@bitkyc08/opencodex 2.86.0 → 2.87.0

package/src/codex/sync.ts

@@ -1,3 +1,4 @@
+import { approvedCodexProviders } from "./provider-routing";
 import { currentExternalCodexModelProvider, injectCodexConfig } from "./inject";
 import { FOREIGN_CODEX_HOME_OWNER_MESSAGE, UNKNOWN_CODEX_HOME_OWNER_MESSAGE, unbackedRoutedRemovalMessage } from "./catalog/routed-removal";
 import { printProjectCodexConfigWarnings, groupProjectCodexConfigWarningsByPath, type ProjectCodexConfigWarning } from "./project-config-warnings";
@@ -33,6 +34,8 @@ export interface CodexSyncResult {
   catalogPath: string | null;
   catalogExists: boolean;
   catalogWritten: boolean;
+  /** Committed configuration-byte change, never inferred from a successful no-op. */
+  configChanged?: boolean;
   cacheSynced: boolean;
   /**
    * Whether the catalog owner committed a validated catalog or refused the
@@ -188,7 +191,7 @@ export async function syncModelsToCodex(
     };
   }
 
-  if (externalProvider) {
+  if (externalProvider && !approvedCodexProviders().includes(externalProvider)) {
     if (catalogEvenWhenNotInjected) {
       // External providers own config.toml, and the injector removes the OpenCodex
       // journal for external providers (inject.ts). This explicit catalog-only sync
@@ -214,6 +217,7 @@ export async function syncModelsToCodex(
     return {
       status: "applied",
       ok: result.success,
+      ...(result.success && result.configChanged === true ? { configChanged: true } : {}),
       added: 0,
       catalogPath: null,
       catalogExists: false,
@@ -332,6 +336,7 @@ export async function syncModelsToCodex(
   return {
     status: "applied",
     ok: result.success,
+    ...(result.success && result.configChanged === true ? { configChanged: true } : {}),
     added,
     ...(refreshOutcome ? { refreshOutcome } : {}),
     catalogPath,

package/src/codex/user-identity.ts

@@ -19,6 +19,7 @@ import { isAbsolute, join, resolve } from "node:path";
 
 import { resolveTrustedWindowsPowerShellExe } from "../lib/windows-elevation";
 import { WINDOWS_PRINCIPAL_LOOKUP_TIMEOUT_MS } from "../lib/windows-user-principal";
+import { resolveWindowsLocalAppData } from "./windows-local-appdata";
 
 import type {
   ResolveCodexCoordinatorDatabasePath,
@@ -209,10 +210,11 @@ export function decodeWindowsIdentityPowerShellOutputForTests(output: Uint8Array
 /**
  * Per-process memo for the Windows lookups.
  *
- * Both values -- the effective token's SID and its known-folder local AppData --
+ * Both helper values -- the effective token's SID and its known-folder local AppData --
  * are fixed for the lifetime of a process: neither can change without a new logon
  * token, and the lookups deliberately ignore the environment, so nothing a caller
- * does between two calls can alter the answer. Each call otherwise spawns a fresh
+ * does between two calls can alter the answer. The native x64 known-folder path
+ * avoids this helper entirely. Each fallback call otherwise spawns a fresh
  * PowerShell, roughly 150ms for the SID and 310ms for the folder, and the
  * coordinator asks for both on every config write and lock acquisition. That cost
  * pushed real multi-process injection tests past their budget while proving
@@ -265,6 +267,15 @@ function resolveWindowsSid(): string {
   return sid.toUpperCase();
 }
 
+function windowsLocalAppData(): string {
+  try {
+    return resolveWindowsLocalAppData(() => powershellValue(windowsLocalAppDataExpression()));
+  } catch (cause) {
+    if (cause instanceof CodexUserIdentityRefusal) throw cause;
+    refuse("Windows LocalAppData resolution failed.", cause);
+  }
+}
+
 export const resolveEffectiveUserIdentity: ResolveEffectiveUserIdentity = () => {
   if (process.platform === "win32") {
     return { platform: "win32", sid: resolveWindowsSid() };
@@ -374,7 +385,7 @@ export function probeCodexCoordinatorNamespace(identity: UserIdentity): Coordina
   }
 
   if (!SID_PATTERN.test(identity.sid)) refuse("The coordinator identity contains an invalid SID.");
-  const localAppData = powershellValue(windowsLocalAppDataExpression());
+  const localAppData = windowsLocalAppData();
   if (!isAbsolute(localAppData)) refuse("Windows LocalAppData resolution returned a relative path.");
   const root = resolve(localAppData, "OpenCodex", "Runtime", "v1", identity.sid.toUpperCase());
   let entry;
@@ -404,10 +415,10 @@ export function probeCodexCoordinatorNamespace(identity: UserIdentity): Coordina
 
 function resolveWindowsRuntimeRoot(identity: Extract<UserIdentity, { platform: "win32" }>): string {
   if (!SID_PATTERN.test(identity.sid)) refuse("The coordinator identity contains an invalid SID.");
-  const localAppData = powershellValue(windowsLocalAppDataExpression());
+  const localAppData = windowsLocalAppData();
   if (!isAbsolute(localAppData)) refuse("Windows LocalAppData resolution returned a relative path.");
 
-  // The SID and known-folder values come from the effective token/.NET OS APIs,
+  // The SID and known-folder values come from effective-token OS APIs,
   // never USERPROFILE or LOCALAPPDATA. WP11 adds descriptor/reparse/ACL checks at
   // the stable-database open boundary where those checks can cover SQLite too.
   const root = resolve(localAppData, "OpenCodex", "Runtime", "v1", identity.sid.toUpperCase());

package/src/codex/windows-local-appdata.ts

@@ -0,0 +1,84 @@
+import { dlopen, ptr, read, type Pointer } from "bun:ffi";
+import { win32 } from "node:path";
+import { resolveTrustedWindowsSystemDirectory } from "../lib/windows-elevation";
+
+// FOLDERID_LocalAppData: GUID fields Data1/Data2/Data3 are little-endian.
+const LOCAL_APPDATA_ID = Buffer.from("8527b3f1ba6fcf4f9d557b8e7f157091", "hex");
+const KF_FLAG_DEFAULT_PATH = 0x400;
+const MAX_PATH_CODE_UNITS = 32_768;
+
+export interface WindowsKnownFolderApi {
+  getPath(id: Uint8Array, flags: number, token: null, output: BigUint64Array): number;
+  readCodeUnit(address: number, byteOffset: number): number;
+  free(address: number): void;
+}
+
+/** Same current-token/default-path API as the PowerShell fallback, without Add-Type. */
+export function readWindowsLocalAppData(api: WindowsKnownFolderApi): string {
+  const output = new BigUint64Array(1);
+  let address = 0;
+  try {
+    const hr = api.getPath(LOCAL_APPDATA_ID, KF_FLAG_DEFAULT_PATH, null, output);
+    address = Number(output[0]);
+    if (hr !== 0 || !Number.isSafeInteger(address) || address <= 0) {
+      throw new Error("Windows LocalAppData known-folder lookup failed.");
+    }
+    const units: number[] = [];
+    for (let index = 0; index < MAX_PATH_CODE_UNITS; index += 1) {
+      const unit = api.readCodeUnit(address, index * 2);
+      if (unit === 0) {
+        const path = String.fromCharCode(...units);
+        if (!win32.isAbsolute(path) || !/^[a-z]:\\|^\\\\/i.test(path)) {
+          throw new Error("Windows LocalAppData known-folder lookup returned an invalid path.");
+        }
+        return path;
+      }
+      units.push(unit);
+    }
+    throw new Error("Windows LocalAppData known-folder lookup returned an unterminated path.");
+  } finally {
+    // SHGetKnownFolderPath requires CoTaskMemFree even on a failed HRESULT.
+    if (address > 0 && Number.isSafeInteger(address)) api.free(address);
+  }
+}
+
+let nativeLookup: (() => string) | null | undefined;
+
+function loadNativeLookup(): (() => string) | null {
+  if (nativeLookup !== undefined) return nativeLookup;
+  if (process.platform !== "win32" || process.arch !== "x64") return null;
+  try {
+    const systemDirectory = resolveTrustedWindowsSystemDirectory();
+    const shell = dlopen(win32.join(systemDirectory, "shell32.dll"), {
+      SHGetKnownFolderPath: { args: ["ptr", "u32", "ptr", "ptr"], returns: "i32" },
+    });
+    let ole;
+    try {
+      ole = dlopen(win32.join(systemDirectory, "ole32.dll"), {
+        CoTaskMemFree: { args: ["ptr"], returns: "void" },
+      });
+    } catch (error) {
+      shell.close();
+      throw error;
+    }
+    const api: WindowsKnownFolderApi = {
+      getPath: (id, flags, token, output) => shell.symbols.SHGetKnownFolderPath(
+        ptr(id), flags, token, ptr(output),
+      ),
+      readCodeUnit: (address, offset) => read.u16(address as Pointer, offset),
+      free: address => { ole.symbols.CoTaskMemFree(address as Pointer); },
+    };
+    nativeLookup = () => readWindowsLocalAppData(api);
+  } catch {
+    nativeLookup = null;
+  }
+  return nativeLookup;
+}
+
+/** Unsupported FFI keeps the bounded trusted helper; an OS API failure still refuses. */
+export function resolveWindowsLocalAppData(
+  powershellLookup: () => string,
+  lookup: (() => string) | null = loadNativeLookup(),
+): string {
+  return lookup ? lookup() : powershellLookup();
+}

package/src/combos/failover.ts

@@ -403,6 +403,9 @@ const REQUEST_SHAPE_FAILURE_CODES = new Set([
   "tool_catalog_too_large",
   "cursor_root_envelope_limit",
   "target_incompatible",
+  // A route that cannot read the request's media (image input to a text-only CLI route) is
+  // healthy for every other request, so cooling it would only block unrelated turns.
+  "unsupported_input_modality",
 ]);
 
 /** Credential/billing failures that every target sharing the provider inherits. */
@@ -836,7 +839,9 @@ export function comboFailureDecision(
   // says nothing about the next combo target. Structured code only, plus the explicit prose
   // form upstreams emit when they carry no code, so an unrelated 400 stays terminal.
   const failureCode = normalizedFailureCode(options?.code || error.code);
-  if (["model_not_found", "model_unavailable", "unsupported_model"].includes(failureCode)) {
+  // The input-modality refusal is the same kind of verdict: this route cannot read the turn's
+  // media, and a later target may. Its 400 would otherwise end the chain as invalid_request_error.
+  if (["model_not_found", "model_unavailable", "unsupported_model", "unsupported_input_modality"].includes(failureCode)) {
     return "hop";
   }
   if (modelRefusal === "refusal") return "hop";

package/src/combos/index.ts

@@ -22,6 +22,7 @@ export {
 export {
   advanceComboAfterFailure,
   clearComboSelectionState,
+  comboExclusionReasons,
   NoAvailableComboTargetsError,
   noteComboFailure,
   noteComboSuccess,

package/src/combos/resolve.ts

@@ -55,17 +55,49 @@ export class UnknownComboError extends Error {
 export class NoAvailableComboTargetsError extends Error {
   readonly code = "combo_unavailable";
 
-  constructor(readonly comboId: string) {
-    super(`No available targets for combo: ${comboId}`);
+  constructor(readonly comboId: string, readonly reasons = "") {
+    super(`No available targets for combo: ${comboId}${reasons ? ` (${reasons})` : ""}`);
     this.name = "NoAvailableComboTargetsError";
   }
 }
 
+function providerExclusionReason(config: OcxConfig, target: OcxComboTarget, now: number): string | undefined {
+  const provider = Object.hasOwn(config.providers, target.provider) ? config.providers[target.provider] : undefined;
+  if (!provider) return "provider missing";
+  if (provider.disabled === true) return "provider disabled";
+  return cachedProviderQuotaIsExhausted(getCachedProviderRoutingQuota(target.provider, provider, now), now, target.model)
+    ? "quota exhausted"
+    : undefined;
+}
+
 function targetProviderIsUsable(config: OcxConfig, target: OcxComboTarget, now: number): boolean {
-  if (!Object.hasOwn(config.providers, target.provider)) return false;
-  const provider = config.providers[target.provider];
-  if (!provider || provider.disabled === true) return false;
-  return !cachedProviderQuotaIsExhausted(getCachedProviderRoutingQuota(target.provider, provider, now), now, target.model);
+  return providerExclusionReason(config, target, now) === undefined;
+}
+
+/**
+ * Why each target of a combo cannot be picked right now, for a zero-attempt refusal. Only the
+ * configured provider/model and a coarse label are named, never account or request data.
+ */
+export function comboExclusionReasons(
+  config: OcxConfig,
+  comboId: string,
+  eligible?: (target: NormalizedComboTarget) => boolean,
+  now = Date.now(),
+): string {
+  return (getCombo(config, comboId)?.targets ?? []).flatMap(target => {
+    let reason = providerExclusionReason(config, target, now);
+    const cooldown = reason ? undefined : earliestComboCooldown(comboId, [target], now);
+    if (cooldown) reason = `cooldown ${Math.max(1, Math.ceil((cooldown.expiry - now) / 1000))}s`;
+    if (!reason && eligible) {
+      try {
+        if (!eligible(target)) reason = "ineligible for this request";
+      } catch {
+        // An eligibility check can exhaust the translator budget; the target still was not picked.
+        reason = "ineligible for this request";
+      }
+    }
+    return reason ? [`${targetKey(target)}: ${reason}`] : [];
+  }).join("; ");
 }
 
 /** Capture usable providers' quota cooldowns; request eligibility is deferred to exhaustion. */
@@ -100,6 +132,9 @@ function quotaWindowExhausted(percent: number | undefined, resetAt: number | und
 const MODEL_FAMILY_WINDOW_LABELS = new Set(["fable", "opus", "sonnet"]);
 
 function customWindowAppliesToModel(window: ProviderQuotaWindow, model: string | undefined): boolean {
+  // Exact Antigravity model readings are diagnostic only. They are not permission or
+  // provider-wide exhaustion evidence until a separate eligibility contract consumes them.
+  if (window.modelId !== undefined) return false;
   if (window.scope !== "model" || model === undefined) return true;
   const family = window.label.trim().toLowerCase();
   if (!MODEL_FAMILY_WINDOW_LABELS.has(family)) return true;
@@ -408,9 +443,10 @@ export function advanceComboAfterFailure(
   // including the pool's OWN "all accounts are cooled" 429, which refuses locally before it picks
   // one. That is what keeps this from trading a blackhole for a hammer: when nothing else is
   // holding the target back, the target cooldown still does.
-  const accountScoped = options.cooldownScope === "target"
-    && options.status === 429
-    && options.failedAccount !== undefined;
+  // A 402 credit refusal is the provider-scoped twin: the caller names an account only after the
+  // pool has cooled it and still holds an eligible sibling.
+  const accountScoped = options.failedAccount !== undefined
+    && (options.status === 429 ? options.cooldownScope === "target" : options.status === 402);
   // "none" records no cooldown at all: the failure described the request, not the target, so
   // the target must stay immediately selectable for the next (differently shaped) request.
   if (options.cooldownScope !== "none" && !accountScoped) {
@@ -612,6 +648,6 @@ export function tryPickComboModel(config: OcxConfig, modelId: string, preview =
   if (!comboId) return null;
   if (!getCombo(config, comboId)) throw new UnknownComboError(comboId);
   const picked = pickComboTarget(config, comboId, { preview });
-  if (!picked) throw new NoAvailableComboTargetsError(comboId);
+  if (!picked) throw new NoAvailableComboTargetsError(comboId, comboExclusionReasons(config, comboId));
   return picked;
 }

package/src/combos/types.ts

@@ -39,12 +39,16 @@ export interface NormalizedComboTarget {
   weight: number;
   /** Emergency-only target, deferred under `cooldownWaitPolicy` (#5691). */
   lastResort: boolean;
+  /** Pay-per-use target; requires key consent or loopback-only operator consent. */
+  metered: boolean;
   reasoningEfforts?: OcxComboDefaultEffort[];
   /** Optional JEV decision description. */
   modelProfile?: string;
 }
 
 export interface NormalizedComboConfig {
+  /** Operator consent, effective only on a loopback-only proxy. */
+  allowMeteredTargets?: boolean;
   strategy: OcxComboStrategy;
   stickyLimit: number;
   cooldownMs?: number;
@@ -164,6 +168,9 @@ export function comboConfigIssues(
   }
 
   const body = raw as Record<string, unknown>;
+  if (body.allowMeteredTargets !== undefined && typeof body.allowMeteredTargets !== "boolean") {
+    issues.push({ path: ["allowMeteredTargets"], message: "allowMeteredTargets must be a boolean" });
+  }
   if (typeof body.alias === "string") {
     const alias = body.alias.toLowerCase();
     for (const [providerName, provider] of Object.entries(providers)) {
@@ -427,6 +434,12 @@ export function comboConfigIssues(
         message: `targets[${i}].lastResort must be a boolean`,
       });
     }
+    if (target.metered !== undefined && typeof target.metered !== "boolean") {
+      issues.push({
+        path: ["targets", i, "metered"],
+        message: `targets[${i}].metered must be a boolean`,
+      });
+    }
     if (target.modelProfile !== undefined
       && (typeof target.modelProfile !== "string"
         || target.modelProfile.trim().length === 0
@@ -477,6 +490,7 @@ export function normalizeComboConfig(raw: OcxComboConfig): NormalizedComboConfig
     : null;
   return {
     strategy: raw.strategy ?? "failover",
+    ...(raw.allowMeteredTargets === true ? { allowMeteredTargets: true } : {}),
     stickyLimit: raw.stickyLimit ?? 1,
     cooldownMs: raw.cooldownMs,
     waitForCooldownMs: raw.waitForCooldownMs ?? COMBO_DEFAULT_WAIT_FOR_COOLDOWN_MS,
@@ -503,6 +517,7 @@ export function normalizeComboConfig(raw: OcxComboConfig): NormalizedComboConfig
         ? { modelProfile: target.modelProfile.trim() }
         : {}),
       lastResort: target.lastResort === true,
+      metered: target.metered === true,
     })),
   };
 }

package/src/config/diagnostics.ts

@@ -1,13 +1,16 @@
 import { readExistingSpendSalt, spendPoolAliasesError, validatePoolAliasOwners } from "../lib/spend-pool-alias-validation";
 import { isSubagentModelEntry, rawSubagentModelForce } from "./subagent-models";
+import { validRemainingQuotaAccountIds } from "../codex/account-use-remaining";
 import { protocolConfigSchema } from "./schema/config-schema";
 import { createHash } from "node:crypto";
 import { lstatSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import * as z from "zod/v4";
 import { compactionRecoveryConfigError } from "./schema/compaction-recovery";
+import { nativeReasoningRetentionConfigError } from "./schema/native-reasoning-retention";
 import { desktopCompatibilityConfigError } from "./schema/desktop-compatibility";
 import { blockedModelRedirectsError } from "./schema/blocked-model-redirects";
+import { mainAccountHardLockFallbackError } from "./schema/main-account-hard-lock-fallback";
 import type { OcxConfig } from "../types";
 import { anthropicAccountPoolConfigError, anthropicOAuthInstanceConfigError, anthropicSidecarConfigError } from "./schema/anthropic-account-pool";
 import { configReasoningPinsConfigError } from "./provider-validation";
@@ -18,6 +21,7 @@ import { isMissingPathError } from "./atomic-write";
 import { getConfigDir, getConfigPath } from "./paths";
 import { getDefaultConfig } from "./proxy-env";
 import { salvageConfigCandidate } from "./salvage";
+import { sanitizeOpenCodeOverridesForLoad } from "./opencode-wire-upgrade";
 import {
   sanitizeReasoningPinsForLoad,
   sanitizeRetryOn429ForLoad,
@@ -25,6 +29,7 @@ import {
   sanitizeModelCostsForLoad,
   sanitizeAutoReviewForLoad,
   degradedListenerWarnings,
+  degradedReasoningRetentionWarning,
   degradedCodexAccountPriorityWarnings,
   degradedCodexQuotaAutoRefreshWarning,
   normalizeApiKeyIds,
@@ -71,6 +76,7 @@ import {
   chatgptDesktopSchema,
   chatgptDesktopConfigIssue,
   compactionRoutingSchema,
+  reasoningRetentionSchema,
   skillsConfigSchema,
   memoryModelsSchema,
 } from "./schema/leaf-validators";
@@ -136,6 +142,8 @@ function validFileConfigDiagnostics(config: OcxConfig, rawParsed: unknown): Conf
   warnings.push(...degradedCodexAccountPriorityWarnings(rawParsed, normalized));
   warnings.push(...degradedListenerWarnings(rawParsed, normalized));
   if (blockedModelRedirectsError(rawParsed)) warnings.push("blockedModelRedirects ignored: expected a map of nonempty model keys to nonempty string targets");
+  if (nativeReasoningRetentionConfigError(rawParsed)) warnings.push("nativeReasoningRetention ignored: expected only optional boolean modelSwitch and accountSwitch fields; both remain off");
+  if (mainAccountHardLockFallbackError(rawParsed)) warnings.push("codexMainAccountHardLockFallback ignored: expected a nonblank model selector and an optional declared reasoningEffort");
   const quotaAutoRefreshWarning = degradedCodexQuotaAutoRefreshWarning(rawParsed, normalized);
   if (quotaAutoRefreshWarning) warnings.push(quotaAutoRefreshWarning);
   if (rawEffort !== undefined && !isClaudeSubagentEffort(rawEffort)) {
@@ -164,6 +172,8 @@ function validFileConfigDiagnostics(config: OcxConfig, rawParsed: unknown): Conf
   if (codexPoolWarning) warnings.push(codexPoolWarning);
   const spendWarning = malformedSpendWarning(rawParsed);
   if (spendWarning) warnings.push(spendWarning);
+  const retentionWarning = degradedReasoningRetentionWarning(rawParsed, normalized);
+  if (retentionWarning) warnings.push(retentionWarning);
   if (rawPoolAliasesError(rawParsed)) {
     warnings.push("spendPoolAliases invalid: configured pool admission is refused until the mapping is corrected");
   }
@@ -404,12 +414,15 @@ function codexAccountPrioritiesError(value: unknown): string | null {
   return null;
 }
 
-function codexAccountPriorityFailbackError(value: unknown): string | null {
+function codexAccountSelectionPreferencesError(value: unknown): string | null {
   const raw = rawConfigRecord(value);
-  if (!raw || !Object.hasOwn(raw, "codexAccountPriorityFailback")) return null;
-  const enabled = raw.codexAccountPriorityFailback;
-  if (enabled === undefined || typeof enabled === "boolean") return null;
-  return "schema_invalid: codexAccountPriorityFailback: must be a boolean or omitted";
+  if (!raw) return null;
+  for (const key of ["codexAccountPriorityFailback", "codexPreserveSignedInAccount"]) {
+    if (raw[key] !== undefined && typeof raw[key] !== "boolean") {
+      return `schema_invalid: ${key}: must be a boolean or omitted`;
+    }
+  }
+  return null;
 }
 
 /**
@@ -505,6 +518,12 @@ function creditCodexAccountIdsError(value: unknown): string | null {
   return "schema_invalid: creditCodexAccountIds: must be an array of account ids or omitted";
 }
 
+function remainingQuotaAccountIdsError(value: unknown): string | null {
+  const ids = rawConfigRecord(value)?.codexUseRemainingQuotaAccountIds;
+  return ids === undefined || validRemainingQuotaAccountIds(ids) ? null
+    : "schema_invalid: codexUseRemainingQuotaAccountIds: must be an array of Codex account ids or omitted";
+}
+
 function oauthOpenBrowserError(value: unknown): string | null {
   const raw = rawConfigRecord(value);
   if (!raw || !Object.hasOwn(raw, "oauthOpenBrowser")) return null;
@@ -681,6 +700,10 @@ export function validateConfigCandidate(value: unknown): { ok: true; config: Ocx
     return { ok: false, error: "schema_invalid: chatgptDesktop: requires an optional boolean appServerShim and no other fields" };
   }
   const compactionRouting = rawConfigRecord(value)?.compactionRouting;
+  const reasoningRetention = rawConfigRecord(value)?.reasoningRetention;
+  if (reasoningRetention !== undefined && !reasoningRetentionSchema.safeParse(reasoningRetention).success) {
+    return { ok: false, error: "schema_invalid: reasoningRetention: requires optional boolean enabled, maxContextPercent greater than 0 and at most 100 and/or positive integer maxTokens, with no other fields" };
+  }
   if (compactionRouting !== undefined && !compactionRoutingSchema.safeParse(compactionRouting).success) {
     return { ok: false, error: "schema_invalid: compactionRouting: requires a nonblank model, an optional valid reasoningEffort, and optional non-repeating triggers drawn from \"manual\" and \"auto\"" };
   }
@@ -695,6 +718,8 @@ export function validateConfigCandidate(value: unknown): { ok: true; config: Ocx
   const anthropicError = anthropicOAuthInstanceConfigError(value) ?? anthropicAccountPoolConfigError(value) ?? anthropicSidecarConfigError(value);
   if (anthropicError) return { ok: false, error: anthropicError };
   const boundaryError = blockedModelRedirectsError(value)
+    ?? nativeReasoningRetentionConfigError(value)
+    ?? mainAccountHardLockFallbackError(value)
     ?? compactionRecoveryConfigError(value) ?? desktopCompatibilityConfigError(value) ?? configReasoningPinsConfigError(value)
     ?? blankHostnameError(value)
     ?? (rawSubagentModelForce(value) !== undefined && !isSubagentModelEntry(rawSubagentModelForce(value)) ? "schema_invalid: claudeCode.subagentModelForce: expected a safe roster-style model id" : null)
@@ -710,7 +735,7 @@ export function validateConfigCandidate(value: unknown): { ok: true; config: Ocx
     ?? codexPoolError(value)
     ?? googleAntigravityStaticCatalogVersionError(value)
     ?? codexAccountPrioritiesError(value)
-    ?? codexAccountPriorityFailbackError(value)
+    ?? codexAccountSelectionPreferencesError(value)
     ?? poolCredentialGroupsError(value)
     ?? codexQuotaAutoRefreshError(value)
     ?? codexAccountPickerEnabledError(value)
@@ -719,6 +744,7 @@ export function validateConfigCandidate(value: unknown): { ok: true; config: Ocx
     ?? oauthOpenBrowserError(value)
     ?? showCodexCreditsError(value)
     ?? creditCodexAccountIdsError(value)
+    ?? remainingQuotaAccountIdsError(value)
     ?? runtimeRoleError(value)
     ?? remoteGuiConfigError(value)
     ?? clientConnectionConfigError(value)
@@ -740,6 +766,7 @@ export function validateConfigCandidate(value: unknown): { ok: true; config: Ocx
 export function configDiagnosticsFromRaw(raw: string): ConfigDiagnostics {
   try {
     const parsed = JSON.parse(raw.replace(/^\uFEFF/, ""));
+    sanitizeOpenCodeOverridesForLoad(parsed);
     sanitizeReasoningPinsForLoad(parsed);
     // Same degradation as loadConfig: a hand-edited invalid retryOn429 must not trip the
     // schema and send the caller a default-config fallback (the config command could then

package/src/config/live-reconcile.ts

@@ -1,4 +1,4 @@
-import type { OcxConfig, OcxProviderConfig } from "../types";
+import type { OcxConfig, OcxProviderConfig, ProviderCostOverlay } from "../types";
 import { configReasoningPinsConfigError } from "./provider-validation";
 import { adoptCustomModelCatalogMigration, projectCustomModelCatalogMigration } from "../codex/custom-model-catalog-migration";
 import { refreshPreservedProviderOwner } from "../usage/user-cost-overlays";
@@ -16,7 +16,7 @@ import {
 } from "./rebase-provenance";
 import { withConfigMutationLockSync, bumpGenerationForCooperatingConfigWrite } from "./mutation-lock";
 import { ConfigWritePublishedError, persistConfigUnlocked, readRawConfigJson } from "./persist-unlocked";
-import { configDiagnosticsFromRaw, readConfigDiagnostics } from "./diagnostics";
+import { configDiagnosticsFromRaw, readConfigDiagnostics, validateConfigCandidate } from "./diagnostics";
 import { normalizePersistedClaudeCode } from "./load-degrade";
 import { reconcileApiKeys } from "./api-key-reconcile";
 import { captureLiveTopologyBaseline, LIVE_TOPOLOGY_KEYS, projectLiveTopology } from "./live-topology";
@@ -61,6 +61,35 @@ export function adoptPersistedCodexAccountSelection(
   if (baseline) clearConfigTopLevelDeletionIntent(baseline, keys);
 }
 
+type ModelCostReplacement = { provider: string; modelId: string; cost: ProviderCostOverlay | null };
+const modelCostReplacements = new WeakMap<OcxConfig, ModelCostReplacement>();
+
+/** Explicit pricing PUT owns one whole row, even when its base tuple equals the baseline. */
+export function withModelCostRowReplacement(
+  config: OcxConfig, provider: string, modelId: string, cost: ProviderCostOverlay | null, save: () => void,
+): void {
+  const previous = modelCostReplacements.get(config);
+  const replacementCost = structuredClone(cost);
+  if (replacementCost?.promptLengthPricing?.mode === "automatic") delete replacementCost.promptLengthPricing;
+  modelCostReplacements.set(config, { provider, modelId, cost: replacementCost });
+  try { save(); }
+  finally {
+    if (previous) modelCostReplacements.set(config, previous);
+    else modelCostReplacements.delete(config);
+  }
+}
+
+function applyModelCostRowReplacement(config: OcxConfig): void {
+  const replacement = modelCostReplacements.get(config);
+  if (!replacement) return;
+  if (!Object.hasOwn(config.providers, replacement.provider)) throw new Error("pricing provider was removed before persistence");
+  const provider = config.providers[replacement.provider]!;
+  const costs = Object.assign(Object.create(null) as Record<string, ProviderCostOverlay>, provider.modelCosts ?? {});
+  if (replacement.cost === null) delete costs[replacement.modelId];
+  else costs[replacement.modelId] = structuredClone(replacement.cost);
+  provider.modelCosts = costs;
+}
+
 /**
  * Adopt a committed discovery decision and its merge baseline as one synchronous step.
  * Visibility writers assign and save synchronously; any future writer yielding between
@@ -483,6 +512,10 @@ export function saveConfigPreservingClaudeCode(config: OcxConfig): void {
   if (pinError) throw new Error(pinError);
   let published = false;
   const persist = (candidate: OcxConfig): void => {
+    if (modelCostReplacements.has(config)) {
+      const validation = validateConfigCandidate(candidate);
+      if (!validation.ok) throw new Error(validation.error);
+    }
     const changed = persistConfigUnlocked(candidate);
     published = true;
     if (changed) bumpGenerationForCooperatingConfigWrite();
@@ -544,6 +577,9 @@ export function saveConfigPreservingClaudeCode(config: OcxConfig): void {
       }
     }
     applyConfigObjectChildDeletions(config, childDeletions);
+    // Recursive three-way merging preserves sibling rows; explicit PUT/reset
+    // replaces only its model after merging, including absent policy fields.
+    applyModelCostRowReplacement(config);
     if (claudeCodeBaseline.has(config)) {
       if (onDisk !== undefined) {
         const baseline = claudeCodeBaseline.get(config);

package/src/config/load-degrade.ts

@@ -3,12 +3,15 @@ import { isSubagentModelEntry, rawSubagentModelForce } from "./subagent-models";
 import { chmodSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { compactionRecoveryConfigError } from "./schema/compaction-recovery";
+import { nativeReasoningRetentionConfigError } from "./schema/native-reasoning-retention";
 import { desktopCompatibilityConfigError } from "./schema/desktop-compatibility";
 import { blockedModelRedirectsError } from "./schema/blocked-model-redirects";
+import { mainAccountHardLockFallbackError } from "./schema/main-account-hard-lock-fallback";
 import { anthropicSidecarConfigError } from "./schema/anthropic-account-pool";
 import {
   modelPinnedEffortsConfigError,
   pinnedReasoningEffortConfigError,
+  autoReviewOverrideConfigError,
   autoReviewModelOverridesConfigError,
   autoReviewModelTargetConfigError,
   modelCapabilitiesConfigError,
@@ -131,10 +134,14 @@ export function warnDegradedCompactionRouting(rawParsed: unknown, validated: Ocx
  * the ratchet only ever moves down: a per-block call there costs a line the file does not have.
  */
 export function warnDegradedTopLevelOptIns(rawParsed: unknown, validated: OcxConfig): void {
+  if (nativeReasoningRetentionConfigError(rawParsed)) console.warn("⚠️  invalid nativeReasoningRetention disabled; model and account switch allowances remain off");
   setCodexWsReuseAcrossTurns(validated.codexWsReuseAcrossTurns === true);
+  const retentionWarning = degradedReasoningRetentionWarning(rawParsed, validated);
+  if (retentionWarning) console.warn(retentionWarning);
   if (compactionRecoveryConfigError(rawParsed)) console.warn("⚠️  invalid compactionRecovery disabled; the original compaction failure is preserved");
   if (desktopCompatibilityConfigError(rawParsed)) console.warn("Invalid desktopCompatibility startup preference ignored; no desktop compatibility service will start automatically.");
   if (blockedModelRedirectsError(rawParsed)) console.warn("⚠️  invalid blockedModelRedirects ignored; provider routing remains available");
+  if (mainAccountHardLockFallbackError(rawParsed)) console.warn("⚠️  invalid codexMainAccountHardLockFallback ignored; the main-account hard lock still refuses while blocked");
   const chatgptDesktop = chatgptDesktopConfigIssue(rawParsed);
   if (chatgptDesktop) console.warn(`⚠️  config.json ${chatgptDesktop} — the whole chatgptDesktop block is ignored, so the ChatGPT desktop integration reads as off`);
   warnDegradedStreamMode(rawParsed, validated);
@@ -147,6 +154,11 @@ export function warnDegradedTopLevelOptIns(rawParsed: unknown, validated: OcxCon
   }
 }
 
+export function degradedReasoningRetentionWarning(rawParsed: unknown, validated: OcxConfig): string | null {
+  if (rawConfigRecord(rawParsed)?.reasoningRetention === undefined || validated.reasoningRetention !== undefined) return null;
+  return "config.json reasoningRetention is invalid — reasoning retention is disabled";
+}
+
 /**
  * A malformed `memoryModels` phase disables that phase rather than failing the whole schema, so
  * say so once: silently keeping whatever route the phase already had — which may be the shadow
@@ -411,6 +423,11 @@ export function sanitizeModelCostsForLoad(parsed: unknown): void {
 export function sanitizeAutoReviewForLoad(parsed: unknown): void {
   if (!parsed || typeof parsed !== "object") return;
   const root = parsed as Record<string, unknown>;
+  if (root.autoReviewOverride !== undefined
+    && autoReviewOverrideConfigError(root.autoReviewOverride) !== null) {
+    console.warn("⚠️  config.json autoReviewOverride is invalid — ignoring the override");
+    delete root.autoReviewOverride;
+  }
   const providers = root.providers;
   if (!providers || typeof providers !== "object" || Array.isArray(providers)) return;
   for (const [name, providerValue] of Object.entries(providers as Record<string, unknown>)) {