The plaintext <tool> rescue could turn a failing 2-bit model's repetition
loop (<tool>glob</tool><tool>glob</tool>… / bare names, no args) into a flood
of bogus tool calls. Harden it: reject a batch with >6 <tool> blocks (that's
model degeneration, not many real calls) and drop any bare <tool>name</tool>
that carries no key: value argument (the spam signature). Genuine single/few
calls with arguments still parse; combined with the existing trailing-action,
declared-name, and DeepSeek-only scoping.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>