@yansigit/opencodex 2.36.1-dev.20260829.47 → 2.36.1-dev.20260829.50

package/src/cli/storage.ts

@@ -0,0 +1,234 @@
+/**
+ * `ocx storage` — the archived-session cleanup, trash, and cleanup-policy surface (wp7).
+ *
+ * Every route here existed with no CLI caller, so reclaiming disk space was dashboard-only.
+ * Three of them delete or move operator data, and the rules for those are deliberate:
+ *
+ * 1. **Default to preview.** `ocx storage cleanup --percent N` runs the preview route and prints
+ *    what WOULD be freed, then exits 0 having mutated nothing.
+ * 2. **`--yes` is required to mutate.** There is no interactive prompt: an agent cannot answer
+ *    one, and a prompt an agent can answer is not a safety boundary.
+ * 3. **`--json` on the preview emits the candidate list**, so an agent can decide from data
+ *    rather than from a sentence.
+ *
+ * This is the opposite of the GitHub star POST, which no flag can authorize: cleanup spends the
+ * operator's DATA, which they can delegate, while starring spends their IDENTITY, which they
+ * cannot delegate to an agent.
+ */
+import {
+  CliUsageError,
+  printData,
+  rejectArgs,
+  runCliAction,
+  runtimeRequest,
+  summaryLines,
+  takeFlag,
+  takeIntegerOption,
+  takeOption,
+  type RuntimeApiDeps,
+} from "./runtime-api";
+
+const USAGE = `Usage:
+  ocx storage report [--json]
+  ocx storage cleanup --percent <0-100> [--mode <quarantine|permanent>] [--yes] [--json]
+  ocx storage trash [list] [--json]
+  ocx storage trash restore <entry-id> [--yes] [--json]
+  ocx storage policy [show] [--json]
+  ocx storage policy set [--enabled <true|false>] [--percent <0-100>]
+      [--mode <quarantine|permanent>] [--schedule <startup|daily|weekly|manual>] [--json]
+  ocx storage policy run [--yes] [--json]
+
+Cleanup and restore MUTATE operator data and require --yes.
+Without --yes, cleanup prints the preview and changes nothing.`;
+
+/** The digest binds a run to the preview it was authorized against. */
+interface CleanupPreview {
+  percent?: number;
+  count?: number;
+  bytes?: number;
+  digest?: string;
+  candidates?: { relPath?: string; bytes?: number }[];
+}
+
+function mib(bytes: number | undefined): string {
+  if (typeof bytes !== "number" || !Number.isFinite(bytes)) return "unknown size";
+  return `${(bytes / 1024 / 1024).toFixed(1)} MiB`;
+}
+
+function previewLines(preview: CleanupPreview): string[] {
+  const lines = [
+    `Would remove ${preview.count ?? 0} archived session file(s), freeing ${mib(preview.bytes)}.`,
+  ];
+  for (const candidate of (preview.candidates ?? []).slice(0, 10)) {
+    lines.push(`  ${candidate.relPath ?? "(unnamed)"}  ${mib(candidate.bytes)}`);
+  }
+  const shown = Math.min((preview.candidates ?? []).length, 10);
+  if ((preview.count ?? 0) > shown) lines.push(`  … and ${(preview.count ?? 0) - shown} more`);
+  lines.push("Nothing was deleted. Re-run with --yes to apply.");
+  return lines;
+}
+
+async function cleanup(argv: string[], deps: RuntimeApiDeps): Promise<void> {
+  const args = [...argv];
+  const wantsJson = takeFlag(args, "--json");
+  const confirmed = takeFlag(args, "--yes");
+  const percent = takeIntegerOption(args, "--percent", { min: 0 });
+  const mode = takeOption(args, "--mode") ?? "quarantine";
+  rejectArgs(args, USAGE);
+
+  if (percent === undefined) throw new CliUsageError("--percent is required", USAGE);
+  if (percent > 100) throw new CliUsageError("--percent must be between 0 and 100", USAGE);
+  if (mode !== "quarantine" && mode !== "permanent") {
+    throw new CliUsageError("--mode must be quarantine or permanent", USAGE);
+  }
+
+  // The preview runs in BOTH paths, and not only to be friendly: the mutating route requires the
+  // digest this call returns and rejects a stale one with 409 `stale_preview`. So the confirmed
+  // path cannot skip it, which conveniently means --yes and no --yes agree on what they mean.
+  const preview = await runtimeRequest<CleanupPreview>("/api/storage/cleanup/preview", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ percent }),
+  }, deps);
+
+  if (!confirmed) {
+    printData(preview, wantsJson, previewLines(preview));
+    return;
+  }
+
+  if (!preview.digest) {
+    // Refuse rather than send an empty digest: the server would reject it, but a clear local
+    // message beats a 400 that looks like a bug in the verb.
+    throw new CliUsageError("the preview returned no digest, so the cleanup cannot be authorized", USAGE);
+  }
+
+  const result = await runtimeRequest("/api/storage/cleanup", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ percent, mode, digest: preview.digest }),
+  }, deps);
+  printData(result, wantsJson, summaryLines(result));
+}
+
+async function trash(argv: string[], deps: RuntimeApiDeps): Promise<void> {
+  const action = argv[0] && !argv[0].startsWith("-") ? argv[0] : "list";
+  const rest = argv[0] && !argv[0].startsWith("-") ? argv.slice(1) : argv;
+
+  if (action === "list") {
+    const args = [...rest];
+    const wantsJson = takeFlag(args, "--json");
+    rejectArgs(args, USAGE);
+    const result = await runtimeRequest("/api/storage/trash", {}, deps);
+    printData(result, wantsJson, summaryLines(result));
+    return;
+  }
+
+  if (action !== "restore") throw new CliUsageError(`unknown trash action ${action}`, USAGE);
+
+  const args = [...rest];
+  const wantsJson = takeFlag(args, "--json");
+  const confirmed = takeFlag(args, "--yes");
+  const id = args.shift();
+  rejectArgs(args, USAGE);
+  if (!id) throw new CliUsageError("a trash entry id is required", USAGE);
+
+  // Restore moves files back and reconciles database rows, and can collide with an existing
+  // destination, so it is gated like cleanup rather than treated as a read.
+  if (!confirmed) {
+    throw new CliUsageError(`restoring ${id} modifies stored sessions; pass --yes to confirm`, USAGE);
+  }
+
+  const result = await runtimeRequest("/api/storage/trash/restore", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ id }),
+  }, deps);
+  printData(result, wantsJson, summaryLines(result));
+}
+
+async function policy(argv: string[], deps: RuntimeApiDeps): Promise<void> {
+  const action = argv[0] && !argv[0].startsWith("-") ? argv[0] : "show";
+  const rest = argv[0] && !argv[0].startsWith("-") ? argv.slice(1) : argv;
+
+  if (action === "show") {
+    const args = [...rest];
+    const wantsJson = takeFlag(args, "--json");
+    rejectArgs(args, USAGE);
+    const result = await runtimeRequest("/api/storage/cleanup-policy", {}, deps);
+    printData(result, wantsJson, summaryLines(result));
+    return;
+  }
+
+  if (action === "set") {
+    const args = [...rest];
+    const wantsJson = takeFlag(args, "--json");
+    const enabled = takeOption(args, "--enabled");
+    const percent = takeIntegerOption(args, "--percent", { min: 0 });
+    const mode = takeOption(args, "--mode");
+    const schedule = takeOption(args, "--schedule");
+    rejectArgs(args, USAGE);
+
+    if (enabled !== undefined && enabled !== "true" && enabled !== "false") {
+      throw new CliUsageError("--enabled must be true or false", USAGE);
+    }
+    const body: Record<string, unknown> = {};
+    if (enabled !== undefined) body.enabled = enabled === "true";
+    if (percent !== undefined) body.percent = percent;
+    if (mode !== undefined) body.mode = mode;
+    if (schedule !== undefined) body.schedule = schedule;
+    if (Object.keys(body).length === 0) {
+      throw new CliUsageError("policy set needs at least one of --enabled, --percent, --mode, --schedule", USAGE);
+    }
+    // Values are NOT re-validated here beyond --enabled's shape. The server owns the mode and
+    // schedule vocabularies and returns a named 400; duplicating them is a second thing to
+    // keep in sync. `enabled` is checked because "--enabled maybe" would otherwise be sent as
+    // `false`, which is a wrong write rather than a rejected one.
+    const result = await runtimeRequest("/api/storage/cleanup-policy", {
+      method: "PUT",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(body),
+    }, deps);
+    printData(result, wantsJson, summaryLines(result));
+    return;
+  }
+
+  if (action !== "run") throw new CliUsageError(`unknown policy action ${action}`, USAGE);
+
+  const args = [...rest];
+  const wantsJson = takeFlag(args, "--json");
+  const confirmed = takeFlag(args, "--yes");
+  rejectArgs(args, USAGE);
+  // `force: true` server-side: this run ignores the schedule and deletes now.
+  if (!confirmed) {
+    throw new CliUsageError("policy run deletes archived sessions now; pass --yes to confirm", USAGE);
+  }
+  const result = await runtimeRequest("/api/storage/cleanup-policy/run", { method: "POST" }, deps);
+  printData(result, wantsJson, summaryLines(result));
+}
+
+export async function handleStorageCommand(argv: string[], deps: RuntimeApiDeps = {}): Promise<number> {
+  const hasSub = argv[0] !== undefined && !argv[0].startsWith("-");
+  const sub = hasSub ? argv[0]! : "report";
+  const rest = hasSub ? argv.slice(1) : argv;
+  if (sub === "codex-logs") {
+    // Doctor and the Log Guard guides still document `ocx storage codex-logs …`.
+    // This module owns cleanup/trash/policy; log-guard stays on the observe handler.
+    const { handleObserveCommand } = await import("./observe");
+    return handleObserveCommand(["storage", "codex-logs", ...rest], deps);
+  }
+  return runCliAction(async () => {
+    if (sub === "report") {
+      const args = [...rest];
+      const wantsJson = takeFlag(args, "--json");
+      rejectArgs(args, USAGE);
+      const result = await runtimeRequest("/api/storage", {}, deps);
+      printData(result, wantsJson, summaryLines(result));
+    }
+    else if (sub === "cleanup") await cleanup(rest, deps);
+    else if (sub === "trash") await trash(rest, deps);
+    else if (sub === "policy") await policy(rest, deps);
+    else throw new CliUsageError(`unknown storage command ${sub}`, USAGE);
+  });
+}
+
+export const STORAGE_USAGE = USAGE;

package/src/cli/system-command.ts

@@ -17,6 +17,8 @@ const USAGE = `Usage:
   ocx system startup <health|install-service|install-shim> [--json]
   ocx system diagnostics [--json]
   ocx system sync [--json]
+  ocx system codex-app-server [--json]
+  ocx system codex-restart --yes [--json]
   ocx system update check [--channel <latest|preview>] [--json]
   ocx system update run [--channel <latest|preview>] [--restart <on|off>] --yes [--json]
   ocx system update status <job-id> [--json]`;
@@ -104,6 +106,20 @@ export async function handleSystemCommand(argv: string[], deps: RuntimeApiDeps =
     } else if (sub === "sync") {
       const args = [...rest]; const wantsJson = takeFlag(args, "--json"); rejectArgs(args, USAGE);
       printData(await runtimeRequest("/api/sync", { method: "POST" }, deps), wantsJson);
+    } else if (sub === "codex-app-server") {
+      // The GUI reads this state directly (gui/src/codex-app-server-state.ts). Without a verb
+      // an agent could not see whether the Codex app-server was reachable at all.
+      const args = [...rest]; const wantsJson = takeFlag(args, "--json"); rejectArgs(args, USAGE);
+      printData(await runtimeRequest("/api/system/codex-app-server", {}, deps), wantsJson);
+    } else if (sub === "codex-restart") {
+      // --yes required: this restarts the user's running Codex app-server, so it is exactly the
+      // class of action that must not happen because an agent guessed a subcommand.
+      const args = [...rest];
+      const wantsJson = takeFlag(args, "--json");
+      const yes = takeFlag(args, "--yes");
+      if (!yes) throw new CliUsageError("system codex-restart requires --yes", USAGE);
+      rejectArgs(args, USAGE);
+      printData(await runtimeRequest("/api/system/codex-restart", { method: "POST" }, deps), wantsJson, ["Codex app-server restart requested."]);
     } else if (sub === "update") await update(rest, deps);
     else throw new CliUsageError(`unknown system command ${sub}`, USAGE);
   });

package/src/cli/usage-report.ts

@@ -38,10 +38,34 @@ interface UsageReportInput {
   providers?: CostRow[];
   days?: { date: string; requests: number; totalTokens: number; estimatedCostUsd?: number }[];
   filter?: { provider: string | null; model: string | null; matched: boolean; comboOverlap: boolean };
+  /**
+   * Per-account totals the API already returns and the CLI discarded (#2700).
+   *
+   * Withheld by the server -- sent as `[]` -- whenever a provider or model filter is active,
+   * because account rows are not provider-partitioned in a way the projection could honestly
+   * re-derive (summary.ts, reasoned around :865-872). An empty array therefore means two very
+   * different things, and the renderer must say which.
+   */
+  accounts?: {
+    accountLogLabel: string;
+    ambiguous?: boolean;
+    requests: number;
+    totalTokens: number;
+    estimatedCostUsd?: number;
+  }[];
 }
 
 const MAX_MODEL_ROWS = 10;
 
+function terminalText(value: string): string {
+  return value.replace(/[\x00-\x1f\x7f-\x9f]/g, character => {
+    const code = character.charCodeAt(0);
+    return code <= 0x7f
+      ? `\\x${code.toString(16).padStart(2, "0")}`
+      : `\\u${code.toString(16).padStart(4, "0")}`;
+  });
+}
+
 function count(value: number | undefined): string {
   return (value ?? 0).toLocaleString("en-US");
 }
@@ -58,6 +82,8 @@ function usd(value: number | undefined): string {
 
 function table(header: string[], rows: string[][]): string[] {
   if (rows.length === 0) return [];
+  header = header.map(terminalText);
+  rows = rows.map(row => row.map(terminalText));
   const widths = header.map((h, i) => Math.max(h.length, ...rows.map(r => (r[i] ?? "").length)));
   const line = (cols: string[]): string => cols.map((c, i) => (c ?? "").padEnd(widths[i]!)).join("  ").trimEnd();
   return [line(header), ...rows.map(line)];
@@ -68,7 +94,7 @@ function describeScope(data: UsageReportInput): string {
   if (data.surface && data.surface !== "all") parts.push(`surface=${data.surface}`);
   if (data.filter?.provider) parts.push(`provider=${data.filter.provider}`);
   if (data.filter?.model) parts.push(`model=${data.filter.model}`);
-  return parts.join(", ");
+  return terminalText(parts.join(", "));
 }
 
 export function formatUsageReport(data: UsageReportInput): string[] {
@@ -78,7 +104,7 @@ export function formatUsageReport(data: UsageReportInput): string[] {
   if (data.filter && !data.filter.matched) {
     const what = [data.filter.provider && `provider "${data.filter.provider}"`, data.filter.model && `model "${data.filter.model}"`]
       .filter(Boolean).join(" and ");
-    lines.push(`No usage recorded for ${what} in this range.`);
+    lines.push(`No usage recorded for ${terminalText(what)} in this range.`);
     lines.push("Check the spelling against `ocx usage --json`, or widen --range.");
     return lines;
   }
@@ -110,6 +136,30 @@ export function formatUsageReport(data: UsageReportInput): string[] {
     ));
   }
 
+  // Per-account spend (#2700). The two empty cases are distinguished deliberately: printing an
+  // empty table under a filter would repeat the silently-wrong-output defect this unit removes,
+  // because "what did this provider cost me per account" is the most natural way to ask and the
+  // server cannot answer it honestly.
+  const accountFilterActive = Boolean(data.filter?.provider || data.filter?.model);
+  const accounts = (data.accounts ?? []).filter(row => row.requests > 0);
+  if (accountFilterActive) {
+    lines.push("");
+    lines.push("ACCOUNT: not reported under a provider or model filter; run without filters for per-account totals.");
+  } else if (accounts.length > 0) {
+    lines.push("");
+    lines.push(...table(
+      ["ACCOUNT", "REQUESTS", "TOKENS", "EST. COST"],
+      accounts.map(row => [
+        // An ambiguous row aggregates several accounts, so reading it as one account draws the
+        // wrong conclusion. Mark it rather than presenting it as a single identity.
+        row.ambiguous ? `${terminalText(row.accountLogLabel)} (ambiguous)` : terminalText(row.accountLogLabel),
+        count(row.requests),
+        count(row.totalTokens),
+        usd(row.estimatedCostUsd),
+      ]),
+    ));
+  }
+
   const models = (data.models ?? []).filter(row => row.requests > 0);
   if (models.length > 0) {
     lines.push("");

package/src/cli/version-skew.ts

@@ -0,0 +1,46 @@
+/**
+ * CLI-versus-proxy version skew (#2701).
+ *
+ * The reported failure: `ocx` on PATH is an older install than the running proxy, so its
+ * help describes commands the proxy does not have and its output describes a different
+ * build. Nothing surfaced that, because the CLI never compared the two.
+ *
+ * Kept in its own module rather than inside `status.ts` so `doctor` can reuse the exact
+ * comparison instead of reimplementing it -- two diagnostics disagreeing about whether an
+ * install is stale would be worse than neither reporting it.
+ */
+
+/** Placeholder versions that mean "unknown", not "different". */
+const PLACEHOLDERS = new Set(["unknown", "0.0.0"]);
+
+export interface VersionSkew {
+  readonly cliVersion: string;
+  /** Version the live proxy reported, or null when nothing is live or it reported none. */
+  readonly proxyVersion: string | null;
+  readonly skewed: boolean;
+  /** Operator-facing explanation; null when there is nothing to report. */
+  readonly warning: string | null;
+}
+
+/**
+ * Compare the running CLI against the live proxy.
+ *
+ * Suppressed rather than reported when either side is a placeholder. `packageVersion()`
+ * answers `"unknown"` when `package.json` carries no string version, and the server's
+ * `VERSION` falls back to `"0.0.0"` when it cannot resolve its own package -- comparing
+ * against either would report skew that says nothing about the install. A false stale-CLI
+ * warning would send an operator to reinstall a healthy setup.
+ */
+export function computeVersionSkew(cliVersion: string, proxyVersion: string | undefined): VersionSkew {
+  const proxy = proxyVersion ?? null;
+  if (proxy === null || PLACEHOLDERS.has(proxy) || PLACEHOLDERS.has(cliVersion) || proxy === cliVersion) {
+    return { cliVersion, proxyVersion: proxy, skewed: false, warning: null };
+  }
+  return {
+    cliVersion,
+    proxyVersion: proxy,
+    skewed: true,
+    warning: `CLI ${cliVersion} does not match the running proxy ${proxy} — this ocx on PATH is stale. `
+      + "Its help and features describe a different build. Reinstall, or run the proxy's own binary.",
+  };
+}

package/src/codex/account-label.ts

@@ -5,6 +5,27 @@ import { MAIN_CODEX_ACCOUNT_ID } from "./main-account";
 
 export const CODEX_ACCOUNT_LOG_LABEL_RE = /^p[a-f0-9]{6}$/;
 
+/**
+ * Account log labels come in two families (#2699):
+ *
+ * - `p<hex6>` (plus the literal `main`) — a Codex pool account.
+ * - `o<hex6>` — a non-Codex OAuth provider account (xai, cursor, and siblings).
+ *
+ * Both are sha256-derived digests, never an email and never a raw provider account id. That is
+ * a privacy requirement, not a formatting preference: these labels are written to the usage log
+ * and served over the management API.
+ *
+ * hex6 is 16.7M values, so two accounts CAN collide and merge into one reported row. That is a
+ * reporting inaccuracy at operator scale, not a correctness or privacy failure, and it is the
+ * accepted cost of keeping the existing `p` format byte-compatible.
+ */
+export const OAUTH_ACCOUNT_LOG_LABEL_RE = /^o[a-f0-9]{6}$/;
+export const ACCOUNT_LOG_LABEL_RE = /^(?:main|[po][a-f0-9]{6})$/;
+
+export function oauthAccountLogLabel(accountId: string, provider = ""): string {
+  return `o${createHash("sha256").update(`${provider}\0${accountId}`).digest("hex").slice(0, 6)}`;
+}
+
 export function createCodexAccountLogLabel(existingLabels: Iterable<string | undefined | null> = []): string {
   const used = new Set([...existingLabels].filter((value): value is string => !!value));
   for (let i = 0; i < 16; i++) {

package/src/codex/catalog/provider-fetch.ts

@@ -46,6 +46,7 @@ import { routedSlug, slugEquals, slugEquivalenceKey, slugsEquivalent } from "../
 import { CODEX_GPT5_IDENTITY_LINE } from "../../adapters/identity";
 import { filterCursorConfiguredModelsByLiveDiscovery } from "../../adapters/cursor/discovery";
 import { fetchCursorUsableModels } from "../../adapters/cursor/live-models";
+import { recordLiveCursorMaxModeModels } from "../../adapters/cursor/catalog";
 import { isCanonicalOpenAiForwardProvider, OPENAI_API_PROVIDER_ID, OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers";
 import {
   COMBO_NAMESPACE,
@@ -1330,6 +1331,9 @@ async function fetchProviderModelsWithAuth(
     });
     if (liveResult.ok) {
       const available = filterCursorConfiguredModelsByLiveDiscovery(configured, liveResult.models);
+      // Live Max-Mode evidence feeds the umbrella resolver's ultra gate
+      // (devlog 260828_cursor_umbrella_catalog; union with static evidence).
+      recordLiveCursorMaxModeModels(liveResult.maxModeModels ?? []);
       const result = available.length > 0 ? available : configured;
       // Cache the discovery-filtered roster without combo retention so a later
       // gather can re-apply the current capture's retain set on read.

package/src/codex/convergence.ts

@@ -1,10 +1,13 @@
 import { join } from "node:path";
 
-import { getConfigDir, saveConfigPreservingClaudeCode, websocketsEnabled, withExpectedConfigGenerationSync } from "../config";
-import { reconcileSuccessfulModelDiscoveries } from "../providers/new-model-policy";
+import { getConfigDir, mutatePersistedConfig, websocketsEnabled, withExpectedConfigGenerationSync } from "../config";
+import {
+  reconcileSuccessfulModelDiscoveries,
+  type KnownModelBaseline,
+} from "../providers/new-model-policy";
 import { COMBO_NAMESPACE } from "../combos";
 import { getAuthStorePath } from "../oauth/store";
-import type { OcxConfig } from "../types";
+import type { OcxConfig, OcxProviderConfig } from "../types";
 import { captureCatalogAdmissionSnapshot } from "./catalog-admission";
 import { legacyCustomModelCatalogSlugs } from "./custom-model-catalog-migration";
 import {
@@ -137,7 +140,22 @@ interface CandidateState {
   readonly changed: boolean;
   readonly notices: readonly CatalogNotice[];
   readonly modelEntitlements: CodexModelEntitlementSnapshot;
-  readonly discoveryConfig?: OcxConfig;
+  readonly discovery: DiscoveryEvidence;
+}
+
+interface DiscoveryEvidence {
+  readonly models: readonly { provider: string; id: string; custom?: boolean }[];
+  readonly authoritativeProviders: readonly string[];
+  readonly providerIdentities: Readonly<Record<string, string>>;
+  readonly now: string;
+}
+
+interface DiscoveryProjection {
+  readonly providers: Readonly<Record<string, Readonly<{
+    knownModel?: KnownModelBaseline;
+    recentArrivals?: readonly { id: string; at: string }[];
+  }>>>;
+  readonly disabledModelsToAdd: readonly string[];
 }
 
 const candidateStates = new WeakMap<object, CandidateState>();
@@ -145,6 +163,16 @@ function same(left: unknown, right: unknown): boolean {
   return JSON.stringify(left) === JSON.stringify(right);
 }
 
+function discoveryProviderIdentity(provider: OcxProviderConfig | undefined): string {
+  if (!provider) return "missing";
+  const row: Record<string, unknown> = { ...provider };
+  delete row.note;
+  delete row.newModelPolicy;
+  return JSON.stringify(row, (_key, value) => value && typeof value === "object" && !Array.isArray(value)
+    ? Object.fromEntries(Object.entries(value as Record<string, unknown>).sort(([left], [right]) => left.localeCompare(right)))
+    : value);
+}
+
 function targetPath(identity: string): string {
   const parsed = JSON.parse(identity) as { path?: unknown };
   if (typeof parsed.path !== "string") throw new TypeError("Catalog target identity has no path.");
@@ -441,13 +469,15 @@ export async function gatherCodexCatalogCandidate(
           : !hasRoutedEntries(source.catalog) ? source.catalog : null)
         : null);
     const discoveryConfig = structuredClone(snapshot.config) as OcxConfig;
-    const discoveryChanged = reconcileSuccessfulModelDiscoveries({
+    const authoritativeProviders = providerModelOutcomes
+      .filter(outcome => outcome.state === "authoritative")
+      .map(outcome => outcome.provider);
+    const discoveryNow = new Date().toISOString();
+    reconcileSuccessfulModelDiscoveries({
       config: discoveryConfig,
       models: routedModels,
-      authoritativeProviders: providerModelOutcomes
-        .filter(outcome => outcome.state === "authoritative")
-        .map(outcome => outcome.provider),
-      now: new Date().toISOString(),
+      authoritativeProviders,
+      now: discoveryNow,
     });
     const preparedCatalog = prepareCatalog(
       discoveryConfig,
@@ -515,7 +545,15 @@ export async function gatherCodexCatalogCandidate(
         || Buffer.from(cacheBytes ?? []).toString("utf8") !== preparedCacheBytes,
       notices: Object.freeze([...notices]),
       modelEntitlements,
-      ...(discoveryChanged ? { discoveryConfig } : {}),
+      discovery: {
+        models: routedModels,
+        authoritativeProviders,
+        providerIdentities: Object.fromEntries(authoritativeProviders.map(provider => [
+          provider,
+          discoveryProviderIdentity(snapshot.config.providers[provider]),
+        ])),
+        now: discoveryNow,
+      },
     });
     return { kind: "candidate", candidate };
   } catch (error) {
@@ -532,6 +570,63 @@ export async function gatherCodexCatalogCandidate(
   }
 }
 
+function reconcilePersistedDiscovery(state: CandidateState) {
+  return mutatePersistedConfig(config => {
+    if (state.discovery.authoritativeProviders.some(provider => (
+      discoveryProviderIdentity(config.providers[provider]) !== state.discovery.providerIdentities[provider]
+    ))) {
+      return { changed: false, value: null };
+    }
+    const disabledBefore = new Set(config.disabledModels ?? []);
+    const changed = reconcileSuccessfulModelDiscoveries({
+      config,
+      ...state.discovery,
+    });
+    const providers = Object.fromEntries(state.discovery.authoritativeProviders.flatMap(provider => {
+      const configured = config.providers[provider];
+      if (!configured || configured.liveModels === false) return [];
+      const knownModel = config.modelDiscovery?.knownModels?.[provider];
+      const recentArrivals = config.modelDiscovery?.recentArrivals?.[provider];
+      return [[provider, {
+        ...(knownModel ? { knownModel: structuredClone(knownModel) } : {}),
+        ...(recentArrivals ? { recentArrivals: structuredClone(recentArrivals) } : {}),
+      }]];
+    }));
+    return {
+      changed,
+      value: {
+        providers,
+        disabledModelsToAdd: (config.disabledModels ?? []).filter(slug => !disabledBefore.has(slug)),
+      } satisfies DiscoveryProjection,
+    };
+  });
+}
+
+function adoptDiscoveryProjection(config: OcxConfig, projection: DiscoveryProjection): void {
+  for (const [provider, discovered] of Object.entries(projection.providers)) {
+    if (discovered.knownModel) {
+      const discovery = config.modelDiscovery ??= {};
+      const knownModels = discovery.knownModels ??= {};
+      knownModels[provider] = structuredClone(discovered.knownModel);
+    } else if (config.modelDiscovery?.knownModels) {
+      delete config.modelDiscovery.knownModels[provider];
+    }
+    if (discovered.recentArrivals) {
+      const discovery = config.modelDiscovery ??= {};
+      const recentArrivals = discovery.recentArrivals ??= {};
+      recentArrivals[provider] = discovered.recentArrivals.map(arrival => ({ ...arrival }));
+    } else if (config.modelDiscovery?.recentArrivals) {
+      delete config.modelDiscovery.recentArrivals[provider];
+    }
+  }
+  if (projection.disabledModelsToAdd.length > 0) {
+    const disabledModels = config.disabledModels ??= [];
+    for (const slug of projection.disabledModelsToAdd) {
+      if (!disabledModels.includes(slug)) disabledModels.push(slug);
+    }
+  }
+}
+
 function revalidateCandidate(state: CandidateState): CodexCatalogCommitResult | null {
   if (!isCodexModelEntitlementSnapshotCurrent(state.modelEntitlements)) {
     return { kind: "stale", reason: "account-entitlement" };
@@ -663,11 +758,11 @@ export async function convergeCodexCatalog(
   const state = candidateStates.get(gathered.candidate as object)!;
   lifecycle.onCommitBegin?.();
   const committed = await commitCodexCatalogCandidate(gathered.candidate, request.deadlineMs);
-  if (committed.kind === "committed" && state.discoveryConfig) {
-    const mutable = snapshot.config as OcxConfig;
-    mutable.modelDiscovery = state.discoveryConfig.modelDiscovery;
-    mutable.disabledModels = state.discoveryConfig.disabledModels;
-    saveConfigPreservingClaudeCode(mutable);
+  if (committed.kind === "committed") {
+    const persisted = reconcilePersistedDiscovery(state);
+    if ((persisted.status === "committed" || persisted.status === "unchanged") && persisted.value) {
+      adoptDiscoveryProjection(snapshot.config as OcxConfig, persisted.value);
+    }
   }
   return {
     changed: committed.kind === "committed" ? committed.changed : false,

package/src/codex/transition-state.ts

@@ -280,7 +280,16 @@ export interface CodexCoordinatorAdoptionOptions {
   readonly onCheckpoint?: (checkpoint: CodexCoordinatorAdoptionCheckpoint) => void;
 }
 
-function fsyncPath(path: string): void {
+function fsyncFile(path: string): void {
+  // Writable fd on purpose. Windows FlushFileBuffers needs GENERIC_WRITE;
+  // openSync(path, "r") is GENERIC_READ only and fails with EPERM (measured on
+  // Windows 11 25H2 / bun 1.3.14). prompt-journal.ts uses the same "r+" open.
+  const fd = openSync(path, "r+");
+  try { fsyncSync(fd); } finally { closeSync(fd); }
+}
+
+function fsyncDir(path: string): void {
+  // POSIX directory fsync is O_RDONLY. O_RDWR ("r+") is EISDIR.
   const fd = openSync(path, "r");
   try { fsyncSync(fd); } finally { closeSync(fd); }
 }
@@ -316,12 +325,12 @@ function publishAdoptionDatabase(
     } finally {
       temp.close();
     }
-    fsyncPath(tempPath);
+    fsyncFile(tempPath);
     options.onCheckpoint?.("temp-committed");
 
     linkSync(tempPath, finalDatabasePath);
     options.onCheckpoint?.("published");
-    if (process.platform !== "win32") fsyncPath(parent);
+    if (process.platform !== "win32") fsyncDir(parent);
   } catch (error) {
     if (errorCode(error) !== "EEXIST") throw error;
   } finally {