glm-5.3-flash intermittently emits malformed string-encoded tool calls via Ollama Cloud

Summary

When glm-5.3-flash is served through Ollama Cloud with tool calling, it intermittently emits the calls field as a JSON-encoded string instead of the OpenAI-compatible native array. The inner JSON string is also structurally corrupted in ways consistent with one dropped or misplaced token.

Zhipu/Z.ai appears to own the underlying model serialization, but I am filing here because the affected model is served through Ollama Cloud and this is the serving/API path where the malformed tool-call response is observed.

Observed response shapes

The outer tool-call envelope remains valid JSON. The corruption is inside the string-valued calls field.

1. The call entry is left unclosed and its name appears as an outer sibling of calls.
2. The argument object is present, but the tool name appears in a malformed trailing fragment with orphaned closing delimiters.
3. Other nonrecoverable variants include a missing name or a name orphaned outside its entry.

The result is that a client that correctly decodes the outer response cannot parse the inner calls string as JSON.

Evidence and scope

• The failures were observed from glm-5.3-flash via Ollama Cloud across four glm-configured Hermes profiles; a sweep of non-glm profiles found no matching emissions.
• Native-array tool calls succeeded in the same window, including payloads up to 11.4 KB. Failed string-encoded payloads ranged from 98 to 5,543 characters, so this is not a payload-size threshold.
• An identical 4,314-character payload succeeded when emitted as a native array minutes after a malformed string emission.
• The impact is retry latency rather than data loss: clients can request a re-emission as a native array, which has been reliable in the observed corpus.

Expected behavior

calls should be emitted as a native JSON array of {name, arguments} objects. If a string representation is used for compatibility, the embedded value must be syntactically valid JSON and preserve the tool name within the entry.

Actual behavior

calls is intermittently a malformed JSON string that cannot be parsed because a closing delimiter is missing/misplaced and/or the name is emitted outside the tool-call entry.

Temporary client mitigation

We added a narrowly gated client-side compatibility repair only for two fully reconstructable shapes. All other malformed shapes are rejected with a request to re-emit a native array; broad automatic repair would be unsafe.

I can provide sanitized raw response samples and a bracket-stack classification harness if useful.