex.Message;
                         chunk = default;
                     }
@@ -180,16 +199,32 @@ public async IAsyncEnumerable<LlmStreamChunk> CompleteStreamingAsync(
 
                     yield return chunk;
                 }
+
+                streamEnded = true;
             }
             finally
             {
                 await e.DisposeAsync().ConfigureAwait(false);
-            }
 
-            // WHY: Classify the whole stream: a stream that produced an error chunk (or nothing at all) is a
-            // failure; a stream that ended cleanly is a success that closes/keeps-closed the breaker.
-            bool ok = sawAnyChunk && !sawTerminalFailure;
-            RecordResult(ok, ok ? LlmErrorCode.None : terminalCode);
+                // WHY: Classify in the finally so the breaker state also updates when the consumer
+                // abandons the await-foreach early (user stop): a stream that already produced a
+                // terminal error chunk is a failure even then; a completed stream is classified as
+                // before (an error chunk or nothing at all = failure, a clean end = success); an
+                // abandoned/cancelled healthy stream carries no verdict at all — it only releases
+                // the half-open probe slot and is never misclassified as a backend failure.
+                if (!classified)
+                {
+                    if (streamEnded || sawTerminalFailure)
+                    {
+                        bool ok = streamEnded && sawAnyChunk && !sawTerminalFailure;
+                        RecordResult(ok, ok ? LlmErrorCode.None : terminalCode);
+                    }
+                    else
+                    {
+                        ReleaseHalfOpenProbe();
+                    }
+                }
+            }
         }
 
         /// <summary>Current state name for diagnostics/tests: "Closed", "Open", or "HalfOpen".</summary>
@@ -217,6 +252,7 @@ private bool TryEnter(out string rejectReason)
                     if (_nowMs() - _openedAtMs >= _openDurationMs)
                     {
                         _state = State.HalfOpen;
+                        _halfOpenProbeInFlight = true;
                         _log?.Invoke("[CircuitBreaker] half-open: admitting one probe request.");
                         rejectReason = null;
                         return true;
@@ -228,12 +264,42 @@ private bool TryEnter(out string rejectReason)
                     return false;
                 }
 
-                // WHY: Closed or HalfOpen: allow through (HalfOpen admits the single probe already in flight).
+                if (_state == State.HalfOpen)
+                {
+                    // WHY: Exactly ONE probe may be in flight while half-open. Admitting every concurrent
+                    // caller here used to burst the whole backlog onto a backend that is still likely down.
+                    if (_halfOpenProbeInFlight)
+                    {
+                        rejectReason =
+                            "Circuit breaker half-open: a single probe request is already in flight; " +
+                            "short-circuited until the probe result is known.";
+                        return false;
+                    }
+
+                    _halfOpenProbeInFlight = true;
+                    _log?.Invoke("[CircuitBreaker] half-open: admitting one probe request.");
+                    rejectReason = null;
+                    return true;
+                }
+
                 rejectReason = null;
                 return true;
             }
         }
 
+        /// <summary>
+        /// Releases the half-open probe slot when a call ends without any success/failure verdict
+        /// (consumer cancelled the call or abandoned the stream). The breaker stays half-open so the
+        /// next call becomes the new probe; abandonment is never counted as a backend failure.
+        /// </summary>
+        private void ReleaseHalfOpenProbe()
+        {
+            lock (_gate)
+            {
+                _halfOpenProbeInFlight = false;
+            }
+        }
+
         private void RecordResult(bool ok, LlmErrorCode code)
         {
             if (ok)
@@ -260,6 +326,7 @@ private void RecordSuccess()
             lock (_gate)
             {
                 _consecutiveFailures = 0;
+                _halfOpenProbeInFlight = false;
                 if (_state != State.Closed)
                 {
                     _state = State.Closed;
@@ -272,6 +339,7 @@ private void RecordFailure()
         {
             lock (_gate)
             {
+                _halfOpenProbeInFlight = false;
                 if (_state == State.HalfOpen)
                 {
                     // WHY: The probe failed — re-open for another cooldown.