fix(catalog): Codewhale corrections hold online, not only offline (#6396)

[Hmbown]

Stacked on #6618. The base is that branch, so this diff shows only this slice. GitHub retargets it to main once #6618 merges.

What was wrong

Codewhale's deliberate catalog holds existed only as hand edits to the offline seed (models_dev.bundled.json). They covered prices left out where a flat rate would mislead, and DeepSeek's output limit kept at its published 384K. A live Models.dev refresh replaces seed rows wholesale, so the holds disappeared on every networked install. Upstream today:

• MiMo and DeepSeek: priced.
• Alibaba Token and Coding Plan rows: listed at $0, which reads as free.
• DeepSeek output limit: 393216.

The "honesty" rule in the seed's _meta was prose that the runtime never read.

The fix

The holds now live in crates/config/assets/catalog_corrections.json as field patches in the cloud-facts ModelFact shape. The signed layer's patch code applies them to every Models.dev row as it is hydrated, whether it comes from the bundled seed (bundled_catalog_offerings) or a live refresh (live_offerings_from_models_dev). A correction therefore ranks above both Models.dev layers and below signed cloud facts and provider rosters. The same correction holds online and offline.

• ModelFact.pricing_withheld: Option<String> (a reason) clears the price, so the route reports PricingSku::UnknownOrStale. The field is optional, and payloads without it parse unchanged. Per-provider rules expand to one withheld-price patch per row.
• One patch path. catalog_patch::apply_patches is shared. Signed facts may create rows; corrections may not. The loader refuses:
  • hide, deprecate and allow_unlisted;
  • labels;
  • a patch that changes nothing;
  • a limit patch without a reason.
• A corrected row keeps its own source. The price a correction owns reports CatalogSource::CodewhaleBundled through cost_source. See the deviations section for why.
• Dead field removed. CatalogCompiler.codewhale_bundled was declared, but nothing had ever set it. The layer docs in catalog.rs, CATALOG_REFRESH.md and CLOUD_FACTS.md now describe the rank where corrections actually apply.

Reasoning controls (second commit)

Regenerating the seed in #6612 turned up a second kind of hold that works only offline: reasoning controls. Before this change, a live refresh replaced all of these, and the picker, /effort and the effort clamp all read them:

• Grok: default effort high (xAI docs, Thinking display: Grok 4.7 and Xiaomi 2.6 render incorrectly; audit all supported reasoning formats #6501).
• MiniMax M2.7: thinking always on.
• MiniMax M3: thinking is adaptive or disabled, with a different default per dialect.
• qwen3.8-max: thinking-only.
• Muse Spark: also takes the none and ultra efforts.
• Step 3.5: reasoning is adaptive.

ModelFact.reasoning_options (optional) replaces a row's controls and keeps any signed annotation already on the row. These 18 rows get corrections, each with the source it cites.

Two groups were left out:

• GLM-5.3's high/max ladder. It was only a placeholder inherited from GLM-5.2, and upstream now publishes low/high/max.
• The Coding Plan qwen budget_tokens entries. They were copies of Token Plan rows, not a Codewhale decision.

Each hold, checked again on its merits

Hold	Decision	Why
DeepSeek native pricing	kept (provider rule)	billed by time of day; crates/tui/src/pricing.rs has the time-aware table
xAI pricing	kept (provider rule)	upstream's own tiers field shows rates doubling past 200K
Xiaomi MiMo pricing	kept (provider rule)	PAYG and Token Plan keys cannot be told apart
Model Studio Token/Coding Plan pricing (4 providers)	kept (provider rules)	plan quota, not per-token; upstream 0 would read as free
StepFun pricing	kept (provider rule)	the same ids serve Step Plan and PAYG; pricing.rs has endpoint-scoped rates
DeepSeek native max_output 384000	kept, marked unverified	DeepSeek publishes 384K; upstream 393216 = 384×1024. Which value the API accepts is unverified, and the lower bound is always accepted. Settling it takes one real provider call (provider spend, so a human runs it)
MiniMax-M3 pricing	added	upstream tiers the price at 512K, the same rule as Grok. The seed already listed it unpriced without saying why
aggregator-hosted DeepSeek pricing (9 rows)	kept (restored in the third commit)	I dropped this first, then #6612's generated seed broke hosted_flash_and_pro_routes_price_from_bundled_docs_rates. crates/tui/src/pricing.rs prices these routes from a reviewed provider-docs table (Fireworks V4 Pro: 1.74 vs Models.dev 1.20), and a catalog rate outranks it
Novita DeepSeek max_output 384000	added	same published-384K question as native DeepSeek (upstream 393216)
grok-4.3 reasoning_options: []	added	xAI documents no effort control for 4.3 (#6501); upstream lists a ladder
OpenRouter dots-3-note-preview:free pricing	dropped	a free model's price is 0
zai GLM-5.3 pricing	kept (restored in the fourth commit)	I first dropped it, reasoning that zai was the pay-as-you-go API. That was wrong: DEFAULT_ZAI_BASE_URL is the Coding Plan (api/coding/paas/v4), which bills credits
MiMo 2.6 text-only image input	dropped	#6618 made a stale text-only row harmless; holding it down would strip images
MiMo 1,000,000 context	dropped	the only citation was our own rows; upstream says 1,048,576

Deviations from the approved design

• Where corrections apply. The design put corrections inside CatalogCompiler::compile. But CatalogCompiler is only used in tests; the runtime merge is crates/tui/src/provider_lake.rs::compute_merged_snapshot. Applying corrections at hydration, the single funnel both Models.dev layers pass through, reaches the resolver, the provider lake, pricing fallbacks and the export path without adding a second merge.
• Row source. The design relabelled corrected rows CodewhaleBundled. That moved a live Models.dev row across a layer boundary: CatalogCompiler::with_live sorts rows by source, so a relabelled row ranked above signed facts, and signed_facts_correct_a_live_models_dev_row_but_never_the_provider_roster failed. Rows now keep their source, and only the owned price is attributed to CodewhaleBundled.

Not in this PR

• Tiered pricing is inconsistent. Upstream tiers 569 rows by prompt length. The seed prices the OpenAI gpt-5.5/5.6 rows (tier at 272K) and three OpenRouter Qwen rows (256K) at their base rate while withholding Grok and MiniMax-M3. The real fix is tier-aware pricing, not more holds, and it needs its own issue.
• A third offline store still overlaps. The legacy crates/models/assets/model_catalog.bundled.json duplicates some of these facts. Its module doc already schedules removal once the models/pricing compat callers migrate.
• Upstream providers are matched by id. A new upstream MiMo or Model Studio id is covered by the provider rules, but a new upstream provider id is not.

Verification

• CARGO_BUILD_JOBS=3 scripts/dev-cargo.sh test -p codewhale-config --lib: 707 passed, 0 failed, 1 ignored (after the second commit)
• CARGO_BUILD_JOBS=3 scripts/dev-cargo.sh test -p codewhale-config --test configured_models: 9 passed
• CARGO_BUILD_JOBS=3 scripts/dev-cargo.sh test -p codewhale-tui --lib -- vision image badge capabilit pricing provider_lake models_dev_live model_picker provider_catalog_live catalog deepseek xiaomi mimo modelstudio grok stepfun minimax effort reasoning thinking muse: 1169 passed, 0 failed, 2 ignored (after the second commit)
  • One earlier run failed route_budget::tests::uncatalogued_remote_model_keeps_a_conservative_ceiling. It passes alone and on rerun. It reads output-limit env vars without taking the env lock.
• cargo fmt --all -- --check: clean
• clippy on -p codewhale-config -p codewhale-tui --all-targets --all-features with CI's flags: clean
• check-blocking-calls-budget.py, check-dead-code-budget.py, check-command-crate-boundaries.py, split/module_graph.py --check: pass
• Changelog chain (sync, derive-*, check-versions.sh --range-audit-advisory, contributor credit, public-copy.test.ts 6/6): pass

New tests cover:

• a live MiMo, Alibaba-plan or DeepSeek row reads as unknown price (never free);
• DeepSeek output clamped live and offline;
• a signed fact still overrides a correction;
• corrections never add or hide rows, and the loader refuses the forbidden shapes;
• pricing_withheld round-trips through serde, and older payloads still parse;
• every committed correction names a row the seed carries.

Refs #6396

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.