diff --git a/backend/agents/create_agent_info.py b/backend/agents/create_agent_info.py
index c23e75d5d8..f86e84770f 100644
--- a/backend/agents/create_agent_info.py
+++ b/backend/agents/create_agent_info.py
@@ -11,6 +11,13 @@
 from typing import Any, Dict, List, Optional
 from urllib.parse import urljoin
 
+from nexent.core.model_service.compatibility.legacy_config import (
+    COMMON_REASONING_LEVELS,
+    legacy_extra_body,
+    legacy_reasoning_budget,
+    legacy_reasoning_effort,
+    legacy_thinking_enabled,
+)
 from nexent.core.utils.observer import MessageObserver
 from nexent.core.agents.prompt.user_context import render_user_context
 from nexent.core.concurrency import run_blocking
@@ -52,7 +59,7 @@
 from database.a2a_agent_db import PROTOCOL_JSONRPC
 from management.services.configuration.user.memory import build_memory_context
 from management.services.knowledge_base.providers.aidp import create_ind_aidp_image_url_builder
-from management.services.model.adapter import get_llm_adapter, get_vlm_adapter
+from management.services.model.adapter import get_llm_adapter, get_vlm_adapter, restore_model_snapshot
 from database.agent_db import (
     search_agent_info_by_agent_id,
     query_sub_agent_relations,
@@ -192,6 +199,7 @@ def _ensure_agent_reasoning_snapshot(
             requested_overrides=current_overrides,
             existing_overrides=current_overrides,
             tenant_id=agent_info.get("tenant_id") or tenant_id,
+            normalize_profiles=False,
         )
         if updated_overrides == current_overrides:
             return
@@ -286,40 +294,6 @@ def _build_effective_knowledge_base_summary(
     "tokenizer_family",
 )
 
-COMMON_REASONING_LEVELS = ("low", "medium", "high")
-COMMON_REASONING_DEFAULT = "auto"
-
-def _is_thinking_enabled(extra_params: Optional[Dict[str, Any]]) -> bool:
-    """Return whether the model explicitly or implicitly enables reasoning."""
-    if not isinstance(extra_params, dict):
-        return False
-    if isinstance(extra_params.get("enable_thinking"), bool):
-        return extra_params["enable_thinking"]
-    return (
-        isinstance(extra_params.get("reasoning_effort"), str)
-        or isinstance(extra_params.get("reasoning_budget_tokens"), int)
-    )
-
-
-def _build_extra_body(extra_params: Optional[Dict[str, Any]]) -> Optional[Dict[str, Any]]:
-    """Build extra_body for ModelConfig from model_record_t.extra_params.
-
-    Merges __custom__ user-defined params into the top level so they flow
-    into OpenAI chat.completions.create request body. Returns None when
-    there is nothing to pass through so production behaviour is unchanged.
-    """
-    if not extra_params or not isinstance(extra_params, dict):
-        return None
-    extra_body = dict(extra_params)
-    # These are dedicated ModelConfig fields, not provider request-body keys.
-    extra_body.pop("reasoning_effort", None)
-    extra_body.pop("reasoning_budget_tokens", None)
-    custom = extra_body.pop("__custom__", None)
-    if custom and isinstance(custom, dict):
-        extra_body.update(custom)
-    return extra_body if extra_body else None
-
-
 def _resolve_reasoning_capability(
     model_name: str,
     base_url: Optional[str],
@@ -337,56 +311,6 @@ def _resolve_reasoning_capability(
     )
 
 
-def _resolve_model_reasoning_effort(
-    extra_params: Optional[Dict[str, Any]],
-    capability: Optional[Dict[str, Any]],
-) -> Optional[str]:
-    """Resolve the enabled model's effort from its supported profile."""
-    if not isinstance(extra_params, dict) or not _is_thinking_enabled(extra_params):
-        return None
-    if extra_params.get("reasoning_effort") == "auto":
-        return None
-    if isinstance(capability, dict) and capability.get("status") == "supported":
-        levels = capability.get("levels") or list(COMMON_REASONING_LEVELS)
-        default = capability.get("default")
-        if default not in levels:
-            default = COMMON_REASONING_DEFAULT
-    else:
-        # Unknown/custom model IDs still use the common generic profile. The
-        # provider remains the source of truth when a concrete value is sent.
-        levels = list(COMMON_REASONING_LEVELS)
-        default = COMMON_REASONING_DEFAULT
-    saved = extra_params.get("reasoning_effort")
-    if saved in levels:
-        return saved
-    # Auto is the universal fallback: omit the provider-specific effort so the
-    # model can choose its own reasoning depth.
-    return None if saved is None or default == COMMON_REASONING_DEFAULT else default
-
-
-def _resolve_model_reasoning_budget(
-    extra_params: Optional[Dict[str, Any]],
-    capability: Optional[Dict[str, Any]],
-) -> Optional[int]:
-    """Resolve a persisted numeric reasoning budget within the source range."""
-    if not isinstance(extra_params, dict) or not _is_thinking_enabled(extra_params):
-        return None
-    value = extra_params.get("reasoning_budget_tokens")
-    if isinstance(value, bool) or not isinstance(value, int) or value <= 0:
-        return None
-    controls = capability.get("controls") if isinstance(capability, dict) else None
-    budget_control = next(
-        (control for control in controls or []
-         if isinstance(control, dict) and control.get("type") == "budget_tokens"),
-        None,
-    )
-    if isinstance(budget_control, dict):
-        minimum = budget_control.get("min")
-        maximum = budget_control.get("max")
-        if isinstance(minimum, int) and isinstance(maximum, int):
-            return min(maximum, max(minimum, value))
-    return value
-
 # Per-process dedup for the "model has no capacity configured" warning.
 # Without this, every agent run logs the same line, drowning real signal.
 # Keyed by model_id; cleared only on process restart.
@@ -443,6 +367,9 @@ def _operator_overrides_from_model_info(model_info: Optional[dict]) -> dict:
         value = model_info.get(field)
         if value is not None:
             overrides[field] = value
+    if (model_info.get("profile_schema_version") is not None
+            and model_info.get("default_max_output_tokens") is not None):
+        overrides["default_output_reserve_tokens"] = model_info["default_max_output_tokens"]
     return overrides
 
 
@@ -495,6 +422,14 @@ def _dominant_capacity_source(field_sources: dict) -> Optional[str]:
     return values[0]
 
 
+def _runtime_capacity_overrides(agent_info, model_id, runtime_output_tokens):
+    """Use the validated root preference as this run's baseline, retaining hard limits."""
+    overrides = _agent_capacity_overrides(agent_info, model_id)
+    if runtime_output_tokens is not None:
+        overrides["default_output_reserve_tokens"] = runtime_output_tokens
+    return overrides
+
+
 def _capacity_snapshot_for_monitoring(snapshot: Any) -> dict:
     data = snapshot.model_dump() if hasattr(snapshot, "model_dump") else dict(snapshot)
     return {
@@ -601,11 +536,18 @@ def _resolve_input_budget(
         operator_overrides = _operator_overrides_from_model_info(model_info)
         if capacity_overrides:
             operator_overrides.update(capacity_overrides)
+            # A smaller Agent window also bounds inherited service limits in this
+            # run's budget view; the saved outlet and its hard limits stay intact.
+            window = capacity_overrides.get("context_window_tokens")
+            if model_info.get("profile_schema_version") is not None and type(window) is int:
+                for key in ("max_input_tokens", "max_output_tokens"):
+                    if key not in capacity_overrides and type(operator_overrides.get(key)) is int:
+                        operator_overrides[key] = min(operator_overrides[key], window)
         snapshot = resolve_capacity(
             model_id=model_id,
             provider=provider,
             operator_overrides=operator_overrides,
-            capability_profiles=CAPABILITY_CATALOG,
+            capability_profiles={} if model_info.get("profile_schema_version") is not None else CAPABILITY_CATALOG,
         )
         logger.debug(
             "Capacity resolved for (%s, %s): input_limit=%s source=%s profile=%s fingerprint=%s",
@@ -1204,8 +1146,39 @@ def _get_skill_script_tools(
         return []
 
 
+def _resolved_model_config(record, snapshot, cite_name=None):
+    """Map one frozen outlet into the existing Agent configuration contract."""
+    from services.model_outlet_projection import project_saved_outlet
+
+    output_reserve = snapshot.parameter_values.get("max_output_tokens")
+    if output_reserve is None:
+        output_reserve = snapshot.context_configuration.output_reserve_tokens
+    return ModelConfig(
+        cite_name=cite_name if cite_name is not None else record["display_name"], api_key=record.get("api_key") or "",
+        model_name=snapshot.identity.request_model_id, url=snapshot.connection.base_url,
+        resolved_profile=snapshot, model_factory=snapshot.identity.provider_id,
+        reasoning_capability=project_saved_outlet(record)["reasoning_capability"],
+        temperature=snapshot.parameter_values.get("temperature"), top_p=snapshot.parameter_values.get("top_p"),
+        enable_thinking=snapshot.parameter_values.get("enable_thinking") is True,
+        reasoning_effort=(snapshot.parameter_values.get("reasoning_effort")
+                          if snapshot.parameter_values.get("reasoning_effort") in
+                          {"auto", "none", "minimal", "low", "medium", "high", "xhigh", "max"} else None),
+        reasoning_budget_tokens=snapshot.parameter_values.get("reasoning_budget_tokens"),
+        context_window_tokens=snapshot.capabilities.context.combined_window,
+        max_input_tokens=snapshot.capabilities.context.input_limit,
+        max_output_tokens=snapshot.capabilities.context.output_limit,
+        default_output_reserve_tokens=output_reserve,
+        tokenizer_family=snapshot.context_configuration.tokenizer_family,
+        capacity_source=snapshot.context_configuration.capacity_source,
+        capability_profile_version=snapshot.context_configuration.capability_profile_version,
+    )
+
+
 def create_model_config_from_record(record):
     """Build a complete provider binding from one exact tenant model record."""
+    snapshot = restore_model_snapshot(record, record.get("tenant_id"))
+    if snapshot is not None:
+        return _resolved_model_config(record, snapshot)
     model_name = add_repo_to_name(
         model_repo=record["model_repo"],
         model_name=record["model_name"],
@@ -1240,50 +1213,48 @@ def create_model_config_from_record(record):
                         # temperature/top_p/extra_params flow into SDK.
                         temperature=record.get("temperature"),
                         top_p=record.get("top_p"),
-                        enable_thinking=_is_thinking_enabled(record.get("extra_params")),
+                        enable_thinking=legacy_thinking_enabled(record.get("extra_params")),
                         reasoning_capability=reasoning_capability,
-                        reasoning_effort=_resolve_model_reasoning_effort(
+                        reasoning_effort=legacy_reasoning_effort(
                             record.get("extra_params"), reasoning_capability
                         ),
-                        reasoning_budget_tokens=_resolve_model_reasoning_budget(
+                        reasoning_budget_tokens=legacy_reasoning_budget(
                             record.get("extra_params"), reasoning_capability
                         ),
-                        extra_body=_build_extra_body(record.get("extra_params")))
+                        extra_body=legacy_extra_body(record.get("extra_params")))
 
 
 async def create_model_config_list(tenant_id):
     records = get_model_records({"model_type": "llm"}, tenant_id)
-    model_list = [create_model_config_from_record(record) for record in records]
+    model_list = [create_model_config_from_record(record) for record in records if record.get("model_id") is None or record.get("profile_schema_version") is not None]
     extra_body = {"logprobs": True} if LLM_INCLUDE_LOGPROBS else None
     # fit for old version, main_model and sub_model use default model
     main_model_config = tenant_config_manager.get_model_config(
         key=MODEL_CONFIG_MAPPING["llm"], tenant_id=tenant_id)
-    main_prompt_cache = resolve_prompt_cache_profile(
-        main_model_config.get("model_factory"))
-    model_list.append(
-        ModelConfig(cite_name="main_model",
-                    api_key=main_model_config.get("api_key", ""),
-                    model_name=get_model_name_from_config(main_model_config) if main_model_config.get(
-                        "model_name") else "",
-                    url=main_model_config.get("base_url", ""),
-                    ssl_verify=main_model_config.get("ssl_verify", True),
-                    model_factory=main_model_config.get("model_factory"),
-                    timeout_seconds=main_model_config.get("timeout_seconds"),
-                    concurrency_limit=main_model_config.get("concurrency_limit"),
-                    prompt_cache=main_prompt_cache,
-                    extra_body=extra_body))
-    model_list.append(
-        ModelConfig(cite_name="sub_model",
-                    api_key=main_model_config.get("api_key", ""),
-                    model_name=get_model_name_from_config(main_model_config) if main_model_config.get(
-                        "model_name") else "",
-                    url=main_model_config.get("base_url", ""),
-                    ssl_verify=main_model_config.get("ssl_verify", True),
-                    model_factory=main_model_config.get("model_factory"),
-                    timeout_seconds=main_model_config.get("timeout_seconds"),
-                    concurrency_limit=main_model_config.get("concurrency_limit"),
-                    prompt_cache=main_prompt_cache,
-                    extra_body=extra_body))
+    # Reuse the row already captured for this run, including its credential and revision.
+    if main_model_config.get("profile_schema_version") is not None:
+        main_model_config = next((record for record in records
+                                  if record.get("model_id") == main_model_config.get("model_id")), main_model_config)
+    if (main_model_config.get("model_id") is not None
+            and main_model_config.get("profile_schema_version") is None):
+        # A failed default outlet is not an implicit fallback for a selected outlet.
+        return model_list
+    main_snapshot = restore_model_snapshot(main_model_config, tenant_id)
+    if main_snapshot is not None:
+        model_list.extend(_resolved_model_config(main_model_config, main_snapshot, cite_name=alias)
+                          for alias in ("main_model", "sub_model"))
+    else:
+        main_prompt_cache = resolve_prompt_cache_profile(main_model_config.get("model_factory"))
+        for alias in ("main_model", "sub_model"):
+            model_list.append(ModelConfig(
+                cite_name=alias, api_key=main_model_config.get("api_key", ""),
+                model_name=get_model_name_from_config(main_model_config) if main_model_config.get("model_name") else "",
+                url=main_model_config.get("base_url", ""), ssl_verify=main_model_config.get("ssl_verify", True),
+                model_factory=main_model_config.get("model_factory"),
+                timeout_seconds=main_model_config.get("timeout_seconds"),
+                concurrency_limit=main_model_config.get("concurrency_limit"),
+                prompt_cache=main_prompt_cache, extra_body=extra_body,
+            ))
 
     return model_list
 
@@ -1347,6 +1318,8 @@ async def create_agent_config(
     runtime_skill_snapshot: Optional[List[Dict[str, Any]]] = None,
     runtime_knowledge_tools: Optional[List[Dict[str, Any]]] = None,
     runtime_sub_agent_mounts: Optional[List[Dict[str, Any]]] = None,
+    runtime_model_records: Optional[Dict[int, Dict[str, Any]]] = None,
+    runtime_output_tokens: int | None = None,
 ):
     normalized_tool_params = _normalize_tool_params_request(tool_params)
     agent_info = search_agent_info_by_agent_id(
@@ -1394,6 +1367,7 @@ async def create_agent_config(
             runtime_file_context=runtime_file_context,
             # Workbench overlays replace Skills on the effective root only.
             runtime_skill_snapshot=None,
+            runtime_model_records=runtime_model_records,
         )
         # Persisted Agent relations are rendered into the manager prompt by
         # their configured business name. Keep the callable registered in the
@@ -1428,6 +1402,7 @@ async def create_agent_config(
             runtime_knowledge_context=child_knowledge_context,
             runtime_file_context=runtime_file_context,
             runtime_skill_snapshot=None,
+            runtime_model_records=runtime_model_records,
             runtime_knowledge_tools=None,
             runtime_sub_agent_mounts=None,
         )
@@ -1807,7 +1782,10 @@ async def create_agent_config(
     model_id_to_use = _select_agent_model_id(agent_model_ids, override_model_id, tenant_id)
     model_info = None
     if model_id_to_use is not None:
-        model_info = get_model_by_model_id(model_id_to_use, tenant_id=tenant_id)
+        model_info = (runtime_model_records.get(model_id_to_use) if runtime_model_records is not None
+                      else get_model_by_model_id(model_id_to_use, tenant_id=tenant_id))
+        if model_info is None and override_model_id is not None:
+            raise ValidationError("MODEL_OUTLET_NOT_AVAILABLE")
         model_name = model_info["display_name"] if model_info is not None else "main_model"
         # W1 step 6: derive input budget via ModelCapacityResolver instead of
         # treating model_info["max_tokens"] (a deprecated output cap) as a
@@ -1817,8 +1795,8 @@ async def create_agent_config(
         input_budget, capacity_snapshot, resolved_capacity_snapshot = (
             _resolve_input_budget(
                 model_info,
-                capacity_overrides=_agent_capacity_overrides(
-                    agent_info, model_id_to_use),
+                capacity_overrides=_runtime_capacity_overrides(
+                    agent_info, model_id_to_use, runtime_output_tokens),
             )
         )
     else:
@@ -1827,7 +1805,8 @@ async def create_agent_config(
         capacity_snapshot = None
         resolved_capacity_snapshot = None
 
-    requested_output_tokens = agent_info.get("requested_output_tokens")
+    requested_output_tokens = (runtime_output_tokens if runtime_output_tokens is not None
+                               else agent_info.get("requested_output_tokens"))
     context_budget_snapshot = _resolve_context_budget(
         capacity_snapshot=resolved_capacity_snapshot,
         tenant_id=tenant_id,
@@ -2585,23 +2564,32 @@ def check_agent_tools(agent_config: AgentConfig):
     return list(used_mcp_urls)
 
 
-def apply_root_generation_overlay(
-    model_list: List[ModelConfig],
-    agent_config: AgentConfig,
-    generation_config: Optional[Dict[str, Any]],
-) -> None:
-    """Add a root-only model alias without changing child Agent aliases."""
-    if not generation_config:
+def apply_root_model_preferences(model_list, agent_config, preferences, *, outlet_profiles=None, agent_overrides=None):
+    """Give the root a private alias; never change a child Agent's model defaults."""
+    if not preferences:
         return
-    from management.services.model.run_controls import overlay_root_model
-    for model_config in model_list:
-        if model_config.cite_name != agent_config.model_name:
+    from services.conversation_model_preferences_service import merge_model_preferences
+
+    for configured in model_list:
+        profile = getattr(configured, "resolved_profile", None)
+        if configured.cite_name != agent_config.model_name or profile is None:
             continue
-        root_model = overlay_root_model(
-            model_config, generation_config, "workbench_root_model",
-        )
-        model_list.append(root_model)
-        agent_config.model_name = root_model.cite_name
+        values = preferences.get(str(profile.outlet_id))
+        if values is None:
+            return
+        original = (outlet_profiles or {}).get(profile.outlet_id)
+        if original is not None:
+            from services.agent_model_parameters import merge_runtime_model_parameters
+
+            resolved = merge_runtime_model_parameters(original, (agent_overrides or {}).get(str(profile.outlet_id), {}), values)
+        else:
+            resolved = merge_model_preferences(profile, values)
+        root = configured.model_copy(deep=True, update={"cite_name": "conversation_root_model_" + uuid.uuid4().hex,
+            "resolved_profile": resolved,
+            "default_output_reserve_tokens": resolved.parameter_values.get("max_output_tokens",
+                configured.default_output_reserve_tokens)})
+        model_list.append(root)
+        agent_config.model_name = root.cite_name
         return
 
 
@@ -2617,8 +2605,6 @@ async def create_agent_run_info(
     is_debug: bool = False,
     override_version_no: int | None = None,
     override_model_id: int | None = None,
-    reasoning_effort: str | None = None,
-    reasoning_budget_tokens: int | None = None,
     requested_output_tokens: int | None = None,
     tool_params: Optional[ToolParamsRequest | Dict[str, Any]] = None,
     conversation_id: Optional[int] = None,
@@ -2628,8 +2614,8 @@ async def create_agent_run_info(
     runtime_knowledge_context: Optional[Dict[str, str]] = None,
     runtime_skill_snapshot: Optional[List[Dict[str, Any]]] = None,
     runtime_knowledge_tools: Optional[List[Dict[str, Any]]] = None,
-    runtime_generation_config: Optional[Dict[str, Any]] = None,
     runtime_sub_agent_mounts: Optional[List[Dict[str, Any]]] = None,
+    model_parameter_preferences: Optional[Dict[str, Dict[str, Any]]] = None,
 ):
     if override_model_id is not None:
         from management.services.model.run_controls import validate_selected_record
@@ -2713,6 +2699,33 @@ async def create_agent_run_info(
         create_config_kwargs["runtime_knowledge_tools"] = runtime_knowledge_tools
     if runtime_sub_agent_mounts is not None:
         create_config_kwargs["runtime_sub_agent_mounts"] = runtime_sub_agent_mounts
+    from nexent.core.model_service.profiles.outlet_storage import encode_resolved_model_profile
+    from nexent.core.model_service.profiles.resolved_profile import ResolvedModelProfile
+    captured_records = {}
+    outlet_profiles = {}
+    for configured in model_list:
+        if isinstance(getattr(configured, "resolved_profile", None), ResolvedModelProfile):
+            from nexent.core.model_service.registry import model_service_references
+
+            outlet_profiles[configured.resolved_profile.outlet_id] = configured.resolved_profile
+            captured = encode_resolved_model_profile(configured.resolved_profile, registered_references=model_service_references())
+            if captured.get("model_id") is not None:
+                captured_records[captured["model_id"]] = captured
+    if captured_records:
+        create_config_kwargs["runtime_model_records"] = captured_records
+    if model_parameter_preferences:
+        selected_info = search_agent_info_by_agent_id(agent_id=agent_id, tenant_id=tenant_id, version_no=version_no)
+        selected_id = _select_agent_model_id((selected_info or {}).get("model_ids") or [], override_model_id, tenant_id)
+        selected_preferences = model_parameter_preferences.get(str(selected_id), {})
+        if selected_preferences.get("max_output_tokens") is not None:
+            from services.conversation_model_preferences_service import merge_model_preferences
+
+            for configured in model_list:
+                profile = getattr(configured, "resolved_profile", None)
+                if isinstance(profile, ResolvedModelProfile) and profile.outlet_id == selected_id:
+                    validated = merge_model_preferences(profile, selected_preferences)
+                    create_config_kwargs["runtime_output_tokens"] = validated.parameter_values["max_output_tokens"]
+                    break
     agent_config = await create_agent_config(**create_config_kwargs, tool_params=tool_params)
 
     # v2.6.0: Apply per-agent model params override to model_config_list.
@@ -2723,6 +2736,11 @@ async def create_agent_run_info(
     _agent_info_for_override = search_agent_info_by_agent_id(
         agent_id=agent_id, tenant_id=tenant_id, version_no=version_no)
     model_params_override = (_agent_info_for_override or {}).get("model_params_override") or {}
+    from services.agent_model_parameters import bind_agent_model_profiles
+
+    bind_agent_model_profiles(model_list, agent_config, _agent_info_for_override or {},
+        lambda selected_agent_id, selected_version: search_agent_info_by_agent_id(
+            agent_id=selected_agent_id, tenant_id=tenant_id, version_no=selected_version))
     if model_params_override:
         for model_id_str, override_entry in model_params_override.items():
             if not isinstance(override_entry, dict):
@@ -2738,6 +2756,8 @@ async def create_agent_run_info(
             if not display_name:
                 continue
             for mc in model_list:
+                if isinstance(getattr(mc, "resolved_profile", None), ResolvedModelProfile):
+                    continue  # Saved outlets were bound independently for each Agent above.
                 if mc.cite_name == display_name:
                     if override_entry.get("temperature") is not None:
                         mc.temperature = override_entry["temperature"]
@@ -2789,31 +2809,6 @@ async def create_agent_run_info(
                         if isinstance(budget, int) and not isinstance(budget, bool) and budget > 0:
                             mc.reasoning_budget_tokens = budget
                     break
-    # Request-scoped Workbench settings apply only to the root model. Static
-    # children retain the model aliases from their published versions.
-    # Static children keep their published aliases and never inherit this overlay.
-    apply_root_generation_overlay(
-        model_list,
-        agent_config,
-        runtime_generation_config,
-    )
-
-    # Legacy top-level fields use the same capability policy as generation overlays.
-    if reasoning_effort is not None or reasoning_budget_tokens is not None:
-        from management.services.model.run_controls import overlay_root_model
-        selected_config = next((m for m in model_list if m.cite_name == agent_config.model_name), None)
-        if selected_config is None:
-            from consts.exceptions import RunModelControlsError
-            raise RunModelControlsError("model_not_available")
-        legacy = {}
-        if reasoning_effort is not None:
-            legacy["thinking_effort"] = reasoning_effort
-        if reasoning_budget_tokens is not None:
-            legacy["reasoning_budget_tokens"] = reasoning_budget_tokens
-        overlay = overlay_root_model(selected_config, legacy, selected_config.cite_name)
-        index = model_list.index(selected_config)
-        model_list[index] = overlay
-
     remote_mcp_list = await get_remote_mcp_server_list(tenant_id=tenant_id, is_need_auth=True)
     default_mcp_url = get_tenant_local_mcp_server(tenant_id)
     remote_mcp_list.append({
@@ -2900,6 +2895,9 @@ async def create_agent_run_info(
                 "shared_workspace": True,
             })
 
+    apply_root_model_preferences(model_list, agent_config, model_parameter_preferences,
+        outlet_profiles=outlet_profiles, agent_overrides=model_params_override)
+
     agent_run_info = AgentRunInfo(
         query=final_query,
         model_config_list=model_list,
diff --git a/backend/apps/agent_app.py b/backend/apps/agent_app.py
index d2475eaed9..d0fc360976 100644
--- a/backend/apps/agent_app.py
+++ b/backend/apps/agent_app.py
@@ -9,6 +9,7 @@
 from fastapi import APIRouter, Body, Depends, File, Header, HTTPException, Query, Request, UploadFile
 from fastapi.encoders import jsonable_encoder
 from nexent.core.concurrency import run_blocking
+from nexent.core.model_service.profiles.parameter_schema import ParameterValidationError
 from starlette.responses import JSONResponse, Response, StreamingResponse
 
 from consts.const import ASSET_OWNER_TENANT_ID, ENABLE_AGENT_WORKBENCH
@@ -356,6 +357,13 @@ async def nl2agent_run_api(
         _, tenant_id, language = get_current_user_info(
             authorization, http_request
         )
+        if nl2agent_request.conversation_id is not None:
+            from services.conversation_model_preferences_service import read_model_preferences
+            preference_user, _ = get_current_user_id(authorization)
+            saved = await run_blocking("creator-model-preferences", read_model_preferences, nl2agent_request.conversation_id, preference_user)
+            nl2agent_request.__dict__["_runtime_model_parameter_preferences"] = saved["model_parameter_preferences"]
+            if nl2agent_request.model_id is None:
+                nl2agent_request.model_id = saved.get("selected_model_id")
         stream = await create_nl2agent_stream(
             request=nl2agent_request,
             tenant_id=tenant_id,
@@ -370,6 +378,8 @@ async def nl2agent_run_api(
                 query=nl2agent_request.query,
                 minio_files=nl2agent_request.minio_files,
                 workbench_config=nl2agent_request.workbench_config,
+                model_parameter_preferences=nl2agent_request.model_parameter_preferences,
+                selected_model_id=nl2agent_request.model_id,
                 agent_id=nl2agent_request.agent_id,
                 user_id=user_id,
                 tenant_id=tenant_id,
@@ -547,6 +557,9 @@ async def update_agent_info_api(
                               user_id=user_id, tenant_id=tenant_id,
                               details=audit_details)
         return result or {}
+    except ParameterValidationError as exc:
+        raise HTTPException(status_code=HTTPStatus.UNPROCESSABLE_ENTITY,
+                            detail={"code": exc.category, "field": exc.path}) from None
     except AgentRelationValidationError as exc:
         raise HTTPException(
             status_code=HTTPStatus.BAD_REQUEST, detail=str(exc)
diff --git a/backend/apps/conversation_management_app.py b/backend/apps/conversation_management_app.py
index e14b40ca91..7876d7ecf1 100644
--- a/backend/apps/conversation_management_app.py
+++ b/backend/apps/conversation_management_app.py
@@ -1,4 +1,5 @@
 # Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
 import logging
 from http import HTTPStatus
 from typing import Annotated, Any, Dict, Optional
@@ -8,6 +9,8 @@
 
 from consts.model import (
     BatchDeleteConversationRequest,
+    ConversationModelPreferencePatch,
+    ConversationModelSelectionPatch,
     ConversationKnowledgeScopeUpdateRequest,
     WorkbenchConfigUpdateRequest,
     ConversationRequest,
@@ -19,6 +22,8 @@
 )
 from consts.exceptions import (
     AppException,
+    ModelOutletConflictError,
+    ModelOutletValidationError,
     ConversationNotFoundError,
     ValidationError,
     TokenExpiredError,
@@ -297,6 +302,77 @@ async def update_conversation_workbench_config_endpoint(
         raise HTTPException(status_code=HTTPStatus.UNPROCESSABLE_ENTITY, detail={"code": "WORKBENCH_CONFIG_INVALID"}) from exc
 
 
+@router.get("/{conversation_id}/model_preferences", response_model=ConversationResponse)
+async def get_conversation_model_preferences(conversation_id: int, authorization: Optional[str] = Header(None)):
+    from nexent.core.concurrency import run_blocking
+    from services.conversation_model_preferences_service import read_model_preferences
+
+    user_id, _ = get_current_user_id(authorization)
+    try:
+        result = await run_blocking("conversation-model-preferences-read", read_model_preferences, conversation_id, user_id)
+        return ConversationResponse(code=0, message="success", data=result)
+    except ConversationNotFoundError:
+        raise HTTPException(status_code=404, detail="CONVERSATION_NOT_FOUND") from None
+
+
+@router.patch("/{conversation_id}/model_preferences", response_model=ConversationResponse)
+async def patch_conversation_model_selection(conversation_id: int, request: ConversationModelSelectionPatch,
+    authorization: Optional[str] = Header(None)):
+    from nexent.core.concurrency import run_blocking
+    from services.conversation_model_preferences_service import patch_model_selection
+    from consts.exceptions import ForbiddenError, RunModelControlsError
+
+    user_id, tenant_id = get_current_user_id(authorization)
+    try:
+        result = await run_blocking("conversation-model-selection-update", patch_model_selection,
+            conversation_id, request, user_id, tenant_id)
+        return ConversationResponse(code=0, message="success", data=result)
+    except ConversationNotFoundError:
+        raise HTTPException(status_code=404, detail="CONVERSATION_NOT_FOUND") from None
+    except ModelOutletConflictError:
+        raise HTTPException(status_code=409, detail={"code": "MODEL_PREFERENCE_VERSION_CONFLICT"}) from None
+    except ForbiddenError:
+        raise HTTPException(status_code=403, detail="MODEL_SELECTION_FORBIDDEN") from None
+    except RunModelControlsError as error:
+        status = {"model_not_available": 404, "model_unavailable": 409, "model_type_invalid": 400}.get(error.code, 422)
+        raise HTTPException(status_code=status, detail={"code": error.code}) from None
+
+
+@router.get("/{conversation_id}/model_preferences/{model_id}", response_model=ConversationResponse)
+async def get_conversation_model_preference_view(conversation_id: int, model_id: int, authorization: Optional[str] = Header(None)):
+    from nexent.core.concurrency import run_blocking
+    from services.conversation_model_preferences_service import read_model_preference_view
+
+    user_id, tenant_id = get_current_user_id(authorization)
+    try:
+        result = await run_blocking("conversation-model-preference-view", read_model_preference_view,
+            conversation_id, model_id, user_id, tenant_id)
+        return ConversationResponse(code=0, message="success", data=result)
+    except ConversationNotFoundError:
+        raise HTTPException(status_code=404, detail="CONVERSATION_NOT_FOUND") from None
+    except ModelOutletValidationError as error:
+        raise HTTPException(status_code=422, detail={"code": error.category, "field": error.path}) from None
+
+
+@router.patch("/{conversation_id}/model_preferences/{model_id}", response_model=ConversationResponse)
+async def patch_conversation_model_preferences(conversation_id: int, model_id: int,
+    request: ConversationModelPreferencePatch, authorization: Optional[str] = Header(None)):
+    from nexent.core.concurrency import run_blocking
+    from services.conversation_model_preferences_service import patch_model_preferences
+
+    user_id, tenant_id = get_current_user_id(authorization)
+    try:
+        result = await run_blocking("conversation-model-preferences-update", patch_model_preferences,
+            conversation_id, model_id, request, user_id, tenant_id)
+        return ConversationResponse(code=0, message="success", data=result)
+    except ConversationNotFoundError:
+        raise HTTPException(status_code=404, detail="CONVERSATION_NOT_FOUND") from None
+    except ModelOutletConflictError:
+        raise HTTPException(status_code=409, detail={"code": "MODEL_PREFERENCE_VERSION_CONFLICT"}) from None
+    except ModelOutletValidationError as error:
+        raise HTTPException(status_code=422, detail={"code": error.category, "field": error.path}) from None
+
+
 @router.post("/sources", response_model=Dict[str, Any])
 async def get_sources_endpoint(request: Dict[str, Any], authorization: Optional[str] = Header(None)):
     """
diff --git a/backend/apps/skill_app.py b/backend/apps/skill_app.py
index 28e36fab50..5364fa4267 100644
--- a/backend/apps/skill_app.py
+++ b/backend/apps/skill_app.py
@@ -7,6 +7,7 @@
 from typing import Any, Dict, List, Optional
 
 from fastapi import APIRouter, Depends, File, Form, Header, HTTPException, Query, Request, UploadFile
+from nexent.core.concurrency import run_blocking
 from pydantic import BaseModel, Field
 from starlette.responses import JSONResponse, StreamingResponse
 
@@ -814,6 +815,13 @@ async def nl2skill_run_api(
         raise HTTPException(status_code=401, detail="Unauthorized")
 
     try:
+        if request.conversation_id is not None:
+            from services.conversation_model_preferences_service import read_model_preferences
+            preference_user, _ = get_current_user_id(authorization)
+            saved = await run_blocking("creator-model-preferences", read_model_preferences, request.conversation_id, preference_user)
+            request.__dict__["_runtime_model_parameter_preferences"] = saved["model_parameter_preferences"]
+            if request.model_id is None:
+                request.model_id = saved.get("selected_model_id")
         stream = await create_nl2skill_stream(
             request=request,
             tenant_id=tenant_id,
@@ -827,6 +835,8 @@ async def nl2skill_run_api(
                 query=request.query,
                 minio_files=request.minio_files,
                 workbench_config=request.workbench_config,
+                model_parameter_preferences=request.model_parameter_preferences,
+                selected_model_id=request.model_id,
                 agent_id=None,
                 user_id=user_id,
                 tenant_id=tenant_id,
diff --git a/backend/configs/model_reasoning_wire_profiles.example.json b/backend/configs/model_reasoning_wire_profiles.example.json
deleted file mode 100644
index db6523e9a4..0000000000
--- a/backend/configs/model_reasoning_wire_profiles.example.json
+++ /dev/null
@@ -1,9 +0,0 @@
-{
-  "profiles": [
-    {
-      "base_url": "https://verified-gateway.example/v1",
-      "model_id": "verified-model-id",
-      "toggle_wire_format": "thinking_object"
-    }
-  ]
-}
diff --git a/backend/consts/const.py b/backend/consts/const.py
index 5320a73a09..21fe6c2cf4 100644
--- a/backend/consts/const.py
+++ b/backend/consts/const.py
@@ -947,11 +947,6 @@ def _resolve_app_version(default: str = "v2.2.1") -> str:
 NEXENT_LITELLM_JSON = os.environ.get("NEXENT_LITELLM_JSON", "/opt/nexent/litellm_models.json")
 
 
-# Exact, operator-verified endpoint/model reasoning transport overrides.
-MODEL_REASONING_WIRE_PROFILES_PATH = os.getenv(
-    "MODEL_REASONING_WIRE_PROFILES_PATH",
-    os.path.join(os.path.dirname(__file__), "..", "configs", "model_reasoning_wire_profiles.json"),
-)
 MODEL_RESPONSE_DIAGNOSTIC_CHUNKS = os.getenv(
     "NEXENT_MODEL_DIAGNOSTIC_CHUNKS", os.getenv("NEXENT_PROTOCOL_DIAGNOSTIC_CONTENT", "0")
 ) == "1"
diff --git a/backend/consts/model.py b/backend/consts/model.py
index 228d1cdcab..ed0905c169 100644
--- a/backend/consts/model.py
+++ b/backend/consts/model.py
@@ -1055,30 +1055,14 @@ class RuntimeSkillMount(BaseModel):
     config_values: Dict[str, Any] = Field(default_factory=dict)
 
 
-class WorkbenchGenerationConfig(BaseModel):
-    """Provider-neutral generation settings persisted with the conversation."""
-
-    model_config = ConfigDict(extra="forbid")
-
-    deep_thinking: bool = False
-    thinking_effort: Literal["auto", "none", "minimal", "low", "medium", "high", "xhigh", "max"] = "low"
-    reasoning_budget_tokens: Optional[StrictInt] = Field(default=None, ge=0)
-    temperature: Optional[float] = Field(default=None, ge=0, le=2, strict=True, allow_inf_nan=False)
-    top_p: Optional[float] = Field(default=None, ge=0, le=1, strict=True, allow_inf_nan=False)
-    requested_output_tokens: Optional[int] = Field(default=None, gt=0)
-
-
 class WorkbenchSessionConfig(BaseModel):
     """Canonical, persisted Workbench declaration; resolved artifacts are excluded."""
 
     model_config = ConfigDict(extra="forbid")
 
-    schema_version: Literal[3] = 3
+    schema_version: Literal[4] = 4
     mode: WorkbenchMode
-    model_id: Optional[int] = Field(default=None, gt=0)
-    generation_config: WorkbenchGenerationConfig = Field(
-        default_factory=WorkbenchGenerationConfig
-    )
+    requested_output_tokens: Optional[int] = Field(default=None, gt=0)
     agent_mounts: List[RuntimeAgentMount] = Field(default_factory=list, max_length=8)
     skill_mounts: List[RuntimeSkillMount] = Field(default_factory=list, max_length=20)
     knowledge_scope: Optional[ConversationKnowledgeScopeRequest] = None
@@ -1129,6 +1113,16 @@ def reject_legacy_agent_fields(value):
     return value
 
 
+def reject_temporary_model_controls(value):
+    """Reject the removed parallel contract instead of silently dropping intent."""
+    if isinstance(value, dict) and {"generation_config", "reasoning_effort", "reasoning_budget_tokens"}.intersection(value):
+        raise ValueError("Use model_parameter_preferences for conversation model parameters")
+    if (isinstance(value, dict) and value.get("conversation_id") is not None
+            and value.get("model_parameter_preferences") and value.get("is_debug") is not True):
+        raise ValueError("Save existing conversation parameters through the preference endpoint")
+    return value
+
+
 class AgentRequest(BaseModel):
     query: str
     conversation_id: Optional[int] = None
@@ -1136,23 +1130,8 @@ class AgentRequest(BaseModel):
     # Complete list of attachment information
     minio_files: Optional[List[Dict[str, Any]]] = None
     agent_id: Optional[int] = None
-    model_id: Optional[int] = None
-    generation_config: Optional[WorkbenchGenerationConfig] = None
-    reasoning_effort: Optional[Literal["auto", "none", "minimal", "low", "medium", "high", "xhigh", "max"]] = Field(
-        default=None,
-        description=(
-            "Optional per-run reasoning effort. None inherits the selected model "
-            "or Agent default."
-        ),
-    )
-    reasoning_budget_tokens: Optional[int] = Field(
-        default=None,
-        gt=0,
-        description=(
-            "Optional per-run reasoning token budget. None inherits the selected "
-            "model or Agent default."
-        ),
-    )
+    model_id: Optional[StrictInt] = Field(default=None, gt=0)
+    model_parameter_preferences: Dict[str, Dict[str, Any]] = Field(default_factory=dict)
     requested_output_tokens: Optional[int] = Field(default=None, gt=0)
     version_no: Optional[int] = None
     is_debug: Optional[bool] = False
@@ -1178,7 +1157,7 @@ class AgentRequest(BaseModel):
     @model_validator(mode="before")
     @classmethod
     def reject_legacy_execution_controls(cls, value):
-        return reject_legacy_agent_fields(value)
+        return reject_temporary_model_controls(reject_legacy_agent_fields(value))
 
     @field_validator("context_policy")
     @classmethod
@@ -1203,72 +1182,16 @@ def validate_workbench_entrypoint(self):
     )
 
 
-class RuntimeGenerationOverrides(BaseModel):
-    """Partial generation intent; absent fields never materialize defaults."""
-
-    model_config = ConfigDict(extra="forbid")
-    deep_thinking: Optional[StrictBool] = None
-    thinking_effort: Optional[Literal["auto", "none", "minimal", "low", "medium", "high", "xhigh", "max"]] = None
-    reasoning_budget_tokens: Optional[StrictInt] = Field(default=None, ge=0)
-    temperature: Optional[float] = Field(default=None, ge=0, le=2, strict=True, allow_inf_nan=False)
-    top_p: Optional[float] = Field(default=None, ge=0, le=1, strict=True, allow_inf_nan=False)
-
-    @field_validator("deep_thinking", "thinking_effort", "reasoning_budget_tokens", mode="before")
-    @classmethod
-    def reject_explicit_null(cls, value):
-        if value is None:
-            raise ValueError("A reasoning override cannot be null; omit it to inherit")
-        return value
-
-
 class NL2ModelControlsRequest(BaseModel):
-    """Shared optional controls for direct and Workbench creator turns."""
+    """The same per-model preferences used by every Agent conversation."""
 
     model_id: Optional[StrictInt] = Field(default=None, gt=0)
-    generation_config: Optional[RuntimeGenerationOverrides] = None
-    reasoning_effort: Optional[Literal["auto", "none", "minimal", "low", "medium", "high", "xhigh", "max"]] = None
-    reasoning_budget_tokens: Optional[StrictInt] = Field(default=None, ge=0)
+    model_parameter_preferences: Dict[str, Dict[str, Any]] = Field(default_factory=dict)
 
     @model_validator(mode="before")
     @classmethod
-    def reconcile_model_controls(cls, value):
-        if not isinstance(value, dict):
-            return value
-        value = dict(value)
-        overlay = value.get("generation_config")
-        if isinstance(overlay, BaseModel):
-            overlay = overlay.model_dump(exclude_unset=True)
-        if overlay is not None and not isinstance(overlay, dict):
-            return value
-        overlay = dict(overlay or {})
-        snapshot = value.get("workbench_config")
-        if isinstance(snapshot, dict):
-            snapshot_model = snapshot.get("model_id")
-            if snapshot_model is not None:
-                if value.get("model_id") is not None and value["model_id"] != snapshot_model:
-                    raise ValueError("model_controls_invalid: conflicting model snapshot")
-                value["model_id"] = snapshot_model
-            saved = snapshot.get("generation_config")
-            if isinstance(saved, dict):
-                for key in ("deep_thinking", "thinking_effort", "reasoning_budget_tokens", "temperature", "top_p"):
-                    if key in ("temperature", "top_p") and key in saved and saved[key] is None:
-                        if overlay.get(key) is not None:
-                            raise ValueError("model_controls_invalid: conflicting sampling snapshot")
-                        continue
-                    if key not in saved or saved[key] is None:
-                        continue
-                    if key in overlay and overlay[key] != saved[key]:
-                        raise ValueError("model_controls_invalid: conflicting generation snapshot")
-                    overlay[key] = saved[key]
-        for legacy, canonical in (("reasoning_effort", "thinking_effort"),
-                                  ("reasoning_budget_tokens", "reasoning_budget_tokens")):
-            if value.get(legacy) is not None:
-                if canonical in overlay and overlay[canonical] != value[legacy]:
-                    raise ValueError("model_controls_invalid: conflicting reasoning override")
-                overlay[canonical] = value[legacy]
-        if overlay or value.get("generation_config") is not None:
-            value["generation_config"] = overlay
-        return value
+    def reject_removed_controls(cls, value):
+        return reject_temporary_model_controls(value)
 
 
 class NL2AgentRunRequest(NL2ModelControlsRequest):
diff --git a/backend/management/services/agent/reasoning.py b/backend/management/services/agent/reasoning.py
index 97cda35e40..354b549888 100644
--- a/backend/management/services/agent/reasoning.py
+++ b/backend/management/services/agent/reasoning.py
@@ -1,4 +1,5 @@
 # Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
 """Helpers for keeping agent-owned reasoning settings independent from models."""
 
 from copy import deepcopy
@@ -26,6 +27,10 @@ def _resolve_model_reasoning_capability(model_info: Optional[dict]) -> Optional[
     """Resolve capability metadata for an agent snapshot when needed."""
     if not isinstance(model_info, dict):
         return None
+    if model_info.get("profile_schema_version") is not None and model_info.get("model_type") in {"llm", "chat"}:
+        from services.model_outlet_projection import project_saved_outlet
+
+        return (project_saved_outlet(model_info) or {}).get("reasoning_capability")
     capability = model_info.get("reasoning_capability")
     if isinstance(capability, dict):
         return capability
@@ -95,6 +100,8 @@ def snapshot_agent_reasoning_config(
     requested_overrides: Optional[dict],
     existing_overrides: Optional[dict],
     tenant_id: str,
+    *,
+    normalize_profiles: bool = True,
 ) -> Optional[dict]:
     """Snapshot reasoning settings while preserving explicit agent overrides.
 
@@ -124,6 +131,25 @@ def snapshot_agent_reasoning_config(
         )
 
         model_info = get_model_by_model_id(model_id, tenant_id=tenant_id)
+        if ((model_info or {}).get("profile_schema_version") is not None
+                and (model_info or {}).get("model_type") in {"llm", "chat"}):
+            # Runtime reads convert in memory; only explicit saves write the current format.
+            if not normalize_profiles:
+                continue
+            # Validate only explicit overrides; omitted values keep inheriting the outlet.
+            from nexent.core.model_service.profiles.outlet_storage import decode_resolved_model_profile
+            from nexent.core.model_service.registry import model_service_references
+            from services.agent_model_parameters import merge_agent_model_parameters
+
+            if not entry:
+                continue
+            from nexent.core.model_service.compatibility.agent_parameters import read_agent_parameter_entry
+            entry = read_agent_parameter_entry(entry)
+            if entry["parameter_values"] or entry.get("context_window_tokens") is not None or entry.get("custom_overrides") is not None:
+                profile = decode_resolved_model_profile(model_info, registered_references=model_service_references())
+                merge_agent_model_parameters(profile, entry)
+            override_map[model_key] = entry
+            continue
         capability = _resolve_model_reasoning_capability(model_info)
         has_reasoning_override = (
             "enable_thinking" in extra_params
diff --git a/backend/management/services/agent/run.py b/backend/management/services/agent/run.py
index 4b804c2193..33a3881ceb 100644
--- a/backend/management/services/agent/run.py
+++ b/backend/management/services/agent/run.py
@@ -48,10 +48,12 @@
 )
 from nexent.core.concurrency import (
     ManagedExecution,
+    run_blocking,
 )
 from nexent.monitor import (
     agent_monitoring_context,
 )
+from services.conversation_model_preferences_service import read_model_preferences as _read_model_preferences
 from management.services.conversation.service import (
     get_current_run_user_message_id,
     get_latest_assistant_message,
@@ -119,9 +121,6 @@ def apply_workbench_runtime_plan(
         "display_name": root_identity.display_name,
         "origin": root_identity.origin,
     }
-    agent_request.__dict__["_runtime_generation_config"] = (
-        canonical_workbench.generation_config.model_dump(mode="json")
-    )
 
 
 async def prepare_agent_run(
@@ -152,8 +151,6 @@ async def prepare_agent_run(
         "is_debug": agent_request.is_debug,
         "override_version_no": agent_request.version_no,
         "override_model_id": agent_request.model_id,
-        "reasoning_effort": agent_request.reasoning_effort,
-        "reasoning_budget_tokens": agent_request.reasoning_budget_tokens,
         "requested_output_tokens": agent_request.requested_output_tokens,
         "tool_params": agent_request.tool_params,
         "conversation_id": agent_request.conversation_id,
@@ -171,18 +168,6 @@ async def prepare_agent_run(
         create_run_kwargs["runtime_knowledge_tools"] = runtime_knowledge_tools
     if runtime_skill_snapshot is not None:
         create_run_kwargs["runtime_skill_snapshot"] = runtime_skill_snapshot
-    runtime_generation_config = getattr(
-        agent_request, "_runtime_generation_config", None
-    )
-    if (
-        runtime_generation_config is None
-        and agent_request.generation_config is not None
-    ):
-        runtime_generation_config = agent_request.generation_config.model_dump(
-            mode="json", exclude_unset=True
-        )
-    if runtime_generation_config is not None:
-        create_run_kwargs["runtime_generation_config"] = runtime_generation_config
     runtime_mount_plan = getattr(agent_request, "_runtime_mount_plan", None)
     if runtime_mount_plan is not None:
         create_run_kwargs["runtime_sub_agent_mounts"] = [
@@ -197,6 +182,14 @@ async def prepare_agent_run(
         ]
     if not agent_request.enable_automation_tool:
         create_run_kwargs["enable_automation_tool"] = False
+    preferences = getattr(agent_request, "_runtime_model_parameter_preferences", None)
+    if preferences is None:
+        preferences = agent_request.model_parameter_preferences
+        if agent_request.conversation_id is not None and not agent_request.is_debug:
+            saved = await run_blocking("run-model-preferences", _read_model_preferences, agent_request.conversation_id, user_id)
+            preferences = saved["model_parameter_preferences"]
+    if preferences:
+        create_run_kwargs["model_parameter_preferences"] = preferences
     agent_run_info = await create_agent_run_info(
         **create_run_kwargs,
     )
diff --git a/backend/management/services/agent/subscription.py b/backend/management/services/agent/subscription.py
index abc077c062..719ca4411e 100644
--- a/backend/management/services/agent/subscription.py
+++ b/backend/management/services/agent/subscription.py
@@ -243,12 +243,6 @@ async def run_agent_stream(
         user_id=user_id,
         tenant_id=tenant_id,
     )
-    if not resume:
-        from management.services.model import run_controls
-
-        run_controls.validate_agent_model_selection(
-            agent_request, resolved_tenant_id, search_agent_info_by_agent_id
-        )
     if agent_request.is_debug and not resume:
         # Debug executions deliberately do not create conversations, so they
         # need a transient identifier for lifecycle operations such as stop.
@@ -286,6 +280,16 @@ async def run_agent_stream(
                     "Conversation belongs to a different chat entrypoint"
                 )
 
+    if not resume:
+        from management.services.model import run_controls
+        if conversation is not None:
+            from services.conversation_model_preferences_service import read_model_preferences
+            saved = await run_blocking("conversation-model-settings", read_model_preferences, agent_request.conversation_id, resolved_user_id)
+            if agent_request.model_id is None:
+                agent_request.model_id = saved.get("selected_model_id")
+            agent_request.__dict__["_runtime_model_parameter_preferences"] = saved["model_parameter_preferences"]
+        run_controls.validate_agent_model_selection(agent_request, resolved_tenant_id, search_agent_info_by_agent_id)
+
     canonical_workbench = None
     if agent_request.entrypoint == "workbench" and not resume:
         from management.services.agent.workbench import (
@@ -335,6 +339,9 @@ async def run_agent_stream(
                 agent_request.expected_workbench_config_version,
             )
 
+    if not resume and conversation is not None and agent_request.model_parameter_preferences:
+        raise ValidationError("Save existing conversation parameters through the preference endpoint")
+
     if not resume:
         run_controls.preflight_agent_turn_controls(
             agent_request, resolved_tenant_id, search_agent_info_by_agent_id
@@ -463,6 +470,10 @@ async def run_agent_stream(
             "agent_id": agent_request.agent_id,
             "chat_mode": "planning" if agent_request.enable_plan else "execution",
         }
+        if agent_request.model_id is not None:
+            conversation_kwargs["selected_model_id"] = agent_request.model_id
+        if agent_request.model_parameter_preferences:
+            conversation_kwargs["model_parameter_preferences"] = agent_request.model_parameter_preferences
         if canonical_workbench is not None:
             conversation_kwargs["workbench_config"] = canonical_workbench.model_dump(
                 mode="json"
@@ -474,6 +485,7 @@ async def run_agent_stream(
         conversation_data = create_new_conversation(**conversation_kwargs)
         agent_request.conversation_id = conversation_data["conversation_id"]
         is_new_conversation = True
+        agent_request.__dict__["_runtime_model_parameter_preferences"] = agent_request.model_parameter_preferences
         logger.info(
             "Auto-created conversation_id=%s for user=%s (new conversation)",
             agent_request.conversation_id,
@@ -997,7 +1009,7 @@ async def stream_with_agent_context():
                                 "config_version": getattr(
                                     agent_request, "_workbench_config_version", 0
                                 ),
-                                "schema_version": 3,
+                                "schema_version": canonical_workbench.schema_version,
                                 "mode": canonical_workbench.mode,
                                 "agent_mounts": [
                                     mount.model_dump(mode="json")
diff --git a/backend/management/services/agent/workbench.py b/backend/management/services/agent/workbench.py
index d157dc1a23..56e36f77f7 100644
--- a/backend/management/services/agent/workbench.py
+++ b/backend/management/services/agent/workbench.py
@@ -449,26 +449,18 @@ def resolve_workbench_config(
         origin="SYSTEM",
     )
     child_mounts = tuple(child_identities)
-    if canonical.model_id is not None:
-        model_info = get_model_by_model_id(
-            canonical.model_id, tenant_id=tenant_id
-        )
-        if not is_model_available(model_info):
-            raise WorkbenchError("WORKBENCH_MODEL_NOT_ALLOWED")
-
     snapshot["skill_instances"] = skill_db.search_skills_for_agent(
         agent_id=int(root_identity.agent_id),
         tenant_id=tenant_id,
         version_no=int(root_identity.version_no),
     )
-    generation = canonical.generation_config
     root = PublishedRootDescriptor(
         identity=root_identity,
         published_snapshot=deepcopy(snapshot),
     )
     overlay = RootRuntimeOverlay(
-        model_id=canonical.model_id,
-        requested_output_tokens=generation.requested_output_tokens,
+        model_id=None,
+        requested_output_tokens=canonical.requested_output_tokens,
         skill_mounts=tuple(
             value.model_dump(mode="json") for value in canonical.skill_mounts
         ),
diff --git a/backend/management/services/conversation/creation_history.py b/backend/management/services/conversation/creation_history.py
index 39f2a61f4f..2b08fe3f89 100644
--- a/backend/management/services/conversation/creation_history.py
+++ b/backend/management/services/conversation/creation_history.py
@@ -38,6 +38,8 @@ def prepare_creation_history(
     agent_id: int | None,
     user_id: str,
     tenant_id: str,
+    model_parameter_preferences: dict[str, dict[str, Any]] | None = None,
+    selected_model_id: int | None = None,
     retry_user_message_id: int | None = None,
     retry_message_index: int | None = None,
 ) -> tuple[int, int]:
@@ -59,6 +61,8 @@ def prepare_creation_history(
             user_id=user_id,
             agent_id=agent_id if mode == "agent_create" else None,
             workbench_config=normalized_config,
+            **({"selected_model_id": selected_model_id} if selected_model_id is not None else {}),
+            **({"model_parameter_preferences": model_parameter_preferences} if model_parameter_preferences else {}),
         )
         resolved_id = int(created["conversation_id"])
         next_index = 0
diff --git a/backend/management/services/conversation/service.py b/backend/management/services/conversation/service.py
index d4d3d737c0..7c8da6826d 100644
--- a/backend/management/services/conversation/service.py
+++ b/backend/management/services/conversation/service.py
@@ -408,6 +408,8 @@ def create_new_conversation(
     knowledge_scope: Optional[Dict[str, Any]] = None,
     runtime_metadata: Optional[Dict[str, Any]] = None,
     workbench_config: Optional[Dict[str, Any]] = None,
+    model_parameter_preferences: Optional[Dict[str, Any]] = None,
+    selected_model_id: Optional[int] = None,
 ) -> Dict[str, Any]:
     """
     Create a new conversation
@@ -432,6 +434,10 @@ def create_new_conversation(
             create_kwargs["runtime_metadata"] = runtime_metadata
         if workbench_config is not None:
             create_kwargs["workbench_config"] = workbench_config
+        if selected_model_id is not None:
+            create_kwargs["selected_model_id"] = selected_model_id
+        if model_parameter_preferences:
+            create_kwargs["model_parameter_preferences"] = model_parameter_preferences
         conversation_data = create_conversation(title, user_id, **create_kwargs)
         return conversation_data
     except AppException:
diff --git a/backend/management/services/model/run_controls.py b/backend/management/services/model/run_controls.py
index 5fe465786b..7e8d73d288 100644
--- a/backend/management/services/model/run_controls.py
+++ b/backend/management/services/model/run_controls.py
@@ -3,14 +3,12 @@
 """Resolve request-scoped root controls without mutating independent models."""
 
 from collections.abc import Callable
-import math
 from typing import Any
 
 from nexent.core.agents.agent_model import AgentConfig, ModelConfig
 
 from consts.exceptions import RunModelControlsError
 from database.model_management_db import get_model_by_model_id
-from management.services.model.reasoning import reasoning_controls
 
 
 def _agent_record_for_run(request, tenant_id: str, lookup: Callable[..., dict]) -> dict:
@@ -27,7 +25,7 @@ def _agent_record_for_run(request, tenant_id: str, lookup: Callable[..., dict])
 
 def validate_agent_model_selection(request, tenant_id: str, lookup: Callable[..., dict]) -> None:
     """Validate selected catalog models and native Agent associations before writes."""
-    selected_id = request.workbench.model_id if request.workbench else request.model_id
+    selected_id = request.model_id
     if selected_id is None:
         return
     validate_selected_model(selected_id, tenant_id)
@@ -41,9 +39,7 @@ def validate_agent_model_selection(request, tenant_id: str, lookup: Callable[...
 
 def preflight_agent_turn_controls(request, tenant_id: str, lookup: Callable[..., dict]) -> None:
     """Preflight only explicit model controls using the native Agent's defaults."""
-    if all(getattr(request, field) is None for field in (
-        "model_id", "generation_config", "reasoning_effort", "reasoning_budget_tokens",
-    )):
+    if request.model_id is None and not request.model_parameter_preferences and not getattr(request, "_runtime_model_parameter_preferences", {}):
         return
     root_record = None
     if request.entrypoint != "workbench" and request.agent_id:
@@ -68,125 +64,49 @@ def validate_selected_record(record: dict | None) -> dict[str, Any]:
     return record
 
 
-def overlay_root_model(base: ModelConfig, values: dict[str, Any], alias: str) -> ModelConfig:
-    """Apply only present fields and validate active effort/budget intent."""
-    root = base.model_copy(deep=True)
-    root.cite_name = alias
-    explicit_sampling = []
-    for key, maximum in (("temperature", 2), ("top_p", 1)):
-        value = values.get(key)
-        if value is None:
-            continue
-        if isinstance(value, bool) or not isinstance(value, (int, float)) or not math.isfinite(value) or not 0 <= value <= maximum:
-            raise RunModelControlsError("model_controls_invalid")
-        explicit_sampling.append(key)
-        setattr(root, key, value)
-    if explicit_sampling:
-        root.explicit_sampling = explicit_sampling
-        # OpenAI's extra_body can otherwise shadow the canonical keyword values.
-        root.extra_body = {k: v for k, v in (root.extra_body or {}).items() if k not in explicit_sampling} or None
-    if not any(k in values for k in ("deep_thinking", "thinking_effort", "reasoning_budget_tokens")):
-        return root
-    enabled = values.get("deep_thinking", base.enable_thinking)
-    effort = values.get("thinking_effort")
-    budget = values.get("reasoning_budget_tokens")
-    controls = reasoning_controls(base.reasoning_capability)
-    effort_control = next((c for c in controls if c.get("type") == "effort"), None)
-    budget_control = next((c for c in controls if c.get("type") == "budget_tokens"), None)
-    if enabled:
-        if not controls:
-            raise RunModelControlsError("model_controls_invalid")
-        if effort not in (None, "auto") and budget not in (None, 0):
-            raise RunModelControlsError("model_controls_invalid")
-        if effort not in (None, "auto"):
-            if not effort_control or effort not in effort_control.get("values", []):
-                raise RunModelControlsError("model_controls_invalid")
-            root.reasoning_effort = effort
-            root.reasoning_budget_tokens = None
-        elif effort == "auto":
-            # Resolve against the immutable model/Agent defaults, never last turn.
-            root.reasoning_effort = base.reasoning_effort
-        if budget is not None:
-            if not budget_control or (budget > 0 and not budget_control["min"] <= budget <= budget_control["max"]):
-                raise RunModelControlsError("model_controls_invalid")
-            root.reasoning_budget_tokens = budget or base.reasoning_budget_tokens
-            root.reasoning_effort = None
-        elif budget_control and effort == "auto":
-            root.reasoning_effort = None
-    else:
-        root.reasoning_effort = None
-        root.reasoning_budget_tokens = None
-    if "deep_thinking" in values:
-        root.enable_thinking = enabled
-    extra = dict(root.extra_body or {})
-    if "deep_thinking" in values:
-        extra["enable_thinking"] = enabled
-    if any(k in values for k in ("deep_thinking", "thinking_effort", "reasoning_budget_tokens")):
-        extra.pop("reasoning_effort", None)
-        extra.pop("reasoning_budget_tokens", None)
-    root.extra_body = extra or None
-    return root
+def preflight_turn_controls(request, tenant_id: str, agent_record: dict | None = None) -> None:
+    """Validate the single preference format before any conversation write."""
+    from consts.exceptions import ModelOutletValidationError
+    from services.conversation_model_preferences_service import validate_model_preferences
+
+    model_id = request.model_id
+    if model_id is None and getattr(request, "_runtime_model_parameter_preferences", {}):
+        configured = (agent_record or {}).get("model_ids") or []
+        if configured:
+            model_id = configured[0]
+        else:
+            from consts.const import MODEL_CONFIG_MAPPING
+            from management.services.configuration.tenant.settings import tenant_config_manager
+            default = tenant_config_manager.get_model_config(MODEL_CONFIG_MAPPING["llm"], tenant_id=tenant_id)
+            model_id = (default or {}).get("model_id")
+    if model_id is not None:
+        validate_selected_model(model_id, tenant_id)
+    allowed = (agent_record or {}).get("model_ids") or None
+    preferences = request.model_parameter_preferences
+    if not preferences and model_id is not None:
+        saved = getattr(request, "_runtime_model_parameter_preferences", {})
+        values = saved.get(str(model_id))
+        if values is not None:
+            preferences = {str(model_id): values}
+    try:
+        validate_model_preferences(preferences, tenant_id, allowed_model_ids=allowed)
+    except ModelOutletValidationError as error:
+        raise RunModelControlsError("model_controls_invalid") from error
 
 
 def resolve_creator_model(
     model_list: list[ModelConfig], agent: AgentConfig, tenant_id: str,
-    model_id: int | None, values: dict[str, Any] | None, default_record: dict | None,
+    model_id: int | None, preferences: dict | None, default_record: dict | None,
 ) -> dict:
-    """Bind a creator root to its actual record, preserving all other aliases."""
+    """Select a creator root and use the shared profile preference merger."""
+    from agents.create_agent_info import apply_root_model_preferences, create_model_config_from_record
+
     record = validate_selected_model(model_id, tenant_id) if model_id is not None else default_record or {}
     if record:
-        from agents.create_agent_info import create_model_config_from_record
-        base = create_model_config_from_record(record)
-    else:
-        base = next((m for m in model_list if m.cite_name == record.get("display_name")), None)
-    if base is None:
-        if model_id is not None:
-            raise RunModelControlsError("model_not_available")
-        base = next((m for m in model_list if m.cite_name == agent.model_name), None)
-    if base is None:
-        raise RunModelControlsError("model_not_available")
-    if model_id is not None or values:
-        root = overlay_root_model(base, values or {}, "creator_root_model")
+        root = create_model_config_from_record(record).model_copy(deep=True, update={"cite_name": "creator_root_model"})
         model_list.append(root)
         agent.model_name = root.cite_name
+    elif not any(model.cite_name == agent.model_name for model in model_list):
+        raise RunModelControlsError("model_not_available")
+    apply_root_model_preferences(model_list, agent, preferences)
     return record
-
-
-def preflight_turn_controls(request, tenant_id: str, agent_record: dict | None = None) -> None:
-    """Reject invalid intent before conversation creation or draft persistence."""
-    model_id = request.model_id
-    values = getattr(request, "_runtime_generation_config", None)
-    if values is None:
-        values = request.generation_config.model_dump(exclude_unset=True) if request.generation_config else {}
-    if model_id is None:
-        if not values and getattr(request, "reasoning_effort", None) is None and getattr(request, "reasoning_budget_tokens", None) is None:
-            return
-        configured = (agent_record or {}).get("model_ids") or []
-        if configured:
-            model_id = configured[0]
-        else:
-            from consts.const import MODEL_CONFIG_MAPPING
-            from management.services.configuration.tenant.settings import tenant_config_manager
-            default_record = tenant_config_manager.get_model_config(MODEL_CONFIG_MAPPING["llm"], tenant_id)
-            model_id = (default_record or {}).get("model_id")
-        if model_id is None:
-            raise RunModelControlsError("model_not_available")
-    record = validate_selected_model(model_id, tenant_id)
-    from agents.create_agent_info import create_model_config_from_record
-    base = create_model_config_from_record(record)
-    if agent_record:
-        override = (agent_record.get("model_params_override") or {}).get(str(model_id), {})
-        extra = override.get("extra_params") or {}
-        for source, target in (("enable_thinking", "enable_thinking"),
-                               ("reasoning_effort", "reasoning_effort"),
-                               ("reasoning_budget_tokens", "reasoning_budget_tokens")):
-            if source in extra:
-                setattr(base, target, extra[source])
-    values = dict(values)
-    for attr, key in (("reasoning_effort", "thinking_effort"), ("reasoning_budget_tokens", "reasoning_budget_tokens")):
-        value = getattr(request, attr, None)
-        if value is not None:
-            if key in values and values[key] != value:
-                raise RunModelControlsError("model_controls_invalid")
-            values[key] = value
-    overlay_root_model(base, values, "preflight_root")
diff --git a/backend/services/nl2agent_service.py b/backend/services/nl2agent_service.py
index bb4b3cc176..366791d9a5 100644
--- a/backend/services/nl2agent_service.py
+++ b/backend/services/nl2agent_service.py
@@ -1356,10 +1356,10 @@ async def build_nl2agent_run_info(
         key=MODEL_CONFIG_MAPPING["llm"],
         tenant_id=tenant_id,
     )
-    if request.model_id is not None or request.generation_config is not None:
+    if request.model_id is not None or request.model_parameter_preferences or getattr(request, "_runtime_model_parameter_preferences", {}):
         default_model = resolve_creator_model(
             model_config_list, agent_config, tenant_id, request.model_id,
-            request.generation_config.model_dump(exclude_unset=True) if request.generation_config else None,
+            getattr(request, "_runtime_model_parameter_preferences", request.model_parameter_preferences),
             default_model,
         )
     input_budget, capacity_snapshot, resolved_capacity_snapshot = (
@@ -1416,6 +1416,7 @@ async def build_nl2agent_run_info(
 
     stop_event = threading.Event()
     run_info = AgentRunInfo(
+        tenant_id=tenant_id,
         query=final_query,
         model_config_list=model_config_list,
         observer=_Nl2AgentBoundaryObserver(
diff --git a/backend/services/nl2skill_service.py b/backend/services/nl2skill_service.py
index f8e84f3cbc..0f4d8b9011 100644
--- a/backend/services/nl2skill_service.py
+++ b/backend/services/nl2skill_service.py
@@ -235,10 +235,10 @@ async def build_nl2skill_run_info(
         system_prompt=template.get("system_prompt", ""),
         model_name=cite_name,
     )
-    if request.model_id is not None or request.generation_config is not None:
+    if request.model_id is not None or request.model_parameter_preferences or getattr(request, "_runtime_model_parameter_preferences", {}):
         model_info = resolve_creator_model(
             model_config_list, agent_config, tenant_id, request.model_id,
-            request.generation_config.model_dump(exclude_unset=True) if request.generation_config else None,
+            getattr(request, "_runtime_model_parameter_preferences", request.model_parameter_preferences),
             model_info,
         )
     input_budget, capacity_snapshot, resolved_capacity = _resolve_input_budget(model_info)
@@ -257,6 +257,7 @@ async def build_nl2skill_run_info(
         compaction_target_tokens=context_budget.compaction_target_tokens if context_budget else 0,
     )
     run_info = AgentRunInfo(
+        tenant_id=tenant_id,
         query=template.get("user_prompt") or final_query,
         model_config_list=model_config_list,
         observer=MessageObserver(lang=template_language),
diff --git a/deploy/sql/migrations/v2.7.1_007_unify_conversation_model_parameters.sql b/deploy/sql/migrations/v2.7.1_007_unify_conversation_model_parameters.sql
new file mode 100644
index 0000000000..cefcbf3da3
--- /dev/null
+++ b/deploy/sql/migrations/v2.7.1_007_unify_conversation_model_parameters.sql
@@ -0,0 +1,70 @@
+-- Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
+ALTER TABLE nexent.conversation_record_t ADD COLUMN IF NOT EXISTS selected_model_id INTEGER;
+COMMENT ON COLUMN nexent.conversation_record_t.selected_model_id IS
+    'Root model selected for this Agent conversation; NULL inherits the Agent default.';
+
+-- Upgrade only historical Workbench declarations. New preferences win per field.
+-- Never assign historical choices to an arbitrary model when its identity is missing.
+DO $$
+BEGIN
+    IF EXISTS (
+        SELECT 1 FROM nexent.conversation_record_t
+        WHERE jsonb_typeof(workbench_config->'generation_config') = 'object'
+          AND COALESCE(workbench_config->>'model_parameters_source', 'legacy_generation') = 'legacy_generation'
+          AND COALESCE(workbench_config->>'model_id', selected_model_id::text) IS NULL
+          AND (workbench_config->'generation_config') - 'requested_output_tokens' <> '{}'::jsonb
+    ) THEN
+        RAISE EXCEPTION 'Workbench model parameter migration requires a model_id; no historical settings were discarded';
+    END IF;
+END $$;
+
+WITH historical AS (
+    SELECT conversation_id, workbench_config AS config,
+           workbench_config->'generation_config' AS generation,
+           COALESCE(workbench_config->>'model_id', selected_model_id::text) AS model_key
+    FROM nexent.conversation_record_t
+    WHERE jsonb_typeof(workbench_config) = 'object'
+      AND (workbench_config ? 'generation_config' OR workbench_config ? 'model_parameters_source'
+           OR workbench_config->>'schema_version' = '3')
+), converted AS (
+    SELECT *, CASE
+        WHEN model_key IS NOT NULL
+         AND COALESCE(config->>'model_parameters_source', 'legacy_generation') = 'legacy_generation'
+        THEN jsonb_strip_nulls(jsonb_build_object(
+            'temperature', generation->'temperature',
+            'top_p', generation->'top_p',
+            'enable_thinking', generation->'deep_thinking',
+            'reasoning_budget_tokens', CASE WHEN generation->>'deep_thinking' = 'true'
+                AND COALESCE((generation->>'reasoning_budget_tokens')::bigint, 0) > 0
+                THEN generation->'reasoning_budget_tokens' END,
+            'reasoning_effort', CASE WHEN generation->>'deep_thinking' = 'true'
+                AND COALESCE((generation->>'reasoning_budget_tokens')::bigint, 0) = 0
+                AND generation->>'thinking_effort' <> 'auto'
+                THEN generation->'thinking_effort' END
+        )) ELSE '{}'::jsonb END AS preferences
+    FROM historical
+)
+UPDATE nexent.conversation_record_t AS target
+SET selected_model_id = COALESCE(target.selected_model_id, converted.model_key::integer),
+    model_parameter_preferences = CASE WHEN converted.preferences <> '{}'::jsonb
+        THEN target.model_parameter_preferences || jsonb_build_object(converted.model_key,
+            (CASE WHEN target.model_parameter_preferences->converted.model_key ?| ARRAY['reasoning_effort', 'reasoning_budget_tokens']
+                    OR target.model_parameter_preferences->converted.model_key->>'enable_thinking' = 'false'
+                THEN converted.preferences - 'reasoning_effort' - 'reasoning_budget_tokens'
+                ELSE converted.preferences END)
+            || COALESCE(target.model_parameter_preferences->converted.model_key, '{}'::jsonb))
+        ELSE target.model_parameter_preferences END,
+    model_parameter_preferences_version = target.model_parameter_preferences_version
+        + CASE WHEN converted.preferences <> '{}'::jsonb
+            OR (converted.model_key IS NOT NULL AND target.selected_model_id IS NULL) THEN 1 ELSE 0 END,
+    workbench_config = (converted.config - 'generation_config' - 'model_parameters_source' - 'model_id')
+        || jsonb_build_object('schema_version', 4)
+        || CASE WHEN converted.generation->>'requested_output_tokens' IS NOT NULL
+            THEN jsonb_build_object('requested_output_tokens', converted.generation->'requested_output_tokens')
+            ELSE '{}'::jsonb END,
+    workbench_config_version = target.workbench_config_version + 1,
+    updated_by = 'migration:session-model-parameters',
+    update_time = CURRENT_TIMESTAMP
+FROM converted
+WHERE target.conversation_id = converted.conversation_id;
diff --git a/frontend/components/chat/ModelParameterSettings.tsx b/frontend/components/chat/ModelParameterSettings.tsx
index ba019b5fe5..efabb64b9d 100644
--- a/frontend/components/chat/ModelParameterSettings.tsx
+++ b/frontend/components/chat/ModelParameterSettings.tsx
@@ -2,7 +2,7 @@
 
 "use client";
 
-import { useEffect, useState } from "react";
+import { useCallback, useEffect, useState, type ReactNode } from "react";
 import { Button, Popover, Slider } from "antd";
 import { ChevronRight } from "lucide-react";
 import { useTranslation } from "react-i18next";
@@ -14,11 +14,12 @@ function configuredValue(value: number | undefined, max: number) {
     : undefined;
 }
 
-function ParameterLevel({
+export function ParameterLevel({
   label,
   value,
   inheritedValue,
   max,
+  min = 0,
   disabled,
   onChange,
 }: {
@@ -26,6 +27,7 @@ function ParameterLevel({
   value?: number;
   inheritedValue?: number;
   max: number;
+  min?: number;
   disabled?: boolean;
   onChange: (value: number) => void;
 }) {
@@ -46,7 +48,7 @@ function ParameterLevel({
   const commit = () => {
     if (!dirty) return;
     const next = Number(text);
-    if (!text.trim() || !Number.isFinite(next) || next < 0 || next > max) {
+    if (!text.trim() || !Number.isFinite(next) || next < min || next > max) {
       setError(true);
       return;
     }
@@ -64,7 +66,7 @@ function ParameterLevel({
       <div className="flex items-center gap-3">
         {sliderValue != null ? (
           <Slider
-            min={0}
+            min={min}
             max={max}
             step={0.1}
             value={sliderValue}
@@ -89,7 +91,7 @@ function ParameterLevel({
         )}
         <input
           type="number"
-          min={0}
+          min={min}
           max={max}
           step={0.1}
           placeholder="—"
@@ -116,7 +118,7 @@ function ParameterLevel({
         <p role="alert" className="text-xs text-destructive">
           {t("workbench.controls.numberRange", {
             defaultValue: "请输入 {{min}}–{{max}} 的数字",
-            min: 0,
+            min,
             max,
           })}
         </p>
@@ -125,34 +127,51 @@ function ParameterLevel({
   );
 }
 
-export function ModelParameterSettings(control: ModelParameterSettingsControl) {
+/** Shared selector entry and nested panel for legacy and profile parameters. */
+export function ModelParameterPopover({
+  children,
+  disabled,
+  onOpenChange,
+}: {
+  children: ReactNode | ((close: () => void) => ReactNode);
+  disabled?: boolean;
+  onOpenChange?: (open: boolean) => void;
+}) {
   const { t } = useTranslation();
   const [open, setOpen] = useState(false);
-  const [resetVersion, setResetVersion] = useState(0);
+  const changeOpen = useCallback(
+    (next: boolean) => {
+      setOpen(next);
+      onOpenChange?.(next);
+    },
+    [onOpenChange]
+  );
   useEffect(() => {
     if (!open) return;
     const closeOutside = (event: PointerEvent) => {
       if (
         event.target instanceof Element &&
         !event.target.closest(
-          "[data-model-parameter-panel], [data-model-parameter-trigger]"
+          "[data-model-parameter-panel], [data-model-parameter-trigger], [data-model-effort-popup]"
         )
       )
-        setOpen(false);
+        changeOpen(false);
     };
     document.addEventListener("pointerdown", closeOutside);
     return () => document.removeEventListener("pointerdown", closeOutside);
-  }, [open]);
+  }, [open, changeOpen]);
   return (
     <Popover
       open={open}
       onOpenChange={(next) => {
         if (
           !next &&
-          document.activeElement?.closest("[data-model-parameter-panel]")
+          document.activeElement?.closest(
+            "[data-model-parameter-panel], [data-model-parameter-trigger]"
+          )
         )
           return;
-        setOpen(next);
+        changeOpen(next);
       }}
       trigger={["hover", "click"]}
       placement="rightTop"
@@ -167,73 +186,28 @@ export function ModelParameterSettings(control: ModelParameterSettingsControl) {
           className="w-64 space-y-3"
           onKeyDown={(event) => {
             event.stopPropagation();
-            if (event.key === "Escape") setOpen(false);
+            if (event.key === "Escape") changeOpen(false);
           }}
         >
-          <ParameterLevel
-            key={`temperature-${resetVersion}`}
-            label={t("workbench.controls.temperature", "温度")}
-            value={control.value.temperature}
-            inheritedValue={control.inheritedValue?.temperature}
-            max={2}
-            disabled={control.disabled}
-            onChange={(temperature) =>
-              control.onChange({ ...control.value, temperature })
-            }
-          />
-          <ParameterLevel
-            key={`top-p-${resetVersion}`}
-            label="Top P"
-            value={control.value.top_p}
-            inheritedValue={control.inheritedValue?.top_p}
-            max={1}
-            disabled={control.disabled}
-            onChange={(top_p) => control.onChange({ ...control.value, top_p })}
-          />
-          {(configuredValue(
-            control.value.temperature ?? control.inheritedValue?.temperature,
-            2
-          ) == null ||
-            configuredValue(
-              control.value.top_p ?? control.inheritedValue?.top_p,
-              1
-            ) == null) && (
-            <p className="text-xs text-muted-foreground">
-              {t(
-                "workbench.controls.configureDefaults",
-                "请先在模型配置中设置默认值，或输入本次使用的数值。"
-              )}
-            </p>
-          )}
-          <Button
-            size="small"
-            htmlType="button"
-            disabled={control.disabled}
-            onPointerDown={(event) => event.preventDefault()}
-            onClick={(event) => {
-              event.preventDefault();
-              event.stopPropagation();
-              control.onChange({ ...control.defaultValue });
-              setResetVersion((value) => value + 1);
-            }}
-          >
-            {t("workbench.controls.restore", "恢复默认")}
-          </Button>
+          {typeof children === "function"
+            ? children(() => changeOpen(false))
+            : children}
         </div>
       }
     >
       <button
         data-model-parameter-trigger
         type="button"
-        disabled={control.disabled}
+        disabled={disabled}
         aria-expanded={open}
+
         onKeyDown={(event) => {
           if (["Enter", "ArrowRight", " "].includes(event.key)) {
             event.preventDefault();
             event.stopPropagation();
-            setOpen(true);
+            changeOpen(true);
           }
-          if (event.key === "Escape") setOpen(false);
+          if (event.key === "Escape") changeOpen(false);
         }}
         className="flex w-full items-center justify-between gap-3 border-b px-3 py-2 text-sm font-normal hover:bg-accent"
       >
@@ -243,3 +217,78 @@ export function ModelParameterSettings(control: ModelParameterSettingsControl) {
     </Popover>
   );
 }
+
+export function ModelSamplingFields(
+  control: ModelParameterSettingsControl & {
+    disabledFields?: string[];
+    bounds?: Record<string, { min?: number; max?: number }>;
+  }
+) {
+  const { t } = useTranslation();
+  const [resetVersion, setResetVersion] = useState(0);
+  return (
+    <>
+      <ParameterLevel
+        key={`temperature-${resetVersion}`}
+        label={t("workbench.controls.temperature", "温度")}
+        value={control.value.temperature}
+        inheritedValue={control.inheritedValue?.temperature}
+        min={control.bounds?.temperature?.min}
+        max={control.bounds?.temperature?.max ?? 2}
+        disabled={
+          control.disabled || control.disabledFields?.includes("temperature")
+        }
+        onChange={(temperature) =>
+          control.onChange({ ...control.value, temperature })
+        }
+      />
+      <ParameterLevel
+        key={`top-p-${resetVersion}`}
+        label="Top P"
+        value={control.value.top_p}
+        inheritedValue={control.inheritedValue?.top_p}
+        min={control.bounds?.top_p?.min}
+        max={control.bounds?.top_p?.max ?? 1}
+        disabled={control.disabled || control.disabledFields?.includes("top_p")}
+        onChange={(top_p) => control.onChange({ ...control.value, top_p })}
+      />
+      {(configuredValue(
+        control.value.temperature ?? control.inheritedValue?.temperature,
+        2
+      ) == null ||
+        configuredValue(
+          control.value.top_p ?? control.inheritedValue?.top_p,
+          1
+        ) == null) && (
+        <p className="text-xs text-muted-foreground">
+          {t(
+            "workbench.controls.configureDefaults",
+            "请先在模型配置中设置默认值，或输入本次使用的数值。"
+          )}
+        </p>
+      )}
+      <Button
+        size="small"
+        htmlType="button"
+        disabled={control.disabled}
+        onPointerDown={(event) => event.preventDefault()}
+        onClick={(event) => {
+          event.preventDefault();
+          event.stopPropagation();
+          control.onChange({ ...control.defaultValue });
+          setResetVersion((value) => value + 1);
+        }}
+      >
+        {t("workbench.controls.restore", "恢复默认")}
+      </Button>
+    </>
+  );
+}
+
+export function ModelParameterSettings(control: ModelParameterSettingsControl) {
+  return (
+    <ModelParameterPopover disabled={control.disabled}>
+      <ModelSamplingFields {...control} />
+    </ModelParameterPopover>
+  );
+}
diff --git a/frontend/components/model/AgentModelParameters.tsx b/frontend/components/model/AgentModelParameters.tsx
new file mode 100644
index 0000000000..d755a45aef
--- /dev/null
+++ b/frontend/components/model/AgentModelParameters.tsx
@@ -0,0 +1,180 @@
+// Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
+"use client";
+
+import { useState } from "react";
+import { useQuery } from "@tanstack/react-query";
+import { Alert, Form, Modal, Spin } from "antd";
+import { useTranslation } from "react-i18next";
+import { getModelOutlet } from "@/services/modelProfileService";
+import {
+  agentParameterValues,
+  AGENT_PARAMETER_KEYS,
+  parameterIsActive,
+  withAgentParameterValues,
+} from "@/lib/modelParameterLayers";
+import {
+  ModelThinkingSettings,
+  thinkingDegreeKeys,
+} from "./ModelThinkingSettings";
+import type {
+  ModelOutletResponse,
+  ThinkingDegreeMode,
+} from "@/types/modelProfile";
+import { StandardButton } from "@/components/common/StandardButton";
+import { ModelParameterField } from "./ModelParameterField";
+
+interface Props {
+  modelId: number;
+  name: string;
+  value: Record<string, unknown>;
+  disabled?: boolean;
+  onApply: (entry: Record<string, unknown>) => void;
+  onClose: () => void;
+}
+
+/** The Agent page owns saving/publishing; this editor only applies a local draft. */
+export function AgentModelParameters(props: Props) {
+  const { t } = useTranslation();
+  const query = useQuery({
+    queryKey: ["model-outlet", props.modelId],
+    queryFn: ({ signal }) => getModelOutlet(props.modelId, signal),
+    staleTime: 0,
+    retry: false,
+    refetchOnWindowFocus: false,
+    refetchOnReconnect: false,
+  });
+  return (
+    <Modal
+      open
+      centered
+      title={`${props.name} · ${t("modelProfile.agentParameters")}`}
+      onCancel={props.onClose}
+      footer={null}
+      destroyOnHidden
+    >
+      {query.isFetching ? (
+        <Spin />
+      ) : query.isError ? (
+        <Alert type="error" title={t("modelProfile.loadFailed")} />
+      ) : (
+        query.data && (
+          <Editor
+            key={`${props.modelId}:${query.data.config_revision}`}
+            {...props}
+            outlet={query.data}
+          />
+        )
+      )}
+    </Modal>
+  );
+}
+
+function Editor({
+  value,
+  disabled,
+  onApply,
+  onClose,
+  outlet,
+}: Props & { outlet: ModelOutletResponse }) {
+  const { t } = useTranslation();
+  const [parameters, setParameters] = useState(() =>
+    agentParameterValues(value)
+  );
+  const [edited, setEdited] = useState(false);
+  const [thinkingMode, setThinkingMode] = useState<ThinkingDegreeMode>();
+  const defaults = outlet.profile.parameter_values;
+  const thinkingKeys = ["enable_thinking", ...thinkingDegreeKeys];
+  const rules = outlet.profile.parameter_rules.filter(
+    (rule) =>
+      rule.visible &&
+      rule.allowed_scopes.includes("conversation") &&
+      AGENT_PARAMETER_KEYS.includes(rule.key)
+  );
+  const change = (patch: Record<string, unknown>, removed: string[] = []) => {
+    setEdited(true);
+    setParameters((previous) => {
+      const next = { ...previous, ...patch };
+      removed.forEach((key) => delete next[key]);
+      return next;
+    });
+  };
+  const effective = { ...defaults, ...parameters };
+  return (
+    <Form
+      layout="vertical"
+      onFinish={() => {
+        const next = edited
+          ? withAgentParameterValues(value, parameters)
+          : { ...value };
+        onApply(next);
+        onClose();
+      }}
+    >
+      <Alert
+        type="info"
+        className="mb-4"
+        title={t("modelProfile.parameterPriority")}
+        description={t("modelProfile.agentParametersScope")}
+      />
+      {rules
+        .filter(
+          (rule) =>
+            !thinkingKeys.includes(rule.key) &&
+            (parameterIsActive(rule.condition, effective) ||
+              Object.hasOwn(parameters, rule.key))
+        )
+        .map((rule) => (
+          <ModelParameterField
+            key={rule.key}
+            rule={rule}
+            values={parameters}
+            fallbackValues={defaults}
+            scope="conversation"
+            pending={disabled}
+            resetLabel={t("modelProfile.useOutletDefault")}
+            onChange={(key, next) => change({ [key]: next })}
+            onReset={(key) => change({}, [key])}
+          />
+        ))}
+      {rules.some((rule) => thinkingKeys.includes(rule.key)) && (
+        <ModelThinkingSettings
+          declaredControlsOnly
+          rules={rules}
+          values={parameters}
+          defaults={defaults}
+          mode={thinkingMode}
+          outputLimit={outlet.profile.capabilities.context.output_limit}
+          pending={disabled}
+          onToggle={(enabled) =>
+            change(
+              { enable_thinking: enabled },
+              enabled ? [] : thinkingDegreeKeys
+            )
+          }
+          onModeChange={(mode) => {
+            setThinkingMode(mode);
+            change({}, thinkingDegreeKeys);
+          }}
+          onValueChange={(key, next) =>
+            next === undefined ? change({}, [key]) : change({ [key]: next })
+          }
+        />
+      )}
+      {!disabled &&
+        thinkingKeys.some((key) => Object.hasOwn(parameters, key)) && (
+          <StandardButton
+            onClick={() => {
+              setThinkingMode(undefined);
+              change({}, thinkingKeys);
+            }}
+          >
+            {t("modelProfile.useOutletDefault")}
+          </StandardButton>
+        )}
+      <StandardButton variant="primary" htmlType="submit" disabled={disabled}>
+        {t("common.confirm")}
+      </StandardButton>
+    </Form>
+  );
+}
diff --git a/frontend/components/model/ModelParameterPanel.tsx b/frontend/components/model/ModelParameterPanel.tsx
new file mode 100644
index 0000000000..28f479211d
--- /dev/null
+++ b/frontend/components/model/ModelParameterPanel.tsx
@@ -0,0 +1,98 @@
+// Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
+"use client";
+
+import type { ReactNode } from "react";
+import {
+  BrainCircuit,
+  Layers,
+  RotateCcw,
+  SlidersHorizontal,
+} from "lucide-react";
+import { useTranslation } from "react-i18next";
+import { StandardCard } from "@/components/common/StandardCard";
+import { StandardButton } from "@/components/common/StandardButton";
+
+/** Shared by onboarding, batch configuration, and saved outlet editing. */
+export function ModelParameterPanel({
+  source,
+  hasModel,
+  pending,
+  onReset,
+  sampling,
+  thinking,
+  capacity,
+}: {
+  source?: string;
+  hasModel: boolean;
+  pending: boolean;
+  onReset?: () => void;
+  sampling: ReactNode;
+  thinking: ReactNode;
+  capacity: ReactNode;
+}) {
+  const { t } = useTranslation();
+  return (
+    <section
+      aria-label={t("modelProfile.modelParameters")}
+      className="min-w-0 space-y-3 bg-muted/30 p-6 lg:border-l"
+    >
+      <h3 className="text-sm font-semibold">
+        {t("modelProfile.modelParameters")}
+      </h3>
+      {!hasModel ? (
+        <div className="flex min-h-72 flex-col items-center justify-center gap-2 rounded-lg border border-dashed bg-background/50 p-6 text-center text-xs text-muted-foreground">
+          <SlidersHorizontal className="mb-2 size-5" />
+          <p className="font-medium text-foreground">
+            {t("modelProfile.layout.emptyTitle")}
+          </p>
+          <p>{t("modelProfile.layout.emptyDescription")}</p>
+        </div>
+      ) : (
+        <>
+          <div className="flex flex-wrap items-center justify-between gap-2 rounded-lg border border-dashed bg-background px-3 py-2 text-xs">
+            <span className="min-w-0 break-words text-muted-foreground">
+              {t("modelProfile.layout.source")}{" "}
+              <span className="font-medium text-foreground">
+                {source ?? t("modelProfile.otherProfile")}
+              </span>
+            </span>
+            {onReset && (
+              <StandardButton
+                className="!h-auto !border-0 !bg-transparent !p-0 !text-xs !shadow-none"
+                icon={<RotateCcw size={12} />}
+                disabled={pending}
+                onClick={onReset}
+              >
+                {t("modelProfile.layout.reset")}
+              </StandardButton>
+            )}
+          </div>
+          {(
+            [
+              ["samplingGroup", SlidersHorizontal, sampling],
+              ["thinkingGroup", BrainCircuit, thinking],
+              ["capacityGroup", Layers, capacity],
+            ] as const
+          ).map(([key, Icon, content]) => (
+            <StandardCard
+              key={key}
+              bordered
+              role="region"
+              aria-label={t(`modelProfile.${key}`)}
+              className="!mb-3 !bg-background shadow-sm [&_.ant-card-body]:!p-4"
+            >
+              <h4 className="mb-3 flex items-center gap-2 text-sm font-medium">
+                <span className="text-primary">
+                  <Icon size={16} />
+                </span>
+                {t(`modelProfile.${key}`)}
+              </h4>
+              {content}
+            </StandardCard>
+          ))}
+        </>
+      )}
+    </section>
+  );
+}
diff --git a/frontend/components/model/ModelThinkingSettings.tsx b/frontend/components/model/ModelThinkingSettings.tsx
new file mode 100644
index 0000000000..d650fd09a1
--- /dev/null
+++ b/frontend/components/model/ModelThinkingSettings.tsx
@@ -0,0 +1,207 @@
+// Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
+"use client";
+
+import { useEffect } from "react";
+import { Form, Select, Switch } from "antd";
+import { ModelParameterField } from "./ModelParameterField";
+import { useTranslation } from "react-i18next";
+import type {
+  ModelParameterRule,
+  ThinkingDegreeMode,
+} from "@/types/modelProfile";
+
+export const thinkingDegreeKeys = [
+  "reasoning_effort",
+  "reasoning_budget_tokens",
+];
+export function detectThinkingMode(
+  rules: ModelParameterRule[],
+  values: Record<string, unknown>
+): ThinkingDegreeMode {
+  if (values.reasoning_effort !== undefined) return "effort";
+  if (values.reasoning_budget_tokens !== undefined) return "budget_tokens";
+  if (rules.some((rule) => rule.key === "reasoning_effort")) return "effort";
+  if (rules.some((rule) => rule.key === "reasoning_budget_tokens"))
+    return "budget_tokens";
+  return "default";
+}
+
+/** Shared prefill for all UI entry points; never invent a request binding. */
+export function thinkingDegreePrefill(
+  rule: ModelParameterRule | undefined,
+  mode: ThinkingDegreeMode,
+  outputLimit?: number | null
+) {
+  if (!rule) return undefined;
+  if (rule.fixed_value !== undefined) return rule.fixed_value;
+  if (rule.default_value !== undefined) return rule.default_value;
+  if (mode === "effort") {
+    const choices = Array.isArray(rule.schema.enum)
+      ? rule.schema.enum
+      : ["low", "medium", "high"];
+    return ["low", "minimal", "medium", "high", "xhigh", "max"].find((value) =>
+      choices.includes(value)
+    );
+  }
+  const maximum = rule.schema.maximum ?? outputLimit;
+  const minimum =
+    typeof rule.schema.minimum === "number" ? rule.schema.minimum : 1;
+  return mode === "budget_tokens" && typeof maximum === "number"
+    ? Math.max(minimum, Math.floor(maximum / 2))
+    : undefined;
+}
+
+/** Product controls; provider request-field bindings stay behind the profile API. */
+export function ModelThinkingSettings({
+  rules,
+  values,
+  defaults = {},
+  mode,
+  pending = false,
+  outputLimit,
+  prefillReady = true,
+  declaredControlsOnly = false,
+  layout = "inline",
+  onToggle,
+  onModeChange,
+  onValueChange,
+}: {
+  rules: ModelParameterRule[];
+  values: Record<string, unknown>;
+  defaults?: Record<string, unknown>;
+  mode?: ThinkingDegreeMode;
+  pending?: boolean;
+  outputLimit?: number | null;
+  prefillReady?: boolean;
+  declaredControlsOnly?: boolean;
+  layout?: "inline" | "panel";
+  onToggle: (enabled: boolean) => void;
+  onModeChange: (mode: ThinkingDegreeMode) => void;
+  onValueChange: (key: string, value: unknown) => void;
+}) {
+  const { t } = useTranslation();
+  const effective = { ...defaults, ...values };
+  const toggle = rules.find((rule) => rule.key === "enable_thinking");
+  const enabled = effective.enable_thinking === true;
+  const selectedMode =
+    mode && mode !== "default" ? mode : detectThinkingMode(rules, effective);
+  const key =
+    selectedMode === "effort" ? "reasoning_effort" : "reasoning_budget_tokens";
+  const rule = rules.find((item) => item.key === key) ?? {
+    key,
+    visible: true,
+    editable: !declaredControlsOnly,
+    required: false,
+    allowed_scopes: [
+      "outlet",
+      "conversation",
+    ] as ModelParameterRule["allowed_scopes"],
+    ui_group: "reasoning",
+    schema:
+      selectedMode === "effort"
+        ? { type: "string", enum: ["low", "medium", "high"] }
+        : { type: "integer", minimum: 1 },
+  };
+  const fixed = rule.editable === false;
+  const modes = (["effort", "budget_tokens"] as const).filter(
+    (value, index) =>
+      rules.some((item) => item.key === thinkingDegreeKeys[index]) ||
+      (!declaredControlsOnly &&
+        (mode === value ||
+          !rules.some((item) => thinkingDegreeKeys.includes(item.key))))
+  );
+  const currentValue = effective[key];
+  const prefill =
+    currentValue !== undefined
+      ? currentValue
+      : prefillReady
+        ? thinkingDegreePrefill(rule, selectedMode, outputLimit)
+        : (rule?.fixed_value ?? rule?.default_value);
+
+  useEffect(() => {
+    if (!prefillReady) return;
+    if (
+      enabled &&
+      !pending &&
+      selectedMode === "default" &&
+      !declaredControlsOnly
+    ) {
+      onModeChange("effort");
+      return;
+    }
+    if (
+      enabled &&
+      !pending &&
+      selectedMode !== "default" &&
+      currentValue === undefined &&
+      prefill !== undefined
+    )
+      onValueChange(key, prefill);
+  }, [
+    enabled,
+    pending,
+    selectedMode,
+    key,
+    currentValue,
+    prefill,
+    onValueChange,
+    onModeChange,
+    prefillReady,
+    declaredControlsOnly,
+  ]);
+  return (
+    <div
+      className={
+        layout === "panel"
+          ? "grid grid-cols-1 items-start gap-x-3 sm:grid-cols-[auto_minmax(0,1fr)_minmax(0,1fr)]"
+          : "grid grid-cols-1 items-start gap-x-4 sm:grid-cols-3"
+      }
+    >
+      <Form.Item label={t("modelProfile.thinkingToggle")}>
+        <div className="flex h-7 items-center">
+          <Switch
+            aria-label={t("modelProfile.thinkingToggle")}
+            checked={enabled}
+            disabled={
+              pending ||
+              toggle?.editable === false ||
+              (declaredControlsOnly && !toggle)
+            }
+            onChange={(enabled) => onToggle(enabled)}
+          />
+        </div>
+      </Form.Item>
+      {enabled && modes.length > 0 && (
+        <>
+          <Form.Item label={t("modelProfile.thinkingMode")}>
+            <Select
+              aria-label={t("modelProfile.thinkingMode")}
+              value={selectedMode === "default" ? undefined : selectedMode}
+              placeholder={t("modelProfile.chooseThinkingMode")}
+              disabled={pending || fixed || !enabled}
+              getPopupContainer={(trigger) => trigger.parentElement!}
+              options={modes.map((value) => ({
+                value,
+                label: t(`modelProfile.thinkingModeOption.${value}`),
+              }))}
+              onChange={onModeChange}
+            />
+          </Form.Item>
+          {selectedMode !== "default" && (
+            <ModelParameterField
+              label={t("modelProfile.thinkingDegree")}
+              rule={rule}
+              values={{ [key]: prefill }}
+              pending={pending || fixed}
+              scope={declaredControlsOnly ? "conversation" : "outlet"}
+              hideReset
+              onChange={onValueChange}
+              onReset={(field) => onValueChange(field, undefined)}
+            />
+          )}
+        </>
+      )}
+    </div>
+  );
+}
diff --git a/frontend/lib/conversationModelDrafts.ts b/frontend/lib/conversationModelDrafts.ts
new file mode 100644
index 0000000000..fb55a9f9e2
--- /dev/null
+++ b/frontend/lib/conversationModelDrafts.ts
@@ -0,0 +1,91 @@
+// Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
+import {
+  getConversationModelPreferences,
+  patchConversationModelPreferences,
+} from "@/services/modelProfileService";
+
+// Unsent choices belong to one local thread, never to browser-wide preferences.
+const drafts = new Map<string, Map<number, Record<string, unknown>>>();
+const selections = new Map<string, string>();
+
+export function readModelSelectionDraft(scope: string) {
+  return selections.get(scope);
+}
+
+export function selectModelDraft(scope: string, modelId: string) {
+  selections.set(scope, modelId);
+}
+
+export function readModelDraft(scope: string, modelId: number) {
+  return { ...drafts.get(scope)?.get(modelId) };
+}
+
+export function patchModelDraft(
+  scope: string,
+  modelId: number,
+  values: Record<string, unknown>,
+  deleted: string[]
+) {
+  const next = readModelDraft(scope, modelId);
+  deleted.forEach((key) => delete next[key]);
+  Object.assign(next, values);
+  const models = drafts.get(scope) ?? new Map();
+  if (Object.keys(next).length) models.set(modelId, next);
+  else models.delete(modelId);
+  if (models.size) drafts.set(scope, models);
+  else drafts.delete(scope);
+}
+
+/** Persist existing-conversation drafts before running; failed patches retain intent. */
+export async function persistModelDrafts(
+  scope: string,
+  conversationId?: number
+) {
+  const snapshot = [...(drafts.get(scope)?.entries() ?? [])].map(
+    ([id, values]) => [id, { ...values }] as const
+  );
+  if (!snapshot.length) return conversationId;
+  if (!conversationId) return undefined;
+  const id = conversationId;
+  for (const [modelId, values] of snapshot) {
+    const saved = await getConversationModelPreferences(id, modelId);
+    await patchConversationModelPreferences(id, modelId, {
+      expected_version: saved.version,
+      parameter_values: values,
+      delete_parameters: [],
+    });
+  }
+  acknowledgeModelDrafts(scope, Object.fromEntries(snapshot));
+  return id;
+}
+
+/** Freeze the first-turn intent without creating a conversation of the wrong mode. */
+export function snapshotModelDrafts(
+  scope: string
+): Record<string, Record<string, unknown>> {
+  return Object.fromEntries(
+    [...(drafts.get(scope)?.entries() ?? [])].map(([id, values]) => [
+      String(id),
+      structuredClone(values),
+    ])
+  );
+}
+
+/** A response identity confirms persistence; edits made during the request remain drafts. */
+export function acknowledgeModelDrafts(
+  scope: string,
+  sent: Record<string, Record<string, unknown>>
+) {
+  for (const [id, values] of Object.entries(sent)) {
+    const current = readModelDraft(scope, Number(id));
+    for (const [key, value] of Object.entries(values)) {
+      if (JSON.stringify(current[key]) === JSON.stringify(value))
+        delete current[key];
+    }
+    const models = drafts.get(scope);
+    if (Object.keys(current).length) models?.set(Number(id), current);
+    else models?.delete(Number(id));
+    if (!models?.size) drafts.delete(scope);
+  }
+}
diff --git a/frontend/public/locales/en/common.json b/frontend/public/locales/en/common.json
index 0c2ee13812..3ffba4ff59 100644
--- a/frontend/public/locales/en/common.json
+++ b/frontend/public/locales/en/common.json
@@ -1,4 +1,4 @@
-{
+{
   "toolConfig.deepseek.onlyHighQuality": "High-quality results only",
   "workbench.genericAgentName": "Agent Workbench",
   "workbench.landingGreeting": "Hi, I'm Nexent. What can I help you with?",
@@ -1548,10 +1548,10 @@
   "modelConfig.slider.maximumChunkSize": "Maximum Chunk Size",
   "modelConfig.input.chunkingBatchSize": "Concurrent Request Count",
   "modelConfig.addDialog.rowSettingsDescEmbedding": "Chunking and multimodal settings (empty fields use defaults)",
-  "modelConfig.addDialog.batchSuccess": "Added {{count}} model(s)",
-  "modelConfig.addDialog.batchPartial": "Added {{count}} model(s), {{failed}} failed",
+  "modelConfig.addDialog.batchSuccess": "Added {{created}} models",
+  "modelConfig.addDialog.batchPartial": "Added {{created}} models, {{failed}} failed",
   "modelConfig.addDialog.batchPartialDuplicates": "Added {{count}} model(s), {{failed}} failed, of which {{duplicates}} already exist ({{names}})",
-  "modelConfig.addDialog.batchAllFailed": "All {{failed}} model(s) failed to add, please check and retry",
+  "modelConfig.addDialog.batchAllFailed": "All {{failed}} models failed to add. Please check and retry.",
   "modelConfig.addDialog.batchAllDuplicates": "All {{total}} model(s) failed to add: already exist ({{names}}); do not add duplicates",
   "modelConfig.addDialog.batchAllFailedDuplicates": "All {{failed}} model(s) failed to add: {{duplicates}} already exist ({{names}}), {{others}} failed for other reasons, please check and retry",
   "businessLogic.title": "Describe how should this Agent work",
@@ -5971,9 +5971,6 @@
   "modelConfig.addDialog.advancedSettings": "Advanced Settings",
   "modelConfig.editDialog.checkConnectivity": "Verify Connectivity",
   "modelConfig.addDialog.baseUrlRequired": "Custom provider requires Base URL",
-  "modelConfig.addDialog.batchSuccess": "Added {{created}} models",
-  "modelConfig.addDialog.batchPartial": "Added {{created}} models, {{failed}} failed",
-  "modelConfig.addDialog.batchAllFailed": "All {{failed}} models failed to add. Please check and retry.",
   "modelConfig.addDialog.fetchModels": "Fetch model list",
   "modelConfig.addDialog.fetchedTitle": "Available models",
   "modelConfig.addDialog.toggleAll": "Select/Deselect all",
@@ -6174,6 +6171,171 @@
   "notifications.deepLink.mcpNotFound": "The linked MCP service was not found",
   "a2a.security.requirementRequired": "Please select an authentication method",
   "common.error.loadFailed": "Failed to load data. Please try again later.",
+  "modelProfile": {
+    "provider": "Model provider",
+    "customProvider": "Custom provider",
+    "endpoint": "Endpoint",
+    "requestModel": "Request model ID",
+    "displayName": "Display name",
+    "apiKey": "API key",
+    "optionalApiKey": "Optional; leave blank to connect without an API key",
+    "previewRequired": "Wait for a valid profile preview",
+    "previewLoading": "Matching and validating profiles…",
+    "previewFailed": "Profile preview failed. Check configuration and parameter dependencies.",
+    "extrasInvalid": "Check custom request parameters: complete names and values and remove duplicates.",
+    "catalogFailed": "Catalog unavailable. Use custom settings or retry later.",
+    "referenceOnly": "Configuration filled from the profile. Please review before saving.",
+    "advanced": "Advanced settings",
+    "manualSelection": "Select atomic profiles manually (otherwise match unselected profiles automatically)",
+    "modelProfile": "Model profile",
+    "sslVerify": "TLS certificate verification",
+    "skipTlsVerify": "Skip TLS certificate verification",
+    "timeout": "Request timeout (seconds)",
+    "extraParameters": "Custom request parameters",
+    "extraHelp": "Add optional model API fields. Enter a field name or a nested /parent/child path. Connection, authentication, messages and tools remain managed by Nexent.",
+    "reset": "Reset to profile default",
+    "omitParameter": "Omit this parameter",
+    "useOutletDefault": "Use outlet default",
+    "saveAndCheck": "Save and check connection",
+    "savedAvailable": "Outlet saved and connection available",
+    "savedUnavailable": "Outlet saved, but the connection check failed. Review its settings in the model list.",
+    "savedCheckFailed": "Outlet saved, but the connection check did not complete. Retry from the model list.",
+    "saveFailed": "Outlet could not be saved. Refresh the profile preview and retry.",
+    "edit": "Edit model outlet",
+    "loadFailed": "Unable to load the saved outlet",
+    "saved": "Model outlet saved",
+    "editFailed": "Save failed. Check parameters. If the revision changed, reopen the editor before retrying.",
+    "frozenRules": "Uses saved outlet rules. Add a new outlet to select a different model or atomic profile.",
+    "replaceWholeKey": "Replace all stars before entering a new key.",
+    "keepKey": "Stars indicate a saved key. Delete all stars to clear it, or enter a new key to replace it.",
+    "combined_window": "Context window length (tokens)",
+    "input_limit": "Hard input limit (tokens)",
+    "output_limit": "Hard output limit (tokens)",
+    "parameters": "Parameters",
+    "sessionParameters": "Model parameters for this conversation",
+    "preferencesAfterCreate": "Preferences can be saved after the conversation is created. New conversations use outlet defaults.",
+    "preferencesInvalid": "Saved preferences are invalid. Edit or explicitly remove them before retrying.",
+    "preferencesScope": "Only explicit choices are saved for this conversation. Running requests are unchanged.",
+    "preferencesFailed": "Save failed. Check parameters or reopen to load the latest revision.",
+    "outputReserve": "Default output reserve (tokens)",
+    "tokenizer": "Tokenizer identifier",
+    "modelUnavailable": "The selected model outlet is unavailable. Check its configuration or explicitly select a model.",
+    "autoProfile": "Auto match or select a profile",
+    "otherProfile": "Other (conservative defaults)",
+    "sharedCredential": "Uses the shared batch API key",
+    "samplingGroup": "Sampling",
+    "requestGroup": "Request settings",
+    "modelParameters": "Model parameters",
+    "capacityGroup": "Context and output limits",
+    "httpGroup": "HTTP connection",
+    "batchConfigurationHint": "Configure this model only. Connection settings come from the batch page. Save to return to the model list.",
+    "configureModel": "Configure model",
+    "checkModel": "Check model",
+    "reasoningSupport": "Reasoning",
+    "toolSupport": "Native tool calls",
+    "supported": "Supported",
+    "unsupported": "Unsupported",
+    "unknown": "Unknown",
+    "agentParameters": "Agent model settings",
+    "parameterPriority": "Conversation > this model in the Agent > model outlet defaults",
+    "agentParametersScope": "Overrides apply only to this model in this Agent. Unchanged values inherit outlet defaults. Conversation choices take precedence. Connection and full advanced settings remain on the model page.",
+    "agentContextWindow": "Context window (tokens)",
+    "useInheritedDefault": "Inherit Agent / outlet settings",
+    "parameterName": "Parameter name",
+    "parameterType": "Type",
+    "parameterValue": "Value",
+    "parameterIndex": "Item",
+    "addParameter": "Add parameter",
+    "parameterRowsInvalid": "Complete parameter names and values, and remove duplicate names.",
+    "valueType": {
+      "string": "Text",
+      "number": "Number",
+      "boolean": "Boolean",
+      "object": "Object",
+      "array": "List",
+      "null": "Null"
+    },
+    "parameterLabel": {
+      "enable_thinking": "Enable thinking",
+      "reasoning_effort": "Thinking effort",
+      "reasoning_budget_tokens": "Thinking budget (tokens)",
+      "temperature": "Temperature",
+      "top_k": "Top K",
+      "top_p": "Top P",
+      "max_output_tokens": "Maximum response tokens"
+    },
+    "approximateMatch": "Model identified. You can adjust the profile.",
+    "inheritedOutputLimit": "Output capability of this model outlet. The runtime determines each request’s output length using its context budget.",
+    "maximumOutput": "Maximum output length (tokens)",
+    "thinkingGroup": "Thinking settings",
+    "thinkingControl": "Thinking switch field format",
+    "thinkingControlHelp": "Normally inherit the profile. For custom services, select the documented API format. This does not verify support.",
+    "thinkingDefaultHint": "No thinking switch is declared. Use the service default or select an explicit field format.",
+    "thinkingFormat": {
+      "profile_default": "Profile / service default",
+      "enable_thinking": "enable_thinking",
+      "thinking_type": "thinking.type",
+      "chat_template": "chat_template_kwargs.enable_thinking"
+    },
+    "thinkingToggle": "Enable thinking",
+    "thinkingMode": "Thinking control type",
+    "chooseThinkingMode": "Select configuration type",
+    "thinkingBudgetPlaceholder": "Enter thinking budget",
+    "thinkingLevel": {
+      "none": "None",
+      "minimal": "Minimal",
+      "low": "Low",
+      "medium": "Medium",
+      "high": "High",
+      "xhigh": "Extra high",
+      "max": "Maximum"
+    },
+    "thinkingDegree": "Thinking level",
+    "thinkingServiceDefault": "Use service default",
+    "thinkingModeOption": {
+      "default": "Service default",
+      "effort": "Effort level",
+      "budget_tokens": "Token budget"
+    },
+    "catalogChanged": "Profiles updated. Please refresh.",
+    "catalogChangedDetail": "This draft refers to an older profile version. Refresh profiles to retain your entries and selections, then review the revalidated draft before saving.",
+    "refreshCatalog": "Refresh profiles",
+    "retryPreview": "Retry validation",
+    "baseConfiguration": "Base model configuration",
+    "layout": {
+      "emptyTitle": "Enter a model name to load parameters",
+      "emptyDescription": "A profile is matched automatically. You can also select or adjust it.",
+      "source": "Profile",
+      "reset": "Restore profile defaults",
+      "advancedHint": "TLS, timeout, authentication and custom parameters",
+      "checkAfterSave": "Connectivity checked after saving",
+      "awaitingProfile": "Enter an endpoint to load configuration"
+    }
+  },
+  "modelMigration": {
+    "pending": "Migrated · Review needed",
+    "reviewed": "Migrated · Reviewed",
+    "failed": "Migration failed",
+    "pendingHint": "Migrated from an earlier version. An administrator should check preserved settings and added defaults. This reminder does not block use.",
+    "reviewedHint": "An administrator has reviewed this configuration version. The migration source is retained.",
+    "failedHint": "This outlet could not be migrated. An administrator must review and resolve its configuration.",
+    "review": "Review migration",
+    "reviewTitle": "Review migrated model settings",
+    "confirm": "Confirm this version reviewed",
+    "confirmed": "This configuration version has been reviewed",
+    "confirmFailed": "Confirmation failed. Settings may have changed; reopen and review them.",
+    "loadFailed": "Unable to load outlet settings. Close and retry.",
+    "unknown": "Not configured / Unknown",
+    "revision": "Configuration revision",
+    "contextWindow": "Context window",
+    "nativeTools": "Native tool calling",
+    "reasoning": "Reasoning capability",
+    "parameters": "Saved default parameters",
+    "credentialPresent": "Credential configured (content hidden)",
+    "credentialAbsent": "No credential configured",
+    "inputLimit": "Input limit",
+    "outputLimit": "Output limit"
+  },
   "workbench.controls.mineTab": "Mine",
   "workbench.controls.repositoryTab": "Repository",
   "workbench.import.precheckTitle": "Import precheck",
diff --git a/frontend/public/locales/zh/common.json b/frontend/public/locales/zh/common.json
index 1b4fd69c60..43e8a4c570 100644
--- a/frontend/public/locales/zh/common.json
+++ b/frontend/public/locales/zh/common.json
@@ -1,4 +1,4 @@
-{
+{
   "toolConfig.deepseek.onlyHighQuality": "仅优质内容",
   "workbench.genericAgentName": "智能体工作台",
   "workbench.landingGreeting": "你好，我是 Nexent，需要我帮你做什么？",
@@ -1443,8 +1443,8 @@
   "modelConfig.slider.maximumChunkSize": "最大切片大小",
   "modelConfig.input.chunkingBatchSize": "单次请求切片量",
   "modelConfig.addDialog.rowSettingsDescEmbedding": "切片与多模态配置（留空使用默认值）",
-  "modelConfig.addDialog.batchSuccess": "已添加 {{count}} 个模型",
-  "modelConfig.addDialog.batchPartial": "已添加 {{count}} 个模型，{{failed}} 个失败",
+  "modelConfig.addDialog.batchSuccess": "已添加 {{created}} 个模型",
+  "modelConfig.addDialog.batchPartial": "已添加 {{created}} 个模型，{{failed}} 个失败",
   "modelConfig.addDialog.batchPartialDuplicates": "已添加 {{count}} 个模型，{{failed}} 个失败，其中 {{duplicates}} 个模型已存在（{{names}}）",
   "modelConfig.addDialog.batchAllFailed": "全部 {{failed}} 个模型添加失败，请检查后重试",
   "modelConfig.addDialog.batchAllDuplicates": "全部 {{total}} 个模型添加失败：模型已存在（{{names}}），请勿重复添加",
@@ -5911,13 +5911,10 @@
   "modelConfig.addDialog.advancedSettings": "高级设置",
   "modelConfig.editDialog.checkConnectivity": "检测连通性",
   "modelConfig.addDialog.baseUrlRequired": "自定义服务商需要填写 Base URL",
-  "modelConfig.addDialog.batchSuccess": "已添加 {{created}} 个模型",
-  "modelConfig.addDialog.batchPartial": "已添加 {{created}} 个模型，{{failed}} 个失败",
-  "modelConfig.addDialog.batchAllFailed": "全部 {{failed}} 个模型添加失败，请检查后重试",
   "modelConfig.addDialog.fetchModels": "获取模型列表",
   "modelConfig.addDialog.fetchedTitle": "可用模型",
   "modelConfig.addDialog.toggleAll": "全选/取消",
-  "modelConfig.addDialog.fetchHint": "填写 API Key 后获取模型列表",
+  "modelConfig.addDialog.fetchHint": "填写服务连接信息后获取模型列表",
   "modelConfig.addDialog.selectedCount": "已选 {{selectedCount}} 个模型",
   "modelConfig.addDialog.batchCheck": "批量检测",
   "modelConfig.addDialog.rowSettingsDesc": "容量与推理参数（留空使用默认值）",
@@ -6174,6 +6171,171 @@
   "notifications.deepLink.mcpNotFound": "未找到链接对应的 MCP 服务",
   "a2a.security.requirementRequired": "请选择认证方式",
   "common.error.loadFailed": "加载失败，请稍后重试",
+  "modelProfile": {
+    "provider": "模型服务提供商",
+    "customProvider": "自定义提供商",
+    "endpoint": "服务地址",
+    "requestModel": "实际请求模型名称",
+    "displayName": "显示名称",
+    "apiKey": "API Key",
+    "optionalApiKey": "选填；留空不使用 API Key 认证",
+    "previewRequired": "请等待有效的档案预览",
+    "previewLoading": "正在匹配和校验档案…",
+    "previewFailed": "档案预览失败，请检查配置或参数依赖后重试",
+    "extrasInvalid": "请检查自定义请求参数，补全参数名和值并移除重复项。",
+    "catalogFailed": "档案目录加载失败，可以继续自定义接入或稍后重试",
+    "referenceOnly": "已根据档案预填配置，请确认后保存",
+    "advanced": "高级配置",
+    "manualSelection": "手动选择原子档案（关闭时自动匹配未选项）",
+    "modelProfile": "模型档案",
+    "sslVerify": "TLS 证书校验",
+    "skipTlsVerify": "忽略 TLS 证书校验",
+    "timeout": "请求超时（秒）",
+    "extraParameters": "自定义请求参数",
+    "extraHelp": "按需添加模型接口参数。普通字段填写参数名；嵌套路径可使用 /父字段/子字段。不要填写连接地址、鉴权或由 Nexent 管理的消息与工具字段。",
+    "reset": "恢复档案默认值",
+    "omitParameter": "不发送此参数",
+    "useOutletDefault": "使用出口默认值",
+    "saveAndCheck": "保存并检查连接",
+    "savedAvailable": "模型出口已保存，连接可用",
+    "savedUnavailable": "模型出口已保存，但连接检查未通过，请在模型列表中检查配置",
+    "savedCheckFailed": "模型出口已保存，但连接检查未完成，请在模型列表中重试",
+    "saveFailed": "模型出口保存失败，请重新预览配置后重试",
+    "edit": "编辑模型出口",
+    "loadFailed": "无法读取已保存的出口配置",
+    "saved": "模型出口已保存",
+    "editFailed": "保存失败，请检查参数；如配置版本已变化，请重新打开编辑后重试。",
+    "frozenRules": "使用已保存的出口规则；切换模型或原子档案请重新添加出口。",
+    "replaceWholeKey": "请完整替换星号后输入新密钥。",
+    "keepKey": "星号表示已保存密钥；删除全部星号可清除，输入新值可替换。",
+    "combined_window": "上下文窗口长度（Token）",
+    "input_limit": "输入硬上限（tokens）",
+    "output_limit": "输出硬上限（tokens）",
+    "parameters": "模型参数",
+    "sessionParameters": "当前会话的模型参数",
+    "preferencesAfterCreate": "会话创建后可保存参数偏好；新会话默认使用出口配置",
+    "preferencesInvalid": "已有偏好不再符合当前出口规则，请修改或明确删除后重试",
+    "preferencesScope": "仅保存本会话中明确调整的值；运行中的请求不受影响",
+    "preferencesFailed": "保存失败：请检查参数或重新打开以获取最新配置版本",
+    "outputReserve": "默认输出预留（tokens）",
+    "tokenizer": "Token 估算器标识",
+    "modelUnavailable": "所选模型出口已不可用，请检查配置或手动重新选择模型。",
+    "autoProfile": "自动匹配，可手动选择",
+    "otherProfile": "其他（保守配置）",
+    "sharedCredential": "使用批量添加的 API Key",
+    "samplingGroup": "采样配置",
+    "requestGroup": "请求配置",
+    "modelParameters": "模型参数",
+    "capacityGroup": "上下文与输出限制",
+    "httpGroup": "HTTP 连接",
+    "batchConfigurationHint": "仅配置当前模型；连接信息使用批量添加页面的值。保存配置后返回模型列表。",
+    "configureModel": "配置模型",
+    "checkModel": "检测模型",
+    "reasoningSupport": "思考能力",
+    "toolSupport": "原生工具调用",
+    "supported": "支持",
+    "unsupported": "不支持",
+    "unknown": "未知",
+    "agentParameters": "Agent 模型配置",
+    "parameterPriority": "会话配置 > Agent 中该模型的配置 > 模型出口默认配置",
+    "agentParametersScope": "只覆盖当前 Agent 中的这个模型。未修改的参数继承模型出口；会话可进一步覆盖常用参数。连接与完整高级配置请在模型接入页调整。",
+    "agentContextWindow": "上下文长度（Token）",
+    "useInheritedDefault": "继承 Agent / 出口配置",
+    "parameterName": "参数名",
+    "parameterType": "类型",
+    "parameterValue": "值",
+    "parameterIndex": "序号",
+    "addParameter": "添加参数",
+    "parameterRowsInvalid": "请补全参数名和值，并移除重复的参数名。",
+    "valueType": {
+      "string": "文本",
+      "number": "数值",
+      "boolean": "开关",
+      "object": "对象",
+      "array": "列表",
+      "null": "空值"
+    },
+    "parameterLabel": {
+      "enable_thinking": "启用思考",
+      "reasoning_effort": "思考深度",
+      "reasoning_budget_tokens": "思考预算（Token）",
+      "temperature": "温度",
+      "top_k": "Top K",
+      "top_p": "Top P",
+      "max_output_tokens": "单次请求最大输出（Token）"
+    },
+    "approximateMatch": "已识别模型，可手动调整",
+    "inheritedOutputLimit": "模型出口支持的输出上限；单次请求的输出长度由运行时结合上下文预算决定。",
+    "maximumOutput": "最大输出长度（Token）",
+    "thinkingGroup": "思考配置",
+    "thinkingControl": "思考开关字段格式",
+    "thinkingControlHelp": "通常沿用档案。自定义服务需按其 API 选择，选择本身不代表已验证。",
+    "thinkingDefaultHint": "档案未声明可用的思考开关；将使用服务默认行为，也可手动指定字段格式。",
+    "thinkingFormat": {
+      "profile_default": "沿用档案 / 服务默认",
+      "enable_thinking": "enable_thinking",
+      "thinking_type": "thinking.type",
+      "chat_template": "chat_template_kwargs.enable_thinking"
+    },
+    "thinkingToggle": "启用思考",
+    "thinkingMode": "思考程度类型",
+    "chooseThinkingMode": "请选择配置类型",
+    "thinkingBudgetPlaceholder": "填写思考预算",
+    "thinkingLevel": {
+      "none": "无",
+      "minimal": "极低",
+      "low": "低",
+      "medium": "中",
+      "high": "高",
+      "xhigh": "极高",
+      "max": "最高"
+    },
+    "thinkingDegree": "思考程度",
+    "thinkingServiceDefault": "使用服务默认值",
+    "thinkingModeOption": {
+      "default": "服务默认",
+      "effort": "档位",
+      "budget_tokens": "Token 预算"
+    },
+    "catalogChanged": "档案已更新，请刷新",
+    "catalogChangedDetail": "当前草稿引用的档案版本已变化。刷新档案后将保留已填写的配置和手动选择，重新校验后请检查再保存。",
+    "refreshCatalog": "刷新档案",
+    "retryPreview": "重新校验",
+    "baseConfiguration": "模型基础配置",
+    "layout": {
+      "emptyTitle": "填写模型名称后自动带出参数",
+      "emptyDescription": "系统会匹配模型档案，也可手动选择或修改",
+      "source": "来自档案",
+      "reset": "恢复档案默认",
+      "advancedHint": "TLS、超时、认证与自定义参数",
+      "checkAfterSave": "保存后检测连通性",
+      "awaitingProfile": "填写服务地址后加载配置"
+    }
+  },
+  "modelMigration": {
+    "pending": "旧版本迁移 · 待检查",
+    "reviewed": "旧版本迁移 · 已检查",
+    "failed": "迁移异常",
+    "pendingHint": "从旧版本迁移，请管理员核对保留的配置和自动补充的默认值。此提醒不影响出口正常使用。",
+    "reviewedHint": "管理员已检查当前配置版本，保留旧版本迁移来源标识。",
+    "failedHint": "此模型出口未能完成迁移，请管理员检查并处理配置异常。",
+    "review": "检查迁移配置",
+    "reviewTitle": "检查旧版本迁移的模型配置",
+    "confirm": "确认已检查此版本",
+    "confirmed": "已确认检查当前配置版本",
+    "confirmFailed": "确认失败，配置可能已变化，请关闭后重新检查",
+    "loadFailed": "无法读取出口配置，请关闭后重试",
+    "unknown": "未配置 / 未知",
+    "revision": "配置版本",
+    "contextWindow": "上下文窗口",
+    "nativeTools": "原生工具调用",
+    "reasoning": "思考能力",
+    "parameters": "保存的默认参数",
+    "credentialPresent": "已配置凭据（不显示内容）",
+    "credentialAbsent": "未配置凭据",
+    "inputLimit": "输入限制",
+    "outputLimit": "输出限制"
+  },
   "workbench.controls.mineTab": "我的",
   "workbench.controls.repositoryTab": "仓库",
   "workbench.import.precheckTitle": "导入预检",
diff --git a/frontend/tests/component/modelThinkingSettings.test.tsx b/frontend/tests/component/modelThinkingSettings.test.tsx
new file mode 100644
index 0000000000..2e83305f58
--- /dev/null
+++ b/frontend/tests/component/modelThinkingSettings.test.tsx
@@ -0,0 +1,223 @@
+// Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
+import { App } from "antd";
+import { fireEvent, render, screen } from "@testing-library/react";
+import { beforeEach, expect, it, vi } from "vitest";
+import zh from "../../public/locales/zh/common.json";
+import en from "../../public/locales/en/common.json";
+import type { ModelParameterRule } from "../../types/modelProfile";
+import { ModelThinkingSettings } from "../../components/model/ModelThinkingSettings";
+const locale = vi.hoisted(() => ({ value: "zh" }));
+vi.mock("react-i18next", () => ({
+  useTranslation: () => ({
+    t: (key: string, options?: { defaultValue?: string }) => {
+      if (!key.startsWith("modelProfile.thinkingLevel.")) return key;
+      const levels = (locale.value === "zh" ? zh : en).modelProfile
+        .thinkingLevel as Record<string, string>;
+      return levels[key.split(".").at(-1)!] ?? options?.defaultValue ?? key;
+    },
+  }),
+}));
+beforeEach(() => {
+  locale.value = "zh";
+});
+
+it("starts custom thinking off and hides both degree inputs", () => {
+  const toggle = vi.fn();
+  render(
+    <App>
+      <ModelThinkingSettings
+        rules={[]}
+        values={{}}
+        onToggle={toggle}
+        onModeChange={vi.fn()}
+        onValueChange={vi.fn()}
+      />
+    </App>
+  );
+  expect(screen.getByRole("switch")).not.toBeChecked();
+  expect(screen.queryByRole("combobox")).not.toBeInTheDocument();
+  fireEvent.click(screen.getByRole("switch"));
+  expect(toggle).toHaveBeenCalledWith(true);
+});
+
+it("prefills the declared budget and respects its domain", () => {
+  render(
+    <App>
+      <ModelThinkingSettings
+        rules={[
+          {
+            key: "reasoning_budget_tokens",
+            schema: { type: "integer", minimum: 128, maximum: 81920 },
+            ui_group: "reasoning",
+            visible: true,
+            editable: true,
+            required: false,
+            allowed_scopes: ["outlet"],
+          },
+        ]}
+        values={{}}
+        defaults={{ enable_thinking: true, reasoning_budget_tokens: 4096 }}
+        onToggle={vi.fn()}
+        onModeChange={vi.fn()}
+        onValueChange={vi.fn()}
+      />
+    </App>
+  );
+  expect(screen.getByRole("switch")).toBeChecked();
+  expect(
+    screen.getByRole("spinbutton", { name: "modelProfile.thinkingDegree" })
+  ).toHaveValue("4096");
+  expect(screen.getByRole("spinbutton")).toHaveAttribute(
+    "aria-valuemin",
+    "128"
+  );
+  expect(screen.getByRole("spinbutton")).toHaveAttribute(
+    "aria-valuemax",
+    "81920"
+  );
+});
+
+it("keeps a profile-fixed thinking switch disabled", () => {
+  render(
+    <App>
+      <ModelThinkingSettings
+        rules={[
+          {
+            key: "enable_thinking",
+            schema: { type: "boolean" },
+            ui_group: "reasoning",
+            visible: true,
+            editable: false,
+            required: false,
+            allowed_scopes: ["outlet"],
+          },
+        ]}
+        values={{ enable_thinking: true }}
+        onToggle={vi.fn()}
+        onModeChange={vi.fn()}
+        onValueChange={vi.fn()}
+      />
+    </App>
+  );
+  expect(screen.getByRole("switch")).toBeDisabled();
+});
+
+const effort: ModelParameterRule = {
+  key: "reasoning_effort",
+  schema: { type: "string", enum: ["low", "medium", "high"] },
+  ui_group: "reasoning",
+  visible: true,
+  editable: true,
+  required: false,
+  allowed_scopes: ["outlet"],
+};
+const budget: ModelParameterRule = {
+  ...effort,
+  key: "reasoning_budget_tokens",
+  schema: { type: "integer", minimum: 128, maximum: 81920 },
+};
+function showThinking(
+  props: Partial<React.ComponentProps<typeof ModelThinkingSettings>> = {}
+) {
+  const changed = vi.fn();
+  render(
+    <App>
+      <ModelThinkingSettings
+        rules={[effort, budget]}
+        values={{ enable_thinking: true }}
+        onToggle={vi.fn()}
+        onModeChange={vi.fn()}
+        onValueChange={changed}
+        {...props}
+      />
+    </App>
+  );
+  return changed;
+}
+
+it("UI-THINKING-09 prefers effort when both modes are supported and materializes low in the draft", () => {
+  const changed = showThinking();
+  expect(screen.getByText("低")).toBeInTheDocument();
+  expect(changed).toHaveBeenCalledWith("reasoning_effort", "low");
+  expect(
+    screen.queryByText("modelProfile.thinkingModeOption.default")
+  ).not.toBeInTheDocument();
+});
+
+it.each(["zh", "en"])(
+  "UI-THINKING-09 translates %s effort labels but submits the original enum",
+  async (language) => {
+    locale.value = language;
+    const changed = showThinking({ rules: [effort] });
+    fireEvent.mouseDown(
+      screen.getByRole("combobox", { name: "modelProfile.thinkingDegree" })
+    );
+    fireEvent.click(await screen.findByText(language === "zh" ? "高" : "High"));
+    expect(changed).toHaveBeenLastCalledWith("reasoning_effort", "high");
+  }
+);
+
+it("UI-THINKING-09 preserves experience budget preference instead of selecting effort", () => {
+  const changed = showThinking({ defaults: { reasoning_budget_tokens: 4096 } });
+  expect(screen.getByRole("spinbutton")).toHaveValue("4096");
+  expect(changed).not.toHaveBeenCalled();
+});
+
+it("UI-THINKING-09 preserves saved effort over experience defaults", () => {
+  const changed = showThinking({
+    values: { enable_thinking: true, reasoning_effort: "high" },
+    defaults: { reasoning_effort: "low" },
+  });
+  expect(screen.getByText("高")).toBeInTheDocument();
+  expect(changed).not.toHaveBeenCalled();
+});
+
+it("UI-THINKING-09 fills half the declared budget limit before the output limit", () => {
+  const changed = showThinking({ rules: [budget], outputLimit: 16000 });
+  expect(screen.getByRole("spinbutton")).toHaveValue("40960");
+  expect(changed).toHaveBeenCalledWith("reasoning_budget_tokens", 40960);
+});
+
+it("UI-THINKING-09 uses half the output limit when the budget limit is missing", () => {
+  const changed = showThinking({
+    rules: [{ ...budget, schema: { type: "integer", minimum: 128 } }],
+    outputLimit: 16001,
+  });
+  expect(screen.getByRole("spinbutton")).toHaveValue("8000");
+  expect(changed).toHaveBeenCalledWith("reasoning_budget_tokens", 8000);
+});
+
+it("UI-THINKING-09 respects the declared budget minimum", () => {
+  const changed = showThinking({
+    rules: [
+      { ...budget, schema: { type: "integer", minimum: 1024, maximum: 1600 } },
+    ],
+  });
+  expect(changed).toHaveBeenCalledWith("reasoning_budget_tokens", 1024);
+});
+
+it("UI-THINKING-09 does not invent a budget without either limit", () => {
+  const changed = showThinking({
+    rules: [{ ...budget, schema: { type: "integer" } }],
+  });
+  expect(screen.getByRole("spinbutton")).toHaveValue("");
+  expect(changed).not.toHaveBeenCalled();
+});
+
+it("UI-THINKING-09 does not add degree parameters while thinking is off", () => {
+  const changed = showThinking({
+    values: { enable_thinking: false },
+    layout: "panel",
+  });
+  expect(
+    screen.queryByRole("combobox", { name: "modelProfile.thinkingDegree" })
+  ).not.toBeInTheDocument();
+  expect(changed).not.toHaveBeenCalled();
+});
+
+it("UI-THINKING-09 waits for the current preview before materializing fallback values", () => {
+  const changed = showThinking({ prefillReady: false });
+  expect(changed).not.toHaveBeenCalled();
+  expect(screen.queryByText("低")).not.toBeInTheDocument();
+});
diff --git a/test/backend/agents/test_agent_outlet_run_snapshot.py b/test/backend/agents/test_agent_outlet_run_snapshot.py
new file mode 100644
index 0000000000..dd1a42f666
--- /dev/null
+++ b/test/backend/agents/test_agent_outlet_run_snapshot.py
@@ -0,0 +1,135 @@
+# Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
+"""Model selection and per-turn snapshots preserve the shared Agent boundary."""
+
+import sys
+from types import ModuleType, SimpleNamespace
+from unittest.mock import AsyncMock, Mock
+
+import pytest
+
+from test_create_agent_info import create_agent_info_module as module
+from test.backend.database.model_outlet_helpers import REGISTRY, profile  # noqa: F401
+
+
+def test_exact_record_uses_frozen_profile_not_legacy_fields(monkeypatch):
+    snapshot = object()
+    record = {'tenant_id': 'tenant', 'model_repo': 'ignored', 'model_name': 'ignored'}
+    restore = Mock(return_value=snapshot)
+    resolved = Mock(return_value='resolved-config')
+    monkeypatch.setattr(module, 'restore_model_snapshot', restore)
+    monkeypatch.setattr(module, '_resolved_model_config', resolved)
+    assert module.create_model_config_from_record(record) == 'resolved-config'
+    restore.assert_called_once_with(record, 'tenant')
+    resolved.assert_called_once_with(record, snapshot)
+
+
+@pytest.mark.asyncio
+async def test_model_list_skips_failed_rows_and_restores_default_aliases(monkeypatch):
+    record = {'model_id': 12, 'profile_schema_version': 1, 'tenant_id': 'tenant'}
+    monkeypatch.setattr(module, 'get_model_records', Mock(return_value=[{'model_id': 99}, record]))
+    snapshot = object()
+    monkeypatch.setattr(module, 'restore_model_snapshot', Mock(return_value=snapshot))
+    monkeypatch.setattr(module, 'create_model_config_from_record', Mock(return_value='selected'))
+    monkeypatch.setattr(module.tenant_config_manager, 'get_model_config', Mock(return_value=record))
+    monkeypatch.setattr(module, '_resolved_model_config', Mock(side_effect=lambda row, snap, cite_name=None: cite_name))
+    result = await module.create_model_config_list('tenant')
+    assert result == ['selected', 'main_model', 'sub_model']
+    module.create_model_config_from_record.assert_called_once_with(record)
+
+
+def test_root_preferences_use_original_outlet_then_agent_values_without_mutating_children(monkeypatch):
+    merge = Mock(return_value=SimpleNamespace(parameter_values={'temperature': 0}))
+    parameters = ModuleType('services.agent_model_parameters')
+    parameters.merge_runtime_model_parameters = merge
+    monkeypatch.setitem(sys.modules, parameters.__name__, parameters)
+    preferences = ModuleType('services.conversation_model_preferences_service')
+    preferences.merge_model_preferences = Mock(side_effect=AssertionError('must use all explicit layers'))
+    monkeypatch.setitem(sys.modules, preferences.__name__, preferences)
+    original, active = object(), SimpleNamespace(outlet_id=12)
+    root = SimpleNamespace(cite_name='root', resolved_profile=active, default_output_reserve_tokens=256)
+    copy = SimpleNamespace(cite_name='private')
+    root.model_copy = Mock(return_value=copy)
+    child = SimpleNamespace(cite_name='child', resolved_profile=active)
+    models, config = [root, child], SimpleNamespace(model_name='root')
+    module.apply_root_model_preferences(models, config, {'12': {'temperature': 0}},
+        outlet_profiles={12: original}, agent_overrides={'12': {'top_p': 0.8}})
+    merge.assert_called_once_with(original, {'top_p': 0.8}, {'temperature': 0})
+    assert models == [root, child, copy] and config.model_name == 'private'
+    assert child.resolved_profile is active and root.resolved_profile is active
+    assert root.model_copy.call_args.kwargs['update']['default_output_reserve_tokens'] == 256
+
+
+@pytest.mark.asyncio
+async def test_run_captures_database_snapshot_and_validates_output_before_config_assembly(monkeypatch, profile):
+    class Prepared(RuntimeError):
+        pass
+
+    registry = ModuleType('nexent.core.model_service.registry')
+    registry.model_service_references = lambda: REGISTRY
+    monkeypatch.setitem(sys.modules, registry.__name__, registry)
+    preferences = ModuleType('services.conversation_model_preferences_service')
+    preferences.merge_model_preferences = Mock(return_value=SimpleNamespace(parameter_values={'max_output_tokens': 128}))
+    monkeypatch.setitem(sys.modules, preferences.__name__, preferences)
+    selected = SimpleNamespace(cite_name='selected', resolved_profile=profile)
+    monkeypatch.setattr(module, '_build_run_workspace', Mock(return_value='/controlled/workspace'))
+    monkeypatch.setattr(module, '_ensure_agent_reasoning_snapshot', Mock())
+    monkeypatch.setattr(module, 'join_minio_file_description_to_query', AsyncMock(return_value='processed'))
+    monkeypatch.setattr(module, 'create_model_config_list', AsyncMock(return_value=[selected]))
+    monkeypatch.setattr(module, 'search_agent_info_by_agent_id', Mock(return_value={'model_ids': [12]}))
+    monkeypatch.setattr(module, '_select_agent_model_id', Mock(return_value=12))
+    prepare = AsyncMock(side_effect=Prepared())
+    monkeypatch.setattr(module, 'create_agent_config', prepare)
+    before = profile.model_dump()
+    with pytest.raises(Prepared):
+        await module.create_agent_run_info(agent_id=1, minio_files=[], query='input', history=[],
+            user_id='user', tenant_id='tenant-one', language='en', is_debug=True,
+            model_parameter_preferences={'12': {'max_output_tokens': 128}})
+    kwargs = prepare.call_args.kwargs
+    assert kwargs['runtime_output_tokens'] == 128
+    assert kwargs['runtime_model_records'][12]['model_name'] == 'Exact/Model'
+    assert kwargs['runtime_model_records'][12]['tenant_id'] == 'tenant-one'
+    assert 'api_key' not in kwargs['runtime_model_records'][12]
+    preferences.merge_model_preferences.assert_called_once_with(profile, {'max_output_tokens': 128})
+    assert profile.model_dump() == before
+
+
+@pytest.mark.parametrize("preferences", [{}, {"99": {"temperature": 0}}])
+def test_missing_preferences_leave_model_identity_unchanged(monkeypatch, preferences):
+    service = ModuleType('services.conversation_model_preferences_service')
+    service.merge_model_preferences = Mock(side_effect=AssertionError('no matching preference'))
+    monkeypatch.setitem(sys.modules, service.__name__, service)
+    root = SimpleNamespace(cite_name='root', resolved_profile=SimpleNamespace(outlet_id=12))
+    models = [root]
+    config = SimpleNamespace(model_name='root')
+    module.apply_root_model_preferences(models, config, preferences)
+    assert models == [root] and config.model_name == 'root'
+
+
+def test_saved_profile_preferences_work_without_original_catalog_lookup(monkeypatch):
+    service = ModuleType('services.conversation_model_preferences_service')
+    resolved = SimpleNamespace(parameter_values={'max_output_tokens': 512})
+    service.merge_model_preferences = Mock(return_value=resolved)
+    monkeypatch.setitem(sys.modules, service.__name__, service)
+    profile = SimpleNamespace(outlet_id=12)
+    root = SimpleNamespace(cite_name='root', resolved_profile=profile, default_output_reserve_tokens=256)
+    copied = SimpleNamespace(cite_name='private')
+    root.model_copy = Mock(return_value=copied)
+    models = [SimpleNamespace(cite_name='child', resolved_profile=None), root]
+    config = SimpleNamespace(model_name='root')
+    module.apply_root_model_preferences(models, config, {'12': {'temperature': 0}})
+    service.merge_model_preferences.assert_called_once_with(profile, {'temperature': 0})
+    assert models[-1] is copied and config.model_name == 'private'
+    assert root.model_copy.call_args.kwargs['update']['default_output_reserve_tokens'] == 512
+
+
+@pytest.mark.asyncio
+async def test_failed_default_does_not_supply_legacy_aliases(monkeypatch):
+    selected = {"model_id": 12, "profile_schema_version": 1}
+    monkeypatch.setattr(module, "get_model_records", Mock(return_value=[selected]))
+    monkeypatch.setattr(module, "create_model_config_from_record", Mock(return_value="selected"))
+    monkeypatch.setattr(module.tenant_config_manager, "get_model_config", Mock(return_value={"model_id": 99, "profile_schema_version": None}))
+    restore = Mock(side_effect=AssertionError("failed default must not be restored"))
+    monkeypatch.setattr(module, "restore_model_snapshot", restore)
+    assert await module.create_model_config_list("tenant") == ["selected"]
+    restore.assert_not_called()
diff --git a/test/backend/agents/test_create_agent_info.py b/test/backend/agents/test_create_agent_info.py
index f14b2c8980..74b9728512 100644
--- a/test/backend/agents/test_create_agent_info.py
+++ b/test/backend/agents/test_create_agent_info.py
@@ -8,6 +8,9 @@
 from contextlib import ExitStack
 from unittest.mock import AsyncMock, MagicMock, patch, Mock, PropertyMock, ANY
 
+# Load the real compatibility helpers before this fixture replaces SDK model packages.
+import nexent.core.model_service.compatibility.legacy_config
+
 from test.common.test_mocks import bootstrap_test_env
 
 env_state = bootstrap_test_env()
@@ -321,6 +324,7 @@ def _load_stub_prompt_bundle(*, is_manager, language, **kwargs):
     "management.services.model.adapter",
     get_llm_adapter=MagicMock(return_value="stub_llm_adapter"),
     get_vlm_adapter=MagicMock(return_value="stub_vlm_adapter"),
+    restore_model_snapshot=MagicMock(return_value=None),
 )
 sys.modules['management.services.configuration.user.memory'] = MagicMock()
 sys.modules['management.services.memory.providers.service'] = _create_stub_module(
@@ -353,6 +357,8 @@ def _load_stub_prompt_bundle(*, is_manager, language, **kwargs):
 
 # Create nested modules for nexent.core to satisfy imports safely
 sys.modules['nexent.core'] = _create_stub_module("nexent.core")
+# Keep the new pure model-service compatibility utilities available to this legacy fixture.
+sys.modules['nexent.core'].__path__ = [str(TEST_ROOT.parent / "sdk" / "nexent" / "core")]
 _concurrency_mod = _create_stub_module("nexent.core.concurrency")
 
 
@@ -4048,12 +4054,12 @@ class TestCreateModelConfigList:
     def test_reasoning_helpers_filter_model_fields_and_resolve_effort(self):
         module = create_agent_info_module
 
-        assert module._is_thinking_enabled(None) is False
-        assert module._is_thinking_enabled({"enable_thinking": True}) is True
-        assert module._is_thinking_enabled({"enable_thinking": False}) is False
-        assert module._is_thinking_enabled({"reasoning_effort": "high"}) is True
+        assert module.legacy_thinking_enabled(None) is False
+        assert module.legacy_thinking_enabled({"enable_thinking": True}) is True
+        assert module.legacy_thinking_enabled({"enable_thinking": False}) is False
+        assert module.legacy_thinking_enabled({"reasoning_effort": "high"}) is True
 
-        assert module._build_extra_body({
+        assert module.legacy_extra_body({
             "enable_thinking": True,
             "reasoning_effort": "high",
             "temperature": 0.2,
@@ -4061,26 +4067,26 @@ def test_reasoning_helpers_filter_model_fields_and_resolve_effort(self):
         }) == {"enable_thinking": True, "temperature": 0.2, "top_k": 4}
 
         supported = {"status": "supported", "levels": ["low", "high"], "default": "high"}
-        assert module._resolve_model_reasoning_effort(
+        assert module.legacy_reasoning_effort(
             {"enable_thinking": True, "reasoning_effort": "low"}, supported
         ) == "low"
-        assert module._resolve_model_reasoning_effort(
+        assert module.legacy_reasoning_effort(
             {"enable_thinking": True, "reasoning_effort": "medium"}, supported
         ) == "high"
-        assert module._resolve_model_reasoning_effort(
+        assert module.legacy_reasoning_effort(
             {"enable_thinking": True}, {"status": "supported", "levels": [], "default": None}
         ) is None
-        assert module._resolve_model_reasoning_effort(
+        assert module.legacy_reasoning_effort(
             {"enable_thinking": True}, {"status": "unsupported"}
         ) is None
-        assert module._resolve_model_reasoning_effort(
+        assert module.legacy_reasoning_effort(
             {"enable_thinking": True, "reasoning_effort": "high"},
             {"status": "unsupported"},
         ) == "high"
-        assert module._resolve_model_reasoning_effort(
+        assert module.legacy_reasoning_effort(
             {"enable_thinking": True, "reasoning_effort": "auto"}, supported
         ) is None
-        assert module._resolve_model_reasoning_effort(
+        assert module.legacy_reasoning_effort(
             {"enable_thinking": False, "reasoning_effort": "high"}, supported
         ) is None
 
@@ -4088,20 +4094,20 @@ def test_reasoning_helpers_filter_model_fields_and_resolve_effort(self):
             "status": "supported",
             "controls": [{"type": "budget_tokens", "min": 128, "max": 32768}],
         }
-        assert module._resolve_model_reasoning_budget(
+        assert module.legacy_reasoning_budget(
             {"enable_thinking": True, "reasoning_budget_tokens": 64},
             budget_capability,
         ) == 128
-        assert module._resolve_model_reasoning_budget(
+        assert module.legacy_reasoning_budget(
             {"enable_thinking": True, "reasoning_budget_tokens": 65536},
             budget_capability,
         ) == 32768
-        assert module._resolve_model_reasoning_budget(
+        assert module.legacy_reasoning_budget(
             {"enable_thinking": True, "reasoning_budget_tokens": 4096},
             {"status": "supported", "controls": []},
         ) == 4096
         for value in (True, 0, -1, "4096"):
-            assert module._resolve_model_reasoning_budget(
+            assert module.legacy_reasoning_budget(
                 {"enable_thinking": True, "reasoning_budget_tokens": value},
                 budget_capability,
             ) is None
@@ -4422,7 +4428,14 @@ def model_copy(self, *, deep=False):
 
 
 class TestCreateAgentRunInfo:
-    """Tests for the create_agent_run_info function"""
+    """Tests for the create_agent_run_info orchestration boundary."""
+
+    @pytest.fixture(autouse=True)
+    def mock_profile_binding(self):
+        # These orchestration tests supply sentinel model/config values. Profile
+        # binding itself is exercised with real profiles in its service suite.
+        with patch("services.agent_model_parameters.bind_agent_model_profiles"):
+            yield
 
     @pytest.mark.asyncio
     async def test_create_agent_run_info_applies_reasoning_overrides(self):
@@ -4552,63 +4565,6 @@ async def test_create_agent_run_info_applies_budget_override(self):
 
         assert selected.reasoning_budget_tokens == 4096
 
-    @pytest.mark.asyncio
-    async def test_create_agent_run_info_validates_request_budget(self):
-        selected = RuntimeModelStub(
-            cite_name="selected",
-            enable_thinking=True,
-            reasoning_effort=None,
-            reasoning_budget_tokens=None,
-            reasoning_capability={
-                "status": "supported",
-                "levels": [],
-                "controls": [{"type": "budget_tokens", "min": 128, "max": 32768}],
-            },
-            extra_body=None,
-        )
-        common_patches = [
-            patch(
-                "backend.agents.create_agent_info.join_minio_file_description_to_query",
-                new_callable=AsyncMock,
-                return_value="processed_query",
-            ),
-            patch(
-                "backend.agents.create_agent_info.create_model_config_list",
-                new_callable=AsyncMock,
-                return_value=[selected],
-            ),
-            patch(
-                "backend.agents.create_agent_info.create_agent_config",
-                new_callable=AsyncMock,
-                return_value=types.SimpleNamespace(model_name="selected", sandbox_policy=None),
-            ),
-            patch("backend.agents.create_agent_info.search_agent_info_by_agent_id", return_value={}),
-            patch(
-                "backend.agents.create_agent_info.get_remote_mcp_server_list",
-                new_callable=AsyncMock,
-                return_value=[],
-            ),
-            patch("backend.agents.create_agent_info.filter_mcp_servers_and_tools", return_value=[]),
-            patch("backend.agents.create_agent_info.urljoin", return_value="http://nexent.mcp/sse"),
-            patch("backend.agents.create_agent_info.threading"),
-        ]
-        with ExitStack() as stack:
-            for item in common_patches:
-                stack.enter_context(item)
-            await create_agent_run_info(
-                agent_id="agent-1",
-                minio_files=[],
-                query="query",
-                history=[],
-                user_id="user-1",
-                tenant_id="tenant-1",
-                language="zh",
-                is_debug=True,
-                reasoning_budget_tokens=4096,
-            )
-
-        assert mock_agent_run_info.call_args.kwargs["model_config_list"][0].reasoning_budget_tokens == 4096
-        assert selected.reasoning_budget_tokens is None
 
     @pytest.mark.asyncio
     @pytest.mark.parametrize(
@@ -4686,118 +4642,7 @@ async def test_create_agent_run_info_covers_reasoning_override_boundaries(
         assert selected.enable_thinking is expected_enabled
         assert selected.reasoning_effort == expected_effort
 
-    @pytest.mark.asyncio
-    @pytest.mark.parametrize(
-        "model_config",
-        [
-            None,
-            RuntimeModelStub(cite_name="selected", enable_thinking=True, reasoning_capability=None),
-            RuntimeModelStub(
-                cite_name="selected",
-                enable_thinking=True,
-                reasoning_capability={"status": "supported", "levels": ["low"]},
-            ),
-        ],
-    )
-    async def test_create_agent_run_info_rejects_invalid_reasoning_effort(self, model_config):
-        with patch(
-            "backend.agents.create_agent_info.join_minio_file_description_to_query",
-            new_callable=AsyncMock,
-            return_value="processed_query",
-        ), patch(
-            "backend.agents.create_agent_info.create_model_config_list",
-            new_callable=AsyncMock,
-            return_value=[] if model_config is None else [model_config],
-        ), patch(
-            "backend.agents.create_agent_info.create_agent_config",
-            new_callable=AsyncMock,
-            return_value=types.SimpleNamespace(model_name="selected"),
-        ), patch(
-            "backend.agents.create_agent_info.search_agent_info_by_agent_id",
-            return_value={},
-        ):
-            with pytest.raises(RunModelControlsError, match="model_"):
-                await create_agent_run_info(
-                    agent_id="agent-1",
-                    minio_files=[],
-                    query="query",
-                    history=[],
-                    user_id="user-1",
-                    tenant_id="tenant-1",
-                    language="zh",
-                    is_debug=True,
-                    reasoning_effort="high",
-                )
-
-    @pytest.mark.asyncio
-    @pytest.mark.parametrize(
-        "reasoning_effort, expected_effort, capability",
-        [
-            (
-                "high",
-                "high",
-                {"status": "supported", "levels": ["low", "high"]},
-            ),
-            (
-                "auto",
-                None,
-                {"status": "supported", "levels": ["low", "high"]},
-            ),
-        ],
-    )
-    async def test_create_agent_run_info_accepts_valid_reasoning_effort(
-        self, reasoning_effort, expected_effort, capability
-    ):
-        selected = RuntimeModelStub(
-            cite_name="selected",
-            enable_thinking=True,
-            reasoning_effort=None,
-            reasoning_capability=capability,
-            extra_body=None,
-        )
-        with patch(
-            "backend.agents.create_agent_info.join_minio_file_description_to_query",
-            new_callable=AsyncMock,
-            return_value="processed_query",
-        ), patch(
-            "backend.agents.create_agent_info.create_model_config_list",
-            new_callable=AsyncMock,
-            return_value=[selected],
-        ), patch(
-            "backend.agents.create_agent_info.create_agent_config",
-            new_callable=AsyncMock,
-            return_value=types.SimpleNamespace(model_name="selected", sandbox_policy=None),
-        ), patch(
-            "backend.agents.create_agent_info.search_agent_info_by_agent_id",
-            return_value={},
-        ), patch(
-            "backend.agents.create_agent_info.get_remote_mcp_server_list",
-            new_callable=AsyncMock,
-            return_value=[],
-        ), patch(
-            "backend.agents.create_agent_info.filter_mcp_servers_and_tools",
-            return_value=[],
-        ), patch(
-            "backend.agents.create_agent_info.urljoin",
-            return_value="http://nexent.mcp/sse",
-        ), patch(
-            "backend.agents.create_agent_info.threading"
-        ) as threading_mock:
-            threading_mock.Event.return_value = "stop_event"
-            await create_agent_run_info(
-                agent_id="agent-1",
-                minio_files=[],
-                query="query",
-                history=[],
-                user_id="user-1",
-                tenant_id="tenant-1",
-                language="zh",
-                is_debug=True,
-                reasoning_effort=reasoning_effort,
-            )
 
-        assert mock_agent_run_info.call_args.kwargs["model_config_list"][0].reasoning_effort == expected_effort
-        assert selected.reasoning_effort is None
 
     @pytest.mark.asyncio
     async def test_create_agent_run_info_success(self):
@@ -8523,6 +8368,24 @@ def test_select_agent_model_id_prefers_first_available_model(self):
             assert _select_agent_model_id([7, 8], None, "tenant") == 8
             assert _select_agent_model_id([7, 8], 9, "tenant") == 9
 
+
+def test_saved_outlet_agent_window_bounds_inherited_limits_without_fallback():
+    """AC-PARAM-LAYERS: pass a consistent smaller window to the budget resolver."""
+    model = {"model_id": 42, "model_name": "model", "model_factory": "custom",
+             "profile_schema_version": 1, "context_window_tokens": 200000,
+             "max_input_tokens": 180000, "max_output_tokens": 32000,
+             "default_max_output_tokens": 2048}
+    snapshot = MockModelCapacitySnapshot(context_window_tokens=64000, provider_input_limit_tokens=61952)
+    with patch("backend.agents.create_agent_info.resolve_capacity", return_value=snapshot) as resolver:
+        budget, monitoring, actual = _resolve_input_budget(model, {"context_window_tokens": 64000})
+    assert actual is snapshot and budget == 61952
+    assert resolver.call_args.kwargs["operator_overrides"] == {
+        "context_window_tokens": 64000, "max_input_tokens": 64000,
+        "max_output_tokens": 32000, "default_output_reserve_tokens": 2048}
+    assert model["context_window_tokens"] == 200000
+    assert monitoring["context_window_tokens"] == 64000
+
+
 class TestDeepSeekRuntimeLanguage:
     @pytest.mark.asyncio
     @pytest.mark.parametrize("language", ["zh", "en"])
diff --git a/test/backend/agents/test_create_agent_info_workbench_coverage.py b/test/backend/agents/test_create_agent_info_workbench_coverage.py
index eb3036a4a1..79a3381434 100644
--- a/test/backend/agents/test_create_agent_info_workbench_coverage.py
+++ b/test/backend/agents/test_create_agent_info_workbench_coverage.py
@@ -158,44 +158,8 @@ def __init__(self, **kwargs):
     assert len(tools) == 5
 
 
-def test_root_generation_overlay_skips_children_and_adds_root_alias():
-    class Model:
-        def __init__(self, cite_name, temperature=0.5, top_p=0.9, extra_body=None):
-            self.cite_name = cite_name
-            self.temperature = temperature
-            self.top_p = top_p
-            self.extra_body = extra_body
-            self.enable_thinking = True
-            self.reasoning_capability = None
-            self.reasoning_effort = None
-            self.reasoning_budget_tokens = None
-
-        def model_copy(self, *, deep):
-            assert deep is True
-            return Model(
-                self.cite_name,
-                self.temperature,
-                self.top_p,
-                dict(self.extra_body) if self.extra_body else None,
-            )
-
-    child = Model("child")
-    root = Model("root", extra_body={"reasoning_effort": "high"})
-    models = [child, root]
-    config = SimpleNamespace(model_name="root")
-
-    create_agent_info.apply_root_generation_overlay(
-        models,
-        config,
-        {"deep_thinking": False, "temperature": 0.2, "top_p": 0.8},
-    )
-
-    assert len(models) == 3
-    assert models[-1].cite_name == "workbench_root_model"
-    assert models[-1].temperature == 0.2
-    assert models[-1].top_p == 0.8
-    assert "reasoning_effort" not in models[-1].extra_body
-    assert config.model_name == "workbench_root_model"
+def test_su_ac_07_no_parallel_generation_overlay_remains():
+    assert not hasattr(create_agent_info, "apply_root_generation_overlay")
 
 
 @pytest.mark.asyncio
diff --git a/test/backend/agents/test_resolved_model_config.py b/test/backend/agents/test_resolved_model_config.py
new file mode 100644
index 0000000000..86539fad29
--- /dev/null
+++ b/test/backend/agents/test_resolved_model_config.py
@@ -0,0 +1,90 @@
+# Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
+"""Saved outlet output preferences must reach the existing context-budget resolver."""
+
+from types import SimpleNamespace
+from unittest.mock import Mock
+
+import pytest
+
+from test_create_agent_info import create_agent_info_module as module
+
+
+@pytest.mark.parametrize("reserve,requested,expected", [(None, 4096, 4096), (1024, 4096, 4096),
+    (8192, 4096, 4096), (1024, None, 1024), (None, None, None)])
+def test_saved_output_default_does_not_become_provider_hard_limit(monkeypatch, reserve, requested, expected):
+    parameters = {} if requested is None else {"max_output_tokens": requested}
+    profile = SimpleNamespace(identity=SimpleNamespace(request_model_id="exact", provider_id="provider"),
+        connection=SimpleNamespace(base_url="https://models.invalid/v1"),
+        capabilities=SimpleNamespace(context=SimpleNamespace(combined_window=200000,
+            input_limit=None, output_limit=32768)),
+        context_configuration=SimpleNamespace(output_reserve_tokens=reserve, tokenizer_family=None,
+            capacity_source="profile", capability_profile_version=None), parameter_values=parameters)
+    import sys
+    from types import ModuleType
+    projection = ModuleType("services.model_outlet_projection")
+    projection.project_saved_outlet = Mock(return_value={"reasoning_capability": {"status": "unknown"}})
+    monkeypatch.setitem(sys.modules, projection.__name__, projection)
+    factory = Mock()
+    monkeypatch.setattr(module, "ModelConfig", factory)
+    module._resolved_model_config({"display_name": "chosen", "api_key": None}, profile)
+    values = factory.call_args.kwargs
+    assert values["api_key"] == ""
+    assert values["max_output_tokens"] == 32768
+    assert values["default_output_reserve_tokens"] == expected
+    assert values["resolved_profile"] is profile
+    assert profile.parameter_values == parameters
+
+
+def test_frozen_outlet_request_default_controls_budget_without_replacing_saved_reserve():
+    record = {"profile_schema_version": 1, "default_output_reserve_tokens": 8192,
+              "default_max_output_tokens": 2048, "max_output_tokens": 32768}
+    overrides = module._operator_overrides_from_model_info(record)
+    assert overrides["default_output_reserve_tokens"] == 2048
+    assert overrides["max_output_tokens"] == 32768
+    assert record["default_output_reserve_tokens"] == 8192
+
+
+def test_conversation_preferences_clone_only_the_root_and_keep_child_model_references(monkeypatch):
+    import sys
+    from types import ModuleType
+
+    profile = SimpleNamespace(outlet_id=42)
+    resolved = SimpleNamespace(parameter_values={"temperature": 0})
+    preference_service = ModuleType("services.conversation_model_preferences_service")
+    preference_service.merge_model_preferences = Mock(return_value=resolved)
+    monkeypatch.setitem(sys.modules, preference_service.__name__, preference_service)
+    copied = SimpleNamespace(cite_name="private-root")
+    original = SimpleNamespace(cite_name="selected", resolved_profile=profile,
+        default_output_reserve_tokens=512, model_copy=Mock(return_value=copied))
+    child_model = SimpleNamespace(cite_name="child", resolved_profile=profile)
+    models = [original, child_model]
+    agent = SimpleNamespace(model_name="selected", worker_agents=[SimpleNamespace(model_name="selected")])
+    module.apply_root_model_preferences(models, agent, {"42": {"temperature": 0}})
+    preference_service.merge_model_preferences.assert_called_once_with(profile, {"temperature": 0})
+    assert models == [original, child_model, copied]
+    assert original.resolved_profile is profile and child_model.resolved_profile is profile
+    assert agent.model_name == "private-root" and agent.worker_agents[0].model_name == "selected"
+
+
+@pytest.mark.parametrize("requested", [512, 4096])
+def test_root_preference_replaces_the_output_baseline_without_replacing_hard_limits(requested):
+    agent_info = {"model_params_override": {"42": {
+        "max_output_tokens": 8192, "default_output_reserve_tokens": 2048,
+        "context_window_tokens": 200000,
+    }}}
+    root = module._runtime_capacity_overrides(agent_info, 42, requested)
+    assert root == {"max_output_tokens": 8192, "default_output_reserve_tokens": requested,
+                    "context_window_tokens": 200000}
+    child = module._runtime_capacity_overrides(agent_info, 42, None)
+    assert child["default_output_reserve_tokens"] == 2048
+    assert agent_info["model_params_override"]["42"]["default_output_reserve_tokens"] == 2048
+
+
+@pytest.mark.parametrize("requested,expected", [(None, 1024), (256, 256)])
+def test_run_output_budget_uses_explicit_preference_without_mutating_agent(monkeypatch, requested, expected):
+    inherited = {"context_window_tokens": 8192, "default_output_reserve_tokens": 1024}
+    monkeypatch.setattr(module, "_agent_capacity_overrides", Mock(return_value=dict(inherited)))
+    actual = module._runtime_capacity_overrides({"agent_id": 1}, 12, requested)
+    assert actual == {**inherited, "default_output_reserve_tokens": expected}
+    assert inherited["default_output_reserve_tokens"] == 1024
diff --git a/test/backend/agents/test_workbench_generation_overlay.py b/test/backend/agents/test_workbench_generation_overlay.py
index 7166bafdb7..ac2e5cb9f6 100644
--- a/test/backend/agents/test_workbench_generation_overlay.py
+++ b/test/backend/agents/test_workbench_generation_overlay.py
@@ -1,152 +1,54 @@
 # Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
 
-"""Functional tests for root-only Workbench generation overrides."""
+"""SU-AC-06: all Agent modes share root-only profile preferences."""
 
-import pytest
-from pydantic import ValidationError
+from copy import deepcopy
 
-from agents.create_agent_info import (
-    _materialize_runtime_skill_snapshot,
-    apply_root_generation_overlay,
-)
-from consts.model import WorkbenchGenerationConfig
+import pytest
+from consts.exceptions import ModelOutletValidationError
+from agents.create_agent_info import _materialize_runtime_skill_snapshot, apply_root_model_preferences
 from nexent.core.agents.agent_model import AgentConfig, ModelConfig
+from services.model_profile_service import build_outlet_draft
+from test.backend.services.test_model_profile_service import draft_request
 
-EFFORT_CAPABILITY = {"status": "supported", "control": "effort", "levels": ["none", "minimal", "low", "medium", "high", "xhigh", "max"]}
-
-
-def test_workbench_generation_schema_defaults_effort_to_low():
-    assert WorkbenchGenerationConfig().thinking_effort == "low"
-
-
-@pytest.mark.parametrize("effort", ["auto", "none", "minimal", "low", "medium", "high", "xhigh", "max"])
-def test_complete_workbench_effort_schema_and_root_overlay(effort):
-    config = WorkbenchGenerationConfig(
-        deep_thinking=True, thinking_effort=effort, temperature=0.6, top_p=0.83,
-        requested_output_tokens=2000,
-    )
-    assert WorkbenchGenerationConfig.model_validate(config.model_dump()) == config
-    root = AgentConfig(name="root", description="", tools=[], model_name="shared")
-    original = ModelConfig(cite_name="shared", model_name="provider/model", url="https://example.invalid", reasoning_capability=EFFORT_CAPABILITY,
-                           temperature=0.2, top_p=0.9, reasoning_effort="high")
-    models = [original]
-    apply_root_generation_overlay(models, root, config.model_dump())
-    assert models[-1].reasoning_effort == ("high" if effort == "auto" else effort)
-    assert models[-1].temperature == 0.6
-    assert models[-1].top_p == 0.83
-    assert original.reasoning_effort == "high"
-    assert original.temperature == 0.2
-    apply_root_generation_overlay(models, root, {"deep_thinking": False, "thinking_effort": effort})
-    assert models[-1].reasoning_effort is None
 
+@pytest.fixture
+def profile():
+    value, _ = build_outlet_draft(draft_request(parameter_values={"enable_thinking": True, "reasoning_budget_tokens": 64}), "tenant")
+    connection = value.connection.model_copy(update={"credential_ref": value.connection.credential_ref.model_copy(update={"model_id": 42})})
+    return value.model_copy(update={"outlet_id": 42, "connection": connection})
 
-@pytest.mark.parametrize("effort", ["invalid", "", 1])
-def test_workbench_effort_schema_rejects_unknown_values(effort):
-    with pytest.raises(ValidationError):
-        WorkbenchGenerationConfig(thinking_effort=effort)
 
-
-def test_neutral_generation_overlay_changes_only_root_alias():
-    """UT-BE-WB-019: runtime generation values affect only the effective root."""
-    child = AgentConfig(
-        name="child",
-        description="",
-        tools=[],
-        model_name="shared_model",
-    )
-    root = AgentConfig(
-        name="root",
-        description="",
-        tools=[],
-        model_name="shared_model",
-        managed_agents=[child],
-    )
-    shared = ModelConfig(
-        cite_name="shared_model",
-        model_name="provider/model",
-        url="https://example.invalid", reasoning_capability=EFFORT_CAPABILITY,
-        temperature=0.1,
-        top_p=0.95,
-    )
+@pytest.mark.parametrize("values", [{"temperature": 0, "top_p": 0.8}, {"enable_thinking": False}, {"reasoning_budget_tokens": 128}])
+def test_su_ac_06_only_root_changes_and_all_persisted_defaults_remain_intact(profile, values):
+    child = AgentConfig(name="child", description="", tools=[], model_name="shared")
+    root = AgentConfig(name="root", description="", tools=[], model_name="shared", managed_agents=[child])
+    shared = ModelConfig(cite_name="shared", model_name="provider/model", url="https://example.invalid", resolved_profile=profile)
     models = [shared]
-
-    apply_root_generation_overlay(
-        models,
-        root,
-        {"deep_thinking": False, "temperature": 0.7, "top_p": 0.8},
-    )
-
-    assert root.model_name == "workbench_root_model"
-    assert child.model_name == "shared_model"
-    assert shared.temperature == 0.1
-    assert models[-1].temperature == 0.7
-    assert models[-1].top_p == 0.8
-    assert models[-1].extra_body == {"enable_thinking": False}
-
-
-def test_thinking_settings_apply_to_root_without_mutating_child_model():
-    root = AgentConfig(name="root", description="", tools=[], model_name="shared_model")
-    shared = ModelConfig(
-        cite_name="shared_model",
-        model_name="provider/model",
-        url="https://example.invalid", reasoning_capability=EFFORT_CAPABILITY,
-        extra_body={"existing": "value"},
-        reasoning_effort="high",
-        reasoning_budget_tokens=2048,
-    )
-    models = [shared]
-    apply_root_generation_overlay(
-        models,
-        root,
-        {"deep_thinking": True, "thinking_effort": "low"},
-    )
-    assert root.model_name == "workbench_root_model"
-    assert shared.extra_body == {"existing": "value"}
-    assert shared.reasoning_effort == "high"
-    assert models[-1].extra_body == {
-        "existing": "value",
-        "enable_thinking": True,
-    }
-    assert models[-1].enable_thinking is True
-    assert models[-1].reasoning_effort == "low"
-    assert models[-1].reasoning_budget_tokens is None
-
-
-def test_enabling_thinking_without_explicit_effort_inherits_provider_default():
-    root = AgentConfig(name="root", description="", tools=[], model_name="shared_model")
-    models = [ModelConfig(
-        cite_name="shared_model",
-        model_name="provider/model",
-        url="https://example.invalid", reasoning_capability=EFFORT_CAPABILITY,
-    )]
-
-    apply_root_generation_overlay(models, root, {"deep_thinking": True})
-
-    assert models[-1].reasoning_effort is None
-    assert models[-1].extra_body == {"enable_thinking": True}
+    before = deepcopy(profile.model_dump())
+    apply_root_model_preferences(models, root, {"42": values}, outlet_profiles={42: profile}, agent_overrides={})
+    assert root.model_name.startswith("conversation_root_model_")
+    assert child.model_name == "shared"
+    assert shared.resolved_profile.model_dump() == before
+    for key, value in values.items():
+        assert models[-1].resolved_profile.parameter_values[key] == value
+    if values.get("enable_thinking") is False:
+        assert "reasoning_budget_tokens" not in models[-1].resolved_profile.parameter_values
+
+
+def test_su_ac_04_other_model_preferences_do_not_affect_selected_root(profile):
+    root = AgentConfig(name="root", description="", tools=[], model_name="shared")
+    models = [ModelConfig(cite_name="shared", model_name="provider/model", url="https://example.invalid", resolved_profile=profile)]
+    apply_root_model_preferences(models, root, {"43": {"temperature": 0}})
+    assert len(models) == 1 and root.model_name == "shared"
 
 
-def test_disabling_thinking_drops_stale_effort_from_root_only():
-    root = AgentConfig(name="root", description="", tools=[], model_name="shared_model")
-    shared = ModelConfig(
-        cite_name="shared_model",
-        model_name="provider/model",
-        url="https://example.invalid", reasoning_capability=EFFORT_CAPABILITY,
-        extra_body={"enable_thinking": True, "reasoning_effort": "high"},
-        reasoning_effort="high",
-        reasoning_budget_tokens=2048,
-    )
-    models = [shared]
-    apply_root_generation_overlay(
-        models,
-        root,
-        {"deep_thinking": False, "thinking_effort": "medium"},
-    )
-    assert shared.extra_body == {"enable_thinking": True, "reasoning_effort": "high"}
-    assert models[-1].extra_body == {"enable_thinking": False}
-    assert models[-1].enable_thinking is False
-    assert models[-1].reasoning_effort is None
-    assert models[-1].reasoning_budget_tokens is None
+def test_su_ac_05_conflicting_values_cannot_mutate_aliases_or_defaults(profile):
+    root = AgentConfig(name="root", description="", tools=[], model_name="shared")
+    models = [ModelConfig(cite_name="shared", model_name="provider/model", url="https://example.invalid", resolved_profile=profile)]
+    with pytest.raises(ModelOutletValidationError):
+        apply_root_model_preferences(models, root, {"42": {"enable_thinking": False, "reasoning_budget_tokens": 64}})
+    assert len(models) == 1 and root.model_name == "shared"
 
 
 def test_ut_be_wb_011_materializes_an_immutable_run_skill_snapshot(tmp_path):
diff --git a/test/backend/app/test_agent_app.py b/test/backend/app/test_agent_app.py
index f246f5b52e..4639c32f35 100644
--- a/test/backend/app/test_agent_app.py
+++ b/test/backend/app/test_agent_app.py
@@ -1197,6 +1197,16 @@ def test_update_agent_info_api_with_result(mocker, mock_auth_header):
     assert response.json()["updated"] is True
 
 
+def test_update_agent_info_api_rejects_invalid_model_parameters(mocker, mock_auth_header):
+    from nexent.core.model_service.profiles.parameter_schema import ParameterValidationError
+
+    mocker.patch("apps.agent_app.update_agent_info_impl", new_callable=AsyncMock,
+                 side_effect=ParameterValidationError("PARAMETER_VALUE_INVALID", "/temperature"))
+    response = config_client.post("/agent/update", json={"agent_id": 1}, headers=mock_auth_header)
+    assert response.status_code == 422
+    assert response.json()["detail"] == {"code": "PARAMETER_VALUE_INVALID", "field": "/temperature"}
+
+
 def test_update_agent_info_api_exception(mocker, mock_auth_header):
     """Test update_agent_info_api exception handling."""
     mock_update_agent = mocker.patch(
diff --git a/test/backend/app/test_config_app.py b/test/backend/app/test_config_app.py
index 89b0324ce5..f34c2aa5f7 100644
--- a/test/backend/app/test_config_app.py
+++ b/test/backend/app/test_config_app.py
@@ -1,4 +1,5 @@
 # Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
 """
 Unit tests for config_app module.
 
@@ -222,6 +223,14 @@ def snapshot(self):
         concurrency_module = types.ModuleType("nexent.core.concurrency")
         concurrency_module.ManagedTaskSpec = ManagedTaskSpec
         concurrency_module.ManagerState = manager_state
+
+        async def invoke_blocking(_name, operation, *args, **kwargs):
+            return operation(*args, **kwargs)
+
+        concurrency_module.run_blocking = AsyncMock(side_effect=invoke_blocking)
+        migration = types.ModuleType("services.model_outlet_migration_service")
+        migration.migrate_legacy_outlets = MagicMock(return_value={"migrated": 2, "failed": 1})
+        monkeypatch.setitem(sys.modules, migration.__name__, migration)
         concurrency_module.set_default_thread_manager = MagicMock()
         concurrency_module.clear_default_thread_manager = MagicMock()
         monkeypatch.setitem(
@@ -319,6 +328,10 @@ async def exercise_lifespan():
             asyncio.run(exercise_lifespan())
 
         assert config_app.app.lifespan is config_app.config_lifespan
+        migration.migrate_legacy_outlets.assert_called_once_with()
+        concurrency_module.run_blocking.assert_awaited_once_with(
+            "model-outlet-upgrade", migration.migrate_legacy_outlets
+        )
         recover_config_tasks.assert_called_once_with()
         start_evaluation_maintenance.assert_called_once_with(
             config_app.config_thread_manager
diff --git a/test/backend/app/test_conversation_model_preferences_app.py b/test/backend/app/test_conversation_model_preferences_app.py
new file mode 100644
index 0000000000..daf2cd2e33
--- /dev/null
+++ b/test/backend/app/test_conversation_model_preferences_app.py
@@ -0,0 +1,90 @@
+# Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
+"""Conversation parameter HTTP contracts and authenticated resource scoping."""
+
+import sys
+import types
+
+import pytest
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+
+from test.backend.app import test_conversation_management_app as legacy_tests
+
+
+@pytest.fixture
+def model_preference_client(monkeypatch):
+    from unittest.mock import Mock
+    app_module = sys.modules[legacy_tests.create_new_conversation_endpoint.__module__]
+    from nexent.core import concurrency
+
+    service = types.ModuleType("services.conversation_model_preferences_service")
+    service.read_model_preferences = Mock(return_value={"version": 2, "model_parameter_preferences": {}})
+    service.read_model_preference_view = Mock(return_value={"version": 2, "parameter_values": {"temperature": 0}})
+    service.patch_model_selection = Mock(return_value={"version": 3, "selected_model_id": 42})
+    service.patch_model_preferences = Mock(return_value={"version": 3, "model_parameter_preferences": {"42": {"temperature": 0}}})
+    monkeypatch.setitem(sys.modules, service.__name__, service)
+
+    async def invoke(_name, operation, *args, **kwargs):
+        return operation(*args, **kwargs)
+
+    monkeypatch.setattr(concurrency, "run_blocking", invoke)
+    monkeypatch.setattr(app_module, "get_current_user_id", Mock(return_value=("owner", "tenant")))
+    app = FastAPI()
+    app.include_router(app_module.router)
+    return TestClient(app), service, app_module
+
+
+def test_model_preference_routes_forward_owned_conversation_and_explicit_zero(model_preference_client):
+    client, service, _ = model_preference_client
+    assert client.get("/conversation/11/model_preferences").json()["data"]["version"] == 2
+    service.read_model_preferences.assert_called_once_with(11, "owner")
+    assert client.get("/conversation/11/model_preferences/42").json()["data"]["parameter_values"] == {"temperature": 0}
+    service.read_model_preference_view.assert_called_once_with(11, 42, "owner", "tenant")
+    response = client.patch("/conversation/11/model_preferences/42", json={
+        "expected_version": 2, "parameter_values": {"temperature": 0}, "delete_parameters": [],
+    })
+    assert response.status_code == 200 and response.json()["data"]["version"] == 3
+    args = service.patch_model_preferences.call_args.args
+    assert args[:2] == (11, 42) and args[3:] == ("owner", "tenant")
+    assert args[2].parameter_values == {"temperature": 0}
+
+
+@pytest.mark.parametrize("kind,status,code", [("missing", 404, "CONVERSATION_NOT_FOUND"),
+    ("conflict", 409, "MODEL_PREFERENCE_VERSION_CONFLICT"), ("invalid", 422, "PARAMETER_UNKNOWN")])
+def test_model_preference_failure_status_and_no_second_write(model_preference_client, kind, status, code):
+    client, service, module = model_preference_client
+    errors = {"missing": module.ConversationNotFoundError("missing"),
+              "conflict": module.ModelOutletConflictError(),
+              "invalid": module.ModelOutletValidationError("PARAMETER_UNKNOWN", "/retired")}
+    service.patch_model_preferences.side_effect = errors[kind]
+    response = client.patch("/conversation/11/model_preferences/42", json={"expected_version": 2})
+    assert response.status_code == status
+    detail = response.json()["detail"]
+    assert (detail if isinstance(detail, str) else detail["code"]) == code
+    service.patch_model_preferences.assert_called_once()
+
+
+@pytest.mark.parametrize("version", [-1, True, "2", 2147483647])
+def test_model_preference_rejects_invalid_version_before_service(model_preference_client, version):
+    client, service, _ = model_preference_client
+    response = client.patch("/conversation/11/model_preferences/42", json={"expected_version": version})
+    assert response.status_code == 422
+    service.patch_model_preferences.assert_not_called()
+
+
+def test_su_ac_01_selection_endpoint_uses_shared_owner_tenant_and_cas(model_preference_client):
+    client, service, _ = model_preference_client
+    response = client.patch("/conversation/11/model_preferences", json={"expected_version": 2, "selected_model_id": 42})
+    assert response.status_code == 200 and response.json()["data"]["selected_model_id"] == 42
+    args = service.patch_model_selection.call_args.args
+    assert args[0] == 11 and args[2:] == ("owner", "tenant")
+    assert args[1].expected_version == 2 and args[1].selected_model_id == 42
+
+
+@pytest.mark.parametrize("model_id", [0, -1, True, "42", 1.5, None])
+def test_su_ac_05_invalid_selection_does_not_reach_service(model_preference_client, model_id):
+    client, service, _ = model_preference_client
+    response = client.patch("/conversation/11/model_preferences", json={"expected_version": 2, "selected_model_id": model_id})
+    assert response.status_code == 422
+    service.patch_model_selection.assert_not_called()
diff --git a/test/backend/app/test_model_profile_app.py b/test/backend/app/test_model_profile_app.py
new file mode 100644
index 0000000000..c5f90c89e7
--- /dev/null
+++ b/test/backend/app/test_model_profile_app.py
@@ -0,0 +1,213 @@
+# Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
+"""Profile endpoints preserve read authorization and validated discovery inputs."""
+
+from unittest.mock import AsyncMock
+
+import pytest
+
+from test.backend.app.test_model_managment_app import client  # noqa: F401 - Shared app fixture.
+
+
+@pytest.mark.parametrize("path,kind", [("model_profiles", "model"), ("provider_profiles", "provider")])
+def test_profile_list_validates_inputs_and_forwards_pagination(client, mocker, path, kind):
+    from backend.apps import model_managment_app as app
+
+    payload = {"items": [], "total": 0, "catalog_revision": "revision", "page": 2, "page_size": 3}
+    run = mocker.patch.object(app, "run_blocking", new=AsyncMock(return_value=payload))
+    response = client.get(f"/model/{path}?query=qwen&page=2&page_size=3")
+    assert response.status_code == 200 and response.json() == {"data": payload}
+    assert run.call_args.args[2] == kind
+    assert run.call_args.kwargs["query"] == "qwen"
+    assert run.call_args.kwargs["page"] == 2 and run.call_args.kwargs["page_size"] == 3
+    run.reset_mock()
+    assert client.get(f"/model/{path}?page_size=101").status_code == 422
+    run.assert_not_called()
+
+
+def test_protocol_discovery_exposes_registered_choices(client):
+    response = client.get("/model/profile_protocols")
+    assert response.status_code == 200
+    assert response.json()["data"]["items"] == [{"ref": "openai_chat_completions", "version": 1}]
+
+
+@pytest.mark.parametrize("path", ["model_profiles", "provider_profiles", "profile_protocols"])
+def test_profile_discovery_rejects_missing_model_read_permission(client, mocker, path):
+    mocker.patch("permissions.depends.has_permission", return_value=False)
+    response = client.get(f"/model/{path}")
+    assert response.status_code == 403
+
+
+def preview_body():
+    return {"provider_info": {"base_url": "https://dashscope.aliyuncs.com/compatible-mode/v1"},
+            "request_model_id": "qwen3.5-plus", "parameter_values": {"enable_thinking": False}}
+
+
+def test_preview_reaches_actual_composer_with_trusted_tenant(client, mocker):
+    from backend.apps import model_managment_app as app
+
+    async def run(_name, fn, *args, **kwargs):
+        return fn(*args, **kwargs)
+
+    mocker.patch.object(app, "run_blocking", new=run)
+    response = client.post("/model/profile_previews", json=preview_body())
+    assert response.status_code == 200
+    data = response.json()["data"]
+    assert data["selected"] == {"model": "alibaba/qwen3.5-plus", "provider": "alibaba-cn"}
+    assert data["parameter_values"] == {"enable_thinking": False}
+    assert "api_key" not in response.text
+    invalid = {**preview_body(), "parameter_values": {"enable_thinking": "wrong"}}
+    response = client.post("/model/profile_previews", json=invalid)
+    assert response.status_code == 400
+    assert response.json()["detail"]["details"]["category"] == "PARAMETER_VALUE_INVALID"
+    assert "wrong" not in response.text
+    assert client.post("/model/profile_previews", json={**preview_body(), "catalog_revision": "stale"}).status_code == 409
+    assert client.post("/model/profile_previews", json={**preview_body(), "tenant_id": "other"}).status_code == 422
+
+
+def test_save_passes_trusted_owner_and_excludes_credentials_from_audit(client, mocker):
+    from backend.apps import model_managment_app as app
+
+    run = mocker.patch.object(app, "run_blocking", new=AsyncMock(return_value={"model_id": 42, "config_revision": 1}))
+    audit = mocker.patch.object(app, "record_security_event")
+    body = {**preview_body(), "catalog_revision": "revision", "api_key": "controlled-key"}
+    response = client.post("/model/outlets", json=body)
+    assert response.status_code == 200
+    assert run.call_args.args[-2:] == ("test_user", "test_tenant")
+    assert run.call_args.args[2].api_key == "controlled-key"
+    assert "controlled-key" not in repr(audit.call_args)
+    assert "controlled-key" not in response.text
+
+
+def test_outlet_get_does_not_expose_foreign_or_missing_record(client, mocker):
+    from backend.apps import model_managment_app as app
+
+    run = mocker.patch.object(app, "run_blocking", new=AsyncMock(return_value=None))
+    assert client.get("/model/outlets/42").status_code == 404
+    assert run.call_args.args[-2:] == (42, "test_tenant")
+    run.reset_mock()
+    assert client.get("/model/outlets/0").status_code == 422
+    run.assert_not_called()
+
+
+@pytest.mark.parametrize("path", ["profile_previews", "outlets"])
+def test_profile_operations_require_permission(client, mocker, path):
+    mocker.patch("permissions.depends.has_permission", return_value=False)
+    assert client.post(f"/model/{path}", json=preview_body()).status_code == 403
+
+
+def test_patch_preserves_omitted_credential_and_trusted_identity(client, mocker):
+    from backend.apps import model_managment_app as app
+
+    run = mocker.patch.object(app, "run_blocking", new=AsyncMock(return_value={"model_id": 42, "config_revision": 2}))
+    audit = mocker.patch.object(app, "record_security_event")
+    response = client.patch("/model/outlets/42", json={"expected_revision": 1,
+        "parameter_values": {"enable_thinking": False}})
+    assert response.status_code == 200
+    assert run.call_args.args[2] == 42
+    request = run.call_args.args[3]
+    assert "api_key" not in request.model_fields_set
+    assert run.call_args.args[-2:] == ("test_user", "test_tenant")
+    assert audit.call_args.kwargs["details"] == {"model_id": 42, "config_revision": 2}
+
+
+@pytest.mark.parametrize("exception,status", [("missing", 404), ("stale", 409), ("invalid", 422)])
+def test_patch_maps_domain_errors(client, mocker, exception, status):
+    from backend.apps import model_managment_app as app
+    from consts.exceptions import ModelOutletConflictError, ModelOutletValidationError
+
+    failures = {"missing": LookupError(), "stale": ModelOutletConflictError(),
+                "invalid": ModelOutletValidationError(category="PARAMETER_VALUE_INVALID", path="enable_thinking")}
+    mocker.patch.object(app, "run_blocking", new=AsyncMock(side_effect=failures[exception]))
+    response = client.patch("/model/outlets/42", json={"expected_revision": 1})
+    assert response.status_code == status
+
+
+def test_probe_returns_unavailable_as_result_and_passes_owner(client, mocker):
+    invoke = mocker.patch("services.model_profile_service.validate_model_outlet", new=AsyncMock(
+        return_value={"ok": False, "error": {"category": "AUTHENTICATION_ERROR"},
+                      "check_scope": "connection_only", "model_id": 42, "config_revision": 1}))
+    response = client.post("/model/outlet_validations", json={"outlet_id": 42, "expected_revision": 1})
+    assert response.status_code == 200 and response.json()["data"]["ok"] is False
+    assert invoke.call_args.args[1] == "test_tenant"
+    invoke.reset_mock()
+    assert client.post("/model/outlet_validations", json={}).status_code == 422
+    assert client.post("/model/outlet_validations", json={"outlet_id": 42, "tenant_id": "other"}).status_code == 422
+    invoke.assert_not_awaited()
+
+
+@pytest.mark.parametrize("method,path,body", [
+    ("patch", "/model/outlets/42", {"expected_revision": 1}),
+    ("post", "/model/outlet_validations", {"outlet_id": 42}),
+])
+def test_outlet_mutations_require_permission(client, mocker, method, path, body):
+    mocker.patch("permissions.depends.has_permission", return_value=False)
+    assert getattr(client, method)(path, json=body).status_code == 403
+
+
+def test_migration_review_passes_authenticated_owner_and_exact_revision(client, mocker):
+    from backend.apps import model_managment_app as app
+
+    run = mocker.patch.object(app, "run_blocking", new=AsyncMock(return_value={
+        "model_id": 42, "config_revision": 7, "migration_review_required": False}))
+    mocker.patch.object(app, "record_security_event")
+    response = client.post("/model/outlets/42/migration_reviews", json={"expected_revision": 7})
+    assert response.status_code == 200
+    assert run.call_args.args[2] == 42 and run.call_args.args[3].expected_revision == 7
+    assert run.call_args.args[-2:] == ("test_user", "test_tenant")
+
+
+def test_migration_review_requires_admin_role_even_with_update_permission(client, mocker):
+    from backend.apps import model_managment_app as app
+    from permissions.models import CurrentUser
+
+    # The shared fixture overrides the authentication dependency directly.
+    client.app.dependency_overrides[app.authenticate] = lambda: CurrentUser("developer", "test_tenant", "DEV")
+    run = mocker.patch.object(app, "run_blocking", new=AsyncMock())
+    assert client.post("/model/outlets/42/migration_reviews", json={"expected_revision": 1}).status_code == 403
+    run.assert_not_awaited()
+
+
+@pytest.mark.parametrize("failure,status", [("stale", 409), ("missing", 404), ("invalid", 422)])
+def test_review_maps_revision_and_record_failures(client, mocker, failure, status):
+    from backend.apps import model_managment_app as app
+    from consts.exceptions import ModelOutletConflictError, ModelOutletValidationError
+
+    run = mocker.patch.object(app, "run_blocking", new=AsyncMock())
+    if failure == "missing":
+        run.return_value = None
+    elif failure == "stale":
+        run.side_effect = ModelOutletConflictError()
+    else:
+        run.side_effect = ModelOutletValidationError(category="MIGRATION_NOT_APPLICABLE")
+    assert client.post("/model/outlets/42/migration_reviews", json={"expected_revision": 1}).status_code == status
+    run.reset_mock()
+    assert client.post("/model/outlets/42/migration_reviews", json={"expected_revision": True}).status_code == 422
+    run.assert_not_awaited()
+
+
+@pytest.mark.parametrize('kind,status', [('stale', 409), ('invalid', 400)])
+def test_create_rejects_version_or_configuration_without_audit(client, mocker, kind, status):
+    from backend.apps import model_managment_app as app
+    from consts.exceptions import ModelOutletConflictError, ModelOutletValidationError
+
+    error = ModelOutletConflictError() if kind == 'stale' else ModelOutletValidationError('PARAMETER_UNKNOWN', '/unknown')
+    mocker.patch.object(app, 'run_blocking', new=AsyncMock(side_effect=error))
+    audit = mocker.patch.object(app, 'record_security_event')
+    response = client.post('/model/outlets', json={**preview_body(), 'catalog_revision': 'revision'})
+    assert response.status_code == status
+    audit.assert_not_called()
+    if kind == 'invalid':
+        assert response.json()['detail']['details'] == {'category': 'PARAMETER_UNKNOWN', 'field': '/unknown'}
+
+
+@pytest.mark.parametrize('kind,status', [('missing', 404), ('stale', 409), ('invalid', 422)])
+def test_validation_distinguishes_selection_version_and_configuration_errors(client, mocker, kind, status):
+    from consts.exceptions import ModelOutletConflictError, ModelOutletValidationError
+
+    errors = {'missing': LookupError(), 'stale': ModelOutletConflictError(),
+              'invalid': ModelOutletValidationError('PROFILE_STORAGE_INVALID')}
+    invoke = mocker.patch('services.model_profile_service.validate_model_outlet', new=AsyncMock(side_effect=errors[kind]))
+    response = client.post('/model/outlet_validations', json={'outlet_id': 42, 'expected_revision': 1})
+    assert response.status_code == status
+    assert invoke.call_args.args[1] == 'test_tenant'
diff --git a/test/backend/configs/test_model_catalog_gateway_fallback.py b/test/backend/configs/test_model_catalog_gateway_fallback.py
index 4815e6d3ed..3dff1782e2 100644
--- a/test/backend/configs/test_model_catalog_gateway_fallback.py
+++ b/test/backend/configs/test_model_catalog_gateway_fallback.py
@@ -205,3 +205,13 @@ def test_resolved_gateway_controls_build_generic_sdk_parameters(catalog, enabled
         "extra_body": {"enable_thinking": enabled},
         **({"reasoning_effort": "xhigh"} if enabled else {}),
     }
+
+
+def test_legacy_migration_keeps_pre_gateway_matching_boundary(catalog):
+    assert loader.resolve_reasoning_capability(
+        "qwen3.8-max", GATEWAY, "custom", allow_gateway_fallback=False,
+    ) is None
+    assert loader.resolve_reasoning_capability(
+        "qwen3.8-max", OFFICIAL, "alibaba-cn", allow_gateway_fallback=False,
+    )["provider_id"] == "alibaba-cn"
+    assert resolve() is not None  # Current gateway behavior remains enabled.
diff --git a/test/backend/configs/test_model_catalog_loader.py b/test/backend/configs/test_model_catalog_loader.py
index d6fbbe824f..e440407ee6 100644
--- a/test/backend/configs/test_model_catalog_loader.py
+++ b/test/backend/configs/test_model_catalog_loader.py
@@ -690,34 +690,3 @@ def test_static_profile_uses_models_dev_provider_reasoning_controls(self, tmp_pa
         assert profile.reasoning_capability.levels == ["low", "high", "max"]
         assert profile.reasoning_capability.source == "models_dev"
 
-
-def test_explicit_gateway_wire_profile_is_exact_scoped_and_non_mutating(tmp_path):
-    import configs.model_catalog_loader as loader
-    profile = {"status": "supported", "provider_id": "compatible", "levels": ["low", "high"], "toggle_wire_format": None}
-    path = tmp_path / "wire.json"
-    path.write_text(json.dumps({"profiles": [{"base_url": "https://gateway.example/v1", "model_id": "verified-model", "toggle_wire_format": "thinking_object"}]}))
-    with mock.patch.object(loader, "MODEL_REASONING_WIRE_PROFILES_PATH", str(path)), mock.patch.object(loader, "_resolve_base_reasoning_capability", return_value=profile):
-        selected = loader.resolve_reasoning_capability("verified-model", "https://gateway.example/v1/")
-        assert selected["toggle_wire_format"] == "thinking_object"
-        assert selected["levels"] == profile["levels"]
-        assert loader.resolve_reasoning_capability("other", "https://gateway.example/v1") == profile
-        assert loader.resolve_reasoning_capability("verified-model", "https://gateway.example/other") == profile
-        assert loader.resolve_reasoning_capability("verified-model", "https://gateway.example/v1?key=secret") == profile
-    assert profile["toggle_wire_format"] is None
-
-
-@pytest.mark.parametrize("document", [
-    "invalid-json", [], {"profiles": {}},
-    {"profiles": [{"base_url": "https://gateway.example/v1", "model_id": "m",
-                   "toggle_wire_format": []}]},
-    {"profiles": [{"base_url": "https://gateway.example/v1", "model_id": "m",
-                   "toggle_wire_format": "thinking_object"}] * 2},
-])
-def test_invalid_or_ambiguous_wire_profiles_preserve_base_capability(tmp_path, document):
-    import configs.model_catalog_loader as loader
-    path = tmp_path / "wire.json"
-    path.write_text(document if isinstance(document, str) else json.dumps(document))
-    capability = {"status": "supported", "toggle_wire_format": None}
-    with mock.patch.object(loader, "MODEL_REASONING_WIRE_PROFILES_PATH", str(path)), \
-            mock.patch.object(loader, "_resolve_base_reasoning_capability", return_value=capability):
-        assert loader.resolve_reasoning_capability("m", "https://gateway.example/v1") == capability
diff --git a/test/backend/consts/test_workbench_models.py b/test/backend/consts/test_workbench_models.py
index d468a96cd1..5c1c63c02d 100644
--- a/test/backend/consts/test_workbench_models.py
+++ b/test/backend/consts/test_workbench_models.py
@@ -1,3 +1,5 @@
+# Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
 """Functional acceptance tests for Workbench wire contracts."""
 
 import pytest
@@ -8,7 +10,7 @@
 
 def _single_agent_payload() -> dict:
     return {
-        "schema_version": 3,
+        "schema_version": 4,
         "mode": "single_agent_chat",
         "agent_mounts": [{"agent_id": 7, "version_no": 2}],
         "skill_mounts": [{"skill_id": 11, "config_values": {"region": "cn"}}],
@@ -45,7 +47,7 @@ def test_ut_be_wb_008_skill_mounts_are_a_unique_full_selection():
 
 
 def test_ut_be_wb_020_unknown_canonical_fields_are_rejected():
-    """UT-BE-WB-020: v3 canonical config rejects silent schema drift."""
+    """UT-BE-WB-020: v4 canonical config rejects silent schema drift."""
     payload = _single_agent_payload()
     payload["resolved_agents"] = []
     with pytest.raises(ValidationError):
@@ -70,4 +72,4 @@ def test_ut_be_wb_025_agent_request_requires_explicit_workbench_entrypoint():
         entrypoint="workbench",
         workbench=_single_agent_payload(),
     )
-    assert request.workbench and request.workbench.schema_version == 3
+    assert request.workbench and request.workbench.schema_version == 4
diff --git a/test/backend/database/model_outlet_helpers.py b/test/backend/database/model_outlet_helpers.py
new file mode 100644
index 0000000000..b3b6a9c69f
--- /dev/null
+++ b/test/backend/database/model_outlet_helpers.py
@@ -0,0 +1,190 @@
+# Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
+"""Unit query/validation proof; actual PostgreSQL transactions belong to MOP-D3-001."""
+
+import importlib.util
+import sys
+from contextlib import contextmanager
+from pathlib import Path
+from types import ModuleType
+from unittest.mock import MagicMock
+
+import pytest
+from nexent.core.model_service.profiles.contracts import VersionedReference
+from nexent.core.model_service.profiles.instruction_mapping import (
+    resolve_instruction_mapping,
+)
+from nexent.core.model_service.profiles.outlet_storage import (
+    encode_resolved_model_profile,
+)
+from nexent.core.model_service.profiles.resolved_profile import ResolvedModelProfile
+from sqlalchemy.dialects import postgresql
+from sqlalchemy.exc import SQLAlchemyError
+
+ROOT = Path(__file__).resolve().parents[3]
+REFERENCE = VersionedReference(ref="fixture_v1", version=1)
+REGISTRY = {
+    key: [REFERENCE]
+    for key in (
+        "protocol",
+        "auth",
+        "adapter",
+        "code_converter",
+        "native_converter",
+        "parameter_transform",
+    )
+}
+
+
+def load(name, path, monkeypatch):
+    spec = importlib.util.spec_from_file_location(name, ROOT / path)
+    module = importlib.util.module_from_spec(spec)
+    monkeypatch.setitem(sys.modules, name, module)
+    spec.loader.exec_module(module)
+    return module
+
+
+@pytest.fixture
+def database(monkeypatch):
+    # Use actual metadata/exception definitions without importing configured DB clients.
+    for package, directory in (
+        ("_outlet_unit_consts", "backend/consts"),
+        ("_outlet_unit_db", "backend/database"),
+    ):
+        module = ModuleType(package)
+        module.__path__ = [str(ROOT / directory)]
+        monkeypatch.setitem(sys.modules, package, module)
+    exceptions = load(
+        "_outlet_unit_consts.exceptions", "backend/consts/exceptions.py", monkeypatch
+    )
+    monkeypatch.setitem(sys.modules, "consts.exceptions", exceptions)
+    client = ModuleType("_outlet_unit_db.client")
+    client.sessions = []
+
+    @contextmanager
+    def get_session(session=None):
+        client.sessions.append(session)
+        yield session
+
+    client.get_db_session = get_session
+    monkeypatch.setitem(sys.modules, client.__name__, client)
+    database = load(
+        "_outlet_unit_db.model_outlet_db",
+        "backend/database/model_outlet_db.py",
+        monkeypatch,
+    )
+    return database, client, exceptions
+
+
+@pytest.fixture
+def profile():
+    role = VersionedReference(ref="system_only_v1", version=1)
+    return ResolvedModelProfile.model_validate(
+        {
+            "schema_version": 1,
+            "outlet_id": 12,
+            "config_revision": 1,
+            "identity": {
+                "tenant_id": "tenant-one",
+                "display_name": "display",
+                "model_type": "llm",
+                "provider_id": "provider",
+                "request_model_id": "Exact/Model",
+                "provider_key": None,
+                "model_profile_key": None,
+            },
+            "connection": {
+                "base_url": "http://localhost/v1",
+                "ssl_verify": False,
+                "timeout_seconds": 120,
+                "concurrency_limit": None,
+                "credential_ref": {"kind": "model_record", "model_id": 12},
+            },
+            "connection_rules": {
+                "credential_kind": "model_record",
+                "relative_path": "/chat/completions",
+                "method": "POST",
+                "headers": {},
+            },
+            "context_configuration": {
+                "output_reserve_tokens": None,
+                "tokenizer_family": None,
+                "capacity_source": None,
+                "capability_profile_version": None,
+            },
+            "capabilities": {},
+            "instruction_mapping": resolve_instruction_mapping(role).model_dump(
+                mode="json"
+            ),
+            "parameter_rules": [
+                {
+                    "key": "custom",
+                    "schema": {},
+                    "visible": True,
+                    "editable": True,
+                    "required": False,
+                    "allowed_scopes": ["outlet", "conversation"],
+                    "ui_group": "common",
+                    "owner": "provider",
+                    "source": {},
+                    "api_binding": {
+                        "path": "/custom",
+                        "transform_ref": "fixture_v1",
+                        "transform_version": 1,
+                    },
+                }
+            ],
+            "parameter_values": {"custom": False},
+            "extra_api_parameters": [],
+            "bindings": {
+                **{
+                    key: REFERENCE.model_dump()
+                    for key in REGISTRY
+                    if key != "parameter_transform"
+                },
+                "role_mapping": role.model_dump(),
+            },
+            "provenance": {
+                "atomic_refs": {
+                    "model": None,
+                    "provider": None,
+                    "provider_model": None,
+                },
+                "interpretation_versions": {
+                    "source_parser": None,
+                    "source_mapping": None,
+                    "supplement_schema": None,
+                    "composer": None,
+                },
+                "overrides": [],
+                "field_sources": [],
+                "provider_metadata": {},
+            },
+        }
+    )
+
+
+def row(profile):
+    return encode_resolved_model_profile(profile, registered_references=REGISTRY)
+
+
+def statement(session, index=0):
+    return (
+        session.execute.call_args_list[index]
+        .args[0]
+        .compile(dialect=postgresql.dialect())
+    )
+
+
+def update(database, profile, session, **kwargs):
+    return database.update_resolved_model_record(
+        profile,
+        1,
+        "actor",
+        "tenant-one",
+        registered_references=REGISTRY,
+        db_session=session,
+        **kwargs,
+    )
+
+
diff --git a/test/backend/database/test_conversation_db_workbench_coverage.py b/test/backend/database/test_conversation_db_workbench_coverage.py
index e4a56f2c47..edc8f278cf 100644
--- a/test/backend/database/test_conversation_db_workbench_coverage.py
+++ b/test/backend/database/test_conversation_db_workbench_coverage.py
@@ -44,7 +44,7 @@ def returning(self, *_columns):
         knowledge_scope=None,
         runtime_metadata={},
         runtime_metadata_version=0,
-        workbench_config={"schema_version": 3, "mode": "single_agent_chat"},
+        workbench_config={"schema_version": 4, "mode": "single_agent_chat"},
         workbench_config_version=1,
         create_time=1000,
         update_time=1000,
@@ -55,14 +55,14 @@ def returning(self, *_columns):
         "Workbench",
         "user-a",
         agent_id=7,
-        workbench_config={"schema_version": 3, "mode": "single_agent_chat"},
+        workbench_config={"schema_version": 4, "mode": "single_agent_chat"},
     )
 
     assert result["workbench_config_version"] == 1
     assert result["workbench_config"]["mode"] == "single_agent_chat"
     assert insert_values["workbench_config_version"] == 1
     assert insert_values["workbench_config"] == {
-        "schema_version": 3,
+        "schema_version": 4,
         "mode": "single_agent_chat",
     }
 
@@ -80,7 +80,7 @@ def test_workbench_replacement_requires_owned_conversation(
     common = {
         "conversation_id": 42,
         "user_id": "user-a",
-        "config": {"schema_version": 3, "mode": "generic_chat"},
+        "config": {"schema_version": 4, "mode": "generic_chat"},
     }
 
     with pytest.raises(conversation_db.ConversationNotFoundError):
@@ -97,11 +97,11 @@ def test_workbench_replacement_requires_owned_conversation(
 
 def test_creation_topology_accepts_same_creation_mode():
     record = SimpleNamespace(
-        workbench_config={"schema_version": 3, "mode": "skill_create"}
+        workbench_config={"schema_version": 4, "mode": "skill_create"}
     )
 
     conversation_db._assert_workbench_topology(
-        record, {"schema_version": 3, "mode": "skill_create"}
+        record, {"schema_version": 4, "mode": "skill_create"}
     )
 
 
diff --git a/test/backend/database/test_conversation_model_preferences_db.py b/test/backend/database/test_conversation_model_preferences_db.py
new file mode 100644
index 0000000000..ad3fa4c5e0
--- /dev/null
+++ b/test/backend/database/test_conversation_model_preferences_db.py
@@ -0,0 +1,103 @@
+# Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
+"""Preference persistence uses conversation ownership, an independent revision and no commits."""
+
+from copy import deepcopy
+from types import SimpleNamespace
+from unittest.mock import MagicMock
+
+import pytest
+from consts.exceptions import ConversationNotFoundError, ModelOutletConflictError
+
+from test.backend.database.test_model_outlet_db import database, load  # noqa: F401
+
+
+@pytest.fixture
+def preferences_db(database, monkeypatch):
+    module = load("_outlet_unit_db.conversation_model_preferences_db",
+        "backend/database/conversation_model_preferences_db.py", monkeypatch)
+    return module, database[1]
+
+
+@pytest.fixture
+def record():
+    return SimpleNamespace(model_parameter_preferences={"42": {"temperature": 0}, "43": {"enable_thinking": False}},
+        model_parameter_preferences_version=2)
+
+
+def test_patch_preserves_other_outlets_and_configurations_and_has_no_commit(preferences_db, record):
+    db, client = preferences_db
+    session = MagicMock()
+    session.scalars.return_value.first.return_value = record
+    db.get_db_session = lambda: __import__("contextlib").nullcontext(session)
+    original = deepcopy(record.model_parameter_preferences)
+    result = db.model_preferences(1, "owner", expected_version=2, outlet_id=42, resolve_values=lambda saved: {})
+    assert result == {"model_parameter_preferences": {"43": {"enable_thinking": False}}, "version": 3, "selected_model_id": None}
+    assert original["42"] == {"temperature": 0}
+    query = str(session.scalars.call_args.args[0])
+    assert "FOR UPDATE" in query and "created_by" in query and "delete_flag" in query
+    assert not hasattr(record, "runtime_metadata") and not hasattr(record, "workbench_config")
+    session.flush.assert_called_once()
+    session.commit.assert_not_called()
+
+
+def test_conflict_does_not_change_values(preferences_db, record):
+    db, client = preferences_db
+    session = MagicMock()
+    session.scalars.return_value.first.return_value = record
+    db.get_db_session = lambda: __import__("contextlib").nullcontext(session)
+    before = deepcopy(record.model_parameter_preferences)
+    with pytest.raises(db.ModelOutletConflictError):
+        db.model_preferences(1, "owner", expected_version=1, outlet_id=42, resolve_values=lambda saved: {})
+    assert record.model_parameter_preferences == before and record.model_parameter_preferences_version == 2
+    session.flush.assert_not_called()
+
+
+def test_missing_or_other_owner_has_no_preferences(preferences_db):
+    db, client = preferences_db
+    session = MagicMock()
+    session.scalars.return_value.first.return_value = None
+    db.get_db_session = lambda: __import__("contextlib").nullcontext(session)
+    with pytest.raises(db.ConversationNotFoundError):
+        db.model_preferences(1, "other-owner")
+    session.flush.assert_not_called()
+
+
+@pytest.mark.parametrize("invalid", [[], False, 0, ""])
+def test_invalid_stored_configuration_is_not_silently_reset(preferences_db, record, invalid):
+    db, _ = preferences_db
+    session = MagicMock()
+    record.model_parameter_preferences = invalid
+    session.scalars.return_value.first.return_value = record
+    db.get_db_session = lambda: __import__("contextlib").nullcontext(session)
+    with pytest.raises(db.ModelOutletValidationError):
+        db.model_preferences(1, "owner", expected_version=2, outlet_id=42, resolve_values=lambda saved: {})
+    assert record.model_parameter_preferences == invalid
+    assert record.model_parameter_preferences_version == 2
+    session.flush.assert_not_called()
+
+
+def test_su_ac_01_selection_uses_the_same_owned_lock_and_preserves_parameter_maps(preferences_db, record):
+    db, _ = preferences_db
+    session = MagicMock()
+    session.scalars.return_value.first.return_value = record
+    db.get_db_session = lambda: __import__("contextlib").nullcontext(session)
+    record.selected_model_id = 42
+    before = deepcopy(record.model_parameter_preferences)
+    result = db.model_preferences(1, "owner", expected_version=2, selected_model_id=43)
+    assert result == {"selected_model_id": 43, "version": 3, "model_parameter_preferences": before}
+    assert record.model_parameter_preferences == before
+    assert "FOR UPDATE" in str(session.scalars.call_args.args[0])
+    session.commit.assert_not_called()
+
+
+def test_su_ac_05_stale_selection_cannot_overwrite_current_identity(preferences_db, record):
+    db, _ = preferences_db
+    session = MagicMock()
+    session.scalars.return_value.first.return_value = record
+    db.get_db_session = lambda: __import__("contextlib").nullcontext(session)
+    record.selected_model_id = 42
+    with pytest.raises(db.ModelOutletConflictError):
+        db.model_preferences(1, "owner", expected_version=1, selected_model_id=43)
+    assert record.selected_model_id == 42
+    session.flush.assert_not_called()
diff --git a/test/backend/database/test_model_outlet_connectivity_db.py b/test/backend/database/test_model_outlet_connectivity_db.py
new file mode 100644
index 0000000000..ce383b9a14
--- /dev/null
+++ b/test/backend/database/test_model_outlet_connectivity_db.py
@@ -0,0 +1,44 @@
+# Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
+"""Tenant/revision query boundaries for connectivity status and credential presence."""
+
+from unittest.mock import MagicMock
+
+import pytest
+from sqlalchemy.dialects import postgresql
+
+from test.backend.database.test_model_outlet_db import database  # noqa: F401
+
+
+@pytest.mark.parametrize("result,expected", [(True, True), (False, False), (None, False)])
+def test_credential_flag_does_not_return_key_material(database, result, expected):
+    db, _, _ = database
+    session = MagicMock()
+    session.execute.return_value.scalar_one_or_none.return_value = result
+    assert db.has_model_outlet_credential(12, "tenant-one", db_session=session) is expected
+    sql = str(session.execute.call_args.args[0].compile(dialect=postgresql.dialect()))
+    assert "length(trim(nexent.model_record_t.api_key))" in sql
+    assert "tenant_id" in sql and "delete_flag" in sql
+
+
+def test_connectivity_status_is_revision_checked_without_config_write(database):
+    db, _, errors = database
+    session = MagicMock()
+    session.execute.return_value.scalar_one_or_none.return_value = 12
+    db.update_model_outlet_connectivity(12, "tenant-one", 3, "available", db_session=session)
+    statement = session.execute.call_args.args[0]
+    sql = str(statement.compile(dialect=postgresql.dialect()))
+    assignments = sql.split(" SET ")[1].split(" WHERE ")[0]
+    assert assignments == "connect_status=%(connect_status)s, update_time=now()"
+    assert "config_revision" in sql and "tenant_id" in sql and "model_type" in sql
+    session.execute.return_value.scalar_one_or_none.return_value = None
+    with pytest.raises(errors.ModelOutletConflictError):
+        db.update_model_outlet_connectivity(12, "tenant-one", 3, "unavailable", db_session=session)
+
+
+@pytest.mark.parametrize("revision,status", [(True, "available"), (0, "available"), (1, "detecting")])
+def test_invalid_status_update_does_not_touch_database(database, revision, status):
+    db, client, errors = database
+    with pytest.raises(errors.ModelOutletValidationError):
+        db.update_model_outlet_connectivity(12, "tenant-one", revision, status, db_session=MagicMock())
+    assert client.sessions == []
diff --git a/test/backend/database/test_model_outlet_db.py b/test/backend/database/test_model_outlet_db.py
new file mode 100644
index 0000000000..a27348efc9
--- /dev/null
+++ b/test/backend/database/test_model_outlet_db.py
@@ -0,0 +1,336 @@
+# Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
+"""Resolved outlet persistence and immutable update guards."""
+
+import sys
+from types import ModuleType
+from unittest.mock import MagicMock
+
+import pytest
+from nexent.core.model_service.profiles.resolved_profile import ResolvedModelProfile
+from sqlalchemy.exc import SQLAlchemyError
+from test.backend.database.model_outlet_helpers import (
+    REGISTRY, database, load, profile, row, statement, update,
+)
+
+
+def test_creation_returns_id_and_keeps_shared_session_owned_by_caller(
+    database, profile
+):
+    db, client, _ = database
+    value = profile.model_dump(mode="json")
+    value["outlet_id"] = value["connection"]["credential_ref"]["model_id"] = None
+    session = MagicMock()
+    session.execute.return_value.scalar_one.return_value = 23
+    assert (
+        db.create_resolved_model_record(
+            ResolvedModelProfile.model_validate(value),
+            "actor",
+            "tenant-one",
+            registered_references=REGISTRY,
+            api_key="dummy-private",
+            db_session=session,
+        )
+        == 23
+    )
+    compiled = statement(session)
+    assert compiled.params["api_key"] == "dummy-private"
+    assert "dummy-private" not in repr(compiled.params["resolved_profile"])
+    assert compiled.params["delete_flag"] == "N"
+    assert compiled.params["created_by"] == compiled.params["updated_by"] == "actor"
+    assert client.sessions == [session]
+    session.commit.assert_not_called()
+    session.rollback.assert_not_called()
+    session.close.assert_not_called()
+
+
+def test_reads_use_tenant_and_active_predicates(database, profile):
+    db, _, _ = database
+    session = MagicMock()
+    session.execute.return_value.mappings.return_value.first.return_value = row(profile)
+    result = db.get_resolved_model_record(
+        12, "tenant-one", registered_references=REGISTRY, db_session=session
+    )
+    assert result.model_dump() == profile.model_dump()
+    compiled = statement(session)
+    assert "model_record_t.model_id =" in str(compiled)
+    assert "model_record_t.tenant_id =" in str(compiled)
+    assert "model_record_t.delete_flag =" in str(compiled)
+    assert {12, "tenant-one", "N"} <= set(compiled.params.values())
+
+
+def test_missing_rows_do_not_construct_a_snapshot(database):
+    db, _, _ = database
+    session = MagicMock()
+    session.execute.return_value.mappings.return_value.first.return_value = None
+    assert (
+        db.get_resolved_model_record(
+            12, "tenant-one", registered_references=REGISTRY, db_session=session
+        )
+        is None
+    )
+
+
+@pytest.mark.parametrize("api_key", [None, "updated-dummy", ""])
+def test_update_is_one_atomic_cas_write_with_optional_credential(
+    database, profile, api_key, monkeypatch
+):
+    db, client, _ = database
+    from nexent.core.model_service.profiles.contracts import VersionedReference
+    monkeypatch.setitem(REGISTRY, "auth", [*REGISTRY["auth"],
+        VersionedReference(ref="bearer_token_v1", version=1), VersionedReference(ref="no_auth_v1", version=1)])
+    session = MagicMock()
+    read_result, write_result = MagicMock(), MagicMock()
+    read_result.mappings.return_value.first.return_value = row(profile)
+    write_result.scalar_one_or_none.return_value = 2
+    session.execute.side_effect = [read_result, write_result]
+    value = profile.model_dump(mode="json")
+    value["parameter_values"]["custom"] = 0
+    value["bindings"]["auth"] = {"ref": "bearer_token_v1" if api_key else "no_auth_v1", "version": 1}
+    value["connection"]["credential_ref"]["kind"] = "model_record" if api_key else "none"
+    value["connection_rules"]["credential_kind"] = "model_record" if api_key else "none"
+    proposed = ResolvedModelProfile.model_validate(value)
+    assert update(db, proposed, session, api_key=api_key) == 2
+    compiled = statement(session, 1)
+    assert "model_record_t.config_revision =" in str(compiled)
+    assert "model_record_t.tenant_id =" in str(compiled)
+    assert "model_record_t.delete_flag =" in str(compiled)
+    assert compiled.params["config_revision"] == 2
+    assert compiled.params["config_revision_1"] == 1
+    assert compiled.params["model_id_1"] == 12
+    assert compiled.params["tenant_id_1"] == "tenant-one"
+    assert compiled.params["delete_flag_1"] == "N"
+    assert compiled.params["api_key"] == api_key
+    assert compiled.params["extra_params"]["parameter_values"] == {"custom": 0}
+    assert client.sessions == [session, session]
+    session.commit.assert_not_called()
+    session.close.assert_not_called()
+
+
+def test_omitted_credential_is_not_cleared(database, profile):
+    db, _, _ = database
+    session = MagicMock()
+    read_result, write_result = MagicMock(), MagicMock()
+    read_result.mappings.return_value.first.return_value = row(profile)
+    write_result.scalar_one_or_none.return_value = 2
+    session.execute.side_effect = [read_result, write_result]
+    update(db, profile, session)
+    assert "api_key" not in statement(session, 1).params
+
+
+@pytest.mark.parametrize("current", [None, "stale"])
+def test_missing_or_stale_update_has_no_write(database, profile, current):
+    db, _, errors = database
+    session = MagicMock()
+    saved = row(profile) if current else None
+    if saved:
+        saved["config_revision"] = 2
+    session.execute.return_value.mappings.return_value.first.return_value = saved
+    with pytest.raises(errors.ModelOutletConflictError):
+        update(db, profile, session)
+    assert session.execute.call_count == 1
+
+
+def test_cas_race_after_read_raises_conflict(database, profile):
+    db, _, errors = database
+    session = MagicMock()
+    read_result, write_result = MagicMock(), MagicMock()
+    read_result.mappings.return_value.first.return_value = row(profile)
+    write_result.scalar_one_or_none.return_value = None
+    session.execute.side_effect = [read_result, write_result]
+    with pytest.raises(errors.ModelOutletConflictError):
+        update(db, profile, session)
+
+
+@pytest.mark.parametrize("bad", ["x" * 501, 0, "bad\x00key", "bad\ud800"])
+def test_invalid_credentials_are_rejected_before_any_query(database, profile, bad):
+    db, client, errors = database
+    session = MagicMock()
+    with pytest.raises(errors.ModelOutletValidationError):
+        update(db, profile, session, api_key=bad)
+    assert client.sessions == []
+    session.execute.assert_not_called()
+
+
+def test_sql_errors_are_sanitized_without_private_parameters(database):
+    db, _, errors = database
+    session = MagicMock()
+    session.execute.side_effect = SQLAlchemyError("dummy-credential-private")
+    with pytest.raises(errors.ModelOutletDatabaseError) as captured:
+        db.get_resolved_model_record(
+            12, "tenant-one", registered_references=REGISTRY, db_session=session
+        )
+    assert "dummy-credential-private" not in str(captured.value)
+    assert captured.value.__suppress_context__ is True
+
+
+def test_immutable_definition_change_is_rejected(database, profile):
+    db, _, errors = database
+    session = MagicMock()
+    session.execute.return_value.mappings.return_value.first.return_value = row(profile)
+    value = profile.model_dump(mode="json")
+    value["identity"]["request_model_id"] = "another-model"
+    with pytest.raises(errors.ModelOutletValidationError):
+        update(db, ResolvedModelProfile.model_validate(value), session)
+    assert session.execute.call_count == 1
+
+
+def test_readonly_parameter_deletion_is_rejected(database, profile):
+    db, _, errors = database
+    value = profile.model_dump(mode="json")
+    value["parameter_rules"][0]["editable"] = False
+    current = ResolvedModelProfile.model_validate(value)
+    session = MagicMock()
+    session.execute.return_value.mappings.return_value.first.return_value = row(current)
+    value["parameter_values"] = {}
+    with pytest.raises(errors.ModelOutletValidationError):
+        update(db, ResolvedModelProfile.model_validate(value), session)
+    assert session.execute.call_count == 1
+
+
+@pytest.mark.parametrize("actor", [None, "", "x" * 101, "bad\x00actor", "bad\ud800"])
+def test_invalid_actors_never_enter_database_session(database, profile, actor):
+    db, client, errors = database
+    with pytest.raises(errors.ModelOutletValidationError):
+        db.update_resolved_model_record(
+            profile,
+            1,
+            actor,
+            "tenant-one",
+            registered_references=REGISTRY,
+            db_session=MagicMock(),
+        )
+    assert client.sessions == []
+
+
+@pytest.mark.parametrize("model_id", [None, True, 0, 2**31])
+def test_invalid_model_ids_are_rejected_before_read(database, model_id):
+    db, client, errors = database
+    with pytest.raises(errors.ModelOutletValidationError):
+        db.get_resolved_model_record(
+            model_id,
+            "tenant-one",
+            registered_references=REGISTRY,
+            db_session=MagicMock(),
+        )
+    assert client.sessions == []
+
+
+@pytest.mark.parametrize("revision", [True, 0, 2, 2**31 - 1])
+def test_invalid_revision_does_not_query(database, profile, revision):
+    db, client, errors = database
+    with pytest.raises(errors.ModelOutletValidationError):
+        db.update_resolved_model_record(
+            profile,
+            revision,
+            "actor",
+            "tenant-one",
+            registered_references=REGISTRY,
+            db_session=MagicMock(),
+        )
+    assert client.sessions == []
+
+
+def test_create_cannot_reuse_existing_identifier(database, profile):
+    db, client, errors = database
+    with pytest.raises(errors.ModelOutletValidationError):
+        db.create_resolved_model_record(
+            profile,
+            "actor",
+            "tenant-one",
+            registered_references=REGISTRY,
+            db_session=MagicMock(),
+        )
+    assert client.sessions == []
+
+
+def test_snapshot_tenant_mismatch_is_not_silently_reassigned(database, profile):
+    db, client, errors = database
+    with pytest.raises(errors.ModelOutletValidationError):
+        db.update_resolved_model_record(
+            profile,
+            1,
+            "actor",
+            "tenant-two",
+            registered_references=REGISTRY,
+            db_session=MagicMock(),
+        )
+    assert client.sessions == []
+
+
+@pytest.mark.parametrize(
+    "change",
+    [
+        lambda d: d["parameter_rules"][0].update(source={"changed": True}),
+        lambda d: d["connection_rules"]["headers"].update(Accept="new"),
+        lambda d: d["capabilities"].update(structured_output={"status": "supported"}),
+    ],
+)
+def test_saved_definitions_cannot_be_replaced_during_update(database, profile, change):
+    db, _, errors = database
+    value = profile.model_dump(mode="json")
+    change(value)
+    session = MagicMock()
+    session.execute.return_value.mappings.return_value.first.return_value = row(profile)
+    with pytest.raises(errors.ModelOutletValidationError):
+        update(db, ResolvedModelProfile.model_validate(value), session)
+    assert session.execute.call_count == 1
+
+
+def test_nul_inside_json_is_rejected_before_postgresql_can_log_query_parameters(
+    database, profile
+):
+    db, client, errors = database
+    value = profile.model_dump(mode="json")
+    value["parameter_values"]["custom"] = {"nested": ["private\x00value"]}
+    with pytest.raises(errors.ModelOutletValidationError) as captured:
+        update(db, ResolvedModelProfile.model_validate(value), MagicMock())
+    assert "private" not in str(captured.value)
+    assert client.sessions == []
+
+
+
+
+def test_registered_thinking_edits_pass_row_guard_and_arbitrary_binding_edits_do_not(database, profile):
+    from copy import deepcopy
+    from nexent.core.model_service.profiles.thinking_configuration import configure_thinking, configure_thinking_degree
+
+    db, _, errors = database
+    changed = configure_thinking_degree(configure_thinking(profile, "enable_thinking"), "effort")
+    db._validate_update(profile, changed)
+    budget = configure_thinking_degree(changed, "budget_tokens")
+    db._validate_update(changed, budget)
+    restored = configure_thinking_degree(budget, "default")
+    db._validate_update(budget, restored)
+    altered = deepcopy(changed.parameter_rules)
+    next(rule for rule in altered if rule["key"] == "reasoning_effort")["api_binding"]["path"] = "/unregistered_effort"
+    with pytest.raises(errors.ModelOutletValidationError):
+        db._validate_update(profile, changed.model_copy(update={"parameter_rules": altered}))
+    metadata = changed.provenance.model_dump()
+    metadata["provider_metadata"]["operator_thinking_degree"]["rules"] = []
+    metadata["provider_metadata"]["unexpected_rule_source"] = "forged"
+    forged = changed.model_copy(update={"provenance": changed.provenance.model_validate(metadata)})
+    with pytest.raises(errors.ModelOutletValidationError):
+        db._validate_update(profile, forged)
+
+
+def test_registered_sampling_upgrade_passes_guard_without_accepting_wire_edits(database, profile):
+    """UI-SESSION-15: permit only the registered v1 protocol normalization."""
+    from copy import deepcopy
+    from nexent.core.model_service.profiles.protocol_parameters import (
+        ensure_outlet_sampling_rules, openai_chat_parameter_rules,
+    )
+
+    db, _, errors = database
+    data = profile.model_dump(mode="json")
+    data["bindings"]["protocol"] = {"ref": "openai_chat_completions", "version": 1}
+    rule = next(item for item in openai_chat_parameter_rules() if item["key"] == "temperature")
+    rule.update(source={"ref": "openai_chat_protocol_parameters_v1", "version": 1}, visible=False, allowed_scopes=["outlet"])
+    data["parameter_rules"].append(rule)
+    old = ResolvedModelProfile.model_validate(data)
+    normalized = ensure_outlet_sampling_rules(old)
+    db._validate_update(old, normalized)
+    forged = deepcopy(normalized.parameter_rules)
+    next(item for item in forged if item["key"] == "temperature")["api_binding"]["path"] = "/unregistered"
+    with pytest.raises(errors.ModelOutletValidationError):
+        db._validate_update(old, normalized.model_copy(update={"parameter_rules": forged}))
diff --git a/test/backend/database/test_model_outlet_db_facade.py b/test/backend/database/test_model_outlet_db_facade.py
new file mode 100644
index 0000000000..5579e2e5e5
--- /dev/null
+++ b/test/backend/database/test_model_outlet_db_facade.py
@@ -0,0 +1,45 @@
+# Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
+"""Legacy database facade forwards resolved outlet operations unchanged."""
+
+import sys
+from types import ModuleType
+from unittest.mock import MagicMock
+
+import pytest
+from test.backend.database.model_outlet_helpers import database, load
+
+
+@pytest.mark.parametrize(
+    "name",
+    [
+        "create_resolved_model_record",
+        "get_resolved_model_record",
+        "update_resolved_model_record",
+    ],
+)
+def test_model_management_entry_delegates_without_legacy_filter(
+    database, monkeypatch, name
+):
+    db, client, _ = database
+    constants = ModuleType("consts.const")
+    constants.DEFAULT_EXPECTED_CHUNK_SIZE = 1024
+    constants.DEFAULT_MAXIMUM_CHUNK_SIZE = 1536
+    monkeypatch.setitem(sys.modules, "consts.const", constants)
+    model_constants = ModuleType("consts.model")
+    model_constants.filter_extra_params = MagicMock(
+        side_effect=AssertionError("New profile must not enter legacy filter")
+    )
+    monkeypatch.setitem(sys.modules, "consts.model", model_constants)
+    client.as_dict, client.db_client = MagicMock(), MagicMock()
+    delegated = MagicMock(return_value=42)
+    monkeypatch.setattr(db, name, delegated)
+    facade = load(
+        "_outlet_unit_db.model_management_db",
+        "backend/database/model_management_db.py",
+        monkeypatch,
+    )
+    assert getattr(facade, name)("profile-or-id", tenant_id="tenant-one") == 42
+    delegated.assert_called_once_with("profile-or-id", tenant_id="tenant-one")
+    model_constants.filter_extra_params.assert_not_called()
+
diff --git a/test/backend/database/test_model_outlet_migration_db.py b/test/backend/database/test_model_outlet_migration_db.py
new file mode 100644
index 0000000000..241287d25c
--- /dev/null
+++ b/test/backend/database/test_model_outlet_migration_db.py
@@ -0,0 +1,126 @@
+# Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
+"""Migration transaction scope, exclusions, dry runs and safe failure persistence."""
+
+from unittest.mock import MagicMock, Mock
+
+import pytest
+from sqlalchemy.dialects import postgresql
+
+from test.backend.database.test_model_outlet_db import database, profile, REGISTRY, row  # noqa: F401
+
+
+def test_batch_locks_legacy_rows_preserves_credentials_and_references(database, profile):
+    db, client, _ = database
+    session = MagicMock()
+    legacy = row(profile)
+    legacy.update(profile_schema_version=None, api_key="controlled-key", delete_flag="Y")
+    session.execute.return_value.mappings.return_value.all.return_value = [legacy]
+    result = db.migrate_legacy_model_records(Mock(return_value=profile), registered_references=REGISTRY, db_session=session)
+    assert result == [{"model_id": 12, "tenant_id": "tenant-one", "status": "migrated", "category": None}]
+    read, write = [call.args[0] for call in session.execute.call_args_list]
+    sql = str(read.compile(dialect=postgresql.dialect()))
+    assert "FOR UPDATE" in sql and "profile_schema_version IS NULL" in sql and "model_type IN" in sql
+    assert "delete_flag" not in sql.split("WHERE ", 1)[1]
+    values = write.compile().params
+    assert "api_key" not in values and "delete_flag" not in values and "model_id" not in values
+    assert values["max_tokens"] is None and values["model_repo"] is None
+    session.commit.assert_not_called()
+    assert client.sessions == [session]
+
+
+def test_dry_run_does_not_lock_or_write(database, profile):
+    db, _, _ = database
+    session = MagicMock()
+    session.execute.return_value.mappings.return_value.all.return_value = [row(profile)]
+    result = db.migrate_legacy_model_records(Mock(return_value=profile), registered_references=REGISTRY,
+        dry_run=True, db_session=session)
+    assert result[0]["status"] == "ready"
+    assert session.execute.call_count == 1
+    assert "FOR UPDATE" not in str(session.execute.call_args.args[0])
+
+
+def test_failure_keeps_old_values_and_persists_only_sanitized_diagnostic(database):
+    db, _, errors = database
+    session = MagicMock()
+    session.execute.return_value.mappings.return_value.all.return_value = [{"model_id": 12, "tenant_id": "tenant-one"}]
+    builder = Mock(side_effect=errors.ModelOutletValidationError(category="LEGACY_OUTLET_INVALID", path="base_url"))
+    result = db.migrate_legacy_model_records(builder, registered_references=REGISTRY, db_session=session)
+    assert result[0]["status"] == "failed"
+    values = session.execute.call_args_list[1].args[0].compile().params
+    assert values["resolved_profile"] == {"migration_error": {"category": "LEGACY_OUTLET_INVALID", "field": "base_url"}}
+    assert "extra_params" not in values and "api_key" not in values and "profile_schema_version" not in values
+
+
+@pytest.mark.parametrize("options", [{"batch_size": 0}, {"batch_size": True}, {"after_model_id": -1}])
+def test_invalid_batch_bounds_never_open_database(database, options):
+    db, client, errors = database
+    with pytest.raises(errors.ModelOutletValidationError):
+        db.migrate_legacy_model_records(Mock(), registered_references=REGISTRY, **options)
+    assert client.sessions == []
+
+
+def test_review_updates_only_provenance_at_the_locked_revision(database, profile):
+    db, _, _ = database
+    data = profile.model_dump()
+    data["provenance"]["provider_metadata"]["migration"] = {"reviewed_revision": None, "version": "fixture_v1"}
+    profile = profile.__class__.model_validate(data)
+    session = MagicMock()
+    session.execute.return_value.mappings.return_value.first.return_value = row(profile)
+    session.execute.return_value.scalar_one_or_none.return_value = 12
+    result = db.confirm_model_outlet_migration(12, "tenant-one", "admin", 1,
+        registered_references=REGISTRY, db_session=session)
+    assert result["config_revision"] == 1 and result["migration_review_required"] is False
+    write = session.execute.call_args_list[1].args[0]
+    values = write.compile().params
+    migration = values["resolved_profile"]["provenance"]["provider_metadata"]["migration"]
+    assert migration["reviewed_revision"] == 1 and migration["reviewed_by"] == "admin"
+    assert "api_key" not in values and "extra_params" not in values and "config_revision" not in values
+    session.commit.assert_not_called()
+
+
+def test_stale_or_non_migration_review_never_writes(database, profile):
+    db, _, errors = database
+    session = MagicMock()
+    session.execute.return_value.mappings.return_value.first.return_value = row(profile)
+    with pytest.raises(errors.ModelOutletConflictError):
+        db.confirm_model_outlet_migration(12, "tenant-one", "admin", 2,
+            registered_references=REGISTRY, db_session=session)
+    assert session.execute.call_count == 1
+    session.reset_mock()
+    with pytest.raises(errors.ModelOutletValidationError):
+        db.confirm_model_outlet_migration(12, "tenant-one", "admin", 1,
+            registered_references=REGISTRY, db_session=session)
+    assert session.execute.call_count == 1
+
+
+def test_repair_keeps_id_credential_and_uses_a_locked_row(database, profile):
+    db, _, _ = database
+    session = MagicMock()
+    old = row(profile)
+    old["profile_schema_version"] = None
+    session.execute.return_value.mappings.return_value.first.return_value = old
+    result = db.repair_legacy_model_record(12, "tenant-one", "admin", 1, Mock(return_value=(profile, None)),
+        registered_references=REGISTRY, db_session=session)
+    assert result == {"model_id": 12, "config_revision": 2}
+    assert "FOR UPDATE" in str(session.execute.call_args_list[0].args[0])
+    values = session.execute.call_args_list[1].args[0].compile().params
+    assert values["config_revision"] == 2 and values["api_key"] is None
+    assert values["profile_schema_version"] == 1 and values["max_tokens"] is None
+    assert "model_id" not in values and "tenant_id" not in values and "delete_flag" not in values
+    session.commit.assert_not_called()
+
+
+@pytest.mark.parametrize("ready,version", [(False, 2), (True, 1)])
+def test_repair_cannot_overwrite_a_newer_or_already_migrated_row(database, profile, ready, version):
+    db, _, errors = database
+    session = MagicMock()
+    old = row(profile)
+    old["profile_schema_version"] = 1 if ready else None
+    session.execute.return_value.mappings.return_value.first.return_value = old
+    builder = Mock()
+    with pytest.raises(errors.ModelOutletConflictError):
+        db.repair_legacy_model_record(12, "tenant-one", "admin", version, builder,
+            registered_references=REGISTRY, db_session=session)
+    builder.assert_not_called()
+    assert session.execute.call_count == 1
diff --git a/test/backend/database/test_model_outlet_schema.py b/test/backend/database/test_model_outlet_schema.py
new file mode 100644
index 0000000000..9f32e9e379
--- /dev/null
+++ b/test/backend/database/test_model_outlet_schema.py
@@ -0,0 +1,77 @@
+# Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
+"""ORM schema contract; actual PostgreSQL migration execution is a separate D5 proof."""
+
+import importlib.util
+from pathlib import Path
+
+import pytest
+from sqlalchemy.dialects import postgresql
+from sqlalchemy.schema import CreateColumn, SetColumnComment
+
+
+@pytest.fixture(scope="module")
+def table():
+    # This metadata module has no database clients or configuration side effects.
+    path = Path(__file__).resolve().parents[3] / "backend/database/db_models.py"
+    spec = importlib.util.spec_from_file_location("outlet_schema_metadata", path)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module.ModelRecord.__table__
+
+
+@pytest.mark.parametrize(
+    "name,sql_type",
+    [
+        ("reasoning_supported", "BOOLEAN"),
+        ("reasoning_controls", "JSONB"),
+        ("native_tool_call_supported", "BOOLEAN"),
+        ("structured_output_supported", "BOOLEAN"),
+        ("temperature_supported", "BOOLEAN"),
+        ("top_p_supported", "BOOLEAN"),
+        ("input_modalities", "JSONB"),
+        ("output_modalities", "JSONB"),
+        ("enable_thinking", "BOOLEAN"),
+        ("reasoning_effort", "VARCHAR(30)"),
+        ("reasoning_budget_tokens", "INTEGER"),
+        ("protocol_id", "VARCHAR(30)"),
+        ("resolved_profile", "JSONB"),
+        ("profile_schema_version", "INTEGER"),
+    ],
+)
+def test_new_fields_have_reviewed_types_and_no_inferred_default(table, name, sql_type):
+    column = table.c[name]
+    assert str(column.type.compile(dialect=postgresql.dialect())) == sql_type
+    assert column.nullable is True
+    assert column.default is None
+    assert column.server_default is None
+    assert column.comment and column.comment.isascii()
+    assert column.comment in str(
+        SetColumnComment(column).compile(dialect=postgresql.dialect())
+    )
+
+
+def test_revision_has_database_default_for_old_and_new_rows(table):
+    column = table.c.config_revision
+    assert column.nullable is False
+    assert column.default.arg == 1
+    assert str(column.server_default.arg) == "1"
+    assert "DEFAULT 1 NOT NULL" in str(
+        CreateColumn(column).compile(dialect=postgresql.dialect())
+    )
+    assert column.comment in str(
+        SetColumnComment(column).compile(dialect=postgresql.dialect())
+    )
+
+
+def test_existing_value_columns_remain_single_storage_locations(table):
+    expected = {
+        "temperature": "FLOAT",
+        "top_p": "FLOAT",
+        "extra_params": "JSONB",
+        "api_key": "VARCHAR(500)",
+    }
+    for name, sql_type in expected.items():
+        assert str(table.c[name].type.compile(dialect=postgresql.dialect())) == sql_type
+    assert not table.c.reasoning_controls.index
+    assert not table.c.native_tool_call_supported.index
diff --git a/test/backend/services/providers/test_model_provider_failures.py b/test/backend/services/providers/test_model_provider_failures.py
index 455f13e7a2..2ac78353e9 100644
--- a/test/backend/services/providers/test_model_provider_failures.py
+++ b/test/backend/services/providers/test_model_provider_failures.py
@@ -1,3 +1,5 @@
+# Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
 """Provider paging, malformed catalog and error regression tests."""
 
 from unittest.mock import AsyncMock
@@ -155,3 +157,14 @@ async def test_dashscope_authentication_failure_is_classified(provider_http):
     )
     assert result[0]["_error"] == "authentication_failed"
     assert result[0]["_http_code"] == 401
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("key,header", [("", None), ("  ", None), (" fixture ", "Bearer fixture")])
+async def test_optional_key_model_discovery_does_not_send_empty_bearer(provider_http, key, header):
+    """UI-AUTH-11: discovery uses the same optional API key convention."""
+    requests = provider_http(openai_provider, lambda request: httpx.Response(200, json={"data": [{"id": "model"}]}))
+    result = await openai_provider.OpenAICompatibleProvider().get_models(
+        {"base_url": "https://fixture.test/v1", "api_key": key})
+    assert result == [{"id": "model", "model_tag": "chat"}]
+    assert requests[0].headers.get("Authorization") == header
diff --git a/test/backend/services/test_agent_model_parameters.py b/test/backend/services/test_agent_model_parameters.py
new file mode 100644
index 0000000000..88eb79ac45
--- /dev/null
+++ b/test/backend/services/test_agent_model_parameters.py
@@ -0,0 +1,177 @@
+# Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
+"""AC-PARAM-LAYERS: explicit Agent overrides sit between outlet and session values."""
+
+from copy import deepcopy
+
+import pytest
+from consts.exceptions import ModelOutletValidationError
+from nexent.core.model_service.profiles.parameter_schema import ParameterValidationError
+from services.agent_model_parameters import merge_agent_model_parameters
+from services.conversation_model_preferences_service import merge_model_preferences
+from services.model_profile_service import build_outlet_draft
+from test.backend.services.test_model_profile_service import draft_request
+
+
+@pytest.fixture
+def profile():
+    value, _ = build_outlet_draft(draft_request(parameter_values={"enable_thinking": True,
+        "reasoning_budget_tokens": 64, "temperature": 0.8, "max_output_tokens": 2048}), "tenant")
+    return value
+
+
+def test_session_overrides_agent_then_outlet_and_clearing_restores_inheritance(profile):
+    original = deepcopy(profile.model_dump())
+    agent = merge_agent_model_parameters(profile, {"temperature": 0.4})
+    assert agent.parameter_values["temperature"] == 0.4
+    assert agent.parameter_values["reasoning_budget_tokens"] == 64
+    assert merge_model_preferences(agent, {"temperature": 0}).parameter_values["temperature"] == 0
+    assert merge_model_preferences(agent, {}).parameter_values["temperature"] == 0.4
+    assert merge_agent_model_parameters(profile, {}).parameter_values["temperature"] == 0.8
+    assert profile.model_dump() == original
+
+
+def test_agent_false_and_top_k_reach_the_profile_without_changing_outlet(profile):
+    data = profile.model_dump()
+    data["parameter_rules"].append({"key": "top_k", "schema": {"type": "integer", "minimum": 0},
+        "visible": True, "editable": True, "required": False, "allowed_scopes": ["outlet", "conversation"],
+        "ui_group": "sampling", "owner": "model", "source": {}, "api_binding": {"path": "/top_k", "transform_ref": "identity_v1", "transform_version": 1}})
+    profile = profile.__class__.model_validate(data)
+    agent = merge_agent_model_parameters(profile, {"extra_params": {"top_k": 0, "enable_thinking": False}})
+    assert agent.parameter_values["top_k"] == 0
+    assert agent.parameter_values["enable_thinking"] is False
+    assert "reasoning_budget_tokens" not in agent.parameter_values
+    assert profile.parameter_values["enable_thinking"] is True
+
+
+@pytest.mark.parametrize("entry", [{"temperature": "invalid"}, {"context_window_tokens": 0},
+    {"context_window_tokens": True}, {"extra_params": [1]}, {"context_window_tokens": 1}, {"extra_params": {"top_k": 5}}])
+def test_invalid_agent_configuration_is_rejected(profile, entry):
+    with pytest.raises(ParameterValidationError):
+        merge_agent_model_parameters(profile, entry)
+
+
+def test_session_reenables_thinking_with_the_inherited_outlet_budget(profile):
+    from services.agent_model_parameters import merge_runtime_model_parameters
+
+    result = merge_runtime_model_parameters(profile, {"extra_params": {"enable_thinking": False}},
+                                            {"enable_thinking": True})
+    assert result.parameter_values["enable_thinking"] is True
+    assert result.parameter_values["reasoning_budget_tokens"] == 64
+    with pytest.raises(ModelOutletValidationError) as error:
+        merge_runtime_model_parameters(profile, {}, {"context_window_tokens": 100})
+    assert error.value.category == "PARAMETER_UNKNOWN"
+
+
+def test_parent_and_child_keep_their_own_override_when_sharing_one_outlet(profile):
+    from types import SimpleNamespace
+    from services.agent_model_parameters import bind_agent_model_profiles
+
+    data = profile.model_dump()
+    data["outlet_id"] = 42
+    data["connection"]["credential_ref"]["model_id"] = 42
+    profile = profile.__class__.model_validate(data)
+    base = SimpleNamespace(cite_name="shared", resolved_profile=profile)
+    child = SimpleNamespace(agent_id=2, version_no=3, model_name="shared", worker_agents=[])
+    root = SimpleNamespace(agent_id=1, version_no=0, model_name="shared", worker_agents=[child])
+    configs = [base]
+    bind_agent_model_profiles(configs, root, {"model_params_override":{"42":{"temperature":0.4}}},
+        lambda agent_id,version: {"model_params_override":{"42":{"temperature":0.2}}})
+    by_name = {item.cite_name:item for item in configs}
+    assert root.model_name != child.model_name
+    assert by_name[root.model_name].resolved_profile.parameter_values["temperature"] == 0.4
+    assert by_name[child.model_name].resolved_profile.parameter_values["temperature"] == 0.2
+    assert base.resolved_profile.parameter_values["temperature"] == 0.8
+
+
+def test_old_outlet_session_sampling_uses_registered_rules_without_recomposing(profile, monkeypatch):
+    """UI-SESSION-15: only missing protocol declarations are added, never persisted."""
+    from services.agent_model_parameters import merge_runtime_model_parameters
+    from services import model_profile_service
+    data = profile.model_dump(mode="json")
+    data["parameter_rules"] = [rule for rule in data["parameter_rules"] if rule["key"] not in {"temperature", "top_p"}]
+    for key in ("temperature", "top_p"):
+        data["parameter_values"].pop(key, None)
+    old = profile.__class__.model_validate(data)
+    before = old.model_dump()
+    monkeypatch.setattr(model_profile_service, "get_model_profile_catalog", lambda: pytest.fail("must not recompose TOML"))
+    result = merge_runtime_model_parameters(old, {"temperature": 0.5}, {"temperature": 0.23, "top_p": 0.79})
+    assert result.parameter_values["temperature"] == 0.23
+    assert result.parameter_values["top_p"] == 0.79
+    assert result.capabilities == old.capabilities
+    assert old.model_dump() == before
+    with pytest.raises(ModelOutletValidationError):
+        merge_model_preferences(old, {"unregistered_sampling": 1})
+
+
+def test_old_protocol_v1_visibility_is_normalized_without_relaxing_model_rules(profile):
+    """UI-SESSION-15: preserve non-protocol visibility and fixed restrictions."""
+    from nexent.core.model_service.profiles.protocol_parameters import ensure_outlet_sampling_rules
+    from services.agent_model_parameters import merge_runtime_model_parameters
+    data = profile.model_dump(mode="json")
+    rule = next(item for item in data["parameter_rules"] if item["key"] == "temperature")
+    rule.update(source={"ref": "openai_chat_protocol_parameters_v1", "version": 1}, visible=False, allowed_scopes=["outlet"])
+    old = profile.__class__.model_validate(data)
+    result = merge_runtime_model_parameters(old, {}, {"temperature": 0.23})
+    normalized = next(item for item in result.parameter_rules if item["key"] == "temperature")
+    assert normalized["visible"] and "conversation" in normalized["allowed_scopes"]
+    assert result.parameter_values["temperature"] == 0.23
+    assert old.parameter_rules != result.parameter_rules
+    rule["source"] = {"ref": "custom_model", "version": 1}
+    custom = profile.__class__.model_validate(data)
+    assert ensure_outlet_sampling_rules(custom).parameter_rules == custom.parameter_rules
+    rule["source"] = {"ref": "openai_chat_protocol_parameters_v1", "version": 1}
+    rule["fixed_value"] = 0.8
+    fixed = profile.__class__.model_validate(data)
+    assert ensure_outlet_sampling_rules(fixed).parameter_rules == fixed.parameter_rules
+
+
+def test_current_agent_values_preserve_explicit_values_and_avoid_legacy_adapter(profile, monkeypatch):
+    from nexent.core.model_service.compatibility import invocation_options
+    def forbidden(*args, **kwargs):
+        raise AssertionError("Canonical Agent parameters entered legacy invocation adaptation")
+    monkeypatch.setattr(invocation_options.LegacyInvocationOptions, "resolve", forbidden)
+    result = merge_agent_model_parameters(profile, {"parameter_values": {"temperature": 0, "enable_thinking": False}})
+    assert result.parameter_values["temperature"] == 0
+    assert result.parameter_values["enable_thinking"] is False
+    assert "reasoning_budget_tokens" not in result.parameter_values
+    assert profile.parameter_values["reasoning_budget_tokens"] == 64
+
+
+def test_read_historical_entry_is_immutable_and_current_shape_is_unambiguous():
+    from nexent.core.model_service.compatibility.agent_parameters import read_agent_parameter_entry
+    old = {"temperature": 0, "top_p": None, "context_window_tokens": 4096,
+           "extra_params": {"enable_thinking": False, "__custom__": {"flag": None}}}
+    original = deepcopy(old)
+    current = read_agent_parameter_entry(old)
+    assert current == {"parameter_values": {"temperature": 0, "enable_thinking": False},
+                       "context_window_tokens": 4096, "custom_overrides": {"flag": None}}
+    assert read_agent_parameter_entry(current) == current
+    assert old == original
+    with pytest.raises(ParameterValidationError, match="PARAMETER_UPDATE_CONFLICT"):
+        read_agent_parameter_entry({"parameter_values": {}, "temperature": 0.3})
+
+
+@pytest.mark.parametrize("values", [{"not_declared": 1}, {"temperature": "bad"},
+    {"enable_thinking": False, "reasoning_budget_tokens": 32}])
+def test_current_agent_invalid_values_are_not_hidden_by_session_overrides(profile, values):
+    from services.agent_model_parameters import merge_runtime_model_parameters
+    with pytest.raises(ParameterValidationError):
+        merge_runtime_model_parameters(profile, {"parameter_values": values}, {"temperature": 0.1})
+
+
+def test_agent_read_projection_normalizes_only_profile_llm_without_writing_versions(monkeypatch):
+    from management.services.agent import read
+    records = {1: {"model_type": "llm", "profile_schema_version": 1, "display_name": "LLM"},
+               2: {"model_type": "vlm", "display_name": "Vision"}}
+    monkeypatch.setattr(read, "get_valid_model_ids", lambda ids, tenant: ids)
+    monkeypatch.setattr(read, "resolve_model_record", lambda model_id, *args: records[model_id])
+    monkeypatch.setattr(read, "is_model_available", lambda record: True)
+    old = {"model_ids": [1, 2], "model_params_override": {
+        "1": {"temperature": 0, "extra_params": {"enable_thinking": False}},
+        "2": {"temperature": 0.3, "extra_params": {"vision_option": True}}}}
+    before = deepcopy(old)
+    view = read.project_agent_models(old, "tenant", detail=True).fields
+    assert view["model_params_override"]["1"] == {"parameter_values": {"temperature": 0, "enable_thinking": False}}
+    assert view["model_params_override"]["2"] == before["model_params_override"]["2"]
+    assert old == before
diff --git a/test/backend/services/test_agent_reasoning_service.py b/test/backend/services/test_agent_reasoning_service.py
index 5b808aca6a..274c24d727 100644
--- a/test/backend/services/test_agent_reasoning_service.py
+++ b/test/backend/services/test_agent_reasoning_service.py
@@ -1,4 +1,5 @@
 # Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
 from unittest.mock import patch
 
 from management.services.agent.reasoning import (
@@ -229,3 +230,51 @@ def test_snapshot_agent_reasoning_config_uses_existing_map_when_request_is_omitt
             existing_overrides=None,
             tenant_id="tenant-1",
         ) == {"7": {"extra_params": {}}}
+
+
+def test_saved_llm_outlets_do_not_generate_new_agent_owned_reasoning_defaults():
+    from services.model_profile_service import build_outlet_draft
+    from nexent.core.model_service.profiles.outlet_storage import encode_resolved_model_profile
+    from nexent.core.model_service.registry import model_service_references
+    from test.backend.services.test_model_profile_service import draft_request
+
+    profile, _ = build_outlet_draft(draft_request(), "tenant")
+    data = profile.model_dump()
+    data["outlet_id"] = 1
+    data["connection"]["credential_ref"]["model_id"] = 1
+    row = encode_resolved_model_profile(profile.__class__.model_validate(data), registered_references=model_service_references())
+    with patch("management.services.agent.reasoning.get_model_by_model_id",
+               return_value=row), \
+         patch("management.services.agent.reasoning._resolve_model_reasoning_capability") as resolve:
+        assert snapshot_agent_reasoning_config([1], None, None, "tenant") is None
+        explicit = {"1": {"extra_params": {"enable_thinking": False}}}
+        assert snapshot_agent_reasoning_config([1], explicit, None, "tenant") == {"1": {"parameter_values": {"enable_thinking": False}}}
+        resolve.assert_not_called()
+
+
+def test_saving_profile_agent_converts_historical_entry_without_rewriting_input():
+    from copy import deepcopy
+    from nexent.core.model_service.profiles.outlet_storage import encode_resolved_model_profile
+    from nexent.core.model_service.registry import model_service_references
+    from services.model_profile_service import build_outlet_draft
+    from test.backend.services.test_model_profile_service import draft_request
+    profile, _ = build_outlet_draft(draft_request(), "tenant")
+    data = profile.model_dump()
+    data["outlet_id"] = 1
+    data["connection"]["credential_ref"]["model_id"] = 1
+    row = encode_resolved_model_profile(profile.__class__.model_validate(data), registered_references=model_service_references())
+    historical = {"1": {"temperature": 0, "extra_params": {"enable_thinking": False}}}
+    before = deepcopy(historical)
+    with patch("management.services.agent.reasoning.get_model_by_model_id", return_value=row):
+        saved = snapshot_agent_reasoning_config([1], historical, None, "tenant")
+    assert saved == {"1": {"parameter_values": {"temperature": 0, "enable_thinking": False}}}
+    assert historical == before
+
+
+
+def test_runtime_backfill_does_not_rewrite_published_profile_agent_versions():
+    historical = {"1": {"temperature": 0, "extra_params": {"enable_thinking": False}}}
+    row = {"profile_schema_version": 1, "model_type": "llm"}
+    with patch("management.services.agent.reasoning.get_model_by_model_id", return_value=row):
+        result = snapshot_agent_reasoning_config([1], historical, historical, "tenant", normalize_profiles=False)
+    assert result == historical
diff --git a/test/backend/services/test_agent_run_workbench_coverage.py b/test/backend/services/test_agent_run_workbench_coverage.py
index 884eae9bff..6735ede34c 100644
--- a/test/backend/services/test_agent_run_workbench_coverage.py
+++ b/test/backend/services/test_agent_run_workbench_coverage.py
@@ -10,6 +10,8 @@
 from test.backend.services import test_agent_service as legacy
 
 
+from test.backend.services.test_agent_service import isolate_conversation_model_preferences  # noqa: F401
+
 agent_run = legacy.agent_run_service
 agent_subscription = legacy.agent_subscription
 AgentRequest = legacy.AgentRequest
@@ -98,24 +100,21 @@ def test_apply_workbench_runtime_plan_attaches_all_runtime_overrides(monkeypatch
         "display_name": "Researcher",
         "origin": "USER",
     }
-    assert request.__dict__["_runtime_generation_config"] == {"temperature": 0.2}
+    assert "_runtime_generation_config" not in request.__dict__
 
 
 @pytest.mark.asyncio
-@pytest.mark.parametrize("stored_generation", [True, False])
+@pytest.mark.parametrize("preferences,is_debug", [({}, False), ({"12": {"temperature": 0}}, False), ({"12": {"temperature": 0}}, True)])
 async def test_prepare_agent_run_forwards_workbench_runtime_state(
-    monkeypatch, stored_generation
+    monkeypatch, preferences, is_debug
 ):
-    from consts.model import WorkbenchGenerationConfig
-
-    request = _request()
+    request = _request(is_debug=is_debug)
+    preference_reader = MagicMock(return_value={"model_parameter_preferences": preferences})
+    monkeypatch.setattr(agent_run, "_read_model_preferences", preference_reader)
     request.__dict__["_runtime_knowledge_context"] = {"policy": "strict"}
     request.__dict__["_runtime_knowledge_tools"] = [{"id": "knowledge"}]
     request.__dict__["_runtime_skill_snapshot"] = {"1": ["skill-a"]}
-    if stored_generation:
-        request.__dict__["_runtime_generation_config"] = {"temperature": 0.1}
-    else:
-        request.generation_config = WorkbenchGenerationConfig(temperature=0.1)
+    request.model_parameter_preferences = preferences
     child = SimpleNamespace(
         agent_id=2,
         version_no=4,
@@ -158,10 +157,19 @@ async def test_prepare_agent_run_forwards_workbench_runtime_state(
     )
 
     kwargs = create_run.await_args.kwargs
+    if not is_debug:
+        preference_reader.assert_called_once_with(123, "user-a")
+    else:
+        preference_reader.assert_not_called()
+    if preferences:
+        assert kwargs["model_parameter_preferences"] == preferences
+    else:
+        assert "model_parameter_preferences" not in kwargs
     assert kwargs["runtime_knowledge_context"] == {"policy": "strict"}
     assert kwargs["runtime_knowledge_tools"] == [{"id": "knowledge"}]
     assert kwargs["runtime_skill_snapshot"] == {"1": ["skill-a"]}
-    assert kwargs["runtime_generation_config"]["temperature"] == 0.1
+    assert "runtime_generation_config" not in kwargs
+    assert "reasoning_effort" not in kwargs
     assert kwargs["runtime_sub_agent_mounts"] == [
         {
             "agent_id": 2,
diff --git a/test/backend/services/test_agent_service.py b/test/backend/services/test_agent_service.py
index cd61e0d273..adb64e2e5a 100644
--- a/test/backend/services/test_agent_service.py
+++ b/test/backend/services/test_agent_service.py
@@ -5414,6 +5414,15 @@ async def test_import_agent_impl_force_import_passes_skip_flag(
     pytest.main()
 
 
+@pytest.fixture(autouse=True)
+def isolate_conversation_model_preferences(monkeypatch):
+    """Keep run orchestration UT independent of the conversation database."""
+    from services import conversation_model_preferences_service
+    reader = MagicMock(return_value={"model_parameter_preferences": {}, "version": 0, "selected_model_id": None})
+    monkeypatch.setattr(agent_run_service, "_read_model_preferences", reader)
+    monkeypatch.setattr(conversation_model_preferences_service, "read_model_preferences", reader)
+
+
 # Agent run tests
 @pytest.fixture
 def mock_agent_request():
@@ -5482,8 +5491,6 @@ async def test_prepare_agent_run(
         is_debug=False,
         override_version_no=None,
         override_model_id=None,
-        reasoning_effort=None,
-        reasoning_budget_tokens=None,
         requested_output_tokens=4096,
         tool_params=None,
         conversation_id=123,
diff --git a/test/backend/services/test_conversation_model_preferences_service.py b/test/backend/services/test_conversation_model_preferences_service.py
new file mode 100644
index 0000000000..eb2f55f24d
--- /dev/null
+++ b/test/backend/services/test_conversation_model_preferences_service.py
@@ -0,0 +1,179 @@
+# Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
+"""Conversation choices preserve explicit values, defaults, revisions and resource boundaries."""
+
+from copy import deepcopy
+from types import ModuleType
+from unittest.mock import Mock
+
+import pytest
+from consts.exceptions import ModelOutletValidationError
+from consts.model import ConversationModelPreferencePatch
+from services import conversation_model_preferences_service as service
+from services.model_profile_service import build_outlet_draft
+
+from test.backend.services.test_model_profile_service import draft_request
+
+
+@pytest.fixture
+def profile():
+    value, _ = build_outlet_draft(draft_request(parameter_values={"enable_thinking": True,
+        "reasoning_budget_tokens": 64}), "tenant")
+    return value
+
+
+def test_zero_false_and_explicit_null_are_not_defaulted(profile):
+    original = deepcopy(profile.model_dump())
+    merged = service.merge_model_preferences(profile, {"temperature": 0})
+    assert merged.parameter_values["temperature"] == 0
+    assert merged.parameter_values["reasoning_budget_tokens"] == 64
+    assert profile.model_dump() == original
+    assert service.merge_model_preferences(profile, {"temperature": None}).parameter_values["temperature"] is None
+
+
+def test_thinking_off_excludes_inherited_budget_but_rejects_explicit_conflict(profile):
+    disabled = service.merge_model_preferences(profile, {"enable_thinking": False})
+    assert disabled.parameter_values["enable_thinking"] is False
+    assert "reasoning_budget_tokens" not in disabled.parameter_values
+    original = deepcopy(profile.model_dump())
+    with pytest.raises(ModelOutletValidationError) as error:
+        service.merge_model_preferences(profile, {"enable_thinking": False, "reasoning_budget_tokens": 64})
+    assert error.value.category == "PARAMETER_DEPENDENCY"
+    assert profile.model_dump() == original
+
+
+def test_missing_saved_value_is_not_replaced_with_a_creation_default(profile):
+    data = profile.model_dump()
+    for rule in data["parameter_rules"]:
+        if rule["key"] == "temperature":
+            rule["default_value"] = 0.9
+    data["parameter_values"].pop("temperature", None)
+    changed = profile.__class__.model_validate(data)
+    assert "temperature" not in service.merge_model_preferences(changed, {}).parameter_values
+
+
+@pytest.fixture
+def persistence(monkeypatch, profile):
+    import sys
+
+    store = ModuleType("database.conversation_model_preferences_db")
+    store.model_preferences = Mock(return_value={"version": 4,
+        "model_parameter_preferences": {"42": {"temperature": 0.2}, "43": {"max_output_tokens": 10}}})
+    outlet = ModuleType("database.model_outlet_db")
+    outlet.get_resolved_model_record = Mock(return_value=profile)
+    monkeypatch.setitem(sys.modules, "database.conversation_model_preferences_db", store)
+    monkeypatch.setitem(sys.modules, "database.model_outlet_db", outlet)
+    return store.model_preferences, outlet.get_resolved_model_record
+
+
+def test_patch_updates_only_explicit_values_and_preserves_other_outlet_preferences(persistence):
+    store, _ = persistence
+    request = ConversationModelPreferencePatch(expected_version=4, parameter_values={"temperature": 0})
+    service.patch_model_preferences(1, 42, request, "owner", "tenant")
+    args = store.call_args
+    assert args.args == (1, "owner") and args.kwargs["expected_version"] == 4
+    assert args.kwargs["outlet_id"] == 42
+    assert args.kwargs["resolve_values"]({"max_output_tokens": 100}) == {"temperature": 0, "max_output_tokens": 100}
+
+
+def test_explicit_delete_removes_an_invalid_old_key_without_modifying_outlet(persistence):
+    store, _ = persistence
+    service.patch_model_preferences(1, 42, ConversationModelPreferencePatch(expected_version=4,
+        delete_parameters=["retired"]), "owner", "tenant")
+    assert store.call_args.kwargs["resolve_values"]({"retired": True}) == {}
+
+
+@pytest.mark.parametrize("body", [{"parameter_values": {"temperature": 0}, "delete_parameters": ["temperature"]},
+                                  {"delete_parameters": ["temperature", "temperature"]}])
+def test_ambiguous_patch_is_rejected_before_update(persistence, body):
+    store, _ = persistence
+    with pytest.raises(ModelOutletValidationError):
+        service.patch_model_preferences(1, 42, ConversationModelPreferencePatch(expected_version=4, **body), "owner", "tenant")
+    assert store.call_count == 1
+
+
+def test_other_tenant_or_missing_outlet_cannot_receive_preferences(persistence):
+    store, outlet = persistence
+    outlet.return_value = None
+    with pytest.raises(ModelOutletValidationError):
+        service.patch_model_preferences(1, 42, ConversationModelPreferencePatch(expected_version=4), "owner", "other-tenant")
+    assert outlet.call_args.args == (42, "other-tenant") and store.call_count == 1
+
+
+def test_read_returns_invalid_values_and_diagnostic_for_explicit_repair(persistence):
+    store, _ = persistence
+    store.return_value = {"version": 4, "model_parameter_preferences": {"42": {"retired": False}}}
+    result = service.read_model_preference_view(1, 42, "owner", "tenant")
+    assert result["parameter_values"] == {"retired": False}
+    assert result["issues"] == [{"category": "PARAMETER_UNKNOWN", "field": "/retired"}]
+
+
+@pytest.mark.parametrize("limit_field", ["output_limit", "combined_window"])
+def test_output_preferences_respect_saved_capacity_limits_without_changing_defaults(profile, limit_field):
+    data = profile.model_dump()
+    data["capabilities"]["context"].update(combined_window=200000, input_limit=None, output_limit=None)
+    data["capabilities"]["context"][limit_field] = 1024
+    limited = profile.__class__.model_validate(data)
+    assert service.merge_model_preferences(limited, {"max_output_tokens": 1024}).parameter_values["max_output_tokens"] == 1024
+    with pytest.raises(ModelOutletValidationError) as error:
+        service.merge_model_preferences(limited, {"max_output_tokens": 1025})
+    assert error.value.category == "PARAMETER_LIMIT_EXCEEDED"
+    assert limited.parameter_values == profile.parameter_values
+
+
+def test_changed_capacity_reports_invalid_saved_preference_without_deleting_it(persistence, profile):
+    store, outlet = persistence
+    data = profile.model_dump()
+    data["capabilities"]["context"]["output_limit"] = 1024
+    outlet.return_value = profile.__class__.model_validate(data)
+    store.return_value = {"version": 4, "model_parameter_preferences": {"42": {"max_output_tokens": 1025}}}
+    result = service.read_model_preference_view(1, 42, "owner", "tenant")
+    assert result["parameter_values"] == {"max_output_tokens": 1025}
+    assert result["issues"] == [{"category": "PARAMETER_LIMIT_EXCEEDED", "field": "/max_output_tokens"}]
+
+
+@pytest.mark.parametrize("locked", ["editable", "allowed_scopes"])
+def test_conversation_cannot_store_locked_value_even_when_identical_to_outlet(profile, locked):
+    data = profile.model_dump()
+    for rule in data["parameter_rules"]:
+        if rule["key"] == "enable_thinking":
+            rule[locked] = False if locked == "editable" else ["outlet"]
+    original = profile.__class__.model_validate(data)
+    with pytest.raises(ModelOutletValidationError) as error:
+        service.merge_model_preferences(original, {"enable_thinking": True})
+    assert error.value.category == "PARAMETER_NOT_EDITABLE"
+
+
+@pytest.mark.parametrize("values", [{"temperature": 0, "top_p": 1}, {"enable_thinking": False}])
+def test_su_ac_02_first_turn_uses_same_profile_validation(persistence, profile, monkeypatch, values):
+    from management.services.model import run_controls
+    monkeypatch.setattr(run_controls, "validate_selected_model", Mock())
+    service.validate_model_preferences({"42": values}, "tenant", allowed_model_ids=[42])
+    assert profile.parameter_values["enable_thinking"] is True
+
+
+@pytest.mark.parametrize("key", ["0", "-1", "1.5", "042", "true"])
+def test_su_ac_05_invalid_outlet_identity_rejected_before_lookup(persistence, monkeypatch, key):
+    from management.services.model import run_controls
+    lookup = Mock()
+    monkeypatch.setattr(run_controls, "validate_selected_model", lookup)
+    with pytest.raises(ModelOutletValidationError):
+        service.validate_model_preferences({key: {"temperature": 0}}, "tenant")
+    lookup.assert_not_called()
+
+
+def test_su_ac_05_draft_cannot_bypass_agent_scope(persistence, monkeypatch):
+    from consts.exceptions import ForbiddenError
+    from management.services.model import run_controls
+    lookup = Mock()
+    monkeypatch.setattr(run_controls, "validate_selected_model", lookup)
+    with pytest.raises(ForbiddenError):
+        service.validate_model_preferences({"42": {"temperature": 0}}, "tenant", allowed_model_ids=[43])
+    lookup.assert_not_called()
+
+
+def test_su_ac_05_draft_rejects_dependency_conflicts(persistence, monkeypatch):
+    from management.services.model import run_controls
+    monkeypatch.setattr(run_controls, "validate_selected_model", Mock())
+    with pytest.raises(ModelOutletValidationError):
+        service.validate_model_preferences({"42": {"enable_thinking": False, "reasoning_budget_tokens": 64}}, "tenant")
diff --git a/test/backend/services/test_model_configuration_writers.py b/test/backend/services/test_model_configuration_writers.py
new file mode 100644
index 0000000000..129a600144
--- /dev/null
+++ b/test/backend/services/test_model_configuration_writers.py
@@ -0,0 +1,57 @@
+# Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
+"""All existing LLM writes reach resolved storage; other model types stay unchanged."""
+
+import sys
+from types import ModuleType
+from unittest.mock import Mock
+
+import pytest
+
+from test.backend.services.test_model_management_service import import_svc
+
+
+@pytest.fixture
+def writers(monkeypatch):
+    service = import_svc(isolate_storage=False)
+    legacy = ModuleType("services.model_outlet_legacy_service")
+    legacy.create_legacy_llm_outlet = Mock(return_value=42)
+    legacy.update_legacy_llm_outlet = Mock(return_value=2)
+    monkeypatch.setitem(sys.modules, legacy.__name__, legacy)
+    monkeypatch.setattr(service, "create_model_record", Mock(return_value=43))
+    monkeypatch.setattr(service, "update_model_record", Mock(return_value=True))
+    return service, legacy
+
+
+@pytest.mark.parametrize("kind", ["llm", "chat"])
+def test_llm_writers_use_one_resolved_storage_path(writers, kind):
+    service, legacy = writers
+    row = {"model_id": 42, "model_type": kind}
+    assert service._create_model_configuration(row, "user", "tenant") == 42
+    legacy.create_legacy_llm_outlet.assert_called_once_with(row, "user", "tenant")
+    assert service._update_model_configuration(row, {"temperature": 0}, "user", "tenant") == 2
+    legacy.update_legacy_llm_outlet.assert_called_once_with(row, {"temperature": 0}, "user", "tenant")
+    service.create_model_record.assert_not_called()
+    service.update_model_record.assert_not_called()
+
+
+@pytest.mark.parametrize("kind", ["vlm", "embedding", "rerank", "stt", "tts"])
+@pytest.mark.parametrize("scoped", [False, True])
+def test_non_llm_writers_keep_existing_storage_contract(writers, kind, scoped):
+    service, legacy = writers
+    row = {"model_id": 43, "model_type": kind}
+    assert service._create_model_configuration(row, "user", "tenant") == 43
+    service.create_model_record.assert_called_once_with(row, "user", "tenant")
+    assert service._update_model_configuration(row, {"display_name": "same"}, "user", "tenant", scope_update=scoped)
+    args = (43, {"display_name": "same"}, "user") + (("tenant",) if scoped else ())
+    service.update_model_record.assert_called_once_with(*args)
+    legacy.create_legacy_llm_outlet.assert_not_called()
+    legacy.update_legacy_llm_outlet.assert_not_called()
+
+
+def test_missing_record_does_not_write(writers):
+    service, legacy = writers
+    with pytest.raises(LookupError, match="MODEL_OUTLET_NOT_FOUND"):
+        service._update_model_configuration(None, {}, "user", "tenant")
+    service.update_model_record.assert_not_called()
+    legacy.update_legacy_llm_outlet.assert_not_called()
diff --git a/test/backend/services/test_model_health_outlet_routing.py b/test/backend/services/test_model_health_outlet_routing.py
new file mode 100644
index 0000000000..01fe7622ca
--- /dev/null
+++ b/test/backend/services/test_model_health_outlet_routing.py
@@ -0,0 +1,74 @@
+# Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
+"""Existing LLM checks use frozen outlets; VLM retains its existing check boundary."""
+
+import sys
+from types import ModuleType
+from unittest.mock import AsyncMock, Mock
+
+import pytest
+from consts.model import ModelOutletValidationRequest
+
+from test.backend.services import test_model_health_service as legacy_tests
+
+
+@pytest.fixture
+def health(monkeypatch):
+    module = sys.modules[legacy_tests.check_model_connectivity.__module__]
+
+    profiles = ModuleType("services.model_profile_service")
+    profiles.validate_model_outlet = AsyncMock(return_value={"ok": True, "error": None})
+    monkeypatch.setitem(sys.modules, profiles.__name__, profiles)
+    return module, profiles
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("model_type", ["llm", "chat"])
+async def test_llm_checks_use_saved_id_revision_and_tenant(health, monkeypatch, model_type):
+    module, profiles = health
+    monkeypatch.setattr(module, "get_model_by_display_name", Mock(return_value={
+        "model_type": model_type, "model_id": 42, "config_revision": 7, "model_name": "Exact/Model",
+    }))
+    old = AsyncMock()
+    monkeypatch.setattr(module, "_check_non_llm_connectivity", old)
+    result = await module.check_model_connectivity("chosen", "tenant", model_type)
+    request, tenant = profiles.validate_model_outlet.await_args.args
+    assert isinstance(request, ModelOutletValidationRequest)
+    assert request.outlet_id == 42 and request.expected_revision == 7 and tenant == "tenant"
+    assert result == {"connectivity": True, "model_name": "Exact/Model"}
+    old.assert_not_awaited()
+
+
+@pytest.mark.asyncio
+async def test_failed_llm_check_keeps_existing_envelope_with_safe_category(health, monkeypatch):
+    module, profiles = health
+    monkeypatch.setattr(module, "get_model_by_display_name", Mock(return_value={
+        "model_type": "llm", "model_id": 42, "config_revision": 1, "model_name": "exact",
+    }))
+    profiles.validate_model_outlet.return_value = {"ok": False, "error": {"category": "model_authentication_error"}}
+    assert await module.check_model_connectivity("chosen", "tenant") == {
+        "connectivity": False, "model_name": "exact", "error": "model_authentication_error",
+    }
+
+
+@pytest.mark.asyncio
+async def test_vlm_check_reuses_original_row_without_llm_profile_validation(health, monkeypatch):
+    module, profiles = health
+    row = {"model_type": "vlm", "model_id": 43}
+    lookup = Mock(return_value=row)
+    monkeypatch.setattr(module, "get_model_by_display_name", lookup)
+    old = AsyncMock(return_value={"connectivity": True, "model_name": "vision"})
+    monkeypatch.setattr(module, "_check_non_llm_connectivity", old)
+    assert await module.check_model_connectivity("vision", "tenant", "vlm") == old.return_value
+    old.assert_awaited_once_with("vision", "tenant", "vlm", _model=row)
+    assert lookup.call_count == 1
+    profiles.validate_model_outlet.assert_not_awaited()
+
+
+@pytest.mark.asyncio
+async def test_missing_outlet_does_not_probe_any_endpoint(health, monkeypatch):
+    module, profiles = health
+    monkeypatch.setattr(module, "get_model_by_display_name", Mock(return_value=None))
+    with pytest.raises(LookupError, match="MODEL_CONFIGURATION_NOT_FOUND"):
+        await module.check_model_connectivity("missing", "tenant")
+    profiles.validate_model_outlet.assert_not_awaited()
diff --git a/test/backend/services/test_model_health_service.py b/test/backend/services/test_model_health_service.py
index 8ae26583bc..1e840be9e6 100644
--- a/test/backend/services/test_model_health_service.py
+++ b/test/backend/services/test_model_health_service.py
@@ -1,4 +1,5 @@
 # Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
 import os
 import sys
 import types
@@ -623,7 +624,7 @@ async def test_check_model_connectivity_success():
             "model_id": "model123",
             "model_repo": "openai",
             "model_name": "gpt-4",
-            "model_type": "llm",
+            "model_type": "vlm",
             "base_url": "https://api.openai.com",
             "api_key": "test-key"
         }
@@ -642,7 +643,7 @@ async def test_check_model_connectivity_success():
         mock_update_model.assert_any_call(
             "model123", {"connect_status": "available"})
         mock_connectivity_check.assert_called_once_with(
-            "openai/gpt-4", "llm", "https://api.openai.com", "test-key", True,
+            "openai/gpt-4", "vlm", "https://api.openai.com", "test-key", True,
             None, None, None, "GPT-4", None,
         )
 
@@ -674,7 +675,7 @@ async def test_check_model_connectivity_failure():
         mock_get_model.return_value = {
             "model_id": "model123",
             "model_name": "gpt-4",
-            "model_type": "llm",
+            "model_type": "vlm",
             "base_url": "https://api.openai.com",
             "api_key": "test-key",
             "ssl_verify": False,  # Explicitly set to False to avoid fallback
@@ -707,7 +708,7 @@ async def test_check_model_connectivity_exception():
         mock_get_model.return_value = {
             "model_id": "model123",
             "model_name": "gpt-4",
-            "model_type": "llm",
+            "model_type": "vlm",
             "base_url": "https://api.openai.com",
             "api_key": "test-key"
         }
@@ -737,7 +738,7 @@ async def test_check_model_connectivity_probe_exception_returns_unavailable():
         mock_get_model.return_value = {
             "model_id": "model123",
             "model_name": "gpt-4",
-            "model_type": "llm",
+            "model_type": "vlm",
             "base_url": "https://api.openai.com",
             "api_key": "test-key"
         }
@@ -782,7 +783,7 @@ async def test_verify_model_config_connectivity_success():
 
         model_config = {
             "model_name": "gpt-4",
-            "model_type": "llm",
+            "model_type": "vlm",
             "base_url": "https://api.openai.com",
             "api_key": "test-key",
             "max_tokens": 2048
@@ -798,7 +799,7 @@ async def test_verify_model_config_connectivity_success():
         assert "error" not in response
 
         mock_connectivity_check.assert_called_once_with(
-            "gpt-4", "llm", "https://api.openai.com", "test-key", True,
+            "gpt-4", "vlm", "https://api.openai.com", "test-key", True,
             "openai", None, None, None, None,
             temperature=None, top_p=None, extra_params=None,
         )
@@ -813,7 +814,7 @@ async def test_verify_model_config_connectivity_failure():
 
         model_config = {
             "model_name": "gpt-4",
-            "model_type": "llm",
+            "model_type": "vlm",
             "base_url": "https://api.openai.com",
             "api_key": "test-key"
         }
@@ -864,7 +865,7 @@ async def test_verify_model_config_connectivity_exception():
 
         model_config = {
             "model_name": "gpt-4",
-            "model_type": "llm",
+            "model_type": "vlm",
             "base_url": "https://api.openai.com",
             "api_key": "test-key"
         }
@@ -1202,7 +1203,7 @@ async def test_check_model_connectivity_sets_monitoring_context():
             mock.patch("management.services.model.health.set_monitoring_context") as mock_set_ctx:
         mock_get_model.return_value = {
             "model_id": 1, "model_repo": "openai", "model_name": "gpt-4",
-            "model_type": "llm", "base_url": "https://api.openai.com",
+            "model_type": "vlm", "base_url": "https://api.openai.com",
             "api_key": "test-key", "ssl_verify": True,
         }
 
@@ -1377,7 +1378,7 @@ async def test_check_model_connectivity_ssl_verify_fallback():
             "model_id": "model123",
             "model_repo": "openai",
             "model_name": "gpt-4",
-            "model_type": "llm",
+            "model_type": "vlm",
             "base_url": "https://api.openai.com",
             "api_key": "test-key",
             "ssl_verify": True,
@@ -1391,12 +1392,12 @@ async def test_check_model_connectivity_ssl_verify_fallback():
         assert mock_connectivity.call_count == 2
         # First call with ssl_verify=True
         mock_connectivity.assert_any_call(
-            "openai/gpt-4", "llm", "https://api.openai.com", "test-key", True,
+            "openai/gpt-4", "vlm", "https://api.openai.com", "test-key", True,
             None, None, None, "GPT-4", None,
         )
         # Second call with ssl_verify=False (fallback)
         mock_connectivity.assert_any_call(
-            "openai/gpt-4", "llm", "https://api.openai.com", "test-key", False,
+            "openai/gpt-4", "vlm", "https://api.openai.com", "test-key", False,
             None, None, None, "GPT-4", None,
         )
         # Verify ssl_verify=False was saved to the record
@@ -1431,7 +1432,7 @@ async def test_verify_model_config_connectivity_ssl_verify_fallback():
 
         model_config = {
             "model_name": "gpt-4",
-            "model_type": "llm",
+            "model_type": "vlm",
             "base_url": "https://api.openai.com",
             "api_key": "test-key",
             "ssl_verify": True,
@@ -1442,12 +1443,12 @@ async def test_verify_model_config_connectivity_ssl_verify_fallback():
         assert result["connectivity"] is True
         assert mock_connectivity.call_count == 2
         mock_connectivity.assert_any_call(
-            "gpt-4", "llm", "https://api.openai.com", "test-key", True,
+            "gpt-4", "vlm", "https://api.openai.com", "test-key", True,
             "openai", None, None, None, None,
             temperature=None, top_p=None, extra_params=None,
         )
         mock_connectivity.assert_any_call(
-            "gpt-4", "llm", "https://api.openai.com", "test-key", False,
+            "gpt-4", "vlm", "https://api.openai.com", "test-key", False,
             "openai", None, None, None, None,
             temperature=None, top_p=None, extra_params=None,
         )
diff --git a/test/backend/services/test_model_management_service.py b/test/backend/services/test_model_management_service.py
index 8af49c4572..6035473f58 100644
--- a/test/backend/services/test_model_management_service.py
+++ b/test/backend/services/test_model_management_service.py
@@ -498,7 +498,7 @@ def isolate_embedding_probe():
         yield
 
 
-def import_svc(module="management"):
+def import_svc(module="management", *, isolate_storage=True):
     """Import service under MinioClient patch to avoid real initialization."""
     minio_client_mock = mock.MagicMock()
     sys.modules["database"] = database_mod
@@ -516,6 +516,16 @@ def import_svc(module="management"):
     sys.modules["nexent.core.models.sampling"] = sampling_module
     with mock.patch("backend.database.client.MinioClient", return_value=minio_client_mock):
         svc = importlib.import_module("management.services.model." + module)
+    if not isolate_storage:
+        return svc
+    # These tests own legacy preprocessing/orchestration. The resolved storage
+    # translator has its own unit and database suites and is a collaborator here.
+    svc._create_model_configuration = lambda data, user, tenant: svc.create_model_record(data, user, tenant)
+    def update_configuration(record, changes, user, tenant, *, scope_update=False):
+        if scope_update:
+            return svc.update_model_record(record["model_id"], changes, user, tenant)
+        return svc.update_model_record(record["model_id"], changes, user)
+    svc._update_model_configuration = update_configuration
     return svc
 
 
@@ -3160,3 +3170,21 @@ def test_backfill_swap_pool_never_resurrects_old_models():
     # does not beat the fresh occupant (256K): nothing changes.
     assert result == []
     assert updated == []
+
+
+def test_saved_outlet_enrichment_uses_projection_without_legacy_normalization(monkeypatch):
+    svc = import_svc("reasoning")
+    projection_module = types.ModuleType("services.model_outlet_projection")
+    projection_module.project_saved_outlet = mock.Mock(return_value={
+        "extra_params": {"enable_thinking": False}, "migration_status": "migrated",
+        "migration_review_required": True})
+    monkeypatch.setitem(sys.modules, "services.model_outlet_projection", projection_module)
+    model = {"model_type": "llm", "profile_schema_version": 1,
+             "extra_params": {"parameter_values": {}, "api_parameters": []}}
+    with mock.patch.object(svc, "resolve_reasoning_capability") as old_lookup, \
+            mock.patch.object(svc, "normalize_reasoning_params") as old_normalize:
+        svc._enrich_model_reasoning_capability(model)
+    old_lookup.assert_not_called()
+    old_normalize.assert_not_called()
+    assert model["extra_params"] == {"enable_thinking": False}
+    assert model["migration_review_required"] is True
diff --git a/test/backend/services/test_model_migration_cli.py b/test/backend/services/test_model_migration_cli.py
new file mode 100644
index 0000000000..f78e888b9b
--- /dev/null
+++ b/test/backend/services/test_model_migration_cli.py
@@ -0,0 +1,26 @@
+# Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
+"""The administrative migration CLI defaults to preview and reports failures."""
+
+import importlib.util
+import json
+from pathlib import Path
+from types import ModuleType
+from unittest.mock import Mock
+
+import pytest
+
+
+@pytest.mark.parametrize('arguments,dry_run,failed', [([], True, 0), (['--apply', '--batch-size', '3'], False, 1)])
+def test_cli_requires_explicit_apply_and_propagates_failure_status(monkeypatch, capsys, arguments, dry_run, failed):
+    service = ModuleType('services.model_outlet_migration_service')
+    service.migrate_legacy_outlets = Mock(return_value={'migrated': 2, 'failed': failed})
+    monkeypatch.setitem(__import__('sys').modules, service.__name__, service)
+    monkeypatch.setattr('sys.argv', ['migrate_model_outlets', *arguments])
+    path = Path(__file__).resolve().parents[3] / 'backend/scripts/migrate_model_outlets.py'
+    spec = importlib.util.spec_from_file_location('_migration_cli_test', path)
+    cli = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(cli)
+    assert cli.main() == int(bool(failed))
+    service.migrate_legacy_outlets.assert_called_once_with(dry_run=dry_run, batch_size=3 if arguments else 100)
+    assert json.loads(capsys.readouterr().out) == {'migrated': 2, 'failed': failed}
diff --git a/test/backend/services/test_model_outlet_legacy_service.py b/test/backend/services/test_model_outlet_legacy_service.py
new file mode 100644
index 0000000000..2433aa6e1d
--- /dev/null
+++ b/test/backend/services/test_model_outlet_legacy_service.py
@@ -0,0 +1,127 @@
+# Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
+"""Old LLM payloads use frozen outlet storage; no alternate request/configuration format."""
+
+from types import ModuleType
+from unittest.mock import Mock
+
+import pytest
+from consts.exceptions import ModelOutletValidationError
+from nexent.core.model_service.profiles.outlet_storage import encode_resolved_model_profile
+from nexent.core.model_service.registry import model_service_references
+from services import model_outlet_legacy_service as service
+from services.model_outlet_migration_service import build_legacy_outlet_snapshot
+
+
+def legacy_row(**changes):
+    return {"model_id": 42, "tenant_id": "tenant", "model_type": "llm", "model_name": "custom-model",
+        "model_factory": "custom", "base_url": "https://custom.invalid/v1", "display_name": "chosen",
+        "temperature": 0, "extra_params": {"enable_thinking": False}, "max_output_tokens": 8192, **changes}
+
+
+@pytest.fixture
+def saved_row():
+    profile = build_legacy_outlet_snapshot(legacy_row(), legacy_capability=None, migrated_at="controlled-time")
+    return encode_resolved_model_profile(profile, registered_references=model_service_references())
+
+
+def test_create_saves_complete_outlet_without_migration_badge(monkeypatch):
+    database = ModuleType("database.model_outlet_db")
+    database.create_resolved_model_record = Mock(return_value=43)
+    catalog = ModuleType("configs.model_catalog_loader")
+    catalog.resolve_reasoning_capability = Mock(return_value=None)
+    monkeypatch.setitem(__import__("sys").modules, "database.model_outlet_db", database)
+    monkeypatch.setitem(__import__("sys").modules, "configs.model_catalog_loader", catalog)
+    assert service.create_legacy_llm_outlet(legacy_row(api_key="controlled-key"), "user", "tenant") == 43
+    profile = database.create_resolved_model_record.call_args.args[0]
+    assert profile.outlet_id is None and profile.connection.credential_ref.model_id is None
+    assert profile.identity.tenant_id == "tenant"
+    assert profile.parameter_values["temperature"] == 0
+    assert profile.parameter_values["enable_thinking"] is False
+    assert "migration" not in profile.provenance.provider_metadata
+    assert "controlled-key" not in repr(profile.model_dump())
+
+
+def test_old_partial_update_uses_saved_rules_and_preserves_key_omission(monkeypatch, saved_row):
+    import services.model_profile_service as profiles
+
+    update = Mock(return_value={"config_revision": 2})
+    monkeypatch.setattr(profiles, "update_model_outlet", update)
+    monkeypatch.setattr(profiles, "get_model_profile_catalog", lambda: pytest.fail("Must not recompose saved outlet"))
+    service.update_legacy_llm_outlet(saved_row, {"temperature": 0, "extra_params": {"enable_thinking": False}}, "user", "tenant")
+    patch = update.call_args.args[1]
+    assert patch.expected_revision == 1
+    assert patch.parameter_values == {"temperature": 0, "enable_thinking": False}
+    assert "api_key" not in patch.model_fields_set and "connection" not in patch.model_fields_set
+
+
+def test_old_output_cap_update_keeps_distinct_request_default_and_context(monkeypatch, saved_row):
+    import services.model_profile_service as profiles
+
+    update = Mock()
+    monkeypatch.setattr(profiles, "update_model_outlet", update)
+    service.update_legacy_llm_outlet(saved_row, {"max_output_tokens": 65536, "config_revision": 3}, "user", "tenant")
+    patch = update.call_args.args[1]
+    assert patch.context_limits.output_limit == 65536
+    assert patch.parameter_values["max_output_tokens"] == 65536
+    assert patch.expected_revision == 3
+
+
+@pytest.mark.parametrize("change", [{"model_name": "another"}, {"model_factory": "another"}])
+def test_old_identity_replacement_is_rejected(saved_row, change):
+    with pytest.raises(ModelOutletValidationError) as error:
+        service.update_legacy_llm_outlet(saved_row, change, "user", "tenant")
+    assert error.value.category == "OUTLET_IDENTITY_IMMUTABLE"
+
+
+def test_explicit_extra_false_zero_and_credential_clear_are_preserved(monkeypatch, saved_row):
+    import services.model_profile_service as profiles
+
+    update = Mock()
+    monkeypatch.setattr(profiles, "update_model_outlet", update)
+    service.update_legacy_llm_outlet(saved_row, {"api_key": None,
+        "extra_params": {"__custom__": {"options": {"flag": False, "count": 0}}}}, "user", "tenant")
+    patch = update.call_args.args[1]
+    assert patch.api_key is None and "api_key" in patch.model_fields_set
+    assert patch.extra_api_parameters == [{"path": "/options/flag", "value": False}, {"path": "/options/count", "value": 0}]
+
+
+def test_repair_keeps_record_identity_and_filters_foreign_tenant_fields(monkeypatch):
+    import sys
+    from copy import deepcopy
+
+    database = ModuleType('database.model_outlet_db')
+    captured = {}
+
+    def repair(model_id, tenant_id, user_id, revision, construct, **kwargs):
+        captured.update(model_id=model_id, tenant_id=tenant_id, user_id=user_id, revision=revision)
+        return construct(deepcopy(original))
+
+    database.repair_legacy_model_record = Mock(side_effect=repair)
+    catalog = ModuleType('configs.model_catalog_loader')
+    catalog.resolve_reasoning_capability = Mock(return_value=None)
+    monkeypatch.setitem(sys.modules, database.__name__, database)
+    monkeypatch.setitem(sys.modules, catalog.__name__, catalog)
+    original = legacy_row(base_url='invalid', config_revision=3)
+    before = deepcopy(original)
+    profile, credential = service.update_legacy_llm_outlet(original, {
+        'model_name': 'replacement', 'model_repo': 'private', 'base_url': 'https://fixed.invalid/v1',
+        'api_key': 'controlled-key', 'tenant_id': 'foreign', 'model_id': 99,
+    }, 'user', 'tenant')
+    assert captured == {'model_id': 42, 'tenant_id': 'tenant', 'user_id': 'user', 'revision': 3}
+    assert profile.outlet_id == 42 and profile.identity.tenant_id == 'tenant'
+    assert profile.identity.request_model_id == 'private/replacement'
+    assert profile.connection.base_url == 'https://fixed.invalid/v1'
+    assert credential == 'controlled-key' and original == before
+    catalog.resolve_reasoning_capability.assert_called_once_with('private/replacement', 'https://fixed.invalid/v1', 'custom')
+
+
+@pytest.mark.parametrize('value', ['invalid', {'__custom__': []}])
+def test_legacy_extra_parameter_shape_is_rejected_without_write(monkeypatch, saved_row, value):
+    from services import model_profile_service
+
+    update = Mock()
+    monkeypatch.setattr(model_profile_service, 'update_model_outlet', update)
+    with pytest.raises(ModelOutletValidationError):
+        service.update_legacy_llm_outlet(saved_row, {'extra_params': value}, 'user', 'tenant')
+    update.assert_not_called()
diff --git a/test/backend/services/test_model_outlet_migration_service.py b/test/backend/services/test_model_outlet_migration_service.py
new file mode 100644
index 0000000000..2f24edbe95
--- /dev/null
+++ b/test/backend/services/test_model_outlet_migration_service.py
@@ -0,0 +1,159 @@
+# Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
+"""Legacy LLM snapshots retain effective values without changing non-LLM records."""
+
+from copy import deepcopy
+
+import pytest
+from consts.exceptions import ModelOutletValidationError
+from nexent.core.model_service.adapters.openai_chat import OpenAIChatAdapter
+from nexent.core.model_service.contracts import ModelMessage, ModelRequest
+from nexent.core.model_service.profiles.outlet_storage import encode_resolved_model_profile
+from nexent.core.model_service.registry import model_service_references
+from services.model_outlet_migration_service import build_legacy_outlet_snapshot
+
+
+def row(**changes):
+    result = {"model_id": 42, "tenant_id": "tenant", "model_type": "llm", "model_name": "custom-model",
+              "model_factory": "custom", "base_url": "https://custom.invalid/v1", "display_name": "chosen",
+              "temperature": None, "top_p": None, "api_key": "controlled-key", "extra_params": None}
+    result.update(changes)
+    return result
+
+
+def build(record, capability=None):
+    return build_legacy_outlet_snapshot(record, legacy_capability=capability, migrated_at="2026-10-14T12:00:00Z")
+
+
+def wire(profile):
+    request = ModelRequest(request_id="migration", outlet_id=profile.outlet_id, config_revision=profile.config_revision,
+        messages=[ModelMessage(semantic_role="user", content_parts=[{"type": "text", "text": "Hello"}])])
+    return OpenAIChatAdapter().prepare_http_request(request, profile).json_body
+
+
+def test_unmatched_model_automatically_uses_agreed_defaults_and_retains_identity():
+    original = row()
+    before = deepcopy(original)
+    profile = build(original)
+    assert profile.outlet_id == 42 and profile.identity.request_model_id == "custom-model"
+    assert profile.capabilities.context.combined_window == 200000
+    assert profile.capabilities.context.input_limit is profile.capabilities.context.output_limit is None
+    assert profile.capabilities.tools.status == profile.capabilities.reasoning.status == "unsupported"
+    metadata = profile.provenance.provider_metadata["migration"]
+    assert metadata["unmatched_atoms"] == ["model", "provider"] and metadata["reviewed_revision"] is None
+    assert "controlled-key" not in repr(profile.model_dump()) and original == before
+
+
+def test_old_explicit_window_and_sampling_values_override_atom_suggestions():
+    profile = build(row(model_name="qwen3.5-plus", model_factory="alibaba-cn",
+        base_url="https://dashscope.aliyuncs.com/compatible-mode/v1", context_window_tokens=65536,
+        max_input_tokens=32000, max_output_tokens=4096, default_output_reserve_tokens=2048,
+        temperature=0, top_p=0, ssl_verify=False, timeout_seconds=23))
+    assert profile.provider_key == "alibaba-cn" and profile.model_profile_key == "alibaba/qwen3.5-plus"
+    assert profile.capabilities.context.combined_window == 65536
+    assert profile.capabilities.context.input_limit == 32000 and profile.capabilities.context.output_limit == 4096
+    assert profile.context_configuration.output_reserve_tokens == 2048
+    assert profile.connection.ssl_verify is False and profile.connection.timeout_seconds == 23
+    assert wire(profile)["temperature"] == wire(profile)["top_p"] == 0
+    from nexent.core.models.capacity_resolver import resolve_capacity
+
+    legacy_capacity = resolve_capacity(model_id="qwen3.5-plus", provider="alibaba-cn", capability_profiles={},
+        operator_overrides={"context_window_tokens": 65536, "max_input_tokens": 32000,
+            "max_output_tokens": 4096, "default_output_reserve_tokens": 2048})
+    assert legacy_capacity.requested_output_tokens == 2048
+    assert wire(profile)["max_tokens"] == legacy_capacity.requested_output_tokens
+
+
+def test_old_deepseek_toggle_and_custom_nested_body_survive_actual_adapter():
+    capability = {"source": "models_dev", "status": "supported", "provider_id": "deepseek"}
+    profile = build(row(model_name="deepseek-chat", model_factory="deepseek", base_url="https://api.deepseek.com/v1",
+        extra_params={"enable_thinking": True, "__custom__": {"custom_options": {"flag": False, "retries": 0}}}), capability)
+    assert profile.parameter_values["enable_thinking"] is True
+    body = wire(profile)
+    assert body["thinking"] == {"type": "enabled"} and "enable_thinking" not in body
+    assert body["custom_options"] == {"flag": False, "retries": 0}
+    assert profile.capabilities.reasoning.status == "supported"
+
+
+def test_disabled_unknown_thinking_remains_conservative_and_keeps_saved_false():
+    profile = build(row(extra_params={"enable_thinking": False}))
+    assert profile.parameter_values["enable_thinking"] is False
+    assert profile.capabilities.reasoning.status == "unsupported"
+    assert wire(profile)["enable_thinking"] is False
+
+
+def test_auto_effort_is_preserved_without_sending_an_auto_wire_field():
+    profile = build(row(extra_params={"reasoning_effort": "auto"}))
+    assert profile.parameter_values["reasoning_effort"] == "auto"
+    assert "reasoning_effort" not in wire(profile)
+    assert profile.provenance.provider_metadata["migration"]["unbound_legacy_parameters"] == ["reasoning_effort"]
+
+
+def test_repo_model_identity_and_legacy_large_output_alias_use_current_rules():
+    profile = build(row(model_repo="repo", model_name="exact", max_tokens=65536))
+    assert profile.identity.request_model_id == "repo/exact"
+    assert wire(profile)["max_tokens"] == 4096
+
+
+def test_already_saved_row_is_not_recombined_with_current_toml(monkeypatch):
+    profile = build(row())
+    saved = encode_resolved_model_profile(profile, registered_references=model_service_references())
+    import services.model_outlet_migration_service as service
+    monkeypatch.setattr(service, "build_outlet_draft", lambda *args, **kwargs: pytest.fail("Saved rows must not recompose"))
+    assert build(saved) == profile
+
+
+@pytest.mark.parametrize("changes", [{"model_type": "vlm"}, {"model_type": "embedding"},
+    {"base_url": "file:///private/secret"}, {"extra_params": {"__custom__": {"messages": []}}},
+    {"context_window_tokens": 0}])
+def test_invalid_or_out_of_scope_record_is_rejected_without_echoing_values(changes):
+    with pytest.raises(ModelOutletValidationError) as error:
+        build(row(**changes))
+    assert "secret" not in str(error.value)
+
+
+@pytest.mark.parametrize("extra", [{"enable_thinking": True, "reasoning_budget_tokens": None},
+                                {"enable_thinking": True, "reasoning_budget_tokens": -1}])
+def test_legacy_unused_budget_values_are_preserved_without_new_wire_fields(extra):
+    profile = build(row(extra_params=extra))
+    assert profile.parameter_values["reasoning_budget_tokens"] == extra["reasoning_budget_tokens"]
+    assert "thinking_budget" not in wire(profile) and "reasoning_budget_tokens" not in wire(profile)
+
+
+def test_unmatched_snapshot_declares_legacy_runtime_options_without_setting_defaults():
+    from nexent.core.model_service.compatibility.invocation_options import LegacyInvocationOptions
+
+    profile = build(row())
+    configured = LegacyInvocationOptions({"max_output_tokens": 512}, stop_sequences=["Observation:"]).resolve(profile)
+    assert wire(configured)["max_tokens"] == 512
+    assert wire(configured)["stop"] == ["Observation:"]
+    assert "max_output_tokens" not in profile.parameter_values
+
+
+@pytest.mark.parametrize("dry_run", [False, True])
+def test_runner_advances_past_failures_and_does_not_repeat_a_batch(monkeypatch, dry_run):
+    import sys
+    from types import ModuleType
+    from unittest.mock import Mock
+    import services.model_outlet_migration_service as service
+
+    database = ModuleType("database.model_outlet_db")
+    database.migrate_legacy_model_records = Mock(side_effect=[
+        [{"model_id": 2, "tenant_id": "tenant", "status": "failed", "category": "LEGACY_OUTLET_INVALID"}],
+        [{"model_id": 3, "tenant_id": "tenant", "status": "ready" if dry_run else "migrated", "category": None}], [],
+    ])
+    catalog = ModuleType("configs.model_catalog_loader")
+    catalog.resolve_reasoning_capability = Mock(return_value=None)
+    monkeypatch.setitem(sys.modules, "database.model_outlet_db", database)
+    monkeypatch.setitem(sys.modules, "configs.model_catalog_loader", catalog)
+    result = service.migrate_legacy_outlets(dry_run=dry_run, batch_size=1)
+    assert result["failed"] == 1
+    assert result["ready" if dry_run else "migrated"] == 1
+    calls = database.migrate_legacy_model_records.call_args_list
+    assert [call.kwargs["after_model_id"] for call in calls] == [0, 2, 3]
+    assert all(call.kwargs["dry_run"] is dry_run for call in calls)
+    constructor = calls[0].args[0]
+    profile = constructor(row())
+    assert profile.outlet_id == 42 and profile.capabilities.context.combined_window == 200000
+    catalog.resolve_reasoning_capability.assert_called_once_with(
+        "custom-model", "https://custom.invalid/v1", "custom", allow_gateway_fallback=False)
diff --git a/test/backend/services/test_model_outlet_projection.py b/test/backend/services/test_model_outlet_projection.py
new file mode 100644
index 0000000000..f49f1cc2a5
--- /dev/null
+++ b/test/backend/services/test_model_outlet_projection.py
@@ -0,0 +1,45 @@
+# Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
+"""Legacy views are derived from a saved row, never from a refreshed catalog."""
+
+from copy import deepcopy
+
+from nexent.core.model_service.profiles.outlet_storage import encode_resolved_model_profile
+from nexent.core.model_service.registry import model_service_references
+from services.model_outlet_projection import project_saved_outlet
+
+from test.backend.services.test_model_outlet_migration_service import build, row
+
+
+def test_projection_preserves_stored_format_and_exports_admin_review_information(monkeypatch):
+    profile = build(row(extra_params={"enable_thinking": True, "__custom__": {"custom": {"flag": False}}}))
+    stored = encode_resolved_model_profile(profile, registered_references=model_service_references())
+    original = deepcopy(stored)
+    monkeypatch.setattr("services.model_profile_service.get_model_profile_catalog", lambda: (_ for _ in ()).throw(
+        AssertionError("Saved projections must not reload TOML")))
+    view = project_saved_outlet(stored)
+    assert stored == original
+    assert view["extra_params"] == {"enable_thinking": True, "__custom__": {"custom": {"flag": False}}}
+    assert view["migration_status"] == "migrated" and view["migration_review_required"] is True
+    assert view["migration_details"]["unmatched_atoms"] == ["model", "provider"]
+    assert view["reasoning_capability"]["source"] == "operator"
+    assert "api_key" not in view
+
+
+def test_confirmed_revision_and_later_configuration_change_have_different_review_states():
+    profile = build(row())
+    data = profile.model_dump()
+    data["provenance"]["provider_metadata"]["migration"]["reviewed_revision"] = 1
+    profile = profile.__class__.model_validate(data)
+    stored = encode_resolved_model_profile(profile, registered_references=model_service_references())
+    assert project_saved_outlet(stored)["migration_review_required"] is False
+    stored["config_revision"] = 2
+    assert project_saved_outlet(stored)["migration_review_required"] is True
+
+
+def test_failed_or_invalid_rows_report_diagnostic_without_legacy_guessing():
+    assert project_saved_outlet({"profile_schema_version": None,
+        "resolved_profile": {"migration_error": {"category": "LEGACY_OUTLET_INVALID"}}})["migration_status"] == "failed"
+    assert project_saved_outlet({"profile_schema_version": 1})["migration_diagnostic"] == {
+        "category": "PROFILE_STORAGE_INVALID"}
+    assert project_saved_outlet({"model_type": "llm"}) is None
diff --git a/test/backend/services/test_model_outlet_update_service.py b/test/backend/services/test_model_outlet_update_service.py
new file mode 100644
index 0000000000..875c33ec7c
--- /dev/null
+++ b/test/backend/services/test_model_outlet_update_service.py
@@ -0,0 +1,88 @@
+# Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
+"""Saved-outlet updates preserve omitted fields and enforce rules and revisions."""
+
+from unittest.mock import Mock
+
+import pytest
+from consts.exceptions import ModelOutletConflictError, ModelOutletValidationError
+from consts.model import ModelOutletPatchRequest
+from services.model_profile_service import apply_outlet_patch, build_outlet_draft, update_model_outlet
+
+from test.backend.services.test_model_profile_service import draft_request, outlet_database  # noqa: F401
+
+
+@pytest.fixture
+def saved_profile():
+    profile, _ = build_outlet_draft(draft_request(parameter_values={"enable_thinking": True,
+                                               "reasoning_budget_tokens": 64}), "tenant")
+    data = profile.model_dump()
+    data["outlet_id"] = data["connection"]["credential_ref"]["model_id"] = 42
+    return profile.__class__.model_validate(data)
+
+
+def test_partial_parameter_update_does_not_drop_unmentioned_values(saved_profile):
+    updated = apply_outlet_patch(saved_profile, ModelOutletPatchRequest(expected_revision=1,
+        parameter_values={"reasoning_budget_tokens": 32}))
+    assert updated.parameter_values == {"enable_thinking": True, "reasoning_budget_tokens": 32}
+    assert saved_profile.parameter_values["reasoning_budget_tokens"] == 64
+
+
+def test_dependency_failure_requires_explicit_delete(saved_profile):
+    with pytest.raises(ModelOutletValidationError) as caught:
+        apply_outlet_patch(saved_profile, ModelOutletPatchRequest(expected_revision=1,
+            parameter_values={"enable_thinking": False}))
+    assert caught.value.category == "PARAMETER_DEPENDENCY"
+    updated = apply_outlet_patch(saved_profile, ModelOutletPatchRequest(expected_revision=1,
+        parameter_values={"enable_thinking": False}, delete_parameters=["reasoning_budget_tokens"]))
+    assert updated.parameter_values == {"enable_thinking": False}
+
+
+@pytest.mark.parametrize("body", [
+    {"parameter_values": {"enable_thinking": None}},
+    {"parameter_values": {"unknown": False}},
+    {"delete_parameters": ["enable_thinking", "enable_thinking"]},
+    {"delete_parameters": ["enable_thinking"], "parameter_values": {"enable_thinking": False}},
+    {"connection": None}, {"connection": {"base_url": "file:///tmp/model"}},
+    {"extra_api_parameters": None},
+])
+def test_invalid_patch_is_rejected_before_mutating_snapshot(saved_profile, body):
+    before = saved_profile.model_dump()
+    with pytest.raises(ModelOutletValidationError):
+        apply_outlet_patch(saved_profile, ModelOutletPatchRequest(expected_revision=1, **body))
+    assert saved_profile.model_dump() == before
+
+
+def test_update_uses_saved_rules_keeps_omitted_key_and_cas(outlet_database, saved_profile, monkeypatch):
+    import services.model_profile_service as service
+
+    db, _ = outlet_database
+    db.get_resolved_model_record.return_value = saved_profile
+    db.update_resolved_model_record = Mock(return_value=2)
+    monkeypatch.setattr(service, "get_model_profile_catalog", lambda: pytest.fail("No live catalog update"))
+    result = update_model_outlet(42, ModelOutletPatchRequest(expected_revision=1,
+        parameter_values={"reasoning_budget_tokens": 32}), "user", "tenant")
+    assert result["config_revision"] == result["profile"]["config_revision"] == 2
+    assert db.update_resolved_model_record.call_args.args[1:] == (1, "user", "tenant")
+    assert "api_key" not in db.update_resolved_model_record.call_args.kwargs
+    assert result["has_credential"] is True
+
+
+def test_explicit_credential_delete_is_not_omission(outlet_database, saved_profile):
+    db, _ = outlet_database
+    db.get_resolved_model_record.return_value = saved_profile
+    db.update_resolved_model_record = Mock(return_value=2)
+    update_model_outlet(42, ModelOutletPatchRequest(expected_revision=1, api_key=None), "user", "tenant")
+    assert db.update_resolved_model_record.call_args.kwargs["api_key"] is None
+
+
+def test_stale_or_missing_outlet_never_writes(outlet_database, saved_profile):
+    db, _ = outlet_database
+    db.get_resolved_model_record.return_value = saved_profile
+    db.update_resolved_model_record = Mock()
+    with pytest.raises(ModelOutletConflictError):
+        update_model_outlet(42, ModelOutletPatchRequest(expected_revision=2), "user", "tenant")
+    db.get_resolved_model_record.return_value = None
+    with pytest.raises(LookupError):
+        update_model_outlet(42, ModelOutletPatchRequest(expected_revision=1), "user", "other")
+    db.update_resolved_model_record.assert_not_called()
diff --git a/test/backend/services/test_model_outlet_validation_loading.py b/test/backend/services/test_model_outlet_validation_loading.py
new file mode 100644
index 0000000000..fb095bba82
--- /dev/null
+++ b/test/backend/services/test_model_outlet_validation_loading.py
@@ -0,0 +1,54 @@
+# Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
+"""Connection checks load only an intact tenant-owned outlet snapshot."""
+
+import sys
+from types import ModuleType
+from unittest.mock import Mock
+
+import pytest
+from consts.exceptions import ModelOutletValidationError
+from nexent.core.model_service.profiles.outlet_storage import encode_resolved_model_profile
+from nexent.core.model_service.registry import model_service_references
+from services.model_profile_service import _load_validation_outlet
+
+from test.backend.services.test_model_outlet_update_service import saved_profile  # noqa: F401
+
+
+@pytest.fixture
+def record_lookup(monkeypatch):
+    database = ModuleType('database.model_management_db')
+    database.get_model_by_model_id = Mock()
+    monkeypatch.setitem(sys.modules, database.__name__, database)
+    return database.get_model_by_model_id
+
+
+def test_validation_load_retains_credential_for_sender_only(record_lookup, saved_profile):
+    record = encode_resolved_model_profile(saved_profile, registered_references=model_service_references())
+    record['api_key'] = 'controlled-key'
+    record_lookup.return_value = record
+    profile, key = _load_validation_outlet(42, 'tenant')
+    assert profile == saved_profile and key == 'controlled-key'
+    assert 'controlled-key' not in profile.model_dump_json()
+    record_lookup.assert_called_once_with(42, tenant_id='tenant')
+
+
+def test_missing_outlet_fails_before_decoding(record_lookup):
+    record_lookup.return_value = None
+    with pytest.raises(LookupError):
+        _load_validation_outlet(42, 'tenant')
+
+
+@pytest.mark.parametrize('outlet_id,tenant', [(43, 'tenant'), (42, 'foreign')])
+def test_wrong_identity_is_rejected_even_if_storage_returns_a_row(record_lookup, saved_profile, outlet_id, tenant):
+    record_lookup.return_value = encode_resolved_model_profile(saved_profile, registered_references=model_service_references())
+    with pytest.raises(ModelOutletValidationError):
+        _load_validation_outlet(outlet_id, tenant)
+
+
+def test_corrupt_snapshot_reports_storage_error_without_credential(record_lookup):
+    record_lookup.return_value = {'profile_schema_version': 1, 'api_key': 'controlled-key'}
+    with pytest.raises(ModelOutletValidationError) as error:
+        _load_validation_outlet(42, 'tenant')
+    assert error.value.category == 'PROFILE_STORAGE_INVALID'
+    assert 'controlled-key' not in str(error.value)
diff --git a/test/backend/services/test_model_outlet_validation_service.py b/test/backend/services/test_model_outlet_validation_service.py
new file mode 100644
index 0000000000..77a74bcd50
--- /dev/null
+++ b/test/backend/services/test_model_outlet_validation_service.py
@@ -0,0 +1,146 @@
+# Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
+"""Connection probes capture configuration once and preserve revision/cancellation boundaries."""
+
+import asyncio
+from contextlib import asynccontextmanager
+from unittest.mock import AsyncMock, Mock
+from uuid import uuid4
+
+import pytest
+from consts.exceptions import ModelOutletConflictError
+from consts.model import ModelOutletCreateRequest, ModelOutletValidationRequest
+from nexent.core.model_service.contracts import AssistantMessage, ModelError, ModelEvent
+from nexent.core.model_service.service import ModelServiceError
+from services.model_profile_service import build_outlet_draft, validate_model_outlet
+
+from test.backend.services.test_model_profile_service import draft_request, outlet_database  # noqa: F401
+
+
+@pytest.fixture
+def probe(monkeypatch, outlet_database):
+    import nexent.core.concurrency as concurrency
+    import nexent.core.model_service.service as model_service
+    import services.model_profile_service as service
+
+    profile, _ = build_outlet_draft(draft_request(parameter_values={"enable_thinking": False}), "tenant")
+    data = profile.model_dump()
+    data["outlet_id"] = data["connection"]["credential_ref"]["model_id"] = 42
+    profile = profile.__class__.model_validate(data)
+    loader = Mock(return_value=(profile, "controlled-key"))
+    monkeypatch.setattr(service, "_load_validation_outlet", loader)
+
+    async def run(_name, fn, *args, **kwargs):
+        return fn(*args, **kwargs)
+
+    monkeypatch.setattr(concurrency, "run_blocking", run)
+    invoke = AsyncMock(return_value=AssistantMessage(content_parts=[{"type": "text", "text": "Hello"}],
+                                                    finish_reason="stop"))
+
+    @asynccontextmanager
+    async def stream(_service, call, captured):
+        async def events():
+            try:
+                message = await invoke(call, captured)
+            except ModelServiceError as failure:
+                yield ModelEvent(request_id=failure.error.request_id, message_id=uuid4(), sequence=1,
+                                 type="error", error=failure.error)
+                return
+            if message is not None:
+                yield ModelEvent(request_id=call.request_id, message_id=message.message_id, sequence=1,
+                                 type="message_completed", message=message, finish_reason=message.finish_reason)
+        iterator = events()
+        try:
+            yield iterator
+        finally:
+            await iterator.aclose()
+
+    monkeypatch.setattr(model_service.ModelService, "astream", stream)
+    db, _ = outlet_database
+    db.update_model_outlet_connectivity = Mock()
+    return profile, loader, invoke, db.update_model_outlet_connectivity
+
+
+@pytest.mark.asyncio
+async def test_saved_probe_uses_captured_parameters_and_revision(probe):
+    profile, loader, invoke, update = probe
+    result = await validate_model_outlet(ModelOutletValidationRequest(outlet_id=42, expected_revision=1), "tenant")
+    assert result["ok"] is True and result["check_scope"] == "connection_only"
+    loader.assert_called_once_with(42, "tenant")
+    call, captured = invoke.call_args.args
+    assert captured is profile and captured.parameter_values == {"enable_thinking": False}
+    assert call.tools == [] and call.stream is True and call.purpose == "connection_validation"
+    assert call.messages[0].semantic_role == "user"
+    assert call.messages[0].content_parts == [{"type": "text", "text": "Hello"}]
+    update.assert_called_once_with(42, "tenant", 1, "available")
+    assert "controlled-key" not in repr(result)
+
+
+@pytest.mark.asyncio
+async def test_draft_probe_does_not_load_or_write_saved_status(probe):
+    _, loader, invoke, update = probe
+    draft = ModelOutletCreateRequest(**draft_request().model_dump(), api_key="controlled-key")
+    result = await validate_model_outlet(ModelOutletValidationRequest(draft=draft), "tenant")
+    assert result["ok"] is True and result["model_id"] is None
+    loader.assert_not_called()
+    update.assert_not_called()
+    assert invoke.call_args.args[1].identity.tenant_id == "tenant"
+
+
+@pytest.mark.asyncio
+async def test_stale_or_missing_record_does_not_send_request(probe):
+    _, loader, invoke, update = probe
+    with pytest.raises(ModelOutletConflictError):
+        await validate_model_outlet(ModelOutletValidationRequest(outlet_id=42, expected_revision=2), "tenant")
+    loader.side_effect = LookupError("MODEL_OUTLET_NOT_FOUND")
+    with pytest.raises(LookupError):
+        await validate_model_outlet(ModelOutletValidationRequest(outlet_id=42), "other")
+    invoke.assert_not_awaited()
+    update.assert_not_called()
+
+
+@pytest.mark.asyncio
+async def test_empty_response_is_unavailable(probe):
+    _, _, invoke, update = probe
+    invoke.return_value = AssistantMessage(finish_reason="stop")
+    result = await validate_model_outlet(ModelOutletValidationRequest(outlet_id=42), "tenant")
+    assert result["ok"] is False and result["error"]["category"] == "MODEL_EMPTY_RESPONSE"
+    update.assert_called_once_with(42, "tenant", 1, "unavailable")
+
+
+@pytest.mark.asyncio
+async def test_normalized_provider_failure_is_returned_without_raw_payload(probe):
+    _, _, invoke, update = probe
+    invoke.side_effect = ModelServiceError(ModelError(category="AUTHENTICATION_ERROR", scope="provider",
+        retryable=False, safe_message="Model authentication failed", request_id="test"))
+    result = await validate_model_outlet(ModelOutletValidationRequest(outlet_id=42), "tenant")
+    assert result["ok"] is False and result["error"]["category"] == "AUTHENTICATION_ERROR"
+    update.assert_called_once_with(42, "tenant", 1, "unavailable")
+
+
+@pytest.mark.asyncio
+async def test_cancelled_probe_never_writes_status(probe):
+    _, _, invoke, update = probe
+    invoke.side_effect = asyncio.CancelledError()
+    with pytest.raises(asyncio.CancelledError):
+        await validate_model_outlet(ModelOutletValidationRequest(outlet_id=42), "tenant")
+    update.assert_not_called()
+
+
+@pytest.mark.asyncio
+async def test_configuration_change_during_probe_rejects_late_status(probe):
+    _, _, invoke, update = probe
+    update.side_effect = ModelOutletConflictError()
+    with pytest.raises(ModelOutletConflictError):
+        await validate_model_outlet(ModelOutletValidationRequest(outlet_id=42, expected_revision=1), "tenant")
+    invoke.assert_awaited_once()
+    update.assert_called_once_with(42, "tenant", 1, "available")
+
+
+@pytest.mark.asyncio
+async def test_stream_without_completion_is_unavailable(probe):
+    _, _, invoke, update = probe
+    invoke.return_value = None
+    result = await validate_model_outlet(ModelOutletValidationRequest(outlet_id=42), "tenant")
+    assert result["ok"] is False
+    update.assert_called_once_with(42, "tenant", 1, "unavailable")
diff --git a/test/backend/services/test_model_profile_catalog_matrix.py b/test/backend/services/test_model_profile_catalog_matrix.py
new file mode 100644
index 0000000000..9227939692
--- /dev/null
+++ b/test/backend/services/test_model_profile_catalog_matrix.py
@@ -0,0 +1,48 @@
+# Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
+"""Every selected China combination has an executable configuration and wire binding."""
+
+import pytest
+from consts.model import ModelProfilePreviewRequest
+from nexent.core.model_service.adapters.openai_chat import OpenAIChatAdapter
+from nexent.core.model_service.compatibility.invocation_options import LegacyInvocationOptions
+from nexent.core.model_service.contracts import ModelMessage, ModelRequest
+from services.model_profile_service import build_outlet_draft, get_model_profile_catalog
+
+CATALOG = get_model_profile_catalog()
+
+
+@pytest.mark.parametrize("key", sorted(CATALOG.provider_models))
+def test_selected_combination_resolves_and_renders_declared_reasoning_controls(key):
+    provider, model = key.split("/", 1)
+    atom = CATALOG.providers[provider]
+    request = ModelProfilePreviewRequest(
+        provider_profile={"key": provider, "revision": atom.revision},
+        provider_info={"base_url": atom.source.connection_suggestions["base_url"]},
+        request_model_id=model,
+    )
+    profile, _ = build_outlet_draft(request, "catalog-test-tenant")
+    assert profile.identity.request_model_id == model
+    assert profile.provider_key == provider
+    parameters = {}
+    for control in profile.capabilities.reasoning.controls or []:
+        if control.mode == "toggle":
+            parameters[control.parameter_key] = True
+        elif control.mode == "effort":
+            parameters[control.parameter_key] = control.values[-1]
+        else:
+            parameters[control.parameter_key] = control.min if control.min is not None else 1
+    configured = LegacyInvocationOptions(parameters).resolve(profile)
+    message = ModelRequest(
+        request_id="catalog-wire-check", outlet_id=profile.outlet_id, config_revision=profile.config_revision,
+        messages=[ModelMessage(semantic_role="user", content_parts=[{"type": "text", "text": "test"}])],
+    )
+    body = OpenAIChatAdapter().prepare_http_request(message, configured).json_body
+    assert body["model"] == model
+    rules = {rule["key"]: rule for rule in profile.parameter_rules}
+    for name, value in parameters.items():
+        binding = rules[name]["api_binding"]
+        actual = body
+        for part in binding["path"].strip("/").split("/"):
+            actual = actual[part]
+        assert actual == ("enabled" if binding["transform_ref"] == "thinking_toggle_v1" else value)
diff --git a/test/backend/services/test_model_profile_service.py b/test/backend/services/test_model_profile_service.py
new file mode 100644
index 0000000000..f3766bb75e
--- /dev/null
+++ b/test/backend/services/test_model_profile_service.py
@@ -0,0 +1,397 @@
+# Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
+"""Profile discovery uses the actual local catalog without writes or qualification claims."""
+
+import pytest
+from consts.exceptions import ModelOutletValidationError
+from services.model_profile_service import list_atomic_profiles, list_profile_protocols
+
+
+def test_model_family_filter_and_deterministic_pages():
+    first = list_atomic_profiles("model", family="QWEN", page_size=2)
+    second = list_atomic_profiles("model", family="qwen", page=2, page_size=2)
+    assert first["total"] > 2 and first["catalog_revision"] == second["catalog_revision"]
+    assert not {x["key"] for x in first["items"]} & {x["key"] for x in second["items"]}
+    assert all(x["family"] == "qwen" and x["qualification"] == "reference_only" for x in first["items"])
+    assert list_atomic_profiles("model", query="not-an-existing-model")["items"] == []
+
+
+def test_provider_search_returns_hints_without_credentials():
+    result = list_atomic_profiles("provider", query="alibaba")
+    assert any(x["key"] == "alibaba-cn" for x in result["items"])
+    assert all(set(x) <= {"key", "name", "revision", "catalog_kind", "qualification",
+                         "endpoint_hints", "suggested_base_url"} for x in result["items"])
+    assert all(x["qualification"] == "reference_only" for x in result["items"])
+
+
+@pytest.mark.parametrize("kwargs", [{"page": 0}, {"page": True}, {"page_size": 101},
+                                    {"query": 1}, {"family": 1}])
+def test_invalid_discovery_inputs_are_rejected(kwargs):
+    with pytest.raises(ModelOutletValidationError):
+        list_atomic_profiles("model", **kwargs)
+
+
+def test_only_executable_protocols_are_advertised():
+    result = list_profile_protocols()
+    assert result["items"] == [{"ref": "openai_chat_completions", "version": 1}]
+    assert {x["ref"] for x in result["authentication_schemes"]} == {"bearer_token_v1", "no_auth_v1"}
+
+
+def draft_request(**updates):
+    from consts.model import ModelProfilePreviewRequest
+
+    body = {"provider_info": {"base_url": "https://dashscope.aliyuncs.com/compatible-mode/v1"},
+            "request_model_id": "qwen3.5-plus"}
+    body.update(updates)
+    return ModelProfilePreviewRequest(**body)
+
+
+def test_preview_matches_exact_sources_and_preserves_endpoint_and_model_id():
+    from services.model_profile_service import build_outlet_draft, preview_model_profile
+
+    request = draft_request(parameter_values={"enable_thinking": False})
+    preview = preview_model_profile(request, "tenant")
+    assert preview["selected"] == {"model": "alibaba/qwen3.5-plus", "provider": "alibaba-cn"}
+    assert preview["parameter_values"] == {"enable_thinking": False}
+    profile, candidates = build_outlet_draft(request, "tenant")
+    assert profile.identity.tenant_id == "tenant" and profile.identity.model_type == "llm"
+    assert profile.connection.base_url == request.provider_info.base_url
+    assert profile.identity.request_model_id == request.request_model_id
+    assert candidates["providers"] == ["alibaba-cn"]
+
+
+def test_manual_selection_does_not_rewrite_custom_request_identity():
+    from services.model_profile_service import (
+        build_outlet_draft,
+        get_model_profile_catalog,
+    )
+
+    catalog = get_model_profile_catalog()
+    key = "alibaba/qwen3.5-plus"
+    request = draft_request(selection_mode="manual", request_model_id="tenant-exact-model",
+        provider_info={"base_url": "https://custom.invalid/v1", "provider_id": "tenant-provider"},
+        model_profile={"key": key, "revision": catalog.models[key].revision})
+    profile, _ = build_outlet_draft(request, "tenant")
+    assert profile.provider_key is None and profile.model_profile_key == key
+    assert profile.identity.request_model_id == "tenant-exact-model"
+    assert profile.identity.provider_id == "tenant-provider"
+
+
+def test_unmatched_custom_service_returns_unknown_capabilities():
+    from services.model_profile_service import build_outlet_draft
+
+    profile, candidates = build_outlet_draft(draft_request(
+        request_model_id="unlisted", provider_info={"base_url": "https://custom.invalid/v1"}), "tenant")
+    assert profile.capabilities.tools.status == profile.capabilities.reasoning.status == "unknown"
+    assert candidates == {"models": [], "providers": []}
+
+
+@pytest.mark.parametrize("values", [{"enable_thinking": "yes"}, {"reasoning_budget_tokens": 81921},
+                                   {"messages": "forbidden"}])
+def test_preview_rejects_invalid_or_undeclared_parameter_values(values):
+    from services.model_profile_service import build_outlet_draft
+
+    with pytest.raises(ModelOutletValidationError) as caught:
+        build_outlet_draft(draft_request(parameter_values=values), "tenant")
+    assert caught.value.category.startswith("PARAMETER_")
+    assert str(caught.value) == "MODEL_OUTLET_INVALID"
+
+
+@pytest.mark.parametrize("url", ["file:///tmp/models", "https://user:secret@custom.invalid/v1", "https://host.invalid:invalid"])
+def test_invalid_connection_rejected_without_echoing_values(url):
+    from services.model_profile_service import build_outlet_draft
+
+    with pytest.raises(ModelOutletValidationError) as caught:
+        build_outlet_draft(draft_request(provider_info={"base_url": url}), "tenant")
+    assert url not in str(caught.value)
+
+
+def test_save_requires_current_preview_revision_and_manual_atom_revision():
+    from consts.exceptions import ModelOutletConflictError
+    from services.model_profile_service import build_outlet_draft
+
+    with pytest.raises(ModelOutletValidationError):
+        build_outlet_draft(draft_request(), "tenant", require_revision=True)
+    with pytest.raises(ModelOutletConflictError):
+        build_outlet_draft(draft_request(catalog_revision="stale"), "tenant")
+    with pytest.raises(ModelOutletConflictError):
+        build_outlet_draft(draft_request(selection_mode="manual",
+            model_profile={"key": "alibaba/qwen3.5-plus", "revision": "stale"}), "tenant")
+
+
+def test_client_cannot_supply_capabilities_or_tenant_identity():
+    from pydantic import ValidationError
+
+    for fields in ({"capabilities": {"tools": True}}, {"tenant_id": "other"}, {"bindings": {}}):
+        with pytest.raises(ValidationError):
+            draft_request(**fields)
+
+
+@pytest.fixture
+def outlet_database(monkeypatch):
+    import sys
+    from types import ModuleType
+    from unittest.mock import Mock
+
+    import services.model_profile_service as service
+
+    monkeypatch.setattr(service, "_backfill_new_outlet", Mock(return_value=[]))
+    database = ModuleType("database.model_outlet_db")
+    database.create_resolved_model_record = Mock(return_value=42)
+    database.get_resolved_model_record = Mock()
+    database.has_model_outlet_credential = Mock(return_value=True)
+    legacy = ModuleType("database.model_management_db")
+    legacy.get_models_by_display_name = Mock(return_value=[])
+    monkeypatch.setitem(sys.modules, "database.model_outlet_db", database)
+    monkeypatch.setitem(sys.modules, "database.model_management_db", legacy)
+    return database, legacy
+
+
+def test_save_recomposes_instead_of_trusting_preview_and_separates_credentials(outlet_database):
+    from consts.model import ModelOutletCreateRequest
+    from services.model_profile_service import (
+        create_model_outlet,
+        get_model_profile_catalog,
+    )
+
+    database, legacy = outlet_database
+    request = ModelOutletCreateRequest(**draft_request().model_dump(), api_key="controlled-key")
+    request.catalog_revision = get_model_profile_catalog().revision
+    result = create_model_outlet(request, "user", "tenant")
+    saved = database.create_resolved_model_record.call_args.args[0]
+    assert saved.identity.tenant_id == "tenant" and saved.outlet_id is None
+    assert database.create_resolved_model_record.call_args.kwargs["api_key"] == "controlled-key"
+    assert result["model_id"] == result["profile"]["connection"]["credential_ref"]["model_id"] == 42
+    assert result["profile"]["outlet_id"] == 42 and result["config_revision"] == 1
+    assert "controlled-key" not in repr(result)
+    legacy.get_models_by_display_name.assert_called_once_with("qwen3.5-plus", "tenant")
+
+
+def test_duplicate_display_name_fails_before_insert(outlet_database):
+    from consts.exceptions import ModelOutletConflictError
+    from consts.model import ModelOutletCreateRequest
+    from services.model_profile_service import (
+        create_model_outlet,
+        get_model_profile_catalog,
+    )
+
+    database, legacy = outlet_database
+    legacy.get_models_by_display_name.return_value = [{"model_id": 99}]
+    request = ModelOutletCreateRequest(**draft_request().model_dump())
+    request.catalog_revision = get_model_profile_catalog().revision
+    with pytest.raises(ModelOutletConflictError):
+        create_model_outlet(request, "user", "tenant")
+    database.create_resolved_model_record.assert_not_called()
+
+
+def test_saved_outlet_read_uses_tenant_database_without_catalog(outlet_database, monkeypatch):
+    import services.model_profile_service as service
+
+    database, _ = outlet_database
+    profile, _ = service.build_outlet_draft(draft_request(), "tenant")
+    database.get_resolved_model_record.return_value = profile
+    monkeypatch.setattr(service, "get_model_profile_catalog", lambda: pytest.fail("Must not recompose saved outlet"))
+    result = service.get_model_outlet(42, "tenant")
+    database.get_resolved_model_record.assert_called_once()
+    assert database.get_resolved_model_record.call_args.args == (42, "tenant")
+    assert result["profile"]["identity"]["tenant_id"] == "tenant"
+    database.get_resolved_model_record.return_value = None
+    assert service.get_model_outlet(42, "other") is None
+
+
+def test_no_auth_selection_uses_none_credential_kind():
+    from services.model_profile_service import build_outlet_draft
+
+    profile, _ = build_outlet_draft(draft_request(authentication_scheme="no_auth_v1"), "tenant")
+    assert profile.bindings.auth.ref == "no_auth_v1"
+    assert profile.connection.credential_ref.kind == profile.connection_rules.credential_kind == "none"
+
+
+@pytest.mark.parametrize("path", ["/model", "/enable_thinking", "/headers/custom", "/api_key"])
+def test_preview_extra_parameters_cannot_override_control_or_auth_fields(path):
+    from services.model_profile_service import build_outlet_draft
+
+    with pytest.raises(ModelOutletValidationError):
+        build_outlet_draft(draft_request(extra_api_parameters=[{"path": path, "value": "controlled-value"}]), "tenant")
+
+
+def test_custom_extra_parameter_is_preserved_without_capability_claim():
+    from services.model_profile_service import build_outlet_draft
+
+    extras = [{"path": "/custom_option", "value": False}]
+    profile, _ = build_outlet_draft(draft_request(extra_api_parameters=extras), "tenant")
+    assert profile.extra_api_parameters == extras
+    assert "custom_option" not in profile.parameter_values
+
+
+def test_unknown_sampling_preserves_legacy_calls_and_explicit_top_p_controls():
+    from services.conversation_model_preferences_service import merge_model_preferences
+    from services.model_profile_service import build_outlet_draft
+
+    from nexent.core.model_service.adapters.openai_chat import OpenAIChatAdapter
+    from nexent.core.model_service.compatibility.invocation_options import LegacyInvocationOptions
+    from nexent.core.model_service.contracts import ModelMessage, ModelRequest
+
+    profile, _ = build_outlet_draft(draft_request(request_model_id="unlisted",
+        provider_info={"base_url": "https://custom.invalid/v1"}), "tenant")
+    declarations = {rule["key"]: rule for rule in profile.parameter_rules}
+    assert profile.capabilities.sampling.temperature.status == "unknown"
+    assert "temperature" not in profile.parameter_values
+    assert declarations["temperature"]["visible"] is True
+    assert declarations["temperature"]["allowed_scopes"] == ["outlet", "conversation"]
+    assert declarations["top_p"]["visible"] is True
+    assert declarations["top_p"]["allowed_scopes"] == ["outlet", "conversation"]
+    assert "top_p" not in profile.parameter_values
+    assert profile.capabilities.sampling.top_p.status == "unknown"
+    assert merge_model_preferences(profile, {"top_p": 0.85}).parameter_values["top_p"] == 0.85
+    invocation = LegacyInvocationOptions({"temperature": 0.5, "top_p": 0}).resolve(profile)
+    request = ModelRequest(request_id="legacy-platform-call", outlet_id=profile.outlet_id,
+        config_revision=profile.config_revision,
+        messages=[ModelMessage(semantic_role="user", content_parts=[{"type": "text", "text": "title"}])])
+    body = OpenAIChatAdapter().prepare_http_request(request, invocation).json_body
+    assert body["temperature"] == 0.5 and body["top_p"] == 0
+    assert merge_model_preferences(profile, {"temperature": 0.5}).parameter_values["temperature"] == 0.5
+
+
+def test_preview_exposes_experience_defaults_before_user_overrides(monkeypatch):
+    from dataclasses import replace
+
+    from consts.model import ModelProfilePreviewRequest
+    from services import model_profile_service as service
+
+    from nexent.core.model_service.profiles.protocol_parameters import openai_chat_parameter_rules
+
+    catalog = service.get_model_profile_catalog()
+    rules = next(rule for rule in openai_chat_parameter_rules() if rule["key"] == "temperature")
+    model_key, provider_key = "alibaba/qwen3.5-plus", "alibaba-cn"
+    combo_key = provider_key + "/qwen3.5-plus"
+    layers = []
+    for collection, key, value in ((catalog.models, model_key, 0.2),
+                                   (catalog.providers, provider_key, 0.4),
+                                   (catalog.provider_models, combo_key, 0.6)):
+        atom = collection[key]
+        rule = {**rules, "default_value": value}
+        layers.append({**collection, key: replace(atom, parameters=(*atom.parameters, rule))})
+    monkeypatch.setattr(service, "get_model_profile_catalog", lambda: replace(catalog,
+        models=layers[0], providers=layers[1], provider_models=layers[2]))
+    request = ModelProfilePreviewRequest(provider_info={"base_url": "https://models.invalid/v1"},
+        request_model_id="qwen3.5-plus", provider_profile={"key": provider_key, "revision": catalog.providers[provider_key].revision})
+    preview = service.preview_model_profile(request, "tenant")
+    assert preview["parameter_values"]["temperature"] == 0.6
+    assert next(rule for rule in preview["field_specs"] if rule["key"] == "temperature")["default_value"] == 0.6
+    request.parameter_values = {"temperature": 0.9}
+    assert service.preview_model_profile(request, "tenant")["parameter_values"]["temperature"] == 0.9
+    assert preview["parameter_values"]["temperature"] == 0.6
+
+
+def test_model_list_includes_detached_base_configuration_without_connection():
+    import json
+
+    from services.model_profile_service import get_model_profile_catalog
+
+    result = list_atomic_profiles("model", query="qwen3.7-max")
+    item = next(item for item in result["items"] if item["key"] == "alibaba/qwen3.7-max")
+    configuration = item["configuration"]
+    assert configuration["capabilities"]["context"]["combined_window"] == 1000000
+    assert configuration["capabilities"]["context"]["output_limit"] == 65536
+    assert configuration["capabilities"]["reasoning"]["status"] == "supported"
+    json.dumps(result)
+    configuration["capabilities"]["context"]["combined_window"] = 1
+    assert get_model_profile_catalog().models[item["key"]].capabilities["context"]["combined_window"] == 1000000
+
+
+def test_model_base_configuration_preserves_explicit_default_values(monkeypatch):
+    from dataclasses import replace
+
+    from services import model_profile_service as service
+
+    catalog = service.get_model_profile_catalog()
+    key = "alibaba/qwen3.7-max"
+    parameters = ({"key": "temperature", "default_value": 0},
+                  {"key": "enable_thinking", "fixed_value": False},
+                  {"key": "custom_nullable", "default_value": None},
+                  {"key": "no_default"})
+    atom = replace(catalog.models[key], parameters=parameters)
+    monkeypatch.setattr(service, "get_model_profile_catalog", lambda: replace(catalog, models={key: atom}))
+    configuration = service.list_atomic_profiles("model")["items"][0]["configuration"]
+    assert configuration["parameter_values"] == {"temperature": 0, "enable_thinking": False, "custom_nullable": None}
+    assert len(configuration["field_specs"]) == 4
+
+
+def test_edit_old_outlet_adds_only_missing_sampling_rules_without_catalog_lookup(monkeypatch):
+    from consts.model import ModelOutletPatchRequest
+    from services import model_profile_service as service
+    from nexent.core.model_service.profiles.resolved_profile import ResolvedModelProfile
+
+    profile, _ = service.build_outlet_draft(draft_request(request_model_id="old",
+        provider_info={"base_url": "https://custom.invalid/v1"}), "tenant")
+    data = profile.model_dump(mode="json")
+    data["parameter_rules"] = [rule for rule in data["parameter_rules"] if rule["key"] not in {"temperature", "top_p"}]
+    before = ResolvedModelProfile.model_validate(data)
+    monkeypatch.setattr(service, "get_model_profile_catalog", lambda: pytest.fail("must not read TOML for an old outlet"))
+    request = ModelOutletPatchRequest(expected_revision=before.config_revision,
+        parameter_values={"temperature": 0.7, "top_p": 1})
+    result = service.apply_outlet_patch(before, request)
+    assert result.parameter_values["temperature"] == 0.7
+    assert result.parameter_values["top_p"] == 1
+    assert result.identity == before.identity
+    assert result.capabilities == before.capabilities
+    assert all(rule in result.parameter_rules for rule in before.parameter_rules)
+
+
+@pytest.mark.parametrize("key,scheme,kind", [(None, "no_auth_v1", "none"),
+    ("", "no_auth_v1", "none"), ("  ", "no_auth_v1", "none"),
+    ("controlled-key", "bearer_token_v1", "model_record")])
+def test_optional_key_controls_authentication_for_create_and_explicit_edit(key, scheme, kind):
+    """UI-AUTH-11: the key controls auth; omitted patch keys preserve it."""
+    from consts.model import ModelOutletCreateRequest, ModelOutletPatchRequest
+    from services.model_profile_service import build_outlet_draft, apply_outlet_patch
+
+    request = ModelOutletCreateRequest(**draft_request().model_dump(), api_key=key)
+    profile, _ = build_outlet_draft(request, "tenant")
+    assert profile.bindings.auth.ref == scheme
+    assert profile.connection.credential_ref.kind == kind
+    original, _ = build_outlet_draft(draft_request(), "tenant")
+    changed = apply_outlet_patch(original, ModelOutletPatchRequest(expected_revision=1, api_key=key))
+    assert changed.bindings.auth.ref == scheme
+    assert changed.connection.credential_ref.kind == kind
+    retained = apply_outlet_patch(changed, ModelOutletPatchRequest(expected_revision=1))
+    assert retained.bindings.auth == changed.bindings.auth
+    assert retained.connection.credential_ref == changed.connection.credential_ref
+
+
+@pytest.mark.parametrize("key", ["********", "***", "********suffix", "prefix********"])
+def test_masked_credential_is_rejected_before_composition_or_patch(key):
+    """UI-AUTH-13: no placeholder may reach persistence or the model transport."""
+    from consts.model import ModelOutletCreateRequest, ModelOutletPatchRequest
+    from services.model_profile_service import build_outlet_draft, apply_outlet_patch
+
+    with pytest.raises(ModelOutletValidationError):
+        build_outlet_draft(ModelOutletCreateRequest(**draft_request().model_dump(), api_key=key), "tenant")
+    profile, _ = build_outlet_draft(draft_request(), "tenant")
+    with pytest.raises(ModelOutletValidationError):
+        apply_outlet_patch(profile, ModelOutletPatchRequest(expected_revision=1, api_key=key))
+
+
+def test_saved_outlet_draft_view_upgrades_only_registered_sampling_rules(outlet_database):
+    import services.model_profile_service as service
+    from nexent.core.model_service.profiles.protocol_parameters import openai_chat_parameter_rules
+
+    database, _ = outlet_database
+    profile, _ = service.build_outlet_draft(draft_request(), "tenant")
+    data = profile.model_dump(mode="json")
+    rules = openai_chat_parameter_rules()
+    for rule in rules:
+        if rule["key"] in {"temperature", "top_p"}:
+            rule["visible"] = False
+            rule["allowed_scopes"] = ["outlet"]
+            rule["source"] = {"ref": "openai_chat_protocol_parameters_v1", "version": 1}
+    data["parameter_rules"] = [rule for rule in data["parameter_rules"] if rule["key"] not in {r["key"] for r in rules}] + rules
+    database.get_resolved_model_record.return_value = type(profile).model_validate(data)
+    result = service.get_model_outlet(42, "tenant")
+    sampling = [rule for rule in result["field_specs"] if rule["key"] in {"temperature", "top_p"}]
+    assert len(sampling) == 2
+    assert all(rule["visible"] and "conversation" in rule["allowed_scopes"] for rule in sampling)
+    assert all(rule["source"]["version"] == 2 for rule in sampling)
+    assert result["profile"]["parameter_values"] == data["parameter_values"]
+    assert all(not rule["visible"] for rule in data["parameter_rules"] if rule["key"] in {"temperature", "top_p"})
diff --git a/test/backend/services/test_model_thinking_configuration.py b/test/backend/services/test_model_thinking_configuration.py
new file mode 100644
index 0000000000..5086e7c8ea
--- /dev/null
+++ b/test/backend/services/test_model_thinking_configuration.py
@@ -0,0 +1,147 @@
+# Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
+"""AC-PARAM-FORM: explicit thinking formats are frozen, validated and sent consistently."""
+
+import pytest
+from consts.model import ModelOutletPatchRequest, ModelProfilePreviewRequest
+from consts.exceptions import ModelOutletValidationError
+from services.model_profile_service import apply_outlet_patch, build_outlet_draft, list_atomic_profiles
+from nexent.core.model_service.registry import model_service_references
+
+
+@pytest.mark.parametrize("preset,path,value", [
+    ("enable_thinking", "/enable_thinking", False),
+    ("thinking_type", "/thinking/type", "disabled"),
+    ("chat_template", "/chat_template_kwargs/enable_thinking", False),
+])
+def test_explicit_thinking_binding_preserves_false_and_survives_storage(preset, path, value):
+    request = ModelProfilePreviewRequest(provider_info={"base_url": "https://custom.invalid/v1"},
+        request_model_id="qwen3.8", thinking_control=preset, parameter_values={"enable_thinking": False})
+    profile, _ = build_outlet_draft(request, "tenant")
+    assert profile.parameter_values["enable_thinking"] is False
+    assert profile.capabilities.reasoning.controls[0].mode == "toggle"
+    rule = next(rule for rule in profile.parameter_rules if rule["key"] == "enable_thinking")
+    assert rule["api_binding"]["path"] == path
+    assert rule["allowed_scopes"] == ["outlet", "conversation"]
+    from nexent.core.model_service.parameter_transforms import transform_parameter
+    assert transform_parameter(rule["api_binding"], False) == value
+    from nexent.core.model_service.profiles.outlet_storage import encode_resolved_model_profile, decode_resolved_model_profile
+    stored = encode_resolved_model_profile(profile, registered_references=model_service_references())
+    stored["model_id"] = 42
+    restored = decode_resolved_model_profile(stored, registered_references=model_service_references())
+    assert restored.parameter_values["enable_thinking"] is False
+    assert restored.capabilities.reasoning.controls[0].mode == "toggle"
+    from nexent.core.model_service.adapters.openai_chat import OpenAIChatAdapter
+    from nexent.core.model_service.contracts import ModelMessage, ModelRequest
+    prepared = OpenAIChatAdapter().prepare_http_request(ModelRequest(request_id="thinking-test", outlet_id=42,
+        config_revision=restored.config_revision, messages=[ModelMessage(semantic_role="user_input",
+        content_parts=[{"type":"text","text":"hello"}])]), restored)
+    actual = prepared.json_body
+    for part in path.strip("/").split("/"):
+        actual = actual[part]
+    assert actual == value
+
+
+def test_edit_restores_the_original_without_reloading_atoms():
+    profile, _ = build_outlet_draft(ModelProfilePreviewRequest(provider_info={"base_url": "https://custom.invalid/v1"},
+        request_model_id="custom-model"), "tenant")
+    original = profile.model_dump()
+    changed = apply_outlet_patch(profile, ModelOutletPatchRequest(expected_revision=1,
+        thinking_control="thinking_type", parameter_values={"enable_thinking": True}))
+    restored = apply_outlet_patch(changed, ModelOutletPatchRequest(expected_revision=1,
+        thinking_control="profile_default"))
+    assert restored.capabilities.reasoning == profile.capabilities.reasoning
+    assert "enable_thinking" not in restored.parameter_values
+    assert restored.parameter_rules == profile.parameter_rules
+    assert profile.model_dump() == original
+
+
+def test_invalid_toggle_does_not_become_a_truthy_string():
+    with pytest.raises(ModelOutletValidationError):
+        build_outlet_draft(ModelProfilePreviewRequest(provider_info={"base_url":"https://custom.invalid/v1"},
+            request_model_id="custom", thinking_control="enable_thinking", parameter_values={"enable_thinking":"false"}), "tenant")
+
+
+def test_smaller_context_automatically_bounds_hidden_limits_without_exposing_more_fields():
+    profile, _ = build_outlet_draft(ModelProfilePreviewRequest(provider_info={"base_url":"https://custom.invalid/v1"},
+        request_model_id="custom", context_limits={"combined_window":200000,"input_limit":180000,"output_limit":16000},
+        parameter_values={"max_output_tokens":4096}), "tenant")
+    updated = apply_outlet_patch(profile, ModelOutletPatchRequest(expected_revision=1, context_limits={"combined_window":8000}))
+    assert updated.capabilities.context.combined_window == 8000
+    assert updated.capabilities.context.input_limit == 8000
+    assert updated.capabilities.context.output_limit == 8000
+    assert updated.parameter_values["max_output_tokens"] == 4096
+    assert profile.capabilities.context.input_limit == 180000
+
+
+@pytest.mark.parametrize("changes", [{"combined_window":4096}, {"combined_window":100000,"output_limit":4096}])
+def test_output_size_cannot_exceed_context_or_profile_limit(changes):
+    with pytest.raises(ModelOutletValidationError) as error:
+        build_outlet_draft(ModelProfilePreviewRequest(provider_info={"base_url":"https://custom.invalid/v1"},
+            request_model_id="custom", context_limits=changes, parameter_values={"max_output_tokens":8192}), "tenant")
+    assert error.value.category == "PARAMETER_LIMIT_EXCEEDED"
+
+
+@pytest.mark.parametrize("mode,key,value,wire", [
+    ("effort", "reasoning_effort", "medium", "reasoning_effort"),
+    ("budget_tokens", "reasoning_budget_tokens", 4096, "thinking_budget"),
+])
+def test_degree_presets_roundtrip_and_build_the_declared_request(mode, key, value, wire):
+    from nexent.core.model_service.adapters.openai_chat import OpenAIChatAdapter
+    from nexent.core.model_service.contracts import ModelMessage, ModelRequest
+    from nexent.core.model_service.profiles.outlet_storage import encode_resolved_model_profile, decode_resolved_model_profile
+
+    profile, _ = build_outlet_draft(ModelProfilePreviewRequest(
+        provider_info={"base_url": "https://custom.invalid/v1"}, request_model_id="custom-degree",
+        thinking_control="enable_thinking", thinking_mode=mode,
+        parameter_values={"enable_thinking": True, key: value}), "tenant")
+    stored = encode_resolved_model_profile(profile, registered_references=model_service_references())
+    stored["model_id"] = 42
+    restored = decode_resolved_model_profile(stored, registered_references=model_service_references())
+    prepared = OpenAIChatAdapter().prepare_http_request(ModelRequest(
+        request_id="degree", outlet_id=42, config_revision=restored.config_revision,
+        messages=[ModelMessage(semantic_role="user_input", content_parts=[{"type": "text", "text": "hello"}])]), restored)
+    assert prepared.json_body[wire] == value
+    assert prepared.json_body["enable_thinking"] is True
+    assert restored.provenance.provider_metadata["operator_thinking_degree"]["mode"] == mode
+
+
+def test_degree_type_switch_and_reset_remove_only_operator_degree_values():
+    profile, _ = build_outlet_draft(ModelProfilePreviewRequest(
+        provider_info={"base_url": "https://custom.invalid/v1"}, request_model_id="custom-degree",
+        thinking_control="enable_thinking", thinking_mode="effort",
+        parameter_values={"enable_thinking": True, "reasoning_effort": "low"}), "tenant")
+    changed = apply_outlet_patch(profile, ModelOutletPatchRequest(expected_revision=1,
+        thinking_mode="budget_tokens", delete_parameters=["reasoning_effort"],
+        parameter_values={"reasoning_budget_tokens": 1234}))
+    assert "reasoning_effort" not in changed.parameter_values
+    assert changed.parameter_values["reasoning_budget_tokens"] == 1234
+    reset = apply_outlet_patch(changed, ModelOutletPatchRequest(expected_revision=1,
+        thinking_mode="default", delete_parameters=["reasoning_budget_tokens"]))
+    assert reset.parameter_values == {"enable_thinking": True}
+    assert reset.provenance.provider_metadata["operator_thinking_degree"]["mode"] == "default"
+    from nexent.core.model_service.profiles.outlet_storage import encode_resolved_model_profile, decode_resolved_model_profile
+    stored = encode_resolved_model_profile(reset, registered_references=model_service_references())
+    stored["model_id"] = 42
+    reloaded = decode_resolved_model_profile(stored, registered_references=model_service_references())
+    assert reloaded.provenance.provider_metadata["operator_thinking_degree"]["mode"] == "default"
+
+
+def test_registered_profile_budget_mapping_and_limit_are_preserved():
+    profile, _ = build_outlet_draft(ModelProfilePreviewRequest(
+        provider_info={"base_url": "https://dashscope.aliyuncs.com/compatible-mode/v1"},
+        provider_profile={"key": "alibaba-cn", "revision": next(item['revision'] for item in list_atomic_profiles('provider', page_size=100)['items'] if item['key'] == 'alibaba-cn')},
+        request_model_id="qwen3.5-plus", thinking_mode="budget_tokens"), "tenant")
+    rule = next(rule for rule in profile.parameter_rules if rule["key"] == "reasoning_budget_tokens")
+    assert rule["schema"]["maximum"] == 81920
+    assert "minimum" not in rule["schema"]
+    assert rule["api_binding"]["path"] == "/thinking_budget"
+    assert rule["source"]["ref"] == "alibaba_cn_qwen35_plus_thinking_v1"
+
+
+def test_invalid_custom_effort_value_is_rejected():
+    with pytest.raises(ModelOutletValidationError):
+        build_outlet_draft(ModelProfilePreviewRequest(
+            provider_info={"base_url": "https://custom.invalid/v1"}, request_model_id="custom-degree",
+            thinking_control="enable_thinking", thinking_mode="effort",
+            parameter_values={"enable_thinking": True, "reasoning_effort": "invented"}), "tenant")
diff --git a/test/backend/services/test_nl2agent_service.py b/test/backend/services/test_nl2agent_service.py
index 525ca769a4..48b8dedce9 100644
--- a/test/backend/services/test_nl2agent_service.py
+++ b/test/backend/services/test_nl2agent_service.py
@@ -1734,6 +1734,7 @@ async def test_build_run_info_is_ephemeral(mocker):
         "Bearer tenant-token",
     )
 
+    assert run_info.tenant_id == "tenant-a"
     assert run_info.query == "final query"
     assert run_info.agent_config.name == "__nl2agent_runtime__"
     assert run_info.agent_config.context_manager_config.token_threshold == 24000
diff --git a/test/backend/services/test_nl2skill_service.py b/test/backend/services/test_nl2skill_service.py
index 6e337a1a53..61a49f232e 100644
--- a/test/backend/services/test_nl2skill_service.py
+++ b/test/backend/services/test_nl2skill_service.py
@@ -179,6 +179,7 @@ async def test_build_nl2skill_run_info_uses_template_and_request_history(mocker)
         language="en",
     )
 
+    assert result.tenant_id == "tenant"
     assert result.query == "rendered query"
     prompt_loader.assert_called_once()
     assert "complexity" not in prompt_loader.call_args.kwargs
diff --git a/test/backend/services/test_run_model_controls.py b/test/backend/services/test_run_model_controls.py
index 9717a3d498..b99a0010c1 100644
--- a/test/backend/services/test_run_model_controls.py
+++ b/test/backend/services/test_run_model_controls.py
@@ -1,367 +1,88 @@
 # Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
 
-"""Isolated presence, capability and root identity policy tests."""
+"""SU-AC-01/05/07: one preference DTO, preserved selection policy and preflight."""
 
+from types import SimpleNamespace
 from unittest.mock import Mock
 
 import pytest
-from nexent.core.agents.agent_model import AgentConfig, ModelConfig
 from pydantic import ValidationError
 
 from consts.exceptions import ForbiddenError, RunModelControlsError
-from consts.model import (
-    AgentRequest,
-    NL2AgentRunRequest,
-    NL2SkillRunRequest,
-    RuntimeGenerationOverrides,
-)
+from consts.model import AgentRequest, NL2AgentRunRequest, NL2SkillRunRequest, WorkbenchSessionConfig
 from management.services.model import run_controls
 
-EFFORTS = ["none", "minimal", "low", "medium", "high", "xhigh", "max"]
 
-
-def model(**overrides):
-    return ModelConfig(
-        cite_name="selected", model_name="provider-B", url="http://fixture.invalid/B",
-        enable_thinking=True, reasoning_effort="medium", temperature=0.43,
-        top_p=0.78, max_input_tokens=7000, extra_body={"custom": "retained"},
-        reasoning_capability={"status": "supported", "control": "effort", "levels": EFFORTS},
-    ).model_copy(update=overrides)
-
-
-@pytest.mark.parametrize("request_type", [NL2AgentRunRequest, NL2SkillRunRequest])
-def test_omitted_empty_and_null_overlay_preserve_presence(request_type):
-    args = {"query": "create", **({"agent_id": 7} if request_type is NL2AgentRunRequest else {})}
-    assert request_type(**args).generation_config is None
-    assert request_type(**args, generation_config={}).generation_config.model_dump(exclude_unset=True) == {}
-    assert request_type(**args, generation_config=None, model_id=None).model_id is None
-    assert RuntimeGenerationOverrides(thinking_effort="xhigh").model_fields_set == {"thinking_effort"}
-
-
-@pytest.mark.parametrize("field,value", [
-    ("deep_thinking", None), ("deep_thinking", "false"),
-    ("thinking_effort", None), ("thinking_effort", "invalid"),
-    ("reasoning_budget_tokens", None), ("reasoning_budget_tokens", True),
-    ("reasoning_budget_tokens", -1), ("reasoning_budget_tokens", 1.1),
-    ("temperature", 50), ("top_p", 90),
+@pytest.mark.parametrize("dto,required", [
+    (AgentRequest, {"query": "fixture"}),
+    (NL2AgentRunRequest, {"query": "fixture", "agent_id": 7}),
+    (NL2SkillRunRequest, {"query": "fixture"}),
 ])
-def test_invalid_partial_controls_are_rejected(field, value):
+def test_su_ac_01_same_preferences_for_all_agent_entrypoints(dto, required):
+    values = {"42": {"temperature": 0, "top_p": 1, "enable_thinking": False}}
+    request = dto(**required, model_id=42, model_parameter_preferences=values)
+    assert request.model_parameter_preferences == values
+    assert not hasattr(request, "generation_config")
+    assert not hasattr(request, "reasoning_effort")
+    assert dto(**required).model_parameter_preferences == {}
+
+
+@pytest.mark.parametrize("dto,required", [(AgentRequest, {"query": "fixture"}),
+    (NL2AgentRunRequest, {"query": "fixture", "agent_id": 7}), (NL2SkillRunRequest, {"query": "fixture"})])
+@pytest.mark.parametrize("old", ["generation_config", "reasoning_effort", "reasoning_budget_tokens"])
+def test_su_ac_07_removed_request_contract_is_rejected_not_silently_ignored(dto, required, old):
+    with pytest.raises(ValidationError, match="model_parameter_preferences"):
+        dto(**required, **{old: {} if old == "generation_config" else 1})
+
+
+def test_su_ac_01_workbench_only_owns_selection_and_resources():
+    config = WorkbenchSessionConfig(mode="generic_chat", requested_output_tokens=100)
+    assert config.schema_version == 4
+    assert config.requested_output_tokens == 100
+    assert "generation_config" not in config.model_dump()
     with pytest.raises(ValidationError):
-        RuntimeGenerationOverrides(**{field: value})
-
-
-def test_snapshot_and_legacy_fields_have_one_authority():
-    request = NL2SkillRunRequest(query="create", workbench_config={
-        "model_id": 8, "generation_config": {"deep_thinking": True, "thinking_effort": "xhigh"},
-    }, reasoning_effort="xhigh")
-    assert request.model_id == 8
-    assert request.generation_config.model_dump(exclude_unset=True) == {
-        "deep_thinking": True, "thinking_effort": "xhigh",
-    }
-    for conflicting in [{"model_id": 9}, {"generation_config": {"thinking_effort": "high"}},
-                        {"reasoning_effort": "high"}]:
-        with pytest.raises(ValidationError, match="conflicting"):
-            NL2SkillRunRequest(query="create", workbench_config=request.workbench_config, **conflicting)
-
+        WorkbenchSessionConfig(mode="generic_chat", generation_config={"temperature": 1})
 
-@pytest.mark.parametrize("effort", EFFORTS + ["auto"])
-def test_exact_effort_or_auto_inherits_immutable_base(effort):
-    base = model()
-    result = run_controls.overlay_root_model(base, {"deep_thinking": True, "thinking_effort": effort}, "root")
-    assert result.reasoning_effort == ("medium" if effort == "auto" else effort)
-    assert (result.temperature, result.top_p, result.max_input_tokens) == (0.43, 0.78, 7000)
-    assert base.reasoning_effort == "medium" and base.cite_name == "selected"
-    assert result.extra_body == {"custom": "retained", "enable_thinking": True}
 
+@pytest.mark.parametrize("record,code", [(None, "model_not_available"),
+    ({"delete_flag": "Y"}, "model_not_available"),
+    ({"model_type": "embedding"}, "model_type_invalid"),
+    ({"connect_status": "unavailable"}, "model_unavailable")])
+def test_su_ac_05_rejects_unavailable_model(record, code):
+    with pytest.raises(RunModelControlsError) as raised:
+        run_controls.validate_selected_record(record)
+    assert raised.value.code == code
 
-def test_partial_fields_do_not_enable_thinking_and_off_clears_active_controls():
-    base = model(enable_thinking=False)
-    result = run_controls.overlay_root_model(base, {"thinking_effort": "xhigh"}, "root")
-    assert result.enable_thinking is False and result.reasoning_effort is None
-    result = run_controls.overlay_root_model(model(), {"deep_thinking": False, "thinking_effort": "max"}, "root")
-    assert result.enable_thinking is False and result.reasoning_effort is None and result.reasoning_budget_tokens is None
-    unchanged = run_controls.overlay_root_model(model(), {}, "root")
-    assert unchanged.reasoning_effort == "medium" and unchanged.extra_body == {"custom": "retained"}
 
+def test_su_ac_05_selected_model_is_resolved_with_tenant(monkeypatch):
+    lookup = Mock(return_value={"model_id": 42, "model_type": "llm", "connect_status": "available"})
+    monkeypatch.setattr(run_controls, "get_model_by_model_id", lookup)
+    assert run_controls.validate_selected_model(42, "tenant")["model_id"] == 42
+    lookup.assert_called_once_with(42, "tenant")
 
-@pytest.mark.parametrize("budget,expected", [(0, 2048), (1024, 1024), (8192, 8192)])
-def test_budget_range_and_zero_auto_keep_sampling(budget, expected):
-    base = model(reasoning_budget_tokens=2048, reasoning_capability={
-        "status": "supported", "controls": [{"type": "budget_tokens", "min": 1024, "max": 8192}],
-    })
-    result = run_controls.overlay_root_model(base, {"reasoning_budget_tokens": budget}, "root")
-    assert result.reasoning_budget_tokens == expected and result.reasoning_effort is None
-    assert result.temperature == base.temperature and result.top_p == base.top_p
-    for invalid in [1, 9000]:
-        with pytest.raises(RunModelControlsError):
-            run_controls.overlay_root_model(base, {"reasoning_budget_tokens": invalid}, "root")
 
-
-def test_unknown_capability_conflicts_and_model_errors_fail_closed(mocker):
-    for values in [{"deep_thinking": True}, {"deep_thinking": True, "thinking_effort": "xhigh"}]:
-        with pytest.raises(RunModelControlsError):
-            run_controls.overlay_root_model(model(reasoning_capability=None), values, "root")
-    with pytest.raises(RunModelControlsError):
-        run_controls.overlay_root_model(model(), {"thinking_effort": "high", "reasoning_budget_tokens": 2000}, "root")
-    for record, code in [(None, "model_not_available"), ({"delete_flag": "Y"}, "model_not_available"),
-                         ({"model_type": "embedding"}, "model_type_invalid"),
-                         ({"connect_status": "Unavailable"}, "model_unavailable")]:
-        lookup = mocker.patch.object(run_controls, "get_model_by_model_id", return_value=record)
-        with pytest.raises(RunModelControlsError, match=code):
-            run_controls.validate_selected_model(9, "current-tenant")
-        lookup.assert_called_once_with(9, "current-tenant")
-
-
-def test_creator_alias_preserves_independent_models_and_real_record(mocker):
-    base = model()
-    independent = model(cite_name="business", model_name="independent")
-    agent = AgentConfig(name="creator", model_name="main_model", tools=[], description="")
-    record = {"model_id": 9, "display_name": "selected", "model_type": "llm", "connect_status": "Available",
-              "model_repo": "", "model_name": "provider-B", "base_url": base.url,
-              "temperature": 0.43, "top_p": 0.78, "max_input_tokens": 7000,
-              "extra_params": {"enable_thinking": True, "reasoning_effort": "medium"}}
-    from agents import create_agent_info
-    mocker.patch.object(create_agent_info, "_resolve_reasoning_capability", return_value=base.reasoning_capability)
-    mocker.patch.object(run_controls, "get_model_by_model_id", return_value=record)
-    models = [base, independent]
-    result = run_controls.resolve_creator_model(models, agent, "tenant", 9, {"deep_thinking": True}, {})
-    assert result == record and agent.model_name == "creator_root_model"
-    assert models[-1].url == base.url and models[-1].model_name == base.model_name
-    assert models[-1].max_input_tokens == 7000
-    assert independent.model_name == "independent" and base.cite_name == "selected"
-
-
-@pytest.mark.parametrize("version_no,current,expected", [(3, 7, 3), (None, 7, 7), (None, None, 0)])
-def test_native_selection_preserves_agent_version_and_tenant(mocker, version_no, current, expected):
-    request = AgentRequest(agent_id=42, query="fixture", model_id=9, version_no=version_no)
-    catalog = mocker.patch.object(run_controls, "validate_selected_model")
-    published = mocker.patch("database.agent_db.query_current_version_no", return_value=current)
-    lookup = Mock(return_value={"model_ids": [9]})
-    run_controls.validate_agent_model_selection(request, "tenant", lookup)
-    catalog.assert_called_once_with(9, "tenant")
-    lookup.assert_called_once_with(agent_id=42, tenant_id="tenant", version_no=expected)
-    if version_no is None:
-        published.assert_called_once_with(42, "tenant")
+@pytest.mark.parametrize("is_debug,entrypoint,allowed", [(False, None, False), (True, None, True), (False, "workbench", True)])
+def test_su_ac_05_preserves_agent_model_scope(monkeypatch, is_debug, entrypoint, allowed):
+    monkeypatch.setattr(run_controls, "validate_selected_model", Mock())
+    monkeypatch.setattr(run_controls, "_agent_record_for_run", Mock(return_value={"model_ids": [41]}))
+    request = SimpleNamespace(model_id=42, workbench=None, entrypoint=entrypoint, is_debug=is_debug, agent_id=7)
+    if allowed:
+        run_controls.validate_agent_model_selection(request, "tenant", Mock())
     else:
-        published.assert_not_called()
-    lookup.return_value = {"model_ids": [1]}
-    with pytest.raises(ForbiddenError, match="not configured"):
-        run_controls.validate_agent_model_selection(request, "tenant", lookup)
-
-
-def test_workbench_and_debug_selection_validate_catalog_without_native_agent_allowlist(mocker):
-    catalog = mocker.patch.object(run_controls, "validate_selected_model")
-    lookup = Mock()
-    for request in (
-        AgentRequest(agent_id=42, query="fixture", model_id=9, is_debug=True),
-        AgentRequest(query="fixture", model_id=1, entrypoint="workbench", workbench={"mode": "generic_chat", "model_id": 9}),
-    ):
-        run_controls.validate_agent_model_selection(request, "tenant", lookup)
-        catalog.assert_called_with(9, "tenant")
-    lookup.assert_not_called()
-    catalog.side_effect = RunModelControlsError("model_unavailable")
-    with pytest.raises(RunModelControlsError, match="model_unavailable"):
-        run_controls.validate_agent_model_selection(request, "tenant", lookup)
-    lookup.assert_not_called()
-
-
-def test_default_run_does_not_lookup_or_preflight_missing_control_intent(mocker):
-    request = AgentRequest(agent_id=42, query="fixture")
-    lookup = Mock()
-    catalog = mocker.patch.object(run_controls, "validate_selected_model")
-    preflight = mocker.patch.object(run_controls, "preflight_turn_controls")
-    run_controls.validate_agent_model_selection(request, "tenant", lookup)
-    run_controls.preflight_agent_turn_controls(request, "tenant", lookup)
-    lookup.assert_not_called()
-    catalog.assert_not_called()
-    preflight.assert_not_called()
-
-
-@pytest.mark.parametrize("intent", [
-    {"model_id": 9}, {"generation_config": {}}, {"reasoning_effort": "auto"},
-    {"reasoning_budget_tokens": 1024}, {"generation_config": {"reasoning_budget_tokens": 0}},
-])
-def test_preflight_preserves_each_explicit_intent_and_entrypoint_defaults(mocker, intent):
-    native = AgentRequest(agent_id=42, query="fixture", version_no=3, **intent)
-    record = {"model_ids": [9], "model_params_override": {"9": {"temperature": 0.43}}}
-    lookup = Mock(return_value=record)
-    preflight = mocker.patch.object(run_controls, "preflight_turn_controls")
-    run_controls.preflight_agent_turn_controls(native, "tenant", lookup)
-    lookup.assert_called_once_with(agent_id=42, tenant_id="tenant", version_no=3)
-    preflight.assert_called_once_with(native, "tenant", record)
-    lookup.reset_mock()
-    workbench = AgentRequest(query="fixture", entrypoint="workbench", workbench={"mode": "generic_chat", "model_id": 9}, **intent)
-    run_controls.preflight_agent_turn_controls(workbench, "tenant", lookup)
-    preflight.assert_called_with(workbench, "tenant", None)
-    lookup.assert_not_called()
-
-
-@pytest.fixture
-def preflight_models(mocker):
-    """Keep catalog/conversion external while executing the actual overlay policy."""
-    from agents import create_agent_info
-
-    catalog = mocker.patch.object(run_controls, "get_model_by_model_id", return_value={"model_id": 9})
-    converted = []
-    roots = []
-
-    def convert(_record):
-        base = model()
-        converted.append(base)
-        return base
-
-    factory = mocker.patch.object(create_agent_info, "create_model_config_from_record", side_effect=convert)
-    overlay = run_controls.overlay_root_model
-
-    def capture(base, values, alias):
-        root = overlay(base, values, alias)
-        roots.append(root)
-        return root
-
-    mocker.patch.object(run_controls, "overlay_root_model", side_effect=capture)
-    return catalog, factory, converted, roots
-
-
-def test_preflight_uses_agent_default_and_overrides_without_mutating_catalog(preflight_models):
-    catalog, factory, bases, roots = preflight_models
-    request = AgentRequest(agent_id=42, query="fixture", generation_config={"thinking_effort": "auto"})
-    record = {"model_ids": [9, 10], "model_params_override": {"9": {"extra_params": {
-        "enable_thinking": True, "reasoning_effort": "high", "reasoning_budget_tokens": None,
-    }}}}
-    run_controls.preflight_turn_controls(request, "tenant", record)
-    catalog.assert_called_once_with(9, "tenant")
-    factory.assert_called_once_with({"model_id": 9})
-    assert roots[0].reasoning_effort == "high"
-    assert roots[0].cite_name == "preflight_root"
-    assert roots[0].temperature == 0.43 and roots[0].top_p == 0.78
-    assert bases[0].cite_name == "selected"
-    assert record["model_ids"] == [9, 10]
-    assert request.model_id is None
-
-
-@pytest.mark.parametrize("default", [{"model_id": 9}, {}, None])
-def test_preflight_resolves_tenant_default_or_rejects_missing_default(mocker, preflight_models, default):
-    from consts.const import MODEL_CONFIG_MAPPING
-    from management.services.configuration.tenant.settings import tenant_config_manager
-
-    catalog, _factory, _bases, roots = preflight_models
-    get_default = mocker.patch.object(tenant_config_manager, "get_model_config", return_value=default)
-    request = AgentRequest(agent_id=42, query="fixture", reasoning_effort="xhigh")
-    if default:
-        run_controls.preflight_turn_controls(request, "tenant")
-        assert roots[0].reasoning_effort == "xhigh"
-        catalog.assert_called_once_with(9, "tenant")
-    else:
-        with pytest.raises(RunModelControlsError, match="model_not_available"):
-            run_controls.preflight_turn_controls(request, "tenant")
-        catalog.assert_not_called()
-    get_default.assert_called_once_with(MODEL_CONFIG_MAPPING["llm"], "tenant")
-
-
-def test_preflight_without_intent_skips_catalog(preflight_models):
-    catalog, factory, _bases, roots = preflight_models
-    run_controls.preflight_turn_controls(AgentRequest(agent_id=42, query="fixture"), "tenant")
-    catalog.assert_not_called()
-    factory.assert_not_called()
-    assert roots == []
-
-
-def test_runtime_snapshot_is_authoritative_and_legacy_conflicts_are_rejected(preflight_models):
-    catalog, _factory, _bases, roots = preflight_models
-    request = AgentRequest(agent_id=42, query="fixture", model_id=9,
-                           generation_config={"thinking_effort": "low"}, reasoning_effort="xhigh")
-    snapshot = {"deep_thinking": True, "thinking_effort": "xhigh"}
-    request.__dict__["_runtime_generation_config"] = snapshot
-    run_controls.preflight_turn_controls(request, "tenant", {"model_params_override": {}})
-    assert roots[0].reasoning_effort == "xhigh"
-    assert snapshot == {"deep_thinking": True, "thinking_effort": "xhigh"}
-    request.__dict__["_runtime_generation_config"] = {"thinking_effort": "high"}
-    with pytest.raises(RunModelControlsError, match="model_controls_invalid"):
+        with pytest.raises(ForbiddenError):
+            run_controls.validate_agent_model_selection(request, "tenant", Mock())
+
+
+def test_su_ac_05_preflight_uses_shared_profile_validation(monkeypatch):
+    from services import conversation_model_preferences_service as service
+    validate = Mock()
+    monkeypatch.setattr(service, "validate_model_preferences", validate)
+    selected = Mock()
+    monkeypatch.setattr(run_controls, "validate_selected_model", selected)
+    request = AgentRequest(query="fixture", model_id=42, model_parameter_preferences={"42": {"temperature": 0}})
+    run_controls.preflight_turn_controls(request, "tenant", {"model_ids": [42]})
+    selected.assert_called_once_with(42, "tenant")
+    validate.assert_called_once_with(request.model_parameter_preferences, "tenant", allowed_model_ids=[42])
+    validate.side_effect = ValueError("invalid preference")
+    with pytest.raises(ValueError, match="invalid preference"):
         run_controls.preflight_turn_controls(request, "tenant")
-    assert len(roots) == 1
-    assert catalog.call_count == 2
-
-
-def test_preflight_legacy_budget_reaches_real_overlay(mocker, preflight_models):
-    _catalog, factory, _bases, roots = preflight_models
-    base = model(reasoning_budget_tokens=2048, reasoning_capability={
-        "status": "supported", "controls": [{"type": "budget_tokens", "min": 1024, "max": 8192}],
-    })
-    factory.side_effect = None
-    factory.return_value = base
-    request = AgentRequest(agent_id=42, query="fixture", model_id=9, reasoning_budget_tokens=4096)
-    run_controls.preflight_turn_controls(request, "tenant")
-    assert roots[0].reasoning_budget_tokens == 4096 and roots[0].reasoning_effort is None
-    assert base.reasoning_budget_tokens == 2048
-
-
-def test_sampling_overlays_preserve_base_and_budget_auto_without_explicit_budget():
-    base = model()
-    for intent in ({"temperature": 0.2, "top_p": 0.8},
-                   {"deep_thinking": False, "temperature": 0.2, "top_p": 0.8}):
-        root = run_controls.overlay_root_model(base, intent, "root")
-        assert root.temperature == 0.2 and root.top_p == 0.8
-        assert base.temperature == 0.43 and base.top_p == 0.78
-    budget = model(reasoning_budget_tokens=2048, reasoning_capability={
-        "status": "supported", "controls": [{"type": "budget_tokens", "min": 1024, "max": 8192}],
-    })
-    root = run_controls.overlay_root_model(budget, {"thinking_effort": "auto"}, "root")
-    assert root.reasoning_budget_tokens == 2048 and root.reasoning_effort is None
-
-
-@pytest.mark.parametrize("capability", [
-    {"status": "supported", "controls": [{"type": "budget_tokens", "min": 1024, "max": 8192}]},
-    {"status": "supported", "controls": [{"type": "effort", "values": ["low"]}]},
-])
-def test_concrete_effort_is_rejected_when_model_does_not_offer_it(capability):
-    with pytest.raises(RunModelControlsError, match="model_controls_invalid"):
-        run_controls.overlay_root_model(model(reasoning_capability=capability), {"thinking_effort": "xhigh"}, "root")
-
-
-@pytest.mark.parametrize("intent", [None, {}, {"thinking_effort": "xhigh"}])
-def test_creator_without_explicit_model_uses_configured_root_or_fails(intent):
-    base = model(cite_name="main_model")
-    agent = AgentConfig(name="creator", model_name="main_model", tools=[], description="")
-    models = [base]
-    assert run_controls.resolve_creator_model(models, agent, "tenant", None, intent, None) == {}
-    if intent:
-        assert agent.model_name == "creator_root_model"
-        assert models[-1].reasoning_effort == "xhigh"
-    else:
-        assert models == [base] and agent.model_name == "main_model"
-    with pytest.raises(RunModelControlsError, match="model_not_available"):
-        run_controls.resolve_creator_model([], agent, "tenant", None, intent, None)
-
-
-def test_creator_explicit_model_never_falls_back_on_failed_conversion(mocker, preflight_models):
-    _catalog, factory, _bases, _roots = preflight_models
-    factory.side_effect = None
-    factory.return_value = None
-    agent = AgentConfig(name="creator", model_name="main_model", tools=[], description="")
-    models = [model(cite_name="main_model")]
-    with pytest.raises(RunModelControlsError, match="model_not_available"):
-        run_controls.resolve_creator_model(models, agent, "tenant", 9, {}, None)
-    assert len(models) == 1 and agent.model_name == "main_model"
-
-
-def test_creator_default_record_keeps_alias_when_no_override(preflight_models):
-    _catalog, factory, _bases, _roots = preflight_models
-    agent = AgentConfig(name="creator", model_name="main_model", tools=[], description="")
-    models = [model(cite_name="main_model")]
-    record = {"model_id": 9}
-    assert run_controls.resolve_creator_model(models, agent, "tenant", None, None, record) == record
-    factory.assert_called_once_with(record)
-    assert len(models) == 1 and agent.model_name == "main_model"
-
-
-@pytest.mark.parametrize("value", ["invalid payload", {"query": "create", "generation_config": "invalid"}])
-def test_creator_dto_rejects_invalid_payload_and_overlay_shapes(value):
-    with pytest.raises(ValidationError):
-        NL2SkillRunRequest.model_validate(value)
-
-
-def test_creator_dto_preserves_typed_overlay_presence_and_ignores_empty_snapshot():
-    overlay = RuntimeGenerationOverrides(thinking_effort="xhigh")
-    request = NL2SkillRunRequest(query="create", generation_config=overlay, workbench_config={"model_id": 9})
-    assert request.generation_config.model_dump(exclude_unset=True) == {"thinking_effort": "xhigh"}
-    assert overlay.model_fields_set == {"thinking_effort"}
diff --git a/test/backend/services/test_sampling_defaults.py b/test/backend/services/test_sampling_defaults.py
index 4bb71ca3f4..998a65e603 100644
--- a/test/backend/services/test_sampling_defaults.py
+++ b/test/backend/services/test_sampling_defaults.py
@@ -7,7 +7,6 @@
 import pytest
 from agents.create_agent_info import create_model_config_from_record
 from management.services.model import management
-from management.services.model.run_controls import overlay_root_model
 
 
 @pytest.mark.parametrize("sampling,expected", [
@@ -27,8 +26,16 @@ async def test_model_list_exposes_effective_sampling_without_filling_stored_fiel
     for key in ("temperature", "top_p"):
         assert result.get(key) == original.get(key)
         assert (key in result) == (key in original)
-    base = create_model_config_from_record(record)
-    inherited = overlay_root_model(base, {"temperature": None, "top_p": None}, "inherited")
+    from consts.exceptions import ModelOutletValidationError
+
+    # Persisted LLM rows must be migrated before runtime use. Anonymous legacy
+    # bindings still preserve the upstream sampling inheritance contract.
+    with pytest.raises(ModelOutletValidationError) as error:
+        create_model_config_from_record(record)
+    assert error.value.category == "PROFILE_MIGRATION_REQUIRED"
+    anonymous = {key: value for key, value in record.items() if key != "model_id"}
+    base = create_model_config_from_record(anonymous)
+    inherited = base
     assert {key: getattr(inherited, key) for key in expected} == expected
     assert inherited.explicit_sampling == []
     assert record == original
diff --git a/test/backend/services/test_sampling_model_controls.py b/test/backend/services/test_sampling_model_controls.py
index 85220cb814..ba5ca9febf 100644
--- a/test/backend/services/test_sampling_model_controls.py
+++ b/test/backend/services/test_sampling_model_controls.py
@@ -1,56 +1,26 @@
 # Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
 
-"""Strict sampling contracts, inheritance and root isolation."""
+"""Strict sampling is checked once against canonical outlet rules."""
 
 import pytest
-from pydantic import ValidationError
-from nexent.core.agents.agent_model import ModelConfig
-
-from consts.model import WorkbenchGenerationConfig, RuntimeGenerationOverrides, NL2SkillRunRequest
-from consts.exceptions import RunModelControlsError
-from management.services.model.run_controls import overlay_root_model
+from consts.exceptions import ModelOutletValidationError
+from services.conversation_model_preferences_service import merge_model_preferences
+from services.model_profile_service import build_outlet_draft
+from test.backend.services.test_model_profile_service import draft_request
 from management.services.agent.stream import sampling_configuration_error_payload, safe_agent_stream_error_chunk
 
 
-@pytest.mark.parametrize('config_type', [WorkbenchGenerationConfig, RuntimeGenerationOverrides])
-@pytest.mark.parametrize('field,maximum', [('temperature', 2), ('top_p', 1)])
-def test_sampling_presence_bounds_and_zero(config_type, field, maximum):
-    assert field not in config_type().model_dump(exclude_unset=True)
-    for value in [0, 0.7, maximum]:
-        assert config_type(**{field: value}).model_dump(exclude_unset=True)[field] == value
-    assert config_type(**{field: None}).model_dump(exclude_unset=True)[field] is None
-    for invalid in [-0.1, maximum + 0.1, True, '0.7', float('nan'), float('inf')]:
-        with pytest.raises(ValidationError):
-            config_type(**{field: invalid})
-
-
-def test_creator_sampling_snapshot_has_one_authority():
-    snapshot = {'model_id': 2, 'generation_config': {'temperature': 0, 'top_p': 0.9}}
-    request = NL2SkillRunRequest(query='fixture', workbench_config=snapshot)
-    assert request.generation_config.model_dump(exclude_unset=True) == snapshot['generation_config']
-    for key in ['temperature', 'top_p']:
-        with pytest.raises(ValidationError, match='conflicting'):
-            NL2SkillRunRequest(query='fixture', workbench_config=snapshot, generation_config={key: 0.5})
-    with pytest.raises(ValidationError, match='conflicting'):
-        NL2SkillRunRequest(query='fixture', workbench_config={'generation_config': {'temperature': None}},
-                          generation_config={'temperature': 0.5})
-
-
-def test_sampling_override_is_root_only_and_preserves_other_defaults():
-    base = ModelConfig(cite_name='root',model_name='fixture',url='http://fixture.invalid',temperature=0.7,top_p=0.9,
-                       extra_body={'temperature': 1.5, 'top_p': 1, 'custom': 'retained'})
-    root = overlay_root_model(base, {'temperature': 0}, 'new-root')
-    assert (root.temperature, root.top_p) == (0, 0.9)
-    assert root.explicit_sampling == ['temperature']
-    assert root.extra_body == {'top_p': 1, 'custom': 'retained'}
-    assert base.temperature == 0.7 and base.explicit_sampling == []
-    assert base.extra_body['temperature'] == 1.5
-    inherited = overlay_root_model(base, {'temperature': None, 'top_p': None}, 'reset')
-    assert (inherited.temperature,inherited.top_p) == (0.7,0.9)
-    assert inherited.explicit_sampling == []
-    for invalid in [True,'0.2',-0.1,3,float('nan'),float('inf')]:
-        with pytest.raises(RunModelControlsError):
-            overlay_root_model(base, {'temperature': invalid}, 'invalid')
+@pytest.mark.parametrize("field,maximum", [("temperature", 2), ("top_p", 1)])
+def test_su_ac_05_sampling_presence_bounds_zero_and_explicit_null(field, maximum):
+    profile, _ = build_outlet_draft(draft_request(), "tenant")
+    data = profile.model_dump()
+    next(rule for rule in data["parameter_rules"] if rule["key"] == field)["schema"].update(minimum=0, maximum=maximum)
+    profile = type(profile).model_validate(data)
+    for value in [0, 0.7, maximum, None]:
+        assert merge_model_preferences(profile, {field: value}).parameter_values[field] == value
+    for invalid in [-0.1, maximum + 0.1, True, "0.7", float("nan"), float("inf")]:
+        with pytest.raises(ModelOutletValidationError):
+            merge_model_preferences(profile, {field: invalid})
 
 
 def test_sampling_errors_are_actionable_and_sanitized_through_wrapped_causes():
diff --git a/test/backend/services/test_tool_configuration_service.py b/test/backend/services/test_tool_configuration_service.py
index 6dc0639a9a..138cd77c7b 100644
--- a/test/backend/services/test_tool_configuration_service.py
+++ b/test/backend/services/test_tool_configuration_service.py
@@ -485,6 +485,11 @@ def validate(self):
 backend_database_client_module = importlib.import_module(
     'backend.database.client')
 sys.modules['backend.database.client'] = backend_database_client_module
+# Tool configuration owns the gateway collaborator, not its model-service internals.
+gateway_stub = types.ModuleType('management.services.model.adapter')
+gateway_stub.get_llm_adapter = MagicMock()
+gateway_stub.get_vlm_adapter = MagicMock()
+sys.modules[gateway_stub.__name__] = gateway_stub
 backend_services_module = importlib.import_module(
     'management.services.tool.configuration')
 # Ensure services package can resolve tool_configuration_service for patching
diff --git a/test/backend/services/test_workbench_creation_history_coverage.py b/test/backend/services/test_workbench_creation_history_coverage.py
index 9655cfd478..5e1bf6ea4e 100644
--- a/test/backend/services/test_workbench_creation_history_coverage.py
+++ b/test/backend/services/test_workbench_creation_history_coverage.py
@@ -6,9 +6,8 @@
 
 def _config(mode="skill_create"):
     return {
-        "schema_version": 3,
+        "schema_version": 4,
         "mode": mode,
-        "generation_config": {"deep_thinking": False},
         "agent_mounts": [],
         "skill_mounts": [],
     }
diff --git a/test/backend/services/test_workbench_creation_history_service.py b/test/backend/services/test_workbench_creation_history_service.py
index 5352a8d829..d43f4aa324 100644
--- a/test/backend/services/test_workbench_creation_history_service.py
+++ b/test/backend/services/test_workbench_creation_history_service.py
@@ -8,9 +8,8 @@
 
 def config(mode):
     return {
-        "schema_version": 3,
+        "schema_version": 4,
         "mode": mode,
-        "generation_config": {"deep_thinking": False},
         "agent_mounts": [],
         "skill_mounts": [],
     }
diff --git a/test/backend/services/test_workbench_knowledge_projection.py b/test/backend/services/test_workbench_knowledge_projection.py
index c07de0f443..c8173f8599 100644
--- a/test/backend/services/test_workbench_knowledge_projection.py
+++ b/test/backend/services/test_workbench_knowledge_projection.py
@@ -12,7 +12,7 @@
 def test_legacy_scope_endpoint_updates_canonical_config_only(mocker):
     """UT-BE-WB-026: legacy PATCH delegates to versioned canonical replacement."""
     canonical = {
-        "schema_version": 3,
+        "schema_version": 4,
         "mode": "single_agent_chat",
         "agent_mounts": [{"agent_id": 7, "version_no": 2}],
         "skill_mounts": [],
@@ -42,7 +42,7 @@ def test_legacy_scope_endpoint_updates_canonical_config_only(mocker):
 def test_legacy_scope_endpoint_rejects_unversioned_or_stale_update(mocker, version):
     """UT-BE-WB-026: stale compatibility clients cannot overwrite v3 scope."""
     mocker.patch.object(service, "get_conversation", return_value={
-        "workbench_config": {"schema_version": 3}, "workbench_config_version": 4,
+        "workbench_config": {"schema_version": 4}, "workbench_config_version": 4,
     })
     replace = mocker.patch.object(service, "update_conversation_workbench_config_service")
     with pytest.raises(WorkbenchConfigVersionConflict):
diff --git a/test/backend/services/test_workbench_service.py b/test/backend/services/test_workbench_service.py
index 6cbdfde0b9..181a0f110d 100644
--- a/test/backend/services/test_workbench_service.py
+++ b/test/backend/services/test_workbench_service.py
@@ -497,17 +497,16 @@ def test_single_agent_uses_tenant_model_on_workbench_root(mocker):
     canonical, plan = workbench_service.resolve_workbench_config(
         WorkbenchSessionConfig(
             mode="single_agent_chat",
-            model_id=13,
             agent_mounts=[{"agent_id": 7, "version_no": 3}],
         ),
         tenant_id="tenant",
     )
 
-    assert canonical.model_id == 13
+    assert "model_id" not in canonical.model_dump()
     assert plan.root.identity.agent_id == 99
     assert [child.agent_id for child in plan.child_mounts] == [7]
-    assert plan.overlay.model_id == 13
-    get_model.assert_called_once_with(13, tenant_id="tenant")
+    assert plan.overlay.model_id is None
+    get_model.assert_not_called()
 
 
 @pytest.mark.parametrize("definitions", [[], [{"tool_id": 4, "author": "tenant", "is_available": False}], [{"tool_id": 4, "author": "other", "is_available": True}]])
diff --git a/test/backend/services/test_workbench_service_coverage.py b/test/backend/services/test_workbench_service_coverage.py
index 29f9eb1802..5ce1c1a2c8 100644
--- a/test/backend/services/test_workbench_service_coverage.py
+++ b/test/backend/services/test_workbench_service_coverage.py
@@ -197,15 +197,10 @@ def test_resolve_workbench_rejects_disabled_system_root(monkeypatch):
         workbench_service.resolve_workbench_config(_config(), tenant_id="tenant-a")
 
 
-def test_resolve_workbench_rejects_unavailable_model(monkeypatch):
-    _resolve_dependencies(monkeypatch)
-    monkeypatch.setattr(workbench_service, "get_model_by_model_id", lambda *_args, **_kwargs: {})
-    monkeypatch.setattr(workbench_service, "is_model_available", lambda _model: False)
-
-    with pytest.raises(WorkbenchError, match="WORKBENCH_MODEL_NOT_ALLOWED"):
-        workbench_service.resolve_workbench_config(
-            _config(model_id=8), tenant_id="tenant-a"
-        )
+def test_su_ac_07_resource_plan_rejects_a_parallel_model_selection():
+    from pydantic import ValidationError
+    with pytest.raises(ValidationError):
+        _config(model_id=8)
 
 
 def test_capability_preview_rejects_missing_published_version(monkeypatch):
diff --git a/test/sdk/core/model_service/test_backend_turn_overlays.py b/test/sdk/core/model_service/test_backend_turn_overlays.py
new file mode 100644
index 0000000000..14780db60c
--- /dev/null
+++ b/test/sdk/core/model_service/test_backend_turn_overlays.py
@@ -0,0 +1,85 @@
+# Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
+
+"""Turn controls must update the frozen outlet used by the HTTP adapter."""
+
+import pytest
+from types import SimpleNamespace
+
+from nexent.core.agents.agent_model import ModelConfig
+from consts.exceptions import ModelOutletValidationError
+
+from agents.create_agent_info import apply_root_model_preferences
+
+
+@pytest.fixture
+def sampling_profile(openai_profile):
+    data = openai_profile.model_dump()
+    data["parameter_rules"] = [rule for rule in data["parameter_rules"] if rule["key"] != "temperature"]
+    data["parameter_rules"].append({
+        "key": "temperature", "schema": {"type": "number", "minimum": 0, "maximum": 2},
+        "visible": True, "editable": True, "required": False,
+        "allowed_scopes": ["outlet", "conversation"], "ui_group": "sampling", "owner": "provider",
+        "source": {"ref": "controlled_rule", "version": 1},
+        "api_binding": {"path": "/temperature", "transform_ref": "identity_v1", "transform_version": 1}})
+    return openai_profile.__class__.model_validate(data)
+
+
+def configured(profile):
+    return ModelConfig(cite_name="selected", model_name=profile.identity.request_model_id,
+        url=profile.connection.base_url, resolved_profile=profile,
+        enable_thinking=False, reasoning_capability={"status": "supported", "control": "toggle"})
+
+
+def apply_preferences(config, values):
+    connection = config.resolved_profile.connection
+    connection = connection.model_copy(update={"credential_ref": connection.credential_ref.model_copy(update={"model_id": 42})})
+    profile = config.resolved_profile.model_copy(update={"outlet_id": 42, "connection": connection})
+    model = config.model_copy(update={"resolved_profile": profile})
+    models = [model]
+    agent = SimpleNamespace(model_name=model.cite_name)
+    apply_root_model_preferences(models, agent, {"42": values})
+    assert models[0] is model and agent.model_name == models[-1].cite_name
+    return models[-1]
+
+
+@pytest.mark.parametrize("value", [0, 0.4])
+def test_sampling_overlay_changes_request_profile_without_mutating_saved_outlet(sampling_profile, value):
+    openai_profile = sampling_profile
+    original = openai_profile.model_dump()
+    result = apply_preferences(configured(openai_profile), {"temperature": value})
+    assert result.resolved_profile.parameter_values["temperature"] == value
+    assert openai_profile.model_dump() == original
+
+
+def test_thinking_disable_updates_profile_and_clears_dependent_budget(openai_profile):
+    data = openai_profile.model_dump()
+    data["parameter_values"].update(enable_thinking=True, reasoning_budget_tokens=64)
+    original = openai_profile.__class__.model_validate(data)
+    base = configured(original)
+    base.enable_thinking = True
+    base.reasoning_budget_tokens = 64
+    result = apply_preferences(base, {"enable_thinking": False})
+    assert result.resolved_profile.parameter_values["enable_thinking"] is False
+    assert "reasoning_budget_tokens" not in result.resolved_profile.parameter_values
+    assert original.parameter_values["enable_thinking"] is True
+    assert original.parameter_values["reasoning_budget_tokens"] == 64
+
+
+def test_profile_constraints_reject_invalid_sampling_without_mutating_original(sampling_profile):
+    openai_profile = sampling_profile
+    original = openai_profile.model_dump()
+
+    # Global request bounds are checked before narrower outlet declarations.
+    with pytest.raises(ModelOutletValidationError):
+        apply_preferences(configured(openai_profile), {"temperature": 100})
+    assert openai_profile.model_dump() == original
+
+
+def test_profile_sampling_bounds_still_apply_inside_global_request_bounds(sampling_profile):
+    data = sampling_profile.model_dump()
+    next(rule for rule in data["parameter_rules"] if rule["key"] == "temperature")["schema"]["maximum"] = 0.5
+    profile = type(sampling_profile).model_validate(data)
+    original = profile.model_dump()
+    with pytest.raises(ModelOutletValidationError):
+        apply_preferences(configured(profile), {"temperature": 0.6})
+    assert profile.model_dump() == original