@iislee/opencodex 2.31.0 → 2.35.0

package/src/providers/command-code-efforts.ts

@@ -9,12 +9,44 @@ const COMMAND_CODE_MODEL_EFFORTS = {
     efforts: ["high", "max"],
     profileUrl: "https://commandcode.ai/models/deepseek-v4-flash",
   },
-  // Ox Alpha (stealth preview, added in Command Code v1.31.0): free 1M-context
-  // reasoning model on every plan. The profile does not publish an effort ladder,
-  // so mirror the OpenRouter contract (reasoning mandatory; max/high/low).
-  "stealth/ox-alpha": {
-    efforts: ["low", "high", "max"],
-    profileUrl: "https://commandcode.ai/models/ox-alpha",
+  /*
+   * Three live routes that reached the catalog without an effort ladder (#2647).
+   * Without a row here the model advertises no efforts at all, so a client that
+   * sends one gets it stripped or rejected rather than honored.
+   *
+   * PROVENANCE, stated plainly: these three ladders are the reporter's
+   * (darwintree, #2647), recorded as reported and NOT independently verified.
+   * All three profileUrls return HTTP 200, but commandcode.ai renders these
+   * pages client-side and ships the ladder inside a serialized React payload
+   * whose `reasoningEfforts` array is EMPTY in the delivered HTML. There is no
+   * fetchable statement of these ladders to check them against.
+   *
+   * Do not assume the refresh path launders this. It does not:
+   * `parsedProfileEfforts` below matches prose of the form
+   * "Reasoning efforts ... are supported;", and `grep -c -i 'reasoning efforts'`
+   * against the live pages returns 0 — for these three AND for the older rows
+   * (deepseek-v4-pro, GLM-5.3, muse-spark-1.2 all measured 0 on 2026-08-27).
+   * So `refreshCommandCodeReasoningEfforts` returns undefined and the caller
+   * keeps whatever is written here, indefinitely. The self-correction mechanism
+   * is currently dead for EVERY row in this table, which is a pre-existing
+   * defect worth its own fix (teach the parser to read the embedded payload),
+   * not something these three rows introduced.
+   *
+   * The practical consequence: a wrong ladder here stays wrong until a human
+   * changes it. It degrades safely — an effort the upstream rejects surfaces as
+   * an error rather than silent corruption — but it does not self-heal.
+   */
+  "deepseek/deepseek-v4-flash-vision-exp": {
+    efforts: ["high", "max"],
+    profileUrl: "https://commandcode.ai/models/deepseek-v4-flash-vision-exp",
+  },
+  "gpt-5.6-luna": {
+    efforts: ["low", "medium", "high", "xhigh", "max"],
+    profileUrl: "https://commandcode.ai/models/gpt-5-6-luna",
+  },
+  "google/gemini-3.7-flash": {
+    efforts: ["low", "medium", "high"],
+    profileUrl: "https://commandcode.ai/models/gemini-3-7-flash",
   },
   // Keys must match the EXACT upstream /provider/v1/models ids (GLM ships as
   // `zai-org/GLM-5.3`, not `zai-org/glm-5.3`). The table doubles as the router's

package/src/providers/context-cap.ts

@@ -1,4 +1,5 @@
 import type { OcxConfig } from "../types";
+import { deleteConfigTopLevelKey } from "../config/rebase-provenance";
 
 export const DEFAULT_PROVIDER_CONTEXT_CAP = 350_000;
 
@@ -50,7 +51,7 @@ export function setProviderContextCap(config: OcxConfig, provider: string, enabl
     delete next[provider];
   }
   if (Object.keys(next).length > 0) config.providerContextCaps = next;
-  else delete config.providerContextCaps;
+  else deleteConfigTopLevelKey(config, "providerContextCaps");
 }
 
 /**
@@ -71,12 +72,12 @@ export function setGlobalContextCapValue(config: OcxConfig, value: number, apply
 /** Enable the cap for every named provider at the current value, or clear all caps. */
 export function setAllProviderContextCaps(config: OcxConfig, providerNames: string[], enabled: boolean): void {
   if (!enabled) {
-    delete config.providerContextCaps;
+    deleteConfigTopLevelKey(config, "providerContextCaps");
     return;
   }
   const value = globalContextCapValue(config);
   const next: Record<string, number> = {};
   for (const name of providerNames) next[name] = value;
   if (Object.keys(next).length > 0) config.providerContextCaps = next;
-  else delete config.providerContextCaps;
+  else deleteConfigTopLevelKey(config, "providerContextCaps");
 }

package/src/providers/default-aliases.ts

@@ -0,0 +1,65 @@
+import type { OcxConfig, OcxProviderConfig } from "../types";
+
+export const MODEL_ALIAS_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+
+/** Ordered, most-specific-first built-in aliases. Updated with the provider registry. */
+export const DEFAULT_MODEL_ALIASES: ReadonlyArray<{ match: RegExp; alias: string }> = [
+  { match: /^claude-opus-5/, alias: "opus" },
+  { match: /^claude-sonnet-5/, alias: "sonnet" },
+  { match: /^claude-haiku/, alias: "haiku" },
+  { match: /^gemini-3(?:\.\d+)?-pro/, alias: "g3p" },
+  { match: /^gemini-3(?:\.\d+)?-flash/, alias: "g3f" },
+  { match: /^deepseek-v4/, alias: "ds4" },
+  { match: /^grok-4/, alias: "grok" },
+];
+
+export interface EffectiveModelAlias { alias: string; source: "user" | "builtin" }
+
+function builtinRule(id: string): { match: RegExp; alias: string } | undefined {
+  const tail = id.slice(id.lastIndexOf("/") + 1);
+  return DEFAULT_MODEL_ALIASES.find(rule => rule.match.test(id) || rule.match.test(tail));
+}
+
+export function defaultAliasesEnabled(config: Pick<OcxConfig, "defaultModelAliases">, provider: OcxProviderConfig): boolean {
+  return provider.defaultAliases ?? config.defaultModelAliases ?? false;
+}
+
+export function effectiveModelAliases(
+  config: Pick<OcxConfig, "defaultModelAliases">,
+  provider: OcxProviderConfig,
+  knownIds: Iterable<string>,
+): Map<string, EffectiveModelAlias> {
+  const result = new Map<string, EffectiveModelAlias>();
+  for (const [id, alias] of Object.entries(provider.modelAliases ?? {})) {
+    if (typeof alias === "string" && MODEL_ALIAS_PATTERN.test(alias)) result.set(id, { alias, source: "user" });
+  }
+  if (!defaultAliasesEnabled(config, provider)) return result;
+  const claims = new Map<string, string[]>();
+  for (const id of knownIds) {
+    if (result.has(id)) continue;
+    const rule = builtinRule(id);
+    if (!rule) continue;
+    const key = rule.alias.toLowerCase();
+    claims.set(key, [...(claims.get(key) ?? []), id]);
+  }
+  for (const [alias, ids] of claims) {
+    if (ids.length !== 1) continue;
+    const id = ids[0]!;
+    // Catalog drift must skip, never shadow, a native id or explicit user alias.
+    if ([...knownIds].some(candidate => candidate.toLowerCase() === alias)) continue;
+    if ([...result.values()].some(value => value.alias.toLowerCase() === alias)) continue;
+    result.set(id, { alias: builtinRule(id)!.alias, source: "builtin" });
+  }
+  return result;
+}
+
+export function resolveModelAlias(
+  config: Pick<OcxConfig, "defaultModelAliases">,
+  provider: OcxProviderConfig,
+  knownIds: Iterable<string>,
+  requested: string,
+): string | undefined {
+  const needle = requested.toLowerCase();
+  return [...effectiveModelAliases(config, provider, knownIds)]
+    .find(([, value]) => value.alias.toLowerCase() === needle)?.[0];
+}

package/src/providers/derive.ts

@@ -390,6 +390,32 @@ function serviceTierModelDefaultsFor(
     : undefined;
 }
 
+/**
+ * Materialize the registry's verbosity opt-out into the provider config at seed/enrich time.
+ *
+ * The catalog hint pass must not read PROVIDER_REGISTRY: a gather flight captures its registry
+ * authority up front and forbids any later read, so consulting the registry per model turned
+ * every hint pass into a post-lookup read and dropped a custom-destination flight's own
+ * discovery result (tests/codex-gather-authority.test.ts).
+ *
+ * Registry values go in first so an explicit user entry still wins, matching
+ * `applyReasoningSummaryDefaults`. `supportsVerbosity` is the provider-wide default, expanded
+ * across the seeded model list so an id discovered later still inherits it through the same
+ * Record the hint pass already reads.
+ */
+function applyVerbosityDefaults(prov: OcxProviderConfig, entry: ProviderRegistryEntry | undefined): void {
+  if (!entry) return;
+  const perModel = entry.modelSupportsVerbosity;
+  if (!perModel && entry.supportsVerbosity === undefined) return;
+  prov.modelSupportsVerbosity = {
+    ...(perModel ?? {}),
+    ...(prov.modelSupportsVerbosity ?? {}),
+  };
+  if (entry.supportsVerbosity !== undefined) {
+    prov.supportsVerbosity ??= entry.supportsVerbosity;
+  }
+}
+
 /**
  * Last-resort enrichment for a provider whose NAME matches no registry id.
  *
@@ -426,6 +452,7 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
     // destinations, so a templated or overridable base URL cannot be claimed by it.
     enrichReasoningSummariesByDestination(prov);
     applyServiceTierModelDefaults(prov, serviceTierModelDefaultsFor(registryEntryForProviderDestination(prov), prov));
+    applyVerbosityDefaults(prov, registryEntryForProviderDestination(prov));
     return;
   }
   const explicitDirectReasoning: DirectReasoningEffortOverrides = {
@@ -489,6 +516,7 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
   if (prov.preserveResponsesReasoningContent === undefined && entry.preserveResponsesReasoningContent !== undefined) prov.preserveResponsesReasoningContent = entry.preserveResponsesReasoningContent;
   applyReasoningSummaryDefaults(prov, entry.modelSupportsReasoningSummaries);
   applyServiceTierModelDefaults(prov, serviceTierModelDefaultsFor(entry, prov));
+  applyVerbosityDefaults(prov, entry);
   // Registry-only repair policy (#938): fill only when the runtime provider has
   // no explicit policy, and deep-clone so saved/user values never alias the
   // registry constant.

package/src/providers/fastwire.ts

@@ -246,6 +246,7 @@ export function tierObservationContext(
   policy: ResolvedFastPolicy,
   fastMode: boolean | undefined,
   callerTier: string | undefined,
+  responseTierAuthoritative?: boolean,
 ): TierObservationContext {
   return {
     capability: policy.capability,
@@ -253,6 +254,7 @@ export function tierObservationContext(
     fastWire: policy.fastWire,
     demandDecision: fastMode === true ? "force-fast" : fastMode === false ? "force-default" : "inherit",
     ...(callerTier !== undefined ? { callerTier } : {}),
+    ...(responseTierAuthoritative !== undefined ? { responseTierAuthoritative } : {}),
   };
 }
 
@@ -344,7 +346,11 @@ export function createAdapterTierMetadata(
 
   const responseCanConfirmFast = effectiveFastRequested
     && context.eligibility === "eligible"
-    && wireValue !== null;
+    && wireValue !== null
+    // A destination whose echo is not authoritative can neither confirm nor deny Fast. The
+    // ChatGPT-internal Codex backend echoes "default" on priority-scheduled turns, so believing
+    // it reported every Fast request as `response-declined` (#2558).
+    && context.responseTierAuthoritative !== false;
   return {
     outcome,
     observeResponseServiceTier(value: unknown) {

package/src/providers/label.ts

@@ -1,4 +1,5 @@
-import { CODEX_ACCOUNT_LOG_LABEL_RE } from "../codex/account-label";
+import { CODEX_ACCOUNT_LOG_LABEL_RE, oauthAccountLogLabel } from "../codex/account-label";
+import type { OcxProviderConfig } from "../types";
 
 export function canonicalUsageProviderLabel(provider: string): string {
   return provider === "chatgpt" || provider === "openai-multi" ? "openai" : provider;
@@ -17,3 +18,35 @@ export function baseProviderLabel(provider: string): string {
   if (suffix === "main") return canonicalUsageProviderLabel(provider.slice(0, cut));
   return CODEX_ACCOUNT_LOG_LABEL_RE.test(suffix) ? canonicalUsageProviderLabel(provider.slice(0, cut)) : provider;
 }
+
+/**
+ * Stamp the per-account usage label for a non-Codex OAuth provider (#2699).
+ *
+ * Call this where the resolved credential is known and NOT inside a failover gate. The obvious
+ * place -- next to the `genericFailoverAccountId` assignment in `core.ts` -- sits inside
+ * `isGenericFailoverProvider`, and the rotation paths additionally require two or more stored
+ * accounts. Stamping there would leave the ordinary case (one xai account, failover off) with no
+ * label at all while every test still passed, which is the bug this fixes rather than a variant
+ * of it.
+ *
+ * Two providers are skipped because they already have attribution:
+ * - `openai` produces its own `p`-labels through `codexAuthContextLogLabel`.
+ * - `anthropic` folds the account into the provider label (`formatAnthropicProviderForLog`).
+ *
+ * It lives here rather than in `account-label.ts` because it needs `baseProviderLabel`, and this
+ * module already imports from that one -- the reverse direction would be an import cycle. This
+ * file stays Lab-clean, which matters because `core.ts` is one of the three files
+ * `tests/core-lab-boundary.test.ts` guards.
+ */
+export function stampOAuthAccountLabel(
+  logCtx: { accountLogLabel?: string },
+  providerName: string,
+  provider: Pick<OcxProviderConfig, "authMode">,
+  accountId: string | undefined,
+): void {
+  if (!accountId) return;
+  if (provider.authMode !== "oauth") return;
+  const base = baseProviderLabel(providerName);
+  if (base === "openai" || base === "anthropic") return;
+  logCtx.accountLogLabel = oauthAccountLogLabel(accountId, base);
+}

package/src/providers/model-presets.ts

@@ -0,0 +1,119 @@
+/**
+ * Shipped per-provider "latest/core" model presets (#2465).
+ *
+ * Adding a high-volume provider exposes its entire catalog to the Codex picker on day one:
+ * openrouter ships 400+ rows, an Anthropic provider ships every historical snapshot. The useful
+ * set is a handful of current flagships, so a newly added provider seeds from a curated preset
+ * and "everything" stays one click away.
+ *
+ * Rules are ID PATTERNS rather than literal id lists so a vendor snapshot suffix does not stale
+ * the preset between releases: `claude-opus-5-20260814` and `claude-opus-5` both match one rule.
+ *
+ * The preset is a SEED, not a lock. Materialization evaluates these rules against the provider's
+ * current catalog and stores CONCRETE ids in `selectedModels`, so the visibility hot path
+ * (`filterCatalogVisibleModels`) never learns about patterns and an older binary still sees a
+ * plain allowlist. Design: devlog/_plan/260824_model_ux_aliases_and_defaults/030_default_preset.md
+ */
+
+import type { OcxProviderConfig } from "../types";
+
+export interface ModelPresetRule {
+  readonly pattern: RegExp;
+}
+
+export interface ModelPreset {
+  /** Bumped whenever this provider's rules change; drives upgrade reconciliation. */
+  readonly version: number;
+  readonly rules: readonly ModelPresetRule[];
+}
+
+/**
+ * Curated on the same release train as the provider registry. A provider WITHOUT an entry has no
+ * preset and behaves exactly as today (mode "all").
+ *
+ * Deliberately limited to high-volume catalogs. A provider that already ships a short curated
+ * list gains nothing from a preset and would only add a marker to reconcile.
+ */
+export const MODEL_PRESETS: Readonly<Record<string, ModelPreset>> = Object.freeze({
+  openrouter: {
+    version: 1,
+    rules: [
+      { pattern: /^anthropic\/claude-(opus|sonnet|haiku)-[45]/ },
+      { pattern: /^google\/gemini-3(\.\d+)?-(pro|flash)/ },
+      { pattern: /^openai\/gpt-5(\.\d+)?/ },
+      { pattern: /^deepseek\/deepseek-(v4|r2)/ },
+      { pattern: /^x-ai\/grok-4(\.\d+)?/ },
+      { pattern: /^moonshotai\/kimi-k[23]/ },
+      { pattern: /^z-ai\/glm-[45]/ },
+    ],
+  },
+  anthropic: {
+    version: 1,
+    rules: [
+      { pattern: /^claude-opus-[45]/ },
+      { pattern: /^claude-sonnet-[45]/ },
+      { pattern: /^claude-haiku-[45]/ },
+      { pattern: /^claude-fable-5/ },
+    ],
+  },
+  "anthropic-apikey": {
+    version: 1,
+    rules: [
+      { pattern: /^claude-opus-[45]/ },
+      { pattern: /^claude-sonnet-[45]/ },
+      { pattern: /^claude-haiku-[45]/ },
+      { pattern: /^claude-fable-5/ },
+    ],
+  },
+});
+
+/** The preset for a provider, or undefined when none is shipped. */
+export function modelPresetFor(providerName: string): ModelPreset | undefined {
+  return MODEL_PRESETS[providerName];
+}
+
+/** True when a provider has a shipped preset at all. */
+export function hasModelPreset(providerName: string): boolean {
+  return modelPresetFor(providerName) !== undefined;
+}
+
+/**
+ * Evaluate a provider's rules against concrete catalog ids.
+ *
+ * Input order is preserved so a caller can show the preset in the same order the picker does.
+ * Duplicates are collapsed; a model matching several rules is selected once.
+ */
+export function materializeModelPreset(
+  providerName: string,
+  catalogModelIds: Iterable<string>,
+): string[] {
+  const preset = modelPresetFor(providerName);
+  if (!preset) return [];
+  const seen = new Set<string>();
+  const out: string[] = [];
+  for (const id of catalogModelIds) {
+    if (seen.has(id)) continue;
+    // `RegExp.test` on a shared literal is safe here because no rule uses the `g` flag; a
+    // sticky/global pattern would carry lastIndex between calls and skip rows.
+    if (preset.rules.some(rule => rule.pattern.test(id))) {
+      seen.add(id);
+      out.push(id);
+    }
+  }
+  return out;
+}
+
+
+/**
+ * Flip a provider out of preset mode when the user edits its selection (#2465).
+ *
+ * No-op unless the provider is currently in preset mode: "all" has no marker to keep, and
+ * "custom" is already terminal. The applied version is retained so the GUI can still offer
+ * "a newer preset is available" without losing what the user chose.
+ */
+export function markModelPresetDiverged(provider: OcxProviderConfig): void {
+  const marker = provider.modelPreset;
+  if (marker?.mode !== "preset") return;
+  provider.modelPreset = { ...marker, mode: "custom" };
+}
+

package/src/providers/new-model-policy.ts

@@ -0,0 +1,146 @@
+import type { OcxConfig } from "../types";
+import { routedSlug } from "./slug-codec";
+
+export const MODEL_REMOVAL_GRACE_FETCHES = 3;
+export const MAX_KNOWN_MODELS_PER_PROVIDER = 2_000;
+export const MAX_RECENT_ARRIVALS_PER_PROVIDER = 50;
+
+export type KnownModelBaseline = NonNullable<NonNullable<OcxConfig["modelDiscovery"]>["knownModels"]>[string];
+export type NewModelPolicy = "on" | "off";
+
+export interface NewModelPolicyResult {
+  newIds: string[];
+  nextBaseline: KnownModelBaseline;
+  slugsToDisable: string[];
+  arrivals: Array<{ id: string; at: string }>;
+  overflow: boolean;
+}
+
+/**
+ * Whether a transition actually changes persisted state.
+ *
+ * `updatedAt` moves on every successful fetch, so comparing whole baselines would report a
+ * change every time and rewrite config.json on every catalog convergence — a write amplification
+ * that also churns the config generation other writers revalidate against. Only the fields that
+ * carry meaning are compared.
+ */
+function baselineDiffers(prior: KnownModelBaseline | undefined, next: KnownModelBaseline): boolean {
+  if (!prior) return true;
+  const sameList = (a: readonly string[], b: readonly string[]) =>
+    a.length === b.length && a.every((value, index) => value === b[index]);
+  if (!sameList(prior.ids, next.ids) || !sameList(prior.removed, next.removed)) return true;
+  const priorMissing = prior.missing ?? {};
+  const nextMissing = next.missing ?? {};
+  const keys = new Set([...Object.keys(priorMissing), ...Object.keys(nextMissing)]);
+  for (const key of keys) if (priorMissing[key] !== nextMissing[key]) return true;
+  return false;
+}
+
+/** Pure successful-discovery transition. An absent baseline bootstraps without hiding anything. */
+export function applyNewModelPolicy(options: {
+  provider: string;
+  discoveredIds: Iterable<string>;
+  baseline?: KnownModelBaseline;
+  policy: NewModelPolicy;
+  hasSelectedModels?: boolean;
+  now: string;
+}): NewModelPolicyResult {
+  const discovered = [...new Set(options.discoveredIds)].sort();
+  const prior = options.baseline;
+  if (!prior) {
+    return {
+      newIds: [],
+      nextBaseline: { ids: discovered, removed: [], updatedAt: options.now },
+      slugsToDisable: [], arrivals: [],
+      overflow: discovered.length > MAX_KNOWN_MODELS_PER_PROVIDER,
+    };
+  }
+  const active = new Set(prior.ids);
+  const removed = new Set(prior.removed);
+  const seen = new Set(discovered);
+  const newIds = discovered.filter(id => !active.has(id) && !removed.has(id));
+  const missing: Record<string, number> = {};
+  for (const id of active) {
+    if (seen.has(id)) continue;
+    const count = (prior.missing?.[id] ?? 0) + 1;
+    if (count >= MODEL_REMOVAL_GRACE_FETCHES) {
+      active.delete(id);
+      removed.add(id);
+    } else missing[id] = count;
+  }
+  for (const id of discovered) active.add(id);
+  const unionSize = active.size + removed.size;
+  const overflow = unionSize > MAX_KNOWN_MODELS_PER_PROVIDER;
+  const arrivals = newIds.map(id => ({ id, at: options.now }));
+  return {
+    newIds,
+    nextBaseline: {
+      ids: [...active].sort(), removed: [...removed].sort(), updatedAt: options.now,
+      ...(Object.keys(missing).length ? { missing } : {}),
+    },
+    // A non-empty preset/custom allowlist already excludes arrivals. This explicit no-op is
+    // deliberate: preset mode owns which matching flagships arrive on.
+    slugsToDisable: !overflow && options.policy === "off" && !options.hasSelectedModels
+      ? newIds.map(id => routedSlug(options.provider, id)) : [],
+    arrivals,
+    overflow,
+  };
+}
+
+export function effectiveNewModelPolicy(config: OcxConfig, provider: string): NewModelPolicy {
+  const local = config.providers[provider]?.newModelPolicy;
+  if (local === "on" || local === "off") return local;
+  return config.modelDiscovery?.newModelPolicy ?? "on";
+}
+
+/** Apply authoritative provider rows to a mutable convergence copy; degraded providers are omitted. */
+export function reconcileSuccessfulModelDiscoveries(options: {
+  config: OcxConfig;
+  models: Iterable<{ provider: string; id: string; custom?: boolean }>;
+  authoritativeProviders: Iterable<string>;
+  now: string;
+}): boolean {
+  const byProvider = new Map<string, string[]>();
+  for (const model of options.models) {
+    if (model.custom) continue;
+    const ids = byProvider.get(model.provider) ?? [];
+    ids.push(model.id); byProvider.set(model.provider, ids);
+  }
+  let changed = false;
+  for (const provider of options.authoritativeProviders) {
+    const configured = options.config.providers[provider];
+    if (!configured || configured.liveModels === false) continue;
+    const discoveredIds = byProvider.get(provider) ?? [];
+    const discovery = options.config.modelDiscovery ??= {};
+    const known = discovery.knownModels ??= {};
+    const result = applyNewModelPolicy({
+      provider, discoveredIds, baseline: known[provider],
+      policy: effectiveNewModelPolicy(options.config, provider),
+      hasSelectedModels: (configured.selectedModels?.length ?? 0) > 0,
+      now: options.now,
+    });
+    if (result.overflow) continue;
+    const priorBaseline = known[provider];
+    const baselineChanged = baselineDiffers(priorBaseline, result.nextBaseline);
+    known[provider] = result.nextBaseline;
+    // Keep the previous timestamp when nothing else moved, so a steady-state roster does not
+    // make the baseline look dirty on the next comparison either.
+    if (!baselineChanged && priorBaseline) known[provider] = priorBaseline;
+    if (result.slugsToDisable.length) {
+      const disabled = options.config.disabledModels ??= [];
+      for (const slug of result.slugsToDisable) {
+        if (disabled.includes(slug)) continue;
+        disabled.push(slug);
+        changed = true;
+      }
+    }
+    if (result.arrivals.length) {
+      const recent = discovery.recentArrivals ??= {};
+      recent[provider] = [...(recent[provider] ?? []), ...result.arrivals]
+        .slice(-MAX_RECENT_ARRIVALS_PER_PROVIDER);
+      changed = true;
+    }
+    if (baselineChanged) changed = true;
+  }
+  return changed;
+}

package/src/providers/provider-id-rewrite.ts

@@ -1,4 +1,5 @@
 import type { OcxConfig } from "../types";
+import { deleteConfigTopLevelKey } from "../config/rebase-provenance";
 
 export interface ProviderRewriteResult {
   /** Number of references re-pointed. */
@@ -174,6 +175,6 @@ export function dropProviderCustomModels(config: OcxConfig, provider: string): n
   // `[]`, so the `customModels` field is absent either way. Only that field —
   // the `customModelCatalogMigration` marker is deliberately left in place.
   if (kept.length > 0) config.customModels = kept;
-  else delete config.customModels;
+  else deleteConfigTopLevelKey(config, "customModels");
   return existing.length - kept.length;
 }