Thanks for the fix — and for the thorough plan doc. We reproduced the bug and confirmed your root-cause analysis: codex-acp >= 0.14.0 (zed-industries/codex-acp#251, shipped in v0.14.0, which our migration 008 pins) maps Codex's ImageGenerationEnd to an ACP ToolCallUpdate whose raw_output.result embeds the whole image as base64 (a multi-MB single JSON-RPC message), and Codex often reports status: "generating" on that final event, so the tool call never reaches completed. Sanitizing at the ACP translation boundary is the right place, and the field contract (result_omitted / image.path) lines up with the AionUi frontend PR (iOfficeAI/AionUi#2935). Approach LGTM overall.

Two correctness issues need to be addressed before merge:

1. Oversized base64 still passes through when saved_path is missing

In sanitize_inline_image_result:

let should_omit = obj
    .get("result")
    .and_then(|v| v.as_str())
    .map(|result| saved_path.is_some() && is_probably_inline_image_result(result))
    .unwrap_or(false);

saved_path.is_some() gates the stripping, so whenever Codex did not save the file (older codex versions, interrupted/failed generations), the multi-MB base64 still flows into WebSocket broadcast and SQLite — which is exactly the failure mode #297 describes. Suggestion: strip any oversized inline-image result unconditionally, and let saved_path only decide whether the image { path, mime_type, source } object is added.

Suggested regression test: a ToolCallUpdate whose raw_output has a >64KB iVBORw0KGgo... result but no saved_path — assert result is removed, result_omitted == true, no image object, and the status passes through unchanged.

2. failed status gets overridden to completed

normalize_tool_status returns Completed whenever the sanitized raw_output contains image.path, regardless of the SDK status — so a ToolCallStatus::Failed reported by the agent would be rewritten to completed. Suggestion: only normalize non-terminal statuses, e.g.:

match (image_saved, sdk_status.map(map_sdk_tool_status)) {
    (true, None | Some(AcpToolCallStatus::Pending | AcpToolCallStatus::InProgress)) => {
        Some(AcpToolCallStatus::Completed)
    }
    (_, status) => status,
}

Suggested regression test: status: Failed + saved_path present — assert the event keeps failed and raw_output.status is not rewritten.

Non-blocking: docs/plans/2026-05-19-codex-image-acp-output.md is a 776-line implementation plan. We'd prefer to keep working plans out of the repo — please drop it from the PR (the ARCHITECTURE.zh-CN.md section is enough documentation).

Happy to merge once the two issues above are covered with tests.

Approving — all requested changes are in and CI is green.

Re-verified at head 38f94cd:

• Oversized inline-image result is stripped unconditionally; saved_path only gates the structured image { path, mime_type, source } object.
• normalize_tool_status preserves a terminal failed and only promotes non-terminal statuses to completed.
• The run_acp_image_tool_call_update_persists_finish_without_base64 test now matches the current 7-arg StreamRelay::new signature.
• Full Test suite + Clippy + Format all pass.

Sanitizing at the ACP translation boundary is the right call, and the result_omitted / image.path contract lines up with the AionUi frontend PR (iOfficeAI/AionUi#2935). Thanks @Jassy930 for the careful follow-up — merging can proceed once the frontend PR is ready to go in together.