@bitkyc08/opencodex 2.58.0 → 2.59.0

package/src/codex/catalog/effort.ts

@@ -226,10 +226,12 @@ export function applyReasoningLevels(
   effortsOverride?: string[],
   defaultOverride?: string,
   preserveExact = false,
+  suppressSyntheticMax = false,
 ): void {
   let efforts = sanitizeCodexReasoningEfforts(effortsOverride) ?? ROUTED_REASONING_LEVELS.map(l => l.effort);
-  // Mock top tiers (user decision 260709): every reasoning-capable model advertises `max`
-  // even when the provider ladder stops lower — subagent spawns pass `max` DIRECTLY
+  // Mock top tiers (user decision 260709): reasoning-capable routed models advertise `max`
+  // even when the provider ladder stops lower, unless the model opts out of that synthesis.
+  // Subagent spawns pass `max` DIRECTLY
   // (no ultra->max client conversion) and codex-rs validates it by catalog membership,
   // so a missing max rung hard-fails spawn_agent effort overrides. The wire stays honest:
   // routed adapters clamp via clampToSupportedCodexEffort and natives via
@@ -237,7 +239,7 @@ export function applyReasoningLevels(
   // reasoning-capable, so it must not grow synthetic top rungs.
   if (!preserveExact && efforts.length > 0 && efforts.some(effort => effort !== "none" && effort !== "minimal")) {
     const additions: string[] = [];
-    if (!efforts.includes("max")) additions.push("max");
+    if (!suppressSyntheticMax && !efforts.includes("max")) additions.push("max");
     if (!efforts.includes("ultra")) additions.push("ultra");
     if (additions.length > 0) efforts = sanitizeCodexReasoningEfforts([...efforts, ...additions]) ?? efforts;
   }
@@ -258,9 +260,11 @@ export function applyReasoningLevels(
   }
   entry.default_reasoning_level = defaultOverride && efforts.includes(defaultOverride)
     ? defaultOverride
-    : efforts.includes("medium") ? "medium" : efforts.includes("high") ? "high"
-    // Sentinels never become the implicit default when real rungs are declared.
-    : efforts.find(effort => effort !== "none" && effort !== "minimal") ?? efforts[0];
+    : suppressSyntheticMax && defaultOverride === "max"
+      ? clampedDefaultEffort(defaultOverride, efforts)
+      : efforts.includes("medium") ? "medium" : efforts.includes("high") ? "high"
+        // Sentinels never become the implicit default when real rungs are declared.
+        : efforts.find(effort => effort !== "none" && effort !== "minimal") ?? efforts[0];
 }
 
 /**

package/src/codex/catalog/gather-capture.ts

@@ -499,6 +499,7 @@ function providerCatalogFingerprint(name: string, prov: OcxProviderConfig): Reco
     inMod: prov.modelInputModalities ?? null,
     capabilities: prov.modelCapabilities ?? null,
     re: prov.modelReasoningEfforts ?? null,
+    suppressMax: prov.modelSuppressSyntheticMax ?? null,
     defRe: prov.modelDefaultReasoningEfforts ?? null,
     rsSum: prov.modelSupportsReasoningSummaries ?? null,
     verbosity: prov.modelSupportsVerbosity ?? null,

package/src/codex/catalog/model-hints.ts

@@ -296,6 +296,7 @@ export function applyProviderConfigHints(
     inputModalities = base.includes("image") ? [...base] : [...base, "image"];
   }
   const reasoningEfforts = configuredReasoningEfforts(prov, model.id);
+  const suppressSyntheticMax = modelRecordValue(prov.modelSuppressSyntheticMax, model.id) === true;
   const defaultReasoningEffort = modelRecordValue(prov.modelDefaultReasoningEfforts, model.id) ?? model.defaultReasoningEffort;
   const supportsReasoningSummaries = configuredReasoningSummarySupport(prov, model.id);
   const supportsVerbosity = configuredVerbositySupport(name, prov, model.id);
@@ -305,6 +306,7 @@ export function applyProviderConfigHints(
     supportsServiceTier: _staleServiceTier,
     fastTierDescription: _staleFastTierDescription,
     providerAlias: _staleProviderAlias,
+    suppressSyntheticMax: _staleSuppressSyntheticMax,
     ...modelWithoutServiceTier
   } = model;
   // 已发现窗口只允许被配置值压低；缺窗口时，已开的 Context cap 就是实际窗口。
@@ -321,6 +323,7 @@ export function applyProviderConfigHints(
     ...(hintedWindow !== undefined ? { contextWindow: hintedWindow } : {}),
     ...(inputModalities ? { inputModalities } : {}),
     ...(reasoningEfforts !== undefined ? { reasoningEfforts } : {}),
+    ...(suppressSyntheticMax ? { suppressSyntheticMax: true } : {}),
     ...(configuredMaxInput !== undefined
       ? {
         maxInputTokens: typeof model.maxInputTokens === "number" && model.maxInputTokens > 0
@@ -394,6 +397,31 @@ export function applyConfigHintsToCachedModels(
 ): CatalogModel[] {
   return models.map(model => applyProviderConfigHints(name, prov, model, contextCap, metadataModelIdCaseFold, effectiveAlias));
 }
+
+/** Catalog slugs whose configured model must not gain a missing synthetic max rung. */
+export function suppressedSyntheticMaxCatalogSlugs(
+  config: Pick<OcxConfig, "providers">,
+  models: readonly CatalogModel[],
+  observedEntries: readonly { slug?: unknown }[] = [],
+): ReadonlySet<string> {
+  const slugs = new Set(models
+    .filter(model => model.suppressSyntheticMax === true)
+    .map(catalogModelSlug));
+  for (const [provider, providerConfig] of Object.entries(config.providers)) {
+    const configured = providerConfig.modelSuppressSyntheticMax ?? {};
+    const encoded = Object.fromEntries(Object.entries(configured)
+      .map(([modelId, suppress]) => [routedSlug(provider, modelId).slice(provider.length + 1), suppress]));
+    for (const [modelId, suppress] of Object.entries(configured)) {
+      if (suppress === true) slugs.add(routedSlug(provider, modelId));
+    }
+    for (const entry of observedEntries) {
+      const slug = typeof entry.slug === "string" ? entry.slug : "";
+      if (!slug.startsWith(`${provider}/`)) continue;
+      if (modelRecordValue(encoded, slug.slice(provider.length + 1)) === true) slugs.add(slug);
+    }
+  }
+  return slugs;
+}
 export const QUIET_AUTHORITATIVE_CATALOG_PROVIDERS = new Set(["kimi", "xai"]);
 
 export const CALLABLE_CONFIGURED_COMPATIBILITY_MODELS: Readonly<Record<string, ReadonlySet<string>>> = {
@@ -582,10 +610,11 @@ function discoveredPricingRate(value: unknown): number | undefined {
 /**
  * Cost class for one discovered row, read from the provider's own `pricing` object (#3666).
  *
- * Fail closed. Only a complete pair of non-negative numeric rates classifies at all; a missing,
- * one-sided, non-numeric, or negative rate is "unknown" and therefore excluded from a free-only
- * filter. Showing a paid model under a Free filter spends the user's money, while hiding a free
- * one costs a click.
+ * Fail closed. Any positive numeric component proves the model is paid. Calling it free requires
+ * a complete prompt/completion pair and every published pricing component to be a non-negative
+ * numeric zero; an unsupported component is "unknown" because it may describe another charge.
+ * Showing a paid model under a Free filter spends the user's money, while hiding a free one costs
+ * a click.
  *
  * Two things that look like evidence and are not. A `:free` id suffix is an OpenRouter naming
  * convention, not a price — Nous ships `:free` slugs on a provider whose `freeTier` is false on
@@ -598,10 +627,13 @@ function discoveredPricingRate(value: unknown): number | undefined {
 export function discoveredPricingStatus(item: ProviderModelsApiItem): "free" | "paid" | "unknown" {
   const pricing = plainRecord(item.pricing) ?? plainRecord(plainRecord(item.metadata)?.pricing);
   if (!pricing) return "unknown";
+  const rates = Object.values(pricing).map(discoveredPricingRate);
+  if (rates.some(rate => rate !== undefined && rate > 0)) return "paid";
+  if (rates.some(rate => rate === undefined)) return "unknown";
   const prompt = discoveredPricingRate(pricing.prompt ?? pricing.input);
   const completion = discoveredPricingRate(pricing.completion ?? pricing.output);
   if (prompt === undefined || completion === undefined) return "unknown";
-  return prompt === 0 && completion === 0 ? "free" : "paid";
+  return "free";
 }
 
 export function catalogHintsFromModelsApiItem(providerName: string, item: ProviderModelsApiItem): Partial<CatalogModel> {

package/src/codex/catalog/parsing.ts

@@ -112,6 +112,8 @@ export interface CatalogModel {
   displayName?: string;
   owned_by?: string;
   reasoningEfforts?: string[];
+  /** Suppress only catalog synthesis of a missing max rung; provider-declared max survives. */
+  suppressSyntheticMax?: boolean;
   defaultReasoningEffort?: string;
   contextWindow?: number;
   maxInputTokens?: number;
@@ -255,12 +257,19 @@ export function readCodexCatalogPath(): string {
   return activeDefaultCatalogPath();
 }
 
-/** Resolve the configured catalog without consulting ambient CODEX_HOME again. */
-export function readCodexCatalogPathForHome(codexHome: string): string {
+/**
+ * Resolve the configured catalog without consulting ambient CODEX_HOME again.
+ *
+ * `configText` is for a caller that has already read that same `config.toml` under
+ * its own constraints - the prompt-text probe reads it bounded, on the request
+ * thread - so resolving the catalog does not cost a second, unbounded read of the
+ * file the caller is holding. Omitting it keeps the original behaviour.
+ */
+export function readCodexCatalogPathForHome(codexHome: string, configText?: string): string {
   try {
     const configPath = join(codexHome, "config.toml");
-    if (existsSync(configPath)) {
-      const toml = readFileSync(configPath, "utf-8");
+    if (configText !== undefined || existsSync(configPath)) {
+      const toml = configText ?? readFileSync(configPath, "utf-8");
       const path = readRootTomlString(toml, "model_catalog_json");
       if (path) return resolve(codexHome, path);
     }
@@ -284,6 +293,30 @@ export function readConfiguredAutoReviewModel(): string | null {
   return null;
 }
 
+/**
+ * Read the root `model` pin from Codex's config.toml (issue #4646).
+ *
+ * Codex starts every new session on this id, and nothing in opencodex checks that the id is one
+ * the proxy actually exposes: the pin lives in Codex's config, while exposure is decided here by
+ * `disabledModels`, provider `selectedModels`, and account entitlements. When the two disagree
+ * every turn fails and no surface says why, which is what the `ocx doctor` section added for
+ * #4646 reports.
+ *
+ * Read-only, and deliberately the same shape and the same swallow-and-return-null error policy as
+ * `readConfiguredAutoReviewModel` above: a diagnostic must degrade to "unknown" on an unreadable
+ * or absent config rather than throw out of the surface that called it.
+ */
+export function readConfiguredDefaultModel(): string | null {
+  try {
+    const configPath = activeCodexConfigPath();
+    if (existsSync(configPath)) {
+      const toml = readFileSync(configPath, "utf-8");
+      return readRootTomlString(toml, "model");
+    }
+  } catch { /* ignore */ }
+  return null;
+}
+
 export function parseCatalogJson(raw: string): RawCatalog | null {
   try {
     const cat = JSON.parse(raw);
@@ -627,6 +660,14 @@ export interface MultiAgentModeOptions {
    * so they can still spawn Grok/Claude — ChatGPT encrypts v2 NEW_TASK bodies.
    */
   keepNativeChatGptOnV1?: boolean;
+  /**
+   * Pristine installed-catalog pins keyed by bare native slug. When provided, the
+   * backup — not the bundled snapshot — is authoritative for the rows it contains,
+   * and a preserved live/native row outside it keeps the pin it already carries:
+   * an absent baseline entry cannot distinguish a stale forced stamp from a
+   * legitimate user- or provider-preserved pin, so the non-destructive read wins.
+   */
+  nativeDefaults?: ReadonlyMap<string, string | null>;
 }
 
 /** Catalog rows that run on the ChatGPT backend (encrypt v2 child tasks). */
@@ -707,13 +748,34 @@ export function applyMultiAgentMode(
         && hasNativeOpenAiCapabilityMetadata(routedNativeSlug)
         ? routedNativeSlug
         : undefined;
+      const accountBoundNativeSlug = trustedAccountBoundNativeCatalogSlug(entry);
+      const nativeLookupSlug = accountBoundNativeSlug ?? slug;
+      // The baseline is built from bare native slugs only, so "absent from the
+      // baseline" is not evidence about a routed row — it is guaranteed. Only a
+      // native row can carry a pin the baseline legitimately failed to mention;
+      // a routed row keeps the documented default-mode normalization.
+      const isNativeCatalogEntry = accountBoundNativeSlug !== undefined || !slug.includes("/");
+      const hasNativeDefault = !nativeAlias
+        && codexForwardCapabilityAlias === undefined
+        && options.nativeDefaults?.has(nativeLookupSlug) === true;
       const upstreamPin = nativeAlias
         ? nativeMultiAgentVersion(slug)
         : codexForwardCapabilityAlias
           ? nativeMultiAgentVersion(codexForwardCapabilityAlias)
-          : UPSTREAM_NATIVE_ENTRIES.get(trustedAccountBoundNativeCatalogSlug(entry) ?? slug)?.multi_agent_version;
+          : hasNativeDefault
+            ? options.nativeDefaults?.get(nativeLookupSlug)
+            : options.nativeDefaults === undefined
+              ? UPSTREAM_NATIVE_ENTRIES.get(nativeLookupSlug)?.multi_agent_version
+              : undefined;
       if (typeof upstreamPin === "string") {
         entry.multi_agent_version = upstreamPin;
+      } else if (options.nativeDefaults !== undefined
+        && !nativeAlias
+        && codexForwardCapabilityAlias === undefined
+        && isNativeCatalogEntry
+        && !hasNativeDefault
+        && typeof entry.multi_agent_version === "string") {
+        continue;
       } else if (v2FeatureEnabled) {
         entry.multi_agent_version = "v2";
       } else {
@@ -888,3 +950,19 @@ export function readNativeBaseline(catalogPath: string): Map<string, number> {
   }
   return out;
 }
+
+/**
+ * Extract the pristine baseline's per-slug multi-agent pins. A bare native row that
+ * carried no pin maps to null so "baseline says unpinned" stays distinguishable
+ * from "baseline never contained this row".
+ */
+export function nativeMultiAgentDefaults(
+  models: readonly Readonly<Record<string, unknown>>[] | null | undefined,
+): Map<string, string | null> {
+  const out = new Map<string, string | null>();
+  for (const entry of models ?? []) {
+    if (typeof entry.slug !== "string" || entry.slug.includes("/")) continue;
+    out.set(entry.slug, typeof entry.multi_agent_version === "string" ? entry.multi_agent_version : null);
+  }
+  return out;
+}

package/src/codex/catalog/reserve-warn.ts

@@ -0,0 +1,96 @@
+import type { OcxConfig } from "../../types";
+import { isEffectiveCodexDesktopAuthless } from "../loopback-target";
+import { NATIVE_RESERVE_MODEL } from "./native-models";
+
+/**
+ * #4811: why an opted-in install still gets no Luna Reserve row.
+ *
+ * The Reserve projection is account-qualified — its slug is `<selector>/gpt-reserve` — so it
+ * cannot be written without a selector that targets the main Codex account. On a fresh authless
+ * install `codexAccountNamespaces` is empty, the account picker is therefore off, no selectors
+ * exist, and `createReserveCatalogProjection` returns `undefined`. Nothing downstream can
+ * explain that: an omitted row has no place to carry a reason, which is exactly the shape of
+ * #4212 for account-gated natives, and the same answer applies — say it once, here, while the
+ * inputs that produced the omission are still in scope.
+ *
+ * Deliberately scoped to an operator who asked for the feature. A default install has
+ * `codexDesktopAuthless` unset, wants no Reserve row, and must not be told about one. An install
+ * that stores the flag on a bind where it cannot take effect is a different silence, already
+ * reported as `inertReason` by `describeCodexDesktopSwitches`, and is not repeated here.
+ */
+export type ReserveCatalogSuppressionReason =
+  | "no-canonical-openai-provider"
+  | "account-picker-disabled"
+  | "no-account-namespaces"
+  | "no-main-account-selector";
+
+type ReserveSuppressionConfig = Pick<
+  OcxConfig,
+  | "runtimeRole"
+  | "hostname"
+  | "unauthenticatedLoopbackListener"
+  | "codexDesktopAuthless"
+  | "codexAccountNamespaces"
+  | "codexAccountPickerEnabled"
+>;
+
+export interface ReserveSuppressionInput {
+  /** Already resolved by the caller; passed in so this module stays off the metadata graph. */
+  includeAccountBoundNativeOpenAi: boolean;
+  /** Selectors that resolved to the main Codex account. A non-empty list means no suppression. */
+  mainSelectors: readonly string[];
+}
+
+export function reserveCatalogSuppressionReason(
+  config: ReserveSuppressionConfig,
+  input: ReserveSuppressionInput,
+): ReserveCatalogSuppressionReason | undefined {
+  if (!isEffectiveCodexDesktopAuthless(config) || input.mainSelectors.length > 0) return undefined;
+  if (!input.includeAccountBoundNativeOpenAi) return "no-canonical-openai-provider";
+  // Checked before the empty-map case: when an operator has explicitly turned the picker off,
+  // naming the empty map would send them to hand-author selectors that the opt-in generates.
+  if (config.codexAccountPickerEnabled === false) return "account-picker-disabled";
+  if (Object.keys(config.codexAccountNamespaces ?? {}).length === 0) return "no-account-namespaces";
+  return "no-main-account-selector";
+}
+
+const SUPPRESSION_TEXT: Readonly<Record<ReserveCatalogSuppressionReason, {
+  cause: string;
+  action: string;
+}>> = {
+  "no-canonical-openai-provider": {
+    cause: "no enabled canonical OpenAI provider can serve account-qualified native routes",
+    action: "Enable the built-in \"openai\" provider with forwarded ChatGPT auth.",
+  },
+  "account-picker-disabled": {
+    cause: "the Codex account picker is turned off (codexAccountPickerEnabled is false)",
+    action: "Set codexAccountPickerEnabled to true to generate the default account selectors.",
+  },
+  "no-account-namespaces": {
+    cause: "no Codex account selectors are configured (codexAccountNamespaces is empty)",
+    action: "Enable the Codex account picker once to generate the default account selectors.",
+  },
+  "no-main-account-selector": {
+    cause: "no configured selector in codexAccountNamespaces targets the main Codex account",
+    action: "Map one selector to the main Codex account.",
+  },
+};
+
+const warnedReserveSuppression = new Set<string>();
+
+/** Test seam: the warn-once memory is process-global, so a case needs to be able to clear it. */
+export function resetReserveSuppressionWarningsForTests(): void {
+  warnedReserveSuppression.clear();
+}
+
+export function warnReserveSuppressedOnce(reason: ReserveCatalogSuppressionReason): void {
+  if (warnedReserveSuppression.has(reason)) return;
+  warnedReserveSuppression.add(reason);
+  const text = SUPPRESSION_TEXT[reason];
+  console.warn(
+    `[opencodex] catalog sync: authless Codex Desktop routing is on, but the Luna Reserve row `
+      + `(<selector>/${NATIVE_RESERVE_MODEL}) is not being written because ${text.cause}. `
+      + `The Reserve projection is account-qualified and needs a selector for the main Codex `
+      + `account. ${text.action}`,
+  );
+}

package/src/codex/catalog/retained-sync.ts

@@ -33,6 +33,7 @@ import {
   readCodexCatalogPath,
   readCodexCatalogPathForHome,
   readNativeBaseline,
+  nativeMultiAgentDefaults,
 } from "./parsing";
 import type { CatalogModel, MultiAgentMode, RawCatalog, RawEntry } from "./parsing";
 import {
@@ -50,6 +51,7 @@ import { trustedAccountBoundNativeCatalogSlug } from "./account-models";
 import { bundledCatalogCacheState, loadBundledCodexCatalog } from "./bundled";
 import { isMultiAgentV2Enabled } from "../features";
 import { clampCatalogModelsToCodexSupport } from "./effort";
+import { suppressedSyntheticMaxCatalogSlugs } from "./model-hints";
 import { filterCatalogVisibleModels, gatherRoutedModels, type CatalogGatherProviderModelOutcome } from "./provider-fetch";
 import { dedupeCatalogEntriesBySlug, enforceCatalogSlugUniqueness, exactComboCatalogSlugs, type ComboCatalogOmission } from "./aggregation";
 import {
@@ -75,6 +77,7 @@ import {
 import { finishUpstreamNativeEntry } from "./derive-entry";
 import { finalizeAutoReviewModelOverride } from "./auto-review";
 import { gatedNativeAccountLabel, gatedNativeReauthSuppressionReason, warnGatedNativeSuppressedOnce } from "./gated-native-warn";
+import { reserveCatalogSuppressionReason, warnReserveSuppressedOnce } from "./reserve-warn";
 
 interface RetainedCatalogSyncRead {
   readonly catalogPath: string;
@@ -320,6 +323,11 @@ function writeRetainedCatalogSync({
   const enabledGo = filterCatalogVisibleModels(goModels, config);
   const featured = config.subagentModels ?? [];
   const orderedGoModels = orderForSubagents(enabledGo, featured); // stable tie-break among equal priorities
+  const suppressedSyntheticMaxSlugs = suppressedSyntheticMaxCatalogSlugs(
+    config,
+    orderedGoModels,
+    catalogModelsForMerge,
+  );
   const modelPickerOrder = config.modelPickerOrder ?? [];
   const multiAgentMode: MultiAgentMode = config.multiAgentMode === "v1" || config.multiAgentMode === "v2" ? config.multiAgentMode : "default";
   const exactComboSlugs = exactComboCatalogSlugs(config);
@@ -376,6 +384,14 @@ function writeRetainedCatalogSync({
   const accountTargets = new Map(codexAccountNamespaceEntries(config));
   const reserveMainSelectors = accountSelectors.filter(selector =>
     isMainCodexAccountTarget(accountTargets.get(selector) ?? ""));
+  // #4811: an omitted Reserve row carries no reason, so the explanation has to be emitted here,
+  // where the selector inputs that produced the omission are still in scope. Silent for every
+  // install that did not opt into authless Codex Desktop routing.
+  const reserveSuppression = reserveCatalogSuppressionReason(config, {
+    includeAccountBoundNativeOpenAi,
+    mainSelectors: reserveMainSelectors,
+  });
+  if (reserveSuppression) warnReserveSuppressedOnce(reserveSuppression);
   // The active file can own a bare source even when the bundled catalog is the build base.
   // A previously clamped qualified projection must not shorten a retained genuine ladder.
   const reserveObservations = [
@@ -443,6 +459,7 @@ function writeRetainedCatalogSync({
   // like `gpt-5.5`; those must not delete the native OpenAI/Codex base row.
   const baselineCatalog = readCatalogBackup(catalogPath);
   const baseline = readNativeBaseline(catalogPath);
+  const nativePinBaseline = nativeMultiAgentDefaults(baselineCatalog?.models);
   const gatheredProviderNames = new Set(
     Object.entries(config.providers ?? {})
       .filter(([, prov]) => prov.disabled !== true)
@@ -512,8 +529,10 @@ function writeRetainedCatalogSync({
     includeNativeOpenAi,
     accountBoundEntries,
     suppressedBareNativeSlugs,
+    suppressedSyntheticMaxSlugs,
     openaiContextCap,
     nativeDisplayNames: config.providers[OPENAI_CODEX_PROVIDER_ID]?.modelDisplayNames,
+    nativeMultiAgentDefaults: nativePinBaseline,
     policy: {
       ...CANONICAL_NATIVE_CATALOG_CONTENT_POLICY,
       nativeBackfillSlugs: [...availableBareNativeSlugs, ...observedNativeSlugs],

package/src/codex/catalog/routed-gather.ts

@@ -850,6 +850,26 @@ function augmentRoutedModelsWithCapturedOpenAiApiRows(
   ];
 }
 
+/**
+ * Add generated-registry rows the live provider list did not return, and backfill a
+ * published context window onto a live row that arrived without one.
+ *
+ * The backfill is the reason this function has a merge branch at all. It used to skip every
+ * id the live list returned, which is correct for a row that already knows its window and
+ * wrong for the normal OpenCode Go case, where discovery returns an id with no context
+ * field at all. The serialized Codex catalog was unaffected, because
+ * `applyCatalogMetadata` writes `context_window` onto the entry straight from the generated
+ * table; the absence was only visible to consumers that read `CatalogModel.contextWindow`
+ * (#4971). Those are not cosmetic: `buildClaudeContextWindows` drops a routed row with no
+ * window from the map that decides the `[1m]` marker, so a published 1M model could not be
+ * recognized as one, and the Grok config writer and several client exporters omit the field
+ * entirely rather than emit a known value.
+ *
+ * It is a missing-value fill, never an override: a live positive window still wins, because
+ * the upstream is the authority on its own model. The seeded row is re-hinted so operator
+ * precedence is unchanged — a configured window still lowers it and `providerContextCaps`
+ * still caps it, exactly as for an appended row.
+ */
 export function augmentRoutedModelsWithMetadata(
   models: CatalogModel[],
   providerNames: string[],
@@ -858,7 +878,7 @@ export function augmentRoutedModelsWithMetadata(
   metadataModelIdCaseFoldByProvider?: ReadonlyMap<string, boolean>,
 ): CatalogModel[] {
   const out = [...models];
-  const seen = new Set(out.map(m => `${m.provider}/${m.id}`));
+  const indexByKey = new Map(out.map((model, index) => [`${model.provider}/${model.id}`, index]));
   for (const provider of providerNames) {
     if (!JAWCODE_CATALOG_AUGMENT_PROVIDERS.has(provider)) continue;
     if (providers?.[provider]?.liveModels === false) continue;
@@ -866,9 +886,28 @@ export function augmentRoutedModelsWithMetadata(
     if (!jawcodeProvider) continue;
     for (const meta of listModelMetadata(jawcodeProvider)) {
       const key = `${provider}/${meta.id}`;
-      if (seen.has(key)) continue;
-      seen.add(key);
       const contextCap = caps ? providerContextCap(caps, provider) : undefined;
+      const existingIndex = indexByKey.get(key);
+      if (existingIndex !== undefined) {
+        const existing = out[existingIndex]!;
+        const publishedWindow = typeof meta.contextWindow === "number" && meta.contextWindow > 0
+          ? meta.contextWindow
+          : undefined;
+        const liveWindow = typeof existing.contextWindow === "number" && existing.contextWindow > 0;
+        if (liveWindow || publishedWindow === undefined) continue;
+        const seeded: CatalogModel = { ...existing, contextWindow: publishedWindow };
+        out[existingIndex] = providers?.[provider]
+          ? applyProviderConfigHints(
+            provider,
+            providers[provider],
+            seeded,
+            contextCap,
+            metadataModelIdCaseFoldByProvider?.get(provider),
+          )
+          : seeded;
+        continue;
+      }
+      indexByKey.set(key, out.length);
       const model: CatalogModel = {
         provider,
         id: meta.id,