diff --git a/cmd/codeaf/carried.go b/cmd/codeaf/carried.go
index e04d20c3b6..821540366b 100644
--- a/cmd/codeaf/carried.go
+++ b/cmd/codeaf/carried.go
@@ -309,6 +309,25 @@ func runCarriedHost(ctx context.Context, inv *delegate.Invocation) error {
 		}
 		inv.Line = carriedResolvedModel(inv.Line, modelFlag, resolved)
 	}
+	// AN AUXILIARY MODEL IS RESOLVED BY THE SAME DOOR. Leaving a light
+	// model as typed sent an unmarked floating alias where the main model
+	// had already been replaced by its catalog spelling.
+	for _, flag := range inv.Program.AuxiliaryModelFlags {
+		flag = strings.TrimSpace(flag)
+		word := strings.TrimSpace(inv.ExplicitFlags[flag])
+		if word == "" {
+			continue
+		}
+		resolved := word
+		if road.resolveModel != nil {
+			resolved, err = road.resolveModel(word)
+			if err != nil {
+				return err
+			}
+		}
+		inv.Line = carriedResolvedModel(inv.Line, flag, resolved)
+		modelsToWarm = append(modelsToWarm, strings.Split(resolved, ",")...)
+	}
 	if asked == "" && road.defaultSeat != nil {
 		road.seat, err = road.defaultSeat()
 		if err != nil {
diff --git a/cmd/codeaf/carried_child_test.go b/cmd/codeaf/carried_child_test.go
index 03c7fcf2f9..01ae4a6d37 100644
--- a/cmd/codeaf/carried_child_test.go
+++ b/cmd/codeaf/carried_child_test.go
@@ -141,6 +141,10 @@ func runAsCarriedChild() (int, bool) {
 		restore := builtin.Override([]delegate.Delegate{fakeFolderProgram()})
 		defer restore()
 		return execute(), true
+	case "model-flags":
+		restore := builtin.Override([]delegate.Delegate{fakeModelFlagsProgram()})
+		defer restore()
+		return execute(), true
 	case "real":
 		return execute(), true
 	}
diff --git a/cmd/codeaf/carried_model_flags_test.go b/cmd/codeaf/carried_model_flags_test.go
new file mode 100644
index 0000000000..3c07470ce9
--- /dev/null
+++ b/cmd/codeaf/carried_model_flags_test.go
@@ -0,0 +1,135 @@
+//go:build !windows
+
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+
+	"github.com/Agent-Field/agentfield/sdk/go/ai"
+	"github.com/Agent-Field/codeaf/internal/agentsession"
+	"github.com/Agent-Field/codeaf/internal/config"
+	"github.com/Agent-Field/codeaf/internal/delegate"
+	"github.com/Agent-Field/codeaf/internal/delegate/builtin"
+)
+
+// A real child asks both declared model flags, so resolving only the main
+// flag cannot hide behind a passing parent parser or a tolerant provider.
+func fakeModelFlagsProgram() delegate.Delegate {
+	return delegate.Delegate{Name: "fake-model-flags", Summary: "tests model resolution", Guide: "Tests the shell's model flags.", Page: "delegates", Default: "run", ModelFlag: "model", AuxiliaryModelFlags: []string{"light"}, Commands: []delegate.Command{{Name: "run", Usage: "[flags] -- <brief>", Summary: "asks both models", Bind: func(fs *flag.FlagSet) delegate.Body {
+		model := fs.String("model", "", "the working model")
+		light := fs.String("light", "", "the light model")
+		return func(ctx context.Context, host delegate.Host, _ []string) error {
+			client, err := agentsession.NewClient(host.Models(), 0)
+			if err != nil {
+				return err
+			}
+			for _, selected := range []string{*model, *light} {
+				if selected == "" {
+					selected = *model
+				}
+				reply, err := client.Complete(ctx, agentsession.Request{Model: selected, Messages: []ai.Message{{Role: "user", Content: []ai.ContentPart{{Type: "text", Text: "answer"}}}}})
+				if err != nil {
+					host.Terminal(delegate.Ending{Status: delegate.StatusFail, Message: err.Error()})
+					return nil
+				}
+				if reply.Text() != "done" {
+					return fmt.Errorf("unexpected answer")
+				}
+			}
+			host.Terminal(delegate.Ending{Status: delegate.StatusPass, Message: "both models answered"})
+			return nil
+		}
+	}}}}
+}
+
+func TestShellResolvesAuxiliaryModelsBeforeARealChildCallsTheProvider(t *testing.T) {
+	for _, tc := range []struct {
+		name, light string
+		refused     bool
+	}{
+		{"floating-alias", "fixture/floating-latest", false},
+		{"native-id", "fixture/native", false},
+		{"unknown-id", "fixture/missing", true},
+		{"omitted-light", "", false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			home := t.TempDir()
+			t.Setenv("CODEAF_HOME", home)
+			t.Setenv(config.ProfileDirEnv, home)
+			t.Setenv("OPENROUTER_API_KEY", "sk-or-v1-fixture")
+			t.Setenv(carriedChildEnv, "model-flags")
+			t.Setenv("DO_NOT_TRACK", "1")
+			t.Setenv("CODEAF_NO_UPDATE_CHECK", "1")
+			var mu sync.Mutex
+			var sent []string
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if r.Method == http.MethodGet && strings.HasSuffix(r.URL.Path, "/models") {
+					rows := []any{}
+					for _, id := range []string{"~fixture/floating-latest", "fixture/native"} {
+						rows = append(rows, map[string]any{"id": id, "name": id, "context_length": 200000, "architecture": map[string]any{"input_modalities": []string{"text"}, "output_modalities": []string{"text"}}, "pricing": map[string]string{"prompt": "0", "completion": "0"}, "supported_parameters": []string{"tools", "tool_choice", "max_tokens"}})
+					}
+					_ = json.NewEncoder(w).Encode(map[string]any{"data": rows})
+					return
+				}
+				if r.Method != http.MethodPost || !strings.HasSuffix(r.URL.Path, "/chat/completions") {
+					http.NotFound(w, r)
+					return
+				}
+				var request struct {
+					Model string `json:"model"`
+				}
+				if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+					http.Error(w, err.Error(), 400)
+					return
+				}
+				mu.Lock()
+				sent = append(sent, request.Model)
+				mu.Unlock()
+				if request.Model != "~fixture/floating-latest" && request.Model != "fixture/native" {
+					http.Error(w, `{"error":{"message":"invalid model ID"}}`, 404)
+					return
+				}
+				w.Header().Set("Content-Type", "text/event-stream")
+				fmt.Fprintf(w, "data: {\"id\":\"fixture\",\"model\":%q,\"choices\":[{\"index\":0,\"delta\":{\"content\":\"done\"},\"finish_reason\":\"stop\"}],\"usage\":{\"prompt_tokens\":1,\"completion_tokens\":1,\"total_tokens\":2,\"cost\":0}}\n\ndata: [DONE]\n\n", request.Model)
+			}))
+			defer server.Close()
+			t.Setenv("CODEAF_BASE_URL", server.URL+"/api/v1")
+			oldCatalog, oldOut := sharedCatalog, carriedStdout
+			sharedCatalog, carriedStdout = newSharedCatalog(), &lockedBuffer{}
+			t.Cleanup(func() { sharedCatalog, carriedStdout = oldCatalog, oldOut })
+			program := fakeModelFlagsProgram()
+			restore := builtin.Override([]delegate.Delegate{program})
+			defer restore()
+			line := []string{"run", "--model", "fixture/floating-latest", "--dir", t.TempDir()}
+			if tc.light != "" {
+				line = append(line, "--light="+tc.light)
+			}
+			line = append(line, "--", "test both models")
+			err := runCarried(program, line)
+			mu.Lock()
+			got := append([]string(nil), sent...)
+			mu.Unlock()
+			if tc.refused {
+				if err == nil || !strings.Contains(err.Error(), "fixture/missing") || len(got) != 0 {
+					t.Fatalf("unknown light started calls or lacked its refusal: %v, %q", err, got)
+				}
+				return
+			}
+			wantLight := "~fixture/floating-latest"
+			if tc.light == "fixture/native" {
+				wantLight = tc.light
+			}
+			if exitCodeOf(err) != 0 || len(got) != 2 || got[0] != "~fixture/floating-latest" || got[1] != wantLight {
+				t.Fatalf("model flags = %q, error = %v", got, err)
+			}
+		})
+	}
+}
diff --git a/cmd/codeaf/chatv3_surface_test.go b/cmd/codeaf/chatv3_surface_test.go
index d0507cf1aa..fd3b1a2c3a 100644
--- a/cmd/codeaf/chatv3_surface_test.go
+++ b/cmd/codeaf/chatv3_surface_test.go
@@ -76,6 +76,12 @@ func TestRunSurfaceWiresTheDeferredLaunchCheckAndInstallerThroughRealInit(t *tes
 	if err := os.WriteFile(target, []byte("old executable"), 0o755); err != nil {
 		t.Fatal(err)
 	}
+	// The installer reports the executable's physical path. A temporary
+	// directory on macOS can name that same file through a linked ancestor.
+	canonicalTarget, err := filepath.EvalSymlinks(target)
+	if err != nil {
+		t.Fatal(err)
+	}
 	oldRun := runSurfaceProgram
 	oldClient, oldExecutable := surfaceUpdateClient, surfaceExecutable
 	oldRunningExecutable := surfaceRunningExecutable
@@ -157,7 +163,7 @@ func TestRunSurfaceWiresTheDeferredLaunchCheckAndInstallerThroughRealInit(t *tes
 		t.Fatal(err)
 	}
 	installed, err := os.ReadFile(target)
-	if err != nil || string(installed) != string(asset) || result.Path != target || resolved != 1 {
+	if err != nil || string(installed) != string(asset) || result.Path != canonicalTarget || resolved != 1 {
 		t.Fatalf("result = %+v resolved = %d installed = %q, %v", result, resolved, installed, err)
 	}
 }
diff --git a/docs/changes/unreleased/1818-review-model-root-formatting.md b/docs/changes/unreleased/1818-review-model-root-formatting.md
new file mode 100644
index 0000000000..868d0c53fd
--- /dev/null
+++ b/docs/changes/unreleased/1818-review-model-root-formatting.md
@@ -0,0 +1,13 @@
+---
+kind: fixed
+title: review resolves model words and linked roots and formats final answers
+pr: 1818
+surface: [chat, engine, docs]
+invalidates:
+  - "The shell resolved the main model flag but passed an explicit light model word unchanged. Review and security now resolve both through the same profile catalog, refusing unknown words before calls start."
+  - "Read tools compared resolved file paths against an unresolved repository root and refused ordinary files under a linked root. Both spellings of the owned root now work while external paths and links remain refused."
+  - "Final review answers requested JSON only through prompt instructions. They now request native schema formatting when the cached catalog publishes support, with one prompt-only fallback for an explicit unsupported-format refusal."
+  - "The macOS installer surface regression compared a physical output path with a linked temporary-path spelling. It now checks the exact resolved installation target while preserving installed-byte and invocation-count checks."
+---
+
+Every review answer is still checked against the original full schema. Invalid schemas, account or ceiling refusals, cancellation and provider outages do not take the formatting fallback. Model defaults and turn, time and cost ceilings are unchanged.
diff --git a/internal/agentsession/app.go b/internal/agentsession/app.go
index 91633917fd..fc9af45b7c 100644
--- a/internal/agentsession/app.go
+++ b/internal/agentsession/app.go
@@ -161,7 +161,8 @@ func (a *App) Harness(ctx context.Context, prompt string, schema map[string]any,
 	// THE REPOSITORY IS THE APP'S, NOT THE CALLER'S. Every agent names the
 	// folder it was handed; one that named another would be read nowhere.
 	if project := strings.TrimSpace(opts.ProjectDir); project != "" && filepath.Clean(project) != filepath.Clean(root) {
-		if real, err := filepath.EvalSymlinks(project); err != nil || !within(root, real) {
+		realRoot, rootErr := filepath.EvalSymlinks(root)
+		if real, err := filepath.EvalSymlinks(project); err != nil || rootErr != nil || !within(realRoot, real) {
 			return nil, fmt.Errorf("%s asked to read %s, which is not the repository this run reads", label, project)
 		}
 	}
diff --git a/internal/agentsession/client.go b/internal/agentsession/client.go
index 16a155f4ea..7f039da1dc 100644
--- a/internal/agentsession/client.go
+++ b/internal/agentsession/client.go
@@ -35,6 +35,7 @@ import (
 	"time"
 
 	"github.com/Agent-Field/agentfield/sdk/go/ai"
+	"github.com/Agent-Field/codeaf/internal/config"
 	"github.com/Agent-Field/codeaf/internal/delegate"
 	"github.com/Agent-Field/codeaf/internal/provider/modelapi"
 )
@@ -57,6 +58,9 @@ type Client struct {
 	// call waits; a test shortens both.
 	pause func(attempt int) time.Duration
 	held  func() time.Duration
+	// supportsParameter reads only the profile's remembered capabilities.
+	// Unknown facts never opt a session into a new provider request field.
+	supportsParameter func(model, parameter string) (supported, known bool)
 }
 
 // NewClient opens the run's model API. It refuses an API with no address or no
@@ -79,8 +83,9 @@ func NewClient(api delegate.ModelAPI, retries int) (*Client, error) {
 		// NO CLIENT TIMEOUT: a thinking model can be quiet for minutes, and the
 		// call's own context (the session's wall, the run's stop) is what ends
 		// it.
-		http:  &http.Client{},
-		pause: func(attempt int) time.Duration { return time.Duration(2<<attempt) * time.Second },
+		http:              &http.Client{},
+		pause:             func(attempt int) time.Duration { return time.Duration(2<<attempt) * time.Second },
+		supportsParameter: config.CachedSupportsParameter,
 	}, nil
 }
 
@@ -216,6 +221,10 @@ func (c *Client) Refusal() error {
 // what is left of the run's ceiling.
 var errHeld = errors.New("the run's ceiling is held by calls in flight")
 
+// errResponseFormatUnsupported is an explicit format refusal, classified
+// at the API boundary. It is not a bad schema, account refusal or outage.
+var errResponseFormatUnsupported = errors.New("the served endpoint does not support the response format")
+
 // holdPause is how long a held call waits before it asks again: about the two
 // seconds the model API suggests, spread so that calls held together do not
 // all ask again together.
@@ -269,6 +278,9 @@ func (c *Client) send(ctx context.Context, body []byte) (*ai.Response, error, bo
 		case http.StatusTooManyRequests, http.StatusBadGateway, http.StatusServiceUnavailable, http.StatusGatewayTimeout, http.StatusInternalServerError:
 			return nil, fmt.Errorf("the model API answered %d: %s", answer.StatusCode, message), true
 		}
+		if responseFormatUnsupported(answer.StatusCode, raw, message) {
+			return nil, fmt.Errorf("%w: %s", errResponseFormatUnsupported, message), false
+		}
 		return nil, fmt.Errorf("the model API answered %d: %s", answer.StatusCode, message), false
 	}
 	var response ai.Response
@@ -281,6 +293,42 @@ func (c *Client) send(ctx context.Context, body []byte) (*ai.Response, error, bo
 	return &response, nil, false
 }
 
+// responseFormatUnsupported recognizes only a permanent request-field
+// refusal. A schema the provider says is invalid must still fail unchanged.
+func responseFormatUnsupported(status int, raw []byte, message string) bool {
+	if status != http.StatusBadRequest && status != http.StatusUnprocessableEntity {
+		return false
+	}
+	var detail struct {
+		Error struct {
+			Param string `json:"param"`
+			Code  string `json:"code"`
+		} `json:"error"`
+	}
+	if json.Unmarshal(raw, &detail) == nil {
+		switch detail.Error.Code {
+		case "invalid_json_schema", "invalid_schema", "schema_validation_error":
+			return false
+		case "unsupported_parameter":
+			if detail.Error.Param == "response_format" {
+				return true
+			}
+		}
+	}
+	message = strings.ToLower(message)
+	for _, phrase := range []string{"invalid schema", "invalid json schema", "schema is invalid", "invalid_json_schema"} {
+		if strings.Contains(message, phrase) {
+			return false
+		}
+	}
+	for _, phrase := range []string{"response_format is not supported", "response_format not supported", "does not support response_format", "unsupported response_format", "json_schema is not supported", "does not support json_schema"} {
+		if strings.Contains(message, phrase) {
+			return true
+		}
+	}
+	return false
+}
+
 // apiMessage is the one sentence an error body carries, or the body itself.
 func apiMessage(raw []byte) string {
 	var shaped ai.ErrorResponse
diff --git a/internal/agentsession/policy.go b/internal/agentsession/policy.go
index 1d52083c7a..3a901880e2 100644
--- a/internal/agentsession/policy.go
+++ b/internal/agentsession/policy.go
@@ -20,6 +20,10 @@ import (
 
 // Policy is how every agent session of a program reads and answers.
 type Policy struct {
+	// StructuredAnswers opts schema-bound final turns into native formatting
+	// only when the profile's catalog publishes support. False keeps the
+	// program's existing prompt-only behavior.
+	StructuredAnswers bool
 	// FollowUps is how many times an answer that does not meet its schema is
 	// asked for again.
 	FollowUps int
diff --git a/internal/agentsession/root_alias_test.go b/internal/agentsession/root_alias_test.go
new file mode 100644
index 0000000000..908764c1d8
--- /dev/null
+++ b/internal/agentsession/root_alias_test.go
@@ -0,0 +1,93 @@
+package agentsession
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/Agent-Field/codeaf/internal/agentsession/appx"
+)
+
+func TestSessionCanReadARepositoryWhoseRootIsASymlink(t *testing.T) {
+	root := repo(t)
+	alias := filepath.Join(t.TempDir(), "repository-alias")
+	if err := os.Symlink(root, alias); err != nil {
+		t.Skipf("this platform cannot create the root alias: %v", err)
+	}
+	api := (&fakeAPI{}).then(callTool("read_file", `{"path":"README.md"}`)).then(func(body wireRequest) (int, any) {
+		observation := body.Messages[len(body.Messages)-1].Content[0].Text
+		if !strings.Contains(observation, "# demo") || strings.Contains(observation, "outside") {
+			t.Errorf("a file inside the aliased repository was refused: %s", observation)
+		}
+		return answer("done", 0)(body)
+	})
+	result, err := RunSession(t.Context(), api.serve(t), SessionOrder{Root: alias, MaxTurns: 6, Policy: testPolicy})
+	if err != nil || result.Failed != "" {
+		t.Fatalf("session = %+v, error = %v", result, err)
+	}
+}
+
+func TestAliasedRootKeepsEveryToolInsideTheRepository(t *testing.T) {
+	root := repo(t)
+	alias := filepath.Join(t.TempDir(), "repository-alias")
+	if err := os.Symlink(root, alias); err != nil {
+		t.Skipf("this platform cannot create the root alias: %v", err)
+	}
+	tools, err := newToolbox(alias, testPolicy.Tools)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, path := range []string{"README.md", filepath.Join(alias, "README.md"), filepath.Join(root, "README.md")} {
+		if text, err := tools.read(path, 0, 0); err != nil || !strings.Contains(text, "# demo") {
+			t.Fatalf("read %q = %q, %v", path, text, err)
+		}
+	}
+	if text, err := tools.list("."); err != nil || !strings.Contains(text, "README.md") {
+		t.Fatalf("list = %q, %v", text, err)
+	}
+	if text, err := tools.glob("**/*.py"); err != nil || !strings.Contains(text, "app/views.py") {
+		t.Fatalf("glob = %q, %v", text, err)
+	}
+	if text, err := tools.grep("popen", ".", "", false); err != nil || !strings.Contains(text, "app/views.py:4:") {
+		t.Fatalf("grep = %q, %v", text, err)
+	}
+	outside := t.TempDir()
+	secret := filepath.Join(outside, "outside.txt")
+	if err := os.WriteFile(secret, []byte("outside the owned repository"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(secret, filepath.Join(root, "escape.txt")); err != nil {
+		t.Fatal(err)
+	}
+	// A path outside the lexical root is still refused even if it links in.
+	inward := filepath.Join(outside, "inward.txt")
+	if err := os.Symlink(filepath.Join(root, "README.md"), inward); err != nil {
+		t.Fatal(err)
+	}
+	for _, path := range []string{secret, inward, "escape.txt", filepath.Join(alias, "escape.txt"), "../outside.txt"} {
+		if _, err := tools.read(path, 0, 0); err == nil {
+			t.Fatalf("read escaped through %q", path)
+		}
+	}
+}
+
+func TestHarnessAcceptsTheCanonicalSpellingOfItsAliasedRepository(t *testing.T) {
+	root := repo(t)
+	alias := filepath.Join(t.TempDir(), "repository-alias")
+	if err := os.Symlink(root, alias); err != nil {
+		t.Skipf("this platform cannot create the root alias: %v", err)
+	}
+	api := (&fakeAPI{}).then(answer("done", 0))
+	app, err := New(api.serve(t), Config{Root: alias, Sessions: 1, Calls: 1, MaxTurns: 6, SessionWall: time.Minute, Policy: testPolicy})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result, err := app.Harness(t.Context(), "answer", nil, nil, appx.HarnessOptions{ProjectDir: root}); err != nil || result.IsError {
+		t.Fatalf("the canonical owned project was refused: %+v, %v", result, err)
+	}
+	if _, err := app.Harness(t.Context(), "answer", nil, nil, appx.HarnessOptions{ProjectDir: t.TempDir()}); err == nil {
+		t.Fatal("an unrelated project was accepted")
+	}
+}
diff --git a/internal/agentsession/session.go b/internal/agentsession/session.go
index a79dfb14ed..c42c756c85 100644
--- a/internal/agentsession/session.go
+++ b/internal/agentsession/session.go
@@ -45,8 +45,12 @@ type SessionOrder struct {
 	// AnswerReserve stops reading this long before the existing deadline, so
 	// the session can answer from completed observations. Zero reserves none.
 	AnswerReserve time.Duration
-	// Policy is how the session reads and answers; every field is required.
+	// Policy is how the session reads and answers; every limit is required.
 	Policy Policy
+	// supportsParameter reads remembered facts inside this session's clock.
+	supportsParameter func(model, parameter string) (supported, known bool)
+	// answerFormat is used only after reading has stopped.
+	answerFormat *ai.ResponseFormat
 }
 
 // SessionResult is how a session ended: its answer, and what it cost.
@@ -71,6 +75,9 @@ var errNoAnswer = errors.New("the session ended without an answer")
 // could not run at all — the model API refused, the run was stopped; a session
 // that ran and gave no usable answer says so in Failed.
 func RunSession(ctx context.Context, client *Client, order SessionOrder) (SessionResult, error) {
+	if client != nil {
+		order.supportsParameter = client.supportsParameter
+	}
 	return runSession(ctx, client.Complete, order, sessionClock{time.Now, context.WithDeadline})
 }
 
@@ -117,8 +124,31 @@ func runSession(ctx context.Context, complete func(context.Context, Request) (*a
 			return SessionResult{}, fmt.Errorf("the answer's schema does not compile: %w", err)
 		}
 		validate = compiled
+		if order.Policy.StructuredAnswers && order.supportsParameter != nil {
+			format, formatKnown := order.supportsParameter(order.Model, "response_format")
+			schema, schemaKnown := order.supportsParameter(order.Model, "structured_outputs")
+			if formatKnown && format && schemaKnown && schema {
+				raw, err := json.Marshal(order.Schema)
+				if err != nil {
+					return result, fmt.Errorf("encode the answer's schema: %w", err)
+				}
+				order.answerFormat = &ai.ResponseFormat{Type: "json_schema", JSONSchema: &ai.JSONSchema{
+					// The existing schemas contain optional/defaulted fields.
+					// Do not impose a provider's narrower strict-mode dialect;
+					// the unchanged local validator enforces the full schema.
+					Name: "response", Schema: raw,
+				}}
+			}
+		}
+	}
+	if err := ctx.Err(); err != nil {
+		result.Failed = err.Error()
+		return result, err
+	}
+	tools, err := newToolbox(order.Root, policy.Tools)
+	if err != nil {
+		return result, err
 	}
-	tools := toolbox{root: order.Root, limits: policy.Tools}
 	messages := []ai.Message{
 		textMessage("system", sessionSystem(order)),
 		textMessage("user", order.Prompt),
@@ -138,6 +168,8 @@ func runSession(ctx context.Context, complete func(context.Context, Request) (*a
 		request := Request{Model: order.Model, Thread: order.Thread, Messages: messages}
 		if !answering {
 			request.Tools = tools.definitions()
+		} else {
+			request.ResponseFormat = order.answerFormat
 		}
 		callCtx := ctx
 		if !answering {
@@ -147,6 +179,13 @@ func runSession(ctx context.Context, complete func(context.Context, Request) (*a
 		result.Turns++
 		result.CostUSD += costOf(response)
 		if err != nil {
+			// One explicit unsupported-format refusal falls back to the schema
+			// already in the prompt. The failed attempt still consumes a turn,
+			// and neither the hard deadline nor local validation changes.
+			if request.ResponseFormat != nil && errors.Is(err, errResponseFormatUnsupported) && ctx.Err() == nil {
+				order.answerFormat = nil
+				continue
+			}
 			// Only our intentional reading cutoff starts an answer. A caller
 			// stop, provider refusal or exhausted full deadline still fails.
 			if !answering && !readingDeadline.IsZero() && errors.Is(readingCtx.Err(), context.DeadlineExceeded) &&
diff --git a/internal/agentsession/session_format_test.go b/internal/agentsession/session_format_test.go
new file mode 100644
index 0000000000..be89fb69e8
--- /dev/null
+++ b/internal/agentsession/session_format_test.go
@@ -0,0 +1,292 @@
+package agentsession
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/Agent-Field/agentfield/sdk/go/ai"
+	"github.com/Agent-Field/codeaf/internal/catalog"
+	"github.com/Agent-Field/codeaf/internal/config"
+)
+
+func TestForcedSchemaAnswerUsesPublishedNativeFormatting(t *testing.T) {
+	profile := t.TempDir()
+	t.Setenv(config.ProfileDirEnv, profile)
+	t.Setenv("CODEAF_HOME", profile)
+	t.Setenv("CODEAF_BASE_URL", "")
+	if err := catalog.Remember(catalog.Options{Dir: profile}, []catalog.Model{{
+		ID: "vendor/work", Parameters: []string{"response_format", "structured_outputs"},
+	}}); err != nil {
+		t.Fatal(err)
+	}
+	api := (&fakeAPI{}).then(func(body wireRequest) (int, any) {
+		if body.ResponseFormat != nil || len(body.Tools) == 0 {
+			t.Error("the reading turn should keep its tools and ordinary format")
+		}
+		return callTool("read_file", `{"path":"README.md"}`)(body)
+	}).then(func(body wireRequest) (int, any) {
+		if body.ResponseFormat == nil || body.ResponseFormat.Type != "json_schema" || len(body.Tools) != 0 {
+			t.Errorf("the forced answer lacks its native schema: %+v", body.ResponseFormat)
+		} else {
+			want, _ := json.Marshal(findingSchema)
+			if string(body.ResponseFormat.JSONSchema.Schema) != string(want) || body.ResponseFormat.JSONSchema.Strict {
+				t.Error("the answer changed its original schema or imposed a provider's strict-mode dialect")
+			}
+		}
+		return answer(`{"file":"README.md","line":1}`, 0)(body)
+	})
+	policy := testPolicy
+	policy.StructuredAnswers = true
+	result, err := RunSession(t.Context(), api.serve(t), SessionOrder{
+		Root: repo(t), Model: "vendor/work", MaxTurns: 2, Policy: policy, Schema: findingSchema,
+	})
+	if err != nil || result.Failed != "" || len(result.JSON) == 0 || result.Turns != 2 {
+		t.Fatalf("result = %+v, error = %v", result, err)
+	}
+}
+
+func nativeAnswerPolicy() Policy {
+	policy := testPolicy
+	policy.StructuredAnswers = true
+	return policy
+}
+
+func nativeAnswerClient(t *testing.T, api *fakeAPI) *Client {
+	client := api.serve(t)
+	client.retries = 0
+	client.supportsParameter = func(string, string) (bool, bool) { return true, true }
+	return client
+}
+
+func TestNativeAnswerFormattingIsAbsentWhenNotPublishedOrNotOptedIn(t *testing.T) {
+	for _, kind := range []string{"unsupported", "unknown", "JSON objects only", "program not opted in", "plain text"} {
+		t.Run(kind, func(t *testing.T) {
+			api := (&fakeAPI{}).then(func(body wireRequest) (int, any) {
+				if body.ResponseFormat != nil {
+					t.Error("an unrequested or unpublished schema format was sent")
+				}
+				return answer(`{"file":"README.md","line":1}`, 0)(body)
+			})
+			client := nativeAnswerClient(t, api)
+			order := SessionOrder{Root: repo(t), Model: "vendor/work", MaxTurns: 1, Policy: nativeAnswerPolicy(), Schema: findingSchema}
+			switch kind {
+			case "unsupported":
+				client.supportsParameter = func(string, string) (bool, bool) { return false, true }
+			case "unknown":
+				client.supportsParameter = func(string, string) (bool, bool) { return false, false }
+			case "JSON objects only":
+				client.supportsParameter = func(_, parameter string) (bool, bool) { return parameter == "response_format", true }
+			case "program not opted in":
+				order.Policy.StructuredAnswers = false
+			case "plain text":
+				order.Schema = nil
+			}
+			if result, err := RunSession(t.Context(), client, order); err != nil || result.Failed != "" {
+				t.Fatalf("the existing answer path changed: %+v, %v", result, err)
+			}
+		})
+	}
+}
+
+func TestNativeAnswerFallsBackOnceOnlyForExplicitUnsupportedFormatting(t *testing.T) {
+	for _, status := range []int{http.StatusBadRequest, http.StatusUnprocessableEntity} {
+		t.Run(http.StatusText(status), func(t *testing.T) {
+			api := (&fakeAPI{}).then(func(body wireRequest) (int, any) {
+				if body.ResponseFormat == nil || len(body.Tools) != 0 {
+					t.Error("the published native format was not asked without tools")
+				}
+				return status, ai.ErrorResponse{Error: ai.ErrorDetail{Message: "response_format is not supported"}}
+			}).then(func(body wireRequest) (int, any) {
+				if body.ResponseFormat != nil || len(body.Tools) != 0 || !strings.Contains(body.Messages[0].Content[0].Text, `"file"`) {
+					t.Error("the fallback dropped its schema or resumed reading")
+				}
+				return answer(`{"file":"README.md","line":1}`, 0.1)(body)
+			})
+			result, err := RunSession(t.Context(), nativeAnswerClient(t, api), SessionOrder{
+				Root: repo(t), Model: "vendor/work", MaxTurns: 1, Policy: nativeAnswerPolicy(), Schema: findingSchema,
+			})
+			if err != nil || result.Failed != "" || result.Turns != 2 || len(result.JSON) == 0 || result.CostUSD != 0.1 {
+				t.Fatalf("result = %+v, error = %v", result, err)
+			}
+		})
+	}
+}
+
+func TestNativeAnswerDoesNotHideSchemaErrorsOutagesRefusalsOrCallerStops(t *testing.T) {
+	for _, kind := range []string{"invalid schema", "unrelated bad request", "capacity outage", "key refusal", "ceiling", "caller stop"} {
+		t.Run(kind, func(t *testing.T) {
+			ctx, stop := context.WithCancel(t.Context())
+			defer stop()
+			status, message := http.StatusBadRequest, "response_format schema is invalid: missing required"
+			switch kind {
+			case "unrelated bad request":
+				message = "invalid request messages"
+			case "capacity outage":
+				status, message = http.StatusBadGateway, "response_format is not supported; no capacity available"
+			case "key refusal":
+				status, message = http.StatusForbidden, "response_format is not supported; key refused"
+			case "ceiling":
+				status, message = http.StatusPaymentRequired, "response_format is not supported; dollar ceiling"
+			}
+			api := (&fakeAPI{}).then(func(body wireRequest) (int, any) {
+				if body.ResponseFormat == nil {
+					t.Error("native format not requested")
+				}
+				if kind == "caller stop" {
+					stop()
+				}
+				return status, ai.ErrorResponse{Error: ai.ErrorDetail{Message: message}}
+			})
+			client := nativeAnswerClient(t, api)
+			result, err := RunSession(ctx, client, SessionOrder{Root: repo(t), Model: "vendor/work", MaxTurns: 1,
+				Policy: nativeAnswerPolicy(), Schema: findingSchema})
+			if err == nil || result.Failed == "" || result.Turns != 1 || len(result.JSON) != 0 || len(api.bodies) != 1 {
+				t.Fatalf("failure was hidden or bought a fallback: %+v, %v", result, err)
+			}
+			if (kind == "key refusal" || kind == "ceiling") && client.Refusal() == nil {
+				t.Error("the account or ceiling refusal was not retained")
+			}
+		})
+	}
+}
+
+func TestNativeAndFallbackAnswersStillNeedTheOriginalSchema(t *testing.T) {
+	for _, fallback := range []bool{false, true} {
+		t.Run(map[bool]string{false: "native", true: "fallback"}[fallback], func(t *testing.T) {
+			api := &fakeAPI{}
+			if fallback {
+				api.then(func(wireRequest) (int, any) {
+					return 400, ai.ErrorResponse{Error: ai.ErrorDetail{Message: "response_format is not supported"}}
+				})
+			}
+			for range 1 + testPolicy.FollowUps {
+				api.then(func(body wireRequest) (int, any) {
+					if len(body.Tools) != 0 || (body.ResponseFormat == nil) != fallback {
+						t.Error("an answer correction changed its format or resumed tools")
+					}
+					return answer(`{"file":"README.md"}`, 0)(body)
+				})
+			}
+			result, err := RunSession(t.Context(), nativeAnswerClient(t, api), SessionOrder{Root: repo(t), Model: "vendor/work",
+				MaxTurns: 1, Policy: nativeAnswerPolicy(), Schema: findingSchema})
+			wantTurns := 1 + testPolicy.FollowUps
+			if fallback {
+				wantTurns++
+			}
+			if err != nil || result.Failed == "" || len(result.JSON) != 0 || result.Turns != wantTurns {
+				t.Fatalf("invalid JSON was accepted or corrections became unbounded: %+v, %v", result, err)
+			}
+		})
+	}
+}
+
+func TestNativeCompatibilityFallbackDoesNotRepeatASecondRefusal(t *testing.T) {
+	api := &fakeAPI{}
+	for range 2 {
+		api.then(func(wireRequest) (int, any) {
+			return 400, ai.ErrorResponse{Error: ai.ErrorDetail{Message: "response_format is not supported"}}
+		})
+	}
+	result, err := RunSession(t.Context(), nativeAnswerClient(t, api), SessionOrder{Root: repo(t), Model: "vendor/work",
+		MaxTurns: 1, Policy: nativeAnswerPolicy(), Schema: findingSchema})
+	if !errors.Is(err, errResponseFormatUnsupported) || result.Failed == "" || result.Turns != 2 || len(api.bodies) != 2 {
+		t.Fatalf("compatibility bought repeated calls: %+v, %v", result, err)
+	}
+}
+
+func TestNativeFormatRefusalClassificationKeepsInvalidSchemasAndOtherFailures(t *testing.T) {
+	for _, tc := range []struct {
+		name, code, param, message string
+		status                     int
+		want                       bool
+	}{
+		{"structured unsupported", "unsupported_parameter", "response_format", "unavailable field", 400, true},
+		{"invalid schema code wins", "invalid_json_schema", "response_format", "response_format is not supported", 400, false},
+		{"invalid schema words win", "", "", "invalid schema: response_format is not supported", 400, false},
+		{"unsupported keyword", "", "", "unsupported JSON Schema keyword allOf", 400, false},
+		{"unrelated field", "unsupported_parameter", "tools", "tools are not supported", 400, false},
+		{"structured upstream outage", "unsupported_parameter", "response_format", "response_format is not supported", 502, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			raw, _ := json.Marshal(map[string]any{"error": map[string]string{"code": tc.code, "param": tc.param, "message": tc.message}})
+			if got := responseFormatUnsupported(tc.status, raw, tc.message); got != tc.want {
+				t.Fatalf("format refusal = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestNativeCapabilityLookupUsesTheExistingSessionClock(t *testing.T) {
+	start := time.Date(2099, 1, 1, 0, 0, 0, 0, time.UTC)
+	clock := &sessionTestClock{now: start}
+	lookup := func(string, string) (bool, bool) {
+		clock.advance(clock.now.Add(3 * time.Second))
+		return true, true
+	}
+	complete := func(ctx context.Context, request Request) (*ai.Response, error) {
+		deadline, _ := ctx.Deadline()
+		if deadline != start.Add(45*time.Second) || request.ResponseFormat == nil {
+			t.Error("the capability read moved the answer's deadline or lost formatting")
+		}
+		clock.advance(start.Add(7 * time.Second))
+		_, value := answer(`{"file":"README.md","line":1}`, 0)(wireRequest{})
+		response := value.(ai.Response)
+		return &response, nil
+	}
+	result, err := runSession(t.Context(), complete, SessionOrder{Root: repo(t), MaxTurns: 1, Wall: 45 * time.Second,
+		Policy: nativeAnswerPolicy(), Schema: findingSchema, supportsParameter: lookup}, clock.runtime())
+	if err != nil || result.Failed != "" || result.Duration != 7*time.Second {
+		t.Fatalf("capability reads escaped the session clock: %+v, %v", result, err)
+	}
+}
+
+func TestNativeFormatFallbackKeepsTheOriginalAnswerDeadline(t *testing.T) {
+	for _, expires := range []bool{false, true} {
+		t.Run(map[bool]string{false: "answer", true: "deadline"}[expires], func(t *testing.T) {
+			start := time.Date(2099, 1, 1, 0, 0, 0, 0, time.UTC)
+			clock := &sessionTestClock{now: start}
+			calls := 0
+			format := &ai.ResponseFormat{Type: "json_schema"}
+			complete := func(ctx context.Context, request Request) (*ai.Response, error) {
+				calls++
+				deadline, _ := ctx.Deadline()
+				if calls == 1 {
+					clock.advance(deadline)
+					return nil, ctx.Err()
+				}
+				if deadline != start.Add(45*time.Second) || len(request.Tools) != 0 {
+					t.Error("format handling extended the deadline or resumed reading")
+				}
+				if calls == 2 {
+					if request.ResponseFormat != format {
+						t.Error("the reading cutoff lost native formatting")
+					}
+					clock.advance(clock.now.Add(time.Second))
+					return nil, errResponseFormatUnsupported
+				}
+				if request.ResponseFormat != nil {
+					t.Error("the explicit unsupported format was asked again")
+				}
+				if expires {
+					clock.advance(deadline)
+					return nil, ctx.Err()
+				}
+				clock.advance(start.Add(43 * time.Second))
+				_, value := answer(`{"file":"README.md","line":1}`, 0)(wireRequest{})
+				response := value.(ai.Response)
+				return &response, nil
+			}
+			result, err := runSession(t.Context(), complete, SessionOrder{Root: repo(t), MaxTurns: 6, Wall: 45 * time.Second,
+				AnswerReserve: 22500 * time.Millisecond, Policy: nativeAnswerPolicy(), Schema: findingSchema, answerFormat: format}, clock.runtime())
+			if result.Turns != 3 || calls != 3 || (expires && (!errors.Is(err, context.DeadlineExceeded) || result.Failed == "")) ||
+				(!expires && (err != nil || result.Failed != "" || len(result.JSON) == 0 || result.Duration != 43*time.Second)) {
+				t.Fatalf("result = %+v, error = %v, calls = %d", result, err, calls)
+			}
+		})
+	}
+}
diff --git a/internal/agentsession/tools.go b/internal/agentsession/tools.go
index 625bedeaca..174fc6edf4 100644
--- a/internal/agentsession/tools.go
+++ b/internal/agentsession/tools.go
@@ -41,10 +41,28 @@ var skippedDirs = map[string]bool{
 
 // toolbox is the four tools over one repository.
 type toolbox struct {
-	root   string
+	root string
+	// alias is the absolute spelling the caller supplied, when an ancestor
+	// or the root itself is a link. Both names identify the same owned root.
+	alias  string
 	limits ToolLimits
 }
 
+func newToolbox(root string, limits ToolLimits) (toolbox, error) {
+	if strings.TrimSpace(root) == "" {
+		return toolbox{}, errors.New("the repository root is not set")
+	}
+	abs, err := filepath.Abs(root)
+	if err != nil {
+		return toolbox{}, err
+	}
+	real, err := filepath.EvalSymlinks(abs)
+	if err != nil {
+		return toolbox{}, fmt.Errorf("cannot open the repository: %s", plainFSError(err))
+	}
+	return toolbox{root: real, alias: abs, limits: limits}, nil
+}
+
 // definitions is what the model is offered.
 func (t toolbox) definitions() []ai.ToolDefinition {
 	tool := func(name, description string, properties map[string]any, required ...string) ai.ToolDefinition {
@@ -123,6 +141,11 @@ func (t toolbox) resolve(name string) (string, error) {
 	path := name
 	if !filepath.IsAbs(path) {
 		path = filepath.Join(t.root, path)
+	} else if t.alias != "" && within(t.alias, filepath.Clean(path)) {
+		// Translate only the caller's owned root spelling, not an arbitrary
+		// external link into the repository. Keep every escape check below.
+		rel, _ := filepath.Rel(t.alias, filepath.Clean(path))
+		path = filepath.Join(t.root, rel)
 	}
 	path = filepath.Clean(path)
 	if !within(t.root, path) {
diff --git a/internal/config/parameter_test.go b/internal/config/parameter_test.go
new file mode 100644
index 0000000000..958ffe2b73
--- /dev/null
+++ b/internal/config/parameter_test.go
@@ -0,0 +1,76 @@
+package config
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
+	"testing"
+
+	"github.com/Agent-Field/codeaf/internal/catalog"
+	"github.com/Agent-Field/codeaf/internal/modelsource"
+)
+
+func TestCachedSupportsParameterDistinguishesPublishedUnsupportedAndUnknownWithoutFetching(t *testing.T) {
+	var calls atomic.Int32
+	server := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) { calls.Add(1) }))
+	defer server.Close()
+	profile := t.TempDir()
+	t.Setenv(ProfileDirEnv, profile)
+	t.Setenv("CODEAF_HOME", profile)
+	t.Setenv("CODEAF_BASE_URL", server.URL)
+	if err := catalog.Remember(catalog.Options{BaseURL: server.URL, Dir: profile}, []catalog.Model{
+		{ID: "~vendor/latest", Parameters: []string{"response_format", "structured_outputs"}},
+		{ID: "vendor/tools-only", Parameters: []string{"tools"}},
+		{ID: "vendor/unpublished"},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	for _, tc := range []struct {
+		model, parameter string
+		supported, known bool
+	}{
+		{"vendor/latest", "response_format", true, true},
+		{"openrouter/~vendor/latest", "structured_outputs", true, true},
+		{"~vendor/latest:low", "structured_outputs", true, true},
+		{"vendor/tools-only", "response_format", false, true},
+		{"vendor/unpublished", "response_format", false, false},
+		{"vendor/missing", "response_format", false, false},
+		{"", "response_format", false, false},
+		{"vendor/latest", "", false, false},
+	} {
+		if supported, known := CachedSupportsParameter(tc.model, tc.parameter); supported != tc.supported || known != tc.known {
+			t.Errorf("%q %q = %v, %v; want %v, %v", tc.model, tc.parameter, supported, known, tc.supported, tc.known)
+		}
+	}
+	if calls.Load() != 0 {
+		t.Fatalf("a metadata lookup reached the network %d times", calls.Load())
+	}
+}
+
+func TestCachedSupportsParameterUsesTheConnectedServicesOwnCompartment(t *testing.T) {
+	profile := t.TempDir()
+	t.Setenv(ProfileDirEnv, profile)
+	t.Setenv("CODEAF_HOME", profile)
+	t.Setenv("CODEAF_BASE_URL", "")
+	if err := writeProfileValue(profile, keyModelSources, []PersistedSource{{ID: "z-ai", Written: "z-ai", Order: 1}}); err != nil {
+		t.Fatal(err)
+	}
+	var service modelsource.Connected
+	for _, row := range ResolveSources(profile, "", "").All() {
+		if row.Source.ID == "z-ai" {
+			service = row
+		}
+	}
+	if service.Source.ID == "" {
+		t.Fatal("the service metadata did not resolve")
+	}
+	if err := catalog.Remember(CatalogOptionsFor(service, profile), []catalog.Model{{ID: "glm-5.1", Parameters: []string{"tools"}}}); err != nil {
+		t.Fatal(err)
+	}
+	if err := catalog.Remember(catalog.Options{Dir: profile}, []catalog.Model{{ID: "glm-5.1", Parameters: []string{"structured_outputs"}}}); err != nil {
+		t.Fatal(err)
+	}
+	if supported, known := CachedSupportsParameter("z-ai/glm-5.1", "structured_outputs"); supported || !known {
+		t.Fatalf("the other service borrowed default support: %v, %v", supported, known)
+	}
+}
diff --git a/internal/config/window.go b/internal/config/window.go
index 830617fb87..ca9ae2f9d5 100644
--- a/internal/config/window.go
+++ b/internal/config/window.go
@@ -27,12 +27,7 @@ func CachedContextWindow(model string) int {
 	if model == "" {
 		return 0
 	}
-	profileDir := ProfileDir()
-	values, _ := readProfileConfig(profileDir)
-	baseURL := firstNonEmpty(env.Get("CODEAF_BASE_URL"), DefaultBaseURL)
-	noKey := func(PersistedSource, modelsource.Source) string { return "" }
-	sources := sourceHomes(resolveSources("", baseURL, persistedSourcesFrom(values), noKey), profileDir)
-	service, bare := sources.For(model)
+	service, bare, profileDir, baseURL := cachedModelService(model)
 	id := strings.TrimSpace(service.Source.ID)
 	switch {
 	case strings.EqualFold(id, modelsource.DefaultID):
@@ -54,3 +49,29 @@ func CachedContextWindow(model string) int {
 	// (none here) and their client are never used.
 	return catalog.Recall(CatalogOptionsFor(service, profileDir)).ContextLength(bare)
 }
+
+// CachedSupportsParameter reads only the profile's remembered model facts.
+// Unknown or unpublished support stays unknown; no fetch or key lookup is
+// allowed on a carried program's answer path.
+func CachedSupportsParameter(model, parameter string) (supported, known bool) {
+	if strings.TrimSpace(model) == "" || strings.TrimSpace(parameter) == "" {
+		return false, false
+	}
+	service, bare, profileDir, baseURL := cachedModelService(model)
+	if strings.EqualFold(strings.TrimSpace(service.Source.ID), modelsource.DefaultID) {
+		return catalog.Recall(catalog.Options{BaseURL: baseURL, Dir: profileDir}).SupportsParameter(bare, parameter)
+	}
+	return catalog.Recall(CatalogOptionsFor(service, profileDir)).SupportsParameter(bare, parameter)
+}
+
+// cachedModelService resolves only a catalog compartment, with every key
+// lookup disabled. Window and parameter facts must use the same service.
+func cachedModelService(model string) (modelsource.Connected, string, string, string) {
+	profileDir := ProfileDir()
+	values, _ := readProfileConfig(profileDir)
+	baseURL := firstNonEmpty(env.Get("CODEAF_BASE_URL"), DefaultBaseURL)
+	noKey := func(PersistedSource, modelsource.Source) string { return "" }
+	sources := sourceHomes(resolveSources("", baseURL, persistedSourcesFrom(values), noKey), profileDir)
+	service, bare := sources.For(strings.TrimSpace(model))
+	return service, bare, profileDir, baseURL
+}
diff --git a/internal/delegate/delegate.go b/internal/delegate/delegate.go
index 93f311569b..2732769f4b 100644
--- a/internal/delegate/delegate.go
+++ b/internal/delegate/delegate.go
@@ -177,6 +177,10 @@ type Delegate struct {
 	// profile's work seat on the line when they typed nothing. Empty is a
 	// program that takes no model.
 	ModelFlag string
+	// AuxiliaryModelFlags names other model flags the shell resolves through
+	// the same profile. Only an explicitly written value is replaced; these
+	// flags do not choose the run's default work seat.
+	AuxiliaryModelFlags []string
 	// CrewFlags is the flags the default command takes to use the models of
 	// the conversation's crew ([Crew]), which codeaf puts on the line of every
 	// run it starts from a conversation. Nil is a program that picks its own
@@ -376,6 +380,12 @@ func (d Delegate) validateLineFlags() error {
 	if flag := strings.TrimSpace(d.ModelFlag); flag != "" && !parses([]string{"--" + flag, "vendor/model"}) {
 		return fmt.Errorf("%s: the model flag --%s is not a flag its %s command takes", d.Name, flag, command.Name)
 	}
+	for _, declared := range d.AuxiliaryModelFlags {
+		flag := strings.TrimSpace(declared)
+		if flag == "" || !parses([]string{"--" + flag, "vendor/model"}) {
+			return fmt.Errorf("%s: the auxiliary model flag --%s is not a flag its %s command takes", d.Name, flag, command.Name)
+		}
+	}
 	if len(d.PlainFolder) > 0 && !parses(d.PlainFolder) {
 		return fmt.Errorf("%s: the plain folder flags %q are not flags its %s command takes", d.Name, strings.Join(d.PlainFolder, " "), command.Name)
 	}
diff --git a/internal/delegate/model_flags_test.go b/internal/delegate/model_flags_test.go
new file mode 100644
index 0000000000..ed33b3c457
--- /dev/null
+++ b/internal/delegate/model_flags_test.go
@@ -0,0 +1,20 @@
+package delegate
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestAuxiliaryModelFlagsMustBeDeclaredByTheCommand(t *testing.T) {
+	program := testProgram(nil)
+	program.AuxiliaryModelFlags = []string{"variant"}
+	if err := program.Validate(); err != nil {
+		t.Fatalf("a declared model flag was refused: %v", err)
+	}
+	for _, flag := range []string{"missing", ""} {
+		program.AuxiliaryModelFlags = []string{flag}
+		if err := program.Validate(); err == nil || !strings.Contains(err.Error(), "auxiliary model flag") {
+			t.Fatalf("undeclared auxiliary flag %q was not refused: %v", flag, err)
+		}
+	}
+}
diff --git a/internal/manual/chat/review.md b/internal/manual/chat/review.md
index bf276a0966..f5433a77d9 100644
--- a/internal/manual/chat/review.md
+++ b/internal/manual/chat/review.md
@@ -47,6 +47,12 @@ Its stages are on the rail and head the lines of its page:
 
 Each reviewer is an agent session that reads the checkout, told it is part of a code review, with four read-only tools — read a file, list a folder, find files by name, look for text in files — within the turns and minutes its part of the review is given — from ten turns for the smallest to thirty for a reviewer. It reserves thirty seconds of its time limit for the answer, or half the remaining time when the limit is shorter than a minute. At the reading cutoff it stops reading and answers from what it has already found; the answer must still finish within the original time limit. At a shell, `--max-turns` and `--session-wall` set one limit for every reviewer instead. A review of a mid-sized pull request commonly takes half an hour to an hour.
 
+A linked path to the repository is accepted as the same reading root. Files and links that lead outside that root are still refused.
+
+## Final answers — JSON Schema, supported response formats, unsupported endpoints
+
+Review's agents ask for a native schema-bound format on their final answers when the profile's cached model catalog publishes support. Reading turns keep their read-only tools. When support is unknown or absent, the schema stays in the prompt. An endpoint that explicitly refuses that format gets one prompt-only fallback inside the existing turn and time limits. Every answer is still checked against the original schema; invalid schemas, account refusals, provider outages and cancellation do not buy a formatting fallback.
+
 ## What /review shows while it runs — each reviewer's line, what it found, which files
 
 Its page shows each stage once as the review enters it, then one line per finished step under it with what it found: `reviewed internal/auth/middleware.go, internal/auth/token.go and 2 more` · `3 findings`, and the step opened shows the first findings by title. A step that failed says `failed` and why. `ctrl+y` shows the raw model calls.
@@ -74,6 +80,8 @@ It keeps three minutes of its time ceiling back to write its review. **A review
 
 **Which models.** From the chat, the conversation's working seat reads the code and its light seat makes the single structured calls; a model you name for the hand-off reads the code instead. At a shell, `--model` and `--light` name them, else the profile's work seat does both.
 
+Both flags resolve model words through the profile's catalog, including floating aliases and provider-qualified names. An unknown model word is refused before any model call starts.
+
 ## Fixing what /review found — hand the findings to senior-dev, fix the blocking findings
 
 When the review found something, the chat also offers to hand the blocking findings to senior-dev as one piece of work, when the conversation's folder is the pull request's checkout, and names which. It starts nothing until you say yes. You can also ask directly: "fix the two blocking findings with senior-dev".
diff --git a/internal/manual/chat/sec.md b/internal/manual/chat/sec.md
index 8d2471ab83..213ae6e3aa 100644
--- a/internal/manual/chat/sec.md
+++ b/internal/manual/chat/sec.md
@@ -98,6 +98,8 @@ What a run spends depends on the repository and the models: a `quick` audit of a
 
 **Which models.** From the chat, the conversation's working seat reads the code and its light seat makes the single quick calls (merging duplicates, the compliance mapping). A model you name for the hand-off reads the code in place of the working seat. At a shell, the profile's work seat does both unless `--model` (and `--light`) name others.
 
+Both flags resolve model words through the profile's catalog, including floating aliases and provider-qualified names. An unknown model word is refused before any model call starts. A linked path to the repository is accepted as the same reading root; files and links that lead outside that root are still refused.
+
 ## Fixing what sec found — hand the findings to senior-dev, fix the vulnerabilities
 
 When the audit finds confirmed or likely problems, the chat offers to hand them to senior-dev as one task that fixes them, and names which. It starts nothing until you say yes; then it proposes that task, and you answer its card as usual. You can also ask directly: "fix the two critical findings with senior-dev".
diff --git a/internal/praf/limits.go b/internal/praf/limits.go
index 1065e11245..0f19a9b73c 100644
--- a/internal/praf/limits.go
+++ b/internal/praf/limits.go
@@ -59,6 +59,7 @@ const retries = 2
 // own: agentsession has no defaults, so that nothing tuned for sec's agents
 // reaches review's, or the reverse.
 var sessionPolicy = agentsession.Policy{
+	StructuredAnswers: true,
 	// Asks for an answer of the right shape after one that was not.
 	FollowUps: 2,
 	// About a hundred thousand tokens, which every model a person is likely to
diff --git a/internal/praf/praf.go b/internal/praf/praf.go
index 47e78c514d..82fd4e229d 100644
--- a/internal/praf/praf.go
+++ b/internal/praf/praf.go
@@ -77,13 +77,14 @@ var Program = delegate.Delegate{
 		"`post <the review-report.json path from the account>`), or handing the blocking findings to senior-dev as " +
 		"one task that fixes them in this folder when it is the pull request's checkout, naming which. " +
 		"Propose neither before they say yes to it.",
-	ModelFlag:  "model",
-	CrewFlags:  crewFlags,
-	StageWords: stageWords,
-	Present:    presentActions,
-	Default:    "run",
-	Page:       Name,
-	Commands:   []delegate.Command{runCommand},
+	ModelFlag:           "model",
+	AuxiliaryModelFlags: []string{"light"},
+	CrewFlags:           crewFlags,
+	StageWords:          stageWords,
+	Present:             presentActions,
+	Default:             "run",
+	Page:                Name,
+	Commands:            []delegate.Command{runCommand},
 }
 
 // title is a typed run's title.
diff --git a/internal/secaf/secaf.go b/internal/secaf/secaf.go
index 6572a9e36b..345692e9e0 100644
--- a/internal/secaf/secaf.go
+++ b/internal/secaf/secaf.go
@@ -99,13 +99,14 @@ var Program = delegate.Delegate{
 	// the person's money, so the conversation offers it and waits.
 	FollowUp: "If it found confirmed or likely problems, offer to hand them to senior-dev as one task that fixes them, " +
 		"naming which; propose that task only after the person says yes.",
-	ModelFlag:  "model",
-	CrewFlags:  crewFlags,
-	StageWords: stageWords,
-	Present:    presentActions,
-	Default:    "run",
-	Page:       Name,
-	Commands:   []delegate.Command{runCommand},
+	ModelFlag:           "model",
+	AuxiliaryModelFlags: []string{"light"},
+	CrewFlags:           crewFlags,
+	StageWords:          stageWords,
+	Present:             presentActions,
+	Default:             "run",
+	Page:                Name,
+	Commands:            []delegate.Command{runCommand},
 }
 
 // crewFlags is the conversation's crew as the audit's own flags: the working