@vellumai/assistant 0.11.3-dev.202608102016.71d1d5b → 0.11.3-dev.202608102215.87736ca

package/openapi.yaml

@@ -4826,6 +4826,7 @@ paths:
                     - gemini
                     - fireworks
                     - openrouter
+                    - chatgpt
                     - vellum
                     - together
                     - vercel-ai-gateway
@@ -34540,6 +34541,7 @@ components:
                     - gemini
                     - fireworks
                     - openrouter
+                    - chatgpt
                     - vellum
                     - together
                     - vercel-ai-gateway
@@ -34917,6 +34919,7 @@ components:
                 - gemini
                 - fireworks
                 - openrouter
+                - chatgpt
                 - vellum
                 - together
                 - vercel-ai-gateway

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.11.3-dev.202608102016.71d1d5b",
+  "version": "0.11.3-dev.202608102215.87736ca",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/turn-events-store.test.ts

@@ -331,3 +331,46 @@ describe("queryUnreportedTurnEvents", () => {
     expect(() => stampTurnOutcome("no-such-message", "failed")).not.toThrow();
   });
 });
+
+describe("unfinalized rows and turn accounting", () => {
+  test("an in-flight grouped tool-result row is not a real user turn", async () => {
+    const conv = createConversation({ conversationType: "standard" });
+    const first = await insertUserMessageAt(conv.id, "real question", 1000);
+    // The grouped tool-result row: user-role, reserved unfinalized while
+    // tool output streams, content a { ref } that does not contain the
+    // tool_result text the content exclusions match. Without the finalized
+    // predicate it counts as a phantom user turn until the fold.
+    const inflight = await insertUserMessageAt(
+      conv.id,
+      JSON.stringify({ ref: "conversations/conv/inflight/x.jsonl" }),
+      2000,
+    );
+    getDb().run(`UPDATE messages SET finalized = 0 WHERE id = '${inflight}'`);
+    const second = await insertUserMessageAt(conv.id, "second question", 3000);
+
+    const events = queryUnreportedTurnEvents(0, undefined, 100);
+    const ids = events
+      .filter((e) => e.conversationId === conv.id)
+      .map((e) => e.id);
+
+    expect(ids).toEqual([first, second]);
+    const byId = Object.fromEntries(events.map((e) => [e.id, e]));
+    expect(byId[first].turnIndex).toBe(1);
+    expect(byId[second].turnIndex).toBe(2);
+  });
+
+  test("a persisted empty-display user row still counts as a turn", async () => {
+    const conv = createConversation({ conversationType: "standard" });
+    const real = await insertUserMessageAt(conv.id, "real question", 1000);
+    // A hidden send persists its user row with [] content (displayContent "")
+    // and still runs a turn, so [] rows must stay in turn accounting.
+    const hidden = await insertUserMessageAt(conv.id, "[]", 2000);
+
+    const events = queryUnreportedTurnEvents(0, undefined, 100);
+    const ids = events
+      .filter((e) => e.conversationId === conv.id)
+      .map((e) => e.id);
+
+    expect(ids).toEqual([real, hidden]);
+  });
+});

package/src/config/__tests__/default-profile-catalog.test.ts

@@ -7,6 +7,7 @@ import {
   CODE_DEFAULT_PROFILE_ENTRIES,
   getEffectiveProfile,
   getEffectiveProfiles,
+  getEffectiveProfilesForProvider,
   PROFILE_IMPLS,
   resolveDefaultProfileForProvider,
 } from "../default-profile-catalog.js";
@@ -333,7 +334,7 @@ describe("resolveDefaultProfileForProvider", () => {
         expect(typeof entry?.model).toBe("string");
         expect(entry?.provider).toBeDefined();
         // Identity columns stamp no connection; BYOK columns always do.
-        if (entry?.provider === "vellum") {
+        if (entry?.provider === "vellum" || entry?.provider === "chatgpt") {
           expect(entry?.provider_connection).toBeUndefined();
         } else {
           expect(entry?.provider_connection).toBeDefined();
@@ -343,6 +344,27 @@ describe("resolveDefaultProfileForProvider", () => {
     }
   });
 
+  test("the chatgpt column resolves Codex-pinned models with no connection stamp", () => {
+    const byKey: Record<string, string> = {
+      balanced: "gpt-5.6-luna",
+      "quality-optimized": "gpt-5.6-sol",
+      "cost-optimized": "gpt-5.6-luna",
+      "latency-optimized": "gpt-5.6-luna",
+    };
+    const effective = getEffectiveProfilesForProvider(undefined, dp("chatgpt"));
+    for (const [key, model] of Object.entries(byKey)) {
+      const entry = effective[key];
+      expect(entry?.provider).toBe("chatgpt");
+      expect(entry?.model).toBe(model);
+      expect(entry?.provider_connection).toBeUndefined();
+      expect(entry?.source).toBe("managed");
+    }
+    // Cost and Speed both opt fully out of reasoning.
+    expect(effective["cost-optimized"]?.effort).toBe("none");
+    expect(effective["latency-optimized"]?.effort).toBe("none");
+    expect(effective.balanced?.thinking?.enabled).toBe(true);
+  });
+
   test("a provider without a named matrix column materializes from the shared BYOK templates", () => {
     const entry = resolveDefaultProfileForProvider(
       undefined,

package/src/config/__tests__/default-provider.test.ts

@@ -157,6 +157,12 @@ describe("resolveDefaultConnectionName", () => {
     );
   });
 
+  test("chatgpt resolves to the canonical subscription connection name", () => {
+    expect(resolveDefaultConnectionName({ provider: "chatgpt" })).toBe(
+      "chatgpt-subscription",
+    );
+  });
+
   test("every other provider resolves to its personal connection", () => {
     expect(resolveDefaultConnectionName({ provider: "anthropic" })).toBe(
       "anthropic-personal",

package/src/config/default-profile-catalog.ts

@@ -4,6 +4,7 @@ import {
   isModelInCatalog,
 } from "../providers/model-catalog.js";
 import { resolveModelIntent } from "../providers/model-intents.js";
+import { isCodexSubscriptionModel } from "../providers/openai/codex-models.js";
 import type { ModelIntent } from "../providers/types.js";
 import { getManagedUpstream } from "../providers/vellum-model-routing.js";
 import {
@@ -31,7 +32,8 @@ import {
  * structured as an intent × provider matrix: each default profile is an
  * intent, and each provider that can serve default profiles has a concrete
  * implementation of that intent (model, token budget, effort, thinking).
- * The `vellum` column is the platform-managed implementation; the other
+ * The `vellum` column is the platform-managed implementation and the
+ * `chatgpt` column is the ChatGPT-subscription implementation; the other
  * columns are the BYOK implementations resolved through `llm.defaultProvider`
  * on off-platform installs.
  *
@@ -147,6 +149,69 @@ const VELLUM_PROFILE_IMPLS: ProfileImpls = {
   },
 };
 
+/**
+ * The `chatgpt` column: ChatGPT-subscription implementations, stamped
+ * `provider: "chatgpt"` so dispatch routes through the canonical
+ * `chatgpt-subscription` row via `resolveRoutingIdentity` with no pinned
+ * connection. Models are pinned (never intents): the intent tables are
+ * keyed by concrete dispatch providers, and the Codex endpoint serves only
+ * `CODEX_SUBSCRIPTION_MODEL_IDS`. Cost and Speed are identical
+ * implementations here: the subscription serves no tier cheaper or faster
+ * than luna, and both profiles advertise reasoning off.
+ */
+const CHATGPT_PROFILE_IMPLS: ProfileImpls = {
+  balanced: {
+    model: "gpt-5.6-luna",
+    provider: "chatgpt",
+    source: "managed",
+    label: "Balanced",
+    description: "Good balance of quality, cost, and speed",
+    // Matches the vellum column's Balanced (same model): the Codex path
+    // sends no max_output_tokens, so this only sizes internal budgeting.
+    maxTokens: 32000,
+    effort: "high",
+    thinking: { enabled: true, streamThinking: true },
+    contextWindow: { maxInputTokens: DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS },
+  },
+  "quality-optimized": {
+    model: "gpt-5.6-sol",
+    provider: "chatgpt",
+    source: "managed",
+    label: "Quality",
+    description: "Best results with the most capable model",
+    maxTokens: 32000,
+    effort: "high",
+    thinking: { enabled: true, streamThinking: true },
+    contextWindow: { maxInputTokens: DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS },
+  },
+  "cost-optimized": {
+    model: "gpt-5.6-luna",
+    provider: "chatgpt",
+    source: "managed",
+    label: "Cost",
+    description: "Cheapest responses, for high-volume work",
+    maxTokens: 8192,
+    effort: "none",
+    thinking: { enabled: false, streamThinking: false },
+    contextWindow: { maxInputTokens: DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS },
+  },
+  "latency-optimized": {
+    model: "gpt-5.6-luna",
+    provider: "chatgpt",
+    source: "managed",
+    label: "Speed",
+    description: "Fastest responses, with reasoning turned off",
+    maxTokens: 8192,
+    // Explicit reasoning opt-out, matching the other columns: this profile
+    // advertises reasoning as off, and OpenAI-compat APIs default reasoning
+    // to "medium" when the field is omitted, so the opt-out has to be stated
+    // rather than implied.
+    effort: "none",
+    thinking: { enabled: false, streamThinking: false },
+    contextWindow: { maxInputTokens: DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS },
+  },
+};
+
 /**
  * The BYOK implementation of each default profile intent, shared by every
  * non-vellum provider. The concrete model resolves per provider from the
@@ -219,7 +284,9 @@ export const PROFILE_IMPLS: Record<
         provider,
         provider === "vellum"
           ? VELLUM_PROFILE_IMPLS[key]
-          : { ...BYOK_PROFILE_IMPLS[key], provider },
+          : provider === "chatgpt"
+            ? CHATGPT_PROFILE_IMPLS[key]
+            : { ...BYOK_PROFILE_IMPLS[key], provider },
       ]),
     ) as Record<DefaultProfileProvider, DefaultProfileTemplate>,
   ]),
@@ -372,21 +439,23 @@ for (const key of DEFAULT_PROFILE_KEYS) {
         `PROFILE_IMPLS[${key}][${provider}] must set exactly one of \`intent\` or \`model\`.`,
       );
     }
-    if (impl.provider === "vellum" && impl.model == null) {
+    if (ROUTING_IDENTITY_PROVIDERS.has(impl.provider) && impl.model == null) {
       throw new Error(
-        `PROFILE_IMPLS[${key}][${provider}] must pin a \`model\`: the vellum ` +
-          `column has no intent table, and the model selects the upstream.`,
+        `PROFILE_IMPLS[${key}][${provider}] must pin a \`model\`: routing ` +
+          `identities have no intent table, and the model selects the route.`,
       );
     }
     if (impl.model != null) {
       const routable =
         impl.provider === "vellum"
           ? getManagedUpstream(impl.model) !== null
-          : isModelInCatalog(impl.provider, impl.model);
+          : impl.provider === "chatgpt"
+            ? isCodexSubscriptionModel(impl.model)
+            : isModelInCatalog(impl.provider, impl.model);
       if (!routable) {
         throw new Error(
           `PROFILE_IMPLS[${key}][${provider}] references model "${impl.model}" ` +
-            `which is not ${impl.provider === "vellum" ? "served by any managed upstream" : `in PROVIDER_CATALOG for provider "${impl.provider}"`}. ` +
+            `which is not ${impl.provider === "vellum" ? "served by any managed upstream" : impl.provider === "chatgpt" ? "in CODEX_SUBSCRIPTION_MODEL_IDS" : `in PROVIDER_CATALOG for provider "${impl.provider}"`}. ` +
             `Update model-catalog.ts or default-profile-catalog.ts.`,
         );
       }
@@ -517,7 +586,9 @@ function resolveAgainstBody(
  * Non-obvious rules:
  *
  * - The `vellum` column stamps `provider: "vellum"` with no connection —
- *   dispatch derives the upstream from the model per-request.
+ *   dispatch derives the upstream from the model per-request. The `chatgpt`
+ *   column likewise stamps its routing identity with no connection;
+ *   dispatch resolves the canonical subscription row per-request.
  * - A default provider without a named matrix column materializes from the
  *   shared `BYOK_PROFILE_IMPLS` templates, with `resolveModelIntent`
  *   falling back to the provider's catalog `defaultModel`.

package/src/config/default-profile-names.ts

@@ -38,7 +38,9 @@ export const OS_BETA_PROFILE_KEY = "os-beta";
 /**
  * The named columns of the intent × provider matrix. `vellum` is the
  * platform-managed column (routed through the single `vellum` connection to
- * an underlying provider per profile); the rest are BYOK columns whose
+ * an underlying provider per profile) and `chatgpt` is the
+ * ChatGPT-subscription column (routed through the `chatgpt-subscription`
+ * connection to the Codex endpoint); the rest are BYOK columns whose
  * models resolve per provider via `resolveModelIntent`. The full set of
  * providers that can back `llm.defaultProvider` is wider, see
  * `DEFAULT_PROVIDER_CHOICES` in `schemas/llm.ts`.
@@ -53,6 +55,7 @@ export const DEFAULT_PROFILE_PROVIDERS = [
   "gemini",
   "fireworks",
   "openrouter",
+  "chatgpt",
   "vellum",
 ] as const;
 export type DefaultProfileProvider = (typeof DEFAULT_PROFILE_PROVIDERS)[number];

package/src/config/default-provider-resolution.ts

@@ -6,6 +6,7 @@
  * conveniences (`getDefaultProvider()` without an argument,
  * `setDefaultProvider`) live in `default-provider.ts`.
  */
+import { CHATGPT_SUBSCRIPTION_CONNECTION_NAME } from "../providers/inference/auth.js";
 import { VELLUM_MANAGED_CONNECTION_NAME } from "../providers/vellum-model-routing.js";
 import type { DefaultProviderConfig } from "./schemas/llm.js";
 import type { AssistantConfig } from "./types.js";
@@ -29,5 +30,8 @@ export function resolveDefaultConnectionName(
   if (dp.provider === "vellum") {
     return VELLUM_MANAGED_CONNECTION_NAME;
   }
+  if (dp.provider === "chatgpt") {
+    return CHATGPT_SUBSCRIPTION_CONNECTION_NAME;
+  }
   return `${dp.provider}-personal`;
 }

package/src/config/schemas/llm.ts

@@ -1,6 +1,9 @@
 import { z } from "zod";
 
-import { PROVIDERS_REQUIRING_BASE_URL_AND_MODELS } from "../../providers/inference/auth.js";
+import {
+  PROVIDERS_REQUIRING_BASE_URL_AND_MODELS,
+  ROUTING_IDENTITY_PROVIDERS,
+} from "../../providers/inference/auth.js";
 import { PROVIDER_CATALOG } from "../../providers/model-catalog.js";
 import { isCodexSubscriptionModel } from "../../providers/openai/codex-models.js";
 import {
@@ -84,13 +87,15 @@ export function isDefaultProviderChoice(value: string): value is LLMProvider {
 
 /**
  * Default-provider choices whose profiles materialize from the shared BYOK
- * templates: every choice except the `vellum` routing identity, whose
- * defaults are pinned managed models.
+ * templates: every choice except the routing identities (`vellum`,
+ * `chatgpt`), whose defaults are pinned models on code-owned columns.
  */
 export function isByokDefaultProviderChoice(
   value: string,
 ): value is LLMProvider {
-  return value !== "vellum" && isDefaultProviderChoice(value);
+  return (
+    !ROUTING_IDENTITY_PROVIDERS.has(value) && isDefaultProviderChoice(value)
+  );
 }
 
 const DefaultProviderEnum = z.enum(

package/src/live-voice/live-voice-archive.ts

@@ -240,6 +240,8 @@ function isArtifactMetadata(
 function readMessageMetadata(
   messageId: string,
 ): MessageMetadataState | "not_found" | "invalid_metadata" {
+  // Any-state read, deliberately: metadata exists from row insert and the id
+  // names a row this archive flow already owns; completeness is irrelevant.
   const row = rawGet<{ metadata: string | null }>(
     "liveVoice:readMessageMetadata",
     `SELECT metadata FROM messages WHERE id = ?`,

package/src/persistence/llm-usage-store.ts

@@ -10,7 +10,10 @@ import type {
 import { APP_VERSION } from "../version.js";
 import { getDb } from "./db-connection.js";
 import { rawAll } from "./raw-query.js";
-import { realUserTurnContentFilter } from "./real-user-turn-filter.js";
+import {
+  realUserTurnContentFilter,
+  realUserTurnContentFilterSql,
+} from "./real-user-turn-filter.js";
 import {
   buildScheduleAttributionSubquery,
   buildScheduleRunWindowExists,
@@ -882,8 +885,7 @@ export function getUsageGroupBreakdown(
                SELECT COUNT(*) FROM messages AS m2
                WHERE m2.conversation_id = e.conversation_id
                  AND m2.role = 'user'
-                 AND m2.content NOT LIKE '%"type":"tool\\_result"%' ESCAPE '\\'
-                 AND m2.content NOT LIKE '%"type":"web\\_search\\_tool\\_result"%' ESCAPE '\\'
+                 AND ${realUserTurnContentFilterSql("m2")}
              )
         END                                              AS turn_count
       FROM llm_usage_events e

package/src/persistence/real-user-turn-filter.ts

@@ -19,8 +19,32 @@ import { sql } from "drizzle-orm";
 export function realUserTurnContentFilter(
   alias: string,
 ): ReturnType<typeof sql> {
-  return sql.raw(
-    `${alias}.content NOT LIKE '%"type":"tool\\_result"%' ESCAPE '\\' ` +
-      `AND ${alias}.content NOT LIKE '%"type":"web\\_search\\_tool\\_result"%' ESCAPE '\\'`,
+  return sql.raw(realUserTurnContentFilterSql(alias));
+}
+
+/**
+ * Raw-string form of {@link realUserTurnContentFilter}, for queries built as
+ * plain SQL template strings (`rawAll` sites). Same fragment, one source.
+ *
+ * `finalized = 1`: the grouped tool-result row is a USER-role row reserved
+ * in-flight (`ensureToolResultRowReserved`), and while it streams its content
+ * is a `{ ref }` pointer that does not contain the tool_result text the
+ * exclusions match. Without this predicate it counts as a real user turn
+ * mid-tool-execution and stops counting once the content folds inline.
+ *
+ * Bare `[]` content is deliberately NOT excluded: a hidden send persists its
+ * user row with empty display content (`processMessage` with
+ * `displayContent: ""`) and still runs a turn, so `[]` rows are legitimate
+ * turns. The cost is a narrow pre-existing window in the writer-creation
+ * fallback, where the tool-result row is born finalized with a `[]`
+ * placeholder and counts until the first content write lands; that window is
+ * rare (writer creation failure only) and transient, and closing it needs a
+ * signal that distinguishes the placeholder from a real empty-display turn.
+ */
+export function realUserTurnContentFilterSql(alias: string): string {
+  return (
+    `${alias}.finalized = 1 ` +
+    `AND ${alias}.content NOT LIKE '%"type":"tool\\_result"%' ESCAPE '\\' ` +
+    `AND ${alias}.content NOT LIKE '%"type":"web\\_search\\_tool\\_result"%' ESCAPE '\\'`
   );
 }

package/src/plugins/defaults/memory/buffer-format.ts

@@ -37,10 +37,11 @@ export interface BufferEntryStart {
  * Anchored at column 0, requiring a space after the dash, and spelling the
  * timestamp with the single spaces {@link formatBufferTimestamp} emits.
  * Everything else in the file is a continuation line belonging to the entry
- * above it, which is how a multiline fact keeps its body: `remember()` stores
- * the body verbatim after the timestamped first line. That rule is what makes
- * a bullet carrying other bracketed text (a `- [ ]` checklist item, a
- * `- [[wikilink]]` bullet) read as continuation rather than as a new fact.
+ * above it, which is how a multiline fact keeps its body: `remember()` writes
+ * only the opening line at column 0 and nests the body beneath it. That rule
+ * is what makes a bullet carrying other bracketed text (a `- [ ]` checklist
+ * item, a `- [[wikilink]]` bullet) read as continuation rather than as a new
+ * fact, and it is why a body line can never imitate an opening.
  *
  * Matching the writer's exact shape is the conservative choice in both
  * directions: a line the writer could not have produced stays body text, so an

package/src/plugins/defaults/memory/graph/image-ref-utils.ts

@@ -17,6 +17,9 @@ export async function loadImageRefData(
   const msg = db
     .select({ content: messages.content })
     .from(messages)
+    // No completeness predicate: refs come from the extracted memory graph,
+    // and extraction reads finalized rows only, so an unfinalized id cannot
+    // reach here. Do not copy this shape for ids with other provenance.
     .where(eq(messages.id, ref.messageId))
     .get();
   if (!msg) {

package/src/plugins/defaults/memory/indexer.ts

@@ -123,7 +123,9 @@ export async function indexMessageNow(
   // memory_segments has no cross-file FK to messages, so this call must not
   // leave pieces for a message with no row. Skip early when the source
   // row is already gone, the common case of a backfill job running after the
-  // message was deleted. A post-write re-check below closes the narrower window
+  // message was deleted. Any-state existence check, deliberately: a
+  // streaming row exists, and orphan prevention is about deletion, not
+  // completeness. A post-write re-check below closes the narrower window
   // where the delete lands mid-transaction.
   const sourceMessage = getDb()
     .select({ id: messages.id })

package/src/plugins/defaults/memory/v1/graph/extraction.ts

@@ -1365,7 +1365,9 @@ function resolveConversationTimestamp(conversationId: string): number | null {
   const db = getDb();
   // Use the last message timestamp, not the conversation creation time.
   // A conversation can span hours/days — memories should be timestamped
-  // to when the relevant content was actually discussed.
+  // to when the relevant content was actually discussed. Any-state read,
+  // deliberately: only `createdAt` is consumed, and a streaming last row
+  // still marks when discussion happened.
   const lastMsg = db
     .select({ createdAt: messages.createdAt })
     .from(messages)

package/src/plugins/defaults/memory/v3/prune.ts

@@ -293,6 +293,8 @@ export function collectPersistedV3Cards(conversationId: string): Set<string> {
   const rows = getSqliteFrom(getDb())
     .query(
       /*sql*/ `
+      -- Any-state scan: only metadata markers are read, and the marker is
+      -- written by the injection path on rows it owns regardless of state.
       SELECT metadata FROM messages
       WHERE conversation_id = ? AND metadata LIKE '%' || ? || '%'
     `,

package/src/plugins/defaults/memory/v3/selection-log-store.ts

@@ -97,6 +97,8 @@ function forkSourceIdsOf(messageIds: string[]): string[] {
     .query(
       /*sql*/ `
       SELECT json_extract(metadata, '$.forkSourceMessageId') AS src
+      -- No completeness predicate: ids come from this store's own selection
+      -- log, written for rows the injection pipeline already processed.
       FROM messages
       WHERE id IN (${placeholders})
     `,

package/src/runtime/pre-first-message-gate.ts

@@ -55,9 +55,13 @@ export function hasReceivedUserMessage(): boolean {
   try {
     const row = rawGet<{ one: number }>(
       "preFirstMsg:hasReceivedUserMessage",
+      // Finalized user-role rows only: the grouped tool-result row is a
+      // user-role row reserved unfinalized mid-turn, and this gate must not
+      // read tool plumbing as "the user has messaged this assistant".
       `SELECT 1 AS one FROM messages m
        JOIN conversations c ON m.conversation_id = c.id
        WHERE m.role = 'user'
+         AND m.finalized = 1
          AND c.conversation_type = 'standard'
        LIMIT 1`,
     );

package/src/runtime/routes/__tests__/default-provider-routes.test.ts

@@ -432,6 +432,31 @@ describe("PUT config/llm/default-provider", () => {
     expect(availability(result)).toEqual({ status: "ok" });
   });
 
+  test("chatgpt persists and resolves the canonical subscription row", async () => {
+    seedConnection({
+      name: "chatgpt-subscription",
+      provider: "chatgpt",
+      auth: {
+        type: "oauth_subscription",
+        credential: "credential/chatgpt/access_token",
+      },
+    });
+    secureKeyResults["credential/chatgpt/access_token"] = {
+      value: "token",
+      unreachable: false,
+    };
+
+    const result = (await put({ provider: "chatgpt" })) as Record<
+      string,
+      unknown
+    >;
+
+    expect(persistedDefaultProvider()).toEqual({ provider: "chatgpt" });
+    expect(result.provider).toBe("chatgpt");
+    expect(result.resolvedConnectionName).toBe("chatgpt-subscription");
+    expect(availability(result)).toEqual({ status: "ok" });
+  });
+
   test("persists an explicit connectionName", async () => {
     await put({ provider: "openai", connectionName: "work-openai" });
     expect(persistedDefaultProvider()).toEqual({
@@ -449,6 +474,42 @@ describe("PUT config/llm/default-provider", () => {
     expect(availability(result).status).toBe("missing_connection");
   });
 
+  test("a noncanonical pin on a routing identity → 400 naming the canonical row", async () => {
+    for (const [provider, canonical] of [
+      ["chatgpt", "chatgpt-subscription"],
+      ["vellum", "vellum"],
+    ] as const) {
+      const err = await put({
+        provider,
+        connectionName: "some-other-row",
+      }).catch((e: unknown) => e);
+      expect(String(err)).toContain(canonical);
+    }
+  });
+
+  test("the canonical pin on a routing identity is accepted", async () => {
+    seedConnection({
+      name: "chatgpt-subscription",
+      provider: "chatgpt",
+      auth: {
+        type: "oauth_subscription",
+        credential: "credential/chatgpt/access_token",
+      },
+    });
+    secureKeyResults["credential/chatgpt/access_token"] = {
+      value: "token",
+      unreachable: false,
+    };
+
+    const result = (await put({
+      provider: "chatgpt",
+      connectionName: "chatgpt-subscription",
+    })) as Record<string, unknown>;
+
+    expect(result.resolvedConnectionName).toBe("chatgpt-subscription");
+    expect(availability(result)).toEqual({ status: "ok" });
+  });
+
   test("invalid provider → 400 naming the allowed providers", async () => {
     const err = await put({ provider: "not-a-provider" }).catch(
       (e: unknown) => e,

package/src/runtime/routes/default-provider-routes.ts

@@ -25,6 +25,7 @@ import {
   DEFAULT_PROVIDER_CHOICES,
   DefaultProviderSchema,
 } from "../../config/schemas/llm.js";
+import { ROUTING_IDENTITY_PROVIDERS } from "../../providers/inference/auth.js";
 import {
   computeConnectionAvailability,
   CONNECTION_AVAILABILITY_STATUSES,
@@ -93,6 +94,20 @@ async function handlePutDefaultProvider({
       )}; "connectionName" is optional and must be a non-empty string.`,
     );
   }
+  // Routing identities dispatch through their canonical row regardless of
+  // any stored pin (`resolveRoutingIdentity`), so a noncanonical
+  // connectionName would be judged by availability and the deletion guards
+  // while inference uses a different row. Reject it here rather than
+  // persisting a pin that status and dispatch disagree about.
+  const { provider, connectionName } = result.data;
+  if (connectionName != null && ROUTING_IDENTITY_PROVIDERS.has(provider)) {
+    const canonical = resolveDefaultConnectionName({ provider });
+    if (connectionName !== canonical) {
+      throw new BadRequestError(
+        `Provider "${provider}" always dispatches through its canonical connection "${canonical}". Omit "connectionName" or pass "${canonical}".`,
+      );
+    }
+  }
   setDefaultProvider(result.data);
   return handleGetDefaultProvider();
 }

package/src/runtime/routes/log-export-routes.ts

@@ -143,6 +143,9 @@ async function handleExport({
         ? [eq(messages.conversationId, conversationId)]
         : [];
 
+      // Any-state export, deliberately: this is a diagnostic surface, and an
+      // in-flight row (finalized = 0, content a { ref } into the turn's delta
+      // file) is often exactly what a bug report needs to show.
       const messageRows = capRows(
         db
           .select()

package/src/runtime/routes/surface-conversation-resolver.ts

@@ -64,6 +64,9 @@ export async function resolveSurfaceConversation(
   const escaped = surfaceId.replace(/[\\%_]/g, "\\$&");
   const row = rawGet<{ conversation_id: string }>(
     "surfaceResolver:resolveConversation",
+    // Unfinalized rows cannot match: their content is a { ref } pointer,
+    // never inline surface JSON, so the LIKE probes below see finalized
+    // content only by shape. No completeness predicate needed.
     `SELECT conversation_id FROM messages
      WHERE content LIKE ? ESCAPE '\\'
      ORDER BY created_at DESC

package/src/workspace/byok-default-profile-ensure.ts

@@ -18,6 +18,7 @@ import {
   type LLMProvider,
   type ProfileEntry,
 } from "../config/schemas/llm.js";
+import { ROUTING_IDENTITY_PROVIDERS } from "../providers/inference/auth.js";
 import { getLogger } from "../util/logger.js";
 import { completedProfileBody } from "./custom-profile-ensure.js";
 
@@ -267,11 +268,13 @@ export function ensureByokDefaultProfiles(workspaceDir: string): void {
   const completionBase = LLMConfigBase.safeParse(llm.default ?? {}).data;
 
   // The default provider on a BYOK default, or the uniform hatch provider
-  // across the complete copy set on a vellum default; null converts nothing.
-  const candidateProvider =
-    parsedDefault.data.provider !== "vellum"
-      ? parsedDefault.data.provider
-      : uniformCopyProvider(profiles);
+  // across the complete copy set on a routing-identity default (vellum,
+  // chatgpt); null converts nothing.
+  const candidateProvider = ROUTING_IDENTITY_PROVIDERS.has(
+    parsedDefault.data.provider,
+  )
+    ? uniformCopyProvider(profiles)
+    : parsedDefault.data.provider;
   const convertibleProvider =
     candidateProvider !== null && isByokDefaultProviderChoice(candidateProvider)
       ? candidateProvider