diff --git a/.env.example b/.env.example
index 8840748..bdacdfb 100644
--- a/.env.example
+++ b/.env.example
@@ -17,6 +17,13 @@ CASE_MAX_RAM_MB=
 # Drive talks to cased on loopback / the compose network. No SSH.
 CASE_LOCAL=1
 
+# Drive home: threads.json, drive/shots (and later drive/inbox). Compose sets
+# CASE_HOME=/data so they share the ui-data volume. Unset = ~/.case.
+# CASE_HOME=
+
+# Per-turn input-token ceiling for Drive chat. Default 2000000.
+# CASE_TURN_TOKENS=2000000
+
 # Desktop resolution for new/woken computers (WxH or WxHxDEPTH).
 # DESK_RESOLUTION=1280x800x24
 
diff --git a/README.md b/README.md
index ea4a215..4f6f5c6 100644
--- a/README.md
+++ b/README.md
@@ -96,6 +96,10 @@ bin/case up
 CASE_LOCAL=1 CASE_URL=http://127.0.0.1:8787 node web/web-ui/serve.mjs
 ```
 
+Drive stores thread screenshots under `~/.case/drive/shots` (Compose: the
+`ui-data` volume via `CASE_HOME=/data`). `CASE_TURN_TOKENS` (default 2M) caps
+one turn's cumulative input tokens. Mid-turn messages go to `/api/chat/steer`.
+
 ### More knobs
 
 Phone notifications for 2FA/approvals (ntfy), CAPTCHA auto-solve, scheduled
diff --git a/SECURITY.md b/SECURITY.md
index fc1f634..fd8c911 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -17,6 +17,9 @@ Case holds logins. These are promises, with code you can read.
   `127.0.0.1:4174`. Set `CASE_TOKEN` before exposing those ports.
 - **Audit log** (`~/.case/audit/<date>.jsonl`): one line per API call; request
   bodies that can carry secrets are redacted; response bodies are never logged.
+- **Drive screenshots persist on disk** under `~/.case/drive/shots` (Compose:
+  `ui-data` via `CASE_HOME=/data`). They are content-addressed and kept until
+  you delete the files or the volume. Deleting a thread does not erase them.
 
 ## Self-host trust model
 
diff --git a/compose.yaml b/compose.yaml
index d3a06ed..16046d4 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -107,6 +107,7 @@ services:
       CASE_BIND: "0.0.0.0"
       CASE_TOKEN: ${CASE_TOKEN:-}
       CASE_THREADS: /data/threads.json
+      CASE_HOME: /data
       CASE_LOCAL: "1"
       PORT: "4174"
     volumes:
diff --git a/web/web-ui/case-tools.mjs b/web/web-ui/case-tools.mjs
index 9802ea4..03684d9 100644
--- a/web/web-ui/case-tools.mjs
+++ b/web/web-ui/case-tools.mjs
@@ -47,7 +47,17 @@ export function caseToolPlan(name, args, cid) {
   }
   if (name === 'computer_exec') {
     const t = Math.min(Math.max(Number(a.timeout_s) || 30, 1), 600);
-    return { method: 'POST', path: `/computers/${id}/exec?wake=true`, json: { command: a.command, timeout_s: t }, timeoutMs: (t + 30) * 1000, act: 'exec' };
+    // Spool the full output to a file inside the computer and show the model only the
+    // head of it. A noisy command otherwise lands whole in history and is re-sent on
+    // every later round of the turn; the file keeps the rest reachable with cat/grep/tail.
+    // The exit code has to be echoed explicitly — the redirect swallows it otherwise.
+    const log = `/tmp/case-out-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 6)}.log`;
+    // Subshell, not a brace group: `exit 1` in the agent's command would otherwise
+    // kill this shell before the exit line is echoed, and `{ cmd\n; }` is a syntax error.
+    const command = `( ${a.command}\n) > ${log} 2>&1; __rc=$?; echo "exit=$__rc";`
+      + ` wc -l < ${log} | tr -d ' ' | sed 's/^/lines=/'; head -c 1500 ${log};`
+      + ` find /tmp -name 'case-out-*.log' -mmin +120 -delete 2>/dev/null || true`;
+    return { method: 'POST', path: `/computers/${id}/exec?wake=true`, json: { command, timeout_s: t }, timeoutMs: (t + 30) * 1000, act: 'exec', logPath: log };
   }
   return { error: `unknown tool ${name}` };
 }
@@ -99,7 +109,11 @@ export async function runCaseTool(name, args, cid) {
     if (r.status >= 400) {
       return { ok: false, status: r.status, error: r.json || r.raw, act: plan.act };
     }
-    return { ok: true, act: plan.act, result: r.json ?? { ok: true } };
+    const result = r.json ?? { ok: true };
+    if (plan.logPath && result && typeof result === 'object') {
+      result.full_output = `${plan.logPath} — only the first 1500 bytes are above; cat/grep/tail this file for the rest`;
+    }
+    return { ok: true, act: plan.act, result };
   } catch (err) {
     return { ok: false, error: err.message || 'cased unreachable', act: plan.act };
   }
@@ -253,7 +267,28 @@ export function tracesFromAnthropicMessage(message) {
   return { thinks, calls, texts };
 }
 
-export function histToAnthropicMessages(items) {
+export function userContentText(content) {
+  if (typeof content === 'string') return content;
+  if (!Array.isArray(content)) return content == null ? '' : String(content);
+  return content.map((c) => {
+    if (typeof c === 'string') return c;
+    if (c?.type === 'input_text' || c?.type === 'text') return c.text || '';
+    return '';
+  }).filter(Boolean).join('\n');
+}
+
+function openaiPartToAnthropic(c) {
+  if (typeof c === 'string') return c ? { type: 'text', text: c } : null;
+  if (c?.type === 'input_text' || c?.type === 'text') return c.text ? { type: 'text', text: c.text } : null;
+  if (c?.type === 'input_image') {
+    const m = /^data:(image\/[a-z0-9.+-]+);base64,(.+)$/i.exec(c.image_url || '');
+    if (!m) return null;
+    return { type: 'image', source: { type: 'base64', media_type: m[1], data: m[2] } };
+  }
+  return null;
+}
+
+export function histToAnthropicMessages(items, { media = false } = {}) {
   const messages = [];
   let pendingAssistant = [];
   let pendingResults = [];
@@ -268,10 +303,22 @@ export function histToAnthropicMessages(items) {
     pendingResults = [];
   };
   for (const it of items || []) {
-    if (it.role === 'user' && typeof it.content === 'string' && !it.type) {
+    if (it.shot) continue;
+    if (it.role === 'user' && it.content != null && !it.type) {
       flushAssistant();
       flushResults();
-      messages.push({ role: 'user', content: String(it.content) });
+      if (media && Array.isArray(it.content)) {
+        const parts = it.content.map(openaiPartToAnthropic).filter(Boolean);
+        if (parts.length) {
+          messages.push({
+            role: 'user',
+            content: parts.length === 1 && parts[0].type === 'text' ? parts[0].text : parts,
+          });
+          continue;
+        }
+      }
+      const text = userContentText(it.content);
+      if (text) messages.push({ role: 'user', content: text });
     } else if (it.type === 'function_call') {
       flushResults();
       let input = {};
@@ -313,8 +360,59 @@ function clipJson(v, n = 8000) {
   return s.length > n ? s.slice(0, n) + '…' : s;
 }
 
+/** Retry a provider round on rate limits (429/529), honoring the server's
+ * suggested wait ("try again in Xs" / retry-after), capped at 60s. History is
+ * only mutated after a round completes, so replaying a failed round is safe. */
+function abortError(signal) {
+  if (signal?.reason instanceof Error) return signal.reason;
+  const err = new Error(signal?.reason ? String(signal.reason) : 'stopped by user');
+  err.name = 'AbortError';
+  return err;
+}
+
+function abortableDelay(ms, signal) {
+  if (!signal) return new Promise((resolve) => setTimeout(resolve, ms));
+  if (signal.aborted) return Promise.reject(abortError(signal));
+  return new Promise((resolve, reject) => {
+    const done = () => {
+      signal.removeEventListener('abort', stop);
+      resolve();
+    };
+    const stop = () => {
+      clearTimeout(timer);
+      signal.removeEventListener('abort', stop);
+      reject(abortError(signal));
+    };
+    const timer = setTimeout(done, ms);
+    signal.addEventListener('abort', stop, { once: true });
+    if (signal.aborted) stop();
+  });
+}
+
+export async function withRateRetry(fn, emit, tries = 5, signal) {
+  for (let a = 0; ; a++) {
+    if (signal?.aborted) throw abortError(signal);
+    try { return await fn(); }
+    catch (err) {
+      if (signal?.aborted) throw err;
+      const status = err?.status ?? err?.response?.status;
+      const limited = status === 429 || status === 529
+        || /rate limit|overloaded/i.test(err?.message || '');
+      if (!limited || a >= tries - 1) throw err;
+      const m = /try again in ([\d.]+)s/i.exec(err?.message || '');
+      const hdr = Number(err?.headers?.['retry-after']
+        ?? err?.response?.headers?.get?.('retry-after'));
+      let wait = m ? Number(m[1]) : Number.isFinite(hdr) && hdr > 0 ? hdr : 2 ** a;
+      wait = Math.min(Math.max(wait + 0.5, 1), 60);
+      emit?.({ type: 'think', text: `rate limited — retrying in ${Math.ceil(wait)}s` });
+      await abortableDelay(wait * 1000, signal);
+    }
+  }
+}
+
 export async function anthropicToolLoop({
   key, model, effort, system, messages, tools, emit, rounds, runTool, actFor, stopped,
+  beforeRound, tokenBudget, signal,
 }) {
   const client = new Anthropic({ apiKey: key });
   const antTools = openaiToolsToAnthropic(tools);
@@ -330,39 +428,55 @@ export async function anthropicToolLoop({
   };
   let text = '';
   let finished = false;
+  const spend = { in: 0, cached: 0, out: 0 };
+  const overBudget = () => Number(tokenBudget) > 0 && spend.in > tokenBudget;
   const round = async (p) => {
     const ctx = newAnthropicStreamCtx();
     let thinkDelta = false;
     let textDelta = false;
     const stream = client.messages.stream(p);
-    for await (const ev of stream) {
-      const nd = anthropicEventToNdjson(ev, ctx);
-      if (!nd) continue;
-      if (nd.type === 'think_delta') thinkDelta = true;
-      if (nd.type === 'text_delta') textDelta = true;
-      if (nd.type === 'tool') nd.act = actFor(nd.name, {}) || nd.name;
-      if (nd.type === 'tool_args') nd.act = actFor(nd.name || 'tool', nd.args || {}) || nd.name;
-      emit(nd);
-    }
-    const message = await stream.finalMessage();
-    const traces = tracesFromAnthropicMessage(message);
-    if (!thinkDelta) {
-      for (const t of traces.thinks) emit({ type: 'think', text: t });
+    const abort = () => stream.abort();
+    signal?.addEventListener('abort', abort, { once: true });
+    if (signal?.aborted) abort();
+    try {
+      for await (const ev of stream) {
+        const nd = anthropicEventToNdjson(ev, ctx);
+        if (!nd) continue;
+        if (nd.type === 'think_delta') thinkDelta = true;
+        if (nd.type === 'text_delta') textDelta = true;
+        if (nd.type === 'tool') nd.act = actFor(nd.name, {}) || nd.name;
+        if (nd.type === 'tool_args') nd.act = actFor(nd.name || 'tool', nd.args || {}) || nd.name;
+        emit(nd);
+      }
+      const message = await stream.finalMessage();
+      const traces = tracesFromAnthropicMessage(message);
+      if (!thinkDelta) {
+        for (const t of traces.thinks) emit({ type: 'think', text: t });
+      }
+      return { message, traces, textDelta };
+    } finally {
+      signal?.removeEventListener('abort', abort);
     }
-    return { message, traces, textDelta };
   };
-  for (let i = 0; i < rounds && !finished; i++) {
+  for (let i = 0; i < rounds && !finished && !overBudget(); i++) {
     if (stopped?.()) break;
+    beforeRound?.(messages);
     let result;
     try {
-      result = await round(params);
+      result = await withRateRetry(() => round(params), emit, 5, signal);
     } catch (err) {
+      if (signal?.aborted) throw err;
       if (!params.output_config) throw err;
       const rest = { ...params };
       delete rest.output_config;
-      result = await round(rest);
+      result = await withRateRetry(() => round(rest), emit, 5, signal);
     }
     const { message, traces, textDelta } = result;
+    const u = message.usage || {};
+    spend.in += (u.input_tokens || 0) + (u.cache_read_input_tokens || 0)
+      + (u.cache_creation_input_tokens || 0);
+    spend.cached += u.cache_read_input_tokens || 0;
+    spend.out += u.output_tokens || 0;
     text = traces.texts.join('\n').trim();
     if (!traces.calls.length) {
       finished = true;
@@ -393,5 +507,5 @@ export async function anthropicToolLoop({
     }
     messages.push({ role: 'user', content: results });
   }
-  return { text, finished };
+  return { text, finished, spend, overBudget: overBudget() };
 }
diff --git a/web/web-ui/index.html b/web/web-ui/index.html
index b771ad6..ceaee89 100644
--- a/web/web-ui/index.html
+++ b/web/web-ui/index.html
@@ -300,6 +300,14 @@
 }
 .ask textarea::placeholder{color:var(--faint)}
 /* narrow panel: squeeze the textarea, never the SEND button */
+.qline{display:flex;flex-wrap:wrap;gap:6px;margin:0 0 8px}
+.qline[hidden]{display:none}
+.qchip{display:inline-flex;align-items:center;gap:6px;max-width:100%;
+  font-family:var(--mono);font-size:10.5px;letter-spacing:.05em;color:var(--faint);
+  border:1px dashed var(--ink);padding:4px 6px 4px 8px}
+.qchip .qtxt{overflow:hidden;text-overflow:ellipsis;white-space:nowrap;max-width:38ch}
+.qchip .qx{border:0;background:transparent;cursor:pointer;color:var(--faint);font-size:12px;padding:0 2px}
+.qchip .qx:hover{color:var(--ink)}
 .ask{min-width:0}
 .ask textarea{min-width:0}
 .ask .btn{flex-shrink:0}
@@ -537,6 +545,7 @@
               </button>
               <div class="cfg-pop" id="cfgPop" hidden></div>
             </div>
+            <div class="qline" id="qline" hidden></div>
             <div class="ask">
               <button type="button" class="plus" id="plusBtn" aria-haspopup="menu" aria-expanded="false" aria-label="More actions">+</button>
               <div class="plus-pop" id="plusPop" hidden>
@@ -1204,11 +1213,49 @@ <h3 id="keyTitle" hidden>OPENAI KEY</h3>
 let chatCtl=null;
 $('stopBtn').addEventListener('click',()=>{if(chatCtl)chatCtl.abort();});
 
-$('go').addEventListener('submit',async e=>{
+/* Prompts typed mid-turn queue up; the next fires when the turn ends. Without
+   this a second submit 409s server-side and its cleanup hides the STOP button
+   for the turn still running. */
+const promptQ=[];
+const paintQ=()=>{
+  const ql=$('qline');
+  ql.hidden=!promptQ.length;
+  ql.innerHTML='';
+  promptQ.forEach((p,i)=>{
+    const chip=document.createElement('span');
+    chip.className='qchip';
+    chip.innerHTML='<span class="qtxt"></span><button type="button" class="qx" aria-label="Remove queued prompt">×</button>';
+    chip.querySelector('.qtxt').textContent=p;
+    chip.querySelector('.qx').addEventListener('click',()=>{promptQ.splice(i,1);paintQ();});
+    ql.appendChild(chip);
+  });
+};
+$('go').addEventListener('submit',e=>{
   e.preventDefault();
   const t=q.value.trim();
   if(!t)return;
   if(!currentKey()){openKey();return;}
+  q.value='';q.style.height='auto';
+  if(chatCtl){steerPrompt(t);return;}
+  sendPrompt(t);
+});
+/* Mid-turn message: try to inject into the running turn; fall back to the
+   local queue if the turn just ended (409) or the server is unreachable. */
+async function steerPrompt(t){
+  const tid=activeTid&&activeTid!=='__pending'?activeTid:'';
+  if(!tid){promptQ.push(t);paintQ();return;}
+  try{
+    const r=await fetch('/api/chat/steer',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({thread_id:tid,input:t})});
+    if(!r.ok){promptQ.push(t);paintQ();return;}
+    const art=document.createElement('article');
+    art.className='turn you';
+    art.innerHTML='<div class="k">YOU</div><p></p>';
+    art.querySelector('p').textContent=t;
+    inner.appendChild(art);
+    stick(true);
+  }catch{promptQ.push(t);paintQ();}
+}
+async function sendPrompt(t){
   const es=$('emptyState');if(es)es.remove();
   /* the task exists the moment you hit enter, born on the computer you are sat at */
   if(!activeTid){
@@ -1228,7 +1275,6 @@ <h3 id="keyTitle" hidden>OPENAI KEY</h3>
   art.innerHTML='<div class="k">YOU</div><p></p>';
   art.querySelector('p').textContent=t;
   inner.appendChild(art);
-  q.value='';q.style.height='auto';
   const reply=document.createElement('article');
   reply.className='turn';
   reply.innerHTML='<div class="k sys">'+esc(String(comp&&comp.name||'BOX').toUpperCase())+'</div>'
@@ -1324,6 +1370,7 @@ <h3 id="keyTitle" hidden>OPENAI KEY</h3>
           glow(false);
           if(ev.ok&&(row.dataset.name==='computer_exec'||ev.name==='computer_exec'))pulseFiles();
         }
+        else if(ev.type==='steer'){/* injected mid-turn; bubble already rendered locally */}
         else if(ev.type==='text_delta'&&ev.text){thinkBlock.open=false;addText(ev.text);}
         else if(ev.type==='text'||(ev.type==='done'&&ev.text)){thinkBlock.open=false;setText(ev.text);if(ev.type==='done')glowOff();}
         else if(ev.type==='done'){glowOff();}
@@ -1343,8 +1390,9 @@ <h3 id="keyTitle" hidden>OPENAI KEY</h3>
     caret.remove();
     if(activeTid==='__pending')activeTid=''; // stream died before the thread was born
     refresh(); // state may have changed (wake on first tool); threads re-sync too
+    if(promptQ.length){const n=promptQ.shift();paintQ();sendPrompt(n);}
   }
-});
+}
 
 /* ---------- teach a task ---------- */
 const teach={on:false,goal:'',events:[],lastHref:'',suppress:false,timer:null,gapNoted:false};
diff --git a/web/web-ui/serve.mjs b/web/web-ui/serve.mjs
index 1649284..3fe0913 100644
--- a/web/web-ui/serve.mjs
+++ b/web/web-ui/serve.mjs
@@ -20,7 +20,7 @@ import path from 'node:path';
 import crypto from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 import OpenAI from 'openai';
-import { CASE_TOOLS, caseCall, caseToolPlan, runCaseTool, streamEventToNdjson, tracesFromOutput, chatAuth, resolveChatModel, histToAnthropicMessages, anthropicToolLoop } from './case-tools.mjs';
+import { CASE_TOOLS, caseCall, caseToolPlan, runCaseTool, streamEventToNdjson, tracesFromOutput, chatAuth, resolveChatModel, histToAnthropicMessages, anthropicToolLoop, withRateRetry } from './case-tools.mjs';
 
 const DIR = path.dirname(fileURLToPath(import.meta.url));
 const PORT = Number(process.env.PORT || 4174);
@@ -42,6 +42,7 @@ export function isLocalMode(env = process.env, host = CASE.hostname) {
   return host === '127.0.0.1' || host === 'localhost' || host === 'cased';
 }
 const LOCAL = isLocalMode();
+const HOME = process.env.CASE_HOME || path.join(process.env.HOME || '/tmp', '.case');
 
 export function liveCid(pathname) {
   const m = String(pathname || '').match(/^\/live\/(c_[A-Za-z0-9]+)(?=\/|$)/);
@@ -532,7 +533,10 @@ function actFor(name, args, id) {
   return caseToolPlan(name, args || {}, id).act || name;
 }
 
-const ROUNDS = 24;
+const ROUNDS = 200;
+// ROUNDS bounds steps, not spend: history is re-sent every round, so cost is quadratic
+// in rounds. This bounds the money — cumulative input tokens for one turn.
+const TURN_TOKEN_BUDGET = Number(process.env.CASE_TURN_TOKENS || 2_000_000);
 // Threads: the sidebar's unit of navigation, each with its own conversation memory.
 // The Responses API runs stateless here (store:false), so the item list IS the
 // memory. agent stays '' until the run first needs hands (a tool call executes) —
@@ -542,11 +546,32 @@ const THREADS_FILE = process.env.CASE_THREADS || path.join(DIR, 'threads.json');
 const THREADS = new Map();
 try {
   for (const t of JSON.parse(fs.readFileSync(THREADS_FILE, 'utf8'))) {
-    t.items = histCloseOpenCalls(t.items);
+    t.items = histCloseOpenCalls(migrateShots(t.items));
     THREADS.set(t.id, t);
   }
 } catch { /* fresh */ }
 const CHAT_BUSY = new Set();
+const STEER = new Map(); // thread id -> user texts typed while the turn runs
+function takeSteers(tid) {
+  const q = STEER.get(tid) || [];
+  if (q.length) STEER.delete(tid);
+  return q;
+}
+function pushSteerItems(items, texts) {
+  for (const n of texts) {
+    items.push({ role: 'user', content: [{ type: 'input_text', text: n }] });
+  }
+}
+function appendSteerToAnthropic(messages, text) {
+  const last = messages[messages.length - 1];
+  if (last?.role === 'user') {
+    if (typeof last.content === 'string') last.content = last.content + '\n\n' + text;
+    else if (Array.isArray(last.content)) last.content.push({ type: 'text', text });
+    else messages.push({ role: 'user', content: text });
+  } else {
+    messages.push({ role: 'user', content: text });
+  }
+}
 let saveTimer = null;
 function saveThreads() {
   clearTimeout(saveTimer);
@@ -576,6 +601,7 @@ const threadSummary = (t) => ({ id: t.id, title: t.title, agent: t.agent, update
 export function threadTurns(items) {
   const turns = [];
   for (const it of items || []) {
+    if (it.shot) continue; // screenshot attachments are model-only
     if (it.role === 'user') {
       if (Array.isArray(it.content)) {
         const text = it.content.map((c) => (typeof c === 'string' ? c : c.text || c.input_text || '')).filter(Boolean).join('\n');
@@ -625,9 +651,102 @@ export function histCloseOpenCalls(items, { keepReasoning = false } = {}) {
   }
   return out;
 }
-function clip(v, n = 8000) {
+export function shotsDir(home = HOME) {
+  return path.join(home, 'drive', 'shots');
+}
+
+/** Persist a screenshot to disk and return a tiny history item. The model still
+ *  sees the image: hydrateShots re-reads the file when building the request. */
+export function stashShot(b64, dir = shotsDir()) {
+  const h = crypto.createHash('sha1').update(String(b64 || '')).digest('hex');
+  const file = path.join(dir, h + '.png');
+  try { fs.mkdirSync(dir, { recursive: true }); } catch { /* exists */ }
+  try {
+    if (!fs.existsSync(file)) fs.writeFileSync(file, Buffer.from(String(b64 || ''), 'base64'));
+  } catch { /* best-effort; hydrateShots falls back to a text note */ }
+  return { role: 'user', shot: file, content: [{ type: 'input_text', text: '[screenshot]' }] };
+}
+
+export function hydrateShots(items, dir = shotsDir()) {
+  const root = path.resolve(dir) + path.sep;
+  return (items || []).map((it) => {
+    if (!it?.shot) return it;
+    const abs = path.resolve(it.shot);
+    if (!abs.startsWith(root) || path.extname(abs) !== '.png') {
+      return { role: 'user', content: [{ type: 'input_text', text: '[screenshot]' }] };
+    }
+    try {
+      const buf = fs.readFileSync(abs);
+      return {
+        role: 'user',
+        content: [{
+          type: 'input_image', detail: 'high',
+          image_url: 'data:image/png;base64,' + buf.toString('base64'),
+        }],
+      };
+    } catch {
+      return { role: 'user', content: [{ type: 'input_text', text: '[screenshot]' }] };
+    }
+  });
+}
+
+export function migrateShots(items, dir = shotsDir()) {
+  let changed = false;
+  const next = (items || []).map((it) => {
+    if (it?.shot) return it;
+    if (!(it?.role === 'user' && Array.isArray(it.content))) return it;
+    const img = it.content.find((c) => c?.type === 'input_image' && typeof c.image_url === 'string');
+    if (!img) return it;
+    const m = /^data:image\/png;base64,(.+)$/.exec(img.image_url);
+    if (!m) return it;
+    changed = true;
+    return stashShot(m[1], dir);
+  });
+  return changed ? next : items;
+}
+
+export function clip(v, n = 8000) {
   const s = typeof v === 'string' ? v : JSON.stringify(v);
-  return s.length > n ? s.slice(0, n) + '…' : s;
+  if (s.length <= n) return s;
+  // Head+tail, not a tail-drop: a 150-element snapshot overruns n, and a blind cut
+  // throws away the very fields that say so (count, truncated) along with the
+  // closing brace, so the model gets mid-JSON garbage with no signal it was cut.
+  const half = Math.floor((n - 40) / 2);
+  return `${s.slice(0, half)}\n…${s.length - 2 * half} chars elided…\n${s.slice(-half)}`;
+}
+
+/** A re-snapshot after a click that changed nothing repeats the whole element list.
+ *  Only the item being appended is replaced — never an earlier one, which would
+ *  invalidate the cached prefix for the rest of the turn. */
+export function snapshotElide(name, rest, snaps) {
+  if (name !== 'computer_snapshot' || !rest.ok) return rest;
+  const els = rest.result?.elements;
+  if (!Array.isArray(els)) return rest;
+  const h = crypto.createHash('sha1').update(els.join('\n')).digest('hex');
+  if (snaps.last === h) {
+    return { ok: true, act: rest.act, result: { unchanged: true, url: rest.result?.url,
+      note: 'same elements as the previous snapshot — refs from it are still valid' } };
+  }
+  snaps.last = h;
+  return rest;
+}
+/** Message typed while a turn runs. Queued here and appended to the running
+ *  turn's history at the next round boundary — appending a user item lands
+ *  after the cached prefix, so steering costs nothing in cache. */
+async function steer(req, res) {
+  const buf = await readBody(req, res);
+  if (!buf) return;
+  let body;
+  try { body = JSON.parse(buf.toString('utf8') || '{}'); }
+  catch { return send(res, 400, 'bad json'); }
+  const tid = String(body.thread_id || '');
+  const text = String(body.input || '').slice(0, 32000).trim();
+  if (!text) return send(res, 400, 'empty input');
+  if (!CHAT_BUSY.has(tid)) return json(res, 409, { error: 'no turn running — send as a normal message' });
+  const q = STEER.get(tid) || [];
+  q.push(text);
+  STEER.set(tid, q);
+  return json(res, 200, { queued: true });
 }
 async function chat(req, res) {
   const buf = await readBody(req, res);
@@ -656,16 +775,23 @@ async function chat(req, res) {
     'content-type': 'application/x-ndjson; charset=utf-8',
     'cache-control': 'no-store', 'x-accel-buffering': 'no',
   });
-  const emit = (obj) => res.write(JSON.stringify(obj) + '\n');
   // STOP in the UI aborts the fetch; stop looping then, but keep the turn's
   // history — tools already ran, and replaying them on "continue" double-acts.
   const stopped = () => res.destroyed;
+  const emit = (obj) => {
+    if (stopped() || res.destroyed) return;
+    try { res.write(JSON.stringify(obj) + '\n'); } catch { /* client gone */ }
+  };
   // A long-poll tool (auth wait can block 4+ min) would hold CHAT_BUSY long after
   // the client is gone. Race each tool against disconnect; once gone, later tools
   // never start. The synthetic output keeps every function_call answered.
   let clientGone;
   const goneP = new Promise((r) => { clientGone = r; });
-  res.on('close', () => clientGone());
+  // Tools are raced against disconnect, but a model round is not — and its HTTP
+  // request has to be torn down explicitly or the SDK keeps draining the stream
+  // into a dead socket, holding CHAT_BUSY (and billing) long after STOP.
+  const gone = new AbortController();
+  res.on('close', () => { clientGone(); gone.abort(); });
   const toolOrStop = (start, act) => stopped()
     ? Promise.resolve({ ok: false, error: 'stopped by user', act })
     : Promise.race([start(), goneP.then(() => ({ ok: false, error: 'stopped by user', act }))]);
@@ -685,12 +811,14 @@ async function chat(req, res) {
   };
   const dev = { role: 'developer', content: `You operate Case computer ${id}${cname ? ` (named "${cname}" — that's you when the user addresses it)` : ''} via tools. Loop: computer_navigate, then computer_click_element/computer_fill by ref. computer_hover for menus that only open on hover. computer_upload for input[type=file] (file already under /home/agent — write it first). If the snapshot has *[n] lines, those just appeared (autocomplete) — click one, do not press Enter. navigate, click and fill(submit) each RETURN the page's numbered elements and the first 2000 chars of page text, so read the result you already have — call computer_snapshot only for a first look or when something you did not do changed the page. Refs stay valid until the page changes. computer_wait_for instead of polling. Screenshots only for canvas/layout; marks=true draws numbered snapshot boxes on the PNG. Coordinates are the display size (1280x800 by default). Login walls: computer_login(credential=<vault name>, url=current page) — never ask the user for a password or type into password fields. Vault names on this computer: ${vault}. On handoff_pending, immediately auth_attempt_wait. You get ${ROUNDS} tool steps per turn; the conversation continues across turns, so if you run out say exactly where you stopped. Short final answer.` };
   const hist = thread;
-  const turnStart = hist.items.length;
+  // A steer accepted in the turn's last round missed every drain; deliver it
+  // ahead of the new prompt so nothing the user typed is lost.
+  pushSteerItems(hist.items, takeSteers(thread.id));
   hist.items.push({ role: 'user', content: inputText });
   try {
     if (auth.provider === 'anthropic') {
-      const messages = histToAnthropicMessages(hist.items);
-      const { text: out, finished } = await anthropicToolLoop({
+      const messages = histToAnthropicMessages(hydrateShots(hist.items), { media: true });
+      const { text: out, finished, spend, overBudget } = await anthropicToolLoop({
         key: auth.key,
         model,
         effort,
@@ -699,7 +827,17 @@ async function chat(req, res) {
         tools: ALL_TOOLS,
         emit,
         rounds: ROUNDS,
+        tokenBudget: TURN_TOKEN_BUDGET,
+        signal: gone.signal,
         stopped,
+        beforeRound: (msgs) => {
+          const nudges = takeSteers(thread.id);
+          for (const n of nudges) {
+            pushSteerItems(hist.items, [n]);
+            appendSteerToAnthropic(msgs, n);
+            emit({ type: 'steer', text: n });
+          }
+        },
         actFor: (name, args) => actFor(name, args || {}, id),
         runTool: async (name, args, call) => {
           claim();
@@ -719,9 +857,11 @@ async function chat(req, res) {
         },
       });
       let text = out;
-      if (!finished) {
+      if (!finished && !stopped()) {
         text = (text ? text + '\n\n' : '')
-          + `**Out of steps.** Stopped after ${ROUNDS} tool calls with the task unfinished. Say **continue** and I pick up from here.`;
+          + (overBudget
+            ? `**Out of budget.** Stopped after ${spend.in.toLocaleString('en-US')} input tokens with the task unfinished. Say **continue** and I pick up from here.`
+            : `**Out of steps.** Stopped after ${ROUNDS} tool calls with the task unfinished. Say **continue** and I pick up from here.`);
         emit({ type: 'text', text });
       } else if (text) {
         hist.items.push({ type: 'message', role: 'assistant', content: [{ type: 'output_text', text }] });
@@ -736,17 +876,33 @@ async function chat(req, res) {
     }
     const client = new OpenAI({ apiKey: auth.key });
     let text = '';
+    const spend = { in: 0, cached: 0, out: 0 };
     let summary = 'detailed';
     const round = async () => {
+      // The SDK leaves its abort listener on the signal after the round ends; over a
+      // 200-round turn that is 200 dead listeners on one signal. A per-round
+      // controller, linked for exactly the lifetime of the round, keeps it at one.
+      const rc = new AbortController();
+      const relay = () => rc.abort();
+      gone.signal.addEventListener('abort', relay, { once: true });
+      if (gone.signal.aborted) rc.abort();
+      try {
       const params = {
-        model, input: [dev, ...hist.items], tools: ALL_TOOLS,
+        model, input: [dev, ...hydrateShots(hist.items)], tools: ALL_TOOLS,
         reasoning: { effort, summary }, stream: true, store: false,
+        // The loop is append-only: every round re-sends [dev, ...items], which is
+        // exactly the shape the prefix cache wants. A stable key is required for
+        // reliable matching; cached input bills at 0.1x.
+        prompt_cache_key: thread.id,
       };
       let stream;
-      try { stream = await client.responses.create(params); }
+      try { stream = await client.responses.create(params, { signal: rc.signal }); }
       catch (err) {
-        if (summary !== 'auto') { summary = 'auto'; stream = await client.responses.create({ ...params, reasoning: { effort, summary } }); }
-        else throw err;
+        // Only the summary-unsupported fallback retries; an abort must not.
+        if (summary !== 'auto' && !gone.signal.aborted) {
+          summary = 'auto';
+          stream = await client.responses.create({ ...params, reasoning: { effort, summary } }, { signal: rc.signal });
+        } else throw err;
       }
       let response = null;
       let thinkDelta = false;
@@ -784,18 +940,41 @@ async function chat(req, res) {
         emit({ type: 'tool', id: cId, call_id: call.call_id || cId, name: call.name, act: actFor(call.name, args, id), args });
       }
       return { response, traces, textDelta };
+      } finally {
+        gone.signal.removeEventListener('abort', relay);
+      }
     };
     let finished = false;
-    for (let i = 0; i < ROUNDS && !finished && !stopped(); i++) {
-      const { response, traces, textDelta } = await round();
+    const shots = new Set();      // screenshot hashes already in this turn's history
+    const snaps = { last: '' };   // hash of the most recent snapshot's element list
+    const overBudget = () => spend.in > TURN_TOKEN_BUDGET;
+    let i = 0;
+    for (; i < ROUNDS && !finished && !stopped() && !overBudget(); i++) {
+      const nudges = takeSteers(thread.id);
+      if (nudges.length) {
+        for (const n of nudges) {
+          pushSteerItems(hist.items, [n]);
+          emit({ type: 'steer', text: n });
+        }
+      }
+      const { response, traces, textDelta } = await withRateRetry(round, emit, 5, gone.signal);
+      const u = response.usage || {};
+      spend.in += u.input_tokens || 0;
+      spend.cached += u.input_tokens_details?.cached_tokens || 0;
+      spend.out += u.output_tokens || 0;
       text = (response.output_text || traces.texts.join('\n') || '').trim();
       if (!traces.calls.length) {
         finished = true;
+        // The answering round must land in history too, or the reply exists
+        // only in the stream: reloads show bare prompts and the model never
+        // sees what it already said.
+        hist.items.push(...response.output);
         if (text && !textDelta) emit({ type: 'text', text });
         break;
       }
       hist.items.push(...response.output);
       claim();   // first tool call = the run needs hands: the task finds its agent
+      const images = [];
       for (const call of traces.calls) {
         let args = {};
         try { args = JSON.parse(call.arguments || '{}'); } catch { args = {}; }
@@ -807,15 +986,30 @@ async function chat(req, res) {
           () => (eplan ? runExtra(eplan) : runCaseTool(call.name, args, id)), act);
         const { image_b64, ...rest } = result;
         emit({ type: 'tool_result', id: call.id, call_id: callId, act: rest.act || act, ok: !!rest.ok, name: call.name, args_used: call.name === 'computer_exec' ? String(args.command || '').slice(0, 200) : undefined, detail: clip(rest.error || rest.result || rest, 400) });
-        hist.items.push({ type: 'function_call_output', call_id: callId, output: clip(rest) });
+        hist.items.push({ type: 'function_call_output', call_id: callId, output: clip(snapshotElide(call.name, rest, snaps)) });
+        if (image_b64) images.push(image_b64);
       }
       hist.items = histCloseOpenCalls(hist.items, { keepReasoning: true });
+      for (const b64 of images) {
+        // A click that changed nothing yields a byte-identical png. Re-sending it buys
+        // no information and then rides along in every later round of the turn.
+        const h = crypto.createHash('sha1').update(b64).digest('hex');
+        if (shots.has(h)) {
+          hist.items.push({ role: 'user', content: [{ type: 'input_text',
+            text: 'screenshot identical to an earlier one this turn — the screen has not changed' }] });
+          continue;
+        }
+        shots.add(h);
+        hist.items.push(stashShot(b64));
+      }
     }
-    if (!finished) {
-      // Out of steps mid-task. Say so — silence here reads as "it just stopped" —
-      // and the carried history makes "continue" actually resume.
+    if (!finished && !stopped()) {
+      // Out of steps or out of budget mid-task. Say so — silence here reads as
+      // "it just stopped" — and the carried history makes "continue" actually resume.
       text = (text ? text + '\n\n' : '')
-        + `**Out of steps.** Stopped after ${ROUNDS} tool calls with the task unfinished. Say **continue** and I pick up from here.`;
+        + (overBudget()
+          ? `**Out of budget.** Stopped after ${spend.in.toLocaleString('en-US')} input tokens with the task unfinished. Say **continue** and I pick up from here.`
+          : `**Out of steps.** Stopped after ${ROUNDS} tool calls with the task unfinished. Say **continue** and I pick up from here.`);
       emit({ type: 'text', text });
     }
     // Reasoning items are only valid inside the turn that produced them; carrying
@@ -826,16 +1020,26 @@ async function chat(req, res) {
     saveThreads();
     emit({ type: 'done', text, computer_id: id, thread_id: thread.id });
   } catch (err) {
-    // Drop the whole turn: a half-written turn can leave a function_call with no
-    // output, which 400s every later request.
-    hist.items.length = turnStart;
+    // Keep the turn even on provider errors: tools already ran, that work is
+    // real. histCloseOpenCalls synthesizes outputs for any dangling
+    // function_call so later requests don't 400. (Rate limits are retried
+    // inside the round; landing here means retries ran dry or a real fault.)
     hist.items = histCloseOpenCalls(hist.items);
+    histTrim(hist);
     thread.updated = Date.now();
     saveThreads();
-    emit({ type: 'error', error: err?.message || 'openai error' });
+    if (!stopped()) emit({ type: 'error', error: (err?.message || 'provider error') + ' — say continue, I pick up where I stopped.' });
   }
   res.end();
   } finally {
+    // Last-round steers missed every drain. Land them in history before the
+    // inbox is forgotten so a reload or restart still has what the user typed.
+    const leftover = takeSteers(thread.id);
+    if (leftover.length) {
+      pushSteerItems(thread.items, leftover);
+      thread.updated = Date.now();
+      saveThreads();
+    }
     CHAT_BUSY.delete(thread.id);
   }
 }
@@ -878,10 +1082,12 @@ function vncWs(req, socket, head) {
   if (head?.length) up.write(head);
 }
 
+// Only the two pages are servable. Everything else in this directory —
+// server source, thread history — is not a web asset; the request falls
+// through to 404 rather than trusting a proxy to filter paths.
+const PAGE_FILES = { '/': '/index.html', '/index.html': '/index.html', '/deploy': '/deploy.html', '/deploy/': '/deploy.html', '/deploy.html': '/deploy.html' };
 export function pageFile(p) {
-  if (p === '/' || p === '/index.html') return '/index.html';
-  if (p === '/deploy' || p === '/deploy/') return '/deploy.html';
-  return p;
+  return PAGE_FILES[p] || '';
 }
 
 export const server = http.createServer(async (req, res) => {
@@ -924,6 +1130,7 @@ export const server = http.createServer(async (req, res) => {
     if (p === '/api/threads') return threadsRoute(req, res, url);
     if (req.method === 'GET' && p === '/api/file') return fsFile(res, url);
     if (req.method === 'POST' && p === '/api/chat') return chat(req, res);
+    if (req.method === 'POST' && p === '/api/chat/steer') return steer(req, res);
     if (req.method === 'POST' && p === '/api/teach-tick') {
       const id = await cid();
       if (!id) return json(res, 409, { error: 'no computer' });
diff --git a/web/web-ui/test_serve.mjs b/web/web-ui/test_serve.mjs
index db492f2..e75b3fb 100644
--- a/web/web-ui/test_serve.mjs
+++ b/web/web-ui/test_serve.mjs
@@ -2,13 +2,16 @@
 // SPDX-License-Identifier: MIT
 // Pure-unit checks for the drive v2 server helpers. Run: node web/web-ui/test_serve.mjs
 import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { shq, pathOk, parseFind, mimeFor, histTrim, histCloseOpenCalls, normHost, threadTurns, parseCaseUrl, liveCid, liveDestPath, livePathHasDotDot, tokenMatches, liveTarget, extraPlan, isLocalMode, pageFile } from './serve.mjs';
+import { shq, pathOk, parseFind, mimeFor, histTrim, histCloseOpenCalls, normHost, threadTurns, parseCaseUrl, liveCid, liveDestPath, livePathHasDotDot, tokenMatches, liveTarget, extraPlan, isLocalMode, pageFile, clip, snapshotElide, stashShot, hydrateShots, migrateShots } from './serve.mjs';
 import {
   CASE_TOOLS, chatAuth, resolveChatModel, openaiToolsToAnthropic,
   newAnthropicStreamCtx, anthropicEventToNdjson, tracesFromAnthropicMessage,
-  histToAnthropicMessages, anthropicThinkingFor,
+  histToAnthropicMessages, anthropicThinkingFor, caseToolPlan, withRateRetry,
 } from './case-tools.mjs';
 
 const html = fs.readFileSync(fileURLToPath(new URL('./index.html', import.meta.url)), 'utf8');
@@ -272,5 +275,164 @@ assert.equal(pageFile('/'), '/index.html');
 assert.equal(pageFile('/deploy'), '/deploy.html');
 assert.equal(pageFile('/deploy/'), '/deploy.html');
 assert.equal(pageFile('/index.html'), '/index.html');
+assert.equal(pageFile('/serve.mjs'), '');
+assert.equal(pageFile('/threads.json'), '');
+assert.equal(pageFile('/../secrets'), '');
+assert.equal(pageFile('/deploy.html'), '/deploy.html');
+
+{
+  const msgs = histToAnthropicMessages([
+    { role: 'user', content: [{ type: 'input_text', text: 'steer mid-turn' }] },
+    { role: 'user', content: [{ type: 'input_image', detail: 'high', image_url: 'data:image/png;base64,xx' }] },
+  ]);
+  assert.equal(msgs.length, 1);
+  assert.equal(msgs[0].content, 'steer mid-turn');
+}
+{
+  const msgs = histToAnthropicMessages([
+    { role: 'user', shot: '/tmp/x.png', content: [{ type: 'input_text', text: '[screenshot]' }] },
+    { role: 'user', content: 'after the shot' },
+  ]);
+  assert.equal(msgs.length, 1);
+  assert.equal(msgs[0].content, 'after the shot');
+}
+
+// STOP keeps the turn — rewind only on provider errors, not disconnect.
+{
+  const serveSrc = fs.readFileSync(fileURLToPath(new URL('./serve.mjs', import.meta.url)), 'utf8');
+  const caseToolsSrc = fs.readFileSync(fileURLToPath(new URL('./case-tools.mjs', import.meta.url)), 'utf8');
+  const chatFn = serveSrc.slice(serveSrc.indexOf('async function chat('), serveSrc.indexOf('// ---------- noVNC'));
+  assert.match(chatFn, /if \(stopped\(\) \|\| res\.destroyed\) return/);
+  const outOfSteps = [...chatFn.matchAll(/if \(!finished(?: && !stopped\(\))?\)/g)];
+  assert.equal(outOfSteps.length, 2, 'Anthropic + OpenAI out-of-steps gates');
+  assert.ok(outOfSteps.every((m) => m[0].includes('!stopped()')), 'STOP is not out-of-rounds');
+  assert.ok(!/turnStart/.test(chatFn), 'no turn rollback on provider error');
+  assert.match(chatFn, /histCloseOpenCalls\(hist\.items\)/);
+  assert.match(chatFn, /withRateRetry\(round, emit, 5, gone\.signal\)/);
+  assert.match(chatFn, /res\.on\('close', \(\) => \{ clientGone\(\); gone\.abort\(\); \}\)/);
+  assert.match(chatFn, /responses\.create\(params, \{ signal: rc\.signal \}\)/);
+  assert.ok(!/responses\.create\(params\)/.test(chatFn), 'every round is abortable');
+  assert.match(chatFn, /summary !== 'auto' && !gone\.signal\.aborted/, 'an abort never retries as a summary fallback');
+  assert.match(chatFn, /gone\.signal\.removeEventListener\('abort', relay\)/, 'round listener is unlinked');
+  assert.match(serveSrc, /takeSteers\(thread\.id\)/, 'steer inbox drained in the loop');
+  assert.match(serveSrc, /type: 'steer'/, 'steer emits to the stream');
+  assert.match(serveSrc, /beforeRound:/, 'anthropic loop drains steers each round');
+  assert.match(serveSrc, /pushSteerItems\(thread\.items, leftover\)/, 'last-round steers persist with the turn');
+  assert.match(chatFn, /prompt_cache_key: thread\.id/);
+  assert.match(serveSrc, /CASE_TURN_TOKENS/);
+  assert.match(chatFn, /tokenBudget: TURN_TOKEN_BUDGET/);
+  assert.match(chatFn, /signal: gone\.signal/);
+  assert.match(caseToolsSrc, /tokenBudget/);
+  assert.match(caseToolsSrc, /stream\.abort\(\)/, 'Anthropic stream is canceled on disconnect');
+  assert.match(caseToolsSrc, /withRateRetry\(\(\) => round\(params\), emit, 5, signal\)/);
+  assert.match(chatFn, /if \(!stopped\(\)\) emit\(\{ type: 'error'/);
+  assert.match(html, /\/api\/chat\/steer/);
+  assert.match(html, /steerPrompt/);
+  assert.ok(!/truncation:\s*['"]auto['"]/.test(chatFn), 'no truncation:auto');
+  assert.ok(!/compactHistory|SUMMARIZE_PROMPT|CASE_COMPACT_AT/.test(serveSrc), 'no compaction');
+}
+
+{
+  assert.equal(clip('abc', 8000), 'abc');
+  const long = 'A'.repeat(4000) + 'B'.repeat(4000) + '"truncated":true}';
+  const cut = clip(long, 200);
+  assert.ok(cut.startsWith('AAA'), 'head kept');
+  assert.ok(cut.endsWith('"truncated":true}'), 'tail kept — this is what a blind cut lost');
+  assert.match(cut, /chars elided/);
+  assert.ok(cut.length < 300, 'stays near the budget');
+  assert.equal(clip({ a: 1 }), '{"a":1}');
+}
+
+{
+  const snaps = { last: '' };
+  const snap = { ok: true, act: 'snapshot', result: { url: 'https://x/', elements: ['[1] button "Go"'] } };
+  assert.deepEqual(snapshotElide('computer_snapshot', snap, snaps), snap, 'first snapshot passes through');
+  const again = snapshotElide('computer_snapshot', JSON.parse(JSON.stringify(snap)), snaps);
+  assert.equal(again.result.unchanged, true);
+  assert.equal(again.result.url, 'https://x/');
+  assert.ok(!again.result.elements, 'element list dropped');
+  const moved = { ok: true, act: 'snapshot', result: { url: 'https://x/2', elements: ['[1] link "Next"'] } };
+  assert.deepEqual(snapshotElide('computer_snapshot', moved, snaps), moved, 'changed page passes through');
+  const other = { ok: true, act: 'eval', result: { value: 1 } };
+  assert.deepEqual(snapshotElide('computer_eval', other, snaps), other, 'only snapshots are elided');
+  const failed = { ok: false, act: 'snapshot', error: 'boom' };
+  assert.deepEqual(snapshotElide('computer_snapshot', failed, snaps), failed, 'errors pass through');
+}
+
+{
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'case-shots-'));
+  const png = 'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg==';
+  const item = stashShot(png, dir);
+  assert.ok(item.shot.startsWith(dir));
+  assert.ok(item.shot.endsWith('.png'));
+  assert.ok(fs.existsSync(item.shot));
+  assert.ok(JSON.stringify(item).length < 400, 'the history item is a pointer, not the png');
+  const hydrated = hydrateShots([item], dir);
+  assert.equal(hydrated[0].content[0].type, 'input_image');
+  assert.equal(hydrated[0].content[0].detail, 'high');
+  assert.ok(hydrated[0].content[0].image_url.startsWith('data:image/png;base64,'));
+  const missing = hydrateShots([{ role: 'user', shot: path.join(dir, 'nope.png'), content: [{ type: 'input_text', text: '[screenshot]' }] }], dir);
+  assert.equal(missing[0].content[0].type, 'input_text');
+  const outside = hydrateShots([{ role: 'user', shot: '/etc/passwd', content: [{ type: 'input_text', text: '[screenshot]' }] }], dir);
+  assert.equal(outside[0].content[0].type, 'input_text', 'paths outside the shots dir are refused');
+  const legacy = [{ role: 'user', content: [{ type: 'input_image', detail: 'high', image_url: 'data:image/png;base64,' + png }] }];
+  const moved = migrateShots(legacy, dir);
+  assert.ok(moved[0].shot);
+  assert.notEqual(moved, legacy);
+  assert.equal(migrateShots(moved, dir), moved, 'already migrated — no second write');
+  fs.rmSync(dir, { recursive: true, force: true });
+}
+
+{
+  let n = 0;
+  const out = await withRateRetry(async () => {
+    n += 1;
+    if (n < 3) {
+      const err = new Error('rate limit: try again in 0s');
+      err.status = 429;
+      throw err;
+    }
+    return 'ok';
+  }, () => {}, 5);
+  assert.equal(out, 'ok');
+  assert.equal(n, 3);
+}
+
+{
+  const ctl = new AbortController();
+  let n = 0;
+  const started = Date.now();
+  await assert.rejects(
+    withRateRetry(async () => {
+      n += 1;
+      const err = new Error('rate limited');
+      err.status = 429;
+      throw err;
+    }, () => ctl.abort(), 5, ctl.signal),
+    (err) => err?.name === 'AbortError',
+  );
+  assert.equal(n, 1, 'disconnect stops retries before another provider request');
+  assert.ok(Date.now() - started < 500, 'disconnect interrupts the backoff sleep');
+}
+
+{
+  const run = (cmd) => {
+    const plan = caseToolPlan('computer_exec', { command: cmd }, 'c_1');
+    return { out: execFileSync('bash', ['-c', plan.json.command], { encoding: 'utf8' }), log: plan.logPath };
+  };
+  const a = run('printf "one\\ntwo\\n"; exit 3');
+  assert.match(a.out, /exit=3/, 'exit code survives the redirect');
+  assert.match(a.out, /lines=2/);
+  assert.match(a.out, /one\ntwo/);
+  const b = run('echo oops >&2');
+  assert.match(b.out, /exit=0/);
+  assert.match(b.out, /oops/, 'stderr is captured too');
+  const c = run('seq 1 100000');
+  assert.match(c.out, /lines=100000/);
+  assert.ok(c.out.length < 3000, 'head only, not 100k lines of history');
+  assert.match(fs.readFileSync(c.log, 'utf8'), /\n100000\n$/, 'the file has the rest');
+  assert.match(run('cd /usr && pwd').out, /\/usr/, 'the command still runs in one shell');
+  for (const { log } of [a, b, c]) fs.rmSync(log, { force: true });
+}
 
 console.log('web-ui serve: all checks pass');