@bitkyc08/opencodex 2.76.0 → 2.78.0-preview.20261005

package/src/codex/catalog/aggregation.ts

@@ -1,4 +1,5 @@
 import { execFileSync } from "node:child_process";
+import { collapseAntigravityPublicModels } from "../../providers/antigravity-effort-families";
 import { createHash } from "node:crypto";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync } from "node:fs";
 import { delimiter, dirname, join, resolve } from "node:path";
@@ -504,6 +505,7 @@ export function resolveSlugAliasCollisions(goModels: CatalogModel[]): Set<Catalo
 }
 
 export function uniqueCatalogModelsForPublicList(goModels: CatalogModel[]): CatalogModel[] {
+  goModels = collapseAntigravityPublicModels(goModels);
   const collisionSkipped = resolveSlugAliasCollisions(goModels);
   const comboPublicSlugs = new Set(goModels
     .filter(model => model.provider === COMBO_NAMESPACE)
@@ -525,6 +527,7 @@ export function uniqueCatalogModelsForPublicList(goModels: CatalogModel[]): Cata
 }
 
 export function uniqueCatalogModelsForRawPublicList(goModels: CatalogModel[]): CatalogModel[] {
+  goModels = collapseAntigravityPublicModels(goModels);
   const publicId = (model: CatalogModel): string => model.alias ?? `${model.provider}/${model.id}`;
   const comboPublicIds = new Set(goModels
     .filter(model => model.provider === COMBO_NAMESPACE)

package/src/codex/catalog/build-entries.ts

@@ -372,7 +372,7 @@ export function orderForModelPicker(
  * user tooling do not. `owned_by` describes upstream ownership, and `comp_hash`
  * describes history compatibility; neither is an authorship signal.
  */
-function isOcxAuthoredRoutedEntry(entry: RawEntry): boolean {
+export function isOcxAuthoredRoutedEntry(entry: RawEntry): boolean {
   if (isNativeAliasCatalogEntry(entry)) return true;
   const desc = typeof entry.description === "string" ? entry.description : "";
   const slug = typeof entry.slug === "string" ? entry.slug : "";

package/src/codex/catalog/bundled.ts

@@ -29,6 +29,7 @@ import type { NormalizedComboConfig } from "../../combos/types";
 import { providerDestinationResolvedError } from "../../lib/destination-policy";
 import { redactSecretString } from "../../lib/redact";
 import upstreamModelsSnapshot from "../data/upstream-models.json";
+import { decodeOverlayState } from "../shim-state-file";
 
 
 import { activeCodexModelsCachePath, catalogBackupPathFor, findNativeTemplate, findSupportedNativeTemplate, isDefaultCatalogPath, legacyCatalogBackupPath, parseCatalogJson, readCatalog, readCatalogBackup, readCodexCatalogPath } from "./parsing";
@@ -196,14 +197,20 @@ export function codexCommandCandidates(): string[] {
 
 export function codexShimCommandCandidates(): string[] {
   try {
-    const state = JSON.parse(readFileSync(join(getConfigDir(), "codex-shim.json"), "utf8")) as {
+    const configDir = getConfigDir();
+    const state = JSON.parse(readFileSync(join(configDir, "codex-shim.json"), "utf8")) as {
+      schema?: unknown;
+      mode?: unknown;
       wrapperPath?: unknown;
       originalPath?: unknown;
       backupPath?: unknown;
       wrappers?: Array<{ wrapperPath?: unknown; originalPath?: unknown; backupPath?: unknown }>;
     };
+    const overlay = decodeOverlayState(state, configDir);
+    if ((state.schema !== undefined || state.mode !== undefined) && !overlay) return [];
     const files = Array.isArray(state.wrappers) && state.wrappers.length > 0 ? state.wrappers : [state];
-    const out: string[] = [];
+    const out: string[] = overlay && isSpawnableCodexCandidate(overlay.launcherPath)
+      ? [overlay.launcherPath] : [];
     for (const file of files) {
       for (const value of [file.backupPath, file.originalPath, file.wrapperPath]) {
         if (typeof value !== "string" || value.length === 0) continue;

package/src/codex/catalog/heal-observation.ts

@@ -0,0 +1,66 @@
+import { closeSync, constants, fstatSync, lstatSync, openSync, readSync, realpathSync, type Stats } from "node:fs";
+import { readCodexHomeJournal } from "../codex-home-owner";
+import { samePath, type RawCatalog } from "./parsing";
+
+export const CATALOG_HEAL_MAX_BYTES = 64 * 1024 * 1024;
+
+export interface CatalogObservation {
+  readonly signature: string;
+  readonly catalog: RawCatalog | null;
+}
+
+/** Canonical path equality when available; unavailable paths retain lexical equality. */
+export function sameCatalogHealPath(left: string, right: string): boolean {
+  try { return samePath(realpathSync.native(left), realpathSync.native(right)); }
+  catch { return samePath(left, right); }
+}
+
+/** Resolve authority without reading catalog bytes or cleaning journal evidence. */
+export function selectCatalogHealPath(
+  journalPath: string,
+  defaultPath: string,
+  resolvePath: (path: string) => string,
+): string | null {
+  const inspected = readCodexHomeJournal(journalPath);
+  if (inspected.kind === "unknown") return null;
+  if (inspected.kind === "missing") return defaultPath;
+  const selected = inspected.journal.injectedCatalogPath;
+  if (selected === undefined || selected === null) return defaultPath;
+  // A selected custom catalog remains selected even when missing or corrupt.
+  if (typeof selected !== "string" || !selected.trim() || selected.includes("\0")) return null;
+  try { return resolvePath(selected); }
+  catch { return null; }
+}
+
+function signature(stat: Stats): string {
+  return `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeMs}:${stat.ctimeMs}`;
+}
+
+/** Bounded regular descriptor reads; never open a FIFO/device or follow a replaced symlink. */
+export function observeCatalogHealFile(path: string, readContent: boolean): CatalogObservation | null {
+  let fd: number | undefined;
+  try {
+    const before = lstatSync(path);
+    if (!before.isFile() || before.size > CATALOG_HEAL_MAX_BYTES) return null;
+    if (!readContent) return { signature: signature(before), catalog: null };
+    fd = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0));
+    const opened = fstatSync(fd);
+    if (!opened.isFile() || opened.size > CATALOG_HEAL_MAX_BYTES || signature(before) !== signature(opened)) return null;
+    const bytes = Buffer.alloc(opened.size + 1);
+    let length = 0;
+    while (length < bytes.length) {
+      const count = readSync(fd, bytes, length, bytes.length - length, null);
+      if (count === 0) break;
+      length += count;
+    }
+    if (length !== opened.size || signature(fstatSync(fd)) !== signature(opened)
+      || signature(lstatSync(path)) !== signature(opened)) return null;
+    let catalog: RawCatalog | null = null;
+    try {
+      const value: unknown = JSON.parse(bytes.subarray(0, length).toString("utf8"));
+      if (value && typeof value === "object" && Array.isArray((value as RawCatalog).models)) catalog = value as RawCatalog;
+    } catch { /* Invalid catalog bytes remain unavailable until their stat changes. */ }
+    return { signature: signature(opened), catalog };
+  } catch { return null; }
+  finally { if (fd !== undefined) closeSync(fd); }
+}

package/src/codex/catalog/model-hints.ts

@@ -295,7 +295,8 @@ export function applyProviderConfigHints(
     inputModalities = base.includes("image") ? [...base] : [...base, "image"];
   }
   const reasoningEfforts = configuredReasoningEfforts(prov, model.id);
-  const suppressSyntheticMax = modelRecordValue(prov.modelSuppressSyntheticMax, model.id) === true;
+  const suppressSyntheticMax = modelRecordValue(prov.modelSuppressSyntheticMax, model.id)
+    ?? (model.antigravityEffortWireModelIds !== undefined);
   const defaultReasoningEffort = staticPolicy.model.defaultReasoningEffort ?? model.defaultReasoningEffort;
   const supportsReasoningSummaries = staticPolicy.model.supportsReasoningSummaries;
   const supportsVerbosity = staticPolicy.model.supportsVerbosity;

package/src/codex/catalog/model-visibility.ts

@@ -1,4 +1,5 @@
 import { effectiveProviderAlias, effectiveProviderAliasDecision } from "../../providers/default-aliases";
+import { antigravityFamilyDisabled, collapseAntigravityPublicModels, projectAntigravitySelectedModels } from "../../providers/antigravity-effort-families";
 import { XAI_OAUTH_FAST_VARIANT_IDS } from "../../providers/xai-fast-model";
 import { initialModelSelectionPending } from "../../providers/initial-model-selection";
 import { execFileSync } from "node:child_process";
@@ -267,7 +268,7 @@ export function mergeConfiguredModelsIntoLiveCatalog(opts: {
 
 export function filterCatalogVisibleModels(
   models: CatalogModel[],
-  config: Pick<OcxConfig, "disabledModels" | "providers">,
+  config: Pick<OcxConfig, "disabledModels" | "providers" | "modelDiscovery">,
 ): CatalogModel[] {
   const disabled = new Set(config.disabledModels ?? []);
   const allowByProvider = new Map<string, Set<string>>();
@@ -289,12 +290,14 @@ export function filterCatalogVisibleModels(
     // Two catalog stages with different equivalence relations is the exact bug class
     // this change exists to remove.
     if (Array.isArray(sel) && sel.length > 0) {
-      allowByProvider.set(name, new Set(sel.map(model => slugEquivalenceKey(routedSlug(name, model)))));
+      allowByProvider.set(name, new Set(projectAntigravitySelectedModels(name, sel, models)
+        .map(model => slugEquivalenceKey(routedSlug(name, model)))));
     }
   }
-  return models.filter(m => {
+  return collapseAntigravityPublicModels(models).filter(m => {
     if (initialModelSelectionPending(config.providers[m.provider])) return false;
     if (config.providers[m.provider]?.disabled === true) return false;
+    if (antigravityFamilyDisabled(config, m, models)) return false;
     const nativeAlias = m.provider === COMBO_NAMESPACE && m.nativeAlias === true;
     // disabledModels may be stored raw (canonical) or encoded (legacy UI writes).
     for (const stored of disabled) {

package/src/codex/catalog/parsing.ts

@@ -113,6 +113,8 @@ export interface CatalogModel {
   displayName?: string;
   owned_by?: string;
   reasoningEfforts?: string[];
+  /** Exact CCA family evidence, retained through the in-memory discovery cache. */
+  antigravityEffortWireModelIds?: Partial<Record<"low" | "medium" | "high", string>>;
   /** Suppress only catalog synthesis of a missing max rung; provider-declared max survives. */
   suppressSyntheticMax?: boolean;
   defaultReasoningEffort?: string;

package/src/codex/catalog/provider-models.ts

@@ -751,20 +751,29 @@ export async function fetchProviderModelsWithAuth(
       const live = antigravity.map(model => applyProviderConfigHints(name, prov, {
         id: model.id,
         provider: name,
-        // CCA only exposes a numeric thinking budget. Until the adapter owns an exact Codex
-        // effort-to-wire mapping for a newly discovered model, do not advertise a false ladder.
-        reasoningEfforts: [],
+        // Only an exact discovered wire map proves a new model's selectable effort ladder.
+        reasoningEfforts: Object.keys(model.effortWireModelIds ?? {}),
+        ...(model.effortWireModelIds ? {
+          antigravityEffortWireModelIds: model.effortWireModelIds,
+          suppressSyntheticMax: true,
+          defaultReasoningEffort: model.effortWireModelIds.medium ? "medium" : "high",
+        } : {}),
         ...(model.contextWindow ? { contextWindow: model.contextWindow } : {}),
         ...(model.inputModalities ? { inputModalities: model.inputModalities } : {}),
       }, contextCap, metadataModelIdCaseFold, captured.effectiveAlias));
       const forCache = withConfiguredRetention(live, { retainComboTargets: false });
-      if (!setCached(name, forCache, Date.now(), cacheGeneration)) {
+      if (!isCurrentCacheGeneration()) {
         return observed(withConfiguredRetention(configured), "degraded");
       }
+      // Save exact family routes before publishing synthetic IDs. These synchronous writes
+      // cannot interleave with a credential-generation change; failure keeps the prior cache.
       registerAntigravityDiscoveredWireModels(prov.baseUrl, antigravity, {
         provider: name,
         cacheGeneration,
       });
+      if (!setCached(name, forCache, Date.now(), cacheGeneration)) {
+        return observed(withConfiguredRetention(configured), "degraded");
+      }
       markProviderDiscoveryOk(name, live.length);
       return observed(withConfiguredRetention(forCache, { warnDrops: true }), "authoritative");
     }

package/src/codex/catalog/publication-observer.ts

@@ -0,0 +1,19 @@
+import type { CatalogWriteIntent } from "./write-audit-contract";
+
+export type CatalogPublicationEvent =
+  | { readonly kind: "published"; readonly path: string; readonly intent: CatalogWriteIntent }
+  | { readonly kind: "native-released"; readonly path: string | null };
+
+const listeners = new Set<(event: CatalogPublicationEvent) => void>();
+
+/** Process-local notifications; subscribers never own publication success. */
+export function subscribeCatalogPublication(listener: (event: CatalogPublicationEvent) => void): () => void {
+  listeners.add(listener);
+  return () => { listeners.delete(listener); };
+}
+
+export function notifyCatalogPublication(event: CatalogPublicationEvent): void {
+  for (const listener of [...listeners]) {
+    try { listener(event); } catch { /* A subscriber cannot fail or undo publication. */ }
+  }
+}

package/src/codex/catalog/remote.ts

@@ -7,7 +7,7 @@ import { replaceActiveCodexCatalog } from "../internal/catalog-writer";
 import { resetCodexAppServerCatalogStateCache } from "../app-server-processes";
 import { getCodexHome } from "../paths";
 import { readCodexCatalogPathForHome } from "./parsing";
-import { invalidateCodexModelsCacheWithPermit } from "./sync";
+import { invalidateCodexModelsCacheWithPermitOutcome } from "./sync";
 
 const DEFAULT_TIMEOUT_MS = 15_000;
 const MAX_MODELS = 2_000;
@@ -17,7 +17,7 @@ const ALLOWED_MODALITIES = new Set(["text", "image", "audio"]);
 export type RemoteCatalogFailureCode =
   | "url_invalid" | "insecure_http_refused" | "credential_invalid" | "request_failed"
   | "redirect_refused" | "http_error" | "body_too_large" | "body_invalid"
-  | "catalog_invalid" | "write_failed" | "lock_busy" | "lock_database" | "unsafe_path";
+  | "catalog_invalid" | "write_failed" | "lock_busy" | "lock_database" | "unsafe_path" | "foreign_owner" | "owner_unknown";
 
 export class RemoteCatalogError extends Error {
   constructor(readonly code: RemoteCatalogFailureCode, message: string, readonly status?: number) {
@@ -202,7 +202,10 @@ export async function fetchRemoteCatalog(
 
 function mapSerializationFailure<T>(outcome: CatalogSerializationOutcome<T>): never {
   if (outcome.kind === "completed") throw new RemoteCatalogError("write_failed", "Remote catalog installation failed");
-  const code = outcome.reason === "busy" ? "lock_busy" : outcome.reason === "database" ? "lock_database" : "unsafe_path";
+  const code = outcome.reason === "busy" ? "lock_busy"
+    : outcome.reason === "database" ? "lock_database"
+      : outcome.reason === "foreign-owner" ? "foreign_owner"
+        : outcome.reason === "owner-unknown" ? "owner_unknown" : "unsafe_path";
   throw new RemoteCatalogError(code, `Remote catalog installation unavailable (${outcome.reason})`);
 }
 
@@ -235,23 +238,18 @@ export async function pullRemoteCatalog(input: string, options: PullRemoteCatalo
   const fetched = await fetchRemoteCatalog(input, options);
   const codexHome = options.codexHome ?? getCodexHome();
   const catalogPath = readCodexCatalogPathForHome(codexHome);
-  const current = existsSync(catalogPath) ? readFileSync(catalogPath) : null;
-  const candidate = Buffer.from(fetched.content, "utf8");
-  if (current?.equals(candidate)) {
-    return { status: "unchanged", catalogWritten: false, cacheSynced: false, codexHome, catalogPath, modelCount: fetched.document.models.length };
-  }
   const outcome = withCatalogWriteSerialization(codexHome, permit => {
     // Re-check under K: another writer may have installed these bytes while the request was in flight.
     const lockedCurrent = existsSync(catalogPath) ? readFileSync(catalogPath) : null;
-    if (lockedCurrent?.equals(candidate)) return { catalogWritten: false, cacheSynced: false };
-    replaceActiveCodexCatalog(permit, codexHome, { path: catalogPath, content: fetched.content });
-    const cacheSynced = invalidateCodexModelsCacheWithPermit(permit, codexHome, { allowWhenDesiredDisabled: true });
-    if (!cacheSynced) {
-      restorePreviousCatalog(permit, codexHome, catalogPath, lockedCurrent);
+    const catalog = replaceActiveCodexCatalog(permit, codexHome, { path: catalogPath, content: fetched.content });
+    if (catalog.kind === "refused") throw new RemoteCatalogError("write_failed", "Remote catalog publication refused");
+    const cache = invalidateCodexModelsCacheWithPermitOutcome(permit, codexHome, { allowWhenDesiredDisabled: true });
+    if (cache !== "written" && cache !== "unchanged") {
+      if (catalog.kind === "written") restorePreviousCatalog(permit, codexHome, catalogPath, lockedCurrent);
       throw new RemoteCatalogError("write_failed", "Remote catalog cache synchronization failed");
     }
-    return { catalogWritten: true, cacheSynced: true };
-  });
+    return { catalogWritten: catalog.kind === "written", cacheSynced: cache === "written" };
+  }, { intent: "pull", writer: "catalog-pull" });
   if (outcome.kind !== "completed") return mapSerializationFailure(outcome);
   return {
     status: outcome.value.catalogWritten ? "updated" : "unchanged",

package/src/codex/catalog/restore.ts

@@ -6,9 +6,12 @@ import { RETIRED_NATIVE_OPENAI_MODELS, SUPPORTED_NATIVE_OPENAI_SLUGS } from "./m
 import { trustedAccountBoundNativeCatalogSlug } from "./account-models";
 import {
   withCatalogWriteSerialization,
+  CatalogWritePermitRefusal,
   type CatalogWritePermit,
 } from "../catalog-write-serialization";
 import { replaceActiveCodexCatalog } from "../internal/catalog-writer";
+import { FOREIGN_CODEX_HOME_OWNER_MESSAGE, UNKNOWN_CODEX_HOME_OWNER_MESSAGE } from "./routed-removal";
+import { notifyCatalogPublication } from "./publication-observer";
 
 function visibleAccountReplacementNatives(
   models: readonly RawEntry[],
@@ -72,7 +75,10 @@ export function restoreCodexCatalogWithPermit(
 ): { removed: number; kept: number; path: string } {
   const catalogPath = injectedCatalogPath ?? readCodexCatalogPath();
   const catalog = readCatalog(catalogPath);
-  if (!catalog || !Array.isArray(catalog.models)) return { removed: 0, kept: 0, path: catalogPath };
+  if (!catalog || !Array.isArray(catalog.models)) {
+    notifyCatalogPublication({ kind: "published", path: catalogPath, intent: "restore" });
+    return { removed: 0, kept: 0, path: catalogPath };
+  }
   const disabledModels = currentDisabledModelsForRestore();
   const replacementVisibility = visibleAccountReplacementNatives(catalog.models, disabledModels);
   const backup = readCatalogBackup(catalogPath);
@@ -94,10 +100,11 @@ export function restoreCodexCatalogWithPermit(
       models: [...backup.models.filter(m => typeof m.slug !== "string"
         || !RETIRED_NATIVE_OPENAI_MODELS.has(trustedAccountBoundNativeCatalogSlug(m) ?? m.slug)), ...userNativeAdditions],
     };
-    replaceActiveCodexCatalog(permit, owningCodexHome, {
+    const replacement = replaceActiveCodexCatalog(permit, owningCodexHome, {
       path: catalogPath,
       content: `${JSON.stringify(restored, null, 2)}\n`,
     });
+    if (replacement.kind === "refused") throw new CatalogWritePermitRefusal("Catalog restoration was refused.");
     return { removed, kept: restored.models.length, path: catalogPath };
   }
   const before = catalog.models.length;
@@ -110,11 +117,13 @@ export function restoreCodexCatalogWithPermit(
   const removed = before - native.length;
   if (removed > 0) {
     catalog.models = native;
-    replaceActiveCodexCatalog(permit, owningCodexHome, {
+    const replacement = replaceActiveCodexCatalog(permit, owningCodexHome, {
       path: catalogPath,
       content: `${JSON.stringify(catalog, null, 2)}\n`,
     });
+    if (replacement.kind === "refused") throw new CatalogWritePermitRefusal("Catalog restoration was refused.");
   }
+  if (removed === 0) notifyCatalogPublication({ kind: "published", path: catalogPath, intent: "restore" });
   return { removed, kept: native.length, path: catalogPath };
 }
 
@@ -123,10 +132,14 @@ export function restoreCodexCatalog(): { removed: number; kept: number; path: st
   const outcome = withCatalogWriteSerialization(
     owningCodexHome,
     permit => restoreCodexCatalogWithPermit(permit, owningCodexHome),
+    { intent: "restore", writer: "catalog-restore" },
   );
-  return outcome.kind === "completed"
-    ? outcome.value
-    : { removed: 0, kept: 0, path: readCodexCatalogPath() };
+  if (outcome.kind === "unavailable") {
+    throw new CatalogWritePermitRefusal(outcome.reason === "foreign-owner"
+      ? FOREIGN_CODEX_HOME_OWNER_MESSAGE : outcome.reason === "owner-unknown"
+        ? UNKNOWN_CODEX_HOME_OWNER_MESSAGE : `Catalog restoration unavailable (${outcome.reason}).`);
+  }
+  return outcome.value;
 }
 
 /** Force Codex's models_cache stale from the on-disk catalog. Returns whether a cache write occurred. */

package/src/codex/catalog/retained-sync.ts

@@ -1,7 +1,8 @@
+import { projectAntigravitySelectedModels } from "../../providers/antigravity-effort-families";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { initializeConfigOwnership } from "../../lib/config-ownership";
-import { getConfigDir, loadConfig, websocketsEnabled } from "../../config";
+import { getConfigDir, loadConfig, websocketsEnabled, withConfigMutationLockSync } from "../../config";
 import { shouldSyncCodexOnStart } from "../desired-state";
 import { legacyCustomModelCatalogSlugs } from "../custom-model-catalog-migration";
 import { getCodexHome } from "../paths";
@@ -39,6 +40,8 @@ import {
   nativeMultiAgentDefaults,
 } from "./parsing";
 import type { CatalogModel, MultiAgentMode, RawCatalog, RawEntry } from "./parsing";
+import { ocxRoutedNamespaceCounts, routedRemovalBackedByConfigFile, unconfiguredRoutedRemoval } from "./routed-removal";
+import { ConfigMutationLockError } from "../../config/mutation-lock";
 import {
   accountBoundNativeOpenAiSlugsBySelector,
   desktopAllowlistSuppressedNativeSlugs,
@@ -63,11 +66,13 @@ import {
 } from "../catalog-write-serialization";
 import {
   preparedBytesDifferFromDisk,
+  auditRefusedCatalogReplacement,
   publishHashedCodexCatalogBackup,
   publishLegacyCodexCatalogBackup,
   replaceActiveCodexCatalog,
   replaceCodexModelsCache,
   type PreparedCatalogFileWrite,
+  type CatalogFileReplacement,
 } from "../internal/catalog-writer";
 import { visibleCodexAccountSelectors } from "./account-models";
 import { ACCOUNT_GATED_NATIVE_OPENAI_MODELS, NATIVE_OPENAI_MODELS, NATIVE_RESERVE_MODEL } from "./native-models";
@@ -104,8 +109,15 @@ interface RetainedCatalogSyncResult {
   comboOmissions: ComboCatalogOmission[];
   /** Validated catalog commit (including identical bytes), or a refused refresh. */
   refreshOutcome?: "committed" | "refused";
-  /** `desired_disabled` observed under K after the provider await; nothing was written. */
-  skippedReason?: "desired_disabled";
+  /**
+   * `desired_disabled`: observed under K after the provider await. `unbacked_routed_removal`: the
+   * catalog would lose routed namespaces config.json still enables, or config.json is missing or
+   * unreadable (#6529). `foreign_owner`: this Codex home is bound to another OPENCODEX_HOME. Nothing
+   * was written in any of these cases.
+   */
+  skippedReason?: "desired_disabled" | "unbacked_routed_removal" | "foreign_owner" | "owner_unknown";
+  /** With `unbacked_routed_removal`: how many routed namespaces the refused write would have emptied. */
+  protectedRoutedNamespaces?: number;
 }
 
 /**
@@ -465,7 +477,7 @@ function writeRetainedCatalogSync({
       provider.disabled !== true
         && Array.isArray(provider.selectedModels)
         && provider.selectedModels.length > 0
-        ? [[name, new Set(provider.selectedModels)] as const]
+        ? [[name, new Set(projectAntigravitySelectedModels(name, provider.selectedModels, goModels))] as const]
         : []
     )),
   );
@@ -553,12 +565,46 @@ function writeRetainedCatalogSync({
   if (!preparedBytesDifferFromDisk(preparedCatalog)) {
     return { added, path: catalogPath, catalogWritten: false, comboOmissions };
   }
-
-  replaceActiveCodexCatalog(permit, owningCodexHome, preparedCatalog);
+  // A refresh may drop a provider's rows only when config.json on disk agrees the provider is gone.
+  // Without that, a config that is not the user's (missing or unreadable file read as defaults,
+  // another OPENCODEX_HOME) would publish a native-only catalog and exit cleanly (#6529).
+  const refused = (protectedRoutedNamespaces: number): RetainedCatalogSyncResult => ({
+    added: 0,
+    path: catalogPath,
+    catalogWritten: false,
+    comboOmissions,
+    skippedReason: "unbacked_routed_removal",
+    protectedRoutedNamespaces,
+  });
+  let replacement: CatalogFileReplacement | undefined;
+  const removal = unconfiguredRoutedRemoval(onDiskCatalog, catalog, config);
+  if (removal !== null) {
+    // Hold C (K -> C) from the config read through the replacement, so a save that enables one of
+    // these providers cannot land between the check and the write. A held C is a refusal too.
+    let backed = false;
+    try {
+      backed = withConfigMutationLockSync(() => {
+        if (!routedRemovalBackedByConfigFile(removal)) return false;
+        replacement = replaceActiveCodexCatalog(permit, owningCodexHome, preparedCatalog);
+        return replacement.kind !== "refused";
+      });
+    } catch (error) {
+      if (!(error instanceof ConfigMutationLockError)) throw error;
+    }
+    if (!backed) {
+      if (replacement?.kind !== "refused") {
+        auditRefusedCatalogReplacement(permit, owningCodexHome, preparedCatalog, "unbacked-routed-removal");
+      }
+      return refused(removal.namespaces.length);
+    }
+  } else {
+    replacement = replaceActiveCodexCatalog(permit, owningCodexHome, preparedCatalog);
+    if (replacement.kind === "refused") return refused(ocxRoutedNamespaceCounts(onDiskCatalog).size);
+  }
   return {
     added,
     path: catalogPath,
-    catalogWritten: true,
+    catalogWritten: replacement?.kind === "written",
     comboOmissions,
   };
 }
@@ -648,7 +694,7 @@ export async function syncCatalogModels(
       owningCodexHome,
       modelEntitlements,
     });
-  });
+  }, { intent: "refresh", writer: "retained-sync" });
   if (committed.kind === "completed" && committed.value !== null) {
     return {
       ...committed.value,
@@ -661,6 +707,10 @@ export async function syncCatalogModels(
     catalogWritten: false,
     comboOmissions,
     refreshOutcome: "refused",
+    ...(committed.kind === "unavailable" && committed.reason === "foreign-owner"
+      ? { skippedReason: "foreign_owner" as const } : {}),
+    ...(committed.kind === "unavailable" && committed.reason === "owner-unknown"
+      ? { skippedReason: "owner_unknown" as const } : {}),
   };
 }
 
@@ -728,9 +778,7 @@ export function invalidateCodexModelsCacheWithPermitOutcome(
     // `cacheSynced` mean what its name and its consumers already assume, and what
     // `pullRemoteCatalog` and the early returns in `refreshCodexModelCatalog`
     // already assert: a write happened.
-    if (!preparedBytesDifferFromDisk(preparedCache)) return "unchanged";
-    replaceCodexModelsCache(permit, owningCodexHome, preparedCache);
-    return "written";
+    return replaceCodexModelsCache(permit, owningCodexHome, preparedCache).kind;
   } catch {
     return "failed";
   }
@@ -749,6 +797,7 @@ export function invalidateCodexModelsCache(options?: CodexCatalogSyncOptions): b
   const outcome = withCatalogWriteSerialization(
     owningCodexHome,
     permit => invalidateCodexModelsCacheWithPermit(permit, owningCodexHome, options),
+    { intent: "cache", writer: "cache-invalidate" },
   );
   return outcome.kind === "completed" && outcome.value;
 }

package/src/codex/catalog/routed-removal.ts

@@ -0,0 +1,116 @@
+import { COMBO_NAMESPACE } from "../../combos";
+import { readConfigAdmissionSnapshot, type ConfigAdmissionSnapshot } from "../../config/diagnostics";
+import type { OcxConfig } from "../../types";
+import { trustedAccountBoundNativeCatalogSlug } from "./account-models";
+import { isOcxAuthoredRoutedEntry } from "./build-entries";
+import { isNativeAliasCatalogEntry } from "./metadata";
+import type { RawCatalog, RawEntry } from "./parsing";
+
+/**
+ * Routed namespaces a candidate catalog empties of OpenCodex-authored rows only because the config
+ * that produced it does not enable them: the "deleted provider" rule in build-entries. That rule is
+ * the one way a refresh removes a provider's rows wholesale, so it is the one a config that is not
+ * the user's (a missing or unreadable config.json read as defaults, another OPENCODEX_HOME) turns
+ * into a silent native-only catalog (#6529).
+ */
+export interface UnconfiguredRoutedRemoval {
+  readonly namespaces: readonly string[];
+}
+
+type RoutedNamespaceConfig = Pick<OcxConfig, "providers" | "combos">;
+
+function routedNamespace(entry: RawEntry): string | null {
+  if (!entry || typeof entry !== "object" || typeof entry.slug !== "string") return null;
+  // Account-bound native rows follow the account pool, not provider config.
+  if (trustedAccountBoundNativeCatalogSlug(entry) !== undefined) return null;
+  if (isNativeAliasCatalogEntry(entry)) return COMBO_NAMESPACE;
+  // Combo aliases may be bare or use an unrelated provider namespace. Ownership selects the
+  // combo namespace only with the same generated-description authorship signal as routed rows.
+  if (entry.owned_by === COMBO_NAMESPACE
+    && typeof entry.description === "string"
+    && entry.description.startsWith("Routed via opencodex → ")) return COMBO_NAMESPACE;
+  // Foreign rows (Cursor, user tooling) are never removed by the provider rule.
+  if (!isOcxAuthoredRoutedEntry(entry)) return null;
+  return entry.slug.slice(0, entry.slug.indexOf("/"));
+}
+
+/** OpenCodex-authored routed rows per namespace; foreign and account-bound rows never count. */
+export function ocxRoutedNamespaceCounts(catalog: RawCatalog | null): Map<string, number> {
+  const counts = new Map<string, number>();
+  for (const entry of catalog?.models ?? []) {
+    const namespace = routedNamespace(entry);
+    if (namespace !== null) counts.set(namespace, (counts.get(namespace) ?? 0) + 1);
+  }
+  return counts;
+}
+
+/** Total OpenCodex-authored routed rows, or null for a value that is not a catalog. */
+export function ocxRoutedRowCount(catalog: unknown): number | null {
+  if (catalog === null || typeof catalog !== "object" || !Array.isArray((catalog as RawCatalog).models)) return null;
+  let total = 0;
+  for (const count of ocxRoutedNamespaceCounts(catalog as RawCatalog).values()) total += count;
+  return total;
+}
+
+/** Whether a config still produces routed rows for a namespace: an enabled provider, or any combo. */
+export function configEnablesRoutedNamespace(config: RoutedNamespaceConfig, namespace: string): boolean {
+  if (namespace === COMBO_NAMESPACE && Object.keys(config.combos ?? {}).length > 0) return true;
+  const provider = config.providers?.[namespace];
+  return provider !== undefined && provider.disabled !== true;
+}
+
+/**
+ * The namespaces whose OpenCodex-authored routed rows are on disk now, absent from the candidate,
+ * and not enabled by the driving config; null when the candidate removes no such namespace.
+ * Removals inside a namespace the driving config still enables (discovery, selection, a deleted
+ * custom model) are the provider's own business and are not reported here.
+ */
+export function unconfiguredRoutedRemoval(
+  active: RawCatalog | null,
+  candidate: RawCatalog,
+  driving: RoutedNamespaceConfig,
+): UnconfiguredRoutedRemoval | null {
+  const activeModels = active?.models ?? [];
+  if (activeModels.length === 0) return null;
+  const kept = new Set((candidate.models ?? []).flatMap(entry => typeof entry.slug === "string" ? [entry.slug] : []));
+  const namespaces = new Set<string>();
+  for (const entry of activeModels) {
+    if (typeof entry.slug === "string" && kept.has(entry.slug)) continue;
+    const namespace = routedNamespace(entry);
+    if (namespace !== null && !configEnablesRoutedNamespace(driving, namespace)) namespaces.add(namespace);
+  }
+  return namespaces.size > 0 ? { namespaces: [...namespaces].sort() } : null;
+}
+
+/**
+ * True when config.json on disk backs every removal: it is a readable, parseable file, and it enables
+ * none of the removed namespaces. A missing, unreadable or salvaged file backs nothing, and a file
+ * that still enables a namespace shows the driving config was not the one on disk. Read once, at
+ * write time, so a config that fell back to defaults while the file was briefly unreadable cannot
+ * pass on a later successful read.
+ */
+export function routedRemovalBackedByConfigFile(
+  removal: UnconfiguredRoutedRemoval,
+  read: () => ConfigAdmissionSnapshot = readConfigAdmissionSnapshot,
+): boolean {
+  const snapshot = read();
+  if (snapshot.kind !== "read" || snapshot.diagnostics.source !== "file") return false;
+  return removal.namespaces.every(namespace => !configEnablesRoutedNamespace(snapshot.diagnostics.config, namespace));
+}
+
+/** One line for logs when K refused a writer from another OPENCODEX_HOME; names no path. */
+export const FOREIGN_CODEX_HOME_OWNER_MESSAGE = "Codex catalog left unchanged: this Codex home was set up by "
+  + "another OpenCodex home (OPENCODEX_HOME), recorded in its opencodex-journal.json. Run opencodex "
+  + "from that home, or run `ocx restore` there first.";
+
+/** Unavailable evidence is not proof of a foreign owner. No paths or journal content are exposed. */
+export const UNKNOWN_CODEX_HOME_OWNER_MESSAGE = "Codex catalog left unchanged: ownership of this Codex home "
+  + "could not be checked. Restore readable ownership evidence and retry.";
+
+/** One line for logs: counts only, never provider names, model ids or paths. */
+export function unbackedRoutedRemovalMessage(count: number): string {
+  return `Codex catalog left unchanged: this refresh would remove the routed models of ${count} `
+    + `provider namespace${count === 1 ? "" : "s"} that config.json still enables, or config.json `
+    + "is missing or unreadable. Run `ocx sync` again once config.json is readable; use `ocx restore` "
+    + "to remove routed models on purpose.";
+}