[SaladDay]

User-managed workspaces can use the same Claude structured-output and deferred-function discovery path as managed workspaces, plus Codex/Claude PNG/JPEG message input and Claude successful image function results. Core admission follows the qualified operation rather than Environment ownership; adapters retain native restrictions and execution semantics.

All three adapters consume one Runtime-owned MCP binding. MiniMax supports installed anonymous HTTP and selected HTTPS bearer MCP. Its native workspace profile now references the Runtime-owned frozen tool-environment file instead of copying credentials into native state. Missing or malformed snapshots fail explicitly. The daemon stop command allows ten seconds for confirmed native cleanup, covering the existing native three-second grace period.

Validation

• Real pinned official-client → Core → native Linux Runtime → Kimi K3 / MiniMax-M2.7: image messages, Claude image callback validation/retries/history, structured output, ToolSearch callbacks, cold continuation and cancellation pass.
• Freshly rebuilt MiniMax native CLI/companion and daemon: anonymous/authenticated HTTP MCP, cold continuation and active-call cancellation pass. Every native state file was scanned for the selected bearer; the profile contains only a Runtime snapshot reference. The original narrower scan missed an extra credential copy; independent review found it, and the fix has its own complete real acceptance record.
• Focused Go image/persistence, MiniMax/Runtime snapshot and Node launcher tests pass; generated OpenAPI/docs and naming/catalog checks pass. Fresh independent full-diff review found no blocking issue; its remaining documentation correction was applied and regenerated.
• Final HEAD 7d11b2261293ee8919376a3eda5fbe6abf85ea53: full make check, official-client and Linux/macOS/Windows native CI all pass. The previous merged-tree check exposed duplicate reset SQL assignments introduced by the concurrent main merge; the source query was corrected, sqlc regenerated, and reset/switch regression tests pass without changing their time budgets.

See the qualification record for exact Sessions, retained failed attempts and limitations. Public environment-origin MCP, public MiniMax MCP, MiniMax images, and discovery with Skills/Plugins/MCP remain outside this batch. Existing general pending-input cancellation limitations are recorded there. No Core proxy, replacement model loop, migration or compatibility layer is added.

PR #246 is merged and this PR targets main. Only owned acceptance services were updated; production deployments, Release artifacts and MX1/MX2 were not updated.