@bitkyc08/opencodex 2.15.1 → 2.16.0

package/src/providers/antigravity-models.ts

@@ -6,8 +6,8 @@ import { isValidModelDiscoveryModelId, MODEL_DISCOVERY_MAX_MODELS } from "./mode
 // CLI resolves labels against. The ids below separate CCA wire ids, collapsed picker entries,
 // and hidden compatibility aliases for saved selections. The CCA envelope's `model` field must
 // receive the wire id (for example "Gemini 3.1 Pro (High)" => gemini-pro-agent), while the
-// picker exposes collapsed base models only when CCA returns every known tier; otherwise each
-// returned wire id remains visible so an unavailable tier cannot be selected.
+// picker exposes collapsed known base models only when CCA returns every known tier; unknown
+// returned wire ids remain visible so they stay directly routable.
 
 // ── Wire IDs (what CCA :fetchAvailableModels returns) ──
 
@@ -63,6 +63,41 @@ const ANTIGRAVITY_WIRE_IDS_BY_PICKER_MODEL: Record<string, string[]> = Object.en
   return out;
 }, {});
 
+const ANTIGRAVITY_DISCOVERY_EFFORTS = ["low", "medium", "high"] as const;
+
+function pickerModelIdForDiscoveredWireId(
+  wireId: string,
+  available: ReadonlyMap<string, Record<string, unknown>>,
+): string {
+  const explicitPickerId = Object.hasOwn(ANTIGRAVITY_PICKER_MODEL_BY_WIRE_ID, wireId)
+    ? ANTIGRAVITY_PICKER_MODEL_BY_WIRE_ID[wireId]
+    : undefined;
+  if (explicitPickerId) {
+    const requiredWireIds = Object.hasOwn(ANTIGRAVITY_WIRE_IDS_BY_PICKER_MODEL, explicitPickerId)
+      ? ANTIGRAVITY_WIRE_IDS_BY_PICKER_MODEL[explicitPickerId] ?? []
+      : [];
+    if (requiredWireIds.every(id => available.has(id))) return explicitPickerId;
+  }
+
+  // CCA uses a single `-tiered` row for models whose effort levels ride on the
+  // request's thinkingLevel field. Keep this generic so new tiered models do not
+  // require another provider-specific ID mapping.
+  if (wireId.endsWith("-tiered")) {
+    const baseId = wireId.slice(0, -"-tiered".length);
+    if (isKnownAntigravityPickerModelId(baseId)) return baseId;
+  }
+
+  const effortMatch = /^(.*)-(low|medium|high)$/.exec(wireId);
+  if (effortMatch) {
+    const baseId = effortMatch[1]!;
+    if (isKnownAntigravityPickerModelId(baseId)
+      && ANTIGRAVITY_DISCOVERY_EFFORTS.every(effort => available.has(`${baseId}-${effort}`))) {
+      return baseId;
+    }
+  }
+  return wireId;
+}
+
 // ── Effort ladders per collapsed base model ──
 // Gemini models: effort → wire model suffix (official agy UI pattern).
 // Claude Opus: effort → thinkingConfig.thinkingLevel (CLIProxyAPI proven pattern).
@@ -141,6 +176,10 @@ export const ANTIGRAVITY_MODELS = [
   "gpt-oss-120b-medium",
 ];
 
+function isKnownAntigravityPickerModelId(value: string): boolean {
+  return isValidModelDiscoveryModelId(value) && ANTIGRAVITY_MODELS.includes(value);
+}
+
 // Context windows from the upstream `:fetchAvailableModels` maxTokens per model.
 const ANTIGRAVITY_WIRE_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
   "gemini-3.7-flash": 1_048_576,
@@ -222,6 +261,7 @@ export function parseAntigravityAvailableModels(
       if (!Array.isArray(modelIds)) return null;
       for (const id of modelIds) {
         if (!isValidModelDiscoveryModelId(id)
+          || !Object.hasOwn(models, id)
           || !antigravityRecord(models[id])
           || ids.length >= limit) return null;
         ids.push(id);
@@ -235,6 +275,19 @@ export function parseAntigravityAvailableModels(
     if (ids.length >= limit) return null;
     ids.push("gemini-3.1-flash-image");
   }
+  // Newer CCA responses identify tiered Flash models through this index instead of
+  // adding their synthetic wire ids to agentModelSorts.
+  const tieredModelIds = antigravityRecord(body.tieredModelIds);
+  const flashTieredIds = tieredModelIds?.flash;
+  if (Array.isArray(flashTieredIds)) {
+    for (const id of flashTieredIds) {
+      if (!isValidModelDiscoveryModelId(id)
+        || !Object.hasOwn(models, id)
+        || !antigravityRecord(models[id])
+        || ids.length >= limit) return null;
+      ids.push(id);
+    }
+  }
 
   const available = new Map<string, Record<string, unknown>>();
   for (const wireId of ids) {
@@ -242,17 +295,17 @@ export function parseAntigravityAvailableModels(
     if (!info || available.has(wireId)) continue;
     // Legacy compatibility aliases are deliberately routed to newer wire ids for saved
     // selections. They are not safe as independently discovered picker rows.
-    if (ANTIGRAVITY_MODEL_ALIASES[wireId] && ANTIGRAVITY_MODEL_ALIASES[wireId] !== wireId) continue;
+    const alias = Object.hasOwn(ANTIGRAVITY_MODEL_ALIASES, wireId)
+      ? ANTIGRAVITY_MODEL_ALIASES[wireId]
+      : undefined;
+    if (alias && alias !== wireId) continue;
     available.set(wireId, info);
   }
 
   const out: AntigravityAvailableModel[] = [];
   const seen = new Set<string>();
   for (const [wireId, info] of available) {
-    const pickerId = ANTIGRAVITY_PICKER_MODEL_BY_WIRE_ID[wireId];
-    const completePickerSet = pickerId !== undefined
-      && ANTIGRAVITY_WIRE_IDS_BY_PICKER_MODEL[pickerId]!.every(id => available.has(id));
-    const id = completePickerSet ? pickerId! : wireId;
+    const id = pickerModelIdForDiscoveredWireId(wireId, available);
     if (seen.has(id)) continue;
     seen.add(id);
     out.push({
@@ -265,7 +318,9 @@ export function parseAntigravityAvailableModels(
 }
 
 export function resolveAntigravityWireModelId(modelId: string): string {
-  return ANTIGRAVITY_MODEL_ALIASES[modelId] ?? modelId;
+  return Object.hasOwn(ANTIGRAVITY_MODEL_ALIASES, modelId)
+    ? ANTIGRAVITY_MODEL_ALIASES[modelId]
+    : modelId;
 }
 
 /**
@@ -279,7 +334,7 @@ export function isAntigravitySuffixModelId(modelId: string): boolean {
 
 /** The reasoning tier a retired Flash id used to encode, if it is one. */
 export function retiredAntigravityFlashTier(modelId: string): string | undefined {
-  return RETIRED_FLASH_TIERS[modelId];
+  return Object.hasOwn(RETIRED_FLASH_TIERS, modelId) ? RETIRED_FLASH_TIERS[modelId] : undefined;
 }
 
 /**
@@ -299,7 +354,7 @@ export function resolveAntigravityEffortWireModel(
   // Rule 0: retired Flash id — Google has taken the wire id offline, so route to the
   // current generation and carry the tier the retired id encoded. This runs BEFORE the
   // suffix check because those ids are aliases, and rule 1 would drop the tier.
-  const retiredTier = RETIRED_FLASH_TIERS[modelId];
+  const retiredTier = retiredAntigravityFlashTier(modelId);
   if (retiredTier) {
     return {
       wireModelId: GEMINI_FLASH_CURRENT,

package/src/routing/compatibility/assemble.ts

@@ -5,73 +5,22 @@ import type { PolicyCandidateEvidence } from "../evaluator";
 import { policyCandidateHealthEvidence } from "../health";
 import type { NormalizedRoutingProfile } from "../profile";
 import { quotaEvidenceForCandidate } from "../quota";
-import {
-  compatibilitySuiteKey,
-  loadCompatibilityCatalogSnapshot,
-  type CompatibilityCatalogSnapshot,
-} from "./catalog";
-import { findVerdictForSuite, loadCompatibilityEvidenceSnapshot } from "./reader";
-import {
-  resolvePolicyCompatibilitySubjects,
-  type ResolvedPolicyCompatibilitySubjects,
-} from "./subject";
-import type { CandidateCompatibilityEvidence } from "./types";
+import { resolveCompatibilityEvidenceProvider, type CoreEvidenceOptions } from "./provider-slot";
 
 export type RoutedProviderResolver = (
   providerName: string,
   provider: OcxProviderConfig,
 ) => OcxProviderConfig;
 
-export interface AssemblePolicyEvidenceOptions {
-  configDir?: string;
-  routedProviderConfig: RoutedProviderResolver;
-  resolveSubjects?: typeof resolvePolicyCompatibilitySubjects;
-  loadEvidenceSnapshot?: typeof loadCompatibilityEvidenceSnapshot;
-  loadCatalogSnapshot?: typeof loadCompatibilityCatalogSnapshot;
-}
-
-function attachCompatibilityEvidence(
-  resolved: ResolvedPolicyCompatibilitySubjects | undefined,
-  snapshot: ReturnType<typeof loadCompatibilityEvidenceSnapshot>,
-  catalog: CompatibilityCatalogSnapshot,
-  profile: NonNullable<NormalizedRoutingProfile["compatibility"]>,
-): CandidateCompatibilityEvidence {
-  const subjectIds = resolved?.subjectIds ?? {};
-  const suites: CandidateCompatibilityEvidence["suites"] = [];
-
-  for (const requirement of profile.requiredSuites) {
-    const subjectId = subjectIds[requirement.evidenceLayer];
-    if (!subjectId) continue;
-    const metadata = catalog.get(compatibilitySuiteKey(requirement.evidenceLayer, requirement.suiteId));
-    if (!metadata) continue;
-    const row = findVerdictForSuite(
-      snapshot,
-      subjectId,
-      requirement.evidenceLayer,
-      requirement.suiteId,
-      metadata.suiteVersion,
-      metadata.suiteManifestDigest,
-    );
-    if (!row) continue;
-    suites.push({
-      subjectId,
-      suiteId: row.suiteId,
-      evidenceLayer: requirement.evidenceLayer,
-      suiteVersion: row.suiteVersion,
-      suiteManifestDigest: row.suiteManifestDigest,
-      verdict: row.verdict,
-      asOf: row.asOf,
-      maxAgeMs: metadata.maxAgeMs,
-      notes: row.notes,
-    });
-  }
-
-  return {
-    subjectIds: { ...subjectIds },
-    projectionAvailable: snapshot.projectionAvailable,
-    suites,
-  };
-}
+/**
+ * Options the core assembler needs. Provider-specific test seams (subject resolution,
+ * catalog and projection loading) belong to the compatibility provider, not here -- keeping
+ * them out is what stops the core assembler from naming Lab-backed contracts.
+ *
+ * The provider reads its own seams off the same object, so callers may still pass a
+ * `LabCompatibilityProviderOptions`; that type extends this one.
+ */
+export type AssemblePolicyEvidenceOptions = CoreEvidenceOptions;
 
 /**
  * Assemble production policy candidate evidence including compatibility snapshots.
@@ -89,55 +38,20 @@ export function assemblePolicyCandidateEvidence(
   const hasCompatibilityRequirements = Boolean(
     compatibilityPolicy && compatibilityPolicy.requiredSuites.length > 0,
   );
-  const resolvedByCandidate = new Map<string, ResolvedPolicyCompatibilitySubjects>();
-  let catalog: CompatibilityCatalogSnapshot = new Map();
-  let snapshot: ReturnType<typeof loadCompatibilityEvidenceSnapshot> = {
-    projectionAvailable: true,
-    projectionIncompatible: false,
-    bySubject: new Map(),
-  };
-
-  if (hasCompatibilityRequirements && compatibilityPolicy) {
-    const resolveSubjects = options.resolveSubjects ?? resolvePolicyCompatibilitySubjects;
-    const loadCatalog = options.loadCatalogSnapshot ?? loadCompatibilityCatalogSnapshot;
-    const loadEvidence = options.loadEvidenceSnapshot ?? loadCompatibilityEvidenceSnapshot;
-    catalog = loadCatalog(compatibilityPolicy.requiredSuites);
-    const subjectIds = new Set<string>();
-
-    for (const candidate of profile.candidates) {
-      const provider = config.providers[candidate.provider];
-      if (!provider) continue;
-      try {
-        const routed = options.routedProviderConfig(candidate.provider, provider);
-        const resolved = resolveSubjects(
-          config,
-          candidate.provider,
-          candidate.model,
-          routed,
-          options.configDir,
-        );
-        resolvedByCandidate.set(`${candidate.provider}/${candidate.model}`, resolved);
-        for (const subjectId of Object.values(resolved.subjectIds)) {
-          if (subjectId) subjectIds.add(subjectId);
-        }
-      } catch {
-        // Subject construction failure is handled per required layer as unknown.
-      }
-    }
-
-    snapshot = loadEvidence([...subjectIds], options.configDir);
-  }
+  // Compatibility evidence is supplied by an opt-in subsystem. With no provider registered
+  // -- every install without compatibility-gated profiles -- the evaluator sees no
+  // compatibility evidence and scores on capability, health, quota, and cost exactly as it
+  // did before compatibility policy existed.
+  const compatibilityProvider = hasCompatibilityRequirements && compatibilityPolicy
+    ? resolveCompatibilityEvidenceProvider()
+    : null;
+  const compatibilityByCandidate = compatibilityProvider && compatibilityPolicy
+    ? compatibilityProvider(config, profile, compatibilityPolicy, options)
+    : null;
 
   return profile.candidates.map(candidate => {
     const key = `${candidate.provider}/${candidate.model}`;
-    const compatibility = hasCompatibilityRequirements && compatibilityPolicy
-      ? attachCompatibilityEvidence(
-        resolvedByCandidate.get(key),
-        snapshot,
-        catalog,
-        compatibilityPolicy,
-      )
-      : undefined;
+    const compatibility = compatibilityByCandidate?.get(key);
 
     return {
       provider: candidate.provider,

package/src/routing/compatibility/lab-evidence-provider.ts

@@ -0,0 +1,130 @@
+/**
+ * Compatibility-evidence provider (Lab-backed).
+ *
+ * Holds every Lab-reaching part of policy candidate evidence: route/protocol subject
+ * construction, the suite catalog snapshot, and the projection read. The core assembler
+ * (`assemble.ts`) keeps capability, health, quota, and cost and consults this only through
+ * the provider slot, so an install that never activates Lab never loads this module.
+ *
+ * This is a relocation of previously inline logic, not a rewrite: `attachCompatibilityEvidence`
+ * below is the original function, and its state arrives entirely through arguments.
+ *
+ * @internal registered by the Lab activation path
+ */
+import type { OcxConfig } from "../../types";
+import type { NormalizedRoutingProfile } from "../profile";
+import {
+  compatibilitySuiteKey,
+  loadCompatibilityCatalogSnapshot,
+  type CompatibilityCatalogSnapshot,
+} from "./catalog";
+import { findVerdictForSuite, loadCompatibilityEvidenceSnapshot } from "./reader";
+import {
+  resolvePolicyCompatibilitySubjects,
+  type ResolvedPolicyCompatibilitySubjects,
+} from "./subject";
+import type { CandidateCompatibilityEvidence } from "./types";
+import type { CoreEvidenceOptions, CompatibilityEvidenceProvider } from "./provider-slot";
+
+/** Lab-side seams, kept off the core options contract. */
+export interface LabCompatibilityProviderOptions extends CoreEvidenceOptions {
+  resolveSubjects?: typeof resolvePolicyCompatibilitySubjects;
+  loadEvidenceSnapshot?: typeof loadCompatibilityEvidenceSnapshot;
+  loadCatalogSnapshot?: typeof loadCompatibilityCatalogSnapshot;
+}
+
+function attachCompatibilityEvidence(
+  resolved: ResolvedPolicyCompatibilitySubjects | undefined,
+  snapshot: ReturnType<typeof loadCompatibilityEvidenceSnapshot>,
+  catalog: CompatibilityCatalogSnapshot,
+  profile: NonNullable<NormalizedRoutingProfile["compatibility"]>,
+): CandidateCompatibilityEvidence {
+  const subjectIds = resolved?.subjectIds ?? {};
+  const suites: CandidateCompatibilityEvidence["suites"] = [];
+
+  for (const requirement of profile.requiredSuites) {
+    const subjectId = subjectIds[requirement.evidenceLayer];
+    if (!subjectId) continue;
+    const metadata = catalog.get(compatibilitySuiteKey(requirement.evidenceLayer, requirement.suiteId));
+    if (!metadata) continue;
+    const row = findVerdictForSuite(
+      snapshot,
+      subjectId,
+      requirement.evidenceLayer,
+      requirement.suiteId,
+      metadata.suiteVersion,
+      metadata.suiteManifestDigest,
+    );
+    if (!row) continue;
+    suites.push({
+      subjectId,
+      suiteId: row.suiteId,
+      evidenceLayer: requirement.evidenceLayer,
+      suiteVersion: row.suiteVersion,
+      suiteManifestDigest: row.suiteManifestDigest,
+      verdict: row.verdict,
+      asOf: row.asOf,
+      maxAgeMs: metadata.maxAgeMs,
+      notes: row.notes,
+    });
+  }
+
+  return {
+    subjectIds: { ...subjectIds },
+    projectionAvailable: snapshot.projectionAvailable,
+    suites,
+  };
+}
+
+/**
+ * Build compatibility evidence for every candidate of one profile.
+ * Keyed `provider/model`; a candidate absent from the map has no compatibility evidence.
+ */
+export const labCompatibilityEvidenceProvider: CompatibilityEvidenceProvider = (
+  config: OcxConfig,
+  profile: NormalizedRoutingProfile,
+  policy: NonNullable<NormalizedRoutingProfile["compatibility"]>,
+  options: CoreEvidenceOptions,
+): Map<string, CandidateCompatibilityEvidence> => {
+  const labOptions = options as LabCompatibilityProviderOptions;
+  const resolveSubjects = labOptions.resolveSubjects ?? resolvePolicyCompatibilitySubjects;
+  const loadCatalog = labOptions.loadCatalogSnapshot ?? loadCompatibilityCatalogSnapshot;
+  const loadEvidence = labOptions.loadEvidenceSnapshot ?? loadCompatibilityEvidenceSnapshot;
+
+  const resolvedByCandidate = new Map<string, ResolvedPolicyCompatibilitySubjects>();
+  const catalog: CompatibilityCatalogSnapshot = loadCatalog(policy.requiredSuites);
+  const subjectIds = new Set<string>();
+
+  for (const candidate of profile.candidates) {
+    const provider = config.providers[candidate.provider];
+    if (!provider) continue;
+    try {
+      const routed = options.routedProviderConfig(candidate.provider, provider);
+      const resolved = resolveSubjects(
+        config,
+        candidate.provider,
+        candidate.model,
+        routed,
+        options.configDir,
+      );
+      resolvedByCandidate.set(`${candidate.provider}/${candidate.model}`, resolved);
+      for (const subjectId of Object.values(resolved.subjectIds)) {
+        if (subjectId) subjectIds.add(subjectId);
+      }
+    } catch {
+      // Subject construction failure is handled per required layer as unknown.
+    }
+  }
+
+  const snapshot = loadEvidence([...subjectIds], options.configDir);
+
+  const byCandidate = new Map<string, CandidateCompatibilityEvidence>();
+  for (const candidate of profile.candidates) {
+    const key = `${candidate.provider}/${candidate.model}`;
+    byCandidate.set(
+      key,
+      attachCompatibilityEvidence(resolvedByCandidate.get(key), snapshot, catalog, policy),
+    );
+  }
+  return byCandidate;
+};

package/src/routing/compatibility/provider-slot.ts

@@ -0,0 +1,56 @@
+/**
+ * Slot for the optional compatibility-evidence provider.
+ *
+ * Routing is synchronous and must stay synchronous: `routeModelInternal` is sync, and so
+ * are the subagent-fallback helpers that call `routeModel` (`isNativeModelQuotaExhausted`,
+ * `isModelHealthBlocked`, `selectAvailableSubagentModel`, ...). Making the chain async to
+ * permit a dynamic import would touch hundreds of call sites and break those APIs, so this
+ * is a plain nullable reference rather than an `await import()`.
+ *
+ * The Lab implementation is installed during activation. Installs without
+ * compatibility-gated routing profiles never register one, so the core evidence assembler
+ * never reaches the Lab module graph.
+ *
+ * See devlog/_plan/260814_lab_core_decoupling/030_router_and_startup_activation.md
+ */
+import type { OcxConfig } from "../../types";
+import type { NormalizedRoutingProfile } from "../profile";
+import type { CandidateCompatibilityEvidence } from "./types";
+
+/** Options the core assembler can supply without knowing anything Lab-specific. */
+export interface CoreEvidenceOptions {
+  configDir?: string;
+  routedProviderConfig: (providerName: string, provider: import("../../types").OcxProviderConfig)
+    => import("../../types").OcxProviderConfig;
+}
+
+/**
+ * Produce compatibility evidence per candidate, keyed `provider/model`.
+ * A candidate absent from the map has no compatibility evidence.
+ */
+export type CompatibilityEvidenceProvider = (
+  config: OcxConfig,
+  profile: NormalizedRoutingProfile,
+  policy: NonNullable<NormalizedRoutingProfile["compatibility"]>,
+  options: CoreEvidenceOptions,
+) => Map<string, CandidateCompatibilityEvidence>;
+
+let provider: CompatibilityEvidenceProvider | null = null;
+
+/** Install the provider. Returns a detach function. */
+export function setCompatibilityEvidenceProvider(next: CompatibilityEvidenceProvider): () => void {
+  provider = next;
+  return () => {
+    if (provider === next) provider = null;
+  };
+}
+
+/** The installed provider, or null when no optional subsystem is active. */
+export function resolveCompatibilityEvidenceProvider(): CompatibilityEvidenceProvider | null {
+  return provider;
+}
+
+/** Test-only reset. */
+export function resetCompatibilityEvidenceProviderForTests(): void {
+  provider = null;
+}

package/src/server/index.ts

@@ -45,12 +45,7 @@ import {
   registerDefaultAppOwnedObservedBuffers,
 } from "../lib/app-owned-memory-stores";
 import { acquireServerBackgroundLifecycle } from "./background-lifecycle";
-import {
-  setLabAutomationDispatchDeps,
-  startLabAutomationScheduler,
-} from "../lab/automation/orchestrator";
-import { loadLabAutomationPolicy } from "../lab/automation/persistence";
-import { createProductionLabRouteExecutor } from "../lib/lab-live-route-production";
+import { activateLab, labActivationRequired } from "../lib/lab-activation";
 import { runOpenAiTierStartupMigration } from "../providers/openai-tier-startup";
 import { runAlibabaRegionStartupMigration } from "../providers/alibaba-region-startup";
 import { runModelRenameStartupMigration } from "../providers/model-rename-startup";
@@ -1735,18 +1730,14 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
   // Opt-in storage policy (default OFF). Never blocks listen; cancellable on shutdown.
   backgroundLifecycle.scheduleStartupRun();
 
+  // Compatibility Lab is optional: wire it only for installs that actually use it -- any
+  // routing profile, or automation enabled on disk. This runs synchronously before
+  // startServer returns, in the same turn as Bun.serve, so a policy route can never be
+  // evaluated before its evidence provider is registered. That ordering is load-bearing:
+  // the subagent-fallback chain routes synchronously and has nowhere to await.
   const labConfigDir = getConfigDir();
-  const productionLabRouteExecutor = createProductionLabRouteExecutor({
-    configDir: labConfigDir,
-    loadConfig: () => config,
-  });
-  setLabAutomationDispatchDeps({
-    configDir: labConfigDir,
-    loadConfig: () => config,
-    routeExecutor: productionLabRouteExecutor,
-  });
-  if (loadLabAutomationPolicy(labConfigDir).enabled) {
-    startLabAutomationScheduler(labConfigDir);
+  if (labActivationRequired(config, labConfigDir)) {
+    activateLab(config, labConfigDir);
   }
 
   return server;

package/src/server/lifecycle.ts

@@ -7,7 +7,7 @@ import {
 } from "../storage/policy-job";
 import { abortRestoreTrashJobAsync } from "../storage/restore-job";
 import { stopStorageCleanupScheduler } from "../storage/policy-scheduler";
-import { stopLabAutomationScheduler, requestLabAutomationShutdown } from "../lab/automation/orchestrator";
+import { runOptionalShutdownHooks } from "../lib/optional-shutdown-hooks";
 import { stopStateStoreSweeper } from "../lib/state-store-sweeper";
 import {
   cancelQueuedStorageWorkerSpawns,
@@ -452,8 +452,10 @@ export async function drainAndShutdown(
     // Abort each job independently so one wedged join cannot skip the other,
     // then drain leftovers; failures must not prevent `server.stop`.
     stopStorageCleanupScheduler();
-    requestLabAutomationShutdown();
-    stopLabAutomationScheduler();
+    // Optional subsystems (Compatibility Lab today, anything added later) tear themselves
+    // down through hooks registered at activation. A process that never activated one runs
+    // nothing here and never loads its module graph.
+    runOptionalShutdownHooks();
     stopStateStoreSweeper();
     // The overlay reconciler is owner-scoped: the startServer stop override
     // releases THIS server's lease through runListenerShutdown →

package/src/server/management/routing-profile-routes.ts

@@ -17,9 +17,10 @@ import {
 } from "../../routing/profile";
 import { evaluatePolicyProfile, type PolicyCandidateEvidence, type PolicyRequestEvidence } from "../../routing/evaluator";
 import { assemblePolicyCandidateEvidence } from "../../routing/compatibility/assemble";
+import { activateLab, labActivationRequired } from "../../lib/lab-activation";
 import { quotaEvidenceForCandidate } from "../../routing/quota";
 import { routedProviderConfig } from "../../router";
-import { saveConfigPreservingClaudeCode } from "../../config";
+import { saveConfigPreservingClaudeCode, getConfigDir } from "../../config";
 import { reconcileLiveStateStores } from "../../lib/state-store-registrations";
 import { isPlainRecord } from "./shared";
 import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
@@ -289,6 +290,9 @@ export async function handleRoutingProfileRoutes(ctx: ManagementContext): Promis
     const nextProfiles = { ...(config.routingProfiles ?? {}) };
     nextProfiles[id] = storedProfile(id, body.profile as OcxRoutingProfileConfig);
     config.routingProfiles = nextProfiles;
+    // Creating the first profile on a process started profile-less must install the
+    // compatibility provider now; activation is synchronous and idempotent per configDir.
+    if (labActivationRequired(config, getConfigDir())) activateLab(config, getConfigDir());
     // An alias change on update renames the public model id; rewrite config
     // references (disabledModels, subagentModels, injectionModel,
     // shadowCallIntercept, claudeCode) so they follow the new alias.
@@ -358,6 +362,10 @@ export async function handleRoutingProfileRoutes(ctx: ManagementContext): Promis
     // One clock read for both assembly and evaluation keeps freshness, health,
     // and trace timestamps mutually consistent with the production router.
     const now = Date.now();
+    // R3-1: dry-run assembles candidate evidence independently of the startup gate, so an
+    // operator preview on a process started without profiles would silently omit
+    // compatibility evidence and disagree with production. Activate first.
+    if (labActivationRequired(config, getConfigDir())) activateLab(config, getConfigDir());
     const candidateEvidence = body.candidates === undefined
       ? assembleCandidateEvidence(config, resolvedProfile, now)
       : parseCandidateEvidence(body.candidates);

package/src/server/management-api.ts

@@ -61,15 +61,12 @@ import { handleConfigRoutes } from "./management/config-routes";
 import { handleLogsUsageRoutes } from "./management/logs-usage-routes";
 import { handleRequestHistoryRoutes } from "./management/request-history-routes";
 import { handleRoutingAnalyticsRoutes } from "./management/routing-analytics-routes";
-import { handleRoutingProfileRoutes } from "./management/routing-profile-routes";
 import { handleProviderRoutes } from "./management/provider-routes";
 import { handleModelRoutes } from "./management/model-routes";
 import { handleAgentSettingsRoutes } from "./management/agent-settings-routes";
 import { handleOauthAccountRoutes } from "./management/oauth-account-routes";
 import { handleComboRoutes } from "./management/combo-routes";
 import { handleSystemRoutes } from "./management/system-routes";
-import { handleLabRoutes } from "./management/lab-routes";
-import { handleLabAutomationRoutes } from "./management/lab-automation-routes";
 import { handleSidebarRoutes } from "./management/sidebar-routes";
 import { handleIntegrationRoutes } from "./management/integration-routes";
 import { handleNativeIntegrationRoutes } from "./management/native-integration-routes";
@@ -96,6 +93,41 @@ const managementConvergenceBindings = new WeakMap<object, Readonly<{
   converge: ConvergeCodex;
 }>>();
 
+/**
+ * Namespace match for management route prefixes: exact hit or a child path, never a
+ * prefix collision (`/api/labfoo` must not match `/api/lab`).
+ */
+function pathInManagementNamespace(pathname: string, prefix: string): boolean {
+  return pathname === prefix || pathname.startsWith(`${prefix}/`);
+}
+
+/**
+ * Routing-profile and Compatibility Lab handlers statically import the Lab module graph,
+ * so mounting them eagerly would pull ~70 `src/lab/` modules into every management
+ * request -- including installs that never opted into Lab. Loading them per namespace
+ * keeps `management-api.ts` on the same footing as the three protected core files.
+ *
+ * Cherry-picked from @Wibias's PR #1676, which solved this before the boundary work
+ * reached it. See devlog/_plan/260814_lab_core_decoupling/.
+ */
+async function handleRoutingProfileRoutesOnDemand(ctx: ManagementContext): Promise<Response | null> {
+  if (!pathInManagementNamespace(ctx.url.pathname, "/api/routing-profiles")) return null;
+  const { handleRoutingProfileRoutes } = await import("./management/routing-profile-routes");
+  return handleRoutingProfileRoutes(ctx);
+}
+
+async function handleLabRoutesOnDemand(ctx: ManagementContext): Promise<Response | null> {
+  if (!pathInManagementNamespace(ctx.url.pathname, "/api/lab")) return null;
+  // Automation is checked first so its narrower namespace keeps its own handler, matching
+  // the eager chain's ordering.
+  if (pathInManagementNamespace(ctx.url.pathname, "/api/lab/automation")) {
+    const { handleLabAutomationRoutes } = await import("./management/lab-automation-routes");
+    return handleLabAutomationRoutes(ctx);
+  }
+  const { handleLabRoutes } = await import("./management/lab-routes");
+  return handleLabRoutes(ctx);
+}
+
 export async function handleManagementAPI(
   req: Request,
   url: URL,
@@ -180,7 +212,7 @@ export async function handleManagementAPI(
     ??     (await handleLogsUsageRoutes(ctx))
     ??     (await handleRequestHistoryRoutes(ctx))
     ??     (await handleRoutingAnalyticsRoutes(ctx))
-    ??     (await handleRoutingProfileRoutes(ctx))
+    ??     (await handleRoutingProfileRoutesOnDemand(ctx))
     ??     (await handleProviderRoutes(ctx))
     ??     (await handleModelRoutes(ctx))
     ??     (await handleIntegrationRoutes(ctx))
@@ -189,8 +221,7 @@ export async function handleManagementAPI(
     ??     (await handleOauthAccountRoutes(ctx))
     ??     (await handleComboRoutes(ctx))
     ??     (await handleSystemRoutes(ctx))
-    ??     (await handleLabAutomationRoutes(ctx))
-    ??     (await handleLabRoutes(ctx))
+    ??     (await handleLabRoutesOnDemand(ctx))
       ?? (await handleSidebarRoutes(ctx));
   } catch (error) {
     const tooLarge = managementBodyTooLargeResponse(error, req, config);