@linxiraos/pi-catalog 1.2.0 → 1.3.0

package/src/compat/rules/README.md

@@ -196,6 +196,8 @@ An `on-api` nested inside `on` under a class requires both the selected provider
 
 A `models` string without `*` is an exact, case-sensitive match against the provider-relative model identifier. A string containing `*` is an anchored, ASCII-case-insensitive wildcard match. Prefer taxonomy ranks; retain exact/glob lists only when they isolate the census member set exactly, and keep a `// residue:` comment explaining why ranks do not.
 
+A row whose own id classifies as `unknown` but whose `requestModelId` does not resolves under the wire id: classification and `models` matching both use it, so the model the row sends gets its own rules. Devin Fusion pairings (`fusion-<lead>-sidekick-*`) resolve as their lead this way.
+
 `priority=N` is an optional signed integer property on the block that owns axis assignments. Its default is zero. Use it only to resolve an intentional equal-specificity overlap; do not use it to encode declaration order.
 
 `buildDiscoveredModel(spec, providerType)` resolves the catalog `discovery-api` axis before materializing compatibility. It preserves the credential-bearing provider ID and records `providerType` as the backend used for provider selectors on subsequent rebuilds. Ordinary `buildModel` preserves its input API. This lets custom-named llama.cpp deployments reuse the same rules without model-specific discovery code.
@@ -213,16 +215,36 @@ The three value shapes are:
 - **Object**: no arguments and a child block, including an empty block. Child names are kebab-case: an axis-directive spelling compiles to its resolved axis key (`template-reasoning-effort` → `qwenTemplateReasoningEffort`), anything else converts mechanically (`input-threshold` → `inputThreshold`); camelCase names are a compile error. `extra-body` payloads (top-level or nested) are the exception — their child names are literal wire JSON keys copied verbatim (`enable_thinking`). Each child is either one scalar or another object; arrays are not representable inside an object payload.
 
 A rule cannot assign the same resolved axis twice in one block.
-One object axis carries a computed form: `long-context-cost` accepts either the absolute rates (`input-threshold` + `input`/`output`/`cache-read`/`cache-write`) or `input-threshold` + `multiplier` (with optional `input-threshold-inclusive`), which derives the tier from the row's base price at build time, after `cost-patch` and `cost-fallback`, so the rule tracks upstream list-price updates (xAI's SuperGrok 200K tier). Rows without a token price carry no tier. An empty `long-context-cost {}` adds no tier; a more specific rule uses it to opt a host out of a broader rule's band (GitHub Copilot's Haiku 5.5 rows, whose long tier is the `-1m` sibling).
+One object axis carries a computed form: `long-context-cost` accepts either the absolute rates (`input-threshold` + `input`/`output`/`cache-read`/`cache-write`) or `input-threshold` + `multiplier` (with optional `input-threshold-inclusive`, and `output-multiplier` when the tier raises output by a different factor than the other legs), which derives the tier from the row's base price at build time, after `cost-patch` and `cost-fallback`, so the rule tracks upstream list-price updates (xAI's SuperGrok 200K tier). Rows without a token price carry no tier. An empty `long-context-cost {}` adds no tier; a more specific rule uses it to opt a host out of a broader rule's band (GitHub Copilot's Haiku 5.5 rows, whose long tier is the `-1m` sibling).
+
+`cost-patch` and `cost-fallback` accept an optional `effective-rates` block of named dated cards, each with a distinct ISO UTC `effective-from` (`YYYY-MM-DDTHH:mm:ssZ` or with three fractional-second digits) and any of `input`/`output`/`cache-read`/`cache-write` as nonnegative rates; a malformed card fails `buildModel` rather than leaving the old price in force. A card overwrites those legs from its date: for `cost-patch` over whatever upstream reports, for `cost-fallback` only when it seeded the row. A patch may carry the dated cards alone, leaving the upstream price in place until the first one starts; pin the current price beside them when upstream may later report the new one, or a row built after that loses the earlier period (Gemini 4 Argon's 2026-12-01 list-price increase in [`classes/gemini.kdl`](classes/gemini.kdl) pins both). `buildModel` sets the row's legs to the card due when it is built, and compiles every price period into `ModelCost.timeBased.effectiveRates` (complete cards, long-context tier and cache-rate derivations included, with a leading card for the price before the first change) under a schedule with no peak windows and a 1x off-peak multiplier. Requests are therefore priced at the card in force when they were made, even on rows built before a change (bundles, caches, long sessions); price displays read `getEffectiveTokenCost`, which selects the same card, and such a schedule reports no peak/off-peak period. Rebuilding a row that already carries such a schedule (dynamic merges, overrides) starts from the card due at the rebuild, and Cursor lanes priced from a sibling slug's card keep that card's schedule, scaled by the lane's multiplier. Cards that leave the price unchanged (a fallback the upstream price outranks) add no schedule. A rule cannot combine these cards with `time-based-cost` `effective-rates`; it may add them to a recurring `time-based-cost` tariff without its own.
 
 `context-window-authoritative #true` preserves a host's supplied context window through runtime model selection instead of applying inferred expansion or reference-price-tier caps. Explicit user context overrides still apply afterward. It applies to rows materialized through `buildModel` (discovery and regenerated bundles). See [`providers/factory-droid.kdl`](providers/factory-droid.kdl).
 
-`inline-image-byte-budget` caps retained base64 image characters for a deployment's request body. It leaves room for tool schemas and text beneath the provider's body-size limit; the coding agent reads it through `resolveInlineImageByteBudget` before sending live history. The budget applies only while `compat.officialEndpoint` holds: a custom `baseUrl` imposes its own body limit.
+`long-context-window-uncapped #true` keeps a model's `long-context-cost` tier from capping its runtime context window while extended context is off: the coding agent normally lowers the window to the tier's input threshold so compaction fires before a request crosses into premium pricing. Use it where the tier is an API-equivalent estimate on a subscription host (`xai-oauth`) or where the model is served at its full window regardless (GPT-5.4, except on GitHub Copilot). `buildModel` materializes it as `Model.longContextWindowUncapped`; explicit user context overrides still apply.
+
+`max-tokens-fallback` seeds `maxTokens` only when the row reports none, and `max-tokens-ceiling` lowers a larger reported `maxTokens` to the host's output cap (an unknown budget stays unknown unless a fallback seeded it). Both apply in `buildModel` after `limits-patch`, so discovery mappers pass upstream output budgets through verbatim. See the Kimi rules in [`providers/fireworks.kdl`](providers/fireworks.kdl).
+
+`inline-image-byte-budget` caps retained base64 image characters for a deployment's request body. It leaves room for tool schemas and text beneath the provider's body-size limit; the coding agent reads it through `resolveInlineImageByteBudget` before sending live history, and snapcompact gives its archive frames half of it (`frameDataBytesBudget`). The budget applies only while the request reaches the official endpoint (the Anthropic API, first-party OpenAI, or the Codex backend at its default URL), which callers decide with pi-ai's `reachesOfficialEndpoint`: `compat.officialEndpoint` for the configured `baseUrl`, and for first-party Anthropic models also the `ANTHROPIC_BASE_URL` or Foundry `FOUNDRY_BASE_URL` reroute applied at request time. A custom or rerouted endpoint imposes its own body limit.
+
+`image-count-budget` is the most images one request may carry, archive frames, screenshots and imaged tool results combined. The coding agent reads it through `resolveImageCountBudget`, drops the oldest images past it, and caps snapcompact frames at it; unassigned hosts get a floor of 5. `official-image-count-budget` replaces it while the request reaches the official endpoint (same gate as `inline-image-byte-budget`), for limits established on the host's own endpoint (Anthropic: 600, 100 on 200k-window models; Codex: 2,000); a custom or rerouted endpoint keeps `image-count-budget` (Anthropic 90, Codex 200).
+
+`endpoint-hosts` lists the HTTPS hostnames a provider serves besides its bundled base URL's host, such as Copilot's per-plan `api.<plan>.githubcopilot.com` hosts. That host plus these define the provider's own endpoint (`isCatalogEndpointUrl`), which separates first-party traffic from a custom model or provider override that keeps a catalog provider id but points `baseUrl` at a gateway, proxy, or local server. Connection prewarming and request compression act only on the provider's own endpoint.
+
+`request-encodings` lists the `Content-Encoding`s (`zstd`, `gzip`) a provider's own endpoint decodes on request bodies, most preferred first; pi-ai's `wrapFetchForRequestCompression` reads them through `resolveRequestCompression` and compresses bodies of 1 KiB or more. A proxy, relay, or `ANTHROPIC_BASE_URL` reroute never receives bytes it cannot read. `request-encoding-rejection` is a regular expression for the JSON 400/415 error body the host returns when it cannot decode the body; unassigned, every JSON 400/415 is re-checked with an uncompressed resend. A 400/403/415 whose body is not JSON (empty included) is presumed to come from a proxy in front of the host, such as a TLS-inspecting gateway that refuses compressed uploads, and is re-checked either way, until the uncompressed resend draws the same status from that host. A rejected encoding is dropped for that host only after the uncompressed resend succeeds. Assign them only from a live probe of every endpoint host: a compressed body, the same plain JSON mislabeled as compressed (a decoding host must reject it), and a real request.
 
 `judgment-questions-max` is the most questions one System One judgment request may carry (razorback16/openjev: 256; Cloudflare Clef on Workers AI and through OpenRouter Decisions: 64; unidentified `*openjev*` deployments: 16). The coding agent reads it through `resolveJudgmentQuestionsMax` and `NativeJudge` splits larger requests into parallel chunks; unassigned means the endpoint takes any batch size. [`providers/judgment-questions.kdl`](providers/judgment-questions.kdl) lists the servers verified uncapped or not isolatable.
 
+`judgment-image-input` assigns model-specific native judgment image bounds, read through `resolveJudgmentImageInput`. Its object accepts `mime-types` as a comma-separated lowercase MIME list and positive integer `max-count`, `max-bytes`, `max-total-bytes`, `min-pixels`, `max-pixels`, `min-side`, and `max-side`; byte limits count decoded data. `NativeJudge` enforces these alongside its wire's encoding constraints without resizing, and candidate filtering skips models whose bounds reject the images. Unassigned adds no model-specific bounds. The Jev selectors in [`providers/typesafe.kdl`](providers/typesafe.kdl) and [`providers/openrouter.kdl`](providers/openrouter.kdl) own Jev's limits rather than imposing them on every model using those APIs.
+
 `prompt-cache-lookback` is how many block positions back from a cache breakpoint the model's prompt cache looks for an earlier request's entry (Claude: 20, counting the breakpoint; a run of consecutive `tool_use` or `tool_result` blocks is one position). The coding agent reads it through `resolvePromptCacheLookback` and keeps warm-cache tool-result pruning inside the window; unassigned means no known bound.
 
+`task-sibling-prompt-cache #true` lets Task children use an automatically derived sibling cache key on the matching request model. Missing or `#false` keeps the provider's per-child default; explicit cache keys still win. The session resolves this catalog policy against the actual model for primary turns, handoff, and ephemeral requests that reuse the live context, including model changes, without sharing conversation IDs or response state. The automatic candidate is persisted separately from explicit keys and survives full forks, `/tan`, and session reopening; new and partial sessions discard it. A fork carrying an automatic candidate uses its own conversation ID on unsupported models, and re-enables the candidate when returning to an eligible model. Ordinary forks without an automatic candidate keep their existing inherited cache routing. Conventional compaction keeps its existing cache routing because its serialized summary prompt differs from the primary context. The opt-in covers Muse Code's `muse-spark-1.3`, `muse-spark-1.3-contributor`, `muse-wonder-1.0`, `muse-wonder-1.0-contributor`, `muse-wonder-full-1.0`, and `muse-wonder-full-1.0-contributor` over `openai-responses`. Meta documents shared-prefix `prompt_cache_key` routing for Responses. Warmed sibling cache reuse was measured on Spark 1.3 Contributor; the standard Spark variant shares this scope following maintainer guidance. A bounded synthetic probe observed cache reuse on all four Wonder variants; it does not establish production or latency benefits. Auxiliary-request latency has not been measured. Provider selectors also match custom providers that declare the same `providerType`; no benefit is established for custom endpoints.
+
+`image-max-edge` is the longest image edge, in pixels, a host passes to the model; it downscales larger images to fit first (Cursor: 1024 for Claude and GPT). Snapcompact reads it through `resolveImageMaxEdge` and renders frames no wider, so their glyphs reach the model at the size they were drawn; unassigned means the host keeps the image's size.
+
+`snapcompact-image-reads #true` opts a reader in to getting a fresh `read` result as snapcompact frames when `snapcompact.toolResults` is on. Frames collapse whitespace, so snapcompact draws each row's leading indentation as a count bracket (`[»2]`, `[·4]`) and keeps the `[path#TAG]` header as text beside them. On 3–4 frame reads Opus 5.5 then made exact first edits from frames within one of text (38 vs 39 of 40), so Opus 5.5+ opts in ([`classes/anthropic.kdl`](classes/anthropic.kdl)); Sonnet 5.5 (37 vs 40) and Haiku 5.5 (35 vs 40) still miscounted deep tab indents. Unassigned: `read` results stay text; other tools' results are imaged either way.
+
 The routed-subscription registry axes (`upstream-rotation`, `region-upstreams-global|us|eu`, `region-limits-eu`, `credit-rates`, `list-price-from`, `routing-family`, `policy-aliases`, `entitlement`, `default-reasoning-off`) describe a gateway whose proxy fans one model out to several upstreams. They are read through `src/compat/factory-droid.ts` by Factory Droid discovery and its request provider, not materialized by `buildModel`. A provider-wide `region-upstreams-*` rule is the upstream serving table and a model rule replaces it for that region. `list-price-from "<provider>" ["<id>"]` shows a bundled row's list price beside the subscription's own billing; unlike seed values it is resolved at runtime and degrades to the seed's zero cost when the row is gone. See [`providers/factory-droid.kdl`](providers/factory-droid.kdl), whose wire and billing pool per model are `api-routes` and `quota-tiers` rules in `runtime/behavior.kdl`.
 
 ### Time-based pricing
@@ -280,7 +302,7 @@ The highest-ranked matching assignment wins for that axis. Two distinct rules th
 
 ### Capability gating
 
-Wire axes are considered for every matching target. Thinking axes require `reasoning`, except that an exact model selector declaring `thinking-efforts` opens the gate for reviewed corrections. A winning `thinking-upgrade-neutral #true` scoped to a recognized class, family, revision, or model selector also opens it when a matching effort ladder exists; provider-wide opt-in alone does not. Materializing a neutral spec as reasoning-capable requires that opt-in and no explicit thinking vocabulary. Family and revision selectors never match targets missing that rank. An unmatched target resolves to empty maps; the cascade does not infer negative capabilities from absence.
+Wire axes are considered for every matching target. Thinking axes require `reasoning`, except that an exact model selector declaring `thinking-efforts` opens the gate for reviewed corrections. A winning `thinking-upgrade-neutral #true` scoped to a recognized class, family, revision, or model selector also opens it when a matching effort ladder exists; provider-wide opt-in alone does not. Materializing a neutral spec as reasoning-capable requires that opt-in and no explicit thinking vocabulary. A winning `thinking-unverified #true` (scoped `class "unknown"` on hosts whose model list carries no capability metadata) instead offers an unclassified neutral spec its ladder as `ThinkingConfig.unverified`: off until the user picks an effort, and sent as non-reasoning without one; it never changes compat. Family and revision selectors never match targets missing that rank. An unmatched target resolves to empty maps; the cascade does not infer negative capabilities from absence.
 
 ## Runtime behavior grammar
 
@@ -313,11 +335,17 @@ behavior {
     pricing-peer provider="google-antigravity" peers="google" "google-vertex" {
         alias "gemini-3-pro" peer-id="gemini-3-pro-preview"
     }
+    role-defaults "smol" {
+        model "claude-haiku-5-5"
+        model "openai-codex/gpt-5.3-codex-spark"
+    }
 }
 ```
 
 `exclude-discovery-modes` takes one or more exact, case-sensitive upstream mode strings plus `provider=`; discovery mappers preserve missing, malformed, and unknown modes unless the provider policy explicitly lists them. Matcher properties on `route` / `exclude-models` / `tier` nodes are `exact=` / `prefix=` / `substring=` / `glob=`, repeatable. `strip-prefix=#true` on a prefix route strips the matched prefix off the wire id. Values are copied verbatim from the TS constants they replaced; runtime accessors live in `src/compat/behavior.ts`.
 
+`role-defaults "<role>"` declares one agent role's built-in default model selector chain, one `model "<selector>"` child per entry, most preferred first. Selectors are copied verbatim (`provider/id`, bare ids, fuzzy fragments such as `-mini`, and `@role` references); duplicates within a role and repeated roles are compile errors. `roleDefaultModels()` returns every chain keyed by role in declaration order.
+
 ## Auth grammar
 
 Every provider has exactly one `auth "<id>" { … }` node under `auth/`; `auth/_order.kdl` holds a single `login-order "id" …` node pinning the `/login` roster order (every provider with a `login` and `show-in-login-list` unset/true must appear; providers without a login sort alphabetically after it). Runtime accessors live in `src/compat/auth.ts`; the id unions in the generated `src/compat/auth-ids.ts`. Every provider in `provider-models/descriptors.ts` needs an auth node (`@linxiraos/pi-ai` type-checks this).
@@ -446,6 +474,7 @@ provider "sakana" {
     dynamic-models-authoritative #true            // discovery replaces bundled rows
     allow-unauthenticated #true                   // runtime manager without a key
     skip-cross-provider-reference-fills #true     // generator never backfills from same-id rows elsewhere
+    keep-bundled-names #true                      // discovery never renames a bundled row
     discovery label="Sakana AI" oauth-provider="sakana" allow-unauthenticated=#true {
         env "SAKANA_GEN_KEY"                      // generation-time keys; defaults to the provider env
     }

package/src/compat/rules/auth/_order.kdl

@@ -4,7 +4,7 @@
 login-order "openai-codex" "anthropic" "zai" "zai-coding-plan" "kimi-code" "openrouter" "github-copilot" \
 	"cursor" "devin" "google-antigravity" "google-gemini-cli" "openai-codex-device" "xai" "xai-oauth" \
 	"gitlab-duo" "gitlab-duo-agent" "alibaba-coding-plan" "alibaba-token-plan" "aiand" "abliteration" "zhipu-coding-plan" \
-	"umans" "qwen-portal" "sakana" "minimax-code" "minimax-code-cn" "xiaomi" "xiaomi-token-plan-sgp" \
+	"umans" "qwen-portal" "sakana" "sambanova" "minimax-code" "minimax-code-cn" "xiaomi" "xiaomi-token-plan-sgp" \
 	"xiaomi-token-plan-ams" "xiaomi-token-plan-cn" "firepass" "cline-pass" "factory-droid" "commandcode" "charm-hyper" "deepseek" "stepfun" "muse-code" "meta" "moonshot" \
 	"cerebras" "baseten" "helmcode" "fireworks" "together" "nvidia" "novita" "deepinfra" "huggingface" "perplexity" \
 	"qianfan" "venice" "siliconflow" "siliconflow-cn" "synthetic" "nanogpt" "wafer-serverless" "coreweave" \

package/src/compat/rules/auth/google-antigravity.kdl

@@ -1,5 +1,5 @@
 auth "google-antigravity" {
-	name "Antigravity (Gemini 3, Claude, GPT-OSS)"
+	name "Google Antigravity (Gemini, Claude, GPT-OSS)"
 	login "oauth-code" {
 		// Antigravity uses different Google OAuth credentials for its additional models.
 		client-id "MTA3MTAwNjA2MDU5MS10bWhzc2luMmgyMWxjcmUyMzV2dG9sb2poNGc0MDNlcC5hcHBzLmdvb2dsZXVzZXJjb250ZW50LmNvbQ==" encoding="base64"

package/src/compat/rules/auth/sambanova.kdl

@@ -0,0 +1,9 @@
+auth "sambanova" {
+	name "SambaNova"
+	login "api-key" {
+		auth-url "https://cloud.sambanova.ai/apis"
+		instructions "Copy your API key from the SambaNova Cloud dashboard"
+		prompt "Paste your SambaNova API key" placeholder="..."
+		validate "models-endpoint" label="SambaNova" url="https://api.sambanova.ai/v1/models"
+	}
+}

package/src/compat/rules/auth/stencil.kdl

@@ -4,7 +4,7 @@
 // Two hosts: the Stencil API at api.stencil.so (`{base}`, STENCIL_BASE_URL)
 // and the OIDC issuer at auth.stencil.so (`{auth}`, STENCIL_AUTH_URL) which
 // serves the PKCE-mandatory authorization codes under /oauth/* and mints
-// ES256 access tokens. The public client id `omp` is code-defined in the
+// ES256 access tokens. The public client id `zetacode` is code-defined in the
 // issuer with a port-flexible 127.0.0.1 loopback callback.
 auth "stencil" {
 	name "Stencil (invite only)"

package/src/compat/rules/classes/anthropic.kdl

@@ -14,10 +14,25 @@
 // consecutive tool_use or tool_result blocks is one position. Warm-cache
 // tool-result pruning keeps its rewrites inside this window.
 // https://platform.claude.com/docs/en/build-with-claude/prompt-caching
+// A replayed signed thinking block bills the full reasoning its signature
+// carries (the server rebuilds it from the signature), at the size its turn
+// billed as output, not the signature's bytes. Thinking a request drops bills
+// nothing (earlier turns on lines that strip it: Opus before 4.5, Sonnet
+// before 4.6, Haiku before 5.5; turns before a compaction or prune on
+// prefix-bound lines; another model's blocks the reader cannot read), so
+// those turns count high.
+// https://platform.claude.com/docs/en/build-with-claude/context-windows#the-context-window-with-thinking
+// https://platform.claude.com/docs/en/build-with-claude/preserved-thinking#switching-models
 class "anthropic" {
 	prompt-cache-lookback 20
+	// Claude's input classifier refuses requests that quote earlier reasoning
+	// back as text (`reasoning_extraction`, issue #6093).
+	classifier-cot-extraction #true
+	thinking-replay-tokens "output"
+	// verified: billing matched this formula on Opus 4.7+ and Fable 5.1.
 	image-tokenization {
 		regime "anthropic-patch"
+		verified #true
 		max-edge 2576
 		max-tokens 4784
 	}
@@ -37,21 +52,39 @@ class "anthropic" {
 			}
 		}
 	}
+	// Standard tier. verified: billing matched it on Sonnet 4.6 only; older
+	// Sonnet lines keep the floor until measured.
 	family "sonnet" {
-		revision "<4.7" {
+		revision "<4.6" {
 			image-tokenization {
 				regime "anthropic-patch"
 				max-edge 1568
 				max-tokens 1568
 			}
 		}
-		revision ">=10 <47" {
+		revision ">=4.6 <4.7" {
+			image-tokenization {
+				regime "anthropic-patch"
+				verified #true
+				max-edge 1568
+				max-tokens 1568
+			}
+		}
+		revision ">=10 <46" {
 			image-tokenization {
 				regime "anthropic-patch"
 				max-edge 1568
 				max-tokens 1568
 			}
 		}
+		revision ">=46 <47" {
+			image-tokenization {
+				regime "anthropic-patch"
+				verified #true
+				max-edge 1568
+				max-tokens 1568
+			}
+		}
 	}
 	family "haiku" {
 		revision "<4.7" {
@@ -87,6 +120,13 @@ class "anthropic" {
 			supports-sampling-params #false
 		}
 	}
+	// Opus 5.5 edits from imaged `read` results within one miss of text; Sonnet
+	// and Haiku 5.5 miscount deep tab indents (measurements: rules/README.md).
+	family "opus" {
+		revision ">=5.5 <10" {
+			snapcompact-image-reads #true
+		}
+	}
 	family "sonnet" {
 		revision ">=5 <10" {
 			supports-sampling-params #false

package/src/compat/rules/classes/deepseek.kdl

@@ -59,6 +59,10 @@ class "deepseek" {
 	on "alibaba-token-plan" "deepseek" {
 		supports-developer-role #false
 	}
+	// Replaces the provider-keyed leaked chat-template special-token strip.
+	on "nvidia" "deepseek" {
+		strip-deepseek-special-tokens #true
+	}
 	on "deepseek" "opencode-go" {
 		family "pro" {
 			max-tokens-field "max_tokens"

package/src/compat/rules/classes/gemini.kdl

@@ -66,13 +66,15 @@ class "gemini" {
 			}
 		}
 	}
-	// Gemini 3.7+ Flash native thinkingLevel does not accept `minimal`
-	// (400 THINKING_LEVEL_MINIMAL; observed on 3.7 and 3.8). Only the direct
+	// Gemini 3.7+ Flash and Gemini 4 Argon native thinkingLevel does not accept
+	// `minimal` (400 THINKING_LEVEL_MINIMAL; observed on Flash 3.7 and 3.8, and
+	// documented for Argon and Argon Cyber Permissive). Only the direct
 	// google-level transports emit `thinkingLevel` on the wire, so the tier is
 	// dropped there; budget (anthropic-messages) and reasoning_effort resellers
 	// never send the rejected value and keep the four-tier ladder. The collapsed
 	// google-antigravity / google-gemini-cli variants remap minimal -> LOW and
 	// carry their own explicit ladder, so they are unaffected.
+	// https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/gemini/4-argon
 	// https://ai.google.dev/gemini-api/docs/generate-content/thinking#thinking-levels
 	on "google" "google-vertex" "opencode-zen" {
 		family "flash" {
@@ -80,6 +82,41 @@ class "gemini" {
 				thinking-efforts "low" "medium" "high"
 			}
 		}
+		// Exact ids: a revision-wide rule would tie with the Pro low/high ladder.
+		// Gemini API discovery has no bundled Argon reference and infers
+		// `reasoning: false` from the id; repair it so the ladder is selectable.
+		models "gemini-4-argon" "gemini-4-argon-cyber-permissive" {
+			thinking-upgrade-neutral #true
+			thinking-efforts "low" "medium" "high"
+		}
+	}
+	// Gemini 4 Argon's introductory list price ($2/$10, $0.10 cached) ends
+	// 2026-11-30; from 2026-12-01 Google bills $4/$20, $0.20 cached, on the
+	// Gemini API and Vertex global endpoint alike. Cloud Billing days start at
+	// midnight US Pacific. Both cards are pinned over whatever stencil.so or
+	// the bundled pricing peer reports: the switch needs no regeneration, and
+	// a row built after upstream catches up still prices earlier requests at
+	// the introductory rate.
+	// https://ai.google.dev/gemini-api/docs/pricing
+	// https://cloud.google.com/vertex-ai/generative-ai/pricing
+	on "google" "google-vertex" "google-antigravity" {
+		models "gemini-4-argon" {
+			cost-patch {
+				input 2
+				output 10
+				cache-read 0.1
+				cache-write 0
+				effective-rates {
+					list-price {
+						effective-from "2026-12-01T08:00:00Z"
+						input 4
+						output 20
+						cache-read 0.2
+						cache-write 0
+					}
+				}
+			}
+		}
 	}
 
 	revision ">=3" {
@@ -88,6 +125,13 @@ class "gemini" {
 		// Replaces the Gemini 3+ mandatory-reasoning fallback.
 		thinking-requires-effort #true
 	}
+	// Gemini 3+ takes `thinkingLevel` on the native Google transports; Gemini 4
+	// rejects `thinkingBudget` outright (400 "Use thinking level instead").
+	on-api "google-generative-ai" "google-gemini-cli" "google-vertex" {
+		revision ">=3" {
+			thinking-mode "google-level"
+		}
+	}
 	// Public Gemini requires the bypass sentinel on every unsigned call and
 	// supports function-part ids. Scope by adapter so custom providers using
 	// the same wire protocol inherit both contracts. The Cloud Code Assist

package/src/compat/rules/classes/meta.kdl

@@ -9,6 +9,13 @@ class "meta" {
 		thinking-efforts "minimal" "low" "medium" "high" "xhigh" "max"
 		thinking-mode "effort"
 	}
+	// Meta documents `max` for Muse Wonder (dev.meta.ai/docs/reasoning); the
+	// Muse Code-only Wonder Full and contributor tiers accept it too (verified
+	// 2026-10-12).
+	models "muse-wonder-1.0" "muse-wonder-1.0-contributor" "muse-wonder-full-1.0" "muse-wonder-full-1.0-contributor" {
+		thinking-efforts "minimal" "low" "medium" "high" "xhigh" "max"
+		thinking-mode "effort"
+	}
 	models "muse-spark-1.1" "muse-spark-1.2" "muse-spark-1.2-contributor" {
 		thinking-efforts "minimal" "low" "medium" "high" "xhigh"
 		thinking-mode "effort"

package/src/compat/rules/classes/minimax.kdl

@@ -7,6 +7,16 @@ class "minimax" {
 	}
 	// Replaces the MiniMax lineage branch in both OpenAI baselines.
 	reasoning-deltas-may-be-cumulative #true
+	// Replaces the identity default: M2/M3 thinking rides Anthropic adaptive
+	// thinking on every Messages route, custom provider ids included.
+	on-api "anthropic-messages" {
+		family "m2" {
+			thinking-mode "anthropic-adaptive"
+		}
+		family "m3" {
+			thinking-mode "anthropic-adaptive"
+		}
+	}
 	on "aimlapi" "coreweave" "fireworks" "huggingface" "kilo" "nanogpt" "novita" "nvidia" \
 		"opencode-go" "opencode-zen" "together" "venice" "wafer-serverless" "zenmux" {
 		family "m3" {
@@ -30,7 +40,7 @@ class "minimax" {
 	// upstream metadata, not the model ceiling (documented: 1M in / 128K out).
 	// Exact selectors are case-sensitive, so both served spellings are listed:
 	// MiniMax hosts publish `MiniMax-M3`, Charm Hyper publishes `minimax-m3`.
-	on "charm-hyper" "minimax" "minimax-cn" "minimax-code" "minimax-code-cn" {
+	on "charm-hyper" "minimax" "minimax-cn" "minimax-code" "minimax-code-cn" "sambanova" {
 		models "MiniMax-M3" "minimax-m3" {
 			limits-patch {
 				context-window 1000000

package/src/compat/rules/classes/openai.kdl

@@ -11,6 +11,14 @@ class "openai" {
 	revision ">=5" {
 		supports-sampling-params #false
 	}
+	// GPT-5.4 serves its 1M window, and its long-context price tier does not
+	// cap that window. GitHub Copilot keeps its own cap (github-copilot.kdl).
+	models "gpt-5.4" {
+		limits-patch {
+			context-window 1000000
+		}
+		long-context-window-uncapped #true
+	}
 	// GPT wire ladders are model generations, not host contracts: <5.2 keeps
 	// the classic four-tier scale, 5.2+ drops minimal for xhigh, and 5.6+
 	// exposes the wire-exact five-tier low..max scale.
@@ -95,9 +103,28 @@ class "openai" {
 // Older lines carry no lineage rule and bill at their wire API's fallback
 // (providers/image-tokenization.kdl).
 class "openai" {
-	// gpt-5.6 sizing, shared by later lines. `<10` keeps separator-collapsed
-	// revisions (`openai-gpt-52-codex` parses as 52) off the 5.6+ sizing.
-	revision ">=5.6 <10" {
+	// gpt-5.6 sizing. verified: billing matched this formula on gpt-5.6 through 6.1.
+	revision ">=5.6 <6.2" {
+		image-tokenization {
+			regime "openai-patch"
+			verified #true
+			multiplier 1.2
+			auto "original"
+			low {
+				max-edge 512
+			}
+			high {
+				max-edge 2048
+				patch-budget 2500
+			}
+			original {
+				max-edge 65535
+			}
+		}
+	}
+	// Later lines size like gpt-5.6, unverified until measured. `<10` keeps
+	// separator-collapsed revisions (`openai-gpt-52-codex` parses as 52) off it.
+	revision ">=6.2 <10" {
 		image-tokenization {
 			regime "openai-patch"
 			multiplier 1.2
@@ -114,9 +141,11 @@ class "openai" {
 			}
 		}
 	}
+	// verified: billing matched this formula on gpt-5.5.
 	revision "=5.5" {
 		image-tokenization {
 			regime "openai-patch"
+			verified #true
 			multiplier 1.2
 			auto "original"
 			low {
@@ -173,9 +202,11 @@ class "openai" {
 		}
 	}
 	// residue: astra's limits differ from the rest of its revision.
+	// verified: billing matched this formula on gpt-6-astra.
 	models "*gpt-6-astra*" {
 		image-tokenization {
 			regime "openai-patch"
+			verified #true
 			multiplier 1.2
 			auto "original"
 			low {

package/src/compat/rules/classes/xai.kdl

@@ -41,6 +41,32 @@ class "xai" {
 			}
 		}
 	}
+	// Grok bills 32px patches plus ~30–40 tokens per image, resizing past
+	// 2,401 patches at every detail level; the 1.017 multiplier carries the
+	// per-image tokens at full size (small images bill slightly more).
+	// verified: billing matched this rule on Grok 4.6, 4.7 and 4.20.
+	family "grok" {
+		revision ">=4.6 <=4.20" {
+			image-tokenization {
+				regime "openai-patch"
+				verified #true
+				multiplier 1.017
+				auto "original"
+				low {
+					max-edge 65535
+					patch-budget 2401
+				}
+				high {
+					max-edge 65535
+					patch-budget 2401
+				}
+				original {
+					max-edge 65535
+					patch-budget 2401
+				}
+			}
+		}
+	}
 	thinking-loop-guard "xai"
 }
 

package/src/compat/rules/providers/amazon-bedrock.kdl

@@ -2,6 +2,7 @@
 
 provider "amazon-bedrock" {
 	default-model "us.anthropic.claude-opus-5-5"
+	image-count-budget 90
 
 	// The Converse assembler positions content blocks by wire index
 	// (`amazon-bedrock.ts`), so a block can land above text already rendered.

package/src/compat/rules/providers/anthropic.kdl

@@ -74,6 +74,10 @@ provider "anthropic" {
 	// combines this fact with a per-request effective-URL check, so it never
 	// authorizes a block on its own.
 	first-party-provider #true
+	// Shares Claude Code's `ANTHROPIC_*` env routing, so it also honors Claude
+	// Code's `CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS` kill switch for gateways
+	// that reject experimental beta fields.
+	honors-claude-code-beta-kill-switch #true
 	// Messages requests cap at 32 MB. Reserve 8 MB for text, tools, and JSON
 	// framing when retaining inline base64 images in a long conversation.
 	// Applied only on the official endpoint; a custom baseUrl has its own limit.
@@ -81,7 +85,26 @@ provider "anthropic" {
 	on-api "anthropic-messages" {
 		inline-image-byte-budget 24000000
 	}
+	// The official endpoint carries at most 600 images and documents per
+	// request, 100 on models with a 200k-token window: every Claude line before
+	// 4.6, including separator-collapsed revisions (`claude-opus-45` parses as
+	// 45). A custom baseUrl keeps the conservative 90.
+	// https://platform.claude.com/docs/en/build-with-claude/vision
+	image-count-budget 90
+	official-image-count-budget 600
+	// The Messages API decodes gzip request bodies and rejects zstd and br
+	// with a 400 (`request_body_encoding_invalid`). Gzip bytes that arrive
+	// without their `Content-Encoding` (a proxy dropped the header) get a 400
+	// "The request body is not valid JSON" (live, 2026-10-17).
+	request-encodings "gzip"
+	request-encoding-rejection "request_body_encoding_invalid|Unsupported Content-Encoding|request body is not valid JSON"
 	class "anthropic" {
+		revision "<4.6" {
+			official-image-count-budget 100
+		}
+		revision ">=10 <46" {
+			official-image-count-budget 100
+		}
 		revision ">=3.7 <4.6" {
 			thinking-efforts "minimal" "low" "medium" "high" "xhigh"
 		}

package/src/compat/rules/providers/azure.kdl

@@ -3,6 +3,8 @@
 provider "azure" {
 	default-model "gpt-5.5"
 	env "AZURE_OPENAI_API_KEY"
+	// Replaces the provider-keyed strict Responses tool-call/result pairing.
+	strict-responses-pairing #true
 
 	class "openai" {
 		thinking-mode "effort"

package/src/compat/rules/providers/cerebras.kdl

@@ -10,6 +10,9 @@ provider "cerebras" {
 	// Replaces the Cerebras provider branches in the completions baseline.
 	supports-usage-in-streaming #false
 	tool-strict-mode "all_strict"
+	// Replaces the provider check in agent-loop history normalization: replayed
+	// assistant history drops its thinking blocks.
+	strip-thinking-history #true
 	// Prompt caching carries no discount: cached input tokens bill at the
 	// standard input rate (https://inference-docs.cerebras.ai/capabilities/prompt-caching).
 	cache-read-at-input-rate #true

package/src/compat/rules/providers/cline-pass.kdl

@@ -10,4 +10,20 @@ provider "cline-pass" {
 	wire-model-id-mode "cline-pass"
 	// Replaces the Cline Pass thinking-format branch.
 	thinking-format "openai"
+	// Replaces the Cline Pass completions baseline branches: the reasoning
+	// field, the disable shape, and reasoning kept on under tool choice.
+	reasoning-content-field "reasoning"
+	reasoning-disable-mode "cline-enabled-false"
+	disable-reasoning-on-forced-tool-choice #false
+	disable-reasoning-on-tool-choice #false
+	// Discovery reports each row's thinking ladder; a row without one
+	// (`supportsReasoningEffort: false`) has no reasoning control at all.
+	trust-explicit-thinking-only #true
+	class "qwen" {
+		supports-forced-tool-choice #false
+		cache-control-format "anthropic"
+	}
+	class "anthropic" {
+		cache-control-format "anthropic"
+	}
 }

package/src/compat/rules/providers/commandcode.kdl

@@ -337,6 +337,16 @@ provider "commandcode" {
 			cache-write 0.0
 		}
 	}
+	// Restate the 64K provider output cap beside the openai class's GPT-5.4
+	// window patch, or the class rule wins the whole limits axis.
+	class "openai" {
+		models "gpt-5.4" {
+			limits-patch {
+				context-window 1000000
+				max-tokens 65536
+			}
+		}
+	}
 	models "gpt-5.3-codex" {
 		cost-patch {
 			input 2.0