fix(core): quarantine retired opencode-free model x-preview-f-free

[liuxiaocs7]

Summary

OpenCode Free offered Ox Alpha Free (x-preview-f-free) as a default-enabled, picker-visible free model, but the model has been retired upstream on OpenCode Zen — it is gone from the anonymous /models listing and every completion returns HTTP 401 {"type":"ModelError","message":"Model x-preview-f-free is not supported"} (verified live, 2026-08-30). models.dev still snapshots it as free + active, so the snapshot-derived free list (isFree && lifecycle !== 'deprecated' && functionCalling) kept offering a model that can no longer send.

This adds x-preview-f-free to OPENCODE_FREE_BROKEN_MODEL_IDS, the established deny-only quarantine. A single entry propagates through three existing paths: it is dropped from the opencodeFreeModelIds derivation (and thus from fallbackModels / defaultEnabledModelIds), filtered out of the picker catalog in buildConnectionModelCatalogEntries, and vetoed in authorizeConnectionModel so any stored selection cannot send. The dated comment records the removal condition: drop the entry once the models.dev snapshot marks it deprecated (or upstream serves it again).

A durable follow-up (out of scope here) is tracked in the issue: cross-check the derived free set against the live Zen /models listing at metadata-refresh time so retired-upstream models drop automatically instead of waiting on models.dev.

Fixes #4214

Verification

Ran locally against compiled dist/:

• New test in packages/core/src/__tests__/provider-catalog-contract.test.ts (opencode-free retired-model quarantine) — asserts x-preview-f-free is quarantined out of fallbackModels / defaultEnabledModelIds and that no broken id leaks back into the offered candidates. Fails without the change (the id is absent from brokenModelIds and present in the derived free list) and passes with it.
• packages/core: provider-catalog-contract (incl. the new tests) 11/11, plus llm-connections and model-catalog — all pass.
• packages/runtime-host: bootstrap-runtime-policy — 9/9 pass.
• packages/runtime: opencode-free-anonymous — 7/7 pass.
• @maka/core build (tsc) passes; the runtime invariant opencodeFreeModelIds[0] === OPENCODE_FREE_DEFAULT_MODEL still holds.
• biome check clean on both changed files (lint + format).
• Derived free list after the change: ['nemotron-3-ultra-free','big-pickle','hy3-free','mimo-v2.5-free','nemotron-3.5-lightning-free'] (was 6; x-preview-f-free removed). brokenModelIds = ['muse-spark-1.2-contributor-free','x-preview-f-free'].

Not run: full-repo typecheck / lint / knip across every workspace (change is isolated to @maka/core; the affected workspaces above build and test clean).

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Claude Code (Opus 4.8) — live-probed the OpenCode Zen endpoint to diagnose the retirement, wrote the quarantine change, its test, and the comment, and ran the verification above. The commit carries a Generated-by trailer.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[jackwener]

[P2] Keep a quarantined stored default out of the model picker

buildConnectionModelCatalogEntries filters connection.models and enabledModelIds against brokenModelIds, but it still passes the raw connection.defaultModel into buildModelCatalogEntries. If an existing OpenCode Free connection has x-preview-f-free as its default—a reachable persisted state because this model was previously picker-visible—makeMissingDefaultEntry adds it back. On this exact head, a production-path probe through buildChatModelChoices still returns Ox Alpha Free (Unlimited) as an available default choice, while authorizeConnectionModel returns undefined for the same connection and model.

That leaves affected upgrade users seeing and selecting a model that the send authority refuses, so the quarantine does not yet cover the picker path claimed by the PR. The new tests only check the derived fallbackModels and defaultEnabledModelIds; they do not exercise a persisted broken default. Please filter the broken ID from the catalog's defaultModel source as well, and add a regression through buildChatModelChoices with the retired ID present as the stored default, enabled model, and inventory row.

---

Automated review notice: This comment was posted by an automated review agent operated by WAWQAQ. It is not an independent human review and does not replace one.

[Astro-Han]

Synthesis at exact head 7c719d65018cca41d8b450555c63be28a462ea62 (7c719d6) — fix(core): quarantine retired opencode-free model x-preview-f-free.

All findings in this comment are from @Muse-Qronos-Reviewer independent review at this exact head. I did not read this diff myself; I verified that the current head has not drifted and the exact-head CI status is green (test/windows_recovery SUCCESS, MERGEABLE per Luna re-check).

Actual change (per reviewer, 2 files +10/+29)

• provider-registry.ts:676-685: add x-preview-f-free to OPENCODE_FREE_BROKEN_MODEL_IDS (Ox Alpha Free removed upstream, 401 but models.dev still marks free+active).
• provider-catalog-contract.test.ts:216-244: add guards: specific id in broken and not in fallback/defaultEnabled, plus mechanism guard that broken ids never return to offered candidates.

Gate

• Code: GO, no P0–P2, isolation correct, comment explains removal condition, tests cover both specific and mechanism.
• CI: exact-head test/windows_recovery SUCCESS, MERGEABLE, REVIEW_REQUIRED/BLOCKED (only jackwener COMMENTED, no formal Review).
• No CONFLICTING, no concurrency/persistence risk.

What this synthesis could not verify

• No check of models.dev snapshot timing beyond comment; relied on reviewer's evidence and hosted CI.

---

Automated review notice: This comment was posted by an automated review agent operated by Astro-Han. It is not an independent human review and does not replace one.

[Astro-Han]

LGTM. Could you check the P2 from bot review?

[jackwener]

Reviewed exact head eadc03fbc551d4c9c630484b17d05706a62e9961.

The previous picker mismatch is resolved. buildConnectionModelCatalogEntries now removes a quarantined persisted default before missing-default synthesis, so x-preview-f-free can no longer reappear as a selectable row while the send authority rejects it. The new production-path regression covers the real upgrade shape: the retired id is simultaneously present as the stored default, enabled model, and inventory row, while a live enabled model remains available.

I also rechecked the external premise. The anonymous OpenCode Zen model catalog currently omits x-preview-f-free, and an anonymous completion request for it returns ModelError: Model x-preview-f-free is not supported; the checked-in models.dev snapshot still marks it active and free. The quarantine remains necessary.

The exact-head full build passed, as did the complete Core suite (716/716), the affected OpenCode/runtime-policy tests (16/16), Biome, git diff --check, the ASF header audit, and both hosted checks. Current main is the head's second parent, and the clean merge result is byte-for-byte the reviewed head tree. I found no remaining issues that should delay this fix.

---

Automated review notice: This comment was posted by an automated review agent operated by WAWQAQ. It is not an independent human review and does not replace one.

[hqhq1025]

Reviewed exact head eadc03fbc551d4c9c630484b17d05706a62e9961. I found no P0-P3 issues.

The current diff quarantines x-preview-f-free from derived OpenCode Free defaults, stored inventories, enabled choices, send authorization, and now also the persisted defaultModel path that previously re-created it as a missing-default picker row. The production-path regression covers the reachable upgrade state while preserving a live alternative model. I independently confirmed that the anonymous OpenCode Zen catalog omits this id and an anonymous completion request returns ModelError: Model x-preview-f-free is not supported, while the checked-in models.dev snapshot still marks it active/free.

Validation: clean full npm run build:test; full repository typecheck; Core 716/716; affected runtime policy/OpenCode suites 16/16; changed-file Biome; git diff --check; exact head is MERGEABLE/CLEAN, directly includes current main, and both hosted checks are successful.

Automated review notice: This comment was posted by an automated review agent operated by hqhq1025. It is not an independent human review and does not replace one.

[Astro-Han]

Thanks for closing the persisted-default gap. Reviewed at exact head eadc03fbc551d4c9c630484b17d05706a62e9961: the retired OpenCode Free model is now excluded consistently from derived defaults, stored inventories, picker synthesis, and send authorization, while a live alternative remains available. The production-path regression covers the real upgrade state, the change extends the existing quarantine owner without adding parallel state, and exact-head test plus windows_recovery are green. I found no remaining P0-P3 issue.

Review analysis was assisted by Codex and independent reviewer agents. I verified the exact head, external problem evidence, production catalog/authorization paths, prior finding, CI, and severity judgment, and I own this review.

中文对照

感谢你补齐 persisted default 的缺口。我审查了精确 head eadc03fbc551d4c9c630484b17d05706a62e9961：已下线的 OpenCode Free 模型现在会一致地从派生默认值、持久化 inventory、picker 合成和发送授权中排除，同时保留可用替代模型。生产路径回归测试覆盖了真实升级状态，改动只扩展既有 quarantine owner，没有增加平行状态；exact-head test 和 windows_recovery 均已通过。没有剩余 P0-P3 问题。

本次分析由 Codex 和独立 reviewer 子代理协助；我核验了精确 head、外部问题证据、生产 catalog/authorization 路径、旧问题、CI 和分级，并对本次 Review 负责。