@bitkyc08/opencodex 2.74.0 → 2.75.0

package/src/oauth/anthropic-routing.ts

@@ -3,7 +3,7 @@
  *
  * Default OFF. When enabled:
  * - Sticky session affinity across requests that share a session key
- * - 429 cools the failed account and fails over to another eligible account
+ * - 429 and classified pre-output account 403s cool the failed account and fail over
  * - New sessions use `strategy` (default quota): lowest known fiveHour usage (#493),
  *   round-robin, or fill-first — affinity still wins for bound sessions
  *
@@ -12,8 +12,8 @@
  *
  * Affinity is process-local (lost on restart). Cooldown uses Retry-After when present, else
  * the reset time of whichever rate-limit window upstream reports as rejected, else a default
- * backoff. 401/403 credential failures should set needsReauth on the store (existing OAuth
- * path) so the account is excluded from eligibility.
+ * backoff. Classified entitlement/billing 403s use a ten-minute default cooldown.
+ * Token refresh failures retain the existing store needsReauth policy.
  */
 import { createHash } from "node:crypto";
 import { captureOAuthAccountSelection, commitOAuthAccountSelection, credentialGeneration, getAccountSet, getAccountCredential, getAccountCredentialWithStatus } from "./store";
@@ -53,6 +53,7 @@ export type AnthropicRateLimitHeaders = Pick<Headers, "get">;
 const PROVIDER = "anthropic";
 /** Backoff only when upstream supplies no usable deadline. */
 const DEFAULT_COOLDOWN_MS = 60_000;
+const ACCOUNT_REFUSAL_COOLDOWN_MS = 10 * 60_000;
 const AFFINITY_IDLE_TTL_MS = 24 * 60 * 60_000;
 const MAX_AFFINITY_ENTRIES = 2_000;
 const MAX_AFFINITY_COMPONENT_BYTES = 512;
@@ -879,7 +880,21 @@ export function rotateAnthropicAccountOn429(
   rateLimitHeaders?: AnthropicRateLimitHeaders | null,
   decision: AnthropicRouteDecision | null = null,
 ): string | null {
-  if (!recordAnthropicAccount429(config, failedAccountId, retryAfterHeader, now, rateLimitHeaders)) return null;
+  return rotateAnthropicAccountOnRefusal(config, failedAccountId, 429, retryAfterHeader, sessionKey, now, rateLimitHeaders, decision);
+}
+
+/** The caller proves that a 403 is an account refusal before entering this pool policy. */
+export function rotateAnthropicAccountOnRefusal(
+  config: OcxConfig,
+  failedAccountId: string,
+  status: 429 | 403,
+  retryAfterHeader: string | null | undefined,
+  sessionKey?: string | null,
+  now = Date.now(),
+  rateLimitHeaders?: AnthropicRateLimitHeaders | null,
+  decision: AnthropicRouteDecision | null = null,
+): string | null {
+  if (!recordAnthropicAccountRefusal(config, failedAccountId, status, retryAfterHeader, now, rateLimitHeaders)) return null;
 
   // The pool's strategy is a PROACTIVE policy. When the pool is disabled, reactive
   // presence-only recovery must not silently reactivate round-robin/fill-first merely
@@ -889,13 +904,14 @@ export function rotateAnthropicAccountOn429(
     ? pickAlternateAnthropicAccount(config, failedAccountId, now, decision)
     : pickLowestUsage(config, failedAccountId, now);
   if (!next) {
-    console.warn(`[anthropic-pool] ${decision ? `route:#${decision.position} ` : ""}no eligible replacement; returning 429`);
+    console.warn(`[anthropic-pool] ${decision ? `route:#${decision.position} ` : ""}no eligible replacement; returning ${status}`);
     return null;
   }
 
-  console.warn(
-    `[anthropic-pool] ${decision ? `route:#${decision.position} ` : ""}429 on ${formatAnthropicAccountOrdinal(failedAccountId)}; failing over to ${formatAnthropicAccountOrdinal(next)}`,
-  );
+  console.warn(status === 403
+    ? `[anthropic-pool] ${decision ? `route:#${decision.position} ` : ""}account unavailable (403); failing over`
+    : `[anthropic-pool] ${decision ? `route:#${decision.position} ` : ""}429 on ${formatAnthropicAccountOrdinal(failedAccountId)}; failing over to ${formatAnthropicAccountOrdinal(next)}`);
+
   return next;
 }
 
@@ -906,6 +922,18 @@ export function recordAnthropicAccount429(
   retryAfterHeader: string | null | undefined,
   now = Date.now(),
   rateLimitHeaders?: AnthropicRateLimitHeaders | null,
+): boolean {
+  return recordAnthropicAccountRefusal(config, failedAccountId, 429, retryAfterHeader, now, rateLimitHeaders);
+}
+
+/** Account entitlement refusals use a finite backoff; renewing a plan does not require login. */
+export function recordAnthropicAccountRefusal(
+  config: OcxConfig,
+  failedAccountId: string,
+  status: 429 | 403,
+  retryAfterHeader: string | null | undefined,
+  now = Date.now(),
+  rateLimitHeaders?: AnthropicRateLimitHeaders | null,
 ): boolean {
   // Reactive 429 failover is NOT gated on the pool flag. That flag buys PROACTIVE routing --
   // session affinity, quota-ranked new-session selection, autoSwitchThreshold, strategy -- all
@@ -923,8 +951,8 @@ export function recordAnthropicAccount429(
   // without that fallback such a refusal cools for the 60s default and the exhausted
   // account is back in the rotation a minute later.
   const parsedRetry = parseRetryAfterMs(retryAfterHeader, now);
-  const resetDerived = parsedRetry === undefined ? parseRateLimitReset(rateLimitHeaders, now) : undefined;
-  const cooldownMs = parsedRetry ?? resetDerived?.delayMs ?? DEFAULT_COOLDOWN_MS;
+  const resetDerived = status === 429 && parsedRetry === undefined ? parseRateLimitReset(rateLimitHeaders, now) : undefined;
+  const cooldownMs = parsedRetry ?? resetDerived?.delayMs ?? (status === 403 ? ACCOUNT_REFUSAL_COOLDOWN_MS : DEFAULT_COOLDOWN_MS);
   const cooldownGeneration = noteAnthropicCooldownMutation(failedAccountId);
   upstreamHealth.set(failedAccountId, {
     cooldownUntil: now + cooldownMs,

package/src/providers/new-model-policy-runtime.ts

@@ -0,0 +1,83 @@
+import { isDeepStrictEqual } from "node:util";
+import { mutatePersistedConfig, readConfigDiagnostics, validateConfigCandidate } from "../config";
+import { fileBackedConfigPath } from "../config/rebase-provenance";
+import { getConfigPath } from "../config/paths";
+import { observeModelCacheRevision } from "../codex/model-cache";
+import { adoptPersistedModelDiscovery } from "../config/live-reconcile";
+import type { OcxConfig } from "../types";
+import { reconcileSuccessfulModelDiscoveries } from "./new-model-policy";
+
+function inventory(config: OcxConfig): unknown {
+  const validated = validateConfigCandidate(config);
+  if (!validated.ok) return null;
+  const providers = Object.fromEntries(Object.entries(validated.config.providers).map(([name, provider]) => [name, {
+    ...provider,
+    // Initial selection may finish during this discovery, but a re-registration is distinct.
+    initialModelSelection: provider.initialModelSelection?.registrationId,
+  }]));
+  // Compare normalized persisted data, not injected fetch functions. Never log this identity.
+  return JSON.parse(JSON.stringify({ providers, combos: validated.config.combos,
+    policy: validated.config.modelDiscovery?.newModelPolicy }));
+}
+
+export function captureModelDiscoveryBaseline(config: OcxConfig) {
+  const identity = inventory(config);
+  const disk = readConfigDiagnostics();
+  return { identity, persisted: identity !== null && disk.source === "file"
+    && isDeepStrictEqual(identity, inventory(disk.config)) };
+}
+
+/** Publish new-arrival choices before returning discovery rows to any visibility consumer. */
+export function finalizeModelDiscovery(
+  config: OcxConfig,
+  baseline: ReturnType<typeof captureModelDiscoveryBaseline>,
+  models: Iterable<{ provider: string; id: string; custom?: boolean }>,
+  authoritativeProviders: string[],
+  revisions: Map<string, string>,
+  /** Read consumers may publish detached policy state; writers require persisted decisions. */
+  publishProjection?: (projection: OcxConfig) => void,
+): boolean {
+  const filePath = fileBackedConfigPath(config);
+  const rows = [...models];
+  const now = new Date().toISOString();
+  const current = () => (filePath === undefined || filePath === getConfigPath())
+    && isDeepStrictEqual(baseline.identity, inventory(config))
+    && [...revisions].every(([provider, revision]) => observeModelCacheRevision(provider) === revision);
+  if (!current()) return false;
+  const reconcile = (target: OcxConfig) => reconcileSuccessfulModelDiscoveries({
+    config: target, models: rows, authoritativeProviders, now, mode: "discovery",
+  });
+  if (!baseline.persisted && filePath === undefined) {
+    // Standalone/synthetic callers may project their own config, never overwrite another home.
+    reconcile(config);
+    return true;
+  }
+  if (!baseline.persisted && publishProjection) {
+    // Drift already existed at admission. Do not add unsaved disables or advance the live
+    // merge baseline: a later rebase-save must preserve the operator's on-disk choices.
+    const projection = { ...config, modelDiscovery: structuredClone(config.modelDiscovery),
+      disabledModels: config.disabledModels === undefined ? undefined : [...config.disabledModels] };
+    reconcile(projection);
+    publishProjection(projection);
+    return true;
+  }
+  // A file-loaded instance remains file-backed after inventory drift. The locked
+  // freshness gate below refuses stale rows without creating unsaved live disables.
+  try {
+    const result = mutatePersistedConfig(fresh => {
+      if (!current() || !isDeepStrictEqual(baseline.identity, inventory(fresh))) {
+        return { changed: false, value: null };
+      }
+      // Re-evaluate against the latest baseline and manual choices under the mutation lock.
+      // A second caller then adopts a first caller's result rather than disabling an ID twice.
+      const changed = reconcile(fresh);
+      return { changed, value: { modelDiscovery: fresh.modelDiscovery, disabledModels: fresh.disabledModels } };
+    });
+    if (result.status === "unavailable" || !result.value) return false;
+    adoptPersistedModelDiscovery(config, result.value);
+    return true;
+  } catch {
+    // Do not publish an unrecorded arrival when persistence failed. The caller retries discovery.
+    return false;
+  }
+}

package/src/providers/new-model-policy.ts

@@ -8,6 +8,17 @@ export const MAX_RECENT_ARRIVALS_PER_PROVIDER = 50;
 export type KnownModelBaseline = NonNullable<NonNullable<OcxConfig["modelDiscovery"]>["knownModels"]>[string];
 export type NewModelPolicy = "on" | "off";
 
+/**
+ * Which side of the reconciliation is running.
+ *
+ * `converge` (the default) is the catalog convergence cycle: it advances the removal grace and
+ * retires ids missing for {@link MODEL_REMOVAL_GRACE_FETCHES} cycles. `discovery` is the HTTP read
+ * side (GET /v1/models), which is polled far more often than convergence runs; it absorbs genuine
+ * arrivals and reappearances but never advances removal accounting, so a transiently absent id
+ * cannot be retired by repeated polls.
+ */
+export type NewModelPolicyMode = "converge" | "discovery";
+
 export interface NewModelPolicyResult {
   newIds: string[];
   nextBaseline: KnownModelBaseline;
@@ -44,6 +55,8 @@ export function applyNewModelPolicy(options: {
   policy: NewModelPolicy;
   hasSelectedModels?: boolean;
   now: string;
+  /** See {@link NewModelPolicyMode}; defaults to `converge`. */
+  mode?: NewModelPolicyMode;
 }): NewModelPolicyResult {
   const discovered = [...new Set(options.discoveredIds)].sort();
   const prior = options.baseline;
@@ -60,8 +73,17 @@ export function applyNewModelPolicy(options: {
   const seen = new Set(discovered);
   const newIds = discovered.filter(id => !active.has(id) && !removed.has(id));
   const missing: Record<string, number> = {};
+  // Read-side discovery must not advance the removal grace: a per-poll increment would retire a
+  // transiently absent id after three polls. Absence keeps its recorded count (and a reappearance
+  // clears it) instead of moving toward `removed`.
+  const discovery = options.mode === "discovery";
   for (const id of active) {
     if (seen.has(id)) continue;
+    if (discovery) {
+      const priorCount = prior.missing?.[id];
+      if (priorCount !== undefined) missing[id] = priorCount;
+      continue;
+    }
     const count = (prior.missing?.[id] ?? 0) + 1;
     if (count >= MODEL_REMOVAL_GRACE_FETCHES) {
       active.delete(id);
@@ -99,6 +121,8 @@ export function reconcileSuccessfulModelDiscoveries(options: {
   models: Iterable<{ provider: string; id: string; custom?: boolean }>;
   authoritativeProviders: Iterable<string>;
   now: string;
+  /** See {@link NewModelPolicyMode}; defaults to `converge`. */
+  mode?: NewModelPolicyMode;
 }): boolean {
   const byProvider = new Map<string, string[]>();
   for (const model of options.models) {
@@ -118,6 +142,7 @@ export function reconcileSuccessfulModelDiscoveries(options: {
       policy: effectiveNewModelPolicy(options.config, provider),
       hasSelectedModels: (configured.selectedModels?.length ?? 0) > 0,
       now: options.now,
+      mode: options.mode,
     });
     if (result.overflow) continue;
     const priorBaseline = known[provider];

package/src/providers/registry/entries-core.ts

@@ -20,6 +20,7 @@ import {
   ANTHROPIC_MODEL_CONTEXT_WINDOWS,
   ANTHROPIC_MODEL_INPUT_MODALITIES,
   ANTHROPIC_DEFAULT_MAX_OUTPUT_TOKENS,
+  ANTHROPIC_MODEL_MAX_OUTPUT_TOKENS,
   ANTHROPIC_MODEL_REASONING_EFFORTS,
   ZAI_GLM_52_REASONING_EFFORTS,
   ZAI_GLM_53_REASONING_EFFORTS,
@@ -489,6 +490,7 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     // Codex omits max_output_tokens; without a provider budget the Anthropic adapter
     // falls back to 8192, which truncates long answers with stop_reason=max_tokens.
     defaultMaxOutputTokens: ANTHROPIC_DEFAULT_MAX_OUTPUT_TOKENS,
+    modelMaxOutputTokens: { ...ANTHROPIC_MODEL_MAX_OUTPUT_TOKENS },
     defaultModel: "claude-sonnet-5",
     // Claude fast mode on the subscription lane (Claude Code `/fast`): the OAuth route accepts
     // `speed` and gates it on account entitlement (usage credits / org enablement), probed live
@@ -516,6 +518,7 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     modelInputModalities: { ...ANTHROPIC_MODEL_INPUT_MODALITIES },
     modelReasoningEfforts: { ...ANTHROPIC_MODEL_REASONING_EFFORTS },
     defaultMaxOutputTokens: ANTHROPIC_DEFAULT_MAX_OUTPUT_TOKENS,
+    modelMaxOutputTokens: { ...ANTHROPIC_MODEL_MAX_OUTPUT_TOKENS },
     defaultModel: "claude-sonnet-5",
     fastWire: ANTHROPIC_FAST_WIRE,
     modelSupportsServiceTier: { ...ANTHROPIC_FAST_MODELS },

package/src/providers/registry/model-seeds.ts

@@ -19,9 +19,38 @@ export const ANTHROPIC_MODEL_INPUT_MODALITIES: Record<string, string[]> = Object
   ANTHROPIC_MODELS.map(id => [id, ["text", "image"]]),
 );
 // Every current Claude family accepts at least 64k output tokens (Haiku 4.5 / Sonnet 4.x
-// through Opus 5 and Fable 5). Anthropic caps max_tokens per model server-side, so a
-// larger request never over-allocates; it only stops the 8192 truncation.
+// through Opus 5 and Fable 5), so this stays the floor for a model id not listed in
+// ANTHROPIC_MODEL_MAX_OUTPUT_TOKENS below.
 export const ANTHROPIC_DEFAULT_MAX_OUTPUT_TOKENS = 64_000;
+/**
+ * Per-model synchronous Messages API output maxima, each read from that model's own overview
+ * page on platform.claude.com (`/docs/en/models/<slug>/overview`), which states the number in
+ * its header line and again in the Capabilities table. Deliberately NOT the 300K Message
+ * Batches extended-output beta, which needs `output-300k-2026-03-24` and does not apply to the
+ * synchronous route these providers use.
+ *
+ * Every seeded Claude model except Haiku 4.5 is 128K. Haiku 4.5 is genuinely 64K and is left
+ * out so it keeps inheriting ANTHROPIC_DEFAULT_MAX_OUTPUT_TOKENS.
+ *
+ * Without this the 64000 default stood in for all of them, which understates the real ceiling
+ * by half on every Opus, Sonnet and Fable model. `resolveOutputCeiling` is the value the
+ * adapter budgets against when a caller declares no `max_tokens`, so a 128K-capable model
+ * stopped at 64000 with `stop_reason: max_tokens`; the same figure feeds the combo admission
+ * reserve in `checkComboTargetInputAdmission`, where understating a target's output makes its
+ * headroom arithmetic wrong.
+ */
+export const ANTHROPIC_MODEL_MAX_OUTPUT_TOKENS: Record<string, number> = {
+  "claude-fable-5-1": 128_000,
+  "claude-fable-5": 128_000,
+  "claude-sonnet-5-5": 128_000,
+  "claude-sonnet-5": 128_000,
+  "claude-opus-5-5": 128_000,
+  "claude-opus-5": 128_000,
+  "claude-opus-4-8": 128_000,
+  "claude-opus-4-7": 128_000,
+  "claude-opus-4-6": 128_000,
+  "claude-sonnet-4-6": 128_000,
+};
 /**
  * The effort rungs opencodex exposes for native Anthropic models. Without this the
  * providers advertised no ladder at all, so every client that keys its effort control off

package/src/providers/xai-transport.ts

@@ -28,8 +28,8 @@ export function isXaiResponsesDestination(provider: Pick<OcxProviderConfig, "bas
 }
 
 export const XAI_GROK_COMPATIBILITY = {
-  version: "0.2.93",
-  userAgent: "opencodex-grok/0.2.93",
+  version: "1.0.46",
+  userAgent: "opencodex-grok/1.0.46",
   headers: {
     clientIdentifier: "x-grok-client-identifier",
     clientVersion: "x-grok-client-version",

package/src/server/claude-messages.ts

@@ -555,6 +555,14 @@ async function anthropicNativePassthrough(
   logCtx.provider = "anthropic-native";
   logCtx.requestedModel = model;
   const finalize = createFinalRequestLog(logIds, logCtx).finish;
+  // Locally generated diagnostics are fixed text plus validated guard limits. Runtime
+  // fetch errors retain their existing client response but use a fixed stored reason.
+  const fail = (status: number, closeReason: PassthroughCloseReason | "non_stream", message: string, type: string, storedReason = message) => {
+    const safeMessage = redactSecretString(message);
+    logCtx.upstreamError = storedReason.slice(0, 500);
+    finalize(status, { closeReason });
+    return anthropicErrorResponse(status, safeMessage, type);
+  };
 
   const base = (config.claudeCode?.anthropicBaseUrl ?? "https://api.anthropic.com").replace(/\/$/, "");
   const search = new URL(req.url).search;
@@ -581,13 +589,11 @@ async function anthropicNativePassthrough(
     req.signal,
   );
   if (result.kind === "timeout") {
-    finalize(504, { closeReason: "non_stream" });
-    return anthropicErrorResponse(504, "anthropic passthrough timed out waiting for response headers", "timeout_error");
+    return fail(504, "non_stream", "anthropic passthrough timed out waiting for response headers", "timeout_error");
   }
   if (result.kind === "error") {
     const err = result.error;
-    finalize(502, { closeReason: "non_stream" });
-    return anthropicErrorResponse(502, `anthropic passthrough failed: ${err instanceof Error ? err.message : String(err)}`, "api_error");
+    return fail(502, "non_stream", `anthropic passthrough failed: ${err instanceof Error ? err.message : String(err)}`, "api_error", "anthropic passthrough failed: upstream connection error");
   }
   const upstream = result.upstream;
 
@@ -607,16 +613,13 @@ async function anthropicNativePassthrough(
   // idle/size bounds — headers are NOT yet sent here, so real statuses are available.
   const bodyResult = await readBoundedPassthroughBody(upstream, bodyGuard);
   if (bodyResult.kind === "client_cancel") {
-    finalize(499, { closeReason: "client_cancel" });
-    return anthropicErrorResponse(499, "client closed request during anthropic passthrough", "api_error");
+    return fail(499, "client_cancel", "client closed request during anthropic passthrough", "api_error");
   }
   if (bodyResult.kind === "stall") {
-    finalize(504, { closeReason: "body_stall" });
-    return anthropicErrorResponse(504, `anthropic passthrough body stalled: no upstream bytes for ${Math.round(bodyGuard.stallMs / 1000)}s`, "timeout_error");
+    return fail(504, "body_stall", `anthropic passthrough body stalled: no upstream bytes for ${Math.round(bodyGuard.stallMs / 1000)}s`, "timeout_error");
   }
   if (bodyResult.kind === "overflow") {
-    finalize(502, { closeReason: "body_overflow" });
-    return anthropicErrorResponse(502, `anthropic passthrough body exceeded ${bodyGuard.maxBytes} bytes`, "api_error");
+    return fail(502, "body_overflow", `anthropic passthrough body exceeded ${bodyGuard.maxBytes} bytes`, "api_error");
   }
   const text = bodyResult.text;
   if (upstream.ok) {
@@ -624,6 +627,21 @@ async function anthropicNativePassthrough(
       const parsed = JSON.parse(text) as { usage?: Rec };
       if (isRec(parsed?.usage)) logCtx.usage = anthropicUsageToOcx(parsed.usage);
     } catch { /* count_tokens etc. */ }
+  } else if (upstream.status >= 400) {
+    // Upstream text is untrusted: retain only a closed type vocabulary in history.
+    // Bound parsing work independently of the larger response-relay body limit.
+    const statusReason = `Provider error ${upstream.status}`;
+    logCtx.upstreamError = statusReason;
+    if (text.length <= PASSTHROUGH_ERROR_DETAIL_MAX_CHARS) {
+      try {
+        const parsed: unknown = JSON.parse(text);
+        if (isRec(parsed) && parsed.type === "error" && isRec(parsed.error)) {
+          const upstreamType = parsed.error.type;
+          const knownType = PASSTHROUGH_ERROR_TYPES.find(type => type === upstreamType);
+          if (knownType) logCtx.upstreamError = `${statusReason}: ${knownType}`;
+        }
+      } catch { /* Malformed errors keep the fixed status-only diagnostic. */ }
+    }
   }
   finalize(upstream.status, { closeReason: "non_stream" });
   const retryAfter = upstream.headers.get("retry-after");
@@ -633,6 +651,11 @@ async function anthropicNativePassthrough(
   });
 }
 
+const PASSTHROUGH_ERROR_TYPES = [
+  "invalid_request_error", "authentication_error", "permission_error", "not_found_error",
+  "rate_limit_error", "api_error", "overloaded_error", "request_too_large",
+] as const;
+const PASSTHROUGH_ERROR_DETAIL_MAX_CHARS = 64 * 1024;
 const DEFAULT_BODY_STALL_SEC = 90;
 const DEFAULT_BODY_MAX_BYTES = 64 * 1024 * 1024;
 

package/src/server/management/agent-settings-routes.ts

@@ -806,8 +806,10 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
         const models = await (deps.fetchAllModels ?? fetchAllModels)(config);
         // Evaluate visibility AFTER discovery: a concurrent visibility write may have completed.
         const visible = new Set(filterCatalogVisibleModels(models, config).map(catalogModelSlug).filter(slug => slug.includes("/")));
+        // A bare native id orders the complete picker (docs: guides/model-ordering.md).
+        for (const row of nativeModelRows(config)) if (!row.disabled) visible.add(row.slug);
         if (pickerOrder.some(model => !visible.has(model))) {
-          return jsonResponse({ error: "pickerOrder must contain each visible routed model at most once" }, 400);
+          return jsonResponse({ error: "pickerOrder must contain visible routed or native model ids, each at most once" }, 400);
         }
       }
     }

package/src/server/management/model-rows.ts

@@ -12,6 +12,7 @@ import type { CatalogModel } from "../../codex/catalog";
 import { observeModelCacheRevision } from "../../codex/model-cache";
 import {
   captureExportConfigAdmission,
+  detachedConfigSnapshot,
   isExportConfigAdmissionCurrent,
   type ExportConfigAdmission,
 } from "../../config/admitted-identity";
@@ -37,6 +38,9 @@ import type { OcxConfig } from "../../types";
 import { enrichProviderFromRegistry } from "../../providers/derive";
 import { ensureCodexEntitlementFreshness } from "../../codex/model-entitlements";
 import { fetchAllModels } from "./shared";
+import { CatalogGatherBusyError } from "../../codex/catalog/routed-gather";
+import { captureModelDiscoveryBaseline, finalizeModelDiscovery } from "../../providers/new-model-policy-runtime";
+import { reconcileSuccessfulModelDiscoveries } from "../../providers/new-model-policy";
 import { initialModelSelectionPending, pendingModelSelectionProviders } from "../../providers/initial-model-selection";
 import { catalogFastRowEligible, fastRowId } from "../fast-row";
 import { knownEffortRowIds } from "../effort-row";
@@ -275,7 +279,7 @@ export async function listManagementModelRows(
    */
   const models = options.models === undefined
     ? (await Promise.all([
-      fetchAllModels(config, options.providerContentRevisions),
+      fetchAllModels(config, options.providerContentRevisions, projection => { config = projection; }),
       ensureCodexEntitlementFreshness(config, {
         waitMs: options.entitlementWaitMs ?? 3_000,
       }),
@@ -471,8 +475,10 @@ export async function loadExportModels(
   // The configuration this pass will use from beginning to end, proved to be the one on disk.
   // Without it there is nothing that may be retained, and the caller still gets its rows: only the
   // preview authority is withheld.
-  const admission = captureExportConfigAdmission(config);
-  const admitted = admission?.config ?? config;
+  let admission = captureExportConfigAdmission(config);
+  let admitted = admission?.config ?? config;
+  const discoveryBaseline = models === undefined ? captureModelDiscoveryBaseline(admitted) : null;
+  const outcomes: Array<{ provider: string; state: "authoritative" | "degraded" }> = [];
   // The gather stamps each provider as it chooses its rows, so the roster and the revisions that
   // vouch for it come from the same moment. Sampling afterwards would let a concurrent flight's
   // publication be recorded against rows it never produced.
@@ -483,10 +489,34 @@ export async function loadExportModels(
   // had, and runs alongside as it did inside the projection.
   const roster = models === undefined
     ? (await Promise.all([
-      (await import("../../codex/catalog")).gatherRoutedModels(admitted, { providerContentRevisions: gathered }),
+      (await import("../../codex/catalog")).gatherRoutedModels(admitted, {
+        providerContentRevisions: gathered, providerModelOutcomes: outcomes,
+      }),
       ensureCodexEntitlementFreshness(admitted, { waitMs: 3_000 }),
     ]))[0]
     : models;
+  if (discoveryBaseline !== null) {
+    const authoritative = outcomes.filter(outcome => outcome.state === "authoritative").map(outcome => outcome.provider);
+    if (admission !== null && isExportConfigAdmissionCurrent(admission, config)
+      && [...gathered].every(([provider, revision]) => observeModelCacheRevision(provider) === revision)) {
+      if (!finalizeModelDiscovery(config, discoveryBaseline, roster, authoritative, gathered)) {
+        lastExportSnapshot = null;
+        throw new CatalogGatherBusyError();
+      }
+      // Only our scoped discovery decision moved: bind the projection to the committed state.
+      admission = captureExportConfigAdmission(config);
+      admitted = admission?.config ?? config;
+    } else {
+      // Preserve the old-response contract after a race, without persisting stale evidence or
+      // retaining it as a current preview. Apply visibility policy only to a detached projection.
+      const projection = detachedConfigSnapshot(admitted);
+      if (projection === null) throw new CatalogGatherBusyError();
+      reconcileSuccessfulModelDiscoveries({ config: projection, models: roster,
+        authoritativeProviders: authoritative, now: new Date().toISOString(), mode: "discovery" });
+      admitted = projection;
+      admission = null;
+    }
+  }
   const rows = await listManagementModelRows(admitted, { models: roster });
   // Management deliberately lists the full roster so hidden models can be enabled.
   // A client picker must also honor the provider selection, not just its blocklist.

package/src/server/management/shared.ts

@@ -1,5 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { captureInitialSelectionBaseline, finalizeInitialModelSelection } from "../../providers/initial-model-selection-runtime";
+import { captureModelDiscoveryBaseline, finalizeModelDiscovery } from "../../providers/new-model-policy-runtime";
+import { CatalogGatherBusyError } from "../../codex/catalog/routed-gather";
 import { initialModelSelectionPending } from "../../providers/initial-model-selection";
 import { readFileSync } from "node:fs";
 import type { CatalogModel } from "../../codex/catalog";
@@ -266,17 +268,31 @@ export async function fetchAllModels(
   config: OcxConfig,
   /** Filled with each provider's content revision as of the moment its rows were chosen. */
   providerContentRevisions?: Map<string, string>,
+  /** Management renders disabled rows using this detached state after inventory drift. */
+  publishProjection?: (projection: OcxConfig) => void,
 ): Promise<CatalogModel[]> {
   const { gatherRoutedModels } = await import("../../codex/catalog");
   const baseline = captureInitialSelectionBaseline(config);
-  if (!baseline) return gatherRoutedModels(config, providerContentRevisions ? { providerContentRevisions } : undefined);
+  const discoveryBaseline = captureModelDiscoveryBaseline(config);
+  const revisions = providerContentRevisions ?? new Map<string, string>();
   const outcomes: Array<{ provider: string; state: "authoritative" | "degraded" }> = [];
   const models = await gatherRoutedModels(config, {
     providerModelOutcomes: outcomes,
-    ...(providerContentRevisions ? { providerContentRevisions } : {}),
+    providerContentRevisions: revisions,
   });
   finalizeInitialModelSelection(config, baseline, uniqueCatalogModelsForPublicList(models),
     outcomes.filter(outcome => outcome.state === "authoritative").map(outcome => outcome.provider));
+  let publicationConfig = config;
+  if (!finalizeModelDiscovery(config, discoveryBaseline, models,
+    outcomes.filter(outcome => outcome.state === "authoritative").map(outcome => outcome.provider), revisions,
+    projection => { publicationConfig = projection; publishProjection?.(projection); })) {
+    throw new CatalogGatherBusyError();
+  }
+  if (publicationConfig !== config && !publishProjection) {
+    // Other consumers keep their live config, so only return rows visible under the projection.
+    const { filterCatalogVisibleModels } = await import("../../codex/catalog");
+    return filterCatalogVisibleModels(models, publicationConfig);
+  }
   return models;
 }
 

package/src/server/responses/adapter-continuation.ts

@@ -1,3 +1,4 @@
+import { rotateAnthropicAccountOnResponse } from "../../oauth/anthropic-account-refusal";
 import type { ResponsesRequestContext } from "./core-options";
 import type { PreparedResponsesRequest } from "./request-prepare";
 import type { ResponsesTransport } from "./request-transport";
@@ -34,8 +35,6 @@ import { resolveWireProtocolOverride } from "../adapter-resolve";
 import { bindRouteReasoningReplayScope } from "./core-replay";
 import {
   ANTHROPIC_POOL_MAX_FAILOVERS_PER_REQUEST,
-  rotateAnthropicAccountOn429,
-  recordAnthropicAccount429,
   getAnthropicPoolAccessSnapshot,
   formatAnthropicProviderForLog,
 } from "../../oauth/anthropic-routing";
@@ -158,6 +157,8 @@ export function createAdapterContinuations(
   const fetchTerminalGuardContinuation = async function* (
     nextParsed: OcxParsedRequest,
     initialRecoveryKind?: AttemptRecoveryKind,
+    // Ordinary terminal continuations have already delivered output; empty retries opt in.
+    allowAccountRefusal = false,
   ): AsyncGenerator<AdapterEvent> {
     let response: Response | undefined;
     let kiroRefusalPendingReplay: Response | undefined;
@@ -389,25 +390,21 @@ export function createAdapterContinuations(
         }
       }
      if (
-       response.status === 429
+       (response.status === 429 || response.status === 403)
        && transportState.anthropicPoolAccountId
         && !isNonReplayableResponse(response)
-       && transportState.anthropicPoolFailovers < ANTHROPIC_POOL_MAX_FAILOVERS_PER_REQUEST
       ) {
-        const nextAccountId = rotateAnthropicAccountOn429(
-          config,
-          transportState.anthropicPoolAccountId,
-          response.headers.get("retry-after"),
-          anthropicSessionKey,
-          Date.now(),
-          response.headers,
-          transportState.anthropicRouteDecision,
-        );
+        const nextAccountId = await rotateAnthropicAccountOnResponse(response, {
+          config, accountId: transportState.anthropicPoolAccountId, sessionKey: anthropicSessionKey,
+          decision: transportState.anthropicRouteDecision, signal: upstream.signal,
+          canRetry: transportState.anthropicPoolFailovers < ANTHROPIC_POOL_MAX_FAILOVERS_PER_REQUEST,
+          allowAccountRefusal,
+        });
         if (nextAccountId) {
-          try { void response.body?.cancel().catch(() => {}); } catch { /* already closed */ }
           try {
             const admitted = await commitResolvedOAuthSelection(await getAnthropicPoolAccessSnapshot(nextAccountId));
             if (!admitted) throw new Error("OAuth selection changed during recovery");
+            try { void response.body?.cancel().catch(() => {}); } catch { /* already consumed/closed */ }
             transportState.anthropicPoolAccountId = admitted.accountId;
             transportState.anthropicPoolFailovers += 1;
             route.provider = { ...route.provider, apiKey: admitted.accessToken };
@@ -426,11 +423,6 @@ export function createAdapterContinuations(
           }
         }
       }
-      if (response.status === 429 && transportState.anthropicPoolAccountId
-        && transportState.anthropicPoolFailovers >= ANTHROPIC_POOL_MAX_FAILOVERS_PER_REQUEST) {
-        recordAnthropicAccount429(config, transportState.anthropicPoolAccountId,
-          response.headers.get("retry-after"), Date.now(), response.headers);
-      }
       // Generic OAuth rotation for the continuation loop. The streaming loop grew this arm with
       // #2568 and this one did not, so an xAI/Cursor/Kimi/Copilot/Antigravity/Nous continuation
       // 429 stayed terminal even with failover fully active -- the same class of divergence the
@@ -704,14 +696,14 @@ export function createAdapterContinuations(
   };
 
   const fetchGuardedEmptyCompletionRetry = (): AsyncIterable<AdapterEvent> => {
-    const retryEvents = fetchTerminalGuardContinuation(parsed, "empty-completion");
+    const retryEvents = fetchTerminalGuardContinuation(parsed, "empty-completion", true);
     return terminalGuardEnabled
       ? guardTerminalEventStream({
           parsed,
           firstEvents: retryEvents,
           adapterName: transportState.activeAdapter.name,
           maxAutoContinuations: 1,
-          continuation: fetchTerminalGuardContinuation,
+          continuation: next => fetchTerminalGuardContinuation(next, undefined, !parsed.stream),
         })
       : retryEvents;
   };

package/src/server/responses/adapter-delivery.ts

@@ -110,7 +110,7 @@ export async function deliverAdapterResponse(
           firstEvents: initialEventStream,
           adapterName: transportState.activeAdapter.name,
           maxAutoContinuations: 1,
-          continuation: fetchTerminalGuardContinuation,
+          continuation: next => fetchTerminalGuardContinuation(next, undefined, !parsed.stream),
         })
       : initialEventStream;
     // The empty-completion guard sits OUTSIDE the terminal guard: a completed
@@ -235,7 +235,7 @@ export async function deliverAdapterResponse(
           firstEvents: (async function* () { yield* initialEvents; })(),
           adapterName: transportState.activeAdapter.name,
           maxAutoContinuations: 1,
-          continuation: fetchTerminalGuardContinuation,
+          continuation: next => fetchTerminalGuardContinuation(next, undefined, !parsed.stream),
         })) guardedEvents.push(event);
       } else {
         guardedEvents = initialEvents;