Risky behavior now covered

• Anthropic native tool search sends the regex tool when the plan kind is regex or toolSearchVariant is regex in any case, and BM25 otherwise.
• cache_control stays off every defer_loading tool. With a mixed catalog it lands on the last eager tool. When every custom tool is deferred and programmatic calling is on, it lands on code_execution and disable_parallel_tool_use is omitted. Programmatic calling also skips askUserQuestion and any schema that contains $ref. Root oneOf is dropped from input_schema while nested $ref / $defs are kept.
• Container reuse stops at an expired container instead of falling through to an older id. A blank explicit container falls through; a padded explicit id wins and is trimmed. Programmatic calling off does not send a container.
• OpenRouter emits openrouter:tool_search and defer_loading. An Anthropic tool-search kind on the OpenAI wire emits neither server tool, defer_loading, nor allowed_callers.
• A 500 or an unrelated 400 that mentions native tool features does not retry and does not change a positive capability cache. A client error that names only tool search or only programmatic calling retries without that feature and leaves the other one cached. A generic tools[n] schema rejection clears both. Anthropic treats tool_search_tool, defer_loading, code_execution, allowed_callers, and container as the feature markers; bare OpenAI tool_search does not disable Anthropic tool search, and container does not disable OpenAI programmatic calling. Aborts, timeouts, and network errors never record a rejection.

Test files added/updated

• crates/cowork-providers/tests/native_tool_wire_edges.rs
• crates/cowork-providers/src/openai_native_rejection_tests.rs
• crates/cowork-providers/src/anthropic_native_rejection_tests.rs
• crates/cowork-providers/src/openai_responses.rs and crates/cowork-providers/src/anthropic_messages.rs only declare those cfg(test) modules

Why these tests materially reduce regression risk

The existing native-tool suite covers the BM25 and OpenAI happy path plus one programmatic 400. The untested edges are the ones that 400 the provider request (cache breakpoint on a deferred tool, parallel tool use during code execution, a stale container, the wrong OpenRouter tool type) or that permanently disable a working feature after a 500 or a single-feature rejection. No production behavior changes.

Validation: cargo test -p cowork-providers --lib native_rejection_tracks_only (2 passed) and cargo test -p cowork-providers --test native_tool_wire_edges (4 passed). cargo fmt -p cowork-providers -- --check and cargo clippy -p cowork-providers --lib --test native_tool_wire_edges -- -D warnings are clean. The full workspace suite was not re-run.