@bitkyc08/opencodex 2.52.0-preview.20260912 → 2.53.0-preview.20260913

package/src/codex/auth-api.ts

@@ -1,3 +1,10 @@
+import { CODEX_ACCOUNT_LOG_LABEL_RE } from "./account-label";
+import { poolQuotaHistoryIdentity } from "./account-store";
+import { estimateCodexQuotaCapacity, insufficientCodexCapacity, type CodexCapacityResult } from "./quota-capacity";
+import { readUsageSnapshotForManagement } from "../usage/log";
+import { capturePoolQuotaWriter } from "./account-store";
+import type { PoolQuotaWriter } from "./quota-types";
+import { getAccountQuotaHistory, isValidWhamHistoryObservation } from "./quota";
 import {
   ConfigMutationLockError,
   loadConfig,
@@ -41,6 +48,7 @@ import {
 } from "./account-priority";
 import {
   claimDueCodexQuotaRecoveryProbes,
+  codexQuotaScopeForModel,
   claimManualResetCooldowns,
   settleManualResetCooldown,
   type ManualResetCooldownClaim,
@@ -49,6 +57,7 @@ import {
   clearThreadAccountMapForAccount,
   getEffectiveActiveCodexAccountId,
   isEffectiveCodexAccountPinned,
+  isCodexAccountPlanExcluded,
   reconcileCodexActiveAfterExclusion,
   resetCodexRoutingForManualSelection,
   settleCodexQuotaRecoveryProbe,
@@ -58,9 +67,9 @@ import {
   MAX_ACCOUNT_PRIORITY,
   MIN_ACCOUNT_PRIORITY,
   normalizeAccountPoolStickyLimit,
-  normalizeAccountPoolStrategy,
+  normalizeCodexAccountPoolStrategy,
   parseAccountPoolStickyLimit,
-  parseAccountPoolStrategy,
+  parseCodexAccountPoolStrategy,
   parseAccountPriority,
 } from "./pool-rotation";
 import { checkAccountIdCollision, getMainChatgptAccountId, readCodexTokens, readCodexTokensResult } from "./auth-collision";
@@ -78,6 +87,7 @@ import {
   parseUsageQuota,
   setAccountQuotaFromParsed,
   updateAccountQuota,
+  withoutRetiredCodexQuota,
   type StoredAccountQuota,
   type WhamUsageResponse,
 } from "./quota";
@@ -242,49 +252,11 @@ function codexAccountPersistenceConflict(
     : undefined;
 }
 
-/**
- * The exact labels `parseUsageQuota` emits for the Codex Spark windows (quota.ts).
- * Matching on the label rather than on "is a custom window" is load-bearing: the same array
- * carries Cursor's First-party models / API usage, Anthropic's Fable / Opus / Sonnet,
- * Antigravity's Gem / Cla, Kimi's subscription credits and a dozen dynamic provider meters.
- */
-const CODEX_SPARK_WINDOW_LABELS = new Set([
-  "GPT-5.3-Codex-Spark 5h",
-  "GPT-5.3-Codex-Spark Weekly",
-]);
-
-/**
- * Drop the Spark window unless the operator asked for it (default hidden).
- *
- * Applied at the DTO boundary, never at parse or cache time: custom windows participate in
- * quota-presence checks, snapshot reconciliation and capacity aggregation, so removing Spark
- * upstream of this point would change routing state rather than display.
- *
- * Both GUI surfaces funnel through here — the Codex Auth rows directly, and /api/provider-quotas
- * via listCodexAuthAccountsSnapshot — so one filter covers both. Filtering only one would leave
- * the other still rendering the row the operator switched off.
- */
-export function withSparkVisibility<T extends Omit<StoredAccountQuota, "updatedAt"> | StoredAccountQuota | null>(
-  quota: T,
-): T {
-  if (!quota?.customWindows?.length) return quota;
-  if (loadConfig().showCodexSparkQuota === true) return quota;
-  const kept = quota.customWindows.filter(window => !CODEX_SPARK_WINDOW_LABELS.has(window.label));
-  if (kept.length === quota.customWindows.length) return quota;
-  // An empty list is dropped rather than serialized: an absent field and an empty array should
-  // not be two different ways of saying "no custom windows" on the wire.
-  const next = { ...quota } as Record<string, unknown>;
-  if (kept.length > 0) next.customWindows = kept;
-  else delete next.customWindows;
-  return next as T;
-}
-
-
 function quotaForPlan<T extends Omit<StoredAccountQuota, "updatedAt"> | StoredAccountQuota | null>(
   quota: T,
   plan: unknown,
-): T {
-  const visible = withSparkVisibility(quota);
+): T | null {
+  const visible = withoutRetiredCodexQuota(quota);
   if (!visible || !isThirtyDayOnlyCodexPlan(plan)) return visible;
   const quotaWindows = visible;
   return {
@@ -379,6 +351,7 @@ export type CodexAccountReauthReason =
   | "forbidden";
 
 function poolAccountDto(
+  config: OcxConfig,
   account: CodexAccount,
   quotaResult: PoolQuotaResult,
   hasCredential: boolean,
@@ -413,6 +386,10 @@ function poolAccountDto(
     quota: quota ? { ...quota } : null,
     needsReauth: needsReauth || health.status === "reauth_required",
     ...(reauthReason !== undefined ? { reauthReason } : {}),
+    ...(isCodexAccountPlanExcluded(config, account.id) ? {
+      selectionExcludedReason: "plan_excluded" as const,
+      selectionExcludedPlan: codexPlanValue(config.codexAccounts?.find(row => row.id === account.id)?.plan),
+    } : {}),
     hasCredential,
     ...(quotaResult.quotaProbeSkipped ? { quotaProbeSkipped: true as const } : {}),
     ...oauthAccountHealthFields("codex", account.id, health),
@@ -1192,6 +1169,9 @@ export interface CodexAuthAccountDto {
    * needs the operator; `/api/oauth/accounts` already carries the same field name.
    */
   reauthReason?: CodexAccountReauthReason;
+  /** Automatic selection policy only; explicit routes retain their usual auth checks. */
+  selectionExcludedReason?: "plan_excluded";
+  selectionExcludedPlan?: string;
   hasCredential: boolean;
   health: OAuthAccountHealth;
   healthLabel: OAuthHealthLabel;
@@ -1358,6 +1338,7 @@ async function recoverPoolQuotaFrom401(ctx: {
 
   const writerGeneration = captureConfigGeneration();
   markQuotaProbeAttempted(ctx.quotaProbeEvidence, refreshed.generation);
+  const poolWriter = capturePoolQuotaWriter(accountId, refreshed);
   const replay = await fetch("https://chatgpt.com/backend-api/wham/usage", {
     headers: {
       Authorization: `Bearer ${refreshed.accessToken}`,
@@ -1376,7 +1357,7 @@ async function recoverPoolQuotaFrom401(ctx: {
     return { quota: existing ?? null, needsReauth: false, credentialGeneration: refreshed.generation };
   }
   const result = await commitPoolQuotaResponse(replay, {
-    accountId, existing, configuredPlan, generation: refreshed.generation, writerGeneration,
+    accountId, existing, configuredPlan, generation: refreshed.generation, writerGeneration, poolWriter,
     mayPublish: ctx.quotaProbeEvidence.mayPublish,
   });
   return result.freshCredentialGeneration === refreshed.generation ? {
@@ -1418,11 +1399,13 @@ async function commitPoolQuotaResponse(
     configuredPlan: string | undefined;
     generation: number;
     writerGeneration: number;
+    poolWriter?: PoolQuotaWriter;
     mayPublish?: () => boolean;
   },
 ): Promise<PoolQuotaResult> {
   const { accountId, existing, configuredPlan, generation, writerGeneration } = ctx;
   const data = (await resp.json()) as WhamUsageResponse;
+  const observedAt = Date.now();
   if (ctx.mayPublish?.() === false) {
     return { quota: getAccountQuota(accountId), needsReauth: false, credentialGeneration: generation };
   }
@@ -1440,7 +1423,8 @@ async function commitPoolQuotaResponse(
   if (!isCodexAccountGenerationLive(accountId, generation)) {
     return { quota: null, needsReauth: false, credentialGeneration: generation };
   }
-  setAccountQuotaFromParsed(accountId, quota, writerGeneration);
+  setAccountQuotaFromParsed(accountId, quota, writerGeneration, undefined, quota,
+    ctx.poolWriter && isValidWhamHistoryObservation(data) ? { writer: ctx.poolWriter, observedAt, source: "wham", raw: quota } : undefined);
   return {
     quota: getAccountQuota(accountId),
     needsReauth: false,
@@ -1464,6 +1448,7 @@ async function fetchFreshPoolAccountQuota(
   let requestCredentialGeneration = readCodexAccountRecord(accountId)?.generation;
   try {
     const { accessToken, chatgptAccountId, generation } = await getValidToken(accountId);
+    const poolWriter = capturePoolQuotaWriter(accountId, { accessToken, chatgptAccountId, generation });
     requestCredentialGeneration = generation;
     onCredentialGeneration?.(generation);
     markQuotaProbeAttempted(quotaProbeEvidence, generation);
@@ -1494,7 +1479,7 @@ async function fetchFreshPoolAccountQuota(
       return withQuotaProbeEvidence(recovered, quotaProbeEvidence);
     }
     const committed = await commitPoolQuotaResponse(resp, {
-      accountId, existing, configuredPlan, generation, writerGeneration,
+      accountId, existing, configuredPlan, generation, writerGeneration, poolWriter,
       mayPublish: quotaProbeEvidence.mayPublish,
     });
     return withQuotaProbeEvidence(committed, quotaProbeEvidence);
@@ -1727,7 +1712,7 @@ export async function runCodexCooldownRecoveryProbes(config: OcxConfig, now = Da
       try {
         const result = await fetchPoolAccountQuota(claim.accountId, true, account.plan);
         // Defence in depth: independent scopes are already excluded at the claim site.
-        // Generic WHAM must never clear Spark or Reserve even if claim selection changes.
+        // Generic WHAM must never clear Reserve even if claim selection changes.
         const recovered = (claim.scope === undefined || claim.scope === "shared")
           && isCompleteCodexQuotaRecoverySnapshot(result.freshQuota ?? null, result.freshPlan ?? account.plan);
         settleCodexQuotaRecoveryProbe(claim, recovered, {
@@ -2006,6 +1991,7 @@ export async function listCodexAuthAccountsSnapshot(
     const currentCredential = getCodexAccountCredential(accountId);
     if (!currentCredential) {
       return [poolAccountDto(
+        runtimeConfig,
         currentAccount,
         { quota: null, needsReauth: true },
         false,
@@ -2026,6 +2012,7 @@ export async function listCodexAuthAccountsSnapshot(
       ? { ...currentAccount, plan: quotaResult.freshPlan }
       : currentAccount;
     return [poolAccountDto(
+      runtimeConfig,
       dtoAccount,
       effectiveQuotaResult,
       true,
@@ -2069,9 +2056,9 @@ export async function listCodexAuthAccountsSnapshot(
     hasCredential: hasMainCredential,
     needsReauth: mainNeedsReauth,
     ...(mainReauthReason !== undefined ? { reauthReason: mainReauthReason } : {}),
-    quota: mainInfo.quota ? {
-      ...quotaForPlan(mainQuotaWithCarriedResetCredits(mainInfo.quota), mainInfo.plan),
-    } : null,
+    quota: mainInfo.quota
+      ? quotaForPlan(mainQuotaWithCarriedResetCredits(mainInfo.quota), mainInfo.plan)
+      : null,
     ...oauthAccountHealthFields("codex", MAIN_CODEX_ACCOUNT_ID, mainHealth),
   };
   return {
@@ -2457,7 +2444,7 @@ export async function handleCodexAuthAPI(
       pinnedAccountId: pinnedCodexAccountId(runtimeConfig) ?? null,
       autoSwitchThreshold: runtimeConfig.autoSwitchThreshold ?? 80,
       upstreamFailoverThreshold: runtimeConfig.upstreamFailoverThreshold ?? 3,
-      accountPoolStrategy: normalizeAccountPoolStrategy(runtimeConfig.accountPoolStrategy),
+      accountPoolStrategy: normalizeCodexAccountPoolStrategy(runtimeConfig.accountPoolStrategy),
       accountPoolStickyLimit: normalizeAccountPoolStickyLimit(runtimeConfig.accountPoolStickyLimit),
     });
   }
@@ -2488,12 +2475,12 @@ export async function handleCodexAuthAPI(
       return jsonResponse({ error: "strategy or stickyLimit required" }, 400);
     }
     const runtimeConfig = getRuntimeConfig(config);
-    let nextStrategy: NonNullable<ReturnType<typeof parseAccountPoolStrategy>> | undefined;
+    let nextStrategy: NonNullable<ReturnType<typeof parseCodexAccountPoolStrategy>> | undefined;
     let nextSticky: NonNullable<ReturnType<typeof parseAccountPoolStickyLimit>> | undefined;
     if (body.strategy !== undefined) {
-      const parsed = parseAccountPoolStrategy(body.strategy);
+      const parsed = parseCodexAccountPoolStrategy(body.strategy);
       if (parsed === null) {
-        return jsonResponse({ error: 'strategy must be one of: quota, round-robin, fill-first' }, 400);
+        return jsonResponse({ error: 'strategy must be one of: quota, round-robin, fill-first, reset-first' }, 400);
       }
       nextStrategy = parsed;
     }
@@ -2509,7 +2496,7 @@ export async function handleCodexAuthAPI(
     saveRuntimeConfig(config, runtimeConfig);
     return jsonResponse({
       ok: true,
-      accountPoolStrategy: normalizeAccountPoolStrategy(runtimeConfig.accountPoolStrategy),
+      accountPoolStrategy: normalizeCodexAccountPoolStrategy(runtimeConfig.accountPoolStrategy),
       accountPoolStickyLimit: normalizeAccountPoolStickyLimit(runtimeConfig.accountPoolStickyLimit),
     });
   }
@@ -2526,6 +2513,46 @@ export async function handleCodexAuthAPI(
     return jsonResponse({ ok: true });
   }
 
+  if (url.pathname === "/api/codex-auth/quota/history" && req.method === "GET") {
+    const accountId = url.searchParams.get("accountId");
+    const rawLimit = url.searchParams.get("limit");
+    if (url.searchParams.getAll("accountId").length !== 1 || !isValidCodexAccountId(accountId)
+      || url.searchParams.getAll("limit").length > 1
+      || [...url.searchParams.keys()].some(key => key !== "accountId" && key !== "limit")
+      || (rawLimit !== null && !/^(?:[1-9]|[1-9][0-9]|1[0-9]{2}|200)$/.test(rawLimit))) {
+      return jsonResponse({ error: "A stored pool accountId and optional limit from 1 to 200 are required" }, 400);
+    }
+    const runtimeConfig = getRuntimeConfig(config);
+    const account = configuredPoolAccount(runtimeConfig, accountId);
+    if (!account) return jsonResponse({ error: "Unknown pool account" }, 404);
+    const identity = poolQuotaHistoryIdentity(accountId);
+    const allHistory = getAccountQuotaHistory(accountId);
+    const limit = rawLimit === null ? 200 : Number(rawLimit);
+    const history = { ...allHistory, observations: allHistory.observations.slice(-limit), truncated: allHistory.observations.length > limit };
+    const label = account.logLabel;
+    const labelStillUnique = () => {
+      const current = getRuntimeConfig(config);
+      return configuredPoolAccount(current, accountId)?.logLabel === label
+        && current.codexAccounts?.filter(row => codexAccountLogLabel(row) === label).length === 1;
+    };
+    let capacity: CodexCapacityResult = insufficientCodexCapacity("identity_unavailable");
+    if (identity && identity === poolQuotaHistoryIdentity(accountId) && label && CODEX_ACCOUNT_LOG_LABEL_RE.test(label) && labelStillUnique()) {
+      try {
+        const usage = await readUsageSnapshotForManagement();
+        if (poolQuotaHistoryIdentity(accountId) !== identity || !labelStillUnique()) capacity = insufficientCodexCapacity("identity_changed");
+        else if (!usage.revision) capacity = insufficientCodexCapacity("ledger_unavailable");
+        else if (usage.truncatedPrefixBytes > 0 || usage.entriesTruncated || usage.entriesDropped > 0) capacity = insufficientCodexCapacity("ledger_truncated");
+        else capacity = estimateCodexQuotaCapacity(allHistory.observations, usage.entries, label,
+          model => codexQuotaScopeForModel(model) === "shared");
+      } catch { capacity = insufficientCodexCapacity("ledger_unavailable"); }
+    }
+    if (!configuredPoolAccount(getRuntimeConfig(config), accountId)) return jsonResponse({ error: "Unknown pool account" }, 404);
+    if (identity !== poolQuotaHistoryIdentity(accountId) || (identity && label && !labelStillUnique())) {
+      return jsonResponse({ accountId, ...getAccountQuotaHistory(accountId, limit), capacity: insufficientCodexCapacity("identity_changed") });
+    }
+    return jsonResponse({ accountId, ...history, capacity });
+  }
+
   if (url.pathname === "/api/codex-auth/quota" && req.method === "GET") {
     const quotas: Record<string, unknown> = {};
     for (const [id, q] of listAccountQuotas()) quotas[id] = q;

package/src/codex/auth-context.ts

@@ -1,3 +1,4 @@
+import type { PoolQuotaWriter } from "./quota-types";
 import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import {
   CodexCredentialGenerationConflictError,
@@ -6,6 +7,7 @@ import {
   CodexCredentialRefreshStaleError,
   getCodexAccountCredential,
   getValidCodexToken,
+  capturePoolQuotaWriter,
   isCodexAccountGenerationLive,
   readCodexAccountRecord,
 } from "./account-store";
@@ -120,6 +122,7 @@ export type CodexAuthContext =
       accountId: string;
       writerGeneration: number;
       generation: number;
+      poolQuotaWriter?: PoolQuotaWriter;
       accessToken: string;
       chatgptAccountId: string;
       /** Bypass Pool selection and suppress quota/transient failover for an exact selector. */
@@ -201,6 +204,19 @@ export class CodexPoolAuthenticationError extends Error {
   }
 }
 
+export type CodexModelAvailabilityReason = "unsupported" | "temporarily_unavailable";
+
+/** A model/account compatibility failure is not a credential failure. */
+export class CodexModelAvailabilityError extends CodexPoolAuthenticationError {
+  reason: CodexModelAvailabilityReason;
+
+  constructor(reason: CodexModelAvailabilityReason, message: string) {
+    super(message);
+    this.name = "CodexModelAvailabilityError";
+    this.reason = reason;
+  }
+}
+
 class CodexAccountValidationPendingError extends CodexPoolAuthenticationError {
   constructor() {
     super("Codex account validation is pending; refresh quota after recovery to validate it");
@@ -558,7 +574,7 @@ export function cooldownErrorMessage(err: CodexAccountCooldownError, accountSele
   if (err instanceof CodexMainAccountHardLockError || err instanceof CodexReserveUnavailableError) return err.message;
   const until = new Date(err.cooldownUntil).toISOString();
   const scopeLabels: Record<CodexQuotaScope, string> = {
-    spark: "Spark quota", shared: "shared native quota", reserve: "Reserve quota",
+    shared: "shared native quota", reserve: "Reserve quota",
   };
   const scope = err.quotaScope ? scopeLabels[err.quotaScope] : null;
   const selected = accountSelector
@@ -700,7 +716,10 @@ export async function resolveCodexAuthContext(
           options.isDirectCallerEntitledToCodexModel ?? isDirectCallerEntitledToCodexModel
         )(headers, options.modelId);
         if (!entitled) {
-          throw new CodexPoolAuthenticationError("The selected ChatGPT account does not support this model");
+          throw new CodexModelAvailabilityError(
+            "unsupported",
+            "The selected ChatGPT account does not support this model",
+          );
         }
       }
       if (callerMatchesObservedMain(headers)) assertMainAccountPolicy(policy);
@@ -734,7 +753,10 @@ export async function resolveCodexAuthContext(
           options.modelId,
         )?.has(MAIN_CODEX_ACCOUNT_ID) === true;
         if (!entitled) {
-          throw new CodexPoolAuthenticationError("The selected ChatGPT account does not support this model");
+          throw new CodexModelAvailabilityError(
+            "unsupported",
+            "The selected ChatGPT account does not support this model",
+          );
         }
       }
       assertMainAccountPolicy(policy);
@@ -861,11 +883,13 @@ export async function resolveCodexAuthContext(
         return await resolveCallerOwnedMainContext();
       }
       if (fixedAccountId !== undefined) {
-        throw new CodexPoolAuthenticationError(
-          modelEligibleAccountIds && !modelEligibleAccountIds.has(fixedAccountId)
-            ? "Selected Codex account does not support this model"
-            : "Selected Codex account is unavailable",
-        );
+        if (modelEligibleAccountIds && !modelEligibleAccountIds.has(fixedAccountId)) {
+          throw new CodexModelAvailabilityError(
+            "unsupported",
+            "Selected Codex account does not support this model",
+          );
+        }
+        throw new CodexPoolAuthenticationError("Selected Codex account is unavailable");
       }
       // Recovery or a turn drain deliberately makes physical main unobservable.
       // If no healthy pool route is available, report the temporary fence rather
@@ -881,13 +905,16 @@ export async function resolveCodexAuthContext(
         && (!modelEligibleAccountIds || modelEligibleAccountIds.has(MAIN_CODEX_ACCOUNT_ID))) {
         assertMainAccountPolicy(policy);
       }
-      throw new CodexPoolAuthenticationError(
-        modelEligibleAccountIds === undefined
-          ? undefined
-          : entitledAccountIds?.size === 0 && !mainModelGrantUnobserved
-          ? "No eligible Codex account supports this model"
-          : "Codex accounts that support this model are currently unavailable",
-      );
+      if (modelEligibleAccountIds !== undefined) {
+        const unsupported = entitledAccountIds?.size === 0 && !mainModelGrantUnobserved;
+        throw new CodexModelAvailabilityError(
+          unsupported ? "unsupported" : "temporarily_unavailable",
+          unsupported
+            ? "No eligible Codex account supports this model"
+            : "Codex accounts that support this model are currently unavailable",
+        );
+      }
+      throw new CodexPoolAuthenticationError();
     }
     accountId = selected;
     if (accountId === MAIN_CODEX_ACCOUNT_ID) assertMainAccountPolicy(policy);
@@ -906,7 +933,8 @@ export async function resolveCodexAuthContext(
     // Model entitlement is different: sending the request would spend a turn on an account whose
     // authenticated roster already denied the model. Reassert this boundary after every selector.
     if (modelEligibleAccountIds && !modelEligibleAccountIds.has(accountId)) {
-      throw new CodexPoolAuthenticationError(
+      throw new CodexModelAvailabilityError(
+        "unsupported",
         fixedAccountId !== undefined
           ? "Selected Codex account does not support this model"
           : "No eligible Codex account supports this model",
@@ -1030,6 +1058,7 @@ export async function resolveCodexAuthContext(
       accountId,
       writerGeneration,
       generation: token.generation,
+      poolQuotaWriter: capturePoolQuotaWriter(accountId, token),
       accessToken: token.accessToken,
       chatgptAccountId: token.chatgptAccountId,
       ...(fixedAccountId !== undefined ? { fixedAccount: true } : {}),

package/src/codex/catalog/effort.ts

@@ -60,7 +60,7 @@ export function nativeEffortClamp(slug: string, effort: string | undefined): str
   if (levels.length === 0) {
     // Not snapshot-covered. gpt-5.6 natives have a REAL max rung (ensureGpt56ReasoningLevels
     // restores it even off-snapshot) -> never clamp. Every other bare native (gpt-5.5,
-    // 5.3-codex-spark, a retired slug a client still asks for, and future old-ladder slugs)
+    // a retired slug a client still asks for, and future old-ladder slugs)
     // really stops at xhigh — the ChatGPT backend error names exactly none..xhigh — so clamp
     // the synthetic top tier.
     return isGpt56NativeSlug(slug) ? null : "xhigh";

package/src/codex/catalog/metadata.ts

@@ -72,7 +72,6 @@ export {
 } from "./native-models";
 
 export const DOCUMENTED_NATIVE_OPENAI_ADDITIONS = [
-  "gpt-5.3-codex-spark",
   "gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna",
   // The shipped pin also backfills older installed Codex catalogs that predate Astra.
   NATIVE_GPT6_ASTRA_MODEL,
@@ -163,7 +162,6 @@ const NATIVE_GPT56_FAMILY = new Set<string>([
 
 export const NATIVE_OPENAI_CONTEXT_OVERRIDES: Record<string, { contextWindow?: number; maxContextWindow?: number; maxInputTokens?: number }> = {
   "gpt-5.5": { contextWindow: 272_000, maxContextWindow: 272_000 },
-  "gpt-5.3-codex-spark": { contextWindow: 100_000, maxContextWindow: 100_000 },
   "gpt-5.6-sol": { contextWindow: NATIVE_GPT56_CONTEXT_WINDOW, maxContextWindow: NATIVE_GPT56_MAX_INPUT_TOKENS, maxInputTokens: NATIVE_GPT56_MAX_INPUT_TOKENS },
   "gpt-5.6-terra": { contextWindow: NATIVE_GPT56_CONTEXT_WINDOW, maxContextWindow: NATIVE_GPT56_MAX_INPUT_TOKENS, maxInputTokens: NATIVE_GPT56_MAX_INPUT_TOKENS },
   "gpt-5.6-luna": { contextWindow: NATIVE_GPT56_CONTEXT_WINDOW, maxContextWindow: NATIVE_GPT56_MAX_INPUT_TOKENS, maxInputTokens: NATIVE_GPT56_MAX_INPUT_TOKENS },
@@ -378,8 +376,7 @@ export function nativeInputModalities(slug: string): string[] {
   if (Array.isArray(upstream?.input_modalities) && upstream!.input_modalities!.length > 0) {
     return [...upstream!.input_modalities as string[]];
   }
-  // gpt-5.3-codex-spark is not in the upstream snapshot; all supported natives are
-  // text+image capable, so default to the family baseline rather than text-only.
+  // Without a pinned row, retain the native family modality baseline.
   return ["text", "image"];
 }
 
@@ -393,7 +390,7 @@ export function nativeReasoningEfforts(slug: string): string[] {
     // include ultra while Luna intentionally ends at max.
     return levels.flatMap(l => typeof l.effort === "string" ? [l.effort] : []);
   }
-  // gpt-5.3-codex-spark is not in upstream snapshot — use the standard old-ladder default.
+  // Without a pinned row, use the standard old-ladder default.
   return ["low", "medium", "high", "xhigh"];
 }
 
@@ -854,7 +851,7 @@ function catalogNativeSlugs(): string[] {
 }
 
 export function listCatalogNativeSlugs(): string[] {
-  // Ensure documented additions (e.g. gpt-5.3-codex-spark) appear even when the bundled catalog
+  // Ensure documented additions (e.g. gpt-6-astra) appear even when the bundled catalog
   // predates the slug — mirrors nativeOpenAiSlugs() which already merges them for /v1/models.
   return unique([...catalogNativeSlugs(), ...DOCUMENTED_NATIVE_OPENAI_ADDITIONS]);
 }

package/src/codex/catalog/native-models.ts

@@ -155,7 +155,7 @@ export function nativeOpenAiAliasPresentation(slug: string): { displayName: stri
  * Devlog: 260816_codexrs_multiagent_v2_and_history_perf/011 §4-bis.
  */
 export const NATIVE_OPENAI_MODELS = [
-  "gpt-5.5", "gpt-5.3-codex-spark",
+  "gpt-5.5",
   "gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna",
   NATIVE_DAYBREAK_BLUE_MODEL,
   NATIVE_GPT6_ASTRA_MODEL,
@@ -178,7 +178,7 @@ export const SUPPORTED_NATIVE_OPENAI_SLUGS = new Set(NATIVE_OPENAI_MODELS);
  * thing that makes a slug retired is upstream withdrawing it.
  */
 export const RETIRED_NATIVE_OPENAI_MODELS: ReadonlySet<string> = new Set([
-  "gpt-5.4", "gpt-5.4-mini",
+  "gpt-5.4", "gpt-5.4-mini", "gpt-5.3-codex-spark",
 ]);
 
 /**
@@ -192,8 +192,8 @@ export const RETIRED_NATIVE_OPENAI_MODELS: ReadonlySet<string> = new Set([
  * flipped false — letting a drain silently rewrite the operator's configured subagent model.
  *
  * It is an explicit list rather than `SUPPORTED_NATIVE_OPENAI_SLUGS`, which would have widened
- * the sentinel to `gpt-5.5` and `gpt-5.3-codex-spark` as well. Those
- * models were never covered, and widening would turn "fell back and answered" into a
+ * the sentinel to `gpt-5.5` as well. That
+ * model was never covered, and widening would turn "fell back and answered" into a
  * maintenance error for the most commonly configured fallback slug in the repo. Membership is
  * the set the drain behaviour was actually reasoned about: the account-gated natives plus the
  * flagships that just left that set.

package/src/codex/catalog/parsing.ts

@@ -337,15 +337,6 @@ export function findSupportedNativeTemplate(catalog: RawCatalog | null): RawEntr
   ) ?? null;
 }
 
-/**
- * Native OpenAI slugs that do NOT support the Fast (priority) service tier.
- * Upstream may advertise service_tiers for these models, but the tier is not
- * actually available — strip it so the Codex UI does not offer a dead toggle.
- */
-const NO_FAST_TIER_NATIVE_SLUGS = new Set([
-  "gpt-5.3-codex-spark",
-]);
-
 /** Does this row already carry an `ultrafast` tier the operator put there themselves? */
 /**
  * Read the opt-in from the live config, ONCE per catalog build.
@@ -438,14 +429,6 @@ export function normalizeServiceTiers(entry: RawEntry): RawEntry {
         ? { ...tier, description: "2x speed, increased usage" } : tier,
     );
   }
-  // Strip service tiers for models that do not actually support the Fast tier.
-  if (typeof entry.slug === "string" && NO_FAST_TIER_NATIVE_SLUGS.has(entry.slug)) {
-    delete entry.service_tier;
-    delete entry.service_tiers;
-    delete entry.default_service_tier;
-    delete entry.additional_speed_tiers;
-    return entry;
-  }
   // Codex stores the user-facing config spelling as "fast", but the catalog/request
   // service tier id is "priority" in current codex-rs. Keep legacy catalogs working.
   if (entry.service_tier === "fast") entry.service_tier = "priority";
@@ -517,9 +500,8 @@ export function applyNativeOpenAiContextOverride(entry: RawEntry, limits?: Nativ
     }
   }
   // providerContextCaps.openai is a ceiling for native OpenAI rows regardless of where the
-  // advertised window came from (#1430): preserved rows without a hardcoded override (e.g.
-  // gpt-5.3-codex-spark) must stay under the cap too, and auto-compaction follows the capped
-  // window.
+  // advertised window came from (#1430): preserved rows without a hardcoded override
+  // must stay under the cap too, and auto-compaction follows the capped window.
   // The per-model window narrows the same rows for the same reason.
   const currentContext = typeof entry.context_window === "number" ? entry.context_window : undefined;
   const cappedContext = narrowNativeMaxContextWindow(nativeSlug, currentContext, limits);

package/src/codex/catalog/provider-fetch.ts

@@ -600,6 +600,7 @@ function providerCatalogFingerprint(name: string, prov: OcxProviderConfig): Reco
     maxOut: prov.modelMaxOutputTokens ?? null,
     autoCompact: prov.modelAutoCompactTokenLimits ?? null,
     inMod: prov.modelInputModalities ?? null,
+    capabilities: prov.modelCapabilities ?? null,
     re: prov.modelReasoningEfforts ?? null,
     defRe: prov.modelDefaultReasoningEfforts ?? null,
     rsSum: prov.modelSupportsReasoningSummaries ?? null,
@@ -673,7 +674,9 @@ export function configuredContextWindow(prov: OcxProviderConfig, id: string): nu
 }
 
 export function configuredInputModalities(prov: OcxProviderConfig, id: string): string[] | undefined {
-  const modalities = modelRecordValue(prov.modelInputModalities, id);
+  const declared = Object.hasOwn(prov.modelCapabilities ?? {}, id)
+    ? prov.modelCapabilities?.[id]?.inputModalities : undefined;
+  const modalities = declared ?? modelRecordValue(prov.modelInputModalities, id);
   return Array.isArray(modalities) && modalities.length > 0 ? [...modalities] : undefined;
 }
 
@@ -1736,6 +1739,12 @@ async function fetchProviderModelsWithAuth(
           id,
           provider: name,
           ...(liveWindow ? { contextWindow: liveWindow } : {}),
+          // The account catalog names the effort variants each base model has, so
+          // its ladder is measured rather than assumed. Without this the entry
+          // inherits the generic routed ladder and offers rungs the model rounds
+          // away, and every client that keys an effort control off this field —
+          // the Pi-shaped exports — renders no control at all.
+          ...(liveResult.efforts[id]?.length ? { reasoningEfforts: liveResult.efforts[id] } : {}),
           ...catalogHintsFromProviderConfig(name, prov, id, contextCap, metadataModelIdCaseFold, captured.effectiveAlias),
         } as CatalogModel;
       });