cartethyia 2.5.4 → 2.5.7

package/src/console/console-router-guards.ts

@@ -14,7 +14,7 @@ import { parseCookieValue, SESSION_COOKIE_NAME, isCsrfValid } from "../security/
 /**
  * Stateless double-submit CSRF guard for unsafe `/console/api/*` mutations.
  * Compares the `x-csrf-token` header against the readable `csrf_token`
- * cookie — zero database I/O, so dashboard writes no longer pay a token
+ * cookie — zero database I/O, so dashboard writes pay no token
  * SELECT + UPDATE on top of the session lookup, and there is no token
  * store whose outage could masquerade as an auth failure.
  */

package/src/console/data-management/contracts.ts

@@ -4,9 +4,9 @@
  *
  * Everything here is files on disk, except one deliberate row-level action.
  * Reclaiming a file is safe because the data it held is already past the point
- * where the gateway would read it: payload frames expire 15 minutes after they
- * are written, and telemetry files past the retention window are outside every
- * query's scan bound. Deleting rows is a different decision with a different
+ * where the gateway would read it: payload frames expire after the tenant's
+ * chosen retention, and telemetry files past the retention window are outside
+ * every query's scan bound. Deleting rows is a different decision with a different
  * blast radius, and the only row data the console offers purging is the health
  * & error log — purely an operator's diagnostic trail with no request-path
  * reader, unlike everything else in this panel.
@@ -19,7 +19,7 @@
 /** One measured category of on-disk data. */
 export interface DiskUsageBucket {
   /** Stable id, so the dashboard can key rows without matching on copy. */
-  readonly id: "telemetry_hourly" | "telemetry_compacted" | "payload_frames";
+  readonly id: "telemetry_events" | "telemetry_index" | "payload_frames";
   readonly label: string;
   readonly bytes: number;
   readonly files: number;
@@ -35,8 +35,15 @@ export interface DiskUsageResponse {
   readonly totalBytes: number;
   /** Retention in days; telemetry older than this is outside every scan. */
   readonly retentionDays: number;
-  /** Payload frames live this long before they are reclaimable. */
+  /** Payload frames live this long by default before they are reclaimable. */
   readonly payloadRetentionMs: number;
+  /**
+   * The longest retention a tenant may have chosen. A frame is only counted as
+   * reclaimable once it is older than *this*, because a tenant who raised the
+   * window has frames the default would call dead while their rows still
+   * address them.
+   */
+  readonly payloadRetentionMaxMs: number;
   /**
    * Stored health & error rows, for the purge row's label. Absent when the
    * composition does not wire the health-event store (a reduced console),
@@ -45,7 +52,7 @@ export interface DiskUsageResponse {
   readonly healthEventCount?: number;
 }
 
-export type ReclaimAction = "payload_frames" | "telemetry_retention" | "telemetry_hourly";
+export type ReclaimAction = "payload_frames" | "telemetry_retention";
 
 export interface ReclaimResponse {
   readonly action: ReclaimAction;

package/src/console/data-management/operations.ts

@@ -35,11 +35,12 @@ export interface DataManagementConfig {
   readonly retentionDays: number;
   readonly payloadRetentionMs: number;
   /**
-   * Whether hourly files may be dropped from the console. Off unless a caller
-   * opts in: an hourly file still inside the compaction window is the only
-   * copy of its requests, so removing one loses real history.
+   * The longest payload retention a tenant may have chosen, and therefore the
+   * only cutoff a frame file can be judged dead against without reading it.
+   * Defaults to `payloadRetentionMs` for callers that predate per-tenant
+   * retention, which is then the true ceiling in that deployment.
    */
-  readonly allowHourlyReclaim: boolean;
+  readonly payloadRetentionMaxMs?: number;
   /**
    * The health & error log store, backing the console's only row-level purge.
    * Absent (a reduced console composition) means the purge is not offered
@@ -79,9 +80,8 @@ async function scan(
 
 const isIndex = (name: string): boolean => name.endsWith(".index.json");
 const isHourly = (name: string): boolean => name.endsWith(".events.jsonl");
-// Both extensions: old `.jsonb` files are still on disk and still counted.
 const isFrame = (name: string): boolean =>
-  name.endsWith(".jsonl") || name.endsWith(".jsonb");
+  name.endsWith(".jsonl");
 
 /** The UTC day a telemetry file name starts with, compared to a cutoff. */
 function dayBefore(name: string, cutoff: number): boolean {
@@ -91,10 +91,19 @@ function dayBefore(name: string, cutoff: number): boolean {
 
 export function createDataManagementOperations(config: DataManagementConfig) {
   const payloadDir = (): string => payloadDirectory();
+  /**
+   * The only cutoff a frame file can be judged dead against without parsing it.
+   *
+   * A file's mtime says when it was last written, not what its frames' tenants
+   * chose — so a file written an hour ago can hold a frame with a week to live.
+   * The ceiling is therefore the bound, and the default retention is only used
+   * when no ceiling was configured.
+   */
+  const payloadMax = (): number => config.payloadRetentionMaxMs ?? config.payloadRetentionMs;
 
   async function usage(): Promise<DiskUsageResponse> {
     const retentionCutoff = Date.now() - config.retentionDays * 24 * 60 * 60_000;
-    const payloadCutoff = Date.now() - config.payloadRetentionMs;
+    const payloadCutoff = Date.now() - payloadMax();
 
     const [hourly, compacted, staleCompacted, frames, staleFrames, healthEventCount] = await Promise.all([
       scan(config.telemetryDir, isHourly),
@@ -107,8 +116,8 @@ export function createDataManagementOperations(config: DataManagementConfig) {
 
     const buckets: DiskUsageBucket[] = [
       {
-        id: "telemetry_hourly",
-        label: "Daily request files",
+        id: "telemetry_events",
+        label: "Request event files",
         bytes: hourly.bytes,
         files: hourly.files,
         note: "Feeds the request list and detail drawer.",
@@ -116,7 +125,7 @@ export function createDataManagementOperations(config: DataManagementConfig) {
         reclaimableFiles: null,
       },
       {
-        id: "telemetry_compacted",
+        id: "telemetry_index",
         label: "Day indexes",
         bytes: compacted.bytes,
         files: compacted.files,
@@ -131,7 +140,7 @@ export function createDataManagementOperations(config: DataManagementConfig) {
         files: frames.files,
         note: `Captured bodies, expiring ${Math.round(
           config.payloadRetentionMs / 60_000,
-        )} min after write.`,
+        )} min after write by default.`,
         reclaimableBytes: staleFrames.bytes,
         reclaimableFiles: staleFrames.files,
       },
@@ -142,6 +151,7 @@ export function createDataManagementOperations(config: DataManagementConfig) {
       totalBytes: buckets.reduce((sum, bucket) => sum + bucket.bytes, 0),
       retentionDays: config.retentionDays,
       payloadRetentionMs: config.payloadRetentionMs,
+      payloadRetentionMaxMs: payloadMax(),
       ...(healthEventCount === undefined ? {} : { healthEventCount }),
     };
   }
@@ -160,7 +170,7 @@ export function createDataManagementOperations(config: DataManagementConfig) {
       const now = new Date();
       const deletedFiles = await prunePayloadFrames(
         now,
-        new Date(now.getTime() - config.payloadRetentionMs),
+        new Date(now.getTime() - payloadMax()),
       );
       const after = await scan(payloadDir(), isFrame);
       return {
@@ -178,12 +188,7 @@ export function createDataManagementOperations(config: DataManagementConfig) {
         (isIndex(name) || isHourly(name)) && dayBefore(name, cutoff),
       );
     }
-    if (!config.allowHourlyReclaim) {
-      throw new ReclaimNotAllowedError(
-        "Hourly files are the only copy of their requests until compaction folds them up, so the console will not delete them.",
-      );
-    }
-    return unlinkWhere(action, config.telemetryDir, isHourly);
+    throw new ReclaimNotAllowedError(`Unknown reclaim action: ${action}`);
   }
 
   /** The one row-level deletion the console offers. */

package/src/console/data-management/routes.ts

@@ -11,7 +11,6 @@ const reclaimBody = t.Object({
   action: t.Union([
     t.Literal("payload_frames"),
     t.Literal("telemetry_retention"),
-    t.Literal("telemetry_hourly"),
   ]),
 });
 

package/src/console/domain-registration.ts

@@ -36,11 +36,14 @@ import { createModelAbuseRoutes } from "./admin/model-abuse/routes";
 import { DrizzleAuditReadStore } from "./audit/store";
 import { createPerformanceRoutes } from "./observability/performance";
 import { createUpdateRoutes } from "./updates/routes";
+import { createRemoteSupportRoutes } from "./remote-support/routes";
+import { createRemoteSupportService } from "./remote-support/service";
+import { resolvePort } from "../config/runtime";
 import { createBackupRoutes } from "./backup/routes";
 import { BackupService } from "./backup/service";
 import type { ConsoleCredentialService } from "./auth/credentials";
 import { resolveTelemetryRetentionDays } from "../config/telemetry";
-import { payloadRetentionMs } from "../observability/payload-capture";
+import { MAX_PAYLOAD_RETENTION_MS, payloadRetentionMs } from "../observability/payload-capture";
 import { TELEMETRY_EVENT_DIR } from "../observability/event-log";
 
 import { InMemoryOAuthFlowStore, OAuthFlowStore } from "../providers/authentication/oauth-flow-store";
@@ -241,6 +244,10 @@ export function registerConsoleDomains(
     accessResolver: ctx.accessResolver,
     observabilityStore,
   }));
+  console.use(createRemoteSupportRoutes({
+    accessResolver: ctx.accessResolver,
+    service: createRemoteSupportService({ port: resolvePort() }),
+  }));
   console.use(createAuditRoutes({ store: auditReadStore, accessResolver: ctx.accessResolver }));
   if (ctx.modelStrikes) {
     console.use(createModelAbuseRoutes({
@@ -281,15 +288,13 @@ export function registerConsoleDomains(
     // same SSRF-validated fetch as every other egress.
     relayFetch: createValidatedFetch({ policy: resolveSsrfPolicy() }),
   }));
-  console.use(createRuntimeSettingsRoutes({ store: runtimeSettingsStore, accessResolver: ctx.accessResolver, auditSink: ctx.auditRecorder }));
+  console.use(createRuntimeSettingsRoutes({ store: runtimeSettingsStore, accessResolver: ctx.accessResolver, auditSink: ctx.auditRecorder, snapshotInvalidator: ctx.routeSnapshotService }));
   console.use(
     createDataManagementRoutes({
       telemetryDir: TELEMETRY_EVENT_DIR,
       retentionDays: resolveTelemetryRetentionDays(),
       payloadRetentionMs: payloadRetentionMs(),
-      // Hourly files are the only copy of their requests until compaction
-      // folds them up, so the console does not delete them on request.
-      allowHourlyReclaim: false,
+      payloadRetentionMaxMs: MAX_PAYLOAD_RETENTION_MS,
       accessResolver: ctx.accessResolver,
       auditSink: ctx.auditRecorder,
       flusher: ctx.flushBuffers,

package/src/console/observability/live.ts

@@ -32,6 +32,7 @@ import { networkPools } from "../../persistence/schema";
 import { subscribePoolHealth } from "../../network/pool-health-machine";
 import { poolByteSnapshot } from "../../network/pool/byte-accounting";
 import { consoleSseResponse, createConsoleSseStream } from "./sse";
+import { subscribeRequestCompleted } from "../../observability/request-notify";
 
 export interface LiveConfig {
   readonly accessResolver: ConsoleAccessResolver;
@@ -87,6 +88,27 @@ function withPoolBytes<T extends { poolId: string; currentInflight?: number }>(
 
 export function createLiveRoutes(config: LiveConfig): Elysia {
   return new Elysia()
+    .get("/live/requests/stream", ({ request, set }) => {
+      try {
+        const access = config.accessResolver(request);
+        requireScope(access, "dashboard:read");
+        const tenantId = access?.tenantId;
+        if (!tenantId) return errorResponse(new Error("Tenant required"), set, "Live operation failed");
+        set.headers["content-type"] = "text/event-stream";
+        set.headers["cache-control"] = "no-cache, no-transform";
+        set.headers["connection"] = "keep-alive";
+        set.headers["x-accel-buffering"] = "no";
+        return consoleSseResponse(
+          createConsoleSseStream(request.signal, ({ send }) => {
+            return subscribeRequestCompleted((notice) => {
+              if (notice.tenantId === tenantId) send("request_completed", notice);
+            });
+          }),
+        );
+      } catch (e) {
+        return errorResponse(e, set, "Live operation failed");
+      }
+    })
     .get("/live/in-flight", ({ request, set }) => {
       try {
         requireScope(config.accessResolver(request), "dashboard:read");

package/src/console/observability/store.ts

@@ -11,6 +11,7 @@ import { isGatewayError } from "../../observability/telemetry-status";
 import { queryIndexedBuckets, type IndexedBucket } from "../../observability/event-day-index";
 import {
   LATENCY_BUCKETS_MS,
+  numeric,
   percentileFromHistogram,
 } from "../../observability/event-compaction";
 import { cachedReadWithEtag, type CachedResult } from "../shared/read-through-cache";
@@ -198,9 +199,9 @@ const HEALTH_WINDOW_MS = 24 * 3_600_000;
 const TOP_N = 50;
 /**
  * How long a parsed window is shared. A dashboard poll fires ~8 usage
- * endpoints at once, and a slow parse used to outlive a 1.5 s window — so the
- * endpoints that missed it each re-read and re-parsed the same files, which is
- * how one page load became several full parses of the retention window.
+ * endpoints at once, and a slow parse outlives a 1.5 s window — so the
+ * endpoints that miss it each re-read and re-parse the same files, which is how
+ * one page load becomes several full parses of the retention window.
  */
 const PERIOD_MEMO_TTL_MS = 5_000;
 
@@ -264,10 +265,20 @@ export function summarizeBucketPerformance(
 ): UsagePerformanceSummary {
   let latencySum = 0;
   let latencyCount = 0;
+  let resolveSum = 0;
+  let resolveCount = 0;
+  let latencyMaxMs: number | null = null;
   const histogram: number[] = [];
   for (const bucket of buckets) {
     latencySum += bucket.latencySum;
     latencyCount += bucket.latencyCount;
+    // Read defensively: an index written before these fields existed carries
+    // neither, and summing `undefined` poisons the whole period with NaN —
+    // including the days that do have the data.
+    resolveSum += numeric(bucket.resolveSumMs);
+    resolveCount += numeric(bucket.resolveCount);
+    if (bucket.latencyMaxMs !== null)
+      latencyMaxMs = latencyMaxMs === null ? bucket.latencyMaxMs : Math.max(latencyMaxMs, bucket.latencyMaxMs);
     for (let index = 0; index < bucket.latencyHistogram.length; index += 1) {
       histogram[index] = (histogram[index] ?? 0) + (bucket.latencyHistogram[index] ?? 0);
     }
@@ -277,13 +288,17 @@ export function summarizeBucketPerformance(
       ? histogram
       : new Array<number>(LATENCY_BUCKETS_MS.length + 1).fill(0);
   return {
-    avgResolveMs: 0,
+    avgResolveMs: resolveCount > 0 ? resolveSum / resolveCount : 0,
     avgDurationMs: latencyCount > 0 ? latencySum / latencyCount : 0,
-    latencyP50Ms: percentileFromHistogram(fill, 50) ?? 0,
-    latencyP95Ms: percentileFromHistogram(fill, 95) ?? 0,
-    latencyP99Ms: percentileFromHistogram(fill, 99) ?? 0,
+    // `latencyMaxMs` is passed as the overflow answer: a percentile past the
+    // histogram's last edge is at most the slowest request actually recorded.
+    // Without it an overflow returned `null`, and `?? 0` turned a P95 of 40 s
+    // into "0 ms" — the slow tail reported as nothing at all.
+    latencyP50Ms: percentileFromHistogram(fill, 50, latencyMaxMs) ?? 0,
+    latencyP95Ms: percentileFromHistogram(fill, 95, latencyMaxMs) ?? 0,
+    latencyP99Ms: percentileFromHistogram(fill, 99, latencyMaxMs) ?? 0,
     latencySampleCount: latencyCount,
-    resolveSampleCount: 0,
+    resolveSampleCount: resolveCount,
   };
 }
 
@@ -340,9 +355,8 @@ export class DrizzleObservabilityStore implements ObservabilityStore {
   ) {}
 
   async health(tenantId: string): Promise<CachedResult<SystemHealthResponse>> {
-    // The only usage-family read that used to bypass both the 5 s in-process
-    // memo and the Redis read-through, so it re-parsed 24 hourly files every
-    // page load. Same 10 s TTL as `/system/usage`.
+    // Cached like its siblings: reading this directly re-parses 24 hourly files
+    // every page load. Same 10 s TTL as `/system/usage`.
     return this.readThroughWithEtag(
       this.usageCacheKey(tenantId, "24h", "health"),
       () => this.computeHealth(tenantId),
@@ -424,8 +438,8 @@ export class DrizzleObservabilityStore implements ObservabilityStore {
       p99 = percentile(latencies, 0.99);
       // Cached share of the prompt: cached/input, the same honest definition
       // usageSummary uses, so the health card and the Usage page cannot
-      // disagree. (This used to be prompt-share input/(input+output), which
-      // read ~99% and was mislabeled a cache hit rate.)
+      // disagree. (Cached share, not prompt share: input/(input+output) reads
+      // ~99% and mislabels it a cache hit rate.)
       cacheHitRate = inputTokens > 0 ? Math.round((cachedTokens / inputTokens) * 10000) / 100 : 0;
       avgTokensPerSec = tokensPerSecCount > 0 ? tokensPerSecSum / tokensPerSecCount : 0;
     } catch {
@@ -596,6 +610,15 @@ export class DrizzleObservabilityStore implements ObservabilityStore {
     let tokensPerSecCount = 0;
     const statuses = new Map<number, number>();
     for (const row of buckets) {
+      // Folded from the index's own per-status counts. These used to be left
+      // empty: the loop below never filled `statuses`, so every status chip and
+      // the requests-list filters read zero for any day whose events had been
+      // folded — while `requests` beside them read the real total.
+      for (const [status, count] of Object.entries(row.byStatus ?? {})) {
+        const code = Number(status);
+        if (!Number.isFinite(code)) continue;
+        statuses.set(code, (statuses.get(code) ?? 0) + count);
+      }
       requests += row.requests;
       inputTokens += row.inputTokens;
       outputTokens += row.outputTokens;
@@ -983,9 +1006,9 @@ export class DrizzleObservabilityStore implements ObservabilityStore {
   ): Promise<TelemetryEventListPage> {
     const before = decodeDatedCursor(cursor);
     // The cursor becomes an `until` bound inside the query, so `limit` applies
-    // to every page and not only the first. Filtering after the read forced the
-    // previous shape: a cursor page had to fetch the whole window to know where
-    // it ended, so `limit` was dropped the moment a cursor appeared.
+    // to every page and not only the first. Filtering after the read would force
+    // a cursor page to fetch the whole window to know where it ended, dropping
+    // `limit` the moment a cursor appears.
     //
     // `until` is inclusive while the cursor is exclusive, so rows at the exact
     // cursor timestamp are still compared by id here — the cheap part of the

package/src/console/observability/usage-dimensions.ts

@@ -7,11 +7,11 @@
  * dashboard offers one breakdown tab per member (kept in sync by hand).
  *
  * This module is intentionally free of Elysia / node:crypto so the dashboard
- * can re-export the tuple as a value. The dashboard previously reached it
- * through `./contracts`, which imports Elysia and — through
+ * can re-export the tuple as a value. Reaching it through `./contracts` would
+ * import Elysia and — through
  * `console/shared/errors` → `protocol/codecs` → `security/outbound-headers`
- * — `node:crypto`, so the browser bundle externalized a Node builtin and
- * carried a slice of the backend graph for one string list.
+ * — `node:crypto`, so the browser bundle would externalize a Node builtin and
+ * carry a slice of the backend graph for one string list.
  */
 export const USAGE_DIMENSIONS = ["model", "provider", "key", "client", "client_ip"] as const;
 

package/src/console/providers/catalog/catalog-projections.ts

@@ -46,13 +46,12 @@ export function endpointPathForProviderModel(
   // Operator profile > the provider's own static catalog > the generic
   // per-wire default.
   //
-  // The path is returned as declared. It used to be rewritten against the
-  // base URL, stripping a segment the base already carried so a versioned root
-  // would not join into `/v1/v1/chat/completions`. That machinery hid the
-  // mistake it was papering over: a provider whose base is already versioned
-  // has to declare its own path, exactly as `cline` and `qianfan` do. A wrong
-  // URL should reach the operator as the wrong URL, not be quietly corrected
-  // into a different address that may or may not be the one they meant.
+  // The path is returned as declared, never rewritten against the base URL.
+  // Stripping a segment the base already carried would paper over the mistake
+  // instead of surfacing it: a provider whose base is already versioned has to
+  // declare its own path, exactly as `cline` and `qianfan` do. A wrong URL
+  // should reach the operator as the wrong URL, not be quietly corrected into
+  // a different address that may or may not be the one they meant.
   const endpointPath =
     profile?.endpoint_paths_by_wire_family?.[wireFamily] ??
     staticEndpoints?.[wireFamily] ??

package/src/console/providers/catalog/model-operations.ts

@@ -60,9 +60,12 @@ export function createModelCatalogOperations(config: ProviderCatalogConfig) {
       },
     async listFlatModels(access: AccessDecision | undefined): Promise<readonly FlatModelCatalogEntry[]> {
       const a = requireTenantAnyScope(access, MODEL_READ_SCOPES);
-      const providers = await config.store.list(a.tenantId);
+      const [providers, allAccounts] = await Promise.all([
+        config.store.list(a.tenantId),
+        config.store.listAllAccounts(a.tenantId),
+      ]);
       const accountsByProvider = new Map<string, number>();
-      for (const account of await config.store.listAllAccounts(a.tenantId)) {
+      for (const account of allAccounts) {
         if (account.status === "active")
           accountsByProvider.set(account.providerId, (accountsByProvider.get(account.providerId) ?? 0) + 1);
       }

package/src/console/providers/catalog/provider-operations.ts

@@ -470,8 +470,8 @@ export function createProviderCatalogOperations(config: ProviderCatalogConfig) {
      * uses, so a batch cannot accept a shape the single create rejects. The
      * expensive per-account bookkeeping — the audit row and the routing snapshot
      * invalidation that forces a 10-table catalog rebuild — is done ONCE for the
-     * whole batch instead of once per account, which is most of why the old
-     * client-side loop scaled linearly with paste size.
+     * whole batch instead of once per account, so cost does not scale linearly
+     * with paste size the way a client-side loop over single creates would.
      *
      * Email/label enrichment is deliberately NOT done here. Persisting the
      * credential is local work (encrypt + hash + insert) and needs no upstream;
@@ -516,8 +516,8 @@ export function createProviderCatalogOperations(config: ProviderCatalogConfig) {
         if (created.account !== undefined) queueNewAccountCheckin(providerId, created.account);
       }
 
-      // One audit row per successful account, but written after the batch lands
-      // rather than inside the request path that used to await it per account.
+      // One audit row per batch, written after the batch lands rather than
+      // awaited per account inside the request path.
       if (result.created > 0) {
         await config.auditSink?.record({
           access: a,

package/src/console/providers/catalog/public-model-store.ts

@@ -359,11 +359,9 @@ export class PublicModelCatalogStore {
   /**
    * Lists the models this key may see.
    *
-   * `modelPrefix` is accepted and currently has NO effect on the result. It
-   * used to feed a `matchesModelPrefix(...) || isModelAllowed(...)` disjunct
-   * that was immediately followed by `isModelAllowed(...)` on its own — so the
-   * prefix could never add a row, and dropping it changes nothing. The
-   * parameter is kept so the call sites and the auth shape stay stable; if a
+   * `modelPrefix` is accepted and has NO effect on the result — a prefix
+   * disjunct fed into `isModelAllowed(...)` on its own could never add a row.
+   * The parameter is kept so the call sites and the auth shape stay stable; if a
    * real prefix filter is wanted later it needs to be an AND, not the OR it
    * was written as.
    */
@@ -449,12 +447,11 @@ export class PublicModelCatalogStore {
         tenantId === null ? row.providerRequiresAccount === false : activeProviderIds.has(row.providerId);
       if (!listed) continue;
       const qualified = `${row.providerId}/${row.modelId}`;
-      // The prefix test is deliberately gone from this path: the chain used to
-      // be `(prefixMatch || isAllowed)` followed by `isAllowed`, which reduces
-      // to `isAllowed` alone — the prefix disjunct could never change the
-      // outcome, only cost a second full pass over the catalog. Collapsing the
-      // four chained filters into one loop also drops the three intermediate
-      // arrays they materialized.
+      // The prefix test is deliberately gone from this path: `(prefixMatch ||
+      // isAllowed)` followed by `isAllowed` reduces to `isAllowed` alone — the
+      // prefix disjunct could never change the outcome, only cost a second full
+      // pass over the catalog. Collapsing the four chained filters into one loop
+      // also drops the three intermediate arrays they materialized.
       if (!isModelAllowed(snapshot, row.modelId, row.providerId)) continue;
       if (shadowsAliasOrCombo(row, aliasTargets, comboNames, snapshot)) continue;
       const capabilities = normalizeModalities(row.modalities);