@aiwg/cli 2026.10.1 → 2026.10.4

package/dist/src/models/model-discovery.js

@@ -1,8 +1,13 @@
+import { signalChild } from '../process/signal-child.mjs';
+import { hasSelectionRelevantConflicts, validateWorkerCatalogDiscovery } from './provider-policy.js';
 import { spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
 import { createInterface } from 'node:readline';
-import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
-import { dirname, join } from 'node:path';
+import { lstat, mkdir, open, readFile, readdir, realpath, rename, writeFile } from 'node:fs/promises';
+import { dirname, join, relative } from 'node:path';
+import { constants } from 'node:fs';
 import { homedir, tmpdir } from 'node:os';
+import { stripVTControlCharacters } from 'node:util';
 export const PROVIDER_DISCOVERY_DECISIONS = {
     claude: {
         provider: 'claude',
@@ -14,8 +19,8 @@ export const PROVIDER_DISCOVERY_DECISIONS = {
     codex: {
         provider: 'codex',
         status: 'native',
-        interface: 'codex app-server model/list',
-        reason: 'The app-server JSON-RPC model/list method returns models available to the current Codex account without running a model turn.',
+        interface: 'codex app-server model/list; codex debug models (version-scoped fixture)',
+        reason: 'The app-server JSON-RPC model/list method returns models available to the current Codex account without running a model turn. The version-scoped codex debug models JSON shape normalizes through the same observation contract.',
         documentation: 'https://developers.openai.com/codex/app-server/',
     },
     copilot: {
@@ -62,9 +67,9 @@ export const PROVIDER_DISCOVERY_DECISIONS = {
     },
     muse: {
         provider: 'muse',
-        status: 'unsupported',
-        interface: null,
-        reason: 'Muse Code is a terminal/CI coding agent with no verified non-interactive model-list command; AIWG does not invent Meta Model API enumeration as Muse Code entitlement.',
+        status: 'native',
+        interface: 'model-catalog JSON rows (~/.local/share/muse/model-catalog/*.json)',
+        reason: 'Bounded model-catalog JSON rows report configured model facts for the current Muse installation without probing model APIs or consuming tokens. Entitlement stays account-scoped and contributor data-use facts remain config-scoped, never row-derived.',
         documentation: 'https://github.com/jmagly/aiwg/blob/main/docs/architecture/adr-muse-provider-target.md',
     },
     opencode: {
@@ -88,6 +93,13 @@ export const PROVIDER_DISCOVERY_DECISIONS = {
         reason: 'OpenHuman profiles accept semantic model hints but expose no standardized local model-list command.',
         documentation: 'https://github.com/roctinam/openhuman',
     },
+    ollama: {
+        provider: 'ollama',
+        status: 'native',
+        interface: 'GET /api/tags on the configured local endpoint',
+        reason: 'The read-only HTTP model-list endpoint reports the locally present models and per-model digests for the configured Ollama server without probing a remote registry or consuming inference tokens. Declared here (roctinam/aiwg#2899, B-OG-09); no fetcher is implemented against this map by this task — see the local-http worker-adapter registry entry and its adapter docstring for what is actually dispatchable today.',
+        documentation: 'https://github.com/ollama/ollama/blob/main/docs/api.md#list-local-models',
+    },
     omp: { provider: 'omp', status: 'native', interface: 'omp models --json --no-extensions',
         reason: 'OMP JSON catalog reports credential-available LLM models; ambient extensions are disabled by default.',
         documentation: 'https://github.com/can1357/oh-my-pi/blob/5964a0f7649275bcde818f20073193fd032451f2/packages/coding-agent/src/commands/models.ts' },
@@ -115,6 +127,12 @@ export const PROVIDER_DISCOVERY_DECISIONS = {
 };
 const DEFAULT_TTL_MS = 24 * 60 * 60 * 1000;
 export function classifyDiscoveryError(message) {
+    message = stripVTControlCharacters(message);
+    if (/\b(?:EROFS|EACCES|EPERM)\b|read-only file system/i.test(message)
+        || (/FileSystem\.open|permission denied|operation not permitted/i.test(message)
+            && /[\\/]opencode[\\/]log[\\/]|[\\/]\.pi[\\/]agent(?:[\\/]|$)/i.test(message))) {
+        return 'environment';
+    }
     if (/(?:401|403|unauth|forbidden|credential|login|required auth)/i.test(message)) {
         return 'authentication';
     }
@@ -128,7 +146,7 @@ const SECRET_ASSIGNMENT = /((?:api[_-]?key|authorization|token|secret|password|c
 const BEARER_SECRET = /(bearer\s+)[A-Za-z0-9._~+/=-]+/gi;
 /** Keep native diagnostics useful without ever echoing credential material. */
 export function redactModelDiscoveryText(value) {
-    return value
+    return stripVTControlCharacters(value)
         .replace(SECRET_ASSIGNMENT, '$1[REDACTED]')
         .replace(BEARER_SECRET, '$1[REDACTED]')
         .slice(0, 4096);
@@ -152,7 +170,7 @@ export const runModelDiscoveryCommand = (command, args, options = {}) => new Pro
     child.stdout.on('data', chunk => { stdout += String(chunk); if (Buffer.byteLength(stdout) > 8 * 1024 * 1024) {
         stdout = '';
         stderr = 'Model catalog exceeded 8 MiB limit';
-        child.kill('SIGKILL');
+        signalChild(child, 'SIGKILL');
         finish(1);
     } });
     child.stderr.on('data', chunk => { stderr = (stderr + String(chunk)).slice(-4096); });
@@ -163,7 +181,7 @@ export const runModelDiscoveryCommand = (command, args, options = {}) => new Pro
     child.on('close', code => finish(code ?? 1));
     const timer = setTimeout(() => {
         stderr = `${stderr}${stderr ? '\n' : ''}${command} timed out`;
-        child.kill();
+        signalChild(child);
         finish(124);
     }, options.timeoutMs ?? 10_000);
 });
@@ -178,7 +196,7 @@ export async function discoverOpenCodeModels(command = 'opencode', runner = runM
         runner(command, ['models', '--pure'], { cwd: tmpdir(), timeoutMs: 15_000 }),
     ]);
     if (result.exitCode !== 0) {
-        const error = result.stderr.trim() || `OpenCode models exited ${result.exitCode}`;
+        const error = redactModelDiscoveryText(result.stderr.trim()) || `OpenCode models exited ${result.exitCode}`;
         return {
             provider: 'opencode',
             source: 'native',
@@ -190,10 +208,16 @@ export async function discoverOpenCodeModels(command = 'opencode', runner = runM
             error,
         };
     }
-    const models = [...new Set(result.stdout.split(/\r?\n/)
-            .map(line => line.trim())
-            .filter(line => /^[a-z0-9][a-z0-9._-]*\/\S+$/i.test(line)))]
-        .map(id => ({ id }));
+    const diagnostics = [];
+    const models = [...new Set(result.stdout.split(/\r?\n/).flatMap((raw, index) => {
+            const line = raw.trim();
+            if (!line)
+                return [];
+            if (/^[a-z0-9][a-z0-9._-]*\/\S+$/i.test(line))
+                return [line];
+            diagnostics.push(`OpenCode models line ${index + 1}: malformed provider/model row`);
+            return [];
+        }))].map(id => ({ id }));
     return {
         provider: 'opencode',
         source: 'native',
@@ -201,8 +225,8 @@ export async function discoverOpenCodeModels(command = 'opencode', runner = runM
         ...(version ? { runtimeVersion: version } : {}),
         accountScope: 'local-runtime',
         models,
-        ...(models.length === 0
-            ? { errorKind: 'invalid-output', error: 'OpenCode returned no normalized provider/model rows.' }
+        ...(diagnostics.length || models.length === 0
+            ? { errorKind: 'invalid-output', error: diagnostics.join('; ') || 'OpenCode returned no normalized provider/model rows.' }
             : {}),
     };
 }
@@ -213,22 +237,33 @@ export async function discoverPiModels(command = 'pi', runner = runModelDiscover
         runner(command, ['--list-models'], { cwd: tmpdir(), timeoutMs: 15_000 }),
     ]);
     if (result.exitCode !== 0) {
-        const error = result.stderr.trim() || `Pi --list-models exited ${result.exitCode}`;
+        const error = redactModelDiscoveryText(result.stderr.trim()) || `Pi --list-models exited ${result.exitCode}`;
         return { provider: 'pi', source: 'native', observedAt,
             ...(version ? { runtimeVersion: version } : {}), accountScope: 'local-runtime',
             models: [], errorKind: classifyDiscoveryError(error), error };
     }
-    const lines = result.stdout.split(/\r?\n/).map(line => line.trim()).filter(Boolean);
-    const models = lines.slice(1).flatMap(line => {
+    const diagnostics = [];
+    const lines = result.stdout.split(/\r?\n/);
+    let headerSeen = false;
+    const models = lines.flatMap((raw, index) => {
+        const line = raw.trim();
+        if (!line)
+            return [];
+        if (!headerSeen && /^provider\s+model(?:\s|$)/i.test(line)) {
+            headerSeen = true;
+            return [];
+        }
         const columns = line.split(/\s{2,}/);
-        if (columns.length < 2 || !/^[a-z0-9][a-z0-9._-]*$/i.test(columns[0]))
+        if (columns.length < 2 || !/^[a-z0-9][a-z0-9._-]*$/i.test(columns[0]) || !/^\S+$/.test(columns[1])) {
+            diagnostics.push(`Pi --list-models line ${index + 1}: malformed provider/model row`);
             return [];
+        }
         return [{ id: `${columns[0]}/${columns[1]}` }];
     });
     return { provider: 'pi', source: 'native', observedAt,
         ...(version ? { runtimeVersion: version } : {}), accountScope: 'local-runtime', models,
-        ...(models.length === 0 ? { errorKind: 'invalid-output',
-            error: 'Pi returned no parseable provider/model rows.' } : {}) };
+        ...(diagnostics.length || models.length === 0 ? { errorKind: 'invalid-output',
+            error: diagnostics.join('; ') || 'Pi returned no parseable provider/model rows.' } : {}) };
 }
 export async function discoverOpenClawModels(command = 'openclaw', runner = runModelDiscoveryCommand) {
     const observedAt = new Date().toISOString();
@@ -237,7 +272,7 @@ export async function discoverOpenClawModels(command = 'openclaw', runner = runM
         runner(command, ['models', 'list', '--json'], { timeoutMs: 15_000 }),
     ]);
     if (result.exitCode !== 0) {
-        const error = result.stderr.trim() || `OpenClaw models list exited ${result.exitCode}`;
+        const error = redactModelDiscoveryText(result.stderr.trim()) || `OpenClaw models list exited ${result.exitCode}`;
         return {
             provider: 'openclaw',
             source: 'native',
@@ -251,13 +286,25 @@ export async function discoverOpenClawModels(command = 'openclaw', runner = runM
     }
     try {
         const payload = JSON.parse(result.stdout);
-        const models = (payload.models ?? []).flatMap(model => typeof model.key === 'string' && model.key.includes('/') && model.available !== false
-            ? [{
+        if (!Array.isArray(payload?.models))
+            throw new Error('expected /models array');
+        const diagnostics = [];
+        const models = payload.models.flatMap((model, index) => {
+            if (!model || typeof model !== 'object' || Array.isArray(model)
+                || typeof model.key !== 'string' || !/^[^\s/]+\/\S+$/.test(model.key)
+                || (model.available !== undefined && typeof model.available !== 'boolean')
+                || (model.name !== undefined && typeof model.name !== 'string')
+                || (model.tags !== undefined && (!Array.isArray(model.tags) || model.tags.some((tag) => typeof tag !== 'string')))) {
+                diagnostics.push(`OpenClaw /models/${index}: malformed model row`);
+                return [];
+            }
+            return model.available !== false ? [{
                     id: model.key,
                     ...(typeof model.name === 'string' ? { displayName: model.name } : {}),
                     isDefault: Array.isArray(model.tags) && model.tags.includes('default'),
                 }]
-            : []);
+                : [];
+        });
         return {
             provider: 'openclaw',
             source: 'native',
@@ -265,8 +312,8 @@ export async function discoverOpenClawModels(command = 'openclaw', runner = runM
             ...(version ? { runtimeVersion: version } : {}),
             accountScope: 'local-runtime',
             models,
-            ...(models.length === 0
-                ? { errorKind: 'invalid-output', error: 'OpenClaw returned no normalized model keys.' }
+            ...(diagnostics.length || models.length === 0
+                ? { errorKind: 'invalid-output', error: diagnostics.join('; ') || 'OpenClaw returned no normalized model keys.' }
                 : {}),
         };
     }
@@ -294,6 +341,8 @@ async function readCatalog(file) {
         const parsed = JSON.parse(await readFile(file, 'utf8'));
         if (!parsed.version || !parsed.providers || typeof parsed.providers !== 'object')
             return null;
+        if (validateWorkerCatalogDiscovery(parsed.discovery).length)
+            return null;
         return parsed;
     }
     catch {
@@ -328,7 +377,27 @@ const STANDARD_FAMILY = /(?:^|[/:._-])(?:sonnet|terra)(?:$|[/:._[-]|\d)/i;
 export function selectRoleModels(models) {
     // Flagship families are user-elected only (epic #2642): discovery never
     // assigns them to a role, even when the provider marks one as its default.
-    const visible = models.filter(model => !model.hidden && !FLAGSHIP_FAMILY.test(model.id));
+    const visible = models.filter(model => {
+        // Keep the legacy name-based selection only for unenriched providers.
+        const worker = model.worker;
+        return !retirementGuard(null, model).blocked && !model.hidden && !FLAGSHIP_FAMILY.test(model.id)
+            && (!worker || (worker.qualification.status === 'qualified'
+                && worker.visibility === 'listed' && worker.availability === 'accessible'
+                && (worker.lifecycle === 'active' || worker.lifecycle === 'deprecated')
+                && worker.effortSupport !== 'unknown' && !hasSelectionRelevantConflicts(worker)));
+    });
+    if (visible.length === 0)
+        return {};
+    const selected = {};
+    for (const role of ['reasoning', 'coding', 'efficiency']) {
+        const candidates = visible.filter(model => !model.worker || model.worker.qualification.roles.includes(role));
+        const model = rankRoleModels(candidates)[role];
+        if (model)
+            selected[role] = model;
+    }
+    return selected;
+}
+function rankRoleModels(visible) {
     if (visible.length === 0)
         return {};
     const coding = visible.find(model => STANDARD_FAMILY.test(model.id))
@@ -379,6 +448,8 @@ export async function discoverCodexModels(command = 'codex', timeoutMs = 10_000,
         const lines = createInterface({ input: child.stdout });
         let settled = false;
         let stderr = '';
+        const diagnostics = [];
+        let lineNumber = 0;
         let detectedRuntimeVersion = version;
         let timer;
         const finish = (result) => {
@@ -387,10 +458,10 @@ export async function discoverCodexModels(command = 'codex', timeoutMs = 10_000,
             settled = true;
             clearTimeout(timer);
             lines.close();
-            child.kill();
+            signalChild(child);
             resolveDiscovery(result);
         };
-        child.stderr.on('data', chunk => { stderr += String(chunk); });
+        child.stderr.on('data', chunk => { stderr = (stderr + String(chunk)).slice(-4096); });
         child.on('error', error => finish({
             provider: 'codex',
             source: 'native',
@@ -398,14 +469,20 @@ export async function discoverCodexModels(command = 'codex', timeoutMs = 10_000,
             accountScope: 'local-account',
             models: [],
             errorKind: classifyDiscoveryError(error.message),
-            error: error.message,
+            error: redactModelDiscoveryText(error.message),
         }));
         lines.on('line', line => {
+            lineNumber++;
             let message;
             try {
                 message = JSON.parse(line);
             }
             catch {
+                diagnostics.push(`Codex app-server line ${lineNumber}: invalid JSON`);
+                return;
+            }
+            if (!message || typeof message !== 'object') {
+                diagnostics.push(`Codex app-server line ${lineNumber}: expected JSON-RPC object`);
                 return;
             }
             if (message.id === 1 && message.result) {
@@ -425,16 +502,34 @@ export async function discoverCodexModels(command = 'codex', timeoutMs = 10_000,
                 })}\n`);
             }
             if (message.id === 2) {
+                if (!Array.isArray(message.result?.data))
+                    diagnostics.push('Codex model/list /result/data: expected array');
+                if (message.result?.nextCursor)
+                    diagnostics.push('Codex model/list /result/nextCursor: truncated catalog (more pages remain)');
                 const models = Array.isArray(message.result?.data)
-                    ? message.result.data.map((model) => ({
-                        id: String(model.model ?? model.id),
-                        displayName: typeof model.displayName === 'string' ? model.displayName : undefined,
-                        hidden: Boolean(model.hidden),
-                        isDefault: Boolean(model.isDefault),
-                        reasoningEfforts: Array.isArray(model.supportedReasoningEfforts)
-                            ? model.supportedReasoningEfforts.map((effort) => typeof effort === 'string' ? effort : String(effort.reasoningEffort ?? effort.effort ?? effort))
-                            : undefined,
-                    }))
+                    ? message.result.data.flatMap((model, index) => {
+                        const id = model?.model ?? model?.id;
+                        const efforts = model?.supportedReasoningEfforts;
+                        if (!model || typeof model !== 'object' || Array.isArray(model) || typeof id !== 'string' || !id.trim()
+                            || ['hidden', 'isDefault'].some(key => model[key] !== undefined && typeof model[key] !== 'boolean')
+                            || (model.displayName !== undefined && typeof model.displayName !== 'string')
+                            || (efforts !== undefined && (!Array.isArray(efforts) || efforts.some((effort) => {
+                                const value = typeof effort === 'string' ? effort : effort?.reasoningEffort ?? effort?.effort;
+                                return typeof value !== 'string' || !value.trim();
+                            })))) {
+                            diagnostics.push(`Codex model/list /result/data/${index}: malformed model row`);
+                            return [];
+                        }
+                        return [{
+                                id,
+                                displayName: typeof model.displayName === 'string' ? model.displayName : undefined,
+                                hidden: Boolean(model.hidden),
+                                isDefault: Boolean(model.isDefault),
+                                reasoningEfforts: Array.isArray(model.supportedReasoningEfforts)
+                                    ? model.supportedReasoningEfforts.map((effort) => typeof effort === 'string' ? effort : String(effort.reasoningEffort ?? effort.effort ?? effort))
+                                    : undefined,
+                            }];
+                    })
                     : [];
                 finish({
                     provider: 'codex',
@@ -443,7 +538,8 @@ export async function discoverCodexModels(command = 'codex', timeoutMs = 10_000,
                     ...(detectedRuntimeVersion ? { runtimeVersion: detectedRuntimeVersion } : {}),
                     accountScope: 'local-account',
                     models,
-                    ...(message.error ? { error: JSON.stringify(message.error) } : {}),
+                    ...(message.error ? { errorKind: 'command', error: redactModelDiscoveryText(JSON.stringify(message.error)) }
+                        : diagnostics.length ? { errorKind: 'invalid-output', error: diagnostics.join('; ') } : {}),
                 });
             }
         });
@@ -463,7 +559,7 @@ export async function discoverCodexModels(command = 'codex', timeoutMs = 10_000,
             accountScope: 'local-account',
             models: [],
             errorKind: 'timeout',
-            error: `Codex app-server model/list timed out${stderr ? `: ${stderr.trim()}` : ''}`,
+            error: `Codex app-server model/list timed out${stderr ? `: ${redactModelDiscoveryText(stderr.trim())}` : ''}`,
         }), timeoutMs);
     });
 }
@@ -472,7 +568,7 @@ export async function resolveDynamicModelCatalog(options) {
     const homeDir = options.homeDir ?? homedir();
     const cacheFile = options.cacheFile ?? join(homeDir, '.cache/aiwg/model-catalog.v1.json');
     const staticFile = join(options.aiwgRoot, 'agentic/code/providers/model-catalog.v1.json');
-    const signature = inventorySignature(options.inventory) + JSON.stringify({ omp: options.omp, profile: process.env.OMP_PROFILE ?? process.env.PI_PROFILE, config: process.env.PI_CONFIG_DIR, data: process.env.XDG_DATA_HOME, cache: process.env.XDG_CACHE_HOME, agent: process.env.PI_CODING_AGENT_DIR });
+    const signature = inventorySignature(options.inventory) + JSON.stringify({ codex: options.codex, muse: options.muse, omp: options.omp, profile: process.env.OMP_PROFILE ?? process.env.PI_PROFILE, config: process.env.PI_CONFIG_DIR, data: process.env.XDG_DATA_HOME, cache: process.env.XDG_CACHE_HOME, agent: process.env.PI_CODING_AGENT_DIR });
     const staticCatalog = await readCatalog(staticFile);
     if (!staticCatalog)
         throw new Error(`Invalid or missing static model catalog: ${staticFile}`);
@@ -480,6 +576,8 @@ export async function resolveDynamicModelCatalog(options) {
     const cached = useCache ? await readCatalog(cacheFile) : null;
     if (!options.forceRefresh
         && cached
+        && (!options.codex?.accountBinding || cached.discovery?.providers.codex?.accountBinding === options.codex.accountBinding)
+        && (!options.muse?.accountBinding || cached.discovery?.providers.muse?.accountBinding === options.muse.accountBinding)
         && isFresh(cached, now, options.ttlMs ?? DEFAULT_TTL_MS, signature)) {
         return {
             ...cached,
@@ -502,6 +600,7 @@ export async function resolveDynamicModelCatalog(options) {
                 fetchedAt: now.toISOString(),
                 inventorySignature: signature,
                 providers: {},
+                ...(staticCatalog.discovery?.instances ? { instances: staticCatalog.discovery.instances } : {}),
             },
         };
     }
@@ -518,7 +617,7 @@ export async function resolveDynamicModelCatalog(options) {
             if (!response.ok)
                 throw new Error(`HTTP ${response.status}`);
             const remote = await response.json();
-            if (!remote.version || !remote.providers)
+            if (!remote.version || !remote.providers || validateWorkerCatalogDiscovery(remote.discovery).length)
                 throw new Error('invalid catalog shape');
             catalog = remote;
             source = 'remote';
@@ -530,7 +629,12 @@ export async function resolveDynamicModelCatalog(options) {
     }
     const available = new Set(options.inventory.providers.filter(provider => provider.available).map(provider => provider.id));
     const nativeDiscoverers = options.nativeDiscoverers ?? {
-        codex: () => discoverCodexModels(),
+        codex: () => discoverCodexDebugModels(options.codex?.command ?? 'codex', options.runner, {
+            accountBinding: options.codex?.accountBinding, now: options.now,
+        }),
+        muse: () => discoverMuseCatalogModels({
+            ...options.muse, catalogDir: options.muse?.catalogDir ?? join(homeDir, MUSE_CATALOG_DIR), now: options.now,
+        }),
         opencode: () => discoverOpenCodeModels(),
         openclaw: () => discoverOpenClawModels(),
         pi: () => discoverPiModels(),
@@ -546,21 +650,6 @@ export async function resolveDynamicModelCatalog(options) {
         if (discoverer) {
             try {
                 providerDiscovery[provider] = await discoverer();
-                const selected = provider === 'omp' ? {} : selectRoleModels(providerDiscovery[provider].models);
-                const providerCatalog = catalog.providers[provider];
-                if (providerCatalog) {
-                    for (const role of ['reasoning', 'coding', 'efficiency']) {
-                        if (!selected[role])
-                            continue;
-                        providerCatalog.roles[role] = {
-                            ...(providerCatalog.roles[role] ?? {}),
-                            id: selected[role].id,
-                            status: 'active',
-                            observed: true,
-                        };
-                    }
-                    providerCatalog.verifiedAt = providerDiscovery[provider].observedAt.slice(0, 10);
-                }
             }
             catch (error) {
                 providerDiscovery[provider] = {
@@ -571,8 +660,67 @@ export async function resolveDynamicModelCatalog(options) {
                     models: [],
                     errorKind: classifyDiscoveryError(error.message),
                     error: error.message,
+                    accountBinding: provider === 'codex' ? options.codex?.accountBinding : provider === 'muse' ? options.muse?.accountBinding : undefined,
                 };
             }
+            const next = providerDiscovery[provider];
+            if (next.error)
+                next.error = stripVTControlCharacters(next.error);
+            const instanceId = discoveryInstanceId(next);
+            const prior = cached?.discovery?.instances?.[instanceId]
+                ?? cached?.discovery?.providers[provider];
+            if (prior)
+                providerDiscovery[provider] = mergeProviderDiscovery(prior, next);
+            const entry = providerDiscovery[provider];
+            if (entry.errorKind && prior && prior.accountBinding === next.accountBinding
+                && cached?.providers[provider])
+                catalog.providers[provider] = structuredClone(cached.providers[provider]);
+            const providerCatalog = catalog.providers[provider];
+            const preservePins = provider === 'omp' || entry.models.some(model => model.worker)
+                || prior?.models.some(model => model.worker);
+            if (!next.errorKind && prior && prior.accountBinding === next.accountBinding
+                && prior.accountScope === next.accountScope) {
+                for (const role of Object.values(providerCatalog?.roles ?? {})) {
+                    const alreadyUnavailable = Object.values(cached?.providers[provider]?.roles ?? {}).some(previous => previous.id === role.id && previous.status === 'unverified' && previous.observed === false);
+                    if (!(alreadyUnavailable || (preservePins && prior.models.some(model => model.id === role.id)))
+                        || entry.models.some(model => model.id === role.id))
+                        continue;
+                    const guard = retirementGuard(role.id);
+                    role.status = 'unverified';
+                    role.observed = false;
+                    entry.policy ??= { layers: [], selected: {}, constraints: [], diagnostics: [] };
+                    if (!entry.policy.diagnostics.includes(guard.reason))
+                        entry.policy.diagnostics.push(guard.reason);
+                }
+            }
+            for (const model of entry.models) {
+                if (!model.worker)
+                    continue;
+                const pinnedRoles = Object.values(providerCatalog?.roles ?? {}).filter(role => role.id === model.id);
+                const guard = retirementGuard(pinnedRoles.length ? model.id : null, model);
+                if (guard.blocked) {
+                    for (const role of pinnedRoles)
+                        role.status = 'unverified';
+                    entry.policy ??= { layers: [], selected: {}, constraints: [], diagnostics: [] };
+                    if (!entry.policy.diagnostics.includes(guard.reason))
+                        entry.policy.diagnostics.push(guard.reason);
+                }
+            }
+            if (providerCatalog) {
+                // Observations are facts, not approval to adopt a model. Preserve pins.
+                const selected = preservePins || entry.errorKind ? {}
+                    : selectRoleModels(entry.models);
+                for (const role of ['reasoning', 'coding', 'efficiency']) {
+                    if (!selected[role])
+                        continue;
+                    providerCatalog.roles[role] = {
+                        ...(providerCatalog.roles[role] ?? {}), id: selected[role].id,
+                        status: 'active', observed: true,
+                    };
+                }
+                if (Object.keys(selected).length)
+                    providerCatalog.verifiedAt = entry.observedAt.slice(0, 10);
+            }
         }
         else {
             const decision = PROVIDER_DISCOVERY_DECISIONS[provider];
@@ -588,7 +736,7 @@ export async function resolveDynamicModelCatalog(options) {
             };
         }
     }
-    const resolved = {
+    let resolved = {
         ...catalog,
         discovery: {
             source,
@@ -597,8 +745,12 @@ export async function resolveDynamicModelCatalog(options) {
             ...(remoteError ? { remoteError } : {}),
             inventorySignature: signature,
             providers: providerDiscovery,
+            instances: { ...cached?.discovery?.instances, ...catalog.discovery?.instances },
         },
     };
+    for (const entry of Object.values(providerDiscovery)) {
+        resolved = recordAccountInstance(resolved, discoveryInstanceId(entry), entry);
+    }
     await atomicWrite(cacheFile, `${JSON.stringify(resolved, null, 2)}\n`);
     return resolved;
 }
@@ -616,10 +768,19 @@ export async function discoverOmpModels(command = 'omp', runner = runModelDiscov
         if (result.exitCode !== 0)
             return { ...base, errorKind: result.exitCode === 124 ? 'timeout' : /unknown|unsupported|not found/i.test(result.stderr) ? 'unsupported' : classifyDiscoveryError(result.stderr), error: 'OMP model discovery failed; check CLI version, selected profile/config, and credential availability.' };
         const payload = JSON.parse(result.stdout);
-        if (!Array.isArray(payload.models) || payload.models.some((m) => !m || typeof m.id !== 'string' || !m.id || typeof m.provider !== 'string' || !m.provider))
-            throw new Error('shape');
-        base.models = payload.models.map((m) => ({ id: `${m.provider}/${m.id}`, llmProvider: m.provider, displayName: m.name, reasoningEfforts: Array.isArray(m.thinking) ? m.thinking : undefined }));
-        return base;
+        if (!Array.isArray(payload?.models))
+            return { ...base, errorKind: 'invalid-output', error: 'OMP /models: expected array' };
+        const diagnostics = [];
+        base.models = payload.models.flatMap((m, index) => {
+            if (!m || typeof m.id !== 'string' || !m.id.trim() || typeof m.provider !== 'string' || !m.provider.trim()
+                || (m.name !== undefined && typeof m.name !== 'string')
+                || (m.thinking !== undefined && (!Array.isArray(m.thinking) || m.thinking.some((effort) => typeof effort !== 'string')))) {
+                diagnostics.push(`OMP /models/${index}: malformed model row`);
+                return [];
+            }
+            return [{ id: `${m.provider}/${m.id}`, llmProvider: m.provider, displayName: m.name, reasoningEfforts: m.thinking }];
+        });
+        return { ...base, ...(diagnostics.length ? { errorKind: 'invalid-output', error: diagnostics.join('; ') } : {}) };
     }
     catch {
         return { ...base, errorKind: 'invalid-output', error: 'OMP returned invalid model catalog JSON or discovery could not run.' };
@@ -634,4 +795,707 @@ export function resolveOmpRoleModel(catalog, role, mappings, explicit) {
         throw new Error(`OMP ${role} model unavailable; configure a model from omp models --json or supply an explicit model.`);
     return id;
 }
+/**
+ * B-OG-03 shared discovery refinements (S1 direct/shared checkpoint).
+ *
+ * Codex `debug models` JSON and Muse model-catalog rows normalize through one
+ * observation contract: per-CLI sources, field provenance, coherent snapshots
+ * and freshness. Native and bridged MCP use identical facts. Synthetic fixture
+ * copies under test fixtures exercise these paths; synthetic seeds never ship
+ * as defaults.
+ */
+/** Evidence dated beyond this skew past now is rejected, never trusted. */
+export const MAX_DISCOVERY_CLOCK_SKEW_MS = 5 * 60 * 1000;
+const MUSE_CATALOG_DIR = '.local/share/muse/model-catalog';
+const MAX_MUSE_CATALOG_FILES = 64;
+const MAX_MUSE_CATALOG_BYTES = 1024 * 1024;
+/** Sanitized provenance digest for a normalized evidence entry. */
+export function discoveryDigest(value) {
+    return `sha256:${createHash('sha256').update(value, 'utf8').digest('hex')}`;
+}
+/** True when an evidence timestamp is materially in the future. Unknown/unparseable stays explicit, not future. */
+export function isFutureDated(value, now = new Date(), skewMs = MAX_DISCOVERY_CLOCK_SKEW_MS) {
+    if (typeof value !== 'string')
+        return false;
+    const time = Date.parse(value);
+    return Number.isFinite(time) && time - now.getTime() > skewMs;
+}
+function normalizeVisibility(value) {
+    if (value === true || value === 'listed' || value === 'list' || value === 'visible' || value === 'shown')
+        return 'listed';
+    if (value === false || value === 'hidden')
+        return 'hidden';
+    return 'unknown';
+}
+function normalizeLifecycle(entry) {
+    const lifecycle = entry.lifecycle ?? entry.status ?? entry.state;
+    if (lifecycle === 'retired' || entry.retired === true) {
+        return {
+            lifecycle: 'retired',
+            sunsetAt: typeof entry.sunset_at === 'string' || entry.sunset_at === null ? entry.sunset_at : null,
+            ...(typeof entry.replacement === 'string' && entry.replacement ? { replacementModelId: entry.replacement } : {}),
+        };
+    }
+    if (lifecycle === 'deprecated' || entry.deprecated === true) {
+        return {
+            lifecycle: 'deprecated',
+            sunsetAt: typeof entry.sunset_at === 'string' || entry.sunset_at === null ? entry.sunset_at : null,
+            ...(typeof entry.replacement === 'string' && entry.replacement ? { replacementModelId: entry.replacement } : {}),
+        };
+    }
+    return { lifecycle: 'active', sunsetAt: null };
+}
+function normalizePositiveInt(value) {
+    return typeof value === 'number' && Number.isSafeInteger(value) && value >= 1 ? value : null;
+}
+function observationTimestamps(options) {
+    const observedAt = options.observedAt ?? (options.now ?? new Date()).toISOString();
+    return {
+        observedAt,
+        firstObservedAt: options.firstObservedAt ?? observedAt,
+        fetchedAt: options.fetchedAt ?? observedAt,
+    };
+}
+/** Build one explicit observation: unknowns stay unknown, every field carries provenance. */
+export function buildWorkerObservation(options, input) {
+    const { observedAt, firstObservedAt, fetchedAt } = observationTimestamps(options);
+    const releaseDate = input.releaseDate ?? null;
+    const efforts = input.efforts ?? [];
+    const effortSupport = input.effortSupport
+        ?? (efforts.length > 0 ? 'explicit' : 'unknown');
+    const lifecycle = input.lifecycle;
+    const availability = input.availability
+        ?? (lifecycle === 'retired' ? 'unavailable' : 'accessible');
+    const provenanceFields = input.dataUseNote
+        ? [...input.provenanceFields, '/dataUse:unknown(config-scoped)']
+        : input.provenanceFields;
+    const observation = {
+        version: 1,
+        recordId: `${options.cliId}:${input.modelId}:${options.accountBinding ?? options.accountScope}`,
+        cliId: options.cliId,
+        family: input.family,
+        runtimeVersion: options.runtimeVersion,
+        accountScope: options.accountBinding ?? options.accountScope,
+        endpointFingerprint: `local-cli:${options.cliId}`,
+        observedAt,
+        verifiedAt: observedAt,
+        releaseDate,
+        releaseDateKind: releaseDate === null ? 'unknown' : (input.releaseDateKind ?? 'reported'),
+        visibility: input.visibility,
+        availability,
+        lifecycle,
+        sunsetAt: input.sunsetAt ?? null,
+        ...(input.replacementModelId ? { replacementModelId: input.replacementModelId } : {}),
+        contextTokens: input.contextTokens ?? null,
+        maxOutputTokens: input.maxOutputTokens ?? null,
+        modalities: ['text'],
+        efforts: effortSupport === 'explicit' ? efforts : [],
+        effortSupport,
+        pricing: { costClass: 'unknown', billing: 'unknown', currency: 'USD', inputPerMillion: null, outputPerMillion: null },
+        dataUse: { processing: 'unknown', productImprovement: null, retentionDays: null },
+        qualification: { status: 'unqualified', roles: [] },
+        provenance: [],
+        firstObservedAt,
+        fetchedAt,
+        retiredAt: lifecycle === 'retired' ? observedAt : null,
+    };
+    const { provenance: _provenance, observedAt: _observedAt, verifiedAt: _verifiedAt, firstObservedAt: _firstObservedAt, fetchedAt: _fetchedAt, retiredAt: _retiredAt, ...facts } = observation;
+    observation.evidenceDigest = discoveryDigest(JSON.stringify({
+        facts, modelId: input.modelId, source: options.source,
+        sourceEvidence: options.contentDigest ?? observationTimestamps(options),
+    }));
+    observation.provenance = [{
+            fields: [...new Set([...observationPointers(observation).filter(field => field !== '/provenance'),
+                    '/id', '/hidden', '/isDefault', '/reasoningEfforts', ...provenanceFields])],
+            source: `${options.source}${options.pointer ? `#${options.pointer}` : ''}`,
+            kind: 'native', observedAt,
+            digest: discoveryDigest(JSON.stringify(observation)), confidence: 'reported',
+        }];
+    return observation;
+}
+/** Include container and leaf JSON Pointers so explicit unknown/default leaves stay traceable. */
+function observationPointers(value, prefix = '') {
+    if (!value || typeof value !== 'object')
+        return [];
+    return Object.entries(value).flatMap(([key, entry]) => {
+        const pointer = `${prefix}/${key.replace(/~/g, '~0').replace(/\//g, '~1')}`;
+        return [pointer, ...observationPointers(entry, pointer)];
+    });
+}
+function stringList(value) {
+    return Array.isArray(value) ? value.flatMap(entry => {
+        if (typeof entry === 'string')
+            return entry ? [entry] : [];
+        if (entry && typeof entry === 'object' && typeof entry.effort === 'string' && entry.effort)
+            return [entry.effort];
+        return [];
+    }) : [];
+}
+/**
+ * Normalize `codex debug models` JSON (`.models[]` with slug, visibility,
+ * supported_reasoning_levels, default_reasoning_level, context_window).
+ * Observed on Codex 0.160.0; hidden CLI defaults are never treated as eligible.
+ */
+export function normalizeCodexDebugModels(payload, options) {
+    const raw = payload?.models;
+    if (!Array.isArray(raw))
+        return { models: [], diagnostics: [`${options.source}: expected .models[] in codex debug models JSON`] };
+    return normalizeObservationRows(raw, options, 'codex');
+}
+function museEfforts(row) {
+    const variants = row.reasoning_effort_variants;
+    if (!Array.isArray(variants))
+        return [];
+    return [...new Set(variants.flatMap(variant => {
+            if (typeof variant === 'string')
+                return variant ? [variant] : [];
+            if (variant && typeof variant === 'object') {
+                const tier = variant.tier;
+                return typeof tier === 'string' && tier ? [tier] : [];
+            }
+            return [];
+        }))];
+}
+/**
+ * Normalize Muse model-catalog rows (`.rows[]` with model_id, visibility,
+ * is_default, is_current, reasoning_effort_variants[].tier, context_limit,
+ * output_limit, release_date). Contributor data-use facts stay config-scoped
+ * and are never derived from a row's name or default bit.
+ */
+export function normalizeMuseCatalogRows(payload, options) {
+    const rows = Array.isArray(payload) ? payload
+        : Array.isArray(payload?.rows) ? payload.rows : [];
+    if (!rows.length)
+        return { models: [], diagnostics: [`${options.source}: expected .rows[] in Muse model-catalog JSON`] };
+    return normalizeObservationRows(rows, options, 'muse');
+}
+function validDate(value) {
+    return typeof value === 'string' && /^\d{4}-\d{2}-\d{2}$/.test(value)
+        && Number.isFinite(Date.parse(value)) && new Date(value).toISOString().slice(0, 10) === value;
+}
+function validTimestamp(value) {
+    return typeof value === 'string' && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/i.test(value)
+        && validDate(value.slice(0, 10)) && Number.isFinite(Date.parse(value));
+}
+/** Use the active window, capped by the reported maximum, with native headroom. */
+function codexContextTokens(row) {
+    const window = normalizePositiveInt(row.context_window);
+    const maximum = normalizePositiveInt(row.max_context_window);
+    const percent = row.effective_context_window_percent;
+    // A malformed supplied limit must not silently enlarge the qualified window.
+    if (window === null || row.max_context_window != null && maximum === null
+        || percent != null && (typeof percent !== 'number' || !Number.isFinite(percent) || percent <= 0 || percent > 100))
+        return null;
+    return normalizePositiveInt(Math.floor(Math.min(window, maximum ?? window) * (typeof percent === 'number' ? percent : 100) / 100));
+}
+function catalogEfforts(ids, raw) {
+    return ids.map(id => {
+        const entry = Array.isArray(raw) ? raw.find(value => value && typeof value === 'object'
+            && (value.effort ?? value.tier) === id) : undefined;
+        // Conductor-verified Codex/Muse catalog rule (#3083): only ultra is
+        // "Maximum reasoning with automatic task delegation". Prefer that explicit
+        // description when present; other listed levels do not self-delegate.
+        // multi_agent_reasoning_effort/version describe child execution, not which
+        // selected effort activates delegation (e.g. xhigh is not self-delegating).
+        return { id, selfDelegates: id === 'ultra'
+                || typeof entry?.description === 'string' && /automatic task delegation/i.test(entry.description) };
+    });
+}
+function normalizeObservationRows(rows, options, cli) {
+    const diagnostics = [];
+    const models = [];
+    const sourcePointers = new Map();
+    for (const [index, entry] of rows.entries()) {
+        const rowOptions = options.rowOptions?.[index] ?? options;
+        const now = rowOptions.now ?? new Date();
+        const sourceOptions = { ...rowOptions, pointer: rowOptions.pointer ?? `/${cli === 'muse' ? 'rows' : 'models'}/${index}` };
+        const source = `${sourceOptions.source}#${sourceOptions.pointer}`;
+        if (!entry || typeof entry !== 'object' || Array.isArray(entry)) {
+            diagnostics.push(`${source}: skipped non-object model entry`);
+            continue;
+        }
+        const row = entry;
+        const id = cli === 'muse' ? row.model_id : row.slug;
+        if (typeof id !== 'string' || !id.trim()) {
+            diagnostics.push(`${source}: skipped entry without a ${cli === 'muse' ? 'model_id' : 'slug'}`);
+            continue;
+        }
+        const times = observationTimestamps(sourceOptions);
+        for (const field of [...(cli === 'muse' ? ['context_limit'] : ['context_window', 'max_context_window']), 'output_limit']) {
+            if (row[field] != null && (typeof row[field] !== 'number' || !Number.isSafeInteger(row[field]) || row[field] < 1)) {
+                diagnostics.push(`${source}: malformed ${field} for ${id}; retained as unknown`);
+                // Do not round or coerce malformed evidence into a valid observation.
+            }
+        }
+        if (cli === 'codex' && row.effective_context_window_percent != null
+            && (typeof row.effective_context_window_percent !== 'number' || !Number.isFinite(row.effective_context_window_percent)
+                || row.effective_context_window_percent <= 0 || row.effective_context_window_percent > 100)) {
+            diagnostics.push(`${source}: malformed effective_context_window_percent for ${id}; context retained as unknown`);
+        }
+        for (const field of ['is_default', 'is_current', 'retired', 'deprecated']) {
+            if (row[field] != null && typeof row[field] !== 'boolean')
+                diagnostics.push(`${source}: malformed ${field} for ${id}`);
+        }
+        const effortField = cli === 'muse' ? 'reasoning_effort_variants' : 'supported_reasoning_levels';
+        const rawEfforts = row[effortField];
+        if (rawEfforts != null) {
+            if (!Array.isArray(rawEfforts))
+                diagnostics.push(`${source}/${effortField}: expected effort array`);
+            else
+                for (const [effortIndex, effort] of rawEfforts.entries()) {
+                    const value = typeof effort === 'string' ? effort : effort?.[cli === 'muse' ? 'tier' : 'effort'];
+                    if (typeof value !== 'string' || !value.trim())
+                        diagnostics.push(`${source}/${effortField}/${effortIndex}: malformed effort`);
+                }
+        }
+        if (row.default_reasoning_level != null && (typeof row.default_reasoning_level !== 'string' || !row.default_reasoning_level.trim())) {
+            diagnostics.push(`${source}: malformed default_reasoning_level for ${id}`);
+        }
+        let invalidTime = false;
+        for (const [field, value] of Object.entries(times)) {
+            if (!validTimestamp(value) || isFutureDated(value, now)) {
+                diagnostics.push(`${source}: ${field} is unknown (invalid or future-dated evidence); rejected ${id}`);
+                invalidTime = true;
+            }
+        }
+        if (invalidTime)
+            continue;
+        let releaseDate = null;
+        if (row.release_date !== null && row.release_date !== undefined) {
+            if (!validDate(row.release_date))
+                diagnostics.push(`${source}: malformed release_date for ${id}; retained as unknown`);
+            else if (isFutureDated(row.release_date, now)) {
+                diagnostics.push(`${source}: rejected future-dated release_date for ${id}; date is unknown`);
+                continue;
+            }
+            else
+                releaseDate = row.release_date;
+        }
+        const visibility = normalizeVisibility(row.visibility);
+        const lifecycle = normalizeLifecycle(row);
+        if (row.sunset_at != null && !validTimestamp(row.sunset_at)) {
+            diagnostics.push(`${source}: malformed sunset_at for ${id}; retained as unknown`);
+            lifecycle.sunsetAt = null;
+        }
+        const efforts = cli === 'muse' ? museEfforts(row) : [...new Set([...stringList(row.supported_reasoning_levels),
+                ...(typeof row.default_reasoning_level === 'string' && row.default_reasoning_level ? [row.default_reasoning_level] : [])])];
+        // Codex's registry provider and catalogAdapter contain no inference-provider
+        // identity. Its providerless native catalog is OpenAI; never infer from a slug.
+        // Muse's real local catalogs use provider_id, not provider.
+        const llmProvider = typeof row.provider === 'string' && row.provider ? row.provider
+            : cli === 'muse' && typeof row.provider_id === 'string' && row.provider_id ? row.provider_id
+                : cli === 'codex' ? 'openai' : undefined;
+        const model = {
+            id, apiModelId: typeof row.api_model_id === 'string' ? row.api_model_id : id,
+            ...(llmProvider ? { llmProvider } : {}),
+            ...(visibility === 'unknown' ? {} : { hidden: visibility === 'hidden' }),
+            ...(cli === 'muse' ? { isDefault: row.is_default === true } : {}),
+            ...(efforts.length ? { reasoningEfforts: efforts } : {}),
+            worker: buildWorkerObservation(sourceOptions, {
+                modelId: id, family: typeof row.family === 'string' && row.family ? row.family : cli,
+                visibility, ...lifecycle, releaseDate,
+                availability: lifecycle.lifecycle === 'retired' ? 'unavailable'
+                    : cli === 'muse' ? (row.is_current === true ? 'accessible' : 'unknown') : 'accessible',
+                contextTokens: cli === 'muse' ? normalizePositiveInt(row.context_limit) : codexContextTokens(row),
+                maxOutputTokens: normalizePositiveInt(row.output_limit),
+                efforts: catalogEfforts(efforts, rawEfforts),
+                // The native renderer passes model_reasoning_effort (Muse: --reasoning-effort).
+                effortSupport: efforts.length ? 'explicit' : 'unknown',
+                ...(cli === 'muse' ? { dataUseNote: 'contributor policy is config-scoped' } : {}),
+                provenanceFields: cli === 'muse'
+                    ? ['/id:model_id', '/isDefault:is_default', '/availability:is_current', '/efforts:reasoning_effort_variants[].tier',
+                        '/efforts/selfDelegates:catalog-description+verified-ultra-rule', '/contextTokens:context_limit', '/maxOutputTokens:output_limit', '/releaseDate:release_date']
+                    : ['/id:slug', '/efforts:supported_reasoning_levels+default_reasoning_level',
+                        '/efforts/selfDelegates:catalog-description+verified-ultra-rule',
+                        '/contextTokens:context_window+max_context_window+effective_context_window_percent'],
+            }),
+        };
+        // Bind compatibility-row values without including unrelated credential-bearing row keys.
+        model.worker.provenance[0].fields.push('/apiModelId');
+        if (model.llmProvider)
+            model.worker.provenance[0].fields.push('/llmProvider', `/llmProvider:${typeof row.provider === 'string' && row.provider ? 'provider' : cli === 'muse' ? 'provider_id' : 'codex-openai-default'}`);
+        const compatibility = { id: model.id, apiModelId: model.apiModelId, llmProvider: model.llmProvider, hidden: model.hidden, isDefault: model.isDefault, reasoningEfforts: model.reasoningEfforts };
+        model.worker.evidenceDigest = discoveryDigest(JSON.stringify({
+            workerDigest: model.worker.evidenceDigest, ...compatibility,
+        }));
+        const { provenance: _provenance, ...values } = model.worker;
+        model.worker.provenance[0].digest = discoveryDigest(JSON.stringify({ worker: values, ...compatibility }));
+        sourcePointers.set(model, {
+            visibility: '/visibility', releaseDate: '/release_date', sunsetAt: '/sunset_at', replacementModelId: '/replacement',
+            lifecycle: row.retired === true ? '/retired' : row.deprecated === true ? '/deprecated'
+                : row.lifecycle !== undefined ? '/lifecycle' : row.status !== undefined ? '/status' : '/state',
+            availability: cli === 'muse' ? '/is_current' : '/visibility',
+            efforts: cli === 'muse' ? '/reasoning_effort_variants' : '/supported_reasoning_levels',
+            effortSupport: cli === 'muse' ? '/reasoning_effort_variants' : '/supported_reasoning_levels',
+            contextTokens: cli === 'muse' ? '/context_limit' : '/context_window', maxOutputTokens: '/output_limit', family: '/family',
+        });
+        models.push(model);
+    }
+    return { models: reconcileDuplicateObservations(models, diagnostics, sourcePointers), diagnostics };
+}
+/** Retain every conflicting value and source; never let the first row erase retirement. */
+function reconcileDuplicateObservations(models, diagnostics, sourcePointers) {
+    const groups = new Map();
+    for (const model of models)
+        groups.set(model.id, [...(groups.get(model.id) ?? []), model]);
+    return [...groups.values()].map(group => {
+        if (group.length === 1)
+            return group[0];
+        const model = { ...group[0], worker: { ...group[0].worker } };
+        const worker = model.worker;
+        const fields = ['family', 'visibility', 'lifecycle', 'availability', 'sunsetAt', 'replacementModelId',
+            'efforts', 'effortSupport', 'releaseDate', 'contextTokens', 'maxOutputTokens'];
+        const conflicts = [];
+        for (const field of fields) {
+            const evidence = group.map(m => ({ value: m.worker[field] ?? null,
+                source: m.worker.provenance[0].source, pointer: sourcePointers.get(m)?.[field] ?? `/${field}`,
+                observedAt: m.worker.observedAt, digest: m.worker.provenance[0].digest }));
+            if (new Set(evidence.map(e => JSON.stringify(e.value))).size < 2)
+                continue;
+            conflicts.push({ field: `/${field}`, evidence });
+            diagnostics.push(`${model.id}: conflicting ${field === 'releaseDate' ? 'release_date' : field} values; retained values with individual sources: ${evidence.map(item => item.source).join(', ')}`);
+            switch (field) {
+                case 'lifecycle':
+                    worker.lifecycle = group.some(m => m.worker.lifecycle === 'retired') ? 'retired' : 'unverified';
+                    break;
+                case 'visibility':
+                    worker.visibility = group.some(m => m.worker.visibility === 'hidden') ? 'hidden' : 'unknown';
+                    break;
+                case 'availability':
+                    worker.availability = 'unknown';
+                    break;
+                case 'efforts':
+                case 'effortSupport':
+                    worker.efforts = [];
+                    worker.effortSupport = 'unknown';
+                    break;
+                case 'releaseDate':
+                    worker.releaseDate = null;
+                    worker.releaseDateKind = 'unknown';
+                    break;
+                case 'sunsetAt':
+                case 'contextTokens':
+                case 'maxOutputTokens':
+                    worker[field] = null;
+                    break;
+                case 'replacementModelId':
+                    delete worker.replacementModelId;
+                    break;
+                case 'family':
+                    worker.family = 'unknown';
+                    break;
+            }
+        }
+        // Provider/API identity is selection evidence too. Conflicting rows must
+        // not acquire a qualified route merely because one row appeared first.
+        for (const field of ['apiModelId', 'llmProvider']) {
+            if (new Set(group.map(row => row[field])).size < 2)
+                continue;
+            conflicts.push({ field: `/${field}`, evidence: group.map(row => ({ value: row[field] ?? null,
+                    source: row.worker.provenance[0].source, pointer: field === 'apiModelId' ? '/api_model_id' : '/provider',
+                    observedAt: row.worker.observedAt, digest: row.worker.provenance[0].digest })) });
+            diagnostics.push(`${model.id}: conflicting ${field}`);
+            delete model[field];
+        }
+        // Compatibility defaults also remain evidence rather than silently keeping the first.
+        if (new Set(group.map(m => m.isDefault)).size > 1) {
+            diagnostics.push(`${model.id}: conflicting isDefault values from ${group.map(m => m.worker.provenance[0].source).join(', ')}`);
+            conflicts.push({ field: '/isDefault', evidence: group.map(m => ({ value: m.isDefault ?? null,
+                    source: m.worker.provenance[0].source, pointer: '/is_default',
+                    observedAt: m.worker.observedAt, digest: m.worker.provenance[0].digest })) });
+            model.isDefault = false;
+        }
+        if (worker.lifecycle === 'retired') {
+            worker.availability = 'unavailable';
+            worker.retiredAt = group.find(m => m.worker.lifecycle === 'retired').worker.retiredAt;
+        }
+        model.hidden = worker.visibility === 'hidden';
+        if (worker.visibility === 'unknown')
+            delete model.hidden;
+        model.reasoningEfforts = worker.efforts.map(e => e.id);
+        worker.provenance = group.flatMap(m => m.worker.provenance);
+        worker.evidenceDigest = discoveryDigest(JSON.stringify(group.map(m => m.worker.evidenceDigest)));
+        if (conflicts.length)
+            worker.conflicts = conflicts;
+        const { provenance: _provenance, ...resolved } = worker;
+        worker.provenance.push({ fields: observationPointers(resolved), source: 'src/models/model-discovery.ts#reconcileDuplicateObservations',
+            kind: 'derived', observedAt: worker.observedAt,
+            digest: discoveryDigest(JSON.stringify(resolved)), confidence: 'derived' });
+        return model;
+    });
+}
+/**
+ * Merge a refresh into its prior snapshot. A failed refresh never renews age:
+ * prior models and prior observation time are kept while the new error and
+ * fetch time stay visible. A partial success retains prior-only rows with
+ * their original age; per-model firstObservedAt is the earliest evidence.
+ * A complete success contains exactly the returned identities.
+ */
+export function mergeProviderDiscovery(prior, next) {
+    if (prior.provider !== next.provider || prior.accountBinding !== next.accountBinding
+        || prior.accountScope !== next.accountScope)
+        return next;
+    if (next.errorKind && next.models.length === 0) {
+        return {
+            ...next,
+            models: prior.models,
+            observedAt: prior.observedAt,
+            ...(prior.accountBinding !== undefined ? { accountBinding: prior.accountBinding } : {}),
+        };
+    }
+    const priorById = new Map(prior.models.map(model => [model.id, model]));
+    const seen = new Set();
+    const merged = next.models.map((model) => {
+        seen.add(model.id);
+        const previous = priorById.get(model.id);
+        if (!previous?.worker || !model.worker)
+            return model;
+        if (next.provider === 'muse' && previous.worker.evidenceDigest
+            && previous.worker.evidenceDigest === model.worker.evidenceDigest)
+            return previous;
+        const firstObservedAt = Date.parse(previous.worker.firstObservedAt) < Date.parse(model.worker.firstObservedAt)
+            ? previous.worker.firstObservedAt
+            : model.worker.firstObservedAt;
+        if (firstObservedAt === model.worker.firstObservedAt)
+            return model;
+        return { ...model, worker: {
+                ...model.worker, firstObservedAt,
+                provenance: [
+                    ...model.worker.provenance.map(p => ({ ...p, fields: p.fields.filter(field => field !== '/firstObservedAt') })),
+                    { fields: ['/firstObservedAt'], source: previous.worker.provenance[0].source,
+                        kind: 'derived', observedAt: previous.worker.observedAt,
+                        digest: discoveryDigest(JSON.stringify({ firstObservedAt, evidence: previous.worker.evidenceDigest })), confidence: 'derived' },
+                ],
+            } };
+    });
+    if (next.errorKind) {
+        for (const model of prior.models) {
+            if (!seen.has(model.id))
+                merged.push(model);
+        }
+    }
+    const observedAt = next.errorKind ? prior.observedAt
+        : next.provider === 'muse' && merged.some(model => model.worker)
+            ? merged.flatMap(model => model.worker ? [model.worker.observedAt] : []).sort((a, b) => Date.parse(a) - Date.parse(b))[0]
+            : next.observedAt;
+    return { ...next, observedAt, models: merged };
+}
+/** Retirement blocks dispatch without rewriting pins; replacement is a proposal, never substitution. */
+export function retirementGuard(pinnedId, model) {
+    if (!model && pinnedId)
+        return {
+            blocked: true, pin: pinnedId,
+            reason: `Unavailable model ${pinnedId} is absent from the complete catalog and blocks dispatch; pin is preserved, never rewritten.`,
+        };
+    if (model?.worker?.lifecycle === 'retired') {
+        const replacement = model.worker.supersededBy ?? model.worker.replacementModelId;
+        return {
+            blocked: true,
+            pin: pinnedId,
+            reason: `Retired model ${model.id} blocks dispatch; pin ${pinnedId ?? '(none)'} is preserved, never rewritten`
+                + `${replacement ? ` (suggested replacement ${replacement} requires operator approval)` : ''}.`,
+        };
+    }
+    return { blocked: false, pin: pinnedId };
+}
+/**
+ * Record an account-scoped discovery under `discovery.instances` without
+ * merging account entitlements into the provider projection.
+ */
+function discoveryInstanceId(entry) {
+    return `${entry.provider}:${entry.accountBinding ?? entry.accountScope}`;
+}
+export function recordAccountInstance(catalog, instanceId, entry) {
+    const discovery = catalog.discovery ?? {
+        source: 'static',
+        fetchedAt: entry.observedAt,
+        providers: {},
+    };
+    return {
+        ...catalog,
+        discovery: {
+            ...discovery,
+            instances: { ...(discovery.instances ?? {}), [instanceId]: entry },
+        },
+    };
+}
+/** Run the version-scoped `codex debug models` strategy and normalize its JSON. */
+export async function discoverCodexDebugModels(command = 'codex', runner = runModelDiscoveryCommand, options = {}) {
+    const observedAt = (options.now ?? (() => new Date()))().toISOString();
+    const version = options.runtimeVersion ?? await runtimeVersion(command, runner);
+    const base = {
+        provider: 'codex',
+        source: 'native',
+        observedAt,
+        ...(version ? { runtimeVersion: version } : {}),
+        accountScope: 'local-account',
+        ...(options.accountBinding ? { accountBinding: options.accountBinding } : {}),
+        models: [],
+    };
+    const result = await runner(command, ['debug', 'models'], { cwd: tmpdir(), timeoutMs: 10_000 });
+    if (result.exitCode !== 0) {
+        const error = redactModelDiscoveryText(result.stderr.trim()) || `codex debug models exited ${result.exitCode}`;
+        return { ...base, errorKind: classifyDiscoveryError(error), error };
+    }
+    let payload;
+    try {
+        payload = JSON.parse(result.stdout);
+    }
+    catch (error) {
+        return { ...base, errorKind: 'invalid-output', error: `Invalid codex debug models JSON: ${error.message}` };
+    }
+    const normalized = normalizeCodexDebugModels(payload, {
+        cliId: 'codex',
+        source: `${command} debug models`,
+        runtimeVersion: version ?? 'unknown',
+        accountScope: 'local-account',
+        ...(options.accountBinding ? { accountBinding: options.accountBinding } : {}),
+        observedAt,
+        now: (options.now ?? (() => new Date()))(),
+    });
+    return {
+        ...base,
+        models: normalized.models,
+        ...(normalized.diagnostics.length > 0 || normalized.models.length === 0
+            ? {
+                errorKind: 'invalid-output',
+                error: normalized.diagnostics.join('; ')
+                    || 'codex debug models returned no normalized model rows.',
+            }
+            : {}),
+        policy: { layers: [], selected: {}, constraints: [], diagnostics: normalized.diagnostics },
+    };
+}
+/** Read bounded Muse model-catalog rows. Reads only declared catalog keys, never credential files. */
+export async function discoverMuseCatalogModels(options = {}) {
+    const now = (options.now ?? (() => new Date()))();
+    const catalogDir = options.catalogDir ?? join(homedir(), MUSE_CATALOG_DIR);
+    const base = {
+        provider: 'muse', source: 'native', observedAt: now.toISOString(),
+        ...(options.runtimeVersion ? { runtimeVersion: options.runtimeVersion } : {}),
+        accountScope: 'local-account', ...(options.accountBinding ? { accountBinding: options.accountBinding } : {}), models: [],
+    };
+    const diagnostics = [];
+    const rows = [];
+    const rowOptions = [];
+    const deadline = Date.now() + (options.timeoutMs ?? 5_000);
+    const bounded = async (operation) => {
+        let timer;
+        try {
+            return await Promise.race([operation, new Promise((_resolve, reject) => {
+                    timer = setTimeout(() => reject(new Error('Muse catalog discovery deadline exceeded')), Math.max(0, deadline - Date.now()));
+                })]);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    };
+    try {
+        const root = await bounded(realpath(catalogDir));
+        const files = (await bounded(readdir(root))).filter(file => file.endsWith('.json')).sort();
+        if (!files.length)
+            diagnostics.push(`${root}: holds no JSON rows`);
+        if (files.length > MAX_MUSE_CATALOG_FILES)
+            diagnostics.push(`${join(root, files[MAX_MUSE_CATALOG_FILES])}: exceeds bounded file count; this and remaining files skipped`);
+        for (const file of files.slice(0, MAX_MUSE_CATALOG_FILES)) {
+            if (Date.now() >= deadline) {
+                diagnostics.push(`${join(root, file)}: discovery deadline exceeded; this and remaining files skipped`);
+                break;
+            }
+            const path = join(root, file);
+            try {
+                const link = await bounded(lstat(path));
+                let target = path;
+                if (link.isSymbolicLink()) {
+                    target = await bounded(realpath(path));
+                    const subpath = relative(root, target);
+                    if (subpath === '..' || subpath.startsWith('../'))
+                        throw new Error('symlink escapes catalog directory; regular file required');
+                }
+                else if (!link.isFile())
+                    throw new Error('not a regular file; skipped');
+                const stat = link.isSymbolicLink() ? await bounded(lstat(target)) : link;
+                if (!stat.isFile())
+                    throw new Error('not a regular file; skipped');
+                if (stat.size > MAX_MUSE_CATALOG_BYTES)
+                    throw new Error('exceeds bounded catalog size; skipped before reading');
+                // O_NONBLOCK prevents a stat/open race to a FIFO from blocking. O_NOFOLLOW
+                // rejects a replacement symlink; fstat rechecks the opened descriptor.
+                const pending = open(target, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+                // If open itself outlives the deadline, close any late descriptor.
+                let expired = false;
+                let lateHandle;
+                void pending.then(handle => {
+                    lateHandle = handle;
+                    if (expired)
+                        void handle.close().catch(() => { });
+                }, () => { });
+                const handle = await bounded(pending).catch(error => {
+                    expired = true;
+                    if (lateHandle)
+                        void lateHandle.close().catch(() => { });
+                    throw error;
+                });
+                try {
+                    const opened = await bounded(handle.stat());
+                    if (!opened.isFile())
+                        throw new Error('not a regular file; skipped');
+                    if (opened.size > MAX_MUSE_CATALOG_BYTES)
+                        throw new Error('exceeds bounded catalog size; skipped before reading');
+                    const buffer = Buffer.alloc(MAX_MUSE_CATALOG_BYTES + 1);
+                    let bytes = 0;
+                    while (bytes < buffer.length) {
+                        const result = await bounded(handle.read(buffer, bytes, buffer.length - bytes, bytes));
+                        if (!result.bytesRead)
+                            break;
+                        bytes += result.bytesRead;
+                    }
+                    if (bytes > MAX_MUSE_CATALOG_BYTES)
+                        throw new Error('exceeds bounded catalog size; skipped');
+                    const payload = JSON.parse(buffer.subarray(0, bytes).toString('utf8'));
+                    const fileRows = Array.isArray(payload) ? payload : payload?.rows;
+                    if (!Array.isArray(fileRows))
+                        throw new Error('expected .rows[]; rejected');
+                    const metadata = Array.isArray(payload) ? {} : payload;
+                    // Re-reading a cache does not create new evidence. Prefer its provider
+                    // timestamp, falling back to the file's own modification time.
+                    const evidenceTime = metadata.fetchedAt ?? metadata.fetched_at ?? metadata.refreshedAt ?? metadata.refreshed_at ?? opened.mtime.toISOString();
+                    const normalizedOptions = {
+                        cliId: 'muse', source: path, contentDigest: discoveryDigest(buffer.subarray(0, bytes).toString('utf8')), runtimeVersion: options.runtimeVersion ?? 'unknown',
+                        accountScope: 'local-account', accountBinding: options.accountBinding, now,
+                        observedAt: metadata.observedAt ?? evidenceTime,
+                        fetchedAt: evidenceTime,
+                        firstObservedAt: metadata.firstObservedAt ?? evidenceTime,
+                    };
+                    for (const [index, row] of fileRows.entries()) {
+                        rows.push(row);
+                        rowOptions.push({ ...normalizedOptions, pointer: `/${Array.isArray(payload) ? '' : 'rows/'}${index}` });
+                    }
+                }
+                finally {
+                    await bounded(handle.close());
+                }
+            }
+            catch (error) {
+                diagnostics.push(`${path}: ${error.message}; rejected`);
+            }
+        }
+    }
+    catch (error) {
+        diagnostics.push(`Muse model catalog is unavailable at ${catalogDir}: ${error.message}`);
+    }
+    const normalized = normalizeMuseCatalogRows(rows, {
+        cliId: 'muse', source: catalogDir, runtimeVersion: options.runtimeVersion ?? 'unknown',
+        accountScope: 'local-account', now, rowOptions,
+    });
+    diagnostics.push(...normalized.diagnostics);
+    const observedAt = normalized.models.length
+        ? normalized.models.map(model => model.worker.observedAt).sort((a, b) => Date.parse(a) - Date.parse(b))[0] : base.observedAt;
+    return {
+        ...base, observedAt, models: normalized.models,
+        ...(diagnostics.length || normalized.models.length === 0
+            ? { errorKind: 'invalid-output', error: diagnostics.join('; ') || 'Muse model catalog returned no usable rows.' } : {}),
+        policy: { layers: [], selected: {}, constraints: [], diagnostics },
+    };
+}
 //# sourceMappingURL=model-discovery.js.map