@eddyskywalker/dsh-chatgpt-subscription 0.42.0 → 0.43.0

package/lib/index.js

@@ -141,7 +141,7 @@ const ROUTE_PREFIX$4 = "/api/dsh-chatgpt-subscription";
 * `test/responses-client.test.ts` asserts the two agree, so a release that
 * forgets this constant fails the suite instead of shipping quietly.
 */
-const PLUGIN_VERSION = "0.42.0";
+const PLUGIN_VERSION = "0.43.0";
 const CODEX_CHATGPT_PROVIDER_ID = "codex-chatgpt";
 const CODEX_API_BASE = "https://chatgpt.com/backend-api/codex";
 const CODEX_RESPONSES_URL = `${CODEX_API_BASE}/responses`;
@@ -26310,9 +26310,11 @@ function identityFromTokens(accessToken, refreshToken) {
 	const refresh = refreshToken === void 0 ? void 0 : decodeJwtPayload(refreshToken);
 	const userId = claimString(access?.user_id) ?? claimString(refresh?.user_id) ?? claimString(access?.sub) ?? claimString(refresh?.sub);
 	const email = (claimString(access?.email) ?? claimString(refresh?.email))?.toLowerCase();
+	const nickname = claimString(access?.nickname) ?? claimString(refresh?.nickname) ?? claimString(access?.name) ?? claimString(refresh?.name) ?? claimString(access?.preferred_username) ?? claimString(refresh?.preferred_username);
 	return {
 		...userId === void 0 ? {} : { userId },
-		...email === void 0 ? {} : { email }
+		...email === void 0 ? {} : { email },
+		...nickname === void 0 ? {} : { nickname }
 	};
 }
 function parseTokenResponse$2(record) {
@@ -26511,7 +26513,7 @@ async function runDeviceLogin(options) {
 			});
 			if (outcome.kind === "success") {
 				const identity = identityFromTokens(outcome.token.accessToken, outcome.token.refreshToken);
-				const credentials = {
+				const signedIn = {
 					accessToken: outcome.token.accessToken,
 					refreshToken: outcome.token.refreshToken,
 					expiresAt: outcome.token.expiresAt,
@@ -26523,8 +26525,10 @@ async function runDeviceLogin(options) {
 					baseUrl: codingBaseUrl(options.region),
 					authenticatedAt: Date.now(),
 					...identity.userId === void 0 ? {} : { userId: identity.userId },
-					...identity.email === void 0 ? {} : { email: identity.email }
+					...identity.email === void 0 ? {} : { email: identity.email },
+					...identity.nickname === void 0 ? {} : { nickname: identity.nickname }
 				};
+				const credentials = options.enrich === void 0 ? signedIn : await options.enrich(signedIn).catch(() => signedIn);
 				await options.store.write(credentials);
 				if (options.onSave) await options.onSave(credentials).catch(() => void 0);
 				await persistRegion(options.region);
@@ -26573,7 +26577,8 @@ async function beginWebLogin(store, options = {}) {
 				region,
 				signal: controller.signal,
 				open,
-				...options.onSave === void 0 ? {} : { onSave: options.onSave }
+				...options.onSave === void 0 ? {} : { onSave: options.onSave },
+				...options.enrich === void 0 ? {} : { enrich: options.enrich }
 			});
 			webLoginFlow = {
 				...webLoginFlow,
@@ -27365,6 +27370,92 @@ function parsePlanLevel(payload) {
 	return asString$18(membership?.level ?? membership?.levelId ?? membership?.level_id) ?? null;
 }
 /**
+* Field names the service uses for the account's own name.
+*
+* `/me` documents a nickname; the platform also echoes a display name, and a
+* gateway envelope adds nothing but depth. All of them are the same fact: what
+* to title the account's card with, and what a `账号 N` placeholder should
+* become.
+*/
+const PROFILE_NAME_KEYS = [
+	"nickname",
+	"name",
+	"username",
+	"display_name",
+	"displayName",
+	"preferred_username"
+];
+/**
+* Every record a profile payload may keep the identity in, outermost first.
+*
+* The endpoint has answered flat (`{ nickname, email, ... }`) and nested
+* (`{ data: { userInfo: { ... } } }`) on different gateway versions, and a
+* nested envelope may hold credentials-adjacent siblings at the top level too,
+* so the search never commits to one shape: each container is tried in turn and
+* the first one that names a field wins.
+*/
+function profileRecords(payload) {
+	const root = asRecord$13(payload);
+	if (root === void 0) return [];
+	const data = asRecord$13(root.data);
+	return [
+		root,
+		data,
+		asRecord$13(root.userInfo) ?? asRecord$13(data?.userInfo),
+		asRecord$13(root.user) ?? asRecord$13(data?.user)
+	].filter((record) => record !== void 0);
+}
+/** First value among `keys` found in any profile container, outermost first. */
+function profileString(payload, keys) {
+	for (const record of profileRecords(payload)) {
+		const found = firstString$1(record, keys);
+		if (found !== void 0) return found;
+	}
+}
+/**
+* Fold the facts a `/me` read established into a credential.
+*
+* Sign-in only names the account through its token, which carries an id and —
+* for an account with a mailbox — an address. The nickname lives on `/me` and
+* nowhere else, so the caller reads it once and stores it here; without this,
+* a phone-signed-in account could never be called anything but `账号 N`.
+*
+* Only fields the profile actually names are written: a gateway that drops the
+* nickname must not blank one learned earlier, and the token pair is copied
+* through untouched. Returns the same object when nothing new was learned, so a
+* caller can tell "nothing to store" from "store this".
+*/
+function credentialsWithProfile(credentials, profile) {
+	const nickname = profileString(profile, PROFILE_NAME_KEYS);
+	const email = profileString(profile, ["email"])?.toLowerCase();
+	const userId = profileString(profile, [
+		"user_id",
+		"userId",
+		"global_id",
+		"globalId"
+	]);
+	const planName = parsePlanName(profile) ?? void 0;
+	const next = { ...credentials };
+	let changed = false;
+	if (nickname !== void 0 && next.nickname !== nickname) {
+		next.nickname = nickname;
+		changed = true;
+	}
+	if (email !== void 0 && next.email !== email) {
+		next.email = email;
+		changed = true;
+	}
+	if (userId !== void 0 && next.userId !== userId) {
+		next.userId = userId;
+		changed = true;
+	}
+	if (planName !== void 0 && next.planName !== planName) {
+		next.planName = planName;
+		changed = true;
+	}
+	return changed ? next : credentials;
+}
+/**
 * Fetch and cache the account's quota snapshot.
 *
 * A 401 is surfaced as a rejection so the caller can invalidate the stored
@@ -27415,6 +27506,9 @@ async function fetchAccountQuota$3(store, options = {}) {
 		...credentials,
 		...learned
 	}).catch(() => void 0);
+	if (options.onAccount !== void 0) try {
+		await options.onAccount(account, credentials);
+	} catch {}
 	const snapshot = {
 		account,
 		planName: account.planName,
@@ -27468,12 +27562,8 @@ function accountFromCredentials$1(credentials, payload, profile) {
 	const planLevel = (profile === void 0 ? null : parsePlanLevel(profile)) ?? (payload === void 0 ? null : parsePlanLevel(payload));
 	return {
 		userId: credentials.userId ?? identity.userId ?? null,
-		nickname: (profile === void 0 ? null : firstString$1(asRecord$13(profile) ?? {}, [
-			"nickname",
-			"username",
-			"name"
-		])) ?? credentials.nickname ?? null,
-		email: credentials.email ?? identity.email ?? null,
+		nickname: (profile === void 0 ? void 0 : profileString(profile, PROFILE_NAME_KEYS)) ?? credentials.nickname ?? null,
+		email: credentials.email ?? identity.email ?? (profile === void 0 ? void 0 : profileString(profile, ["email"])?.toLowerCase()) ?? null,
 		planName,
 		planLevel,
 		region: credentials.region,
@@ -31991,6 +32081,46 @@ function processLine(line, state, wire) {
 function kimiCodePoolPath() {
 	return path.join(dshHomeDir(), "storages", "kimi-code-pool.json");
 }
+/**
+* Aliases that name nobody: the placeholder this pool mints at sign-in.
+*
+* `defaultAlias` writes `账号 N` when the credential carried neither an address
+* nor a name (a phone-signed-in account carries neither), and the legacy
+* single-credential mirror wrote `主账号`. Both mean "no name learned yet", so
+* both may be upgraded once the profile reports one — while anything else is a
+* name someone chose or an address already on the card, and stays put.
+*/
+const PLACEHOLDER_ALIAS = /^(?:账号|帐号|account)\s*\d*$|^主账号$|^primary$/i;
+/**
+* Whether an alias is still the placeholder a sign-in mints, rather than a name
+* somebody recognises.
+*
+* Exported because the routes decide whether one more profile read is worth it:
+* a row still titled `账号 N` is exactly the row whose name nobody has learned.
+*/
+function isPlaceholderAlias(alias) {
+	return PLACEHOLDER_ALIAS.test(alias.trim());
+}
+/** A field worth storing, or undefined when the service left it blank. */
+function learnedField(value) {
+	const text = (value ?? "").trim();
+	return text === "" ? void 0 : text;
+}
+/**
+* The alias one sign-in should leave the row with.
+*
+* A fresh sign-in computes one from the credential it just produced, and that is
+* the truth when it names something (an address, or a nickname in the token). It
+* names nothing for a phone account, though, while the row may already carry the
+* nickname a profile read learned or a title the user typed — dropping those
+* back to `账号 N` on a re-sign-in would undo both. So a minted placeholder only
+* beats another placeholder; anything that names somebody is kept.
+*/
+function aliasForSignIn(minted, previous) {
+	if (!isPlaceholderAlias(minted)) return minted;
+	if (previous !== void 0 && !isPlaceholderAlias(previous)) return previous;
+	return minted;
+}
 function optionalString$11(record, key) {
 	const value = record[key];
 	if (value === void 0 || value === null) return void 0;
@@ -32089,9 +32219,9 @@ var KimiCodeAccountPool = class extends AccountPoolCore {
 			parsePoolData: parseKimiCodePoolData,
 			dedupeKey: (credentials) => credentials.userId ?? credentials.email,
 			defaultAlias: (credentials, position) => credentials.email ?? credentials.nickname ?? `账号 ${position}`,
-			createAccount: ({ id, alias, credentials, addedAt, isPrimary }) => ({
+			createAccount: ({ id, alias, credentials, addedAt, isPrimary, existing }) => ({
 				id,
-				alias,
+				alias: aliasForSignIn(alias, existing?.alias),
 				credentials,
 				addedAt,
 				isPrimary,
@@ -32183,6 +32313,47 @@ var KimiCodeAccountPool = class extends AccountPoolCore {
 	mirrorStore() {
 		return this.store;
 	}
+	/**
+	* Remember who the service says one pooled account is.
+	*
+	* Sign-in can only name an account through its token, which carries an id and
+	* — for an account with a mailbox — an address. That is why a phone-signed-in
+	* row is titled `账号 N` and never changes on its own: the nickname lives on
+	* `/me`, which only the quota read asks, and nothing used to carry the answer
+	* back to the row. Every reading now calls this with what the profile said, so
+	* the card can name its own account without a re-sign-in.
+	*
+	* Only the placeholder yields: a name someone chose stays, because silently
+	* renaming a row a user named is worse than leaving a default in place. The
+	* learned facts also go into the mirrored credential, so a later re-sign-in
+	* (which mints the alias from the credential) keeps the name, and so do the
+	* single-account fallbacks that read that copy.
+	*/
+	async learnAccount(accountId, account) {
+		const nickname = learnedField(account.nickname);
+		const email = learnedField(account.email)?.toLowerCase();
+		const userId = learnedField(account.userId);
+		const planName = learnedField(account.planName);
+		if (nickname === void 0 && email === void 0 && userId === void 0 && planName === void 0) return;
+		await this.updatePool((data) => {
+			const target = data.accounts.find((entry) => entry.id === accountId);
+			if (target === void 0) return;
+			if (nickname !== void 0) target.nickname = nickname;
+			if (email !== void 0) target.email = email;
+			if (userId !== void 0) target.userId = userId;
+			if (planName !== void 0) target.planName = planName;
+			const next = { ...target.credentials };
+			if (nickname !== void 0) next.nickname = nickname;
+			if (email !== void 0) next.email = email;
+			if (userId !== void 0) next.userId = userId;
+			if (planName !== void 0) next.planName = planName;
+			target.credentials = next;
+			if (isPlaceholderAlias(target.alias)) {
+				const name = nickname ?? email;
+				if (name !== void 0) target.alias = name;
+			}
+		});
+	}
 };
 //#endregion
 //#region src/host/kimi-code/routes.ts
@@ -32426,6 +32597,57 @@ function registerKimiCodeRoutes(ctx, store, modelSettings, preferences, options
 		return (_credentials) => pool.renewCredential(accountId, fetchFn);
 	};
 	/**
+	* Learning seam for the quota fetch, bound to one pool account.
+	*
+	* The reading is the only thing that asks `/me`, so it is also the only place
+	* the account's nickname can be found. The pool owns the row, so the facts go
+	* there: without this the card stayed titled `账号 N` forever, because nothing
+	* ever carried the profile back to the account it describes.
+	*/
+	const learnFor = (accountId) => {
+		const pool = accountPool;
+		if (pool === void 0 || accountId === void 0) return void 0;
+		return (account) => pool.learnAccount(accountId, account);
+	};
+	/**
+	* Accounts whose name has already been asked for, once per process.
+	*
+	* A row titled `账号 N` needs exactly one `/me`; retrying on every status poll
+	* (the card asks every minute) would spend a request a minute on an account
+	* whose profile simply has no nickname to give.
+	*/
+	const nameProbes = /* @__PURE__ */ new Set();
+	/**
+	* One profile read for a row still carrying the sign-in placeholder.
+	*
+	* The quota read is the natural place to learn a name, but it happens only
+	* when the snapshot is stale — and not at all while the usage call is failing
+	* — so a fresh cache could hold the card at `账号 N` for as long as the TTL
+	* lasts. This reads `/me` with the token the status call already holds, once
+	* per account, and reports whether the row was renamed.
+	*/
+	const probeName = async (target, rows) => {
+		const pool = accountPool;
+		if (pool === void 0 || target.id === void 0) return false;
+		const row = rows.find((entry) => entry.id === target.id);
+		if (row === void 0 || !isPlaceholderAlias(row.alias)) return false;
+		if (nameProbes.has(target.id)) return false;
+		nameProbes.add(target.id);
+		try {
+			const credentials = await effectiveCredentials(target);
+			if (credentials === void 0) return false;
+			const profile = await fetchProfile(store, {
+				fetchFn,
+				credentials
+			});
+			if (profile === null) return false;
+			await pool.learnAccount(target.id, accountFromCredentials$1(credentials, void 0, profile));
+			return true;
+		} catch {
+			return false;
+		}
+	};
+	/**
 	* The credential the active account should be used with right now.
 	*
 	* Every card path goes through the pool here. A pool owns both the rotation
@@ -32467,17 +32689,20 @@ function registerKimiCodeRoutes(ctx, store, modelSettings, preferences, options
 								...accountPool === void 0 ? {} : {
 									credentials,
 									accountId: poolActive.id,
-									renewFn: renewFor(poolActive.id)
+									renewFn: renewFor(poolActive.id),
+									onAccount: learnFor(poolActive.id)
 								}
 							});
 						};
 						if (cached === null) await quotaRefresh.run(refresh);
 						else quotaRefresh.start(refresh);
 					}
+					let value = await readStatus(url.searchParams.get("sessionId") ?? void 0);
+					if (await probeName(poolActive, value.accounts ?? [])) value = await readStatus(url.searchParams.get("sessionId") ?? void 0);
 					return sendJson$8(response, 200, {
 						ok: true,
 						value: {
-							...await readStatus(url.searchParams.get("sessionId") ?? void 0),
+							...value,
 							quotaError: quotaRefresh.lastError(),
 							quotaRefreshing: quotaRefresh.refreshing
 						}
@@ -32497,6 +32722,13 @@ function registerKimiCodeRoutes(ctx, store, modelSettings, preferences, options
 							fetchFn,
 							region: requested,
 							openBrowser: options.openBrowser,
+							enrich: async (credentials) => {
+								const profile = await fetchProfile(store, {
+									fetchFn,
+									credentials
+								}).catch(() => null);
+								return profile === null ? credentials : credentialsWithProfile(credentials, profile);
+							},
 							...accountPool === void 0 ? {} : { onSave: (credentials) => accountPool.addAccount(credentials) }
 						})
 					});
@@ -32536,7 +32768,8 @@ function registerKimiCodeRoutes(ctx, store, modelSettings, preferences, options
 						...accountPool === void 0 ? {} : {
 							credentials: await effectiveCredentials(poolActive),
 							accountId: poolActive.id,
-							renewFn: renewFor(poolActive.id)
+							renewFn: renewFor(poolActive.id),
+							onAccount: learnFor(poolActive.id)
 						}
 					});
 					return sendJson$8(response, 200, {
@@ -32566,7 +32799,8 @@ function registerKimiCodeRoutes(ctx, store, modelSettings, preferences, options
 							...accountPool === void 0 ? {} : {
 								credentials: await effectiveCredentials(quotaActive),
 								accountId: quotaActive.id,
-								renewFn: renewFor(quotaActive.id)
+								renewFn: renewFor(quotaActive.id),
+								onAccount: learnFor(quotaActive.id)
 							}
 						}) === null) return sendJson$8(response, 502, {
 							ok: false,
@@ -65296,14 +65530,14 @@ function publishedCatalogMeta(store, id) {
 function formatModelHint$1(contextWindow, input, reasoning) {
 	return formatModelCapacity$1(contextWindow) + " · " + input.join("+") + (reasoning ? " · reasoning" : "");
 }
-function uniqueModels$1(settings) {
+function uniqueModels(settings) {
 	const ids = new Set(DEFAULT_MODELS);
 	for (const model of listedClinePassCatalogModels(settings)) ids.add(model.id);
 	return [...ids];
 }
 /** Every model the card should render, whether or not it is advertised. */
 function projectModels$1(settings, store) {
-	const known = uniqueModels$1(settings);
+	const known = uniqueModels(settings);
 	const hidden = new Set(settings.hiddenModels);
 	const enabledSet = settings.enabledModelIds === null ? null : new Set(settings.enabledModelIds);
 	return known.map((id) => {
@@ -65959,7 +66193,7 @@ function registerClinePassRoutes(ctx, options) {
 					});
 					const body = await readRequestJson$2(request).catch(() => ({}));
 					const current = await settingsStore.read();
-					const known = uniqueModels$1(current);
+					const known = uniqueModels(current);
 					const hidden = new Set(current.hiddenModels);
 					if (path === "models/visibility") {
 						const model = typeof body.model === "string" ? body.model.trim() : "";
@@ -73021,8 +73255,7 @@ const MODEL_CATALOG$1 = Object.freeze({
 			output: .28
 		},
 		contextWindow: 1048576,
-		input: ["text", "image"],
-		reasoning: false
+		input: ["text", "image"]
 	},
 	"mimo-v2.6-pro": {
 		name: "MiMo V2.6 Pro",
@@ -73031,8 +73264,7 @@ const MODEL_CATALOG$1 = Object.freeze({
 			output: .87
 		},
 		contextWindow: 1048576,
-		input: ["text", "image"],
-		reasoning: false
+		input: ["text", "image"]
 	},
 	"minimax-m3.1-flash": {
 		name: "MiniMax M3.1 Flash",
@@ -73076,8 +73308,7 @@ const MODEL_CATALOG$1 = Object.freeze({
 		},
 		contextWindow: 1e6,
 		maxTokens: 65536,
-		input: ["text"],
-		reasoning: false
+		input: ["text"]
 	}
 });
 /** Subscription models current at release time; the live catalog extends this. */
@@ -73099,6 +73330,96 @@ function catalogEntry$1(model) {
 	return MODEL_CATALOG$1[model];
 }
 //#endregion
+//#region src/host/opendesign/catalog.ts
+/**
+* Merge the shipped table, the last gateway listing and the user's per-model
+* override into the descriptor the harness validates.
+*
+* Context window and output cap are provider facts, not preferences: the harness
+* sizes its prompt budget against `context.contextWindow`, so an understated
+* window silently truncates history. This line ships no per-model windows (the
+* gateway publishes none to an API key), so the window is the line default until
+* a live listing or a user override states one.
+*
+* @module dsh-chatgpt-subscription/opendesign-catalog
+*/
+/** The wire's whole modality vocabulary; a listing may claim more than it accepts. */
+const SEAM_MODALITIES = /* @__PURE__ */ new Set(["text", "image"]);
+function definedOnly(value) {
+	if (value === void 0) return {};
+	const result = {};
+	for (const [key, entry] of Object.entries(value)) if (entry !== void 0 && entry !== null) result[key] = entry;
+	return result;
+}
+/**
+* The output budget to advertise for one model.
+*
+* `defaultMaxTokens` is what a request asks for, not what the model can emit,
+* and the harness spends it twice: it fills a request's `max_tokens` from it
+* and reserves the same number as completion room before deciding to compact.
+* So a published ceiling clamps the configured budget rather than becoming it,
+* and a budget is never taken past half the window.
+*/
+function resolveOutputBudget(budget, ceiling, contextWindow) {
+	const wanted = Number.isFinite(budget) && (budget ?? 0) > 0 ? budget : void 0;
+	const most = Number.isFinite(ceiling) && (ceiling ?? 0) > 0 ? ceiling : void 0;
+	const chosen = wanted === void 0 ? most : most === void 0 ? wanted : Math.min(wanted, most);
+	if (chosen === void 0) return void 0;
+	const half = Number.isFinite(contextWindow) && contextWindow > 0 ? Math.floor(contextWindow / 2) : void 0;
+	return half === void 0 ? chosen : Math.min(chosen, half);
+}
+/**
+* Whether the subscription is known to serve one model.
+*
+* `servedModelIds === null` is "nobody has ever measured this plan": the absence
+* of a fact is not a denial, so nothing is hidden on its strength and the shipped
+* table stands in exactly as it did before this fact existed. An array is a
+* measurement taken from a successful scan, and an id outside it is a model this
+* plan does not serve — it stays in the editor as a described model, it just stops
+* being advertised.
+*
+* The user's own override lives one layer up (`forceVisibleModels`): this function
+* answers what the plan said, never what the user decided.
+*/
+function isModelServed(model, servedModelIds) {
+	return servedModelIds === null || servedModelIds.includes(model);
+}
+/**
+* Resolve the metadata one model is advertised with.
+*
+* Precedence per field: the user's override, then the last gateway listing,
+* then the shipped table, then the route-wide fallback. The listing sits above
+* the shipped table for the fields the table cannot carry (window, modalities):
+* the table's windows do not exist to be beaten, and its names/prices are
+* curated, so a listing that states no name keeps the table's.
+*/
+function resolveModelInfo(model, options) {
+	const synced = options.synced.find((entry) => entry.id === model);
+	const shipped = catalogEntry$1(model);
+	const published = {
+		...definedOnly(shipped),
+		...definedOnly(synced)
+	};
+	const fallbackWindow = options.defaultContextWindow ?? 128e3;
+	const contextWindow = options.contextWindowOverride ?? published.contextWindow ?? fallbackWindow;
+	const maxTokens = resolveOutputBudget(options.defaultMaxTokens ?? 64e3, published.maxTokens, contextWindow);
+	const reasoning = published.reasoning ?? shipped?.reasoning ?? true;
+	const efforts = (Array.isArray(published.efforts) && published.efforts.length > 0 ? published.efforts : void 0) ?? (shipped?.efforts !== void 0 && shipped.efforts.length > 0 ? [...shipped.efforts] : DEFAULT_EFFORTS);
+	const defaultEffort = reasoning && shipped?.defaultEffort !== void 0 && efforts.includes(shipped.defaultEffort) ? shipped.defaultEffort : void 0;
+	const input = (Array.isArray(published.input) && published.input.length > 0 ? published.input : shipped?.input ?? ["text"]).filter((entry) => SEAM_MODALITIES.has(entry));
+	return {
+		id: model,
+		displayName: String(published.name ?? "").trim() || model,
+		contextWindow,
+		maxTokens: maxTokens ?? options.defaultMaxTokens ?? 64e3,
+		reasoning,
+		...reasoning ? { efforts } : { efforts: [] },
+		...defaultEffort === void 0 ? {} : { defaultEffort },
+		input: input.length > 0 ? input : ["text"],
+		...shipped?.pricing === void 0 ? {} : { pricing: shipped.pricing }
+	};
+}
+//#endregion
 //#region src/host/opendesign/token-store.ts
 /** Whether one credential is a device-flow session rather than a pasted key. */
 function isOpenDesignOAuthCredentials(credentials) {
@@ -73254,6 +73575,24 @@ function readCatalogModels(value) {
 	}
 	return models;
 }
+/**
+* One stored id list, normalized: non-empty strings only, deduplicated, and
+* `null` when the value is not a list at all.
+*
+* `null` and `[]` stay distinct here; see the tri-state note on
+* {@link OpenDesignModelSettings.servedModelIds}.
+*/
+function readIdList(value) {
+	if (!Array.isArray(value)) return null;
+	const ids = [];
+	for (const entry of value) {
+		if (typeof entry !== "string") continue;
+		const id = entry.trim();
+		if (id === "" || ids.includes(id)) continue;
+		ids.push(id);
+	}
+	return ids;
+}
 function positiveInteger(value, fallback, allowZero = false) {
 	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < (allowZero ? 0 : 1)) return fallback;
 	return value;
@@ -73268,6 +73607,8 @@ function parseOpenDesignModelSettings(value) {
 		enabledModelIds,
 		catalogModels: readCatalogModels(record.catalogModels),
 		hiddenModels: Array.isArray(record.hiddenModels) ? record.hiddenModels.filter((id) => typeof id === "string") : [],
+		servedModelIds: readIdList(record.servedModelIds),
+		forceVisibleModels: readIdList(record.forceVisibleModels) ?? [],
 		contextWindowOverrides: readNumberOverrides(record.contextWindowOverrides),
 		defaultContextWindow: positiveInteger(record.defaultContextWindow, DEFAULT_CONTEXT_WINDOW),
 		defaultMaxTokens: positiveInteger(record.defaultMaxTokens, DEFAULT_MAX_TOKENS),
@@ -73285,12 +73626,30 @@ function defaultOpenDesignModelSettings() {
 *
 * The file is written atomically (temp + rename) so a crash mid-write leaves the
 * previous document intact rather than a truncated one that reads as "reset all
-* settings".
+* settings", and writes are SERIALIZED behind one queue so two read→compute→write
+* cycles can never interleave and erase each other's fields. Reads do not queue:
+* see {@link OpenDesignModelSettingsStore.pending}.
 */
 var OpenDesignModelSettingsStore = class {
 	filePath;
 	cached = null;
 	loadPromise = null;
+	/**
+	* Tail of the write queue.
+	*
+	* Every mutator derives a WHOLE document from the one it read, so two of them in
+	* flight at once each erase the other's fields. That is not hypothetical here:
+	* the catalog sync is fire-and-forget (`void syncCatalog()` on account add and on
+	* a completed sign-in), so it really can land between a selection change's read
+	* and its write. Each mutation therefore runs its entire read → compute → write
+	* inside one turn of this queue.
+	*
+	* `read()` stays OUTSIDE the queue on purpose: it is the hot path (every status
+	* request, every keystroke-driven checkbox), and waiting behind a write would buy
+	* nothing — by the time a queued operation runs, every write queued before it has
+	* already landed, so the plain read it performs IS the in-lock read.
+	*/
+	pending = Promise.resolve();
 	constructor(filePath = modelSettingsPath$7()) {
 		this.filePath = filePath;
 	}
@@ -73300,7 +73659,14 @@ var OpenDesignModelSettingsStore = class {
 	status() {
 		return this.cached ?? defaultOpenDesignModelSettings();
 	}
-	/** Read the document at activation time, synchronously. */
+	/**
+	* Read the document at activation time, synchronously.
+	*
+	* Synchronous by contract, so it cannot join the write queue — and it does not
+	* need to: it only READS, a rename makes the file either the old or the new
+	* document (never a half-written one), and a queued write assigns `cached` after
+	* that rename, so a reading taken mid-write is superseded by the write's own.
+	*/
 	readSync() {
 		if (this.cached !== null) return this.cached;
 		try {
@@ -73330,7 +73696,30 @@ var OpenDesignModelSettingsStore = class {
 		this.cached = defaultOpenDesignModelSettings();
 		return this.cached;
 	}
+	/**
+	* Run one operation with exclusive access to the document.
+	*
+	* The queue's tail never carries a rejection: an operation that throws rejects
+	* its OWN caller only, and the tail is flattened to a fulfilled promise right
+	* afterwards, so a failed write cannot poison the writes queued behind it.
+	*/
+	async exclusive(operation) {
+		const result = this.pending.then(operation);
+		this.pending = result.then(() => void 0, () => void 0);
+		return await result;
+	}
+	/** Replace the whole document, queued behind any write already in flight. */
 	async write(settings) {
+		return await this.exclusive(() => this.writeUnlocked(settings));
+	}
+	/**
+	* The file half of a write, for callers that ALREADY hold the queue.
+	*
+	* No public mutator may call another one: awaiting a queued mutator from inside
+	* `exclusive` would wait for a queue position behind itself and deadlock. That is
+	* why every mutator below composes `read()` with THIS, never with `write()`.
+	*/
+	async writeUnlocked(settings) {
 		await fs.mkdir(path.dirname(this.filePath), { recursive: true });
 		const tmp = `${this.filePath}.tmp.${Date.now()}`;
 		await fs.writeFile(tmp, JSON.stringify({
@@ -73342,32 +73731,75 @@ var OpenDesignModelSettingsStore = class {
 		return settings;
 	}
 	async update(patch) {
-		const current = await this.read();
-		const next = {
-			...current,
-			...patch,
-			contextWindowOverrides: patch.contextWindowOverrides === void 0 ? current.contextWindowOverrides : patch.contextWindowOverrides
-		};
-		await this.write(next);
-		return next;
+		return await this.exclusive(async () => {
+			const current = await this.read();
+			const next = {
+				...current,
+				...patch,
+				contextWindowOverrides: patch.contextWindowOverrides === void 0 ? current.contextWindowOverrides : patch.contextWindowOverrides
+			};
+			return await this.writeUnlocked(next);
+		});
 	}
-	/** Record a catalog sync without touching the user's selection. */
-	async storeCatalog(models) {
-		const current = await this.read();
-		return await this.write({
-			...current,
-			catalogModels: models
+	/**
+	* Record a catalog sync without touching the user's selection.
+	*
+	* `servedModelIds` is written only when the caller actually measured it: a sync
+	* in which every scan failed must leave the previous measurement standing rather
+	* than clearing the filter, so `undefined` keeps the stored value while an array
+	* (including an empty one) replaces it.
+	*/
+	async storeCatalog(models, servedModelIds) {
+		return await this.exclusive(async () => {
+			const current = await this.read();
+			return await this.writeUnlocked(servedModelIds === void 0 ? {
+				...current,
+				catalogModels: models
+			} : {
+				...current,
+				catalogModels: models,
+				servedModelIds
+			});
+		});
+	}
+	/**
+	* Replace the model selection, dropping any forced reveal it excludes.
+	*
+	* One `read` for both the prune input and the write baseline, so the two cannot
+	* disagree: computing the prune outside and then patching would read the document
+	* twice, and a forced reveal added in that gap would be recorded and then erased
+	* by the second read's snapshot.
+	*
+	* The prune belongs to the selection rather than to `models/visibility` because
+	* the card's only un-tick path is the selection patch: it removes the id from the
+	* whitelist and never posts `{visible:false}`, so a forced reveal would otherwise
+	* outlive the tick that asked for it. `null` is "no filter" — not a "keep only
+	* these" statement — so it prunes nothing.
+	*/
+	async selectModels(ids) {
+		return await this.exclusive(async () => {
+			const current = await this.read();
+			return await this.writeUnlocked(ids === null ? {
+				...current,
+				enabledModelIds: null
+			} : {
+				...current,
+				enabledModelIds: ids,
+				forceVisibleModels: current.forceVisibleModels.filter((id) => ids.includes(id))
+			});
 		});
 	}
 	/** Store or clear (null) one model's context-window override. */
 	async setContextWindowOverride(model, contextWindow) {
-		const current = await this.read();
-		const overrides = { ...current.contextWindowOverrides };
-		if (contextWindow === null) delete overrides[model];
-		else overrides[model] = contextWindow;
-		return await this.write({
-			...current,
-			contextWindowOverrides: overrides
+		return await this.exclusive(async () => {
+			const current = await this.read();
+			const overrides = { ...current.contextWindowOverrides };
+			if (contextWindow === null) delete overrides[model];
+			else overrides[model] = contextWindow;
+			return await this.writeUnlocked({
+				...current,
+				contextWindowOverrides: overrides
+			});
 		});
 	}
 };
@@ -73521,80 +73953,6 @@ var OpenDesignAccountPool = class extends AccountPoolCore {
 	}
 };
 //#endregion
-//#region src/host/opendesign/catalog.ts
-/**
-* Merge the shipped table, the last gateway listing and the user's per-model
-* override into the descriptor the harness validates.
-*
-* Context window and output cap are provider facts, not preferences: the harness
-* sizes its prompt budget against `context.contextWindow`, so an understated
-* window silently truncates history. This line ships no per-model windows (the
-* gateway publishes none to an API key), so the window is the line default until
-* a live listing or a user override states one.
-*
-* @module dsh-chatgpt-subscription/opendesign-catalog
-*/
-/** The wire's whole modality vocabulary; a listing may claim more than it accepts. */
-const SEAM_MODALITIES = /* @__PURE__ */ new Set(["text", "image"]);
-function definedOnly(value) {
-	if (value === void 0) return {};
-	const result = {};
-	for (const [key, entry] of Object.entries(value)) if (entry !== void 0 && entry !== null) result[key] = entry;
-	return result;
-}
-/**
-* The output budget to advertise for one model.
-*
-* `defaultMaxTokens` is what a request asks for, not what the model can emit,
-* and the harness spends it twice: it fills a request's `max_tokens` from it
-* and reserves the same number as completion room before deciding to compact.
-* So a published ceiling clamps the configured budget rather than becoming it,
-* and a budget is never taken past half the window.
-*/
-function resolveOutputBudget(budget, ceiling, contextWindow) {
-	const wanted = Number.isFinite(budget) && (budget ?? 0) > 0 ? budget : void 0;
-	const most = Number.isFinite(ceiling) && (ceiling ?? 0) > 0 ? ceiling : void 0;
-	const chosen = wanted === void 0 ? most : most === void 0 ? wanted : Math.min(wanted, most);
-	if (chosen === void 0) return void 0;
-	const half = Number.isFinite(contextWindow) && contextWindow > 0 ? Math.floor(contextWindow / 2) : void 0;
-	return half === void 0 ? chosen : Math.min(chosen, half);
-}
-/**
-* Resolve the metadata one model is advertised with.
-*
-* Precedence per field: the user's override, then the last gateway listing,
-* then the shipped table, then the route-wide fallback. The listing sits above
-* the shipped table for the fields the table cannot carry (window, modalities):
-* the table's windows do not exist to be beaten, and its names/prices are
-* curated, so a listing that states no name keeps the table's.
-*/
-function resolveModelInfo(model, options) {
-	const synced = options.synced.find((entry) => entry.id === model);
-	const shipped = catalogEntry$1(model);
-	const published = {
-		...definedOnly(shipped),
-		...definedOnly(synced)
-	};
-	const fallbackWindow = options.defaultContextWindow ?? 128e3;
-	const contextWindow = options.contextWindowOverride ?? published.contextWindow ?? fallbackWindow;
-	const maxTokens = resolveOutputBudget(options.defaultMaxTokens ?? 64e3, published.maxTokens, contextWindow);
-	const reasoning = published.reasoning ?? shipped?.reasoning ?? true;
-	const efforts = (Array.isArray(published.efforts) && published.efforts.length > 0 ? published.efforts : void 0) ?? (shipped?.efforts !== void 0 && shipped.efforts.length > 0 ? [...shipped.efforts] : DEFAULT_EFFORTS);
-	const defaultEffort = reasoning && shipped?.defaultEffort !== void 0 && efforts.includes(shipped.defaultEffort) ? shipped.defaultEffort : void 0;
-	const input = (Array.isArray(published.input) && published.input.length > 0 ? published.input : shipped?.input ?? ["text"]).filter((entry) => SEAM_MODALITIES.has(entry));
-	return {
-		id: model,
-		displayName: String(published.name ?? "").trim() || model,
-		contextWindow,
-		maxTokens: maxTokens ?? options.defaultMaxTokens ?? 64e3,
-		reasoning,
-		...reasoning ? { efforts } : { efforts: [] },
-		...defaultEffort === void 0 ? {} : { defaultEffort },
-		input: input.length > 0 ? input : ["text"],
-		...shipped?.pricing === void 0 ? {} : { pricing: shipped.pricing }
-	};
-}
-//#endregion
 //#region src/host/opendesign/client.ts
 /**
 * Transport for the OpenDesign link gateway. Transport only: no account or
@@ -75019,27 +75377,6 @@ var OpenDesignAdapter = class extends LlmAdapter {
 	settings() {
 		return this.modelSettings.read();
 	}
-	/** Every id the line knows: the shipped table plus the synced live catalog. */
-	knownModelIds(settings) {
-		const ids = new Set(DEFAULT_MODELS$1);
-		for (const model of settings.catalogModels) ids.add(model.id);
-		return [...ids];
-	}
-	/**
-	* The ids the route advertises, narrowed by the user's selection and hidden
-	* list.
-	*
-	* The selection is captured against this same id vocabulary (the gateway's
-	* own wire ids), so a cold start filters the shipped table through it without
-	* the empty-intersection trap a foreign-vocabulary whitelist would spring —
-	* and an explicit "everything off" (`[]`) still wins, because that intent
-	* does not depend on a vocabulary at all.
-	*/
-	visibleModelIds(settings) {
-		const hidden = new Set(settings.hiddenModels);
-		const enabled = settings.enabledModelIds === null ? null : new Set(settings.enabledModelIds);
-		return this.knownModelIds(settings).filter((id) => !hidden.has(id) && (enabled === null || enabled.has(id)));
-	}
 	/** One model's resolved descriptor, from the shipped table plus live data. */
 	async modelInfo(modelId) {
 		const settings = await this.settings();
@@ -75054,7 +75391,7 @@ var OpenDesignAdapter = class extends LlmAdapter {
 		const prov = provider || "opendesign";
 		const settings = await this.settings();
 		if (settings.enabled === false) return [];
-		const ids = this.visibleModelIds(settings);
+		const ids = openDesignVisibleModelIds(settings);
 		return await Promise.all(ids.map(async (id) => {
 			const info = await this.modelInfo(id);
 			return {
@@ -75131,28 +75468,33 @@ var OpenDesignAdapter = class extends LlmAdapter {
 			try {
 				let response;
 				let transportError;
-				for (let transportTry = 0; transportTry <= TRANSPORT_RETRIES; transportTry += 1) try {
-					response = await openChatStream$1({
-						fetchFn: this.options.fetchFn,
-						baseURL,
-						apiKey,
-						body,
-						signal: withAttemptTimeout(upstream)
-					});
-					break;
-				} catch (error) {
-					if (signal.aborted) throw new LlmError("OpenDesign request aborted by caller", "ABORTED", { cause: error });
-					transportError = error;
-					if (transportTry < TRANSPORT_RETRIES && isPreConnectionFailure(error)) {
-						try {
-							await setTimeout$1(TRANSPORT_RETRY_BASE_MS * (transportTry + 1), void 0, { signal: upstream });
-						} catch (waitError) {
-							if (signal.aborted) throw new LlmError("OpenDesign request aborted by caller", "ABORTED", { cause: waitError });
-							throw waitError;
+				for (let transportTry = 0; transportTry <= TRANSPORT_RETRIES; transportTry += 1) {
+					const headerDeadline = withAttemptTimeout(upstream, this.options.headerTimeoutMs);
+					try {
+						response = await openChatStream$1({
+							fetchFn: this.options.fetchFn,
+							baseURL,
+							apiKey,
+							body,
+							signal: headerDeadline.signal
+						});
+						headerDeadline.clear();
+						break;
+					} catch (error) {
+						headerDeadline.clear();
+						if (signal.aborted) throw new LlmError("OpenDesign request aborted by caller", "ABORTED", { cause: error });
+						transportError = error;
+						if (transportTry < TRANSPORT_RETRIES && isPreConnectionFailure(error)) {
+							try {
+								await setTimeout$1(TRANSPORT_RETRY_BASE_MS * (transportTry + 1), void 0, { signal: upstream });
+							} catch (waitError) {
+								if (signal.aborted) throw new LlmError("OpenDesign request aborted by caller", "ABORTED", { cause: waitError });
+								throw waitError;
+							}
+							continue;
 						}
-						continue;
+						break;
 					}
-					break;
 				}
 				if (response === void 0) {
 					lastError = new LlmError(`${errorChain$1(transportError)} The request never reached the gateway: ${baseURL} failed during TLS/connect. Check the network or proxy.`, "TRANSPORT", { cause: transportError });
@@ -75220,9 +75562,31 @@ var OpenDesignAdapter = class extends LlmAdapter {
 		await this.accountPool.markCooldown(accountId, POOL_COOLDOWN_MS$1, `${PROVIDER_NAME$2} credits exhausted`).catch(() => void 0);
 	}
 };
-/** A caller signal combined with the attempt's header deadline. */
-function withAttemptTimeout(signal) {
-	return AbortSignal.any([signal, AbortSignal.timeout(ATTEMPT_TIMEOUT_MS)]);
+/**
+* A caller signal combined with the attempt's CLEARABLE header deadline.
+*
+* The clear is not a nicety, it is the difference between a header deadline and
+* a request deadline. `AbortSignal.timeout` is absolute and cannot be disarmed,
+* so attaching one to the fetch signal and leaving it there keeps counting
+* through the whole response body — a model that thinks for more than
+* `ATTEMPT_TIMEOUT_MS` then dies mid-answer with "The operation was aborted due
+* to timeout", is retried by the host, and dies again at the same wall clock.
+* That is exactly what happened here: two attempts streamed reasoning for 155s
+* and 173s and both were cut 180s after their request went out.
+*
+* Cleared after the headers (see the transport loop), at which point the stream
+* idle watchdog owns liveness: it watches for SILENCE and resets on every
+* chunk, so a long thinking pass is fine and a dead socket is still caught.
+*/
+function withAttemptTimeout(signal, timeoutMs = ATTEMPT_TIMEOUT_MS) {
+	const deadline = new AbortController();
+	const timer = setTimeout(() => {
+		deadline.abort(new DOMException("The operation was aborted due to timeout", "TimeoutError"));
+	}, timeoutMs);
+	return {
+		signal: AbortSignal.any([signal, deadline.signal]),
+		clear: () => clearTimeout(timer)
+	};
 }
 /**
 * Whether a transport failure happened before any request was sent.
@@ -75540,6 +75904,15 @@ const OPENDESIGN_ROUTE_PREFIX = "/opendesign/api";
 const OPENDESIGN_CONSOLE_URL = "https://open-design.ai/cloud";
 //#endregion
 //#region src/host/opendesign/routes.ts
+/**
+* Accounts one catalog sync asks at most.
+*
+* Each account costs up to two upstream reads, so this is what stands between a
+* twenty-key pool and forty requests behind one button. It bounds the SCAN, not
+* the pool: an account beyond the cap contributes nothing to the union, because
+* the cap is a hard bound on the measurement rather than a rotating window.
+*/
+const MAX_SYNC_ACCOUNTS = 8;
 function sendJson(response, status, body) {
 	response.writeHead(status, { "content-type": "application/json; charset=utf-8" });
 	response.end(JSON.stringify(body));
@@ -75592,17 +75965,20 @@ function formatModelHint(contextWindow, input, reasoning, efforts, pricing) {
 	const base = formatModelCapacity(contextWindow) + " · " + input.join("+") + (ladder === "" ? "" : " · " + ladder);
 	return pricing === void 0 ? base : `${base} · $${pricing.input}/$${pricing.output}`;
 }
-/** Every id the line knows: the shipped table plus the synced live catalog. */
-function uniqueModels(settings) {
-	const ids = new Set(DEFAULT_MODELS$1);
-	for (const model of settings.catalogModels) ids.add(model.id);
-	return [...ids];
-}
-/** Every model the card should render, whether or not it is advertised. */
+/**
+* Every model the card should render, whether or not it is advertised.
+*
+* `enabled` is the state of the card's checklist row, and it is read from the ONE
+* visibility rule (`openDesignVisibleModelIds` in ./line.ts) — the very function
+* the adapter offers the picker with. A row that reads "checked" while no picker
+* offers it is the contradiction this projection must not be able to produce, so
+* the two are not two calculations: a model the plan withholds reads as unchecked
+* until the user forces it, because that is what the picker does with it.
+*/
 function projectModels(settings) {
-	const known = uniqueModels(settings);
-	const hidden = new Set(settings.hiddenModels);
-	const enabledSet = settings.enabledModelIds === null ? null : new Set(settings.enabledModelIds);
+	const known = openDesignKnownModelIds(settings);
+	const visible = new Set(openDesignVisibleModelIds(settings));
+	const forcedVisible = new Set(settings.forceVisibleModels);
 	return known.map((id) => {
 		const base = resolveModelInfo(id, {
 			synced: settings.catalogModels,
@@ -75615,6 +75991,7 @@ function projectModels(settings) {
 			defaultMaxTokens: settings.defaultMaxTokens,
 			contextWindowOverride: settings.contextWindowOverrides[id]
 		});
+		const served = isModelServed(id, settings.servedModelIds);
 		return {
 			id,
 			name: info.displayName,
@@ -75624,7 +76001,9 @@ function projectModels(settings) {
 			maxTokens: info.maxTokens,
 			reasoning: info.reasoning,
 			input: [...info.input],
-			enabled: (enabledSet === null || enabledSet.has(id)) && !hidden.has(id),
+			enabled: visible.has(id),
+			served,
+			forcedVisible: forcedVisible.has(id),
 			...info.pricing === void 0 ? {} : { pricing: info.pricing },
 			...settings.contextWindowOverrides[id] === void 0 ? {} : { contextWindowOverride: settings.contextWindowOverrides[id] }
 		};
@@ -75717,16 +76096,22 @@ function registerOpenDesignRoutes(ctx, options) {
 	};
 	const status = async () => await getOpenDesignWebStatus(options, usageStore);
 	/**
-	* Sync the live catalog with the first usable account's key.
+	* Sync the live catalog with every usable account's key.
+	*
+	* The gateway's listing is the authority on what a key's plan serves, and a plan
+	* belongs to an ACCOUNT rather than to the line: two pooled keys can serve two
+	* different model sets, so every account is asked and the union is what gets
+	* remembered. That union is persisted as `servedModelIds` — the fact the picker
+	* needs and the one this sync used to throw away — and it is written only when a
+	* scan really succeeded, so a network failure cannot switch the filter off.
 	*
-	* The gateway's listing is the authority on what this key's plan serves; a
-	* failed or refused read changes nothing (the shipped table still stands in),
-	* and the sync's answer says which happened. Announces only a real change:
-	* the picker rebuilds on `llm/adapters-updated`, so a no-change sync must
-	* stay silent.
+	* A failed or refused read changes nothing (the shipped table still stands in),
+	* and the sync's answer says which happened. Announces only a real change: the
+	* picker rebuilds on `llm/adapters-updated`, so a no-change sync must stay
+	* silent.
 	*/
 	const syncCatalog = async () => {
-		const known = uniqueModels(await settingsStore.read());
+		const known = openDesignKnownModelIds(await settingsStore.read());
 		const data = await accountPool.read().catch(() => null);
 		const now = Date.now();
 		const accounts = (data?.accounts ?? []).filter((account) => isUsable(account, now));
@@ -75737,27 +76122,22 @@ function registerOpenDesignRoutes(ctx, options) {
 		};
 		const scans = [];
 		let controlRefused = false;
-		for (const account of accounts) {
+		const settings = await settingsStore.read();
+		for (const account of accounts.slice(0, MAX_SYNC_ACCOUNTS)) {
 			const controlKey = controlKeyFor(account.credentials);
-			if (controlKey === void 0) continue;
-			const scan = await fetchControlPlaneCatalog({
-				fetchFn,
-				controlKey,
-				knownIds: known
-			});
-			if (scan === null) {
-				controlRefused = true;
-				continue;
+			if (controlKey !== void 0) {
+				const scan = await fetchControlPlaneCatalog({
+					fetchFn,
+					controlKey,
+					knownIds: known
+				});
+				if (scan === null) controlRefused = true;
+				else if (scan.ids.length > 0) scans.push(scan);
 			}
-			if (scan.ids.length > 0) scans.push(scan);
-			break;
-		}
-		{
-			const settings = await settingsStore.read();
 			const gateway = await fetchGatewayCatalog$1({
 				fetchFn,
 				baseURL: settings.baseURL,
-				apiKey: bearerFor(accounts[0].credentials)
+				apiKey: bearerFor(account.credentials)
 			});
 			if (gateway !== null && gateway.ids.length > 0) scans.push(gateway);
 		}
@@ -75787,9 +76167,10 @@ function registerOpenDesignRoutes(ctx, options) {
 		const merged = [...existing.values()].filter((entry) => {
 			return !current.catalogModels.some((old) => old.id === entry.id) || syncedIds.has(entry.id);
 		});
+		const served = [...new Set(scans.flatMap((scan) => scan.ids))];
 		const fingerprintBefore = current.catalogModels.map((entry) => entry.id).join("\n");
 		const fingerprintAfter = merged.map((entry) => entry.id).join("\n");
-		await settingsStore.storeCatalog(merged);
+		await settingsStore.storeCatalog(merged, served);
 		if (fingerprintBefore !== fingerprintAfter) emitModelsUpdated();
 		return {
 			added,
@@ -76033,8 +76414,7 @@ function registerOpenDesignRoutes(ctx, options) {
 					const body = await readRequestJson(request).catch(() => ({}));
 					let touched = false;
 					if (body.enabledModelIds === null || Array.isArray(body.enabledModelIds)) {
-						const ids = body.enabledModelIds === null ? null : body.enabledModelIds.filter((id) => typeof id === "string");
-						await settingsStore.update({ enabledModelIds: ids });
+						await settingsStore.selectModels(body.enabledModelIds === null ? null : body.enabledModelIds.filter((id) => typeof id === "string"));
 						touched = true;
 					}
 					if (typeof body.enabled === "boolean") {
@@ -76055,16 +76435,24 @@ function registerOpenDesignRoutes(ctx, options) {
 					});
 					const body = await readRequestJson(request).catch(() => ({}));
 					const current = await settingsStore.read();
-					const known = uniqueModels(current);
+					const known = openDesignKnownModelIds(current);
 					const hidden = new Set(current.hiddenModels);
+					const forced = new Set(current.forceVisibleModels);
 					if (path === "models/visibility") {
 						const model = typeof body.model === "string" ? body.model.trim() : "";
 						if (!known.includes(model)) return sendJson(response, 400, {
 							ok: false,
 							error: `${JSON.stringify(model)} is not one of this route's models`
 						});
-						if (body.visible === false) hidden.add(model);
-						else hidden.delete(model);
+						const served = isModelServed(model, current.servedModelIds);
+						if (body.visible === false) {
+							if (served) hidden.add(model);
+							forced.delete(model);
+						} else {
+							hidden.delete(model);
+							if (served) forced.delete(model);
+							else forced.add(model);
+						}
 					} else {
 						const mode = body.mode;
 						if (mode !== "all" && mode !== "none" && mode !== "invert") return sendJson(response, 400, {
@@ -76077,7 +76465,11 @@ function registerOpenDesignRoutes(ctx, options) {
 						const wasHidden = current.hiddenModels.includes(id);
 						return mode === "all" ? false : mode === "none" ? true : !wasHidden;
 					}) : [...hidden];
-					await settingsStore.update({ hiddenModels: nextHidden });
+					const nextForced = path !== "models/visibility-all" ? [...forced] : body.mode === "invert" ? current.forceVisibleModels : [];
+					await settingsStore.update({
+						hiddenModels: nextHidden,
+						forceVisibleModels: nextForced
+					});
 					emitModelsUpdated();
 					return sendJson(response, 200, {
 						ok: true,
@@ -76285,18 +76677,30 @@ function openDesignKnownModelIds(settings) {
 	return [...ids];
 }
 /**
-* Every id the line advertises right now.
+* Every id the line advertises right now — THE one visibility rule.
+*
+* The adapter (what the picker is offered), the status route (what each checklist
+* row reports as checked) and the hub card (how many models the line advertises)
+* all read this function and nothing else. Three private copies is how the hub
+* card ended up counting models the picker refused to show, which is exactly the
+* contradiction this rule exists to make impossible.
+*
+* Three layers, applied in this order:
 *
-* The selection rule is shared by the adapter, the status route and the hub
-* card — they must all read this one function, not three private copies: the
-* user's tick list and the shipped table speak the same id vocabulary here (the
-* gateway's own wire ids), so a cold-start intersection cannot empty the picker,
-* and an explicit "everything off" (`[]`) still wins.
+* 1. the user's hidden list;
+* 2. the user's tick list — unset means every known model, an explicit `[]` means
+*    everything off (the tick list and the shipped table speak the same wire ids,
+*    so a cold-start intersection cannot empty the picker);
+* 3. the PLAN, once somebody measured it: an id the last successful scan did not
+*    list is not served, and only a forced reveal (`forceVisibleModels`) keeps it.
+*    Before that first scan `servedModelIds` is `null` and this layer hides
+*    nothing — an unmeasured plan is not a denial.
 */
 function openDesignVisibleModelIds(settings) {
 	const hidden = new Set(settings.hiddenModels);
 	const enabled = settings.enabledModelIds === null ? null : new Set(settings.enabledModelIds);
-	return openDesignKnownModelIds(settings).filter((id) => !hidden.has(id) && (enabled === null || enabled.has(id)));
+	const forced = new Set(settings.forceVisibleModels);
+	return openDesignKnownModelIds(settings).filter((id) => !hidden.has(id) && (enabled === null || enabled.has(id)) && (isModelServed(id, settings.servedModelIds) || forced.has(id)));
 }
 /**
 * Build the line.